diff options
| author |  Jeff King <peff@peff.net> | 2012-10-31 07:29:16 -0400 |
|---|---|---|
| committer | Jeff King <peff@peff.net> | 2012-10-31 07:45:13 -0400 |
| commit | 2e736fd5e94c6fa44ba95d81a5b0ae407b968b78 (patch) | |
| tree | 8a3808b42b50592d9c3eccc05865d3d4c3ba6b48 /t | |
| parent | remote-curl: hoist gzip buffer size to top of post_rpc (diff) | |
| download | tgif-2e736fd5e94c6fa44ba95d81a5b0ae407b968b78.tar.xz | |
remote-curl: retry failed requests for auth even with gzip
Commit b81401c taught the post_rpc function to retry the
http request after prompting for credentials. However, it
did not handle two cases:
1. If we have a large request, we do not retry. That's OK,
since we would have sent a probe (with retry) already.
2. If we are gzipping the request, we do not retry. That
was considered OK, because the intended use was for
push (e.g., listing refs is OK, but actually pushing
objects is not), and we never gzip on push.
This patch teaches post_rpc to retry even a gzipped request.
This has two advantages:
1. It is possible to configure a "half-auth" state for
fetching, where the set of refs and their sha1s are
advertised, but one cannot actually fetch objects.
This is not a recommended configuration, as it leaks
some information about what is in the repository (e.g.,
an attacker can try brute-forcing possible content in
your repository and checking whether it matches your
branch sha1). However, it can be slightly more
convenient, since a no-op fetch will not require a
password at all.
2. It future-proofs us should we decide to ever gzip more
requests.
Signed-off-by: Jeff King <peff@peff.net>
Diffstat (limited to 't')
| -rw-r--r-- | t/lib-httpd/apache.conf | 7 | ||||
| -rwxr-xr-x | t/t5551-http-fetch.sh | 15 |
2 files changed, 22 insertions, 0 deletions
diff --git a/t/lib-httpd/apache.conf b/t/lib-httpd/apache.conf index ec8618dfde..15a3c71555 100644 --- a/t/lib-httpd/apache.conf +++ b/t/lib-httpd/apache.conf @@ -96,6 +96,13 @@ SSLEngine On Require valid-user </LocationMatch> +<LocationMatch "^/auth-fetch/.*/git-upload-pack$"> + AuthType Basic + AuthName "git-auth" + AuthUserFile passwd + Require valid-user +</LocationMatch> + <IfDefine DAV> LoadModule dav_module modules/mod_dav.so LoadModule dav_fs_module modules/mod_dav_fs.so diff --git a/t/t5551-http-fetch.sh b/t/t5551-http-fetch.sh index 7380f2a2dd..5f174da3c7 100755 --- a/t/t5551-http-fetch.sh +++ b/t/t5551-http-fetch.sh @@ -129,6 +129,21 @@ test_expect_success 'clone from auth-only-for-push repository' ' test_cmp expect actual ' +test_expect_success 'clone from auth-only-for-objects repository' ' + echo two >expect && + set_askpass user@host && + git clone --bare "$HTTPD_URL/auth-fetch/smart/repo.git" half-auth && + expect_askpass both user@host && + git --git-dir=half-auth log -1 --format=%s >actual && + test_cmp expect actual +' + +test_expect_success 'no-op half-auth fetch does not require a password' ' + set_askpass wrong && + git --git-dir=half-auth fetch && + expect_askpass none +' + test -n "$GIT_TEST_LONG" && test_set_prereq EXPENSIVE test_expect_success EXPENSIVE 'create 50,000 tags in the repo' ' |