mercurial/error.py

sslutil: abort when unable to verify peer connection (BC)

Previously, when we connected to a server and were unable to verify
its certificate against a trusted certificate authority we would
issue a warning and continue to connect. This is obviously not
great behavior because the x509 certificate model is based upon
trust of specific CAs. Failure to enforce that trust erodes security.
This behavior was defined several years ago when Python did not
support loading the system trusted CA store (Python 2.7.9's
backports of Python 3's improvements to the "ssl" module enabled
this).

This commit changes behavior when connecting to abort if the peer
certificate can't be validated. With an empty/default Mercurial
configuration, the peer certificate can be validated if Python is
able to load the system trusted CA store. Environments able to load
the system trusted CA store include:

* Python 2.7.9+ on most platforms and installations
* Python 2.7 distributions with a modern ssl module (e.g. RHEL7's
  patched 2.7.5 package)
* Python shipped on OS X

Environments unable to load the system trusted CA store include:

* Python 2.6
* Python 2.7 on many existing Linux installs (because they don't
  ship 2.7.9+ or haven't backported modern ssl module)
* Python 2.7.9+ on some installs where Python is unable to locate
  the system CA store (this is hopefully rare)

Users of these Pythongs will need to configure Mercurial to load the
system CA store using web.cacerts. This should ideally be performed
by packagers (by setting web.cacerts in the global/system hgrc file).
Where Mercurial packagers aren't setting this, the linked URL in the
new abort message can contain instructions for users.

In the future, we may want to add more code for finding the system
CA store. For example, many Linux distributions have the CA store
at well-known locations (such as /etc/ssl/certs/ca-certificates.crt
in the case of Ubuntu). This will enable CA loading to "just work"
on more Python configurations and will be best for our users since
they won't have to change anything after upgrading to a Mercurial
with this patch.

We may also want to consider distributing a trusted CA store with
Mercurial. Although we should think long and hard about that because
most systems have a global CA store and Mercurial should almost
certainly use the same store used by everything else on the system.

# error.py - Mercurial exceptions
#
# Copyright 2005-2008 Matt Mackall <[e-mail]>
#
# This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version.

"""Mercurial exceptions.

This allows us to catch exceptions at higher levels without forcing
imports.
"""

from __future__ import absolute_import

# Do not import anything here, please

class HintException(Exception):
    def __init__(self, *args, **kw):
        Exception.__init__(self, *args)
        self.hint = kw.get('hint')

class RevlogError(HintException):
    pass

class FilteredIndexError(IndexError):
    pass

class LookupError(RevlogError, KeyError):
    def __init__(self, name, index, message):
        self.name = name
        self.index = index
        # this can't be called 'message' because at least some installs of
        # Python 2.6+ complain about the 'message' property being deprecated
        self.lookupmessage = message
        if isinstance(name, str) and len(name) == 20:
            from .node import short
            name = short(name)
        RevlogError.__init__(self, '%s@%s: %s' % (index, name, message))

    def __str__(self):
        return RevlogError.__str__(self)

class FilteredLookupError(LookupError):
    pass

class ManifestLookupError(LookupError):
    pass

class CommandError(Exception):
    """Exception raised on errors in parsing the command line."""

class InterventionRequired(HintException):
    """Exception raised when a command requires human intervention."""

class Abort(HintException):
    """Raised if a command needs to print an error and exit."""

class HookLoadError(Abort):
    """raised when loading a hook fails, aborting an operation

    Exists to allow more specialized catching."""

class HookAbort(Abort):
    """raised when a validation hook fails, aborting an operation

    Exists to allow more specialized catching."""

class ConfigError(Abort):
    """Exception raised when parsing config files"""

class UpdateAbort(Abort):
    """Raised when an update is aborted for destination issue"""

class MergeDestAbort(Abort):
    """Raised when an update is aborted for destination issues"""

class NoMergeDestAbort(MergeDestAbort):
    """Raised when an update is aborted because there is nothing to merge"""

class ManyMergeDestAbort(MergeDestAbort):
    """Raised when an update is aborted because destination is ambigious"""

class ResponseExpected(Abort):
    """Raised when an EOF is received for a prompt"""
    def __init__(self):
        from .i18n import _
        Abort.__init__(self, _('response expected'))

class OutOfBandError(HintException):
    """Exception raised when a remote repo reports failure"""

class ParseError(HintException):
    """Raised when parsing config files and {rev,file}sets (msg[, pos])"""

class UnknownIdentifier(ParseError):
    """Exception raised when a {rev,file}set references an unknown identifier"""

    def __init__(self, function, symbols):
        from .i18n import _
        ParseError.__init__(self, _("unknown identifier: %s") % function)
        self.function = function
        self.symbols = symbols

class RepoError(HintException):
    pass

class RepoLookupError(RepoError):
    pass

class FilteredRepoLookupError(RepoLookupError):
    pass

class CapabilityError(RepoError):
    pass

class RequirementError(RepoError):
    """Exception raised if .hg/requires has an unknown entry."""

class UnsupportedMergeRecords(Abort):
    def __init__(self, recordtypes):
        from .i18n import _
        self.recordtypes = sorted(recordtypes)
        s = ' '.join(self.recordtypes)
        Abort.__init__(
            self, _('unsupported merge state records: %s') % s,
            hint=_('see https://mercurial-scm.org/wiki/MergeStateRecords for '
                   'more information'))

class LockError(IOError):
    def __init__(self, errno, strerror, filename, desc):
        IOError.__init__(self, errno, strerror, filename)
        self.desc = desc

class LockHeld(LockError):
    def __init__(self, errno, filename, desc, locker):
        LockError.__init__(self, errno, 'Lock held', filename, desc)
        self.locker = locker

class LockUnavailable(LockError):
    pass

# LockError is for errors while acquiring the lock -- this is unrelated
class LockInheritanceContractViolation(RuntimeError):
    pass

class ResponseError(Exception):
    """Raised to print an error with part of output and exit."""

class UnknownCommand(Exception):
    """Exception raised if command is not in the command table."""

class AmbiguousCommand(Exception):
    """Exception raised if command shortcut matches more than one command."""

# derived from KeyboardInterrupt to simplify some breakout code
class SignalInterrupt(KeyboardInterrupt):
    """Exception raised on SIGTERM and SIGHUP."""

class SignatureError(Exception):
    pass

class PushRaced(RuntimeError):
    """An exception raised during unbundling that indicate a push race"""

# bundle2 related errors
class BundleValueError(ValueError):
    """error raised when bundle2 cannot be processed"""

class BundleUnknownFeatureError(BundleValueError):
    def __init__(self, parttype=None, params=(), values=()):
        self.parttype = parttype
        self.params = params
        self.values = values
        if self.parttype is None:
            msg = 'Stream Parameter'
        else:
            msg = parttype
        entries = self.params
        if self.params and self.values:
            assert len(self.params) == len(self.values)
            entries = []
            for idx, par in enumerate(self.params):
                val = self.values[idx]
                if val is None:
                    entries.append(val)
                else:
                    entries.append("%s=%r" % (par, val))
        if entries:
            msg = '%s - %s' % (msg, ', '.join(entries))
        ValueError.__init__(self, msg)

class ReadOnlyPartError(RuntimeError):
    """error raised when code tries to alter a part being generated"""

class PushkeyFailed(Abort):
    """error raised when a pushkey part failed to update a value"""

    def __init__(self, partid, namespace=None, key=None, new=None, old=None,
                 ret=None):
        self.partid = partid
        self.namespace = namespace
        self.key = key
        self.new = new
        self.old = old
        self.ret = ret
        # no i18n expected to be processed into a better message
        Abort.__init__(self, 'failed to update value for "%s/%s"'
                       % (namespace, key))

class CensoredNodeError(RevlogError):
    """error raised when content verification fails on a censored node

    Also contains the tombstone data substituted for the uncensored data.
    """

    def __init__(self, filename, node, tombstone):
        from .node import short
        RevlogError.__init__(self, '%s:%s' % (filename, short(node)))
        self.tombstone = tombstone

class CensoredBaseError(RevlogError):
    """error raised when a delta is rejected because its base is censored

    A delta based on a censored revision must be formed as single patch
    operation which replaces the entire base with new content. This ensures
    the delta may be applied by clones which have not censored the base.
    """

class InvalidBundleSpecification(Exception):
    """error raised when a bundle specification is invalid.

    This is used for syntax errors as opposed to support errors.
    """

class UnsupportedBundleSpecification(Exception):
    """error raised when a bundle specification is not supported."""