vmware-nsxlib/vmware_nsxlib
Shawn Wang 1bbcc22d31 Add support of pinning NSX leaf cert
In order to support cert pinning in WCP, this change adds exact cert
match for checking NSX manager authenticity. Setting "nsx_cert_der"
enables this mode, where the pritotity is below ca cert and above
thumbprints.

Currently in nsxlib, the call chain to manage HTTPs connextion is:
1. NSXHTTPAdapter (subclass of urllib3 HTTPAdapter)
2. urllib3 PoolManager
3. urllib3 HTTPSConnectionPool
4. urllib3 HTTPSConnection
In order to inject custom TLS cert validation, we have to override the
connect() function in HTTPSConnection level. Introducing a child class
of HTTPSConnectionPool is also needed to pass the new param. Pool
manager only needs overrding two attrs to allow passing the new param
and properly binding to the new child class of connection pool.

When leaf cert verification is not used, the native urllib3 behavior
will be kept to reduce regression risk.

Change-Id: Icecf30b6df3b60fbeac20cf79586827f3370ce13
2024-02-05 23:30:21 +00:00
..
tests Add support of pinning NSX leaf cert 2024-02-05 23:30:21 +00:00
v3 Add support of pinning NSX leaf cert 2024-02-05 23:30:21 +00:00
__init__.py Add initial framework using cookiecutter 2016-08-08 20:41:29 +00:00
_i18n.py Drop log translations 2017-03-27 08:03:53 +03:00
version.py Move all nsxlib code and tests to vmware_nsxlib 2016-10-06 09:59:47 +03:00