{"thread":{"id":"29921","subject":"[PATCH v4 2/5] http: handle proxy proactive authentication","startedAt":"2012-03-12T17:26:51Z","lastAt":"2012-03-12T22:25:43Z","messageCount":2,"participants":["Nelson Benitez Leon","Junio C Hamano"],"isPatch":true,"patchVersion":4,"patchTotal":5},"messages":[{"id":"186733","messageId":"4F5E31DB.5050900@seap.minhap.es","threadId":"29921","inReplyTo":null,"subject":"[PATCH v4 2/5] http: handle proxy proactive authentication","fromName":"Nelson Benitez Leon","fromEmail":"nelsonjesus.benitez@seap.minhap.es","sentAt":"2012-03-12T17:26:51Z","receivedAt":"2012-03-12T17:26:51Z","isPatch":true,"sender":{"key":"nelsonjesus.benitez@seap.minhap.es","avatar":null},"body":"If http_proactive_auth flag is set and there is a username\nbut no password in the proxy url, then interactively ask for\nthe password.\n\nThis makes possible to not have the password written down in\nhttp_proxy env var or in http.proxy config option.\n\nAlso take care that CURLOPT_PROXY don't include username or\npassword, as we now set them in the new set_proxy_auth() function\nwhere we use their specific cURL options.\n\nSigned-off-by: Nelson Benitez Leon <nbenitezl@gmail.com>\n---\n http.c |   27 ++++++++++++++++++++++++++-\n 1 files changed, 26 insertions(+), 1 deletions(-)\n\ndiff --git a/http.c b/http.c\nindex 8932da5..dbdbc3f 100644\n--- a/http.c\n+++ b/http.c\n@@ -43,6 +43,7 @@ static int curl_ftp_no_epsv;\n static const char *curl_http_proxy;\n static const char *curl_cookie_file;\n static struct credential http_auth = CREDENTIAL_INIT;\n+static struct credential proxy_auth = CREDENTIAL_INIT;\n static int http_proactive_auth;\n static const char *user_agent;\n \n@@ -232,6 +233,20 @@ static int has_cert_password(void)\n \treturn 1;\n }\n \n+static void set_proxy_auth(CURL *result)\n+{\n+\tif (proxy_auth.username && proxy_auth.password) {\n+#if LIBCURL_VERSION_NUM >= 0x071901\n+\t\tcurl_easy_setopt(result, CURLOPT_PROXYUSERNAME, proxy_auth.username);\n+\t\tcurl_easy_setopt(result, CURLOPT_PROXYPASSWORD, proxy_auth.password);\n+#else\n+\t\tchar userpwd[100];\n+\t\tsnprintf(userpwd, 100, \"%s:%s\", proxy_auth.username, proxy_auth.password);\n+\t\tcurl_easy_setopt(result, CURLOPT_PROXYUSERPWD, userpwd);\n+#endif\n+\t}\n+}\n+\n static CURL *get_curl_handle(void)\n {\n \tCURL *result = curl_easy_init();\n@@ -303,8 +318,18 @@ static CURL *get_curl_handle(void)\n \t\t}\n \t}\n \tif (curl_http_proxy) {\n-\t\tcurl_easy_setopt(result, CURLOPT_PROXY, curl_http_proxy);\n+\t\tif (!proxy_auth.host) { // check to parse only once\n+\t\t\tcredential_from_url(&proxy_auth, curl_http_proxy);\n+\t\t}\n+\t\tif (http_proactive_auth && proxy_auth.username && !proxy_auth.password) {\n+\t\t\t/* proxy string has username but no password, ask for password */\n+\t\t\tcredential_fill(&proxy_auth);\n+\t\t}\n+\t\tchar proxyhost[100];\n+\t\tsnprintf(proxyhost, 100, \"%s://%s\", proxy_auth.protocol, proxy_auth.host);\n+\t\tcurl_easy_setopt(result, CURLOPT_PROXY, proxyhost);\n \t\tcurl_easy_setopt(result, CURLOPT_PROXYAUTH, CURLAUTH_ANY);\n+\t\tset_proxy_auth(result);\n \t}\n \n \treturn result;\n-- \n1.7.7.6\n"},{"id":"186799","messageId":"7vk42po3rs.fsf@alter.siamese.dyndns.org","threadId":"29921","inReplyTo":"4F5E31DB.5050900@seap.minhap.es","subject":"Re: [PATCH v4 2/5] http: handle proxy proactive authentication","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2012-03-12T22:25:43Z","receivedAt":"2012-03-12T22:25:43Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Nelson Benitez Leon <nelsonjesus.benitez@seap.minhap.es> writes:\n\n> If http_proactive_auth flag is set and there is a username\n> but no password in the proxy url, then interactively ask for\n> the password.\n>\n> This makes possible to not have the password written down in\n> http_proxy env var or in http.proxy config option.\n>\n> Also take care that CURLOPT_PROXY don't include username or\n> password, as we now set them in the new set_proxy_auth() function\n> where we use their specific cURL options.\n>\n> Signed-off-by: Nelson Benitez Leon <nbenitezl@gmail.com>\n> ---\n>  http.c |   27 ++++++++++++++++++++++++++-\n>  1 files changed, 26 insertions(+), 1 deletions(-)\n\nJust a minor style nit first so that we do not have to go ping-pong\non the trivialities.\n\n> @@ -303,8 +318,18 @@ static CURL *get_curl_handle(void)\n>  \t\t}\n>  \t}\n>  \tif (curl_http_proxy) {\n> -\t\tcurl_easy_setopt(result, CURLOPT_PROXY, curl_http_proxy);\n> +\t\tif (!proxy_auth.host) { // check to parse only once\n\nNo C99 // comments.\n\n> +\t\t\tcredential_from_url(&proxy_auth, curl_http_proxy);\n> +\t\t}\n> +\t\tif (http_proactive_auth && proxy_auth.username && !proxy_auth.password) {\n> +\t\t\t/* proxy string has username but no password, ask for password */\n> +\t\t\tcredential_fill(&proxy_auth);\n> +\t\t}\n\nNo {} around single statement block (this comment applies also to\nthe previous \"if (!proxy_auth.host)\").\n\n> +\t\tchar proxyhost[100];\n\nNo decl-after-statement.\n\n> +\t\tsnprintf(proxyhost, 100, \"%s://%s\", proxy_auth.protocol, proxy_auth.host);\n\nWouldn't it be far more pleasant if you used strbuf_addf() for\nthings like this?  That way you do not have to wonder if a 100-byte\nbuffer is too small.\n\n> +\t\tcurl_easy_setopt(result, CURLOPT_PROXY, proxyhost);\n>  \t\tcurl_easy_setopt(result, CURLOPT_PROXYAUTH, CURLAUTH_ANY);\n> +\t\tset_proxy_auth(result);\n>  \t}\n>  \n>  \treturn result;\n"}]}