@matheusbsbs / matheus-bagliano / commits / 21084e84a4

http: add support for selecting SSL backends at runtime

As of version 7.56.0, curl supports being compiled with multiple SSL backends. This patch adds the Git side of that feature: by setting http.sslBackend to "openssl" or "schannel", Git for Windows can now choose the SSL backend at runtime. This comes in handy on Windows because Secure Channel ("schannel") is the native solution, accessing the Windows Credential Store, thereby allowing for enterprise-wide management of certificates. For historical reasons, Git for Windows needs to support OpenSSL still, as it has previously been the only supported SSL backend in Git for Windows for almost a decade. The patch has been carried in Git for Windows for over a year, and is considered mature. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Johannes Schindelin committed Oct 15, 2018 at 03:14 UTC 21084e84a418e0a6c4da72f632c5cd99386bd64b

2 files changed +40

Documentation/config.txt

@@ -2236,6 +2236,11 @@ http.sslCAPath::

2236 with when fetching or pushing over HTTPS. Can be overridden

2237 by the `GIT_SSL_CAPATH` environment variable.

2238

2239 +http.sslBackend::

2240 + Name of the SSL backend to use (e.g. "openssl" or "schannel").

2241 + This option is ignored if cURL lacks support for choosing the SSL

2242 + backend at runtime.

2243 +

2244 http.pinnedpubkey::

2245 Public key of the https service. It may either be the filename of

2246 a PEM or DER encoded public key file or a string starting with

http.c

+35

@@ -155,6 +155,8 @@ static struct active_request_slot *active_queue_head;

155

156 static char *cached_accept_language;

157

158 +static char *http_ssl_backend;

159 +

160 size_t fread_buffer(char *ptr, size_t eltsize, size_t nmemb, void *buffer_)

161 {

162 size_t size = eltsize * nmemb;

@@ -302,6 +304,12 @@ static int http_options(const char *var, const char *value, void *cb)

304 curl_ssl_try = git_config_bool(var, value);

305 return 0;

306 }

307 + if (!strcmp("http.sslbackend", var)) {

308 + free(http_ssl_backend);

309 + http_ssl_backend = xstrdup_or_null(value);

310 + return 0;

311 + }

312 +

313 if (!strcmp("http.minsessions", var)) {

314 min_curl_sessions = git_config_int(var, value);

315 #ifndef USE_CURL_MULTI

@@ -995,6 +1003,33 @@ void http_init(struct remote *remote, const char *url, int proactive_auth)

1003 git_config(urlmatch_config_entry, &config);

1004 free(normalized_url);

1005

1006 +#if LIBCURL_VERSION_NUM >= 0x073800

1007 + if (http_ssl_backend) {

1008 + const curl_ssl_backend **backends;

1009 + struct strbuf buf = STRBUF_INIT;

1010 + int i;

1011 +

1012 + switch (curl_global_sslset(-1, http_ssl_backend, &backends)) {

1013 + case CURLSSLSET_UNKNOWN_BACKEND:

1014 + strbuf_addf(&buf, _("Unsupported SSL backend '%s'. "

1015 + "Supported SSL backends:"),

1016 + http_ssl_backend);

1017 + for (i = 0; backends[i]; i++)

1018 + strbuf_addf(&buf, "\n\t%s", backends[i]->name);

1019 + die("%s", buf.buf);

1020 + case CURLSSLSET_NO_BACKENDS:

1021 + die(_("Could not set SSL backend to '%s': "

1022 + "cURL was built without SSL backends"),

1023 + http_ssl_backend);

1024 + case CURLSSLSET_TOO_LATE:

1025 + die(_("Could not set SSL backend to '%s': already set"),

1026 + http_ssl_backend);

1027 + case CURLSSLSET_OK:

1028 + break; /* Okay! */

1029 + }

1030 + }

1031 +#endif

1032 +

1033 if (curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK)

1034 die("curl_global_init failed");

1035