Commit b4dde78a776f3dca8eb21c9028ecd161291c78c0
2018-02-27T12:43:47
Merge pull request #4550 from libgit2/ethomson/winhttp winhttp: enable TLS 1.2
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68
diff --git a/deps/winhttp/winhttp.h b/deps/winhttp/winhttp.h
index dd1986a..b7fef1c 100644
--- a/deps/winhttp/winhttp.h
+++ b/deps/winhttp/winhttp.h
@@ -437,10 +437,12 @@ typedef int INTERNET_SCHEME, *LPINTERNET_SCHEME;
#define WINHTTP_CALLBACK_STATUS_FLAG_CERT_WRONG_USAGE 0x00000040
#define WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR 0x80000000
-#define WINHTTP_FLAG_SECURE_PROTOCOL_SSL2 0x00000008
-#define WINHTTP_FLAG_SECURE_PROTOCOL_SSL3 0x00000020
-#define WINHTTP_FLAG_SECURE_PROTOCOL_TLS1 0x00000080
-#define WINHTTP_FLAG_SECURE_PROTOCOL_ALL (WINHTTP_FLAG_SECURE_PROTOCOL_SSL2 | WINHTTP_FLAG_SECURE_PROTOCOL_SSL3 | WINHTTP_FLAG_SECURE_PROTOCOL_TLS1)
+#define WINHTTP_FLAG_SECURE_PROTOCOL_SSL2 0x00000008
+#define WINHTTP_FLAG_SECURE_PROTOCOL_SSL3 0x00000020
+#define WINHTTP_FLAG_SECURE_PROTOCOL_TLS1 0x00000080
+#define WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1 0x00000200
+#define WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2 0x00000800
+#define WINHTTP_FLAG_SECURE_PROTOCOL_ALL (WINHTTP_FLAG_SECURE_PROTOCOL_SSL2 | WINHTTP_FLAG_SECURE_PROTOCOL_SSL3 | WINHTTP_FLAG_SECURE_PROTOCOL_TLS1)
#define WINHTTP_AUTH_SCHEME_BASIC 0x00000001
#define WINHTTP_AUTH_SCHEME_NTLM 0x00000002
diff --git a/src/transports/winhttp.c b/src/transports/winhttp.c
index 46a8fcd..e52d54b 100644
--- a/src/transports/winhttp.c
+++ b/src/transports/winhttp.c
@@ -40,6 +40,14 @@
#define WINHTTP_IGNORE_REQUEST_TOTAL_LENGTH 0
#endif
+#ifndef WINHTTP_FLAG_SECURE_PROTOCOL_TLS_1_1
+# define WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1 0x00000200
+#endif
+
+#ifndef WINHTTP_FLAG_SECURE_PROTOCOL_TLS_1_2
+# define WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2 0x00000800
+#endif
+
static const char *prefix_https = "https://";
static const char *upload_pack_service = "upload-pack";
static const char *upload_pack_ls_service_url = "/info/refs?service=git-upload-pack";
@@ -744,6 +752,10 @@ static int winhttp_connect(
int error = -1;
int default_timeout = TIMEOUT_INFINITE;
int default_connect_timeout = DEFAULT_CONNECT_TIMEOUT;
+ DWORD protocols =
+ WINHTTP_FLAG_SECURE_PROTOCOL_TLS1 |
+ WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_1 |
+ WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2;
t->session = NULL;
t->connection = NULL;
@@ -786,6 +798,16 @@ static int winhttp_connect(
goto on_error;
}
+ /*
+ * Do a best-effort attempt to enable TLS 1.2 but allow this to
+ * fail; if TLS 1.2 support is not available for some reason,
+ * ignore the failure (it will keep the default protocols).
+ */
+ WinHttpSetOption(t->session,
+ WINHTTP_OPTION_SECURE_PROTOCOLS,
+ &protocols,
+ sizeof(protocols));
+
if (!WinHttpSetTimeouts(t->session, default_timeout, default_connect_timeout, default_timeout, default_timeout)) {
giterr_set(GITERR_OS, "failed to set timeouts for WinHTTP");
goto on_error;