annotate mercurial/sslutil.py @ 16719:e7bf09acd410

localrepo: add branchtip() method for faster single-branch lookups

For the PyPy repo with 744 branches and 843 branch heads, this brings
hg log -r default over NFS from:

   CallCount    Recursive    Total(ms)   Inline(ms) module:lineno(function)
        3249            0      1.3222      1.3222   <open>
        3244            0      0.6211      0.6211   <method 'close' of 'file' objects>
        3243            0      0.0800      0.0800   <method 'read' of 'file' objects>
        3241            0      0.0660      0.0660   <method 'seek' of 'file' objects>
        3905            0      0.0476      0.0476   <zlib.decompress>
        3281            0      2.6756      0.0472   mercurial.changelog:182(read)
       +3281            0      2.5256      0.0453   +mercurial.revlog:881(revision)
       +3276            0      0.0389      0.0196   +mercurial.changelog:28(decodeextra)
       +6562            0      0.0123      0.0123   +<method 'split' of 'str' objects>
       +6562            0      0.0408      0.0073   +mercurial.encoding:61(tolocal)
       +3281            0      0.0054      0.0054   +<method 'index' of 'str' objects>
        3241            0      2.2464      0.0456   mercurial.revlog:818(_loadchunk)
       +3241            0      0.6205      0.6205   +<method 'close' of 'file' objects>
       +3241            0      0.0765      0.0765   +<method 'read' of 'file' objects>
       +3241            0      0.0660      0.0660   +<method 'seek' of 'file' objects>
       +3241            0      1.4209      0.0135   +mercurial.store:374(__call__)
       +3241            0      0.0122      0.0107   +mercurial.revlog:810(_addchunk)
        3281            0      2.5256      0.0453   mercurial.revlog:881(revision)
       +3280            0      0.0175      0.0175   +mercurial.revlog:305(rev)
       +3281            0      2.2819      0.0119   +mercurial.revlog:847(_chunkraw)
       +3281            0      0.0603      0.0083   +mercurial.revlog:945(_checkhash)
       +3281            0      0.0051      0.0051   +mercurial.revlog:349(flags)
       +3281            0      0.0040      0.0040   +<mercurial.mpatch.patches>
       13682            0      0.0479      0.0248   <method 'decode' of 'str' objects>
       +7418            0      0.0228      0.0076   +encodings.utf_8:15(decode)
          +1            0      0.0003      0.0000   +encodings:71(search_function)
        3248            0      1.3995      0.0246   mercurial.scmutil:218(__call__)
       +3248            0      1.3222      1.3222   +<open>
       +3248            0      0.0235      0.0184   +os.path:80(split)
       +3248            0      0.0084      0.0068   +mercurial.scmutil:92(__call__)
Time: real 2.750 secs (user 0.680+0.000 sys 0.360+0.000)

down to:

   CallCount    Recursive    Total(ms)   Inline(ms) module:lineno(function)
          55           31      0.0197      0.0163   <__import__>
          +1            0      0.0006      0.0002   +mercurial.context:8(<module>)
          +1            0      0.0042      0.0001   +mercurial.revlog:12(<module>)
          +1            0      0.0002      0.0001   +mercurial.match:8(<module>)
          +1            0      0.0003      0.0001   +mercurial.dirstate:7(<module>)
          +1            0      0.0057      0.0001   +mercurial.changelog:8(<module>)
           1            0      0.0117      0.0032   mercurial.localrepo:525(_readbranchcache)
        +844            0      0.0015      0.0015   +<binascii.unhexlify>
        +845            0      0.0010      0.0010   +<method 'split' of 'str' objects>
        +843            0      0.0045      0.0009   +mercurial.encoding:61(tolocal)
        +843            0      0.0004      0.0004   +<method 'setdefault' of 'dict' objects>
          +1            0      0.0003      0.0003   +<method 'close' of 'file' objects>
           3            0      0.0029      0.0029   <method 'read' of 'file' objects>
           9            0      0.0018      0.0018   <open>
         990            0      0.0017      0.0017   <binascii.unhexlify>
          53            0      0.0016      0.0016   mercurial.demandimport:43(__init__)
         862            0      0.0015      0.0015   <_codecs.utf_8_decode>
         862            0      0.0037      0.0014   <method 'decode' of 'str' objects>
        +862            0      0.0023      0.0008   +encodings.utf_8:15(decode)
         981            0      0.0011      0.0011   <method 'split' of 'str' objects>
         861            0      0.0046      0.0009   mercurial.encoding:61(tolocal)
        +861            0      0.0037      0.0014   +<method 'decode' of 'str' objects>
         862            0      0.0023      0.0008   encodings.utf_8:15(decode)
        +862            0      0.0015      0.0015   +<_codecs.utf_8_decode>
           4            0      0.0008      0.0008   <method 'close' of 'file' objects>
         179          154      0.0202      0.0004   mercurial.demandimport:83(__getattribute__)
         +36           11      0.0199      0.0003   +mercurial.demandimport:55(_load)
         +72            0      0.0001      0.0001   +mercurial.demandimport:83(__getattribute__)
         +36            0      0.0000      0.0000   +<getattr>
           1            0      0.0015      0.0004   mercurial.tags:148(_readtagcache)
Time: real 0.060 secs (user 0.030+0.000 sys 0.010+0.000)

# sslutil.py - SSL handling for mercurial
#
# Copyright 2005, 2006, 2007, 2008 Matt Mackall <[e-mail]>
# Copyright 2006, 2007 Alexis S. L. Carvalho <[e-mail]>
# Copyright 2006 Vadim Gelfer <[e-mail]>
#
# This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version.
import os

from mercurial import util
from mercurial.i18n import _
try:
    # avoid using deprecated/broken FakeSocket in python 2.6
    import ssl
    CERT_REQUIRED = ssl.CERT_REQUIRED
    def ssl_wrap_socket(sock, keyfile, certfile,
                cert_reqs=ssl.CERT_NONE, ca_certs=None):
        sslsocket = ssl.wrap_socket(sock, keyfile, certfile,
                cert_reqs=cert_reqs, ca_certs=ca_certs)
        # check if wrap_socket failed silently because socket had been closed
        # - see http://bugs.python.org/issue13721
        if not sslsocket.cipher():
            raise util.Abort(_('ssl connection failed'))
        return sslsocket
except ImportError:
    CERT_REQUIRED = 2

    import socket, httplib

    def ssl_wrap_socket(sock, key_file, cert_file,
                        cert_reqs=CERT_REQUIRED, ca_certs=None):
        if not util.safehasattr(socket, 'ssl'):
            raise util.Abort(_('Python SSL support not found'))
        if ca_certs:
            raise util.Abort(_(
                'certificate checking requires Python 2.6'))

        ssl = socket.ssl(sock, key_file, cert_file)
        return httplib.FakeSocket(sock, ssl)

def _verifycert(cert, hostname):
    '''Verify that cert (in socket.getpeercert() format) matches hostname.
    CRLs is not handled.

    Returns error message if any problems are found and None on success.
    '''
    if not cert:
        return _('no certificate received')
    dnsname = hostname.lower()
    def matchdnsname(certname):
        return (certname == dnsname or
                '.' in dnsname and certname == '*.' + dnsname.split('.', 1)[1])

    san = cert.get('subjectAltName', [])
    if san:
        certnames = [value.lower() for key, value in san if key == 'DNS']
        for name in certnames:
            if matchdnsname(name):
                return None
        if certnames:
            return _('certificate is for %s') % ', '.join(certnames)

    # subject is only checked when subjectAltName is empty
    for s in cert.get('subject', []):
        key, value = s[0]
        if key == 'commonName':
            try:
                # 'subject' entries are unicode
                certname = value.lower().encode('ascii')
            except UnicodeEncodeError:
                return _('IDN in certificate not supported')
            if matchdnsname(certname):
                return None
            return _('certificate is for %s') % certname
    return _('no commonName or subjectAltName found in certificate')


# CERT_REQUIRED means fetch the cert from the server all the time AND
# validate it against the CA store provided in web.cacerts.
#
# We COMPLETELY ignore CERT_REQUIRED on Python <= 2.5, as it's totally
# busted on those versions.

def sslkwargs(ui, host):
    cacerts = ui.config('web', 'cacerts')
    hostfingerprint = ui.config('hostfingerprints', host)
    if cacerts and not hostfingerprint:
        cacerts = util.expandpath(cacerts)
        if not os.path.exists(cacerts):
            raise util.Abort(_('could not find web.cacerts: %s') % cacerts)
        return {'ca_certs': cacerts,
                'cert_reqs': CERT_REQUIRED,
                }
    return {}

class validator(object):
    def __init__(self, ui, host):
        self.ui = ui
        self.host = host

    def __call__(self, sock):
        host = self.host
        cacerts = self.ui.config('web', 'cacerts')
        hostfingerprint = self.ui.config('hostfingerprints', host)
        if not getattr(sock, 'getpeercert', False): # python 2.5 ?
            if hostfingerprint:
                raise util.Abort(_("host fingerprint for %s can't be "
                                   "verified (Python too old)") % host)
            if self.ui.configbool('ui', 'reportoldssl', True):
                self.ui.warn(_("warning: certificate for %s can't be verified "
                               "(Python too old)\n") % host)
            return
        if not sock.cipher(): # work around http://bugs.python.org/issue13721
            raise util.Abort(_('%s ssl connection error') % host)
        peercert = sock.getpeercert(True)
        if not peercert:
            raise util.Abort(_('%s certificate error: '
                               'no certificate received') % host)
        peerfingerprint = util.sha1(peercert).hexdigest()
        nicefingerprint = ":".join([peerfingerprint[x:x + 2]
            for x in xrange(0, len(peerfingerprint), 2)])
        if hostfingerprint:
            if peerfingerprint.lower() != \
                    hostfingerprint.replace(':', '').lower():
                raise util.Abort(_('certificate for %s has unexpected '
                                   'fingerprint %s') % (host, nicefingerprint),
                                 hint=_('check hostfingerprint configuration'))
            self.ui.debug('%s certificate matched fingerprint %s\n' %
                          (host, nicefingerprint))
        elif cacerts:
            msg = _verifycert(sock.getpeercert(), host)
            if msg:
                raise util.Abort(_('%s certificate error: %s') % (host, msg),
                                 hint=_('configure hostfingerprint %s or use '
                                        '--insecure to connect insecurely') %
                                      nicefingerprint)
            self.ui.debug('%s certificate successfully verified\n' % host)
        else:
            self.ui.warn(_('warning: %s certificate with fingerprint %s not '
                           'verified (check hostfingerprints or web.cacerts '
                           'config setting)\n') %
                         (host, nicefingerprint))