From d81216ee4dd46ae59a388044d1266d6fa9030c19 Mon Sep 17 00:00:00 2001 From: Johannes Schindelin Date: Wed, 2 Aug 2017 22:10:06 +0200 Subject: [PATCH] http: add support for selecting SSL backends at runtime The Pull Request at https://github.com/curl/curl/pull/1601 adds support for choosing the SSL backend at runtime to cURL, and will hopefully be merged before version 7.56.0 comes out. Git for Windows will ship with those patches backported to 7.54.1 (and come August 9th, 2017, 7.55.0 and later). This patch adds the Git side of that feature: by setting http.sslBackend to "openssl" or "schannel", Git for Windows can now choose the SSL backend at runtime. This comes in handy because Secure Channel ("schannel") is the native Windows solution, accessing the Windows Credential Store, thereby allowing for enterprise-wide management of certificates. For historical reasons, Git for Windows needs to support OpenSSL still, as it has previously been the only supported SSL backend in Git for Windows for almost a decade. Signed-off-by: Johannes Schindelin --- Documentation/config.txt | 5 +++++ http.c | 23 +++++++++++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/Documentation/config.txt b/Documentation/config.txt index d5c9c4cab6..703962748b 100644 --- a/Documentation/config.txt +++ b/Documentation/config.txt @@ -1948,6 +1948,11 @@ http.sslCAPath:: with when fetching or pushing over HTTPS. Can be overridden by the `GIT_SSL_CAPATH` environment variable. +http.sslBackend:: + Name of the SSL backend to use (e.g. "openssl" or "schannel"). + This option is ignored if cURL lacks support for choosing the SSL + backend at runtime. + http.pinnedpubkey:: Public key of the https service. It may either be the filename of a PEM or DER encoded public key file or a string starting with diff --git a/http.c b/http.c index c6c010f881..6494dc2db9 100644 --- a/http.c +++ b/http.c @@ -291,6 +291,29 @@ static int http_options(const char *var, const char *value, void *cb) curl_ssl_try = git_config_bool(var, value); return 0; } +#if LIBCURL_VERSION_NUM >= 0x073800 || \ + defined(CURL_WITH_EXPERIMENTAL_SSL_BACKEND_SUPPORT) + if (!strcmp("http.sslbackend", var)) { + const curl_ssl_backend **backends; + struct strbuf buf = STRBUF_INIT; + int i; + + switch (curl_global_sslset(-1, value, &backends)) { + case CURLSSLSET_UNKNOWN_BACKEND: + strbuf_addf(&buf, _("Unsupported SSL backend '%s'. " + "Supported SSL backends:"), value); + for (i = 0; backends[i]; i++) + strbuf_addf(&buf, "\n\t%s", backends[i]->name); + die(buf.buf); + case CURLSSLSET_TOO_LATE: + die(_("Could not set SSL backend to '%s': already set"), + value); + case CURLSSLSET_OK: + break; /* Okay! */ + } + } +#endif + if (!strcmp("http.minsessions", var)) { min_curl_sessions = git_config_int(var, value); #ifndef USE_CURL_MULTI