tree 0e656a609e09c9a2e8793a6dda2385d53b9fd80a
parent b8f8c60e872209b5fd0abed2674c2cb701cf9526
author David Ostrovsky <david@ostrovsky.org> 1569969925 +0200
committer Edwin Kempin <ekempin@google.com> 1570780977 +0200

Add integration test for git protocol version 2

Start gerrit server using StandaloneSiteTest and configure git client
connection using git-core client and SSH and HTTP protocols. The minimum
git-core version that supports git protocol v2 is 2.18.0. Check the
locally installed git version, and abort the test with assumption
violation if the version is older than 2.18.0.

Continue with the test and create the test project. To activate git
protocol version 2 for the target repository, protocol.version = 2
config option must be set.

Using Gerrit API set HTTP password for admin and non admin users, and
using ssh-keygen command generate private/public keys for admin and non
admin users, and using Gerrit API set the public SSH keys for admin and
non admin users. Execute git ls-remote command to list the refs from the
target repository, using SSH and HTTP protocols for admin and non admin
users. Given that the -c protocol.version=2 git option is specified and
given that the git protocol v2 is enabled unconditionally in server, git
protocol v2 communication is expected to take place and can be verified.

For verification the refs visibility is tested. This was the security
vulnerability that was not detected during fist attempt to activate Git
wire protocl v2 in Gerrit server:

1. Start a test Gerrit server
2. Enable support for git protocol v2 (not needed, as git wire protocol
   v2 is activated per default)
3. Create a project with two branches: refs/heads/master and
   refs/heads/secret
4. Remove read access for “Anonymous Users” on “refs/*” from the
   All-Projects project
5. Setup the following ACL on the new project to make refs/heads/secret
   only accessible by admins:
[access "refs/heads/master"]
        read = group Registered Users
[access "refs/heads/secret"]
        read = group Administrators
6. Clone repository with a non-admin user and do
    ‘git ls-remote origin’ -> refs/heads/secret branch is not listed

Test Plan:

  $ bazel test javatests/com/google/gerrit/integration/git:git

Change-Id: Ica7d2b57b4296e1c39f93528f17bef799d5ac824