upstream/mercurial-mirror Files · mercurial/pycompat.py

sslutil: config option to specify TLS protocol version...

sslutil: config option to specify TLS protocol version Currently, Mercurial will use TLS 1.0 or newer when connecting to remote servers, selecting the highest TLS version supported by both peers. On older Pythons, only TLS 1.0 is available. On newer Pythons, TLS 1.1 and 1.2 should be available. Security-minded people may want to not take any risks running TLS 1.0 (or even TLS 1.1). This patch gives those people a config option to explicitly control which TLS versions Mercurial should use. By providing this option, one can require newer TLS versions before they are formally deprecated by Mercurial/Python/OpenSSL/etc and lower their security exposure. This option also provides an easy mechanism to change protocol policies in Mercurial. If there is a 0-day and TLS 1.0 is completely broken, we can act quickly without changing much code. Because setting the minimum TLS protocol is something you'll likely want to do globally, this patch introduces a global config option under [hostsecurity] for that purpose. wrapserversocket() has been taught a hidden config option to define the explicit protocol to use. This is queried in this function and not passed as an argument because I don't want to expose this dangerous option as part of the Python API. There is a risk someone could footgun themselves. But the config option is a devel option, has a warning comment, and I doubt most people are using `hg serve` to run a production HTTPS server (I would have something not Mercurial/Python handle TLS). If this is problematic, we can go back to using a custom extension in tests to coerce the server into bad behavior.

Pulkit Goyal - - Load All Authors

File last commit:

r29455:0c741fd6 default


                r29559:7dec5e44

default

Download file

             pycompat.py
        
                    159 lines
            
             | 3.3 KiB
            
                | text/x-python
            
             |
                PythonLexer
            
             / mercurial / pycompat.py
          
                    History
                
                 |
                  Annotation
                 | Raw
                 |Copy content
                 |Copy permalink

      # pycompat.py - portability shim for python 3

      #

      # This software may be used and distributed according to the terms of the

      # GNU General Public License version 2 or any later version.

      """Mercurial portability shim for python 3.

      This contains aliases to hide python version-specific details from the core.

      """

      from __future__ import absolute_import

      try:

          import cPickle as pickle

          pickle.dumps

      except ImportError:

          import pickle

          pickle.dumps # silence pyflakes

      try:

          import httplib

          httplib.HTTPException

      except ImportError:

          import http.client as httplib

          httplib.HTTPException

      try:

          import SocketServer as socketserver

          socketserver.ThreadingMixIn

      except ImportError:

          import socketserver

          socketserver.ThreadingMixIn

      try:

          import xmlrpclib

          xmlrpclib.Transport

      except ImportError:

          import xmlrpc.client as xmlrpclib

          xmlrpclib.Transport

      try:

          import urlparse

          urlparse.urlparse

      except ImportError:

          import urllib.parse as urlparse

          urlparse.urlparse

      try:

          import cStringIO as io

          stringio = io.StringIO

      except ImportError:

          import io

          stringio = io.StringIO

      try:

          import Queue as _queue

          _queue.Queue

      except ImportError:

          import queue as _queue

      empty = _queue.Empty

      queue = _queue.Queue

      class _pycompatstub(object):

          pass

      def _alias(alias, origin, items):

          """ populate a _pycompatstub

          copies items from origin to alias

          """

          def hgcase(item):

              return item.replace('_', '').lower()

          for item in items:

              try:

                  setattr(alias, hgcase(item), getattr(origin, item))

              except AttributeError:

                  pass

      urlreq = _pycompatstub()

      urlerr = _pycompatstub()

      try:

          import urllib2

          import urllib

          _alias(urlreq, urllib, (

              "addclosehook",

              "addinfourl",

              "ftpwrapper",

              "pathname2url",

              "quote",

              "splitattr",

              "splitpasswd",

              "splitport",

              "splituser",

              "unquote",

              "url2pathname",

              "urlencode",

              "urlencode",

          ))

          _alias(urlreq, urllib2, (

              "AbstractHTTPHandler",

              "BaseHandler",

              "build_opener",

              "FileHandler",

              "FTPHandler",

              "HTTPBasicAuthHandler",

              "HTTPDigestAuthHandler",

              "HTTPHandler",

              "HTTPPasswordMgrWithDefaultRealm",

              "HTTPSHandler",

              "install_opener",

              "ProxyHandler",

              "Request",

              "urlopen",

          ))

          _alias(urlerr, urllib2, (

              "HTTPError",

              "URLError",

          ))

      except ImportError:

          import urllib.request

          _alias(urlreq, urllib.request, (

              "AbstractHTTPHandler",

              "addclosehook",

              "addinfourl",

              "BaseHandler",

              "build_opener",

              "FileHandler",

              "FTPHandler",

              "ftpwrapper",

              "HTTPHandler",

              "HTTPSHandler",

              "install_opener",

              "pathname2url",

              "HTTPBasicAuthHandler",

              "HTTPDigestAuthHandler",

              "HTTPPasswordMgrWithDefaultRealm",

              "ProxyHandler",

              "quote",

              "Request",

              "splitattr",

              "splitpasswd",

              "splitport",

              "splituser",

              "unquote",

              "url2pathname",

              "urlopen",

          ))

          import urllib.error

          _alias(urlerr, urllib.error, (

              "HTTPError",

              "URLError",

          ))

      try:

          xrange

      except NameError:

          import builtins

          builtins.xrange = range

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

				# pycompat.py - portability shim for python 3
				#
				# This software may be used and distributed according to the terms of the
				# GNU General Public License version 2 or any later version.

				"""Mercurial portability shim for python 3.

				This contains aliases to hide python version-specific details from the core.
				"""

				from __future__ import absolute_import

				try:
				import cPickle as pickle
				pickle.dumps
				except ImportError:
				import pickle
				pickle.dumps # silence pyflakes

				try:
				import httplib
				httplib.HTTPException
				except ImportError:
				import http.client as httplib
				httplib.HTTPException

				try:
				import SocketServer as socketserver
				socketserver.ThreadingMixIn
				except ImportError:
				import socketserver
				socketserver.ThreadingMixIn

				try:
				import xmlrpclib
				xmlrpclib.Transport
				except ImportError:
				import xmlrpc.client as xmlrpclib
				xmlrpclib.Transport

				try:
				import urlparse
				urlparse.urlparse
				except ImportError:
				import urllib.parse as urlparse
				urlparse.urlparse

				try:
				import cStringIO as io
				stringio = io.StringIO
				except ImportError:
				import io
				stringio = io.StringIO

				try:
				import Queue as _queue
				_queue.Queue
				except ImportError:
				import queue as _queue
				empty = _queue.Empty
				queue = _queue.Queue

				class _pycompatstub(object):
				pass

				def _alias(alias, origin, items):
				""" populate a _pycompatstub

				copies items from origin to alias
				"""
				def hgcase(item):
				return item.replace('_', '').lower()
				for item in items:
				try:
				setattr(alias, hgcase(item), getattr(origin, item))
				except AttributeError:
				pass

				urlreq = _pycompatstub()
				urlerr = _pycompatstub()
				try:
				import urllib2
				import urllib
				_alias(urlreq, urllib, (
				"addclosehook",
				"addinfourl",
				"ftpwrapper",
				"pathname2url",
				"quote",
				"splitattr",
				"splitpasswd",
				"splitport",
				"splituser",
				"unquote",
				"url2pathname",
				"urlencode",
				"urlencode",
				))
				_alias(urlreq, urllib2, (
				"AbstractHTTPHandler",
				"BaseHandler",
				"build_opener",
				"FileHandler",
				"FTPHandler",
				"HTTPBasicAuthHandler",
				"HTTPDigestAuthHandler",
				"HTTPHandler",
				"HTTPPasswordMgrWithDefaultRealm",
				"HTTPSHandler",
				"install_opener",
				"ProxyHandler",
				"Request",
				"urlopen",
				))
				_alias(urlerr, urllib2, (
				"HTTPError",
				"URLError",
				))

				except ImportError:
				import urllib.request
				_alias(urlreq, urllib.request, (
				"AbstractHTTPHandler",
				"addclosehook",
				"addinfourl",
				"BaseHandler",
				"build_opener",
				"FileHandler",
				"FTPHandler",
				"ftpwrapper",
				"HTTPHandler",
				"HTTPSHandler",
				"install_opener",
				"pathname2url",
				"HTTPBasicAuthHandler",
				"HTTPDigestAuthHandler",
				"HTTPPasswordMgrWithDefaultRealm",
				"ProxyHandler",
				"quote",
				"Request",
				"splitattr",
				"splitpasswd",
				"splitport",
				"splituser",
				"unquote",
				"url2pathname",
				"urlopen",
				))
				import urllib.error
				_alias(urlerr, urllib.error, (
				"HTTPError",
				"URLError",
				))

				try:
				xrange
				except NameError:
				import builtins
				builtins.xrange = range