summaryrefslogtreecommitdiff
path: root/src/streams
Commit message (Collapse)AuthorAgeFilesLines
* mbedtls: fix potential size overflow when reading or writing dataethomson/stream-truncated-writesPatrick Steinhardt2019-01-311-2/+9
| | | | | | | | | | | | | | | | The mbedtls library uses a callback mechanism to allow downstream users to plug in their own receive and send functions. We implement `bio_read` and `bio_write` functions, which simply wrap the `git_stream_read` and `git_stream_write` functions, respectively. The problem arises due to the return value of the callback functions: mbedtls expects us to return an `int` containing the actual number of bytes that were read or written. But this is in fact completely misdesigned, as callers are allowed to pass in a buffer with length `SIZE_MAX`. We thus may be unable to represent the number of bytes written via the return value. Fix this by only ever reading or writing at most `INT_MAX` bytes.
* mbedtls: make global variables staticPatrick Steinhardt2019-01-311-4/+2
| | | | | | The mbedtls stream implementation makes use of some global variables which are not marked as `static`, even though they're only used in this compilation unit. Fix this and remove a duplicate declaration.
* openssl: fix potential size overflow when writing dataPatrick Steinhardt2019-01-311-2/+1
| | | | | | | Our `openssl_write` function calls `SSL_write` by passing in both `data` and `len` arguments directly. Thing is, our `len` parameter is of type `size_t` and theirs is of type `int`. We thus need to clamp our length to be at most `INT_MAX`.
* streams: handle short writes only in generic streamPatrick Steinhardt2019-01-312-20/+11
| | | | | | | | Now that the function `git_stream__write_full` exists and callers of `git_stream_write` have been adjusted, we can lift logic for short writes out of the stream implementations. Instead, this is now handled either by `git_stream__write_full` or by callers of `git_stream_write` directly.
* streams: fix callers potentially only writing partial dataPatrick Steinhardt2019-01-311-2/+1
| | | | | | | | | | | | | | | | | | | | | Similar to the write(3) function, implementations of `git_stream_write` do not guarantee that all bytes are written. Instead, they return the number of bytes that actually have been written, which may be smaller than the total number of bytes. Furthermore, due to an interface design issue, we cannot ever write more than `SSIZE_MAX` bytes at once, as otherwise we cannot represent the number of bytes written to the caller. Unfortunately, no caller of `git_stream_write` ever checks the return value, except to verify that no error occurred. Due to this, they are susceptible to the case where only partial data has been written. Fix this by introducing a new function `git_stream__write_full`. In contrast to `git_stream_write`, it will always return either success or failure, without returning the number of bytes written. Thus, it is able to write all `SIZE_MAX` bytes and loop around `git_stream_write` until all data has been written. Adjust all callers except the BIO callbacks in our mbedtls and OpenSSL streams, which already do the right thing and require the amount of bytes written.
* streams: make file-local functions staticPatrick Steinhardt2019-01-313-19/+17
| | | | | | The callback functions that implement the `git_stream` structure are only used inside of their respective implementation files, but they are not marked as `static`. Fix this.
* streams: don't write more than SSIZE_MAXEdward Thomson2019-01-254-13/+13
| | | | | | | | | Our streams implementation takes a `size_t` that indicates the length of the data buffer to be written, and returns an `ssize_t` that indicates the length that _was_ written. Clearly no such implementation can write more than `SSIZE_MAX` bytes. Ensure that each TLS stream implementation does not try to write more than `SSIZE_MAX` bytes (or smaller; if the given implementation takes a smaller size).
* deprecation: don't use deprecated stream cbEdward Thomson2019-01-251-1/+3
| | | | | | Avoid the deprecated `git_stream_cb` typedef since we want to compile the library without deprecated functions or types. Instead, we can unroll the alias to its actual type.
* Don't use deprecated constantsSven Strickroth2019-01-241-1/+1
| | | | | | Follow up for PR #4917. Signed-off-by: Sven Strickroth <email@cs-ware.de>
* git_error: use new names in internal APIs and usageEdward Thomson2019-01-226-74/+74
| | | | | Move to the `git_error` name in the internal API for error-related functions.
* Fix a bunch of warningslhchavez2019-01-051-1/+1
| | | | | | | | | | | This change fixes a bunch of warnings that were discovered by compiling with `clang -target=i386-pc-linux-gnu`. It turned out that the intrinsics were not necessarily being used in all platforms! Especially in GCC, since it does not support __has_builtin. Some more warnings were gleaned from the Windows build, but I stopped when I saw that some third-party dependencies (e.g. zlib) have warnings of their own, so we might never be able to enable -Werror there.
* stream registration: take an enum typeEdward Thomson2018-11-284-20/+37
| | | | | | Accept an enum (`git_stream_t`) during custom stream registration that indicates whether the registration structure should be used for standard (non-TLS) streams or TLS streams.
* stream: provide generic registration APIEdward Thomson2018-11-285-71/+161
| | | | | | | | | Update the new stream registration API to be `git_stream_register` which takes a registration structure and a TLS boolean. This allows callers to register non-TLS streams as well as TLS streams. Provide `git_stream_register_tls` that takes just the init callback for backward compatibliity.
* http: remove cURLEdward Thomson2018-11-285-429/+2
| | | | | We previously used cURL to support HTTP proxies. Now that we've added this support natively, we can remove the curl dependency.
* streams: remove unused tls functionsEdward Thomson2018-11-285-42/+12
| | | | | | | The implementations of git_openssl_stream_new and git_mbedtls_stream_new have callers protected by #ifdefs and are never called unless compiled in. There's no need for a dummy implementation. Remove them.
* tls: introduce a wrap functionEdward Thomson2018-11-288-71/+259
| | | | | | | | | | | Introduce `git_tls_stream_wrap` which will take an existing `stream` with an already connected socket and begin speaking TLS on top of it. This is useful if you've built a connection to a proxy server and you wish to begin CONNECT over it to tunnel a TLS connection. Also update the pluggable TLS stream layer so that it can accept a registration structure that provides an `init` and `wrap` function, instead of a single initialization function.
* openssl: only say we're connected if the connection succeededEtienne Samson2018-11-011-2/+2
| | | | | | | ssl_close uses this boolean to know if SSL_shutdown should be called. It turns out OpenSSL auto-shutdowns on failure, so if the call to SSL_connect fails, it will complain about "shutdown while in init", trampling the original error.
* openssl: set the error class to GITERR_SSLEtienne Samson2018-11-011-5/+5
|
* global: replace remaining use of `git__strtol32`Patrick Steinhardt2018-10-181-1/+1
| | | | | | | Replace remaining uses of the `git__strtol32` function. While these uses are all safe as the strings were either sanitized or from a trusted source, we want to remove `git__strtol32` altogether to avoid future misuse.
* stransport: fix a warning on iOSEtienne Samson2018-09-251-1/+1
| | | "warning: values of type 'OSStatus' should not be used as format arguments; add an explicit cast to 'int' instead [-Wformat]"
* mbedtls: remove unused variable "cacert"Patrick Steinhardt2018-07-261-4/+0
| | | | | | | | | In commit 382ed1e87 (mbedtls: load default CA certificates, 2018-03-29), the function `git_mbedtls_stream_global_init` was refactored to call out to `git_mbedtls__set_cert_location` instead of setting up the certificates itself. The conversion forgot to remove the now-unused "cacert" variable, which is now only getting declared to be free'd at the end of the function. Remove it.
* mbedtls: free stream on shutdownethomson/leaksEdward Thomson2018-07-201-0/+1
|
* mbedtls: make ciphers_list a static arrayEdward Thomson2018-07-201-10/+10
| | | | | Instead of allocating the ciphers_list, make it a static array. This prevents us from leaking it or having to manage its memory.
* mbedtls: free ciphers_listEdward Thomson2018-07-201-0/+2
|
* mbedtls: check allocationsEdward Thomson2018-07-201-1/+14
|
* mbedtls: fix `inline` being used in mbedtls headersPatrick Steinhardt2018-07-131-0/+11
| | | | | | | | | | | | The mbedtls headers make direct use of the `inline` attribute to instruct the compiler to inline functions. As this function is not C90 compliant, this can cause the compiler to error as soon as any of these files is included and the `-std=c90` flag is being added. The mbedtls headers declaring functions as inline always have a prelude which define `inline` as a macro in case it is not yet defined. Thus, we can easily replace their define with our own define, which simply copies the logic of our own `GIT_INLINE` macro.
* streams: report OpenSSL errors if global init failsPatrick Steinhardt2018-07-061-21/+16
| | | | | | | | In case when the global initialization of the OpenSSL stream fails, the user is left without any hint as to what went wrong as we do not provide any error message at all. This commit refactors the init function to have a common error path, which now also sets an error message including the error string provided by OpenSSL.
* streams: openssl: Handle error in SSL_CTX_newNikita Leshenko2018-06-251-0/+4
| | | | SIGSEGV otherwise...
* streams: openssl: add missing check on OPENSSL_LEGACY_APIQuentin Minster2018-05-301-1/+1
| | | The `CRYPTO_THREADID` type is no longer available in OpenSSL ≥ 1.1.0 with deprecated features disabled, and causes build failures. Since the `threadid_cb()` function is only ever called by `git_openssl_set_locking()` when `defined(OPENSSL_LEGACY_API)`, only define it then.
* streams: openssl: fix bogus warning on unused parameterPatrick Steinhardt2018-05-041-1/+2
| | | | | | | | | | | | Our provided callback function `threadid_cb(CRYPTO_THREADID *threadid)` sets up a unique thread ID by asking pthread for the current thread ID. Since openssl version 1.1, `CRYPTO_THREADID_set_numeric` is simply a no-op macro, leaving the `threadid` argument unused after the preprocessor has processed the macro. GCC does not account for that situation and will thus complain about `threadid` being unused. Silence this warning by using `GIT_UNUSED(threadid)`.
* Merge pull request #4608 from pks-t/pks/openssl-api-cleanupCarlos Martín Nieto2018-04-302-121/+112
|\ | | | | OpenSSL legacy API cleanups
| * openssl: remove leftover #ifdefEtienne Samson2018-04-301-3/+0
| | | | | | This is the "OpenSSL available" global init function after all
| * streams: openssl: provide `OPENSSL_init_ssl` for legacy APIPatrick Steinhardt2018-04-031-6/+10
| | | | | | | | | | In order to further avoid using ifdef's in our code flow, provide the function `OPENSSL_init_ssl` in case we are using the legacy OpenSSL API.
| * streams: openssl: unify version checks into single definePatrick Steinhardt2018-04-031-13/+12
| | | | | | | | | | | | | | | | | | | | By now, we have several locations where we are checking the version of OpenSSL to determine whether we can use the new "modern" API or need to use the pre-1.1 legacy API. As we have multiple implementations of OpenSSL with the rather recent libressl implementation, these checks need to honor versions of both implementations, which is rather tedious. Instead, we can just check once for the correct versions and define `OPENSSL_LEGACY_API` in case we cannot use the modern API.
| * streams: openssl: move OpenSSL compat layer into implementationPatrick Steinhardt2018-04-032-107/+98
| | | | | | | | | | | | | | | | | | | | | | OpenSSL version 1.1 has broken its API in quite a few ways. To avoid having to use ifdef's everywhere, we have implemented the BIO functions added in version 1.1 ourselves in case we are using the legacy API. We were implementing them in the header file, though, which doesn't make a lot of sense, since these functions are only ever being used the the openssl stream implementation. Move these functions to the implementation file and mark them static.
* | mbedtls: display error codes as hex for consistency with mbedTLS docsEtienne Samson2018-04-111-4/+4
| | | | | | | | Remaining parts of https://github.com/JuliaLang/julia/blob/8d47a314537779c8fb86642c54925613628a91b0/deps/patches/libgit2-mbedtls-fixup.patch
* | mbedtls: load default CA certificatesEtienne Samson2018-04-112-23/+39
| |
* | mbedtls: use mbedTLS certificate verificationEtienne Samson2018-04-111-69/+6
| | | | | | | | Taken from https://github.com/JuliaLang/julia/blob/8d47a314537779c8fb86642c54925613628a91b0/deps/patches/libgit2-mbedtls-verify.patch, with some modifications.
* | mbedtls: use our own certificate validationEtienne Samson2018-04-111-1/+5
| | | | | | | | | | Otherwise REQUIRED means that `git_stream_certificate` will always error. We're doing the mbedtls check in verify_server_cert though.
* | mbedtls: fix libgit2 hanging due to incomplete writesEtienne Samson2018-04-111-5/+9
| |
* | mbedtls: default cipher list supportEtienne Samson2018-04-111-0/+29
| |
* | mbedtls: add global initializationEtienne Samson2018-04-112-3/+99
| |
* | mbedtls: proper certificate verificationEtienne Samson2018-04-111-26/+50
| |
* | mbedtls: initial supportEtienne Samson2018-04-113-0/+365
|/
* Fix build with LibreSSL 2.7Bernard Spil2018-04-022-2/+4
| | | | | | LibreSSL 2.7 adds OpenSSL 1.1 API Signed-off-by: Bernard Spil <brnrd@FreeBSD.org>
* curl: explicitly initialize and cleanup global curl statePatrick Steinhardt2018-02-282-0/+19
| | | | | | | | | | | | | Our curl-based streams make use of the easy curl interface. This interface automatically initializes and de-initializes the global curl state by calling out to `curl_global_init` and `curl_global_cleanup`. Thus, all global state will be repeatedly re-initialized when creating multiple curl streams in succession. Despite being inefficient, this is not thread-safe due to `curl_global_init` being not thread-safe itself. Thus a multi-threaded programing handling multiple curl streams at the same time is inherently racy. Fix the issue by globally initializing and cleaning up curl's state.
* streams: openssl: fix use of uninitialized variablePatrick Steinhardt2018-02-161-3/+3
| | | | | | | | | | | | | | When verifying the server certificate, we do try to make sure that the hostname actually matches the certificate alternative names. In cases where the host is either an IPv4 or IPv6 address, we have to compare the binary representations of the hostname with the declared IP address of the certificate. We only do that comparison in case we were successfully able to parse the hostname as an IP, which would always result in the memory region being initialized. Still, GCC 6.4.0 was complaining about usage of non-initialized memory. Fix the issue by simply asserting that `addr` needs to be initialized. This shuts up the GCC warning.
* Merge pull request #4437 from pks-t/pks/openssl-hash-errorsEdward Thomson2018-01-031-5/+13
|\ | | | | hash: openssl: check return values of SHA1_* functions
| * streams: openssl: fix thread-safety for OpenSSL error messagesPatrick Steinhardt2018-01-031-5/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The function `ERR_error_string` can be invoked without providing a buffer, in which case OpenSSL will simply return a string printed into a static buffer. Obviously and as documented in ERR_error_string(3), this is not thread-safe at all. As libgit2 is a library, though, it is easily possible that other threads may be using OpenSSL at the same time, which might lead to clobbered error strings. Fix the issue by instead using a stack-allocated buffer. According to the documentation, the caller has to provide a buffer of at least 256 bytes of size. While we do so, make sure that the buffer will never get overflown by switching to `ERR_error_string_n` to specify the buffer's size.
* | openssl: free the peer certificateEtienne Samson2017-12-161-1/+2
| | | | | | | | | | | | Per SSL_get_peer_certificate docs: ``` The reference count of the X509 object is incremented by one, so that it will not be destroyed when the session containing the peer certificate is freed. The X509 object must be explicitly freed using X509_free(). ```
View Lorry Controller Status