fence-agents: master - Allow ssl connections to fallback to SSL3.0 negotiation

Fabio M. Di Nitto fabbione at fedoraproject.org
Thu Feb 20 11:06:10 UTC 2014


Gitweb:        http://git.fedorahosted.org/git/?p=fence-agents.git;a=commitdiff;h=6bb1f3363e3856c1d95e21b25d380ca651eeeb1b
Commit:        6bb1f3363e3856c1d95e21b25d380ca651eeeb1b
Parent:        ff12e705744a4f5a525c7a64cd22ca358a43daaa
Author:        Fabio M. Di Nitto <fdinitto at redhat.com>
AuthorDate:    Thu Feb 20 12:03:08 2014 +0100
Committer:     Fabio M. Di Nitto <fdinitto at redhat.com>
CommitterDate: Thu Feb 20 12:03:08 2014 +0100

Allow ssl connections to fallback to SSL3.0 negotiation

The preferred/default method is TLS1.x, but some old devices
just can't deal with it.

Add support for "notls" option that will force negotiation
to use SSL3.0. Wherever possible you are adviced to upgrade
your device firwmare.

Signed-off-by: Fabio M. Di Nitto <fdinitto at redhat.com>
---
 fence/agents/cisco_ucs/fence_cisco_ucs.py     |    2 +-
 fence/agents/ilo/fence_ilo.py                 |    2 +-
 fence/agents/lib/fencing.py.py                |   14 +++++++++++++-
 fence/agents/rhevm/fence_rhevm.py             |    2 +-
 fence/agents/vmware_soap/fence_vmware_soap.py |    2 +-
 5 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/fence/agents/cisco_ucs/fence_cisco_ucs.py b/fence/agents/cisco_ucs/fence_cisco_ucs.py
index f70a835..71782cb 100644
--- a/fence/agents/cisco_ucs/fence_cisco_ucs.py
+++ b/fence/agents/cisco_ucs/fence_cisco_ucs.py
@@ -107,7 +107,7 @@ def define_new_opts():
 		"order" : 1 }
 
 def main():
-	device_opt = [ "ipaddr", "login", "passwd", "ssl", "port", "web", "suborg" ]
+	device_opt = [ "ipaddr", "login", "passwd", "ssl", "notls", "port", "web", "suborg" ]
 
 	atexit.register(atexit_handler)
 
diff --git a/fence/agents/ilo/fence_ilo.py b/fence/agents/ilo/fence_ilo.py
index ab6e342..444f94b 100644
--- a/fence/agents/ilo/fence_ilo.py
+++ b/fence/agents/ilo/fence_ilo.py
@@ -63,7 +63,7 @@ def define_new_opts():
 		"order" : 1 }
 
 def main():
-	device_opt = [ "ipaddr", "login", "passwd", "ssl", "ribcl" ]
+	device_opt = [ "ipaddr", "login", "passwd", "ssl", "notls", "ribcl" ]
 
 	atexit.register(atexit_handler)
 
diff --git a/fence/agents/lib/fencing.py.py b/fence/agents/lib/fencing.py.py
index 798f855..b8aa98f 100644
--- a/fence/agents/lib/fencing.py.py
+++ b/fence/agents/lib/fencing.py.py
@@ -170,6 +170,14 @@ all_opt = {
 		"required" : "0",
 		"shortdesc" : "SSL connection",
 		"order" : 1 },
+	"notls" : {
+		"getopt" : "t",
+		"longopt" : "notls",
+		"help" : "-t, --notls                    Disable TLS negotiation and force SSL3.0.\n" +
+	"                                        This should only be used for devices that do not support TLS1.0 and up.",
+		"required" : "0",
+		"shortdesc" : "Disable TLS negotiation",
+		"order" : 1 },
 	"port" : {
 		"getopt" : "n:",
 		"longopt" : "plug",
@@ -960,7 +968,11 @@ def fence_login(options, re_login_string = "(login\s*: )|(Login Name:  )|(userna
 		re_pass  = re.compile("(password)|(pass phrase)", re.IGNORECASE)
 
 		if options.has_key("--ssl"):
-			command = '%s --insecure --crlf -p %s %s' % (SSL_PATH, options["--ipport"], options["--ip"])
+			gnutls_opts=""
+			if options.has_key("--notls"):
+				gnutls_opts = "--priority \"NORMAL:-VERS-TLS1.2:-VERS-TLS1.1:-VERS-TLS1.0:+VERS-SSL3.0\""
+
+			command = '%s %s --insecure --crlf -p %s %s' % (SSL_PATH, gnutls_opts, options["--ipport"], options["--ip"])
 			try:
 				conn = fspawn(options, command)
 			except pexpect.ExceptionPexpect, ex:
diff --git a/fence/agents/rhevm/fence_rhevm.py b/fence/agents/rhevm/fence_rhevm.py
index d7fc326..ff3d19f 100644
--- a/fence/agents/rhevm/fence_rhevm.py
+++ b/fence/agents/rhevm/fence_rhevm.py
@@ -101,7 +101,7 @@ def send_command(opt, command, method = "GET"):
 	return result
 
 def main():
-	device_opt = [ "ipaddr", "login", "passwd", "ssl", "web", "port" ]
+	device_opt = [ "ipaddr", "login", "passwd", "ssl", "notls", "web", "port" ]
 
 	atexit.register(atexit_handler)
 
diff --git a/fence/agents/vmware_soap/fence_vmware_soap.py b/fence/agents/vmware_soap/fence_vmware_soap.py
index 776273e..400e81f 100644
--- a/fence/agents/vmware_soap/fence_vmware_soap.py
+++ b/fence/agents/vmware_soap/fence_vmware_soap.py
@@ -177,7 +177,7 @@ def remove_tmp_dir(tmp_dir):
 	shutil.rmtree(tmp_dir)
 
 def main():
-	device_opt = [ "ipaddr", "login", "passwd", "web", "ssl", "port" ]
+	device_opt = [ "ipaddr", "login", "passwd", "web", "ssl", "notls", "port" ]
 
 	atexit.register(atexit_handler)
 


More information about the cluster-commits mailing list