LibGit2: respect NetworkOptions.verify_host

[StefanKarpinski]

No description provided.

[StefanKarpinski]

Everything passed except aarch64 which has some numerical test failures that definitely aren't related. I'm gonna do some more testing before merge to make sure this is doing what I think it is, but at least it doesn't break anything.

[StefanKarpinski]

Ok, so here's a way to test this using ghostunnel. First, set up the "client" side that connects to github.com:

ghostunnel client --target=github.com:443 --listen=localhost:1234 --disable-authentication

Next, generate a phony key/cert pair:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

Then start the "server" side that serves incoming HTTPS connections and sends them through to the client:

sudo ghostunnel server --listen $ip:443 --target localhost:1234 --key key.pem --cert cert.pem --disable-authentication

Then you modify /etc/hosts on the machine you're running julia on to add this entry:

$ip github.com

With this configuration, the local machine will be man-in-the-middled for HTTPS connections to github.com. In order to test that this is correctly rejected by Pkg, you'll want to export JULIA_PKG_SERVER="" and delete ~/.julia/registries/General so that Pkg uses LibGit2 to clone the registry. Pkg should abort since it's getting man-in-the-middled. However, if you set JULIA_NO_VERIFY_HOSTS="github.com" then you should be able to clone registry again, despite the man-in-the-middle attack.

This is useful because this kind of man-in-the-middle attack is exactly what is done behind many firewalls. If this kind of man-in-the-middle proxy is correctly setup, it is still secure (aside from the operator being able to snoop on your traffic) since the proxy will verify it's outbound connections. In these situations the client systems should have a CA root certificate for the certificate that the proxy uses on the internal side, but sometimes that's misconfigured or not done.

[GunnarFarneback]

This is not working right with ssh keys, as discussed on slack. To reproduce, try to add your own fork of General with git URL.

(@v1.6) pkg> registry add [email protected]:GunnarFarneback/General.git
     Cloning registry from "[email protected]:GunnarFarneback/General.git"
ERROR: failed to clone from [email protected]:GunnarFarneback/General.git, error: GitError(Code:ERROR, Class:Net, user cancelled hostkey check)

[StefanKarpinski]

SSH issue should be fixed by #38563.

[GunnarFarneback]

Confirmed, works well now.