This is an archive of the discontinued Mercurial Phabricator instance.

Differential D9390

errors: introduce SecurityError and use it in a few places
ClosedPublic

Authored by martinvonz on Nov 24 2020, 1:05 PM.

Details

Reviewers
mharbison72
Group Reviewers
hg-reviewers
Commits
rHG8f50dc096cf4: errors: introduce SecurityError and use it in a few places
Summary

This is part of
https://www.mercurial-scm.org/wiki/ErrorCategoriesPlan. There are
perhaps more errors in sslutil.py that should raise SecurityError;
I picked the most clear ones to start with.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Revision Contents
Changeset List

PathPackages
Mmercurial/error.py (8 lines)
Mmercurial/scmutil.py (2 lines)
Mmercurial/sslutil.py (12 lines)
Mtests/test-https.t (12 lines)
Mtests/test-patchbomb-tls.t (2 lines)

Diff 23675

mercurial/error.py

class CanceledError(Abort): class CanceledError(Abort):
"""Indicates that the user canceled the operation. """Indicates that the user canceled the operation.
Examples: Close commit editor with error status, quit chistedit. Examples: Close commit editor with error status, quit chistedit.
""" """
class SecurityError(Abort):
"""Indicates that some aspect of security failed.
Examples: Bad server credentials, expired local credentials for network
filesystem, mismatched GPG signature, DoS protection.
"""
class HookLoadError(Abort): class HookLoadError(Abort):
"""raised when loading a hook fails, aborting an operation """raised when loading a hook fails, aborting an operation
Exists to allow more specialized catching.""" Exists to allow more specialized catching."""
class HookAbort(Abort): class HookAbort(Abort):
"""raised when a validation hook fails, aborting an operation """raised when a validation hook fails, aborting an operation

mercurial/scmutil.py

ui.error(_(b"abort: working directory revision cannot be specified\n")) ui.error(_(b"abort: working directory revision cannot be specified\n"))
except error.Abort as inst: except error.Abort as inst:
if isinstance(inst, (error.InputError, error.ParseError)): if isinstance(inst, (error.InputError, error.ParseError)):
detailed_exit_code = 10 detailed_exit_code = 10
elif isinstance(inst, error.StateError): elif isinstance(inst, error.StateError):
detailed_exit_code = 20 detailed_exit_code = 20
elif isinstance(inst, error.ConfigError): elif isinstance(inst, error.ConfigError):
detailed_exit_code = 30 detailed_exit_code = 30
elif isinstance(inst, error.SecurityError):
detailed_exit_code = 150
elif isinstance(inst, error.CanceledError): elif isinstance(inst, error.CanceledError):
detailed_exit_code = 250 detailed_exit_code = 250
ui.error(inst.format()) ui.error(inst.format())
except error.WorkerError as inst: except error.WorkerError as inst:
# Don't print a message -- the worker already should have # Don't print a message -- the worker already should have
return inst.status_code return inst.status_code
except ImportError as inst: except ImportError as inst:
ui.error(_(b"abort: %s\n") % stringutil.forcebytestr(inst)) ui.error(_(b"abort: %s\n") % stringutil.forcebytestr(inst))

mercurial/sslutil.py

) )
) )
raise raise
# check if wrap_socket failed silently because socket had been # check if wrap_socket failed silently because socket had been
# closed # closed
# - see http://bugs.python.org/issue13721 # - see http://bugs.python.org/issue13721
if not sslsocket.cipher(): if not sslsocket.cipher():
raise error.Abort(_(b'ssl connection failed')) raise error.SecurityError(_(b'ssl connection failed'))
sslsocket._hgstate = { sslsocket._hgstate = {
b'caloaded': caloaded, b'caloaded': caloaded,
b'hostname': serverhostname, b'hostname': serverhostname,
b'settings': settings, b'settings': settings,
b'ui': ui, b'ui': ui,
} }
host = pycompat.bytesurl(shost) host = pycompat.bytesurl(shost)
ui = sock._hgstate[b'ui'] ui = sock._hgstate[b'ui']
settings = sock._hgstate[b'settings'] settings = sock._hgstate[b'settings']
try: try:
peercert = sock.getpeercert(True) peercert = sock.getpeercert(True)
peercert2 = sock.getpeercert() peercert2 = sock.getpeercert()
except AttributeError: except AttributeError:
raise error.Abort(_(b'%s ssl connection error') % host) raise error.SecurityError(_(b'%s ssl connection error') % host)
if not peercert: if not peercert:
raise error.Abort( raise error.SecurityError(
_(b'%s certificate error: no certificate received') % host _(b'%s certificate error: no certificate received') % host
) )
if settings[b'disablecertverification']: if settings[b'disablecertverification']:
# We don't print the certificate fingerprint because it shouldn't # We don't print the certificate fingerprint because it shouldn't
# be necessary: if the user requested certificate verification be # be necessary: if the user requested certificate verification be
# disabled, they presumably already saw a message about the inability # disabled, they presumably already saw a message about the inability
# to verify the certificate and this message would have printed the # to verify the certificate and this message would have printed the
# Pinned fingerprint didn't match. This is a fatal error. # Pinned fingerprint didn't match. This is a fatal error.
if settings[b'legacyfingerprint']: if settings[b'legacyfingerprint']:
section = b'hostfingerprint' section = b'hostfingerprint'
nice = fmtfingerprint(peerfingerprints[b'sha1']) nice = fmtfingerprint(peerfingerprints[b'sha1'])
else: else:
section = b'hostsecurity' section = b'hostsecurity'
nice = b'%s:%s' % (hash, fmtfingerprint(peerfingerprints[hash])) nice = b'%s:%s' % (hash, fmtfingerprint(peerfingerprints[hash]))
raise error.Abort( raise error.SecurityError(
_(b'certificate for %s has unexpected fingerprint %s') _(b'certificate for %s has unexpected fingerprint %s')
% (host, nice), % (host, nice),
hint=_(b'check %s configuration') % section, hint=_(b'check %s configuration') % section,
) )
# Security is enabled but no CAs are loaded. We can't establish trust # Security is enabled but no CAs are loaded. We can't establish trust
# for the cert so abort. # for the cert so abort.
if not sock._hgstate[b'caloaded']: if not sock._hgstate[b'caloaded']:
raise error.Abort( raise error.SecurityError(
_( _(
b'unable to verify security of %s (no loaded CA certificates); ' b'unable to verify security of %s (no loaded CA certificates); '
b'refusing to connect' b'refusing to connect'
) )
% host, % host,
hint=_( hint=_(
b'see https://mercurial-scm.org/wiki/SecureConnections for ' b'see https://mercurial-scm.org/wiki/SecureConnections for '
b'how to configure Mercurial to avoid this error or set ' b'how to configure Mercurial to avoid this error or set '
b'hostsecurity.%s:fingerprints=%s to trust this server' b'hostsecurity.%s:fingerprints=%s to trust this server'
) )
% (host, nicefingerprint), % (host, nicefingerprint),
) )
msg = _verifycert(peercert2, shost) msg = _verifycert(peercert2, shost)
if msg: if msg:
raise error.Abort( raise error.SecurityError(
_(b'%s certificate error: %s') % (host, msg), _(b'%s certificate error: %s') % (host, msg),
hint=_( hint=_(
b'set hostsecurity.%s:certfingerprints=%s ' b'set hostsecurity.%s:certfingerprints=%s '
b'config setting or use --insecure to connect ' b'config setting or use --insecure to connect '
b'insecurely' b'insecurely'
) )
% (host, nicefingerprint), % (host, nicefingerprint),
) )

tests/test-https.t

$ DISABLECACERTS="--config devel.disableloaddefaultcerts=true" $ DISABLECACERTS="--config devel.disableloaddefaultcerts=true"
Inability to verify peer certificate will result in abort Inability to verify peer certificate will result in abort
$ hg clone https://localhost:$HGPORT/ copy-pull $DISABLECACERTS $ hg clone https://localhost:$HGPORT/ copy-pull $DISABLECACERTS
abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect
(see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server) (see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server)
[255] [150]
$ hg clone --insecure https://localhost:$HGPORT/ copy-pull $ hg clone --insecure https://localhost:$HGPORT/ copy-pull
warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering
requesting all changes requesting all changes
adding changesets adding changesets
adding manifests adding manifests
adding file changes adding file changes
added 1 changesets with 4 changes to 4 files added 1 changesets with 4 changes to 4 files
$ cat >> .hg/hgrc <<EOF $ cat >> .hg/hgrc <<EOF
> [hooks] > [hooks]
> changegroup = sh -c "printenv.py --line changegroup" > changegroup = sh -c "printenv.py --line changegroup"
> EOF > EOF
$ hg pull $DISABLECACERTS $ hg pull $DISABLECACERTS
pulling from https://localhost:$HGPORT/ pulling from https://localhost:$HGPORT/
abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect
(see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server) (see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server)
[255] [150]
$ hg pull --insecure $ hg pull --insecure
pulling from https://localhost:$HGPORT/ pulling from https://localhost:$HGPORT/
warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering
searching for changes searching for changes
adding changesets adding changesets
adding manifests adding manifests
adding file changes adding file changes
cacert mismatch cacert mismatch
$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub.pem" \ $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub.pem" \
> https://$LOCALIP:$HGPORT/ > https://$LOCALIP:$HGPORT/
pulling from https://*:$HGPORT/ (glob) pulling from https://*:$HGPORT/ (glob)
abort: $LOCALIP certificate error: certificate is for localhost (glob) abort: $LOCALIP certificate error: certificate is for localhost (glob)
(set hostsecurity.$LOCALIP:certfingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e config setting or use --insecure to connect insecurely) (set hostsecurity.$LOCALIP:certfingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e config setting or use --insecure to connect insecurely)
[255] [150]
$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub.pem" \ $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub.pem" \
> https://$LOCALIP:$HGPORT/ --insecure > https://$LOCALIP:$HGPORT/ --insecure
pulling from https://*:$HGPORT/ (glob) pulling from https://*:$HGPORT/ (glob)
warning: connection security to $LOCALIP is disabled per current settings; communication is susceptible to eavesdropping and tampering (glob) warning: connection security to $LOCALIP is disabled per current settings; communication is susceptible to eavesdropping and tampering (glob)
searching for changes searching for changes
no changes found no changes found
$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-other.pem" $ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-other.pem"
pulling from https://localhost:$HGPORT/ pulling from https://localhost:$HGPORT/
$ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03' -R copy-pull id https://localhost:$HGPORT/ $ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03' -R copy-pull id https://localhost:$HGPORT/
5fed3813f7f5 5fed3813f7f5
- multiple fingerprints specified and none match - multiple fingerprints specified and none match
$ hg --config 'hostfingerprints.localhost=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ --insecure $ hg --config 'hostfingerprints.localhost=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ --insecure
abort: certificate for localhost has unexpected fingerprint ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03 abort: certificate for localhost has unexpected fingerprint ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03
(check hostfingerprint configuration) (check hostfingerprint configuration)
[255] [150]
$ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ $ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/
abort: certificate for localhost has unexpected fingerprint sha1:ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03 abort: certificate for localhost has unexpected fingerprint sha1:ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03
(check hostsecurity configuration) (check hostsecurity configuration)
[255] [150]
- fails when cert doesn't match hostname (port is ignored) - fails when cert doesn't match hostname (port is ignored)
$ hg -R copy-pull id https://localhost:$HGPORT1/ --config hostfingerprints.localhost=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 $ hg -R copy-pull id https://localhost:$HGPORT1/ --config hostfingerprints.localhost=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03
abort: certificate for localhost has unexpected fingerprint f4:2f:5a:0c:3e:52:5b:db:e7:24:a8:32:1d:18:97:6d:69:b5:87:84 abort: certificate for localhost has unexpected fingerprint f4:2f:5a:0c:3e:52:5b:db:e7:24:a8:32:1d:18:97:6d:69:b5:87:84
(check hostfingerprint configuration) (check hostfingerprint configuration)
[255] [150]
- ignores that certificate doesn't match hostname - ignores that certificate doesn't match hostname
$ hg -R copy-pull id https://$LOCALIP:$HGPORT/ --config hostfingerprints.$LOCALIP=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03 $ hg -R copy-pull id https://$LOCALIP:$HGPORT/ --config hostfingerprints.$LOCALIP=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03
(SHA-1 fingerprint for $LOCALIP found in legacy [hostfingerprints] section; if you trust this fingerprint, remove the old SHA-1 fingerprint from [hostfingerprints] and add the following entry to the new [hostsecurity] section: $LOCALIP:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e) (SHA-1 fingerprint for $LOCALIP found in legacy [hostfingerprints] section; if you trust this fingerprint, remove the old SHA-1 fingerprint from [hostfingerprints] and add the following entry to the new [hostsecurity] section: $LOCALIP:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e)
5fed3813f7f5 5fed3813f7f5
Ports used by next test. Kill servers. Ports used by next test. Kill servers.

tests/test-patchbomb-tls.t

this patch series consists of 1 patches. this patch series consists of 1 patches.
(using smtps) (using smtps)
sending mail: smtp host localhost, port * (glob) sending mail: smtp host localhost, port * (glob)
(verifying remote certificate) (verifying remote certificate)
abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect
(see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server) (see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server)
[255] [150]
With global certificates: With global certificates:
$ try --debug --config web.cacerts="$CERTSDIR/pub.pem" $ try --debug --config web.cacerts="$CERTSDIR/pub.pem"
this patch series consists of 1 patches. this patch series consists of 1 patches.
(using smtps) (using smtps)