jgit/org.eclipse.jgit.http.apache
Thomas Wolf 471ad49546 TransportHttp: shared SSLContext during fetch or push
TransportHttp makes several HTTP requests. The SSLContext and socket
factory must be shared over these requests, otherwise authentication
information may not be propagated correctly from one request to the
next. This is important for authentication mechanisms that rely on
client-side state, like NEGOTIATE (either NTLM, if the underlying HTTP
library supports it, or Kerberos). In particular, SPNEGO cannot
authenticate on a POST request; the authentication must come from the
initial GET request, which implies that the POST request must use the
same SSLContext and socket factory that was used for the GET.

Change the way HTTPS connections are configured. Introduce the concept
of a GitSession, which is a client-side HTTP session over several HTTPS
requests. TransportHttp creates such a session and uses it to configure
all HTTP requests during that session (fetch or push). This gives a way
to abstract away the differences between JDK and Apache HTTP connections
and to configure SSL setup outside.

A GitSession can maintain state and thus give all HTTP requests in a
session the same socket factory.

Introduce an extension interface HttpConnectionFactory2 that adds a
method to obtain a new GitSession. Implement this for both existing
HTTP connection factories. Change TransportHttp to use the new
GitSession to configure HTTP connections.

The old methods for disabling SSL verification still exist to support
possibly external connection and connection factory implementations
that do not make use of the new GitSession yet.

Bug: 535850
Change-Id: Iedf67464e4e353c1883447c13c86b5a838e678f1
Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>
2021-01-14 16:23:45 +01:00
..
.settings Enable and fix "Statement unnecessarily nested within else clause" warnings 2019-10-17 10:20:14 +09:00
META-INF Prepare 5.11.0-SNAPSHOT builds 2020-12-02 15:57:16 +01:00
resources/org/eclipse/jgit/transport/http/apache/internal TransportHttp: shared SSLContext during fetch or push 2021-01-14 16:23:45 +01:00
src/org/eclipse/jgit/transport/http/apache TransportHttp: shared SSLContext during fetch or push 2021-01-14 16:23:45 +01:00
.classpath Change JGit minimum execution environment to JavaSE-1.8 2016-09-20 11:32:36 +02:00
.gitignore Move Apache httpclient based HTTP support to a separate bundle 2014-02-20 23:57:21 +01:00
.project Move Apache httpclient based HTTP support to a separate bundle 2014-02-20 23:57:21 +01:00
BUILD Bazel: Add fixes for --incompatible_load_java_rules_from_bzl 2019-09-07 15:36:11 +09:00
about.html Move Apache httpclient based HTTP support to a separate bundle 2014-02-20 23:57:21 +01:00
build.properties Move Apache httpclient based HTTP support to a separate bundle 2014-02-20 23:57:21 +01:00
plugin.properties Fix bundle localization of Apache SSH bundle 2019-06-21 17:54:06 +02:00
pom.xml Prepare 5.11.0-SNAPSHOT builds 2020-12-02 15:57:16 +01:00