2015-08-14 23:32 GMT+02:00 Junio C Hamano <[email protected]>:
> Elia Pinto <[email protected]> writes:
>
>> Teach git about a new option, "http.sslVersion", which permits one to
>> specify the SSL version to use when negotiating SSL connections. The
>> setting can be overridden by the GIT_SSL_VERSION environment
>> variable.
>>
>> Signed-off-by: Elia Pinto <[email protected]>
>> ---
>> This is the fifth version of the patch. Changes from the previous version:
>>
>> - Minor style changes (Eric)
>
> Thanks.
>
> I'd probably credit Eric with Helped-by: there if I were you ;-)
>
>> diff --git a/http.c b/http.c
>> index e9c6fdd..4c5a2e0 100644
>> --- a/http.c
>> +++ b/http.c
>> @@ -37,6 +37,20 @@ static int curl_ssl_verify = -1;
>> static int curl_ssl_try;
>> static const char *ssl_cert;
>> static const char *ssl_cipherlist;
>> +static const char *ssl_version;
>> +static struct {
>> + const char *name;
>> + long ssl_version;
>> + } sslversions[] = {
>> + { "sslv2", CURL_SSLVERSION_SSLv2 },
>> + { "sslv3", CURL_SSLVERSION_TLSv1 },
>> + { "tlsv1", CURL_SSLVERSION_TLSv1 },
>> +#if LIBCURL_VERSION_NUM >= 0x072200
>> + { "tlsv1.0", CURL_SSLVERSION_TLSv1_0 },
>> + { "tlsv1.1", CURL_SSLVERSION_TLSv1_1 },
>> + { "tlsv1.2", CURL_SSLVERSION_TLSv1_2 }
>> +#endif
>> +};
>
> The indentation of the above is somewhat screwed up. Also even
> though it is clear that you accept a comma after the last item in an
> array initialization (i.e. when compiled for an older libCurl, the
> last entry in the array is for tlsv1 which ends with a comma), for
> newer libCurl, the last entry does not end with a comma, which is
> (1) inconsistent, and (2) makes it harder to add more entries at the
> end of the array in the future.diff --git a/http.c b/http.c
My bad.Can you squash this fix also ? Thanks
diff --git a/http.c b/http.c
index 4c5a2e0..2bf4d4c 100644
--- a/http.c
+++ b/http.c
@@ -43,7 +43,7 @@ static struct {
long ssl_version;
} sslversions[] = {
{ "sslv2", CURL_SSLVERSION_SSLv2 },
- { "sslv3", CURL_SSLVERSION_TLSv1 },
+ { "sslv3", CURL_SSLVERSION_SSLv3 },
{ "tlsv1", CURL_SSLVERSION_TLSv1 },
#if LIBCURL_VERSION_NUM >= 0x072200
{ "tlsv1.0", CURL_SSLVERSION_TLSv1_0 },
>
> Here is with a slight edit that I'll queue for now.
>
> Thanks.
My bad. Can you squash also this fix
>
> -- >8 --
> From: Elia Pinto <[email protected]>
> Date: Fri, 14 Aug 2015 21:37:43 +0200
> Subject: [PATCH] http: add support for specifying the SSL version
>
> Teach git about a new option, "http.sslVersion", which permits one
> to specify the SSL version to use when negotiating SSL connections.
> The setting can be overridden by the GIT_SSL_VERSION environment
> variable.
>
> Signed-off-by: Elia Pinto <[email protected]>
> Helped-by: Eric Sunshine <[email protected]>
> Signed-off-by: Junio C Hamano <[email protected]>
> ---
> Documentation/config.txt | 23 +++++++++++++++++++++++
> contrib/completion/git-completion.bash | 1 +
> http.c | 33 ++++++++++++++++++++++++++++++++-
> 3 files changed, 56 insertions(+), 1 deletion(-)
>
> diff --git a/Documentation/config.txt b/Documentation/config.txt
> index 43bb53c..8d334c5 100644
> --- a/Documentation/config.txt
> +++ b/Documentation/config.txt
> @@ -1576,6 +1576,29 @@ http.saveCookies::
> If set, store cookies received during requests to the file specified
> by
> http.cookieFile. Has no effect if http.cookieFile is unset.
>
> +http.sslVersion::
> + The SSL version to use when negotiating an SSL connection, if you
> + want to force the default. The available and default version
> + depend on whether libcurl was built against NSS or OpenSSL and the
> + particular configuration of the crypto library in use. Internally
> + this sets the 'CURLOPT_SSL_VERSION' option; see the libcurl
> + documentation for more details on the format of this option and
> + for the ssl version supported. Actually the possible values of
> + this option are:
> +
> + - sslv2
> + - sslv3
> + - tlsv1
> + - tlsv1.0
> + - tlsv1.1
> + - tlsv1.2
> +
> ++
> +Can be overridden by the 'GIT_SSL_VERSION' environment variable.
> +To force git to use libcurl's default ssl version and ignore any
> +explicit http.sslversion option, set 'GIT_SSL_VERSION' to the
> +empty string.
> +
> http.sslCipherList::
> A list of SSL ciphers to use when negotiating an SSL connection.
> The available ciphers depend on whether libcurl was built against
> diff --git a/contrib/completion/git-completion.bash
> b/contrib/completion/git-completion.bash
> index c97c648..6e9359c 100644
> --- a/contrib/completion/git-completion.bash
> +++ b/contrib/completion/git-completion.bash
> @@ -2118,6 +2118,7 @@ _git_config ()
> http.postBuffer
> http.proxy
> http.sslCipherList
> + http.sslVersion
> http.sslCAInfo
> http.sslCAPath
> http.sslCert
> diff --git a/http.c b/http.c
> index e9c6fdd..ba3cc0e 100644
> --- a/http.c
> +++ b/http.c
> @@ -37,6 +37,20 @@ static int curl_ssl_verify = -1;
> static int curl_ssl_try;
> static const char *ssl_cert;
> static const char *ssl_cipherlist;
> +static const char *ssl_version;
> +static struct {
> + const char *name;
> + long ssl_version;
> +} sslversions[] = {
> + { "sslv2", CURL_SSLVERSION_SSLv2 },
> + { "sslv3", CURL_SSLVERSION_TLSv1 },
> + { "tlsv1", CURL_SSLVERSION_TLSv1 },
> +#if LIBCURL_VERSION_NUM >= 0x072200
> + { "tlsv1.0", CURL_SSLVERSION_TLSv1_0 },
> + { "tlsv1.1", CURL_SSLVERSION_TLSv1_1 },
> + { "tlsv1.2", CURL_SSLVERSION_TLSv1_2 },
> +#endif
> +};
> #if LIBCURL_VERSION_NUM >= 0x070903
> static const char *ssl_key;
> #endif
> @@ -190,6 +204,8 @@ static int http_options(const char *var, const char
> *value, void *cb)
> }
> if (!strcmp("http.sslcipherlist", var))
> return git_config_string(&ssl_cipherlist, var, value);
> + if (!strcmp("http.sslversion", var))
> + return git_config_string(&ssl_version, var, value);
> if (!strcmp("http.sslcert", var))
> return git_config_string(&ssl_cert, var, value);
> #if LIBCURL_VERSION_NUM >= 0x070903
> @@ -364,9 +380,24 @@ static CURL *get_curl_handle(void)
> if (http_proactive_auth)
> init_curl_http_auth(result);
>
> + if (getenv("GIT_SSL_VERSION"))
> + ssl_version = getenv("GIT_SSL_VERSION");
> + if (ssl_version && *ssl_version) {
> + int i;
> + for (i = 0; i < ARRAY_SIZE(sslversions); i++) {
> + if (!strcmp(ssl_version, sslversions[i].name)) {
> + curl_easy_setopt(result, CURLOPT_SSLVERSION,
> + sslversions[i].ssl_version);
> + break;
> + }
> + }
> + if (i == ARRAY_SIZE(sslversions))
> + warning("unsupported ssl version %s: using default",
> + ssl_version);
> + }
> +
> if (getenv("GIT_SSL_CIPHER_LIST"))
> ssl_cipherlist = getenv("GIT_SSL_CIPHER_LIST");
> -
> if (ssl_cipherlist != NULL && *ssl_cipherlist)
> curl_easy_setopt(result, CURLOPT_SSL_CIPHER_LIST,
> ssl_cipherlist);
> --
> 2.5.0-487-g2edca40
>
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
