310 # CAs may undermine the user's intent. For example, a user may define a CA |
310 # CAs may undermine the user's intent. For example, a user may define a CA |
311 # bundle with a specific CA cert removed. If the system/default CA bundle |
311 # bundle with a specific CA cert removed. If the system/default CA bundle |
312 # is loaded and contains that removed CA, you've just undone the user's |
312 # is loaded and contains that removed CA, you've just undone the user's |
313 # choice. |
313 # choice. |
314 |
314 |
315 if True: |
315 sslcontext = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) |
316 sslcontext = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) |
316 minimumprotocol = settings[b'minimumprotocol'] |
317 minimumprotocol = settings[b'minimumprotocol'] |
317 if minimumprotocol == b'tls1.0': |
318 if minimumprotocol == b'tls1.0': |
318 with warnings.catch_warnings(): |
319 with warnings.catch_warnings(): |
319 warnings.filterwarnings( |
320 warnings.filterwarnings( |
320 'ignore', |
321 'ignore', |
321 'ssl.TLSVersion.TLSv1 is deprecated', |
322 'ssl.TLSVersion.TLSv1 is deprecated', |
322 DeprecationWarning, |
323 DeprecationWarning, |
323 ) |
324 ) |
324 sslcontext.minimum_version = ssl.TLSVersion.TLSv1 |
325 sslcontext.minimum_version = ssl.TLSVersion.TLSv1 |
325 elif minimumprotocol == b'tls1.1': |
326 elif minimumprotocol == b'tls1.1': |
326 with warnings.catch_warnings(): |
327 with warnings.catch_warnings(): |
327 warnings.filterwarnings( |
328 warnings.filterwarnings( |
328 'ignore', |
329 'ignore', |
329 'ssl.TLSVersion.TLSv1_1 is deprecated', |
330 'ssl.TLSVersion.TLSv1_1 is deprecated', |
330 DeprecationWarning, |
331 DeprecationWarning, |
331 ) |
332 ) |
332 sslcontext.minimum_version = ssl.TLSVersion.TLSv1_1 |
333 sslcontext.minimum_version = ssl.TLSVersion.TLSv1_1 |
333 elif minimumprotocol == b'tls1.2': |
334 elif minimumprotocol == b'tls1.2': |
334 sslcontext.minimum_version = ssl.TLSVersion.TLSv1_2 |
335 sslcontext.minimum_version = ssl.TLSVersion.TLSv1_2 |
335 else: |
336 else: |
336 raise error.Abort(_(b'this should not happen')) |
337 raise error.Abort(_(b'this should not happen')) |
337 # Prevent CRIME. |
338 # Prevent CRIME. |
338 # There is no guarantee this attribute is defined on the module. |
339 # There is no guarantee this attribute is defined on the module. |
339 sslcontext.options |= getattr(ssl, 'OP_NO_COMPRESSION', 0) |
340 sslcontext.options |= getattr(ssl, 'OP_NO_COMPRESSION', 0) |
|
341 |
340 |
342 # We check the hostname ourselves in _verifycert |
341 # We check the hostname ourselves in _verifycert |
343 sslcontext.check_hostname = False |
342 sslcontext.check_hostname = False |
344 sslcontext.verify_mode = settings[b'verifymode'] |
343 sslcontext.verify_mode = settings[b'verifymode'] |
345 |
344 |
536 if f and not os.path.exists(f): |
535 if f and not os.path.exists(f): |
537 raise error.Abort( |
536 raise error.Abort( |
538 _(b'referenced certificate file (%s) does not exist') % f |
537 _(b'referenced certificate file (%s) does not exist') % f |
539 ) |
538 ) |
540 |
539 |
541 if True: |
540 sslcontext = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) |
542 sslcontext = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) |
541 sslcontext.options |= getattr(ssl, 'OP_NO_COMPRESSION', 0) |
543 sslcontext.options |= getattr(ssl, 'OP_NO_COMPRESSION', 0) |
542 |
544 |
543 # This config option is intended for use in tests only. It is a giant |
545 # This config option is intended for use in tests only. It is a giant |
544 # footgun to kill security. Don't define it. |
546 # footgun to kill security. Don't define it. |
545 exactprotocol = ui.config(b'devel', b'server-insecure-exact-protocol') |
547 exactprotocol = ui.config(b'devel', b'server-insecure-exact-protocol') |
546 if exactprotocol == b'tls1.0': |
548 if exactprotocol == b'tls1.0': |
547 if b'tls1.0' not in supportedprotocols: |
549 if b'tls1.0' not in supportedprotocols: |
548 raise error.Abort(_(b'TLS 1.0 not supported by this Python')) |
550 raise error.Abort(_(b'TLS 1.0 not supported by this Python')) |
549 with warnings.catch_warnings(): |
551 with warnings.catch_warnings(): |
550 warnings.filterwarnings( |
552 warnings.filterwarnings( |
551 'ignore', |
553 'ignore', |
552 'ssl.TLSVersion.TLSv1 is deprecated', |
554 'ssl.TLSVersion.TLSv1 is deprecated', |
553 DeprecationWarning, |
555 DeprecationWarning, |
554 ) |
556 ) |
555 sslcontext.minimum_version = ssl.TLSVersion.TLSv1 |
557 sslcontext.minimum_version = ssl.TLSVersion.TLSv1 |
556 sslcontext.maximum_version = ssl.TLSVersion.TLSv1 |
558 sslcontext.maximum_version = ssl.TLSVersion.TLSv1 |
557 elif exactprotocol == b'tls1.1': |
559 elif exactprotocol == b'tls1.1': |
558 if b'tls1.1' not in supportedprotocols: |
560 if b'tls1.1' not in supportedprotocols: |
559 raise error.Abort(_(b'TLS 1.1 not supported by this Python')) |
561 raise error.Abort(_(b'TLS 1.1 not supported by this Python')) |
560 with warnings.catch_warnings(): |
562 with warnings.catch_warnings(): |
561 warnings.filterwarnings( |
563 warnings.filterwarnings( |
562 'ignore', |
564 'ignore', |
563 'ssl.TLSVersion.TLSv1_1 is deprecated', |
565 'ssl.TLSVersion.TLSv1_1 is deprecated', |
564 DeprecationWarning, |
566 DeprecationWarning, |
565 ) |
567 ) |
566 sslcontext.minimum_version = ssl.TLSVersion.TLSv1_1 |
568 sslcontext.minimum_version = ssl.TLSVersion.TLSv1_1 |
567 sslcontext.maximum_version = ssl.TLSVersion.TLSv1_1 |
569 sslcontext.maximum_version = ssl.TLSVersion.TLSv1_1 |
568 elif exactprotocol == b'tls1.2': |
570 elif exactprotocol == b'tls1.2': |
569 if b'tls1.2' not in supportedprotocols: |
571 if b'tls1.2' not in supportedprotocols: |
570 raise error.Abort(_(b'TLS 1.2 not supported by this Python')) |
572 raise error.Abort(_(b'TLS 1.2 not supported by this Python')) |
571 sslcontext.minimum_version = ssl.TLSVersion.TLSv1_2 |
573 sslcontext.minimum_version = ssl.TLSVersion.TLSv1_2 |
572 sslcontext.maximum_version = ssl.TLSVersion.TLSv1_2 |
574 sslcontext.maximum_version = ssl.TLSVersion.TLSv1_2 |
573 elif exactprotocol: |
575 elif exactprotocol: |
574 raise error.Abort( |
576 raise error.Abort( |
575 _(b'invalid value for server-insecure-exact-protocol: %s') |
577 _(b'invalid value for server-insecure-exact-protocol: %s') |
576 % exactprotocol |
578 % exactprotocol |
577 ) |
579 ) |
|
580 |
578 |
581 # Improve forward secrecy. |
579 # Improve forward secrecy. |
582 sslcontext.options |= getattr(ssl, 'OP_SINGLE_DH_USE', 0) |
580 sslcontext.options |= getattr(ssl, 'OP_SINGLE_DH_USE', 0) |
583 sslcontext.options |= getattr(ssl, 'OP_SINGLE_ECDH_USE', 0) |
581 sslcontext.options |= getattr(ssl, 'OP_SINGLE_ECDH_USE', 0) |
584 |
582 |