t/t5551-http-fetch-smart.sh

   1 #!/bin/sh
   2
   3 : ${HTTP_PROTO:=HTTP/1.1}
   4 test_description="test smart fetching over http via http-backend ($HTTP_PROTO)"
   5 GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME=main
   6 export GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME
   7
   8 . ./test-lib.sh
   9 . "$TEST_DIRECTORY"/lib-httpd.sh
  10 test "$HTTP_PROTO" = "HTTP/2" && enable_http2
  11 start_httpd
  12
  13 test_expect_success HTTP2 'enable client-side http/2' '
  14         git config --global http.version HTTP/2
  15 '
  16
  17 test_expect_success 'setup repository' '
  18         git config push.default matching &&
  19         echo content >file &&
  20         git add file &&
  21         git commit -m one
  22 '
  23
  24 test_expect_success 'create http-accessible bare repository' '
  25         mkdir "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" &&
  26         (cd "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" &&
  27          git --bare init
  28         ) &&
  29         git remote add public "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" &&
  30         git push public main:main
  31 '
  32
  33 setup_askpass_helper
  34
  35 test_expect_success 'clone http repository' '
  36         if test_have_prereq HTTP2 && test "$HTTPD_PROTO" = "https"
  37         then
  38                 # ALPN lets us immediately use HTTP/2; likewise, POSTs with
  39                 # bodies can use it because they do not need to upgrade
  40                 INITIAL_PROTO=HTTP/2
  41         else
  42                 # either we are not using HTTP/2, or the initial
  43                 # request is sent via HTTP/1.1 and asks for upgrade
  44                 INITIAL_PROTO=HTTP/1.1
  45         fi &&
  46
  47         cat >exp.raw <<-EOF &&
  48         > GET /smart/repo.git/info/refs?service=git-upload-pack $INITIAL_PROTO
  49         > accept: */*
  50         > accept-encoding: ENCODINGS
  51         > accept-language: ko-KR, *;q=0.9
  52         > pragma: no-cache
  53         {V2} > git-protocol: version=2
  54         < $HTTP_PROTO 200 OK
  55         < pragma: no-cache
  56         < cache-control: no-cache, max-age=0, must-revalidate
  57         < content-type: application/x-git-upload-pack-advertisement
  58         > POST /smart/repo.git/git-upload-pack $INITIAL_PROTO
  59         > accept-encoding: ENCODINGS
  60         > content-type: application/x-git-upload-pack-request
  61         > accept: application/x-git-upload-pack-result
  62         > accept-language: ko-KR, *;q=0.9
  63         {V2} > git-protocol: version=2
  64         > content-length: xxx
  65         < $INITIAL_PROTO 200 OK
  66         < pragma: no-cache
  67         < cache-control: no-cache, max-age=0, must-revalidate
  68         < content-type: application/x-git-upload-pack-result
  69         {V2} > POST /smart/repo.git/git-upload-pack $INITIAL_PROTO
  70         {V2} > accept-encoding: ENCODINGS
  71         {V2} > content-type: application/x-git-upload-pack-request
  72         {V2} > accept: application/x-git-upload-pack-result
  73         {V2} > accept-language: ko-KR, *;q=0.9
  74         {V2} > git-protocol: version=2
  75         {V2} > content-length: xxx
  76         {V2} < $INITIAL_PROTO 200 OK
  77         {V2} < pragma: no-cache
  78         {V2} < cache-control: no-cache, max-age=0, must-revalidate
  79         {V2} < content-type: application/x-git-upload-pack-result
  80         EOF
  81
  82         if test "$GIT_TEST_PROTOCOL_VERSION" = 0
  83         then
  84                 sed "/^{V2}/d" <exp.raw >exp
  85         else
  86                 sed "s/^{V2} //" <exp.raw >exp
  87         fi &&
  88
  89         GIT_TRACE_CURL=true LANGUAGE="ko_KR.UTF-8" \
  90                 git clone --quiet $HTTPD_URL/smart/repo.git clone 2>err &&
  91         test_cmp file clone/file &&
  92         tr '\''\015'\'' Q <err |
  93         perl -pe '\''
  94                 s/(Send|Recv) header: ([A-Za-z0-9-]+):/
  95                 "$1 header: " . lc($2) . ":"
  96                 /e;
  97         '\'' |
  98         sed -e "
  99                 s/Q\$//
 100                 /^[^<=]/d
 101                 /^== Info:/d
 102                 /^=> Send header, /d
 103                 /^=> Send header:$/d
 104                 /^<= Recv header, /d
 105                 /^<= Recv header:$/d
 106                 s/=> Send header: //
 107                 s/= Recv header://
 108                 /^<= Recv data/d
 109                 /^=> Send data/d
 110                 /^<= Recv SSL data/d
 111                 /^=> Send SSL data/d
 112                 /^$/d
 113                 /^< $/d
 114
 115                 /^[^><]/{
 116                         s/^/> /
 117                 }
 118
 119                 /^< HTTP/ {
 120                         s/200$/200 OK/
 121                 }
 122                 /^< HTTP\\/1.1 101/d
 123                 /^[><] connection: /d
 124                 /^[><] upgrade: /d
 125                 /^> http2-settings: /d
 126
 127                 /^> user-agent: /d
 128                 /^> host: /d
 129                 /^> POST /,$ {
 130                         /^> Accept: [*]\\/[*]/d
 131                 }
 132                 s/^> content-length: .*/> content-length: xxx/
 133                 /^> 00..want /d
 134                 /^> 00.*done/d
 135
 136                 /^< server: /d
 137                 /^< expires: /d
 138                 /^< date: /d
 139                 /^< content-length: /d
 140                 /^< transfer-encoding: /d
 141         " >actual &&
 142
 143         sed -e "s/^> accept-encoding: .*/> accept-encoding: ENCODINGS/" \
 144                         actual >actual.smudged &&
 145         test_cmp exp actual.smudged &&
 146
 147         grep "accept-encoding:.*gzip" actual >actual.gzip
 148 '
 149
 150 test_expect_success 'fetch changes via http' '
 151         echo content >>file &&
 152         git commit -a -m two &&
 153         git push public &&
 154         (cd clone && git pull) &&
 155         test_cmp file clone/file
 156 '
 157
 158 test_expect_success 'used upload-pack service' '
 159         strip_access_log >log &&
 160         grep "GET  /smart/repo.git/info/refs?service=git-upload-pack HTTP/[0-9.]* 200" log &&
 161         grep "POST /smart/repo.git/git-upload-pack HTTP/[0-9.]* 200" log
 162 '
 163
 164 test_expect_success 'follow redirects (301)' '
 165         git clone $HTTPD_URL/smart-redir-perm/repo.git --quiet repo-p
 166 '
 167
 168 test_expect_success 'follow redirects (302)' '
 169         git clone $HTTPD_URL/smart-redir-temp/repo.git --quiet repo-t
 170 '
 171
 172 test_expect_success 'redirects re-root further requests' '
 173         git clone $HTTPD_URL/smart-redir-limited/repo.git repo-redir-limited
 174 '
 175
 176 test_expect_success 're-rooting dies on insane schemes' '
 177         test_must_fail git clone $HTTPD_URL/insane-redir/repo.git insane
 178 '
 179
 180 test_expect_success 'clone from password-protected repository' '
 181         echo two >expect &&
 182         set_askpass user@host pass@host &&
 183         git clone --bare "$HTTPD_URL/auth/smart/repo.git" smart-auth &&
 184         expect_askpass both user@host &&
 185         git --git-dir=smart-auth log -1 --format=%s >actual &&
 186         test_cmp expect actual
 187 '
 188
 189 test_expect_success 'clone from auth-only-for-push repository' '
 190         echo two >expect &&
 191         set_askpass wrong &&
 192         git clone --bare "$HTTPD_URL/auth-push/smart/repo.git" smart-noauth &&
 193         expect_askpass none &&
 194         git --git-dir=smart-noauth log -1 --format=%s >actual &&
 195         test_cmp expect actual
 196 '
 197
 198 test_expect_success 'clone from auth-only-for-objects repository' '
 199         echo two >expect &&
 200         set_askpass user@host pass@host &&
 201         git clone --bare "$HTTPD_URL/auth-fetch/smart/repo.git" half-auth &&
 202         expect_askpass both user@host &&
 203         git --git-dir=half-auth log -1 --format=%s >actual &&
 204         test_cmp expect actual
 205 '
 206
 207 test_expect_success 'no-op half-auth fetch does not require a password' '
 208         set_askpass wrong &&
 209
 210         # NEEDSWORK: When using HTTP(S), protocol v0 supports a "half-auth"
 211         # configuration with authentication required only when downloading
 212         # objects and not refs, by having the HTTP server only require
 213         # authentication for the "git-upload-pack" path and not "info/refs".
 214         # This is not possible with protocol v2, since both objects and refs
 215         # are obtained from the "git-upload-pack" path. A solution to this is
 216         # to teach the server and client to be able to inline ls-refs requests
 217         # as an Extra Parameter (see "git help gitformat-pack-protocol"), so that
 218         # "info/refs" can serve refs, just like it does in protocol v0.
 219         GIT_TEST_PROTOCOL_VERSION=0 git --git-dir=half-auth fetch &&
 220         expect_askpass none
 221 '
 222
 223 test_expect_success 'redirects send auth to new location' '
 224         set_askpass user@host pass@host &&
 225         git -c credential.useHttpPath=true \
 226           clone $HTTPD_URL/smart-redir-auth/repo.git repo-redir-auth &&
 227         expect_askpass both user@host auth/smart/repo.git
 228 '
 229
 230 test_expect_success 'GIT_TRACE_CURL redacts auth details' '
 231         rm -rf redact-auth trace &&
 232         set_askpass user@host pass@host &&
 233         GIT_TRACE_CURL="$(pwd)/trace" git clone --bare "$HTTPD_URL/auth/smart/repo.git" redact-auth &&
 234         expect_askpass both user@host &&
 235
 236         # Ensure that there is no "Basic" followed by a base64 string, but that
 237         # the auth details are redacted
 238         ! grep -i "Authorization: Basic [0-9a-zA-Z+/]" trace &&
 239         grep -i "Authorization: Basic <redacted>" trace
 240 '
 241
 242 test_expect_success 'GIT_CURL_VERBOSE redacts auth details' '
 243         rm -rf redact-auth trace &&
 244         set_askpass user@host pass@host &&
 245         GIT_CURL_VERBOSE=1 git clone --bare "$HTTPD_URL/auth/smart/repo.git" redact-auth 2>trace &&
 246         expect_askpass both user@host &&
 247
 248         # Ensure that there is no "Basic" followed by a base64 string, but that
 249         # the auth details are redacted
 250         ! grep -i "Authorization: Basic [0-9a-zA-Z+/]" trace &&
 251         grep -i "Authorization: Basic <redacted>" trace
 252 '
 253
 254 test_expect_success 'GIT_TRACE_CURL does not redact auth details if GIT_TRACE_REDACT=0' '
 255         rm -rf redact-auth trace &&
 256         set_askpass user@host pass@host &&
 257         GIT_TRACE_REDACT=0 GIT_TRACE_CURL="$(pwd)/trace" \
 258                 git clone --bare "$HTTPD_URL/auth/smart/repo.git" redact-auth &&
 259         expect_askpass both user@host &&
 260
 261         grep -i "Authorization: Basic [0-9a-zA-Z+/]" trace
 262 '
 263
 264 test_expect_success 'disable dumb http on server' '
 265         git --git-dir="$HTTPD_DOCUMENT_ROOT_PATH/repo.git" \
 266                 config http.getanyfile false
 267 '
 268
 269 test_expect_success 'GIT_SMART_HTTP can disable smart http' '
 270         (GIT_SMART_HTTP=0 &&
 271          export GIT_SMART_HTTP &&
 272          cd clone &&
 273          test_must_fail git fetch)
 274 '
 275
 276 test_expect_success 'invalid Content-Type rejected' '
 277         test_must_fail git clone $HTTPD_URL/broken_smart/repo.git 2>actual &&
 278         test_grep "not valid:" actual
 279 '
 280
 281 test_expect_success 'create namespaced refs' '
 282         test_commit namespaced &&
 283         git push public HEAD:refs/namespaces/ns/refs/heads/main &&
 284         git --git-dir="$HTTPD_DOCUMENT_ROOT_PATH/repo.git" \
 285                 symbolic-ref refs/namespaces/ns/HEAD refs/namespaces/ns/refs/heads/main
 286 '
 287
 288 test_expect_success 'smart clone respects namespace' '
 289         git clone "$HTTPD_URL/smart_namespace/repo.git" ns-smart &&
 290         echo namespaced >expect &&
 291         git --git-dir=ns-smart/.git log -1 --format=%s >actual &&
 292         test_cmp expect actual
 293 '
 294
 295 test_expect_success 'dumb clone via http-backend respects namespace' '
 296         git --git-dir="$HTTPD_DOCUMENT_ROOT_PATH/repo.git" \
 297                 config http.getanyfile true &&
 298         GIT_SMART_HTTP=0 git clone \
 299                 "$HTTPD_URL/smart_namespace/repo.git" ns-dumb &&
 300         echo namespaced >expect &&
 301         git --git-dir=ns-dumb/.git log -1 --format=%s >actual &&
 302         test_cmp expect actual
 303 '
 304
 305 test_expect_success 'cookies stored in http.cookiefile when http.savecookies set' '
 306         cat >cookies.txt <<-\EOF &&
 307         127.0.0.1       FALSE   /smart_cookies/ FALSE   0       othername       othervalue
 308         EOF
 309         sort >expect_cookies.txt <<-\EOF &&
 310         127.0.0.1       FALSE   /smart_cookies/ FALSE   0       othername       othervalue
 311         127.0.0.1       FALSE   /smart_cookies/repo.git/        FALSE   0       name    value
 312         127.0.0.1       FALSE   /smart_cookies/repo.git/info/   FALSE   0       name    value
 313         EOF
 314         git config http.cookiefile cookies.txt &&
 315         git config http.savecookies true &&
 316
 317         test_when_finished "
 318                 git --git-dir=\"\$HTTPD_DOCUMENT_ROOT_PATH/repo.git\" \
 319                         tag -d cookie-tag
 320         " &&
 321         git --git-dir="$HTTPD_DOCUMENT_ROOT_PATH/repo.git" \
 322                 tag -m "foo" cookie-tag &&
 323         git fetch $HTTPD_URL/smart_cookies/repo.git cookie-tag &&
 324
 325         grep "^[^#]" cookies.txt | sort >cookies_stripped.txt &&
 326         test_cmp expect_cookies.txt cookies_stripped.txt
 327 '
 328
 329 test_expect_success 'transfer.hiderefs works over smart-http' '
 330         test_commit hidden &&
 331         test_commit visible &&
 332         git push public HEAD^:refs/heads/a HEAD:refs/heads/b &&
 333         git --git-dir="$HTTPD_DOCUMENT_ROOT_PATH/repo.git" \
 334                 config transfer.hiderefs refs/heads/a &&
 335         git clone --bare "$HTTPD_URL/smart/repo.git" hidden.git &&
 336         test_must_fail git -C hidden.git rev-parse --verify a &&
 337         git -C hidden.git rev-parse --verify b
 338 '
 339
 340 # create an arbitrary number of tags, numbered from tag-$1 to tag-$2
 341 create_tags () {
 342         rm -f marks &&
 343         for i in $(test_seq "$1" "$2")
 344         do
 345                 # don't use here-doc, because it requires a process
 346                 # per loop iteration
 347                 echo "commit refs/heads/too-many-refs-$1" &&
 348                 echo "mark :$i" &&
 349                 echo "committer git <git@example.com> $i +0000" &&
 350                 echo "data 0" &&
 351                 echo "M 644 inline bla.txt" &&
 352                 echo "data 4" &&
 353                 echo "bla" &&
 354                 # make every commit dangling by always
 355                 # rewinding the branch after each commit
 356                 echo "reset refs/heads/too-many-refs-$1" &&
 357                 echo "from :$1"
 358         done | git fast-import --export-marks=marks &&
 359
 360         # now assign tags to all the dangling commits we created above
 361         tag=$(perl -e "print \"bla\" x 30") &&
 362         sed -e "s|^:\([^ ]*\) \(.*\)$|create refs/tags/$tag-\1 \2|" <marks >input &&
 363         git update-ref --stdin <input &&
 364         rm input
 365 }
 366
 367 test_expect_success 'create 2,000 tags in the repo' '
 368         (
 369                 cd "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" &&
 370                 create_tags 1 2000
 371         )
 372 '
 373
 374 test_expect_success CMDLINE_LIMIT \
 375         'clone the 2,000 tag repo to check OS command line overflow' '
 376         run_with_limited_cmdline git clone $HTTPD_URL/smart/repo.git too-many-refs &&
 377         (
 378                 cd too-many-refs &&
 379                 git for-each-ref refs/tags >actual &&
 380                 test_line_count = 2000 actual
 381         )
 382 '
 383
 384 test_expect_success 'large fetch-pack requests can be sent using chunked encoding' '
 385         GIT_TRACE_CURL=true git -c http.postbuffer=65536 \
 386                 clone --bare "$HTTPD_URL/smart/repo.git" split.git 2>err &&
 387         {
 388                 test_have_prereq HTTP2 ||
 389                 grep "^=> Send header: Transfer-Encoding: chunked" err
 390         }
 391 '
 392
 393 test_expect_success 'test allowreachablesha1inwant' '
 394         test_when_finished "rm -rf test_reachable.git" &&
 395         server="$HTTPD_DOCUMENT_ROOT_PATH/repo.git" &&
 396         main_sha=$(git -C "$server" rev-parse refs/heads/main) &&
 397         git -C "$server" config uploadpack.allowreachablesha1inwant 1 &&
 398
 399         git init --bare test_reachable.git &&
 400         git -C test_reachable.git remote add origin "$HTTPD_URL/smart/repo.git" &&
 401         git -C test_reachable.git fetch origin "$main_sha"
 402 '
 403
 404 test_expect_success 'test allowreachablesha1inwant with unreachable' '
 405         test_when_finished "rm -rf test_reachable.git; git reset --hard $(git rev-parse HEAD)" &&
 406
 407         #create unreachable sha
 408         echo content >file2 &&
 409         git add file2 &&
 410         git commit -m two &&
 411         git push public HEAD:refs/heads/doomed &&
 412         git push public :refs/heads/doomed &&
 413
 414         server="$HTTPD_DOCUMENT_ROOT_PATH/repo.git" &&
 415         main_sha=$(git -C "$server" rev-parse refs/heads/main) &&
 416         git -C "$server" config uploadpack.allowreachablesha1inwant 1 &&
 417
 418         git init --bare test_reachable.git &&
 419         git -C test_reachable.git remote add origin "$HTTPD_URL/smart/repo.git" &&
 420         # Some protocol versions (e.g. 2) support fetching
 421         # unadvertised objects, so restrict this test to v0.
 422         test_must_fail env GIT_TEST_PROTOCOL_VERSION=0 \
 423                 git -C test_reachable.git fetch origin "$(git rev-parse HEAD)"
 424 '
 425
 426 test_expect_success 'test allowanysha1inwant with unreachable' '
 427         test_when_finished "rm -rf test_reachable.git; git reset --hard $(git rev-parse HEAD)" &&
 428
 429         #create unreachable sha
 430         echo content >file2 &&
 431         git add file2 &&
 432         git commit -m two &&
 433         git push public HEAD:refs/heads/doomed &&
 434         git push public :refs/heads/doomed &&
 435
 436         server="$HTTPD_DOCUMENT_ROOT_PATH/repo.git" &&
 437         main_sha=$(git -C "$server" rev-parse refs/heads/main) &&
 438         git -C "$server" config uploadpack.allowreachablesha1inwant 1 &&
 439
 440         git init --bare test_reachable.git &&
 441         git -C test_reachable.git remote add origin "$HTTPD_URL/smart/repo.git" &&
 442         # Some protocol versions (e.g. 2) support fetching
 443         # unadvertised objects, so restrict this test to v0.
 444         test_must_fail env GIT_TEST_PROTOCOL_VERSION=0 \
 445                 git -C test_reachable.git fetch origin "$(git rev-parse HEAD)" &&
 446
 447         git -C "$server" config uploadpack.allowanysha1inwant 1 &&
 448         git -C test_reachable.git fetch origin "$(git rev-parse HEAD)"
 449 '
 450
 451 test_expect_success EXPENSIVE 'http can handle enormous ref negotiation' '
 452         (
 453                 cd "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" &&
 454                 create_tags 2001 50000
 455         ) &&
 456         git -C too-many-refs fetch -q --tags &&
 457         (
 458                 cd "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" &&
 459                 create_tags 50001 100000
 460         ) &&
 461         git -C too-many-refs fetch -q --tags &&
 462         git -C too-many-refs for-each-ref refs/tags >tags &&
 463         test_line_count = 100000 tags
 464 '
 465
 466 test_expect_success 'custom http headers' '
 467         test_must_fail git -c http.extraheader="x-magic-two: cadabra" \
 468                 fetch "$HTTPD_URL/smart_headers/repo.git" &&
 469         git -c http.extraheader="x-magic-one: abra" \
 470             -c http.extraheader="x-magic-two: cadabra" \
 471             fetch "$HTTPD_URL/smart_headers/repo.git" &&
 472         git update-index --add --cacheinfo 160000,$(git rev-parse HEAD),sub &&
 473         git config -f .gitmodules submodule.sub.path sub &&
 474         git config -f .gitmodules submodule.sub.url \
 475                 "$HTTPD_URL/smart_headers/repo.git" &&
 476         git submodule init sub &&
 477         test_must_fail git submodule update sub &&
 478         git -c http.extraheader="x-magic-one: abra" \
 479             -c http.extraheader="x-magic-two: cadabra" \
 480                 submodule update sub
 481 '
 482
 483 test_expect_success 'using fetch command in remote-curl updates refs' '
 484         SERVER="$HTTPD_DOCUMENT_ROOT_PATH/twobranch" &&
 485         rm -rf "$SERVER" client &&
 486
 487         git init "$SERVER" &&
 488         test_commit -C "$SERVER" foo &&
 489         git -C "$SERVER" update-ref refs/heads/anotherbranch foo &&
 490
 491         git clone $HTTPD_URL/smart/twobranch client &&
 492
 493         test_commit -C "$SERVER" bar &&
 494         git -C client -c protocol.version=0 fetch &&
 495
 496         git -C "$SERVER" rev-parse main >expect &&
 497         git -C client rev-parse origin/main >actual &&
 498         test_cmp expect actual
 499 '
 500
 501 test_expect_success 'fetch by SHA-1 without tag following' '
 502         SERVER="$HTTPD_DOCUMENT_ROOT_PATH/server" &&
 503         rm -rf "$SERVER" client &&
 504
 505         git init "$SERVER" &&
 506         test_commit -C "$SERVER" foo &&
 507
 508         git clone $HTTPD_URL/smart/server client &&
 509
 510         test_commit -C "$SERVER" bar &&
 511         git -C "$SERVER" rev-parse bar >bar_hash &&
 512         git -C client -c protocol.version=0 fetch \
 513                 --no-tags origin $(cat bar_hash)
 514 '
 515
 516 test_expect_success 'cookies are redacted by default' '
 517         rm -rf clone &&
 518         echo "Set-Cookie: Foo=1" >cookies &&
 519         echo "Set-Cookie: Bar=2" >>cookies &&
 520         GIT_TRACE_CURL=true \
 521                 git -c "http.cookieFile=$(pwd)/cookies" clone \
 522                 $HTTPD_URL/smart/repo.git clone 2>err &&
 523         grep -i "Cookie:.*Foo=<redacted>" err &&
 524         grep -i "Cookie:.*Bar=<redacted>" err &&
 525         ! grep -i "Cookie:.*Foo=1" err &&
 526         ! grep -i "Cookie:.*Bar=2" err
 527 '
 528
 529 test_expect_success 'empty values of cookies are also redacted' '
 530         rm -rf clone &&
 531         echo "Set-Cookie: Foo=" >cookies &&
 532         GIT_TRACE_CURL=true \
 533                 git -c "http.cookieFile=$(pwd)/cookies" clone \
 534                 $HTTPD_URL/smart/repo.git clone 2>err &&
 535         grep -i "Cookie:.*Foo=<redacted>" err
 536 '
 537
 538 test_expect_success 'GIT_TRACE_REDACT=0 disables cookie redaction' '
 539         rm -rf clone &&
 540         echo "Set-Cookie: Foo=1" >cookies &&
 541         echo "Set-Cookie: Bar=2" >>cookies &&
 542         GIT_TRACE_REDACT=0 GIT_TRACE_CURL=true \
 543                 git -c "http.cookieFile=$(pwd)/cookies" clone \
 544                 $HTTPD_URL/smart/repo.git clone 2>err &&
 545         grep -i "Cookie:.*Foo=1" err &&
 546         grep -i "Cookie:.*Bar=2" err
 547 '
 548
 549 test_expect_success 'GIT_TRACE_CURL_NO_DATA prevents data from being traced' '
 550         rm -rf clone &&
 551         GIT_TRACE_CURL=true \
 552                 git clone $HTTPD_URL/smart/repo.git clone 2>err &&
 553         grep "=> Send data" err &&
 554
 555         rm -rf clone &&
 556         GIT_TRACE_CURL=true GIT_TRACE_CURL_NO_DATA=1 \
 557                 git clone $HTTPD_URL/smart/repo.git clone 2>err &&
 558         ! grep "=> Send data" err
 559 '
 560
 561 test_expect_success 'server-side error detected' '
 562         test_must_fail git clone $HTTPD_URL/error_smart/repo.git 2>actual &&
 563         test_grep "server-side error" actual
 564 '
 565
 566 test_expect_success 'http auth remembers successful credentials' '
 567         rm -f .git-credentials &&
 568         test_config credential.helper store &&
 569
 570         # the first request prompts the user...
 571         set_askpass user@host pass@host &&
 572         git ls-remote "$HTTPD_URL/auth/smart/repo.git" >/dev/null &&
 573         expect_askpass both user@host &&
 574
 575         # ...and the second one uses the stored value rather than
 576         # prompting the user.
 577         set_askpass bogus-user bogus-pass &&
 578         git ls-remote "$HTTPD_URL/auth/smart/repo.git" >/dev/null &&
 579         expect_askpass none
 580 '
 581
 582 test_expect_success 'http auth forgets bogus credentials' '
 583         # seed credential store with bogus values. In real life,
 584         # this would probably come from a password which worked
 585         # for a previous request.
 586         rm -f .git-credentials &&
 587         test_config credential.helper store &&
 588         {
 589                 echo "url=$HTTPD_URL" &&
 590                 echo "username=bogus" &&
 591                 echo "password=bogus"
 592         } | git credential approve &&
 593
 594         # we expect this to use the bogus values and fail, never even
 595         # prompting the user...
 596         set_askpass user@host pass@host &&
 597         test_must_fail git ls-remote "$HTTPD_URL/auth/smart/repo.git" >/dev/null &&
 598         expect_askpass none &&
 599
 600         # ...but now we should have forgotten the bad value, causing
 601         # us to prompt the user again.
 602         set_askpass user@host pass@host &&
 603         git ls-remote "$HTTPD_URL/auth/smart/repo.git" >/dev/null &&
 604         expect_askpass both user@host
 605 '
 606
 607 test_expect_success 'client falls back from v2 to v0 to match server' '
 608         GIT_TRACE_PACKET=$PWD/trace \
 609         GIT_TEST_PROTOCOL_VERSION=2 \
 610         git clone $HTTPD_URL/smart_v0/repo.git repo-v0 &&
 611         # check for v0; there the HEAD symref is communicated in the capability
 612         # line; v2 uses a different syntax on each ref advertisement line
 613         grep symref=HEAD:refs/heads/ trace
 614 '
 615
 616 test_expect_success 'create empty http-accessible SHA-256 repository' '
 617         mkdir "$HTTPD_DOCUMENT_ROOT_PATH/sha256.git" &&
 618         (cd "$HTTPD_DOCUMENT_ROOT_PATH/sha256.git" &&
 619          git --bare init --object-format=sha256
 620         )
 621 '
 622
 623 test_expect_success 'clone empty SHA-256 repository with protocol v2' '
 624         rm -fr sha256 &&
 625         echo sha256 >expected &&
 626         git -c protocol.version=2 clone "$HTTPD_URL/smart/sha256.git" &&
 627         git -C sha256 rev-parse --show-object-format >actual &&
 628         test_cmp actual expected &&
 629         git ls-remote "$HTTPD_URL/smart/sha256.git" >actual &&
 630         test_must_be_empty actual
 631 '
 632
 633 test_expect_success 'clone empty SHA-256 repository with protocol v0' '
 634         rm -fr sha256 &&
 635         echo sha256 >expected &&
 636         GIT_TRACE=1 GIT_TRACE_PACKET=1 git -c protocol.version=0 clone "$HTTPD_URL/smart/sha256.git" &&
 637         git -C sha256 rev-parse --show-object-format >actual &&
 638         test_cmp actual expected &&
 639         git ls-remote "$HTTPD_URL/smart/sha256.git" >actual &&
 640         test_must_be_empty actual
 641 '
 642
 643 test_expect_success 'passing hostname resolution information works' '
 644         BOGUS_HOST=gitbogusexamplehost.invalid &&
 645         BOGUS_HTTPD_URL=$HTTPD_PROTO://$BOGUS_HOST:$LIB_HTTPD_PORT &&
 646         git -c "http.curloptResolve=$BOGUS_HOST:$LIB_HTTPD_PORT:127.0.0.1" ls-remote "$BOGUS_HTTPD_URL/smart/repo.git" >/dev/null
 647 '
 648
 649 # here user%40host is the URL-encoded version of user@host,
 650 # which is our intentionally-odd username to catch parsing errors
 651 url_user=$HTTPD_URL_USER/auth/smart/repo.git
 652 url_userpass=$HTTPD_URL_USER_PASS/auth/smart/repo.git
 653 url_userblank=$HTTPD_PROTO://user%40host:@$HTTPD_DEST/auth/smart/repo.git
 654 message="URL .*:<redacted>@.* uses plaintext credentials"
 655
 656 test_expect_success 'clone warns or fails when using username:password' '
 657         test_when_finished "rm -rf attempt*" &&
 658
 659         git -c transfer.credentialsInUrl=allow \
 660                 clone $url_userpass attempt1 2>err &&
 661         ! grep "$message" err &&
 662
 663         git -c transfer.credentialsInUrl=warn \
 664                 clone $url_userpass attempt2 2>err &&
 665         grep "warning: $message" err >warnings &&
 666         test_line_count -ge 1 warnings &&
 667
 668         test_must_fail git -c transfer.credentialsInUrl=die \
 669                 clone $url_userpass attempt3 2>err &&
 670         grep "fatal: $message" err >warnings &&
 671         test_line_count -ge 1 warnings &&
 672
 673         test_must_fail git -c transfer.credentialsInUrl=die \
 674                 clone $url_userblank attempt4 2>err &&
 675         grep "fatal: $message" err >warnings &&
 676         test_line_count -ge 1 warnings
 677 '
 678
 679 test_expect_success 'clone does not detect username:password when it is https://username@domain:port/' '
 680         test_when_finished "rm -rf attempt1" &&
 681
 682         # we are relying on lib-httpd for url construction, so document our
 683         # assumptions
 684         case "$HTTPD_URL_USER" in
 685         *:[0-9]*) : ok ;;
 686         *) BUG "httpd url does not have port: $HTTPD_URL_USER"
 687         esac &&
 688
 689         git -c transfer.credentialsInUrl=warn clone $url_user attempt1 2>err &&
 690         ! grep "uses plaintext credentials" err
 691 '
 692
 693 test_expect_success 'fetch warns or fails when using username:password' '
 694         git -c transfer.credentialsInUrl=allow fetch $url_userpass 2>err &&
 695         ! grep "$message" err &&
 696
 697         git -c transfer.credentialsInUrl=warn fetch $url_userpass 2>err &&
 698         grep "warning: $message" err >warnings &&
 699         test_line_count -ge 1 warnings &&
 700
 701         test_must_fail git -c transfer.credentialsInUrl=die \
 702                 fetch $url_userpass 2>err &&
 703         grep "fatal: $message" err >warnings &&
 704         test_line_count -ge 1 warnings &&
 705
 706         test_must_fail git -c transfer.credentialsInUrl=die \
 707                 fetch $url_userblank 2>err &&
 708         grep "fatal: $message" err >warnings &&
 709         test_line_count -ge 1 warnings
 710 '
 711
 712
 713 test_expect_success 'push warns or fails when using username:password' '
 714         git -c transfer.credentialsInUrl=allow push $url_userpass 2>err &&
 715         ! grep "$message" err &&
 716
 717         git -c transfer.credentialsInUrl=warn push $url_userpass 2>err &&
 718         grep "warning: $message" err >warnings &&
 719
 720         test_must_fail git -c transfer.credentialsInUrl=die \
 721                 push $url_userpass 2>err &&
 722         grep "fatal: $message" err >warnings &&
 723         test_line_count -ge 1 warnings
 724 '
 725
 726 test_expect_success 'no empty path components' '
 727         # In the URL, add a trailing slash, and see if git appends yet another
 728         # slash.
 729         git clone $HTTPD_URL/smart/repo.git/ clone-with-slash &&
 730
 731         strip_access_log >log &&
 732         ! grep "//" log
 733 '
 734
 735 test_expect_success 'tag following always works over v0 http' '
 736         upstream=$HTTPD_DOCUMENT_ROOT_PATH/tags &&
 737         git init "$upstream" &&
 738         (
 739                 cd "$upstream" &&
 740                 git commit --allow-empty -m base &&
 741                 git tag not-annotated &&
 742                 git tag -m foo annotated
 743         ) &&
 744         git init tags &&
 745         git -C tags -c protocol.version=0 \
 746                 fetch --depth 1 $HTTPD_URL/smart/tags \
 747                 refs/tags/annotated:refs/tags/annotated &&
 748         git -C "$upstream" for-each-ref refs/tags >expect &&
 749         git -C tags for-each-ref >actual &&
 750         test_cmp expect actual
 751 '
 752
 753 test_done