-
Notifications
You must be signed in to change notification settings - Fork 25.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add unix domain socket support to HTTP transport
This changeset introduces an `http.unixSocket` option so that users can proxy their git over HTTP remotes to a unix domain socket. In terms of why, since UDS are local and git already has a local protocol: some corporate environments use a UDS to proxy requests to internal resources (ie. source control), so this change would support those use-cases. This proxy can occasionally be necessary to attach MFA tokens or client certificates for CLI tools. The implementation leverages `--unix-socket` option [0] via the `CURLOPT_UNIX_SOCKET_PATH` flag available with libcurl [1]. `GIT_CURL_HAVE_CURLOPT_UNIX_SOCKET_PATH` and `NO_UNIX_SOCKETS` were kept separate so that we can spit out better error messages for users if git was compiled with `NO_UNIX_SOCKETS`. [0] https://curl.se/docs/manpage.html#--unix-socket [1] https://curl.se/libcurl/c/CURLOPT_UNIX_SOCKET_PATH.html Signed-off-by: Leslie Cheng <leslie@lc.fyi>
- Loading branch information
Showing
4 changed files
with
142 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,107 @@ | ||
#!/bin/sh | ||
|
||
test_description="test fetching through http via unix domain socket" | ||
|
||
. ./test-lib.sh | ||
. "$TEST_DIRECTORY"/lib-httpd.sh | ||
|
||
test -z "$NO_UNIX_SOCKETS" || { | ||
skip_all='skipping http-unix-socket tests, unix sockets not available' | ||
test_done | ||
} | ||
|
||
if ! test_have_prereq PERL | ||
then | ||
skip_all='skipping http-unix-socket tests; perl not available' | ||
test_done | ||
fi | ||
|
||
SOCKET_PROXY_PID= | ||
UDS_SOCKET="$(pwd)/uds.sock" | ||
UNRESOLVABLE_ENDPOINT=http://localhost:4242 | ||
|
||
start_proxy_unix_to_tcp() { | ||
local socket_path="$UDS_SOCKET" | ||
local host=127.0.0.1 | ||
local port=$LIB_HTTPD_PORT | ||
|
||
rm -f "$socket_path" | ||
|
||
perl -Mstrict -MIO::Select -MIO::Socket::INET -MIO::Socket::UNIX -e ' | ||
my $uds_path = $ARGV[0]; | ||
my $host = $ARGV[1]; | ||
my $port = $ARGV[2]; | ||
my $uds = IO::Socket::UNIX->new( | ||
Local => $uds_path, | ||
Type => SOCK_STREAM, | ||
Listen => 5, | ||
) or die "failed to create unix domain socket"; | ||
while (my $conn = $uds->accept()) { | ||
my $tcp_client = IO::Socket::INET->new( | ||
PeerAddr => $host, | ||
PeerPort => $port, | ||
Proto => "tcp", | ||
) or die "failed to create TCP socket"; | ||
my $sel = IO::Select->new($conn, $tcp_client); | ||
while (my @ready = $sel->can_read(1)) { | ||
foreach my $socket (@ready) { | ||
my $other = ($socket == $conn) ? $tcp_client : $conn; | ||
my $data; | ||
my $bytes = $socket->sysread($data, 4096); | ||
if ($bytes) { | ||
$other->syswrite($data, $bytes); | ||
} else { | ||
$socket->close(); | ||
} | ||
} | ||
} | ||
} | ||
' "$socket_path" "$host" "$port" & | ||
SOCKET_PROXY_PID=$! | ||
|
||
test_atexit 'stop_proxy_unix_to_tcp' | ||
} | ||
|
||
stop_proxy_unix_to_tcp() { | ||
kill "$SOCKET_PROXY_PID" | ||
} | ||
|
||
start_httpd | ||
start_proxy_unix_to_tcp | ||
|
||
test_expect_success 'setup repository' ' | ||
test_commit foo && | ||
git init --bare "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" && | ||
git push --mirror "$HTTPD_DOCUMENT_ROOT_PATH/repo.git" | ||
' | ||
|
||
# sanity check that we can't clone normally | ||
test_expect_success 'cloning without UDS fails' ' | ||
test_must_fail git clone "$UNRESOLVABLE_ENDPOINT/smart/repo.git" clone | ||
' | ||
|
||
test_expect_success 'cloning with UDS succeeds' ' | ||
test_when_finished "rm -rf clone" && | ||
test_config_global http.unixsocket "$UDS_SOCKET" && | ||
git clone "$UNRESOLVABLE_ENDPOINT/smart/repo.git" clone | ||
' | ||
|
||
test_expect_success 'cloning with a non-existent http proxy fails' ' | ||
git clone $HTTPD_URL/smart/repo.git clone && | ||
rm -rf clone && | ||
test_config_global http.proxy 127.0.0.1:0 && | ||
test_must_fail git clone $HTTPD_URL/smart/repo.git clone | ||
' | ||
|
||
test_expect_success 'UDS socket takes precedence over http proxy' ' | ||
test_when_finished "rm -rf clone" && | ||
test_config_global http.proxy 127.0.0.1:0 && | ||
test_config_global http.unixsocket "$UDS_SOCKET" && | ||
git clone $HTTPD_URL/smart/repo.git clone | ||
' | ||
|
||
test_done |