[PATCH v2] http: add support for specifying an SSL cipher list
- From
Lars Kellogg-Stedman <lars@redhat.com>
- Date
- May 7, 2015, 16:08 UTC
- Message-ID
- <1431014932-19236-1-git-send-email-lars@redhat.com>
- In-Reply-To
- <xmqq8ud0s7sv.fsf@gitster.dls.corp.google.com>
Teach git about a new option, "http.sslCipherList", which permits one to specify a list of ciphers to use when negotiating SSL connections. The setting can be overwridden by the GIT_SSL_CIPHER_LIST environment variable.
Signed-off-by: Lars Kellogg-Stedman <lars@redhat.com> --- Documentation/config.txt | 8 ++++++++ http.c | 11 +++++++++++ 2 files changed, 19 insertions(+)
diff --git a/Documentation/config.txt b/Documentation/config.txt index 2e5ceaf..b0af723 100644 --- a/Documentation/config.txt +++ b/Documentation/config.txt @@ -1560,6 +1560,14 @@ http.saveCookies:: If set, store cookies received during requests to the file specified by http.cookieFile. Has no effect if http.cookieFile is unset. +http.sslCipherList:: + A list of SSL ciphers to use when negotiating an SSL connection. + The available ciphers depend on whether libcurl was built against + NSS or OpenSSL and the particular configuration of the crypto + library in use. Can be overwridden by the 'GIT_SSL_CIPHER_LIST' + environment variable. To force git to use libcurl's default cipher + list, set GIT_SSL_CIPHER_LIST to the empty string. + http.sslVerify:: Whether to verify the SSL certificate when fetching or pushing over HTTPS. Can be overridden by the 'GIT_SSL_NO_VERIFY' environment diff --git a/http.c b/http.c index 4b179f6..55adff1 100644 --- a/http.c +++ b/http.c @@ -36,6 +36,7 @@ char curl_errorstr[CURL_ERROR_SIZE]; static int curl_ssl_verify = -1; static int curl_ssl_try; static const char *ssl_cert; +static const char *ssl_cipherlist; #if LIBCURL_VERSION_NUM >= 0x070903 static const char *ssl_key; #endif @@ -187,6 +188,9 @@ static int http_options(const char *var, const char *value, void *cb) curl_ssl_verify = git_config_bool(var, value); return 0; } + if (!strcmp("http.sslcipherlist", var)) { + return git_config_string(&ssl_cipherlist, var, value); + } if (!strcmp("http.sslcert", var)) return git_config_string(&ssl_cert, var, value); #if LIBCURL_VERSION_NUM >= 0x070903 @@ -361,6 +365,13 @@ static CURL *get_curl_handle(void) if (http_proactive_auth) init_curl_http_auth(result); + if (getenv("GIT_SSL_CIPHER_LIST")) + ssl_cipherlist = getenv("GIT_SSL_CIPHER_LIST"); + + if (ssl_cipherlist != NULL && ssl_cipherlist[0] != '\0') + curl_easy_setopt(result, CURLOPT_SSL_CIPHER_LIST, + ssl_cipherlist); + if (ssl_cert != NULL) curl_easy_setopt(result, CURLOPT_SSLCERT, ssl_cert); if (has_cert_password())
-- 2.4.0