This is an archive of the discontinued Mercurial Phabricator instance.

Differential D9390

errors: introduce SecurityError and use it in a few places
ClosedPublic

Authored by martinvonz on Nov 24 2020, 1:05 PM.

Download Raw Diff

Details

Reviewers

mharbison72

Group Reviewers

hg-reviewers

Commits

rHG8f50dc096cf4: errors: introduce SecurityError and use it in a few places

Summary

This is part of
https://www.mercurial-scm.org/wiki/ErrorCategoriesPlan. There are
perhaps more errors in sslutil.py that should raise SecurityError;
I picked the most clear ones to start with.

Diff Detail

Repository

rHG Mercurial

Lint

Automatic diff as part of commit; lint not applicable.

Unit

Automatic diff as part of commit; unit tests not applicable.

Event Timeline

martinvonz created this revision.Nov 24 2020, 1:05 PM

Herald added a reviewer: hg-reviewers. · View Herald TranscriptNov 24 2020, 1:05 PM

Herald added a subscriber: mercurial-patches. · View Herald Transcript

martinvonz added a child revision: D9391: errors: raise StateError when push fails because it creates new heads.Nov 24 2020, 1:05 PM

mharbison72 accepted this revision.Nov 25 2020, 4:51 PM

This revision is now accepted and ready to land.Nov 25 2020, 4:51 PM

martinvonz added a commit: rHG8f50dc096cf4: errors: introduce SecurityError and use it in a few places.Nov 25 2020, 4:57 PM

Closed by commit rHG8f50dc096cf4: errors: introduce SecurityError and use it in a few places (authored by martinvonz). · Explain Why

This revision was automatically updated to reflect the committed changes.

martinvonz removed a child revision: D9391: errors: raise StateError when push fails because it creates new heads.Dec 14 2020, 4:31 PM

Revision Contents
Changeset List

			Path	Packages
M			mercurial/error.py (8 lines)
M			mercurial/scmutil.py (2 lines)
M			mercurial/sslutil.py (12 lines)
M			tests/test-https.t (12 lines)
M			tests/test-patchbomb-tls.t (2 lines)

Status	Author	Revision
Closed	martinvonz	D9393 errors: raise StateError on uncommitted changes when merge starts
Closed	martinvonz	D9392 errors: raise StateError when there are unresolves merge conflicts
Closed	martinvonz	D9602 errors: raise InputError on recursive template definition
Closed	martinvonz	D9391 errors: raise StateError when push fails because it creates new heads
Closed	martinvonz	D9390 errors: introduce SecurityError and use it in a few places
Closed	martinvonz	D9389 errors: raise InputError when too few arguments given to alias
Closed	martinvonz	D9388 errors: raise InputError on bad top-level flags
Closed	martinvonz	D9387 errors: raise InputError on early parse error in dispatch
Closed	martinvonz	D9386 errors: raise more specifc errors from narrowcommands
Closed	martinvonz	D9601 errors: use detailed exit code 50 for StorageError
Closed	martinvonz	D9600 errors: raise InputError if an ambiguous revision id prefix is used
Closed	martinvonz	D9599 localrepo: delete obsolete comment about `prefix in repo` raising exception

Diff 23675

mercurial/error.py


	class CanceledError(Abort):			class CanceledError(Abort):
	"""Indicates that the user canceled the operation.			"""Indicates that the user canceled the operation.

	Examples: Close commit editor with error status, quit chistedit.			Examples: Close commit editor with error status, quit chistedit.
	"""			"""


				class SecurityError(Abort):
				"""Indicates that some aspect of security failed.

				Examples: Bad server credentials, expired local credentials for network
				filesystem, mismatched GPG signature, DoS protection.
				"""


	class HookLoadError(Abort):			class HookLoadError(Abort):
	"""raised when loading a hook fails, aborting an operation			"""raised when loading a hook fails, aborting an operation

	Exists to allow more specialized catching."""			Exists to allow more specialized catching."""


	class HookAbort(Abort):			class HookAbort(Abort):
	"""raised when a validation hook fails, aborting an operation			"""raised when a validation hook fails, aborting an operation

mercurial/scmutil.py

	ui.error(_(b"abort: working directory revision cannot be specified\n"))			ui.error(_(b"abort: working directory revision cannot be specified\n"))
	except error.Abort as inst:			except error.Abort as inst:
	if isinstance(inst, (error.InputError, error.ParseError)):			if isinstance(inst, (error.InputError, error.ParseError)):
	detailed_exit_code = 10			detailed_exit_code = 10
	elif isinstance(inst, error.StateError):			elif isinstance(inst, error.StateError):
	detailed_exit_code = 20			detailed_exit_code = 20
	elif isinstance(inst, error.ConfigError):			elif isinstance(inst, error.ConfigError):
	detailed_exit_code = 30			detailed_exit_code = 30
				elif isinstance(inst, error.SecurityError):
				detailed_exit_code = 150
	elif isinstance(inst, error.CanceledError):			elif isinstance(inst, error.CanceledError):
	detailed_exit_code = 250			detailed_exit_code = 250
	ui.error(inst.format())			ui.error(inst.format())
	except error.WorkerError as inst:			except error.WorkerError as inst:
	# Don't print a message -- the worker already should have			# Don't print a message -- the worker already should have
	return inst.status_code			return inst.status_code
	except ImportError as inst:			except ImportError as inst:
	ui.error(_(b"abort: %s\n") % stringutil.forcebytestr(inst))			ui.error(_(b"abort: %s\n") % stringutil.forcebytestr(inst))

mercurial/sslutil.py

	)			)
	)			)
	raise			raise

	# check if wrap_socket failed silently because socket had been			# check if wrap_socket failed silently because socket had been
	# closed			# closed
	# - see http://bugs.python.org/issue13721			# - see http://bugs.python.org/issue13721
	if not sslsocket.cipher():			if not sslsocket.cipher():
	raise error.Abort(_(b'ssl connection failed'))			raise error.SecurityError(_(b'ssl connection failed'))

	sslsocket._hgstate = {			sslsocket._hgstate = {
	b'caloaded': caloaded,			b'caloaded': caloaded,
	b'hostname': serverhostname,			b'hostname': serverhostname,
	b'settings': settings,			b'settings': settings,
	b'ui': ui,			b'ui': ui,
	}			}

	host = pycompat.bytesurl(shost)			host = pycompat.bytesurl(shost)
	ui = sock._hgstate[b'ui']			ui = sock._hgstate[b'ui']
	settings = sock._hgstate[b'settings']			settings = sock._hgstate[b'settings']

	try:			try:
	peercert = sock.getpeercert(True)			peercert = sock.getpeercert(True)
	peercert2 = sock.getpeercert()			peercert2 = sock.getpeercert()
	except AttributeError:			except AttributeError:
	raise error.Abort(_(b'%s ssl connection error') % host)			raise error.SecurityError(_(b'%s ssl connection error') % host)

	if not peercert:			if not peercert:
	raise error.Abort(			raise error.SecurityError(
	_(b'%s certificate error: no certificate received') % host			_(b'%s certificate error: no certificate received') % host
	)			)

	if settings[b'disablecertverification']:			if settings[b'disablecertverification']:
	# We don't print the certificate fingerprint because it shouldn't			# We don't print the certificate fingerprint because it shouldn't
	# be necessary: if the user requested certificate verification be			# be necessary: if the user requested certificate verification be
	# disabled, they presumably already saw a message about the inability			# disabled, they presumably already saw a message about the inability
	# to verify the certificate and this message would have printed the			# to verify the certificate and this message would have printed the

	# Pinned fingerprint didn't match. This is a fatal error.			# Pinned fingerprint didn't match. This is a fatal error.
	if settings[b'legacyfingerprint']:			if settings[b'legacyfingerprint']:
	section = b'hostfingerprint'			section = b'hostfingerprint'
	nice = fmtfingerprint(peerfingerprints[b'sha1'])			nice = fmtfingerprint(peerfingerprints[b'sha1'])
	else:			else:
	section = b'hostsecurity'			section = b'hostsecurity'
	nice = b'%s:%s' % (hash, fmtfingerprint(peerfingerprints[hash]))			nice = b'%s:%s' % (hash, fmtfingerprint(peerfingerprints[hash]))
	raise error.Abort(			raise error.SecurityError(
	_(b'certificate for %s has unexpected fingerprint %s')			_(b'certificate for %s has unexpected fingerprint %s')
	% (host, nice),			% (host, nice),
	hint=_(b'check %s configuration') % section,			hint=_(b'check %s configuration') % section,
	)			)

	# Security is enabled but no CAs are loaded. We can't establish trust			# Security is enabled but no CAs are loaded. We can't establish trust
	# for the cert so abort.			# for the cert so abort.
	if not sock._hgstate[b'caloaded']:			if not sock._hgstate[b'caloaded']:
	raise error.Abort(			raise error.SecurityError(
	_(			_(
	b'unable to verify security of %s (no loaded CA certificates); '			b'unable to verify security of %s (no loaded CA certificates); '
	b'refusing to connect'			b'refusing to connect'
	)			)
	% host,			% host,
	hint=_(			hint=_(
	b'see https://mercurial-scm.org/wiki/SecureConnections for '			b'see https://mercurial-scm.org/wiki/SecureConnections for '
	b'how to configure Mercurial to avoid this error or set '			b'how to configure Mercurial to avoid this error or set '
	b'hostsecurity.%s:fingerprints=%s to trust this server'			b'hostsecurity.%s:fingerprints=%s to trust this server'
	)			)
	% (host, nicefingerprint),			% (host, nicefingerprint),
	)			)

	msg = _verifycert(peercert2, shost)			msg = _verifycert(peercert2, shost)
	if msg:			if msg:
	raise error.Abort(			raise error.SecurityError(
	_(b'%s certificate error: %s') % (host, msg),			_(b'%s certificate error: %s') % (host, msg),
	hint=_(			hint=_(
	b'set hostsecurity.%s:certfingerprints=%s '			b'set hostsecurity.%s:certfingerprints=%s '
	b'config setting or use --insecure to connect '			b'config setting or use --insecure to connect '
	b'insecurely'			b'insecurely'
	)			)
	% (host, nicefingerprint),			% (host, nicefingerprint),
	)			)

tests/test-https.t


	$ DISABLECACERTS="--config devel.disableloaddefaultcerts=true"			$ DISABLECACERTS="--config devel.disableloaddefaultcerts=true"

	Inability to verify peer certificate will result in abort			Inability to verify peer certificate will result in abort

	$ hg clone https://localhost:$HGPORT/ copy-pull $DISABLECACERTS			$ hg clone https://localhost:$HGPORT/ copy-pull $DISABLECACERTS
	abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect			abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect
	(see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server)			(see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server)
	[255]			[150]

	$ hg clone --insecure https://localhost:$HGPORT/ copy-pull			$ hg clone --insecure https://localhost:$HGPORT/ copy-pull
	warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering			warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering
	requesting all changes			requesting all changes
	adding changesets			adding changesets
	adding manifests			adding manifests
	adding file changes			adding file changes
	added 1 changesets with 4 changes to 4 files			added 1 changesets with 4 changes to 4 files
	$ cat >> .hg/hgrc <<EOF			$ cat >> .hg/hgrc <<EOF
	> [hooks]			> [hooks]
	> changegroup = sh -c "printenv.py --line changegroup"			> changegroup = sh -c "printenv.py --line changegroup"
	> EOF			> EOF
	$ hg pull $DISABLECACERTS			$ hg pull $DISABLECACERTS
	pulling from https://localhost:$HGPORT/			pulling from https://localhost:$HGPORT/
	abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect			abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect
	(see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server)			(see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server)
	[255]			[150]

	$ hg pull --insecure			$ hg pull --insecure
	pulling from https://localhost:$HGPORT/			pulling from https://localhost:$HGPORT/
	warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering			warning: connection security to localhost is disabled per current settings; communication is susceptible to eavesdropping and tampering
	searching for changes			searching for changes
	adding changesets			adding changesets
	adding manifests			adding manifests
	adding file changes			adding file changes

	cacert mismatch			cacert mismatch

	$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub.pem" \			$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub.pem" \
	> https://$LOCALIP:$HGPORT/			> https://$LOCALIP:$HGPORT/
	pulling from https://*:$HGPORT/ (glob)			pulling from https://*:$HGPORT/ (glob)
	abort: $LOCALIP certificate error: certificate is for localhost (glob)			abort: $LOCALIP certificate error: certificate is for localhost (glob)
	(set hostsecurity.$LOCALIP:certfingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e config setting or use --insecure to connect insecurely)			(set hostsecurity.$LOCALIP:certfingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e config setting or use --insecure to connect insecurely)
	[255]			[150]
	$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub.pem" \			$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub.pem" \
	> https://$LOCALIP:$HGPORT/ --insecure			> https://$LOCALIP:$HGPORT/ --insecure
	pulling from https://*:$HGPORT/ (glob)			pulling from https://*:$HGPORT/ (glob)
	warning: connection security to $LOCALIP is disabled per current settings; communication is susceptible to eavesdropping and tampering (glob)			warning: connection security to $LOCALIP is disabled per current settings; communication is susceptible to eavesdropping and tampering (glob)
	searching for changes			searching for changes
	no changes found			no changes found
	$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-other.pem"			$ hg -R copy-pull pull --config web.cacerts="$CERTSDIR/pub-other.pem"
	pulling from https://localhost:$HGPORT/			pulling from https://localhost:$HGPORT/
	$ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03' -R copy-pull id https://localhost:$HGPORT/			$ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03' -R copy-pull id https://localhost:$HGPORT/
	5fed3813f7f5			5fed3813f7f5

	- multiple fingerprints specified and none match			- multiple fingerprints specified and none match

	$ hg --config 'hostfingerprints.localhost=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ --insecure			$ hg --config 'hostfingerprints.localhost=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/ --insecure
	abort: certificate for localhost has unexpected fingerprint ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03			abort: certificate for localhost has unexpected fingerprint ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03
	(check hostfingerprint configuration)			(check hostfingerprint configuration)
	[255]			[150]

	$ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/			$ hg --config 'hostsecurity.localhost:fingerprints=sha1:deadbeefdeadbeefdeadbeefdeadbeefdeadbeef, sha1:aeadbeefdeadbeefdeadbeefdeadbeefdeadbeef' -R copy-pull id https://localhost:$HGPORT/
	abort: certificate for localhost has unexpected fingerprint sha1:ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03			abort: certificate for localhost has unexpected fingerprint sha1:ec:d8:7c:d6:b3:86:d0:4f:c1:b8:b4:1c:9d:8f:5e:16:8e:ef:1c:03
	(check hostsecurity configuration)			(check hostsecurity configuration)
	[255]			[150]

	- fails when cert doesn't match hostname (port is ignored)			- fails when cert doesn't match hostname (port is ignored)
	$ hg -R copy-pull id https://localhost:$HGPORT1/ --config hostfingerprints.localhost=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03			$ hg -R copy-pull id https://localhost:$HGPORT1/ --config hostfingerprints.localhost=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03
	abort: certificate for localhost has unexpected fingerprint f4:2f:5a:0c:3e:52:5b:db:e7:24:a8:32:1d:18:97:6d:69:b5:87:84			abort: certificate for localhost has unexpected fingerprint f4:2f:5a:0c:3e:52:5b:db:e7:24:a8:32:1d:18:97:6d:69:b5:87:84
	(check hostfingerprint configuration)			(check hostfingerprint configuration)
	[255]			[150]


	- ignores that certificate doesn't match hostname			- ignores that certificate doesn't match hostname
	$ hg -R copy-pull id https://$LOCALIP:$HGPORT/ --config hostfingerprints.$LOCALIP=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03			$ hg -R copy-pull id https://$LOCALIP:$HGPORT/ --config hostfingerprints.$LOCALIP=ecd87cd6b386d04fc1b8b41c9d8f5e168eef1c03
	(SHA-1 fingerprint for $LOCALIP found in legacy [hostfingerprints] section; if you trust this fingerprint, remove the old SHA-1 fingerprint from [hostfingerprints] and add the following entry to the new [hostsecurity] section: $LOCALIP:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e)			(SHA-1 fingerprint for $LOCALIP found in legacy [hostfingerprints] section; if you trust this fingerprint, remove the old SHA-1 fingerprint from [hostfingerprints] and add the following entry to the new [hostsecurity] section: $LOCALIP:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e)
	5fed3813f7f5			5fed3813f7f5

	Ports used by next test. Kill servers.			Ports used by next test. Kill servers.

tests/test-patchbomb-tls.t

	this patch series consists of 1 patches.			this patch series consists of 1 patches.


	(using smtps)			(using smtps)
	sending mail: smtp host localhost, port * (glob)			sending mail: smtp host localhost, port * (glob)
	(verifying remote certificate)			(verifying remote certificate)
	abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect			abort: unable to verify security of localhost (no loaded CA certificates); refusing to connect
	(see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server)			(see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.localhost:fingerprints=sha256:20:de:b3:ad:b4:cd:a5:42:f0:74:41:1c:a2:70:1e:da:6e:c0:5c:16:9e:e7:22:0f:f1:b7:e5:6e:e4:92:af:7e to trust this server)
	[255]			[150]

	With global certificates:			With global certificates:

	$ try --debug --config web.cacerts="$CERTSDIR/pub.pem"			$ try --debug --config web.cacerts="$CERTSDIR/pub.pem"
	this patch series consists of 1 patches.			this patch series consists of 1 patches.


	(using smtps)			(using smtps)

Diff	ID	Description	Created	Lint	Unit
Base		Base
Diff 1	23648		Nov 24 2020, 1:05 PM	★	★
Diff 2	23675	rHG8f50dc096cf4fc25d510e0e6f503781e6057aa04	Nov 23 2020, 7:20 PM	★	★