{"thread":{"id":"18870","subject":"[PATCH] Add an option for using any HTTP authentication scheme, not only basic","startedAt":"2009-04-14T20:52:11Z","lastAt":"2009-04-14T21:42:29Z","messageCount":4,"participants":["Martin Storsjö","Johannes Schindelin"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"111318","messageId":"Pine.LNX.4.64.0904142350140.7479@localhost.localdomain","threadId":"18870","inReplyTo":null,"subject":"[PATCH] Add an option for using any HTTP authentication scheme, not only basic","fromName":"Martin Storsjö","fromEmail":"martin@martin.st","sentAt":"2009-04-14T20:52:11Z","receivedAt":"2009-04-14T20:52:11Z","isPatch":true,"sender":{"key":"martin@martin.st","avatar":"https://avatars.githubusercontent.com/u/69727?v=4"},"body":"This adds the configuration option http.authAny (overridable with\nthe environment variable GIT_HTTP_AUTH_ANY), for instructing curl\nto allow any HTTP authentication scheme, not only basic (which\nsends the password in plaintext).\n\nWhen this is enabled, curl has to do double requests most of the time,\nin order to discover which HTTP authentication method to use, which\nlowers the performance slightly. Therefore this isn't enabled by default.\n\nOne example of another authentication scheme to use is digest, which\ndoesn't send the password in plaintext, but uses a challenge-response\nmechanism instead. Using digest authentication in practice requires\nat least curl 7.18.2, due to bugs in the digest handling in earlier\nversions of curl.\n\nSigned-off-by: Martin Storsjo <martin@martin.st>\n---\n\nThis is a resend of a patch I sent a few weeks ago. Now this functionality\nis configurable and disabled by default.\n\n Documentation/config.txt |    7 +++++++\n http.c                   |   18 ++++++++++++++++++\n 2 files changed, 25 insertions(+), 0 deletions(-)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex f3ebd2f..1515d77 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -1011,6 +1011,13 @@ http.noEPSV::\n \tsupport EPSV mode. Can be overridden by the 'GIT_CURL_FTP_NO_EPSV'\n \tenvironment variable. Default is false (curl will use EPSV).\n \n+http.authAny::\n+\tAllow any HTTP authentication method, not only basic. Enabling\n+\tthis lowers the performance slightly, by having to do requests\n+\twithout any authentication to discover the authentication method\n+\tto use. Can be overridden by the 'GIT_HTTP_AUTH_ANY'\n+\tenvironment variable. Default is false.\n+\n i18n.commitEncoding::\n \tCharacter encoding the commit messages are stored in; git itself\n \tdoes not care per se, but this information is necessary e.g. when\ndiff --git a/http.c b/http.c\nindex 2e3d649..0b18c64 100644\n--- a/http.c\n+++ b/http.c\n@@ -26,6 +26,9 @@ static long curl_low_speed_time = -1;\n static int curl_ftp_no_epsv;\n static const char *curl_http_proxy;\n static char *user_name, *user_pass;\n+#if LIBCURL_VERSION_NUM >= 0x070a06\n+static int curl_http_auth_any = 0;\n+#endif\n \n static struct curl_slist *pragma_header;\n \n@@ -150,6 +153,12 @@ static int http_options(const char *var, const char *value, void *cb)\n \t}\n \tif (!strcmp(\"http.proxy\", var))\n \t\treturn git_config_string(&curl_http_proxy, var, value);\n+#if LIBCURL_VERSION_NUM >= 0x070a06\n+\tif (!strcmp(\"http.authany\", var)) {\n+\t\tcurl_http_auth_any = git_config_bool(var, value);\n+\t\treturn 0;\n+\t}\n+#endif\n \n \t/* Fall back on the default ones */\n \treturn git_default_config(var, value, cb);\n@@ -184,6 +193,10 @@ static CURL *get_curl_handle(void)\n #if LIBCURL_VERSION_NUM >= 0x070907\n \tcurl_easy_setopt(result, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);\n #endif\n+#if LIBCURL_VERSION_NUM >= 0x070a06\n+\tif (curl_http_auth_any)\n+\t\tcurl_easy_setopt(result, CURLOPT_HTTPAUTH, CURLAUTH_ANY);\n+#endif\n \n \tinit_curl_http_auth(result);\n \n@@ -329,6 +342,11 @@ void http_init(struct remote *remote)\n \tif (getenv(\"GIT_CURL_FTP_NO_EPSV\"))\n \t\tcurl_ftp_no_epsv = 1;\n \n+#if LIBCURL_VERSION_NUM >= 0x070a06\n+\tif (getenv(\"GIT_HTTP_AUTH_ANY\"))\n+\t\tcurl_http_auth_any = 1;\n+#endif\n+\n \tif (remote && remote->url && remote->url[0])\n \t\thttp_auth_init(remote->url[0]);\n \n-- \n1.6.0.2\n"},{"id":"111320","messageId":"alpine.DEB.1.00.0904142307110.10279@pacific.mpi-cbg.de","threadId":"18870","inReplyTo":"Pine.LNX.4.64.0904142350140.7479@localhost.localdomain","subject":"Re: [PATCH] Add an option for using any HTTP authentication scheme, not only basic","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2009-04-14T21:08:36Z","receivedAt":"2009-04-14T21:08:36Z","isPatch":true,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Tue, 14 Apr 2009, Martin Storsjö wrote:\n\n> diff --git a/http.c b/http.c\n> index 2e3d649..0b18c64 100644\n> --- a/http.c\n> +++ b/http.c\n> @@ -26,6 +26,9 @@ static long curl_low_speed_time = -1;\n>  static int curl_ftp_no_epsv;\n>  static const char *curl_http_proxy;\n>  static char *user_name, *user_pass;\n> +#if LIBCURL_VERSION_NUM >= 0x070a06\n> +static int curl_http_auth_any = 0;\n> +#endif\n\nIn six months from now, it might be easier to read\n\n#if LIBCURL_VERSION_NUM >= 0x070a06\n#define LIBCURL_CAN_HANDLE_ANY_AUTH\n#endif\n\n[...]\n\n#ifdef LIBCURL_CAN_HANDLE_ANY_AUTH\n[...]\n\nDon't you agree?\n\nThanks,\nDscho"},{"id":"111324","messageId":"Pine.LNX.4.64.0904150007130.7479@localhost.localdomain","threadId":"18870","inReplyTo":"alpine.DEB.1.00.0904142307110.10279@pacific.mpi-cbg.de","subject":"Re: [PATCH] Add an option for using any HTTP authentication scheme, not only basic","fromName":"Martin Storsjö","fromEmail":"martin@martin.st","sentAt":"2009-04-14T21:15:54Z","receivedAt":"2009-04-14T21:15:54Z","isPatch":true,"sender":{"key":"martin@martin.st","avatar":"https://avatars.githubusercontent.com/u/69727?v=4"},"body":"Hi,\n\nOn Tue, 14 Apr 2009, Johannes Schindelin wrote:\n\n> In six months from now, it might be easier to read\n> \n> #if LIBCURL_VERSION_NUM >= 0x070a06\n> #define LIBCURL_CAN_HANDLE_ANY_AUTH\n> #endif\n> \n> [...]\n> \n> #ifdef LIBCURL_CAN_HANDLE_ANY_AUTH\n> [...]\n> \n> Don't you agree?\n\nYeah, absolutely.\n\nAny comments on the naming of options and env variables? Otherwise, I'll \nresend an updated version soon.\n\n// Martin\n"},{"id":"111327","messageId":"alpine.DEB.1.00.0904142342130.10279@pacific.mpi-cbg.de","threadId":"18870","inReplyTo":"Pine.LNX.4.64.0904150007130.7479@localhost.localdomain","subject":"Re: [PATCH] Add an option for using any HTTP authentication scheme, not only basic","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2009-04-14T21:42:29Z","receivedAt":"2009-04-14T21:42:29Z","isPatch":true,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Wed, 15 Apr 2009, Martin Storsjö wrote:\n\n> On Tue, 14 Apr 2009, Johannes Schindelin wrote:\n> \n> > In six months from now, it might be easier to read\n> > \n> > #if LIBCURL_VERSION_NUM >= 0x070a06\n> > #define LIBCURL_CAN_HANDLE_ANY_AUTH\n> > #endif\n> > \n> > [...]\n> > \n> > #ifdef LIBCURL_CAN_HANDLE_ANY_AUTH\n> > [...]\n> > \n> > Don't you agree?\n> \n> Yeah, absolutely.\n> \n> Any comments on the naming of options and env variables? Otherwise, I'll \n> resend an updated version soon.\n\nThey sound sensible enough to me!\n\nThanks,\nDscho\n"}]}