mirrors/git
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

credential: clear expired c->credential, unify secret clearing

Browse Source 
When a struct credential expires, credential_fill() clears c->password
so that clients don't try to use it later. However, a struct cred that
uses an alternate authtype won't have a password, but might have a
credential stored in c->credential.

This is a problem, for example, when an OAuth2 bearer token is used. In
the system I'm using, the OAuth2 configuration generates and caches a
bearer token that is valid for an hour. After the token expires, git
needs to call back into the credential helper to use a stored refresh
token to get a new bearer token. But if c->credential is still non-NULL,
git will instead try to use the expired token and fail with an error:

 fatal: Authentication failed for 'https://<oauth2-enabled-server>/repository'

And on the server:

 [auth_openidc:error] [client <ip>:34012] oidc_proto_validate_exp: "exp" validation failure (1717522989): JWT expired 224 seconds ago

Fix this by clearing both c->password and c->credential for an expired
struct credential. While we're at it, use credential_clear_secrets()
wherever both c->password and c->credential are being cleared.

Update comments in credential.h to mention the new struct fields.

Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Aaron Plattner
2024-06-06 11:35:16 -07:00
committed by Junio C Hamano
parent ffff4ac065
commit 27db485c34
2 changed files with 28 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
credential.c
View File

@ -20,12 +20,11 @@ void credential_init(struct credential *c)
void credential_clear(struct credential *c)
{
credential_clear_secrets(c);
free(c->protocol);
free(c->host);
free(c->path);
free(c->username);
free(c->password);
free(c->credential);
free(c->oauth_refresh_token);
free(c->authtype);
string_list_clear(&c->helpers, 0);
@ -479,9 +478,15 @@ void credential_fill(struct credential *c, int all_capabilities)
for (i = 0; i < c->helpers.nr; i++) {
credential_do(c, c->helpers.items[i].string, "get");
if (c->password_expiry_utc < time(NULL)) {
/* Discard expired password */
FREE_AND_NULL(c->password);
/*
* Don't use credential_clear() here: callers such as
* cmd_credential() expect to still be able to call
* credential_write() on a struct credential whose
* secrets have expired.
*/
credential_clear_secrets(c);
/* Reset expiry to maintain consistency */
c->password_expiry_utc = TIME_MAX;
}
@ -528,9 +533,8 @@ void credential_reject(struct credential *c)
for (i = 0; i < c->helpers.nr; i++)
credential_do(c, c->helpers.items[i].string, "erase");
credential_clear_secrets(c);
FREE_AND_NULL(c->username);
FREE_AND_NULL(c->password);
FREE_AND_NULL(c->credential);
FREE_AND_NULL(c->oauth_refresh_token);
c->password_expiry_utc = TIME_MAX;
c->approved = 0;