undef/git-commit-vandalism
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

http: store credential when PKI auth is used

Browse Source 
We already looked for the PKI credentials in the credential store, but
failed to approve it on success.  Meaning, the PKI certificate password
was never stored and git would request it on every connection to the
remote.  Let's complete the chain by storing the certificate password on
success.

Likewise, we also need to reject the credential when there is a failure.
Curl appears to report client-related certificate issues are reported
with the CURLE_SSL_CERTPROBLEM error.  This includes not only a bad
password, but potentially other client certificate related problems.
Since we cannot get more information from curl, we'll go ahead and
reject the credential upon receiving that error, just to be safe and
avoid caching or saving a bad password.

Signed-off-by: John Szakmeister <john@szakmeister.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
John Szakmeister 2021-03-11 21:40:26 -05:00 committed by Junio C Hamano
parent 13d7ab6b5d
commit cd27f604e4
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
http.c
View File

@ -1637,7 +1637,17 @@ static int handle_curl_result(struct slot_results *results)
credential_approve(&http_auth);
if (proxy_auth.password)
credential_approve(&proxy_auth);
credential_approve(&cert_auth);
return HTTP_OK;
} else if (results->curl_result == CURLE_SSL_CERTPROBLEM) {
/*
* We can't tell from here whether it's a bad path, bad
* certificate, bad password, or something else wrong
* with the certificate. So we reject the credential to
* avoid caching or saving a bad password.
*/
credential_reject(&cert_auth);
return HTTP_NOAUTH;
} else if (missing_target(results))
return HTTP_MISSING_TARGET;
else if (results->http_code == 401) {