)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"eee1f005ccba03c47c7d4360d8d5e61143459055","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Thomas Leaman \u003cthomas.leaman@hp.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2013-06-25 13:11:31 +0000"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add SSL verification by default"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Verifies the SSL certificates credentials including matching CNAME."},{"line_number":10,"context_line":"Can be turned off with --insecure"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"AAAAPn%2F%2Fdw4%3D","line":7,"updated":"2013-07-01 13:08:57.000000000","message":"Minor nit, I\u0027d say \u0027Add SSL certificate verification by default\u0027 here.","commit_id":"dfbe8409d081aa1430f895caa4cef39d549616ac"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"eee1f005ccba03c47c7d4360d8d5e61143459055","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add SSL verification by default"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Verifies the SSL certificates credentials including matching CNAME."},{"line_number":10,"context_line":"Can be turned off with --insecure"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I168dba604b32e0cb814333d64396926e2bccf242"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"AAAAPn%2F%2FdwM%3D","line":9,"updated":"2013-07-01 13:08:57.000000000","message":"To me \u0027credentials\u0027 means access control (eg password etc). Not a big deal but we could take that word out and not lose meaning.","commit_id":"dfbe8409d081aa1430f895caa4cef39d549616ac"}],"swiftclient/client.py":[{"author":{"_account_id":2696,"name":"Darrell Bishop","email":"dbishop@nvidia.com","username":"darrellb"},"change_message_id":"ec38aa71386a97290f48a303968d8f1280fc87be","unresolved":false,"context_lines":[{"line_number":168,"context_line":"    if parsed.scheme \u003d\u003d \u0027http\u0027:"},{"line_number":169,"context_line":"        conn \u003d HTTPConnection(host)"},{"line_number":170,"context_line":"    elif parsed.scheme \u003d\u003d \u0027https\u0027:"},{"line_number":171,"context_line":"        conn \u003d VerifiedHTTPSConnection(host, insecure\u003dinsecure, ssl_compression\u003dssl_compression)"},{"line_number":172,"context_line":"    else:"},{"line_number":173,"context_line":"        raise ClientException(\u0027Cannot handle protocol scheme %s for url %s\u0027 %"},{"line_number":174,"context_line":"                              (parsed.scheme, repr(url)))"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2F4i4%3D","line":171,"updated":"2013-06-19 01:50:11.000000000","message":"Looks like the trick of assigning HTTPSConnection to VerifiedHTTPSConnection isn\u0027t going to work since the fall-back class doesn\u0027t have the insecure and ssl_compression kwargs:\n\n  2013-06-18 17:01:51.726 | \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n  2013-06-18 17:01:51.726 | FAIL: tests.test_swiftclient.TestHttpHelpers.test_http_connection\n  2013-06-18 17:01:51.726 | tags: worker-3\n  2013-06-18 17:01:51.726 | ----------------------------------------------------------------------\n  2013-06-18 17:01:51.726 | Traceback (most recent call last):\n  2013-06-18 17:01:51.726 |   File \"/home/jenkins/workspace/gate-python-swiftclient-python27/tests/test_swiftclient.py\", line 185, in test_http_connection\n  2013-06-18 17:01:51.726 |     _junk, conn \u003d c.http_connection(url)\n  2013-06-18 17:01:51.726 |   File \"/home/jenkins/workspace/gate-python-swiftclient-python27/swiftclient/client.py\", line 171, in http_connection\n  2013-06-18 17:01:51.726 |     conn \u003d VerifiedHTTPSConnection(host, insecure\u003dinsecure, ssl_compression\u003dssl_compression)\n  2013-06-18 17:01:51.726 | TypeError: __init__() got an unexpected keyword argument \u0027insecure\u0027\n  2013-06-18 17:01:51.726 |   \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d","commit_id":"1eb9df9b52e75c60f04cf4e6acadc3520f125f7d"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"eee1f005ccba03c47c7d4360d8d5e61143459055","unresolved":false,"context_lines":[{"line_number":142,"context_line":"        return b and \u0027%s: %s\u0027 % (a, b) or a"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"def http_connection(url, proxy\u003dNone, insecure\u003dFalse, ssl_compression\u003dTrue):"},{"line_number":146,"context_line":"    \"\"\""},{"line_number":147,"context_line":"    Make an HTTPConnection or HTTPSConnection"},{"line_number":148,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAPn%2F%2Fdp0%3D","line":145,"updated":"2013-07-01 13:08:57.000000000","message":"Typically we would add insecure last to handle existing code such as\n\nhttp_connection(url, None, True)\n\nbut what you have is probably ok I think.","commit_id":"dfbe8409d081aa1430f895caa4cef39d549616ac"},{"author":{"_account_id":7817,"name":"Thomas Leaman","email":"thomas.leaman@hp.com","username":"bugsduggan"},"change_message_id":"dfdf7004262ad59fc2bfb733531f8f2daf824f67","unresolved":false,"context_lines":[{"line_number":142,"context_line":"        return b and \u0027%s: %s\u0027 % (a, b) or a"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"def http_connection(url, proxy\u003dNone, insecure\u003dFalse, ssl_compression\u003dTrue):"},{"line_number":146,"context_line":"    \"\"\""},{"line_number":147,"context_line":"    Make an HTTPConnection or HTTPSConnection"},{"line_number":148,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAPn%2F%2Fdn8%3D","line":145,"in_reply_to":"AAAAPn%2F%2Fdp0%3D","updated":"2013-07-01 13:27:33.000000000","message":"This is consistent with the argument order of python-glanceclient","commit_id":"dfbe8409d081aa1430f895caa4cef39d549616ac"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"eee1f005ccba03c47c7d4360d8d5e61143459055","unresolved":false,"context_lines":[{"line_number":149,"context_line":"    :param url: url to connect to"},{"line_number":150,"context_line":"    :param proxy: proxy to connect through, if any; None by default; str of the"},{"line_number":151,"context_line":"                  format \u0027http://127.0.0.1:8888\u0027 to set one"},{"line_number":152,"context_line":"    :param insecure: Whether to allow insecure SSL certificates."},{"line_number":153,"context_line":"                     If set to \u0027False\u0027 (default) pyOpenSSL will be used to"},{"line_number":154,"context_line":"                     check the certificate\u0027s validity. If pyOpenSSL is not"},{"line_number":155,"context_line":"                     available, an error will be raised."}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAPn%2F%2Fdtk%3D","line":152,"updated":"2013-07-01 13:08:57.000000000","message":"I like the wording you use in putheader_wrapper -- why not re-use it here?","commit_id":"dfbe8409d081aa1430f895caa4cef39d549616ac"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"7a5701a6113a1a4dcd9881fc9aa0654897c891e9","unresolved":false,"context_lines":[{"line_number":145,"context_line":"    elif parsed.scheme \u003d\u003d \u0027https\u0027:"},{"line_number":146,"context_line":"        conn \u003d HTTPSConnection(host,"},{"line_number":147,"context_line":"                               insecure\u003dinsecure,"},{"line_number":148,"context_line":"                               ssl_compression\u003dssl_compression)"},{"line_number":149,"context_line":"    else:"},{"line_number":150,"context_line":"        raise ClientException(\u0027Cannot handle protocol scheme %s for url %s\u0027 %"},{"line_number":151,"context_line":"                              (parsed.scheme, repr(url)))"}],"source_content_type":"text/x-python","patch_set":16,"id":"AAAATn%2F9RMc%3D","line":148,"updated":"2013-12-13 09:51:55.000000000","message":"As of now, HTTPSConnection need the cacert parameter to use the --os-cacert CLI option.\nElse this option looks like completely ignored. Here is my test case:\n* proxy-server configured with cert_file\u003dtests/var/certificate.crt and key_file\u003dtests/var/privatekey.key\n* swift --os-cacert ./tests/var/ca.crt list --lh\n[...]\nOpenSSL.SSL.Error: [(\u0027SSL routines\u0027, \u0027SSL3_GET_SERVER_CERTIFICATE\u0027, \u0027certificate verify failed\u0027)]","commit_id":"55523cda8bde70dab34dfc457d2e807aa5379daa"}],"swiftclient/https_connection.py":[{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"d4ea770c1b316f8d05de12c9ec6b5f0242b6a560","unresolved":false,"context_lines":[{"line_number":117,"context_line":"        Set up the OpenSSL context."},{"line_number":118,"context_line":"        \"\"\""},{"line_number":119,"context_line":"        self.context \u003d OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"        if self.ssl_compression is False:"},{"line_number":122,"context_line":"            self.context.set_options(0x20000)  # SSL_OP_NO_COMPRESSION"},{"line_number":123,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAPn%2F%2F0XI%3D","line":120,"updated":"2013-06-20 15:06:45.000000000","message":"Why is this not simply \"if not self.ssl_compression:\"","commit_id":"76ceb7eab60715fcdc0954be31d9614dfba42764"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"d4ea770c1b316f8d05de12c9ec6b5f0242b6a560","unresolved":false,"context_lines":[{"line_number":120,"context_line":""},{"line_number":121,"context_line":"        if self.ssl_compression is False:"},{"line_number":122,"context_line":"            self.context.set_options(0x20000)  # SSL_OP_NO_COMPRESSION"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"        if self.insecure is not True:"},{"line_number":125,"context_line":"            self.context.set_verify(OpenSSL.SSL.VERIFY_PEER,"},{"line_number":126,"context_line":"                                    self.verify_callback)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAPn%2F%2F0XE%3D","line":123,"updated":"2013-06-20 15:06:45.000000000","message":"Dito","commit_id":"76ceb7eab60715fcdc0954be31d9614dfba42764"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"d4ea770c1b316f8d05de12c9ec6b5f0242b6a560","unresolved":false,"context_lines":[{"line_number":164,"context_line":"        Connect to an SSL port using the OpenSSL library and apply"},{"line_number":165,"context_line":"        per-connection parameters."},{"line_number":166,"context_line":"        \"\"\""},{"line_number":167,"context_line":"        sock \u003d socket.socket(socket.AF_INET, socket.SOCK_STREAM)"},{"line_number":168,"context_line":"        if self.timeout is not None:"},{"line_number":169,"context_line":"            # \u00270\u0027 microseconds"},{"line_number":170,"context_line":"            sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVTIMEO,"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAPn%2F%2F0Ws%3D","line":167,"updated":"2013-06-20 15:06:45.000000000","message":"I can\u0027t tell if \"is not None\" is your coding style or because zero is a valid value for timeout. If zero is a valid value, then \"is not None\" is correct and you can ignore this comment","commit_id":"76ceb7eab60715fcdc0954be31d9614dfba42764"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"eee1f005ccba03c47c7d4360d8d5e61143459055","unresolved":false,"context_lines":[{"line_number":68,"context_line":"                                  cert_file\u003dcert_file)"},{"line_number":69,"context_line":"        if not openssl_support:"},{"line_number":70,"context_line":"            if not insecure:"},{"line_number":71,"context_line":"                raise SSLConfigurationError(\u0027No OpenSSL support\u0027)"},{"line_number":72,"context_line":"            elif not ssl_compression:"},{"line_number":73,"context_line":"                warn(\u0027No OpenSSL support\u0027)"},{"line_number":74,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAPn%2F%2FdpU%3D","line":71,"updated":"2013-07-01 13:08:57.000000000","message":"I think a little more info would be useful to the user. Something along the lines of \u0027No OpenSSL support: Cannot verify server certificate. Install python-openssl or re-run using \u0027--insecure\u0027\u0027\u0027","commit_id":"dfbe8409d081aa1430f895caa4cef39d549616ac"},{"author":{"_account_id":7817,"name":"Thomas Leaman","email":"thomas.leaman@hp.com","username":"bugsduggan"},"change_message_id":"dfdf7004262ad59fc2bfb733531f8f2daf824f67","unresolved":false,"context_lines":[{"line_number":68,"context_line":"                                  cert_file\u003dcert_file)"},{"line_number":69,"context_line":"        if not openssl_support:"},{"line_number":70,"context_line":"            if not insecure:"},{"line_number":71,"context_line":"                raise SSLConfigurationError(\u0027No OpenSSL support\u0027)"},{"line_number":72,"context_line":"            elif not ssl_compression:"},{"line_number":73,"context_line":"                warn(\u0027No OpenSSL support\u0027)"},{"line_number":74,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAPn%2F%2Fdmc%3D","line":71,"in_reply_to":"AAAAPn%2F%2FdpU%3D","updated":"2013-07-01 13:27:33.000000000","message":"Yep. Put these in as placeholders and forgot to go back to make them useful!","commit_id":"dfbe8409d081aa1430f895caa4cef39d549616ac"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"eee1f005ccba03c47c7d4360d8d5e61143459055","unresolved":false,"context_lines":[{"line_number":70,"context_line":"            if not insecure:"},{"line_number":71,"context_line":"                raise SSLConfigurationError(\u0027No OpenSSL support\u0027)"},{"line_number":72,"context_line":"            elif not ssl_compression:"},{"line_number":73,"context_line":"                warn(\u0027No OpenSSL support\u0027)"},{"line_number":74,"context_line":"        else:"},{"line_number":75,"context_line":"            self.key_file \u003d key_file"},{"line_number":76,"context_line":"            self.cert_file \u003d cert_file"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAPn%2F%2FdrM%3D","line":73,"updated":"2013-07-01 13:08:57.000000000","message":"Its great to see this warning. How about making the wording a little more obvious? Something like \"No OpenSSL support: cannot disable SSL compression negotiation.\"","commit_id":"dfbe8409d081aa1430f895caa4cef39d549616ac"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"eee1f005ccba03c47c7d4360d8d5e61143459055","unresolved":false,"context_lines":[{"line_number":183,"context_line":"            if self.timeout is not None:"},{"line_number":184,"context_line":"                # \u00270\u0027 microseconds"},{"line_number":185,"context_line":"                sock.setsockopt(socket.SOL_SOCKET, socket.SO_RCVTIMEO,"},{"line_number":186,"context_line":"                                struct.pack(\u0027LL\u0027, self.timeout, 0))"},{"line_number":187,"context_line":"            self.sock \u003d OpenSSLConnectionDelegator(self.context, sock)"},{"line_number":188,"context_line":"            self.sock.connect((self.host, self.port))"},{"line_number":189,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAPn%2F%2Fdq4%3D","line":186,"updated":"2013-07-01 13:08:57.000000000","message":"LL should possibly be \u0027fL\u0027. See https://review.openstack.org/#/c/33884/\nAlso that patch has a .close related change.","commit_id":"dfbe8409d081aa1430f895caa4cef39d549616ac"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"1e3bfeff3a50ce7061f1f56b267281dd794e6bfb","unresolved":false,"context_lines":[{"line_number":192,"context_line":""},{"line_number":193,"context_line":"    def close(self):"},{"line_number":194,"context_line":"        if self.sock:"},{"line_number":195,"context_line":"            # Removing reference to socket but don\u0027t close it yet."},{"line_number":196,"context_line":"            # Response close will close both socket and associated"},{"line_number":197,"context_line":"            # file. Closing socket too soon will cause response"},{"line_number":198,"context_line":"            # reads to fail with (9, \u0027Bad file descriptor\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAUX%2F%2FoIs%3D","line":195,"updated":"2014-02-11 22:03:48.000000000","message":"In what circumstances does the error occur?\n\nI\u0027m asking because in my testing, the EBADF occurs _with_ this shimming of close. But if I revert this to patch #3 by removing all this, then everything works as expected.","commit_id":"55739a1039e70d257275bbd562d8b1d6bf55f2f3"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"ee49a4f576a8ff991ca204c08185566b8497696f","unresolved":false,"context_lines":[{"line_number":17,"context_line":"HTTPS/SSL related functionality"},{"line_number":18,"context_line":"\"\"\""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"import OpenSSL"},{"line_number":21,"context_line":"import socket"},{"line_number":22,"context_line":"import struct"},{"line_number":23,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"AAAAP3%2F%2FgHI%3D","line":20,"updated":"2013-07-17 09:42:43.000000000","message":"Nit: not sure if this ordering of imports is correct.","commit_id":"e0bbb5ac0540029d210d5ad8ba552bac6c19715d"},{"author":{"_account_id":8257,"name":"Brian Curtin","email":"brian@python.org","username":"briancurtin"},"change_message_id":"0ca48666220fb884b5c9d302db49567537c4e7ef","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"        # Also try Subject Alternative Names for a match"},{"line_number":91,"context_line":"        san_list \u003d None"},{"line_number":92,"context_line":"        for i in xrange(x509.get_extension_count()):"},{"line_number":93,"context_line":"            ext \u003d x509.get_extension(i)"},{"line_number":94,"context_line":"            if ext.get_short_name() \u003d\u003d \u0027subjectAltName\u0027:"},{"line_number":95,"context_line":"                san_list \u003d str(ext)"}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAAS3%2F%2F9J0%3D","line":92,"updated":"2013-09-16 16:35:05.000000000","message":"In the name of Python 3 compatibility, this could just be `range(...)`.","commit_id":"e56f8c17784145e0431dbbacca6830a70d8a6574"},{"author":{"_account_id":866,"name":"Chmouel Boudjnah","email":"chmouel@chmouel.com","username":"chmouel"},"change_message_id":"8970f2328953eb083615ab7f9b9a2463f61ef8a5","unresolved":false,"context_lines":[{"line_number":26,"context_line":"try:"},{"line_number":27,"context_line":"    from eventlet.green.OpenSSL.SSL import GreenConnection"},{"line_number":28,"context_line":"    from eventlet.greenio import GreenSocket"},{"line_number":29,"context_line":"    from eventlet.patcher import is_monkey_patched"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    def getsockopt(self, *args, **kwargs):"},{"line_number":32,"context_line":"        return self.fd.getsockopt(*args, **kwargs)"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAATH%2F%2FezA%3D","line":29,"updated":"2013-10-15 16:46:37.000000000","message":"FYI: we have eradicated eventlet from swiftclient with pete\u0027s patch here :\n\nhttp://is.gd/Fkmozq\n\nwe may want to do some cleanup as well here.","commit_id":"afd9d39a217d8563e73bb8a46e343e55627bd5d1"},{"author":{"_account_id":7687,"name":"Donald Stufft","email":"donald@stufft.io","username":"dstufft"},"change_message_id":"96b552f11ef8d6c265368fe3a3248d267b54b0d0","unresolved":false,"context_lines":[{"line_number":54,"context_line":"        self.setcontext()"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    @staticmethod"},{"line_number":57,"context_line":"    def host_matches_cert(host, x509):"},{"line_number":58,"context_line":"        \"\"\""},{"line_number":59,"context_line":"        Verify that the the x509 certificate we have received"},{"line_number":60,"context_line":"        from \u0027host\u0027 correctly identifies the server we are"}],"source_content_type":"text/x-python","patch_set":17,"id":"AAAAUH%2F%2FLR0%3D","line":57,"updated":"2014-01-16 18:12:28.000000000","message":"I\u0027m pretty sure this entire method is wrong.\n\n1) RFC 2818 states that if any SANs exist then they are the only thing that should be consulted for determining if a certificate matches.\n\n2) Certificates can have more than one CN (it\u0027s rare but allowed), RFC 2818 states that you must validate against the most specific one.\n\n3) It doesn\u0027t properly handle wildcards, again RFC2818 states that f*.example.com should match for foo.example.com\n\n4) It doesn\u0027t properly handle the IP address type of SAN\n\nThere might possibly be more, this is just what I found on a quick scan.","commit_id":"b75bf48941a9344ce75378269d54d2dbc236ca5a"},{"author":{"_account_id":7687,"name":"Donald Stufft","email":"donald@stufft.io","username":"dstufft"},"change_message_id":"96b552f11ef8d6c265368fe3a3248d267b54b0d0","unresolved":false,"context_lines":[{"line_number":99,"context_line":"                        depth, preverify_ok):"},{"line_number":100,"context_line":"        # NOTE(leaman): preverify_ok may be a non-boolean type"},{"line_number":101,"context_line":"        preverify_ok \u003d bool(preverify_ok)"},{"line_number":102,"context_line":"        if x509.has_expired():"},{"line_number":103,"context_line":"            msg \u003d \"SSL Certificate expired on \u0027%s\u0027\" % x509.get_notAfter()"},{"line_number":104,"context_line":"            raise SSLCertificateError(msg)"},{"line_number":105,"context_line":""}],"source_content_type":"text/x-python","patch_set":17,"id":"AAAAUH%2F%2FLgA%3D","line":102,"updated":"2014-01-16 18:12:28.000000000","message":"I could be wrong, but I don\u0027t think this is adequate. It looks like it verifies that the certificate hasn\u0027t expired, but I don\u0027t believe it\u0027ll verify that the ticket has started being valid. X509 certificates have a start and an end date.","commit_id":"b75bf48941a9344ce75378269d54d2dbc236ca5a"},{"author":{"_account_id":7687,"name":"Donald Stufft","email":"donald@stufft.io","username":"dstufft"},"change_message_id":"96b552f11ef8d6c265368fe3a3248d267b54b0d0","unresolved":false,"context_lines":[{"line_number":117,"context_line":"        \"\"\""},{"line_number":118,"context_line":"        self.context \u003d OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"        if self.ssl_compression is False:"},{"line_number":121,"context_line":"            self.context.set_options(0x20000)  # SSL_OP_NO_COMPRESSION"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"        if self.insecure is not True:"}],"source_content_type":"text/x-python","patch_set":17,"id":"AAAAUH%2F%2FLjo%3D","line":120,"updated":"2014-01-16 18:12:28.000000000","message":"Don\u0027t use explicit is checks against boolean values in Python. Use\n\nif not self.ssl_compression:","commit_id":"b75bf48941a9344ce75378269d54d2dbc236ca5a"},{"author":{"_account_id":7687,"name":"Donald Stufft","email":"donald@stufft.io","username":"dstufft"},"change_message_id":"96b552f11ef8d6c265368fe3a3248d267b54b0d0","unresolved":false,"context_lines":[{"line_number":120,"context_line":"        if self.ssl_compression is False:"},{"line_number":121,"context_line":"            self.context.set_options(0x20000)  # SSL_OP_NO_COMPRESSION"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"        if self.insecure is not True:"},{"line_number":124,"context_line":"            self.context.set_verify(OpenSSL.SSL.VERIFY_PEER,"},{"line_number":125,"context_line":"                                    self.verify_callback)"},{"line_number":126,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":17,"id":"AAAAUH%2F%2FLig%3D","line":123,"updated":"2014-01-16 18:12:28.000000000","message":"Ditto here, don\u0027t use expicit is checks against Booleans.","commit_id":"b75bf48941a9344ce75378269d54d2dbc236ca5a"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"03ae7d2560a8912fc8516e9f1b08552708de7f58","unresolved":false,"context_lines":[{"line_number":153,"context_line":"            try:"},{"line_number":154,"context_line":"                self.context.load_verify_locations(self.cacert)"},{"line_number":155,"context_line":"            except Exception as e:"},{"line_number":156,"context_line":"                msg \u003d \u0027Unable to load CA from \"%s\"\u0027 % (self.cacert, e)"},{"line_number":157,"context_line":"                raise SSLConfigurationError(msg)"},{"line_number":158,"context_line":"        else:"},{"line_number":159,"context_line":"            self.context.set_default_verify_paths()"}],"source_content_type":"text/x-python","patch_set":17,"id":"AAAAUH%2F%2Fra0%3D","line":156,"updated":"2014-01-09 17:47:23.000000000","message":"This does not compute, not all arguments converted during string formatting","commit_id":"b75bf48941a9344ce75378269d54d2dbc236ca5a"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"c86e91ae8f07832a10a9f1a9f3cfa5b7e2529434","unresolved":false,"context_lines":[{"line_number":203,"context_line":"        # Making sure socket is closed when this file is closed"},{"line_number":204,"context_line":"        # since we now avoid closing socket on connection close"},{"line_number":205,"context_line":"        # see new close method under VerifiedHTTPSConnection"},{"line_number":206,"context_line":"        kwargs[\u0027close\u0027] \u003d True"},{"line_number":207,"context_line":""},{"line_number":208,"context_line":"        return socket._fileobject(self.connection, *args, **kwargs)"}],"source_content_type":"text/x-python","patch_set":17,"id":"AAAAT3%2F%2F10c%3D","line":206,"updated":"2013-12-30 11:47:55.000000000","message":"Removing that line fixes the OpenSSL.SSL.SysCallError: (9, \u0027Bad file descriptor\u0027)","commit_id":"b75bf48941a9344ce75378269d54d2dbc236ca5a"},{"author":{"_account_id":9311,"name":"Tristan Cacqueray","email":"tdecacqu@redhat.com","username":"tristanC"},"change_message_id":"cc20968d5f71d60823651292f3eb86e289472d53","unresolved":false,"context_lines":[{"line_number":153,"context_line":"            try:"},{"line_number":154,"context_line":"                self.context.load_verify_locations(self.cacert)"},{"line_number":155,"context_line":"            except Exception as e:"},{"line_number":156,"context_line":"                msg \u003d \u0027Unable to load CA from \"%s\"\u0027 % (self.cacert, e)"},{"line_number":157,"context_line":"                raise SSLConfigurationError(msg)"},{"line_number":158,"context_line":"        else:"},{"line_number":159,"context_line":"            self.context.set_default_verify_paths()"}],"source_content_type":"text/x-python","patch_set":18,"id":"AAAAUH%2F%2FLpc%3D","line":156,"updated":"2014-01-16 17:14:43.000000000","message":"This does not compute, not all arguments converted during string formatting","commit_id":"b87155655635954572b925c22317cfa23c483e35"}],"tests/test_ssl.py":[{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"eee1f005ccba03c47c7d4360d8d5e61143459055","unresolved":false,"context_lines":[{"line_number":1,"context_line":"# Copyright 2012 OpenStack LLC."},{"line_number":2,"context_line":"# All Rights Reserved."},{"line_number":3,"context_line":"#"},{"line_number":4,"context_line":"#    Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAPn%2F%2Fdqk%3D","line":1,"updated":"2013-07-01 13:08:57.000000000","message":"2013?","commit_id":"dfbe8409d081aa1430f895caa4cef39d549616ac"},{"author":{"_account_id":8257,"name":"Brian Curtin","email":"brian@python.org","username":"briancurtin"},"change_message_id":"0ca48666220fb884b5c9d302db49567537c4e7ef","unresolved":false,"context_lines":[{"line_number":53,"context_line":"                              cacert\u003dcacert)"},{"line_number":54,"context_line":"            self.fail(\u0027Failed to raise assertion.\u0027)"},{"line_number":55,"context_line":"        except h.SSLConfigurationError:"},{"line_number":56,"context_line":"            pass"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"    def test_ssl_init_key_no_cert(self):"},{"line_number":59,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAAS3%2F%2F9E4%3D","line":56,"updated":"2013-09-16 16:35:05.000000000","message":"You could be using assertRaises here and in a few more similar tests below. You use it later on in the file.","commit_id":"e56f8c17784145e0431dbbacca6830a70d8a6574"},{"author":{"_account_id":8257,"name":"Brian Curtin","email":"brian@python.org","username":"briancurtin"},"change_message_id":"3efa1b027df92d67ae7686dd9a53f5028f692cb0","unresolved":false,"context_lines":[{"line_number":18,"context_line":"import testtools"},{"line_number":19,"context_line":"from OpenSSL import crypto"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from swiftclient import https_connection as h"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"TEST_VAR_DIR \u003d os.path.abspath(os.path.join(os.path.dirname(__file__),"}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAAS3%2F%2F5Fc%3D","line":21,"updated":"2013-09-17 16:10:10.000000000","message":"I think it\u0027d be more clear if you just imported htttplib.HTTPSConnection directly rather than accessing it via swiftclient.https_connection doing that import. It becomes more explicit this way - I had to look back to that module to see if this was vanilla HTTPSConnection or something else.","commit_id":"f7e0bc3a9b0cfa8fdaa0b8cc6aa0aa2c6eb2817d"},{"author":{"_account_id":7817,"name":"Thomas Leaman","email":"thomas.leaman@hp.com","username":"bugsduggan"},"change_message_id":"53f24f26851ba466a7d16b2df9481c2af78ed9a1","unresolved":false,"context_lines":[{"line_number":18,"context_line":"import testtools"},{"line_number":19,"context_line":"from OpenSSL import crypto"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"from swiftclient import https_connection as h"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"TEST_VAR_DIR \u003d os.path.abspath(os.path.join(os.path.dirname(__file__),"}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAAS3%2F%2F2hU%3D","line":21,"in_reply_to":"AAAAS3%2F%2F5Fc%3D","updated":"2013-09-18 08:43:45.000000000","message":"We actually use several classes from https_connection, one of which is a subclass of httplib.HTTPSConnection, not the vanilla version.","commit_id":"f7e0bc3a9b0cfa8fdaa0b8cc6aa0aa2c6eb2817d"},{"author":{"_account_id":8257,"name":"Brian Curtin","email":"brian@python.org","username":"briancurtin"},"change_message_id":"3efa1b027df92d67ae7686dd9a53f5028f692cb0","unresolved":false,"context_lines":[{"line_number":62,"context_line":"            h.HTTPSConnection(\u0027127.0.0.1\u0027, 0,"},{"line_number":63,"context_line":"                              key_file\u003dkey_file,"},{"line_number":64,"context_line":"                              cacert\u003dcacert)"},{"line_number":65,"context_line":"        except:"},{"line_number":66,"context_line":"            self.fail(\u0027Failed to init HTTPSConnection.\u0027)"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"    def test_ssl_init_bad_key(self):"}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAAS3%2F%2F5TY%3D","line":65,"updated":"2013-09-17 16:10:10.000000000","message":"This has the same fail message as test_ssl_init_ok but it\u0027s catching all types of exceptions. Should this be catching SSLConfigurationError? (I believe so)","commit_id":"f7e0bc3a9b0cfa8fdaa0b8cc6aa0aa2c6eb2817d"},{"author":{"_account_id":7817,"name":"Thomas Leaman","email":"thomas.leaman@hp.com","username":"bugsduggan"},"change_message_id":"53f24f26851ba466a7d16b2df9481c2af78ed9a1","unresolved":false,"context_lines":[{"line_number":62,"context_line":"            h.HTTPSConnection(\u0027127.0.0.1\u0027, 0,"},{"line_number":63,"context_line":"                              key_file\u003dkey_file,"},{"line_number":64,"context_line":"                              cacert\u003dcacert)"},{"line_number":65,"context_line":"        except:"},{"line_number":66,"context_line":"            self.fail(\u0027Failed to init HTTPSConnection.\u0027)"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"    def test_ssl_init_bad_key(self):"}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAAS3%2F%2F2ec%3D","line":65,"in_reply_to":"AAAAS3%2F%2F5TY%3D","updated":"2013-09-18 08:43:45.000000000","message":"Agreed.","commit_id":"f7e0bc3a9b0cfa8fdaa0b8cc6aa0aa2c6eb2817d"},{"author":{"_account_id":8257,"name":"Brian Curtin","email":"brian@python.org","username":"briancurtin"},"change_message_id":"3efa1b027df92d67ae7686dd9a53f5028f692cb0","unresolved":false,"context_lines":[{"line_number":110,"context_line":"        try:"},{"line_number":111,"context_line":"            conn \u003d h.HTTPSConnection(\u00270.0.0.0\u0027, 0)"},{"line_number":112,"context_line":"            conn.verify_callback(None, cert, 0, 0, 1)"},{"line_number":113,"context_line":"        except:"},{"line_number":114,"context_line":"            self.fail(\u0027Unexpected exception.\u0027)"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    def test_ssl_cert_cname_wildcard(self):"}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAAS3%2F%2F5FU%3D","line":113,"updated":"2013-09-17 16:10:10.000000000","message":"This bare except clause and subsequent self.fail will mask whatever the exception is. As it stands you\u0027ll get an AssertionError in the fail case, which isn\u0027t helpful in pointing you to what went wrong. I\u0027d probably take this out of the try/except block and let unexpected exceptions just occur, and do some type of assertion on the expected case.\n\nThe same goes for several tests below.","commit_id":"f7e0bc3a9b0cfa8fdaa0b8cc6aa0aa2c6eb2817d"},{"author":{"_account_id":7817,"name":"Thomas Leaman","email":"thomas.leaman@hp.com","username":"bugsduggan"},"change_message_id":"53f24f26851ba466a7d16b2df9481c2af78ed9a1","unresolved":false,"context_lines":[{"line_number":110,"context_line":"        try:"},{"line_number":111,"context_line":"            conn \u003d h.HTTPSConnection(\u00270.0.0.0\u0027, 0)"},{"line_number":112,"context_line":"            conn.verify_callback(None, cert, 0, 0, 1)"},{"line_number":113,"context_line":"        except:"},{"line_number":114,"context_line":"            self.fail(\u0027Unexpected exception.\u0027)"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    def test_ssl_cert_cname_wildcard(self):"}],"source_content_type":"text/x-python","patch_set":12,"id":"AAAAS3%2F%2F2d8%3D","line":113,"in_reply_to":"AAAAS3%2F%2F5FU%3D","updated":"2013-09-18 08:43:45.000000000","message":"Agreed.","commit_id":"f7e0bc3a9b0cfa8fdaa0b8cc6aa0aa2c6eb2817d"}],"tests/test_swiftclient.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"77b2a2fab1cb302a7d73c3e21cdbb5c52b168d5c","unresolved":false,"context_lines":[{"line_number":125,"context_line":"            query_string \u003d kwargs.get(\u0027query_string\u0027)"},{"line_number":126,"context_line":"            storage_url \u003d kwargs.get(\u0027storage_url\u0027)"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"            def wrapper(url, proxy\u003dNone, insecure\u003dFalse, ssl_compression\u003dTrue):"},{"line_number":129,"context_line":"                if storage_url:"},{"line_number":130,"context_line":"                    self.assertEqual(storage_url, url)"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAASn%2F%2FHJs%3D","line":128,"updated":"2013-09-11 19:36:22.000000000","message":"Do you need tests now to check for explicitly setting insecure to true?","commit_id":"e56f8c17784145e0431dbbacca6830a70d8a6574"},{"author":{"_account_id":7817,"name":"Thomas Leaman","email":"thomas.leaman@hp.com","username":"bugsduggan"},"change_message_id":"1159cd9369d132695f81c94d9d17fbd6d84f4eb6","unresolved":false,"context_lines":[{"line_number":125,"context_line":"            query_string \u003d kwargs.get(\u0027query_string\u0027)"},{"line_number":126,"context_line":"            storage_url \u003d kwargs.get(\u0027storage_url\u0027)"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"            def wrapper(url, proxy\u003dNone, insecure\u003dFalse, ssl_compression\u003dTrue):"},{"line_number":129,"context_line":"                if storage_url:"},{"line_number":130,"context_line":"                    self.assertEqual(storage_url, url)"},{"line_number":131,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"AAAAS3%2F%2F6i4%3D","line":128,"in_reply_to":"AAAASn%2F%2FHJs%3D","updated":"2013-09-17 09:12:28.000000000","message":"test_http_connection (see below) covers this case.","commit_id":"e56f8c17784145e0431dbbacca6830a70d8a6574"}]}