Changeset 272

Timestamp:

12/29/14 16:35:37 (10 years ago)

Author:

atzm

Message:

add SSL certificate verification for controller API

Location:

etherws/trunk

Files:

• README.rst (modified) (1 diff)
• etherws.py (modified) (4 diffs)

etherws/trunk/README.rst

@@ -162 +162 @@
 
 Password can be input from stdin as well as WebSocket tunnel creation.
-
-Note: *etherws ctl* currently cannot verify SSL certificate on controller.
 
 Virtual Machines Connection

etherws/trunk/etherws.py

@@ -944 +944 @@
             return setattr(ns, htpasswd, Htpasswd(val))
 
-    #if args.debug:
-    #    websocket.enableTrace(True)
+    # if args.debug:
+    #     websocket.enableTrace(True)
 
     if args.ageout <= 0:
@@ -1018 +1018 @@
 
 def _start_ctl(args):
+    def have_ssl_cert_verification():
+        return 'context' in urllib2.urlopen.__code__.co_varnames
+
     def request(args, method, params=None, id_=0):
         req = urllib2.Request(args.ctlurl)
@@ -1030 +1033 @@
         if params is not None:
             data['params'] = params
-        return json.loads(urllib2.urlopen(req, json.dumps(data)).read())
+        if have_ssl_cert_verification():
+            ctx = ssl.create_default_context(purpose=ssl.Purpose.SERVER_AUTH,
+                                             cafile=args.ctlsslcert)
+            if args.ctlinsecure:
+                ctx.check_hostname = False
+                ctx.verify_mode = ssl.CERT_NONE
+            fp = urllib2.urlopen(req, json.dumps(data), context=ctx)
+        elif args.ctlsslcert:
+            raise EnvironmentError('do not support certificate verification')
+        else:
+            fp = urllib2.urlopen(req, json.dumps(data))
+        return json.loads(fp.read())
 
     def print_table(rows):
@@ -1204 +1218 @@
     parser_ctl.add_argument('--ctlpasswd',
                             help='password to auth control API')
+    parser_ctl.add_argument('--ctlsslcert',
+                            help='path to SSL certificate for control API')
+    parser_ctl.add_argument(
+        '--ctlinsecure', action='store_true', default=False,
+        help='do not verify control API certificate')
 
     control_method = parser_ctl.add_subparsers(dest='control_method')