[PATCH 2/2] http.c: add http.sslCertNoPass option
From: Mark Lodato <hidden>
Date: 2016-06-15 22:46:52
Subsystem:
documentation, the rest · Maintainers:
Jonathan Corbet, Linus Torvalds
Add a configuration option, http.sslCertNoPass, and associated environment variable, GIT_SSL_CERT_NO_PASS, to allow disabling of the SSL client certificate password prompt from within git. If this option is set to true, or if the environment variable exists, git falls back to OpenSSL's prompts (as in earlier versions of git). This option is useful in (at least) two cases: 1. The certificate is not encrypted and the user does not want to be prompted needlessly. 2. The user does not wish to leave the password in the clear in git's (and libcurl's) memory, in case the program crashes and core dumps. The environment variable may only be used to disable, not to re-enable, git's password prompt. This behavior mimics GIT_NO_VERIFY; the mere existence of the variable is all that is checked. Signed-off-by: Mark Lodato <redacted> --- Documentation/config.txt | 9 +++++++++ http.c | 9 ++++++++- 2 files changed, 17 insertions(+), 1 deletions(-)
diff --git a/Documentation/config.txt b/Documentation/config.txt
index 2c03162..65c3ac5 100644
--- a/Documentation/config.txt
+++ b/Documentation/config.txt@@ -1038,6 +1038,15 @@ http.sslKey:: over HTTPS. Can be overridden by the 'GIT_SSL_KEY' environment variable. +http.sslCertNoPass:: + Disable git's password prompt for the SSL certificate. OpenSSL + will still prompt the user, possibly many times, if the + certificate or private key is encrypted. Useful if the + certificate is not encrypted (to disable the password prompt) or + if you do not wish to store the certificate password in git's + memory. Can be overridden by the 'GIT_SSL_CERT_NO_PASS' + environment variable. + http.sslCAInfo:: File containing the certificates to verify the peer with when fetching or pushing over HTTPS. Can be overridden by the
diff --git a/http.c b/http.c
index 1fc3444..6ae59b6 100644
--- a/http.c
+++ b/http.c@@ -131,6 +131,11 @@ static int http_options(const char *var, const char *value, void *cb) #endif if (!strcmp("http.sslcainfo", var)) return git_config_string(&ssl_cainfo, var, value); + if (!strcmp("http.sslcertnopass", var)) { + if (git_config_bool(var, value)) + ssl_cert_password_required = -1; + return 0; + } #ifdef USE_CURL_MULTI if (!strcmp("http.maxrequests", var)) { max_requests = git_config_int(var, value);
@@ -359,7 +364,9 @@ void http_init(struct remote *remote) if (remote && remote->url && remote->url[0]) { http_auth_init(remote->url[0]); - if (!prefixcmp(remote->url[0], "https://")) + if (ssl_cert_password_required == 0 && + !getenv("GIT_SSL_CERT_NO_PASS") && + !prefixcmp(remote->url[0], "https://")) ssl_cert_password_required = 1; }
--
1.6.3.1