Mercurial > hg
comparison mercurial/sslutil.py @ 29112:5edc5acecc83
sslutil: handle ui.insecureconnections in validator
Right now, web.cacerts=! means one of two things:
1) Use of --insecure
2) No CAs could be found and were loaded (see sslkwargs)
This isn't very obvious and makes changing behavior of these
different scenarios independent of the other impossible.
This patch changes the validator code to explicit handle the
case of --insecure being used.
As the inline comment indicates, there is room to possibly change
messaging and logic here. For now, we are backwards compatible.
author | Gregory Szorc <gregory.szorc@gmail.com> |
---|---|
date | Thu, 05 May 2016 00:37:28 -0700 |
parents | 843df550b465 |
children | 5b9577edf745 |
comparison
equal
deleted
inserted
replaced
29111:843df550b465 | 29112:5edc5acecc83 |
---|---|
327 hint=_('check hostfingerprint configuration')) | 327 hint=_('check hostfingerprint configuration')) |
328 self.ui.debug('%s certificate matched fingerprint %s\n' % | 328 self.ui.debug('%s certificate matched fingerprint %s\n' % |
329 (host, nicefingerprint)) | 329 (host, nicefingerprint)) |
330 return | 330 return |
331 | 331 |
332 # If insecure connections were explicitly requested via --insecure, | |
333 # print a warning and do no verification. | |
334 # | |
335 # It may seem odd that this is checked *after* host fingerprint pinning. | |
336 # This is for backwards compatibility (for now). The message is also | |
337 # the same as below for BC. | |
338 if self.ui.insecureconnections: | |
339 self.ui.warn(_('warning: %s certificate with fingerprint %s not ' | |
340 'verified (check hostfingerprints or web.cacerts ' | |
341 'config setting)\n') % | |
342 (host, nicefingerprint)) | |
343 return | |
344 | |
332 # No pinned fingerprint. Establish trust by looking at the CAs. | 345 # No pinned fingerprint. Establish trust by looking at the CAs. |
333 cacerts = self.ui.config('web', 'cacerts') | 346 cacerts = self.ui.config('web', 'cacerts') |
334 if cacerts != '!': | 347 if cacerts != '!': |
335 msg = _verifycert(peercert2, host) | 348 msg = _verifycert(peercert2, host) |
336 if msg: | 349 if msg: |