|
 |
c5477d |
From 8fd9cbf91bb7190450531b25a3806c5b7f69744e Mon Sep 17 00:00:00 2001
|
|
|
c5477d |
From: Vratislav Podzimek <vpodzime@redhat.com>
|
|
|
c5477d |
Date: Tue, 17 May 2016 12:13:40 +0200
|
|
|
c5477d |
Subject: [PATCH 03/13] Do not verify SSL if inst.noverifyssl was given
|
|
|
c5477d |
|
|
|
c5477d |
inst.noverifyssl is a boot/cmdline option which should take precedence over
|
|
|
c5477d |
everything specified in the kickstart or UI.
|
|
|
c5477d |
|
|
|
c5477d |
Resolves: rhbz#1263257
|
|
|
c5477d |
---
|
|
|
c5477d |
org_fedora_oscap/data_fetch.py | 13 +++++++++++++
|
|
|
c5477d |
1 file changed, 13 insertions(+)
|
|
|
c5477d |
|
|
|
c5477d |
diff --git a/org_fedora_oscap/data_fetch.py b/org_fedora_oscap/data_fetch.py
|
|
|
c5477d |
index 21edd0f..7336025 100644
|
|
|
c5477d |
--- a/org_fedora_oscap/data_fetch.py
|
|
|
c5477d |
+++ b/org_fedora_oscap/data_fetch.py
|
|
|
c5477d |
@@ -9,8 +9,14 @@ import os
|
|
|
c5477d |
import os.path
|
|
|
c5477d |
import pycurl
|
|
|
c5477d |
|
|
|
c5477d |
+from pyanaconda.flags import flags as ana_flags
|
|
|
c5477d |
+
|
|
|
c5477d |
from org_fedora_oscap import utils
|
|
|
c5477d |
|
|
|
c5477d |
+import logging
|
|
|
c5477d |
+log = logging.getLogger("anaconda")
|
|
|
c5477d |
+
|
|
|
c5477d |
+
|
|
|
c5477d |
# everything else should be private
|
|
|
c5477d |
__all__ = ["fetch_data", "can_fetch_from"]
|
|
|
c5477d |
|
|
|
c5477d |
@@ -150,8 +156,15 @@ def _fetch_http_ftp_data(url, out_file, ca_certs=None):
|
|
|
c5477d |
if ca_certs and protocol == "https":
|
|
|
c5477d |
# the strictest verification
|
|
|
c5477d |
curl.setopt(pycurl.SSL_VERIFYHOST, 2)
|
|
|
c5477d |
+ curl.setopt(pycurl.SSL_VERIFYPEER, 1)
|
|
|
c5477d |
curl.setopt(pycurl.CAINFO, ca_certs)
|
|
|
c5477d |
|
|
|
c5477d |
+ # may be turned off by flags (specified on command line, take precedence)
|
|
|
c5477d |
+ if ana_flags.noverifyssl:
|
|
|
c5477d |
+ log.warning("Disabling SSL verification due to the noverifyssl flag")
|
|
|
c5477d |
+ curl.setopt(pycurl.SSL_VERIFYHOST, 0)
|
|
|
c5477d |
+ curl.setopt(pycurl.SSL_VERIFYPEER, 0)
|
|
|
c5477d |
+
|
|
|
c5477d |
try:
|
|
|
c5477d |
with open(out_file, "w") as fobj:
|
|
|
c5477d |
curl.setopt(pycurl.WRITEDATA, fobj)
|
|
|
c5477d |
--
|
|
|
c5477d |
2.5.5
|
|
|
c5477d |
|