comparison mercurial/hgweb/server.py @ 23070:c289fb3624b8 stable

hgweb: disable SSLv3 serving (BC)

Because of recent attacks[0] on SSLv3, let's just drop support entirely.

0: http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html

23069:22db405536be

        try:
            import OpenSSL
            OpenSSL.SSL.Context
        except ImportError:
            raise util.Abort(_("SSL support is unavailable"))
        ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)
        ctx.use_privatekey_file(ssl_cert)
        ctx.use_certificate_file(ssl_cert)
        sock = socket.socket(httpserver.address_family, httpserver.socket_type)
        httpserver.socket = OpenSSL.SSL.Connection(ctx, sock)
        httpserver.server_bind()

        try:
            import ssl
            ssl.wrap_socket
        except ImportError:
            raise util.Abort(_("SSL support is unavailable"))
        httpserver.socket = ssl.wrap_socket(httpserver.socket, server_side=True,
            certfile=ssl_cert, ssl_version=ssl.PROTOCOL_SSLv23)

    def setup(self):
        self.connection = self.request
        self.rfile = socket._fileobject(self.request, "rb", self.rbufsize)
        self.wfile = socket._fileobject(self.request, "wb", self.wbufsize)

23070:c289fb3624b8

        try:
            import OpenSSL
            OpenSSL.SSL.Context
        except ImportError:
            raise util.Abort(_("SSL support is unavailable"))
        ctx = OpenSSL.SSL.Context(OpenSSL.SSL.TLSv1_METHOD)
        ctx.use_privatekey_file(ssl_cert)
        ctx.use_certificate_file(ssl_cert)
        sock = socket.socket(httpserver.address_family, httpserver.socket_type)
        httpserver.socket = OpenSSL.SSL.Connection(ctx, sock)
        httpserver.server_bind()

        try:
            import ssl
            ssl.wrap_socket
        except ImportError:
            raise util.Abort(_("SSL support is unavailable"))
        httpserver.socket = ssl.wrap_socket(
            httpserver.socket, server_side=True,
            certfile=ssl_cert, ssl_version=ssl.PROTOCOL_TLSv1)

    def setup(self):
        self.connection = self.request
        self.rfile = socket._fileobject(self.request, "rb", self.rbufsize)
        self.wfile = socket._fileobject(self.request, "wb", self.wbufsize)