mirrors/git
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'cb/cvsserver'

Browse Source 
"git cvsserver" had a long-standing bug in its authentication code,
which has finally been corrected (it is unclear and is a separate
question if anybody is seriously using it, though).

* cb/cvsserver:
  Documentation: cleanup git-cvsserver
  git-cvsserver: protect against NULL in crypt(3)
  git-cvsserver: use crypt correctly to compare password hashes
This commit is contained in:
Junio C Hamano
2021-10-03 21:49:17 -07:00
parent df9c83bdf7 4b81f690f6
commit 1030daecda
3 changed files with 24 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
Documentation/git-cvsserver.txt
View File

@ -99,7 +99,7 @@ looks like
------ ------
Only anonymous access is provided by pserve by default. To commit you Only anonymous access is provided by pserver by default. To commit you
will have to create pserver accounts, simply add a gitcvs.authdb will have to create pserver accounts, simply add a gitcvs.authdb
setting in the config file of the repositories you want the cvsserver setting in the config file of the repositories you want the cvsserver
to allow writes to, for example: to allow writes to, for example:
@ -114,21 +114,20 @@ The format of these files is username followed by the encrypted password,
for example: for example:
------ ------
myuser:$1Oyx5r9mdGZ2 myuser:sqkNi8zPf01HI
myuser:$1$BA)@$vbnMJMDym7tA32AamXrm./ myuser:$1$9K7FzU28$VfF6EoPYCJEYcVQwATgOP/
myuser:$5$.NqmNH1vwfzGpV8B$znZIcumu1tNLATgV2l6e1/mY8RzhUDHMOaVOeL1cxV3
------ ------
You can use the 'htpasswd' facility that comes with Apache to make these You can use the 'htpasswd' facility that comes with Apache to make these
files, but Apache's MD5 crypt method differs from the one used by most C files, but only with the -d option (or -B if your system suports it).
library's crypt() function, so don't use the -m option.
Alternatively you can produce the password with perl's crypt() operator: Preferably use the system specific utility that manages password hash
----- creation in your platform (e.g. mkpasswd in Linux, encrypt in OpenBSD or
perl -e 'my ($user, $pass) = @ARGV; printf "%s:%s\n", $user, crypt($user, $pass)' $USER password pwhash in NetBSD) and paste it in the right location.
-----
Then provide your password via the pserver method, for example: Then provide your password via the pserver method, for example:
------ ------
cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name> cvs -d:pserver:someuser:somepassword@server:/path/repo.git co <HEAD_name>
------ ------
No special setup is needed for SSH access, other than having Git tools No special setup is needed for SSH access, other than having Git tools
in the PATH. If you have clients that do not accept the CVS_SERVER in the PATH. If you have clients that do not accept the CVS_SERVER
@ -138,7 +137,7 @@ Note: Newer CVS versions (>= 1.12.11) also support specifying
CVS_SERVER directly in CVSROOT like CVS_SERVER directly in CVSROOT like
------ ------
cvs -d ":ext;CVS_SERVER=git cvsserver:user@server/path/repo.git" co <HEAD_name> cvs -d ":ext;CVS_SERVER=git cvsserver:user@server/path/repo.git" co <HEAD_name>
------ ------
This has the advantage that it will be saved in your 'CVS/Root' files and This has the advantage that it will be saved in your 'CVS/Root' files and
you don't need to worry about always setting the correct environment you don't need to worry about always setting the correct environment

5
git-cvsserver.perl
View File

@ -222,10 +222,11 @@ if ($state->{method} eq 'pserver') {
open my $passwd, "<", $authdb or die $!; open my $passwd, "<", $authdb or die $!;
while (<$passwd>) { while (<$passwd>) {
if (m{^\Q$user\E:(.*)}) { if (m{^\Q$user\E:(.*)}) {
if (crypt($user, descramble($password)) eq $1) { my $hash = crypt(descramble($password), $1);
if (defined $hash and $hash eq $1) {
$auth_ok = 1; $auth_ok = 1;
} }
}; }
} }
close $passwd; close $passwd;

9
t/t9400-git-cvsserver-server.sh
View File

@ -36,6 +36,13 @@ CVSWORK="$PWD/cvswork"
CVS_SERVER=git-cvsserver CVS_SERVER=git-cvsserver
export CVSROOT CVS_SERVER export CVSROOT CVS_SERVER
if perl -e 'exit(1) if not defined crypt("", "cv")'
then
PWDHASH='lac2ItudM3.KM'
else
PWDHASH='$2b$10$t8fGvE/a9eLmfOLzsZme2uOa2QtoMYwIxq9wZA6aBKtF1Yb7FJIzi'
fi
rm -rf "$CVSWORK" "$SERVERDIR" rm -rf "$CVSWORK" "$SERVERDIR"
test_expect_success 'setup' ' test_expect_success 'setup' '
git config push.default matching && git config push.default matching &&
@ -54,7 +61,7 @@ test_expect_success 'setup' '
GIT_DIR="$SERVERDIR" git config --bool gitcvs.enabled true && GIT_DIR="$SERVERDIR" git config --bool gitcvs.enabled true &&
GIT_DIR="$SERVERDIR" git config gitcvs.logfile "$SERVERDIR/gitcvs.log" && GIT_DIR="$SERVERDIR" git config gitcvs.logfile "$SERVERDIR/gitcvs.log" &&
GIT_DIR="$SERVERDIR" git config gitcvs.authdb "$SERVERDIR/auth.db" && GIT_DIR="$SERVERDIR" git config gitcvs.authdb "$SERVERDIR/auth.db" &&
echo cvsuser:cvGVEarMLnhlA > "$SERVERDIR/auth.db" echo "cvsuser:$PWDHASH" >"$SERVERDIR/auth.db"
' '
# note that cvs doesn't accept absolute pathnames # note that cvs doesn't accept absolute pathnames