Commit 22317057a526e6edbbdd0370f9ab55a8d6c23bed
2017-03-21T00:36:32
https: Prevent OpenSSL from namespace-leaking
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89
diff --git a/src/global.h b/src/global.h
index b75ad6f..3c0559c 100644
--- a/src/global.h
+++ b/src/global.h
@@ -25,11 +25,6 @@ typedef struct {
git_thread *current_thread;
} git_global_st;
-#ifdef GIT_OPENSSL
-# include <openssl/ssl.h>
-extern SSL_CTX *git__ssl_ctx;
-#endif
-
git_global_st *git__global_state(void);
extern git_mutex git__mwindow_mutex;
diff --git a/src/settings.c b/src/settings.c
index ba2f6a4..99d8b9d 100644
--- a/src/settings.c
+++ b/src/settings.c
@@ -19,6 +19,7 @@
#include "odb.h"
#include "refs.h"
#include "transports/smart.h"
+#include "streams/openssl.h"
void git_libgit2_version(int *major, int *minor, int *rev)
{
@@ -172,11 +173,7 @@ int git_libgit2_opts(int key, ...)
{
const char *file = va_arg(ap, const char *);
const char *path = va_arg(ap, const char *);
- if (!SSL_CTX_load_verify_locations(git__ssl_ctx, file, path)) {
- giterr_set(GITERR_NET, "SSL error: %s",
- ERR_error_string(ERR_get_error(), NULL));
- error = -1;
- }
+ error = git_openssl__set_cert_location(file, path);
}
#else
giterr_set(GITERR_NET, "cannot set certificate locations: OpenSSL is not enabled");
diff --git a/src/streams/openssl.c b/src/streams/openssl.c
index 550b4e1..56164bf 100644
--- a/src/streams/openssl.c
+++ b/src/streams/openssl.c
@@ -628,6 +628,16 @@ out_err:
return error;
}
+int git_openssl__set_cert_location(const char *file, const char *path)
+{
+ if (SSL_CTX_load_verify_locations(git__ssl_ctx, file, path) == 0) {
+ giterr_set(GITERR_SSL, "OpenSSL error: failed to load certificates: %s",
+ ERR_error_string(ERR_get_error(), NULL));
+ return -1;
+ }
+ return 0;
+}
+
#else
#include "stream.h"
@@ -654,4 +664,13 @@ int git_openssl_stream_new(git_stream **out, const char *host, const char *port)
return -1;
}
+int git_openssl__set_cert_location(const char *file, const char *path)
+{
+ GIT_UNUSED(file);
+ GIT_UNUSED(path);
+
+ giterr_set(GITERR_SSL, "openssl is not supported in this version");
+ return -1;
+}
+
#endif
diff --git a/src/streams/openssl.h b/src/streams/openssl.h
index 202f567..2bbad7c 100644
--- a/src/streams/openssl.h
+++ b/src/streams/openssl.h
@@ -15,6 +15,8 @@ extern int git_openssl_stream_global_init(void);
extern int git_openssl_stream_new(git_stream **out, const char *host, const char *port);
+extern int git_openssl__set_cert_location(const char *file, const char *path);
+
/*
* OpenSSL 1.1 made BIO opaque so we have to use functions to interact with it
* which do not exist in previous versions. We define these inline functions so