libgit2/libgit2 — pull request #2497 by ethomson (2014-08-01 18:06:26+00:00)
Title: SPNEGO authentication via GSSAPI

Optionally link against GSSAPI when `USE_GSSAPI=ON` in the CMake configuration. This allows one to use Kerberos to authenticate to a remote server over HTTP(S):

````
ethomson-deb74:libgit2/build% kinit ethomson@AD.EDWARDTHOMSON.COM
Password:
ethomson-deb74:libgit2/build% export GITTEST_REMOTE_URL=http://tfs2013:8080/tfs/DefaultCollection/Git/_git/libgit2_test
ethomson-deb74:libgit2/build% export GITTEST_REMOTE_DEFAULT=ok
ethomson-deb74:libgit2/build% ./libgit2_clar -ionline -sonline
Loaded 261 suites:
Started

online::clone......S...S
online::fetch..........
online::fetchhead...
online::push....................
````

The first three commits are simply test fixtures independent of GSSAPI support: the first corrects an SSH test to not run when the test repo is over SSH, the second updates a test to prevent subsequent failures, the third updates a test to not assume username/password credentials.

The final three commits introduce GSSAPI support itself. `a90943b` corrects an issue with keep-alive: we were erroneously attempting to do keep-alive only when `http_body_is_final` returned true, however that function actually tests [whether the parser state has finished parsing](https://github.com/libgit2/libgit2/blob/master/deps/http-parser/http_parser.c#L2173). In `http_connect` we will have reset the parser state to [`start_state`](https://github.com/libgit2/libgit2/blob/master/deps/http-parser/http_parser.c#L383), thus we will never perform keep-alive, as far as I can tell. (I suspect some refactoring moved this.) Keep-alive is a requirement for GSSAPI and other challenge-response mechanisms since they're session based. `3bbe29c` and `9fc18c9` introduce GSSAPI support itself.