| hg-reviewers |
At this point, test-https.t no longer dumps tracebacks
everywhere. Instead, we get some results that look like we're not
adequately finding things in hg's configuration, which should be
manageable (if somewhat annoying to find and fix.)
| Lint Skipped |
| Unit Tests Skipped |
| Path | Packages | |||
|---|---|---|---|---|
| M | mercurial/sslutil.py (16 lines) |
| server (and client) support SNI, this tells the server which certificate | server (and client) support SNI, this tells the server which certificate | ||||
| to use. | to use. | ||||
| """ | """ | ||||
| if not serverhostname: | if not serverhostname: | ||||
| raise error.Abort(_('serverhostname argument is required')) | raise error.Abort(_('serverhostname argument is required')) | ||||
| for f in (keyfile, certfile): | for f in (keyfile, certfile): | ||||
| if f and not os.path.exists(f): | if f and not os.path.exists(f): | ||||
| raise error.Abort(_('certificate file (%s) does not exist; ' | raise error.Abort( | ||||
| 'cannot connect to %s') % (f, serverhostname), | _('certificate file (%s) does not exist; cannot connect to %s') % ( | ||||
| f, pycompat.bytesurl(serverhostname)), | |||||
| hint=_('restore missing file or fix references ' | hint=_('restore missing file or fix references ' | ||||
| 'in Mercurial config')) | 'in Mercurial config')) | ||||
| settings = _hostsettings(ui, serverhostname) | settings = _hostsettings(ui, serverhostname) | ||||
| # We can't use ssl.create_default_context() because it calls | # We can't use ssl.create_default_context() because it calls | ||||
| # load_default_certs() unless CA arguments are passed to it. We want to | # load_default_certs() unless CA arguments are passed to it. We want to | ||||
| # have explicit control over CA loading because implicitly loading | # have explicit control over CA loading because implicitly loading | ||||
| # CAs may undermine the user's intent. For example, a user may define a CA | # CAs may undermine the user's intent. For example, a user may define a CA | ||||
| # bundle with a specific CA cert removed. If the system/default CA bundle | # bundle with a specific CA cert removed. If the system/default CA bundle | ||||
| # is loaded and contains that removed CA, you've just undone the user's | # is loaded and contains that removed CA, you've just undone the user's | ||||
| # choice. | # choice. | ||||
| sslcontext = SSLContext(settings['protocol']) | sslcontext = SSLContext(settings['protocol']) | ||||
| # This is a no-op unless using modern ssl. | # This is a no-op unless using modern ssl. | ||||
| sslcontext.options |= settings['ctxoptions'] | sslcontext.options |= settings['ctxoptions'] | ||||
| # This still works on our fake SSLContext. | # This still works on our fake SSLContext. | ||||
| sslcontext.verify_mode = settings['verifymode'] | sslcontext.verify_mode = settings['verifymode'] | ||||
| if settings['ciphers']: | if settings['ciphers']: | ||||
| try: | try: | ||||
| sslcontext.set_ciphers(pycompat.sysstr(settings['ciphers'])) | sslcontext.set_ciphers(pycompat.sysstr(settings['ciphers'])) | ||||
| except ssl.SSLError as e: | except ssl.SSLError as e: | ||||
| raise error.Abort(_('could not set ciphers: %s') % e.args[0], | raise error.Abort( | ||||
| _('could not set ciphers: %s') % util.forcebytestr(e.args[0]), | |||||
| hint=_('change cipher string (%s) in config') % | hint=_('change cipher string (%s) in config') % | ||||
| settings['ciphers']) | settings['ciphers']) | ||||
| if certfile is not None: | if certfile is not None: | ||||
| def password(): | def password(): | ||||
| f = keyfile or certfile | f = keyfile or certfile | ||||
| return ui.getpass(_('passphrase for %s: ') % f, '') | return ui.getpass(_('passphrase for %s: ') % f, '') | ||||
| sslcontext.load_cert_chain(certfile, keyfile, password) | sslcontext.load_cert_chain(certfile, keyfile, password) | ||||
| if settings['cafile'] is not None: | if settings['cafile'] is not None: | ||||