remote-curl: retry failed requests for auth even with gzip

Commit b81401c taught the post_rpc function to retry the
http request after prompting for credentials. However, it
did not handle two cases:

  1. If we have a large request, we do not retry. That's OK,
     since we would have sent a probe (with retry) already.

  2. If we are gzipping the request, we do not retry. That
     was considered OK, because the intended use was for
     push (e.g., listing refs is OK, but actually pushing
     objects is not), and we never gzip on push.

This patch teaches post_rpc to retry even a gzipped request.
This has two advantages:

  1. It is possible to configure a "half-auth" state for
     fetching, where the set of refs and their sha1s are
     advertised, but one cannot actually fetch objects.

     This is not a recommended configuration, as it leaks
     some information about what is in the repository (e.g.,
     an attacker can try brute-forcing possible content in
     your repository and checking whether it matches your
     branch sha1). However, it can be slightly more
     convenient, since a no-op fetch will not require a
     password at all.

  2. It future-proofs us should we decide to ever gzip more
     requests.

Signed-off-by: Jeff King <peff@peff.net>

diff --git a/remote-curl.c b/remote-curl.c
index 10cd47d381ea0b6c9e89afd4e5545a81f82f1863..fac2befd86b30f2b90e6dfc1a6f851649e980cdd 100644 (file)
--- a/remote-curl.c
+++ b/remote-curl.c
@@ -474,6 +474,15 @@ retry:
                        fflush(stderr);
                }
 
+       } else if (gzip_body) {
+               /*
+                * If we are looping to retry authentication, then the previous
+                * run will have set up the headers and gzip buffer already,
+                * and we just need to send it.
+                */
+               curl_easy_setopt(slot->curl, CURLOPT_POSTFIELDS, gzip_body);
+               curl_easy_setopt(slot->curl, CURLOPT_POSTFIELDSIZE, gzip_size);
+
        } else if (use_gzip && 1024 < rpc->len) {
                /* The client backend isn't giving us compressed data so
                 * we can try to deflate it ourselves, this may save on.
@@ -530,7 +539,7 @@ retry:
        curl_easy_setopt(slot->curl, CURLOPT_FILE, rpc);
 
        err = run_slot(slot);
-       if (err == HTTP_REAUTH && !large_request && !use_gzip)
+       if (err == HTTP_REAUTH && !large_request)
                goto retry;
        if (err != HTTP_OK)
                err = -1;

diff --git a/t/lib-httpd/apache.conf b/t/lib-httpd/apache.conf
index ec8618dfde3b106c79f1d056bc0ed085075fc8c8..15a3c7155571ec5c9cc3f3d9355787ab92004f35 100644 (file)
--- a/t/lib-httpd/apache.conf
+++ b/t/lib-httpd/apache.conf
@@ -96,6 +96,13 @@ SSLEngine On
        Require valid-user
 </LocationMatch>
 
+<LocationMatch "^/auth-fetch/.*/git-upload-pack$">
+       AuthType Basic
+       AuthName "git-auth"
+       AuthUserFile passwd
+       Require valid-user
+</LocationMatch>
+
 <IfDefine DAV>
        LoadModule dav_module modules/mod_dav.so
        LoadModule dav_fs_module modules/mod_dav_fs.so

diff --git a/t/t5551-http-fetch.sh b/t/t5551-http-fetch.sh
index 7380f2a2dd3f22d65a10389d8197af94f9ea4123..5f174da3c7be992c7bc52ee42050775b41af9cc5 100755 (executable)
--- a/t/t5551-http-fetch.sh
+++ b/t/t5551-http-fetch.sh
@@ -129,6 +129,21 @@ test_expect_success 'clone from auth-only-for-push repository' '
        test_cmp expect actual
 '
 
+test_expect_success 'clone from auth-only-for-objects repository' '
+       echo two >expect &&
+       set_askpass user@host &&
+       git clone --bare "$HTTPD_URL/auth-fetch/smart/repo.git" half-auth &&
+       expect_askpass both user@host &&
+       git --git-dir=half-auth log -1 --format=%s >actual &&
+       test_cmp expect actual
+'
+
+test_expect_success 'no-op half-auth fetch does not require a password' '
+       set_askpass wrong &&
+       git --git-dir=half-auth fetch &&
+       expect_askpass none
+'
+
 test -n "$GIT_TEST_LONG" && test_set_prereq EXPENSIVE
 
 test_expect_success EXPENSIVE 'create 50,000 tags in the repo' '