From: Áshin László Date: Tue, 06 Jul 2010 17:34:43 GMT Subject: [PATCH 1/5] git-cvsserver: implement script based pserver auth Message-ID: In-Reply-To: <449772932078145114@unknownmsgid> ---  Documentation/git-cvsserver.txt |   42 +++++++++++++++++++++++++++---  git-cvsserver.perl              |   34 ++++++++++++++++++++++++  t/t9400-git-cvsserver-server.sh |   55 +++++++++++++++++++++++++++++++++++++++  3 files changed, 127 insertions(+), 4 deletions(-) diff --git a/Documentation/git-cvsserver.txt b/Documentation/git-cvsserver.txt index 7004dd2..59c8e5d 100644 --- a/Documentation/git-cvsserver.txt +++ b/Documentation/git-cvsserver.txt @@ -100,10 +100,44 @@ looks like  ------  Only anonymous access is provided by pserve by default. To commit you -will have to create pserver accounts, simply add a gitcvs.authdb -setting in the config file of the repositories you want the cvsserver -to allow writes to, for example: +will have to specify an authentication option in the config file. +Currently there are two options are available for authentication through +pserver in git-cvsserver: one through an authenticator script and an other +through a textual authentication database. + +  a. To use the authentication script based method, simply add a +     gitcvs.authscript setting in the config file of the repositories you want +     the cvsserver to allow writes to, for example: ++ +-- +------ + +   [gitcvs] +    authscript = /usr/local/bin/cvsserver-auth.sh + +------ +The file specified here must be executable by the user the git-cvsserver runs +under. The script will receive two lines on standard input, the first is the +username and the second is the password. It should return 0 if the user was +successfully authenticated, and a non-zero value if not. +Here is an example for an authentication script which checks the users against +active directory: +------ +#!/bin/sh +# /usr/local/bin/cvsserver-auth.sh +read username +read password + +wbinfo -a "${username}%${password}" +------ +-- + +  b. To use the authentication database based method, simply add a +     gitcvs.authdb setting in the config file of the repositories you want the +     cvsserver to allow writes to, for example: ++ +--  ------    [gitcvs] @@ -125,7 +159,7 @@ Alternatively you can produce the password with perl's crypt() operator:  -----    perl -e 'my ($user, $pass) = @ARGV; printf "%s:%s\n", $user, crypt($user, $pass)' $USER password  ----- - +--  Then provide your password via the pserver method, for example:  ------    cvs -d:pserver:someuser:somepassword server/path/repo.git co diff --git a/git-cvsserver.perl b/git-cvsserver.perl index e9f3037..c89d999 100755 --- a/git-cvsserver.perl +++ b/git-cvsserver.perl @@ -197,6 +197,40 @@ if ($state->{method} eq 'pserver') {         }         # Fall through to LOVE +    } elsif (exists $cfg->{gitcvs}->{authscript} and +             exists $cfg->{gitcvs}->{authdb}) { +        print "E Ambiguous configuration of authentication methods. " . +            "Only one authentication method can be enabled at once\n"; +        print "I HATE YOU\n"; +        exit 1; +    } elsif (exists $cfg->{gitcvs}->{authscript}) { +        my $authscript = $cfg->{gitcvs}->{authscript}; + +        unless (-x $authscript) { +            print "E The authentication script specified in " . +                "[gitcvs.authscript] cannot be executed\n"; +            print "I HATE YOU\n"; +            exit 1; +        } + +        open my $script_fd, '|-', "'$authscript'" +            or die "Couldn't open authentication script '$authscript': $!"; + +        if (length($password) > 0) { +            $password = descramble($password); +        } + +        print $script_fd "$user\n"; +        print $script_fd "$password\n"; +        close $script_fd; + +        unless ($? == 0) { +            print "E External script authentication failed.\n"; +            print "I HATE YOU\n"; +            exit 1; +        } + +        # Fall through to LOVE     } else {         # Trying to authenticate a user         if (not exists $cfg->{gitcvs}->{authdb}) { diff --git a/t/t9400-git-cvsserver-server.sh b/t/t9400-git-cvsserver-server.sh index 8639506..ab5cb26 100755 --- a/t/t9400-git-cvsserver-server.sh +++ b/t/t9400-git-cvsserver-server.sh @@ -64,6 +64,16 @@ test_expect_success 'basic checkout' \  # PSERVER AUTHENTICATION  #------------------------ +cat >"$SERVERDIR/authscript.sh" <request-anonymous  <log 2>&1 +   then +       false +   else +       true +   fi && +   sed -ne \$p log | grep "^I HATE YOU\$"' + +GIT_DIR="$SERVERDIR" git config --unset gitcvs.authdb || exit 1 + +test_expect_success 'pserver authentication (authscript)' \ +  'cat request-anonymous | git-cvsserver pserver >log 2>&1 && +   sed -ne \$p log | grep "^I LOVE YOU\$"' + +test_expect_success 'pserver authentication failure (authscript, non-anonymous user)' \ +  'if cat request-git | git-cvsserver pserver >log 2>&1 +   then +       false +   else +       true +   fi && +   sed -ne \$p log | grep "^I HATE YOU\$"' + +test_expect_success 'pserver authentication success (authscript, non-anonymous user with password)' \ +  'cat login-git-ok | git-cvsserver pserver >log 2>&1 && +   sed -ne \$p log | grep "^I LOVE YOU\$"' + +test_expect_success 'pserver authentication (authscript, login)' \ +  'cat login-anonymous | git-cvsserver pserver >log 2>&1 && +   sed -ne \$p log | grep "^I LOVE YOU\$"' + +test_expect_success 'pserver authentication failure (authscript, login/non-anonymous user)' \ +  'if cat login-git | git-cvsserver pserver >log 2>&1 +   then +       false +   else +       true +   fi && +   sed -ne \$p log | grep "^I HATE YOU\$"' + +GIT_DIR="$SERVERDIR" git config --unset gitcvs.authscript || exit 1 +GIT_DIR="$SERVERDIR" git config gitcvs.authdb "$SERVERDIR/auth.db" || exit 1  # misuse pserver authentication for testing of req_Root -- 1.7.0.4