Author: tomaz
Date: Wed Jul 13 21:45:23 2011
New Revision: 1146493
URL: http://svn.apache.org/viewvc?rev=1146493&view=rev
Log:
Add VERIFY_SSL_CERT_STRICT variable to the libcloud.security and throw a
RuntimeError if SSL verification is enabled and CA certificates could not be
found.
Modified:
libcloud/trunk/libcloud/httplib_ssl.py
libcloud/trunk/libcloud/security.py
libcloud/trunk/test/test_httplib_ssl.py
Modified: libcloud/trunk/libcloud/httplib_ssl.py
URL:
http://svn.apache.org/viewvc/libcloud/trunk/libcloud/httplib_ssl.py?rev=1146493&r1=1146492&r2=1146493&view=diff
==============================================================================
--- libcloud/trunk/libcloud/httplib_ssl.py (original)
+++ libcloud/trunk/libcloud/httplib_ssl.py Wed Jul 13 21:45:23 2011
@@ -48,6 +48,7 @@ class LibcloudHTTPSConnection(httplib.HT
inherited httplib.HTTPSConnection connect()
"""
self.verify = libcloud.security.VERIFY_SSL_CERT
+ self.strict = libcloud.security.VERIFY_SSL_CERT_STRICT
if self.verify:
self._setup_ca_cert()
@@ -71,10 +72,13 @@ class LibcloudHTTPSConnection(httplib.HT
# use first available certificate
self.ca_cert = ca_certs_available[0]
else:
- # no certificates found; toggle verify to False
- warnings.warn(libcloud.security.CA_CERTS_UNAVAILABLE_MSG)
- self.ca_cert = None
- self.verify = False
+ if self.strict:
+ raise
RuntimeError(libcloud.security.CA_CERTS_UNAVAILABLE_ERROR_MSG)
+ else:
+ # no certificates found; toggle verify to False
+
warnings.warn(libcloud.security.CA_CERTS_UNAVAILABLE_WARNING_MSG)
+ self.ca_cert = None
+ self.verify = False
def connect(self):
"""Connect
Modified: libcloud/trunk/libcloud/security.py
URL:
http://svn.apache.org/viewvc/libcloud/trunk/libcloud/security.py?rev=1146493&r1=1146492&r2=1146493&view=diff
==============================================================================
--- libcloud/trunk/libcloud/security.py (original)
+++ libcloud/trunk/libcloud/security.py Wed Jul 13 21:45:23 2011
@@ -24,6 +24,7 @@ Usage:
"""
# For backward compatibility this option is disabled by default
VERIFY_SSL_CERT = False
+VERIFY_SSL_CERT_STRICT = True
# File containing one or more PEM-encoded CA certificates
# concatenated together
@@ -41,11 +42,15 @@ CA_CERTS_PATH = [
'/opt/local/share/curl/curl-ca-bundle.crt',
]
-CA_CERTS_UNAVAILABLE_MSG = (
+CA_CERTS_UNAVAILABLE_WARNING_MSG = (
'Warning: No CA Certificates were found in CA_CERTS_PATH. '
'Toggling VERIFY_SSL_CERT to False.'
)
+CA_CERTS_UNAVAILABLE_ERROR_MSG = (
+ 'No CA Certificates were found in CA_CERTS_PATH. '
+)
+
VERIFY_SSL_DISABLED_MSG = (
'SSL certificate verification is disabled, this can pose a '
'security risk. For more information how to enable the SSL '
Modified: libcloud/trunk/test/test_httplib_ssl.py
URL:
http://svn.apache.org/viewvc/libcloud/trunk/test/test_httplib_ssl.py?rev=1146493&r1=1146492&r2=1146493&view=diff
==============================================================================
--- libcloud/trunk/test/test_httplib_ssl.py (original)
+++ libcloud/trunk/test/test_httplib_ssl.py Wed Jul 13 21:45:23 2011
@@ -97,15 +97,29 @@ class TestHttpLibSSLTests(unittest.TestC
def test_setup_verify(self):
# @TODO: catch warnings
+ # non-strict mode,s hould just emit a warning
libcloud.security.VERIFY_SSL_CERT = True
+ libcloud.security.VERIFY_SSL_CERT_STRICT = False
self.httplib_object._setup_verify()
+ # strict mode, should throw a runtime error
+ libcloud.security.VERIFY_SSL_CERT = True
+ libcloud.security.VERIFY_SSL_CERT_STRICT = True
+ try:
+ self.httplib_object._setup_verify()
+ except:
+ pass
+ else:
+ self.fail('Exception not thrown')
+
libcloud.security.VERIFY_SSL_CERT = False
+ libcloud.security.VERIFY_SSL_CERT_STRICT = False
self.httplib_object._setup_verify()
def test_setup_ca_cert(self):
# @TODO: catch warnings
self.httplib_object.verify = False
+ self.httplib_object.strict = False
self.httplib_object._setup_ca_cert()
self.assertEqual(self.httplib_object.ca_cert, None)
