Show More
@@ -1024,11 +1024,39 b' The following per-host settings can be d' | |||||
1024 | This can provide stronger security than traditional CA-based validation |
|
1024 | This can provide stronger security than traditional CA-based validation | |
1025 | at the expense of convenience. |
|
1025 | at the expense of convenience. | |
1026 |
|
1026 | |||
|
1027 | This option takes precedence over ``verifycertsfile``. | |||
|
1028 | ||||
|
1029 | ``verifycertsfile`` | |||
|
1030 | Path to file a containing a list of PEM encoded certificates used to | |||
|
1031 | verify the server certificate. Environment variables and ``~user`` | |||
|
1032 | constructs are expanded in the filename. | |||
|
1033 | ||||
|
1034 | The server certificate or the certificate's certificate authority (CA) | |||
|
1035 | must match a certificate from this file or certificate verification | |||
|
1036 | will fail and connections to the server will be refused. | |||
|
1037 | ||||
|
1038 | If defined, only certificates provided by this file will be used: | |||
|
1039 | ``web.cacerts`` and any system/default certificates will not be | |||
|
1040 | used. | |||
|
1041 | ||||
|
1042 | This option has no effect if the per-host ``fingerprints`` option | |||
|
1043 | is set. | |||
|
1044 | ||||
|
1045 | The format of the file is as follows: | |||
|
1046 | ||||
|
1047 | -----BEGIN CERTIFICATE----- | |||
|
1048 | ... (certificate in base64 PEM encoding) ... | |||
|
1049 | -----END CERTIFICATE----- | |||
|
1050 | -----BEGIN CERTIFICATE----- | |||
|
1051 | ... (certificate in base64 PEM encoding) ... | |||
|
1052 | -----END CERTIFICATE----- | |||
|
1053 | ||||
1027 | For example:: |
|
1054 | For example:: | |
1028 |
|
1055 | |||
1029 | [hostsecurity] |
|
1056 | [hostsecurity] | |
1030 | hg.example.com:fingerprints = sha256:c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f2 |
|
1057 | hg.example.com:fingerprints = sha256:c3ab8ff13720e8ad9047dd39466b3c8974e592c2fa383d4a3960714caef0c4f2 | |
1031 | hg2.example.com:fingerprints = sha1:914f1aff87249c09b6859b88b1906d30756491ca, sha1:fc:e2:8d:d9:51:cd:cb:c1:4d:18:6b:b7:44:8d:49:72:57:e6:cd:33 |
|
1058 | hg2.example.com:fingerprints = sha1:914f1aff87249c09b6859b88b1906d30756491ca, sha1:fc:e2:8d:d9:51:cd:cb:c1:4d:18:6b:b7:44:8d:49:72:57:e6:cd:33 | |
|
1059 | foo.example.com:verifycertsfile = /etc/ssl/trusted-ca-certs.pem | |||
1032 |
|
1060 | |||
1033 | ``http_proxy`` |
|
1061 | ``http_proxy`` | |
1034 | -------------- |
|
1062 | -------------- |
@@ -162,23 +162,42 b' def _hostsettings(ui, hostname):' | |||||
162 | if ui.configbool('devel', 'disableloaddefaultcerts'): |
|
162 | if ui.configbool('devel', 'disableloaddefaultcerts'): | |
163 | s['allowloaddefaultcerts'] = False |
|
163 | s['allowloaddefaultcerts'] = False | |
164 |
|
164 | |||
|
165 | # If both fingerprints and a per-host ca file are specified, issue a warning | |||
|
166 | # because users should not be surprised about what security is or isn't | |||
|
167 | # being performed. | |||
|
168 | cafile = ui.config('hostsecurity', '%s:verifycertsfile' % hostname) | |||
|
169 | if s['certfingerprints'] and cafile: | |||
|
170 | ui.warn(_('(hostsecurity.%s:verifycertsfile ignored when host ' | |||
|
171 | 'fingerprints defined; using host fingerprints for ' | |||
|
172 | 'verification)\n') % hostname) | |||
|
173 | ||||
165 | # Try to hook up CA certificate validation unless something above |
|
174 | # Try to hook up CA certificate validation unless something above | |
166 | # makes it not necessary. |
|
175 | # makes it not necessary. | |
167 | if s['verifymode'] is None: |
|
176 | if s['verifymode'] is None: | |
168 | # Find global certificates file in config. |
|
177 | # Look at per-host ca file first. | |
169 | cafile = ui.config('web', 'cacerts') |
|
|||
170 |
|
||||
171 | if cafile: |
|
178 | if cafile: | |
172 | cafile = util.expandpath(cafile) |
|
179 | cafile = util.expandpath(cafile) | |
173 | if not os.path.exists(cafile): |
|
180 | if not os.path.exists(cafile): | |
174 |
raise error.Abort(_(' |
|
181 | raise error.Abort(_('path specified by %s does not exist: %s') % | |
|
182 | ('hostsecurity.%s:verifycertsfile' % hostname, | |||
|
183 | cafile)) | |||
|
184 | s['cafile'] = cafile | |||
175 | else: |
|
185 | else: | |
176 |
# |
|
186 | # Find global certificates file in config. | |
177 |
cafile = |
|
187 | cafile = ui.config('web', 'cacerts') | |
|
188 | ||||
178 | if cafile: |
|
189 | if cafile: | |
179 | ui.debug('using %s to enable OS X system CA\n' % cafile) |
|
190 | cafile = util.expandpath(cafile) | |
|
191 | if not os.path.exists(cafile): | |||
|
192 | raise error.Abort(_('could not find web.cacerts: %s') % | |||
|
193 | cafile) | |||
|
194 | else: | |||
|
195 | # No global CA certs. See if we can load defaults. | |||
|
196 | cafile = _defaultcacerts() | |||
|
197 | if cafile: | |||
|
198 | ui.debug('using %s to enable OS X system CA\n' % cafile) | |||
180 |
|
199 | |||
181 | s['cafile'] = cafile |
|
200 | s['cafile'] = cafile | |
182 |
|
201 | |||
183 | # Require certificate validation if CA certs are being loaded and |
|
202 | # Require certificate validation if CA certs are being loaded and | |
184 | # verification hasn't been disabled above. |
|
203 | # verification hasn't been disabled above. |
@@ -53,6 +53,54 b' we are able to load CA certs.' | |||||
53 | [255] |
|
53 | [255] | |
54 | #endif |
|
54 | #endif | |
55 |
|
55 | |||
|
56 | Specifying a per-host certificate file that doesn't exist will abort | |||
|
57 | ||||
|
58 | $ hg --config hostsecurity.localhost:verifycertsfile=/does/not/exist clone https://localhost:$HGPORT/ | |||
|
59 | abort: path specified by hostsecurity.localhost:verifycertsfile does not exist: /does/not/exist | |||
|
60 | [255] | |||
|
61 | ||||
|
62 | A malformed per-host certificate file will raise an error | |||
|
63 | ||||
|
64 | $ echo baddata > badca.pem | |||
|
65 | $ hg --config hostsecurity.localhost:verifycertsfile=badca.pem clone https://localhost:$HGPORT/ | |||
|
66 | abort: error: unknown error* (glob) | |||
|
67 | [255] | |||
|
68 | ||||
|
69 | A per-host certificate mismatching the server will fail verification | |||
|
70 | ||||
|
71 | $ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/client-cert.pem" clone https://localhost:$HGPORT/ | |||
|
72 | abort: error: *certificate verify failed* (glob) | |||
|
73 | [255] | |||
|
74 | ||||
|
75 | A per-host certificate matching the server's cert will be accepted | |||
|
76 | ||||
|
77 | $ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/pub.pem" clone -U https://localhost:$HGPORT/ perhostgood1 | |||
|
78 | requesting all changes | |||
|
79 | adding changesets | |||
|
80 | adding manifests | |||
|
81 | adding file changes | |||
|
82 | added 1 changesets with 4 changes to 4 files | |||
|
83 | ||||
|
84 | A per-host certificate with multiple certs and one matching will be accepted | |||
|
85 | ||||
|
86 | $ cat "$CERTSDIR/client-cert.pem" "$CERTSDIR/pub.pem" > perhost.pem | |||
|
87 | $ hg --config hostsecurity.localhost:verifycertsfile=perhost.pem clone -U https://localhost:$HGPORT/ perhostgood2 | |||
|
88 | requesting all changes | |||
|
89 | adding changesets | |||
|
90 | adding manifests | |||
|
91 | adding file changes | |||
|
92 | added 1 changesets with 4 changes to 4 files | |||
|
93 | ||||
|
94 | Defining both per-host certificate and a fingerprint will print a warning | |||
|
95 | ||||
|
96 | $ hg --config hostsecurity.localhost:verifycertsfile="$CERTSDIR/pub.pem" --config hostsecurity.localhost:fingerprints=sha1:914f1aff87249c09b6859b88b1906d30756491ca clone -U https://localhost:$HGPORT/ caandfingerwarning | |||
|
97 | (hostsecurity.localhost:verifycertsfile ignored when host fingerprints defined; using host fingerprints for verification) | |||
|
98 | requesting all changes | |||
|
99 | adding changesets | |||
|
100 | adding manifests | |||
|
101 | adding file changes | |||
|
102 | added 1 changesets with 4 changes to 4 files | |||
|
103 | ||||
56 | $ DISABLECACERTS="--config devel.disableloaddefaultcerts=true" |
|
104 | $ DISABLECACERTS="--config devel.disableloaddefaultcerts=true" | |
57 |
|
105 | |||
58 | clone via pull |
|
106 | clone via pull |
General Comments 0
You need to be logged in to leave comments.
Login now