From 6b8dda9a4fdec1638b047506a121df8e15872492 Mon Sep 17 00:00:00 2001 From: Matthew John Cheetham Date: Mon, 27 Feb 2023 17:20:19 +0000 Subject: http: read HTTP WWW-Authenticate response headers Read and store the HTTP WWW-Authenticate response headers made for a particular request. This will allow us to pass important authentication challenge information to credential helpers or others that would otherwise have been lost. libcurl only provides us with the ability to read all headers recieved for a particular request, including any intermediate redirect requests or proxies. The lines returned by libcurl include HTTP status lines delinating any intermediate requests such as "HTTP/1.1 200". We use these lines to reset the strvec of WWW-Authenticate header values as we encounter them in order to only capture the final response headers. The collection of all header values matching the WWW-Authenticate header is complicated by the fact that it is legal for header fields to be continued over multiple lines, but libcurl only gives us each physical line a time, not each logical header. This line folding feature is deprecated in RFC 7230 [1] but older servers may still emit them, so we need to handle them. In the future [2] we may be able to leverage functions to read headers from libcurl itself, but as of today we must do this ourselves. [1] https://www.rfc-editor.org/rfc/rfc7230#section-3.2 [2] https://daniel.haxx.se/blog/2022/03/22/a-headers-api-for-libcurl/ Signed-off-by: Matthew John Cheetham Signed-off-by: Junio C Hamano --- credential.c | 1 + 1 file changed, 1 insertion(+) (limited to 'credential.c') diff --git a/credential.c b/credential.c index f6389a5068..897b467933 100644 --- a/credential.c +++ b/credential.c @@ -22,6 +22,7 @@ void credential_clear(struct credential *c) free(c->username); free(c->password); string_list_clear(&c->helpers, 0); + strvec_clear(&c->wwwauth_headers); credential_init(c); } -- cgit v1.2.1 From 5f2117b24f568ecc789c677748d70ccd538b16ba Mon Sep 17 00:00:00 2001 From: Matthew John Cheetham Date: Mon, 27 Feb 2023 17:20:20 +0000 Subject: credential: add WWW-Authenticate header to cred requests Add the value of the WWW-Authenticate response header to credential requests. Credential helpers that understand and support HTTP authentication and authorization can use this standard header (RFC 2616 Section 14.47 [1]) to generate valid credentials. WWW-Authenticate headers can contain information pertaining to the authority, authentication mechanism, or extra parameters/scopes that are required. The current I/O format for credential helpers only allows for unique names for properties/attributes, so in order to transmit multiple header values (with a specific order) we introduce a new convention whereby a C-style array syntax is used in the property name to denote multiple ordered values for the same property. In this case we send multiple `wwwauth[]` properties where the order that the repeated attributes appear in the conversation reflects the order that the WWW-Authenticate headers appeared in the HTTP response. Add a set of tests to exercise the HTTP authentication header parsing and the interop with credential helpers. Credential helpers will receive WWW-Authenticate information in credential requests. [1] https://datatracker.ietf.org/doc/html/rfc2616#section-14.47 Signed-off-by: Matthew John Cheetham Signed-off-by: Junio C Hamano --- credential.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'credential.c') diff --git a/credential.c b/credential.c index 897b467933..f566c8ab19 100644 --- a/credential.c +++ b/credential.c @@ -270,6 +270,9 @@ void credential_write(const struct credential *c, FILE *fp) credential_write_item(fp, "path", c->path, 0); credential_write_item(fp, "username", c->username, 0); credential_write_item(fp, "password", c->password, 0); + for (size_t i = 0; i < c->wwwauth_headers.nr; i++) + credential_write_item(fp, "wwwauth[]", c->wwwauth_headers.v[i], + 0); } static int run_credential_helper(struct credential *c, -- cgit v1.2.1