upstream/mercurial-mirror Files · tests/test-patch.t

sslutil: require TLS 1.1+ when supported...

sslutil: require TLS 1.1+ when supported Currently, Mercurial will use TLS 1.0 or newer when connecting to remote servers, selecting the highest TLS version supported by both peers. On older Pythons, only TLS 1.0 is available. On newer Pythons, TLS 1.1 and 1.2 should be available. Security professionals recommend avoiding TLS 1.0 if possible. PCI DSS 3.1 "strongly encourages" the use of TLS 1.2. Known attacks like BEAST and POODLE exist against TLS 1.0 (although mitigations are available and properly configured servers aren't vulnerable). I asked Eric Rescorla - Mozilla's resident crypto expert - whether Mercurial should drop support for TLS 1.0. His response was "if you can get away with it." Essentially, a number of servers on the Internet don't support TLS 1.1+. This is why web browsers continue to support TLS 1.0 despite desires from security experts. This patch changes Mercurial's default behavior on modern Python versions to require TLS 1.1+, thus avoiding known security issues with TLS 1.0 and making Mercurial more secure by default. Rather than drop TLS 1.0 support wholesale, we still allow TLS 1.0 to be used if configured. This is a compromise solution - ideally we'd disallow TLS 1.0. However, since we're not sure how many Mercurial servers don't support TLS 1.1+ and we're not sure how much user inconvenience this change will bring, I think it is prudent to ship an escape hatch that still allows usage of TLS 1.0. In the default case our users get better security. In the worst case, they are no worse off than before this patch. This patch has no effect when running on Python versions that don't support TLS 1.1+. As the added test shows, connecting to a server that doesn't support TLS 1.1+ will display a warning message with a link to our wiki, where we can guide people to configure their client to allow less secure connections.

Greg Ward - - Load All Authors

File last commit:

r15194:0705f2ac default


                r29560:303e9300

default

Download file

             test-patch.t
        
                    89 lines
            
             | 2.3 KiB
            
                | text/troff
            
             |
                Tads3Lexer
            
             / tests / test-patch.t
          
                    History
                
                 |
                  Annotation
                 | Raw
                 |Copy content
                 |Copy permalink

        $ cat > patchtool.py <<EOF

        > import sys

        > print 'Using custom patch'

        > if '--binary' in sys.argv:

        >     print '--binary found !'

        > EOF

        $ echo "[ui]" >> $HGRCPATH

        $ echo "patch=python ../patchtool.py" >> $HGRCPATH

        $ hg init a

        $ cd a

        $ echo a > a

        $ hg commit -Ama -d '1 0'

        adding a

        $ echo b >> a

        $ hg commit -Amb -d '2 0'

        $ cd ..

      This test checks that:

       - custom patch commands with arguments actually work

       - patch code does not try to add weird arguments like

       --binary when custom patch commands are used. For instance

       --binary is added by default under win32.

      check custom patch options are honored

        $ hg --cwd a export -o ../a.diff tip

        $ hg clone -r 0 a b

        adding changesets

        adding manifests

        adding file changes

        added 1 changesets with 1 changes to 1 files

        updating to branch default

        1 files updated, 0 files merged, 0 files removed, 0 files unresolved

        $ hg --cwd b import -v ../a.diff

        applying ../a.diff

        Using custom patch

        applied to working directory

      Issue2417: hg import with # comments in description

      Prepare source repo and patch:

        $ rm $HGRCPATH

        $ hg init c

        $ cd c

        $ printf "a\rc" > a

        $ hg ci -A -m 0 a -d '0 0'

        $ printf "a\rb\rc" > a

        $ cat << eof > log

        > first line which can't start with '# '

        > # second line is a comment but that shouldn't be a problem.

        > A patch marker like this was more problematic even after d7452292f9d3:

        > # HG changeset patch

        > # User lines looks like this - but it _is_ just a comment

        > eof

        $ hg ci -l log -d '0 0'

        $ hg export -o p 1

        $ cd ..

      Clone and apply patch:

        $ hg clone -r 0 c d

        adding changesets

        adding manifests

        adding file changes

        added 1 changesets with 1 changes to 1 files

        updating to branch default

        1 files updated, 0 files merged, 0 files removed, 0 files unresolved

        $ cd d

        $ hg import ../c/p

        applying ../c/p

        $ hg log -v -r 1

        changeset:   1:cd0bde79c428

        tag:         tip

        user:        test

        date:        Thu Jan 01 00:00:00 1970 +0000

        files:       a

        description:

        first line which can't start with '# '

        # second line is a comment but that shouldn't be a problem.

        A patch marker like this was more problematic even after d7452292f9d3:

        # HG changeset patch

        # User lines looks like this - but it _is_ just a comment

        $ cd ..

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

				$ cat > patchtool.py <<EOF
				> import sys
				> print 'Using custom patch'
				> if '--binary' in sys.argv:
				> print '--binary found !'
				> EOF

				$ echo "[ui]" >> $HGRCPATH
				$ echo "patch=python ../patchtool.py" >> $HGRCPATH

				$ hg init a
				$ cd a
				$ echo a > a
				$ hg commit -Ama -d '1 0'
				adding a
				$ echo b >> a
				$ hg commit -Amb -d '2 0'
				$ cd ..

				This test checks that:
				- custom patch commands with arguments actually work
				- patch code does not try to add weird arguments like
				--binary when custom patch commands are used. For instance
				--binary is added by default under win32.

				check custom patch options are honored

				$ hg --cwd a export -o ../a.diff tip
				$ hg clone -r 0 a b
				adding changesets
				adding manifests
				adding file changes
				added 1 changesets with 1 changes to 1 files
				updating to branch default
				1 files updated, 0 files merged, 0 files removed, 0 files unresolved

				$ hg --cwd b import -v ../a.diff
				applying ../a.diff
				Using custom patch
				applied to working directory

				Issue2417: hg import with # comments in description

				Prepare source repo and patch:

				$ rm $HGRCPATH
				$ hg init c
				$ cd c
				$ printf "a\rc" > a
				$ hg ci -A -m 0 a -d '0 0'
				$ printf "a\rb\rc" > a
				$ cat << eof > log
				> first line which can't start with '# '
				> # second line is a comment but that shouldn't be a problem.
				> A patch marker like this was more problematic even after d7452292f9d3:
				> # HG changeset patch
				> # User lines looks like this - but it _is_ just a comment
				> eof
				$ hg ci -l log -d '0 0'
				$ hg export -o p 1
				$ cd ..

				Clone and apply patch:

				$ hg clone -r 0 c d
				adding changesets
				adding manifests
				adding file changes
				added 1 changesets with 1 changes to 1 files
				updating to branch default
				1 files updated, 0 files merged, 0 files removed, 0 files unresolved
				$ cd d
				$ hg import ../c/p
				applying ../c/p
				$ hg log -v -r 1
				changeset: 1:cd0bde79c428
				tag: tip
				user: test
				date: Thu Jan 01 00:00:00 1970 +0000
				files: a
				description:
				first line which can't start with '# '
				# second line is a comment but that shouldn't be a problem.
				A patch marker like this was more problematic even after d7452292f9d3:
				# HG changeset patch
				# User lines looks like this - but it _is_ just a comment


				$ cd ..