comparison mercurial/sslutil.py @ 29508:d65ec41b6384

sslutil: move context options flags to _hostsettings

Again, moving configuration determination to a single location.

29507:97dcdcf75f4f

        'legacyfingerprint': False,
        # PROTOCOL_* constant to use for SSLContext.__init__.
        'protocol': None,
        # ssl.CERT_* constant used by SSLContext.verify_mode.
        'verifymode': None,
    }

    # Despite its name, PROTOCOL_SSLv23 selects the highest protocol
    # that both ends support, including TLS protocols. On legacy stacks,
    # the highest it likely goes in TLS 1.0. On modern stacks, it can

    if modernssl:
        s['protocol'] = ssl.PROTOCOL_SSLv23
    else:
        s['protocol'] = ssl.PROTOCOL_TLSv1

    # Look for fingerprints in [hostsecurity] section. Value is a list
    # of <alg>:<fingerprint> strings.
    fingerprints = ui.configlist('hostsecurity', '%s:fingerprints' % hostname,
                                 [])
    for fingerprint in fingerprints:

            # validation (once we have the fingerprint to print to the
            # user).
            s['verifymode'] = ssl.CERT_NONE

    assert s['protocol'] is not None
    assert s['verifymode'] is not None

    return s

def wrapsocket(sock, keyfile, certfile, ui, serverhostname=None):

    settings = _hostsettings(ui, serverhostname)

    # TODO use ssl.create_default_context() on modernssl.
    sslcontext = SSLContext(settings['protocol'])

    # SSLv2 and SSLv3 are broken. We ban them outright.
    # This is a no-op on old Python.
    sslcontext.options |= OP_NO_SSLv2 | OP_NO_SSLv3

    # This still works on our fake SSLContext.
    sslcontext.verify_mode = settings['verifymode']

    if certfile is not None:

29508:d65ec41b6384

        'legacyfingerprint': False,
        # PROTOCOL_* constant to use for SSLContext.__init__.
        'protocol': None,
        # ssl.CERT_* constant used by SSLContext.verify_mode.
        'verifymode': None,
        # Defines extra ssl.OP* bitwise options to set.
        'ctxoptions': None,
    }

    # Despite its name, PROTOCOL_SSLv23 selects the highest protocol
    # that both ends support, including TLS protocols. On legacy stacks,
    # the highest it likely goes in TLS 1.0. On modern stacks, it can

    if modernssl:
        s['protocol'] = ssl.PROTOCOL_SSLv23
    else:
        s['protocol'] = ssl.PROTOCOL_TLSv1

    # SSLv2 and SSLv3 are broken. We ban them outright.
    # WARNING: ctxoptions doesn't have an effect unless the modern ssl module
    # is available. Be careful when adding flags!
    s['ctxoptions'] = OP_NO_SSLv2 | OP_NO_SSLv3

    # Look for fingerprints in [hostsecurity] section. Value is a list
    # of <alg>:<fingerprint> strings.
    fingerprints = ui.configlist('hostsecurity', '%s:fingerprints' % hostname,
                                 [])
    for fingerprint in fingerprints:

            # validation (once we have the fingerprint to print to the
            # user).
            s['verifymode'] = ssl.CERT_NONE

    assert s['protocol'] is not None
    assert s['ctxoptions'] is not None
    assert s['verifymode'] is not None

    return s

def wrapsocket(sock, keyfile, certfile, ui, serverhostname=None):

    settings = _hostsettings(ui, serverhostname)

    # TODO use ssl.create_default_context() on modernssl.
    sslcontext = SSLContext(settings['protocol'])

    # This is a no-op unless using modern ssl.
    sslcontext.options |= settings['ctxoptions']

    # This still works on our fake SSLContext.
    sslcontext.verify_mode = settings['verifymode']

    if certfile is not None: