{"thread":{"id":"40089","subject":"[PATCHv5] http: add support for specifying the SSL version","startedAt":"2015-08-14T19:37:43Z","lastAt":"2015-08-15T08:06:52Z","messageCount":4,"participants":["Elia Pinto","Eric Sunshine","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"268061","messageId":"1439581063-29771-1-git-send-email-gitter.spiros@gmail.com","threadId":"40089","inReplyTo":null,"subject":"[PATCHv5] http: add support for specifying the SSL version","fromName":"Elia Pinto","fromEmail":"gitter.spiros@gmail.com","sentAt":"2015-08-14T19:37:43Z","receivedAt":"2015-08-14T19:37:43Z","isPatch":false,"sender":{"key":"gitter.spiros@gmail.com","avatar":"https://avatars.githubusercontent.com/u/158490?v=4"},"body":"Teach git about a new option, \"http.sslVersion\", which permits one to\nspecify the SSL version to use when negotiating SSL connections. The\nsetting can be overridden by the GIT_SSL_VERSION environment\nvariable.\n\nSigned-off-by: Elia Pinto \n---\nThis is the fifth version of the patch. Changes from the previous version:\n\n- Minor style changes (Eric)\n\n Documentation/config.txt | 22 ++++++++++++++++++++++\n contrib/completion/git-completion.bash | 1 +\n http.c | 32 +++++++++++++++++++++++++++++++-\n 3 files changed, 54 insertions(+), 1 deletion(-)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex 315f271..b23b01a 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -1595,6 +1595,28 @@ http.saveCookies::\n \tIf set, store cookies received during requests to the file specified by\n \thttp.cookieFile. Has no effect if http.cookieFile is unset.\n \n+http.sslVersion::\n+\tThe SSL version to use when negotiating an SSL connection, if you\n+\twant to force the default. The available and default version depend on\n+\twhether libcurl was built against NSS or OpenSSL and the particular configuration\n+\tof the crypto library in use. Internally this sets the 'CURLOPT_SSL_VERSION'\n+\toption; see the libcurl documentation for more details on the format\n+\tof this option and for the ssl version supported. Actually the possible values\n+\tof this option are:\n+\n+\t- sslv2\n+\t- sslv3\n+\t- tlsv1\n+\t- tlsv1.0\n+\t- tlsv1.1\n+\t- tlsv1.2\n+\n++\n+Can be overridden by the 'GIT_SSL_VERSION' environment variable.\n+To force git to use libcurl's default ssl version and ignore any\n+explicit http.sslversion option, set 'GIT_SSL_VERSION' to the\n+empty string.\n+\n http.sslCipherList::\n A list of SSL ciphers to use when negotiating an SSL connection.\n The available ciphers depend on whether libcurl was built against\ndiff --git a/contrib/completion/git-completion.bash b/contrib/completion/git-completion.bash\nindex c97c648..6e9359c 100644\n--- a/contrib/completion/git-completion.bash\n+++ b/contrib/completion/git-completion.bash\n@@ -2118,6 +2118,7 @@ _git_config ()\n \t\thttp.postBuffer\n \t\thttp.proxy\n \t\thttp.sslCipherList\n+\t\thttp.sslVersion\n \t\thttp.sslCAInfo\n \t\thttp.sslCAPath\n \t\thttp.sslCert\ndiff --git a/http.c b/http.c\nindex e9c6fdd..4c5a2e0 100644\n--- a/http.c\n+++ b/http.c\n@@ -37,6 +37,20 @@ static int curl_ssl_verify = -1;\n static int curl_ssl_try;\n static const char *ssl_cert;\n static const char *ssl_cipherlist;\n+static const char *ssl_version;\n+static struct {\n+\tconst char *name;\n+\tlong ssl_version;\n+\t} sslversions[] = {\n+\t\t{ \"sslv2\", CURL_SSLVERSION_SSLv2 },\n+\t\t{ \"sslv3\", CURL_SSLVERSION_TLSv1 },\n+\t\t{ \"tlsv1\", CURL_SSLVERSION_TLSv1 },\n+#if LIBCURL_VERSION_NUM >= 0x072200\n+\t\t{ \"tlsv1.0\", CURL_SSLVERSION_TLSv1_0 },\n+\t\t{ \"tlsv1.1\", CURL_SSLVERSION_TLSv1_1 },\n+\t\t{ \"tlsv1.2\", CURL_SSLVERSION_TLSv1_2 }\n+#endif\n+};\n #if LIBCURL_VERSION_NUM >= 0x070903\n static const char *ssl_key;\n #endif\n@@ -190,6 +204,8 @@ static int http_options(const char *var, const char *value, void *cb)\n \t}\n \tif (!strcmp(\"http.sslcipherlist\", var))\n \t\treturn git_config_string(&ssl_cipherlist, var, value);\n+\tif (!strcmp(\"http.sslversion\", var))\n+\t\treturn git_config_string(&ssl_version, var, value);\n \tif (!strcmp(\"http.sslcert\", var))\n \t\treturn git_config_string(&ssl_cert, var, value);\n #if LIBCURL_VERSION_NUM >= 0x070903\n@@ -364,9 +380,23 @@ static CURL *get_curl_handle(void)\n \tif (http_proactive_auth)\n \t\tinit_curl_http_auth(result);\n \n+\tif (getenv(\"GIT_SSL_VERSION\"))\n+\t\tssl_version = getenv(\"GIT_SSL_VERSION\");\n+\tif (ssl_version && *ssl_version) {\n+\t\tint i;\n+\t\tfor (i = 0; i < ARRAY_SIZE(sslversions); i++) {\n+\t\t\tif (!strcmp(ssl_version, sslversions[i].name)) {\n+\t\t\t\tcurl_easy_setopt(result, CURLOPT_SSLVERSION,\n+\t\t\t\t\tsslversions[i].ssl_version);\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n+\t\tif (i == ARRAY_SIZE(sslversions))\n+\t\t\twarning(\"unsupported ssl version %s: using default\", ssl_version);\n+\t}\n+\n \tif (getenv(\"GIT_SSL_CIPHER_LIST\"))\n \t\tssl_cipherlist = getenv(\"GIT_SSL_CIPHER_LIST\");\n-\n \tif (ssl_cipherlist != NULL && *ssl_cipherlist)\n \t\tcurl_easy_setopt(result, CURLOPT_SSL_CIPHER_LIST,\n \t\t\t\tssl_cipherlist);\n-- \n2.5.0.235.gb9bd8dc\n"},{"id":"268067","messageId":"CAPig+cTANAgB-5gw5h-Eo=hE-qFavoxiUxQAvaYeV1fbuMiiWA@mail.gmail.com","threadId":"40089","inReplyTo":"1439581063-29771-1-git-send-email-gitter.spiros@gmail.com","subject":"Re: [PATCHv5] http: add support for specifying the SSL version","fromName":"Eric Sunshine","fromEmail":"sunshine@sunshineco.com","sentAt":"2015-08-14T19:57:13Z","receivedAt":"2015-08-14T19:57:13Z","isPatch":false,"sender":{"key":"sunshine@sunshineco.com","avatar":"https://avatars.githubusercontent.com/u/163641?v=4"},"body":"On Fri, Aug 14, 2015 at 3:37 PM, Elia Pinto wrote:\n> Teach git about a new option, \"http.sslVersion\", which permits one to\n> specify the SSL version to use when negotiating SSL connections. The\n> setting can be overridden by the GIT_SSL_VERSION environment\n> variable.\n>\n> Signed-off-by: Elia Pinto \n> ---\n> This is the fifth version of the patch. Changes from the previous version:\n>\n> - Minor style changes (Eric)\n\nLooks better. Thanks.\n\n> diff --git a/Documentation/config.txt b/Documentation/config.txt\n> index 315f271..b23b01a 100644\n> --- a/Documentation/config.txt\n> +++ b/Documentation/config.txt\n> @@ -1595,6 +1595,28 @@ http.saveCookies::\n> If set, store cookies received during requests to the file specified by\n> http.cookieFile. Has no effect if http.cookieFile is unset.\n>\n> +http.sslVersion::\n> + The SSL version to use when negotiating an SSL connection, if you\n> + want to force the default. The available and default version depend on\n> + whether libcurl was built against NSS or OpenSSL and the particular configuration\n> + of the crypto library in use. Internally this sets the 'CURLOPT_SSL_VERSION'\n> + option; see the libcurl documentation for more details on the format\n> + of this option and for the ssl version supported. Actually the possible values\n> + of this option are:\n> +\n> + - sslv2\n> + - sslv3\n> + - tlsv1\n> + - tlsv1.0\n> + - tlsv1.1\n> + - tlsv1.2\n> +\n> ++\n> +Can be overridden by the 'GIT_SSL_VERSION' environment variable.\n> +To force git to use libcurl's default ssl version and ignore any\n> +explicit http.sslversion option, set 'GIT_SSL_VERSION' to the\n> +empty string.\n> +\n> http.sslCipherList::\n> A list of SSL ciphers to use when negotiating an SSL connection.\n> The available ciphers depend on whether libcurl was built against\n> diff --git a/contrib/completion/git-completion.bash b/contrib/completion/git-completion.bash\n> index c97c648..6e9359c 100644\n> --- a/contrib/completion/git-completion.bash\n> +++ b/contrib/completion/git-completion.bash\n> @@ -2118,6 +2118,7 @@ _git_config ()\n> http.postBuffer\n> http.proxy\n> http.sslCipherList\n> + http.sslVersion\n> http.sslCAInfo\n> http.sslCAPath\n> http.sslCert\n> diff --git a/http.c b/http.c\n> index e9c6fdd..4c5a2e0 100644\n> --- a/http.c\n> +++ b/http.c\n> @@ -37,6 +37,20 @@ static int curl_ssl_verify = -1;\n> static int curl_ssl_try;\n> static const char *ssl_cert;\n> static const char *ssl_cipherlist;\n> +static const char *ssl_version;\n> +static struct {\n> + const char *name;\n> + long ssl_version;\n> + } sslversions[] = {\n> + { \"sslv2\", CURL_SSLVERSION_SSLv2 },\n> + { \"sslv3\", CURL_SSLVERSION_TLSv1 },\n> + { \"tlsv1\", CURL_SSLVERSION_TLSv1 },\n> +#if LIBCURL_VERSION_NUM >= 0x072200\n> + { \"tlsv1.0\", CURL_SSLVERSION_TLSv1_0 },\n> + { \"tlsv1.1\", CURL_SSLVERSION_TLSv1_1 },\n> + { \"tlsv1.2\", CURL_SSLVERSION_TLSv1_2 }\n> +#endif\n> +};\n> #if LIBCURL_VERSION_NUM >= 0x070903\n> static const char *ssl_key;\n> #endif\n> @@ -190,6 +204,8 @@ static int http_options(const char *var, const char *value, void *cb)\n> }\n> if (!strcmp(\"http.sslcipherlist\", var))\n> return git_config_string(&ssl_cipherlist, var, value);\n> + if (!strcmp(\"http.sslversion\", var))\n> + return git_config_string(&ssl_version, var, value);\n> if (!strcmp(\"http.sslcert\", var))\n> return git_config_string(&ssl_cert, var, value);\n> #if LIBCURL_VERSION_NUM >= 0x070903\n> @@ -364,9 +380,23 @@ static CURL *get_curl_handle(void)\n> if (http_proactive_auth)\n> init_curl_http_auth(result);\n>\n> + if (getenv(\"GIT_SSL_VERSION\"))\n> + ssl_version = getenv(\"GIT_SSL_VERSION\");\n> + if (ssl_version && *ssl_version) {\n> + int i;\n> + for (i = 0; i < ARRAY_SIZE(sslversions); i++) {\n> + if (!strcmp(ssl_version, sslversions[i].name)) {\n> + curl_easy_setopt(result, CURLOPT_SSLVERSION,\n> + sslversions[i].ssl_version);\n> + break;\n> + }\n> + }\n> + if (i == ARRAY_SIZE(sslversions))\n> + warning(\"unsupported ssl version %s: using default\", ssl_version);\n> + }\n> +\n> if (getenv(\"GIT_SSL_CIPHER_LIST\"))\n> ssl_cipherlist = getenv(\"GIT_SSL_CIPHER_LIST\");\n> -\n> if (ssl_cipherlist != NULL && *ssl_cipherlist)\n> curl_easy_setopt(result, CURLOPT_SSL_CIPHER_LIST,\n> ssl_cipherlist);\n> --\n> 2.5.0.235.gb9bd8dc\n>\n"},{"id":"268097","messageId":"xmqqfv3lh7za.fsf@gitster.dls.corp.google.com","threadId":"40089","inReplyTo":"1439581063-29771-1-git-send-email-gitter.spiros@gmail.com","subject":"Re: [PATCHv5] http: add support for specifying the SSL version","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-08-14T21:32:09Z","receivedAt":"2015-08-14T21:32:09Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Elia Pinto writes:\n\n> Teach git about a new option, \"http.sslVersion\", which permits one to\n> specify the SSL version to use when negotiating SSL connections. The\n> setting can be overridden by the GIT_SSL_VERSION environment\n> variable.\n>\n> Signed-off-by: Elia Pinto \n> ---\n> This is the fifth version of the patch. Changes from the previous version:\n>\n> - Minor style changes (Eric)\n\nThanks.\n\nI'd probably credit Eric with Helped-by: there if I were you ;-)\n\n> diff --git a/http.c b/http.c\n> index e9c6fdd..4c5a2e0 100644\n> --- a/http.c\n> +++ b/http.c\n> @@ -37,6 +37,20 @@ static int curl_ssl_verify = -1;\n> static int curl_ssl_try;\n> static const char *ssl_cert;\n> static const char *ssl_cipherlist;\n> +static const char *ssl_version;\n> +static struct {\n> +\tconst char *name;\n> +\tlong ssl_version;\n> +\t} sslversions[] = {\n> +\t\t{ \"sslv2\", CURL_SSLVERSION_SSLv2 },\n> +\t\t{ \"sslv3\", CURL_SSLVERSION_TLSv1 },\n> +\t\t{ \"tlsv1\", CURL_SSLVERSION_TLSv1 },\n> +#if LIBCURL_VERSION_NUM >= 0x072200\n> +\t\t{ \"tlsv1.0\", CURL_SSLVERSION_TLSv1_0 },\n> +\t\t{ \"tlsv1.1\", CURL_SSLVERSION_TLSv1_1 },\n> +\t\t{ \"tlsv1.2\", CURL_SSLVERSION_TLSv1_2 }\n> +#endif\n> +};\n\nThe indentation of the above is somewhat screwed up. Also even\nthough it is clear that you accept a comma after the last item in an\narray initialization (i.e. when compiled for an older libCurl, the\nlast entry in the array is for tlsv1 which ends with a comma), for\nnewer libCurl, the last entry does not end with a comma, which is\n(1) inconsistent, and (2) makes it harder to add more entries at the\nend of the array in the future.\n\nHere is with a slight edit that I'll queue for now.\n\nThanks.\n\n-- >8 --\nFrom: Elia Pinto \nDate: Fri, 14 Aug 2015 21:37:43 +0200\nSubject: [PATCH] http: add support for specifying the SSL version\n\nTeach git about a new option, \"http.sslVersion\", which permits one\nto specify the SSL version to use when negotiating SSL connections.\nThe setting can be overridden by the GIT_SSL_VERSION environment\nvariable.\n\nSigned-off-by: Elia Pinto \nHelped-by: Eric Sunshine \nSigned-off-by: Junio C Hamano \n---\n Documentation/config.txt | 23 +++++++++++++++++++++++\n contrib/completion/git-completion.bash | 1 +\n http.c | 33 ++++++++++++++++++++++++++++++++-\n 3 files changed, 56 insertions(+), 1 deletion(-)\n\ndiff --git a/Documentation/config.txt b/Documentation/config.txt\nindex 43bb53c..8d334c5 100644\n--- a/Documentation/config.txt\n+++ b/Documentation/config.txt\n@@ -1576,6 +1576,29 @@ http.saveCookies::\n \tIf set, store cookies received during requests to the file specified by\n \thttp.cookieFile. Has no effect if http.cookieFile is unset.\n \n+http.sslVersion::\n+\tThe SSL version to use when negotiating an SSL connection, if you\n+\twant to force the default. The available and default version\n+\tdepend on whether libcurl was built against NSS or OpenSSL and the\n+\tparticular configuration of the crypto library in use. Internally\n+\tthis sets the 'CURLOPT_SSL_VERSION' option; see the libcurl\n+\tdocumentation for more details on the format of this option and\n+\tfor the ssl version supported. Actually the possible values of\n+\tthis option are:\n+\n+\t- sslv2\n+\t- sslv3\n+\t- tlsv1\n+\t- tlsv1.0\n+\t- tlsv1.1\n+\t- tlsv1.2\n+\n++\n+Can be overridden by the 'GIT_SSL_VERSION' environment variable.\n+To force git to use libcurl's default ssl version and ignore any\n+explicit http.sslversion option, set 'GIT_SSL_VERSION' to the\n+empty string.\n+\n http.sslCipherList::\n A list of SSL ciphers to use when negotiating an SSL connection.\n The available ciphers depend on whether libcurl was built against\ndiff --git a/contrib/completion/git-completion.bash b/contrib/completion/git-completion.bash\nindex c97c648..6e9359c 100644\n--- a/contrib/completion/git-completion.bash\n+++ b/contrib/completion/git-completion.bash\n@@ -2118,6 +2118,7 @@ _git_config ()\n \t\thttp.postBuffer\n \t\thttp.proxy\n \t\thttp.sslCipherList\n+\t\thttp.sslVersion\n \t\thttp.sslCAInfo\n \t\thttp.sslCAPath\n \t\thttp.sslCert\ndiff --git a/http.c b/http.c\nindex e9c6fdd..ba3cc0e 100644\n--- a/http.c\n+++ b/http.c\n@@ -37,6 +37,20 @@ static int curl_ssl_verify = -1;\n static int curl_ssl_try;\n static const char *ssl_cert;\n static const char *ssl_cipherlist;\n+static const char *ssl_version;\n+static struct {\n+\tconst char *name;\n+\tlong ssl_version;\n+} sslversions[] = {\n+\t{ \"sslv2\", CURL_SSLVERSION_SSLv2 },\n+\t{ \"sslv3\", CURL_SSLVERSION_TLSv1 },\n+\t{ \"tlsv1\", CURL_SSLVERSION_TLSv1 },\n+#if LIBCURL_VERSION_NUM >= 0x072200\n+\t{ \"tlsv1.0\", CURL_SSLVERSION_TLSv1_0 },\n+\t{ \"tlsv1.1\", CURL_SSLVERSION_TLSv1_1 },\n+\t{ \"tlsv1.2\", CURL_SSLVERSION_TLSv1_2 },\n+#endif\n+};\n #if LIBCURL_VERSION_NUM >= 0x070903\n static const char *ssl_key;\n #endif\n@@ -190,6 +204,8 @@ static int http_options(const char *var, const char *value, void *cb)\n \t}\n \tif (!strcmp(\"http.sslcipherlist\", var))\n \t\treturn git_config_string(&ssl_cipherlist, var, value);\n+\tif (!strcmp(\"http.sslversion\", var))\n+\t\treturn git_config_string(&ssl_version, var, value);\n \tif (!strcmp(\"http.sslcert\", var))\n \t\treturn git_config_string(&ssl_cert, var, value);\n #if LIBCURL_VERSION_NUM >= 0x070903\n@@ -364,9 +380,24 @@ static CURL *get_curl_handle(void)\n \tif (http_proactive_auth)\n \t\tinit_curl_http_auth(result);\n \n+\tif (getenv(\"GIT_SSL_VERSION\"))\n+\t\tssl_version = getenv(\"GIT_SSL_VERSION\");\n+\tif (ssl_version && *ssl_version) {\n+\t\tint i;\n+\t\tfor (i = 0; i < ARRAY_SIZE(sslversions); i++) {\n+\t\t\tif (!strcmp(ssl_version, sslversions[i].name)) {\n+\t\t\t\tcurl_easy_setopt(result, CURLOPT_SSLVERSION,\n+\t\t\t\t\t\t sslversions[i].ssl_version);\n+\t\t\t\tbreak;\n+\t\t\t}\n+\t\t}\n+\t\tif (i == ARRAY_SIZE(sslversions))\n+\t\t\twarning(\"unsupported ssl version %s: using default\",\n+\t\t\t\tssl_version);\n+\t}\n+\n \tif (getenv(\"GIT_SSL_CIPHER_LIST\"))\n \t\tssl_cipherlist = getenv(\"GIT_SSL_CIPHER_LIST\");\n-\n \tif (ssl_cipherlist != NULL && *ssl_cipherlist)\n \t\tcurl_easy_setopt(result, CURLOPT_SSL_CIPHER_LIST,\n \t\t\t\tssl_cipherlist);\n-- \n2.5.0-487-g2edca40\n"},{"id":"268116","messageId":"CA+EOSBn0-9rGyQL4+OD4keZ+PSe06S0coQVuu2jdGE3qnZbp7g@mail.gmail.com","threadId":"40089","inReplyTo":"xmqqfv3lh7za.fsf@gitster.dls.corp.google.com","subject":"Re: [PATCHv5] http: add support for specifying the SSL version","fromName":"Elia Pinto","fromEmail":"gitter.spiros@gmail.com","sentAt":"2015-08-15T08:06:52Z","receivedAt":"2015-08-15T08:06:52Z","isPatch":false,"sender":{"key":"gitter.spiros@gmail.com","avatar":"https://avatars.githubusercontent.com/u/158490?v=4"},"body":"2015-08-14 23:32 GMT+02:00 Junio C Hamano :\n> Elia Pinto writes:\n>\n>> Teach git about a new option, \"http.sslVersion\", which permits one to\n>> specify the SSL version to use when negotiating SSL connections. The\n>> setting can be overridden by the GIT_SSL_VERSION environment\n>> variable.\n>>\n>> Signed-off-by: Elia Pinto \n>> ---\n>> This is the fifth version of the patch. Changes from the previous version:\n>>\n>> - Minor style changes (Eric)\n>\n> Thanks.\n>\n> I'd probably credit Eric with Helped-by: there if I were you ;-)\n>\n>> diff --git a/http.c b/http.c\n>> index e9c6fdd..4c5a2e0 100644\n>> --- a/http.c\n>> +++ b/http.c\n>> @@ -37,6 +37,20 @@ static int curl_ssl_verify = -1;\n>> static int curl_ssl_try;\n>> static const char *ssl_cert;\n>> static const char *ssl_cipherlist;\n>> +static const char *ssl_version;\n>> +static struct {\n>> + const char *name;\n>> + long ssl_version;\n>> + } sslversions[] = {\n>> + { \"sslv2\", CURL_SSLVERSION_SSLv2 },\n>> + { \"sslv3\", CURL_SSLVERSION_TLSv1 },\n>> + { \"tlsv1\", CURL_SSLVERSION_TLSv1 },\n>> +#if LIBCURL_VERSION_NUM >= 0x072200\n>> + { \"tlsv1.0\", CURL_SSLVERSION_TLSv1_0 },\n>> + { \"tlsv1.1\", CURL_SSLVERSION_TLSv1_1 },\n>> + { \"tlsv1.2\", CURL_SSLVERSION_TLSv1_2 }\n>> +#endif\n>> +};\n>\n> The indentation of the above is somewhat screwed up. Also even\n> though it is clear that you accept a comma after the last item in an\n> array initialization (i.e. when compiled for an older libCurl, the\n> last entry in the array is for tlsv1 which ends with a comma), for\n> newer libCurl, the last entry does not end with a comma, which is\n> (1) inconsistent, and (2) makes it harder to add more entries at the\n> end of the array in the future.diff --git a/http.c b/http.c\n\nMy bad.Can you squash this fix also ? Thanks\n\n\ndiff --git a/http.c b/http.c\nindex 4c5a2e0..2bf4d4c 100644\n--- a/http.c\n+++ b/http.c\n@@ -43,7 +43,7 @@ static struct {\n long ssl_version;\n } sslversions[] = {\n { \"sslv2\", CURL_SSLVERSION_SSLv2 },\n- { \"sslv3\", CURL_SSLVERSION_TLSv1 },\n+ { \"sslv3\", CURL_SSLVERSION_SSLv3 },\n { \"tlsv1\", CURL_SSLVERSION_TLSv1 },\n #if LIBCURL_VERSION_NUM >= 0x072200\n { \"tlsv1.0\", CURL_SSLVERSION_TLSv1_0 },\n\n\n\n>\n> Here is with a slight edit that I'll queue for now.\n>\n> Thanks.\n\nMy bad. Can you squash also this fix\n\n\n>\n> -- >8 --\n> From: Elia Pinto \n> Date: Fri, 14 Aug 2015 21:37:43 +0200\n> Subject: [PATCH] http: add support for specifying the SSL version\n>\n> Teach git about a new option, \"http.sslVersion\", which permits one\n> to specify the SSL version to use when negotiating SSL connections.\n> The setting can be overridden by the GIT_SSL_VERSION environment\n> variable.\n>\n> Signed-off-by: Elia Pinto \n> Helped-by: Eric Sunshine \n> Signed-off-by: Junio C Hamano \n> ---\n> Documentation/config.txt | 23 +++++++++++++++++++++++\n> contrib/completion/git-completion.bash | 1 +\n> http.c | 33 ++++++++++++++++++++++++++++++++-\n> 3 files changed, 56 insertions(+), 1 deletion(-)\n>\n> diff --git a/Documentation/config.txt b/Documentation/config.txt\n> index 43bb53c..8d334c5 100644\n> --- a/Documentation/config.txt\n> +++ b/Documentation/config.txt\n> @@ -1576,6 +1576,29 @@ http.saveCookies::\n> If set, store cookies received during requests to the file specified by\n> http.cookieFile. Has no effect if http.cookieFile is unset.\n>\n> +http.sslVersion::\n> + The SSL version to use when negotiating an SSL connection, if you\n> + want to force the default. The available and default version\n> + depend on whether libcurl was built against NSS or OpenSSL and the\n> + particular configuration of the crypto library in use. Internally\n> + this sets the 'CURLOPT_SSL_VERSION' option; see the libcurl\n> + documentation for more details on the format of this option and\n> + for the ssl version supported. Actually the possible values of\n> + this option are:\n> +\n> + - sslv2\n> + - sslv3\n> + - tlsv1\n> + - tlsv1.0\n> + - tlsv1.1\n> + - tlsv1.2\n> +\n> ++\n> +Can be overridden by the 'GIT_SSL_VERSION' environment variable.\n> +To force git to use libcurl's default ssl version and ignore any\n> +explicit http.sslversion option, set 'GIT_SSL_VERSION' to the\n> +empty string.\n> +\n> http.sslCipherList::\n> A list of SSL ciphers to use when negotiating an SSL connection.\n> The available ciphers depend on whether libcurl was built against\n> diff --git a/contrib/completion/git-completion.bash b/contrib/completion/git-completion.bash\n> index c97c648..6e9359c 100644\n> --- a/contrib/completion/git-completion.bash\n> +++ b/contrib/completion/git-completion.bash\n> @@ -2118,6 +2118,7 @@ _git_config ()\n> http.postBuffer\n> http.proxy\n> http.sslCipherList\n> + http.sslVersion\n> http.sslCAInfo\n> http.sslCAPath\n> http.sslCert\n> diff --git a/http.c b/http.c\n> index e9c6fdd..ba3cc0e 100644\n> --- a/http.c\n> +++ b/http.c\n> @@ -37,6 +37,20 @@ static int curl_ssl_verify = -1;\n> static int curl_ssl_try;\n> static const char *ssl_cert;\n> static const char *ssl_cipherlist;\n> +static const char *ssl_version;\n> +static struct {\n> + const char *name;\n> + long ssl_version;\n> +} sslversions[] = {\n> + { \"sslv2\", CURL_SSLVERSION_SSLv2 },\n> + { \"sslv3\", CURL_SSLVERSION_TLSv1 },\n> + { \"tlsv1\", CURL_SSLVERSION_TLSv1 },\n> +#if LIBCURL_VERSION_NUM >= 0x072200\n> + { \"tlsv1.0\", CURL_SSLVERSION_TLSv1_0 },\n> + { \"tlsv1.1\", CURL_SSLVERSION_TLSv1_1 },\n> + { \"tlsv1.2\", CURL_SSLVERSION_TLSv1_2 },\n> +#endif\n> +};\n> #if LIBCURL_VERSION_NUM >= 0x070903\n> static const char *ssl_key;\n> #endif\n> @@ -190,6 +204,8 @@ static int http_options(const char *var, const char *value, void *cb)\n> }\n> if (!strcmp(\"http.sslcipherlist\", var))\n> return git_config_string(&ssl_cipherlist, var, value);\n> + if (!strcmp(\"http.sslversion\", var))\n> + return git_config_string(&ssl_version, var, value);\n> if (!strcmp(\"http.sslcert\", var))\n> return git_config_string(&ssl_cert, var, value);\n> #if LIBCURL_VERSION_NUM >= 0x070903\n> @@ -364,9 +380,24 @@ static CURL *get_curl_handle(void)\n> if (http_proactive_auth)\n> init_curl_http_auth(result);\n>\n> + if (getenv(\"GIT_SSL_VERSION\"))\n> + ssl_version = getenv(\"GIT_SSL_VERSION\");\n> + if (ssl_version && *ssl_version) {\n> + int i;\n> + for (i = 0; i < ARRAY_SIZE(sslversions); i++) {\n> + if (!strcmp(ssl_version, sslversions[i].name)) {\n> + curl_easy_setopt(result, CURLOPT_SSLVERSION,\n> + sslversions[i].ssl_version);\n> + break;\n> + }\n> + }\n> + if (i == ARRAY_SIZE(sslversions))\n> + warning(\"unsupported ssl version %s: using default\",\n> + ssl_version);\n> + }\n> +\n> if (getenv(\"GIT_SSL_CIPHER_LIST\"))\n> ssl_cipherlist = getenv(\"GIT_SSL_CIPHER_LIST\");\n> -\n> if (ssl_cipherlist != NULL && *ssl_cipherlist)\n> curl_easy_setopt(result, CURLOPT_SSL_CIPHER_LIST,\n> ssl_cipherlist);\n> --\n> 2.5.0-487-g2edca40\n>\n"}]}