summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* http: reset replay_count upon connectionethomson/proxyEdward Thomson2018-11-281-0/+1
| | | | | | | | | Reset the replay_count upon a successful connection. It's possible that we could encounter a situation where we connect successfully but need to replay a request - for example, a connection and initial request succeeds without authentication but a subsequent call does require authentication. Reset the replay count upon any successful request to afford subsequent replays room to manuever.
* stream registration: take an enum typeEdward Thomson2018-11-284-20/+37
| | | | | | Accept an enum (`git_stream_t`) during custom stream registration that indicates whether the registration structure should be used for standard (non-TLS) streams or TLS streams.
* http: don't allow SSL connections to a proxyEdward Thomson2018-11-281-1/+9
| | | | | Temporarily disallow SSL connections to a proxy until we can understand the valgrind warnings when tunneling OpenSSL over OpenSSL.
* http: only load proxy configuration during connectionEdward Thomson2018-11-281-2/+4
| | | | | | | | | | | | Only load the proxy configuration during connection; we need this data when we're going to connect to the server, however we may mutate it after connection (connecting through a CONNECT proxy means that we should send requests like normal). If we reload the proxy configuration but do not actually reconnect (because we're in a keep-alive session) then we will reload the proxy configuration that we should have mutated. Thus, only load the proxy configuration when we know that we're going to reconnect.
* stream: provide generic registration APIEdward Thomson2018-11-286-73/+163
| | | | | | | | | Update the new stream registration API to be `git_stream_register` which takes a registration structure and a TLS boolean. This allows callers to register non-TLS streams as well as TLS streams. Provide `git_stream_register_tls` that takes just the init callback for backward compatibliity.
* http: disallow repeated headers from serversEdward Thomson2018-11-281-9/+18
| | | | | Don't allow servers to send us multiple Content-Type, Content-Length or Location headers.
* http: remove cURLEdward Thomson2018-11-289-466/+2
| | | | | We previously used cURL to support HTTP proxies. Now that we've added this support natively, we can remove the curl dependency.
* streams: remove unused tls functionsEdward Thomson2018-11-285-42/+12
| | | | | | | The implementations of git_openssl_stream_new and git_mbedtls_stream_new have callers protected by #ifdefs and are never called unless compiled in. There's no need for a dummy implementation. Remove them.
* http: use CONNECT to talk to proxiesEdward Thomson2018-11-281-13/+224
| | | | | Natively support HTTPS connections through proxies by speaking CONNECT to the proxy and then adding a TLS connection on top of the socket.
* tls: introduce a wrap functionEdward Thomson2018-11-2810-88/+297
| | | | | | | | | | | Introduce `git_tls_stream_wrap` which will take an existing `stream` with an already connected socket and begin speaking TLS on top of it. This is useful if you've built a connection to a proxy server and you wish to begin CONNECT over it to tunnel a TLS connection. Also update the pluggable TLS stream layer so that it can accept a registration structure that provides an `init` and `wrap` function, instead of a single initialization function.
* http transport: reset error message on cert failureEdward Thomson2018-11-281-11/+11
| | | | | | | | Store the error message from the underlying TLS library before calling the certificate callback. If it refuses to act (demonstrated by returning GIT_PASSTHROUGH) then restore the error message. Otherwise, if the callback does not set an error message, set a sensible default that implicates the callback itself.
* http transport: support cert check for proxiesEdward Thomson2018-11-281-39/+70
| | | | | Refactor certificate checking so that it can easily be called for proxies or the remote server.
* http transport: provide proxy credentialsEdward Thomson2018-11-284-8/+19
|
* http transport: refactor storageEdward Thomson2018-11-281-120/+133
| | | | | | | Create a simple data structure that contains information about the server being connected to, whether that's the actual remote endpoint (git server) or an intermediate proxy. This allows for organization of streams, authentication state, etc.
* http transport: cap number of authentication replaysEdward Thomson2018-11-283-9/+10
| | | | | | Put a limit on the number of authentication replays in the HTTP transport. Standardize on 7 replays for authentication or redirects, which matches the behavior of the WinHTTP transport.
* http transport: prompt for proxy credentialsEdward Thomson2018-11-281-19/+37
| | | | Teach the HTTP transport how to prompt for proxy credentials.
* http transport: further refactor credential handlingEdward Thomson2018-11-281-17/+32
| | | | | Prepare credential handling to understand both git server and proxy server authentication.
* http transport: refactor credential handlingEdward Thomson2018-11-281-47/+58
| | | | | | | Factor credential handling into its own function. Additionally, add safety checks to ensure that we are in a valid state - that we have received a valid challenge from the server and that we have configuration to respond to that challenge.
* http transport: use HTTP proxies when requestedEdward Thomson2018-11-281-33/+80
| | | | | | | | The HTTP transport should understand how to apply proxies when configured with `GIT_PROXY_SPECIFIED` and `GIT_PROXY_SPECIFIED`. When a proxy is configured, the HTTP transport will now connect to the proxy (instead of directly to the git server), and will request the properly-formed URL of the git server endpoint.
* http: rename http subtransport's `io` to `gitserver_stream`Edward Thomson2018-11-281-29/+38
| | | | | | Rename `http_subtransport->io` to `http_subtransport->gitserver_stream` to clarify its use, especially as we might have additional streams (eg for a proxy) in the future.
* http: rename `connection_data` -> `gitserver_data`Edward Thomson2018-11-281-20/+20
| | | | | | Rename the `connection_data` struct member to `gitserver_data`, to disambiguate future `connection_data`s that apply to the proxy, not the final server endpoint.
* proxy: propagate proxy configuration errorsEdward Thomson2018-11-281-1/+2
|
* Merge pull request #4879 from libgit2/ethomson/defer_cert_cred_cbPatrick Steinhardt2018-11-284-5/+23
|\ | | | | Allow certificate and credential callbacks to decline to act
| * transport: allow cred/cert callbacks to return GIT_PASSTHROUGHethomson/defer_cert_cred_cbEdward Thomson2018-11-213-5/+13
| | | | | | | | | | | | | | | | | | | | | | | | Allow credential and certificate checking callbacks to return GIT_PASSTHROUGH, indicating that they do not want to act. Introduce this to support in both the http and ssh callbacks. Additionally, enable the same mechanism for certificate validation. This is most useful to disambiguate any meaning in the publicly exposed credential and certificate functions (`git_transport_smart_credentials` and `git_transport_smart_certificate_check`) but it may be more generally useful for callers to be able to defer back to libgit2.
| * transport: see if cert/cred callbacks exist before calling themEdward Thomson2018-11-151-0/+10
| | | | | | | | | | | | | | Custom transports may want to ask libgit2 to invoke a configured credential or certificate callback; however they likely do not know if a callback was actually configured. Return a sentinal value (GIT_PASSTHROUGH) if there is no callback configured instead of crashing.
* | Fix warning C4133 incompatible types in MSVCSven Strickroth2018-11-251-2/+2
| | | | | | | | | | | | Introduced in commit b433a22a979ae78c28c8b16f8c3487e2787cb73e. Signed-off-by: Sven Strickroth <email@cs-ware.de>
* | Merge pull request #4884 from libgit2/ethomson/index_iteratorPatrick Steinhardt2018-11-212-0/+51
|\ \ | | | | | | index: introduce git_index_iterator
| * | index: introduce git_index_iteratorethomson/index_iteratorEdward Thomson2018-11-142-0/+51
| | | | | | | | | | | | | | | | | | Provide a public git_index_iterator API that is backed by an index snapshot. This allows consumers to provide a stable iteration even while manipulating the index during iteration.
* | | commit: fix out-of-bound reads when parsing truncated author fieldsPatrick Steinhardt2018-11-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While commit objects usually should have only one author field, our commit parser actually handles the case where a commit has multiple author fields because some tools that exist in the wild actually write them. Detection of those additional author fields is done by using a simple `git__prefixcmp`, checking whether the current line starts with the string "author ". In case where we are handed a non-NUL-terminated string that ends directly after the space, though, we may have an out-of-bounds read of one byte when trying to compare the expected final NUL byte. Fix the issue by using `git__prefixncmp` instead of `git_prefixcmp`. Unfortunately, a test cannot be easily written to catch this case. While we could test the last error message and verify that it didn't in fact fail parsing a signature (because that would indicate that it has in fact tried to parse the additional "author " field, which it shouldn't be able to detect in the first place), this doesn't work as the next line needs to be the "committer" field, which would error out with the same error message even if we hadn't done an out-of-bounds read. As objects read from the object database are always NUL terminated, this issue cannot be triggered in normal code and thus it's not security critical.
* | | Merge branch 'tiennou/fix/logallrefupdates-always'Edward Thomson2018-11-183-13/+30
|\ \ \
| * | | refs: add support for core.logAllRefUpdates=alwaysEtienne Samson2018-11-183-13/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Since we were not expecting this config entry to contain a string, we would fail as soon as its (cached) value would be accessed. Hence, provide some constants for the 4 states we use, and account for "always" when we decide to reflog changes.
* | | | Merge pull request #4847 from noahp/noahp/null-arg-fixesEdward Thomson2018-11-181-1/+2
|\ \ \ \ | | | | | | | | | | tests: 🌀 address two null argument instances
| * | | | tests: address two null argument instancesNoah Pendleton2018-11-131-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Handle two null argument cases that occur in the unit tests. One is in library code, the other is in test code. Detected by running unit tests with undefined behavior sanitizer: ```bash # build mkdir build && cd build cmake -DBUILD_CLAR=ON -DCMAKE_C_FLAGS="-fsanitize=address \ -fsanitize=undefined -fstack-usage -static-libasan" .. cmake --build . # run with asan ASAN_OPTIONS="allocator_may_return_null=1" ./libgit2_clar ... ............../libgit2/src/apply.c:316:3: runtime error: null pointer \ passed as argument 1, which is declared to never be null ...................../libgit2/tests/apply/fromfile.c:46:3: runtime \ error: null pointer passed as argument 1, which is declared to never be null ```
* | | | | Merge pull request #4875 from tiennou/fix/openssl-errorsEdward Thomson2018-11-181-7/+7
|\ \ \ \ \ | | | | | | | | | | | | Some OpenSSL issues
| * | | | | openssl: only say we're connected if the connection succeededEtienne Samson2018-11-011-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ssl_close uses this boolean to know if SSL_shutdown should be called. It turns out OpenSSL auto-shutdowns on failure, so if the call to SSL_connect fails, it will complain about "shutdown while in init", trampling the original error.
| * | | | | openssl: set the error class to GITERR_SSLEtienne Samson2018-11-011-5/+5
| | | | | |
* | | | | | Merge pull request #4882 from kc8apf/include_port_in_host_headerEdward Thomson2018-11-183-4/+19
|\ \ \ \ \ \ | |_|_|/ / / |/| | | | | transport/http: Include non-default ports in Host header
| * | | | | transport/http: Include non-default ports in Host headerRick Altherr2018-11-091-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the port is omitted, the server assumes the default port for the service is used (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Host). In cases where the client provided a non-default port, it should be passed along. This hasn't been an issue so far as the git protocol doesn't include server-generated URIs. I encountered this when implementing Rust registry support for Sonatype Nexus. Rust's registry uses a git repository for the package index. Clients look at a file in the root of the package index to find the base URL for downloading the packages. Sonatype Nexus looks at the incoming HTTP request (Host header and URL) to determine the client-facing URL base as it may be running behind a load balancer or reverse proxy. This client-facing URL base is then used to construct the package download base URL. When libgit2 fetches the index from Nexus on a non-default port, Nexus trusts the incorrect Host header and generates an incorrect package download base URL.
| * | | | | netops: add method to return default http port for a connectionRick Altherr2018-11-092-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Constant strings and logic for HTTP(S) default ports were starting to be spread throughout netops.c. Instead of duplicating this again to determine if a Host header should include the port, move the default port constants and logic into an internal method in netops.{c,h}.
* | | | | | Merge pull request #4713 from libgit2/ethomson/win_symlinksEdward Thomson2018-11-153-53/+69
|\ \ \ \ \ \ | |_|_|_|_|/ |/| | | | | Support symlinks on Windows when core.symlinks=true
| * | | | | repository: load_config for non-repo configsEdward Thomson2018-10-201-6/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Teach `load_config` how to load all the configurations except (optionally) the repository configuration. This allows the new repository codepath to load the global/xdg/system configuration paths so that they can be inspected during repository initialization.
| * | | | | win32: emulate Git for Windows in symlink supportEdward Thomson2018-10-201-10/+42
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Emulate the Git for Windows `core.symlinks` support. Since symbolic links are generally enabled for Administrator (and _may_ be enabled due to enabling Developer mode) but symbolic links are still sufficiently uncommon on Windows that Git users are expected to explicitly opt-in to symbolic links by enabling `core.symlinks=true` in a global (or xdg or system) configuration. When `core.symlinks=true` is set globally _and_ symbolic links support is detected then new repositories created will not have a `core.symlinks` set. If `core.symlinks` is _not_ set then no detection will be performed, and `core.symlinks=false` will be set in the repository configuration.
| * | | | | win32: add symbolic link supportEdward Thomson2018-10-201-5/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enable `p_symlink` to actually create symbolic links, not just create a fake link (a text file containing the link target). This now means that `core.symlinks=true` works on Windows platforms where symbolic links are enabled (likely due to running in Developer Mode).
| * | | | | win32: use GetFinalPathNameByHandle directlyEdward Thomson2018-10-201-31/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now that we've updated to WIN32_WINNT version of Vista or better, we don't need to dynamically load GetFinalPathNameByHandle and can simply invoke it directly.
| * | | | | cmake: increase WIN32_WINNT to VistaEdward Thomson2018-10-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Increase the WIN32_WINNT level to 0x0600, which enables support for new APIs from Windows 6.0 (Vista). We had previously set this to 0x0501, which was Windows XP. Although we removed XP support many years ago, there was no need to update this level previously. We're doing so now explicitly so that we can get support for the `CreateSymbolicLink` API.
* | | | | | patch_parse: remove unused function `parse_number`Patrick Steinhardt2018-11-141-20/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The function `parse_number` was replaced by `git_parse_advance_digit` which is provided by the parser interface in commit 252f2eeee (parse: implement and use `git_parse_advance_digit`, 2017-07-14). As there are no remaining callers, remove it.
* | | | | | strntol: fix out-of-bounds reads when parsing numbers with leading signPatrick Steinhardt2018-11-141-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When parsing a number, we accept a leading plus or minus sign to return a positive or negative number. When the parsed string has such a leading sign, we set up a flag indicating that the number is negative and advance the pointer to the next character in that string. This misses updating the number of bytes in the string, though, which is why the parser may later on do an out-of-bounds read. Fix the issue by correctly updating both the pointer and the number of remaining bytes. Furthermore, we need to check whether we actually have any bytes left after having advanced the pointer, as otherwise the auto-detection of the base may do an out-of-bonuds access. Add a test that detects the out-of-bound read. Note that this is not actually security critical. While there are a lot of places where the function is called, all of these places are guarded or irrelevant: - commit list: this operates on objects from the ODB, which are always NUL terminated any may thus not trigger the off-by-one OOB read. - config: the configuration is NUL terminated. - curl stream: user input is being parsed that is always NUL terminated - index: the index is read via `git_futils_readbuffer`, which always NUL terminates it. - loose objects: used to parse the length from the object's header. As we check previously that the buffer contains a NUL byte, this is safe. - rebase: this parses numbers from the rebase instruction sheet. As the rebase code uses `git_futils_readbuffer`, the buffer is always NUL terminated. - revparse: this parses a user provided buffer that is NUL terminated. - signature: this parser the header information of objects. As objects read from the ODB are always NUL terminated, this is a non-issue. The constructor `git_signature_from_buffer` does not accept a length parameter for the buffer, so the buffer needs to be NUL terminated, as well. - smart transport: the buffer that is parsed is NUL terminated - tree cache: this parses the tree cache from the index extension. The index itself is read via `git_futils_readbuffer`, which always NUL terminates it. - winhttp transport: user input is being parsed that is always NUL terminated
* | | | | | Merge pull request #4883 from pks-t/pks/signature-tz-oobPatrick Steinhardt2018-11-131-1/+1
|\ \ \ \ \ \ | | | | | | | | | | | | | | signature: fix out-of-bounds read when parsing timezone offset
| * | | | | | signature: fix out-of-bounds read when parsing timezone offsetPatrick Steinhardt2018-11-091-1/+1
| | |/ / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When parsing a signature's timezone offset, we first check whether there is a timezone at all by verifying that there are still bytes left to read following the time itself. The check thus looks like `time_end + 1 < buffer_end`, which is actually correct in this case. After setting the timezone's start pointer to that location, we compute the remaining bytes by using the formula `buffer_end - tz_start + 1`, re-using the previous `time_end + 1`. But this is in fact missing the braces around `(tz_start + 1)`, thus leading to an overestimation of the remaining bytes by a length of two. In case of a non-NUL terminated buffer, this will result in an overflow. The function `git_signature__parse` is only used in two locations. First is `git_signature_from_buffer`, which only accepts a string without a length. The string thus necessarily has to be NUL terminated and cannot trigger the issue. The other function is `git_commit__parse_raw`, which can in fact trigger the error as it may receive non-NUL terminated commit data. But as objects read from the ODB are always NUL-terminated by us as a cautionary measure, it cannot trigger the issue either. In other words, this error does not have any impact on security.
* | | | | | Merge pull request #4667 from tiennou/feature/remote-create-apiPatrick Steinhardt2018-11-132-64/+113
|\ \ \ \ \ \ | | | | | | | | | | | | | | Remote creation API
View Lorry Controller Status