add support for TCPConnector param verify_fingerprint#361
add support for TCPConnector param verify_fingerprint#361requiredfield wants to merge 0 commit intoaio-libs:masterfrom
verify_fingerprint#361Conversation
|
Please go ahead! |
aiohttp/connector.py
Outdated
There was a problem hiding this comment.
Use at least FingerprintMismatch(). Maybe later you'll add info about failing host:port pair -- it is helpful for understanding the source of problem.
There was a problem hiding this comment.
Good idea. Addressed this in the latest commit. Also storing the expected vs. got fingerprint.
62668ab to
2fbbb9c
Compare
|
@asvetlov Thanks for reviewing! Just pushed a new patch with tests. Would you mind taking a peek at the latest patch? |
tests/test_connector.py
Outdated
There was a problem hiding this comment.
wasn't sure if I needed these two lines with the exc_handler
b59208d to
c27f6fb
Compare
CHANGES.txt
Outdated
There was a problem hiding this comment.
updated changelog
verify_fingerprint
ae68bb1 to
a9674ce
Compare
|
Pushed another improved version. Please let me know if there's anything left to do before this is good to merge. Thanks again for reviewing! |
aiohttp/connector.py
Outdated
There was a problem hiding this comment.
@asvetlov Do these two lines (502 and 504) look good to you? The conn[0]._sock makes me feel the need to check because of the private member access. As for sock.getpeercert, if sock is a regular socket.socket rather than an SSLSocket this will cause AttributeError, but I think that would only happen if the user tries to use verify_fingerprint with a non-SSL connection. I can code this more defensively though if that would be better.
There was a problem hiding this comment.
conn is (transport, protocol) pair.
For getting socket object from transport please call transport.get_extra_info('socket').
Also you have skip certificate check for non-ssl socket (request.ssl is False).
Not yet ready to merge but starting a PR now to incorporate any early feedback. Thanks for any review!