| Index: tools/telemetry/third_party/gsutilz/third_party/boto/tests/integration/s3/test_https_cert_validation.py
|
| diff --git a/tools/telemetry/third_party/gsutilz/third_party/boto/tests/integration/s3/test_https_cert_validation.py b/tools/telemetry/third_party/gsutilz/third_party/boto/tests/integration/s3/test_https_cert_validation.py
|
| deleted file mode 100644
|
| index 9222a4a7075929f119afb980736627e68a153b8d..0000000000000000000000000000000000000000
|
| --- a/tools/telemetry/third_party/gsutilz/third_party/boto/tests/integration/s3/test_https_cert_validation.py
|
| +++ /dev/null
|
| @@ -1,141 +0,0 @@
|
| -# Copyright 2011 Google Inc.
|
| -#
|
| -# Permission is hereby granted, free of charge, to any person obtaining a
|
| -# copy of this software and associated documentation files (the
|
| -# "Software"), to deal in the Software without restriction, including
|
| -# without limitation the rights to use, copy, modify, merge, publish, dis-
|
| -# tribute, sublicense, and/or sell copies of the Software, and to permit
|
| -# persons to whom the Software is furnished to do so, subject to the fol-
|
| -# lowing conditions:
|
| -#
|
| -# The above copyright notice and this permission notice shall be included
|
| -# in all copies or substantial portions of the Software.
|
| -#
|
| -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
| -# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABIL-
|
| -# ITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
|
| -# SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
| -# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
| -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
|
| -# IN THE SOFTWARE.
|
| -
|
| -"""
|
| -Tests to validate correct validation of SSL server certificates.
|
| -
|
| -Note that this test assumes two external dependencies are available:
|
| - - A http proxy, which by default is assumed to be at host 'cache' and port
|
| - 3128. This can be overridden with environment variables PROXY_HOST and
|
| - PROXY_PORT, respectively.
|
| - - An ssl-enabled web server that will return a valid certificate signed by one
|
| - of the bundled CAs, and which can be reached by an alternate hostname that
|
| - does not match the CN in that certificate. By default, this test uses host
|
| - 'www' (without fully qualified domain). This can be overridden with
|
| - environment variable INVALID_HOSTNAME_HOST. If no suitable host is already
|
| - available, such a mapping can be established by temporarily adding an IP
|
| - address for, say, www.google.com or www.amazon.com to /etc/hosts.
|
| -"""
|
| -
|
| -import os
|
| -import ssl
|
| -import unittest
|
| -
|
| -from nose.plugins.attrib import attr
|
| -
|
| -import boto
|
| -from boto import exception, https_connection
|
| -from boto.gs.connection import GSConnection
|
| -from boto.s3.connection import S3Connection
|
| -
|
| -
|
| -# File 'other_cacerts.txt' contains a valid CA certificate of a CA that is used
|
| -# by neither S3 nor Google Cloud Storage. Validation against this CA cert should
|
| -# result in a certificate error.
|
| -DEFAULT_CA_CERTS_FILE = os.path.join(
|
| - os.path.dirname(os.path.abspath(__file__ )), 'other_cacerts.txt')
|
| -
|
| -
|
| -PROXY_HOST = os.environ.get('PROXY_HOST', 'cache')
|
| -PROXY_PORT = os.environ.get('PROXY_PORT', '3128')
|
| -
|
| -# This test assumes that this host returns a certificate signed by one of the
|
| -# trusted CAs, but with a Common Name that won't match host name 'www' (i.e.,
|
| -# the server should return a certificate with CN 'www.<somedomain>.com').
|
| -INVALID_HOSTNAME_HOST = os.environ.get('INVALID_HOSTNAME_HOST', 'www')
|
| -
|
| -
|
| -@attr('notdefault', 'ssl')
|
| -class CertValidationTest(unittest.TestCase):
|
| - def setUp(self):
|
| - # Clear config
|
| - for section in boto.config.sections():
|
| - boto.config.remove_section(section)
|
| -
|
| - # Enable https_validate_certificates.
|
| - boto.config.add_section('Boto')
|
| - boto.config.setbool('Boto', 'https_validate_certificates', True)
|
| -
|
| - # Set up bogus credentials so that the auth module is willing to go
|
| - # ahead and make a request; the request should fail with a service-level
|
| - # error if it does get to the service (S3 or GS).
|
| - boto.config.add_section('Credentials')
|
| - boto.config.set('Credentials', 'gs_access_key_id', 'xyz')
|
| - boto.config.set('Credentials', 'gs_secret_access_key', 'xyz')
|
| - boto.config.set('Credentials', 'aws_access_key_id', 'xyz')
|
| - boto.config.set('Credentials', 'aws_secret_access_key', 'xyz')
|
| -
|
| - def enableProxy(self):
|
| - boto.config.set('Boto', 'proxy', PROXY_HOST)
|
| - boto.config.set('Boto', 'proxy_port', PROXY_PORT)
|
| -
|
| - def assertConnectionThrows(self, connection_class, error):
|
| - conn = connection_class()
|
| - self.assertRaises(error, conn.get_all_buckets)
|
| -
|
| - def do_test_valid_cert(self):
|
| - # When connecting to actual servers with bundled root certificates, no
|
| - # cert errors should be thrown; instead we will get "invalid
|
| - # credentials" errors since the config used does not contain any
|
| - # credentials.
|
| - self.assertConnectionThrows(S3Connection, exception.S3ResponseError)
|
| - self.assertConnectionThrows(GSConnection, exception.GSResponseError)
|
| -
|
| - def test_valid_cert(self):
|
| - self.do_test_valid_cert()
|
| -
|
| - def test_valid_cert_with_proxy(self):
|
| - self.enableProxy()
|
| - self.do_test_valid_cert()
|
| -
|
| - def do_test_invalid_signature(self):
|
| - boto.config.set('Boto', 'ca_certificates_file', DEFAULT_CA_CERTS_FILE)
|
| - self.assertConnectionThrows(S3Connection, ssl.SSLError)
|
| - self.assertConnectionThrows(GSConnection, ssl.SSLError)
|
| -
|
| - def test_invalid_signature(self):
|
| - self.do_test_invalid_signature()
|
| -
|
| - def test_invalid_signature_with_proxy(self):
|
| - self.enableProxy()
|
| - self.do_test_invalid_signature()
|
| -
|
| - def do_test_invalid_host(self):
|
| - boto.config.set('Credentials', 'gs_host', INVALID_HOSTNAME_HOST)
|
| - boto.config.set('Credentials', 's3_host', INVALID_HOSTNAME_HOST)
|
| - self.assertConnectionThrows(S3Connection, ssl.SSLError)
|
| - self.assertConnectionThrows(GSConnection, ssl.SSLError)
|
| -
|
| - def do_test_invalid_host(self):
|
| - boto.config.set('Credentials', 'gs_host', INVALID_HOSTNAME_HOST)
|
| - boto.config.set('Credentials', 's3_host', INVALID_HOSTNAME_HOST)
|
| - self.assertConnectionThrows(
|
| - S3Connection, https_connection.InvalidCertificateException)
|
| - self.assertConnectionThrows(
|
| - GSConnection, https_connection.InvalidCertificateException)
|
| -
|
| - def test_invalid_host(self):
|
| - self.do_test_invalid_host()
|
| -
|
| - def test_invalid_host_with_proxy(self):
|
| - self.enableProxy()
|
| - self.do_test_invalid_host()
|
| -
|
|
|