@matheusbsbs / matheus-bagliano / commits / a7775c7eb8

git-cvsserver: use crypt correctly to compare password hashes

c057bad370 (git-cvsserver: use a password file cvsserver pserver, 2010-05-15) adds a way for `git cvsserver` to provide authenticated pserver accounts without having clear text passwords, but uses the username instead of the password to the call for crypt(3). Correct that, and make sure the documentation correctly indicates how to obtain hashed passwords that could be used to populate this configuration, as well as correcting the hash that was used for the tests. This change will require that any user of this feature updates the hashes in their configuration, but has the advantage of using a more similar format than cvs uses, probably also easying any migration. Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Carlo Marcelo Arenas Belón committed Sep 15, 2021 at 01:09 UTC a7775c7eb8074fcf37f22bdcdc0971448c1aa4d1

3 files changed +8 -8

Documentation/git-cvsserver.txt

+4 -6

@@ -118,13 +118,11 @@ for example:

118 myuser:$1$BA)@$vbnMJMDym7tA32AamXrm./

119 ------

120 You can use the 'htpasswd' facility that comes with Apache to make these

121 -files, but Apache's MD5 crypt method differs from the one used by most C

122 -library's crypt() function, so don't use the -m option.

121 +files, but only with the -d option (or -B if your system suports it).

122

124 -Alternatively you can produce the password with perl's crypt() operator:

125 ------

126 - perl -e 'my ($user, $pass) = @ARGV; printf "%s:%s\n", $user, crypt($user, $pass)' $USER password

127 ------

123 +Preferably use the system specific utility that manages password hash

124 +creation in your platform (e.g. mkpasswd in Linux, encrypt in OpenBSD or

125 +pwhash in NetBSD) and paste it in the right location.

126

127 Then provide your password via the pserver method, for example:

128 ------

git-cvsserver.perl

+1 -1

@@ -222,7 +222,7 @@ if ($state->{method} eq 'pserver') {

222 open my $passwd, "<", $authdb or die $!;

223 while (<$passwd>) {

224 if (m{^\Q$user\E:(.*)}) {

225 - if (crypt($user, descramble($password)) eq $1) {

225 + if (crypt(descramble($password), $1) eq $1) {

226 $auth_ok = 1;

227 }

228 };

t/t9400-git-cvsserver-server.sh

+3 -1

@@ -36,6 +36,8 @@ CVSWORK="$PWD/cvswork"

36 CVS_SERVER=git-cvsserver

37 export CVSROOT CVS_SERVER

39 +PWDHASH='lac2ItudM3.KM'

40 +

41 rm -rf "$CVSWORK" "$SERVERDIR"

42 test_expect_success 'setup' '

43 git config push.default matching &&

@@ -54,7 +56,7 @@ test_expect_success 'setup' '

56 GIT_DIR="$SERVERDIR" git config --bool gitcvs.enabled true &&

57 GIT_DIR="$SERVERDIR" git config gitcvs.logfile "$SERVERDIR/gitcvs.log" &&

58 GIT_DIR="$SERVERDIR" git config gitcvs.authdb "$SERVERDIR/auth.db" &&

57 - echo cvsuser:cvGVEarMLnhlA > "$SERVERDIR/auth.db"

59 + echo "cvsuser:$PWDHASH" >"$SERVERDIR/auth.db"

60 '

62 # note that cvs doesn't accept absolute pathnames