Merge lp:~dobey/ubuntu-sso-client/ssl-strict into lp:ubuntu-sso-client

[dobey]

Ensure we are using strict ssl with the system ca-certificates.crt file

[Roberto Alsina (ralsina)]

review: Approve

[dobey (dobey)]

Now, I'm seeing this at the end of the gtk+ tests run, preventing the qt tests and style checks from running:

PASSED (skips=9, successes=822)
Segmentation fault (core dumped)

Not sure why though.

[Alejandro J. Cura (alecu)]

I'm getting the same segmentation errors on Precise 64 bits.

[Alejandro J. Cura (alecu)]

Passes all tests now

review: Approve

=== modified file 'ubuntu_sso/gtk/gui.py'
--- ubuntu_sso/gtk/gui.py	2012-04-11 16:38:28 +0000
+++ ubuntu_sso/gtk/gui.py	2012-06-13 20:18:19 +0000
@@ -109,6 +109,12 @@
 LARGE_MARKUP = u'<span size="x-large">%s</span>'
 
 
+# SSL properties and certs location
+STRICT_SSL_PROP = 'ssl-strict'
+CERTS_FILE_PROP = 'ssl-ca-file'
+CA_CERT_FILE = '/etc/ssl/certs/ca-certificates.crt'
+
+
 def log_call(f):
     """Decorator to log call funtions."""
 
@@ -953,11 +959,23 @@
 
         self._set_current_page(self.processing_vbox)
 
+    def _webkit_init_ssl(self):
+        """Set the WebKit ssl strictness."""
+        # delay the import of webkit to be able to build without it
+        from gi.repository import WebKit  # pylint: disable=E0611
+
+        # Set the Soup session to be strict and use system CA certs
+        session = WebKit.get_default_session()
+        session.set_property(STRICT_SSL_PROP, True)
+        session.set_property(CERTS_FILE_PROP, CA_CERT_FILE)
+
     def _add_webkit_browser(self):
         """Add the webkit browser for the t&c."""
         # delay the import of webkit to be able to build without it
         from gi.repository import WebKit  # pylint: disable=E0611
 
+        self._webkit_init_ssl()
+
         browser = WebKit.WebView()
 
         browser.connect('notify::load-status',

=== modified file 'ubuntu_sso/gtk/tests/test_gui.py'
--- ubuntu_sso/gtk/tests/test_gui.py	2012-04-11 16:38:28 +0000
+++ ubuntu_sso/gtk/tests/test_gui.py	2012-06-13 20:18:19 +0000
@@ -911,6 +911,7 @@
     def setUp(self):
         yield super(TermsAndConditionsBrowserTestCase, self).setUp()
         self.patch(WebKit, 'WebView', FakedEmbeddedBrowser)
+        self.patch(self.ui, '_webkit_init_ssl', self._set_called)
 
         self.ui.tc_button.clicked()
         self.addCleanup(self.ui.tc_browser_vbox.hide)
@@ -919,6 +920,12 @@
         assert len(children) == 1
         self.browser = children[0]
 
+    def test_ssl_validation(self):
+        """The browser is set to validate SSL."""
+        self.assertEqual(self._called, ((), {}),
+                         '_webkit_init_ssl should be called when creating a '
+                         'webkit browser.')
+
     def test_tc_browser_is_created_when_tc_page_is_shown(self):
         """The browser is created when the TC button is clicked."""
         self.ui.on_tc_browser_notify_load_status(self.browser)