Idea-Studios/libgit2
2
0
Fork 0
mirror of https://github.com/libgit2/libgit2.git synced 2026-06-22 06:26:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: require TLSv1.2 or higher

Browse Source
This commit is contained in:
Edward Thomson
2024-03-16 15:42:57 +00:00
parent 8049f00e3b
commit 833224964a
4 changed files with 19 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/libgit2/streams/mbedtls.c
View File

@@ -94,10 +94,8 @@ int git_mbedtls_stream_global_init(void)
goto cleanup;
}
/* configure TLSv1.1 */
#ifdef MBEDTLS_SSL_MINOR_VERSION_2
mbedtls_ssl_conf_min_version(&mbedtls_config, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_2);
#endif
/* configure TLSv1.2 */
mbedtls_ssl_conf_min_version(&mbedtls_config, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_3);
/* verify_server_cert is responsible for making the check.
* OPTIONAL because REQUIRED drops the certificate as soon as the check

13
src/libgit2/streams/openssl.c
View File

@@ -106,7 +106,10 @@ static void git_openssl_free(void *mem)
static int openssl_init(void)
{
long ssl_opts = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
long ssl_opts = SSL_OP_NO_SSLv2 |
SSL_OP_NO_SSLv3 |
SSL_OP_NO_TLSv1 |
SSL_OP_NO_TLSv1_1;
const char *ciphers = git__ssl_ciphers;
#ifdef VALGRIND
static bool allocators_initialized = false;
@@ -135,10 +138,10 @@ static int openssl_init(void)
OPENSSL_init_ssl(0, NULL);
/*
* Load SSLv{2,3} and TLSv1 so that we can talk with servers
* which use the SSL hellos, which are often used for
* compatibility. We then disable SSL so we only allow OpenSSL
* to speak TLSv1 to perform the encryption itself.
* Despite the name SSLv23_method, this is actually a version-
* flexible context, which honors the protocol versions
* specified in `ssl_opts`. So we only support TLSv1.2 and
* higher.
*/
if (!(git__ssl_ctx = SSL_CTX_new(SSLv23_method())))
goto error;

3
src/libgit2/streams/stransport.c
View File

@@ -331,8 +331,7 @@ static int stransport_wrap(
if ((ret = SSLSetIOFuncs(st->ctx, read_cb, write_cb)) != noErr ||
(ret = SSLSetConnection(st->ctx, st)) != noErr ||
(ret = SSLSetSessionOption(st->ctx, kSSLSessionOptionBreakOnServerAuth, true)) != noErr ||
(ret = SSLSetProtocolVersionMin(st->ctx, kTLSProtocol1)) != noErr ||
(ret = SSLSetProtocolVersionMax(st->ctx, kTLSProtocol12)) != noErr ||
(ret = SSLSetProtocolVersionMin(st->ctx, kTLSProtocol12)) != noErr ||
(ret = SSLSetPeerDomainName(st->ctx, host, strlen(host))) != noErr) {
CFRelease(st->ctx);
git__free(st);

8
tests/libgit2/online/badssl.c
View File

@@ -73,3 +73,11 @@ void test_online_badssl__old_cipher(void)
cl_git_fail(git_clone(&g_repo, "https://rc4.badssl.com/fake.git", "./fake", NULL));
cl_git_fail(git_clone(&g_repo, "https://rc4.badssl.com/fake.git", "./fake", &opts));
}
void test_online_badssl__sslv3(void)
{
if (!g_has_ssl)
cl_skip();
cl_git_fail(git_clone(&g_repo, "https://mailserv.baehal.com/fake.git", "./fake", NULL));
}