# [PATCH 2/2] http: use a feature check to enable GSSAPI delegation control 11 messages from 2017-08-11 to 2017-08-23. Participants: Tom G. Christensen, Junio C Hamano, Jeff King. Thread: https://gitlist.dev/t/46568 ## Tom G. Christensen, 2017-08-11 16:37 Subject: [PATCH 2/2] http: use a feature check to enable GSSAPI delegation control Message-ID: URL: https://gitlist.dev/e/b037d7116bb6eac965a5cba2357611b156c07b8d.1502462884.git.tgc%40jupiterrise.com In-Reply-To: ``` Turn the version check into a feature check to ensure this functionality is also enabled with vendor supported curl versions where the feature may have been backported. Signed-off-by: Tom G. Christensen --- http.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/http.c b/http.c index 569909e8a..a3ae58f13 100644 --- a/http.c +++ b/http.c @@ -91,7 +91,7 @@ static struct { * here, too */ }; -#if LIBCURL_VERSION_NUM >= 0x071600 +#ifdef CURLGSSAPI_DELEGATION_FLAG static const char *curl_deleg; static struct { const char *name; @@ -356,7 +356,7 @@ static int http_options(const char *var, const char *value, void *cb) } if (!strcmp("http.delegation", var)) { -#if LIBCURL_VERSION_NUM >= 0x071600 +#ifdef CURLGSSAPI_DELEGATION_FLAG return git_config_string(&curl_deleg, var, value); #else warning(_("Delegation control is not supported with cURL < 7.22.0")); @@ -727,7 +727,7 @@ static CURL *get_curl_handle(void) curl_easy_setopt(result, CURLOPT_HTTPAUTH, CURLAUTH_ANY); #endif -#if LIBCURL_VERSION_NUM >= 0x071600 +#ifdef CURLGSSAPI_DELEGATION_FLAG if (curl_deleg) { int i; for (i = 0; i < ARRAY_SIZE(curl_deleg_levels); i++) { -- 2.14.1 ``` ## Tom G. Christensen, 2017-08-11 16:37 Subject: [PATCH 0/2] http: handle curl with vendor backports Message-ID: URL: https://gitlist.dev/e/cover.1502462884.git.tgc%40jupiterrise.com In-Reply-To: <030356f8-0472-7400-c9f6-7492788dd2d0@jupiterrise.com> ``` The curl packages provided by Red Hat for RHEL contain several backports of features from later curl releases. This causes problems with current version based checks in http.c. Here is an overview of the features that have been backported: 7.10.6 (el3) Backports CURLPROTO_* 7.12.1 (el4) Backports CURLPROTO_* 7.15.5 (el5) Backports GSSAPI_DELEGATION_* Backports CURLPROTO_* 7.19.7 (el6) Backports GSSAPI_DELEGATION_* Backports CURL_SSL_VERSION_TLSv1_{0,1,2} 7.29.0 (el7) Backports CURL_SSL_VERSION_TLSv1_{0,1,2} This patch series will update the current version based checks for protocol restriction and GSSAPI delegation control support to ones based on features to properly deal with the above listed backports. The fine grained TLS version support does not seem to be distinguishable via a preprocessor macro so I've left that alone. I have build tested these changes against upstream curl 7.12.0 (fails), 7.12.1 and 7.15.5. I have also built and run the testsuite against the Red Hat provided curl versions listed above. Tom G. Christensen (2): http: Fix handling of missing CURLPROTO_* http: use a feature check to enable GSSAPI delegation control http.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.14.1 ``` ## Tom G. Christensen, 2017-08-11 16:37 Subject: [PATCH 1/2] http: Fix handling of missing CURLPROTO_* Message-ID: <4d29d43d458f61c6dabca093f591ad8698ca2ceb.1502462884.git.tgc@jupiterrise.com> URL: https://gitlist.dev/e/4d29d43d458f61c6dabca093f591ad8698ca2ceb.1502462884.git.tgc%40jupiterrise.com In-Reply-To: ``` Commit aeae4db1 refactored the handling of the curl protocol restriction support into a function but failed to add a version check for older versions of curl that lack CURLPROTO_* support. This adds the missing check and at the same time converts it to a feature check instead of a version based check. This is done to ensure that vendor supported curl versions that have had CURLPROTO_* support backported are handled correctly. Signed-off-by: Tom G. Christensen --- http.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/http.c b/http.c index e00264cff..569909e8a 100644 --- a/http.c +++ b/http.c @@ -685,6 +685,7 @@ void setup_curl_trace(CURL *handle) curl_easy_setopt(handle, CURLOPT_DEBUGDATA, NULL); } +#ifdef CURLPROTO_HTTP static long get_curl_allowed_protocols(int from_user) { long allowed_protocols = 0; @@ -700,6 +701,7 @@ static long get_curl_allowed_protocols(int from_user) return allowed_protocols; } +#endif static CURL *get_curl_handle(void) { @@ -798,7 +800,7 @@ static CURL *get_curl_handle(void) #elif LIBCURL_VERSION_NUM >= 0x071101 curl_easy_setopt(result, CURLOPT_POST301, 1); #endif -#if LIBCURL_VERSION_NUM >= 0x071304 +#ifdef CURLPROTO_HTTP curl_easy_setopt(result, CURLOPT_REDIR_PROTOCOLS, get_curl_allowed_protocols(0)); curl_easy_setopt(result, CURLOPT_PROTOCOLS, -- 2.14.1 ``` ## Junio C Hamano, 2017-08-11 22:15 Subject: Re: [PATCH 0/2] http: handle curl with vendor backports Message-ID: URL: https://gitlist.dev/e/xmqq1sohzr85.fsf%40gitster.mtv.corp.google.com In-Reply-To: ``` "Tom G. Christensen" writes: > The curl packages provided by Red Hat for RHEL contain several > backports of features from later curl releases. > This causes problems with current version based checks in http.c. > > Here is an overview of the features that have been backported: > 7.10.6 (el3) Backports CURLPROTO_* > 7.12.1 (el4) Backports CURLPROTO_* > 7.15.5 (el5) Backports GSSAPI_DELEGATION_* > Backports CURLPROTO_* > 7.19.7 (el6) Backports GSSAPI_DELEGATION_* > Backports CURL_SSL_VERSION_TLSv1_{0,1,2} > 7.29.0 (el7) Backports CURL_SSL_VERSION_TLSv1_{0,1,2} > > This patch series will update the current version based checks for > protocol restriction and GSSAPI delegation control support to ones > based on features to properly deal with the above listed backports. > The fine grained TLS version support does not seem to be > distinguishable via a preprocessor macro so I've left that alone. Thanks; these feature macros ought to be more dependable, and I think this moves things in the right direction (regardless of which features we might later pick as mandatory and cut off supports for older versions). > I have build tested these changes against upstream curl 7.12.0 (fails), > 7.12.1 and 7.15.5. I have also built and run the testsuite against the > Red Hat provided curl versions listed above. Hmph, what does "(fails)" mean here? > > Tom G. Christensen (2): > http: Fix handling of missing CURLPROTO_* > http: use a feature check to enable GSSAPI delegation control > > http.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) ``` ## Junio C Hamano, 2017-08-12 00:30 Subject: Re: [PATCH 1/2] http: Fix handling of missing CURLPROTO_* Message-ID: URL: https://gitlist.dev/e/xmqqo9rly6dx.fsf%40gitster.mtv.corp.google.com In-Reply-To: <4d29d43d458f61c6dabca093f591ad8698ca2ceb.1502462884.git.tgc@jupiterrise.com> ``` "Tom G. Christensen" writes: > Commit aeae4db1 refactored the handling of the curl protocol restriction > support into a function but failed to add a version check for older > versions of curl that lack CURLPROTO_* support. > This adds the missing check and at the same time converts it to a feature > check instead of a version based check. > This is done to ensure that vendor supported curl versions that have had > CURLPROTO_* support backported are handled correctly. > > Signed-off-by: Tom G. Christensen > --- > http.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/http.c b/http.c > index e00264cff..569909e8a 100644 > --- a/http.c > +++ b/http.c > @@ -685,6 +685,7 @@ void setup_curl_trace(CURL *handle) > curl_easy_setopt(handle, CURLOPT_DEBUGDATA, NULL); > } > > +#ifdef CURLPROTO_HTTP > static long get_curl_allowed_protocols(int from_user) > { > long allowed_protocols = 0; > @@ -700,6 +701,7 @@ static long get_curl_allowed_protocols(int from_user) > > return allowed_protocols; > } > +#endif > > static CURL *get_curl_handle(void) > { > @@ -798,7 +800,7 @@ static CURL *get_curl_handle(void) > #elif LIBCURL_VERSION_NUM >= 0x071101 > curl_easy_setopt(result, CURLOPT_POST301, 1); > #endif > -#if LIBCURL_VERSION_NUM >= 0x071304 > +#ifdef CURLPROTO_HTTP > curl_easy_setopt(result, CURLOPT_REDIR_PROTOCOLS, > get_curl_allowed_protocols(0)); > curl_easy_setopt(result, CURLOPT_PROTOCOLS, This may make the code to _compile_, but is it sensible to let the code build and be used by the end users without the "these protocols are safe" filter, I wonder? Granted, ancient code was unsafe and people were happily using it, but now we know better, and more importantly, we have since added users of transport (e.g. blindly fetch submodules recursively) that may _rely_ on this layer of the code safely filtering unsafe protocols, so... ``` ## Tom G. Christensen, 2017-08-12 06:20 Subject: Re: [PATCH 0/2] http: handle curl with vendor backports Message-ID: <1b91d00f-eeae-30cf-0889-8fad05d849d3@jupiterrise.com> URL: https://gitlist.dev/e/1b91d00f-eeae-30cf-0889-8fad05d849d3%40jupiterrise.com In-Reply-To: ``` On 12/08/17 00:15, Junio C Hamano wrote: > "Tom G. Christensen" writes: >> I have build tested these changes against upstream curl 7.12.0 (fails), >> 7.12.1 and 7.15.5. I have also built and run the testsuite against the >> Red Hat provided curl versions listed above. > > Hmph, what does "(fails)" mean here? > It means building against 7.12.0 fails which is expected because it is missing CURLINFO_SSL_DATA_{IN,OUT}. There are patches in the other thread that would add support for curl < 7.12.1 if necessary. -tgc ``` ## Tom G. Christensen, 2017-08-12 09:04 Subject: Re: [PATCH 1/2] http: Fix handling of missing CURLPROTO_* Message-ID: <91420770-f02e-7685-9c0e-f840633f01d5@jupiterrise.com> URL: https://gitlist.dev/e/91420770-f02e-7685-9c0e-f840633f01d5%40jupiterrise.com In-Reply-To: ``` On 12/08/17 02:30, Junio C Hamano wrote: > This may make the code to _compile_, but is it sensible to let the > code build and be used by the end users without the "these protocols > are safe" filter, I wonder? > Git will display a warning at runtime if this is not available but perhaps this warning could be worded more strongly and/or make reference to CVE-2009-0037. -tgc ``` ## Jeff King, 2017-08-20 08:47 Subject: Re: [PATCH 0/2] http: handle curl with vendor backports Message-ID: <20170820084725.ce5inn5jzkyor4zk@sigill.intra.peff.net> URL: https://gitlist.dev/e/20170820084725.ce5inn5jzkyor4zk%40sigill.intra.peff.net In-Reply-To: ``` On Fri, Aug 11, 2017 at 03:15:06PM -0700, Junio C Hamano wrote: > "Tom G. Christensen" writes: > > > The curl packages provided by Red Hat for RHEL contain several > > backports of features from later curl releases. > > This causes problems with current version based checks in http.c. > > > > Here is an overview of the features that have been backported: > > 7.10.6 (el3) Backports CURLPROTO_* > > 7.12.1 (el4) Backports CURLPROTO_* > > 7.15.5 (el5) Backports GSSAPI_DELEGATION_* > > Backports CURLPROTO_* > > 7.19.7 (el6) Backports GSSAPI_DELEGATION_* > > Backports CURL_SSL_VERSION_TLSv1_{0,1,2} > > 7.29.0 (el7) Backports CURL_SSL_VERSION_TLSv1_{0,1,2} > > > > This patch series will update the current version based checks for > > protocol restriction and GSSAPI delegation control support to ones > > based on features to properly deal with the above listed backports. > > The fine grained TLS version support does not seem to be > > distinguishable via a preprocessor macro so I've left that alone. > > Thanks; these feature macros ought to be more dependable, and I > think this moves things in the right direction (regardless of which > features we might later pick as mandatory and cut off supports for > older versions). Yes, I agree that these are an improvement regardless. If we follow through on the cut-off to 7.19.4, then the CURLPROTO ones all go away. But I don't mind rebasing any cut-off proposal on top of this work. -Peff ``` ## Jeff King, 2017-08-20 08:59 Subject: Re: [PATCH 1/2] http: Fix handling of missing CURLPROTO_* Message-ID: <20170820085913.w6pxal3hlpwbio74@sigill.intra.peff.net> URL: https://gitlist.dev/e/20170820085913.w6pxal3hlpwbio74%40sigill.intra.peff.net In-Reply-To: ``` On Fri, Aug 11, 2017 at 05:30:34PM -0700, Junio C Hamano wrote: > > -#if LIBCURL_VERSION_NUM >= 0x071304 > > +#ifdef CURLPROTO_HTTP > > curl_easy_setopt(result, CURLOPT_REDIR_PROTOCOLS, > > get_curl_allowed_protocols(0)); > > curl_easy_setopt(result, CURLOPT_PROTOCOLS, > > This may make the code to _compile_, but is it sensible to let the > code build and be used by the end users without the "these protocols > are safe" filter, I wonder? > > Granted, ancient code was unsafe and people were happily using it, > but now we know better, and more importantly, we have since added > users of transport (e.g. blindly fetch submodules recursively) that > may _rely_ on this layer of the code safely filtering unsafe > protocols, so... I don't think Tom's patch changes this in any meaningful way. The "fallback to skipping the safety and showing a warning" dates back to the original introduction of the feature. But FWIW, that is exactly the kind of thing that led me to wanting to implement a hard cutoff in the first place. The warning is small consolation if Git allows an attack through anyway. Or worse, you don't even see the warning because it's an automated process that is being exploited. There's a good chance if you have such an antique curl that it is also riddled with other curl-specific bugs that have since been fixed. And that would argue that we don't need to care that much anyway; people running old curl have decided that it's not worth caring about the security implications. But in the case of RHEL, in theory they are patching security bugs in curl but just not implementing new features. So if we have a vulnerability introduced by using an old version of curl, we really are making things worse. And that argues for having a hard cutoff. But as Tom's series demonstrates, they are backporting _some_ features (presumably ones needed by other programs like Git to fix security bugs). Which argues for having #ifdefs that handle those backports, which in theory gives us a secure Git on systems that do careful backporting, and gives us an insecure-but-not-worse-than-it-already-was Git on systems that don't do backporting. I dunno. There were a lot of assumptions and mental gymnastics there. I'm still tempted to target curl >= 7.19.4 just based on timing and RHEL5's support life-cycle. -Peff ``` ## Junio C Hamano, 2017-08-20 16:28 Subject: Re: [PATCH 0/2] http: handle curl with vendor backports Message-ID: URL: https://gitlist.dev/e/xmqqziau6w63.fsf%40gitster.mtv.corp.google.com In-Reply-To: <20170820084725.ce5inn5jzkyor4zk@sigill.intra.peff.net> ``` Jeff King writes: > On Fri, Aug 11, 2017 at 03:15:06PM -0700, Junio C Hamano wrote: > >> "Tom G. Christensen" writes: >> >> > The curl packages provided by Red Hat for RHEL contain several >> > backports of features from later curl releases. >> > This causes problems with current version based checks in http.c. >> > >> > Here is an overview of the features that have been backported: >> > 7.10.6 (el3) Backports CURLPROTO_* >> > 7.12.1 (el4) Backports CURLPROTO_* >> > 7.15.5 (el5) Backports GSSAPI_DELEGATION_* >> > Backports CURLPROTO_* >> > 7.19.7 (el6) Backports GSSAPI_DELEGATION_* >> > Backports CURL_SSL_VERSION_TLSv1_{0,1,2} >> > 7.29.0 (el7) Backports CURL_SSL_VERSION_TLSv1_{0,1,2} >> > >> > This patch series will update the current version based checks for >> > protocol restriction and GSSAPI delegation control support to ones >> > based on features to properly deal with the above listed backports. >> > The fine grained TLS version support does not seem to be >> > distinguishable via a preprocessor macro so I've left that alone. >> >> Thanks; these feature macros ought to be more dependable, and I >> think this moves things in the right direction (regardless of which >> features we might later pick as mandatory and cut off supports for >> older versions). > > Yes, I agree that these are an improvement regardless. If we follow > through on the cut-off to 7.19.4, then the CURLPROTO ones all go away. > But I don't mind rebasing any cut-off proposal on top of this work. Yeah I came to a similar conclusion and was about asking if you feel the same way that your series should be made on top of Tom's fixes. The aspect of that series I do like the most is to base our decisions on features, not versions, and I also wonder if we can do similar in your "abandon too old ones" series, too. Thanks. ``` ## Jeff King, 2017-08-23 15:41 Subject: Re: [PATCH 0/2] http: handle curl with vendor backports Message-ID: <20170823154114.zanr26hg2silquez@sigill.intra.peff.net> URL: https://gitlist.dev/e/20170823154114.zanr26hg2silquez%40sigill.intra.peff.net In-Reply-To: ``` On Sun, Aug 20, 2017 at 09:28:20AM -0700, Junio C Hamano wrote: > > Yes, I agree that these are an improvement regardless. If we follow > > through on the cut-off to 7.19.4, then the CURLPROTO ones all go away. > > But I don't mind rebasing any cut-off proposal on top of this work. > > Yeah I came to a similar conclusion and was about asking if you feel > the same way that your series should be made on top of Tom's fixes. > > The aspect of that series I do like the most is to base our > decisions on features, not versions, and I also wonder if we can do > similar in your "abandon too old ones" series, too. Yeah, I don't mind moving to feature flags where we can (though some features do not have a useful flag; e.g., the only way to know whether we must be strdup curl_easy_setopt() arguments is by checking the curl version). One annoying thing about "feature" flags instead of version flags is that it takes a lot of legwork to figure out how old those features are (whereas with the versions I was able to look that up in the curl history pretty easily). Since people adding the feature flag generally do that legwork, it's probably worth having a comment for each mentioning the general vintage (or maybe the commit message is an OK place for that). I actually wonder if it is worth defining our own readable flags in a big table at the beginning of the file, like: /* * introduced in curl 7.19.4, but backported by some distros like * RHEL. We can identify it by the presence of the PROTO flags. */ #ifdef CURLPROTO_HTTP #define CURL_SUPPORTS_PROTOCOL_REDIRECTION #endif That keeps the logic in one place (where it can be changed if we later find that the define we picked for our feature isn't quite accurate). And then the #ifdefs sprinkled through the code itself become self-documenting. -Peff ```