comparison mercurial/sslutil.py @ 49055:50bd2910d162

sslutil: be less strict about which ciphers are allowed when using --insecure

Python 3.10 restricted which ciphers are enabled by default, leading to
no available ciphers for TLS < 1.2.  When using the --insecure flag we
allow old TLS, so also adjust the cipher list to give connections a
chance to work.

On the server side, also loosen the cipher selection in tests (when
using the devel.serverexactprotocol option).

Differential Revision: https://phab.mercurial-scm.org/D12489

49054:5144d3579a9c

    key = b'%s:minimumprotocol' % bhostname
    minimumprotocol = ui.config(b'hostsecurity', key, minimumprotocol)
    validateprotocol(minimumprotocol, key)

    # If --insecure is used, we allow the use of TLS 1.0 despite config options.
    # We always print a "connection security to %s is disabled..." message when
    # --insecure is used. So no need to print anything more here.
    if ui.insecureconnections:
        minimumprotocol = b'tls1.0'

    s[b'minimumprotocol'] = minimumprotocol

    ciphers = ui.config(b'hostsecurity', b'ciphers')
    ciphers = ui.config(b'hostsecurity', b'%s:ciphers' % bhostname, ciphers)
    s[b'ciphers'] = ciphers

    # Look for fingerprints in [hostsecurity] section. Value is a list
    # of <alg>:<fingerprint> strings.
    fingerprints = ui.configlist(

    # Improve forward secrecy.
    sslcontext.options |= getattr(ssl, 'OP_SINGLE_DH_USE', 0)
    sslcontext.options |= getattr(ssl, 'OP_SINGLE_ECDH_USE', 0)

    # Use the list of more secure ciphers if found in the ssl module.
    if util.safehasattr(ssl, b'_RESTRICTED_SERVER_CIPHERS'):
        sslcontext.options |= getattr(ssl, 'OP_CIPHER_SERVER_PREFERENCE', 0)
        # pytype: disable=module-attr
        sslcontext.set_ciphers(ssl._RESTRICTED_SERVER_CIPHERS)
        # pytype: enable=module-attr

49055:50bd2910d162

    key = b'%s:minimumprotocol' % bhostname
    minimumprotocol = ui.config(b'hostsecurity', key, minimumprotocol)
    validateprotocol(minimumprotocol, key)

    ciphers = ui.config(b'hostsecurity', b'ciphers')
    ciphers = ui.config(b'hostsecurity', b'%s:ciphers' % bhostname, ciphers)

    # If --insecure is used, we allow the use of TLS 1.0 despite config options.
    # We always print a "connection security to %s is disabled..." message when
    # --insecure is used. So no need to print anything more here.
    if ui.insecureconnections:
        minimumprotocol = b'tls1.0'
        if not ciphers:
            ciphers = b'DEFAULT'

    s[b'minimumprotocol'] = minimumprotocol
    s[b'ciphers'] = ciphers

    # Look for fingerprints in [hostsecurity] section. Value is a list
    # of <alg>:<fingerprint> strings.
    fingerprints = ui.configlist(

    # Improve forward secrecy.
    sslcontext.options |= getattr(ssl, 'OP_SINGLE_DH_USE', 0)
    sslcontext.options |= getattr(ssl, 'OP_SINGLE_ECDH_USE', 0)

    # In tests, allow insecure ciphers
    # Otherwise, use the list of more secure ciphers if found in the ssl module.
    if exactprotocol:
        sslcontext.set_ciphers('DEFAULT')
    elif util.safehasattr(ssl, b'_RESTRICTED_SERVER_CIPHERS'):
        sslcontext.options |= getattr(ssl, 'OP_CIPHER_SERVER_PREFERENCE', 0)
        # pytype: disable=module-attr
        sslcontext.set_ciphers(ssl._RESTRICTED_SERVER_CIPHERS)
        # pytype: enable=module-attr