{"thread":{"id":"40086","subject":"[PATCHv4] http: add support for specifying the SSL version","startedAt":"2015-08-14T16:35:35Z","lastAt":"2015-08-14T17:57:42Z","messageCount":2,"participants":["Elia Pinto","Eric Sunshine"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"268044","messageId":"1439570135-17324-1-git-send-email-gitter.spiros@gmail.com","threadId":"40086","inReplyTo":null,"subject":"[PATCHv4] http: add support for specifying the SSL version","fromName":"Elia Pinto","fromEmail":"gitter.spiros@gmail.com","sentAt":"2015-08-14T16:35:35Z","receivedAt":"2015-08-14T16:35:35Z","isPatch":false,"sender":{"key":"gitter.spiros@gmail.com","avatar":"https://avatars.githubusercontent.com/u/158490?v=4"},"body":"Teach git about a new option, \"http.sslVersion\", which permits one to\nspecify the SSL version to use when negotiating SSL connections. The\nsetting can be overridden by the GIT_SSL_VERSION environment\nvariable.\n\nSigned-off-by: Elia Pinto \n---\nThis is the fourth revision of the patch. Changes from previous\n\n- Used only ARRAY_SIZE for walking sslversions (Eric, Junio)\n- Fixed some problems of style: spurious blanks in if stm, wrapped warning \n\n\n Documentation/config.txt | 22 ++++++++++++++++++++++\n contrib/completion/git-completion.bash | 1 +\n http.c | 31 ++++++++++++++++++++++++++++++-\n 3 files changed, 53 insertions(+), 1 deletion(-)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex 315f271..b23b01a 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -1595,6 +1595,28 @@ http.saveCookies::\n \tIf set, store cookies received during requests to the file specified by\n \thttp.cookieFile. Has no effect if http.cookieFile is unset.\n \n+http.sslVersion::\n+\tThe SSL version to use when negotiating an SSL connection, if you\n+\twant to force the default. The available and default version depend on\n+\twhether libcurl was built against NSS or OpenSSL and the particular configuration\n+\tof the crypto library in use. Internally this sets the 'CURLOPT_SSL_VERSION'\n+\toption; see the libcurl documentation for more details on the format\n+\tof this option and for the ssl version supported. Actually the possible values\n+\tof this option are:\n+\n+\t- sslv2\n+\t- sslv3\n+\t- tlsv1\n+\t- tlsv1.0\n+\t- tlsv1.1\n+\t- tlsv1.2\n+\n++\n+Can be overridden by the 'GIT_SSL_VERSION' environment variable.\n+To force git to use libcurl's default ssl version and ignore any\n+explicit http.sslversion option, set 'GIT_SSL_VERSION' to the\n+empty string.\n+\n http.sslCipherList::\n A list of SSL ciphers to use when negotiating an SSL connection.\n The available ciphers depend on whether libcurl was built against\ndiff --git a/contrib/completion/git-completion.bash b/contrib/completion/git-completion.bash\nindex c97c648..6e9359c 100644\n--- a/contrib/completion/git-completion.bash\n+++ b/contrib/completion/git-completion.bash\n@@ -2118,6 +2118,7 @@ _git_config ()\n \t\thttp.postBuffer\n \t\thttp.proxy\n \t\thttp.sslCipherList\n+\t\thttp.sslVersion\n \t\thttp.sslCAInfo\n \t\thttp.sslCAPath\n \t\thttp.sslCert\ndiff --git a/http.c b/http.c\nindex e9c6fdd..83118b5 100644\n--- a/http.c\n+++ b/http.c\n@@ -37,6 +37,20 @@ static int curl_ssl_verify = -1;\n static int curl_ssl_try;\n static const char *ssl_cert;\n static const char *ssl_cipherlist;\n+static const char *ssl_version;\n+static struct {\n+\tconst char *name;\n+\tlong ssl_version;\n+\t} sslversions[] = {\n+\t\t{ \"sslv2\", CURL_SSLVERSION_SSLv2 },\n+\t\t{ \"sslv3\", CURL_SSLVERSION_TLSv1 },\n+\t\t{ \"tlsv1\", CURL_SSLVERSION_TLSv1 },\n+#if LIBCURL_VERSION_NUM >= 0x072200\n+\t\t{ \"tlsv1.0\", CURL_SSLVERSION_TLSv1_0 },\n+\t\t{ \"tlsv1.1\", CURL_SSLVERSION_TLSv1_1 },\n+\t\t{ \"tlsv1.2\", CURL_SSLVERSION_TLSv1_2 }\n+#endif\n+};\n #if LIBCURL_VERSION_NUM >= 0x070903\n static const char *ssl_key;\n #endif\n@@ -190,6 +204,8 @@ static int http_options(const char *var, const char *value, void *cb)\n \t}\n \tif (!strcmp(\"http.sslcipherlist\", var))\n \t\treturn git_config_string(&ssl_cipherlist, var, value);\n+\tif (!strcmp(\"http.sslversion\", var))\n+\t\treturn git_config_string(&ssl_version, var, value);\n \tif (!strcmp(\"http.sslcert\", var))\n \t\treturn git_config_string(&ssl_cert, var, value);\n #if LIBCURL_VERSION_NUM >= 0x070903\n@@ -364,9 +380,22 @@ static CURL *get_curl_handle(void)\n \tif (http_proactive_auth)\n \t\tinit_curl_http_auth(result);\n \n+\tif (getenv(\"GIT_SSL_VERSION\"))\n+\t\tssl_version = getenv(\"GIT_SSL_VERSION\");\n+\tif (ssl_version != NULL && *ssl_version) {\n+\t\tint i;\n+\t\tfor ( i = 0; i < ARRAY_SIZE(sslversions); i++ ) {\n+\t\t\tif (!strcmp(ssl_version,sslversions[i].name)) {\n+\t\t\t\tcurl_easy_setopt(result, CURLOPT_SSLVERSION,\n+\t\t\t\t\tsslversions[i].ssl_version);\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n+\t\tif (i == ARRAY_SIZE(sslversions)) warning(\"unsupported ssl version %s: using default\",ssl_version);\n+\t}\n+\n \tif (getenv(\"GIT_SSL_CIPHER_LIST\"))\n \t\tssl_cipherlist = getenv(\"GIT_SSL_CIPHER_LIST\");\n-\n \tif (ssl_cipherlist != NULL && *ssl_cipherlist)\n \t\tcurl_easy_setopt(result, CURLOPT_SSL_CIPHER_LIST,\n \t\t\t\tssl_cipherlist);\n-- \n2.5.0.235.gb9bd8dc\n"},{"id":"268055","messageId":"CAPig+cSUR4CEbg3HobZPHyWfGFoGzctP7BbTswg8vyXjGmma6Q@mail.gmail.com","threadId":"40086","inReplyTo":"1439570135-17324-1-git-send-email-gitter.spiros@gmail.com","subject":"Re: [PATCHv4] http: add support for specifying the SSL version","fromName":"Eric Sunshine","fromEmail":"sunshine@sunshineco.com","sentAt":"2015-08-14T17:57:42Z","receivedAt":"2015-08-14T17:57:42Z","isPatch":false,"sender":{"key":"sunshine@sunshineco.com","avatar":"https://avatars.githubusercontent.com/u/163641?v=4"},"body":"On Fri, Aug 14, 2015 at 12:35 PM, Elia Pinto wrote:\n> Teach git about a new option, \"http.sslVersion\", which permits one to\n> specify the SSL version to use when negotiating SSL connections. The\n> setting can be overridden by the GIT_SSL_VERSION environment\n> variable.\n>\n> Signed-off-by: Elia Pinto \n> ---\n> This is the fourth revision of the patch. Changes from previous\n>\n> - Used only ARRAY_SIZE for walking sslversions (Eric, Junio)\n> - Fixed some problems of style: spurious blanks in if stm, wrapped warning\n\nThanks, this is looking better. A few very minor style-related\ncomments below (most or all of which were mentioned previously, I\nthink)...\n\n> diff --git a/http.c b/http.c\n> index e9c6fdd..83118b5 100644\n> --- a/http.c\n> +++ b/http.c\n> @@ -364,9 +380,22 @@ static CURL *get_curl_handle(void)\n> if (http_proactive_auth)\n> init_curl_http_auth(result);\n>\n> + if (getenv(\"GIT_SSL_VERSION\"))\n> + ssl_version = getenv(\"GIT_SSL_VERSION\");\n> + if (ssl_version != NULL && *ssl_version) {\n\nIn this codebase, it is customary to omit the \"!= NULL\", so:\n\n if (ssl_version && *ssl_version) {\n\n> + int i;\n> + for ( i = 0; i < ARRAY_SIZE(sslversions); i++ ) {\n\nStyle: Drop space after open '(' and before close ')' in 'for' loop:\n\n for (i = 0; i < ARRAY_SIZE(sslversions); i++) {\n\n> + if (!strcmp(ssl_version,sslversions[i].name)) {\n\nStyle: Insert space after comma.\n\n> + curl_easy_setopt(result, CURLOPT_SSLVERSION,\n> + sslversions[i].ssl_version);\n> + break;\n> + }\n> + }\n> + if (i == ARRAY_SIZE(sslversions)) warning(\"unsupported ssl version %s: using default\",ssl_version);\n\nwarning() call should be on its own line.\n\nStyle: Insert space after comma.\n\n> + }\n> +\n> if (getenv(\"GIT_SSL_CIPHER_LIST\"))\n> ssl_cipherlist = getenv(\"GIT_SSL_CIPHER_LIST\");\n> -\n> if (ssl_cipherlist != NULL && *ssl_cipherlist)\n> curl_easy_setopt(result, CURLOPT_SSL_CIPHER_LIST,\n> ssl_cipherlist);\n> --\n> 2.5.0.235.gb9bd8dc\n"}]}