From: Junio C Hamano <gitster@pobox.com>
To: "Jorge Lopez Silva via GitGitGadget" <gitgitgadget@gmail.com>
Cc: git@vger.kernel.org, Jorge <JALopezSilva@gmail.com>
Subject: Re: [PATCH v2 1/2] http: add client cert for HTTPS proxies.
Date: Thu, 27 Feb 2020 10:31:48 -0800 [thread overview]
Message-ID: <xmqqftevg9uz.fsf@gitster-ct.c.googlers.com> (raw)
In-Reply-To: <a5d980e7501b1e0ab6f20a97136cd3a58427a139.1582759438.git.gitgitgadget@gmail.com> (Jorge Lopez Silva via GitGitGadget's message of "Wed, 26 Feb 2020 23:23:57 +0000")
"Jorge Lopez Silva via GitGitGadget" <gitgitgadget@gmail.com>
writes:
> +#if LIBCURL_VERSION_NUM >= 0x073400
> +static const char *http_proxy_ssl_cert;
> +static const char *http_proxy_ssl_key;
> +static const char *http_proxy_ssl_keypasswd;
> +#endif
> +static const char *http_proxy_ssl_ca_info;
> +
> static struct {
> const char *name;
> long curlauth_param;
> @@ -365,6 +373,20 @@ static int http_options(const char *var, const char *value, void *cb)
> if (!strcmp("http.proxyauthmethod", var))
> return git_config_string(&http_proxy_authmethod, var, value);
>
> +#if LIBCURL_VERSION_NUM >= 0x073400
> + if (!strcmp("http.proxycert", var))
> + return git_config_string(&http_proxy_ssl_cert, var, value);
> +
> + if (!strcmp("http.proxykey", var))
> + return git_config_string(&http_proxy_ssl_key, var, value);
> +
> + if (!strcmp("http.proxykeypass", var))
> + return git_config_string(&http_proxy_ssl_keypasswd, var, value);
> +
> + if (!strcmp("http.proxycainfo", var))
> + return git_config_string(&http_proxy_ssl_ca_info, var, value);
> +#endif
You may copy around your ~/.gitconfig to multiple hosts, some may
have newer and others may have older versions of libcurl, so it
would be OK for a version of Git built with older libcurl to at
least see and parse configurations meant for newer one, if only
to ignore and discard.
The only two effects these #if/#endif have are (1) they save a tiny
bit of memory, code and runtime cycle on an older platform and (2)
they make the resuting code ugly and harder to read. I do not think
that the tradeoff is worth it.
> if (!strcmp("http.cookiefile", var))
> return git_config_pathname(&curl_cookie_file, var, value);
> if (!strcmp("http.savecookies", var)) {
> @@ -924,8 +946,14 @@ static CURL *get_curl_handle(void)
> #if LIBCURL_VERSION_NUM >= 0x073400
> curl_easy_setopt(result, CURLOPT_PROXY_CAINFO, NULL);
> #endif
> - } else if (ssl_cainfo != NULL)
> - curl_easy_setopt(result, CURLOPT_CAINFO, ssl_cainfo);
> + } else if (ssl_cainfo != NULL || http_proxy_ssl_ca_info != NULL) {
> + if (ssl_cainfo != NULL)
> + curl_easy_setopt(result, CURLOPT_CAINFO, ssl_cainfo);
> +#if LIBCURL_VERSION_NUM >= 0x073400
> + if (http_proxy_ssl_ca_info != NULL)
> + curl_easy_setopt(result, CURLOPT_PROXY_CAINFO, http_proxy_ssl_ca_info);
> +#endif
> + }
On this codepath, unlike the config and variable definitions,
#if/#endif is absolutely necessary.
In any case, the code around here is messy, but it is mostly due to
the fact that the existing #if/#endif with if/elseif/... cascade was
messy. The general idea is
* We want to honor ssl_cainfo and http_proxy_ssl_ca_info, and use
CAINFO when set, but
* When http_schannel_use_ssl_cainfo is not in effect and
http_ssl_backend is schannel, ssl_cainfo/http_proxy_ssl_ca_info
business is completely skipped, and these two CAINFO are cleared
instead.
I do not know if the above is the best code structure to express
that, but at least the way this patch adds code is the least noisy,
I guess.
> @@ -1018,9 +1046,19 @@ static CURL *get_curl_handle(void)
> CURLOPT_PROXYTYPE, CURLPROXY_SOCKS4);
> #endif
> #if LIBCURL_VERSION_NUM >= 0x073400
> - else if (starts_with(curl_http_proxy, "https"))
> - curl_easy_setopt(result,
> - CURLOPT_PROXYTYPE, CURLPROXY_HTTPS);
> + else if (starts_with(curl_http_proxy, "https")) {
> + curl_easy_setopt(result, CURLOPT_PROXYTYPE, CURLPROXY_HTTPS);
> +
> + if (http_proxy_ssl_cert != NULL)
> + curl_easy_setopt(result, CURLOPT_PROXY_SSLCERT, http_proxy_ssl_cert);
> +
> + if (http_proxy_ssl_key != NULL)
> + curl_easy_setopt(result, CURLOPT_PROXY_SSLKEY, http_proxy_ssl_key);
> +
> + if (http_proxy_ssl_keypasswd != NULL)
> + curl_easy_setopt(result, CURLOPT_PROXY_KEYPASSWD, http_proxy_ssl_keypasswd);
This part is more or less straight-forward.
This is a minor tangent, but I see many "var != NULL" instances used
as the condition to if statements, which we tend to frown upon
(instead just say "if (var) ..."). I know there are already many in
the existing code in this file, but this patch is making it even
worse.
> + }
> #endif
> if (strstr(curl_http_proxy, "://"))
> credential_from_url(&proxy_auth, curl_http_proxy);
next prev parent reply other threads:[~2020-02-27 18:31 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-21 21:36 [PATCH 0/2] Add HTTPS proxy SSL options (cert, key, cainfo) Jorge via GitGitGadget
2020-02-21 21:36 ` [PATCH 1/2] http: add client cert for HTTPS proxies Jorge Lopez Silva via GitGitGadget
2020-02-21 22:28 ` Eric Sunshine
2020-02-26 21:05 ` Jorge A López Silva
2020-02-21 21:36 ` [PATCH 2/2] config: documentation for HTTPS proxy client cert Jorge Lopez Silva via GitGitGadget
2020-02-26 23:23 ` [PATCH v2 0/2] Add HTTPS proxy SSL options (cert, key, cainfo) Jorge via GitGitGadget
2020-02-26 23:23 ` [PATCH v2 1/2] http: add client cert for HTTPS proxies Jorge Lopez Silva via GitGitGadget
2020-02-27 18:31 ` Junio C Hamano [this message]
2020-03-03 1:41 ` Jorge A López Silva
2020-02-26 23:23 ` [PATCH v2 2/2] config: documentation for HTTPS proxy client cert Jorge Lopez Silva via GitGitGadget
2020-02-27 18:58 ` Junio C Hamano
2020-03-03 1:47 ` Jorge A López Silva
2020-03-04 18:40 ` [PATCH v3 0/2] Add HTTPS proxy SSL options (cert, key, cainfo) Jorge via GitGitGadget
2020-03-04 18:40 ` [PATCH v3 1/2] http: add client cert for HTTPS proxies Jorge Lopez Silva via GitGitGadget
2020-03-04 18:40 ` [PATCH v3 2/2] http: add environment variable for HTTPS proxy Jorge Lopez Silva via GitGitGadget
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=xmqqftevg9uz.fsf@gitster-ct.c.googlers.com \
--to=gitster@pobox.com \
--cc=JALopezSilva@gmail.com \
--cc=git@vger.kernel.org \
--cc=gitgitgadget@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).