krb5: Only generate a SPN when its not known

Prior to this change, we were generating the SPN in the SSPI code when
the credentials were NULL and in the GSS-API code when the context was
empty. It is better to decouple the SPN generation from these checks
and only generate it when the SPN itself is NULL.

This also brings this part of the Kerberos 5 code in line with the
Negotiate code.

diff --git a/lib/vauth/krb5_gssapi.c b/lib/vauth/krb5_gssapi.c
index e680535031458767d93fcffd288222887d982451..18c6dbb46f43f6fce63d1f2756c8eaad74808c17 100644 (file)
--- a/lib/vauth/krb5_gssapi.c
+++ b/lib/vauth/krb5_gssapi.c
@@ -88,7 +88,7 @@ CURLcode Curl_auth_create_gssapi_user_message(struct SessionHandle *data,
   (void) userp;
   (void) passwdp;
 
-  if(krb5->context == GSS_C_NO_CONTEXT) {
+  if(!krb5->spn) {
     /* Generate our SPN */
     char *spn = Curl_auth_build_gssapi_spn(service, host);
     if(!spn)
@@ -112,7 +112,8 @@ CURLcode Curl_auth_create_gssapi_user_message(struct SessionHandle *data,
 
     free(spn);
   }
-  else {
+
+  if(krb5->context != GSS_C_NO_CONTEXT) {
     /* Decode the base-64 encoded challenge message */
     if(strlen(chlg64) && *chlg64 != '=') {
       result = Curl_base64_decode(chlg64, &chlg, &chlglen);

diff --git a/lib/vauth/krb5_sspi.c b/lib/vauth/krb5_sspi.c
index 6afd83dde7e1f7683b0be1fd07ff6ff46855f4cc..da08f8f0356a82c5ed72991d97860a08ca503039 100644 (file)
--- a/lib/vauth/krb5_sspi.c
+++ b/lib/vauth/krb5_sspi.c
@@ -85,6 +85,13 @@ CURLcode Curl_auth_create_gssapi_user_message(struct SessionHandle *data,
   unsigned long attrs;
   TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
 
+  if(!krb5->spn) {
+    /* Generate our SPN */
+    krb5->spn = Curl_auth_build_spn(service, host);
+    if(!krb5->spn)
+      return CURLE_OUT_OF_MEMORY;
+  }
+
   if(!krb5->credentials) {
     /* Query the security package for Kerberos */
     status = s_pSecFn->QuerySecurityPackageInfo((TCHAR *)
@@ -104,11 +111,6 @@ CURLcode Curl_auth_create_gssapi_user_message(struct SessionHandle *data,
     if(!krb5->output_token)
       return CURLE_OUT_OF_MEMORY;
 
-    /* Generate our SPN */
-    krb5->spn = Curl_auth_build_spn(service, host);
-    if(!krb5->spn)
-      return CURLE_OUT_OF_MEMORY;
-
     if(userp && *userp) {
       /* Populate our identity structure */
       result = Curl_create_sspi_identity(userp, passwdp, &krb5->identity);