This is an archive of the discontinued Mercurial Phabricator instance.

Differential D7850

sslutil: migrate to hashutil.sha1 instead of hashlib.sha1
ClosedPublic

Authored by durin42 on Jan 13 2020, 5:48 PM.

Details

Reviewers
indygreg
Group Reviewers
hg-reviewers
Commits
rHGcbc5755df6bf: sslutil: migrate to hashutil.sha1 instead of hashlib.sha1
rHGe5db237545c2: sslutil: migrate to hashutil.sha1 instead of hashlib.sha1
rHGfde05ece875c: sslutil: migrate to hashutil.sha1 instead of hashlib.sha1
Summary

This is a straight-line replacement like the others, but I split it
out since it's used in a network context and I'm not sure this is
appropriate (we should probably drop support for sha1
fingerprints over TLS) and wanted this to be easily dropped.

Diff Detail

Repository
rHG Mercurial
Branch
default
Lint
No Linters Available
Unit
No Unit Test Coverage

Event Timeline

durin42 created this revision.Jan 13 2020, 5:48 PM
indygreg accepted this revision.Jan 13 2020, 11:24 PM
indygreg added a subscriber: indygreg.

Yeah, the new SHA-1 routine probably doesn't matter in this context. And we should probably drop support for SHA-1 certificate fingerprint verification. But consistency in using our SHA-1 wrapper is worth it, IMO.

This revision is now accepted and ready to land.Jan 13 2020, 11:24 PM

Revision Contents
Changeset List

PathPackages
Mmercurial/sslutil.py (3 lines)

Diff 19191

mercurial/sslutil.py

from . import ( from . import (
encoding, encoding,
error, error,
node, node,
pycompat, pycompat,
util, util,
) )
from .utils import ( from .utils import (
hashutil,
resourceutil, resourceutil,
stringutil, stringutil,
) )
# Python 2.7.9+ overhauled the built-in SSL/TLS features of Python. It added # Python 2.7.9+ overhauled the built-in SSL/TLS features of Python. It added
# support for TLS 1.1, TLS 1.2, SNI, system CA stores, etc. These features are # support for TLS 1.1, TLS 1.2, SNI, system CA stores, etc. These features are
# all exposed via the "ssl" module. # all exposed via the "ssl" module.
# #
) )
% host % host
) )
return return
# If a certificate fingerprint is pinned, use it and only it to # If a certificate fingerprint is pinned, use it and only it to
# validate the remote cert. # validate the remote cert.
peerfingerprints = { peerfingerprints = {
b'sha1': node.hex(hashlib.sha1(peercert).digest()), b'sha1': node.hex(hashutil.sha1(peercert).digest()),
b'sha256': node.hex(hashlib.sha256(peercert).digest()), b'sha256': node.hex(hashlib.sha256(peercert).digest()),
b'sha512': node.hex(hashlib.sha512(peercert).digest()), b'sha512': node.hex(hashlib.sha512(peercert).digest()),
} }
def fmtfingerprint(s): def fmtfingerprint(s):
return b':'.join([s[x : x + 2] for x in range(0, len(s), 2)]) return b':'.join([s[x : x + 2] for x in range(0, len(s), 2)])
nicefingerprint = b'sha256:%s' % fmtfingerprint(peerfingerprints[b'sha256']) nicefingerprint = b'sha256:%s' % fmtfingerprint(peerfingerprints[b'sha256'])