AMBARI-16810. Ambari Agent security bypassed in Python=>2.7.9 (aonishuk)

ambari-agent/conf/unix/ambari-agent.ini

@@ -39,6 +39,7 @@ system_resource_overrides=/etc/resource_overrides
 keysdir=/var/lib/ambari-agent/keys
 server_crt=ca.crt
 passphrase_env_var_name=AMBARI_PASSPHRASE
+ssl_verify_cert=0
 
 [services]
 pidLookupPath=/var/run/

ambari-agent/src/main/python/ambari_agent/AmbariConfig.py

@@ -157,7 +157,7 @@ class AmbariConfig:
   def __init__(self):
     global content
     self.config = ConfigParser.RawConfigParser()
-    self.net = NetUtil()
+    self.net = NetUtil(self)
     self.config.readfp(StringIO.StringIO(content))
 
   def get(self, section, value, default=None):

ambari-agent/src/main/python/ambari_agent/Controller.py

@@ -72,7 +72,7 @@ class Controller(threading.Thread):
     self.registerUrl = server_secured_url + '/agent/v1/register/' + self.hostname
     self.heartbeatUrl = server_secured_url + '/agent/v1/heartbeat/' + self.hostname
     self.componentsUrl = server_secured_url + '/agent/v1/components/'
-    self.netutil = NetUtil(heartbeat_stop_callback)
+    self.netutil = NetUtil(self.config, heartbeat_stop_callback)
     self.responseId = -1
     self.repeatRegistration = False
     self.isRegistered = False

ambari-agent/src/main/python/ambari_agent/NetUtil.py

@@ -46,10 +46,11 @@ class NetUtil:
   # Returns true if the application is stopping, false if continuing execution
   stopCallback = None
 
-  def __init__(self, stop_callback=None):
+  def __init__(self, config, stop_callback=None):
     if stop_callback is None:
       stop_callback = HeartbeatStopHandlers()
     self.stopCallback = stop_callback
+    self.config = config
 
   def checkURL(self, url):
     """Try to connect to a given url. Result is True if url returns HTTP code 200, in any other case
@@ -60,10 +61,12 @@ class NetUtil:
     logger.info("Connecting to " + url)
     responseBody = ""
 
+    ssl_verify_cert = self.config.get("security","ssl_verify_cert") != "0"
+
     try:
       parsedurl = urlparse(url)
       
-      if sys.version_info >= (2,7,9):
+      if sys.version_info >= (2,7,9) and not ssl_verify_cert:
           import ssl
           ca_connection = httplib.HTTPSConnection(parsedurl[1], context=ssl._create_unverified_context())
       else:

ambari-agent/src/main/python/ambari_agent/main.py

@@ -329,7 +329,7 @@ def main(heartbeat_stop_callback=None):
         logger.warn("Unable to determine the IP address of the Ambari server '%s'", server_hostname)
 
       # Wait until MAX_RETRIES to see if server is reachable
-      netutil = NetUtil(heartbeat_stop_callback)
+      netutil = NetUtil(config, heartbeat_stop_callback)
       (retries, connected, stopped) = netutil.try_to_connect(server_url, MAX_RETRIES, logger)
 
       # if connected, launch controller

ambari-agent/src/test/python/ambari_agent/TestNetUtil.py

@@ -41,7 +41,7 @@ class TestNetUtil(unittest.TestCase):
     httpsConMock.return_value = ca_connection
 
     # test 200
-    netutil = NetUtil.NetUtil()
+    netutil = NetUtil.NetUtil(MagicMock())
     self.assertTrue(netutil.checkURL("url")[0])
 
     # test fail
@@ -59,7 +59,7 @@ class TestNetUtil(unittest.TestCase):
   def test_try_to_connect(self, event_mock,
                             sleepMock):
     event_mock.return_value = False
-    netutil = NetUtil.NetUtil()
+    netutil = NetUtil.NetUtil(MagicMock())
     checkURL = MagicMock(name="checkURL")
     checkURL.return_value = True, "test"
     netutil.checkURL = checkURL

ambari-agent/src/test/python/ambari_agent/TestSecurity.py

@@ -50,6 +50,7 @@ class TestSecurity(unittest.TestCase):
     sys.stdout = out
     # Create config
     self.config = AmbariConfig()
+    self.config.set('security', 'ssl_verify_cert', '0')
     # Instantiate CachedHTTPSConnection (skip connect() call)
     with patch.object(security.VerifiedHTTPSConnection, "connect"):
       self.cachedHTTPSConnection = security.CachedHTTPSConnection(self.config, "example.com")