add basic http proxy tests

We do not test our http proxy functionality at all in the test suite, so this is a pretty big blind spot. Let's at least add a basic check that we can go through an authenticating proxy to perform a clone. A few notes on the implementation: - I'm using a single apache instance to proxy to itself. This seems to work fine in practice, and we can check with a test that this rather unusual setup is doing what we expect. - I've put the proxy tests into their own script, and it's the only one which loads the apache proxy config. If any platform can't handle this (e.g., doesn't have the right modules), the start_httpd step should fail and gracefully skip the rest of the script (but all the other http tests in existing scripts will continue to run). - I used a separate passwd file to make sure we don't ever get confused between proxy and regular auth credentials. It's using the antiquated crypt() format. This is a terrible choice security-wise in the modern age, but it's what our existing passwd file uses, and should be portable. It would probably be reasonable to switch both of these to bcrypt, but we can do that in a separate patch. - On the client side, we test two situations with credentials: when they are present in the url, and when the username is present but we prompt for the password. I think we should be able to handle the case that _neither_ is present, but an HTTP 407 causes us to prompt for them. However, this doesn't seem to work. That's either a bug, or at the very least an opportunity for a feature, but I punted on it for now. The point of this patch is just getting basic coverage, and we can explore possible deficiencies later. - this doesn't work with LIB_HTTPD_SSL. This probably would be valuable to have, as https over an http proxy is totally different (it uses CONNECT to tunnel the session). But adding in mod_proxy_connect and some basic config didn't seem to work for me, so I punted for now. Much of the rest of the test suite does not currently work with LIB_HTTPD_SSL either, so we shouldn't be making anything much worse here. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jeff King committed Feb 16, 2023 at 15:56 UTC 29ae2c9e742c167f3e46cf9a2d78f420b261e254
4 files changed +65
t/lib-httpd.sh
+7
@@ -25,6 +25,7 @@
25 # LIB_HTTPD_DAV enable DAV
26 # LIB_HTTPD_SVN enable SVN at given location (e.g. "svn")
27 # LIB_HTTPD_SSL enable SSL
28 +# LIB_HTTPD_PROXY enable proxy
29 #
30 # Copyright (c) 2008 Clemens Buchacher <drizzd@aon.at>
31 #
@@ -133,6 +134,7 @@ install_script () {
134 prepare_httpd() {
135 mkdir -p "$HTTPD_DOCUMENT_ROOT_PATH"
136 cp "$TEST_PATH"/passwd "$HTTPD_ROOT_PATH"
137 + cp "$TEST_PATH"/proxy-passwd "$HTTPD_ROOT_PATH"
138 install_script incomplete-length-upload-pack-v2-http.sh
139 install_script incomplete-body-upload-pack-v2-http.sh
140 install_script error-no-report.sh
@@ -176,6 +178,11 @@ prepare_httpd() {
178 export LIB_HTTPD_SVN LIB_HTTPD_SVNPATH
179 fi
180 fi
181 +
182 + if test -n "$LIB_HTTPD_PROXY"
183 + then
184 + HTTPD_PARA="$HTTPD_PARA -DPROXY"
185 + fi
186 }
187
188 enable_http2 () {
t/lib-httpd/apache.conf
+16
@@ -47,6 +47,22 @@ Protocols h2c
47 LoadModule authz_host_module modules/mod_authz_host.so
48 </IfModule>
49
50 +<IfDefine PROXY>
51 +<IfModule !mod_proxy.c>
52 + LoadModule proxy_module modules/mod_proxy.so
53 +</IfModule>
54 +<IfModule !mod_proxy_http.c>
55 + LoadModule proxy_http_module modules/mod_proxy_http.so
56 +</IfModule>
57 +ProxyRequests On
58 +<Proxy "*">
59 + AuthType Basic
60 + AuthName "proxy-auth"
61 + AuthUserFile proxy-passwd
62 + Require valid-user
63 +</Proxy>
64 +</IfDefine>
65 +
66 <IfModule !mod_authn_core.c>
67 LoadModule authn_core_module modules/mod_authn_core.so
68 </IfModule>
t/lib-httpd/proxy-passwd new
+1
@@ -0,0 +1 @@
1 +proxuser:2x7tAukjAED5M
t/t5564-http-proxy.sh new
+41
@@ -0,0 +1,41 @@
1 +#!/bin/sh
2 +
3 +test_description="test fetching through http proxy"
4 +
5 +. ./test-lib.sh
6 +. "$TEST_DIRECTORY"/lib-httpd.sh
7 +
8 +LIB_HTTPD_PROXY=1
9 +start_httpd
10 +
11 +test_expect_success 'setup repository' '
12 + test_commit foo &&
13 + git init --bare "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" &&
14 + git push --mirror "$HTTPD_DOCUMENT_ROOT_PATH/repo.git"
15 +'
16 +
17 +setup_askpass_helper
18 +
19 +# sanity check that our test setup is correctly using proxy
20 +test_expect_success 'proxy requires password' '
21 + test_config_global http.proxy $HTTPD_DEST &&
22 + test_must_fail git clone $HTTPD_URL/smart/repo.git 2>err &&
23 + grep "error.*407" err
24 +'
25 +
26 +test_expect_success 'clone through proxy with auth' '
27 + test_when_finished "rm -rf clone" &&
28 + test_config_global http.proxy http://proxuser:proxpass@$HTTPD_DEST &&
29 + GIT_TRACE_CURL=$PWD/trace git clone $HTTPD_URL/smart/repo.git clone &&
30 + grep -i "Proxy-Authorization: Basic <redacted>" trace
31 +'
32 +
33 +test_expect_success 'clone can prompt for proxy password' '
34 + test_when_finished "rm -rf clone" &&
35 + test_config_global http.proxy http://proxuser@$HTTPD_DEST &&
36 + set_askpass nobody proxpass &&
37 + GIT_TRACE_CURL=$PWD/trace git clone $HTTPD_URL/smart/repo.git clone &&
38 + expect_askpass pass proxuser
39 +'
40 +
41 +test_done