# HG changeset patch
# User Augie Fackler <raf@durin42.com>
# Date 1413925777 14400
# Node ID c289fb3624b89670f159aaabafac399b5516c8cc
# Parent  22db405536beca6cbfbb7e397816b244ea9da101
hgweb: disable SSLv3 serving (BC)

Because of recent attacks[0] on SSLv3, let's just drop support entirely.

0: http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html

diff -r 22db405536be -r c289fb3624b8 mercurial/hgweb/server.py
--- a/mercurial/hgweb/server.py	Tue Oct 21 17:01:23 2014 -0400
+++ b/mercurial/hgweb/server.py	Tue Oct 21 17:09:37 2014 -0400
@@ -208,7 +208,7 @@
             OpenSSL.SSL.Context
         except ImportError:
             raise util.Abort(_("SSL support is unavailable"))
-        ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)
+        ctx = OpenSSL.SSL.Context(OpenSSL.SSL.TLSv1_METHOD)
         ctx.use_privatekey_file(ssl_cert)
         ctx.use_certificate_file(ssl_cert)
         sock = socket.socket(httpserver.address_family, httpserver.socket_type)
@@ -249,8 +249,9 @@
             ssl.wrap_socket
         except ImportError:
             raise util.Abort(_("SSL support is unavailable"))
-        httpserver.socket = ssl.wrap_socket(httpserver.socket, server_side=True,
-            certfile=ssl_cert, ssl_version=ssl.PROTOCOL_SSLv23)
+        httpserver.socket = ssl.wrap_socket(
+            httpserver.socket, server_side=True,
+            certfile=ssl_cert, ssl_version=ssl.PROTOCOL_TLSv1)
 
     def setup(self):
         self.connection = self.request