[Feature] Set CURLSSLOPT_REVOKE_BEST_EFFORT (#3831)

* [Feature]
 Set CURLSSLOPT_REVOKE_BEST_EFFORT

* [Feature]
 Set CURLSSLOPT_REVOKE_BEST_EFFORT

* [Feature]
 Set CURLSSLOPT_REVOKE_BEST_EFFORT

* changed the naming of config, and changed comment, and changed unreferenced to void

* added a warning for the config and changed it to not be windows only

Author: kai-ion

src/aws-cpp-sdk-core/include/aws/core/client/ClientConfiguration.h

@@ -488,6 +488,17 @@ namespace Aws
               bool useAnonymousAuth = false;
             } winHTTPOptions;
 
+            /**
+             * Configuration that is specifically used for the curl http client
+             */
+            struct CurlOptions {
+              /**
+               * If set to true, SSL connections will use best-effort revocation checking,
+               * proceeding even when CRL servers are unreachable. Off by default.
+               */
+              bool revokeBestEffort = false;
+            } curlOptions;
+
           /**
             * The AWS account ID. Used for account-based endpoint routing. An AWS account ID has a format like 111122223333.
             * Account-based endpoint routing provides better request performance for some services.

src/aws-cpp-sdk-core/include/aws/core/http/curl/CurlHttpClient.h

@@ -65,6 +65,7 @@ class AWS_CORE_API CurlHttpClient: public HttpClient
     unsigned m_proxyPort = 0;
     Aws::String m_nonProxyHosts;
     bool m_verifySSL = true;
+    bool m_revokeBestEffort = false;
     Aws::String m_caPath;
     Aws::String m_caFile;
     Aws::String m_proxyCaPath;

src/aws-cpp-sdk-core/source/http/curl/CurlHttpClient.cpp

@@ -608,7 +608,7 @@ CurlHttpClient::CurlHttpClient(const ClientConfiguration& clientConfig) :
     m_proxySSLCertPath(clientConfig.proxySSLCertPath), m_proxySSLCertType(clientConfig.proxySSLCertType),
     m_proxySSLKeyPath(clientConfig.proxySSLKeyPath), m_proxySSLKeyType(clientConfig.proxySSLKeyType),
     m_proxyKeyPasswd(clientConfig.proxySSLKeyPassword),
-    m_proxyPort(clientConfig.proxyPort), m_verifySSL(clientConfig.verifySSL), m_caPath(clientConfig.caPath),
+    m_proxyPort(clientConfig.proxyPort), m_verifySSL(clientConfig.verifySSL), m_revokeBestEffort(clientConfig.curlOptions.revokeBestEffort), m_caPath(clientConfig.caPath),
     m_caFile(clientConfig.caFile), m_proxyCaPath(clientConfig.proxyCaPath), m_proxyCaFile(clientConfig.proxyCaFile),
     m_disableExpectHeader(clientConfig.disableExpectHeader),
     m_enableHttpClientTrace(clientConfig.enableHttpClientTrace || FORCE_ENABLE_CURL_LOGGING),
@@ -744,6 +744,19 @@ std::shared_ptr<HttpResponse> CurlHttpClient::MakeRequest(const std::shared_ptr<
 #else
             curl_easy_setopt(connectionHandle, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
 #endif
+
+#if LIBCURL_VERSION_NUM >= 0x074600 // 7.70.0
+            if (m_revokeBestEffort)
+            {
+                curl_easy_setopt(connectionHandle, CURLOPT_SSL_OPTIONS, CURLSSLOPT_REVOKE_BEST_EFFORT);
+            }
+#else
+            if (m_revokeBestEffort)
+            {
+                AWS_LOGSTREAM_WARN(CURL_HTTP_CLIENT_TAG,
+                    "curlOptions.revokeBestEffort requires libcurl >= 7.70.0");
+            }
+#endif
         }
         else
         {