Merge lp:~statik/ubuntuone-client/no-ssl-verify into lp:ubuntuone-client

[Elliot Murphy]

[r=pfibiger, r=verterok] This is the first of two branches to enable SSL verification in the syncdaemon. This adds a config option that our test suite can use to disable SSL certification verification in the test suite only, and the second branch will enable SSL verification by default.

[Elliot Murphy (statik)]

This is the first of two branches to enable SSL verification in the syncdaemon. This adds a config option that our test suite can use to disable SSL certification verification in the test suite only, and the second branch will enable SSL verification by default.

[Philip Fibiger (pfibiger)]

this looks good. well commented, too :)

review: Approve

[Guillermo Gonzalez (verterok)]

Looks ok.

review: Approve

[Guillermo Gonzalez (verterok)]

Looks ok.

review: Approve

=== modified file 'bin/ubuntuone-syncdaemon'
--- bin/ubuntuone-syncdaemon	2009-05-14 15:04:58 +0000
+++ bin/ubuntuone-syncdaemon	2009-06-18 19:01:02 +0000
@@ -117,6 +117,7 @@
     main = Main(user_root_dir, shares_root_dir, options.data_dir,
                 host=options.host, port=int(options.port), 
                 dns_srv=options.dns_srv, ssl=True,
+                disable_ssl_verify=options.disable_ssl_verify,
                 realm=options.realm, mark_interval=options.mark_interval)
     if options.oauth:
         try:

=== modified file 'canonical/ubuntuone/storage/syncdaemon/action_queue.py'
--- canonical/ubuntuone/storage/syncdaemon/action_queue.py	2009-06-12 22:14:02 +0000
+++ canonical/ubuntuone/storage/syncdaemon/action_queue.py	2009-06-18 19:01:02 +0000
@@ -473,12 +473,13 @@
     protocol = ActionQueueProtocol
 
     def __init__(self, event_queue, host, port, dns_srv,
-                 use_ssl=False):
+                 use_ssl=False, disable_ssl_verify=False):
         self.event_queue = event_queue
         self.host = host
         self.port = port
         self.dns_srv = dns_srv
         self.use_ssl = use_ssl
+        self.disable_ssl_verify = disable_ssl_verify
 
         self.token = None
         self.client = None
@@ -580,9 +581,17 @@
         def _connect(result):
             """ do the real thing """
             host, port = result
+            if self.disable_verify_ssl:
+                # This ssl context does no certficate verification
+                # and is only safe to use in the test suite.
+                sslContext = ssl.ClientContextFactory()
+            else:
+                # XXX: This fix is being landed in stages.
+                # here we need to use a proper SSL context that will
+                # verify the certificate and disconnect if invalid.
+                sslContext = ssl.ClientContextFactory()
             if self.use_ssl:
-                reactor.connectSSL(host, port, self,
-                                   ssl.ClientContextFactory())
+                reactor.connectSSL(host, port, self, sslContext)
             else:
                 reactor.connectTCP(host, port, self)
         d.addCallback(_connect)

=== modified file 'canonical/ubuntuone/storage/syncdaemon/main.py'
--- canonical/ubuntuone/storage/syncdaemon/main.py	2009-05-26 14:23:45 +0000
+++ canonical/ubuntuone/storage/syncdaemon/main.py	2009-06-18 19:01:02 +0000
@@ -46,6 +46,7 @@
 
     def __init__(self, root_dir, shares_dir, data_dir,
                  host='fs-1.ubuntuone.com', port=443, dns_srv=None, ssl=True,
+                 disable_ssl_verify=False,
                  realm='https://ubuntuone.com', glib_loop=False,
                  mark_interval=120):
         """ create the instance. """
@@ -57,6 +58,7 @@
         self.port = port
         self.dns_srv = dns_srv
         self.ssl = ssl
+        self.disable_ssl_verify = disable_ssl_verify
         self.realm = realm
         self.token = None
 
@@ -70,7 +72,8 @@
         self.vm.init_root()
         # we don't have the oauth tokens yet, we 'll get them later
         self.action_q = action_queue.ActionQueue(self.event_q, host, port,
-                                                 self.dns_srv, ssl)
+                                                 self.dns_srv, ssl,
+                                                 disable_ssl_verify)
         self.hash_q = hash_queue.HashQueue(self.event_q)
 
         self.sync = sync.Sync(self)

=== modified file 'data/syncdaemon-dev.conf'
--- data/syncdaemon-dev.conf	2009-05-12 13:36:05 +0000
+++ data/syncdaemon-dev.conf	2009-06-18 19:01:02 +0000
@@ -6,3 +6,6 @@
 # In development don't lookup the SRV records 
 dns_srv.default = 
 
+# In development don't verify the SSL certificate.
+disable_ssl_verify = True
+

=== modified file 'data/syncdaemon.conf'
--- data/syncdaemon.conf	2009-05-12 13:36:05 +0000
+++ data/syncdaemon.conf	2009-06-18 19:01:02 +0000
@@ -5,6 +5,11 @@
 dns_srv.default = _https._tcp.fs.ubuntuone.com
 dns_srv.help = The DNS SRV record
 
+disable_ssl_verify.default = False
+disable_ssl_verify.action = store_true
+disable_ssl_verify.parser = bool
+disable_ssl_verify.help = Disable SSL certificate verification in a test environment.
+
 port.default = 443
 port.parser = int
 port.help = The port on which to connect to the server