Skip to content

Commit a109da2

Browse files
pascalmullerGit for Windows Build Agent
authored and
Git for Windows Build Agent
committed
http: optionally send SSL client certificate
This adds support for a new http.sslAutoClientCert config value. In cURL 7.77 or later the schannel backend does not automatically send client certificates from the Windows Certificate Store anymore. This config value is only used if http.sslBackend is set to "schannel", and can be used to opt in to the old behavior and force cURL to send client certificates. This fixes #3292 Signed-off-by: Pascal Muller <[email protected]>
1 parent 81f6e4f commit a109da2

File tree

3 files changed

+34
-3
lines changed

3 files changed

+34
-3
lines changed

Documentation/config/http.adoc

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,11 @@ http.schannelUseSSLCAInfo::
249249
when the `schannel` backend was configured via `http.sslBackend`,
250250
unless `http.schannelUseSSLCAInfo` overrides this behavior.
251251

252+
http.sslAutoClientCert::
253+
As of cURL v7.77.0, the Secure Channel backend won't automatically
254+
send client certificates from the Windows Certificate Store anymore.
255+
To opt in to the old behavior, http.sslAutoClientCert can be set.
256+
252257
http.pinnedPubkey::
253258
Public key of the https service. It may either be the filename of
254259
a PEM or DER encoded public key file or a string starting with

git-curl-compat.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,14 @@
3737
#define GIT_CURL_NEED_TRANSFER_ENCODING_HEADER
3838
#endif
3939

40+
/**
41+
* CURLSSLOPT_AUTO_CLIENT_CERT was added in 7.77.0, released in May
42+
* 2021.
43+
*/
44+
#if LIBCURL_VERSION_NUM >= 0x074d00
45+
#define GIT_CURL_HAVE_CURLSSLOPT_AUTO_CLIENT_CERT
46+
#endif
47+
4048
/**
4149
* CURLOPT_PROTOCOLS_STR and CURLOPT_REDIR_PROTOCOLS_STR were added in 7.85.0,
4250
* released in August 2022.

http.c

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,8 @@ static int http_schannel_check_revoke_mode =
161161
*/
162162
static int http_schannel_use_ssl_cainfo;
163163

164+
static int http_auto_client_cert;
165+
164166
static int always_auth_proactively(void)
165167
{
166168
return http_proactive_auth != PROACTIVE_AUTH_NONE &&
@@ -449,6 +451,11 @@ static int http_options(const char *var, const char *value,
449451
return 0;
450452
}
451453

454+
if (!strcmp("http.sslautoclientcert", var)) {
455+
http_auto_client_cert = git_config_bool(var, value);
456+
return 0;
457+
}
458+
452459
if (!strcmp("http.minsessions", var)) {
453460
min_curl_sessions = git_config_int(var, value, ctx->kvi);
454461
if (min_curl_sessions > 1)
@@ -1073,9 +1080,20 @@ static CURL *get_curl_handle(void)
10731080
}
10741081
#endif
10751082

1076-
if (http_ssl_backend && !strcmp("schannel", http_ssl_backend) &&
1077-
http_schannel_check_revoke_mode) {
1078-
curl_easy_setopt(result, CURLOPT_SSL_OPTIONS, http_schannel_check_revoke_mode);
1083+
if (http_ssl_backend && !strcmp("schannel", http_ssl_backend)) {
1084+
long ssl_options = 0;
1085+
if (http_schannel_check_revoke_mode) {
1086+
ssl_options |= http_schannel_check_revoke_mode;
1087+
}
1088+
1089+
if (http_auto_client_cert) {
1090+
#ifdef GIT_CURL_HAVE_CURLSSLOPT_AUTO_CLIENT_CERT
1091+
ssl_options |= CURLSSLOPT_AUTO_CLIENT_CERT;
1092+
#endif
1093+
}
1094+
1095+
if (ssl_options)
1096+
curl_easy_setopt(result, CURLOPT_SSL_OPTIONS, ssl_options);
10791097
}
10801098

10811099
if (http_proactive_auth != PROACTIVE_AUTH_NONE)

0 commit comments

Comments
 (0)