upstream/mercurial-mirror Files · mercurial/scmwindows.py

sslutil: config option to specify TLS protocol version...

sslutil: config option to specify TLS protocol version Currently, Mercurial will use TLS 1.0 or newer when connecting to remote servers, selecting the highest TLS version supported by both peers. On older Pythons, only TLS 1.0 is available. On newer Pythons, TLS 1.1 and 1.2 should be available. Security-minded people may want to not take any risks running TLS 1.0 (or even TLS 1.1). This patch gives those people a config option to explicitly control which TLS versions Mercurial should use. By providing this option, one can require newer TLS versions before they are formally deprecated by Mercurial/Python/OpenSSL/etc and lower their security exposure. This option also provides an easy mechanism to change protocol policies in Mercurial. If there is a 0-day and TLS 1.0 is completely broken, we can act quickly without changing much code. Because setting the minimum TLS protocol is something you'll likely want to do globally, this patch introduces a global config option under [hostsecurity] for that purpose. wrapserversocket() has been taught a hidden config option to define the explicit protocol to use. This is queried in this function and not passed as an argument because I don't want to expose this dangerous option as part of the Python API. There is a risk someone could footgun themselves. But the config option is a devel option, has a warning comment, and I doubt most people are using `hg serve` to run a production HTTPS server (I would have something not Mercurial/Python handle TLS). If this is problematic, we can go back to using a custom extension in tests to coerce the server into bad behavior.

Gregory Szorc - - Load All Authors

File last commit:

r27481:029f0275 default


                r29559:7dec5e44

default

Download file

             scmwindows.py
        
                    48 lines
            
             | 1.6 KiB
            
                | text/x-python
            
             |
                PythonLexer
            
             / mercurial / scmwindows.py
          
                    History
                
                 |
                  Annotation
                 | Raw
                 |Copy content
                 |Copy permalink

      from __future__ import absolute_import

      import _winreg

      import os

      from . import (

          osutil,

          util,

      )

      def systemrcpath():

          '''return default os-specific hgrc search path'''

          rcpath = []

          filename = util.executablepath()

          # Use mercurial.ini found in directory with hg.exe

          progrc = os.path.join(os.path.dirname(filename), 'mercurial.ini')

          rcpath.append(progrc)

          # Use hgrc.d found in directory with hg.exe

          progrcd = os.path.join(os.path.dirname(filename), 'hgrc.d')

          if os.path.isdir(progrcd):

              for f, kind in osutil.listdir(progrcd):

                  if f.endswith('.rc'):

                      rcpath.append(os.path.join(progrcd, f))

          # else look for a system rcpath in the registry

          value = util.lookupreg('SOFTWARE\\Mercurial', None,

                                 _winreg.HKEY_LOCAL_MACHINE)

          if not isinstance(value, str) or not value:

              return rcpath

          value = util.localpath(value)

          for p in value.split(os.pathsep):

              if p.lower().endswith('mercurial.ini'):

                  rcpath.append(p)

              elif os.path.isdir(p):

                  for f, kind in osutil.listdir(p):

                      if f.endswith('.rc'):

                          rcpath.append(os.path.join(p, f))

          return rcpath

      def userrcpath():

          '''return os-specific hgrc search path to the user dir'''

          home = os.path.expanduser('~')

          path = [os.path.join(home, 'mercurial.ini'),

                  os.path.join(home, '.hgrc')]

          userprofile = os.environ.get('USERPROFILE')

          if userprofile and userprofile != home:

              path.append(os.path.join(userprofile, 'mercurial.ini'))

              path.append(os.path.join(userprofile, '.hgrc'))

          return path

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

				from __future__ import absolute_import

				import _winreg
				import os

				from . import (
				osutil,
				util,
				)

				def systemrcpath():
				'''return default os-specific hgrc search path'''
				rcpath = []
				filename = util.executablepath()
				# Use mercurial.ini found in directory with hg.exe
				progrc = os.path.join(os.path.dirname(filename), 'mercurial.ini')
				rcpath.append(progrc)
				# Use hgrc.d found in directory with hg.exe
				progrcd = os.path.join(os.path.dirname(filename), 'hgrc.d')
				if os.path.isdir(progrcd):
				for f, kind in osutil.listdir(progrcd):
				if f.endswith('.rc'):
				rcpath.append(os.path.join(progrcd, f))
				# else look for a system rcpath in the registry
				value = util.lookupreg('SOFTWARE\\Mercurial', None,
				_winreg.HKEY_LOCAL_MACHINE)
				if not isinstance(value, str) or not value:
				return rcpath
				value = util.localpath(value)
				for p in value.split(os.pathsep):
				if p.lower().endswith('mercurial.ini'):
				rcpath.append(p)
				elif os.path.isdir(p):
				for f, kind in osutil.listdir(p):
				if f.endswith('.rc'):
				rcpath.append(os.path.join(p, f))
				return rcpath

				def userrcpath():
				'''return os-specific hgrc search path to the user dir'''
				home = os.path.expanduser('~')
				path = [os.path.join(home, 'mercurial.ini'),
				os.path.join(home, '.hgrc')]
				userprofile = os.environ.get('USERPROFILE')
				if userprofile and userprofile != home:
				path.append(os.path.join(userprofile, 'mercurial.ini'))
				path.append(os.path.join(userprofile, '.hgrc'))
				return path