Merged against master

.travis.yml

@@ -0,0 +1,11 @@
+language: python
+python:
+  - 2.6
+  - 2.7
+  - 3.2
+  - 3.3
+script: nosetests
+install:
+  - pip install -r test-requirements.txt --use-mirrors
+notifications:
+  email: false

CHANGES.rst

@@ -4,6 +4,8 @@ Changes
 dev (master branch)
 +++++++++++++++++++
 
+* Contrib: Optional SNI support for Py2 using PyOpenSSL. (Issue #156)
+
 * ``ProxyManager`` automatically adds ``Host: ...`` header if not given.
 
 * Improved SSL-related code. ``cert_req`` now optionally takes a string like
@@ -49,6 +51,10 @@ dev (master branch)
 
 * Pass `strict` param down to ``httplib.HTTPConnection``. (Issue #122)
 
+* Added mechanism to verify SSL certificates by fingerprint (md5, sha1) or
+  against an arbitrary hostname (when connecting by IP or for misconfigured
+  servers). (Issue #140)
+
 
 1.5 (2012-08-02)
 ++++++++++++++++

CONTRIBUTORS.txt

@@ -46,7 +46,16 @@ In chronological order:
   * Support for explicitly closing pooled connections
 
 * hartator <hartator@gmail.com>
-  * Corrected multipart behavior for params 
+  * Corrected multipart behavior for params
+
+* Thomas Weißschuh <thomas@t-8ch.de>
+  * Support for TLS SNI
+  * API unification of ssl_version/cert_reqs
+  * SSL fingerprint and alternative hostname verification
+  * Bugfixes in testsuite
+
+* Sune Kirkeby <mig@ibofobi.dk>
+  * Optional SNI-support for Python 2 via PyOpenSSL.
 
 * Stanislav Vitkovskiy <stas.vitkovsky@gmail.com>
   * Added HTTPS (CONNECT) proxy support

README.rst

@@ -1,3 +1,11 @@
+=======
+urllib3
+=======
+
+.. image:: https://travis-ci.org/shazow/urllib3.png?branch=master
+        :target: https://travis-ci.org/shazow/urllib3
+
+
 Highlights
 ==========
 

docs/contrib.rst

@@ -0,0 +1,10 @@
+Contrib Modules
+===============
+
+These modules implement various extra features, that may not be ready for
+prime time.
+
+SNI-support for Python 2
+------------------------
+
+.. automodule:: urllib3.contrib.pyopenssl

docs/index.rst

@@ -9,6 +9,7 @@ urllib3 Documentation
    managers
    helpers
    collections
+   contrib
 
 
 Highlights
@@ -166,6 +167,15 @@ but can also be used independently.
 
    helpers
 
+Contrib Modules
+---------------
+
+These modules implement various extra features, that may not be ready for
+prime time.
+
+.. toctree::
+
+   contrib
 
 Contributing
 ============

setup.cfg

@@ -2,3 +2,5 @@
 logging-clear-handlers=true
 with-coverage=true
 cover-package=urllib3
+# no rounding problems here
+cover-min-percentage=100

setup.py

@@ -44,8 +44,9 @@
       author_email='andrey.petrov@shazow.net',
       url='http://urllib3.readthedocs.org/',
       license='MIT',
-      packages=['urllib3', 'dummyserver', 'urllib3.packages',
-                'urllib3.packages.ssl_match_hostname',
+      packages=['urllib3', 'dummyserver',
+                'urllib3.packages', 'urllib3.packages.ssl_match_hostname',
+                'urllib3.contrib',
                 ],
       requires=requirements,
       tests_require=tests_requirements,

test/contrib/test_pyopenssl.py

@@ -0,0 +1,17 @@
+try:
+    from urllib3.contrib.pyopenssl import (inject_into_urllib3,
+                                           extract_from_urllib3)
+except ImportError as e:
+    from nose.plugins.skip import SkipTest
+    raise SkipTest('Could not import pyopenssl: %r' % e)
+
+from ..with_dummyserver.test_https import TestHTTPS, TestHTTPS_TLSv1
+from ..with_dummyserver.test_socketlevel import TestSNI, TestSocketClosing
+
+
+def setup_module():
+    inject_into_urllib3()
+
+
+def teardown_module():
+    extract_from_urllib3()

test/test_filepost.py

@@ -62,7 +62,7 @@ def test_field_encoding(self):
                 , fields)
 
             self.assertEqual(content_type,
-                b'multipart/form-data; boundary=' + b(BOUNDARY))
+                'multipart/form-data; boundary=' + str(BOUNDARY))
 
 
     def test_filename(self):
@@ -80,7 +80,7 @@ def test_filename(self):
             )
 
         self.assertEqual(content_type,
-            b'multipart/form-data; boundary=' + b(BOUNDARY))
+            'multipart/form-data; boundary=' + str(BOUNDARY))
 
 
     def test_textplain(self):
@@ -98,7 +98,7 @@ def test_textplain(self):
             )
 
         self.assertEqual(content_type,
-            b'multipart/form-data; boundary=' + b(BOUNDARY))
+            'multipart/form-data; boundary=' + str(BOUNDARY))
 
 
     def test_explicit(self):
@@ -116,4 +116,4 @@ def test_explicit(self):
             )
 
         self.assertEqual(content_type,
-            b'multipart/form-data; boundary=' + b(BOUNDARY))
+            'multipart/form-data; boundary=' + str(BOUNDARY))

test/with_dummyserver/test_https.py

@@ -137,6 +137,55 @@ def test_set_ssl_version_to_sslv3(self):
         self._pool.ssl_version = ssl.PROTOCOL_SSLv3
         self.assertRaises(SSLError, self._pool.request, 'GET', '/')
 
+    def test_assert_specific_hostname(self):
+        https_pool = HTTPSConnectionPool('127.0.0.1', self.port,
+                                         cert_reqs='CERT_REQUIRED')
+
+        https_pool.ca_certs = DEFAULT_CA
+        https_pool.assert_hostname = 'localhost'
+        https_pool.request('GET', '/')
+
+    def test_assert_fingerprint_md5(self):
+        https_pool = HTTPSConnectionPool('127.0.0.1', self.port,
+                                         cert_reqs='CERT_REQUIRED')
+
+        https_pool.ca_certs = DEFAULT_CA
+        https_pool.assert_fingerprint = 'CA:84:E1:AD0E5a:ef:2f:C3:09' \
+                                        ':E7:30:F8:CD:C8:5B'
+        https_pool.request('GET', '/')
+
+    def test_assert_fingerprint_sha1(self):
+        https_pool = HTTPSConnectionPool('127.0.0.1', self.port,
+                                         cert_reqs='CERT_REQUIRED')
+
+        https_pool.ca_certs = DEFAULT_CA
+        https_pool.assert_fingerprint = 'CC:45:6A:90:82:F7FF:C0:8218:8e:' \
+                                        '7A:F2:8A:D7:1E:07:33:67:DE'
+        https_pool.request('GET', '/')
+
+    def test_assert_invalid_fingerprint(self):
+        https_pool = HTTPSConnectionPool('127.0.0.1', self.port,
+                                         cert_reqs='CERT_REQUIRED')
+
+        https_pool.ca_certs = DEFAULT_CA
+        https_pool.assert_fingerprint = 'AA:AA:AA:AA:AA:AAAA:AA:AAAA:AA:' \
+                                        'AA:AA:AA:AA:AA:AA:AA:AA:AA'
+
+        self.assertRaises(SSLError,
+                          https_pool.request, 'GET', '/')
+
+        # invalid length
+        https_pool.assert_fingerprint = 'AA'
+
+        self.assertRaises(SSLError,
+                          https_pool.request, 'GET', '/')
+
+        # uneven length
+        https_pool.assert_fingerprint = 'AA:A'
+
+        self.assertRaises(SSLError,
+                          https_pool.request, 'GET', '/')
+
 
 if __name__ == '__main__':
     unittest.main()

test/with_dummyserver/test_poolmanager.py

@@ -84,7 +84,11 @@ def test_headers(self):
         self.assertEqual(returned_headers.get('Foo'), None)
         self.assertEqual(returned_headers.get('Baz'), 'quux')
 
+    def test_http_with_ssl_keywords(self):
+        http = PoolManager(ca_certs='REQUIRED')
 
+        r = http.request('GET', 'http://%s:%s/' % (self.host, self.port))
+        self.assertEqual(r.status, 200)
 
 
 if __name__ == '__main__':

test/with_dummyserver/test_socketlevel.py

@@ -1,16 +1,13 @@
 from urllib3 import HTTPConnectionPool, HTTPSConnectionPool
 from urllib3.poolmanager import proxy_from_url
 from urllib3.exceptions import MaxRetryError, TimeoutError, SSLError
+from urllib3 import util
 
 from dummyserver.testcase import SocketDummyServerTestCase
 
+from nose.plugins.skip import SkipTest
 from threading import Event
 
-try:
-    from ssl import HAS_SNI
-except ImportError: # openssl without SNI
-    HAS_SNI = False
-
 
 class TestCookies(SocketDummyServerTestCase):
 
@@ -34,28 +31,30 @@ def multicookie_response_handler(listener):
         self.assertEquals(r.headers, {'set-cookie': 'foo=1, bar=1'})
 
 
-if HAS_SNI:
-    class TestSNI(SocketDummyServerTestCase):
+class TestSNI(SocketDummyServerTestCase):
 
-        def test_hostname_in_first_request_packet(self):
-            done_receiving = Event()
-            self.buf = b''
+    def test_hostname_in_first_request_packet(self):
+        if not util.HAS_SNI:
+            raise SkipTest('SNI-support not available')
 
-            def socket_handler(listener):
-                sock = listener.accept()[0]
+        done_receiving = Event()
+        self.buf = b''
+
+        def socket_handler(listener):
+            sock = listener.accept()[0]
 
-                self.buf = sock.recv(65536) # We only accept one packet
-                done_receiving.set()  # let the test know it can proceed
+            self.buf = sock.recv(65536) # We only accept one packet
+            done_receiving.set()  # let the test know it can proceed
 
-            self._start_server(socket_handler)
-            pool = HTTPSConnectionPool(self.host, self.port)
-            try:
-                pool.request('GET', '/', retries=0)
-            except SSLError: # We are violating the protocol
-                pass
-            done_receiving.wait()
-            self.assertTrue(self.host.encode() in self.buf,
-                            "missing hostname in SSL handshake")
+        self._start_server(socket_handler)
+        pool = HTTPSConnectionPool(self.host, self.port)
+        try:
+            pool.request('GET', '/', retries=0)
+        except SSLError: # We are violating the protocol
+            pass
+        done_receiving.wait()
+        self.assertTrue(self.host.encode() in self.buf,
+                        "missing hostname in SSL handshake")
 
 
 class TestSocketClosing(SocketDummyServerTestCase):
@@ -102,7 +101,7 @@ def test_connection_refused(self):
         # Does the pool retry if there is no listener on the port?
         # Note: Socket server is not started until after the test.
         pool = HTTPConnectionPool(self.host, self.port)
-        self.assertRaises(MaxRetryError, pool.request, 'GET', '/')
+        self.assertRaises(MaxRetryError, pool.request, 'GET', '/', retries=0)
         self._start_server(lambda x: None)
 
     def test_connection_timeout(self):

tox.ini

@@ -0,0 +1,11 @@
+[tox]
+envlist = py26, py27, py32, py33, pypy
+
+[testenv]
+deps=
+   nose
+   tornado
+   coverage
+commands=
+   nosetests \
+   []