hgweb: disable SSLv3 serving (BC) stable
authorAugie Fackler <raf@durin42.com>
Tue, 21 Oct 2014 17:09:37 -0400
branchstable
changeset 23070 c289fb3624b8
parent 23069 22db405536be
child 23071 652ab726ba93
hgweb: disable SSLv3 serving (BC) Because of recent attacks[0] on SSLv3, let's just drop support entirely. 0: http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html
mercurial/hgweb/server.py
--- a/mercurial/hgweb/server.py	Tue Oct 21 17:01:23 2014 -0400
+++ b/mercurial/hgweb/server.py	Tue Oct 21 17:09:37 2014 -0400
@@ -208,7 +208,7 @@
             OpenSSL.SSL.Context
         except ImportError:
             raise util.Abort(_("SSL support is unavailable"))
-        ctx = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)
+        ctx = OpenSSL.SSL.Context(OpenSSL.SSL.TLSv1_METHOD)
         ctx.use_privatekey_file(ssl_cert)
         ctx.use_certificate_file(ssl_cert)
         sock = socket.socket(httpserver.address_family, httpserver.socket_type)
@@ -249,8 +249,9 @@
             ssl.wrap_socket
         except ImportError:
             raise util.Abort(_("SSL support is unavailable"))
-        httpserver.socket = ssl.wrap_socket(httpserver.socket, server_side=True,
-            certfile=ssl_cert, ssl_version=ssl.PROTOCOL_SSLv23)
+        httpserver.socket = ssl.wrap_socket(
+            httpserver.socket, server_side=True,
+            certfile=ssl_cert, ssl_version=ssl.PROTOCOL_TLSv1)
 
     def setup(self):
         self.connection = self.request