Merge lp:~alecu/ubuntuone-storage-protocol/validate-ssl-cert into lp:ubuntuone-storage-protocol

[Alejandro J. Cura]

- Validate SSL certificates (LP: #882062).

[lp:~alecu/ubuntuone-storage-protocol/validate-ssl-cert]

159. By Alejandro J. Cura on 2012-06-08

The forgotten tests

Unmerged revisions

159. By Alejandro J. Cura on 2012-06-08

The forgotten tests

158. By Alejandro J. Cura on 2012-06-06

Validate SSL certificates

157. By dobey on 2012-05-18

[release] 3.0.1

156. By dobey on 2012-04-10

[release] 3.0.0

155. By Natalia Bidart on 2012-04-03

- Release v2.99.92.

154. By dobey on 2012-04-03

- Updating from trunk up to revno 145:

[ Rodney Dawes <email address hidden> ]
  - License exception for use of OpenSSL (LP: #968555).

153. By dobey on 2012-03-20

[release] 2.99.91

152. By Natalia Bidart on 2012-03-06

- Release v2.99.90.

151. By dobey on 2012-02-21

[release] 2.99.5

150. By dobey on 2012-02-15

[release] 2.99.4

=== modified file 'setup.py'
--- setup.py	2012-05-24 19:10:04 +0000
+++ setup.py	2012-06-06 14:31:18 +0000
@@ -70,7 +70,11 @@
 
 
 setup(name='ubuntuone-storage-protocol',
+<<<<<<< TREE
       version='4.1',
+=======
+      version='3.0.1',
+>>>>>>> MERGE-SOURCE
       packages=['ubuntuone',
                 'ubuntuone.storageprotocol'],
       extra_path='ubuntuone-storage-protocol',

=== modified file 'ubuntuone/storageprotocol/context.py'
--- ubuntuone/storageprotocol/context.py	2012-03-29 20:28:09 +0000
+++ ubuntuone/storageprotocol/context.py	2012-06-06 14:31:18 +0000
@@ -34,6 +34,7 @@
 
 from OpenSSL import SSL
 from twisted.internet import ssl
+from twisted.python import log
 
 if sys.platform == "win32":
     # diable pylint warning, as it may be the wrong platform
@@ -58,18 +59,47 @@
     ssl_cert_location = '/etc/ssl/certs'
 
 
-def get_ssl_context(no_verify):
-    """ Get the ssl context """
+class HostnameVerifyContextFactory(ssl.CertificateOptions):
+    """Does hostname checks in addition to certificate checks."""
+
+    def __init__(self, hostname, *args, **kwargs):
+        """Initialize this instance."""
+        super(HostnameVerifyContextFactory, self).__init__(*args, **kwargs)
+        self.expected_hostname = hostname
+
+    def verify_server_hostname(self, conn, cert, errno, depth, preverifyOK):
+        """Verify the server hostname."""
+        if depth == 0:
+            # No extra checks because U1 certs have the right commonName
+            if self.expected_hostname != cert.get_subject().commonName:
+                log.err("Host name does not match certificate. "
+                        "Expected %s but got %s." % (self.expected_hostname,
+                            cert.get_subject().commonName))
+                return False
+        return preverifyOK
+
+    def getContext(self):
+        """The context returned will verify the hostname too."""
+        ctx = super(HostnameVerifyContextFactory, self).getContext()
+        flags = SSL.VERIFY_PEER | SSL.VERIFY_FAIL_IF_NO_PEER_CERT
+        ctx.set_verify(flags, self.verify_server_hostname)
+        return ctx
+
+
+def get_certificates():
+    """Get a list of certificate paths."""
+    ca_file = ssl.Certificate.loadPEM(file(os.path.join(ssl_cert_location,
+                     'UbuntuOne-Go_Daddy_Class_2_CA.pem'), 'r').read())
+    ca_file_2 = ssl.Certificate.loadPEM(file(os.path.join(ssl_cert_location,
+                    'UbuntuOne-Go_Daddy_CA.pem'), 'r').read())
+    return [ca_file.original, ca_file_2.original]
+
+
+def get_ssl_context(no_verify, hostname):
+    """Get the ssl context."""
     if no_verify:
         ctx = ssl.ClientContextFactory()
     else:
-        ca_file = ssl.Certificate.loadPEM(file(
-            os.path.join(ssl_cert_location,
-                         'UbuntuOne-Go_Daddy_Class_2_CA.pem'), 'r').read())
-        ca_file_2 = ssl.Certificate.loadPEM(file(
-            os.path.join(ssl_cert_location,
-                        'UbuntuOne-Go_Daddy_CA.pem'), 'r').read())
-        ctx = ssl.CertificateOptions(verify=True,
-            caCerts=[ca_file.original, ca_file_2.original],
-                     method=SSL.SSLv23_METHOD)
+        ctx = HostnameVerifyContextFactory(hostname, verify=True,
+                          caCerts=get_certificates(), method=SSL.SSLv23_METHOD)
     return ctx