Show More
@@ -645,25 +645,11 b' def has_ssl():' | |||
|
645 | 645 | return False |
|
646 | 646 | |
|
647 | 647 | |
|
648 | @check("sslcontext", "python >= 2.7.9 ssl") | |
|
649 | def has_sslcontext(): | |
|
650 | try: | |
|
651 | import ssl | |
|
652 | ||
|
653 | ssl.SSLContext | |
|
654 | return True | |
|
655 | except (ImportError, AttributeError): | |
|
656 | return False | |
|
657 | ||
|
658 | ||
|
659 | 648 | @check("defaultcacertsloaded", "detected presence of loaded system CA certs") |
|
660 | 649 | def has_defaultcacertsloaded(): |
|
661 | 650 | import ssl |
|
662 | 651 | from mercurial import sslutil, ui as uimod |
|
663 | 652 | |
|
664 | if not has_sslcontext(): | |
|
665 | return False | |
|
666 | ||
|
667 | 653 | ui = uimod.ui.load() |
|
668 | 654 | cafile = sslutil._defaultcacerts(ui) |
|
669 | 655 | ctx = ssl.create_default_context() |
@@ -255,7 +255,8 b' Automatic fallback when all entries are ' | |||
|
255 | 255 | added 2 changesets with 2 changes to 2 files |
|
256 | 256 | new changesets 53245c60e682:aaff8d2ffbbf |
|
257 | 257 | |
|
258 | URLs requiring SNI are filtered in Python <2.7.9 | |
|
258 | We require a Python version that supports SNI. Therefore, URLs requiring SNI | |
|
259 | are not filtered. | |
|
259 | 260 | |
|
260 | 261 | $ cp full.hg sni.hg |
|
261 | 262 | $ cat > server/.hg/clonebundles.manifest << EOF |
@@ -263,9 +264,6 b' URLs requiring SNI are filtered in Pytho' | |||
|
263 | 264 | > http://localhost:$HGPORT1/full.hg |
|
264 | 265 | > EOF |
|
265 | 266 | |
|
266 | #if sslcontext | |
|
267 | Python 2.7.9+ support SNI | |
|
268 | ||
|
269 | 267 | $ hg clone -U http://localhost:$HGPORT sni-supported |
|
270 | 268 | applying clone bundle from http://localhost:$HGPORT1/sni.hg |
|
271 | 269 | adding changesets |
@@ -276,20 +274,6 b' Python 2.7.9+ support SNI' | |||
|
276 | 274 | searching for changes |
|
277 | 275 | no changes found |
|
278 | 276 | 2 local changesets published |
|
279 | #else | |
|
280 | Python <2.7.9 will filter SNI URLs | |
|
281 | ||
|
282 | $ hg clone -U http://localhost:$HGPORT sni-unsupported | |
|
283 | applying clone bundle from http://localhost:$HGPORT1/full.hg | |
|
284 | adding changesets | |
|
285 | adding manifests | |
|
286 | adding file changes | |
|
287 | added 2 changesets with 2 changes to 2 files | |
|
288 | finished applying clone bundle | |
|
289 | searching for changes | |
|
290 | no changes found | |
|
291 | 2 local changesets published | |
|
292 | #endif | |
|
293 | 277 |
|
|
294 | 278 | Stream clone bundles are supported |
|
295 | 279 |
@@ -49,38 +49,13 b' Test server address cannot be reused' | |||
|
49 | 49 | Our test cert is not signed by a trusted CA. It should fail to verify if |
|
50 | 50 | we are able to load CA certs. |
|
51 | 51 | |
|
52 |
#if |
|
|
52 | #if no-defaultcacertsloaded | |
|
53 | 53 | $ hg clone https://localhost:$HGPORT/ copy-pull |
|
54 | 54 | (an attempt was made to load CA certificates but none were loaded; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error) |
|
55 | 55 | abort: error: *certificate verify failed* (glob) |
|
56 | 56 | [255] |
|
57 | 57 | #endif |
|
58 | 58 | |
|
59 | #if no-sslcontext | |
|
60 | $ hg clone https://localhost:$HGPORT/ copy-pull | |
|
61 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | |
|
62 | (using CA certificates from *; if you see this message, your Mercurial install is not properly configured; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) (glob) (?) | |
|
63 | abort: error: *certificate verify failed* (glob) | |
|
64 | [255] | |
|
65 | #endif | |
|
66 | ||
|
67 | #if no-sslcontext windows | |
|
68 | $ hg clone https://localhost:$HGPORT/ copy-pull | |
|
69 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info | |
|
70 | (unable to load Windows CA certificates; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) | |
|
71 | abort: error: *certificate verify failed* (glob) | |
|
72 | [255] | |
|
73 | #endif | |
|
74 | ||
|
75 | #if no-sslcontext osx | |
|
76 | $ hg clone https://localhost:$HGPORT/ copy-pull | |
|
77 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info | |
|
78 | (unable to load CA certificates; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) | |
|
79 | abort: localhost certificate error: no certificate received | |
|
80 | (set hostsecurity.localhost:certfingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e config setting or use --insecure to connect insecurely) | |
|
81 | [255] | |
|
82 | #endif | |
|
83 | ||
|
84 | 59 | #if defaultcacertsloaded |
|
85 | 60 |
$ |
|
86 | 61 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) |
@@ -101,35 +76,21 b' C:/path/to/msysroot will print on Window' | |||
|
101 | 76 | A malformed per-host certificate file will raise an error |
|
102 | 77 | |
|
103 | 78 | $ echo baddata > badca.pem |
|
104 | #if sslcontext | |
|
105 | 79 | $ hg --config hostsecurity.localhost:verifycertsfile=badca.pem clone https://localhost:$HGPORT/ |
|
106 | 80 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) |
|
107 | 81 | abort: error loading CA file badca.pem: * (glob) |
|
108 | 82 | (file is empty or malformed?) |
|
109 | 83 | [255] |
|
110 | #else | |
|
111 | $ hg --config hostsecurity.localhost:verifycertsfile=badca.pem clone https://localhost:$HGPORT/ | |
|
112 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | |
|
113 | abort: error: * (glob) | |
|
114 | [255] | |
|
115 | #endif | |
|
116 | 84 | |
|
117 | 85 | A per-host certificate mismatching the server will fail verification |
|
118 | 86 | |
|
119 | 87 | (modern ssl is able to discern whether the loaded cert is a CA cert) |
|
120 | #if sslcontext | |
|
121 | 88 | $ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/client-cert.pem" clone https://localhost:$HGPORT/ |
|
122 | 89 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) |
|
123 | 90 | (an attempt was made to load CA certificates but none were loaded; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error) |
|
124 | 91 | (the full certificate chain may not be available locally; see "hg help debugssl") (windows !) |
|
125 | 92 | abort: error: *certificate verify failed* (glob) |
|
126 | 93 | [255] |
|
127 | #else | |
|
128 | $ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/client-cert.pem" clone https://localhost:$HGPORT/ | |
|
129 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | |
|
130 | abort: error: *certificate verify failed* (glob) | |
|
131 | [255] | |
|
132 | #endif | |
|
133 | 94 | |
|
134 | 95 | A per-host certificate matching the server's cert will be accepted |
|
135 | 96 | |
@@ -269,20 +230,12 b' empty cacert file' | |||
|
269 | 230 | |
|
270 | 231 | $ touch emptycafile |
|
271 | 232 | |
|
272 | #if sslcontext | |
|
273 | 233 | $ hg --config web.cacerts=emptycafile -R copy-pull pull |
|
274 | 234 | pulling from https://localhost:$HGPORT/ |
|
275 | 235 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) |
|
276 | 236 | abort: error loading CA file emptycafile: * (glob) |
|
277 | 237 | (file is empty or malformed?) |
|
278 | 238 | [255] |
|
279 | #else | |
|
280 | $ hg --config web.cacerts=emptycafile -R copy-pull pull | |
|
281 | pulling from https://localhost:$HGPORT/ | |
|
282 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) | |
|
283 | abort: error: * (glob) | |
|
284 | [255] | |
|
285 | #endif | |
|
286 | 239 |
|
|
287 | 240 | cacert mismatch |
|
288 | 241 | |
@@ -344,20 +297,6 b' Disabling the TLS 1.0 warning works' | |||
|
344 | 297 | > --config hostsecurity.disabletls10warning=true |
|
345 | 298 | 5fed3813f7f5 |
|
346 | 299 | |
|
347 | Error message for setting ciphers is different depending on SSLContext support | |
|
348 | ||
|
349 | #if no-sslcontext | |
|
350 | $ P="$CERTSDIR" hg --config hostsecurity.ciphers=invalid -R copy-pull id https://localhost:$HGPORT/ | |
|
351 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info | |
|
352 | abort: *No cipher can be selected. (glob) | |
|
353 | [255] | |
|
354 | ||
|
355 | $ P="$CERTSDIR" hg --config hostsecurity.ciphers=HIGH -R copy-pull id https://localhost:$HGPORT/ | |
|
356 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info | |
|
357 | 5fed3813f7f5 | |
|
358 | #endif | |
|
359 | ||
|
360 | #if sslcontext | |
|
361 | 300 | Setting ciphers to an invalid value aborts |
|
362 | 301 | $ P="$CERTSDIR" hg --config hostsecurity.ciphers=invalid -R copy-pull id https://localhost:$HGPORT/ |
|
363 | 302 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) |
@@ -376,7 +315,6 b' Changing the cipher string works' | |||
|
376 | 315 | $ P="$CERTSDIR" hg --config hostsecurity.ciphers=HIGH -R copy-pull id https://localhost:$HGPORT/ |
|
377 | 316 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?) |
|
378 | 317 | 5fed3813f7f5 |
|
379 | #endif | |
|
380 | 318 | |
|
381 | 319 | Fingerprints |
|
382 | 320 | |
@@ -449,7 +387,7 b' Ports used by next test. Kill servers.' | |||
|
449 | 387 | $ killdaemons.py hg1.pid |
|
450 | 388 | $ killdaemons.py hg2.pid |
|
451 | 389 | |
|
452 |
#if |
|
|
390 | #if tls1.2 | |
|
453 | 391 | Start servers running supported TLS versions |
|
454 | 392 | |
|
455 | 393 | $ cd test |
@@ -603,8 +541,6 b' Test https with cert problems through pr' | |||
|
603 | 541 | |
|
604 | 542 | $ killdaemons.py hg0.pid |
|
605 | 543 | |
|
606 | #if sslcontext | |
|
607 | ||
|
608 | 544 | $ cd test |
|
609 | 545 | |
|
610 | 546 | Missing certificate file(s) are detected |
@@ -668,5 +604,3 b' Missing certficate and key files result ' | |||
|
668 | 604 | abort: certificate file (*/missing/key) does not exist; cannot connect to localhost (glob) |
|
669 | 605 | (restore missing file or fix references in Mercurial config) |
|
670 | 606 | [255] |
|
671 | ||
|
672 | #endif |
@@ -39,7 +39,7 b' Utility functions:' | |||
|
39 | 39 | Our test cert is not signed by a trusted CA. It should fail to verify if |
|
40 | 40 | we are able to load CA certs: |
|
41 | 41 | |
|
42 |
#if |
|
|
42 | #if no-defaultcacertsloaded | |
|
43 | 43 | $ try |
|
44 | 44 | this patch series consists of 1 patches. |
|
45 | 45 | |
@@ -49,17 +49,6 b' we are able to load CA certs:' | |||
|
49 | 49 | [255] |
|
50 | 50 | #endif |
|
51 | 51 | |
|
52 | #if no-sslcontext | |
|
53 | $ try | |
|
54 | this patch series consists of 1 patches. | |
|
55 | ||
|
56 | ||
|
57 | warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info | |
|
58 | (using CA certificates from *; if you see this message, your Mercurial install is not properly configured; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message) (glob) (?) | |
|
59 | (?i)abort: .*?certificate.verify.failed.* (re) | |
|
60 | [255] | |
|
61 | #endif | |
|
62 | ||
|
63 | 52 | #if defaultcacertsloaded |
|
64 | 53 | $ try |
|
65 | 54 | this patch series consists of 1 patches. |
General Comments 0
You need to be logged in to leave comments.
Login now