thodg/libgit2/tests/online/badssl.c

• Show log

  Commit

• Hash : 589b8129
  Author :
  Date : 2020-12-14T10:43:07
  

  badssl: RC4 should not fail with ECERTIFICATE Using RC4 is not a _certificate_ problem, it's a cipher problem. The SSL implementation should and will fail with an unrecoverable error (-1). There's no opportunity to accept/continue.

Download

• tests/online/badssl.c

• #include "clar_libgit2.h"
  
  #include "git2/clone.h"
  
  static git_repository *g_repo;
  
  #ifdef GIT_HTTPS
  static bool g_has_ssl = true;
  #else
  static bool g_has_ssl = false;
  #endif
  
  static int cert_check_assert_invalid(git_cert *cert, int valid, const char* host, void *payload)
  {
  	GIT_UNUSED(cert); GIT_UNUSED(host); GIT_UNUSED(payload);
  
  	cl_assert_equal_i(0, valid);
  
  	return GIT_ECERTIFICATE;
  }
  
  void test_online_badssl__expired(void)
  {
  	git_clone_options opts = GIT_CLONE_OPTIONS_INIT;
  	opts.fetch_opts.callbacks.certificate_check = cert_check_assert_invalid;
  
  	if (!g_has_ssl)
  		cl_skip();
  
  	cl_git_fail_with(GIT_ECERTIFICATE,
  			 git_clone(&g_repo, "https://expired.badssl.com/fake.git", "./fake", NULL));
  
  	cl_git_fail_with(GIT_ECERTIFICATE,
  			 git_clone(&g_repo, "https://expired.badssl.com/fake.git", "./fake", &opts));
  }
  
  void test_online_badssl__wrong_host(void)
  {
  	git_clone_options opts = GIT_CLONE_OPTIONS_INIT;
  	opts.fetch_opts.callbacks.certificate_check = cert_check_assert_invalid;
  
  	if (!g_has_ssl)
  		cl_skip();
  
  	cl_git_fail_with(GIT_ECERTIFICATE,
  			 git_clone(&g_repo, "https://wrong.host.badssl.com/fake.git", "./fake", NULL));
  	cl_git_fail_with(GIT_ECERTIFICATE,
  			 git_clone(&g_repo, "https://wrong.host.badssl.com/fake.git", "./fake", &opts));
  }
  
  void test_online_badssl__self_signed(void)
  {
  	git_clone_options opts = GIT_CLONE_OPTIONS_INIT;
  	opts.fetch_opts.callbacks.certificate_check = cert_check_assert_invalid;
  
  	if (!g_has_ssl)
  		cl_skip();
  
  	cl_git_fail_with(GIT_ECERTIFICATE,
  			 git_clone(&g_repo, "https://self-signed.badssl.com/fake.git", "./fake", NULL));
  	cl_git_fail_with(GIT_ECERTIFICATE,
  			 git_clone(&g_repo, "https://self-signed.badssl.com/fake.git", "./fake", &opts));
  }
  
  void test_online_badssl__old_cipher(void)
  {
  	git_clone_options opts = GIT_CLONE_OPTIONS_INIT;
  	opts.fetch_opts.callbacks.certificate_check = cert_check_assert_invalid;
  
  	if (!g_has_ssl)
  		cl_skip();
  
  	cl_git_fail(git_clone(&g_repo, "https://rc4.badssl.com/fake.git", "./fake", NULL));
  	cl_git_fail(git_clone(&g_repo, "https://rc4.badssl.com/fake.git", "./fake", &opts));
  }
  

Download