Merge pull request #530 from dlorenc/master

Add assert_fingerprint option.

docker/ssladapter/ssladapter.py

@@ -25,10 +25,12 @@ def get_max_tls_protocol():
 
 class SSLAdapter(HTTPAdapter):
     '''An HTTPS Transport Adapter that uses an arbitrary SSL version.'''
-    def __init__(self, ssl_version=None, assert_hostname=None, **kwargs):
+    def __init__(self, ssl_version=None, assert_hostname=None,
+                 assert_fingerprint=None, **kwargs):
         ssl_version = ssl_version or get_max_tls_protocol()
         self.ssl_version = ssl_version
         self.assert_hostname = assert_hostname
+        self.assert_fingerprint = assert_fingerprint
         super(SSLAdapter, self).__init__(**kwargs)
 
     def init_poolmanager(self, connections, maxsize, block=False):
@@ -37,6 +39,7 @@ class SSLAdapter(HTTPAdapter):
             'maxsize': maxsize,
             'block': block,
             'assert_hostname': self.assert_hostname,
+            'assert_fingerprint': self.assert_fingerprint,
         }
         if self.can_override_ssl_version():
             kwargs['ssl_version'] = self.ssl_version

docker/tls.py

@@ -10,7 +10,8 @@ class TLSConfig(object):
     ssl_version = None
 
     def __init__(self, client_cert=None, ca_cert=None, verify=None,
-                 ssl_version=None, assert_hostname=None):
+                 ssl_version=None, assert_hostname=None,
+                 assert_fingerprint=None):
         # Argument compatibility/mapping with
         # http://docs.docker.com/examples/https/
         # This diverges from the Docker CLI in that users can specify 'tls'
@@ -24,6 +25,7 @@ class TLSConfig(object):
         ssl_version = ssl_version or ssladapter.get_max_tls_protocol()
         self.ssl_version = ssl_version
         self.assert_hostname = assert_hostname
+        self.assert_fingerprint = assert_fingerprint
 
         # "tls" and "tls_verify" must have both or neither cert/key files
         # In either case, Alert the user when both are expected, but any are
@@ -72,4 +74,5 @@ class TLSConfig(object):
         client.mount('https://', ssladapter.SSLAdapter(
             ssl_version=self.ssl_version,
             assert_hostname=self.assert_hostname,
+            assert_fingerprint=self.assert_fingerprint,
         ))