{"thread":{"id":"40068","subject":"[PATCH] http: add support for specifying the SSL version","startedAt":"2015-08-12T13:00:56Z","lastAt":"2015-08-12T14:10:40Z","messageCount":3,"participants":["Elia Pinto","Remi Galan Alfonso"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"267900","messageId":"1439384456-16335-1-git-send-email-gitter.spiros@gmail.com","threadId":"40068","inReplyTo":null,"subject":"[PATCH] http: add support for specifying the SSL version","fromName":"Elia Pinto","fromEmail":"gitter.spiros@gmail.com","sentAt":"2015-08-12T13:00:56Z","receivedAt":"2015-08-12T13:00:56Z","isPatch":true,"sender":{"key":"gitter.spiros@gmail.com","avatar":"https://avatars.githubusercontent.com/u/158490?v=4"},"body":"Teach git about a new option, \"http.sslVersion\", which permits one to\nspecify the SSL version to use when negotiating SSL connections. The\nsetting can be overridden by the GIT_SSL_VERSION environment\nvariable.\n\nSigned-off-by: Elia Pinto \n---\n Documentation/config.txt | 21 +++++++++++++++++++++\n contrib/completion/git-completion.bash | 1 +\n http.c | 31 +++++++++++++++++++++++++++++--\n 3 files changed, 51 insertions(+), 2 deletions(-)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex 315f271..76a4f2b 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -1595,6 +1595,27 @@ http.saveCookies::\n \tIf set, store cookies received during requests to the file specified by\n \thttp.cookieFile. Has no effect if http.cookieFile is unset.\n \n+http.sslVersion::\n+\tThe SSL version to use when negotiating an SSL connection, if you\n+\twant to force the default. The available and default version depend on\n+\twhether libcurl was built against NSS or OpenSSL and the particular configuration\n+\tof the crypto library in use. Internally this sets the 'CURLOPT_SSL_VERSION'\n+\toption; see the libcurl documentation for more details on the format\n+\tof this option and for the ssl version supported. Actually the possible values\n+\tof this option are:\n+\n+\t- sslv2\n+\t- sslv3\n+\t- tlsv1\n+\t- tlsv1.0\n+\t- tlsv1.1\n+\t- tlsv1.2\n++\n+Can be overridden by the 'GIT_SSL_VERSION' environment variable.\n+To force git to use libcurl's default ssl version and ignore any\n+explicit http.sslversion option, set 'GIT_SSL_VERSION' to the\n+empty string.\n+\n http.sslCipherList::\n A list of SSL ciphers to use when negotiating an SSL connection.\n The available ciphers depend on whether libcurl was built against\ndiff --git a/contrib/completion/git-completion.bash b/contrib/completion/git-completion.bash\nindex c97c648..6e9359c 100644\n--- a/contrib/completion/git-completion.bash\n+++ b/contrib/completion/git-completion.bash\n@@ -2118,6 +2118,7 @@ _git_config ()\n \t\thttp.postBuffer\n \t\thttp.proxy\n \t\thttp.sslCipherList\n+\t\thttp.sslVersion\n \t\thttp.sslCAInfo\n \t\thttp.sslCAPath\n \t\thttp.sslCert\ndiff --git a/http.c b/http.c\nindex e9c6fdd..a7401b1 100644\n--- a/http.c\n+++ b/http.c\n@@ -37,6 +37,8 @@ static int curl_ssl_verify = -1;\n static int curl_ssl_try;\n static const char *ssl_cert;\n static const char *ssl_cipherlist;\n+static const char *ssl_version;\n+static long sslversion = CURL_SSLVERSION_DEFAULT;\n #if LIBCURL_VERSION_NUM >= 0x070903\n static const char *ssl_key;\n #endif\n@@ -190,6 +192,8 @@ static int http_options(const char *var, const char *value, void *cb)\n \t}\n \tif (!strcmp(\"http.sslcipherlist\", var))\n \t\treturn git_config_string(&ssl_cipherlist, var, value);\n+\tif (!strcmp(\"http.sslversion\", var))\n+\t\treturn git_config_string(&ssl_version, var, value);\n \tif (!strcmp(\"http.sslcert\", var))\n \t\treturn git_config_string(&ssl_cert, var, value);\n #if LIBCURL_VERSION_NUM >= 0x070903\n@@ -364,13 +368,36 @@ static CURL *get_curl_handle(void)\n \tif (http_proactive_auth)\n \t\tinit_curl_http_auth(result);\n \n+\n+\tif (getenv(\"GIT_SSL_VERSION\"))\n+\t\tssl_version = getenv(\"GIT_SSL_VERSION\");\n+\tif (ssl_version != NULL && *ssl_version) {\n+\t\tif (!strcmp(ssl_version,\"tlsv1\")) {\n+\t\t\tsslversion = CURL_SSLVERSION_TLSv1;\n+\t\t} else if (!strcmp(ssl_version,\"sslv2\")) {\n+\t\t\tsslversion = CURL_SSLVERSION_SSLv2;\n+\t\t} else if (!strcmp(ssl_version,\"sslv3\")) {\n+\t\t\tsslversion = CURL_SSLVERSION_SSLv3;\n+#if LIBCURL_VERSION_NUM >= 0x072200\n+\t\t} else if (!strcmp(ssl_version,\"tlsv1.0\")) {\n+\t\t\tsslversion = CURL_SSLVERSION_TLSv1_0;\n+\t\t} else if (!strcmp(ssl_version,\"tlsv1.1\")) {\n+\t\t\tsslversion = CURL_SSLVERSION_TLSv1_1;\n+\t\t} else if (!strcmp(ssl_version,\"tlsv1.2\")) {\n+\t\t\tsslversion = CURL_SSLVERSION_TLSv1_2;\n+ } else {\n+\t\t\twarning(\"unsupported ssl version %s : using default\",\n+\t\t\tssl_version);\n+#endif\n+\t\t}\n+ }\n+\tcurl_easy_setopt(result, CURLOPT_SSLVERSION,\n+\t\t\t\tsslversion);\n \tif (getenv(\"GIT_SSL_CIPHER_LIST\"))\n \t\tssl_cipherlist = getenv(\"GIT_SSL_CIPHER_LIST\");\n-\n \tif (ssl_cipherlist != NULL && *ssl_cipherlist)\n \t\tcurl_easy_setopt(result, CURLOPT_SSL_CIPHER_LIST,\n \t\t\t\tssl_cipherlist);\n-\n \tif (ssl_cert != NULL)\n \t\tcurl_easy_setopt(result, CURLOPT_SSLCERT, ssl_cert);\n \tif (has_cert_password())\n-- \n2.5.0.234.gefc8a62\n"},{"id":"267904","messageId":"950187984.739852.1439386399510.JavaMail.zimbra@ensimag.grenoble-inp.fr","threadId":"40068","inReplyTo":"1439384456-16335-1-git-send-email-gitter.spiros@gmail.com","subject":"Re: [PATCH] http: add support for specifying the SSL version","fromName":"Remi Galan Alfonso","fromEmail":"remi.galan-alfonso@ensimag.grenoble-inp.fr","sentAt":"2015-08-12T13:33:19Z","receivedAt":"2015-08-12T13:33:19Z","isPatch":true,"sender":{"key":"remi.galan-alfonso@ensimag.grenoble-inp.fr","avatar":"https://avatars.githubusercontent.com/u/12509162?v=4"},"body":"Hello, Elia\n\nElia Pinto writes:\n> + if (ssl_version != NULL && *ssl_version) {\n> + if (!strcmp(ssl_version,\"tlsv1\")) {\n> + sslversion = CURL_SSLVERSION_TLSv1;\n> + } else if (!strcmp(ssl_version,\"sslv2\")) {\n> + sslversion = CURL_SSLVERSION_SSLv2;\n> + } else if (!strcmp(ssl_version,\"sslv3\")) {\n> + sslversion = CURL_SSLVERSION_SSLv3;\n> +#if LIBCURL_VERSION_NUM >= 0x072200\n> + } else if (!strcmp(ssl_version,\"tlsv1.0\")) {\n> + sslversion = CURL_SSLVERSION_TLSv1_0;\n> + } else if (!strcmp(ssl_version,\"tlsv1.1\")) {\n> + sslversion = CURL_SSLVERSION_TLSv1_1;\n> + } else if (!strcmp(ssl_version,\"tlsv1.2\")) {\n> + sslversion = CURL_SSLVERSION_TLSv1_2;\n> + } else {\n> + warning(\"unsupported ssl version %s : using default\",\n> + ssl_version);\n> +#endif\n> + }\n> + }\n\nI'm curious about what would happen should 'sslVersion' be set to\n'tlsv1.0' (or a value that doesn't belong to the possible values) and\n'LIBCURL_VERSION_NUM' be inferior to '0x072200'.\nSince we wouldn't go through any 'if' and would also skip the 'else'\ncase, wouldn't we have a silent 'unsupported ssl version: using\ndefault' ?\n\nSo I think that the 'else' case should be outside of the '#if [...]\n#endif'.\n\nThanks,\nRémi\n"},{"id":"267906","messageId":"CA+EOSBn8xXHEXSwZ3sqcs8AaLQfDNw-5bSJSv-gwwGpaH4VW9w@mail.gmail.com","threadId":"40068","inReplyTo":"950187984.739852.1439386399510.JavaMail.zimbra@ensimag.grenoble-inp.fr","subject":"Re: [PATCH] http: add support for specifying the SSL version","fromName":"Elia Pinto","fromEmail":"gitter.spiros@gmail.com","sentAt":"2015-08-12T14:10:40Z","receivedAt":"2015-08-12T14:10:40Z","isPatch":true,"sender":{"key":"gitter.spiros@gmail.com","avatar":"https://avatars.githubusercontent.com/u/158490?v=4"},"body":"2015-08-12 15:33 GMT+02:00 Remi Galan Alfonso\n:\n> Hello, Elia\n>\n> Elia Pinto writes:\n>> + if (ssl_version != NULL && *ssl_version) {\n>> + if (!strcmp(ssl_version,\"tlsv1\")) {\n>> + sslversion = CURL_SSLVERSION_TLSv1;\n>> + } else if (!strcmp(ssl_version,\"sslv2\")) {\n>> + sslversion = CURL_SSLVERSION_SSLv2;\n>> + } else if (!strcmp(ssl_version,\"sslv3\")) {\n>> + sslversion = CURL_SSLVERSION_SSLv3;\n>> +#if LIBCURL_VERSION_NUM >= 0x072200\n>> + } else if (!strcmp(ssl_version,\"tlsv1.0\")) {\n>> + sslversion = CURL_SSLVERSION_TLSv1_0;\n>> + } else if (!strcmp(ssl_version,\"tlsv1.1\")) {\n>> + sslversion = CURL_SSLVERSION_TLSv1_1;\n>> + } else if (!strcmp(ssl_version,\"tlsv1.2\")) {\n>> + sslversion = CURL_SSLVERSION_TLSv1_2;\n>> + } else {\n>> + warning(\"unsupported ssl version %s : using default\",\n>> + ssl_version);\n>> +#endif\n>> + }\n>> + }\n>\n> I'm curious about what would happen should 'sslVersion' be set to\n> 'tlsv1.0' (or a value that doesn't belong to the possible values) and\n> 'LIBCURL_VERSION_NUM' be inferior to '0x072200'.\n> Since we wouldn't go through any 'if' and would also skip the 'else'\n> case, wouldn't we have a silent 'unsupported ssl version: using\n> default' ?\nYou are right. I will resend. Thank you very much\n>\n> So I think that the 'else' case should be outside of the '#if [...]\n> #endif'.\n>\n> Thanks,\n> Rémi\n"}]}