# [PATCH] http: add support for specifying the SSL version 3 messages from 2015-08-12 to 2015-08-12. Participants: Elia Pinto, Remi Galan Alfonso. Thread: https://gitlist.dev/t/40068 ## Elia Pinto, 2015-08-12 13:00 Subject: [PATCH] http: add support for specifying the SSL version Message-ID: <1439384456-16335-1-git-send-email-gitter.spiros@gmail.com> URL: https://gitlist.dev/e/1439384456-16335-1-git-send-email-gitter.spiros%40gmail.com ``` Teach git about a new option, "http.sslVersion", which permits one to specify the SSL version to use when negotiating SSL connections. The setting can be overridden by the GIT_SSL_VERSION environment variable. Signed-off-by: Elia Pinto --- Documentation/config.txt | 21 +++++++++++++++++++++ contrib/completion/git-completion.bash | 1 + http.c | 31 +++++++++++++++++++++++++++++-- 3 files changed, 51 insertions(+), 2 deletions(-) diff --git a/Documentation/config.txt b/Documentation/config.txt index 315f271..76a4f2b 100644 --- a/Documentation/config.txt +++ b/Documentation/config.txt @@ -1595,6 +1595,27 @@ http.saveCookies:: If set, store cookies received during requests to the file specified by http.cookieFile. Has no effect if http.cookieFile is unset. +http.sslVersion:: + The SSL version to use when negotiating an SSL connection, if you + want to force the default. The available and default version depend on + whether libcurl was built against NSS or OpenSSL and the particular configuration + of the crypto library in use. Internally this sets the 'CURLOPT_SSL_VERSION' + option; see the libcurl documentation for more details on the format + of this option and for the ssl version supported. Actually the possible values + of this option are: + + - sslv2 + - sslv3 + - tlsv1 + - tlsv1.0 + - tlsv1.1 + - tlsv1.2 ++ +Can be overridden by the 'GIT_SSL_VERSION' environment variable. +To force git to use libcurl's default ssl version and ignore any +explicit http.sslversion option, set 'GIT_SSL_VERSION' to the +empty string. + http.sslCipherList:: A list of SSL ciphers to use when negotiating an SSL connection. The available ciphers depend on whether libcurl was built against diff --git a/contrib/completion/git-completion.bash b/contrib/completion/git-completion.bash index c97c648..6e9359c 100644 --- a/contrib/completion/git-completion.bash +++ b/contrib/completion/git-completion.bash @@ -2118,6 +2118,7 @@ _git_config () http.postBuffer http.proxy http.sslCipherList + http.sslVersion http.sslCAInfo http.sslCAPath http.sslCert diff --git a/http.c b/http.c index e9c6fdd..a7401b1 100644 --- a/http.c +++ b/http.c @@ -37,6 +37,8 @@ static int curl_ssl_verify = -1; static int curl_ssl_try; static const char *ssl_cert; static const char *ssl_cipherlist; +static const char *ssl_version; +static long sslversion = CURL_SSLVERSION_DEFAULT; #if LIBCURL_VERSION_NUM >= 0x070903 static const char *ssl_key; #endif @@ -190,6 +192,8 @@ static int http_options(const char *var, const char *value, void *cb) } if (!strcmp("http.sslcipherlist", var)) return git_config_string(&ssl_cipherlist, var, value); + if (!strcmp("http.sslversion", var)) + return git_config_string(&ssl_version, var, value); if (!strcmp("http.sslcert", var)) return git_config_string(&ssl_cert, var, value); #if LIBCURL_VERSION_NUM >= 0x070903 @@ -364,13 +368,36 @@ static CURL *get_curl_handle(void) if (http_proactive_auth) init_curl_http_auth(result); + + if (getenv("GIT_SSL_VERSION")) + ssl_version = getenv("GIT_SSL_VERSION"); + if (ssl_version != NULL && *ssl_version) { + if (!strcmp(ssl_version,"tlsv1")) { + sslversion = CURL_SSLVERSION_TLSv1; + } else if (!strcmp(ssl_version,"sslv2")) { + sslversion = CURL_SSLVERSION_SSLv2; + } else if (!strcmp(ssl_version,"sslv3")) { + sslversion = CURL_SSLVERSION_SSLv3; +#if LIBCURL_VERSION_NUM >= 0x072200 + } else if (!strcmp(ssl_version,"tlsv1.0")) { + sslversion = CURL_SSLVERSION_TLSv1_0; + } else if (!strcmp(ssl_version,"tlsv1.1")) { + sslversion = CURL_SSLVERSION_TLSv1_1; + } else if (!strcmp(ssl_version,"tlsv1.2")) { + sslversion = CURL_SSLVERSION_TLSv1_2; + } else { + warning("unsupported ssl version %s : using default", + ssl_version); +#endif + } + } + curl_easy_setopt(result, CURLOPT_SSLVERSION, + sslversion); if (getenv("GIT_SSL_CIPHER_LIST")) ssl_cipherlist = getenv("GIT_SSL_CIPHER_LIST"); - if (ssl_cipherlist != NULL && *ssl_cipherlist) curl_easy_setopt(result, CURLOPT_SSL_CIPHER_LIST, ssl_cipherlist); - if (ssl_cert != NULL) curl_easy_setopt(result, CURLOPT_SSLCERT, ssl_cert); if (has_cert_password()) -- 2.5.0.234.gefc8a62 ``` ## Remi Galan Alfonso, 2015-08-12 13:33 Subject: Re: [PATCH] http: add support for specifying the SSL version Message-ID: <950187984.739852.1439386399510.JavaMail.zimbra@ensimag.grenoble-inp.fr> URL: https://gitlist.dev/e/950187984.739852.1439386399510.JavaMail.zimbra%40ensimag.grenoble-inp.fr In-Reply-To: <1439384456-16335-1-git-send-email-gitter.spiros@gmail.com> ``` Hello, Elia Elia Pinto writes: > + if (ssl_version != NULL && *ssl_version) { > + if (!strcmp(ssl_version,"tlsv1")) { > + sslversion = CURL_SSLVERSION_TLSv1; > + } else if (!strcmp(ssl_version,"sslv2")) { > + sslversion = CURL_SSLVERSION_SSLv2; > + } else if (!strcmp(ssl_version,"sslv3")) { > + sslversion = CURL_SSLVERSION_SSLv3; > +#if LIBCURL_VERSION_NUM >= 0x072200 > + } else if (!strcmp(ssl_version,"tlsv1.0")) { > + sslversion = CURL_SSLVERSION_TLSv1_0; > + } else if (!strcmp(ssl_version,"tlsv1.1")) { > + sslversion = CURL_SSLVERSION_TLSv1_1; > + } else if (!strcmp(ssl_version,"tlsv1.2")) { > + sslversion = CURL_SSLVERSION_TLSv1_2; > + } else { > + warning("unsupported ssl version %s : using default", > + ssl_version); > +#endif > + } > + } I'm curious about what would happen should 'sslVersion' be set to 'tlsv1.0' (or a value that doesn't belong to the possible values) and 'LIBCURL_VERSION_NUM' be inferior to '0x072200'. Since we wouldn't go through any 'if' and would also skip the 'else' case, wouldn't we have a silent 'unsupported ssl version: using default' ? So I think that the 'else' case should be outside of the '#if [...] #endif'. Thanks, Rémi ``` ## Elia Pinto, 2015-08-12 14:10 Subject: Re: [PATCH] http: add support for specifying the SSL version Message-ID: URL: https://gitlist.dev/e/CA%2BEOSBn8xXHEXSwZ3sqcs8AaLQfDNw-5bSJSv-gwwGpaH4VW9w%40mail.gmail.com In-Reply-To: <950187984.739852.1439386399510.JavaMail.zimbra@ensimag.grenoble-inp.fr> ``` 2015-08-12 15:33 GMT+02:00 Remi Galan Alfonso : > Hello, Elia > > Elia Pinto writes: >> + if (ssl_version != NULL && *ssl_version) { >> + if (!strcmp(ssl_version,"tlsv1")) { >> + sslversion = CURL_SSLVERSION_TLSv1; >> + } else if (!strcmp(ssl_version,"sslv2")) { >> + sslversion = CURL_SSLVERSION_SSLv2; >> + } else if (!strcmp(ssl_version,"sslv3")) { >> + sslversion = CURL_SSLVERSION_SSLv3; >> +#if LIBCURL_VERSION_NUM >= 0x072200 >> + } else if (!strcmp(ssl_version,"tlsv1.0")) { >> + sslversion = CURL_SSLVERSION_TLSv1_0; >> + } else if (!strcmp(ssl_version,"tlsv1.1")) { >> + sslversion = CURL_SSLVERSION_TLSv1_1; >> + } else if (!strcmp(ssl_version,"tlsv1.2")) { >> + sslversion = CURL_SSLVERSION_TLSv1_2; >> + } else { >> + warning("unsupported ssl version %s : using default", >> + ssl_version); >> +#endif >> + } >> + } > > I'm curious about what would happen should 'sslVersion' be set to > 'tlsv1.0' (or a value that doesn't belong to the possible values) and > 'LIBCURL_VERSION_NUM' be inferior to '0x072200'. > Since we wouldn't go through any 'if' and would also skip the 'else' > case, wouldn't we have a silent 'unsupported ssl version: using > default' ? You are right. I will resend. Thank you very much > > So I think that the 'else' case should be outside of the '#if [...] > #endif'. > > Thanks, > Rémi ```