summaryrefslogtreecommitdiff
path: root/http.c
diff options
context:
space:
mode:
Diffstat (limited to 'http.c')
-rw-r--r--http.c311
1 files changed, 266 insertions, 45 deletions
diff --git a/http.c b/http.c
index 168ca30..3d80bd6 100644
--- a/http.c
+++ b/http.c
@@ -1,9 +1,9 @@
#include "git-compat-util.h"
#include "git-curl-compat.h"
+#include "hex.h"
#include "http.h"
#include "config.h"
#include "pack.h"
-#include "sideband.h"
#include "run-command.h"
#include "url.h"
#include "urlmatch.h"
@@ -11,11 +11,12 @@
#include "version.h"
#include "pkt-line.h"
#include "gettext.h"
+#include "trace.h"
#include "transport.h"
#include "packfile.h"
-#include "protocol.h"
#include "string-list.h"
-#include "object-store.h"
+#include "object-file.h"
+#include "object-store-ll.h"
static struct trace_key trace_curl = TRACE_KEY_INIT(CURL);
static int trace_curl_data = 1;
@@ -39,6 +40,7 @@ static int curl_ssl_verify = -1;
static int curl_ssl_try;
static const char *curl_http_version = NULL;
static const char *ssl_cert;
+static const char *ssl_cert_type;
static const char *ssl_cipherlist;
static const char *ssl_version;
static struct {
@@ -58,6 +60,7 @@ static struct {
#endif
};
static const char *ssl_key;
+static const char *ssl_key_type;
static const char *ssl_capath;
static const char *curl_no_proxy;
#ifdef GIT_CURL_HAVE_CURLOPT_PINNEDPUBLICKEY
@@ -157,21 +160,19 @@ size_t fread_buffer(char *ptr, size_t eltsize, size_t nmemb, void *buffer_)
return size / eltsize;
}
-curlioerr ioctl_buffer(CURL *handle, int cmd, void *clientp)
+int seek_buffer(void *clientp, curl_off_t offset, int origin)
{
struct buffer *buffer = clientp;
- switch (cmd) {
- case CURLIOCMD_NOP:
- return CURLIOE_OK;
-
- case CURLIOCMD_RESTARTREAD:
- buffer->posn = 0;
- return CURLIOE_OK;
-
- default:
- return CURLIOE_UNKNOWNCMD;
+ if (origin != SEEK_SET)
+ BUG("seek_buffer only handles SEEK_SET");
+ if (offset < 0 || offset >= buffer->buf.len) {
+ error("curl seek would be outside of buffer");
+ return CURL_SEEKFUNC_FAIL;
}
+
+ buffer->posn = offset;
+ return CURL_SEEKFUNC_OK;
}
size_t fwrite_buffer(char *ptr, size_t eltsize, size_t nmemb, void *buffer_)
@@ -183,7 +184,117 @@ size_t fwrite_buffer(char *ptr, size_t eltsize, size_t nmemb, void *buffer_)
return nmemb;
}
-size_t fwrite_null(char *ptr, size_t eltsize, size_t nmemb, void *strbuf)
+/*
+ * A folded header continuation line starts with any number of spaces or
+ * horizontal tab characters (SP or HTAB) as per RFC 7230 section 3.2.
+ * It is not a continuation line if the line starts with any other character.
+ */
+static inline int is_hdr_continuation(const char *ptr, const size_t size)
+{
+ return size && (*ptr == ' ' || *ptr == '\t');
+}
+
+static size_t fwrite_wwwauth(char *ptr, size_t eltsize, size_t nmemb, void *p UNUSED)
+{
+ size_t size = eltsize * nmemb;
+ struct strvec *values = &http_auth.wwwauth_headers;
+ struct strbuf buf = STRBUF_INIT;
+ const char *val;
+ size_t val_len;
+
+ /*
+ * Header lines may not come NULL-terminated from libcurl so we must
+ * limit all scans to the maximum length of the header line, or leverage
+ * strbufs for all operations.
+ *
+ * In addition, it is possible that header values can be split over
+ * multiple lines as per RFC 7230. 'Line folding' has been deprecated
+ * but older servers may still emit them. A continuation header field
+ * value is identified as starting with a space or horizontal tab.
+ *
+ * The formal definition of a header field as given in RFC 7230 is:
+ *
+ * header-field = field-name ":" OWS field-value OWS
+ *
+ * field-name = token
+ * field-value = *( field-content / obs-fold )
+ * field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
+ * field-vchar = VCHAR / obs-text
+ *
+ * obs-fold = CRLF 1*( SP / HTAB )
+ * ; obsolete line folding
+ * ; see Section 3.2.4
+ */
+
+ /* Start of a new WWW-Authenticate header */
+ if (skip_iprefix_mem(ptr, size, "www-authenticate:", &val, &val_len)) {
+ strbuf_add(&buf, val, val_len);
+
+ /*
+ * Strip the CRLF that should be present at the end of each
+ * field as well as any trailing or leading whitespace from the
+ * value.
+ */
+ strbuf_trim(&buf);
+
+ strvec_push(values, buf.buf);
+ http_auth.header_is_last_match = 1;
+ goto exit;
+ }
+
+ /*
+ * This line could be a continuation of the previously matched header
+ * field. If this is the case then we should append this value to the
+ * end of the previously consumed value.
+ */
+ if (http_auth.header_is_last_match && is_hdr_continuation(ptr, size)) {
+ /*
+ * Trim the CRLF and any leading or trailing from this line.
+ */
+ strbuf_add(&buf, ptr, size);
+ strbuf_trim(&buf);
+
+ /*
+ * At this point we should always have at least one existing
+ * value, even if it is empty. Do not bother appending the new
+ * value if this continuation header is itself empty.
+ */
+ if (!values->nr) {
+ BUG("should have at least one existing header value");
+ } else if (buf.len) {
+ char *prev = xstrdup(values->v[values->nr - 1]);
+
+ /* Join two non-empty values with a single space. */
+ const char *const sp = *prev ? " " : "";
+
+ strvec_pop(values);
+ strvec_pushf(values, "%s%s%s", prev, sp, buf.buf);
+ free(prev);
+ }
+
+ goto exit;
+ }
+
+ /* Not a continuation of a previously matched auth header line. */
+ http_auth.header_is_last_match = 0;
+
+ /*
+ * If this is a HTTP status line and not a header field, this signals
+ * a different HTTP response. libcurl writes all the output of all
+ * response headers of all responses, including redirects.
+ * We only care about the last HTTP request response's headers so clear
+ * the existing array.
+ */
+ if (skip_iprefix_mem(ptr, size, "http/", &val, &val_len))
+ strvec_clear(values);
+
+exit:
+ strbuf_release(&buf);
+ return size;
+}
+
+size_t fwrite_null(char *ptr UNUSED, size_t eltsize UNUSED, size_t nmemb,
+ void *data UNUSED)
{
return nmemb;
}
@@ -251,7 +362,8 @@ static void process_curl_messages(void)
}
}
-static int http_options(const char *var, const char *value, void *cb)
+static int http_options(const char *var, const char *value,
+ const struct config_context *ctx, void *data)
{
if (!strcmp("http.version", var)) {
return git_config_string(&curl_http_version, var, value);
@@ -266,8 +378,12 @@ static int http_options(const char *var, const char *value, void *cb)
return git_config_string(&ssl_version, var, value);
if (!strcmp("http.sslcert", var))
return git_config_pathname(&ssl_cert, var, value);
+ if (!strcmp("http.sslcerttype", var))
+ return git_config_string(&ssl_cert_type, var, value);
if (!strcmp("http.sslkey", var))
return git_config_pathname(&ssl_key, var, value);
+ if (!strcmp("http.sslkeytype", var))
+ return git_config_string(&ssl_key_type, var, value);
if (!strcmp("http.sslcapath", var))
return git_config_pathname(&ssl_capath, var, value);
if (!strcmp("http.sslcainfo", var))
@@ -297,21 +413,21 @@ static int http_options(const char *var, const char *value, void *cb)
}
if (!strcmp("http.minsessions", var)) {
- min_curl_sessions = git_config_int(var, value);
+ min_curl_sessions = git_config_int(var, value, ctx->kvi);
if (min_curl_sessions > 1)
min_curl_sessions = 1;
return 0;
}
if (!strcmp("http.maxrequests", var)) {
- max_requests = git_config_int(var, value);
+ max_requests = git_config_int(var, value, ctx->kvi);
return 0;
}
if (!strcmp("http.lowspeedlimit", var)) {
- curl_low_speed_limit = (long)git_config_int(var, value);
+ curl_low_speed_limit = (long)git_config_int(var, value, ctx->kvi);
return 0;
}
if (!strcmp("http.lowspeedtime", var)) {
- curl_low_speed_time = (long)git_config_int(var, value);
+ curl_low_speed_time = (long)git_config_int(var, value, ctx->kvi);
return 0;
}
@@ -347,7 +463,7 @@ static int http_options(const char *var, const char *value, void *cb)
}
if (!strcmp("http.postbuffer", var)) {
- http_post_buffer = git_config_ssize_t(var, value);
+ http_post_buffer = git_config_ssize_t(var, value, ctx->kvi);
if (http_post_buffer < 0)
warning(_("negative value for http.postBuffer; defaulting to %d"), LARGE_PACKET_MAX);
if (http_post_buffer < LARGE_PACKET_MAX)
@@ -418,7 +534,7 @@ static int http_options(const char *var, const char *value, void *cb)
}
/* Fall back on the default ones */
- return git_default_config(var, value, cb);
+ return git_default_config(var, value, ctx, data);
}
static int curl_empty_auth_enabled(void)
@@ -560,13 +676,15 @@ static void set_curl_keepalive(CURL *c)
}
#endif
-static void redact_sensitive_header(struct strbuf *header)
+/* Return 1 if redactions have been made, 0 otherwise. */
+static int redact_sensitive_header(struct strbuf *header, size_t offset)
{
+ int ret = 0;
const char *sensitive_header;
if (trace_curl_redact &&
- (skip_iprefix(header->buf, "Authorization:", &sensitive_header) ||
- skip_iprefix(header->buf, "Proxy-Authorization:", &sensitive_header))) {
+ (skip_iprefix(header->buf + offset, "Authorization:", &sensitive_header) ||
+ skip_iprefix(header->buf + offset, "Proxy-Authorization:", &sensitive_header))) {
/* The first token is the type, which is OK to log */
while (isspace(*sensitive_header))
sensitive_header++;
@@ -575,8 +693,9 @@ static void redact_sensitive_header(struct strbuf *header)
/* Everything else is opaque and possibly sensitive */
strbuf_setlen(header, sensitive_header - header->buf);
strbuf_addstr(header, " <redacted>");
+ ret = 1;
} else if (trace_curl_redact &&
- skip_iprefix(header->buf, "Cookie:", &sensitive_header)) {
+ skip_iprefix(header->buf + offset, "Cookie:", &sensitive_header)) {
struct strbuf redacted_header = STRBUF_INIT;
const char *cookie;
@@ -612,6 +731,52 @@ static void redact_sensitive_header(struct strbuf *header)
strbuf_setlen(header, sensitive_header - header->buf);
strbuf_addbuf(header, &redacted_header);
+ ret = 1;
+ }
+ return ret;
+}
+
+static int match_curl_h2_trace(const char *line, const char **out)
+{
+ const char *p;
+
+ /*
+ * curl prior to 8.1.0 gives us:
+ *
+ * h2h3 [<header-name>: <header-val>]
+ *
+ * Starting in 8.1.0, the first token became just "h2".
+ */
+ if (skip_iprefix(line, "h2h3 [", out) ||
+ skip_iprefix(line, "h2 [", out))
+ return 1;
+
+ /*
+ * curl 8.3.0 uses:
+ * [HTTP/2] [<stream-id>] [<header-name>: <header-val>]
+ * where <stream-id> is numeric.
+ */
+ if (skip_iprefix(line, "[HTTP/2] [", &p)) {
+ while (isdigit(*p))
+ p++;
+ if (skip_prefix(p, "] [", out))
+ return 1;
+ }
+
+ return 0;
+}
+
+/* Redact headers in info */
+static void redact_sensitive_info_header(struct strbuf *header)
+{
+ const char *sensitive_header;
+
+ if (trace_curl_redact &&
+ match_curl_h2_trace(header->buf, &sensitive_header)) {
+ if (redact_sensitive_header(header, sensitive_header - header->buf)) {
+ /* redaction ate our closing bracket */
+ strbuf_addch(header, ']');
+ }
}
}
@@ -629,7 +794,7 @@ static void curl_dump_header(const char *text, unsigned char *ptr, size_t size,
for (header = headers; *header; header++) {
if (hide_sensitive_header)
- redact_sensitive_header(*header);
+ redact_sensitive_header(*header, 0);
strbuf_insertstr((*header), 0, text);
strbuf_insertstr((*header), strlen(text), ": ");
strbuf_rtrim((*header));
@@ -668,14 +833,28 @@ static void curl_dump_data(const char *text, unsigned char *ptr, size_t size)
strbuf_release(&out);
}
-static int curl_trace(CURL *handle, curl_infotype type, char *data, size_t size, void *userp)
+static void curl_dump_info(char *data, size_t size)
+{
+ struct strbuf buf = STRBUF_INIT;
+
+ strbuf_add(&buf, data, size);
+
+ redact_sensitive_info_header(&buf);
+ trace_printf_key(&trace_curl, "== Info: %s", buf.buf);
+
+ strbuf_release(&buf);
+}
+
+static int curl_trace(CURL *handle UNUSED, curl_infotype type,
+ char *data, size_t size,
+ void *userp UNUSED)
{
const char *text;
enum { NO_FILTER = 0, DO_FILTER = 1 };
switch (type) {
case CURLINFO_TEXT:
- trace_printf_key(&trace_curl, "== Info: %s", data);
+ curl_dump_info(data, size);
break;
case CURLINFO_HEADER_OUT:
text = "=> Send header";
@@ -731,20 +910,37 @@ void setup_curl_trace(CURL *handle)
curl_easy_setopt(handle, CURLOPT_DEBUGDATA, NULL);
}
-static long get_curl_allowed_protocols(int from_user)
+static void proto_list_append(struct strbuf *list, const char *proto)
{
- long allowed_protocols = 0;
+ if (!list)
+ return;
+ if (list->len)
+ strbuf_addch(list, ',');
+ strbuf_addstr(list, proto);
+}
- if (is_transport_allowed("http", from_user))
- allowed_protocols |= CURLPROTO_HTTP;
- if (is_transport_allowed("https", from_user))
- allowed_protocols |= CURLPROTO_HTTPS;
- if (is_transport_allowed("ftp", from_user))
- allowed_protocols |= CURLPROTO_FTP;
- if (is_transport_allowed("ftps", from_user))
- allowed_protocols |= CURLPROTO_FTPS;
+static long get_curl_allowed_protocols(int from_user, struct strbuf *list)
+{
+ long bits = 0;
- return allowed_protocols;
+ if (is_transport_allowed("http", from_user)) {
+ bits |= CURLPROTO_HTTP;
+ proto_list_append(list, "http");
+ }
+ if (is_transport_allowed("https", from_user)) {
+ bits |= CURLPROTO_HTTPS;
+ proto_list_append(list, "https");
+ }
+ if (is_transport_allowed("ftp", from_user)) {
+ bits |= CURLPROTO_FTP;
+ proto_list_append(list, "ftp");
+ }
+ if (is_transport_allowed("ftps", from_user)) {
+ bits |= CURLPROTO_FTPS;
+ proto_list_append(list, "ftps");
+ }
+
+ return bits;
}
#ifdef GIT_CURL_HAVE_CURL_HTTP_VERSION_2
@@ -854,10 +1050,14 @@ static CURL *get_curl_handle(void)
if (ssl_cert)
curl_easy_setopt(result, CURLOPT_SSLCERT, ssl_cert);
+ if (ssl_cert_type)
+ curl_easy_setopt(result, CURLOPT_SSLCERTTYPE, ssl_cert_type);
if (has_cert_password())
curl_easy_setopt(result, CURLOPT_KEYPASSWD, cert_auth.password);
if (ssl_key)
curl_easy_setopt(result, CURLOPT_SSLKEY, ssl_key);
+ if (ssl_key_type)
+ curl_easy_setopt(result, CURLOPT_SSLKEYTYPE, ssl_key_type);
if (ssl_capath)
curl_easy_setopt(result, CURLOPT_CAPATH, ssl_capath);
#ifdef GIT_CURL_HAVE_CURLOPT_PINNEDPUBLICKEY
@@ -888,10 +1088,26 @@ static CURL *get_curl_handle(void)
curl_easy_setopt(result, CURLOPT_MAXREDIRS, 20);
curl_easy_setopt(result, CURLOPT_POSTREDIR, CURL_REDIR_POST_ALL);
+
+#ifdef GIT_CURL_HAVE_CURLOPT_PROTOCOLS_STR
+ {
+ struct strbuf buf = STRBUF_INIT;
+
+ get_curl_allowed_protocols(0, &buf);
+ curl_easy_setopt(result, CURLOPT_REDIR_PROTOCOLS_STR, buf.buf);
+ strbuf_reset(&buf);
+
+ get_curl_allowed_protocols(-1, &buf);
+ curl_easy_setopt(result, CURLOPT_PROTOCOLS_STR, buf.buf);
+ strbuf_release(&buf);
+ }
+#else
curl_easy_setopt(result, CURLOPT_REDIR_PROTOCOLS,
- get_curl_allowed_protocols(0));
+ get_curl_allowed_protocols(0, NULL));
curl_easy_setopt(result, CURLOPT_PROTOCOLS,
- get_curl_allowed_protocols(-1));
+ get_curl_allowed_protocols(-1, NULL));
+#endif
+
if (getenv("GIT_CURL_VERBOSE"))
http_trace_curl_no_data();
setup_curl_trace(result);
@@ -1076,7 +1292,9 @@ void http_init(struct remote *remote, const char *url, int proactive_auth)
curl_ssl_verify = 0;
set_from_env(&ssl_cert, "GIT_SSL_CERT");
+ set_from_env(&ssl_cert_type, "GIT_SSL_CERT_TYPE");
set_from_env(&ssl_key, "GIT_SSL_KEY");
+ set_from_env(&ssl_key_type, "GIT_SSL_KEY_TYPE");
set_from_env(&ssl_capath, "GIT_SSL_CAPATH");
set_from_env(&ssl_cainfo, "GIT_SSL_CAINFO");
@@ -1234,6 +1452,7 @@ struct active_request_slot *get_active_slot(void)
curl_easy_setopt(slot->curl, CURLOPT_READFUNCTION, NULL);
curl_easy_setopt(slot->curl, CURLOPT_WRITEFUNCTION, NULL);
curl_easy_setopt(slot->curl, CURLOPT_POSTFIELDS, NULL);
+ curl_easy_setopt(slot->curl, CURLOPT_POSTFIELDSIZE, -1L);
curl_easy_setopt(slot->curl, CURLOPT_UPLOAD, 0);
curl_easy_setopt(slot->curl, CURLOPT_HTTPGET, 1);
curl_easy_setopt(slot->curl, CURLOPT_FAILONERROR, 1);
@@ -1682,7 +1901,7 @@ static void write_accept_language(struct strbuf *buf)
* MAX_DECIMAL_PLACES must not be larger than 3. If it is larger than
* that, q-value will be smaller than 0.001, the minimum q-value the
* HTTP specification allows. See
- * http://tools.ietf.org/html/rfc7231#section-5.3.1 for q-value.
+ * https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.1 for q-value.
*/
const int MAX_DECIMAL_PLACES = 3;
const int MAX_LANGUAGE_TAGS = 1000;
@@ -1775,7 +1994,7 @@ static void write_accept_language(struct strbuf *buf)
* LANGUAGE= LANG=en_US.UTF-8 -> "Accept-Language: en-US, *; q=0.1"
* LANGUAGE= LANG=C -> ""
*/
-static const char *get_accept_language(void)
+const char *http_get_accept_language_header(void)
{
if (!cached_accept_language) {
struct strbuf buf = STRBUF_INIT;
@@ -1829,7 +2048,9 @@ static int http_request(const char *url,
fwrite_buffer);
}
- accept_language = get_accept_language();
+ curl_easy_setopt(slot->curl, CURLOPT_HEADERFUNCTION, fwrite_wwwauth);
+
+ accept_language = http_get_accept_language_header();
if (accept_language)
headers = curl_slist_append(headers, accept_language);
generated by cgit v0.10.2-6-g49f6 at 2024-04-24 14:06:22 (GMT)