Load SSL certificate according to git config

GVFS/GVFS.Common/FileSystem/PhysicalFileSystem.cs

@@ -64,6 +64,11 @@ public virtual string ReadAllText(string path)
             return File.ReadAllText(path);
         }
 
+        public virtual byte[] ReadAllBytes(string path)
+        {
+            return File.ReadAllBytes(path);
+        }
+
         public virtual IEnumerable<string> ReadLines(string path)
         {
             return File.ReadLines(path);

GVFS/GVFS.Common/GVFS.Common.csproj

@@ -28,4 +28,7 @@
     </PackageReference>
     <PackageReference Include="System.Security.Cryptography.Algorithms" Version="4.3.0" />
   </ItemGroup>
+  <ItemGroup>
+    <Folder Include="X509Certificates\" />
+  </ItemGroup>
 </Project>

GVFS/GVFS.Common/Git/GitAuthentication.cs

@@ -1,7 +1,10 @@
 using GVFS.Common.Http;
 using GVFS.Common.Tracing;
 using System;
+using System.Collections.Generic;
 using System.Net;
+using System.Net.Http;
+using System.Security.Cryptography.X509Certificates;
 using System.Text;
 
 namespace GVFS.Common.Git
@@ -25,6 +28,11 @@ public GitAuthentication(GitProcess git, string repoUrl)
         {
             this.git = git;
             this.repoUrl = repoUrl;
+
+            if (git.TryGetConfigUrlMatch("http", this.repoUrl, out Dictionary<string, GitConfigSetting> configSettings))
+            {
+                this.GitSsl = new GitSsl(configSettings);
+            }
         }
 
         public bool IsBackingOff
@@ -37,6 +45,8 @@ public bool IsBackingOff
 
         public bool IsAnonymous { get; private set; } = true;
 
+        private GitSsl GitSsl { get; }
+
         public void ConfirmCredentialsWorked(string usedCredential)
         {
             lock (this.gitAuthLock)
@@ -152,6 +162,25 @@ public bool TryInitializeAndRequireAuth(ITracer tracer, out string errorMessage)
             return false;
         }
 
+        public void ConfigureHttpClientHandlerSslIfNeeded(ITracer tracer, HttpClientHandler httpClientHandler, GitProcess gitProcess)
+        {
+            X509Certificate2 cert = this.GitSsl?.GetCertificate(tracer, gitProcess);
+            if (cert != null)
+            {
+                if (this.GitSsl != null && !this.GitSsl.ShouldVerify)
+                {
+                    httpClientHandler.ServerCertificateCustomValidationCallback =
+                        (httpRequestMessage, c, cetChain, policyErrors) =>
+                        {
+                            return true;
+                        };
+                }
+
+                httpClientHandler.ClientCertificateOptions = ClientCertificateOption.Manual;
+                httpClientHandler.ClientCertificates.Add(cert);
+            }
+        }
+
         private bool TryAnonymousQuery(ITracer tracer, Enlistment enlistment, out bool isAnonymous)
         {
             bool querySucceeded;

GVFS/GVFS.Common/Git/GitConfigHelper.cs

@@ -79,13 +79,14 @@ public static Dictionary<string, GitConfigSetting> GetSettings(string[] configLi
         ///     section.settingName=settingValue
         /// </summary>
         /// <param name="input">The lines of text with the settings to parse.</param>
+        /// <param name="delimiter">The delimiter char, separating key from value</param>
         /// <returns>A dictionary of settings, keyed off the setting name representing the settings parsed from input.</returns>
-        public static Dictionary<string, GitConfigSetting> ParseKeyValues(IEnumerable<string> input)
+        public static Dictionary<string, GitConfigSetting> ParseKeyValues(IEnumerable<string> input, char delimiter = '=')
         {
             Dictionary<string, GitConfigSetting> configSettings = new Dictionary<string, GitConfigSetting>(StringComparer.OrdinalIgnoreCase);
             foreach (string line in input)
             {
-                string[] fields = line.Trim().Split(new[] { '=' }, 2, StringSplitOptions.None);
+                string[] fields = line.Split(new[] { delimiter }, 2, StringSplitOptions.None);
 
                 if (fields.Length > 0)
                 {
@@ -128,10 +129,11 @@ public static Dictionary<string, GitConfigSetting> ParseKeyValues(IEnumerable<st
         ///     section.settingNameN=settingValueN
         /// </summary>
         /// <param name="input">The settings as text.</param>
+        /// <param name="delimiter">The delimiter char, separating key from value</param>
         /// <returns>A dictionary of settings, keyed off the setting name representing the settings parsed from input.</returns>
-        public static Dictionary<string, GitConfigSetting> ParseKeyValues(string input)
+        public static Dictionary<string, GitConfigSetting> ParseKeyValues(string input, char delimiter = '=')
         {
-            return ParseKeyValues(input.Split(new[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries));
+            return ParseKeyValues(input.Split(new[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries), delimiter);
         }
     }
 }

GVFS/GVFS.Common/Git/GitConfigSetting.cs

@@ -8,6 +8,10 @@ public class GitConfigSetting
         public const string CoreVirtualFileSystemName = "core.virtualfilesystem";
         public const string CredentialUseHttpPath = "credential.useHttpPath";
 
+        public const string HttpSslCert = "http.sslcert";
+        public const string HttpSslVerify = "http.sslverify";
+        public const string HttpSslCertPasswordProtected = "http.sslcertpasswordprotected";
+
         public GitConfigSetting(string name, params string[] values)
         {
             this.Name = name;

GVFS/GVFS.Common/Git/GitProcess.cs

@@ -164,6 +164,61 @@ public virtual void RevokeCredential(string repoUrl)
                 null);
         }
 
+        /// <summary>
+        /// Input for certificate credentials looks like
+        /// <code> protocol=cert
+        /// path=[http.sslCert value]
+        /// username =</code>
+        /// </summary>
+        public virtual bool TryGetCertificatePassword(
+            ITracer tracer,
+            string certificatePath,
+            out string password,
+            out string errorMessage)
+        {
+            password = null;
+            errorMessage = null;
+
+            using (ITracer activity = tracer.StartActivity("TryGetCertificatePassword", EventLevel.Informational))
+            {
+                Result gitCredentialOutput = this.InvokeGitAgainstDotGitFolder(
+                    "credential fill",
+                    stdin => stdin.Write("protocol=cert\npath=" + certificatePath + "\nusername=\n\n"),
+                    parseStdOutLine: null);
+
+                if (gitCredentialOutput.ExitCodeIsFailure)
+                {
+                    EventMetadata errorData = new EventMetadata();
+                    errorData.Add("CertificatePath", certificatePath);
+                    tracer.RelatedWarning(
+                        errorData,
+                        "Git could not get credentials: " + gitCredentialOutput.Errors,
+                        Keywords.Network | Keywords.Telemetry);
+                    errorMessage = gitCredentialOutput.Errors;
+
+                    return false;
+                }
+
+                password = ParseValue(gitCredentialOutput.Output, "password=");
+
+                bool success = password != null;
+
+                EventMetadata metadata = new EventMetadata
+                {
+                    { "Success", success },
+                    { "CertificatePath", certificatePath }
+                };
+
+                if (!success)
+                {
+                    metadata.Add("Output", gitCredentialOutput.Output);
+                }
+
+                activity.Stop(metadata);
+                return success;
+            }
+        }
+
         public virtual bool TryGetCredentials(
             ITracer tracer,
             string repoUrl,
@@ -259,6 +314,19 @@ public Result SetInFileConfig(string configFile, string settingName, string valu
                  value));
         }
 
+        public bool TryGetConfigUrlMatch(string section, string repositoryUrl, out Dictionary<string, GitConfigSetting> configSettings)
+        {
+            Result result = this.InvokeGitAgainstDotGitFolder($"config --get-urlmatch {section} {repositoryUrl}");
+            if (result.ExitCodeIsFailure)
+            {
+                configSettings = null;
+                return false;
+            }
+
+            configSettings = GitConfigHelper.ParseKeyValues(result.Output, ' ');
+            return true;
+        }
+
         public bool TryGetAllConfig(bool localOnly, out Dictionary<string, GitConfigSetting> configSettings)
         {
             configSettings = null;