This is an archive of the discontinued Mercurial Phabricator instance.

Differential D2690

sslutil: some more forcebytes() on some exception messages
ClosedPublic

Authored by durin42 on Mar 4 2018, 9:20 PM.

Details

Reviewers
None
Group Reviewers
hg-reviewers
Commits
rHG4c71a26a4009: sslutil: some more forcebytes() on some exception messages
Summary

At this point, test-https.t no longer dumps tracebacks
everywhere. Instead, we get some results that look like we're not
adequately finding things in hg's configuration, which should be
manageable (if somewhat annoying to find and fix.)

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

durin42 created this revision.Mar 4 2018, 9:20 PM
Closed by commit rHG4c71a26a4009: sslutil: some more forcebytes() on some exception messages (authored by durin42). · Explain WhyMar 6 2018, 4:38 AM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mmercurial/sslutil.py (16 lines)

Diff 6667

mercurial/sslutil.py

server (and client) support SNI, this tells the server which certificate server (and client) support SNI, this tells the server which certificate
to use. to use.
""" """
if not serverhostname: if not serverhostname:
raise error.Abort(_('serverhostname argument is required')) raise error.Abort(_('serverhostname argument is required'))
for f in (keyfile, certfile): for f in (keyfile, certfile):
if f and not os.path.exists(f): if f and not os.path.exists(f):
raise error.Abort(_('certificate file (%s) does not exist; ' raise error.Abort(
'cannot connect to %s') % (f, serverhostname), _('certificate file (%s) does not exist; cannot connect to %s')
% (f, pycompat.bytesurl(serverhostname)),
hint=_('restore missing file or fix references ' hint=_('restore missing file or fix references '
'in Mercurial config')) 'in Mercurial config'))
settings = _hostsettings(ui, serverhostname) settings = _hostsettings(ui, serverhostname)
# We can't use ssl.create_default_context() because it calls # We can't use ssl.create_default_context() because it calls
# load_default_certs() unless CA arguments are passed to it. We want to # load_default_certs() unless CA arguments are passed to it. We want to
# have explicit control over CA loading because implicitly loading # have explicit control over CA loading because implicitly loading
# CAs may undermine the user's intent. For example, a user may define a CA # CAs may undermine the user's intent. For example, a user may define a CA
# bundle with a specific CA cert removed. If the system/default CA bundle # bundle with a specific CA cert removed. If the system/default CA bundle
# is loaded and contains that removed CA, you've just undone the user's # is loaded and contains that removed CA, you've just undone the user's
# choice. # choice.
sslcontext = SSLContext(settings['protocol']) sslcontext = SSLContext(settings['protocol'])
# This is a no-op unless using modern ssl. # This is a no-op unless using modern ssl.
sslcontext.options |= settings['ctxoptions'] sslcontext.options |= settings['ctxoptions']
# This still works on our fake SSLContext. # This still works on our fake SSLContext.
sslcontext.verify_mode = settings['verifymode'] sslcontext.verify_mode = settings['verifymode']
if settings['ciphers']: if settings['ciphers']:
try: try:
sslcontext.set_ciphers(pycompat.sysstr(settings['ciphers'])) sslcontext.set_ciphers(pycompat.sysstr(settings['ciphers']))
except ssl.SSLError as e: except ssl.SSLError as e:
raise error.Abort(_('could not set ciphers: %s') % e.args[0], raise error.Abort(
_('could not set ciphers: %s') % util.forcebytestr(e.args[0]),
hint=_('change cipher string (%s) in config') % hint=_('change cipher string (%s) in config') %
settings['ciphers']) settings['ciphers'])
if certfile is not None: if certfile is not None:
def password(): def password():
f = keyfile or certfile f = keyfile or certfile
return ui.getpass(_('passphrase for %s: ') % f, '') return ui.getpass(_('passphrase for %s: ') % f, '')
sslcontext.load_cert_chain(certfile, keyfile, password) sslcontext.load_cert_chain(certfile, keyfile, password)
if settings['cafile'] is not None: if settings['cafile'] is not None: