Authentication support for pserver

PATCH In review Ævar Arnfjörð Bjarmason 5 participants 25 messages Jun 15, 2016 1 message not in the archive Documentation

lore

Share & tools

lore

Ævar Arnfjörð Bjarmason

author

2016-06-15 22:43 UTC #0 lore raw

PATCH 1/1 Authentication support for pserver

I've patched git-cvsserver so that it supports pserver authentication as opposed to only anonymous access. The patch itself works but I haven't updated the relevant documentation or test cases and won't be able to do so until after the weekend so I'm submitting what I have for review on the list.

The pserver user/password database is stored in the config file for each repository because I didn't know where else to put it, for example:

avar@oe:/tmp/fleh$ cat /tmp/git-test.git/config 
[core]
	repositoryformatversion = 0
	filemode = true
	bare = true

[gitcvs]
enabled = 1

[gitcvs.users]
avar = foobar
whee = whoo

The user can then login/checkout and do other operations with the user/password set in the config file:

avar@oe:/tmp/fleh$ cvs -d:pserver:whee:whoo@localhost/tmp/git-test.git login
Logging in to :pserver:whee@localhost:2401/tmp/git-test.git
avar@oe:/tmp/fleh$ cvs -d:pserver:whee:oops@localhost/tmp/git-test.git login
Logging in to :pserver:whee@localhost:2401/tmp/git-test.git
The password supplied for user whee was incorrect
cvs login: authorization failed: server localhost rejected access to
    /tmp/git-test.git for user whee

$ cvs -d:pserver:whee:whoo@localhost/tmp/git-test.git co master
cvs checkout: Updating master
U master/.emacs
[...]

git-cvsserver.perl +61 ~~-12~~

index ecded3b..851383b 100755
@@ -150,12 +150,32 @@ if ($state->{method} eq 'pserver') {
        exit 1;
     }
     $line = <STDIN>; chomp $line;
-    unless ($line eq 'anonymous') {
-       print "E Only anonymous user allowed via pserver\n";
-       print "I HATE YOU\n";
-       exit 1;
+    my $user = $line;
+    $line = <STDIN>; chomp $line;
+    my $password = $line;
+
+    unless ($user eq 'anonymous') {
+        # Trying to authenticate a user
+        if (not exists $cfg->{gitcvs}->{users}) {
+            print "E the repo config file needs a [gitcvs.users] section with user/password key-value pairs\n";
+            print "I HATE YOU\n";
+            exit 1;
+        } elsif (exists $cfg->{gitcvs}->{users} and not exists $cfg->{gitcvs}->{users}->{$user}) {
+            print "E the repo config file has a [gitcvs.users] section but the user $user is not defined in it\n";
+            print "I HATE YOU\n";
+            exit 1;
+        } else {
+            my $descrambled_password = descramble($password);
+            my $cleartext_password = $cfg->{gitcvs}->{users}->{$user};
+            if ($descrambled_password ne $cleartext_password) {
+                print "E The password supplied for user $user was incorrect\n";
+                print "I HATE YOU\n";
+                exit 1;
+            }
+            # else fall through to LOVE
+        }
     }
-    $line = <STDIN>; chomp $line;    # validate the password?
+
     $line = <STDIN>; chomp $line;
     unless ($line eq "END $request REQUEST") {
        die "E Do not understand $line -- expecting END $request REQUEST\n";

@@ -273,7 +293,7 @@ sub req_Root
     }
     foreach my $line ( @gitvars )
     {
-        next unless ( $line =~ /^(gitcvs)\.(?:(ext|pserver)\.)?([\w-]+)=(.*)$/ );
+        next unless ( $line =~ /^(gitcvs)\.(?:(ext|pserver|users)\.)?([\w-]+)=(.*)$/ );
         unless ($2) {
             $cfg->{$1}{$3} = $4;
         } else {

@@ -1176,12 +1196,6 @@ sub req_ci
 
     $log->info("req_ci : " . ( defined($data) ? $data : "[NULL]" ));
 
-    if ( $state->{method} eq 'pserver')
-    {
-        print "error 1 pserver access cannot commit\n";
-        exit;
-    }
-
     if ( -e $state->{CVSROOT} . "/index" )
     {
         $log->warn("file 'index' already exists in the git repository");

@@ -2107,6 +2121,41 @@ sub kopts_from_path
     }
 }
 
+
+sub descramble
+{
+    # This table is from src/scramble.c in the CVS source
+    my @SHIFTS = (
+        0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15,
+        16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31,
+        114,120, 53, 79, 96,109, 72,108, 70, 64, 76, 67,116, 74, 68, 87,
+        111, 52, 75,119, 49, 34, 82, 81, 95, 65,112, 86,118,110,122,105,
+        41, 57, 83, 43, 46,102, 40, 89, 38,103, 45, 50, 42,123, 91, 35,
+        125, 55, 54, 66,124,126, 59, 47, 92, 71,115, 78, 88,107,106, 56,
+        36,121,117,104,101,100, 69, 73, 99, 63, 94, 93, 39, 37, 61, 48,
+        58,113, 32, 90, 44, 98, 60, 51, 33, 97, 62, 77, 84, 80, 85,223,
+        225,216,187,166,229,189,222,188,141,249,148,200,184,136,248,190,
+        199,170,181,204,138,232,218,183,255,234,220,247,213,203,226,193,
+        174,172,228,252,217,201,131,230,197,211,145,238,161,179,160,212,
+        207,221,254,173,202,146,224,151,140,196,205,130,135,133,143,246,
+        192,159,244,239,185,168,215,144,139,165,180,157,147,186,214,176,
+        227,231,219,169,175,156,206,198,129,164,150,210,154,177,134,127,
+        182,128,158,208,162,132,167,209,149,241,153,251,237,236,171,195,
+        243,233,253,240,194,250,191,155,142,137,245,235,163,242,178,152
+    );
+    my ($str) = @_;
+
+    # This should never happen, the same format has been used since
+    # CVS was spawned
+    $str =~ s/^(.)//;
+    die "invalid password format $1" unless $1 eq 'A';
+
+    $str =~ s/(.)/chr $SHIFTS[ord $1]/ge;
+
+    return $str;
+}
+
+
 package GITCVS::log;
 
 ####

Junio C Hamano

2016-06-15 22:43 UTC #1 lore raw

Quoted 8 lines · [email protected] (Ævar Arnfjörð Bjarmason) writes:

git-cvsserver.perl +8 -0

+    unless ($user eq 'anonymous') {
+        # Trying to authenticate a user
+        if (not exists $cfg->{gitcvs}->{users}) {
+            print "E the repo config file needs a [gitcvs.users] section with user/password key-value pairs\n";
+            print "I HATE YOU\n";
+            exit 1;
+        } elsif (exists $cfg->{gitcvs}->{users} and not exists $cfg->{gitcvs}->{users}->{$user}) {
+            print "E the repo config file has a [gitcvs.users] section but the user $user is not defined in it\n";

git-cvsserver.perl if ($state->{method} eq 'pserver') { · line 174

Quoted 10 lines

git-cvsserver.perl +10 -0

+            print "I HATE YOU\n";
+            exit 1;
+        } else {
+            my $descrambled_password = descramble($password);
+            my $cleartext_password = $cfg->{gitcvs}->{users}->{$user};
+            if ($descrambled_password ne $cleartext_password) {
+                print "E The password supplied for user $user was incorrect\n";
+                print "I HATE YOU\n";
+                exit 1;
+            }

I do not know what the real pserver does but by sending these E lines in the latter two different forms back to the client you are leaking sensitive information, which is probably not what you want (the first one is Ok, though. It would help the server administrator to notice misconfiguration, and until it is corrected nobody would be able to log in anyway).

Admittedly, the pserver password scrambling is not a real security, but if we were paranoid, we would probably be even adding random delay in "no user found" case and "password does not match" case, so that the client cannot even tell from the response latency if a username exists at the server.

git-cvsserver.perl sub req_ci · line 1184

Quoted 10 lines

git-cvsserver.perl +0 -6

@@ -1176,12 +1196,6 @@ sub req_ci
 
     $log->info("req_ci : " . ( defined($data) ? $data : "[NULL]" ));
 
-    if ( $state->{method} eq 'pserver')
-    {
-        print "error 1 pserver access cannot commit\n";
-        exit;
-    }
-

Is this correct? You are still allowing anonymous pserver access, so shouldn't you check if this was an anonymous access or authenticated one and refuse access like before for anonymous people?

git-cvsserver.perl sub kopts_from_path · line 2151

Quoted 6 lines

git-cvsserver.perl +6 -0

+    my ($str) = @_;
+
+    # This should never happen, the same format has been used since
+    # CVS was spawned
+    $str =~ s/^(.)//;
+    die "invalid password format $1" unless $1 eq 'A';

I do not quite understand what "spawn" means in this sentence.

Shawn O. Pearce

2016-06-15 22:43 UTC #2 lore raw

Quoted 8 lines · Junio C Hamano

git-cvsserver.perl sub kopts_from_path · line 2151
Quoted 5 lines · [email protected] (Ævar Arnfjörð Bjarmason) writes:
git-cvsserver.perl +5 -0
+
+    # This should never happen, the same format has been used since
+    # CVS was spawned
+    $str =~ s/^(.)//;
+    die "invalid password format $1" unless $1 eq 'A';
I do not quite understand what "spawn" means in this sentence.

spawned: since it came from the depths of hell and cursed all
developers, until the day Git was born. :-)

Signature · 1 line

Shawn.

Ævar Arnfjörð Bjarmason

author

2016-06-15 22:43 UTC #3 lore raw

In reply to Junio C Hamano

Quoted 21 lines · Junio C Hamano

Quoted 8 lines · [email protected] (Ævar Arnfjörð Bjarmason) writes:

(quoted diff) +8 -0

+    unless ($user eq 'anonymous') {
+        # Trying to authenticate a user
+        if (not exists $cfg->{gitcvs}->{users}) {
+            print "E the repo config file needs a [gitcvs.users] section with user/password key-value pairs\n";
+            print "I HATE YOU\n";
+            exit 1;
+        } elsif (exists $cfg->{gitcvs}->{users} and not exists $cfg->{gitcvs}->{users}->{$user}) {
+            print "E the repo config file has a [gitcvs.users] section but the user $user is not defined in it\n";

Review

Quoted 10 lines

(quoted diff) +10 -0

+            print "I HATE YOU\n";
+            exit 1;
+        } else {
+            my $descrambled_password = descramble($password);
+            my $cleartext_password = $cfg->{gitcvs}->{users}->{$user};
+            if ($descrambled_password ne $cleartext_password) {
+                print "E The password supplied for user $user was incorrect\n";
+                print "I HATE YOU\n";
+                exit 1;
+            }

Quoted 6 lines

I do not know what the real pserver does but by sending these E lines in the latter two different forms back to the client you are leaking sensitive information, which is probably not what you want (the first one is Ok, though. It would help the server administrator to notice misconfiguration, and until it is corrected nobody would be able to log in anyway).

I've commented out those two error messages, it now doesn't provide that info.

Quoted 10 lines

Admittedly, the pserver password scrambling is not a real security, but if we were paranoid, we would probably be even adding random delay in "no user found" case and "password does not match" case, so that the client cannot even tell from the response latency if a username exists at the server.
Quoted 4 lines
(quoted diff) +0 -0
@@ -1176,12 +1196,6 @@ sub req_ci
 
     $log->info("req_ci : " . ( defined($data) ? $data : "[NULL]" ));
 

Quoted 10 lines

Review sub req_ci · line 1184
Quoted 6 lines
(quoted diff) +0 -6
-    if ( $state->{method} eq 'pserver')
-    {
-        print "error 1 pserver access cannot commit\n";
-        exit;
-    }
-
Is this correct? You are still allowing anonymous pserver access, so shouldn't you check if this was an anonymous access or authenticated one and refuse access like before for anonymous people?

No it's not, oops. Fixed.

Quoted 8 lines

Review sub req_ci
Quoted 6 lines
(quoted diff) +6 -0
+    my ($str) = @_;
+
+    # This should never happen, the same format has been used since
+    # CVS was spawned
+    $str =~ s/^(.)//;
+    die "invalid password format $1" unless $1 eq 'A';
I do not quite understand what "spawn" means in this sentence.

Shawn O. Pearce put it best but I've changed the comment to be more readable to someone without a odd sense of humor:)

Documentation/git-cvsserver.txt +17 -4

index 258a62f..5ca84fc 100644
@@ -69,9 +69,6 @@ plugin. Most functionality works fine with both of these clients.
 LIMITATIONS
 -----------
 
-Currently cvsserver works over SSH connections for read/write clients, and
-over pserver for anonymous CVS access.
-
 CVS clients cannot tag, branch or perform GIT merges.
 
 git-cvsserver maps GIT branches to CVS modules. This is very different

@@ -81,7 +78,7 @@ one or more directories.
 INSTALLATION
 ------------
 
-1. If you are going to offer anonymous CVS access via pserver, add a line in
+1. If you are going to offer CVS access via pserver, add a line in
    /etc/inetd.conf like
 +
 --

@@ -98,6 +95,22 @@ looks like
    cvspserver stream tcp nowait nobody /usr/bin/git-cvsserver git-cvsserver pserver
 
 ------
+
+Only anonymous access is provided by pserve by default. To commit you
+will have to create pserver accounts, simply add a [gitcvs.users]
+section to the repositories you want to access, for example:
+
+------
+   
+   [gitcvs.users]
+        someuser = somepassword
+        otheruser = otherpassword
+   
+------
+Then provide your password via the pserver method, for example:
+------
+   cvs -d:pserver:someuser:somepassword@server/path/repo.git co <HEAD_name>
+------
 No special setup is needed for SSH access, other than having GIT tools
 in the PATH. If you have clients that do not accept the CVS_SERVER
 environment variable, you can rename git-cvsserver to cvs.

git-cvsserver.perl +66 -8

100 lines not on this page · raw message

Junio C Hamano

2016-06-15 22:43 UTC #4 lore raw

Documentation/git-cvsserver.txt

Quoted 4 lines · [email protected] (Ævar Arnfjörð Bjarmason) writes:

Documentation/git-cvsserver.txt +0 -0
index 258a62f..5ca84fc 100644

Looks good. I'll queue only so that I won't lose it and wait for Acks from Mart[iy]ns. Please sign off your patch.

Thanks.

Ævar Arnfjörð Bjarmason

author

2016-06-15 22:43 UTC #5 lore raw

Quoted 2 lines · Junio C Hamano

Looks good. I'll queue only so that I won't lose it and wait for Acks from Mart[iy]ns. Please sign off your patch.

Will this do?

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 Documentation/git-cvsserver.txt |   21 +++++++++--
 git-cvsserver.perl              |   74 ++++++++++++++++++++++++++++++++++----
 2 files changed, 83 insertions(+), 12 deletions(-)

Documentation/git-cvsserver.txt +17 -4

index 258a62f..5ca84fc 100644
@@ -69,9 +69,6 @@ plugin. Most functionality works fine with both of these clients.
 LIMITATIONS
 -----------
 
-Currently cvsserver works over SSH connections for read/write clients, and
-over pserver for anonymous CVS access.
-
 CVS clients cannot tag, branch or perform GIT merges.
 
 git-cvsserver maps GIT branches to CVS modules. This is very different

@@ -81,7 +78,7 @@ one or more directories.
 INSTALLATION
 ------------
 
-1. If you are going to offer anonymous CVS access via pserver, add a line in
+1. If you are going to offer CVS access via pserver, add a line in
    /etc/inetd.conf like
 +
 --

@@ -98,6 +95,22 @@ looks like
    cvspserver stream tcp nowait nobody /usr/bin/git-cvsserver git-cvsserver pserver
 
 ------
+
+Only anonymous access is provided by pserve by default. To commit you
+will have to create pserver accounts, simply add a [gitcvs.users]
+section to the repositories you want to access, for example:
+
+------
+   
+   [gitcvs.users]
+        someuser = somepassword
+        otheruser = otherpassword
+   
+------
+Then provide your password via the pserver method, for example:
+------
+   cvs -d:pserver:someuser:somepassword@server/path/repo.git co <HEAD_name>
+------
 No special setup is needed for SSH access, other than having GIT tools
 in the PATH. If you have clients that do not accept the CVS_SERVER
 environment variable, you can rename git-cvsserver to cvs.

git-cvsserver.perl +66 -8

100 lines not on this page · raw message

Signature · 1 line

1.5.3.6.gea559

Martin Langhoff

2016-06-15 22:44 UTC #6 lore raw

Quoted 2 lines · Ævar Arnfjörð Bjarmason

Quoted 2 lines
Looks good. I'll queue only so that I won't lose it and wait for Acks from Mart[iy]ns. Please sign off your patch.

I have been mulling a bit about this change. Seems correct from a code flow POV. But anon pserver support was added with a lot of trepidation. Authenticated, write-enabled pserver support fills me with dread ;-)

A few things that come to mind

- git/config is very likely to be readable if the site is served via
other means, like dumb http protocol, or git+ssh. So even if the password scrambling is mickey-mouse. it might make sense to force the password data to live elsewhere.

- umasks/file permissions will probably be handled by the underlying
git tools and core.sharedrepository, since we no longer update refs "manually". So after a bit of thinking, this should not be an issue.

- I still worry about running cvsserver with an acct that has write
privileges. With anon, all we need write access is the sqlite db, and that's not even based on user input. And it can be relocated elsewhere via git/config.

So, wondering about input validation and related matters re-read most of cvsserver. The only suspicious bit I find is a caller to transmitfile @ lines 1117, where the 2nd parameter doesn't come from tempfile() - if a nasty filename sneaked in, we could (perhaps) be in for a surprise. We do that for diff header prettyness - we could use --label / -L instead. Will try and prep a patch for that tomorrow if noone beats me to it (bedtime in nz!).

Hmmm. Does "worried ACK" count as an ACK? Can we add big fat warnings along the lines of "run this in a locked down environment, pretty please"?

cheers,

A message that is not in the archive (sent off-list or not yet received): [email protected]

Ævar Arnfjörð Bjarmason

2016-06-15 22:44 UTC #8 lore raw

Quoted 9 lines · Martin Langhoff

Quoted 4 lines · Martin Langhoff
- git/config is very likely to be readable if the site is served via
other means, like dumb http protocol, or git+ssh. So even if the password scrambling is mickey-mouse. it might make sense to force the password data to live elsewhere.
On this aspect, I see no reason why we wouldn't have the passwords crypt()ed or SHA1'd. Perl includes crypt() in the default distribution, so it wouldn't add any dependency.

It also includes Digest::SHA in the default distribution as of today:)

I could add another option for allowing users to choose their password storage, e.g.:

[gitcvs]
password_storage = plaintext # or sha1, crypt, ...

Junio C Hamano

2016-06-15 22:44 UTC #9 lore raw

Quoted 11 lines · Ævar Arnfjörð Bjarmason

Quoted 3 lines
On this aspect, I see no reason why we wouldn't have the passwords crypt()ed or SHA1'd. Perl includes crypt() in the default distribution, so it wouldn't add any dependency.
It also includes Digest::SHA in the default distribution as of today:)
I could add another option for allowing users to choose their password storage, e.g.:
[gitcvs]
password_storage = plaintext # or sha1, crypt, ...

I personally feel that selectable password storage format is going overboard. Pick a reasonable one and use it everywhere.

Using some form of crypt is a good idea but then we would need a separate mode of operation to gitcvs to generate user password.

	$ gitcvs adduser junio
        Password: ******
        Retype password: ******
	Added user 'junio' to .git/config
	$ exit

I personally do not care about deluser or change-password subcommands, as you can always go directly to .git/config to remove the user and recreate anew, but adding them might be nice finishing touches.

	$ gitcvs password junio
        New password: ******
        Retype password: ******
	Changed password for user 'junio' in .git/config        
	$ gitcvs deluser junio
        Are you sure you want to remove user 'junio' [y/N]? Y
	Removed user 'junio' from .git/config
	$ exit

Martin Langhoff

2016-06-15 22:44 UTC #10 lore raw

In reply to Martin Langhoff

Quoted 4 lines · Martin Langhoff

- git/config is very likely to be readable if the site is served via
other means, like dumb http protocol, or git+ssh. So even if the password scrambling is mickey-mouse. it might make sense to force the password data to live elsewhere.

On this aspect, I see no reason why we wouldn't have the passwords crypt()ed or SHA1'd. Perl includes crypt() in the default distribution, so it wouldn't add any dependency.

The protocol may be ROT13'ing the passwords, but we don't have to double-ROT13 them in our storage format ;-)

cheers,

martin

Ævar Arnfjörð Bjarmason

author

2016-06-15 22:44 UTC #11 lore raw

In reply to Martin Langhoff

Quoted 33 lines · Martin Langhoff

Quoted 2 lines · Ævar Arnfjörð Bjarmason
Quoted 2 lines
Looks good. I'll queue only so that I won't lose it and wait for Acks from Mart[iy]ns. Please sign off your patch.
I have been mulling a bit about this change. Seems correct from a code flow POV. But anon pserver support was added with a lot of trepidation. Authenticated, write-enabled pserver support fills me with dread ;-)
A few things that come to mind
- git/config is very likely to be readable if the site is served via
other means, like dumb http protocol, or git+ssh. So even if the password scrambling is mickey-mouse. it might make sense to force the password data to live elsewhere.
- umasks/file permissions will probably be handled by the underlying
git tools and core.sharedrepository, since we no longer update refs "manually". So after a bit of thinking, this should not be an issue.
- I still worry about running cvsserver with an acct that has write
privileges. With anon, all we need write access is the sqlite db, and that's not even based on user input. And it can be relocated elsewhere via git/config.
So, wondering about input validation and related matters re-read most of cvsserver. The only suspicious bit I find is a caller to transmitfile @ lines 1117, where the 2nd parameter doesn't come from tempfile() - if a nasty filename sneaked in, we could (perhaps) be in for a surprise. We do that for diff header prettyness - we could use --label / -L instead. Will try and prep a patch for that tomorrow if noone beats me to it (bedtime in nz!).

Quoted 3 lines

Hmmm. Does "worried ACK" count as an ACK? Can we add big fat warnings along the lines of "run this in a locked down environment, pretty please"?

Better late than never, here's a more complete and hopefully final patch to add authentication support to CVS. Thanks to Sam Vilain for contributing and kicking me into action.

Now you specify a user:password authentication database in the [gitcvs] section. The passwords are crypt()-ed and can be produced by htpasswd, example config file:

[gitcvs]
enabled = 1
authdb = /tmp/authdb.htpasswd

The patch can be pulled from git://git.nix.is/avar/git

It's also produced below:

Quoted 1 line

From 5900732b52c3a693bfb36c0bf56e3c5eb83ef65e Mon Sep 17 00:00:00 2001

From: =?utf-8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?= <[email protected]>
Date: Fri, 14 Dec 2007 08:08:46 +0000
Subject: [PATCH] git-cvsserver: authentication support for pserver
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Allow git-cvsserver to use authentication over pserver mode. The pserver user/password database is stored in the config file for each repository.

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

Worriedly-Acked-by Martin Langhoff <[email protected]>

---
 Documentation/git-cvsserver.txt |   21 +++++++++--
 git-cvsserver.perl              |   74 ++++++++++++++++++++++++++++++++++----
 2 files changed, 83 insertions(+), 12 deletions(-)

Documentation/git-cvsserver.txt +17 -4

index d3e9993..98183d4 100644
@@ -69,9 +69,6 @@ plugin. Most functionality works fine with both of these clients.
 LIMITATIONS
 -----------
 
-Currently cvsserver works over SSH connections for read/write clients, and
-over pserver for anonymous CVS access.
-
 CVS clients cannot tag, branch or perform GIT merges.
 
 git-cvsserver maps GIT branches to CVS modules. This is very different

@@ -81,7 +78,7 @@ one or more directories.
 INSTALLATION
 ------------
 
-1. If you are going to offer anonymous CVS access via pserver, add a line in
+1. If you are going to offer CVS access via pserver, add a line in
    /etc/inetd.conf like
 +
 --

@@ -98,6 +95,22 @@ looks like
    cvspserver stream tcp nowait nobody /usr/bin/git-cvsserver git-cvsserver pserver
 
 ------
+
+Only anonymous access is provided by pserve by default. To commit you
+will have to create pserver accounts, simply add a [gitcvs.users]
+section to the repositories you want to access, for example:
+
+------
+   
+   [gitcvs.users]
+        someuser = somepassword
+        otheruser = otherpassword
+   
+------
+Then provide your password via the pserver method, for example:
+------
+   cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>
+------
 No special setup is needed for SSH access, other than having GIT tools
 in the PATH. If you have clients that do not accept the CVS_SERVER
 environment variable, you can rename git-cvsserver to cvs.

git-cvsserver.perl +66 -8

100 lines not on this page · raw message

Signature · 1 line

1.5.3.rc3.120.g68d422

Quoted 1 line

From f59c255ed14c5b80d5328f94f6934461cfe454da Mon Sep 17 00:00:00 2001

From: Sam Vilain <[email protected]>
Date: Fri, 7 Mar 2008 11:03:14 +1300
Subject: [PATCH] git-cvsserver: use a password file cvsserver pserver

If a git repository is shared via HTTP, the config file is typically visible. Use an external file instead.

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 Documentation/git-cvsserver.txt |   21 ++++++++++++++++-----
 git-cvsserver.perl              |   27 ++++++++++++++-------------
 2 files changed, 30 insertions(+), 18 deletions(-)

Documentation/git-cvsserver.txt +16 -5

index 98183d4..c642f12 100644
@@ -97,16 +97,27 @@ looks like
 ------
 
 Only anonymous access is provided by pserve by default. To commit you
-will have to create pserver accounts, simply add a [gitcvs.users]
-section to the repositories you want to access, for example:
+will have to create pserver accounts, simply add a gitcvs.authdb
+setting in the config file of the repositories you want the cvsserver
+to allow writes to, for example:
 
 ------
    
-   [gitcvs.users]
-        someuser = somepassword
-        otheruser = otherpassword
+   [gitcvs]
+        authdb = /etc/cvsserver/passwd
    
 ------
+The format of these files is username followed by the crypted password,
+for example:
+
+------
+   myuser:$1Oyx5r9mdGZ2
+   myuser:$1$BA)@$vbnMJMDym7tA32AamXrm./
+------
+You can use the 'htpasswd' facility that comes with Apache to make these
+files, but Apache's MD5 crypt method differs from the one used by most C
+library's crypt() function, so don't use the -m option.
+
 Then provide your password via the pserver method, for example:
 ------
    cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>

git-cvsserver.perl +14 ~~-13~~

index 9bc2ff5..e54cbcd 100755
@@ -156,24 +156,25 @@ if ($state->{method} eq 'pserver') {
 
     unless ($user eq 'anonymous') {
         # Trying to authenticate a user
-        if (not exists $cfg->{gitcvs}->{users}) {
-            print "E the repo config file needs a [gitcvs.users] section with user/password key-value pairs\n";
+        if (not exists $cfg->{gitcvs}->{authdb}) {
+            print "E the repo config file needs a [gitcvs.authdb] section with a filename\n";
             print "I HATE YOU\n";
             exit 1;
-        } elsif (exists $cfg->{gitcvs}->{users} and not exists $cfg->{gitcvs}->{users}->{$user}) {
-            #print "E the repo config file has a [gitcvs.users] section but the user $user is not defined in it\n";
+        }
+	my $auth_ok;
+	open PASSWD, "<$cfg->{gitcvs}->{authdb}" or die $!;
+	while(<PASSWD>) {
+	    if (m{^\Q$user\E:(.*)}) {
+		if (crypt($user, $1) eq $1) {
+		    $auth_ok = 1;
+		}
+	    };
+	}
+	unless ($auth_ok) {
             print "I HATE YOU\n";
             exit 1;
-        } else {
-            my $descrambled_password = descramble($password);
-            my $cleartext_password = $cfg->{gitcvs}->{users}->{$user};
-            if ($descrambled_password ne $cleartext_password) {
-                #print "E The password supplied for user $user was incorrect\n";
-                print "I HATE YOU\n";
-                exit 1;
-            }
-            # else fall through to LOVE
         }
+        # else fall through to LOVE
     }
 
     # For checking whether the user is anonymous on commit

Signature · 1 line

1.5.3.rc3.120.g68d422

Quoted 1 line

From e8b69f313888900447f45ac3a8dceb38bd5c261e Mon Sep 17 00:00:00 2001

From: =?utf-8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?= <[email protected]>
Date: Thu, 6 Mar 2008 23:43:13 +0000
Subject: [PATCH] Indent the last commit to fit with the rest of the code.

Use lexical filehandles instead of global globs

Close the filehandle after the password database has been read

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 git-cvsserver.perl |   23 +++++++++++++----------
 1 files changed, 13 insertions(+), 10 deletions(-)

git-cvsserver.perl +13 ~~-10~~

index e54cbcd..f956ac9 100755
@@ -161,16 +161,19 @@ if ($state->{method} eq 'pserver') {
             print "I HATE YOU\n";
             exit 1;
         }
-	my $auth_ok;
-	open PASSWD, "<$cfg->{gitcvs}->{authdb}" or die $!;
-	while(<PASSWD>) {
-	    if (m{^\Q$user\E:(.*)}) {
-		if (crypt($user, $1) eq $1) {
-		    $auth_ok = 1;
-		}
-	    };
-	}
-	unless ($auth_ok) {
+
+        my $auth_ok;
+        open my $passwd, "<", $cfg->{gitcvs}->{authdb} or die $!;
+        while (<$passwd>) {
+            if (m{^\Q$user\E:(.*)}) {
+                if (crypt($user, $1) eq $1) {
+                    $auth_ok = 1;
+                }
+            };
+        }
+        close $passwd;
+
+        unless ($auth_ok) {
             print "I HATE YOU\n";
             exit 1;
         }

Signature · 1 line

1.5.3.rc3.120.g68d422

Quoted 1 line

From 90d3468556b46fc649a9408af42ff24ed2e50455 Mon Sep 17 00:00:00 2001

From: =?utf-8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?= <[email protected]>
Date: Fri, 7 Mar 2008 00:06:52 +0000
Subject: [PATCH] Produce an error if the user tries to supply a password for anonymous

Clarify the error message produced when there's no [gitcvs.authdb]

Produce an E error if the authdb doesn't exist instead of spewing $! to the user

do crypt($user, descramble($pass)) eq $hash; crypt($user, $hash) eq $hash would accept any password

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 git-cvsserver.perl |   28 +++++++++++++++++++++++-----
 1 files changed, 23 insertions(+), 5 deletions(-)

git-cvsserver.perl +23 -5

index f956ac9..aa0299e 100755
@@ -154,19 +154,36 @@ if ($state->{method} eq 'pserver') {
     $line = <STDIN>; chomp $line;
     my $password = $line;
 
-    unless ($user eq 'anonymous') {
+    if ($user eq 'anonymous') {
+        # "A" will be 1 byte, use length instead in case the
+        # encryption method ever changes (yeah, right!)
+        if (length($password) > 1 ) {
+            print "E Don't supply a password for the `anonymous' user\n";
+            print "I HATE YOU\n";
+        }
+
+        # Fall through to LOVE
+    } else {
         # Trying to authenticate a user
         if (not exists $cfg->{gitcvs}->{authdb}) {
-            print "E the repo config file needs a [gitcvs.authdb] section with a filename\n";
+            print "E the repo config file needs a [gitcvs] section with an 'authdb' parameter set to the filename of the authentication database\n";
+            print "I HATE YOU\n";
+            exit 1;
+        }
+
+        my $authdb = $cfg->{gitcvs}->{authdb};
+
+        unless (-e $authdb) {
+            print "E The authentication database specified in [gitcvs.authdb] does not exist\n";
             print "I HATE YOU\n";
             exit 1;
         }
 
         my $auth_ok;
-        open my $passwd, "<", $cfg->{gitcvs}->{authdb} or die $!;
+        open my $passwd, "<", $authdb or die $!;
         while (<$passwd>) {
             if (m{^\Q$user\E:(.*)}) {
-                if (crypt($user, $1) eq $1) {
+                if (crypt($user, descramble($password)) eq $1) {
                     $auth_ok = 1;
                 }
             };

@@ -177,7 +194,8 @@ if ($state->{method} eq 'pserver') {
             print "I HATE YOU\n";
             exit 1;
         }
-        # else fall through to LOVE
+
+        # Fall through to LOVE
     }
 
     # For checking whether the user is anonymous on commit

Signature · 1 line

1.5.3.rc3.120.g68d422

Quoted 1 line

From a55dfa2667da1473199ee70ca6cfd53094001119 Mon Sep 17 00:00:00 2001

From: =?utf-8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?= <[email protected]>
Date: Fri, 7 Mar 2008 00:09:14 +0000
Subject: [PATCH] document a perl snippet to produce passwords for those that don't have htpasswd

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 Documentation/git-cvsserver.txt |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

Documentation/git-cvsserver.txt +5 -0

index c642f12..d410a11 100644
@@ -118,6 +118,11 @@ You can use the 'htpasswd' facility that comes with Apache to make these
 files, but Apache's MD5 crypt method differs from the one used by most C
 library's crypt() function, so don't use the -m option.
 
+Alternatively you can produce the password with perl's crypt() operator:
+-----
+   perl -e 'my ($user, $pass) = @ARGV; printf "%s:%s\n", $user, crypt($user, $pass)' $USER password
+-----
+
 Then provide your password via the pserver method, for example:
 ------
    cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>

Signature · 1 line

1.5.3.rc3.120.g68d422

Ævar Arnfjörð Bjarmason

author

2016-06-15 22:44 UTC #12 lore raw

Quoted 8 lines · [email protected] (Ævar Arnfjörð Bjarmason) writes:

Better late than never, here's a more complete and hopefully final patch to add authentication support to CVS. Thanks to Sam Vilain for contributing and kicking me into action.
Now you specify a user:password authentication database in the [gitcvs] section. The passwords are crypt()-ed and can be produced by htpasswd, example config file:

Quoted 7 lines

[gitcvs]
enabled = 1
authdb = /tmp/authdb.htpasswd
The patch can be pulled from git://git.nix.is/avar/git
It's also produced below:

The patch needed a small fix, I didn't exit(1) after an error condition[1]. This can also be got at git://git.nix.is/avar/git and is produced in full below:

Quoted 1 line

From 5900732b52c3a693bfb36c0bf56e3c5eb83ef65e Mon Sep 17 00:00:00 2001

Allow git-cvsserver to use authentication over pserver mode. The pserver user/password database is stored in the config file for each repository.

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

Worriedly-Acked-by Martin Langhoff <[email protected]>

---
 Documentation/git-cvsserver.txt |   21 +++++++++--
 git-cvsserver.perl              |   74 ++++++++++++++++++++++++++++++++++----
 2 files changed, 83 insertions(+), 12 deletions(-)

Documentation/git-cvsserver.txt +17 -4

index d3e9993..98183d4 100644
@@ -69,9 +69,6 @@ plugin. Most functionality works fine with both of these clients.
 LIMITATIONS
 -----------
 
-Currently cvsserver works over SSH connections for read/write clients, and
-over pserver for anonymous CVS access.
-
 CVS clients cannot tag, branch or perform GIT merges.
 
 git-cvsserver maps GIT branches to CVS modules. This is very different

@@ -81,7 +78,7 @@ one or more directories.
 INSTALLATION
 ------------
 
-1. If you are going to offer anonymous CVS access via pserver, add a line in
+1. If you are going to offer CVS access via pserver, add a line in
    /etc/inetd.conf like
 +
 --

@@ -98,6 +95,22 @@ looks like
    cvspserver stream tcp nowait nobody /usr/bin/git-cvsserver git-cvsserver pserver
 
 ------
+
+Only anonymous access is provided by pserve by default. To commit you
+will have to create pserver accounts, simply add a [gitcvs.users]
+section to the repositories you want to access, for example:
+
+------
+   
+   [gitcvs.users]
+        someuser = somepassword
+        otheruser = otherpassword
+   
+------
+Then provide your password via the pserver method, for example:
+------
+   cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>
+------
 No special setup is needed for SSH access, other than having GIT tools
 in the PATH. If you have clients that do not accept the CVS_SERVER
 environment variable, you can rename git-cvsserver to cvs.

git-cvsserver.perl +66 -8

100 lines not on this page · raw message

Signature · 1 line

1.5.3.rc3.120.g68d422

Quoted 1 line

From f59c255ed14c5b80d5328f94f6934461cfe454da Mon Sep 17 00:00:00 2001

From: Sam Vilain <[email protected]>
Date: Fri, 7 Mar 2008 11:03:14 +1300
Subject: [PATCH] git-cvsserver: use a password file cvsserver pserver

If a git repository is shared via HTTP, the config file is typically visible. Use an external file instead.

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 Documentation/git-cvsserver.txt |   21 ++++++++++++++++-----
 git-cvsserver.perl              |   27 ++++++++++++++-------------
 2 files changed, 30 insertions(+), 18 deletions(-)

Documentation/git-cvsserver.txt +16 -5

index 98183d4..c642f12 100644
@@ -97,16 +97,27 @@ looks like
 ------
 
 Only anonymous access is provided by pserve by default. To commit you
-will have to create pserver accounts, simply add a [gitcvs.users]
-section to the repositories you want to access, for example:
+will have to create pserver accounts, simply add a gitcvs.authdb
+setting in the config file of the repositories you want the cvsserver
+to allow writes to, for example:
 
 ------
    
-   [gitcvs.users]
-        someuser = somepassword
-        otheruser = otherpassword
+   [gitcvs]
+        authdb = /etc/cvsserver/passwd
    
 ------
+The format of these files is username followed by the crypted password,
+for example:
+
+------
+   myuser:$1Oyx5r9mdGZ2
+   myuser:$1$BA)@$vbnMJMDym7tA32AamXrm./
+------
+You can use the 'htpasswd' facility that comes with Apache to make these
+files, but Apache's MD5 crypt method differs from the one used by most C
+library's crypt() function, so don't use the -m option.
+
 Then provide your password via the pserver method, for example:
 ------
    cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>

git-cvsserver.perl +14 ~~-13~~

index 9bc2ff5..e54cbcd 100755
@@ -156,24 +156,25 @@ if ($state->{method} eq 'pserver') {
 
     unless ($user eq 'anonymous') {
         # Trying to authenticate a user
-        if (not exists $cfg->{gitcvs}->{users}) {
-            print "E the repo config file needs a [gitcvs.users] section with user/password key-value pairs\n";
+        if (not exists $cfg->{gitcvs}->{authdb}) {
+            print "E the repo config file needs a [gitcvs.authdb] section with a filename\n";
             print "I HATE YOU\n";
             exit 1;
-        } elsif (exists $cfg->{gitcvs}->{users} and not exists $cfg->{gitcvs}->{users}->{$user}) {
-            #print "E the repo config file has a [gitcvs.users] section but the user $user is not defined in it\n";
+        }
+	my $auth_ok;
+	open PASSWD, "<$cfg->{gitcvs}->{authdb}" or die $!;
+	while(<PASSWD>) {
+	    if (m{^\Q$user\E:(.*)}) {
+		if (crypt($user, $1) eq $1) {
+		    $auth_ok = 1;
+		}
+	    };
+	}
+	unless ($auth_ok) {
             print "I HATE YOU\n";
             exit 1;
-        } else {
-            my $descrambled_password = descramble($password);
-            my $cleartext_password = $cfg->{gitcvs}->{users}->{$user};
-            if ($descrambled_password ne $cleartext_password) {
-                #print "E The password supplied for user $user was incorrect\n";
-                print "I HATE YOU\n";
-                exit 1;
-            }
-            # else fall through to LOVE
         }
+        # else fall through to LOVE
     }
 
     # For checking whether the user is anonymous on commit

Signature · 1 line

1.5.3.rc3.120.g68d422

Quoted 1 line

From e8b69f313888900447f45ac3a8dceb38bd5c261e Mon Sep 17 00:00:00 2001

From: =?utf-8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?= <[email protected]>
Date: Thu, 6 Mar 2008 23:43:13 +0000
Subject: [PATCH] Indent the last commit to fit with the rest of the code.

Use lexical filehandles instead of global globs

Close the filehandle after the password database has been read

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 git-cvsserver.perl |   23 +++++++++++++----------
 1 files changed, 13 insertions(+), 10 deletions(-)

git-cvsserver.perl +13 ~~-10~~

index e54cbcd..f956ac9 100755
@@ -161,16 +161,19 @@ if ($state->{method} eq 'pserver') {
             print "I HATE YOU\n";
             exit 1;
         }
-	my $auth_ok;
-	open PASSWD, "<$cfg->{gitcvs}->{authdb}" or die $!;
-	while(<PASSWD>) {
-	    if (m{^\Q$user\E:(.*)}) {
-		if (crypt($user, $1) eq $1) {
-		    $auth_ok = 1;
-		}
-	    };
-	}
-	unless ($auth_ok) {
+
+        my $auth_ok;
+        open my $passwd, "<", $cfg->{gitcvs}->{authdb} or die $!;
+        while (<$passwd>) {
+            if (m{^\Q$user\E:(.*)}) {
+                if (crypt($user, $1) eq $1) {
+                    $auth_ok = 1;
+                }
+            };
+        }
+        close $passwd;
+
+        unless ($auth_ok) {
             print "I HATE YOU\n";
             exit 1;
         }

Signature · 1 line

1.5.3.rc3.120.g68d422

Quoted 1 line

From 90d3468556b46fc649a9408af42ff24ed2e50455 Mon Sep 17 00:00:00 2001

Clarify the error message produced when there's no [gitcvs.authdb]

Produce an E error if the authdb doesn't exist instead of spewing $! to the user

do crypt($user, descramble($pass)) eq $hash; crypt($user, $hash) eq $hash would accept any password

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 git-cvsserver.perl |   28 +++++++++++++++++++++++-----
 1 files changed, 23 insertions(+), 5 deletions(-)

git-cvsserver.perl +23 -5

index f956ac9..aa0299e 100755
@@ -154,19 +154,36 @@ if ($state->{method} eq 'pserver') {
     $line = <STDIN>; chomp $line;
     my $password = $line;
 
-    unless ($user eq 'anonymous') {
+    if ($user eq 'anonymous') {
+        # "A" will be 1 byte, use length instead in case the
+        # encryption method ever changes (yeah, right!)
+        if (length($password) > 1 ) {
+            print "E Don't supply a password for the `anonymous' user\n";
+            print "I HATE YOU\n";
+        }
+
+        # Fall through to LOVE
+    } else {
         # Trying to authenticate a user
         if (not exists $cfg->{gitcvs}->{authdb}) {
-            print "E the repo config file needs a [gitcvs.authdb] section with a filename\n";
+            print "E the repo config file needs a [gitcvs] section with an 'authdb' parameter set to the filename of the authentication database\n";
+            print "I HATE YOU\n";
+            exit 1;
+        }
+
+        my $authdb = $cfg->{gitcvs}->{authdb};
+
+        unless (-e $authdb) {
+            print "E The authentication database specified in [gitcvs.authdb] does not exist\n";
             print "I HATE YOU\n";
             exit 1;
         }
 
         my $auth_ok;
-        open my $passwd, "<", $cfg->{gitcvs}->{authdb} or die $!;
+        open my $passwd, "<", $authdb or die $!;
         while (<$passwd>) {
             if (m{^\Q$user\E:(.*)}) {
-                if (crypt($user, $1) eq $1) {
+                if (crypt($user, descramble($password)) eq $1) {
                     $auth_ok = 1;
                 }
             };

@@ -177,7 +194,8 @@ if ($state->{method} eq 'pserver') {
             print "I HATE YOU\n";
             exit 1;
         }
-        # else fall through to LOVE
+
+        # Fall through to LOVE
     }
 
     # For checking whether the user is anonymous on commit

Signature · 1 line

1.5.3.rc3.120.g68d422

Quoted 1 line

From a55dfa2667da1473199ee70ca6cfd53094001119 Mon Sep 17 00:00:00 2001

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 Documentation/git-cvsserver.txt |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

Documentation/git-cvsserver.txt +5 -0

index c642f12..d410a11 100644
@@ -118,6 +118,11 @@ You can use the 'htpasswd' facility that comes with Apache to make these
 files, but Apache's MD5 crypt method differs from the one used by most C
 library's crypt() function, so don't use the -m option.
 
+Alternatively you can produce the password with perl's crypt() operator:
+-----
+   perl -e 'my ($user, $pass) = @ARGV; printf "%s:%s\n", $user, crypt($user, $pass)' $USER password
+-----
+
 Then provide your password via the pserver method, for example:
 ------
    cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>

Signature · 1 line

1.5.3.rc3.120.g68d422

Quoted 1 line

From 60f893bd9fe329bd5cf8ec513d10ec00e85feb2c Mon Sep 17 00:00:00 2001

From: =?utf-8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?= <[email protected]>
Date: Fri, 7 Mar 2008 16:06:31 +0000
Subject: [PATCH] exit after producing the error about anonymous having a password

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 git-cvsserver.perl |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

git-cvsserver.perl +1 -0

index aa0299e..da48ebd 100755
@@ -160,6 +160,7 @@ if ($state->{method} eq 'pserver') {
         if (length($password) > 1 ) {
             print "E Don't supply a password for the `anonymous' user\n";
             print "I HATE YOU\n";
+            exit 1;
         }
 
         # Fall through to LOVE

Signature · 1 line

1.5.3.rc3.120.g68d422

1. http://git.nix.is/?p=avar/git;a=commitdiff;h=60f893bd9fe329bd5cf8ec513d10ec00e85feb2c

Ævar Arnfjörð Bjarmason

author

2016-06-15 22:44 UTC #13 lore raw

Quoted 487 lines · [email protected] (Ævar Arnfjörð Bjarmason) writes:

Quoted 8 lines · [email protected] (Ævar Arnfjörð Bjarmason) writes:

Better late than never, here's a more complete and hopefully final patch to add authentication support to CVS. Thanks to Sam Vilain for contributing and kicking me into action.
Now you specify a user:password authentication database in the [gitcvs] section. The passwords are crypt()-ed and can be produced by htpasswd, example config file:

Quoted 7 lines

[gitcvs]
enabled = 1
authdb = /tmp/authdb.htpasswd
The patch can be pulled from git://git.nix.is/avar/git
It's also produced below:

The patch needed a small fix, I didn't exit(1) after an error condition[1]. This can also be got at git://git.nix.is/avar/git and is produced in full below:

From 5900732b52c3a693bfb36c0bf56e3c5eb83ef65e Mon Sep 17 00:00:00 2001
From: =?utf-8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?= <[email protected]>
Date: Fri, 14 Dec 2007 08:08:46 +0000
Subject: [PATCH] git-cvsserver: authentication support for pserver
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Allow git-cvsserver to use authentication over pserver mode. The pserver user/password database is stored in the config file for each repository.

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

Worriedly-Acked-by Martin Langhoff <[email protected]>

---
 Documentation/git-cvsserver.txt |   21 +++++++++--
 git-cvsserver.perl              |   74 ++++++++++++++++++++++++++++++++++----
 2 files changed, 83 insertions(+), 12 deletions(-)

Documentation/git-cvsserver.txt +17 -4

index d3e9993..98183d4 100644
@@ -69,9 +69,6 @@ plugin. Most functionality works fine with both of these clients.
 LIMITATIONS
 -----------
 
-Currently cvsserver works over SSH connections for read/write clients, and
-over pserver for anonymous CVS access.
-
 CVS clients cannot tag, branch or perform GIT merges.
 
 git-cvsserver maps GIT branches to CVS modules. This is very different

@@ -81,7 +78,7 @@ one or more directories.
 INSTALLATION
 ------------
 
-1. If you are going to offer anonymous CVS access via pserver, add a line in
+1. If you are going to offer CVS access via pserver, add a line in
    /etc/inetd.conf like
 +
 --

@@ -98,6 +95,22 @@ looks like
    cvspserver stream tcp nowait nobody /usr/bin/git-cvsserver git-cvsserver pserver
 
 ------
+
+Only anonymous access is provided by pserve by default. To commit you
+will have to create pserver accounts, simply add a [gitcvs.users]
+section to the repositories you want to access, for example:
+
+------
+   
+   [gitcvs.users]
+        someuser = somepassword
+        otheruser = otherpassword
+   
+------
+Then provide your password via the pserver method, for example:
+------
+   cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>
+------
 No special setup is needed for SSH access, other than having GIT tools
 in the PATH. If you have clients that do not accept the CVS_SERVER
 environment variable, you can rename git-cvsserver to cvs.

git-cvsserver.perl +66 -8

index afe3d0b..9bc2ff5 100755
@@ -150,12 +150,35 @@ if ($state->{method} eq 'pserver') {
        exit 1;
     }
     $line = <STDIN>; chomp $line;
-    unless ($line eq 'anonymous') {
-       print "E Only anonymous user allowed via pserver\n";
-       print "I HATE YOU\n";
-       exit 1;
+    my $user = $line;
+    $line = <STDIN>; chomp $line;
+    my $password = $line;
+
+    unless ($user eq 'anonymous') {
+        # Trying to authenticate a user
+        if (not exists $cfg->{gitcvs}->{users}) {
+            print "E the repo config file needs a [gitcvs.users] section with user/password key-value pairs\n";
+            print "I HATE YOU\n";
+            exit 1;
+        } elsif (exists $cfg->{gitcvs}->{users} and not exists $cfg->{gitcvs}->{users}->{$user}) {
+            #print "E the repo config file has a [gitcvs.users] section but the user $user is not defined in it\n";
+            print "I HATE YOU\n";
+            exit 1;
+        } else {
+            my $descrambled_password = descramble($password);
+            my $cleartext_password = $cfg->{gitcvs}->{users}->{$user};
+            if ($descrambled_password ne $cleartext_password) {
+                #print "E The password supplied for user $user was incorrect\n";
+                print "I HATE YOU\n";
+                exit 1;
+            }
+            # else fall through to LOVE
+        }
     }
-    $line = <STDIN>; chomp $line;    # validate the password?
+
+    # For checking whether the user is anonymous on commit
+    $state->{user} = $user;
+
     $line = <STDIN>; chomp $line;
     unless ($line eq "END $request REQUEST") {
        die "E Do not understand $line -- expecting END $request REQUEST\n";

@@ -273,7 +296,7 @@ sub req_Root
     }
     foreach my $line ( @gitvars )
     {
-        next unless ( $line =~ /^(gitcvs)\.(?:(ext|pserver)\.)?([\w-]+)=(.*)$/ );
+        next unless ( $line =~ /^(gitcvs)\.(?:(ext|pserver|users)\.)?([\w-]+)=(.*)$/ );
         unless ($2) {
             $cfg->{$1}{$3} = $4;
         } else {

@@ -1176,9 +1199,9 @@ sub req_ci
 
     $log->info("req_ci : " . ( defined($data) ? $data : "[NULL]" ));
 
-    if ( $state->{method} eq 'pserver')
+    if ($state->{method} eq 'pserver' and $state->{user} eq 'anonymous')
     {
-        print "error 1 pserver access cannot commit\n";
+        print "error 1 anonymous user cannot commit via pserver\n";
         exit;
     }

@@ -2107,6 +2130,41 @@ sub kopts_from_path
     }
 }
 
+
+sub descramble
+{
+    # This table is from src/scramble.c in the CVS source
+    my @SHIFTS = (
+        0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15,
+        16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31,
+        114,120, 53, 79, 96,109, 72,108, 70, 64, 76, 67,116, 74, 68, 87,
+        111, 52, 75,119, 49, 34, 82, 81, 95, 65,112, 86,118,110,122,105,
+        41, 57, 83, 43, 46,102, 40, 89, 38,103, 45, 50, 42,123, 91, 35,
+        125, 55, 54, 66,124,126, 59, 47, 92, 71,115, 78, 88,107,106, 56,
+        36,121,117,104,101,100, 69, 73, 99, 63, 94, 93, 39, 37, 61, 48,
+        58,113, 32, 90, 44, 98, 60, 51, 33, 97, 62, 77, 84, 80, 85,223,
+        225,216,187,166,229,189,222,188,141,249,148,200,184,136,248,190,
+        199,170,181,204,138,232,218,183,255,234,220,247,213,203,226,193,
+        174,172,228,252,217,201,131,230,197,211,145,238,161,179,160,212,
+        207,221,254,173,202,146,224,151,140,196,205,130,135,133,143,246,
+        192,159,244,239,185,168,215,144,139,165,180,157,147,186,214,176,
+        227,231,219,169,175,156,206,198,129,164,150,210,154,177,134,127,
+        182,128,158,208,162,132,167,209,149,241,153,251,237,236,171,195,
+        243,233,253,240,194,250,191,155,142,137,245,235,163,242,178,152
+    );
+    my ($str) = @_;
+
+    # This should never happen, the same password format (A) bas been
+    # used by CVS since the beginning of time
+    $str =~ s/^(.)//;
+    die "invalid password format $1" unless $1 eq 'A';
+
+    $str =~ s/(.)/chr $SHIFTS[ord $1]/ge;
+
+    return $str;
+}
+
+
 package GITCVS::log;
 
 ####

Signature · 16 lines

1.5.3.rc3.120.g68d422


From f59c255ed14c5b80d5328f94f6934461cfe454da Mon Sep 17 00:00:00 2001
From: Sam Vilain <[email protected]>
Date: Fri, 7 Mar 2008 11:03:14 +1300
Subject: [PATCH] git-cvsserver: use a password file cvsserver pserver

If a git repository is shared via HTTP, the config file is typically
visible.  Use an external file instead.

Signed-off-by: Ævar Arnfjörð Bjarmason <[email protected]>
---
 Documentation/git-cvsserver.txt |   21 ++++++++++++++++-----
 git-cvsserver.perl              |   27 ++++++++++++++-------------
 2 files changed, 30 insertions(+), 18 deletions(-)

Documentation/git-cvsserver.txt +16 -5

index 98183d4..c642f12 100644
@@ -97,16 +97,27 @@ looks like
 ------
 
 Only anonymous access is provided by pserve by default. To commit you
-will have to create pserver accounts, simply add a [gitcvs.users]
-section to the repositories you want to access, for example:
+will have to create pserver accounts, simply add a gitcvs.authdb
+setting in the config file of the repositories you want the cvsserver
+to allow writes to, for example:
 
 ------
 
-   [gitcvs.users]
-        someuser = somepassword
-        otheruser = otherpassword
+   [gitcvs]
+        authdb = /etc/cvsserver/passwd
 
 ------
+The format of these files is username followed by the crypted password,
+for example:
+
+------
+   myuser:$1Oyx5r9mdGZ2
+   myuser:$1$BA)@$vbnMJMDym7tA32AamXrm./
+------
+You can use the 'htpasswd' facility that comes with Apache to make these
+files, but Apache's MD5 crypt method differs from the one used by most C
+library's crypt() function, so don't use the -m option.
+
 Then provide your password via the pserver method, for example:
 ------
    cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>

git-cvsserver.perl +14 ~~-13~~

index 9bc2ff5..e54cbcd 100755
@@ -156,24 +156,25 @@ if ($state->{method} eq 'pserver') {
 
     unless ($user eq 'anonymous') {
         # Trying to authenticate a user
-        if (not exists $cfg->{gitcvs}->{users}) {
-            print "E the repo config file needs a [gitcvs.users] section with user/password key-value pairs\n";
+        if (not exists $cfg->{gitcvs}->{authdb}) {
+            print "E the repo config file needs a [gitcvs.authdb] section with a filename\n";
             print "I HATE YOU\n";
             exit 1;
-        } elsif (exists $cfg->{gitcvs}->{users} and not exists $cfg->{gitcvs}->{users}->{$user}) {
-            #print "E the repo config file has a [gitcvs.users] section but the user $user is not defined in it\n";
+        }
+	my $auth_ok;
+	open PASSWD, "<$cfg->{gitcvs}->{authdb}" or die $!;
+	while(<PASSWD>) {
+	    if (m{^\Q$user\E:(.*)}) {
+		if (crypt($user, $1) eq $1) {
+		    $auth_ok = 1;
+		}
+	    };
+	}
+	unless ($auth_ok) {
             print "I HATE YOU\n";
             exit 1;
-        } else {
-            my $descrambled_password = descramble($password);
-            my $cleartext_password = $cfg->{gitcvs}->{users}->{$user};
-            if ($descrambled_password ne $cleartext_password) {
-                #print "E The password supplied for user $user was incorrect\n";
-                print "I HATE YOU\n";
-                exit 1;
-            }
-            # else fall through to LOVE
         }
+        # else fall through to LOVE
     }
 
     # For checking whether the user is anonymous on commit

Signature · 16 lines

1.5.3.rc3.120.g68d422

From e8b69f313888900447f45ac3a8dceb38bd5c261e Mon Sep 17 00:00:00 2001
From: =?utf-8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?= <[email protected]>
Date: Thu, 6 Mar 2008 23:43:13 +0000
Subject: [PATCH] Indent the last commit to fit with the rest of the code.

Use lexical filehandles instead of global globs

Close the filehandle after the password database has been read

Signed-off-by: Ævar Arnfjörð Bjarmason <[email protected]>
---
 git-cvsserver.perl |   23 +++++++++++++----------
 1 files changed, 13 insertions(+), 10 deletions(-)

git-cvsserver.perl +13 ~~-10~~

index e54cbcd..f956ac9 100755
@@ -161,16 +161,19 @@ if ($state->{method} eq 'pserver') {
             print "I HATE YOU\n";
             exit 1;
         }
-	my $auth_ok;
-	open PASSWD, "<$cfg->{gitcvs}->{authdb}" or die $!;
-	while(<PASSWD>) {
-	    if (m{^\Q$user\E:(.*)}) {
-		if (crypt($user, $1) eq $1) {
-		    $auth_ok = 1;
-		}
-	    };
-	}
-	unless ($auth_ok) {
+
+        my $auth_ok;
+        open my $passwd, "<", $cfg->{gitcvs}->{authdb} or die $!;
+        while (<$passwd>) {
+            if (m{^\Q$user\E:(.*)}) {
+                if (crypt($user, $1) eq $1) {
+                    $auth_ok = 1;
+                }
+            };
+        }
+        close $passwd;
+
+        unless ($auth_ok) {
             print "I HATE YOU\n";
             exit 1;
         }

Signature · 20 lines

1.5.3.rc3.120.g68d422


From 90d3468556b46fc649a9408af42ff24ed2e50455 Mon Sep 17 00:00:00 2001
From: =?utf-8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?= <[email protected]>
Date: Fri, 7 Mar 2008 00:06:52 +0000
Subject: [PATCH] Produce an error if the user tries to supply a password for anonymous

Clarify the error message produced when there's no [gitcvs.authdb]

Produce an E error if the authdb doesn't exist instead of spewing $!
to the user

do crypt($user, descramble($pass)) eq $hash; crypt($user, $hash) eq
$hash would accept any password

Signed-off-by: Ævar Arnfjörð Bjarmason <[email protected]>
---
 git-cvsserver.perl |   28 +++++++++++++++++++++++-----
 1 files changed, 23 insertions(+), 5 deletions(-)

git-cvsserver.perl +23 -5

index f956ac9..aa0299e 100755
@@ -154,19 +154,36 @@ if ($state->{method} eq 'pserver') {
     $line = <STDIN>; chomp $line;
     my $password = $line;
 
-    unless ($user eq 'anonymous') {
+    if ($user eq 'anonymous') {
+        # "A" will be 1 byte, use length instead in case the
+        # encryption method ever changes (yeah, right!)
+        if (length($password) > 1 ) {
+            print "E Don't supply a password for the `anonymous' user\n";
+            print "I HATE YOU\n";
+        }
+
+        # Fall through to LOVE
+    } else {
         # Trying to authenticate a user
         if (not exists $cfg->{gitcvs}->{authdb}) {
-            print "E the repo config file needs a [gitcvs.authdb] section with a filename\n";
+            print "E the repo config file needs a [gitcvs] section with an 'authdb' parameter set to the filename of the authentication database\n";
+            print "I HATE YOU\n";
+            exit 1;
+        }
+
+        my $authdb = $cfg->{gitcvs}->{authdb};
+
+        unless (-e $authdb) {
+            print "E The authentication database specified in [gitcvs.authdb] does not exist\n";
             print "I HATE YOU\n";
             exit 1;
         }
 
         my $auth_ok;
-        open my $passwd, "<", $cfg->{gitcvs}->{authdb} or die $!;
+        open my $passwd, "<", $authdb or die $!;
         while (<$passwd>) {
             if (m{^\Q$user\E:(.*)}) {
-                if (crypt($user, $1) eq $1) {
+                if (crypt($user, descramble($password)) eq $1) {
                     $auth_ok = 1;
                 }
             };

@@ -177,7 +194,8 @@ if ($state->{method} eq 'pserver') {
             print "I HATE YOU\n";
             exit 1;
         }
-        # else fall through to LOVE
+
+        # Fall through to LOVE
     }
 
     # For checking whether the user is anonymous on commit

Signature · 13 lines

1.5.3.rc3.120.g68d422


From a55dfa2667da1473199ee70ca6cfd53094001119 Mon Sep 17 00:00:00 2001
From: =?utf-8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?= <[email protected]>
Date: Fri, 7 Mar 2008 00:09:14 +0000
Subject: [PATCH] document a perl snippet to produce passwords for those that don't have htpasswd


Signed-off-by: Ævar Arnfjörð Bjarmason <[email protected]>
---
 Documentation/git-cvsserver.txt |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

Documentation/git-cvsserver.txt +5 -0

index c642f12..d410a11 100644
@@ -118,6 +118,11 @@ You can use the 'htpasswd' facility that comes with Apache to make these
 files, but Apache's MD5 crypt method differs from the one used by most C
 library's crypt() function, so don't use the -m option.
 
+Alternatively you can produce the password with perl's crypt() operator:
+-----
+   perl -e 'my ($user, $pass) = @ARGV; printf "%s:%s\n", $user, crypt($user, $pass)' $USER password
+-----
+
 Then provide your password via the pserver method, for example:
 ------
    cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>

Signature · 13 lines

1.5.3.rc3.120.g68d422


From 60f893bd9fe329bd5cf8ec513d10ec00e85feb2c Mon Sep 17 00:00:00 2001
From: =?utf-8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?= <[email protected]>
Date: Fri, 7 Mar 2008 16:06:31 +0000
Subject: [PATCH] exit after producing the error about anonymous having a password


Signed-off-by: Ævar Arnfjörð Bjarmason <[email protected]>
---
 git-cvsserver.perl |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

git-cvsserver.perl +1 -0

index aa0299e..da48ebd 100755
@@ -160,6 +160,7 @@ if ($state->{method} eq 'pserver') {
         if (length($password) > 1 ) {
             print "E Don't supply a password for the `anonymous' user\n";
             print "I HATE YOU\n";
+            exit 1;
         }
 
         # Fall through to LOVE

Signature · 5 lines

1.5.3.rc3.120.g68d422



1. http://git.nix.is/?p=avar/git;a=commitdiff;h=60f893bd9fe329bd5cf8ec513d10ec00e85feb2c

It has been over 3 months since I submitted this patch without anyone acting on it. In absence of comment from the Mart[yi]ns could this please applied anyway?

Martin Langhoff

2016-06-15 22:44 UTC #14 lore raw

Quoted 5 lines · Ævar Arnfjörð Bjarmason

Quoted 1 line
1. http://git.nix.is/?p=avar/git;a=commitdiff;h=60f893bd9fe329bd5cf8ec513d10ec00e85feb2c
It has been over 3 months since I submitted this patch without anyone acting on it. In absence of comment from the Mart[yi]ns could this please applied anyway?

Sorry. My opinion on this is a mild ACK on the technical front, and a bit of a frown ("do we really want to offer this?"). Specifically, my concern goes beyond what you can do against a pserver service - git hooks can be targeted with this. "Warning: as safe as telnet" ;-)

cheers,

Signature · 5 lines

 [email protected]
 [email protected] -- School Server Architect
 - ask interesting questions
 - don't get distracted with shiny stuff - working code first
 - http://wiki.laptop.org/go/User:Martinlanghoff

Junio C Hamano

2016-06-15 22:44 UTC #15 lore raw

Quoted 11 lines · Martin Langhoff

Quoted 5 lines · Ævar Arnfjörð Bjarmason
Quoted 1 line
1. http://git.nix.is/?p=avar/git;a=commitdiff;h=60f893bd9fe329bd5cf8ec513d10ec00e85feb2c
It has been over 3 months since I submitted this patch without anyone acting on it. In absence of comment from the Mart[yi]ns could this please applied anyway?
Sorry. My opinion on this is a mild ACK on the technical front, and a bit of a frown ("do we really want to offer this?"). Specifically, my concern goes beyond what you can do against a pserver service - git hooks can be targeted with this. "Warning: as safe as telnet" ;-)

"As safe as telnet" is Ok as long as it is strictly optional. What I would primarily be worried about is if this change is a no-op for existing users, when they chose not to enable the new feature.

Junio C Hamano

2016-06-15 22:44 UTC #16 lore raw

In reply to Ævar Arnfjörð Bjarmason

Quoted 4 lines · [email protected] (Ævar Arnfjörð Bjarmason) writes:

...
It has been over 3 months since I submitted this patch without anyone acting on it. In absence of comment from the Mart[yi]ns could this please applied anyway?

Can you send a patch that can be applied (cf. Documentation/SubmittingPatches)?

Ævar Arnfjörð Bjarmason

2016-06-15 22:48 UTC #17 lore raw

cover git-cvsserver: password support for pserver

This series adds optional pserver authentication support to git-cvsserver. It's useful in legacy environments that rely on pserver authentication support, and for various reasons can't easily switch to ssh-based authentication.

This series was originally submitted in 2007/2008[1] and approved by Junio[2], it stalled because I didn't follow up[3] on sending it in an applyable format until now.

Changes since the series was originally submitted:

- There's now a test for pserver authentication support

- Fixed the commit message of a few commits & squashed some commits.

- It now complies with Documentation/SubmittingPatches. I.e. has signed-off-by lines.

- Changed my E-Mail address in the commits.

1. http://lists-archives.org/git/640574-authentication-support-for-pserver.html
2. http://lists-archives.org/git/640617-authentication-support-for-pserver.html
3. http://article.gmane.org/gmane.comp.version-control.git/85521/

Sam Vilain (1):
git-cvsserver: use a password file cvsserver pserver

Ævar Arnfjörð Bjarmason (5):
git-cvsserver: authentication support for pserver
git-cvsserver: indent & clean up authdb code
git-cvsserver: Improved error handling for pserver
git-cvsserver: document making a password without htpasswd
git-cvsserver: test for pserver authentication support

 Documentation/git-cvsserver.txt |   37 +++++++++++++--
 git-cvsserver.perl              |   97 +++++++++++++++++++++++++++++++++++---
 t/t9400-git-cvsserver-server.sh |   16 ++++++-
 3 files changed, 137 insertions(+), 13 deletions(-)

Ævar Arnfjörð Bjarmason

2016-06-15 22:48 UTC #18 lore raw

PATCH 1/6 git-cvsserver: authentication support for pserver

In reply to Junio C Hamano

Allow git-cvsserver to use authentication over pserver mode. The pserver user/password database is stored in the config file for each repository.

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

Worriedly-Acked-by Martin Langhoff <[email protected]>

---
 Documentation/git-cvsserver.txt |   21 +++++++++--
 git-cvsserver.perl              |   74 ++++++++++++++++++++++++++++++++++----
 2 files changed, 83 insertions(+), 12 deletions(-)

Documentation/git-cvsserver.txt +17 -4

index dbb053e..f4e1339 100644
@@ -72,9 +72,6 @@ plugin. Most functionality works fine with both of these clients.
 LIMITATIONS
 -----------
 
-Currently cvsserver works over SSH connections for read/write clients, and
-over pserver for anonymous CVS access.
-
 CVS clients cannot tag, branch or perform GIT merges.
 
 'git-cvsserver' maps GIT branches to CVS modules. This is very different

@@ -84,7 +81,7 @@ one or more directories.
 INSTALLATION
 ------------
 
-1. If you are going to offer anonymous CVS access via pserver, add a line in
+1. If you are going to offer CVS access via pserver, add a line in
    /etc/inetd.conf like
 +
 --

@@ -101,6 +98,22 @@ looks like
    cvspserver stream tcp nowait nobody /usr/bin/git-cvsserver git-cvsserver pserver
 
 ------
+
+Only anonymous access is provided by pserve by default. To commit you
+will have to create pserver accounts, simply add a [gitcvs.users]
+section to the repositories you want to access, for example:
+
+------
+   
+   [gitcvs.users]
+        someuser = somepassword
+        otheruser = otherpassword
+   
+------
+Then provide your password via the pserver method, for example:
+------
+   cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>
+------
 No special setup is needed for SSH access, other than having GIT tools
 in the PATH. If you have clients that do not accept the CVS_SERVER
 environment variable, you can rename 'git-cvsserver' to `cvs`.

git-cvsserver.perl +66 -8

100 lines not on this page · raw message

Signature · 1 line

1.7.1.84.gd92f8

Ævar Arnfjörð Bjarmason

2016-06-15 22:48 UTC #19 lore raw

PATCH v2 1/6 git-cvsserver: authentication support for pserver

Allow git-cvsserver to use authentication over pserver mode. The pserver user/password database is stored in the config file for each repository.

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

Worriedly-Acked-by Martin Langhoff <[email protected]>

---
The descramble() method was potentially broken if anyone had fed it a non-bytestring. Now it uses unpack() instead of regexes.

 Documentation/git-cvsserver.txt |   21 +++++++++--
 git-cvsserver.perl              |   73 ++++++++++++++++++++++++++++++++++----
 2 files changed, 82 insertions(+), 12 deletions(-)

Documentation/git-cvsserver.txt +17 -4

index dbb053e..f4e1339 100644
@@ -72,9 +72,6 @@ plugin. Most functionality works fine with both of these clients.
 LIMITATIONS
 -----------
 
-Currently cvsserver works over SSH connections for read/write clients, and
-over pserver for anonymous CVS access.
-
 CVS clients cannot tag, branch or perform GIT merges.
 
 'git-cvsserver' maps GIT branches to CVS modules. This is very different

@@ -84,7 +81,7 @@ one or more directories.
 INSTALLATION
 ------------
 
-1. If you are going to offer anonymous CVS access via pserver, add a line in
+1. If you are going to offer CVS access via pserver, add a line in
    /etc/inetd.conf like
 +
 --

@@ -101,6 +98,22 @@ looks like
    cvspserver stream tcp nowait nobody /usr/bin/git-cvsserver git-cvsserver pserver
 
 ------
+
+Only anonymous access is provided by pserve by default. To commit you
+will have to create pserver accounts, simply add a [gitcvs.users]
+section to the repositories you want to access, for example:
+
+------
+   
+   [gitcvs.users]
+        someuser = somepassword
+        otheruser = otherpassword
+   
+------
+Then provide your password via the pserver method, for example:
+------
+   cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>
+------
 No special setup is needed for SSH access, other than having GIT tools
 in the PATH. If you have clients that do not accept the CVS_SERVER
 environment variable, you can rename 'git-cvsserver' to `cvs`.

git-cvsserver.perl +65 -8

99 lines not on this page · raw message

Signature · 1 line

1.7.1.84.gd92f8

Ævar Arnfjörð Bjarmason

2016-06-15 22:48 UTC #20 lore raw

PATCH 2/6 git-cvsserver: use a password file cvsserver pserver

In reply to Junio C Hamano

From: Sam Vilain <[email protected]>

If a git repository is shared via HTTP, the config file is typically visible. Use an external file instead.

---
 Documentation/git-cvsserver.txt |   21 ++++++++++++++++-----
 git-cvsserver.perl              |   27 ++++++++++++++-------------
 2 files changed, 30 insertions(+), 18 deletions(-)

Documentation/git-cvsserver.txt +16 -5

index f4e1339..bc2da8c 100644
@@ -100,16 +100,27 @@ looks like
 ------
 
 Only anonymous access is provided by pserve by default. To commit you
-will have to create pserver accounts, simply add a [gitcvs.users]
-section to the repositories you want to access, for example:
+will have to create pserver accounts, simply add a gitcvs.authdb
+setting in the config file of the repositories you want the cvsserver
+to allow writes to, for example:
 
 ------
    
-   [gitcvs.users]
-        someuser = somepassword
-        otheruser = otherpassword
+   [gitcvs]
+        authdb = /etc/cvsserver/passwd
    
 ------
+The format of these files is username followed by the crypted password,
+for example:
+
+------
+   myuser:$1Oyx5r9mdGZ2
+   myuser:$1$BA)@$vbnMJMDym7tA32AamXrm./
+------
+You can use the 'htpasswd' facility that comes with Apache to make these
+files, but Apache's MD5 crypt method differs from the one used by most C
+library's crypt() function, so don't use the -m option.
+
 Then provide your password via the pserver method, for example:
 ------
    cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>

git-cvsserver.perl +14 ~~-13~~

index d9a26cb..ca02fba 100755
@@ -189,24 +189,25 @@ if ($state->{method} eq 'pserver') {
 
     unless ($user eq 'anonymous') {
         # Trying to authenticate a user
-        if (not exists $cfg->{gitcvs}->{users}) {
-            print "E the repo config file needs a [gitcvs.users] section with user/password key-value pairs\n";
+        if (not exists $cfg->{gitcvs}->{authdb}) {
+            print "E the repo config file needs a [gitcvs.authdb] section with a filename\n";
             print "I HATE YOU\n";
             exit 1;
-        } elsif (exists $cfg->{gitcvs}->{users} and not exists $cfg->{gitcvs}->{users}->{$user}) {
-            #print "E the repo config file has a [gitcvs.users] section but the user $user is not defined in it\n";
+        }
+	my $auth_ok;
+	open PASSWD, "<$cfg->{gitcvs}->{authdb}" or die $!;
+	while(<PASSWD>) {
+	    if (m{^\Q$user\E:(.*)}) {
+		if (crypt($user, $1) eq $1) {
+		    $auth_ok = 1;
+		}
+	    };
+	}
+	unless ($auth_ok) {
             print "I HATE YOU\n";
             exit 1;
-        } else {
-            my $descrambled_password = descramble($password);
-            my $cleartext_password = $cfg->{gitcvs}->{users}->{$user};
-            if ($descrambled_password ne $cleartext_password) {
-                #print "E The password supplied for user $user was incorrect\n";
-                print "I HATE YOU\n";
-                exit 1;
-            }
-            # else fall through to LOVE
         }
+        # else fall through to LOVE
     }
 
     # For checking whether the user is anonymous on commit

Signature · 1 line

1.7.1.84.gd92f8

Ævar Arnfjörð Bjarmason

2016-06-15 22:48 UTC #21 lore raw

PATCH v2 2/6 git-cvsserver: use a password file cvsserver pserver

From: Sam Vilain <[email protected]>

If a git repository is shared via HTTP, the config file is typically visible. Use an external file instead.

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
This patch was missing a removal of the gitcvs.users config key introduced in the last patch.

 Documentation/git-cvsserver.txt |   21 ++++++++++++++++-----
 git-cvsserver.perl              |   29 +++++++++++++++--------------
 2 files changed, 31 insertions(+), 19 deletions(-)

Documentation/git-cvsserver.txt +16 -5

index f4e1339..bc2da8c 100644
@@ -100,16 +100,27 @@ looks like
 ------
 
 Only anonymous access is provided by pserve by default. To commit you
-will have to create pserver accounts, simply add a [gitcvs.users]
-section to the repositories you want to access, for example:
+will have to create pserver accounts, simply add a gitcvs.authdb
+setting in the config file of the repositories you want the cvsserver
+to allow writes to, for example:
 
 ------
    
-   [gitcvs.users]
-        someuser = somepassword
-        otheruser = otherpassword
+   [gitcvs]
+        authdb = /etc/cvsserver/passwd
    
 ------
+The format of these files is username followed by the crypted password,
+for example:
+
+------
+   myuser:$1Oyx5r9mdGZ2
+   myuser:$1$BA)@$vbnMJMDym7tA32AamXrm./
+------
+You can use the 'htpasswd' facility that comes with Apache to make these
+files, but Apache's MD5 crypt method differs from the one used by most C
+library's crypt() function, so don't use the -m option.
+
 Then provide your password via the pserver method, for example:
 ------
    cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>

git-cvsserver.perl +15 ~~-14~~

index 7097419..8b97fb8 100755
@@ -189,24 +189,25 @@ if ($state->{method} eq 'pserver') {
 
     unless ($user eq 'anonymous') {
         # Trying to authenticate a user
-        if (not exists $cfg->{gitcvs}->{users}) {
-            print "E the repo config file needs a [gitcvs.users] section with user/password key-value pairs\n";
+        if (not exists $cfg->{gitcvs}->{authdb}) {
+            print "E the repo config file needs a [gitcvs.authdb] section with a filename\n";
             print "I HATE YOU\n";
             exit 1;
-        } elsif (exists $cfg->{gitcvs}->{users} and not exists $cfg->{gitcvs}->{users}->{$user}) {
-            #print "E the repo config file has a [gitcvs.users] section but the user $user is not defined in it\n";
+        }
+	my $auth_ok;
+	open PASSWD, "<$cfg->{gitcvs}->{authdb}" or die $!;
+	while(<PASSWD>) {
+	    if (m{^\Q$user\E:(.*)}) {
+		if (crypt($user, $1) eq $1) {
+		    $auth_ok = 1;
+		}
+	    };
+	}
+	unless ($auth_ok) {
             print "I HATE YOU\n";
             exit 1;
-        } else {
-            my $descrambled_password = descramble($password);
-            my $cleartext_password = $cfg->{gitcvs}->{users}->{$user};
-            if ($descrambled_password ne $cleartext_password) {
-                #print "E The password supplied for user $user was incorrect\n";
-                print "I HATE YOU\n";
-                exit 1;
-            }
-            # else fall through to LOVE
         }
+        # else fall through to LOVE
     }
 
     # For checking whether the user is anonymous on commit

@@ -337,7 +338,7 @@ sub req_Root
     }
     foreach my $line ( @gitvars )
     {
-        next unless ( $line =~ /^(gitcvs)\.(?:(ext|pserver|users)\.)?([\w-]+)=(.*)$/ );
+        next unless ( $line =~ /^(gitcvs)\.(?:(ext|pserver)\.)?([\w-]+)=(.*)$/ );
         unless ($2) {
             $cfg->{$1}{$3} = $4;
         } else {

Signature · 1 line

1.7.1.84.gd92f8

Ævar Arnfjörð Bjarmason

2016-06-15 22:48 UTC #22 lore raw

PATCH 3/6 git-cvsserver: indent & clean up authdb code

In reply to Junio C Hamano

- Indent the last commit to fit with the rest of the code.

- Use lexical filehandles instead of global globs

- Close the filehandle after the password database has been read.

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 git-cvsserver.perl |   23 +++++++++++++----------
 1 files changed, 13 insertions(+), 10 deletions(-)

git-cvsserver.perl +13 ~~-10~~

index ca02fba..9f63c56 100755
@@ -194,16 +194,19 @@ if ($state->{method} eq 'pserver') {
             print "I HATE YOU\n";
             exit 1;
         }
-	my $auth_ok;
-	open PASSWD, "<$cfg->{gitcvs}->{authdb}" or die $!;
-	while(<PASSWD>) {
-	    if (m{^\Q$user\E:(.*)}) {
-		if (crypt($user, $1) eq $1) {
-		    $auth_ok = 1;
-		}
-	    };
-	}
-	unless ($auth_ok) {
+
+        my $auth_ok;
+        open my $passwd, "<", $cfg->{gitcvs}->{authdb} or die $!;
+        while (<$passwd>) {
+            if (m{^\Q$user\E:(.*)}) {
+                if (crypt($user, $1) eq $1) {
+                    $auth_ok = 1;
+                }
+            };
+        }
+        close $passwd;
+
+        unless ($auth_ok) {
             print "I HATE YOU\n";
             exit 1;
         }

Signature · 1 line

1.7.1.84.gd92f8

Ævar Arnfjörð Bjarmason

2016-06-15 22:48 UTC #23 lore raw

PATCH 4/6 git-cvsserver: Improved error handling for pserver

In reply to Junio C Hamano

- Produce an error if the user tries to supply a password for anonymous

- Clarify the error message produced when there's no [gitcvs.authdb]

- Produce an E error if the authdb doesn't exist instead of spewing $! to the user

- do crypt($user, descramble($pass)) eq $hash; crypt($user, $hash) eq $hash would accept any password

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 git-cvsserver.perl |   29 ++++++++++++++++++++++++-----
 1 files changed, 24 insertions(+), 5 deletions(-)

git-cvsserver.perl +24 -5

index 9f63c56..813df76 100755
@@ -187,19 +187,37 @@ if ($state->{method} eq 'pserver') {
     $line = <STDIN>; chomp $line;
     my $password = $line;
 
-    unless ($user eq 'anonymous') {
+    if ($user eq 'anonymous') {
+        # "A" will be 1 byte, use length instead in case the
+        # encryption method ever changes (yeah, right!)
+        if (length($password) > 1 ) {
+            print "E Don't supply a password for the `anonymous' user\n";
+            print "I HATE YOU\n";
+            exit 1;
+        }
+
+        # Fall through to LOVE
+    } else {
         # Trying to authenticate a user
         if (not exists $cfg->{gitcvs}->{authdb}) {
-            print "E the repo config file needs a [gitcvs.authdb] section with a filename\n";
+            print "E the repo config file needs a [gitcvs] section with an 'authdb' parameter set to the filename of the authentication database\n";
+            print "I HATE YOU\n";
+            exit 1;
+        }
+
+        my $authdb = $cfg->{gitcvs}->{authdb};
+
+        unless (-e $authdb) {
+            print "E The authentication database specified in [gitcvs.authdb] does not exist\n";
             print "I HATE YOU\n";
             exit 1;
         }
 
         my $auth_ok;
-        open my $passwd, "<", $cfg->{gitcvs}->{authdb} or die $!;
+        open my $passwd, "<", $authdb or die $!;
         while (<$passwd>) {
             if (m{^\Q$user\E:(.*)}) {
-                if (crypt($user, $1) eq $1) {
+                if (crypt($user, descramble($password)) eq $1) {
                     $auth_ok = 1;
                 }
             };

@@ -210,7 +228,8 @@ if ($state->{method} eq 'pserver') {
             print "I HATE YOU\n";
             exit 1;
         }
-        # else fall through to LOVE
+
+        # Fall through to LOVE
     }
 
     # For checking whether the user is anonymous on commit

Signature · 1 line

1.7.1.84.gd92f8

Ævar Arnfjörð Bjarmason

2016-06-15 22:48 UTC #24 lore raw

PATCH 5/6 git-cvsserver: document making a password without htpasswd

In reply to Junio C Hamano

This perl snippet is useful for quickly making a password without htpasswd(1).

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 Documentation/git-cvsserver.txt |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

Documentation/git-cvsserver.txt +5 -0

index bc2da8c..5825787 100644
@@ -121,6 +121,11 @@ You can use the 'htpasswd' facility that comes with Apache to make these
 files, but Apache's MD5 crypt method differs from the one used by most C
 library's crypt() function, so don't use the -m option.
 
+Alternatively you can produce the password with perl's crypt() operator:
+-----
+   perl -e 'my ($user, $pass) = @ARGV; printf "%s:%s\n", $user, crypt($user, $pass)' $USER password
+-----
+
 Then provide your password via the pserver method, for example:
 ------
    cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>

Signature · 1 line

1.7.1.84.gd92f8

Ævar Arnfjörð Bjarmason

2016-06-15 22:48 UTC #25 lore raw

PATCH 6/6 git-cvsserver: test for pserver authentication support

In reply to Junio C Hamano

Signed-off-by Ævar Arnfjörð Bjarmason <[email protected]>

---
 t/t9400-git-cvsserver-server.sh |   16 +++++++++++++++-
 1 files changed, 15 insertions(+), 1 deletions(-)

t/t9400-git-cvsserver-server.sh +15 -1

index daef2d6..437e9b8 100755
@@ -48,7 +48,9 @@ test_expect_success 'setup' '
   git pull secondroot master &&
   git clone -q --bare "$WORKDIR/.git" "$SERVERDIR" >/dev/null 2>&1 &&
   GIT_DIR="$SERVERDIR" git config --bool gitcvs.enabled true &&
-  GIT_DIR="$SERVERDIR" git config gitcvs.logfile "$SERVERDIR/gitcvs.log"
+  GIT_DIR="$SERVERDIR" git config gitcvs.logfile "$SERVERDIR/gitcvs.log" &&
+  GIT_DIR="$SERVERDIR" git config gitcvs.authdb "$SERVERDIR/auth.db" &&
+  echo cvsuser:cvGVEarMLnhlA > "$SERVERDIR/auth.db"
 '
 
 # note that cvs doesn't accept absolute pathnames

@@ -94,6 +96,14 @@ git
 END VERIFICATION REQUEST
 EOF
 
+cat >login-git-ok <<EOF
+BEGIN VERIFICATION REQUEST
+$SERVERDIR
+cvsuser
+Ah<Z:yZZ30 e
+END VERIFICATION REQUEST
+EOF
+
 test_expect_success 'pserver authentication' \
   'cat request-anonymous | git-cvsserver pserver >log 2>&1 &&
    sed -ne \$p log | grep "^I LOVE YOU\$"'

@@ -107,6 +117,10 @@ test_expect_success 'pserver authentication failure (non-anonymous user)' \
    fi &&
    sed -ne \$p log | grep "^I HATE YOU\$"'
 
+test_expect_success 'pserver authentication success (non-anonymous user with password)' \
+  'cat login-git-ok | git-cvsserver pserver >log 2>&1 &&
+   sed -ne \$p log | grep "^I LOVE YOU\$"'
+
 test_expect_success 'pserver authentication (login)' \
   'cat login-anonymous | git-cvsserver pserver >log 2>&1 &&
    sed -ne \$p log | grep "^I LOVE YOU\$"'

Signature · 1 line

1.7.1.84.gd92f8