summaryrefslogtreecommitdiff
path: root/src/transports
Commit message (Collapse)AuthorAgeFilesLines
...
* http transport: use HTTP proxies when requestedEdward Thomson2018-11-281-33/+80
| | | | | | | | The HTTP transport should understand how to apply proxies when configured with `GIT_PROXY_SPECIFIED` and `GIT_PROXY_SPECIFIED`. When a proxy is configured, the HTTP transport will now connect to the proxy (instead of directly to the git server), and will request the properly-formed URL of the git server endpoint.
* http: rename http subtransport's `io` to `gitserver_stream`Edward Thomson2018-11-281-29/+38
| | | | | | Rename `http_subtransport->io` to `http_subtransport->gitserver_stream` to clarify its use, especially as we might have additional streams (eg for a proxy) in the future.
* http: rename `connection_data` -> `gitserver_data`Edward Thomson2018-11-281-20/+20
| | | | | | Rename the `connection_data` struct member to `gitserver_data`, to disambiguate future `connection_data`s that apply to the proxy, not the final server endpoint.
* proxy: propagate proxy configuration errorsEdward Thomson2018-11-281-1/+2
|
* Merge pull request #4879 from libgit2/ethomson/defer_cert_cred_cbPatrick Steinhardt2018-11-284-5/+23
|\ | | | | Allow certificate and credential callbacks to decline to act
| * transport: allow cred/cert callbacks to return GIT_PASSTHROUGHethomson/defer_cert_cred_cbEdward Thomson2018-11-213-5/+13
| | | | | | | | | | | | | | | | | | | | | | | | Allow credential and certificate checking callbacks to return GIT_PASSTHROUGH, indicating that they do not want to act. Introduce this to support in both the http and ssh callbacks. Additionally, enable the same mechanism for certificate validation. This is most useful to disambiguate any meaning in the publicly exposed credential and certificate functions (`git_transport_smart_credentials` and `git_transport_smart_certificate_check`) but it may be more generally useful for callers to be able to defer back to libgit2.
| * transport: see if cert/cred callbacks exist before calling themEdward Thomson2018-11-151-0/+10
| | | | | | | | | | | | | | Custom transports may want to ask libgit2 to invoke a configured credential or certificate callback; however they likely do not know if a callback was actually configured. Return a sentinal value (GIT_PASSTHROUGH) if there is no callback configured instead of crashing.
* | Merge pull request #4882 from kc8apf/include_port_in_host_headerEdward Thomson2018-11-181-1/+5
|\ \ | |/ |/| transport/http: Include non-default ports in Host header
| * transport/http: Include non-default ports in Host headerRick Altherr2018-11-091-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the port is omitted, the server assumes the default port for the service is used (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Host). In cases where the client provided a non-default port, it should be passed along. This hasn't been an issue so far as the git protocol doesn't include server-generated URIs. I encountered this when implementing Rust registry support for Sonatype Nexus. Rust's registry uses a git repository for the package index. Clients look at a file in the root of the package index to find the base URL for downloading the packages. Sonatype Nexus looks at the incoming HTTP request (Host header and URL) to determine the client-facing URL base as it may be running behind a load balancer or reverse proxy. This client-facing URL base is then used to construct the package download base URL. When libgit2 fetches the index from Nexus on a non-default port, Nexus trusts the incorrect Host header and generates an incorrect package download base URL.
* | smart transport: only clear url on hard resetethomson/smart_transport_urlEdward Thomson2018-11-071-5/+4
|/ | | | | | | | | | | | | | | | | | | | | | After creating a transport for a server, we expect to be able to call `connect`, then invoke subsequent `action` calls. We provide the URL to these `action` calls, although our built-in transports happen to ignore it since they've already parsed it into an internal format that they intend to use (`gitno_connection_data`). In ca2eb4608243162a13c427e74526b6422d5a6659, we began clearing the URL field after a connection, meaning that subsequent calls to transport `action` callbacks would get a NULL URL, which went undetected since the builtin transports ignore the URL when they're already connected (instead of re-parsing it into an internal format). Downstream custom transport implementations (eg, LibGit2Sharp) did notice this change, however. Since `reset_stream` is called even when we're not closing the subtransport, update to only clear the URL when we're closing the subtransport. This ensures that `action` calls will get the correct URL information even after a connection.
* global: replace remaining use of `git__strtol32`Patrick Steinhardt2018-10-182-2/+3
| | | | | | | Replace remaining uses of the `git__strtol32` function. While these uses are all safe as the strings were either sanitized or from a trusted source, we want to remove `git__strtol32` altogether to avoid future misuse.
* Merge commit 'afd10f0' (Follow 308 redirects)Carlos Martín Nieto2018-10-151-1/+2
|\
| * Follow 308 redirects (as used by GitLab)Zander Brown2018-10-131-1/+2
| |
* | ignore unsupported http authentication schemesAnders Borum2018-10-061-1/+4
|/ | | | | | | | | auth_context_match returns 0 instead of -1 for unknown schemes to not fail in situations where some authentication schemes are supported and others are not. apply_credentials is adjusted to handle auth_context_match returning 0 without producing authentication context.
* smart_pkt: do not accept callers passing in no line lengthPatrick Steinhardt2018-10-031-3/+3
| | | | | | | | | | Right now, we simply ignore the `linelen` parameter of `git_pkt_parse_line` in case the caller passed in zero. But in fact, we never want to assume anything about the provided buffer length and always want the caller to pass in the available number of bytes. And in fact, checking all the callers, one can see that the funciton is never being called in case where the buffer length is zero, and thus we are safe to remove this check.
* smart_pkt: return parsed length via out-parameterPatrick Steinhardt2018-10-031-29/+34
| | | | | | | | | | | | | | | | | The `parse_len` function currently directly returns the parsed length of a packet line or an error code in case there was an error. Instead, convert this to our usual style of using the return value as error code only and returning the actual value via an out-parameter. Thus, we can now convert the output parameter to an unsigned type, as the size of a packet cannot ever be negative. While at it, we also move the check whether the input buffer is long enough into `parse_len` itself. We don't really want to pass around potentially non-NUL-terminated buffers to functions without also passing along the length, as this is dangerous in the unlikely case where other callers for that function get added. Note that we need to make sure though to not mess with `GIT_EBUFS` error codes, as these indicate not an error to the caller but that he needs to fetch more data.
* smart_pkt: reorder and rename parameters of `git_pkt_parse_line`Patrick Steinhardt2018-10-033-24/+24
| | | | | | | The parameters of the `git_pkt_parse_line` function are quite confusing. First, there is no real indicator what the `out` parameter is actually all about, and it's not really clear what the `bufflen` parameter refers to. Reorder and rename the parameters to make this more obvious.
* smart_pkt: fix buffer overflow when parsing "unpack" packetsPatrick Steinhardt2018-10-031-4/+2
| | | | | | | When checking whether an "unpack" packet returned the "ok" status or not, we use a call to `git__prefixcmp`. In case where the passed line isn't properly NUL terminated, though, this may overrun the line buffer. Fix this by using `git__prefixncmp` instead.
* smart_pkt: fix "ng" parser accepting non-space characterPatrick Steinhardt2018-10-031-2/+2
| | | | | | | | | | When parsing "ng" packets, we blindly assume that the character immediately following the "ng" prefix is a space and skip it. As the calling function doesn't make sure that this is the case, we can thus end up blindly accepting an invalid packet line. Fix the issue by using `git__prefixncmp`, checking whether the line starts with "ng ".
* smart_pkt: fix buffer overflow when parsing "ok" packetsPatrick Steinhardt2018-10-031-9/+12
| | | | | | | | | | | | | | | | | | | | | | | | There are two different buffer overflows present when parsing "ok" packets. First, we never verify whether the line already ends after "ok", but directly go ahead and also try to skip the expected space after "ok". Second, we then go ahead and use `strchr` to scan for the terminating newline character. But in case where the line isn't terminated correctly, this can overflow the line buffer. Fix the issues by using `git__prefixncmp` to check for the "ok " prefix and only checking for a trailing '\n' instead of using `memchr`. This also fixes the issue of us always requiring a trailing '\n'. Reported by oss-fuzz, issue 9749: Crash Type: Heap-buffer-overflow READ {*} Crash Address: 0x6310000389c0 Crash State: ok_pkt git_pkt_parse_line git_smart__store_refs Sanitizer: address (ASAN)
* smart_pkt: fix buffer overflow when parsing "ACK" packetsPatrick Steinhardt2018-10-031-14/+23
| | | | | | | | | | | | We are being quite lenient when parsing "ACK" packets. First, we didn't correctly verify that we're not overrunning the provided buffer length, which we fix here by using `git__prefixncmp` instead of `git__prefixcmp`. Second, we do not verify that the actual contents make any sense at all, as we simply ignore errors when parsing the ACKs OID and any unknown status strings. This may result in a parsed packet structure with invalid contents, which is being silently passed to the caller. This is being fixed by performing proper input validation and checking of return codes.
* smart_pkt: adjust style of "ref" packet parsing functionPatrick Steinhardt2018-10-031-25/+19
| | | | | | | | | | While the function parsing ref packets doesn't have any immediately obvious buffer overflows, it's style is different to all the other parsing functions. Instead of checking buffer length while we go, it does a check up-front. This causes the code to seem a lot more magical than it really is due to some magic constants. Refactor the function to instead make use of the style of other packet parser and verify buffer lengths as we go.
* smart_pkt: check whether error packets are prefixed with "ERR "Patrick Steinhardt2018-10-031-2/+9
| | | | | | | | | | | | | | | In the `git_pkt_parse_line` function, we determine what kind of packet a given packet line contains by simply checking for the prefix of that line. Except for "ERR" packets, we always only check for the immediate identifier without the trailing space (e.g. we check for an "ACK" prefix, not for "ACK "). But for "ERR" packets, we do in fact include the trailing space in our check. This is not really much of a problem at all, but it is inconsistent with all the other packet types and thus causes confusion when the `err_pkt` function just immediately skips the space without checking whether it overflows the line buffer. Adjust the check in `git_pkt_parse_line` to not include the trailing space and instead move it into `err_pkt` for consistency.
* smart_pkt: explicitly avoid integer overflows when parsing packetsPatrick Steinhardt2018-10-032-6/+6
| | | | | | | | | | | | | | | | | When parsing data, progress or error packets, we need to copy the contents of the rest of the current packet line into the flex-array of the parsed packet. To keep track of this array's length, we then assign the remaining length of the packet line to the structure. We do have a mismatch of types here, as the structure's `len` field is a signed integer, while the length that we are assigning has type `size_t`. On nearly all platforms, this shouldn't pose any problems at all. The line length can at most be 16^4, as the line's length is being encoded by exactly four hex digits. But on a platforms with 16 bit integers, this assignment could cause an overflow. While such platforms will probably only exist in the embedded ecosystem, we still want to avoid this potential overflow. Thus, we now simply change the structure's `len` member to be of type `size_t` to avoid any integer promotion.
* smart_pkt: honor line length when determining packet typePatrick Steinhardt2018-10-031-6/+6
| | | | | | | | When we parse the packet type of an incoming packet line, we do not verify that we don't overflow the provided line buffer. Fix this by using `git__prefixncmp` instead and passing in `len`. As we have previously already verified that `len <= linelen`, we thus won't ever overflow the provided buffer length.
* Merge pull request #4774 from tiennou/fix/clang-analyzerPatrick Steinhardt2018-08-241-1/+1
|\ | | | | Coverity flavored clang analyzer fixes
| * transport/http: do not return success if we failed to get a schemeEtienne Samson2018-08-211-1/+1
| | | | | | | | Otherwise we return a NULL context, which will get dereferenced in apply_credentials.
* | Fix 'invalid packet line' for ng packets containing errorsChristian Schlack2018-08-171-7/+9
|/
* Merge pull request #4758 from pks-t/pks/smart-pkt-oob-readPatrick Steinhardt2018-08-061-2/+8
|\ | | | | smart_pkt: fix potential OOB-read when processing ng packet
| * smart_pkt: fix potential OOB-read when processing ng packetPatrick Steinhardt2018-07-191-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OSS-fuzz has reported a potential out-of-bounds read when processing a "ng" smart packet: ==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6310000249c0 at pc 0x000000493a92 bp 0x7ffddc882cd0 sp 0x7ffddc882480 READ of size 65529 at 0x6310000249c0 thread T0 SCARINESS: 26 (multi-byte-read-heap-buffer-overflow) #0 0x493a91 in __interceptor_strchr.part.35 /src/llvm/projects/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc:673 #1 0x813960 in ng_pkt libgit2/src/transports/smart_pkt.c:320:14 #2 0x810f79 in git_pkt_parse_line libgit2/src/transports/smart_pkt.c:478:9 #3 0x82c3c9 in git_smart__store_refs libgit2/src/transports/smart_protocol.c:47:12 #4 0x6373a2 in git_smart__connect libgit2/src/transports/smart.c:251:15 #5 0x57688f in git_remote_connect libgit2/src/remote.c:708:15 #6 0x52e59b in LLVMFuzzerTestOneInput /src/download_refs_fuzzer.cc:145:9 #7 0x52ef3f in ExecuteFilesOnyByOne(int, char**) /src/libfuzzer/afl/afl_driver.cpp:301:5 #8 0x52f4ee in main /src/libfuzzer/afl/afl_driver.cpp:339:12 #9 0x7f6c910db82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291 #10 0x41d518 in _start When parsing an "ng" packet, we keep track of both the current position as well as the remaining length of the packet itself. But instead of taking care not to exceed the length, we pass the current pointer's position to `strchr`, which will search for a certain character until hitting NUL. It is thus possible to create a crafted packet which doesn't contain a NUL byte to trigger an out-of-bounds read. Fix the issue by instead using `memchr`, passing the remaining length as restriction. Furthermore, verify that we actually have enough bytes left to produce a match at all. OSS-Fuzz-Issue: 9406
* | Merge pull request #4743 from Agent00Log/dev/winbugfixesEdward Thomson2018-08-021-4/+9
|\ \ | | | | | | Windows: default credentials / fallback credential handling
| * | Only unitialize if the call to CoInitializeEx was successfulHenning Schaffaf2018-07-301-1/+3
| | |
| * | Fix fallback credentials: The call to CoInitializeEx fails if it was ↵Henning Schaffaf2018-07-261-1/+4
| | | | | | | | | | | | previously been set to a different mode.
| * | Fix default credentials: The WinHttpSetCredentials auth scheme must only be ↵Henning Schaffaf2018-07-261-2/+2
| | | | | | | | | | | | one of the supported schemes.
* | | Merge pull request #4731 from libgit2/ethomson/wintls_fixEdward Thomson2018-07-271-14/+18
|\ \ \ | |/ / |/| | winhttp: retry erroneously failing requests
| * | winhttp: retry erroneously failing requestsethomson/wintls_fixEdward Thomson2018-07-201-14/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Early Windows TLS 1.2 implementations have an issue during key exchange with OpenSSL implementations that cause negotiation to fail with the error "the buffer supplied to a function was too small." This is a transient error on the connection, so when that error is received, retry up to 5 times to create a connection to the remote server before actually giving up.
* | | smart subtransport: free url when resetting streamEdward Thomson2018-07-201-0/+5
|/ / | | | | | | Free the url field when resetting the stream to avoid leaking it.
* | Merge pull request #4702 from tiennou/fix/coverityPatrick Steinhardt2018-07-202-18/+22
|\ \ | |/ |/| Assorted Coverity fixes
| * smart: don't dereference a NULL pkt pointerEtienne Samson2018-07-062-12/+15
| | | | | | | | | | | | | | By clarifying what detect_caps returns on empty/missing packet, we can be sure there are actually refs to process. The old code could blindly dereference `first`, which might have been NULL. Reported by Coverity, CID 1393614
| * smart: clarify error handling in git_smart__connectEtienne Samson2018-07-061-8/+9
| |
* | Merge pull request #4704 from nelhage/no-pkt-packPatrick Steinhardt2018-07-193-24/+4
|\ \ | | | | | | Remove GIT_PKT_PACK entirely
| * | No need for this placeholder.Nelson Elhage2018-07-151-1/+0
| | |
| * | This error case is now unneededNelson Elhage2018-06-291-6/+0
| | |
| * | Merge remote-tracking branch 'origin/master' into no-pkt-packNelson Elhage2018-06-293-14/+41
| |\ \
| * | | Small style tweak, and set an errorNelson Elhage2018-06-281-1/+11
| | | |
| * | | Remove GIT_PKT_PACK entirelyNelson Elhage2018-06-262-26/+3
| | | |
* | | | treewide: remove use of C++ style commentsPatrick Steinhardt2018-07-131-3/+3
| |_|/ |/| | | | | | | | | | | | | | | | | | | | | | | C++ style comment ("//") are not specified by the ISO C90 standard and thus do not conform to it. While libgit2 aims to conform to C90, we did not enforce it until now, which is why quite a lot of these non-conforming comments have snuck into our codebase. Do a tree-wide conversion of all C++ style comments to the supported C style comments to allow us enforcing strict C90 compliance in a later commit.
* | | refspec: rename `git_refspec__free` to `git_refspec__dispose`Patrick Steinhardt2018-06-292-2/+2
| |/ |/| | | | | | | | | | | | | | | Since commit 630a67366 (refspec: add public parsing api, 2018-02-07), we now have two functions `git_refspec_free` and `git_refspec__free`. The difference is that the first one will free the structure itself, while the second one will only free the structure's contents. Use our new `dispose` naming pattern for the latter function to help avoid confusion.
* | Merge pull request #4698 from nelhage/fix-leaksEdward Thomson2018-06-273-14/+25
|\ \ | | | | | | Fix assorted leaks found via fuzzing
| * | git_pkt_free: Allow freeing NULLNelson Elhage2018-06-252-10/+8
| | |
View Lorry Controller Status