• Junio C Hamano's avatar
    signed push: allow stale nonce in stateless mode · 5732373d
    Junio C Hamano authored
    When operating with the stateless RPC mode, we will receive a nonce
    issued by another instance of us that advertised our capability and
    refs some time ago.  Update the logic to check received nonce to
    detect this case, compute how much time has passed since the nonce
    was issued and report the status with a new environment variable
    GIT_PUSH_CERT_NONCE_SLOP to the hooks.
    GIT_PUSH_CERT_NONCE_STATUS will report "SLOP" in such a case.  The
    hooks are free to decide how large a slop it is willing to accept.
    Strictly speaking, the "nonce" is not really a "nonce" anymore in
    the stateless RPC mode, as it will happily take any "nonce" issued
    by it (which is protected by HMAC and its secret key) as long as it
    is fresh enough.  The degree of this security degradation, relative
    to the native protocol, is about the same as the "we make sure that
    the 'git push' decided to update our refs with new objects based on
    the freshest observation of our refs by making sure the values they
    claim the original value of the refs they ask us to update exactly
    match the current state" security is loosened to accomodate the
    stateless RPC mode in the existing code without this series, so
    there is no need for those who are already using smart HTTP to push
    to their repositories to be alarmed any more than they already are.
    In addition, the server operator can set receive.certnonceslop
    configuration variable to specify how stale a nonce can be (in
    seconds).  When this variable is set, and if the nonce received in
    the certificate that passes the HMAC check was less than that many
    seconds old, hooks are given "OK" in GIT_PUSH_CERT_NONCE_STATUS
    (instead of "SLOP") and the received nonce value is given in
    GIT_PUSH_CERT_NONCE, which makes it easier for a simple-minded
    hook to check if the certificate we received is recent enough.
    Signed-off-by: default avatarJunio C Hamano <gitster@pobox.com>
git-receive-pack.txt 7.82 KB