From e51df7a73141c4d378d12e4a3ade12776e48ebff Mon Sep 17 00:00:00 2001

From: Marek 'marx' Grac <mgrac@redhat.com>

Date: Wed, 5 Mar 2014 12:49:17 +0100

Subject: [PATCH] fencing: Add new options --ssl-secure and --ssl-insecure

These new options extends current --ssl (same as --ssl-secure). Until now certificate of the fence device

was not validated what can possibly lead to attack on infrastructe. With this patch, user can decide

if certificate should (--ssl-secure) or should not (--ssl-insecure) be verified.

---

 fence/agents/cisco_ucs/fence_cisco_ucs.py     |   10 ++++++-

 fence/agents/lib/fencing.py.py                |   29 ++++++++++++++++++---

 fence/agents/rhevm/fence_rhevm.py             |   11 ++++++--

 4 files changed, 70 insertions(+), 14 deletions(-)

diff --git a/fence/agents/cisco_ucs/fence_cisco_ucs.py b/fence/agents/cisco_ucs/fence_cisco_ucs.py

index 71782cb..1e9d983 100644

--- a/fence/agents/cisco_ucs/fence_cisco_ucs.py

+++ b/fence/agents/cisco_ucs/fence_cisco_ucs.py

@@ -85,8 +85,14 @@ def send_command(opt, command, timeout):

 	c.setopt(pycurl.POSTFIELDS, command)

 	c.setopt(pycurl.WRITEFUNCTION, b.write)

 	c.setopt(pycurl.TIMEOUT, timeout)

-	c.setopt(pycurl.SSL_VERIFYPEER, 0)

-	c.setopt(pycurl.SSL_VERIFYHOST, 0)

+	if opt.has_key("--ssl") or opt.has_key("--ssl-secure"):

+		c.setopt(pycurl.SSL_VERIFYPEER, 1)

+		c.setopt(pycurl.SSL_VERIFYHOST, 2)

+

+	if opt.has_key("--ssl-insecure"):

+		c.setopt(pycurl.SSL_VERIFYPEER, 0)

+		c.setopt(pycurl.SSL_VERIFYHOST, 0)

+		

 	c.perform()

 	result = b.getvalue()

diff --git a/fence/agents/lib/fencing.py.py b/fence/agents/lib/fencing.py.py

index 2006f0d..e40cbb2 100644

--- a/fence/agents/lib/fencing.py.py

+++ b/fence/agents/lib/fencing.py.py

@@ -170,6 +170,20 @@ all_opt = {

 		"required" : "0",

 		"shortdesc" : "SSL connection",

 		"order" : 1 },

+	"ssl_insecure" : {

+		"getopt" : "9",

+		"longopt" : "ssl-insecure",

+		"help" : "--ssl-insecure                 Use ssl connection without verifying certificate",

+		"required" : "0",

+		"shortdesc" : "SSL connection without verifying fence device's certificate",

+		"order" : 1 },

+	"ssl_secure" : {

+		"getopt" : "9",

+		"longopt" : "ssl-secure",

+		"help" : "--ssl-secure                   Use ssl connection with verifying certificate",

+		"required" : "0",

+		"shortdesc" : "SSL connection with verifying fence device's certificate",

+		"order" : 1 },

 	"notls" : {

 		"getopt" : "t",

 		"longopt" : "notls",

@@ -370,6 +384,7 @@ DEPENDENCY_OPT = {

 		"secure" : [ "identity_file", "ssh_options" ],

 		"ipaddr" : [ "ipport", "inet4_only", "inet6_only" ],

 		"port" : [ "separator" ],

+		"ssl" : [ "ssl_secure", "ssl_insecure" ],

 		"community" : [ "snmp_auth_prot", "snmp_sec_level", "snmp_priv_prot", \

 			"snmp_priv_passwd", "snmp_priv_passwd_script" ]

 	}

@@ -645,7 +660,7 @@ def check_input(device_opt, opt):

 		elif options.has_key("--ssh"):

 			all_opt["ipport"]["default"] = 22

 			all_opt["ipport"]["help"] = "-u, --ipport=[port]            TCP/UDP port to use (default 22)"

-		elif options.has_key("--ssl"):

+		elif options.has_key("--ssl") or options.has_key("--ssl-secure") or options.has_key("--ssl-insecure"):

 			all_opt["ipport"]["default"] = 443

 			all_opt["ipport"]["help"] = "-u, --ipport=[port]            TCP/UDP port to use (default 443)"

 		elif device_opt.count("web"):

@@ -738,7 +753,7 @@ def check_input(device_opt, opt):

 	if options.has_key("--ipport") == False:

 		if options.has_key("--ssh"):

 			options["--ipport"] = 22

-		elif options.has_key("--ssl"):

+		elif options.has_key("--ssl") or options.has_key("--ssl-secure") or options.has_key("--ssl-insecure"):

 			options["--ipport"] = 443

 		elif device_opt.count("web"):

 			options["--ipport"] = 80

@@ -968,11 +983,17 @@ def fence_login(options, re_login_string = "(login\s*: )|(Login Name:  )|(userna

 		re_pass  = re.compile("(password)|(pass phrase)", re.IGNORECASE)

 		if options.has_key("--ssl"):

-			gnutls_opts=""

+			gnutls_opts = ""

+			ssl_opts = ""

+

 			if options.has_key("--notls"):

 				gnutls_opts = "--priority \"NORMAL:-VERS-TLS1.2:-VERS-TLS1.1:-VERS-TLS1.0:+VERS-SSL3.0\""

-			command = '%s %s --insecure --crlf -p %s %s' % (SSL_PATH, gnutls_opts, options["--ipport"], options["--ip"])

+			# --ssl is same as the --ssl-secure

+			if options.has_key("--ssl-insecure"):

+				ssl_opts = "--insecure"

+

+			command = '%s %s %s --crlf -p %s %s' % (SSL_PATH, gnutls_opts, ssl_opts, options["--ipport"], options["--ip"])

 			try:

 				conn = fspawn(options, command)

 			except pexpect.ExceptionPexpect, ex:

diff --git a/fence/agents/rhevm/fence_rhevm.py b/fence/agents/rhevm/fence_rhevm.py

index ff3d19f..6098071 100644

--- a/fence/agents/rhevm/fence_rhevm.py

+++ b/fence/agents/rhevm/fence_rhevm.py

@@ -84,9 +84,14 @@ def send_command(opt, command, method = "GET"):

 	c.setopt(pycurl.HTTPAUTH, pycurl.HTTPAUTH_BASIC)

 	c.setopt(pycurl.USERPWD, opt["--username"] + ":" + opt["--password"])

 	c.setopt(pycurl.TIMEOUT, int(opt["--shell-timeout"]))

-	c.setopt(pycurl.SSL_VERIFYPEER, 0)

-	c.setopt(pycurl.SSL_VERIFYHOST, 0)

-

+	if opt.has_key("--ssl") or opt.has_key("--ssl-secure"):

+		c.setopt(pycurl.SSL_VERIFYPEER, 1)

+		c.setopt(pycurl.SSL_VERIFYHOST, 2)

+

+	if opt.has_key("--ssl-insecure"):

+		c.setopt(pycurl.SSL_VERIFYPEER, 0)

+		c.setopt(pycurl.SSL_VERIFYHOST, 0)

+                                                                               

 	if (method == "POST"):

 		c.setopt(pycurl.POSTFIELDS, "<action />")