@matheusbsbs / matheus-bagliano / commits / cd27f604e4

http: store credential when PKI auth is used

We already looked for the PKI credentials in the credential store, but failed to approve it on success. Meaning, the PKI certificate password was never stored and git would request it on every connection to the remote. Let's complete the chain by storing the certificate password on success. Likewise, we also need to reject the credential when there is a failure. Curl appears to report client-related certificate issues are reported with the CURLE_SSL_CERTPROBLEM error. This includes not only a bad password, but potentially other client certificate related problems. Since we cannot get more information from curl, we'll go ahead and reject the credential upon receiving that error, just to be safe and avoid caching or saving a bad password. Signed-off-by: John Szakmeister <john@szakmeister.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

John Szakmeister committed Mar 11, 2021 at 21:40 UTC cd27f604e41475633d068d3f4852ab6b597c5e75

1 file changed +10

http.c

+10

@@ -1637,7 +1637,17 @@ static int handle_curl_result(struct slot_results *results)

1637 credential_approve(&http_auth);

1638 if (proxy_auth.password)

1639 credential_approve(&proxy_auth);

1640 + credential_approve(&cert_auth);

1641 return HTTP_OK;

1642 + } else if (results->curl_result == CURLE_SSL_CERTPROBLEM) {

1643 + /*

1644 + * We can't tell from here whether it's a bad path, bad

1645 + * certificate, bad password, or something else wrong

1646 + * with the certificate. So we reject the credential to

1647 + * avoid caching or saving a bad password.

1648 + */

1649 + credential_reject(&cert_auth);

1650 + return HTTP_NOAUTH;

1651 } else if (missing_target(results))

1652 return HTTP_MISSING_TARGET;

1653 else if (results->http_code == 401) {