Merge lp:~mandel/ubuntu-sso-client/libsoup-ssl-dialog into lp:ubuntu-sso-client

[Manuel de la Peña]

- Added the required logic to allow the libsoup weclient implementation to spawn the ssl dialog that will allow the user to accept an ssl cert with errors (LP: #939671)

- Added the required logic to allow the libsoup weclient implementation to spawn the ssl dialog that will allow the user to accept an ssl cert with errors (LP: #939671)

[lp:~mandel/ubuntu-sso-client/libsoup-ssl-dialog]

948. By Manuel de la Peña on 2012-03-14

Merged with trunk.

949. By Manuel de la Peña on 2012-03-15

Merged with trunk.

[Manuel de la Peña (mandel)]

Rejecting since we wont use this code.

review: Disapprove

Unmerged revisions

949. By Manuel de la Peña on 2012-03-15

Merged with trunk.

948. By Manuel de la Peña on 2012-03-14

Merged with trunk.

947. By Manuel de la Peña on 2012-03-12

Reduced diff size.

946. By Manuel de la Peña on 2012-03-12

Reduced diff size.

945. By Manuel de la Peña on 2012-03-12

Merged with trunk.

944. By Manuel de la Peña on 2012-03-12

Added the required code to let the libsoup webclient implementation deal with ssl cert errors.

943. By Manuel de la Peña on 2012-03-12

Made changes to the tests so that they work correctly.

942. By Manuel de la Peña on 2012-03-09

Commit to share progress.

941. By Manuel de la Peña on 2012-03-09

Merged with parent and fixed conflicts.

=== modified file 'ubuntu_sso/qt/ssl_dialog.py'
--- ubuntu_sso/qt/ssl_dialog.py	2012-03-06 14:13:10 +0000
+++ ubuntu_sso/qt/ssl_dialog.py	2012-03-15 11:28:19 +0000
@@ -63,7 +63,7 @@
 
 
 class SSLDialog(QDialog):
-    """"Dialog used to show SSL exceptions."""
+    """Dialog used to show SSL exceptions."""
 
     def __init__(self, app_name, domain=None, details=None, parent=None):
         """Create a new instance."""

=== modified file 'ubuntu_sso/utils/webclient/common.py'
--- ubuntu_sso/utils/webclient/common.py	2012-03-09 12:04:31 +0000
+++ ubuntu_sso/utils/webclient/common.py	2012-03-15 11:28:19 +0000
@@ -47,6 +47,16 @@
     """Failure raised when there is an issue with the proxy auth."""
 
 
+class SSLCertError(WebClientError):
+    """Failure raised when there is an issue with the ssl cert."""
+
+    def __init__(self, message, ssl_details=None, response=None):
+        """Create a new insance with the given details."""
+        super(SSLCertError, self).__init__(message)
+        self.ssl_details = ssl_details
+        self.response = response
+
+
 class Response(object):
     """A response object."""
 

=== modified file 'ubuntu_sso/utils/webclient/libsoup.py'
--- ubuntu_sso/utils/webclient/libsoup.py	2012-03-09 11:47:38 +0000
+++ ubuntu_sso/utils/webclient/libsoup.py	2012-03-15 11:28:19 +0000
@@ -17,6 +17,7 @@
 
 import httplib
 
+from OpenSSL.crypto import load_certificate, FILETYPE_PEM
 from twisted.internet import defer
 
 from ubuntu_sso.logger import setup_logging
@@ -25,6 +26,7 @@
     HeaderDict,
     Response,
     ProxyUnauthorizedError,
+    SSLCertError,
     UnauthorizedError,
     WebClientError,
 )
@@ -48,17 +50,37 @@
         self.session.add_feature(SoupGNOME.ProxyResolverGNOME())
         self.session.connect("authenticate", self._on_authenticate)
 
+    def _get_response(self, message):
+        """Return a response from a SoupMessage."""
+        headers = HeaderDict()
+        response_headers = message.get_property("response-headers")
+        add_header = lambda key, value, _: headers[key].append(value)
+        response_headers.foreach(add_header, None)
+        content = message.response_body.flatten().get_data()
+        response = Response(content, headers)
+        return response
+
     def _on_message(self, session, message, d):
         """Handle the result of an http message."""
         logger.debug('_on_message status code is %s', message.status_code)
+        is_ssl, raw_cert, errors = message.get_https_status()
         if message.status_code == httplib.OK:
-            headers = HeaderDict()
-            response_headers = message.get_property("response-headers")
-            add_header = lambda key, value, _: headers[key].append(value)
-            response_headers.foreach(add_header, None)
-            content = message.response_body.flatten().get_data()
-            response = Response(content, headers)
-            d.callback(response)
+            response = self._get_response(message)
+            if is_ssl and errors.real != 0:
+                cert = load_certificate(FILETYPE_PEM,
+                                    raw_cert.props.certificate_pem)
+                cert_subject = cert.get_subject()
+                ssl_details = dict(organization=cert_subject.O,
+                                   common_name=cert_subject.CN,
+                                   locality_name=cert_subject.L,
+                                   unit=cert_subject.OU,
+                                   country_name=cert_subject.C,
+                                   state_name=cert_subject.ST)
+                e = SSLCertError(message.reason_phrase,
+                        ssl_details=ssl_details, response=response)
+                d.errback(e)
+            else:
+                d.callback(response)
         elif message.status_code == httplib.UNAUTHORIZED:
             e = UnauthorizedError(message.reason_phrase)
             d.errback(e)
@@ -109,6 +131,17 @@
             defer.returnValue(response)
 
     @defer.inlineCallbacks
+    def _on_ssl_error(self, failure):
+        """Deal with SSL errors."""
+        failure.trap(SSLCertError)
+        logger.debug('SSL cert errors found.')
+        trust_cert = yield self.request_ssl_cert_approval(
+                           failure.value.ssl_details['common_name'],
+                           self.format_ssl_details(failure.value.ssl_details))
+        if trust_cert:
+            defer.returnValue(failure.value.response)
+
+    @defer.inlineCallbacks
     def request(self, iri, method="GET", extra_headers=None,
                 oauth_credentials=None, post_content=None):
         """Return a deferred that will be fired with a Response object."""
@@ -136,6 +169,7 @@
         self.session.queue_message(message, self._on_message, d)
         d.addErrback(self._on_proxy_authenticate, iri, method, extra_headers,
                      oauth_credentials, post_content)
+        d.addErrback(self._on_ssl_error)
         response = yield d
         defer.returnValue(response)
 

=== modified file 'ubuntu_sso/utils/webclient/tests/__init__.py'
--- ubuntu_sso/utils/webclient/tests/__init__.py	2012-03-09 12:04:31 +0000
+++ ubuntu_sso/utils/webclient/tests/__init__.py	2012-03-15 11:28:19 +0000
@@ -17,7 +17,7 @@
 """Tests for the proxy-aware webclient."""
 
 from twisted.application import internet, service
-from twisted.internet import ssl
+from twisted.internet import defer, ssl
 from twisted.web import http, server
 
 
@@ -62,12 +62,12 @@
 class SaveHTTPChannel(http.HTTPChannel):
     """A save protocol to be used in tests."""
 
-    protocolInstance = None
+    protocolInstances = []
 
     # pylint: disable=C0103
     def connectionMade(self):
         """Keep track of the given protocol."""
-        SaveHTTPChannel.protocolInstance = self
+        SaveHTTPChannel.protocolInstances.append(self)
         http.HTTPChannel.connectionMade(self)
 
 
@@ -137,9 +137,12 @@
             return self.ssl_server._port.getHost().port
         # pylint: enable=W0212
 
+    @defer.inlineCallbacks
     def stop(self):
         """Shut it down."""
         #pylint: disable=E1101
-        if self.site.protocol.protocolInstance:
-            self.site.protocol.protocolInstance.timeoutConnection()
-        return self.service_collection.stopService()
+        for protocol in  self.site.protocol.protocolInstances:
+            protocol.timeoutConnection()
+        if self.ssl_server:
+            yield self.ssl_server.stopService()
+        yield self.service_collection.stopService()

=== modified file 'ubuntu_sso/utils/webclient/tests/test_webclient.py'
--- ubuntu_sso/utils/webclient/tests/test_webclient.py	2012-03-12 23:15:45 +0000
+++ ubuntu_sso/utils/webclient/tests/test_webclient.py	2012-03-15 11:28:19 +0000
@@ -1015,11 +1015,12 @@
 
     def test_ssl_fail_dialog_user_accepts(self):
         """Test showing the dialog and accepting."""
-        self._assert_ssl_fail_user_accepts()
+        return self._assert_ssl_fail_user_accepts()
 
     def test_ssl_fail_dialog_user_accepts_via_proxy(self):
         """Test showing the dialog and accepting when using a proxy."""
-        self._assert_ssl_fail_user_accepts(self.get_nonauth_proxy_settings())
+        return self._assert_ssl_fail_user_accepts(
+                                            self.get_nonauth_proxy_settings())
 
     def test_ssl_fail_dialog_user_rejects(self):
         """Test showing the dialog and rejecting."""
@@ -1032,8 +1033,7 @@
         self.assertEqual(details,
                 self.wc.format_ssl_details(self.cert_details))
 
-    if (WEBCLIENT_MODULE_NAME.endswith(".txweb") or
-            WEBCLIENT_MODULE_NAME.endswith(".libsoup")):
+    if WEBCLIENT_MODULE_NAME.endswith(".txweb"):
         reason = 'SSL support has not yet been implemented.'
         test_ssl_fail_dialog_user_accepts.skip = reason
         test_ssl_fail_dialog_user_accepts_via_proxy.skip = reason