view mercurial/strutil.py @ 28525:dfb21c34e07d

sslutil: allow multiple fingerprints per host

Certificate pinning via [hostfingerprints] is a useful security
feature. Currently, we only support one fingerprint per hostname.
This is simple but it fails in the real world:

* Switching certificates breaks clients until they change the
  pinned certificate fingerprint. This incurs client downtime
  and can require massive amounts of coordination to perform
  certificate changes.
* Some servers operate with multiple certificates on the same
  hostname.

This patch adds support for defining multiple certificate
fingerprints per host. This overcomes the deficiencies listed
above. I anticipate the primary use case of this feature will
be to define both the old and new certificate so a certificate
transition can occur with minimal interruption, so this scenario
has been called out in the help documentation.

# strutil.py - string utilities for Mercurial
#
# Copyright 2006 Vadim Gelfer <[e-mail]>
#
# This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version.

from __future__ import absolute_import

def findall(haystack, needle, start=0, end=None):
    if end is None:
        end = len(haystack)
    if end < 0:
        end += len(haystack)
    if start < 0:
        start += len(haystack)
    while start < end:
        c = haystack.find(needle, start, end)
        if c == -1:
            break
        yield c
        start = c + 1

def rfindall(haystack, needle, start=0, end=None):
    if end is None:
        end = len(haystack)
    if end < 0:
        end += len(haystack)
    if start < 0:
        start += len(haystack)
    while end >= 0:
        c = haystack.rfind(needle, start, end)
        if c == -1:
            break
        yield c
        end = c - 1