{"thread":{"id":"29004","subject":"[PATCH] Fix https interactive authentication problem","startedAt":"2011-11-23T07:58:02Z","lastAt":"2011-11-25T12:10:26Z","messageCount":3,"participants":["Steinmann Ruedi","Jeff King","Ruedi Steinmann"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"179861","messageId":"F6A589D6B10801478E0DE246A9EF187C1BD5E8@MBX12.d.ethz.ch","threadId":"29004","inReplyTo":null,"subject":"[PATCH] Fix https interactive authentication problem","fromName":"Steinmann Ruedi","fromEmail":"ruediste@student.ethz.ch","sentAt":"2011-11-23T07:58:02Z","receivedAt":"2011-11-23T07:58:02Z","isPatch":true,"sender":{"key":"ruediste@student.ethz.ch","avatar":null},"body":">From 986e29085ee2215a3e0a412ee7874dc2d0ef36be Mon Sep 17 00:00:00 2001\nFrom: Ruedi Steinmann <ruediste@student.ethz.ch>\nDate: Wed, 23 Nov 2011 08:41:52 +0100\nSubject: [PATCH] Fix https interactive authentication problem\n\nCloning a repository over https works fine when the username/password is\ngiven in the URL. But if it is queried interactively, an error occurs(see below).\nI found that the username/password is not set when a connection is reused.\n\nWith this patch, the username/password is set whenever a connection is reused.\n\nSample output showing the error:\n\ngit clone https://n.ethz.ch/student/...\nCloning into ...\nUsername:\nPassword:\nerror: Unable to get pack file https://n.ethz.ch/student/.../objects/pack/pack-1ced2ebff0c9fc1f07e0c7cc9dd3fc75f6ac6962.pack\nThe requested URL returned error: 401\n...\nerror: Fetch failed.\n\n\nSigned-off-by: Ruedi Steinmann <ruediste@student.ethz.ch>\n---\n http.c |    5 ++++-\n 1 files changed, 4 insertions(+), 1 deletions(-)\n\ndiff --git a/http.c b/http.c\nindex e6c7597..c7b3558 100644\n--- a/http.c\n+++ b/http.c\n@@ -550,7 +550,10 @@ struct active_request_slot *get_active_slot(void)\n     curl_easy_setopt(slot->curl, CURLOPT_POSTFIELDS, NULL);\n     curl_easy_setopt(slot->curl, CURLOPT_UPLOAD, 0);\n     curl_easy_setopt(slot->curl, CURLOPT_HTTPGET, 1);\n-\n+\n+    // set username and password if already set\n+    init_curl_http_auth(slot->curl);\n+\n     return slot;\n }\n\n--\n1.7.5.4\n"},{"id":"179920","messageId":"20111123225121.GA23357@sigill.intra.peff.net","threadId":"29004","inReplyTo":"F6A589D6B10801478E0DE246A9EF187C1BD5E8@MBX12.d.ethz.ch","subject":"Re: [PATCH] Fix https interactive authentication problem","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2011-11-23T22:51:21Z","receivedAt":"2011-11-23T22:51:21Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Wed, Nov 23, 2011 at 07:58:02AM +0000, Steinmann  Ruedi wrote:\n\n> Cloning a repository over https works fine when the username/password is\n> given in the URL. But if it is queried interactively, an error occurs(see below).\n> I found that the username/password is not set when a connection is reused.\n> \n> With this patch, the username/password is set whenever a connection is reused.\n> \n> Sample output showing the error:\n> \n> git clone https://n.ethz.ch/student/...\n> Cloning into ...\n> Username:\n> Password:\n> error: Unable to get pack file https://n.ethz.ch/student/.../objects/pack/pack-1ced2ebff0c9fc1f07e0c7cc9dd3fc75f6ac6962.pack\n> The requested URL returned error: 401\n> ...\n> error: Fetch failed.\n\nHmm. What version of git are you using?\n\nWe used to always set up the auth information in get_curl_handle, so all\nhandles had any auth information that we already got. But we removed\nthat recently in 986bbc0 (http: don't always prompt for password,\n2011-11-04), which is in v1.7.8-rc1 and later.\n\nI'm wondering if this was an unintended side effect of that patch.\n\nUsually git will notice the 401 and retry with credentials (requesting\nthem from the user if necessary). That used to not work for all requests\nbut I fixed that in 8d677ed (http: retry authentication failures for all\nhttp requests, 2011-07-18), which is also in v1.7.8-rc*.\n\nHowever, it looks like the packfile-fetching code for dumb http does not\nactually go through the usual http_request method, and does not\nrecognize the 401.\n\nSo if you are using v1.7.8-rc*, then I think that is the issue. And your\npatch is just undoing what 8d677ed did. But the right fix is to refactor\nthe packfile-fetching function on top of the other http-fetching code,\nso it can get the benefit of that logic.\n\nIf you are using an older version of git (pre-8d677ed), then one guess\nabout what is happening is a race condition with setting up multiple\ncurl handles:\n\n  1. we get curl handle 1 from get_curl_handle, calling\n     init_curl_http_auth. But we have no username in the url, so we\n     assume no credentials are needed.\n\n  2. we get curl handle 2 from get_curl_handle, as above.\n\n  3. we make a request on handle one, get a 401, and ask for\n     credentials.\n\n  4. we make a request for a packfile on handle 2, but we never copied\n     the auth from step (3) into the curl handle from step (2), and it\n     fails.\n\n(I haven't looked closely at our usage of curl_multi_*, so I am not 100%\nsure that this can even happen. So consider it just a theory).\n\nIf this is the case, your fix works because it calls init_curl_http_auth\nmore often (i.e., before making any request, not just when we create the\nhandle). But that means it is also undoing what 8d677ed did; we will ask\nthe user for credentials before actually seeing a 401.\n\nWe could still fix this by teaching the packfile-fetching code to\nrespect 401s. However, it does incur an unnecessary round-trip (we\nalready know from the other request that credentials are required, but\nwe don't bother to use them).\n\nSo I think the logic you want instead is \"if we already have\ncredentials, use them with this curl slot, but otherwise don't bother\nthe user\". Which would mean splitting the prompting bit out of\ninit_curl_http_auth.\n\n-Peff\n"},{"id":"179964","messageId":"loom.20111125T125630-755@post.gmane.org","threadId":"29004","inReplyTo":"20111123225121.GA23357@sigill.intra.peff.net","subject":"Re: [PATCH] Fix https interactive authentication problem","fromName":"Ruedi Steinmann","fromEmail":"ruediste@student.ethz.ch","sentAt":"2011-11-25T12:10:26Z","receivedAt":"2011-11-25T12:10:26Z","isPatch":true,"sender":{"key":"ruediste@student.ethz.ch","avatar":null},"body":"Jeff King <peff <at> peff.net> writes:\n\n> \n> Hmm. What version of git are you using?\n> \n\nHi Jeff,\n\nI'm a little short of time at the moment, I'll come to this back later. So just\nthe quick infos. I discovered the error in my preinstalled version of git\n(1.7.5.4). I reproduced the error with the version of git I have the source code\nof: (which I should have done before, sorry)\n\n../git/git/git clone https://n.ethz.ch/...\nCloning into 'masterthesis'...\nwarning: templates not found /home/ruedi/share/git-core/templates\nUsername for 'n.ethz.ch': \nPassword for 'n.ethz.ch': \nerror: The requested URL returned error: 401 (curl_result = 22, http_code = 401,\nsha1 = 4e69f4215f0d8c02ec1c29aadcd4ea39bb4e7c5e)\nerror: Unable to find 4e69f4215f0d8c02ec1c29aadcd4ea39bb4e7c5e under\nhttps://n.ethz.ch/.../masterthesis.git\nCannot obtain needed commit 4e69f4215f0d8c02ec1c29aadcd4ea39bb4e7c5e\nwhile processing commit 0fa41a9d4b3282891173ec54c04e0e3763867807.\nerror: Fetch failed.\n\nI am working with the git repository from https://github.com/gitster/git.git.\n\n>From the first few lines of my commit from gitk:\n\nParent: 017d1e134545db0d162908f3538077eaa1f34fb6 (Update 1.7.8 draft release\nnotes in preparation for rc4)\nBranch: master\nFollows: v1.7.7.4, v1.7.8-rc3\n\nHope this helps\n\nCheers\nRuedi\n"}]}