Skip to content

Commit 9638384

Browse files
gitstergitster
committed
Merge branch 'jk/http-auth'
* jk/http-auth: http_init: accept separate URL parameter http: use hostname in credential description http: retry authentication failures for all http requests remote-curl: don't retry auth failures with dumb protocol improve httpd auth tests url: decode buffers that are not NUL-terminated
2 parents 7f8a938 + deba493 commit 9638384

File tree

9 files changed

+130
-69
lines changed

9 files changed

+130
-69
lines changed

‎http-fetch.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ int main(int argc, const char **argv)
6767

6868
git_config(git_default_config, NULL);
6969

70-
http_init(NULL);
70+
http_init(NULL, url);
7171
walker = get_http_walker(url);
7272
walker->get_tree = get_tree;
7373
walker->get_history = get_history;

‎http-push.c‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1747,7 +1747,6 @@ int main(int argc, char **argv)
17471747
int i;
17481748
int new_refs;
17491749
struct ref *ref, *local_refs;
1750-
struct remote *remote;
17511750

17521751
git_extract_argv0_path(argv[0]);
17531752

@@ -1821,14 +1820,7 @@ int main(int argc, char **argv)
18211820

18221821
memset(remote_dir_exists, -1, 256);
18231822

1824-
/*
1825-
* Create a minimum remote by hand to give to http_init(),
1826-
* primarily to allow it to look at the URL.
1827-
*/
1828-
remote = xcalloc(sizeof(*remote), 1);
1829-
ALLOC_GROW(remote->url, remote->url_nr + 1, remote->url_alloc);
1830-
remote->url[remote->url_nr++] = repo->url;
1831-
http_init(remote);
1823+
http_init(NULL, repo->url);
18321824

18331825
#ifdef USE_CURL_MULTI
18341826
is_running_queue = 0;

‎http.c‎

Lines changed: 53 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ static long curl_low_speed_time = -1;
4242
static int curl_ftp_no_epsv;
4343
static const char *curl_http_proxy;
4444
static const char *curl_cookie_file;
45-
static char *user_name, *user_pass;
45+
static char *user_name, *user_pass, *description;
4646
static const char *user_agent;
4747

4848
#if LIBCURL_VERSION_NUM >= 0x071700
@@ -139,6 +139,27 @@ static void process_curl_messages(void)
139139
}
140140
#endif
141141

142+
static char *git_getpass_with_description(const char *what, const char *desc)
143+
{
144+
struct strbuf prompt = STRBUF_INIT;
145+
char *r;
146+
147+
if (desc)
148+
strbuf_addf(&prompt, "%s for '%s': ", what, desc);
149+
else
150+
strbuf_addf(&prompt, "%s: ", what);
151+
/*
152+
* NEEDSWORK: for usernames, we should do something less magical that
153+
* actually echoes the characters. However, we need to read from
154+
* /dev/tty and not stdio, which is not portable (but getpass will do
155+
* it for us). http.c uses the same workaround.
156+
*/
157+
r = git_getpass(prompt.buf);
158+
159+
strbuf_release(&prompt);
160+
return xstrdup(r);
161+
}
162+
142163
static int http_options(const char *var, const char *value, void *cb)
143164
{
144165
if (!strcmp("http.sslverify", var)) {
@@ -214,7 +235,7 @@ static void init_curl_http_auth(CURL *result)
214235
if (user_name) {
215236
struct strbuf up = STRBUF_INIT;
216237
if (!user_pass)
217-
user_pass = xstrdup(git_getpass("Password: "));
238+
user_pass = xstrdup(git_getpass_with_description("Password", description));
218239
strbuf_addf(&up, "%s:%s", user_name, user_pass);
219240
curl_easy_setopt(result, CURLOPT_USERPWD,
220241
strbuf_detach(&up, NULL));
@@ -229,7 +250,7 @@ static int has_cert_password(void)
229250
return 0;
230251
/* Only prompt the user once. */
231252
ssl_cert_password_required = -1;
232-
ssl_cert_password = git_getpass("Certificate Password: ");
253+
ssl_cert_password = git_getpass_with_description("Certificate Password", description);
233254
if (ssl_cert_password != NULL) {
234255
ssl_cert_password = xstrdup(ssl_cert_password);
235256
return 1;
@@ -307,8 +328,7 @@ static CURL *get_curl_handle(void)
307328

308329
static void http_auth_init(const char *url)
309330
{
310-
char *at, *colon, *cp, *slash, *decoded;
311-
int len;
331+
const char *at, *colon, *cp, *slash, *host;
312332

313333
cp = strstr(url, "://");
314334
if (!cp)
@@ -324,34 +344,22 @@ static void http_auth_init(const char *url)
324344
at = strchr(cp, '@');
325345
colon = strchr(cp, ':');
326346
slash = strchrnul(cp, '/');
327-
if (!at || slash <= at)
328-
return; /* No credentials */
329-
if (!colon || at <= colon) {
347+
if (!at || slash <= at) {
348+
/* No credentials, but we may have to ask for some later */
349+
host = cp;
350+
}
351+
else if (!colon || at <= colon) {
330352
/* Only username */
331-
len = at - cp;
332-
user_name = xmalloc(len + 1);
333-
memcpy(user_name, cp, len);
334-
user_name[len] = '\0';
335-
decoded = url_decode(user_name);
336-
free(user_name);
337-
user_name = decoded;
353+
user_name = url_decode_mem(cp, at - cp);
338354
user_pass = NULL;
355+
host = at + 1;
339356
} else {
340-
len = colon - cp;
341-
user_name = xmalloc(len + 1);
342-
memcpy(user_name, cp, len);
343-
user_name[len] = '\0';
344-
decoded = url_decode(user_name);
345-
free(user_name);
346-
user_name = decoded;
347-
len = at - (colon + 1);
348-
user_pass = xmalloc(len + 1);
349-
memcpy(user_pass, colon + 1, len);
350-
user_pass[len] = '\0';
351-
decoded = url_decode(user_pass);
352-
free(user_pass);
353-
user_pass = decoded;
357+
user_name = url_decode_mem(cp, colon - cp);
358+
user_pass = url_decode_mem(colon + 1, at - (colon + 1));
359+
host = at + 1;
354360
}
361+
362+
description = url_decode_mem(host, slash - host);
355363
}
356364

357365
static void set_from_env(const char **var, const char *envname)
@@ -361,7 +369,7 @@ static void set_from_env(const char **var, const char *envname)
361369
*var = val;
362370
}
363371

364-
void http_init(struct remote *remote)
372+
void http_init(struct remote *remote, const char *url)
365373
{
366374
char *low_speed_limit;
367375
char *low_speed_time;
@@ -425,11 +433,11 @@ void http_init(struct remote *remote)
425433
if (getenv("GIT_CURL_FTP_NO_EPSV"))
426434
curl_ftp_no_epsv = 1;
427435

428-
if (remote && remote->url && remote->url[0]) {
429-
http_auth_init(remote->url[0]);
436+
if (url) {
437+
http_auth_init(url);
430438
if (!ssl_cert_password_required &&
431439
getenv("GIT_SSL_CERT_PASSWORD_PROTECTED") &&
432-
!prefixcmp(remote->url[0], "https://"))
440+
!prefixcmp(url, "https://"))
433441
ssl_cert_password_required = 1;
434442
}
435443

@@ -847,7 +855,7 @@ static int http_request(const char *url, void *result, int target, int options)
847855
* but that is non-portable. Using git_getpass() can at least be stubbed
848856
* on other platforms with a different implementation if/when necessary.
849857
*/
850-
user_name = xstrdup(git_getpass("Username: "));
858+
user_name = xstrdup(git_getpass_with_description("Username", description));
851859
init_curl_http_auth(slot->curl);
852860
ret = HTTP_REAUTH;
853861
}
@@ -870,13 +878,18 @@ static int http_request(const char *url, void *result, int target, int options)
870878
return ret;
871879
}
872880

881+
static int http_request_reauth(const char *url, void *result, int target,
882+
int options)
883+
{
884+
int ret = http_request(url, result, target, options);
885+
if (ret != HTTP_REAUTH)
886+
return ret;
887+
return http_request(url, result, target, options);
888+
}
889+
873890
int http_get_strbuf(const char *url, struct strbuf *result, int options)
874891
{
875-
int http_ret = http_request(url, result, HTTP_REQUEST_STRBUF, options);
876-
if (http_ret == HTTP_REAUTH) {
877-
http_ret = http_request(url, result, HTTP_REQUEST_STRBUF, options);
878-
}
879-
return http_ret;
892+
return http_request_reauth(url, result, HTTP_REQUEST_STRBUF, options);
880893
}
881894

882895
/*
@@ -899,7 +912,7 @@ static int http_get_file(const char *url, const char *filename, int options)
899912
goto cleanup;
900913
}
901914

902-
ret = http_request(url, result, HTTP_REQUEST_FILE, options);
915+
ret = http_request_reauth(url, result, HTTP_REQUEST_FILE, options);
903916
fclose(result);
904917

905918
if ((ret == HTTP_OK) && move_temp_to_file(tmpfile.buf, filename))

‎http.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ extern void add_fill_function(void *data, int (*fill)(void *));
8686
extern void step_active_slots(void);
8787
#endif
8888

89-
extern void http_init(struct remote *remote);
89+
extern void http_init(struct remote *remote, const char *url);
9090
extern void http_cleanup(void);
9191

9292
extern int data_received;

‎remote-curl.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ static struct discovery* discover_refs(const char *service)
115115
http_ret = http_get_strbuf(refs_url, &buffer, HTTP_NO_CACHE);
116116

117117
/* try again with "plain" url (no ? or & appended) */
118-
if (http_ret != HTTP_OK) {
118+
if (http_ret != HTTP_OK && http_ret != HTTP_NOAUTH) {
119119
free(refs_url);
120120
strbuf_reset(&buffer);
121121

@@ -859,7 +859,7 @@ int main(int argc, const char **argv)
859859

860860
url = strbuf_detach(&buf, NULL);
861861

862-
http_init(remote);
862+
http_init(remote, url);
863863

864864
do {
865865
if (strbuf_getline(&buf, stdin, '\n') == EOF) {

‎t/lib-httpd.sh‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,7 @@ prepare_httpd() {
8181

8282
if test -n "$LIB_HTTPD_SSL"
8383
then
84-
HTTPD_URL=https://127.0.0.1:$LIB_HTTPD_PORT
85-
AUTH_HTTPD_URL=https://user%40host:user%40host@127.0.0.1:$LIB_HTTPD_PORT
84+
HTTPD_PROTO=https
8685

8786
RANDFILE_PATH="$HTTPD_ROOT_PATH"/.rnd openssl req \
8887
-config "$TEST_PATH/ssl.cnf" \
@@ -93,9 +92,12 @@ prepare_httpd() {
9392
export GIT_SSL_NO_VERIFY
9493
HTTPD_PARA="$HTTPD_PARA -DSSL"
9594
else
96-
HTTPD_URL=http://127.0.0.1:$LIB_HTTPD_PORT
97-
AUTH_HTTPD_URL=http://user%40host:user%40host@127.0.0.1:$LIB_HTTPD_PORT
95+
HTTPD_PROTO=http
9896
fi
97+
HTTPD_DEST=127.0.0.1:$LIB_HTTPD_PORT
98+
HTTPD_URL=$HTTPD_PROTO://$HTTPD_DEST
99+
HTTPD_URL_USER=$HTTPD_PROTO://user%40host@$HTTPD_DEST
100+
HTTPD_URL_USER_PASS=$HTTPD_PROTO://user%40host:user%40host@$HTTPD_DEST
99101

100102
if test -n "$LIB_HTTPD_DAV" -o -n "$LIB_HTTPD_SVN"
101103
then

‎t/t5550-http-fetch.sh‎

Lines changed: 47 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,54 @@ test_expect_success 'clone http repository' '
3535
test_cmp file clone/file
3636
'
3737

38-
test_expect_success 'clone http repository with authentication' '
38+
test_expect_success 'create password-protected repository' '
3939
mkdir "$HTTPD_DOCUMENT_ROOT_PATH/auth/" &&
40-
cp -Rf "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" "$HTTPD_DOCUMENT_ROOT_PATH/auth/repo.git" &&
41-
git clone $AUTH_HTTPD_URL/auth/repo.git clone-auth &&
42-
test_cmp file clone-auth/file
40+
cp -Rf "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" \
41+
"$HTTPD_DOCUMENT_ROOT_PATH/auth/repo.git"
42+
'
43+
44+
test_expect_success 'setup askpass helpers' '
45+
cat >askpass <<-EOF &&
46+
#!/bin/sh
47+
echo >>"$PWD/askpass-query" "askpass: \$*" &&
48+
cat "$PWD/askpass-response"
49+
EOF
50+
chmod +x askpass &&
51+
GIT_ASKPASS="$PWD/askpass" &&
52+
export GIT_ASKPASS &&
53+
>askpass-expect-none &&
54+
echo "askpass: Password for '\''$HTTPD_DEST'\'': " >askpass-expect-pass &&
55+
{ echo "askpass: Username for '\''$HTTPD_DEST'\'': " &&
56+
cat askpass-expect-pass
57+
} >askpass-expect-both
58+
'
59+
60+
test_expect_success 'cloning password-protected repository can fail' '
61+
>askpass-query &&
62+
echo wrong >askpass-response &&
63+
test_must_fail git clone "$HTTPD_URL/auth/repo.git" clone-auth-fail &&
64+
test_cmp askpass-expect-both askpass-query
65+
'
66+
67+
test_expect_success 'http auth can use user/pass in URL' '
68+
>askpass-query &&
69+
echo wrong >askpass-reponse &&
70+
git clone "$HTTPD_URL_USER_PASS/auth/repo.git" clone-auth-none &&
71+
test_cmp askpass-expect-none askpass-query
72+
'
73+
74+
test_expect_success 'http auth can use just user in URL' '
75+
>askpass-query &&
76+
echo user@host >askpass-response &&
77+
git clone "$HTTPD_URL_USER/auth/repo.git" clone-auth-pass &&
78+
test_cmp askpass-expect-pass askpass-query
79+
'
80+
81+
test_expect_success 'http auth can request both user and pass' '
82+
>askpass-query &&
83+
echo user@host >askpass-response &&
84+
git clone "$HTTPD_URL/auth/repo.git" clone-auth-both &&
85+
test_cmp askpass-expect-both askpass-query
4386
'
4487

4588
test_expect_success 'fetch changes via http' '

0 commit comments

Comments
 (0)