[PATCH v2 1/1] configure.ac: disable NTLM by default as it's insecure

From: Philip Prindeville <[email protected]>

Copyright-paperwork-exempt: Yes
---
 .gitlab-ci.yml | 20 +++++++++++++++-----
 configure.ac   |  4 ++--
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index c764e2dbf366f5d9b2f01eca2f8ec5eadaf28344..ec8a340eb5278ec88bc4f9a728657956c1e373bc 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -96,6 +96,7 @@ Valgrind:
         - tar xvf wget-*.gz
         - cd wget-*/
         - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+          --enable-ntlm
         - make check-valgrind
     except:
         - coverity-scan@gnuwget/wget
@@ -149,6 +150,7 @@ Debian-OldStable:
         - tar xvf wget-*.gz
         - cd wget-*/
         - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+          --enable-ntlm
         - make
         - make -j$(nproc) check
     except:
@@ -175,6 +177,7 @@ Debian-Stable:
         - tar xvf wget-*.gz
         - cd wget-*/
         - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+          --enable-ntlm
         - make -j$(nproc) check
     except:
         - coverity-scan@gnuwget/wget
@@ -200,6 +203,7 @@ CentOS-OldLTS:
         - tar xvf wget-*.gz
         - cd wget-*/
         - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+          --enable-ntlm
         - make -j$(nproc)
         - make -j$(nproc) check
     except:
@@ -229,7 +233,8 @@ TLS/OpenSSL:
         - cd wget-*/
         - echo "127.0.0.1 wgettestingserver" >>/etc/hosts
         - cat /etc/hosts
-        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache --with-ssl=openssl
+        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+          --with-ssl=openssl --enable-ntlm
         - make -j$(nproc)
         - make -j$(nproc) check-valgrind
     except:
@@ -257,7 +262,8 @@ TLS/GnuTLS:
         - cd wget-*/
         - echo "127.0.0.1 wgettestingserver" >>/etc/hosts
         - cat /etc/hosts
-        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache --with-ssl=gnutls
+        - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+          --with-ssl=gnutls --enable-ntlm
         - make -j$(nproc)
         - make -j$(nproc) check-valgrind
     except:
@@ -290,7 +296,8 @@ Sanitizers:
         - export ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer
 #       - export LSAN_OPTIONS=suppressions="$PWD/tests/clang-asan-suppressions"
         - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
-            --enable-fsanitize-asan --enable-fsanitize-ubsan
+          --enable-fsanitize-asan --enable-fsanitize-ubsan
+          --enable-ntlm
         - make -j$(nproc) check
     except:
         - coverity-scan@gnuwget/wget
@@ -316,6 +323,7 @@ Scan-Build:
         - tar xvf wget-*.gz
         - cd wget-*/
         - scan-build ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+          --enable-ntlm
         - make -C lib -j$(nproc)
         - make -C src css_.o
         - scan-build -v -enable-checker nullability --keep-empty --status-bugs -o ../scan-build make -j$(nproc)
@@ -343,6 +351,7 @@ CoverageReports:
         - tar xvf wget-*.gz
         - cd wget-*/
         - ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
+         --enable-ntlm
         - make -j$(nproc) check-coverage
         - mv lcov ../test-coverage
         - make -C doc html
@@ -377,6 +386,7 @@ MinGW64:
         - echo "WINEPATH=$WINEPATH"
         - LIBS="-ldl -lpsapi" ./configure $CONFIGURE_BASE_FLAGS --cache-file ../cache/config.cache
             --build=x86_64-pc-linux-gnu --host=$PREFIX --enable-shared
+            --enable-ntlm
         - make -j$(nproc)
         - cp -p src/wget.exe src/wget
         - make check -j$(nproc) LOG_COMPILER=wine
@@ -407,7 +417,7 @@ ArchLinux:
         - ./bootstrap
         - autoreconf -fi
         - touch .manywarnings
-        - ./configure $CONFIGURE_BASE_FLAGS
+        - ./configure $CONFIGURE_BASE_FLAGS --enable-ntlm
         - make -j$(nproc)
         - make check -j$(nproc)
     except:
@@ -431,7 +441,7 @@ Fedora:
         - ./bootstrap
         - autoreconf -fi
         - touch .manywarnings
-        - ./configure $CONFIGURE_BASE_FLAGS
+        - ./configure $CONFIGURE_BASE_FLAGS --enable-ntlm
         - make -j$(nproc) check
     except:
         - coverity-scan@gnuwget/wget
diff --git a/configure.ac b/configure.ac
index 5f6a7286ca8782d791a821c3c90872a9f8ae8646..6ce2e43f59ac744f96054cca21dcf9ad8277b943 100644
--- a/configure.ac
+++ b/configure.ac
@@ -188,9 +188,9 @@ AS_IF([test "x$ENABLE_DIGEST" = xyes],
 
 dnl NTLM: Support for HTTP NTLM Authentication
 AC_ARG_ENABLE([ntlm],
-  [AS_HELP_STRING([--disable-ntlm], [disable support for NTLM authorization])],
+  [AS_HELP_STRING([--enable-ntlm], [enable support for NTLM authorization])],
   [ENABLE_NTLM=$enableval],
-  [ENABLE_NTLM=auto]
+  [ENABLE_NTLM=no]
 )
 
 
-- 
2.43.0