transport: add protocol policy config option
Previously the `GIT_ALLOW_PROTOCOL` environment variable was used to specify a whitelist of protocols to be used in clone/fetch/push commands. This patch introduces new configuration options for more fine-grained control for allowing/disallowing protocols. This also has the added benefit of allowing easier construction of a protocol whitelist on systems where setting an environment variable is non-trivial. Now users can specify a policy to be used for each type of protocol via the 'protocol.<name>.allow' config option. A default policy for all unconfigured protocols can be set with the 'protocol.allow' config option. If no user configured default is made git will allow known-safe protocols (http, https, git, ssh, file), disallow known-dangerous protocols (ext), and have a default policy of `user` for all other protocols. The supported policies are `always`, `never`, and `user`. The `user` policy can be used to configure a protocol to be usable when explicitly used by a user, while disallowing it for commands which run clone/fetch/push commands without direct user intervention (e.g. recursive initialization of submodules). Commands which can potentially clone/fetch/push from untrusted repositories without user intervention can export `GIT_PROTOCOL_FROM_USER` with a value of '0' to prevent protocols configured to the `user` policy from being used. Fix remote-ext tests to use the new config to allow the ext protocol to be tested. Based on a patch by Jeff King <peff@peff.net> Signed-off-by: Brandon Williams <bmwill@google.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Brandon Williams committed
Dec 14, 2016 at 14:39 UTC
f1762d772e9b415a3163abf5f217fc3b71a3b40e
7 files changed
+264
-39
Documentation/config.txt
+46
@@ -2260,6 +2260,52 @@ pretty.<name>::
2260
Note that an alias with the same name as a built-in format
2261
will be silently ignored.
2262
2263
+protocol.allow::
2264
+ If set, provide a user defined default policy for all protocols which
2265
+ don't explicitly have a policy (`protocol.<name>.allow`). By default,
2266
+ if unset, known-safe protocols (http, https, git, ssh, file) have a
2267
+ default policy of `always`, known-dangerous protocols (ext) have a
2268
+ default policy of `never`, and all other protocols have a default
2269
+ policy of `user`. Supported policies:
2270
++
2271
+--
2272
+
2273
+* `always` - protocol is always able to be used.
2274
+
2275
+* `never` - protocol is never able to be used.
2276
+
2277
+* `user` - protocol is only able to be used when `GIT_PROTOCOL_FROM_USER` is
2278
+ either unset or has a value of 1. This policy should be used when you want a
2279
+ protocol to be directly usable by the user but don't want it used by commands which
2280
+ execute clone/fetch/push commands without user input, e.g. recursive
2281
+ submodule initialization.
2282
+
2283
+--
2284
+
2285
+protocol.<name>.allow::
2286
+ Set a policy to be used by protocol `<name>` with clone/fetch/push
2287
+ commands. See `protocol.allow` above for the available policies.
2288
++
2289
+The protocol names currently used by git are:
2290
++
2291
+--
2292
+ - `file`: any local file-based path (including `file://` URLs,
2293
+ or local paths)
2294
+
2295
+ - `git`: the anonymous git protocol over a direct TCP
2296
+ connection (or proxy, if configured)
2297
+
2298
+ - `ssh`: git over ssh (including `host:path` syntax,
2299
+ `ssh://`, etc).
2300
+
2301
+ - `http`: git over http, both "smart http" and "dumb http".
2302
+ Note that this does _not_ include `https`; if you want to configure
2303
+ both, you must do so individually.
2304
+
2305
+ - any external helpers are named by their protocol (e.g., use
2306
+ `hg` to allow the `git-remote-hg` helper)
2307
+--
2308
+
2309
pull.ff::
2310
By default, Git does not create an extra merge commit when merging
2311
a commit that is a descendant of the current commit. Instead, the
Documentation/git.txt
+14
-24
@@ -1129,30 +1129,20 @@ of clones and fetches.
1129
cloning a repository to make a backup).
1130
1131
`GIT_ALLOW_PROTOCOL`::
1132
- If set, provide a colon-separated list of protocols which are
1133
- allowed to be used with fetch/push/clone. This is useful to
1134
- restrict recursive submodule initialization from an untrusted
1135
- repository. Any protocol not mentioned will be disallowed (i.e.,
1136
- this is a whitelist, not a blacklist). If the variable is not
1137
- set at all, all protocols are enabled. The protocol names
1138
- currently used by git are:
1139
-
1140
- - `file`: any local file-based path (including `file://` URLs,
1141
- or local paths)
1142
-
1143
- - `git`: the anonymous git protocol over a direct TCP
1144
- connection (or proxy, if configured)
1145
-
1146
- - `ssh`: git over ssh (including `host:path` syntax,
1147
- `ssh://`, etc).
1148
-
1149
- - `http`: git over http, both "smart http" and "dumb http".
1150
- Note that this does _not_ include `https`; if you want both,
1151
- you should specify both as `http:https`.
1152
-
1153
- - any external helpers are named by their protocol (e.g., use
1154
- `hg` to allow the `git-remote-hg` helper)
1155
-
1132
+ If set to a colon-separated list of protocols, behave as if
1133
+ `protocol.allow` is set to `never`, and each of the listed
1134
+ protocols has `protocol.<name>.allow` set to `always`
1135
+ (overriding any existing configuration). In other words, any
1136
+ protocol not mentioned will be disallowed (i.e., this is a
1137
+ whitelist, not a blacklist). See the description of
1138
+ `protocol.allow` in linkgit:git-config[1] for more details.
1139
+
1140
+`GIT_PROTOCOL_FROM_USER`::
1141
+ Set to 0 to prevent protocols used by fetch/push/clone which are
1142
+ configured to the `user` state. This is useful to restrict recursive
1143
+ submodule initialization from an untrusted repository or for programs
1144
+ which feed potentially-untrusted URLS to git commands. See
1145
+ linkgit:git-config[1] for more details.
1146
1147
Discussion[[Discussion]]
1148
------------------------
git-submodule.sh
+4
-8
@@ -22,14 +22,10 @@ require_work_tree
22
wt_prefix=$(git rev-parse --show-prefix)
23
cd_to_toplevel
24
25
-# Restrict ourselves to a vanilla subset of protocols; the URLs
26
-# we get are under control of a remote repository, and we do not
27
-# want them kicking off arbitrary git-remote-* programs.
28
-#
29
-# If the user has already specified a set of allowed protocols,
30
-# we assume they know what they're doing and use that instead.
31
-: ${GIT_ALLOW_PROTOCOL=file:git:http:https:ssh}
32
-export GIT_ALLOW_PROTOCOL
25
+# Tell the rest of git that any URLs we get don't come
26
+# directly from the user, so it can apply policy as appropriate.
27
+GIT_PROTOCOL_FROM_USER=0
28
+export GIT_PROTOCOL_FROM_USER
29
30
command=
31
branch=
t/lib-proto-disable.sh
+125
-5
@@ -1,10 +1,7 @@
1
# Test routines for checking protocol disabling.
2
3
-# test cloning a particular protocol
4
-# $1 - description of the protocol
5
-# $2 - machine-readable name of the protocol
6
-# $3 - the URL to try cloning
7
-test_proto () {
3
+# Test clone/fetch/push with GIT_ALLOW_PROTOCOL whitelist
4
+test_whitelist () {
5
desc=$1
6
proto=$2
7
url=$3
@@ -62,6 +59,129 @@ test_proto () {
59
test_must_fail git clone --bare "$url" tmp.git
60
)
61
'
62
+
63
+ test_expect_success "clone $desc (env var has precedence)" '
64
+ rm -rf tmp.git &&
65
+ (
66
+ GIT_ALLOW_PROTOCOL=none &&
67
+ export GIT_ALLOW_PROTOCOL &&
68
+ test_must_fail git -c protocol.allow=always clone --bare "$url" tmp.git &&
69
+ test_must_fail git -c protocol.$proto.allow=always clone --bare "$url" tmp.git
70
+ )
71
+ '
72
+}
73
+
74
+test_config () {
75
+ desc=$1
76
+ proto=$2
77
+ url=$3
78
+
79
+ # Test clone/fetch/push with protocol.<type>.allow config
80
+ test_expect_success "clone $desc (enabled with config)" '
81
+ rm -rf tmp.git &&
82
+ git -c protocol.$proto.allow=always clone --bare "$url" tmp.git
83
+ '
84
+
85
+ test_expect_success "fetch $desc (enabled)" '
86
+ git -C tmp.git -c protocol.$proto.allow=always fetch
87
+ '
88
+
89
+ test_expect_success "push $desc (enabled)" '
90
+ git -C tmp.git -c protocol.$proto.allow=always push origin HEAD:pushed
91
+ '
92
+
93
+ test_expect_success "push $desc (disabled)" '
94
+ test_must_fail git -C tmp.git -c protocol.$proto.allow=never push origin HEAD:pushed
95
+ '
96
+
97
+ test_expect_success "fetch $desc (disabled)" '
98
+ test_must_fail git -C tmp.git -c protocol.$proto.allow=never fetch
99
+ '
100
+
101
+ test_expect_success "clone $desc (disabled)" '
102
+ rm -rf tmp.git &&
103
+ test_must_fail git -c protocol.$proto.allow=never clone --bare "$url" tmp.git
104
+ '
105
+
106
+ # Test clone/fetch/push with protocol.user.allow and its env var
107
+ test_expect_success "clone $desc (enabled)" '
108
+ rm -rf tmp.git &&
109
+ git -c protocol.$proto.allow=user clone --bare "$url" tmp.git
110
+ '
111
+
112
+ test_expect_success "fetch $desc (enabled)" '
113
+ git -C tmp.git -c protocol.$proto.allow=user fetch
114
+ '
115
+
116
+ test_expect_success "push $desc (enabled)" '
117
+ git -C tmp.git -c protocol.$proto.allow=user push origin HEAD:pushed
118
+ '
119
+
120
+ test_expect_success "push $desc (disabled)" '
121
+ (
122
+ cd tmp.git &&
123
+ GIT_PROTOCOL_FROM_USER=0 &&
124
+ export GIT_PROTOCOL_FROM_USER &&
125
+ test_must_fail git -c protocol.$proto.allow=user push origin HEAD:pushed
126
+ )
127
+ '
128
+
129
+ test_expect_success "fetch $desc (disabled)" '
130
+ (
131
+ cd tmp.git &&
132
+ GIT_PROTOCOL_FROM_USER=0 &&
133
+ export GIT_PROTOCOL_FROM_USER &&
134
+ test_must_fail git -c protocol.$proto.allow=user fetch
135
+ )
136
+ '
137
+
138
+ test_expect_success "clone $desc (disabled)" '
139
+ rm -rf tmp.git &&
140
+ (
141
+ GIT_PROTOCOL_FROM_USER=0 &&
142
+ export GIT_PROTOCOL_FROM_USER &&
143
+ test_must_fail git -c protocol.$proto.allow=user clone --bare "$url" tmp.git
144
+ )
145
+ '
146
+
147
+ # Test clone/fetch/push with protocol.allow user defined default
148
+ test_expect_success "clone $desc (enabled)" '
149
+ rm -rf tmp.git &&
150
+ git config --global protocol.allow always &&
151
+ git clone --bare "$url" tmp.git
152
+ '
153
+
154
+ test_expect_success "fetch $desc (enabled)" '
155
+ git -C tmp.git fetch
156
+ '
157
+
158
+ test_expect_success "push $desc (enabled)" '
159
+ git -C tmp.git push origin HEAD:pushed
160
+ '
161
+
162
+ test_expect_success "push $desc (disabled)" '
163
+ git config --global protocol.allow never &&
164
+ test_must_fail git -C tmp.git push origin HEAD:pushed
165
+ '
166
+
167
+ test_expect_success "fetch $desc (disabled)" '
168
+ test_must_fail git -C tmp.git fetch
169
+ '
170
+
171
+ test_expect_success "clone $desc (disabled)" '
172
+ rm -rf tmp.git &&
173
+ test_must_fail git clone --bare "$url" tmp.git
174
+ '
175
+}
176
+
177
+# test cloning a particular protocol
178
+# $1 - description of the protocol
179
+# $2 - machine-readable name of the protocol
180
+# $3 - the URL to try cloning
181
+test_proto () {
182
+ test_whitelist "$@"
183
+
184
+ test_config "$@"
185
}
186
187
# set up an ssh wrapper that will access $host/$repo in the
t/t5509-fetch-push-namespaces.sh
+1
@@ -4,6 +4,7 @@ test_description='fetch/push involving ref namespaces'
4
. ./test-lib.sh
5
6
test_expect_success setup '
7
+ git config --global protocol.ext.allow user &&
8
test_tick &&
9
git init original &&
10
(
t/t5802-connect-helper.sh
+1
@@ -4,6 +4,7 @@ test_description='ext::cmd remote "connect" helper'
4
. ./test-lib.sh
5
6
test_expect_success setup '
7
+ git config --global protocol.ext.allow user &&
8
test_tick &&
9
git commit --allow-empty -m initial &&
10
test_tick &&
transport.c
+73
-2
@@ -617,10 +617,81 @@ static const struct string_list *protocol_whitelist(void)
617
return enabled ? &allowed : NULL;
618
}
619
620
+enum protocol_allow_config {
621
+ PROTOCOL_ALLOW_NEVER = 0,
622
+ PROTOCOL_ALLOW_USER_ONLY,
623
+ PROTOCOL_ALLOW_ALWAYS
624
+};
625
+
626
+static enum protocol_allow_config parse_protocol_config(const char *key,
627
+ const char *value)
628
+{
629
+ if (!strcasecmp(value, "always"))
630
+ return PROTOCOL_ALLOW_ALWAYS;
631
+ else if (!strcasecmp(value, "never"))
632
+ return PROTOCOL_ALLOW_NEVER;
633
+ else if (!strcasecmp(value, "user"))
634
+ return PROTOCOL_ALLOW_USER_ONLY;
635
+
636
+ die("unknown value for config '%s': %s", key, value);
637
+}
638
+
639
+static enum protocol_allow_config get_protocol_config(const char *type)
640
+{
641
+ char *key = xstrfmt("protocol.%s.allow", type);
642
+ char *value;
643
+
644
+ /* first check the per-protocol config */
645
+ if (!git_config_get_string(key, &value)) {
646
+ enum protocol_allow_config ret =
647
+ parse_protocol_config(key, value);
648
+ free(key);
649
+ free(value);
650
+ return ret;
651
+ }
652
+ free(key);
653
+
654
+ /* if defined, fallback to user-defined default for unknown protocols */
655
+ if (!git_config_get_string("protocol.allow", &value)) {
656
+ enum protocol_allow_config ret =
657
+ parse_protocol_config("protocol.allow", value);
658
+ free(value);
659
+ return ret;
660
+ }
661
+
662
+ /* fallback to built-in defaults */
663
+ /* known safe */
664
+ if (!strcmp(type, "http") ||
665
+ !strcmp(type, "https") ||
666
+ !strcmp(type, "git") ||
667
+ !strcmp(type, "ssh") ||
668
+ !strcmp(type, "file"))
669
+ return PROTOCOL_ALLOW_ALWAYS;
670
+
671
+ /* known scary; err on the side of caution */
672
+ if (!strcmp(type, "ext"))
673
+ return PROTOCOL_ALLOW_NEVER;
674
+
675
+ /* unknown; by default let them be used only directly by the user */
676
+ return PROTOCOL_ALLOW_USER_ONLY;
677
+}
678
+
679
int is_transport_allowed(const char *type)
680
{
622
- const struct string_list *allowed = protocol_whitelist();
623
- return !allowed || string_list_has_string(allowed, type);
681
+ const struct string_list *whitelist = protocol_whitelist();
682
+ if (whitelist)
683
+ return string_list_has_string(whitelist, type);
684
+
685
+ switch (get_protocol_config(type)) {
686
+ case PROTOCOL_ALLOW_ALWAYS:
687
+ return 1;
688
+ case PROTOCOL_ALLOW_NEVER:
689
+ return 0;
690
+ case PROTOCOL_ALLOW_USER_ONLY:
691
+ return git_env_bool("GIT_PROTOCOL_FROM_USER", 1);
692
+ }
693
+
694
+ die("BUG: invalid protocol_allow_config type");
695
}
696
697
void transport_check_allowed(const char *type)