sslutil.py
214 lines
| 8.6 KiB
| text/x-python
|
PythonLexer
/ mercurial / sslutil.py
|
r14204 | # sslutil.py - SSL handling for mercurial | ||
# | ||||
# Copyright 2005, 2006, 2007, 2008 Matt Mackall <mpm@selenic.com> | ||||
# Copyright 2006, 2007 Alexis S. L. Carvalho <alexis@cecm.usp.br> | ||||
# Copyright 2006 Vadim Gelfer <vadim.gelfer@gmail.com> | ||||
# | ||||
# This software may be used and distributed according to the terms of the | ||||
# GNU General Public License version 2 or any later version. | ||||
|
r25977 | |||
from __future__ import absolute_import | ||||
|
r14204 | |||
|
r25977 | import os | ||
import ssl | ||||
import sys | ||||
from .i18n import _ | ||||
|
r28577 | from . import ( | ||
error, | ||||
util, | ||||
) | ||||
|
r24291 | |||
|
r26622 | hassni = getattr(ssl, 'HAS_SNI', False) | ||
|
r24291 | _canloaddefaultcerts = False | ||
|
r14204 | try: | ||
|
r25431 | ssl_context = ssl.SSLContext | ||
_canloaddefaultcerts = util.safehasattr(ssl_context, 'load_default_certs') | ||||
|
r23834 | |||
|
r25431 | def wrapsocket(sock, keyfile, certfile, ui, cert_reqs=ssl.CERT_NONE, | ||
ca_certs=None, serverhostname=None): | ||||
# Allow any version of SSL starting with TLSv1 and | ||||
# up. Note that specifying TLSv1 here prohibits use of | ||||
# newer standards (like TLSv1_2), so this is the right way | ||||
# to do this. Note that in the future it'd be better to | ||||
# support using ssl.create_default_context(), which sets | ||||
# up a bunch of things in smart ways (strong ciphers, | ||||
# protocol versions, etc) and is upgraded by Python | ||||
# maintainers for us, but that breaks too many things to | ||||
# do it in a hurry. | ||||
sslcontext = ssl.SSLContext(ssl.PROTOCOL_SSLv23) | ||||
|
r27688 | sslcontext.options |= ssl.OP_NO_SSLv2 | ssl.OP_NO_SSLv3 | ||
|
r25431 | if certfile is not None: | ||
def password(): | ||||
f = keyfile or certfile | ||||
return ui.getpass(_('passphrase for %s: ') % f, '') | ||||
sslcontext.load_cert_chain(certfile, keyfile, password) | ||||
sslcontext.verify_mode = cert_reqs | ||||
if ca_certs is not None: | ||||
sslcontext.load_verify_locations(cafile=ca_certs) | ||||
elif _canloaddefaultcerts: | ||||
sslcontext.load_default_certs() | ||||
|
r23834 | |||
|
r25431 | sslsocket = sslcontext.wrap_socket(sock, server_hostname=serverhostname) | ||
# check if wrap_socket failed silently because socket had been | ||||
# closed | ||||
# - see http://bugs.python.org/issue13721 | ||||
if not sslsocket.cipher(): | ||||
|
r26587 | raise error.Abort(_('ssl connection failed')) | ||
|
r25431 | return sslsocket | ||
except AttributeError: | ||||
def wrapsocket(sock, keyfile, certfile, ui, cert_reqs=ssl.CERT_NONE, | ||||
ca_certs=None, serverhostname=None): | ||||
sslsocket = ssl.wrap_socket(sock, keyfile, certfile, | ||||
cert_reqs=cert_reqs, ca_certs=ca_certs, | ||||
ssl_version=ssl.PROTOCOL_TLSv1) | ||||
# check if wrap_socket failed silently because socket had been | ||||
# closed | ||||
# - see http://bugs.python.org/issue13721 | ||||
if not sslsocket.cipher(): | ||||
|
r26587 | raise error.Abort(_('ssl connection failed')) | ||
|
r25431 | return sslsocket | ||
|
r14204 | |||
def _verifycert(cert, hostname): | ||||
'''Verify that cert (in socket.getpeercert() format) matches hostname. | ||||
CRLs is not handled. | ||||
Returns error message if any problems are found and None on success. | ||||
''' | ||||
if not cert: | ||||
return _('no certificate received') | ||||
dnsname = hostname.lower() | ||||
def matchdnsname(certname): | ||||
return (certname == dnsname or | ||||
'.' in dnsname and certname == '*.' + dnsname.split('.', 1)[1]) | ||||
san = cert.get('subjectAltName', []) | ||||
if san: | ||||
certnames = [value.lower() for key, value in san if key == 'DNS'] | ||||
for name in certnames: | ||||
if matchdnsname(name): | ||||
return None | ||||
|
r14666 | if certnames: | ||
return _('certificate is for %s') % ', '.join(certnames) | ||||
|
r14204 | |||
# subject is only checked when subjectAltName is empty | ||||
for s in cert.get('subject', []): | ||||
key, value = s[0] | ||||
if key == 'commonName': | ||||
try: | ||||
# 'subject' entries are unicode | ||||
certname = value.lower().encode('ascii') | ||||
except UnicodeEncodeError: | ||||
return _('IDN in certificate not supported') | ||||
if matchdnsname(certname): | ||||
return None | ||||
return _('certificate is for %s') % certname | ||||
return _('no commonName or subjectAltName found in certificate') | ||||
# CERT_REQUIRED means fetch the cert from the server all the time AND | ||||
# validate it against the CA store provided in web.cacerts. | ||||
|
r23042 | def _plainapplepython(): | ||
"""return true if this seems to be a pure Apple Python that | ||||
* is unfrozen and presumably has the whole mercurial module in the file | ||||
system | ||||
* presumably is an Apple Python that uses Apple OpenSSL which has patches | ||||
for using system certificate store CAs in addition to the provided | ||||
cacerts file | ||||
""" | ||||
|
r24614 | if sys.platform != 'darwin' or util.mainfrozen() or not sys.executable: | ||
|
r23042 | return False | ||
|
r24614 | exe = os.path.realpath(sys.executable).lower() | ||
|
r23042 | return (exe.startswith('/usr/bin/python') or | ||
exe.startswith('/system/library/frameworks/python.framework/')) | ||||
|
r24288 | def _defaultcacerts(): | ||
|
r24291 | """return path to CA certificates; None for system's store; ! to disable""" | ||
|
r24288 | if _plainapplepython(): | ||
dummycert = os.path.join(os.path.dirname(__file__), 'dummycert.pem') | ||||
if os.path.exists(dummycert): | ||||
return dummycert | ||||
|
r24291 | if _canloaddefaultcerts: | ||
return None | ||||
|
r24290 | return '!' | ||
|
r24288 | |||
|
r14204 | def sslkwargs(ui, host): | ||
|
r25415 | kws = {'ui': ui} | ||
|
r22574 | hostfingerprint = ui.config('hostfingerprints', host) | ||
if hostfingerprint: | ||||
return kws | ||||
cacerts = ui.config('web', 'cacerts') | ||||
|
r24290 | if cacerts == '!': | ||
pass | ||||
elif cacerts: | ||||
|
r14204 | cacerts = util.expandpath(cacerts) | ||
if not os.path.exists(cacerts): | ||||
|
r26587 | raise error.Abort(_('could not find web.cacerts: %s') % cacerts) | ||
|
r24290 | else: | ||
cacerts = _defaultcacerts() | ||||
if cacerts and cacerts != '!': | ||||
ui.debug('using %s to enable OS X system CA\n' % cacerts) | ||||
ui.setconfig('web', 'cacerts', cacerts, 'defaultcacerts') | ||||
if cacerts != '!': | ||||
|
r19806 | kws.update({'ca_certs': cacerts, | ||
|
r25432 | 'cert_reqs': ssl.CERT_REQUIRED, | ||
|
r19806 | }) | ||
return kws | ||||
|
r14204 | |||
class validator(object): | ||||
def __init__(self, ui, host): | ||||
self.ui = ui | ||||
self.host = host | ||||
|
r18887 | def __call__(self, sock, strict=False): | ||
|
r14204 | host = self.host | ||
cacerts = self.ui.config('web', 'cacerts') | ||||
|
r28525 | hostfingerprints = self.ui.configlist('hostfingerprints', host) | ||
|
r18879 | |||
|
r15816 | if not sock.cipher(): # work around http://bugs.python.org/issue13721 | ||
|
r26587 | raise error.Abort(_('%s ssl connection error') % host) | ||
|
r18879 | try: | ||
peercert = sock.getpeercert(True) | ||||
peercert2 = sock.getpeercert() | ||||
except AttributeError: | ||||
|
r26587 | raise error.Abort(_('%s ssl connection error') % host) | ||
|
r18879 | |||
|
r15817 | if not peercert: | ||
|
r26587 | raise error.Abort(_('%s certificate error: ' | ||
|
r15817 | 'no certificate received') % host) | ||
|
r15814 | peerfingerprint = util.sha1(peercert).hexdigest() | ||
nicefingerprint = ":".join([peerfingerprint[x:x + 2] | ||||
for x in xrange(0, len(peerfingerprint), 2)]) | ||||
|
r28525 | if hostfingerprints: | ||
fingerprintmatch = False | ||||
for hostfingerprint in hostfingerprints: | ||||
if peerfingerprint.lower() == \ | ||||
hostfingerprint.replace(':', '').lower(): | ||||
fingerprintmatch = True | ||||
break | ||||
if not fingerprintmatch: | ||||
|
r26587 | raise error.Abort(_('certificate for %s has unexpected ' | ||
|
r15997 | 'fingerprint %s') % (host, nicefingerprint), | ||
hint=_('check hostfingerprint configuration')) | ||||
|
r15815 | self.ui.debug('%s certificate matched fingerprint %s\n' % | ||
(host, nicefingerprint)) | ||||
|
r24290 | elif cacerts != '!': | ||
|
r18879 | msg = _verifycert(peercert2, host) | ||
|
r14204 | if msg: | ||
|
r26587 | raise error.Abort(_('%s certificate error: %s') % (host, msg), | ||
|
r15814 | hint=_('configure hostfingerprint %s or use ' | ||
'--insecure to connect insecurely') % | ||||
nicefingerprint) | ||||
|
r14204 | self.ui.debug('%s certificate successfully verified\n' % host) | ||
|
r18887 | elif strict: | ||
|
r26587 | raise error.Abort(_('%s certificate with fingerprint %s not ' | ||
|
r18887 | 'verified') % (host, nicefingerprint), | ||
hint=_('check hostfingerprints or web.cacerts ' | ||||
'config setting')) | ||||
|
r14204 | else: | ||
|
r15815 | self.ui.warn(_('warning: %s certificate with fingerprint %s not ' | ||
'verified (check hostfingerprints or web.cacerts ' | ||||
'config setting)\n') % | ||||
(host, nicefingerprint)) | ||||