( )⚙ D6343 sslutil: add support for SSLKEYLOGFILE to wrapsocket

This is an archive of the discontinued Mercurial Phabricator instance.

Differential D6343

sslutil: add support for SSLKEYLOGFILE to wrapsocket
ClosedPublic

Authored by durin42 on May 4 2019, 11:42 PM.

Details

Reviewers
None
Group Reviewers
hg-reviewers
Commits
rHGc8d55ff80da1: sslutil: add support for SSLKEYLOGFILE to wrapsocket
Summary

I recently learned of a Firefox/Chrome feature that allows
wiresharking otherwise-TLS'd network connections. Gloriously, there's
a pypi module that enables this same feature on Python, so let's add
support for it to Mercurial in case we need to wireshark some HTTPs
connections.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

durin42 created this revision.May 4 2019, 11:42 PM
Closed by commit rHGc8d55ff80da1: sslutil: add support for SSLKEYLOGFILE to wrapsocket (authored by durin42). · Explain WhyMay 10 2019, 12:01 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mmercurial/sslutil.py (12 lines)

Diff 15048

mercurial/sslutil.py

import hashlib import hashlib
import os import os
import re import re
import ssl import ssl
from .i18n import _ from .i18n import _
from . import ( from . import (
encoding,
error, error,
node, node,
pycompat, pycompat,
util, util,
) )
from .utils import ( from .utils import (
procutil, procutil,
stringutil, stringutil,
* serverhostname - The expected hostname of the remote server. If the * serverhostname - The expected hostname of the remote server. If the
server (and client) support SNI, this tells the server which certificate server (and client) support SNI, this tells the server which certificate
to use. to use.
""" """
if not serverhostname: if not serverhostname:
raise error.Abort(_('serverhostname argument is required')) raise error.Abort(_('serverhostname argument is required'))
if b'SSLKEYLOGFILE' in encoding.environ:
try:
import sslkeylog
sslkeylog.set_keylog(pycompat.fsdecode(
encoding.environ[b'SSLKEYLOGFILE']))
ui.warn(
b'sslkeylog enabled by SSLKEYLOGFILE environment variable\n')
except ImportError:
ui.warn(b'sslkeylog module missing, '
b'but SSLKEYLOGFILE set in environment\n')
for f in (keyfile, certfile): for f in (keyfile, certfile):
if f and not os.path.exists(f): if f and not os.path.exists(f):
raise error.Abort( raise error.Abort(
_('certificate file (%s) does not exist; cannot connect to %s') _('certificate file (%s) does not exist; cannot connect to %s')
% (f, pycompat.bytesurl(serverhostname)), % (f, pycompat.bytesurl(serverhostname)),
hint=_('restore missing file or fix references ' hint=_('restore missing file or fix references '
'in Mercurial config')) 'in Mercurial config'))