how to set-up HTTPS authentication with client certificate and passwords

[Igor Lautar-3]

Hi All,

We are setting up a repo served by hgwebdir over https. Apache
requires client to have certificate issued by this server.

I have .pam file that I've imported into firefox and are able to access repo.

Now I want to clone repo using hg (or use existing repo and
authenticate to this repo).

From docs, I've seen that [auth] section should be used:

[paths]
default = https://<server>/<repo>

[auth]
rc.prefix = <server>
rc.username = <username>
rc.password = <password>
rc.key = <key>
rc.cert = <cert>
rc.schemes = https

where <key> is .pam file I've also imported to FF and <cert> is
authority cerfiticate I've accepted in FF and exported for HG to use.

However, it seams [auth] section is ignored (or at least not working
with this configuration):

$ hg --traceback pull
Traceback (most recent call last):
  File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 43,
in _runcatch
    return _dispatch(ui, args)
  File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 449,
in _dispatch
    return runcommand(lui, repo, cmd, fullargs, ui, options, d)
  File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 317,
in runcommand
    ret = _runcommand(ui, options, cmd, d)
  File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 501,
in _runcommand
    return checkargs()
  File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 454,
in checkargs
    return cmdfunc()
  File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 448,
in <lambda>
    d = lambda: util.checksignature(func)(ui, *args, **cmdoptions)
  File "/usr/lib/pymodules/python2.6/mercurial/util.py", line 402, in check
    return func(*args, **kwargs)
  File "/usr/lib/pymodules/python2.6/mercurial/commands.py", line 2287, in pull
    other = hg.repository(cmdutil.remoteui(repo, opts), source)
  File "/usr/lib/pymodules/python2.6/mercurial/hg.py", line 63, in repository
    repo = _lookup(path).instance(ui, path, create)
  File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 254,
in instance
    inst.between([(nullid, nullid)])
  File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 175,
in between
    d = self.do_read("between", pairs=n)
  File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 126,
in do_read
    fp = self.do_cmd(cmd, **args)
  File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 79, in do_cmd
    resp = self.urlopener.open(urllib2.Request(cu, data, headers))
  File "/usr/lib/python2.6/urllib2.py", line 389, in open
    response = self._open(req, data)
  File "/usr/lib/python2.6/urllib2.py", line 407, in _open
    '_open', req)
  File "/usr/lib/python2.6/urllib2.py", line 367, in _call_chain
    result = func(*args)
  File "/usr/lib/pymodules/python2.6/mercurial/url.py", line 425, in https_open
    return self.do_open(self._makeconnection, req)
  File "/usr/lib/pymodules/python2.6/mercurial/keepalive.py", line
248, in do_open
    raise urllib2.URLError(err)
URLError: <urlopen error [Errno 1] _ssl.c:480: error:14094410:SSL
routines:SSL3_READ_BYTES:sslv3 alert handshake failure>
abort: error: _ssl.c:480: error:14094410:SSL
routines:SSL3_READ_BYTES:sslv3 alert handshake failure



Running 1.3.1 on kubuntu karmic:

$ hg --version
Mercurial Distributed SCM (version 1.3.1)

Copyright (C) 2005-2009 Matt Mackall <mpm@...> and others
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$ uname -a
Linux arrow 2.6.31-14-generic #48-Ubuntu SMP Fri Oct 16 14:05:01 UTC
2009 x86_64 GNU/Linux

Any ideas?

Regards,
Igor
_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[J.S. van Bethlehem-2]

I have a working repo over https. All I need to do is to put in the
[paths] section and it works. But to be honest, the certificate part is
not dealt with by myself, so maybe that makes a difference.

Looking at the traceback I suspect the problem is not in the [auth]
section, but in a wrong path. You wrote a http-url there. I think you
need to write a directory on the server there, eg I have:

  repo = /data/users/<username>/<path to repository>

Greetsz, Jakob


Igor Lautar wrote:

> Hi All,
>
> We are setting up a repo served by hgwebdir over https. Apache
> requires client to have certificate issued by this server.
>
> I have .pam file that I've imported into firefox and are able to access repo.
>
> Now I want to clone repo using hg (or use existing repo and
> authenticate to this repo).
>
>>From docs, I've seen that [auth] section should be used:
>
> [paths]
> default = https://<server>/<repo>
>
> [auth]
> rc.prefix = <server>
> rc.username = <username>
> rc.password = <password>
> rc.key = <key>
> rc.cert = <cert>
> rc.schemes = https
>
> where <key> is .pam file I've also imported to FF and <cert> is
> authority cerfiticate I've accepted in FF and exported for HG to use.
>
> However, it seams [auth] section is ignored (or at least not working
> with this configuration):
>
> $ hg --traceback pull
> Traceback (most recent call last):
>   File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 43,
> in _runcatch
>     return _dispatch(ui, args)
>   File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 449,
> in _dispatch
>     return runcommand(lui, repo, cmd, fullargs, ui, options, d)
>   File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 317,
> in runcommand
>     ret = _runcommand(ui, options, cmd, d)
>   File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 501,
> in _runcommand
>     return checkargs()
>   File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 454,
> in checkargs
>     return cmdfunc()
>   File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 448,
> in <lambda>
>     d = lambda: util.checksignature(func)(ui, *args, **cmdoptions)
>   File "/usr/lib/pymodules/python2.6/mercurial/util.py", line 402, in check
>     return func(*args, **kwargs)
>   File "/usr/lib/pymodules/python2.6/mercurial/commands.py", line 2287, in pull
>     other = hg.repository(cmdutil.remoteui(repo, opts), source)
>   File "/usr/lib/pymodules/python2.6/mercurial/hg.py", line 63, in repository
>     repo = _lookup(path).instance(ui, path, create)
>   File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 254,
> in instance
>     inst.between([(nullid, nullid)])
>   File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 175,
> in between
>     d = self.do_read("between", pairs=n)
>   File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 126,
> in do_read
>     fp = self.do_cmd(cmd, **args)
>   File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 79, in do_cmd
>     resp = self.urlopener.open(urllib2.Request(cu, data, headers))
>   File "/usr/lib/python2.6/urllib2.py", line 389, in open
>     response = self._open(req, data)
>   File "/usr/lib/python2.6/urllib2.py", line 407, in _open
>     '_open', req)
>   File "/usr/lib/python2.6/urllib2.py", line 367, in _call_chain
>     result = func(*args)
>   File "/usr/lib/pymodules/python2.6/mercurial/url.py", line 425, in https_open
>     return self.do_open(self._makeconnection, req)
>   File "/usr/lib/pymodules/python2.6/mercurial/keepalive.py", line
> 248, in do_open
>     raise urllib2.URLError(err)
> URLError: <urlopen error [Errno 1] _ssl.c:480: error:14094410:SSL
> routines:SSL3_READ_BYTES:sslv3 alert handshake failure>
> abort: error: _ssl.c:480: error:14094410:SSL
> routines:SSL3_READ_BYTES:sslv3 alert handshake failure
>
>
>
> Running 1.3.1 on kubuntu karmic:
>
> $ hg --version
> Mercurial Distributed SCM (version 1.3.1)
>
> Copyright (C) 2005-2009 Matt Mackall <mpm@...> and others
> This is free software; see the source for copying conditions. There is NO
> warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
>
> $ uname -a
> Linux arrow 2.6.31-14-generic #48-Ubuntu SMP Fri Oct 16 14:05:01 UTC
> 2009 x86_64 GNU/Linux
>
> Any ideas?
>
> Regards,
> Igor
> _______________________________________________
> Mercurial mailing list
> Mercurial@...
> http://selenic.com/mailman/listinfo/mercurial

_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Igor Lautar-3]

We have been also testing https only, and that works (with same paths
as used in previous example).

But after requiring client certificates, I cannot set-it up properly
on client side.

Anybody else have any ideas?

I will try running it over some kind of tunnel so authentication is
handled outside hg, but I would really like to set it up using hg
auth.

Thx,
Igor

On Wed, Oct 28, 2009 at 3:09 PM, J.S. van Bethlehem
<j.s.van.bethlehem@...> wrote:

> I have a working repo over https. All I need to do is to put in the
> [paths] section and it works. But to be honest, the certificate part is
> not dealt with by myself, so maybe that makes a difference.
>
> Looking at the traceback I suspect the problem is not in the [auth]
> section, but in a wrong path. You wrote a http-url there. I think you
> need to write a directory on the server there, eg I have:
>
>  repo = /data/users/<username>/<path to repository>
>
> Greetsz, Jakob
>
>
> Igor Lautar wrote:
>> Hi All,
>>
>> We are setting up a repo served by hgwebdir over https. Apache
>> requires client to have certificate issued by this server.
>>
>> I have .pam file that I've imported into firefox and are able to access repo.
>>
>> Now I want to clone repo using hg (or use existing repo and
>> authenticate to this repo).
>>
>>>From docs, I've seen that [auth] section should be used:
>>
>> [paths]
>> default = https://<server>/<repo>
>>
>> [auth]
>> rc.prefix = <server>
>> rc.username = <username>
>> rc.password = <password>
>> rc.key = <key>
>> rc.cert = <cert>
>> rc.schemes = https
>>
>> where <key> is .pam file I've also imported to FF and <cert> is
>> authority cerfiticate I've accepted in FF and exported for HG to use.
>>
>> However, it seams [auth] section is ignored (or at least not working
>> with this configuration):
>>
>> $ hg --traceback pull
>> Traceback (most recent call last):
>>   File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 43,
>> in _runcatch
>>     return _dispatch(ui, args)
>>   File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 449,
>> in _dispatch
>>     return runcommand(lui, repo, cmd, fullargs, ui, options, d)
>>   File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 317,
>> in runcommand
>>     ret = _runcommand(ui, options, cmd, d)
>>   File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 501,
>> in _runcommand
>>     return checkargs()
>>   File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 454,
>> in checkargs
>>     return cmdfunc()
>>   File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 448,
>> in <lambda>
>>     d = lambda: util.checksignature(func)(ui, *args, **cmdoptions)
>>   File "/usr/lib/pymodules/python2.6/mercurial/util.py", line 402, in check
>>     return func(*args, **kwargs)
>>   File "/usr/lib/pymodules/python2.6/mercurial/commands.py", line 2287, in pull
>>     other = hg.repository(cmdutil.remoteui(repo, opts), source)
>>   File "/usr/lib/pymodules/python2.6/mercurial/hg.py", line 63, in repository
>>     repo = _lookup(path).instance(ui, path, create)
>>   File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 254,
>> in instance
>>     inst.between([(nullid, nullid)])
>>   File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 175,
>> in between
>>     d = self.do_read("between", pairs=n)
>>   File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 126,
>> in do_read
>>     fp = self.do_cmd(cmd, **args)
>>   File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 79, in do_cmd
>>     resp = self.urlopener.open(urllib2.Request(cu, data, headers))
>>   File "/usr/lib/python2.6/urllib2.py", line 389, in open
>>     response = self._open(req, data)
>>   File "/usr/lib/python2.6/urllib2.py", line 407, in _open
>>     '_open', req)
>>   File "/usr/lib/python2.6/urllib2.py", line 367, in _call_chain
>>     result = func(*args)
>>   File "/usr/lib/pymodules/python2.6/mercurial/url.py", line 425, in https_open
>>     return self.do_open(self._makeconnection, req)
>>   File "/usr/lib/pymodules/python2.6/mercurial/keepalive.py", line
>> 248, in do_open
>>     raise urllib2.URLError(err)
>> URLError: <urlopen error [Errno 1] _ssl.c:480: error:14094410:SSL
>> routines:SSL3_READ_BYTES:sslv3 alert handshake failure>
>> abort: error: _ssl.c:480: error:14094410:SSL
>> routines:SSL3_READ_BYTES:sslv3 alert handshake failure
>>
>>
>>
>> Running 1.3.1 on kubuntu karmic:
>>
>> $ hg --version
>> Mercurial Distributed SCM (version 1.3.1)
>>
>> Copyright (C) 2005-2009 Matt Mackall <mpm@...> and others
>> This is free software; see the source for copying conditions. There is NO
>> warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
>>
>> $ uname -a
>> Linux arrow 2.6.31-14-generic #48-Ubuntu SMP Fri Oct 16 14:05:01 UTC
>> 2009 x86_64 GNU/Linux
>>
>> Any ideas?
>>
>> Regards,
>> Igor
>> _______________________________________________
>> Mercurial mailing list
>> Mercurial@...
>> http://selenic.com/mailman/listinfo/mercurial
>

_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Paul van der Linden-4]

I had the same problem with the auth configuration.

I tested this today a bit more, and it looks like if you put the auth  
configuration in the repository configuration file it will not work. When  
I put my auth configuration in my user configuration it works.

When you want your auth configuration in the repository configuration you  
will have to put it like this:  
https://<username>:<password>@<server>/<repo>/ but that won't solve  
anything for you. But maybe someone has some other configuration.

greets,
Paul

On Wed, 28 Oct 2009 13:22:15 +0100, Igor Lautar <igor.lautar@...>  
wrote:

> Hi All,
>
> We are setting up a repo served by hgwebdir over https. Apache
> requires client to have certificate issued by this server.
>
> I have .pam file that I've imported into firefox and are able to access  
> repo.
>
> Now I want to clone repo using hg (or use existing repo and
> authenticate to this repo).
>
> From docs, I've seen that [auth] section should be used:
>
> [paths]
> default = https://<server>/<repo>
>
> [auth]
> rc.prefix = <server>
> rc.username = <username>
> rc.password = <password>
> rc.key = <key>
> rc.cert = <cert>
> rc.schemes = https
>
> etc...

_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Dennis Brakhane-2]

On Wed, Oct 28, 2009 at 3:13 PM, Igor Lautar <igor.lautar@...> wrote:
> We have been also testing https only, and that works (with same paths
> as used in previous example).
>
> But after requiring client certificates, I cannot set-it up properly
> on client side.

AFAIK, Mercurial does not yet support client certificates. I have the
same problem with myself and
always wanted to write a patch to add support for it. Hmm, perhaps I
should do so, now that I know
I'm not the only one.

Greetings,
  Dennis
_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Igor Lautar-3]

Hi,

On Wed, Oct 28, 2009 at 6:45 PM, Paul van der Linden <paul@...> wrote:
> I had the same problem with the auth configuration.
>
> I tested this today a bit more, and it looks like if you put the auth
> configuration in the repository configuration file it will not work. When
> I put my auth configuration in my user configuration it works.

Just tried that, now I get:
abort: error: _ssl.c:337: error:140B0009:SSL
routines:SSL_CTX_use_PrivateKey_file:PEM lib

So it seams to at least have some effect. Yeah, and my private key is
password protected, but I do not how to tell mercurial the password
for it...
_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Igor Lautar-3]

Hi,

On Wed, Oct 28, 2009 at 11:02 PM, Dennis Brakhane
<brakhane@...> wrote:
> On Wed, Oct 28, 2009 at 3:13 PM, Igor Lautar <igor.lautar@...> wrote:
> AFAIK, Mercurial does not yet support client certificates. I have the
> same problem with myself and
> always wanted to write a patch to add support for it. Hmm, perhaps I
> should do so, now that I know
> I'm not the only one.

It would be great if you can check it out. I can also give you a hand.
However, I'm not 100% sure it didn't work in the past. Somebody had to
put those [auth] section stuff in.
In fact, digging through hg repo shows:

annotate doc/hgrc.5.txt @ 8847:7951f385fcb7

find changesets by author, revision, files, or words in the commit message
url: support client certificate files over HTTPS (issue643)

This extends the httpshandler with the means to utilise the auth
section to provide it with a PEM encoded certificate key file and
certificate chain file. This works also with sites that both require
client certificate authentication and basic or digest password
authentication, although the latter situation may require the user to
enter the PEM password multiple times.

author Henrik Stuart <hg@...>
date Sat Jun 20 10:58:57 2009 +0200 (4 months ago)
parents ac92775b3b80
children 75cc02e7f672

Seams HTTPS client cert support was added with 7951f385fcb7.

Regards,
Igor
_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Dennis Brakhane-2]

On Thu, Oct 29, 2009 at 7:50 AM, Igor Lautar <igor.lautar@...> wrote:
> It would be great if you can check it out. I can also give you a hand.
> However, I'm not 100% sure it didn't work in the past. Somebody had to
> put those [auth] section stuff in.

> [...]
> Seams HTTPS client cert support was added with 7951f385fcb7.

Indeed. I must have overlooked it. Thanks for the hint.
_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Igor Lautar-3]

Hi,

On Thu, Oct 29, 2009 at 7:17 PM, Dennis Brakhane
<brakhane@...> wrote:

> On Thu, Oct 29, 2009 at 7:50 AM, Igor Lautar <igor.lautar@...> wrote:
>> It would be great if you can check it out. I can also give you a hand.
>> However, I'm not 100% sure it didn't work in the past. Somebody had to
>> put those [auth] section stuff in.
>
>> [...]
>> Seams HTTPS client cert support was added with 7951f385fcb7.
>
> Indeed. I must have overlooked it. Thanks for the hint.
>

Well, I have (sort of) managed to get it going (w/o code changes).

First of all, it seams that user-wide hgrc (as pointed out in one of
previous posts) must be used for this to work.
- additionally, PEM private key file should not be protected by passphrase
  - if it is, hg asks for pass many times during operation, and stalls
at some point waiting for ssh handshake
  - it seams it only stalls when there is a delay in writing password
(like few secs, which is not really enough time to write it)

Interrupting it during this stall, I get:
Traceback (most recent call last):
  File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 43,
in _runcatch
    return _dispatch(ui, args)
  File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 449,
in _dispatch
    return runcommand(lui, repo, cmd, fullargs, ui, options, d)
  File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 317,
in runcommand
    ret = _runcommand(ui, options, cmd, d)
  File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 501,
in _runcommand
    return checkargs()
  File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 454,
in checkargs
    return cmdfunc()
  File "/usr/lib/pymodules/python2.6/mercurial/dispatch.py", line 448,
in <lambda>
    d = lambda: util.checksignature(func)(ui, *args, **cmdoptions)
  File "/usr/lib/pymodules/python2.6/mercurial/util.py", line 402, in check
    return func(*args, **kwargs)
  File "/usr/lib/pymodules/python2.6/mercurial/commands.py", line 2287, in pull
    other = hg.repository(cmdutil.remoteui(repo, opts), source)
  File "/usr/lib/pymodules/python2.6/mercurial/hg.py", line 63, in repository
    repo = _lookup(path).instance(ui, path, create)
  File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 254,
in instance
    inst.between([(nullid, nullid)])
  File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 175,
in between
    d = self.do_read("between", pairs=n)
  File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 126,
in do_read
    fp = self.do_cmd(cmd, **args)
  File "/usr/lib/pymodules/python2.6/mercurial/httprepo.py", line 79, in do_cmd
    resp = self.urlopener.open(urllib2.Request(cu, data, headers))
  File "/usr/lib/python2.6/urllib2.py", line 389, in open
    response = self._open(req, data)
  File "/usr/lib/python2.6/urllib2.py", line 407, in _open
    '_open', req)
  File "/usr/lib/python2.6/urllib2.py", line 367, in _call_chain
    result = func(*args)
  File "/usr/lib/pymodules/python2.6/mercurial/url.py", line 425, in https_open
    return self.do_open(self._makeconnection, req)
  File "/usr/lib/pymodules/python2.6/mercurial/keepalive.py", line
245, in do_open
    self._start_transaction(h, req)
  File "/usr/lib/pymodules/python2.6/mercurial/keepalive.py", line
338, in _start_transaction
    h.endheaders()
  File "/usr/lib/python2.6/httplib.py", line 892, in endheaders
    self._send_output()
  File "/usr/lib/python2.6/httplib.py", line 764, in _send_output
    self.send(msg)
  File "/usr/lib/pymodules/python2.6/mercurial/url.py", line 247, in _sendfile
    connection.send(self, data)
  File "/usr/lib/python2.6/httplib.py", line 723, in send
    self.connect()
  File "/usr/lib/python2.6/httplib.py", line 1100, in connect
    self.sock = ssl.wrap_socket(sock, self.key_file, self.cert_file)
  File "/usr/lib/python2.6/ssl.py", line 350, in wrap_socket
    suppress_ragged_eofs=suppress_ragged_eofs)
  File "/usr/lib/python2.6/ssl.py", line 118, in __init__
    self.do_handshake()
  File "/usr/lib/python2.6/ssl.py", line 293, in do_handshake
    self._sslobj.do_handshake()
KeyboardInterrupt


It would be also good if one could provide PEM passphrase to hg, and
hg remembers it for future uses. Can this be done now (haven't found
any clues in docs)?

Regards,
_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Paul van der Linden-4]

It looks like the security support in mercurial is not very complete. The  
gui client for windows (tortoisehg) and the eclipse client both just hangs  
when a PEM certificate with passphrase is used. And the same problem with  
repeatedly inputting passwords within one command happens when using http  
authentication. I think Mercurial needs some improvement there.

_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Paul van der Linden-4]

On Fri, 30 Oct 2009 15:29:54 +0100, Igor Lautar <igor.lautar@...>  
wrote:

> * cutout *
> Well, I have (sort of) managed to get it going (w/o code changes).
>
> First of all, it seams that user-wide hgrc (as pointed out in one of
> previous posts) must be used for this to work.
> - additionally, PEM private key file should not be protected by  
> passphrase
>   - if it is, hg asks for pass many times during operation, and stalls
> at some point waiting for ssh handshake

There are 2 ways to solve this:
     - If you have control over the server: be sure to activate keep alive  
on the server
        This will solve the many asks per command.
     - The other one is not easy, will add some dependencies, has to be  
accepted with the developers of mercurial, and maybe is very safe:
        We have to rewrite some code, the standard ssl support for python not  
very complete. It will need something like pyopenssl to override the  
standard passphrase callback of openssl, so we can store the passphrase  
somewhere in memory. So the callback can provide it again within the same  
hg instance.
       
>   - it seams it only stalls when there is a delay in writing password
> (like few secs, which is not really enough time to write it)
> * backtrace *

I've not had the stall problem, so I don't know how to solve this, this  
works normally here.

>
>
> It would be also good if one could provide PEM passphrase to hg, and
> hg remembers it for future uses. Can this be done now (haven't found
> any clues in docs)?

This doesn't seem like a good idea, that looks the same to me as putting  
the unencrypted/unprotected version of the private key on disk.

_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Martin Geisler-4]

"Paul van der Linden" <paul@...> writes:

Hi Paul

I'm CC'ing our HTTPS expert, perhaps he can help.

> It looks like the security support in mercurial is not very complete.
> The gui client for windows (tortoisehg) and the eclipse client both
> just hangs when a PEM certificate with passphrase is used.
> And the same problem with repeatedly inputting passwords within one
> command happens when using http authentication. I think Mercurial
> needs some improvement there.

Have you seen the [auth] section in the hgrc man page:

  http://www.selenic.com/mercurial/hgrc.5.html#auth

That will allow you to specify username and password for HTTP.

It also says something about PEM encoded certificates, but I don't
anything about those.

--
Martin Geisler

VIFF (Virtual Ideal Functionality Framework) brings easy and efficient
SMPC (Secure Multiparty Computation) to Python. See: http://viff.dk/.


_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Igor Lautar-3]

Hi,

On Mon, Nov 2, 2009 at 5:34 PM, Paul van der Linden <paul@...> wrote:
>> It would be also good if one could provide PEM passphrase to hg, and
>> hg remembers it for future uses. Can this be done now (haven't found
>> any clues in docs)?
>
> This doesn't seem like a good idea, that looks the same to me as putting
> the unencrypted/unprotected version of the private key on disk.

This was in the context of one hg command, so suggestion above would
address this.

Regards,
Igor
_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Igor Lautar-3]

Hi,

On Mon, Nov 2, 2009 at 7:22 PM, Martin Geisler <mg@...> wrote:

> "Paul van der Linden" <paul@...> writes:
>
> Hi Paul
>
> I'm CC'ing our HTTPS expert, perhaps he can help.
>
>> It looks like the security support in mercurial is not very complete.
>> The gui client for windows (tortoisehg) and the eclipse client both
>> just hangs when a PEM certificate with passphrase is used.
>> And the same problem with repeatedly inputting passwords within one
>> command happens when using http authentication. I think Mercurial
>> needs some improvement there.
>
> Have you seen the [auth] section in the hgrc man page:
>
>  http://www.selenic.com/mercurial/hgrc.5.html#auth
>
> That will allow you to specify username and password for HTTP.
>
> It also says something about PEM encoded certificates, but I don't
> anything about those.

If you take a look towards the beginning of this thread, there is a
lot of talk about that auth section.

There are 2 things:
* http[s] authentication
* client certificate and stuff that goes with it (private key,
certificate, passphrase)

First one is clear. You can also specify username (and pwd, but thats
not good idea) as part of URL.
However, for second one, you have to specify passphrase multiple times
during single session, which is sub-optimal (annoying and breaks
workflow).

Will try the keep alive trick.

Regards,

_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Henrik Stuart]

Igor Lautar wrote:

> Hi,
>
> On Mon, Nov 2, 2009 at 7:22 PM, Martin Geisler <mg@...> wrote:
>> "Paul van der Linden" <paul@...> writes:
>>
>> Hi Paul
>>
>> I'm CC'ing our HTTPS expert, perhaps he can help.
>>
>>> It looks like the security support in mercurial is not very complete.
>>> The gui client for windows (tortoisehg) and the eclipse client both
>>> just hangs when a PEM certificate with passphrase is used.
>>> And the same problem with repeatedly inputting passwords within one
>>> command happens when using http authentication. I think Mercurial
>>> needs some improvement there.
>> Have you seen the [auth] section in the hgrc man page:
>>
>>  http://www.selenic.com/mercurial/hgrc.5.html#auth
>>
>> That will allow you to specify username and password for HTTP.
>>
>> It also says something about PEM encoded certificates, but I don't
>> anything about those.
>
> If you take a look towards the beginning of this thread, there is a
> lot of talk about that auth section.
>
> There are 2 things:
> * http[s] authentication
> * client certificate and stuff that goes with it (private key,
> certificate, passphrase)
>
> First one is clear. You can also specify username (and pwd, but thats
> not good idea) as part of URL.
> However, for second one, you have to specify passphrase multiple times
> during single session, which is sub-optimal (annoying and breaks
> workflow).
>
> Will try the keep alive trick.

It is correct that you will need to input the PEM password multiple
times when connecting upstream. This is largely due to an inefficiency
in urllib2 and occasionally there are factors that make it impossible
for connections to be reused (I haven't looked too closely at this). For
the typical hg command it might require several over the wire commands
and this is why the password must be entered repeatedly. Currently it is
urllib2 prompting for the password so we're reliant on when it wants to
ask for it, which is whenever a new connection is made, unfortunately.

The only real alternative is to rip out the use of urllib2 and roll our
own thing, which will probably not be something that happens lightly.

The PEM certificate support is fairly new (it only arrived in 1.3). If
Eclipse and TortoiseHg do not work with it, please raise issues on their
respective issue trackers.

This is where we're at currently, and I'm afraid that there's no easy
way to help solve your problem with client certificates.

--
Kind regards,
  Henrik Stuart
_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Igor Lautar-3]

Hi,

On Mon, Nov 2, 2009 at 5:34 PM, Paul van der Linden <paul@...> wrote:
>>   - it seams it only stalls when there is a delay in writing password
>> (like few secs, which is not really enough time to write it)
>> * backtrace *
>
> I've not had the stall problem, so I don't know how to solve this, this
> works normally here.

I looked at transfer during this hang, and got the following TCP sequence:
TCP 55210 > https [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=369583 TSER=0 WS=7
TCP https > 55210 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1292
TSV=274543409 TSER=369583 WS=7
TCP 55210 > https [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=369587 TSER=274543409
SSLv2 Client Hello
TCP [TCP Dup ACK 116#1] https > 55210 [ACK] Seq=1 Ack=1 Win=741376 Len=0
TCP [TCP Dup ACK 116#2] https > 55210 [ACK] Seq=1 Ack=1 Win=741376
Len=0 TSV=274545584 TSER=274544359
SSLv2 [TCP Retransmission] Client Hello
TCP [TCP Dup ACK 116#3] https > 55210 [ACK] Seq=1 Ack=1 Win=741376 Len=0
TCP [TCP Dup ACK 116#4] https > 55210 [ACK] Seq=1 Ack=1 Win=741376
Len=0 TSV=274545641 TSER=274544359
...

and last 3 being repeated endlessly. Seams like a problem in making
SSL handshake go through.

Anybody with experience that would point in right direction? Could it
be something on server side not going on with hg (some configuration
on apache)?

Regards,
Igor

_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Igor Lautar-3]

Hi All,

Just a follow up.

I've tried implementing our shared repo using mercurial-server via SSH
instead. Combining that with ssh-agent (and pageant on Windows) seams
like a satisfactory solution. I still have to set-up ACLs on repos,
but first impressions are good.
One thing missing is hgwebdir web interface (for graph views etc.),
but we can get that functionality back with local hg serve.

This would not be possible w/o having control over server itself, so I
can imagine being issue for some users. Hopefully more people will use
HTTPS and support will get better over time. If needed, I can give a
hand in testing potential improvements.

Thx for all tips and help provided in this thread.

Regards,
Igor

On Tue, Nov 3, 2009 at 9:10 AM, Igor Lautar <igor.lautar@...> wrote:
<cut>
_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Paul van der Linden-4]

On Mon, 02 Nov 2009 22:16:53 +0100, Henrik Stuart <hg@...> wrote:

>
> It is correct that you will need to input the PEM password multiple
> times when connecting upstream. This is largely due to an inefficiency
> in urllib2 and occasionally there are factors that make it impossible
> for connections to be reused (I haven't looked too closely at this). For
> the typical hg command it might require several over the wire commands
> and this is why the password must be entered repeatedly. Currently it is
> urllib2 prompting for the password so we're reliant on when it wants to
> ask for it, which is whenever a new connection is made, unfortunately.
>
> The only real alternative is to rip out the use of urllib2 and roll our
> own thing, which will probably not be something that happens lightly.
>
> The PEM certificate support is fairly new (it only arrived in 1.3). If
> Eclipse and TortoiseHg do not work with it, please raise issues on their
> respective issue trackers.
>
> This is where we're at currently, and I'm afraid that there's no easy
> way to help solve your problem with client certificates.
>

It looks to me like there is nothing wrong with the urllib2, at least for  
normal passwords and for normal reusing of connections.
The connection reusing won't be able to do it's job because some servers  
are not configured to do keepalive (the standard package of red hat  
enterprise for example).
The problem is that when I put in a password (for http authentication), it  
won't get used like normally when I put it in a configuration file. I  
would like to type it only once per command (just like putting it in the  
configuration file, except it doesn't get stored on disk). I don't like  
storing passwords on disk, as you would understand.

The PEM password problem is more complicated but doesn't require to not  
use the urllib2 library. The problem is the ssl module (which is used to  
wrap the socket) which doesn't give any possibility for a callback for PEM  
passwords. It looks like the library which is used by the ssl module  
(OpenSSL) *does* provide this functionality. I will look for it but I  
think there is no easy solution.

For the Eclipse Plugin & TortoiseHg: I've reported these issue indeed.

_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial

[Marcin Kasperski-4]

> I tested this today a bit more, and it looks like if you put the auth  
> configuration in the repository configuration file it will not work. When  
> I put my auth configuration in my user configuration it works.

I also faced this recently. Here is my workaround:

http://bitbucket.org/Mekk/mercurial_keyring/src/62d2b5bbd611/mercurial_keyring.py#cl-324

--
----------------------------------------------------------------------
| Marcin Kasperski   | You have the right to peace, fun, and
| http://mekk.waw.pl | productive and enjoyable work. (Beck)
----------------------------------------------------------------------

_______________________________________________
Mercurial mailing list
Mercurial@...
http://selenic.com/mailman/listinfo/mercurial