This change:
https:/ /review. openstack. org/#/c/ 78269/
means that two different code paths are followed depending on whether SSL compression has been disabled or not.
SSL validation was broken in both (ie all) cases.
$ ./.tox/ py27/bin/ glance --os-image-url https:/ /localhost: 9292 image-list
+---- ------- ------- ------- ------- ------+ ------- ------- ------- ------- -----+- ------- -----+- ------- ------- ---+--- ------- -+----- ---+
| ID | Name | Disk Format | Container Format | Size | Status |
+----- ------- ------- ------- ------- -----+- ------- ------- ------- ------- ----+-- ------- ----+-- ------- ------- --+---- ------- +------ --+
| b9a6d072- 7e47-4821- 8dd9-d61d9dfa8c a7 | cirros- 0.3.2-x86_ 64-uec | ami | ami | 25165824 | active |
| 6ada155d- a9a1-46eb- 8518-72f55927a6 29 | cirros- 0.3.2-x86_ 64-uec- kernel | aki | aki | 4969360 | active |
| b621fed3- e9d1-4378- b538-cfab84cc38 aa | cirros- 0.3.2-x86_ 64-uec- ramdisk | ari | ari | 3723817 | active |
| 9e24be91- 5a53-4794- 92f1-16ae2ac252 ec | Fedora- x86_64- 20-20140618- sda | qcow2 | bare | 209649664 | active |
| 2ebd1bf3- 3f2a-42db- 90e0-ecf1dbdbe2 58 | x1 | raw | bare | | queued |
| 6da314be- 279f-4379- 99f8-a595277f37 59 | x1 | raw | bare | 10485760 | active |
| 154bbfaa- ba46-4c03- afbd-34057510e7 6b | x1 | raw | bare | 10485760 | active |
| 2051134d- f81b-4c37- ab7d-9e7cde369e 73 | x1 | raw | bare | 10485760 | active |
| 5b0acf74- c084-4dcd- 89c7-8d591aef7a ed | x1 | raw | bare | 1048576 | active |
| 3e62a31f- f6ab-41fd- 9968-4cb1867c31 b6 | x1 | raw | bare | 1048576 | active |
| 1f2b988d- 3f62-42cb- a7f8-b32ce5ee56 7d | x1 | raw | bare | 1048576 | active |
| a0a42e53- 0779-4701- 8fe3-4b5e0f3b17 0a | x1 | raw | bare | 1048576 | active |
+----- ------- ------- ------- ------- -----+- ------- ------- ------- ------- ----+-- ------- ----+-- ------- ------- --+---- ------- +------ --+
$ ./.tox/ py27/bin/ glance --no-ssl- compression --os-image-url https:/ /localhost: 9292 image-list
+----- ------- ------- ------- ------- -----+- ------- ------- ------- ------- ----+-- ------- ----+-- ------- ------- --+---- ------- +------ --+
| ID | Name | Disk Format | Container Format | Size | Status |
+----- ------- ------- ------- ------- -----+- ------- ------- ------- ------- ----+-- ------- ----+-- ------- ------- --+---- ------- +------ --+
| b9a6d072- 7e47-4821- 8dd9-d61d9dfa8c a7 | cirros- 0.3.2-x86_ 64-uec | ami | ami | 25165824 | active |
| 6ada155d- a9a1-46eb- 8518-72f55927a6 29 | cirros- 0.3.2-x86_ 64-uec- kernel | aki | aki | 4969360 | active |
| b621fed3- e9d1-4378- b538-cfab84cc38 aa | cirros- 0.3.2-x86_ 64-uec- ramdisk | ari | ari | 3723817 | active |
| 9e24be91- 5a53-4794- 92f1-16ae2ac252 ec | Fedora- x86_64- 20-20140618- sda | qcow2 | bare | 209649664 | active |
| 2ebd1bf3- 3f2a-42db- 90e0-ecf1dbdbe2 58 | x1 | raw | bare | | queued |
| 6da314be- 279f-4379- 99f8-a595277f37 59 | x1 | raw | bare | 10485760 | active |
| 154bbfaa- ba46-4c03- afbd-34057510e7 6b | x1 | raw | bare | 10485760 | active |
| 2051134d- f81b-4c37- ab7d-9e7cde369e 73 | x1 | raw | bare | 10485760 | active |
| 5b0acf74- c084-4dcd- 89c7-8d591aef7a ed | x1 | raw | bare | 1048576 | active |
| 3e62a31f- f6ab-41fd- 9968-4cb1867c31 b6 | x1 | raw | bare | 1048576 | active |
| 1f2b988d- 3f62-42cb- a7f8-b32ce5ee56 7d | x1 | raw | bare | 1048576 | active |
| a0a42e53- 0779-4701- 8fe3-4b5e0f3b17 0a | x1 | raw | bare | 1048576 | active |
+----- ------- ------- ------- ------- -----+- ------- ------- ------- ------- ----+-- ------- ----+-- ------- ------- --+---- ------- +------ --+
(both of these should fail since the server's cert has a CNAME mismatch).
This patch fixes the two cases:
------- ------- ------- ------- ------- ------- ------- -----
diff --git a/glanceclient/ common/ http.py b/glanceclient/ common/ http.py
index ad8e4c7..cc80843 100644
--- a/glanceclient/ common/ http.py
+++ b/glanceclient/ common/ http.py
@@ -67,8 +67,16 @@ class HTTPClient(object):
if not compression:
self. session. mount("https://", https.HTTPSAdap ter())
- self.session.verify = kwargs. get('cacert' ,
- not kwargs. get('insecure' , True))
+ self.session.verify = (kwargs. get('cacert' , None),
+ kwargs. get('insecure' , False))
+
+ else:
+ if kwargs. get('insecure' , False) is True:
+ self.session.verify = False
+ else:
+ if kwargs. get('cacert' , None) is not '':
+ self.session.verify = kwargs. get('cacert' , True)
+
self.session. cert = (kwargs. get('cert_ file'),
kwargs. get('key_ file'))
diff --git a/glanceclient/ common/ https.py b/glanceclient/ common/ https.py
index 93c6e6a..4f0e6f5 100644
--- a/glanceclient/ common/ https.py
+++ b/glanceclient/ common/ https.py
@@ -77,7 +77,8 @@ class HTTPSAdapter( adapters. HTTPAdapter) :
def cert_verify(self, conn, url, verify, cert):
super( HTTPSAdapter, self).cert_ verify( conn, url, verify, cert)
- conn.insecure = not verify
+ conn.ca_certs = verify[0]
+ conn.insecure = verify[1]
class HTTPSConnection Pool(connection pool.HTTPSConne ctionPool) :
------- ------- ------- ------- -------