Re: [PATCH 2/2] http: use credential API to handle proxy authentication

Currently, the only way to pass proxy credentials to curl is by including them
in the proxy URL. Usually, this means they will end up on disk unencrypted, one
way or another (by inclusion in ~/.gitconfig, shell profile or history). Since
proxy authentication often uses a domain user, credentials can be security
sensitive; therefore, a safer way of passing credentials is desirable.

If the configured proxy contains a username but not a password, query the
credential API for one. Also, make sure we approve/reject proxy credentials
properly.

For consistency reasons, add parsing of http_proxy/https_proxy/all_proxy
environment variables, which would otherwise be evaluated as a fallback by curl.
Without this, we would have different semantics for git configuration and
environment variables.

Signed-off-by: Knut Franke <redacted>
---

diff --git a/http.c b/http.c
index 4756bab..11bebe1 100644
--- a/http.c
+++ b/http.c

@@ -79,6 +79,7 @@ static struct {
        // curl(1) and is not included in CURLAUTH_ANY, so we leave it out
        // here, too
 };
+struct credential http_proxy_auth = CREDENTIAL_INIT;

 static const char *curl_cookie_file;
 static int curl_save_cookies;
 struct credential http_auth = CREDENTIAL_INIT;

@@ -176,6 +177,9 @@ static void finish_active_slot(struct active_request_slot *slot)
 #else
                slot->results->auth_avail = 0;
 #endif
+
+               curl_easy_getinfo(slot->curl, CURLINFO_HTTP_CONNECTCODE,
+                       &slot->results->http_connectcode);
        }

        /* Run callback if appropriate */

@@ -333,6 +337,25 @@ static void copy_from_env(const char **var, const char *envname)

 static void init_curl_proxy_auth(CURL *result)
 {
+       if (http_proxy_auth.username) {
+               if (!http_proxy_auth.password) {
+                       credential_fill(&http_proxy_auth);
+               }

+#endif
+       }
+
        copy_from_env(&http_proxy_authmethod, "GIT_HTTP_PROXY_AUTHMETHOD");

        if (http_proxy_authmethod) {

@@ -513,8 +536,36 @@ static CURL *get_curl_handle(void)
                curl_easy_setopt(result, CURLOPT_USE_SSL, CURLUSESSL_TRY);
 #endif

+       /*
+        * curl also examines these variables as a fallback; but we need to query
+        * them here in order to decide whether to prompt for missing password (cf.
+        * init_curl_proxy_auth()).
+        */
+       if (!curl_http_proxy) {
+               if (!strcmp(http_auth.protocol, "https")) {
+                       copy_from_env(&curl_http_proxy, "HTTPS_PROXY");
+                       copy_from_env(&curl_http_proxy, "https_proxy");
+               } else {
+                       copy_from_env(&curl_http_proxy, "http_proxy");