openstack/python-glanceclient
Code Issues Proposed changes

Merge "Fix SSL certificate CNAME checking"

Browse Source
This commit is contained in:
Jenkins
2013-07-22 21:50:07 +00:00
committed by Gerrit Code Review
parent 093064caa8 822cd64c07
commit 49a1207266
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
glanceclient/common/http.py
View File

@@ -343,11 +343,13 @@ class VerifiedHTTPSConnection(HTTPSConnection):
def verify_callback(self, connection, x509, errnum, def verify_callback(self, connection, x509, errnum,
depth, preverify_ok): depth, preverify_ok):
# NOTE(leaman): preverify_ok may be a non-boolean type
preverify_ok = bool(preverify_ok)
if x509.has_expired(): if x509.has_expired():
msg = "SSL Certificate expired on '%s'" % x509.get_notAfter() msg = "SSL Certificate expired on '%s'" % x509.get_notAfter()
raise exc.SSLCertificateError(msg) raise exc.SSLCertificateError(msg)
if depth == 0 and preverify_ok is True: if depth == 0 and preverify_ok:
# We verify that the host matches against the last # We verify that the host matches against the last
# certificate in the chain # certificate in the chain
return self.host_matches_cert(self.host, x509) return self.host_matches_cert(self.host, x509)

10
tests/test_ssl.py
View File

@@ -125,7 +125,7 @@ class TestVerifiedHTTPSConnection(testtools.TestCase):
self.assertEqual(cert.get_subject().commonName, '0.0.0.0') self.assertEqual(cert.get_subject().commonName, '0.0.0.0')
try: try:
conn = http.VerifiedHTTPSConnection('0.0.0.0', 0) conn = http.VerifiedHTTPSConnection('0.0.0.0', 0)
conn.verify_callback(None, cert, 0, 0, True) conn.verify_callback(None, cert, 0, 0, 1)
except Exception: except Exception:
self.fail('Unexpected exception.') self.fail('Unexpected exception.')
@@ -140,13 +140,13 @@ class TestVerifiedHTTPSConnection(testtools.TestCase):
self.assertEqual(cert.get_subject().commonName, '0.0.0.0') self.assertEqual(cert.get_subject().commonName, '0.0.0.0')
try: try:
conn = http.VerifiedHTTPSConnection('alt1.example.com', 0) conn = http.VerifiedHTTPSConnection('alt1.example.com', 0)
conn.verify_callback(None, cert, 0, 0, True) conn.verify_callback(None, cert, 0, 0, 1)
except Exception: except Exception:
self.fail('Unexpected exception.') self.fail('Unexpected exception.')
try: try:
conn = http.VerifiedHTTPSConnection('alt2.example.com', 0) conn = http.VerifiedHTTPSConnection('alt2.example.com', 0)
conn.verify_callback(None, cert, 0, 0, True) conn.verify_callback(None, cert, 0, 0, 1)
except Exception: except Exception:
self.fail('Unexpected exception.') self.fail('Unexpected exception.')
@@ -165,7 +165,7 @@ class TestVerifiedHTTPSConnection(testtools.TestCase):
self.fail('Failed to init VerifiedHTTPSConnection.') self.fail('Failed to init VerifiedHTTPSConnection.')
self.assertRaises(exc.SSLCertificateError, self.assertRaises(exc.SSLCertificateError,
conn.verify_callback, None, cert, 0, 0, True) conn.verify_callback, None, cert, 0, 0, 1)
def test_ssl_expired_cert(self): def test_ssl_expired_cert(self):
""" """
@@ -183,7 +183,7 @@ class TestVerifiedHTTPSConnection(testtools.TestCase):
self.fail('Failed to init VerifiedHTTPSConnection.') self.fail('Failed to init VerifiedHTTPSConnection.')
self.assertRaises(exc.SSLCertificateError, self.assertRaises(exc.SSLCertificateError,
conn.verify_callback, None, cert, 0, 0, True) conn.verify_callback, None, cert, 0, 0, 1)
def test_ssl_broken_key_file(self): def test_ssl_broken_key_file(self):
""" """