@matheusbsbs / matheus-bagliano / commits / 3e8084f188

http: check CURLE_SSL_PINNEDPUBKEYNOTMATCH when emitting errors

Change the error shown when a http.pinnedPubKey doesn't match to point the http.pinnedPubKey variable added in aeff8a61216 (http: implement public key pinning, 2016-02-15), e.g.: git -c http.pinnedPubKey=sha256/someNonMatchingKey ls-remote https://github.com/git/git.git fatal: unable to access 'https://github.com/git/git.git/' with http.pinnedPubkey configuration: SSL: public key does not match pinned public key! Before this we'd emit the exact same thing without the " with http.pinnedPubkey configuration". The advantage of doing this is that we're going to get a translated message (everything after the ":" is hardcoded in English in libcurl), and we've got a reference to the git-specific configuration variable that's causing the error. Unfortunately we can't test this easily, as there are no tests that require https:// in the test suite, and t/lib-httpd.sh doesn't know how to set up such tests. See [1] for the start of a discussion about what it would take to have divergent "t/lib-httpd/apache.conf" test setups. #leftoverbits 1. https://lore.kernel.org/git/YUonS1uoZlZEt+Yd@coredump.intra.peff.net/ Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Ævar Arnfjörð Bjarmason committed Sep 24, 2021 at 12:08 UTC 3e8084f1884ffea25b80f76b7a1bd0e5b3200c8a

4 files changed +11 -1

git-curl-compat.h

+2 -1

@@ -67,10 +67,11 @@

68 /**

69 * CURLOPT_PINNEDPUBLICKEY was added in 7.39.0, released in November

70 - * 2014.

70 + * 2014. CURLE_SSL_PINNEDPUBKEYNOTMATCH was added in that same version.

71 */

72 #if LIBCURL_VERSION_NUM >= 0x072c00

73 #define GIT_CURL_HAVE_CURLOPT_PINNEDPUBLICKEY 1

74 +#define GIT_CURL_HAVE_CURLE_SSL_PINNEDPUBKEYNOTMATCH 1

75 #endif

77 /**

http.c

@@ -1489,6 +1489,10 @@ static int handle_curl_result(struct slot_results *results)

1489 */

1490 credential_reject(&cert_auth);

1491 return HTTP_NOAUTH;

1492 +#ifdef GIT_CURL_HAVE_CURLE_SSL_PINNEDPUBKEYNOTMATCH

1493 + } else if (results->curl_result == CURLE_SSL_PINNEDPUBKEYNOTMATCH) {

1494 + return HTTP_NOMATCHPUBLICKEY;

1495 +#endif

1496 } else if (missing_target(results))

1497 return HTTP_MISSING_TARGET;

1498 else if (results->http_code == 401) {

http.h

@@ -154,6 +154,7 @@ struct http_get_options {

154 #define HTTP_START_FAILED 3

155 #define HTTP_REAUTH 4

156 #define HTTP_NOAUTH 5

157 +#define HTTP_NOMATCHPUBLICKEY 6

158

159 /*

160 * Requests a URL and stores the result in a strbuf.

remote-curl.c

@@ -499,6 +499,10 @@ static struct discovery *discover_refs(const char *service, int for_push)

499 show_http_message(&type, &charset, &buffer);

500 die(_("Authentication failed for '%s'"),

501 transport_anonymize_url(url.buf));

502 + case HTTP_NOMATCHPUBLICKEY:

503 + show_http_message(&type, &charset, &buffer);

504 + die(_("unable to access '%s' with http.pinnedPubkey configuration: %s"),

505 + transport_anonymize_url(url.buf), curl_errorstr);

506 default:

507 show_http_message(&type, &charset, &buffer);

508 die(_("unable to access '%s': %s"),