test-https.t
639 lines
| 33.0 KiB
| text/troff
|
Tads3Lexer
/ tests / test-https.t
|
r22046 | #require serve ssl | ||
|
r12740 | |||
|
r22046 | Proper https client requires the built-in ssl from Python 2.6. | ||
|
r12740 | |||
|
r29331 | Make server certificates: | ||
|
r12741 | |||
|
r29331 | $ CERTSDIR="$TESTDIR/sslcerts" | ||
$ cat "$CERTSDIR/priv.pem" "$CERTSDIR/pub.pem" >> server.pem | ||||
$ PRIV=`pwd`/server.pem | ||||
$ cat "$CERTSDIR/priv.pem" "$CERTSDIR/pub-not-yet.pem" > server-not-yet.pem | ||||
$ cat "$CERTSDIR/priv.pem" "$CERTSDIR/pub-expired.pem" > server-expired.pem | ||||
|
r25413 | |||
|
r12740 | $ hg init test | ||
$ cd test | ||||
$ echo foo>foo | ||||
$ mkdir foo.d foo.d/bAr.hg.d foo.d/baR.d.hg | ||||
$ echo foo>foo.d/foo | ||||
$ echo bar>foo.d/bAr.hg.d/BaR | ||||
$ echo bar>foo.d/baR.d.hg/bAR | ||||
$ hg commit -A -m 1 | ||||
adding foo | ||||
adding foo.d/bAr.hg.d/BaR | ||||
adding foo.d/baR.d.hg/bAR | ||||
adding foo.d/foo | ||||
$ hg serve -p $HGPORT -d --pid-file=../hg0.pid --certificate=$PRIV | ||||
$ cat ../hg0.pid >> $DAEMON_PIDS | ||||
|
r13544 | cacert not found | ||
$ hg in --config web.cacerts=no-such.pem https://localhost:$HGPORT/ | ||||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r13544 | abort: could not find web.cacerts: no-such.pem | ||
[255] | ||||
|
r12740 | Test server address cannot be reused | ||
|
r17023 | #if windows | ||
$ hg serve -p $HGPORT --certificate=$PRIV 2>&1 | ||||
|
r18682 | abort: cannot start server at ':$HGPORT': | ||
|
r17023 | [255] | ||
#else | ||||
|
r12740 | $ hg serve -p $HGPORT --certificate=$PRIV 2>&1 | ||
abort: cannot start server at ':$HGPORT': Address already in use | ||||
[255] | ||||
|
r17023 | #endif | ||
|
r12740 | $ cd .. | ||
|
r29288 | Our test cert is not signed by a trusted CA. It should fail to verify if | ||
we are able to load CA certs. | ||||
|
r22575 | |||
|
r29481 | #if sslcontext defaultcacerts no-defaultcacertsloaded | ||
|
r22575 | $ hg clone https://localhost:$HGPORT/ copy-pull | ||
|
r29449 | (an attempt was made to load CA certificates but none were loaded; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error) | ||
|
r23823 | abort: error: *certificate verify failed* (glob) | ||
|
r22575 | [255] | ||
|
r29481 | #endif | ||
#if no-sslcontext defaultcacerts | ||||
$ hg clone https://localhost:$HGPORT/ copy-pull | ||||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29500 | (using CA certificates from *; if you see this message, your Mercurial install is not properly configured; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) (glob) (?) | ||
|
r29481 | abort: error: *certificate verify failed* (glob) | ||
[255] | ||||
#endif | ||||
|
r29489 | #if no-sslcontext windows | ||
$ hg clone https://localhost:$HGPORT/ copy-pull | ||||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info | ||
|
r29489 | (unable to load Windows CA certificates; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) | ||
abort: error: *certificate verify failed* (glob) | ||||
[255] | ||||
#endif | ||||
|
r29499 | #if no-sslcontext osx | ||
$ hg clone https://localhost:$HGPORT/ copy-pull | ||||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info | ||
|
r29499 | (unable to load CA certificates; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) | ||
abort: localhost certificate error: no certificate received | ||||
|
r29526 | (set hostsecurity.localhost:certfingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e config setting or use --insecure to connect insecurely) | ||
|
r29499 | [255] | ||
#endif | ||||
|
r29481 | #if defaultcacertsloaded | ||
$ hg clone https://localhost:$HGPORT/ copy-pull | ||||
|
r29601 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29500 | (using CA certificates from *; if you see this message, your Mercurial install is not properly configured; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) (glob) (?) | ||
|
r29481 | abort: error: *certificate verify failed* (glob) | ||
[255] | ||||
#endif | ||||
#if no-defaultcacerts | ||||
|
r29448 | $ hg clone https://localhost:$HGPORT/ copy-pull | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29499 | (unable to load * certificates; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) (glob) (?) | ||
|
r29448 | abort: localhost certificate error: no certificate received | ||
|
r29526 | (set hostsecurity.localhost:certfingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e config setting or use --insecure to connect insecurely) | ||
|
r29448 | [255] | ||
|
r29288 | #endif | ||
|
r22575 | |||
|
r29334 | Specifying a per-host certificate file that doesn't exist will abort | ||
$ hg --config hostsecurity.localhost:verifycertsfile=/does/not/exist clone https://localhost:$HGPORT/ | ||||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29334 | abort: path specified by hostsecurity.localhost:verifycertsfile does not exist: /does/not/exist | ||
[255] | ||||
A malformed per-host certificate file will raise an error | ||||
$ echo baddata > badca.pem | ||||
|
r29446 | #if sslcontext | ||
$ hg --config hostsecurity.localhost:verifycertsfile=badca.pem clone https://localhost:$HGPORT/ | ||||
|
r29601 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29446 | abort: error loading CA file badca.pem: * (glob) | ||
(file is empty or malformed?) | ||||
[255] | ||||
#else | ||||
|
r29334 | $ hg --config hostsecurity.localhost:verifycertsfile=badca.pem clone https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29356 | abort: error: * (glob) | ||
|
r29334 | [255] | ||
|
r29446 | #endif | ||
|
r29334 | |||
A per-host certificate mismatching the server will fail verification | ||||
|
r29449 | (modern ssl is able to discern whether the loaded cert is a CA cert) | ||
#if sslcontext | ||||
$ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/client-cert.pem" clone https://localhost:$HGPORT/ | ||||
|
r29601 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29449 | (an attempt was made to load CA certificates but none were loaded; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error) | ||
abort: error: *certificate verify failed* (glob) | ||||
[255] | ||||
#else | ||||
|
r29334 | $ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/client-cert.pem" clone https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29334 | abort: error: *certificate verify failed* (glob) | ||
[255] | ||||
|
r29449 | #endif | ||
|
r29334 | |||
A per-host certificate matching the server's cert will be accepted | ||||
$ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/pub.pem" clone -U https://localhost:$HGPORT/ perhostgood1 | ||||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29334 | requesting all changes | ||
adding changesets | ||||
adding manifests | ||||
adding file changes | ||||
added 1 changesets with 4 changes to 4 files | ||||
A per-host certificate with multiple certs and one matching will be accepted | ||||
$ cat "$CERTSDIR/client-cert.pem" "$CERTSDIR/pub.pem" > perhost.pem | ||||
$ hg --config hostsecurity.localhost:verifycertsfile=perhost.pem clone -U https://localhost:$HGPORT/ perhostgood2 | ||||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29334 | requesting all changes | ||
adding changesets | ||||
adding manifests | ||||
adding file changes | ||||
added 1 changesets with 4 changes to 4 files | ||||
Defining both per-host certificate and a fingerprint will print a warning | ||||
|
r29526 | $ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/pub.pem" --config hostsecurity.localhost:fingerprints=sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 clone -U https://localhost:$HGPORT/ caandfingerwarning | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29334 | (hostsecurity.localhost:verifycertsfile ignored when host fingerprints defined; using host fingerprints for verification) | ||
requesting all changes | ||||
adding changesets | ||||
adding manifests | ||||
adding file changes | ||||
added 1 changesets with 4 changes to 4 files | ||||
|
r29288 | $ DISABLECACERTS="--config devel.disableloaddefaultcerts=true" | ||
|
r22575 | |||
|
r29411 | Inability to verify peer certificate will result in abort | ||
|
r12740 | |||
|
r29288 | $ hg clone https://localhost:$HGPORT/ copy-pull $DISABLECACERTS | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29411 | abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect | ||
|
r29526 | (see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server) | ||
|
r29411 | [255] | ||
$ hg clone --insecure https://localhost:$HGPORT/ copy-pull | ||||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29411 | warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering | ||
|
r12740 | requesting all changes | ||
adding changesets | ||||
adding manifests | ||||
adding file changes | ||||
added 1 changesets with 4 changes to 4 files | ||||
updating to branch default | ||||
4 files updated, 0 files merged, 0 files removed, 0 files unresolved | ||||
$ hg verify -R copy-pull | ||||
checking changesets | ||||
checking manifests | ||||
crosschecking files in changesets and manifests | ||||
checking files | ||||
4 files, 1 changesets, 4 total revisions | ||||
$ cd test | ||||
$ echo bar > bar | ||||
$ hg commit -A -d '1 0' -m 2 | ||||
adding bar | ||||
$ cd .. | ||||
|
r13192 | pull without cacert | ||
|
r12740 | |||
$ cd copy-pull | ||||
|
r30234 | $ cat >> .hg/hgrc <<EOF | ||
> [hooks] | ||||
> changegroup = sh -c "printenv.py changegroup" | ||||
> EOF | ||||
|
r29288 | $ hg pull $DISABLECACERTS | ||
|
r24138 | pulling from https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29411 | abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect | ||
|
r29526 | (see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server) | ||
|
r29411 | [255] | ||
$ hg pull --insecure | ||||
pulling from https://localhost:$HGPORT/ | ||||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29411 | warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering | ||
|
r12740 | searching for changes | ||
adding changesets | ||||
adding manifests | ||||
adding file changes | ||||
added 1 changesets with 1 changes to 1 files | ||||
|
r27739 | changegroup hook: HG_NODE=5fed3813f7f5e1824344fdc9cf8f63bb662c292d HG_NODE_LAST=5fed3813f7f5e1824344fdc9cf8f63bb662c292d HG_SOURCE=pull HG_TXNID=TXN:* HG_URL=https://localhost:$HGPORT/ (glob) | ||
|
r12740 | (run 'hg update' to get a working copy) | ||
$ cd .. | ||||
|
r12741 | |||
|
r13192 | cacert configured in local repo | ||
|
r12741 | |||
|
r13192 | $ cp copy-pull/.hg/hgrc copy-pull/.hg/hgrc.bu | ||
$ echo "[web]" >> copy-pull/.hg/hgrc | ||||
|
r29331 | $ echo "cacerts=$CERTSDIR/pub.pem" >> copy-pull/.hg/hgrc | ||
|
r29842 | $ hg -R copy-pull pull | ||
|
r12741 | pulling from https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r12741 | searching for changes | ||
no changes found | ||||
|
r13192 | $ mv copy-pull/.hg/hgrc.bu copy-pull/.hg/hgrc | ||
|
r13231 | cacert configured globally, also testing expansion of environment | ||
variables in the filename | ||||
|
r13192 | |||
$ echo "[web]" >> $HGRCPATH | ||||
|
r13231 | $ echo 'cacerts=$P/pub.pem' >> $HGRCPATH | ||
|
r29331 | $ P="$CERTSDIR" hg -R copy-pull pull | ||
|
r13192 | pulling from https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r13192 | searching for changes | ||
no changes found | ||||
|
r29331 | $ P="$CERTSDIR" hg -R copy-pull pull --insecure | ||
|
r24138 | pulling from https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29289 | warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering | ||
|
r13328 | searching for changes | ||
no changes found | ||||
|
r13192 | |||
|
r29445 | empty cacert file | ||
$ touch emptycafile | ||||
|
r29446 | |||
#if sslcontext | ||||
$ hg --config web.cacerts=emptycafile -R copy-pull pull | ||||
pulling from https://localhost:$HGPORT/ | ||||
|
r29601 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29446 | abort: error loading CA file emptycafile: * (glob) | ||
(file is empty or malformed?) | ||||
[255] | ||||
#else | ||||
|
r29445 | $ hg --config web.cacerts=emptycafile -R copy-pull pull | ||
pulling from https://localhost:$HGPORT/ | ||||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29445 | abort: error: * (glob) | ||
[255] | ||||
|
r29446 | #endif | ||
|
r29445 | |||
|
r13192 | cacert mismatch | ||
|
r29331 | $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub.pem" \ | ||
|
r31008 | > https://$LOCALIP:$HGPORT/ | ||
pulling from https://*:$HGPORT/ (glob) | ||||
warning: connecting to $LOCALIP using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||||
abort: $LOCALIP certificate error: certificate is for localhost | ||||
(set hostsecurity.$LOCALIP:certfingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e config setting or use --insecure to connect insecurely) | ||||
|
r12741 | [255] | ||
|
r29331 | $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub.pem" \ | ||
|
r31008 | > https://$LOCALIP:$HGPORT/ --insecure | ||
pulling from https://*:$HGPORT/ (glob) | ||||
warning: connecting to $LOCALIP using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||||
warning: connection security to $LOCALIP is disabled per current settings; communication is susceptible to eavesdropping and tampering | ||||
|
r13328 | searching for changes | ||
no changes found | ||||
|
r29331 | $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-other.pem" | ||
|
r24138 | pulling from https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r23823 | abort: error: *certificate verify failed* (glob) | ||
|
r12741 | [255] | ||
|
r29331 | $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-other.pem" \ | ||
> --insecure | ||||
|
r24138 | pulling from https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29289 | warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering | ||
|
r13328 | searching for changes | ||
no changes found | ||||
|
r12741 | |||
Test server cert which isn't valid yet | ||||
|
r28549 | $ hg serve -R test -p $HGPORT1 -d --pid-file=hg1.pid --certificate=server-not-yet.pem | ||
|
r12741 | $ cat hg1.pid >> $DAEMON_PIDS | ||
|
r29331 | $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-not-yet.pem" \ | ||
> https://localhost:$HGPORT1/ | ||||
|
r24138 | pulling from https://localhost:$HGPORT1/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r23823 | abort: error: *certificate verify failed* (glob) | ||
|
r12741 | [255] | ||
Test server cert which no longer is valid | ||||
|
r28549 | $ hg serve -R test -p $HGPORT2 -d --pid-file=hg2.pid --certificate=server-expired.pem | ||
|
r12741 | $ cat hg2.pid >> $DAEMON_PIDS | ||
|
r29331 | $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-expired.pem" \ | ||
> https://localhost:$HGPORT2/ | ||||
|
r24138 | pulling from https://localhost:$HGPORT2/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r23823 | abort: error: *certificate verify failed* (glob) | ||
|
r12741 | [255] | ||
|
r13314 | |||
|
r29561 | Disabling the TLS 1.0 warning works | ||
$ hg -R copy-pull id https://localhost:$HGPORT/ \ | ||||
> --config hostsecurity.localhost:fingerprints=sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 \ | ||||
> --config hostsecurity.disabletls10warning=true | ||||
5fed3813f7f5 | ||||
|
r29577 | #if no-sslcontext no-py27+ | ||
Setting ciphers doesn't work in Python 2.6 | ||||
$ P="$CERTSDIR" hg --config hostsecurity.ciphers=HIGH -R copy-pull id https://localhost:$HGPORT/ | ||||
warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info | ||||
abort: setting ciphers in [hostsecurity] is not supported by this version of Python | ||||
(remove the config option or run Mercurial with a modern Python version (preferred)) | ||||
[255] | ||||
#endif | ||||
Setting ciphers works in Python 2.7+ but the error message is different on | ||||
legacy ssl. We test legacy once and do more feature checking on modern | ||||
configs. | ||||
#if py27+ no-sslcontext | ||||
$ P="$CERTSDIR" hg --config hostsecurity.ciphers=invalid -R copy-pull id https://localhost:$HGPORT/ | ||||
warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info | ||||
abort: *No cipher can be selected. (glob) | ||||
[255] | ||||
$ P="$CERTSDIR" hg --config hostsecurity.ciphers=HIGH -R copy-pull id https://localhost:$HGPORT/ | ||||
warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info | ||||
5fed3813f7f5 | ||||
#endif | ||||
#if sslcontext | ||||
Setting ciphers to an invalid value aborts | ||||
$ P="$CERTSDIR" hg --config hostsecurity.ciphers=invalid -R copy-pull id https://localhost:$HGPORT/ | ||||
|
r29601 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29577 | abort: could not set ciphers: No cipher can be selected. | ||
(change cipher string (invalid) in config) | ||||
[255] | ||||
$ P="$CERTSDIR" hg --config hostsecurity.localhost:ciphers=invalid -R copy-pull id https://localhost:$HGPORT/ | ||||
|
r29601 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29577 | abort: could not set ciphers: No cipher can be selected. | ||
(change cipher string (invalid) in config) | ||||
[255] | ||||
Changing the cipher string works | ||||
$ P="$CERTSDIR" hg --config hostsecurity.ciphers=HIGH -R copy-pull id https://localhost:$HGPORT/ | ||||
|
r29601 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29577 | 5fed3813f7f5 | ||
#endif | ||||
|
r13314 | Fingerprints | ||
|
r30332 | - works without cacerts (hostfingerprints) | ||
|
r29526 | $ hg -R copy-pull id https://localhost:$HGPORT/ --insecure --config hostfingerprints.localhost=ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03 | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r13314 | 5fed3813f7f5 | ||
|
r29267 | - works without cacerts (hostsecurity) | ||
|
r29526 | $ hg -R copy-pull id https://localhost:$HGPORT/ --config hostsecurity.localhost:fingerprints=sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29267 | 5fed3813f7f5 | ||
|
r29526 | $ hg -R copy-pull id https://localhost:$HGPORT/ --config hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29267 | 5fed3813f7f5 | ||
|
r28525 | - multiple fingerprints specified and first matches | ||
|
r29526 | $ hg --config 'hostfingerprints.localhost=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03, deadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ --insecure | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r28525 | 5fed3813f7f5 | ||
|
r29526 | $ hg --config 'hostsecurity.localhost:fingerprints=sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03, sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29267 | 5fed3813f7f5 | ||
|
r28525 | - multiple fingerprints specified and last matches | ||
|
r29526 | $ hg --config 'hostfingerprints.localhost=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03' -R copy-pull id https://localhost:$HGPORT/ --insecure | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r28525 | 5fed3813f7f5 | ||
|
r29526 | $ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03' -R copy-pull id https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29267 | 5fed3813f7f5 | ||
|
r28525 | - multiple fingerprints specified and none match | ||
|
r28847 | $ hg --config 'hostfingerprints.localhost=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ --insecure | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29526 | abort: certificate for localhost has unexpected fingerprint ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03 | ||
|
r28525 | (check hostfingerprint configuration) | ||
[255] | ||||
|
r29267 | $ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29526 | abort: certificate for localhost has unexpected fingerprint sha1:ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03 | ||
|
r29268 | (check hostsecurity configuration) | ||
|
r29267 | [255] | ||
|
r13314 | - fails when cert doesn't match hostname (port is ignored) | ||
|
r29526 | $ hg -R copy-pull id https://localhost:$HGPORT1/ --config hostfingerprints.localhost=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29526 | abort: certificate for localhost has unexpected fingerprint f4:2f:5a:0c:3e:52:5b:db:e7:24:a8:32:1d:18:97:6d:69:b5:87:84 | ||
|
r15997 | (check hostfingerprint configuration) | ||
|
r13314 | [255] | ||
|
r18588 | |||
|
r13314 | - ignores that certificate doesn't match hostname | ||
|
r31008 | $ hg -R copy-pull id https://$LOCALIP:$HGPORT/ --config hostfingerprints.$LOCALIP=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 | ||
warning: connecting to $LOCALIP using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||||
|
r13314 | 5fed3813f7f5 | ||
|
r13423 | |||
|
r29559 | Ports used by next test. Kill servers. | ||
$ killdaemons.py hg0.pid | ||||
|
r25472 | $ killdaemons.py hg1.pid | ||
|
r29559 | $ killdaemons.py hg2.pid | ||
|
r29601 | #if sslcontext tls1.2 | ||
|
r29559 | Start servers running supported TLS versions | ||
$ cd test | ||||
$ hg serve -p $HGPORT -d --pid-file=../hg0.pid --certificate=$PRIV \ | ||||
> --config devel.serverexactprotocol=tls1.0 | ||||
$ cat ../hg0.pid >> $DAEMON_PIDS | ||||
$ hg serve -p $HGPORT1 -d --pid-file=../hg1.pid --certificate=$PRIV \ | ||||
> --config devel.serverexactprotocol=tls1.1 | ||||
$ cat ../hg1.pid >> $DAEMON_PIDS | ||||
$ hg serve -p $HGPORT2 -d --pid-file=../hg2.pid --certificate=$PRIV \ | ||||
> --config devel.serverexactprotocol=tls1.2 | ||||
$ cat ../hg2.pid >> $DAEMON_PIDS | ||||
$ cd .. | ||||
Clients talking same TLS versions work | ||||
$ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.0 id https://localhost:$HGPORT/ | ||||
5fed3813f7f5 | ||||
$ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.1 id https://localhost:$HGPORT1/ | ||||
5fed3813f7f5 | ||||
$ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.2 id https://localhost:$HGPORT2/ | ||||
5fed3813f7f5 | ||||
Clients requiring newer TLS version than what server supports fail | ||||
|
r29560 | $ P="$CERTSDIR" hg id https://localhost:$HGPORT/ | ||
|
r29619 | (could not negotiate a common security protocol (tls1.1+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) | ||
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) | ||||
(see https://mercurial-scm.org/wiki/SecureConnections for more info) | ||||
|
r29560 | abort: error: *unsupported protocol* (glob) | ||
[255] | ||||
|
r29559 | $ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.1 id https://localhost:$HGPORT/ | ||
|
r29619 | (could not negotiate a common security protocol (tls1.1+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) | ||
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) | ||||
(see https://mercurial-scm.org/wiki/SecureConnections for more info) | ||||
|
r29559 | abort: error: *unsupported protocol* (glob) | ||
[255] | ||||
$ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.2 id https://localhost:$HGPORT/ | ||||
|
r29619 | (could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) | ||
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) | ||||
(see https://mercurial-scm.org/wiki/SecureConnections for more info) | ||||
|
r29559 | abort: error: *unsupported protocol* (glob) | ||
[255] | ||||
$ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.2 id https://localhost:$HGPORT1/ | ||||
|
r29619 | (could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) | ||
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) | ||||
(see https://mercurial-scm.org/wiki/SecureConnections for more info) | ||||
|
r29559 | abort: error: *unsupported protocol* (glob) | ||
[255] | ||||
|
r29617 | --insecure will allow TLS 1.0 connections and override configs | ||
$ hg --config hostsecurity.minimumprotocol=tls1.2 id --insecure https://localhost:$HGPORT1/ | ||||
warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering | ||||
5fed3813f7f5 | ||||
|
r29559 | The per-host config option overrides the default | ||
$ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \ | ||||
> --config hostsecurity.minimumprotocol=tls1.2 \ | ||||
> --config hostsecurity.localhost:minimumprotocol=tls1.0 | ||||
5fed3813f7f5 | ||||
The per-host config option by itself works | ||||
$ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \ | ||||
> --config hostsecurity.localhost:minimumprotocol=tls1.2 | ||||
|
r29619 | (could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) | ||
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) | ||||
(see https://mercurial-scm.org/wiki/SecureConnections for more info) | ||||
|
r29559 | abort: error: *unsupported protocol* (glob) | ||
[255] | ||||
|
r29616 | .hg/hgrc file [hostsecurity] settings are applied to remote ui instances (issue5305) | ||
$ cat >> copy-pull/.hg/hgrc << EOF | ||||
> [hostsecurity] | ||||
> localhost:minimumprotocol=tls1.2 | ||||
> EOF | ||||
$ P="$CERTSDIR" hg -R copy-pull id https://localhost:$HGPORT/ | ||||
|
r29619 | (could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) | ||
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) | ||||
(see https://mercurial-scm.org/wiki/SecureConnections for more info) | ||||
|
r29635 | abort: error: *unsupported protocol* (glob) | ||
|
r29616 | [255] | ||
|
r29559 | $ killdaemons.py hg0.pid | ||
$ killdaemons.py hg1.pid | ||||
$ killdaemons.py hg2.pid | ||||
#endif | ||||
|
r16300 | |||
|
r13423 | Prepare for connecting through proxy | ||
|
r29559 | $ hg serve -R test -p $HGPORT -d --pid-file=hg0.pid --certificate=$PRIV | ||
$ cat hg0.pid >> $DAEMON_PIDS | ||||
$ hg serve -R test -p $HGPORT2 -d --pid-file=hg2.pid --certificate=server-expired.pem | ||||
$ cat hg2.pid >> $DAEMON_PIDS | ||||
tinyproxy.py doesn't fully detach, so killing it may result in extra output | ||||
from the shell. So don't kill it. | ||||
|
r25472 | $ tinyproxy.py $HGPORT1 localhost >proxy.log </dev/null 2>&1 & | ||
|
r16496 | $ while [ ! -f proxy.pid ]; do sleep 0; done | ||
|
r13423 | $ cat proxy.pid >> $DAEMON_PIDS | ||
$ echo "[http_proxy]" >> copy-pull/.hg/hgrc | ||||
$ echo "always=True" >> copy-pull/.hg/hgrc | ||||
$ echo "[hostfingerprints]" >> copy-pull/.hg/hgrc | ||||
$ echo "localhost =" >> copy-pull/.hg/hgrc | ||||
Test unvalidated https through proxy | ||||
|
r29842 | $ http_proxy=http://localhost:$HGPORT1/ hg -R copy-pull pull --insecure | ||
|
r24138 | pulling from https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29289 | warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering | ||
|
r13423 | searching for changes | ||
no changes found | ||||
Test https with cacert and fingerprint through proxy | ||||
|
r29331 | $ http_proxy=http://localhost:$HGPORT1/ hg -R copy-pull pull \ | ||
> --config web.cacerts="$CERTSDIR/pub.pem" | ||||
|
r13423 | pulling from https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r13423 | searching for changes | ||
no changes found | ||||
|
r31008 | $ http_proxy=http://localhost:$HGPORT1/ hg -R copy-pull pull https://localhost:$HGPORT/ --config hostfingerprints.localhost=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 --trace | ||
pulling from https://*:$HGPORT/ (glob) | ||||
warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||||
|
r13423 | searching for changes | ||
no changes found | ||||
Test https with cert problems through proxy | ||||
|
r29331 | $ http_proxy=http://localhost:$HGPORT1/ hg -R copy-pull pull \ | ||
> --config web.cacerts="$CERTSDIR/pub-other.pem" | ||||
|
r24138 | pulling from https://localhost:$HGPORT/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r23823 | abort: error: *certificate verify failed* (glob) | ||
|
r13424 | [255] | ||
|
r29331 | $ http_proxy=http://localhost:$HGPORT1/ hg -R copy-pull pull \ | ||
> --config web.cacerts="$CERTSDIR/pub-expired.pem" https://localhost:$HGPORT2/ | ||||
|
r24138 | pulling from https://localhost:$HGPORT2/ | ||
|
r29561 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r23823 | abort: error: *certificate verify failed* (glob) | ||
|
r13424 | [255] | ||
|
r25413 | |||
|
r25472 | $ killdaemons.py hg0.pid | ||
|
r25413 | |||
#if sslcontext | ||||
|
r29555 | Start hgweb that requires client certificates: | ||
|
r25413 | |||
$ cd test | ||||
$ hg serve -p $HGPORT -d --pid-file=../hg0.pid --certificate=$PRIV \ | ||||
|
r29555 | > --config devel.servercafile=$PRIV --config devel.serverrequirecert=true | ||
|
r25413 | $ cat ../hg0.pid >> $DAEMON_PIDS | ||
$ cd .. | ||||
without client certificate: | ||||
|
r29331 | $ P="$CERTSDIR" hg id https://localhost:$HGPORT/ | ||
|
r29601 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r25413 | abort: error: *handshake failure* (glob) | ||
[255] | ||||
with client certificate: | ||||
$ cat << EOT >> $HGRCPATH | ||||
> [auth] | ||||
> l.prefix = localhost | ||||
|
r29331 | > l.cert = $CERTSDIR/client-cert.pem | ||
> l.key = $CERTSDIR/client-key.pem | ||||
|
r25413 | > EOT | ||
|
r29331 | $ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \ | ||
> --config auth.l.key="$CERTSDIR/client-key-decrypted.pem" | ||||
|
r29601 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r25413 | 5fed3813f7f5 | ||
|
r29331 | $ printf '1234\n' | env P="$CERTSDIR" hg id https://localhost:$HGPORT/ \ | ||
|
r25415 | > --config ui.interactive=True --config ui.nontty=True | ||
|
r29601 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r29331 | passphrase for */client-key.pem: 5fed3813f7f5 (glob) | ||
|
r25415 | |||
|
r29331 | $ env P="$CERTSDIR" hg id https://localhost:$HGPORT/ | ||
|
r29601 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | ||
|
r25415 | abort: error: * (glob) | ||
[255] | ||||
|
r25413 | #endif | ||