global/git
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2026-01-18 06:34:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'http-ssl-backend'

Browse Source 
This topic branch brings support for choosing cURL's SSL backend at
runtime via http.sslBackend, based on patches already submitted to the
cURL project and backported to cURL 7.54.1 as used in Git for Windows'
SDK.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
This commit is contained in:
Johannes Schindelin
2018-06-08 18:36:08 +02:00
parent fd28c3d93d cbea143773
commit 3360cb294b
2 changed files with 91 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
Documentation/config.txt
View File

@@ -2242,6 +2242,27 @@ http.sslCAPath::
with when fetching or pushing over HTTPS. Can be overridden
by the `GIT_SSL_CAPATH` environment variable.
http.sslBackend::
Name of the SSL backend to use (e.g. "openssl" or "schannel").
This option is ignored if cURL lacks support for choosing the SSL
backend at runtime.
http.schannelCheckRevoke::
Used to enforce or disable certificate revocation checks in cURL
when http.sslBackend is set to "schannel". Defaults to `true` if
unset. Only necessary to disable this if Git consistently errors
and the message is about checking the revocation status of a
certificate. This option is ignored if cURL lacks support for
setting the relevant SSL option at runtime.
http.schannelUseSSLCAInfo::
As of cURL v7.60.0, the Secure Channel backend can use the
certificate bundle provided via `http.sslCAInfo`, but that would
override the Windows Certificate Store. Since this is not desirable
by default, Git will tell cURL not to use that bundle by default
when the `schannel` backend was configured via `http.sslBackend`,
unless `http.schannelUseSSLCAInfo` overrides this behavior.
http.pinnedpubkey::
Public key of the https service. It may either be the filename of
a PEM or DER encoded public key file or a string starting with

71
http.c
View File

@@ -155,6 +155,16 @@ static struct active_request_slot *active_queue_head;
static char *cached_accept_language;
static char *http_ssl_backend;
static int http_schannel_check_revoke = 1;
/*
* With the backend being set to `schannel`, setting sslCAinfo would override
* the Certificate Store in cURL v7.60.0 and later, which is not what we want
* by default.
*/
static int http_schannel_use_ssl_cainfo;
size_t fread_buffer(char *ptr, size_t eltsize, size_t nmemb, void *buffer_)
{
size_t size = eltsize * nmemb;
@@ -302,6 +312,22 @@ static int http_options(const char *var, const char *value, void *cb)
curl_ssl_try = git_config_bool(var, value);
return 0;
}
if (!strcmp("http.sslbackend", var)) {
free(http_ssl_backend);
http_ssl_backend = xstrdup_or_null(value);
return 0;
}
if (!strcmp("http.schannelcheckrevoke", var)) {
http_schannel_check_revoke = git_config_bool(var, value);
return 0;
}
if (!strcmp("http.schannelusesslcainfo", var)) {
http_schannel_use_ssl_cainfo = git_config_bool(var, value);
return 0;
}
if (!strcmp("http.minsessions", var)) {
min_curl_sessions = git_config_int(var, value);
#ifndef USE_CURL_MULTI
@@ -803,6 +829,16 @@ static CURL *get_curl_handle(void)
}
#endif
if (http_ssl_backend && !strcmp("schannel", http_ssl_backend) &&
!http_schannel_check_revoke) {
#if LIBCURL_VERSION_NUM >= 0x072c00
curl_easy_setopt(result, CURLOPT_SSL_OPTIONS, CURLSSLOPT_NO_REVOKE);
#else
warning("CURLSSLOPT_NO_REVOKE not applied to curl SSL options because\n"
"your curl version is too old (>= 7.44.0)");
#endif
}
if (http_proactive_auth)
init_curl_http_auth(result);
@@ -844,7 +880,13 @@ static CURL *get_curl_handle(void)
if (ssl_pinnedkey != NULL)
curl_easy_setopt(result, CURLOPT_PINNEDPUBLICKEY, ssl_pinnedkey);
#endif
if (ssl_cainfo != NULL)
if (http_ssl_backend && !strcmp("schannel", http_ssl_backend) &&
!http_schannel_use_ssl_cainfo) {
curl_easy_setopt(result, CURLOPT_CAINFO, NULL);
#if LIBCURL_VERSION_NUM >= 0x073400
curl_easy_setopt(result, CURLOPT_PROXY_CAINFO, NULL);
#endif
} else if (ssl_cainfo != NULL)
curl_easy_setopt(result, CURLOPT_CAINFO, ssl_cainfo);
if (curl_low_speed_limit > 0 && curl_low_speed_time > 0) {
@@ -995,6 +1037,33 @@ void http_init(struct remote *remote, const char *url, int proactive_auth)
git_config(urlmatch_config_entry, &config);
free(normalized_url);
#if LIBCURL_VERSION_NUM >= 0x073800
if (http_ssl_backend) {
const curl_ssl_backend **backends;
struct strbuf buf = STRBUF_INIT;
int i;
switch (curl_global_sslset(-1, http_ssl_backend, &backends)) {
case CURLSSLSET_UNKNOWN_BACKEND:
strbuf_addf(&buf, _("Unsupported SSL backend '%s'. "
"Supported SSL backends:"),
http_ssl_backend);
for (i = 0; backends[i]; i++)
strbuf_addf(&buf, "\n\t%s", backends[i]->name);
die("%s", buf.buf);
case CURLSSLSET_NO_BACKENDS:
die(_("Could not set SSL backend to '%s': "
"cURL was built without SSL backends"),
http_ssl_backend);
case CURLSSLSET_TOO_LATE:
die(_("Could not set SSL backend to '%s': already set"),
http_ssl_backend);
case CURLSSLSET_OK:
break; /* Okay! */
}
}
#endif
if (curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK)
die("curl_global_init failed");