# [PATCH v4 2/5] http: handle proxy proactive authentication

2 messages from 2012-03-12 to 2012-03-12. Participants: Nelson Benitez Leon, Junio C Hamano.
Thread: https://gitlist.dev/t/29921

## Nelson Benitez Leon, 2012-03-12 17:26

Subject: [PATCH v4 2/5] http: handle proxy proactive authentication
Message-ID: <4F5E31DB.5050900@seap.minhap.es>
URL: https://gitlist.dev/e/4F5E31DB.5050900%40seap.minhap.es

```
If http_proactive_auth flag is set and there is a username
but no password in the proxy url, then interactively ask for
the password.

This makes possible to not have the password written down in
http_proxy env var or in http.proxy config option.

Also take care that CURLOPT_PROXY don't include username or
password, as we now set them in the new set_proxy_auth() function
where we use their specific cURL options.

Signed-off-by: Nelson Benitez Leon <nbenitezl@gmail.com>
---
 http.c |   27 ++++++++++++++++++++++++++-
 1 files changed, 26 insertions(+), 1 deletions(-)

diff --git a/http.c b/http.c
index 8932da5..dbdbc3f 100644
--- a/http.c
+++ b/http.c
@@ -43,6 +43,7 @@ static int curl_ftp_no_epsv;
 static const char *curl_http_proxy;
 static const char *curl_cookie_file;
 static struct credential http_auth = CREDENTIAL_INIT;
+static struct credential proxy_auth = CREDENTIAL_INIT;
 static int http_proactive_auth;
 static const char *user_agent;
 
@@ -232,6 +233,20 @@ static int has_cert_password(void)
 	return 1;
 }
 
+static void set_proxy_auth(CURL *result)
+{
+	if (proxy_auth.username && proxy_auth.password) {
+#if LIBCURL_VERSION_NUM >= 0x071901
+		curl_easy_setopt(result, CURLOPT_PROXYUSERNAME, proxy_auth.username);
+		curl_easy_setopt(result, CURLOPT_PROXYPASSWORD, proxy_auth.password);
+#else
+		char userpwd[100];
+		snprintf(userpwd, 100, "%s:%s", proxy_auth.username, proxy_auth.password);
+		curl_easy_setopt(result, CURLOPT_PROXYUSERPWD, userpwd);
+#endif
+	}
+}
+
 static CURL *get_curl_handle(void)
 {
 	CURL *result = curl_easy_init();
@@ -303,8 +318,18 @@ static CURL *get_curl_handle(void)
 		}
 	}
 	if (curl_http_proxy) {
-		curl_easy_setopt(result, CURLOPT_PROXY, curl_http_proxy);
+		if (!proxy_auth.host) { // check to parse only once
+			credential_from_url(&proxy_auth, curl_http_proxy);
+		}
+		if (http_proactive_auth && proxy_auth.username && !proxy_auth.password) {
+			/* proxy string has username but no password, ask for password */
+			credential_fill(&proxy_auth);
+		}
+		char proxyhost[100];
+		snprintf(proxyhost, 100, "%s://%s", proxy_auth.protocol, proxy_auth.host);
+		curl_easy_setopt(result, CURLOPT_PROXY, proxyhost);
 		curl_easy_setopt(result, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
+		set_proxy_auth(result);
 	}
 
 	return result;
-- 
1.7.7.6

```

## Junio C Hamano, 2012-03-12 22:25

Subject: Re: [PATCH v4 2/5] http: handle proxy proactive authentication
Message-ID: <7vk42po3rs.fsf@alter.siamese.dyndns.org>
URL: https://gitlist.dev/e/7vk42po3rs.fsf%40alter.siamese.dyndns.org
In-Reply-To: <4F5E31DB.5050900@seap.minhap.es>

```
Nelson Benitez Leon <nelsonjesus.benitez@seap.minhap.es> writes:

> If http_proactive_auth flag is set and there is a username
> but no password in the proxy url, then interactively ask for
> the password.
>
> This makes possible to not have the password written down in
> http_proxy env var or in http.proxy config option.
>
> Also take care that CURLOPT_PROXY don't include username or
> password, as we now set them in the new set_proxy_auth() function
> where we use their specific cURL options.
>
> Signed-off-by: Nelson Benitez Leon <nbenitezl@gmail.com>
> ---
>  http.c |   27 ++++++++++++++++++++++++++-
>  1 files changed, 26 insertions(+), 1 deletions(-)

Just a minor style nit first so that we do not have to go ping-pong
on the trivialities.

> @@ -303,8 +318,18 @@ static CURL *get_curl_handle(void)
>  		}
>  	}
>  	if (curl_http_proxy) {
> -		curl_easy_setopt(result, CURLOPT_PROXY, curl_http_proxy);
> +		if (!proxy_auth.host) { // check to parse only once

No C99 // comments.

> +			credential_from_url(&proxy_auth, curl_http_proxy);
> +		}
> +		if (http_proactive_auth && proxy_auth.username && !proxy_auth.password) {
> +			/* proxy string has username but no password, ask for password */
> +			credential_fill(&proxy_auth);
> +		}

No {} around single statement block (this comment applies also to
the previous "if (!proxy_auth.host)").

> +		char proxyhost[100];

No decl-after-statement.

> +		snprintf(proxyhost, 100, "%s://%s", proxy_auth.protocol, proxy_auth.host);

Wouldn't it be far more pleasant if you used strbuf_addf() for
things like this?  That way you do not have to wonder if a 100-byte
buffer is too small.

> +		curl_easy_setopt(result, CURLOPT_PROXY, proxyhost);
>  		curl_easy_setopt(result, CURLOPT_PROXYAUTH, CURLAUTH_ANY);
> +		set_proxy_auth(result);
>  	}
>  
>  	return result;

```