From c40a11439c738b67471da01ebfbc3d3d66db6311 Mon Sep 17 00:00:00 2001
From: Marek 'marx' Grac <mgrac@redhat.com>
Date: Fri, 7 Mar 2014 15:13:44 +0100
Subject: [PATCH] fence_vmware_soap: Add new options --ssl-secure and
--ssl-insecure
These new options extends current --ssl (same as --ssl-secure). Until now certificate of the fence device
was not validated what can possibly lead to attack on infrastructe. With this patch, user can decide
if certificate should (--ssl-secure) or should not (--ssl-insecure) be verified.
python-suds do not validates SSL certificates at all. It is required to change underlying library to
one that can support that what results in new dependency on python-requests.
---
fence/agents/vmware_soap/fence_vmware_soap.py | 35 +++++++++++++++++++++---
1 files changed, 30 insertions(+), 5 deletions(-)
diff --git a/fence/agents/vmware_soap/fence_vmware_soap.py b/fence/agents/vmware_soap/fence_vmware_soap.py
index bbac1c5..a578662 100644
--- a/fence/agents/vmware_soap/fence_vmware_soap.py
+++ b/fence/agents/vmware_soap/fence_vmware_soap.py
@@ -2,11 +2,13 @@
import sys, exceptions, time
import shutil, tempfile, suds
-import logging
+import logging, requests
sys.path.append("@FENCEAGENTSLIBDIR@")
from suds.client import Client
from suds.sudsobject import Property
+from suds.transport.http import HttpAuthenticated
+from suds.transport import Reply, TransportError
from fencing import *
#BEGIN_VERSION_GENERATION
@@ -15,13 +17,32 @@ REDHAT_COPYRIGHT=""
BUILD_DATE="April, 2011"
#END_VERSION_GENERATION
+class RequestsTransport(HttpAuthenticated):
+ def __init__(self, **kwargs):
+ self.cert = kwargs.pop('cert', None)
+ self.verify = kwargs.pop('verify', True)
+ self.session = requests.Session()
+ # super won't work because not using new style class
+ HttpAuthenticated.__init__(self, **kwargs)
+
+ def send(self, request):
+ self.addcredentials(request)
+ resp = self.session.post(request.url, data = request.message, headers = request.headers, cert = self.cert, verify = self.verify)
+ result = Reply(resp.status_code, resp.headers, resp.content)
+ return result
+
def soap_login(options):
if options["--action"] in ["off", "reboot"]:
time.sleep(int(options["--delay"]))
- if options.has_key("--ssl"):
+ if options.has_key("--ssl") or options.has_key("--ssl-secure") or options.has_key("--ssl-insecure"):
+ if options.has_key("--ssl-insecure"):
+ verify = False
+ else:
+ verify = True
url = "https://"
else:
+ verify = False
url = "http://"
url += options["--ip"] + ":" + str(options["--ipport"]) + "/sdk"
@@ -29,10 +50,10 @@ def soap_login(options):
tmp_dir = tempfile.mkdtemp()
tempfile.tempdir = tmp_dir
atexit.register(remove_tmp_dir, tmp_dir)
-
+
try:
- conn = Client(url + "/vimService.wsdl")
- conn.set_options(location = url)
+ headers = {"Content-Type" : "text/xml;charset=UTF-8", "SOAPAction" : ""}
+ conn = Client(url + "/vimService.wsdl", location = url, transport = RequestsTransport(verify = verify), headers = headers)
mo_ServiceInstance = Property('ServiceInstance')
mo_ServiceInstance._type = 'ServiceInstance'
@@ -41,6 +62,8 @@ def soap_login(options):
mo_SessionManager._type = 'SessionManager'
SessionManager = conn.service.Login(mo_SessionManager, options["--username"], options["--password"])
+ except requests.exceptions.SSLError, ex:
+ fail_usage("Server side certificate verification failed")
except Exception, ex:
fail(EC_LOGIN_DENIED)
@@ -202,6 +225,8 @@ Alternatively you can always use UUID to access virtual machine."
logging.basicConfig(level=logging.INFO)
logging.getLogger('suds.client').setLevel(logging.CRITICAL)
+ logging.getLogger("requests").setLevel(logging.CRITICAL)
+ logging.getLogger("urllib3").setLevel(logging.CRITICAL)
##
## Operate the fencing device
--
1.7.7.6