git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH v2 18/19] signed push: remove duplicated protocol info

From
Junio C Hamano <gitster@pobox.com>
Date
Aug 22, 2014, 20:30 UTC
Message-ID
<1408739424-31429-19-git-send-email-gitster@pobox.com>
In-Reply-To
<1408739424-31429-1-git-send-email-gitster@pobox.com>

With the interim protocol, we used to send the update commands even though we already send a signed copy of the same information when push certificate is in use. Update the send-pack/receive-pack pair not to do so.

The notable thing on the receive-pack side is that it makes sure that there is no command sent over the traditional protocol packet outside the push certificate. Otherwise a pusher can claim to be pushing one set of ref updates in the signed certificate while issuing commands to update unrelated refs, and such an update will evade later audits.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 Documentation/technical/pack-protocol.txt         | 20 ++++++++++++++-
 Documentation/technical/protocol-capabilities.txt | 12 +++++++--
 builtin/receive-pack.c                            | 30 +++++++++++++++++++++--
 send-pack.c                                       |  2 +-
 4 files changed, 58 insertions(+), 6 deletions(-)
diff --git a/Documentation/technical/pack-protocol.txt b/Documentation/technical/pack-protocol.txt
index a845d51..b86580b 100644
--- a/Documentation/technical/pack-protocol.txt
+++ b/Documentation/technical/pack-protocol.txt
@@ -465,7 +465,7 @@ contain all the objects that the server will need to complete the new
 references.
 
 ----
-  update-request    =  *shallow command-list [pack-file]
+  update-request    =  *shallow ( command-list | push-cert ) [pack-file]
 
   shallow           =  PKT-LINE("shallow" SP obj-id)
 
@@ -481,12 +481,30 @@ references.
   old-id            =  obj-id
   new-id            =  obj-id
 
+  push-cert         = PKT-LINE("push-cert" NUL capability-list LF)
+		      PKT-LINE("certificate version 0.1" LF)
+		      PKT-LINE("pusher" ident LF)
+		      PKT-LINE(LF)
+		      *PKT-LINE(command LF)
+		      *PKT-LINE(GPG signature lines LF)
+		      PKT-LINE("push-cert-end" LF)
+
   pack-file         = "PACK" 28*(OCTET)
 ----
 
 If the receiving end does not support delete-refs, the sending end MUST
 NOT ask for delete command.
 
+If the receiving end does not support push-cert, the sending end MUST
+NOT send a push-cert command.
+
+When a push-cert command is sent, command-list MUST NOT be sent; the
+commands recorded in the push certificate is used instead.  The GPG
+signature lines are a detached signature for the contents recorded in
+the push certificate before the signature block begins and are used
+to certify that the commands were given by the pusher, who must be
+the signer.
+
 The pack-file MUST NOT be sent if the only command used is 'delete'.
 
 A pack-file MUST be sent if either create or update command is used,
diff --git a/Documentation/technical/protocol-capabilities.txt b/Documentation/technical/protocol-capabilities.txt
index e174343..a478cc4 100644
--- a/Documentation/technical/protocol-capabilities.txt
+++ b/Documentation/technical/protocol-capabilities.txt
@@ -18,8 +18,8 @@ was sent.  Server MUST NOT ignore capabilities that client requested
 and server advertised.  As a consequence of these rules, server MUST
 NOT advertise capabilities it does not understand.
 
-The 'report-status', 'delete-refs', and 'quiet' capabilities are sent and
-recognized by the receive-pack (push to server) process.
+The 'report-status', 'delete-refs', 'quiet', and 'push-cert' capabilities
+are sent and recognized by the receive-pack (push to server) process.
 
 The 'ofs-delta' and 'side-band-64k' capabilities are sent and recognized
 by both upload-pack and receive-pack protocols.  The 'agent' capability
@@ -250,3 +250,11 @@ allow-tip-sha1-in-want
 If the upload-pack server advertises this capability, fetch-pack may
 send "want" lines with SHA-1s that exist at the server but are not
 advertised by upload-pack.
+
+push-cert
+---------
+
+The receive-pack server that advertises this capability is willing
+to accept a signed push certificate.  A send-pack client MUST NOT
+send a push-cert packet unless the receive-pack server advertises
+this capability.
diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c
index abdc296..991e417 100644
--- a/builtin/receive-pack.c
+++ b/builtin/receive-pack.c
@@ -880,7 +880,7 @@ static void execute_commands(struct command *commands,
 		      "the reported refs above");
 }
 
-static struct command **queue_command(struct command **p,
+static struct command **queue_command(struct command **tail,
 				      const char *line,
 				      int linelen)
 {
@@ -903,10 +903,32 @@ static struct command **queue_command(struct command **p,
 	hashcpy(cmd->new_sha1, new_sha1);
 	memcpy(cmd->ref_name, refname, reflen);
 	cmd->ref_name[reflen] = '\0';
-	*p = cmd;
+	*tail = cmd;
 	return &cmd->next;
 }
 
+static void queue_commands_from_cert(struct command **tail,
+				     struct strbuf *push_cert)
+{
+	const char *boc, *eoc;
+
+	if (*tail)
+		die("protocol error: got both push certificate and unsigned commands");
+
+	boc = strstr(push_cert->buf, "\n\n");
+	if (!boc)
+		die("malformed push certificate %.*s", 100, push_cert->buf);
+	else
+		boc += 2;
+	eoc = push_cert->buf + parse_signature(push_cert->buf, push_cert->len);
+
+	while (boc < eoc) {
+		const char *eol = memchr(boc, '\n', eoc - boc);
+		tail = queue_command(tail, boc, eol ? eol - boc : eoc - eol);
+		boc = eol ? eol + 1 : eoc;
+	}
+}
+
 static struct command *read_head_info(struct sha1_array *shallow)
 {
 	struct command *commands = NULL;
@@ -962,6 +984,10 @@ static struct command *read_head_info(struct sha1_array *shallow)
 
 		p = queue_command(p, line, linelen);
 	}
+
+	if (push_cert.len)
+		queue_commands_from_cert(p, &push_cert);
+
 	return commands;
 }
 
diff --git a/send-pack.c b/send-pack.c
index 4125892..61f321d 100644
--- a/send-pack.c
+++ b/send-pack.c
@@ -363,7 +363,7 @@ int send_pack(struct send_pack_args *args,
 	for (ref = remote_refs; ref; ref = ref->next) {
 		char *old_hex, *new_hex;
 
-		if (args->dry_run)
+		if (args->dry_run || args->push_cert)
 			continue;
 
 		if (!ref_update_to_be_sent(ref, args))

-- 
2.1.0-304-g950f846
Previous: Junio C HamanoNext: Junio C Hamano
Message 19 of 23 in “Signed push”
  1. 00/19 Signed pushJunio C Hamano, Aug 22, 2014
  2. 01/19 receive-pack: do not overallocate command structureJunio C Hamano, Aug 22, 2014
  3. 02/19 receive-pack: parse feature request a bit earlierJunio C Hamano, Aug 22, 2014
  4. 03/19 receive-pack: do not reuse old_sha1[] for other thingsJunio C Hamano, Aug 22, 2014
  5. 04/19 receive-pack: factor out queueing of commandJunio C Hamano, Aug 22, 2014
  6. 05/19 send-pack: move REF_STATUS_REJECT_NODELETE logic a bit higherJunio C Hamano, Aug 22, 2014
  7. 06/19 send-pack: refactor decision to send update per refJunio C Hamano, Aug 22, 2014
  8. 07/19 send-pack: always send capabilitiesJunio C Hamano, Aug 22, 2014
  9. 08/19 send-pack: factor out capability string generationJunio C Hamano, Aug 22, 2014
  10. 09/19 send-pack: rename "new_refs" to "need_pack_data"Junio C Hamano, Aug 22, 2014
  11. 10/19 send-pack: refactor inspecting and resetting status and sending commandsJunio C Hamano, Aug 22, 2014
  12. 11/19 send-pack: clarify that cmds_sent is a booleanJunio C Hamano, Aug 22, 2014
  13. 12/19 gpg-interface: move parse_gpg_output() to where it should beJunio C Hamano, Aug 22, 2014
  14. 13/19 gpg-interface: move parse_signature() to where it should beJunio C Hamano, Aug 22, 2014
  15. 14/19 pack-protocol doc: typofix for PKT-LINEJunio C Hamano, Aug 22, 2014
  16. 15/19 the beginning of the signed pushJunio C Hamano, Aug 22, 2014
  17. 16/19 receive-pack: GPG-validate push certificatesJunio C Hamano, Aug 22, 2014
  18. 17/19 send-pack: send feature request on push-cert packetJunio C Hamano, Aug 22, 2014
  19. 18/19 signed push: remove duplicated protocol infoJunio C Hamano, Aug 22, 2014
  20. 19/19 signed push: fortify against replay attacksJunio C Hamano, Aug 22, 2014
  21. Eric SunshineAug 24, 2014
  22. Stefan BellerAug 30, 2014
  23. Junio C HamanoSep 2, 2014

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.