undef/git-commit-vandalism
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

http: add support for specifying the SSL version

Browse Source 
Teach git about a new option, "http.sslVersion", which permits one
to specify the SSL version to use when negotiating SSL connections.
The setting can be overridden by the GIT_SSL_VERSION environment
variable.

Signed-off-by: Elia Pinto <gitter.spiros@gmail.com>
Helped-by: Eric Sunshine <sunshine@sunshineco.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Elia Pinto 2015-08-14 21:37:43 +02:00 committed by Junio C Hamano
parent a17c56c056
commit 01861cb7a2
3 changed files with 56 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
Documentation/config.txt
View File

@ -1576,6 +1576,29 @@ http.saveCookies::
If set, store cookies received during requests to the file specified by
http.cookieFile. Has no effect if http.cookieFile is unset.
http.sslVersion::
The SSL version to use when negotiating an SSL connection, if you
want to force the default. The available and default version
depend on whether libcurl was built against NSS or OpenSSL and the
particular configuration of the crypto library in use. Internally
this sets the 'CURLOPT_SSL_VERSION' option; see the libcurl
documentation for more details on the format of this option and
for the ssl version supported. Actually the possible values of
this option are:
- sslv2
- sslv3
- tlsv1
- tlsv1.0
- tlsv1.1
- tlsv1.2
+
Can be overridden by the 'GIT_SSL_VERSION' environment variable.
To force git to use libcurl's default ssl version and ignore any
explicit http.sslversion option, set 'GIT_SSL_VERSION' to the
empty string.
http.sslCipherList::
A list of SSL ciphers to use when negotiating an SSL connection.
The available ciphers depend on whether libcurl was built against

1
contrib/completion/git-completion.bash
View File

@ -2118,6 +2118,7 @@ _git_config ()
http.postBuffer
http.proxy
http.sslCipherList
http.sslVersion
http.sslCAInfo
http.sslCAPath
http.sslCert

33
http.c
View File

@ -37,6 +37,20 @@ static int curl_ssl_verify = -1;
static int curl_ssl_try;
static const char *ssl_cert;
static const char *ssl_cipherlist;
static const char *ssl_version;
static struct {
const char *name;
long ssl_version;
} sslversions[] = {
{ "sslv2", CURL_SSLVERSION_SSLv2 },
{ "sslv3", CURL_SSLVERSION_SSLv3 },
{ "tlsv1", CURL_SSLVERSION_TLSv1 },
#if LIBCURL_VERSION_NUM >= 0x072200
{ "tlsv1.0", CURL_SSLVERSION_TLSv1_0 },
{ "tlsv1.1", CURL_SSLVERSION_TLSv1_1 },
{ "tlsv1.2", CURL_SSLVERSION_TLSv1_2 },
#endif
};
#if LIBCURL_VERSION_NUM >= 0x070903
static const char *ssl_key;
#endif
@ -190,6 +204,8 @@ static int http_options(const char *var, const char *value, void *cb)
}
if (!strcmp("http.sslcipherlist", var))
return git_config_string(&ssl_cipherlist, var, value);
if (!strcmp("http.sslversion", var))
return git_config_string(&ssl_version, var, value);
if (!strcmp("http.sslcert", var))
return git_config_string(&ssl_cert, var, value);
#if LIBCURL_VERSION_NUM >= 0x070903
@ -364,9 +380,24 @@ static CURL *get_curl_handle(void)
if (http_proactive_auth)
init_curl_http_auth(result);
if (getenv("GIT_SSL_VERSION"))
ssl_version = getenv("GIT_SSL_VERSION");
if (ssl_version && *ssl_version) {
int i;
for (i = 0; i < ARRAY_SIZE(sslversions); i++) {
if (!strcmp(ssl_version, sslversions[i].name)) {
curl_easy_setopt(result, CURLOPT_SSLVERSION,
sslversions[i].ssl_version);
break;
}
}
if (i == ARRAY_SIZE(sslversions))
warning("unsupported ssl version %s: using default",
ssl_version);
}
if (getenv("GIT_SSL_CIPHER_LIST"))
ssl_cipherlist = getenv("GIT_SSL_CIPHER_LIST");
if (ssl_cipherlist != NULL && *ssl_cipherlist)
curl_easy_setopt(result, CURLOPT_SSL_CIPHER_LIST,
ssl_cipherlist);