netlib.certutils -> mitmproxy.certs

9 files changed, 97 insertions, 86 deletions

diff --git a/netlib/certutils.py b/mitmproxy/certs.py
index 9cb8a40e..9cb8a40e 100644
--- a/netlib/certutils.py
+++ b/mitmproxy/certs.py
diff --git a/mitmproxy/connections.py b/mitmproxy/connections.py
index bf7a12aa..6b39ac20 100644
--- a/mitmproxy/connections.py
+++ b/mitmproxy/connections.py
@@ -4,7 +4,7 @@ import copy
 import os
 
 from mitmproxy import stateobject
-from netlib import certutils
+from mitmproxy import certs
 from netlib import tcp
 
 
@@ -57,7 +57,7 @@ class ClientConnection(tcp.BaseHandler, stateobject.StateObject):
     _stateobject_attributes = dict(
         address=tcp.Address,
         ssl_established=bool,
-        clientcert=certutils.SSLCert,
+        clientcert=certs.SSLCert,
         timestamp_start=float,
         timestamp_ssl_setup=float,
         timestamp_end=float,
@@ -151,7 +151,7 @@ class ServerConnection(tcp.TCPClient, stateobject.StateObject):
         ip_address=tcp.Address,
         source_address=tcp.Address,
         ssl_established=bool,
-        cert=certutils.SSLCert,
+        cert=certs.SSLCert,
         sni=str,
         timestamp_start=float,
         timestamp_tcp_setup=float,
diff --git a/mitmproxy/proxy/config.py b/mitmproxy/proxy/config.py
index a6fc739b..86b68ee5 100644
--- a/mitmproxy/proxy/config.py
+++ b/mitmproxy/proxy/config.py
@@ -10,7 +10,7 @@ from OpenSSL import SSL, crypto
 
 from mitmproxy import exceptions
 from mitmproxy import options as moptions
-from netlib import certutils
+from mitmproxy import certs
 from netlib import tcp
 from netlib.http import authentication
 from netlib.http import url
@@ -106,7 +106,7 @@ class ProxyConfig:
                 "Certificate Authority parent directory does not exist: %s" %
                 os.path.dirname(options.cadir)
             )
-        self.certstore = certutils.CertStore.from_store(
+        self.certstore = certs.CertStore.from_store(
             certstore_path,
             CONF_BASENAME
         )
diff --git a/netlib/tcp.py b/netlib/tcp.py
index 4379c9b5..6e323957 100644
--- a/netlib/tcp.py
+++ b/netlib/tcp.py
@@ -17,7 +17,7 @@ from backports import ssl_match_hostname
 import OpenSSL
 from OpenSSL import SSL
 
-from netlib import certutils
+from mitmproxy import certs
 from mitmproxy.utils import version_check
 from mitmproxy.types import serializable
 from netlib import exceptions
@@ -685,11 +685,11 @@ class TCPClient(_Connection):
             if verification_mode == SSL.VERIFY_PEER and self.ssl_verification_error:
                 raise self.ssl_verification_error
 
-        self.cert = certutils.SSLCert(self.connection.get_peer_certificate())
+        self.cert = certs.SSLCert(self.connection.get_peer_certificate())
 
         # Keep all server certificates in a list
         for i in self.connection.get_peer_cert_chain():
-            self.server_certs.append(certutils.SSLCert(i))
+            self.server_certs.append(certs.SSLCert(i))
 
         # Validate TLS Hostname
         try:
@@ -782,7 +782,7 @@ class BaseHandler(_Connection):
                            extra_chain_certs=None,
                            **sslctx_kwargs):
         """
-            cert: A certutils.SSLCert object or the path to a certificate
+            cert: A certs.SSLCert object or the path to a certificate
             chain file.
 
             handle_sni: SNI handler, should take a connection object. Server
@@ -810,7 +810,7 @@ class BaseHandler(_Connection):
         context = self._create_ssl_context(ca_pemfile=chain_file, **sslctx_kwargs)
 
         context.use_privatekey(key)
-        if isinstance(cert, certutils.SSLCert):
+        if isinstance(cert, certs.SSLCert):
             context.use_certificate(cert.x509)
         else:
             context.use_certificate_chain_file(cert)
@@ -825,7 +825,7 @@ class BaseHandler(_Connection):
 
         if request_client_cert:
             def save_cert(conn_, cert, errno_, depth_, preverify_ok_):
-                self.clientcert = certutils.SSLCert(cert)
+                self.clientcert = certs.SSLCert(cert)
                 # Return true to prevent cert verification error
                 return True
             context.set_verify(SSL.VERIFY_PEER, save_cert)
diff --git a/pathod/pathoc.py b/pathod/pathoc.py
index caa9accb..39dedf05 100644
--- a/pathod/pathoc.py
+++ b/pathod/pathoc.py
@@ -13,13 +13,17 @@ import logging
 
 from netlib.tutils import treq
 from mitmproxy.utils import strutils
-from netlib import tcp, certutils, websockets, socks
+from netlib import tcp
+from mitmproxy import certs
+from netlib import websockets
+from netlib import socks
 from netlib import exceptions
 from netlib.http import http1
 from mitmproxy.types import basethread
 
-from . import log, language
-from .protocols import http2
+from pathod import log
+from pathod import language
+from pathod.protocols import http2
 
 
 logging.getLogger("hpack").setLevel(logging.WARNING)
@@ -76,7 +80,7 @@ class SSLInfo:
             }
             t = types.get(pk.type(), "Uknown")
             parts.append("\tPubkey: %s bit %s" % (pk.bits(), t))
-            s = certutils.SSLCert(i)
+            s = certs.SSLCert(i)
             if s.altnames:
                 parts.append("\tSANs: %s" % " ".join(strutils.native(n, "utf8") for n in s.altnames))
         return "\n".join(parts)
diff --git a/pathod/pathod.py b/pathod/pathod.py
index 3692ceff..5d951350 100644
--- a/pathod/pathod.py
+++ b/pathod/pathod.py
@@ -5,15 +5,17 @@ import sys
 import threading
 
 from netlib import tcp
-from netlib import certutils
+from mitmproxy import certs as mcerts
 from netlib import websockets
 from mitmproxy import version
 
 import urllib
-from netlib.exceptions import HttpException, HttpReadDisconnect, TcpTimeout, TcpDisconnect, \
-    TlsException
+from netlib import exceptions
 
-from . import language, utils, log, protocols
+from pathod import language
+from pathod import utils
+from pathod import log
+from pathod import protocols
 
 
 DEFAULT_CERT_DOMAIN = b"pathod.net"
@@ -52,7 +54,7 @@ class SSLOptions:
         self.ssl_options = ssl_options
         self.ciphers = ciphers
         self.alpn_select = alpn_select
-        self.certstore = certutils.CertStore.from_store(
+        self.certstore = mcerts.CertStore.from_store(
             os.path.expanduser(confdir),
             CERTSTORE_BASENAME
         )
@@ -128,9 +130,9 @@ class PathodHandler(tcp.BaseHandler):
         with logger.ctx() as lg:
             try:
                 req = self.protocol.read_request(self.rfile)
-            except HttpReadDisconnect:
+            except exceptions.HttpReadDisconnect:
                 return None, None
-            except HttpException as s:
+            except exceptions.HttpException as s:
                 s = str(s)
                 lg(s)
                 return None, dict(type="error", msg=s)
@@ -252,7 +254,7 @@ class PathodHandler(tcp.BaseHandler):
                     options=self.server.ssloptions.ssl_options,
                     alpn_select=self.server.ssloptions.alpn_select,
                 )
-            except TlsException as v:
+            except exceptions.TlsException as v:
                 s = str(v)
                 self.server.add_log(
                     dict(
@@ -384,7 +386,7 @@ class Pathod(tcp.TCPServer):
         try:
             h.handle()
             h.finish()
-        except TcpDisconnect:  # pragma: no cover
+        except exceptions.TcpDisconnect:  # pragma: no cover
             log.write_raw(self.logfp, "Disconnect")
             self.add_log(
                 dict(
@@ -393,7 +395,7 @@ class Pathod(tcp.TCPServer):
                 )
             )
             return
-        except TcpTimeout:
+        except exceptions.TcpTimeout:
             log.write_raw(self.logfp, "Timeout")
             self.add_log(
                 dict(
diff --git a/test/netlib/test_certutils.py b/test/mitmproxy/test_certs.py
index cf9a671b..35407fd6 100644
--- a/test/netlib/test_certutils.py
+++ b/test/mitmproxy/test_certs.py
@@ -1,9 +1,10 @@
 import os
-from netlib import certutils, tutils
+from mitmproxy import certs
+from netlib import tutils
 
 # class TestDNTree:
 #     def test_simple(self):
-#         d = certutils.DNTree()
+#         d = certs.DNTree()
 #         d.add("foo.com", "foo")
 #         d.add("bar.com", "bar")
 #         assert d.get("foo.com") == "foo"
@@ -19,12 +20,12 @@ from netlib import certutils, tutils
 #         assert d.get("foo.foo.match.org") == "match"
 #
 #     def test_wildcard(self):
-#         d = certutils.DNTree()
+#         d = certs.DNTree()
 #         d.add("foo.com", "foo")
 #         assert not d.get("*.foo.com")
 #         d.add("*.foo.com", "wild")
 #
-#         d = certutils.DNTree()
+#         d = certs.DNTree()
 #         d.add("*", "foo")
 #         assert d.get("foo.com") == "foo"
 #         assert d.get("*.foo.com") == "foo"
@@ -35,22 +36,22 @@ class TestCertStore:
 
     def test_create_explicit(self):
         with tutils.tmpdir() as d:
-            ca = certutils.CertStore.from_store(d, "test")
+            ca = certs.CertStore.from_store(d, "test")
             assert ca.get_cert(b"foo", [])
 
-            ca2 = certutils.CertStore.from_store(d, "test")
+            ca2 = certs.CertStore.from_store(d, "test")
             assert ca2.get_cert(b"foo", [])
 
             assert ca.default_ca.get_serial_number() == ca2.default_ca.get_serial_number()
 
     def test_create_no_common_name(self):
         with tutils.tmpdir() as d:
-            ca = certutils.CertStore.from_store(d, "test")
+            ca = certs.CertStore.from_store(d, "test")
             assert ca.get_cert(None, [])[0].cn is None
 
     def test_create_tmp(self):
         with tutils.tmpdir() as d:
-            ca = certutils.CertStore.from_store(d, "test")
+            ca = certs.CertStore.from_store(d, "test")
             assert ca.get_cert(b"foo.com", [])
             assert ca.get_cert(b"foo.com", [])
             assert ca.get_cert(b"*.foo.com", [])
@@ -60,7 +61,7 @@ class TestCertStore:
 
     def test_sans(self):
         with tutils.tmpdir() as d:
-            ca = certutils.CertStore.from_store(d, "test")
+            ca = certs.CertStore.from_store(d, "test")
             c1 = ca.get_cert(b"foo.com", [b"*.bar.com"])
             ca.get_cert(b"foo.bar.com", [])
             # assert c1 == c2
@@ -69,14 +70,14 @@ class TestCertStore:
 
     def test_sans_change(self):
         with tutils.tmpdir() as d:
-            ca = certutils.CertStore.from_store(d, "test")
+            ca = certs.CertStore.from_store(d, "test")
             ca.get_cert(b"foo.com", [b"*.bar.com"])
             cert, key, chain_file = ca.get_cert(b"foo.bar.com", [b"*.baz.com"])
             assert b"*.baz.com" in cert.altnames
 
     def test_expire(self):
         with tutils.tmpdir() as d:
-            ca = certutils.CertStore.from_store(d, "test")
+            ca = certs.CertStore.from_store(d, "test")
             ca.STORE_CAP = 3
             ca.get_cert(b"one.com", [])
             ca.get_cert(b"two.com", [])
@@ -101,8 +102,8 @@ class TestCertStore:
 
     def test_overrides(self):
         with tutils.tmpdir() as d:
-            ca1 = certutils.CertStore.from_store(os.path.join(d, "ca1"), "test")
-            ca2 = certutils.CertStore.from_store(os.path.join(d, "ca2"), "test")
+            ca1 = certs.CertStore.from_store(os.path.join(d, "ca1"), "test")
+            ca2 = certs.CertStore.from_store(os.path.join(d, "ca2"), "test")
             assert not ca1.default_ca.get_serial_number(
             ) == ca2.default_ca.get_serial_number()
 
@@ -121,8 +122,8 @@ class TestDummyCert:
 
     def test_with_ca(self):
         with tutils.tmpdir() as d:
-            ca = certutils.CertStore.from_store(d, "test")
-            r = certutils.dummy_cert(
+            ca = certs.CertStore.from_store(d, "test")
+            r = certs.dummy_cert(
                 ca.default_privatekey,
                 ca.default_ca,
                 b"foo.com",
@@ -130,7 +131,7 @@ class TestDummyCert:
             )
             assert r.cn == b"foo.com"
 
-            r = certutils.dummy_cert(
+            r = certs.dummy_cert(
                 ca.default_privatekey,
                 ca.default_ca,
                 None,
@@ -144,13 +145,13 @@ class TestSSLCert:
     def test_simple(self):
         with open(tutils.test_data.path("data/text_cert"), "rb") as f:
             d = f.read()
-        c1 = certutils.SSLCert.from_pem(d)
+        c1 = certs.SSLCert.from_pem(d)
         assert c1.cn == b"google.com"
         assert len(c1.altnames) == 436
 
         with open(tutils.test_data.path("data/text_cert_2"), "rb") as f:
             d = f.read()
-        c2 = certutils.SSLCert.from_pem(d)
+        c2 = certs.SSLCert.from_pem(d)
         assert c2.cn == b"www.inode.co.nz"
         assert len(c2.altnames) == 2
         assert c2.digest("sha1")
@@ -169,12 +170,12 @@ class TestSSLCert:
     def test_err_broken_sans(self):
         with open(tutils.test_data.path("data/text_cert_weird1"), "rb") as f:
             d = f.read()
-        c = certutils.SSLCert.from_pem(d)
+        c = certs.SSLCert.from_pem(d)
         # This breaks unless we ignore a decoding error.
         assert c.altnames is not None
 
     def test_der(self):
         with open(tutils.test_data.path("data/dercert"), "rb") as f:
             d = f.read()
-        s = certutils.SSLCert.from_der(d)
+        s = certs.SSLCert.from_der(d)
         assert s.cn
diff --git a/test/mitmproxy/test_server.py b/test/mitmproxy/test_server.py
index 93a82954..cadc67a8 100644
--- a/test/mitmproxy/test_server.py
+++ b/test/mitmproxy/test_server.py
@@ -9,13 +9,16 @@ from mitmproxy.addons import script
 from mitmproxy import http
 from mitmproxy.proxy.config import HostMatcher, parse_server_spec
 import netlib.http
-from netlib import tcp, socks
-from netlib.certutils import SSLCert
-from netlib.exceptions import HttpReadDisconnect, HttpException
-from netlib.http import authentication, http1
+from netlib import tcp
+from netlib import socks
+from mitmproxy import certs
+from netlib import exceptions
+from netlib.http import authentication
+from netlib.http import http1
 from netlib.tcp import Address
 from netlib.tutils import raises
-from pathod import pathoc, pathod
+from pathod import pathoc
+from pathod import pathod
 
 from . import tutils, tservers
 
@@ -144,9 +147,9 @@ class TcpMixin:
 
         # Test that we get the original SSL cert
         if self.ssl:
-            i_cert = SSLCert(i.sslinfo.certchain[0])
-            i2_cert = SSLCert(i2.sslinfo.certchain[0])
-            n_cert = SSLCert(n.sslinfo.certchain[0])
+            i_cert = certs.SSLCert(i.sslinfo.certchain[0])
+            i2_cert = certs.SSLCert(i2.sslinfo.certchain[0])
+            n_cert = certs.SSLCert(n.sslinfo.certchain[0])
 
             assert i_cert == i2_cert
             assert i_cert != n_cert
@@ -156,7 +159,7 @@ class TcpMixin:
         # mitmproxy responds with bad gateway
         assert self.pathod(spec).status_code == 502
         self._ignore_on()
-        with raises(HttpException):
+        with raises(exceptions.HttpException):
             self.pathod(spec)  # pathoc tries to parse answer as HTTP
 
         self._ignore_off()
@@ -190,9 +193,9 @@ class TcpMixin:
 
         # Test that we get the original SSL cert
         if self.ssl:
-            i_cert = SSLCert(i.sslinfo.certchain[0])
-            i2_cert = SSLCert(i2.sslinfo.certchain[0])
-            n_cert = SSLCert(n.sslinfo.certchain[0])
+            i_cert = certs.SSLCert(i.sslinfo.certchain[0])
+            i2_cert = certs.SSLCert(i2.sslinfo.certchain[0])
+            n_cert = certs.SSLCert(n.sslinfo.certchain[0])
 
             assert i_cert == i2_cert == n_cert
 
@@ -830,7 +833,7 @@ class TestKillRequest(tservers.HTTPProxyTest):
     masterclass = MasterKillRequest
 
     def test_kill(self):
-        with raises(HttpReadDisconnect):
+        with raises(exceptions.HttpReadDisconnect):
             self.pathod("200")
         # Nothing should have hit the server
         assert not self.server.last_log()
@@ -847,7 +850,7 @@ class TestKillResponse(tservers.HTTPProxyTest):
     masterclass = MasterKillResponse
 
     def test_kill(self):
-        with raises(HttpReadDisconnect):
+        with raises(exceptions.HttpReadDisconnect):
             self.pathod("200")
         # The server should have seen a request
         assert self.server.last_log()
@@ -1050,7 +1053,7 @@ class AddUpstreamCertsToClientChainMixin:
     def test_add_upstream_certs_to_client_chain(self):
         with open(self.servercert, "rb") as f:
             d = f.read()
-        upstreamCert = SSLCert.from_pem(d)
+        upstreamCert = certs.SSLCert.from_pem(d)
         p = self.pathoc()
         with p.connect():
             upstream_cert_found_in_client_chain = False
diff --git a/test/netlib/test_tcp.py b/test/netlib/test_tcp.py
index 797a5a04..2c1b92dc 100644
--- a/test/netlib/test_tcp.py
+++ b/test/netlib/test_tcp.py
@@ -9,9 +9,10 @@ import mock
 
 from OpenSSL import SSL
 
-from netlib import tcp, certutils, tutils
-from netlib.exceptions import InvalidCertificateException, TcpReadIncomplete, TlsException, \
-    TcpTimeout, TcpDisconnect, TcpException, NetlibException
+from mitmproxy import certs
+from netlib import tcp
+from netlib import tutils
+from netlib import exceptions
 
 from . import tservers
 
@@ -108,7 +109,7 @@ class TestServerBind(tservers.ServerTestBase):
                 with c.connect():
                     assert c.rfile.readline() == str(("127.0.0.1", random_port)).encode()
                     return
-            except TcpException:  # port probably already in use
+            except exceptions.TcpException:  # port probably already in use
                 pass
 
 
@@ -155,7 +156,7 @@ class TestFinishFail(tservers.ServerTestBase):
         c = tcp.TCPClient(("127.0.0.1", self.port))
         with c.connect():
             c.wfile.write(b"foo\n")
-            c.wfile.flush = mock.Mock(side_effect=TcpDisconnect)
+            c.wfile.flush = mock.Mock(side_effect=exceptions.TcpDisconnect)
             c.finish()
 
 
@@ -195,7 +196,7 @@ class TestSSLv3Only(tservers.ServerTestBase):
     def test_failure(self):
         c = tcp.TCPClient(("127.0.0.1", self.port))
         with c.connect():
-            tutils.raises(TlsException, c.convert_to_ssl, sni="foo.com")
+            tutils.raises(exceptions.TlsException, c.convert_to_ssl, sni="foo.com")
 
 
 class TestSSLUpstreamCertVerificationWBadServerCert(tservers.ServerTestBase):
@@ -236,7 +237,7 @@ class TestSSLUpstreamCertVerificationWBadServerCert(tservers.ServerTestBase):
     def test_mode_strict_should_fail(self):
         c = tcp.TCPClient(("127.0.0.1", self.port))
         with c.connect():
-            with tutils.raises(InvalidCertificateException):
+            with tutils.raises(exceptions.InvalidCertificateException):
                 c.convert_to_ssl(
                     sni="example.mitmproxy.org",
                     verify_options=SSL.VERIFY_PEER,
@@ -261,7 +262,7 @@ class TestSSLUpstreamCertVerificationWBadHostname(tservers.ServerTestBase):
     def test_should_fail_without_sni(self):
         c = tcp.TCPClient(("127.0.0.1", self.port))
         with c.connect():
-            with tutils.raises(TlsException):
+            with tutils.raises(exceptions.TlsException):
                 c.convert_to_ssl(
                     verify_options=SSL.VERIFY_PEER,
                     ca_pemfile=tutils.test_data.path("data/verificationcerts/trusted-root.crt")
@@ -270,7 +271,7 @@ class TestSSLUpstreamCertVerificationWBadHostname(tservers.ServerTestBase):
     def test_should_fail(self):
         c = tcp.TCPClient(("127.0.0.1", self.port))
         with c.connect():
-            with tutils.raises(InvalidCertificateException):
+            with tutils.raises(exceptions.InvalidCertificateException):
                 c.convert_to_ssl(
                     sni="mitmproxy.org",
                     verify_options=SSL.VERIFY_PEER,
@@ -348,7 +349,7 @@ class TestSSLClientCert(tservers.ServerTestBase):
         c = tcp.TCPClient(("127.0.0.1", self.port))
         with c.connect():
             tutils.raises(
-                TlsException,
+                exceptions.TlsException,
                 c.convert_to_ssl,
                 cert=tutils.test_data.path("data/clientcert/make")
             )
@@ -454,7 +455,7 @@ class TestSSLDisconnect(tservers.ServerTestBase):
             # Excercise SSL.ZeroReturnError
             c.rfile.read(10)
             c.close()
-            tutils.raises(TcpDisconnect, c.wfile.write, b"foo")
+            tutils.raises(exceptions.TcpDisconnect, c.wfile.write, b"foo")
             tutils.raises(queue.Empty, self.q.get_nowait)
 
 
@@ -469,7 +470,7 @@ class TestSSLHardDisconnect(tservers.ServerTestBase):
             # Exercise SSL.SysCallError
             c.rfile.read(10)
             c.close()
-            tutils.raises(TcpDisconnect, c.wfile.write, b"foo")
+            tutils.raises(exceptions.TcpDisconnect, c.wfile.write, b"foo")
 
 
 class TestDisconnect(tservers.ServerTestBase):
@@ -492,7 +493,7 @@ class TestServerTimeOut(tservers.ServerTestBase):
             self.settimeout(0.01)
             try:
                 self.rfile.read(10)
-            except TcpTimeout:
+            except exceptions.TcpTimeout:
                 self.timeout = True
 
     def test_timeout(self):
@@ -510,7 +511,7 @@ class TestTimeOut(tservers.ServerTestBase):
         with c.connect():
             c.settimeout(0.1)
             assert c.gettimeout() == 0.1
-            tutils.raises(TcpTimeout, c.rfile.read, 10)
+            tutils.raises(exceptions.TcpTimeout, c.rfile.read, 10)
 
 
 class TestALPNClient(tservers.ServerTestBase):
@@ -562,13 +563,13 @@ class TestSSLTimeOut(tservers.ServerTestBase):
         with c.connect():
             c.convert_to_ssl()
             c.settimeout(0.1)
-            tutils.raises(TcpTimeout, c.rfile.read, 10)
+            tutils.raises(exceptions.TcpTimeout, c.rfile.read, 10)
 
 
 class TestDHParams(tservers.ServerTestBase):
     handler = HangHandler
     ssl = dict(
-        dhparams=certutils.CertStore.load_dhparam(
+        dhparams=certs.CertStore.load_dhparam(
             tutils.test_data.path("data/dhparam.pem"),
         ),
         cipher_list="DHE-RSA-AES256-SHA"
@@ -584,7 +585,7 @@ class TestDHParams(tservers.ServerTestBase):
     def test_create_dhparams(self):
         with tutils.tmpdir() as d:
             filename = os.path.join(d, "dhparam.pem")
-            certutils.CertStore.load_dhparam(filename)
+            certs.CertStore.load_dhparam(filename)
             assert os.path.exists(filename)
 
 
@@ -592,7 +593,7 @@ class TestTCPClient:
 
     def test_conerr(self):
         c = tcp.TCPClient(("127.0.0.1", 0))
-        tutils.raises(TcpException, c.connect)
+        tutils.raises(exceptions.TcpException, c.connect)
 
 
 class TestFileLike:
@@ -661,7 +662,7 @@ class TestFileLike:
         o = mock.MagicMock()
         o.flush = mock.MagicMock(side_effect=socket.error)
         s.o = o
-        tutils.raises(TcpDisconnect, s.flush)
+        tutils.raises(exceptions.TcpDisconnect, s.flush)
 
     def test_reader_read_error(self):
         s = BytesIO(b"foobar\nfoobar")
@@ -669,7 +670,7 @@ class TestFileLike:
         o = mock.MagicMock()
         o.read = mock.MagicMock(side_effect=socket.error)
         s.o = o
-        tutils.raises(TcpDisconnect, s.read, 10)
+        tutils.raises(exceptions.TcpDisconnect, s.read, 10)
 
     def test_reset_timestamps(self):
         s = BytesIO(b"foobar\nfoobar")
@@ -700,24 +701,24 @@ class TestFileLike:
         s = mock.MagicMock()
         s.read = mock.MagicMock(side_effect=SSL.Error())
         s = tcp.Reader(s)
-        tutils.raises(TlsException, s.read, 1)
+        tutils.raises(exceptions.TlsException, s.read, 1)
 
     def test_read_syscall_ssl_error(self):
         s = mock.MagicMock()
         s.read = mock.MagicMock(side_effect=SSL.SysCallError())
         s = tcp.Reader(s)
-        tutils.raises(TlsException, s.read, 1)
+        tutils.raises(exceptions.TlsException, s.read, 1)
 
     def test_reader_readline_disconnect(self):
         o = mock.MagicMock()
         o.read = mock.MagicMock(side_effect=socket.error)
         s = tcp.Reader(o)
-        tutils.raises(TcpDisconnect, s.readline, 10)
+        tutils.raises(exceptions.TcpDisconnect, s.readline, 10)
 
     def test_reader_incomplete_error(self):
         s = BytesIO(b"foobar")
         s = tcp.Reader(s)
-        tutils.raises(TcpReadIncomplete, s.safe_read, 10)
+        tutils.raises(exceptions.TcpReadIncomplete, s.safe_read, 10)
 
 
 class TestPeek(tservers.ServerTestBase):
@@ -738,11 +739,11 @@ class TestPeek(tservers.ServerTestBase):
             assert c.rfile.readline() == testval
 
             c.close()
-            with tutils.raises(NetlibException):
+            with tutils.raises(exceptions.NetlibException):
                 if c.rfile.peek(1) == b"":
                     # Workaround for Python 2 on Unix:
                     # Peeking a closed connection does not raise an exception here.
-                    raise NetlibException()
+                    raise exceptions.NetlibException()
 
 
 class TestPeekSSL(TestPeek):