##// END OF EJS Templates
sslutil: require TLS 1.1+ when supported...
sslutil: require TLS 1.1+ when supported Currently, Mercurial will use TLS 1.0 or newer when connecting to remote servers, selecting the highest TLS version supported by both peers. On older Pythons, only TLS 1.0 is available. On newer Pythons, TLS 1.1 and 1.2 should be available. Security professionals recommend avoiding TLS 1.0 if possible. PCI DSS 3.1 "strongly encourages" the use of TLS 1.2. Known attacks like BEAST and POODLE exist against TLS 1.0 (although mitigations are available and properly configured servers aren't vulnerable). I asked Eric Rescorla - Mozilla's resident crypto expert - whether Mercurial should drop support for TLS 1.0. His response was "if you can get away with it." Essentially, a number of servers on the Internet don't support TLS 1.1+. This is why web browsers continue to support TLS 1.0 despite desires from security experts. This patch changes Mercurial's default behavior on modern Python versions to require TLS 1.1+, thus avoiding known security issues with TLS 1.0 and making Mercurial more secure by default. Rather than drop TLS 1.0 support wholesale, we still allow TLS 1.0 to be used if configured. This is a compromise solution - ideally we'd disallow TLS 1.0. However, since we're not sure how many Mercurial servers don't support TLS 1.1+ and we're not sure how much user inconvenience this change will bring, I think it is prudent to ship an escape hatch that still allows usage of TLS 1.0. In the default case our users get better security. In the worst case, they are no worse off than before this patch. This patch has no effect when running on Python versions that don't support TLS 1.1+. As the added test shows, connecting to a server that doesn't support TLS 1.1+ will display a warning message with a link to our wiki, where we can guide people to configure their client to allow less secure connections.

File last commit:

r29503:0103b673 default
r29560:303e9300 default
Show More
test-journal-share.t
153 lines | 4.5 KiB | text/troff | Tads3Lexer
/ tests / test-journal-share.t
Journal extension test: tests the share extension support
$ cat >> testmocks.py << EOF
> # mock out util.getuser() and util.makedate() to supply testable values
> import os
> from mercurial import util
> def mockgetuser():
> return 'foobar'
>
> def mockmakedate():
> filename = os.path.join(os.environ['TESTTMP'], 'testtime')
> try:
> with open(filename, 'rb') as timef:
> time = float(timef.read()) + 1
> except IOError:
> time = 0.0
> with open(filename, 'wb') as timef:
> timef.write(str(time))
> return (time, 0)
>
> util.getuser = mockgetuser
> util.makedate = mockmakedate
> EOF
$ cat >> $HGRCPATH << EOF
> [extensions]
> journal=
> share=
> testmocks=`pwd`/testmocks.py
> [remotenames]
> rename.default=remote
> EOF
$ hg init repo
$ cd repo
$ hg bookmark bm
$ touch file0
$ hg commit -Am 'file0 added'
adding file0
$ hg journal --all
previous locations of the working copy and bookmarks:
5640b525682e . commit -Am 'file0 added'
5640b525682e bm commit -Am 'file0 added'
A shared working copy initially receives the same bookmarks and working copy
$ cd ..
$ hg share repo shared1
updating working directory
1 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ cd shared1
$ hg journal --all
previous locations of the working copy and bookmarks:
5640b525682e . share repo shared1
unless you explicitly share bookmarks
$ cd ..
$ hg share --bookmarks repo shared2
updating working directory
1 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ cd shared2
$ hg journal --all
previous locations of the working copy and bookmarks:
5640b525682e . share --bookmarks repo shared2
5640b525682e bm commit -Am 'file0 added'
Moving the bookmark in the original repository is only shown in the repository
that shares bookmarks
$ cd ../repo
$ touch file1
$ hg commit -Am "file1 added"
adding file1
$ cd ../shared1
$ hg journal --all
previous locations of the working copy and bookmarks:
5640b525682e . share repo shared1
$ cd ../shared2
$ hg journal --all
previous locations of the working copy and bookmarks:
6432d239ac5d bm commit -Am 'file1 added'
5640b525682e . share --bookmarks repo shared2
5640b525682e bm commit -Am 'file0 added'
But working copy changes are always 'local'
$ cd ../repo
$ hg up 0
0 files updated, 0 files merged, 1 files removed, 0 files unresolved
(leaving bookmark bm)
$ hg journal --all
previous locations of the working copy and bookmarks:
5640b525682e . up 0
6432d239ac5d . commit -Am 'file1 added'
6432d239ac5d bm commit -Am 'file1 added'
5640b525682e . commit -Am 'file0 added'
5640b525682e bm commit -Am 'file0 added'
$ cd ../shared2
$ hg journal --all
previous locations of the working copy and bookmarks:
6432d239ac5d bm commit -Am 'file1 added'
5640b525682e . share --bookmarks repo shared2
5640b525682e bm commit -Am 'file0 added'
$ hg up tip
1 files updated, 0 files merged, 0 files removed, 0 files unresolved
$ hg up 0
0 files updated, 0 files merged, 1 files removed, 0 files unresolved
$ hg journal
previous locations of '.':
5640b525682e up 0
6432d239ac5d up tip
5640b525682e share --bookmarks repo shared2
Unsharing works as expected; the journal remains consistent
$ cd ../shared1
$ hg unshare
$ hg journal --all
previous locations of the working copy and bookmarks:
5640b525682e . share repo shared1
$ cd ../shared2
$ hg unshare
$ hg journal --all
previous locations of the working copy and bookmarks:
5640b525682e . up 0
6432d239ac5d . up tip
6432d239ac5d bm commit -Am 'file1 added'
5640b525682e . share --bookmarks repo shared2
5640b525682e bm commit -Am 'file0 added'
New journal entries in the source repo no longer show up in the other working copies
$ cd ../repo
$ hg bookmark newbm -r tip
$ hg journal newbm
previous locations of 'newbm':
6432d239ac5d bookmark newbm -r tip
$ cd ../shared2
$ hg journal newbm
previous locations of 'newbm':
no recorded locations
This applies for both directions
$ hg bookmark shared2bm -r tip
$ hg journal shared2bm
previous locations of 'shared2bm':
6432d239ac5d bookmark shared2bm -r tip
$ cd ../repo
$ hg journal shared2bm
previous locations of 'shared2bm':
no recorded locations