git-for-windows/git
1
0
Fork 0
mirror of https://github.com/git-for-windows/git.git synced 2026-04-28 10:34:31 -05:00
Code Issues Packages Projects Releases 335 Wiki Activity

http: optionally send SSL client certificate

Browse Source 
This adds support for a new http.sslAutoClientCert config value.

In cURL 7.77 or later the schannel backend does not automatically send
client certificates from the Windows Certificate Store anymore.

This config value is only used if http.sslBackend is set to "schannel",
and can be used to opt in to the old behavior and force cURL to send
client certificates.

This fixes https://github.com/git-for-windows/git/issues/3292

Signed-off-by: Pascal Muller <pascalmuller@gmail.com>
This commit is contained in:
Pascal Muller
2021-06-23 21:21:10 +02:00
committed by Johannes Schindelin
parent 0ab9505c28
commit 278adc237e
3 changed files with 34 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
http.c
View File

@@ -162,6 +162,8 @@ static long http_schannel_check_revoke_mode =
*/
static int http_schannel_use_ssl_cainfo;
static int http_auto_client_cert;
static int always_auth_proactively(void)
{
return http_proactive_auth != PROACTIVE_AUTH_NONE &&
@@ -450,6 +452,11 @@ static int http_options(const char *var, const char *value,
return 0;
}
if (!strcmp("http.sslautoclientcert", var)) {
http_auto_client_cert = git_config_bool(var, value);
return 0;
}
if (!strcmp("http.minsessions", var)) {
min_curl_sessions = git_config_int(var, value, ctx->kvi);
if (min_curl_sessions > 1)
@@ -1074,9 +1081,20 @@ static CURL *get_curl_handle(void)
}
#endif
if (http_ssl_backend && !strcmp("schannel", http_ssl_backend) &&
http_schannel_check_revoke_mode) {
curl_easy_setopt(result, CURLOPT_SSL_OPTIONS, http_schannel_check_revoke_mode);
if (http_ssl_backend && !strcmp("schannel", http_ssl_backend)) {
long ssl_options = 0;
if (http_schannel_check_revoke_mode) {
ssl_options |= http_schannel_check_revoke_mode;
}
if (http_auto_client_cert) {
#ifdef GIT_CURL_HAVE_CURLSSLOPT_AUTO_CLIENT_CERT
ssl_options |= CURLSSLOPT_AUTO_CLIENT_CERT;
#endif
}
if (ssl_options)
curl_easy_setopt(result, CURLOPT_SSL_OPTIONS, ssl_options);
}
if (http_proactive_auth != PROACTIVE_AUTH_NONE)