Merge lp:~chad.smith/landscape-client/autoregistration-cacert-ignore-invalid-cert into lp:~landscape/landscape-client/trunk

[Chad Smith]

dpb found issues during integration testing that client wget & prcurl redirects http://landscape.local/get-ca-cert -> https://landscape.local/get-ca-cert due to CA cert fail.

Since we can't put the cart before the horse:

   This branch adds pycurl.setopt(SSL_VERIFYPEER, False) during initial fetch attempt of cusotom CA-cert.
   This insecure fetch option is only used during auto-discovery/auto-registration to avoid https redirects or inital cert errors.

 Added a test to ensure the proper curl.setopt is called if fetch(insecure=True)

[Alberto Donato (ack)]

Nice fix! +1

review: Approve

[Mike Milner (milner)]

Looks great +1!

[1]
20 def fetch(url, post=False, data="", headers={}, cainfo=None, curl=None,
21 - connect_timeout=30, total_timeout=600):
22 + connect_timeout=30, total_timeout=600, insecure=False):

Please add "insecure" to the docstring params.

review: Approve

[lp:~chad.smith/landscape-client/autoregistration-cacert-ignore-invalid-cert]

480. By Chad Smith on 2012-03-07

add insecure parameter info to the docstring

481. By Chad Smith on 2012-03-07

typo fix

=== modified file 'landscape/configuration.py'
--- landscape/configuration.py	2012-02-28 00:12:17 +0000
+++ landscape/configuration.py	2012-03-07 15:37:19 +0000
@@ -501,7 +501,7 @@
     encoded_cert = ""
     ca_url = "http://%s/get-ca-cert" % hostname
     try:
-        content = fetch(ca_url)
+        content = fetch(ca_url, insecure=True)
     except HTTPCodeError, error:
         on_error("Unable to fetch CA certificate from discovered server %s: "
                  "Server does not support client auto-registation." % hostname)

=== modified file 'landscape/lib/fetch.py'
--- landscape/lib/fetch.py	2011-01-20 19:25:15 +0000
+++ landscape/lib/fetch.py	2012-03-07 15:37:19 +0000
@@ -44,7 +44,7 @@
 
 
 def fetch(url, post=False, data="", headers={}, cainfo=None, curl=None,
-          connect_timeout=30, total_timeout=600):
+          connect_timeout=30, total_timeout=600, insecure=False):
     """Retrieve a URL and return the content.
 
     @param url: The url to be fetched.
@@ -53,6 +53,9 @@
     @param headers: Dictionary of header => value entries to be used
                     on the request.
     @param cainfo: Path to the file with CA certificates.
+    @param insecure: If true, perform curl using insecure option which will
+                     not attempt to verify authenticity of the peer's
+                     certificate. (Used during autodiscovery)
     """
     import pycurl
     output = StringIO(data)
@@ -75,6 +78,9 @@
         curl.setopt(pycurl.HTTPHEADER,
                     ["%s: %s" % pair for pair in sorted(headers.iteritems())])
 
+    if insecure:
+        curl.setopt(pycurl.SSL_VERIFYPEER, False)
+
     curl.setopt(pycurl.URL, str(url))
     curl.setopt(pycurl.FOLLOWLOCATION, True)
     curl.setopt(pycurl.MAXREDIRS, 5)

=== modified file 'landscape/lib/tests/test_fetch.py'
--- landscape/lib/tests/test_fetch.py	2011-12-16 14:44:24 +0000
+++ landscape/lib/tests/test_fetch.py	2012-03-07 15:37:19 +0000
@@ -231,6 +231,24 @@
         else:
             self.fail("PyCurlError not raised")
 
+    def test_pycurl_insecure(self):
+        curl = CurlStub("result")
+        result = fetch("http://example.com/get-ca-cert", curl=curl,
+                       insecure=True)
+        self.assertEqual(result, "result")
+        self.assertEqual(curl.options,
+                         {pycurl.URL: "http://example.com/get-ca-cert",
+                          pycurl.FOLLOWLOCATION: True,
+                          pycurl.MAXREDIRS: 5,
+                          pycurl.CONNECTTIMEOUT: 30,
+                          pycurl.LOW_SPEED_LIMIT: 1,
+                          pycurl.LOW_SPEED_TIME: 600,
+                          pycurl.NOSIGNAL: 1,
+                          pycurl.WRITEFUNCTION: Any(),
+                          pycurl.SSL_VERIFYPEER: False,
+                          pycurl.DNS_CACHE_TIMEOUT: 0,
+                          pycurl.ENCODING: "gzip,deflate"})
+
     def test_pycurl_error_str(self):
         self.assertEqual(str(PyCurlError(60, "pycurl error")),
                          "Error 60: pycurl error")

=== modified file 'landscape/tests/test_configuration.py'
--- landscape/tests/test_configuration.py	2012-03-05 14:11:42 +0000
+++ landscape/tests/test_configuration.py	2012-03-07 15:37:19 +0000
@@ -1991,7 +1991,7 @@
         """
         base64_cert = "base64:  MTIzNDU2Nzg5MA=="  # encoded woo hoo
         fetch_mock = self.mocker.replace("landscape.lib.fetch.fetch")
-        fetch_mock("http://fakehost/get-ca-cert")
+        fetch_mock("http://fakehost/get-ca-cert", insecure=True)
         self.mocker.result(
             "{\"custom_ca_cert\": \"%s\"}" % base64_cert)
         self.mocker.replay()
@@ -2012,7 +2012,7 @@
         if it exists, otherwise it should return an empty string.""
         """
         fetch_mock = self.mocker.replace("landscape.lib.fetch.fetch")
-        fetch_mock("http://fakehost/get-ca-cert")
+        fetch_mock("http://fakehost/get-ca-cert", insecure=True)
         self.mocker.result("{}")
 
         print_text_mock = self.mocker.replace(print_text)
@@ -2027,7 +2027,7 @@
 
     def test_fetch_base64_ssl_with_http_code_fetch_error(self):
         fetch_mock = self.mocker.replace("landscape.lib.fetch.fetch")
-        fetch_mock("http://fakehost/get-ca-cert")
+        fetch_mock("http://fakehost/get-ca-cert", insecure=True)
         self.mocker.throw(HTTPCodeError(404, ""))
         print_text_mock = self.mocker.replace(print_text)
         print_text_mock(
@@ -2047,7 +2047,7 @@
 
     def test_fetch_base64_ssl_with_pycurl_error(self):
         fetch_mock = self.mocker.replace("landscape.lib.fetch.fetch")
-        fetch_mock("http://fakehost/get-ca-cert")
+        fetch_mock("http://fakehost/get-ca-cert", insecure=True)
         self.mocker.throw(PyCurlError(60, "pycurl message"))
         print_text_mock = self.mocker.replace(print_text)
         print_text_mock(