summaryrefslogtreecommitdiff
path: root/tests/test_ssl.py
Commit message (Collapse)AuthorAgeFilesLines
* Fix failure to create glance https connection poolHaikel Guemar2015-12-221-0/+16
| | | | | | | | | | | | Due to a typo in an attribute named, an Attribute error is raised causing failure in connection to glance through HTTPS Urllib3 PoolManager class has a connection_pool_kw attribute but not connection_kw Change-Id: Id4d6a5bdcf971d09e80043fd2ab399e208fd931c Closes-Bug: #1479020 (cherry picked from commit c41dcc9f4366429d952cc47853496d58d47b7511)
* Fix client when using no ssl compressionStuart McLaren2015-04-161-0/+42
| | | | | | | | | | | | Since the release of the 0.16.1 client, using the 'no ssl compression' option, whether on the command line, or via the library -- Nova does this by default -- a stack trace was generated. Closes-bug: 1442664 Related-bug: 1357430 Change-Id: I2b8ddcb0a7ae3cfccdfc20d3ba476f3b4f4ec32d (cherry picked from commit c698b4e3227b4767f042e435423fcc307d7f6d5c)
* Add SSL cert verification regression testsStuart McLaren2015-04-161-21/+108
| | | | | | | | | | | | | | | A security bug (1357430) was introduced which meant that SSL certificate verification was not occurring. Add new tests which help prevent the 'requests' part of bug 115260 recurring. Note: Cherry-picking onto the stable branch -- these tests are required for proper testing of one of the SSL related fixes. Change-Id: Iaf56fd8bc34fa8f35c2fd7051f9f8424002352cf Related-bug: 1357430 (cherry picked from commit 64a1a0fdcc563579a8b01d10debfafc4cc160f81)
* Merge "https: Prevent leaking sockets for some operations"Jenkins2015-03-041-9/+12
|\
| * https: Prevent leaking sockets for some operationsStuart McLaren2015-02-181-9/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Other OpenStack services which instantiate a 'https' glanceclient using ssl_compression=False and insecure=False (eg Nova, Cinder) are leaking sockets due to glanceclient not closing the connection to the Glance server. This could happen for a sub-set of calls, eg 'show', 'delete', 'update'. netstat -nopd would show the sockets would hang around forever: ... 127.0.0.1:9292 ESTABLISHED 9552/python off (0.00/0/0) urllib's ConnectionPool relies on the garbage collector to tear down sockets which are no longer in use. The 'verify_callback' function used to validate SSL certs was holding a reference to the VerifiedHTTPSConnection instance which prevented the sockets being torn down. Change-Id: Idb3e68151c48ed623ab89d05d88ea48465429838 Closes-bug: 1423165
* | Merge "Register our own ConnectionPool without globals"Jenkins2015-02-261-4/+4
|\ \
| * | Register our own ConnectionPool without globalsIan Cordasco2015-02-061-4/+4
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, on systems like Fedora and Debian, it is possible to import urllib3 as well as requests.packages.urllib3. They functionally point to the same code but sys.modules considers them to be separate items. When downstream packagers unvendor urllib3 from requests, they also change all the imports inside of the package. So if the code imports urllib3 from requests.packages.urllib3 and modifies globals in a submodule, that will not be visible to requests since it has been rewritten to use urllib3 (not requests.packages.urllib3). By handling this logic ourselves, we can issue a release until upstream packages and requests can fix this and cut a new release. Change-Id: Ic77ce8a06d9d148a899b4b8695990fca8fdaefc5 Closes-bug: 1396550
* | Update HTTPS certificate handling for pep-0476James Page2014-12-191-0/+2
|/ | | | | | | | | | | | | | This pep (included in python 2.7.9) changes the behaviour of SSL certificate chain handling to be more py3 like. Include required new exception behaviour in the list of exceptions to translate under py2. https://github.com/python/peps/blob/master/pep-0476.txt Closes-Bug: 1404227 Change-Id: I7da1a13d1ec861a07fd96684d0431508a214a2c8
* Don't replace the https handler in the poolmanagerFlavio Percoco2014-10-301-1/+11
| | | | | | | | | | | | | | | | | In order to keep the support for `--ssl-nocompression` it was decided to overwrite the https HTTPAdapter in `requests` poolmanager. Although this seemed to work correctly, it was causing some issues when using glanceclient from other services that rely on requests and that were also configured to use TLS. THis patch changes implements a different strategy by using `glance+https` as the scheme to use when `no-compression` is requested. Closes-bug: #1350251 Closes-bug: #1347150 Closes-bug: #1362766 Change-Id: Ib25237ba821ee20a561a163b79402d1375ebed0b
* Replace old httpclient with requestsAmalaBasha2014-07-101-36/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This review implements blueprint python-request and replaces the old http client implementation in favor of a new one based on python-requests. Major changes: * raw_request and json_request removed since everything is now being handled by the same method "_request" * New methods that match HTTP's methods were added: - get - put - post - head - patch - delete * Content-Type is now being "inferred" based on the data being sent: - if it is file-like object it chunks the request - if it is a python type not instance of basestring then it'll try to serialize it to json - Every other case will keep the incoming content-type and will send the data as is. * Glanceclient's HTTPSConnection implementation will be used if no-compression flag is set to True. Co-Author: Flavio Percoco<flaper87@gmail.com> Change-Id: I09f70eee3e2777f52ce040296015d41649c2586a
* Enable F841ChangBo Guo(gcb)2014-07-091-28/+25
| | | | | | | F841 detects local variable is assigned to but never used. This commit fixes the violations and enables F841 in gate. Change-Id: Ic4dcac2733dfe334009327ac17aa3952cafaa63a
* Fix CA certificate handlingStuart McLaren2014-06-251-0/+21
| | | | | | | | | | | | | | | | | | If --os-cacert was passed to the cli the following error was triggered: "cafile must be None or a byte string". This is because 'load_verify_locations' requires a byte string to be passed in. We fix this by explicitly converting the argument to a byte string. We do this in 'VerifiedHTTPSConnection' rather than sooner, eg during arg handling, as it will no longer be required should we move to a different http library (eg requests). Fixes bug 1301849. Change-Id: I9014f5d040cae9f0b6f03d8f13de8419597560cb
* Finalize Python3 supportFrederic Lepied2014-05-201-0/+2
| | | | | | | Set the environment variable PYTHONHASHSEED to 0 to have predictive tests under Python 3. Change-Id: Ia15a9383e0f20bd0e4572e9f9b9772f1704dff86
* Merge "Fix the parameter order of assertEqual in glanceclient test"Jenkins2014-04-211-7/+7
|\
| * Fix the parameter order of assertEqual in glanceclient testEiichi Aikawa2014-02-251-7/+7
| | | | | | | | | | | | | | | | | | On assertEqual, the order of parameters should be (expected, observed). But, some part of glanceclient test were written with invalid order. This patch fixes this problem. Change-Id: I7722fdce766ce3cc5bc9944dc72d7d0af0b09f69 Partially-bug: #1277104
* | Replace file with open, which is Python 3 compatibleAlex Gaynor2014-02-131-6/+6
|/ | | | Change-Id: I471ae9b372f88a508d4654b1a18c6da90397a828
* Fix misspellings in python-glanceclientShane Wang2014-02-071-2/+2
| | | | | | | | | Fix misspellings detected by: * pip install misspellings * git ls-files | grep -v locale | misspellings -f - Change-Id: I504521e702c675640ab3869c608fa96edd2477b4 Closes-Bug: #1257295
* Merge "Fix and enable gating on H306"Jenkins2013-12-231-1/+1
|\
| * Fix and enable gating on H306Dirk Mueller2013-12-161-1/+1
| | | | | | | | | | | | H306 - module imports should be in alphabetical order Change-Id: I1f8fc25b0e6ca23c21c90bda420f42a45141c2e2
* | SSL: Handle wildcards in Subject Alternative NamesDominik Heidler2013-12-111-0/+28
|/ | | | | | Closes-Bug: #1259528 Change-Id: Iedc2b98d47f1f9433a4cfd77e07f7f86bae806c1
* Replace OpenStack LLC with OpenStack FoundationZhiQiang Fan2013-09-201-1/+1
| | | | | Change-Id: I38dcbcf1a6c8efe540fcf5f29e782cb3826e583d Fixes-Bug: #1214176
* Allow single-wildcard SSL common name matchingBrian Waldon2013-08-211-0/+15
| | | | | | Fix bug 1212463 Change-Id: I168601fd9847497c2261c77ce6c856bca187c6c8
* Fix SSL certificate CNAME checkingThomas Leaman2013-07-151-5/+5
| | | | | | | | | | | | Currently, accessing a host via ip address will pass SSL verification; the CNAME is not checked as intended as part of verify_callback. 'preverify_ok is True' will always return false (int/bool comparison). preverify_ok will be 1 if preverification has passed. Fixes bug 1192229 Change-Id: Ib651548ab4289295a9b92ee039b2aff2d08aba5f
* Start using Pyflakes and HackingDirk Mueller2013-06-221-6/+6
| | | | | | | | | | Instead of globally ignoring pyflakes and hacking warnings, only blacklist those that trigger very frequently so far, in order to clean them up in followup commits. Fix and start gating on the rest already. Change-Id: Ied7c7250061e3bf379e8286e8ce3b9e4af817faf
* Improve unit tests for python-glanceclient.glanceclient.common.httpTatyana Leontovich2013-04-041-1/+46
| | | | | | | Add several tests for glanceclient.common.http module Fixes: bug #1149445 Change-Id: I6a47c64e11cefea276163777dcd559316fc8e0ad
* Use testtools instead of unittest.Monty Taylor2013-01-021-2/+2
| | | | | | Part of blueprint grizzly-testtools Change-Id: Ie914fd8f59cddb1a480566ec4eff908bfb51921c
* Support --os-cacertDean Troyer2012-12-111-12/+12
| | | | | | | | | | | | | * Rename --ca-file to --os-cacert (--ca-file deprecated for backward compatibility) * Add cacert to keystoneclient initialization to verify the keystone server certificate This aligns glanceclient with keystoneclient for option naming and the use of TLS for the keystone auth connection. It does not change the use of TLS/SSL for the glance connection. Change-Id: If8b05655aea5f3c62612d77bf947dd790f77eddf
* Verify that host matches certificateStuart McLaren2012-11-201-0/+74
| | | | | | | | | | When using https verify that the Common Name (CN) or the Subject Alternative Name listed in the server's certificate match the host we are connected to. Addresses LP bug 1079692. Change-Id: I24ea1511a2cbdb7c34ce72ac704d7b5e7d57cec2
* Implement blueprint ssl-connect-reworkStuart McLaren2012-10-081-0/+112
Use pyOpenSSL for HTTPS connections. This allows: * Neater loading of system CA files * Optional disabling of SSL compression The performance gain from disabling SSL compression is significant in cases where the image being uploaded/downloaded is in an already compressed format (eg qcow2). Related to bp ssl-connect-rework. Change-Id: I0568b6c95c5fc7b8eafdbd0284e24c453660a55a
View Lorry Controller Status