112 return |
112 return |
113 peercert = sock.getpeercert(True) |
113 peercert = sock.getpeercert(True) |
114 peerfingerprint = util.sha1(peercert).hexdigest() |
114 peerfingerprint = util.sha1(peercert).hexdigest() |
115 nicefingerprint = ":".join([peerfingerprint[x:x + 2] |
115 nicefingerprint = ":".join([peerfingerprint[x:x + 2] |
116 for x in xrange(0, len(peerfingerprint), 2)]) |
116 for x in xrange(0, len(peerfingerprint), 2)]) |
117 if cacerts and not hostfingerprint: |
117 if hostfingerprint: |
|
118 if peerfingerprint.lower() != \ |
|
119 hostfingerprint.replace(':', '').lower(): |
|
120 raise util.Abort(_('invalid certificate for %s with ' |
|
121 'fingerprint %s') % (host, nicefingerprint)) |
|
122 self.ui.debug('%s certificate matched fingerprint %s\n' % |
|
123 (host, nicefingerprint)) |
|
124 elif cacerts: |
118 msg = _verifycert(sock.getpeercert(), host) |
125 msg = _verifycert(sock.getpeercert(), host) |
119 if msg: |
126 if msg: |
120 raise util.Abort(_('%s certificate error: %s') % (host, msg), |
127 raise util.Abort(_('%s certificate error: %s') % (host, msg), |
121 hint=_('configure hostfingerprint %s or use ' |
128 hint=_('configure hostfingerprint %s or use ' |
122 '--insecure to connect insecurely') % |
129 '--insecure to connect insecurely') % |
123 nicefingerprint) |
130 nicefingerprint) |
124 self.ui.debug('%s certificate successfully verified\n' % host) |
131 self.ui.debug('%s certificate successfully verified\n' % host) |
125 else: |
132 else: |
126 if hostfingerprint: |
133 self.ui.warn(_('warning: %s certificate with fingerprint %s not ' |
127 if peerfingerprint.lower() != \ |
134 'verified (check hostfingerprints or web.cacerts ' |
128 hostfingerprint.replace(':', '').lower(): |
135 'config setting)\n') % |
129 raise util.Abort(_('invalid certificate for %s ' |
136 (host, nicefingerprint)) |
130 'with fingerprint %s') % |
|
131 (host, nicefingerprint)) |
|
132 self.ui.debug('%s certificate matched fingerprint %s\n' % |
|
133 (host, nicefingerprint)) |
|
134 else: |
|
135 self.ui.warn(_('warning: %s certificate ' |
|
136 'with fingerprint %s not verified ' |
|
137 '(check hostfingerprints or web.cacerts ' |
|
138 'config setting)\n') % |
|
139 (host, nicefingerprint)) |
|