You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@libcloud.apache.org by to...@apache.org on 2016/01/14 21:15:28 UTC
[1/9] libcloud git commit: Throw a more friendly error message if
establishing SSL / TLS connection fails.
Repository: libcloud
Updated Branches:
refs/heads/trunk 4a328a4a4 -> b515b8f84
Throw a more friendly error message if establishing SSL / TLS connection fails.
Project: http://git-wip-us.apache.org/repos/asf/libcloud/repo
Commit: http://git-wip-us.apache.org/repos/asf/libcloud/commit/a9acb7fc
Tree: http://git-wip-us.apache.org/repos/asf/libcloud/tree/a9acb7fc
Diff: http://git-wip-us.apache.org/repos/asf/libcloud/diff/a9acb7fc
Branch: refs/heads/trunk
Commit: a9acb7fca02867c3d1aa101c9d457803cfb7aef1
Parents: 6a1b6a3
Author: Tomaz Muraus <to...@apache.org>
Authored: Thu Jan 14 13:47:09 2016 +0100
Committer: Tomaz Muraus <to...@apache.org>
Committed: Thu Jan 14 13:47:09 2016 +0100
----------------------------------------------------------------------
libcloud/httplib_ssl.py | 46 ++++++++++++++++++++++++++++++++++++++------
1 file changed, 40 insertions(+), 6 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/libcloud/blob/a9acb7fc/libcloud/httplib_ssl.py
----------------------------------------------------------------------
diff --git a/libcloud/httplib_ssl.py b/libcloud/httplib_ssl.py
index cac4098..a447e50 100644
--- a/libcloud/httplib_ssl.py
+++ b/libcloud/httplib_ssl.py
@@ -40,6 +40,24 @@ __all__ = [
HTTP_PROXY_ENV_VARIABLE_NAME = 'http_proxy'
+# Error message which is thrown when establishing SSL / TLS connection fails
+UNSUPPORTED_TLS_VERSION_ERROR_MSG = """
+Failed to establish SSL / TLS connection (%s). It is possible that the server \
+doesn't support requested SSL / TLS version (%s).
+For information on how to work around this issue, please see \
+https://libcloud.readthedocs.org/en/latest/other/\
+ssl-certificate-validation.html#changing-used-ssl-tls-version
+""".strip()
+
+# Maps ssl.PROTOCOL_* constant to the actual SSL / TLS version name
+SSL_CONSTANT_TO_TLS_VERSION_MAP = {
+ 0: 'SSL v2',
+ 2: 'SSLv3, TLS v1.0, TLS v1.1, TLS v1.2',
+ 3: 'TLS v1.0',
+ 4: 'TLS v1.1',
+ 5: 'TLS v1.2'
+}
+
class LibcloudBaseConnection(object):
"""
@@ -272,12 +290,28 @@ class LibcloudHTTPSConnection(httplib.HTTPSConnection, LibcloudBaseConnection):
if self.http_proxy_used:
self._activate_http_proxy(sock=sock)
- self.sock = ssl.wrap_socket(sock,
- self.key_file,
- self.cert_file,
- cert_reqs=ssl.CERT_REQUIRED,
- ca_certs=self.ca_cert,
- ssl_version=libcloud.security.SSL_VERSION)
+ try:
+ self.sock = ssl.wrap_socket(sock,
+ self.key_file,
+ self.cert_file,
+ cert_reqs=ssl.CERT_REQUIRED,
+ ca_certs=self.ca_cert,
+ ssl_version=libcloud.security.SSL_VERSION)
+ except Exception:
+ exc_cls = sys.exc_info()[0]
+ e = sys.exc_info()[1]
+
+ exc_msg = str(e)
+ # Re-throw an exception with a more friendly error message
+ if 'connection reset by peer' in exc_msg.lower():
+ ssl_version = libcloud.security.SSL_VERSION
+ ssl_version = SSL_CONSTANT_TO_TLS_VERSION_MAP[ssl_version]
+ msg = UNSUPPORTED_TLS_VERSION_ERROR_MSG % (exc_msg, ssl_version)
+ new_e = exc_cls(msg)
+ new_e.original_exc = e
+ raise new_e
+
+ raise e
cert = self.sock.getpeercert()
try:
match_hostname(cert, self.host)
[9/9] libcloud git commit: Update changelog.
Posted by to...@apache.org.
Update changelog.
Project: http://git-wip-us.apache.org/repos/asf/libcloud/repo
Commit: http://git-wip-us.apache.org/repos/asf/libcloud/commit/b515b8f8
Tree: http://git-wip-us.apache.org/repos/asf/libcloud/tree/b515b8f8
Diff: http://git-wip-us.apache.org/repos/asf/libcloud/diff/b515b8f8
Branch: refs/heads/trunk
Commit: b515b8f84ff1dc1e7d64fa44d6ae1c35a17bdcb8
Parents: c8073f4
Author: Tomaz Muraus <to...@apache.org>
Authored: Thu Jan 14 20:42:29 2016 +0100
Committer: Tomaz Muraus <to...@apache.org>
Committed: Thu Jan 14 20:42:29 2016 +0100
----------------------------------------------------------------------
CHANGES.rst | 5 +++++
1 file changed, 5 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/libcloud/blob/b515b8f8/CHANGES.rst
----------------------------------------------------------------------
diff --git a/CHANGES.rst b/CHANGES.rst
index ed5e407..c991fd9 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -17,6 +17,11 @@ General
(GITHUB-556, LIBCLOUD-728)
[Scott Kruger]
+- Throw a more user-friendly exception if a client fails to establish SSL / TLS
+ connection with a server because of an unsupported SSL / TLS version.
+ (GITHUB-682)
+ [Tomaz Muraus]
+
Compute
~~~~~~~
[6/9] libcloud git commit: Merge branch 'trunk' into
friendlier_error_message_on_tls_error
Posted by to...@apache.org.
Merge branch 'trunk' into friendlier_error_message_on_tls_error
Project: http://git-wip-us.apache.org/repos/asf/libcloud/repo
Commit: http://git-wip-us.apache.org/repos/asf/libcloud/commit/46f850bc
Tree: http://git-wip-us.apache.org/repos/asf/libcloud/tree/46f850bc
Diff: http://git-wip-us.apache.org/repos/asf/libcloud/diff/46f850bc
Branch: refs/heads/trunk
Commit: 46f850bc037d3036e1c5574e5dc60c9a4b75ca2c
Parents: 47914e4 4a328a4
Author: Tomaz Muraus <to...@apache.org>
Authored: Thu Jan 14 19:29:41 2016 +0100
Committer: Tomaz Muraus <to...@apache.org>
Committed: Thu Jan 14 19:29:41 2016 +0100
----------------------------------------------------------------------
docs/other/ssl-certificate-validation.rst | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
[2/9] libcloud git commit: Fix lint.
Posted by to...@apache.org.
Fix lint.
Project: http://git-wip-us.apache.org/repos/asf/libcloud/repo
Commit: http://git-wip-us.apache.org/repos/asf/libcloud/commit/d01e1419
Tree: http://git-wip-us.apache.org/repos/asf/libcloud/tree/d01e1419
Diff: http://git-wip-us.apache.org/repos/asf/libcloud/diff/d01e1419
Branch: refs/heads/trunk
Commit: d01e141993065a7b923947c6c3087b4f3dbea47b
Parents: a9acb7f
Author: Tomaz Muraus <to...@apache.org>
Authored: Thu Jan 14 14:05:09 2016 +0100
Committer: Tomaz Muraus <to...@apache.org>
Committed: Thu Jan 14 14:05:09 2016 +0100
----------------------------------------------------------------------
libcloud/httplib_ssl.py | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/libcloud/blob/d01e1419/libcloud/httplib_ssl.py
----------------------------------------------------------------------
diff --git a/libcloud/httplib_ssl.py b/libcloud/httplib_ssl.py
index a447e50..61f1ac6 100644
--- a/libcloud/httplib_ssl.py
+++ b/libcloud/httplib_ssl.py
@@ -291,22 +291,25 @@ class LibcloudHTTPSConnection(httplib.HTTPSConnection, LibcloudBaseConnection):
self._activate_http_proxy(sock=sock)
try:
- self.sock = ssl.wrap_socket(sock,
- self.key_file,
- self.cert_file,
- cert_reqs=ssl.CERT_REQUIRED,
- ca_certs=self.ca_cert,
- ssl_version=libcloud.security.SSL_VERSION)
+ self.sock = ssl.wrap_socket(
+ sock,
+ self.key_file,
+ self.cert_file,
+ cert_reqs=ssl.CERT_REQUIRED,
+ ca_certs=self.ca_cert,
+ ssl_version=libcloud.security.SSL_VERSION)
except Exception:
exc_cls = sys.exc_info()[0]
e = sys.exc_info()[1]
-
exc_msg = str(e)
+
# Re-throw an exception with a more friendly error message
if 'connection reset by peer' in exc_msg.lower():
ssl_version = libcloud.security.SSL_VERSION
ssl_version = SSL_CONSTANT_TO_TLS_VERSION_MAP[ssl_version]
- msg = UNSUPPORTED_TLS_VERSION_ERROR_MSG % (exc_msg, ssl_version)
+ msg = (UNSUPPORTED_TLS_VERSION_ERROR_MSG %
+ (exc_msg, ssl_version))
+
new_e = exc_cls(msg)
new_e.original_exc = e
raise new_e
[3/9] libcloud git commit: Only catch socket.error exception.
Posted by to...@apache.org.
Only catch socket.error exception.
Project: http://git-wip-us.apache.org/repos/asf/libcloud/repo
Commit: http://git-wip-us.apache.org/repos/asf/libcloud/commit/08b548e1
Tree: http://git-wip-us.apache.org/repos/asf/libcloud/tree/08b548e1
Diff: http://git-wip-us.apache.org/repos/asf/libcloud/diff/08b548e1
Branch: refs/heads/trunk
Commit: 08b548e1a78aa73df006685c245c941c59e29395
Parents: d01e141
Author: Tomaz Muraus <to...@apache.org>
Authored: Thu Jan 14 19:00:59 2016 +0100
Committer: Tomaz Muraus <to...@apache.org>
Committed: Thu Jan 14 19:00:59 2016 +0100
----------------------------------------------------------------------
libcloud/httplib_ssl.py | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/libcloud/blob/08b548e1/libcloud/httplib_ssl.py
----------------------------------------------------------------------
diff --git a/libcloud/httplib_ssl.py b/libcloud/httplib_ssl.py
index 61f1ac6..73d2dee 100644
--- a/libcloud/httplib_ssl.py
+++ b/libcloud/httplib_ssl.py
@@ -298,8 +298,7 @@ class LibcloudHTTPSConnection(httplib.HTTPSConnection, LibcloudBaseConnection):
cert_reqs=ssl.CERT_REQUIRED,
ca_certs=self.ca_cert,
ssl_version=libcloud.security.SSL_VERSION)
- except Exception:
- exc_cls = sys.exc_info()[0]
+ except socket.error:
e = sys.exc_info()[1]
exc_msg = str(e)
@@ -310,7 +309,7 @@ class LibcloudHTTPSConnection(httplib.HTTPSConnection, LibcloudBaseConnection):
msg = (UNSUPPORTED_TLS_VERSION_ERROR_MSG %
(exc_msg, ssl_version))
- new_e = exc_cls(msg)
+ new_e = socket.error(msg)
new_e.original_exc = e
raise new_e
[5/9] libcloud git commit: In some cases socket.error constructor
contains two arguments - errno and message.
Posted by to...@apache.org.
In some cases socket.error constructor contains two arguments - errno and
message.
Make sure we also handle that case.
Project: http://git-wip-us.apache.org/repos/asf/libcloud/repo
Commit: http://git-wip-us.apache.org/repos/asf/libcloud/commit/47914e4a
Tree: http://git-wip-us.apache.org/repos/asf/libcloud/tree/47914e4a
Diff: http://git-wip-us.apache.org/repos/asf/libcloud/diff/47914e4a
Branch: refs/heads/trunk
Commit: 47914e4a6fc2208abfc4a432edfc29ef76b88ba9
Parents: b9e7a62
Author: Tomaz Muraus <to...@apache.org>
Authored: Thu Jan 14 19:14:45 2016 +0100
Committer: Tomaz Muraus <to...@apache.org>
Committed: Thu Jan 14 19:14:45 2016 +0100
----------------------------------------------------------------------
libcloud/httplib_ssl.py | 22 ++++++++++++++++------
libcloud/test/test_httplib_ssl.py | 11 ++++++++++-
2 files changed, 26 insertions(+), 7 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/libcloud/blob/47914e4a/libcloud/httplib_ssl.py
----------------------------------------------------------------------
diff --git a/libcloud/httplib_ssl.py b/libcloud/httplib_ssl.py
index 73d2dee..5f11d05 100644
--- a/libcloud/httplib_ssl.py
+++ b/libcloud/httplib_ssl.py
@@ -299,8 +299,8 @@ class LibcloudHTTPSConnection(httplib.HTTPSConnection, LibcloudBaseConnection):
ca_certs=self.ca_cert,
ssl_version=libcloud.security.SSL_VERSION)
except socket.error:
- e = sys.exc_info()[1]
- exc_msg = str(e)
+ exc = sys.exc_info()[1]
+ exc_msg = str(exc)
# Re-throw an exception with a more friendly error message
if 'connection reset by peer' in exc_msg.lower():
@@ -309,11 +309,21 @@ class LibcloudHTTPSConnection(httplib.HTTPSConnection, LibcloudBaseConnection):
msg = (UNSUPPORTED_TLS_VERSION_ERROR_MSG %
(exc_msg, ssl_version))
- new_e = socket.error(msg)
- new_e.original_exc = e
- raise new_e
+ # Note: In some cases arguments are (errno, message) and in
+ # other it's just (message,)
+ exc_args = getattr(exc, 'args', [])
+
+ if len(exc_args) == 2:
+ new_exc_args = [exc.args[0], msg]
+ else:
+ new_exc_args = [msg]
+
+ new_exc = socket.error(*new_exc_args)
+ new_exc.original_exc = exc
+ raise new_exc
+
+ raise exc
- raise e
cert = self.sock.getpeercert()
try:
match_hostname(cert, self.host)
http://git-wip-us.apache.org/repos/asf/libcloud/blob/47914e4a/libcloud/test/test_httplib_ssl.py
----------------------------------------------------------------------
diff --git a/libcloud/test/test_httplib_ssl.py b/libcloud/test/test_httplib_ssl.py
index a2f8bf5..25f6450 100644
--- a/libcloud/test/test_httplib_ssl.py
+++ b/libcloud/test/test_httplib_ssl.py
@@ -128,9 +128,18 @@ class TestHttpLibSSLTests(unittest.TestCase):
mock_wrap_socket.side_effect = socket.error('Connection reset by peer')
expected_msg = 'Failed to establish SSL / TLS connection'
- self.assertRaisesRegexp(Exception, expected_msg,
+ self.assertRaisesRegexp(socket.error, expected_msg,
self.httplib_object.connect)
+ # Same error but including errno
+ with self.assertRaises(socket.error) as cm:
+ mock_wrap_socket.side_effect = socket.error(104, 'Connection reset by peer')
+ self.httplib_object.connect()
+
+ e = cm.exception
+ self.assertEqual(e.errno, 104)
+ self.assertTrue(expected_msg in str(e))
+
if __name__ == '__main__':
sys.exit(unittest.main())
[7/9] libcloud git commit: Also patch socket.socket.
Posted by to...@apache.org.
Also patch socket.socket.
Project: http://git-wip-us.apache.org/repos/asf/libcloud/repo
Commit: http://git-wip-us.apache.org/repos/asf/libcloud/commit/5c2517ee
Tree: http://git-wip-us.apache.org/repos/asf/libcloud/tree/5c2517ee
Diff: http://git-wip-us.apache.org/repos/asf/libcloud/diff/5c2517ee
Branch: refs/heads/trunk
Commit: 5c2517eefbc27ee805bb5be29dd0baf2233ff549
Parents: 46f850b
Author: Tomaz Muraus <to...@apache.org>
Authored: Thu Jan 14 19:35:15 2016 +0100
Committer: Tomaz Muraus <to...@apache.org>
Committed: Thu Jan 14 19:35:15 2016 +0100
----------------------------------------------------------------------
libcloud/test/test_httplib_ssl.py | 1 +
1 file changed, 1 insertion(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/libcloud/blob/5c2517ee/libcloud/test/test_httplib_ssl.py
----------------------------------------------------------------------
diff --git a/libcloud/test/test_httplib_ssl.py b/libcloud/test/test_httplib_ssl.py
index 25f6450..6459cd7 100644
--- a/libcloud/test/test_httplib_ssl.py
+++ b/libcloud/test/test_httplib_ssl.py
@@ -108,6 +108,7 @@ class TestHttpLibSSLTests(unittest.TestCase):
self.httplib_object._setup_ca_cert)
@mock.patch('socket.create_connection', mock.MagicMock())
+ @mock.patch('socket.socket', mock.MagicMock())
@mock.patch('ssl.wrap_socket')
def test_connect_throws_friendly_error_message_on_ssl_wrap_connection_reset_by_peer(self, mock_wrap_socket):
# Test that we re-throw a more friendly error message in case
[4/9] libcloud git commit: Add a test case for it.
Posted by to...@apache.org.
Add a test case for it.
Project: http://git-wip-us.apache.org/repos/asf/libcloud/repo
Commit: http://git-wip-us.apache.org/repos/asf/libcloud/commit/b9e7a62d
Tree: http://git-wip-us.apache.org/repos/asf/libcloud/tree/b9e7a62d
Diff: http://git-wip-us.apache.org/repos/asf/libcloud/diff/b9e7a62d
Branch: refs/heads/trunk
Commit: b9e7a62d3ecdbb36e462d5d3d24d7eb6ee80b34a
Parents: 08b548e
Author: Tomaz Muraus <to...@apache.org>
Authored: Thu Jan 14 19:01:36 2016 +0100
Committer: Tomaz Muraus <to...@apache.org>
Committed: Thu Jan 14 19:01:36 2016 +0100
----------------------------------------------------------------------
libcloud/test/test_httplib_ssl.py | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/libcloud/blob/b9e7a62d/libcloud/test/test_httplib_ssl.py
----------------------------------------------------------------------
diff --git a/libcloud/test/test_httplib_ssl.py b/libcloud/test/test_httplib_ssl.py
index 65e676c..a2f8bf5 100644
--- a/libcloud/test/test_httplib_ssl.py
+++ b/libcloud/test/test_httplib_ssl.py
@@ -16,7 +16,9 @@
import os
import sys
import os.path
+import socket
+import mock
from mock import patch
import libcloud.security
@@ -105,6 +107,30 @@ class TestHttpLibSSLTests(unittest.TestCase):
self.assertRaisesRegexp(RuntimeError, expected_msg,
self.httplib_object._setup_ca_cert)
+ @mock.patch('socket.create_connection', mock.MagicMock())
+ @mock.patch('ssl.wrap_socket')
+ def test_connect_throws_friendly_error_message_on_ssl_wrap_connection_reset_by_peer(self, mock_wrap_socket):
+ # Test that we re-throw a more friendly error message in case
+ # "connection reset by peer" error occurs when trying to establish a
+ # SSL connection
+ libcloud.security.VERIFY_SSL_CERT = True
+ self.httplib_object.verify = True
+
+ # No connection reset by peer, original exception should be thrown
+ mock_wrap_socket.side_effect = Exception('foo bar fail')
+
+ expected_msg = 'foo bar fail'
+ self.assertRaisesRegexp(Exception, expected_msg,
+ self.httplib_object.connect)
+
+ # Connection reset by peer, wrapped exception with friendly error
+ # message should be thrown
+ mock_wrap_socket.side_effect = socket.error('Connection reset by peer')
+
+ expected_msg = 'Failed to establish SSL / TLS connection'
+ self.assertRaisesRegexp(Exception, expected_msg,
+ self.httplib_object.connect)
+
if __name__ == '__main__':
sys.exit(unittest.main())
[8/9] libcloud git commit: Explicitly disable HTTP proxy since it
breaks tests on Travis.
Posted by to...@apache.org.
Explicitly disable HTTP proxy since it breaks tests on Travis.
Project: http://git-wip-us.apache.org/repos/asf/libcloud/repo
Commit: http://git-wip-us.apache.org/repos/asf/libcloud/commit/c8073f46
Tree: http://git-wip-us.apache.org/repos/asf/libcloud/tree/c8073f46
Diff: http://git-wip-us.apache.org/repos/asf/libcloud/diff/c8073f46
Branch: refs/heads/trunk
Commit: c8073f46abbb27a48ed251144fd15b974df49128
Parents: 5c2517e
Author: Tomaz Muraus <to...@apache.org>
Authored: Thu Jan 14 20:02:19 2016 +0100
Committer: Tomaz Muraus <to...@apache.org>
Committed: Thu Jan 14 20:02:19 2016 +0100
----------------------------------------------------------------------
libcloud/test/test_httplib_ssl.py | 1 +
1 file changed, 1 insertion(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/libcloud/blob/c8073f46/libcloud/test/test_httplib_ssl.py
----------------------------------------------------------------------
diff --git a/libcloud/test/test_httplib_ssl.py b/libcloud/test/test_httplib_ssl.py
index 6459cd7..28eed69 100644
--- a/libcloud/test/test_httplib_ssl.py
+++ b/libcloud/test/test_httplib_ssl.py
@@ -116,6 +116,7 @@ class TestHttpLibSSLTests(unittest.TestCase):
# SSL connection
libcloud.security.VERIFY_SSL_CERT = True
self.httplib_object.verify = True
+ self.httplib_object.http_proxy_used = False
# No connection reset by peer, original exception should be thrown
mock_wrap_socket.side_effect = Exception('foo bar fail')