( )⚙ D6410 tests: work around libressl being different about error strings (issue6122)

This is an archive of the discontinued Mercurial Phabricator instance.

Differential D6410

tests: work around libressl being different about error strings (issue6122)
ClosedPublic

Authored by durin42 on May 20 2019, 11:46 AM.

Details

Reviewers
pulkit
Group Reviewers
hg-reviewers
Commits
rHGe0ac310bd033: tests: work around libressl being different about error strings (issue6122)
Summary

As far as I can tell, this is the right behavior. Thanks to Alex
Gaynor for checking what the string means by looking at libressl
sources for me.

Diff Detail

Repository
rHG Mercurial
Lint
Lint Skipped
Unit
Unit Tests Skipped

Event Timeline

durin42 created this revision.May 20 2019, 11:46 AM
pulkit accepted this revision.May 20 2019, 5:11 PM
Closed by commit rHGe0ac310bd033: tests: work around libressl being different about error strings (issue6122) (authored by durin42). · Explain WhyMay 20 2019, 5:36 PM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathPackages
Mtests/test-https.t (12 lines)

Diff 15193

tests/test-https.t

5fed3813f7f5 5fed3813f7f5
Clients requiring newer TLS version than what server supports fail Clients requiring newer TLS version than what server supports fail
$ P="$CERTSDIR" hg id https://localhost:$HGPORT/ $ P="$CERTSDIR" hg id https://localhost:$HGPORT/
(could not negotiate a common security protocol (tls1.1+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) (could not negotiate a common security protocol (tls1.1+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support)
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
(see https://mercurial-scm.org/wiki/SecureConnections for more info) (see https://mercurial-scm.org/wiki/SecureConnections for more info)
abort: error: *unsupported protocol* (glob) abort: error: .*(unsupported protocol|wrong ssl version).* (re)
[255] [255]
$ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.1 id https://localhost:$HGPORT/ $ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.1 id https://localhost:$HGPORT/
(could not negotiate a common security protocol (tls1.1+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) (could not negotiate a common security protocol (tls1.1+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support)
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
(see https://mercurial-scm.org/wiki/SecureConnections for more info) (see https://mercurial-scm.org/wiki/SecureConnections for more info)
abort: error: *unsupported protocol* (glob) abort: error: .*(unsupported protocol|wrong ssl version).* (re)
[255] [255]
$ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.2 id https://localhost:$HGPORT/ $ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.2 id https://localhost:$HGPORT/
(could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) (could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support)
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
(see https://mercurial-scm.org/wiki/SecureConnections for more info) (see https://mercurial-scm.org/wiki/SecureConnections for more info)
abort: error: *unsupported protocol* (glob) abort: error: .*(unsupported protocol|wrong ssl version).* (re)
[255] [255]
$ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.2 id https://localhost:$HGPORT1/ $ P="$CERTSDIR" hg --config hostsecurity.minimumprotocol=tls1.2 id https://localhost:$HGPORT1/
(could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) (could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support)
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
(see https://mercurial-scm.org/wiki/SecureConnections for more info) (see https://mercurial-scm.org/wiki/SecureConnections for more info)
abort: error: *unsupported protocol* (glob) abort: error: .*(unsupported protocol|wrong ssl version).* (re)
[255] [255]
--insecure will allow TLS 1.0 connections and override configs --insecure will allow TLS 1.0 connections and override configs
$ hg --config hostsecurity.minimumprotocol=tls1.2 id --insecure https://localhost:$HGPORT1/ $ hg --config hostsecurity.minimumprotocol=tls1.2 id --insecure https://localhost:$HGPORT1/
warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering
5fed3813f7f5 5fed3813f7f5
The per-host config option overrides the default The per-host config option overrides the default
$ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \ $ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \
> --config hostsecurity.minimumprotocol=tls1.2 \ > --config hostsecurity.minimumprotocol=tls1.2 \
> --config hostsecurity.localhost:minimumprotocol=tls1.0 > --config hostsecurity.localhost:minimumprotocol=tls1.0
5fed3813f7f5 5fed3813f7f5
The per-host config option by itself works The per-host config option by itself works
$ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \ $ P="$CERTSDIR" hg id https://localhost:$HGPORT/ \
> --config hostsecurity.localhost:minimumprotocol=tls1.2 > --config hostsecurity.localhost:minimumprotocol=tls1.2
(could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) (could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support)
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
(see https://mercurial-scm.org/wiki/SecureConnections for more info) (see https://mercurial-scm.org/wiki/SecureConnections for more info)
abort: error: *unsupported protocol* (glob) abort: error: .*(unsupported protocol|wrong ssl version).* (re)
[255] [255]
.hg/hgrc file [hostsecurity] settings are applied to remote ui instances (issue5305) .hg/hgrc file [hostsecurity] settings are applied to remote ui instances (issue5305)
$ cat >> copy-pull/.hg/hgrc << EOF $ cat >> copy-pull/.hg/hgrc << EOF
> [hostsecurity] > [hostsecurity]
> localhost:minimumprotocol=tls1.2 > localhost:minimumprotocol=tls1.2
> EOF > EOF
$ P="$CERTSDIR" hg -R copy-pull id https://localhost:$HGPORT/ $ P="$CERTSDIR" hg -R copy-pull id https://localhost:$HGPORT/
(could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support) (could not negotiate a common security protocol (tls1.2+) with localhost; the likely cause is Mercurial is configured to be more secure than the server can support)
(consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server) (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.localhost:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
(see https://mercurial-scm.org/wiki/SecureConnections for more info) (see https://mercurial-scm.org/wiki/SecureConnections for more info)
abort: error: *unsupported protocol* (glob) abort: error: .*(unsupported protocol|wrong ssl version).* (re)
[255] [255]
$ killdaemons.py hg0.pid $ killdaemons.py hg0.pid
$ killdaemons.py hg1.pid $ killdaemons.py hg1.pid
$ killdaemons.py hg2.pid $ killdaemons.py hg2.pid
#endif #endif
Prepare for connecting through proxy Prepare for connecting through proxy