@matheusbsbs / matheus-bagliano / commits / 93aef7c79b

http: add support for disabling SSL revocation checks in cURL

This adds support for a new http.schannelCheckRevoke config value. This config value is only used if http.sslBackend is set to "schannel", which forces cURL to use the Windows Certificate Store when validating server certificates associated with a remote server. This config value should only be set to "false" if you are in an environment where revocation checks are blocked by the network, with no alternative options. This is only supported in cURL 7.44 or later. Note: originally, we wanted to call the config setting `http.schannel.checkRevoke`. This, however, does not work: the `http.*` config settings can be limited to specific URLs via `http.<url>.*` (and this feature would mistake `schannel` for a URL). Helped by Agustín Martín Barbero. Signed-off-by: Brendan Forster <github@brendanforster.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Brendan Forster committed Oct 25, 2018 at 11:53 UTC 93aef7c79beb0bde12f2633423f8edd129eed019

2 files changed +25

Documentation/config.txt

@@ -2241,6 +2241,14 @@ http.sslBackend::

2241 This option is ignored if cURL lacks support for choosing the SSL

2242 backend at runtime.

2243

2244 +http.schannelCheckRevoke::

2245 + Used to enforce or disable certificate revocation checks in cURL

2246 + when http.sslBackend is set to "schannel". Defaults to `true` if

2247 + unset. Only necessary to disable this if Git consistently errors

2248 + and the message is about checking the revocation status of a

2249 + certificate. This option is ignored if cURL lacks support for

2250 + setting the relevant SSL option at runtime.

2251 +

2252 http.pinnedpubkey::

2253 Public key of the https service. It may either be the filename of

2254 a PEM or DER encoded public key file or a string starting with

http.c

+17

@@ -157,6 +157,8 @@ static char *cached_accept_language;

157

158 static char *http_ssl_backend;

159

160 +static int http_schannel_check_revoke = 1;

161 +

162 size_t fread_buffer(char *ptr, size_t eltsize, size_t nmemb, void *buffer_)

163 {

164 size_t size = eltsize * nmemb;

@@ -310,6 +312,11 @@ static int http_options(const char *var, const char *value, void *cb)

312 return 0;

313 }

314

315 + if (!strcmp("http.schannelcheckrevoke", var)) {

316 + http_schannel_check_revoke = git_config_bool(var, value);

317 + return 0;

318 + }

319 +

320 if (!strcmp("http.minsessions", var)) {

321 min_curl_sessions = git_config_int(var, value);

322 #ifndef USE_CURL_MULTI

@@ -811,6 +818,16 @@ static CURL *get_curl_handle(void)

818 }

819 #endif

820

821 + if (http_ssl_backend && !strcmp("schannel", http_ssl_backend) &&

822 + !http_schannel_check_revoke) {

823 +#if LIBCURL_VERSION_NUM >= 0x072c00

824 + curl_easy_setopt(result, CURLOPT_SSL_OPTIONS, CURLSSLOPT_NO_REVOKE);

825 +#else

826 + warning("CURLSSLOPT_NO_REVOKE not applied to curl SSL options because\n"

827 + "your curl version is too old (< 7.44.0)");

828 +#endif

829 + }

830 +

831 if (http_proactive_auth)

832 init_curl_http_auth(result);

833