diff --git a/SOURCES/bz1199970-fence_ilo_support_tls10.patch b/SOURCES/bz1199970-fence_ilo_support_tls10.patch new file mode 100644 index 0000000..811f436 --- /dev/null +++ b/SOURCES/bz1199970-fence_ilo_support_tls10.patch @@ -0,0 +1,119 @@ +From 9a6bb12b2c8aaf9d30d0d228bf0b4d93e06e1153 Mon Sep 17 00:00:00 2001 +From: Marek 'marx' Grac +Date: Wed, 25 Mar 2015 18:22:08 +0100 +Subject: [PATCH 4/5] fence_ilo: Add support for TLS1.0 + +HP iLO2 firmware 2.27 has broken implementation of TLS and SSLv3 is disabled by default. +gnutls (3.4.x) has support to disable proper negotiation and use only TLS1.0 that works well. + +Option --tls1.0 (tls1.0 on stdin) was added to enable this feature and fence_ilo(2) works +correctly also with this firmware. + +Resolves: rhbz#1199970 +--- + fence/agents/ilo/fence_ilo.py | 2 +- + fence/agents/lib/fencing.py.py | 16 +++++++++++++++- + tests/data/metadata/fence_ilo.xml | 7 ++++++- + tests/data/metadata/fence_ilo2.xml | 7 ++++++- + 4 files changed, 28 insertions(+), 4 deletions(-) + +diff --git a/fence/agents/ilo/fence_ilo.py b/fence/agents/ilo/fence_ilo.py +index 965aabf..047040b 100644 +--- a/fence/agents/ilo/fence_ilo.py ++++ b/fence/agents/ilo/fence_ilo.py +@@ -65,7 +65,7 @@ def define_new_opts(): + "order" : 1} + + def main(): +- device_opt = ["ipaddr", "login", "passwd", "ssl", "notls", "ribcl"] ++ device_opt = ["ipaddr", "login", "passwd", "ssl", "notls", "tls1.0", "ribcl"] + + atexit.register(atexit_handler) + +diff --git a/fence/agents/lib/fencing.py.py b/fence/agents/lib/fencing.py.py +index 7209d5e..f893082 100644 +--- a/fence/agents/lib/fencing.py.py ++++ b/fence/agents/lib/fencing.py.py +@@ -203,7 +203,19 @@ all_opt = { + " " + "This should only be used for devices that do not support TLS1.0 and up.", + "required" : "0", +- "shortdesc" : "Disable TLS negotiation", ++ "shortdesc" : "Disable TLS negotiation, force SSL 3.0", ++ "order" : 1}, ++ "tls1.0" : { ++ "getopt" : "", ++ "longopt" : "tls1.0", ++ "help" : "--tls1.0 " ++ "Disable TLS negotiation and force TLS1.0\n" ++ " " ++ "This should only be used for devices that\n" ++ " " ++ "do not support TLS1.1 and up.", ++ "required" : "0", ++ "shortdesc" : "Disable TLS negotiaton, force TLS 1.0", + "order" : 1}, + "port" : { + "getopt" : "n:", +@@ -995,6 +1007,8 @@ def fence_login(options, re_login_string=r"(login\s*: )|(Login Name: )|(usernam + + if options.has_key("--notls"): + gnutls_opts = "--priority \"NORMAL:-VERS-TLS1.2:-VERS-TLS1.1:-VERS-TLS1.0:+VERS-SSL3.0\"" ++ elif options.has_key("--tls1.0"): ++ gnutls_opts = "--priority \"NORMAL:-VERS-TLS1.2:-VERS-TLS1.1:+VERS-TLS1.0:%LATEST_RECORD_VERSION\"" + + # --ssl is same as the --ssl-secure + if options.has_key("--ssl-insecure"): +diff --git a/tests/data/metadata/fence_ilo.xml b/tests/data/metadata/fence_ilo.xml +index 25d9d54..ae7fe9c 100644 +--- a/tests/data/metadata/fence_ilo.xml ++++ b/tests/data/metadata/fence_ilo.xml +@@ -12,7 +12,7 @@ + + + +- Disable TLS negotiation ++ Disable TLS negotiation, force SSL 3.0 + + + +@@ -49,6 +49,11 @@ + + Script to retrieve password + ++ ++ ++ ++ Disable TLS negotiaton, force TLS 1.0 ++ + + + +diff --git a/tests/data/metadata/fence_ilo2.xml b/tests/data/metadata/fence_ilo2.xml +index 47e8e28..19a31a1 100644 +--- a/tests/data/metadata/fence_ilo2.xml ++++ b/tests/data/metadata/fence_ilo2.xml +@@ -12,7 +12,7 @@ + + + +- Disable TLS negotiation ++ Disable TLS negotiation, force SSL 3.0 + + + +@@ -49,6 +49,11 @@ + + Script to retrieve password + ++ ++ ++ ++ Disable TLS negotiaton, force TLS 1.0 ++ + + + +-- +1.9.3 + diff --git a/SOURCES/bz1203877-fence_ipmilan-default_cipher.patch b/SOURCES/bz1203877-fence_ipmilan-default_cipher.patch new file mode 100644 index 0000000..8c15361 --- /dev/null +++ b/SOURCES/bz1203877-fence_ipmilan-default_cipher.patch @@ -0,0 +1,109 @@ +From 05a6bf8619560b559bfb0ea3688635935a96ca94 Mon Sep 17 00:00:00 2001 +From: Marek 'marx' Grac +Date: Thu, 19 Mar 2015 21:28:22 +0100 +Subject: [PATCH 5/5] fence_ipmilan: Un-set default cipher + +Previously, the default cipher was left to ipmitool, in one of latest releases we have changed it +to cipher=0. This commit removes this default and uses --cipher for ipmitool only when explicitly +set by user. + +Resolves: rhbz#1203877 +--- + fence/agents/ipmilan/fence_ipmilan.py | 4 ++-- + tests/data/metadata/fence_idrac.xml | 2 +- + tests/data/metadata/fence_ilo3.xml | 2 +- + tests/data/metadata/fence_ilo4.xml | 2 +- + tests/data/metadata/fence_imm.xml | 2 +- + tests/data/metadata/fence_ipmilan.xml | 2 +- + 6 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/fence/agents/ipmilan/fence_ipmilan.py b/fence/agents/ipmilan/fence_ipmilan.py +index eaff7b7..8490837 100644 +--- a/fence/agents/ipmilan/fence_ipmilan.py ++++ b/fence/agents/ipmilan/fence_ipmilan.py +@@ -53,7 +53,8 @@ def create_command(options, action): + cmd += " -P ''" + + # --cipher / -C +- cmd += " -C " + options["--cipher"] ++ if "--cipher" in options: ++ cmd += " -C " + options["--cipher"] + + # --port / -n + if options.has_key("--ipport"): +@@ -96,7 +97,6 @@ def define_new_opts(): + "help" : "-C, --cipher=[cipher] Ciphersuite to use (same as ipmitool -C parameter)", + "required" : "0", + "shortdesc" : "Ciphersuite to use (same as ipmitool -C parameter)", +- "default" : "0", + "order": 1 + } + all_opt["privlvl"] = { +diff --git a/tests/data/metadata/fence_idrac.xml b/tests/data/metadata/fence_idrac.xml +index 26a2758..dcb3235 100644 +--- a/tests/data/metadata/fence_idrac.xml ++++ b/tests/data/metadata/fence_idrac.xml +@@ -61,7 +61,7 @@ + + + +- ++ + Ciphersuite to use (same as ipmitool -C parameter) + + +diff --git a/tests/data/metadata/fence_ilo3.xml b/tests/data/metadata/fence_ilo3.xml +index c1e01ae..e6a48bc 100644 +--- a/tests/data/metadata/fence_ilo3.xml ++++ b/tests/data/metadata/fence_ilo3.xml +@@ -61,7 +61,7 @@ + + + +- ++ + Ciphersuite to use (same as ipmitool -C parameter) + + +diff --git a/tests/data/metadata/fence_ilo4.xml b/tests/data/metadata/fence_ilo4.xml +index bbba9a0..e7b0d60 100644 +--- a/tests/data/metadata/fence_ilo4.xml ++++ b/tests/data/metadata/fence_ilo4.xml +@@ -61,7 +61,7 @@ + + + +- ++ + Ciphersuite to use (same as ipmitool -C parameter) + + +diff --git a/tests/data/metadata/fence_imm.xml b/tests/data/metadata/fence_imm.xml +index addfcd4..8fbdddd 100644 +--- a/tests/data/metadata/fence_imm.xml ++++ b/tests/data/metadata/fence_imm.xml +@@ -61,7 +61,7 @@ + + + +- ++ + Ciphersuite to use (same as ipmitool -C parameter) + + +diff --git a/tests/data/metadata/fence_ipmilan.xml b/tests/data/metadata/fence_ipmilan.xml +index d15e352..199490c 100644 +--- a/tests/data/metadata/fence_ipmilan.xml ++++ b/tests/data/metadata/fence_ipmilan.xml +@@ -61,7 +61,7 @@ + + + +- ++ + Ciphersuite to use (same as ipmitool -C parameter) + + +-- +1.9.3 + diff --git a/SOURCES/tests-01.patch b/SOURCES/tests-01.patch new file mode 100644 index 0000000..15bc477 --- /dev/null +++ b/SOURCES/tests-01.patch @@ -0,0 +1,36 @@ +From 8270ec5d2d2526ff32ef0836ba8dca707ffa4d41 Mon Sep 17 00:00:00 2001 +From: Marek 'marx' Grac +Date: Thu, 16 Oct 2014 14:13:24 +0200 +Subject: [PATCH 2/5] [build] Fix paths in process of building releases + +--- + make/agentccheck.mk | 2 +- + make/agentpycheck.mk | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/make/agentccheck.mk b/make/agentccheck.mk +index 3ef97f9..46e2055 100644 +--- a/make/agentccheck.mk ++++ b/make/agentccheck.mk +@@ -1,5 +1,5 @@ + TEMPFILE:=$(shell mktemp) +-DATADIR:=$(abs_top_builddir)/../tests/data/metadata ++DATADIR:=$(abs_top_srcdir)/tests/data/metadata + + check: $(TARGET:%=xml-check.%) $(SYMTARGET:%=xml-check.%) + +diff --git a/make/agentpycheck.mk b/make/agentpycheck.mk +index ae4e477..63cb9da 100644 +--- a/make/agentpycheck.mk ++++ b/make/agentpycheck.mk +@@ -1,5 +1,6 @@ + TEMPFILE:=$(shell mktemp) +-DATADIR:=$(abs_top_builddir)/../tests/data/metadata ++#DATADIR:=$(abs_top_builddir)/tests/data/metadata ++DATADIR:=$(abs_top_srcdir)/tests/data/metadata + + check: $(TARGET:%=xml-check.%) $(SYMTARGET:%=xml-check.%) $(TARGET:%=delay-check.%) + +-- +1.9.3 + diff --git a/SOURCES/tests-02.patch b/SOURCES/tests-02.patch new file mode 100644 index 0000000..c0087b3 --- /dev/null +++ b/SOURCES/tests-02.patch @@ -0,0 +1,443 @@ +From a09307e2723f4536c71fe9b3b650b1d6ab8e9b79 Mon Sep 17 00:00:00 2001 +From: Marek 'marx' Grac +Date: Wed, 25 Mar 2015 17:53:14 +0100 +Subject: [PATCH 3/5] [tests] Add XML metadata for fence_ilo*_ssh + +--- + tests/data/metadata/fence_ilo3_ssh.xml | 136 +++++++++++++++++++++++++++++++++ + tests/data/metadata/fence_ilo4_ssh.xml | 136 +++++++++++++++++++++++++++++++++ + tests/data/metadata/fence_ilo_ssh.xml | 136 +++++++++++++++++++++++++++++++++ + 3 files changed, 408 insertions(+) + create mode 100644 tests/data/metadata/fence_ilo3_ssh.xml + create mode 100644 tests/data/metadata/fence_ilo4_ssh.xml + create mode 100644 tests/data/metadata/fence_ilo_ssh.xml + +diff --git a/tests/data/metadata/fence_ilo3_ssh.xml b/tests/data/metadata/fence_ilo3_ssh.xml +new file mode 100644 +index 0000000..b3531b2 +--- /dev/null ++++ b/tests/data/metadata/fence_ilo3_ssh.xml +@@ -0,0 +1,136 @@ ++ ++ ++ ++ ++fence_ilo_ssh is a fence agent that connects to iLO device. It logs into device via ssh and reboot a specified outlet. ++http://www.hp.com ++ ++ ++ ++ ++ TCP/UDP port to use for connection with device ++ ++ ++ ++ ++ IP Address or Hostname ++ ++ ++ ++ ++ SSH connection ++ ++ ++ ++ ++ Force Python regex for command prompt ++ ++ ++ ++ ++ Forces agent to use IPv6 addresses only ++ ++ ++ ++ ++ Identity file for ssh ++ ++ ++ ++ ++ Forces agent to use IPv4 addresses only ++ ++ ++ ++ ++ ++ Method to fence (onoff|cycle) ++ ++ ++ ++ ++ Script to retrieve password ++ ++ ++ ++ ++ Login password or passphrase ++ ++ ++ ++ ++ SSH options to use ++ ++ ++ ++ ++ Fencing Action ++ ++ ++ ++ ++ Login Name ++ ++ ++ ++ ++ Verbose mode ++ ++ ++ ++ ++ Write debug information to given file ++ ++ ++ ++ ++ Display version information and exit ++ ++ ++ ++ ++ Display help and exit ++ ++ ++ ++ ++ Wait X seconds after issuing ON/OFF ++ ++ ++ ++ ++ Wait X seconds for cmd prompt after login ++ ++ ++ ++ ++ Test X seconds for status change after ON/OFF ++ ++ ++ ++ ++ Wait X seconds before fencing is started ++ ++ ++ ++ ++ Wait X seconds for cmd prompt after issuing command ++ ++ ++ ++ ++ Count of attempts to retry power on ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/tests/data/metadata/fence_ilo4_ssh.xml b/tests/data/metadata/fence_ilo4_ssh.xml +new file mode 100644 +index 0000000..2266ee1 +--- /dev/null ++++ b/tests/data/metadata/fence_ilo4_ssh.xml +@@ -0,0 +1,136 @@ ++ ++ ++ ++ ++fence_ilo_ssh is a fence agent that connects to iLO device. It logs into device via ssh and reboot a specified outlet. ++http://www.hp.com ++ ++ ++ ++ ++ TCP/UDP port to use for connection with device ++ ++ ++ ++ ++ IP Address or Hostname ++ ++ ++ ++ ++ SSH connection ++ ++ ++ ++ ++ Force Python regex for command prompt ++ ++ ++ ++ ++ Forces agent to use IPv6 addresses only ++ ++ ++ ++ ++ Identity file for ssh ++ ++ ++ ++ ++ Forces agent to use IPv4 addresses only ++ ++ ++ ++ ++ ++ Method to fence (onoff|cycle) ++ ++ ++ ++ ++ Script to retrieve password ++ ++ ++ ++ ++ Login password or passphrase ++ ++ ++ ++ ++ SSH options to use ++ ++ ++ ++ ++ Fencing Action ++ ++ ++ ++ ++ Login Name ++ ++ ++ ++ ++ Verbose mode ++ ++ ++ ++ ++ Write debug information to given file ++ ++ ++ ++ ++ Display version information and exit ++ ++ ++ ++ ++ Display help and exit ++ ++ ++ ++ ++ Wait X seconds after issuing ON/OFF ++ ++ ++ ++ ++ Wait X seconds for cmd prompt after login ++ ++ ++ ++ ++ Test X seconds for status change after ON/OFF ++ ++ ++ ++ ++ Wait X seconds before fencing is started ++ ++ ++ ++ ++ Wait X seconds for cmd prompt after issuing command ++ ++ ++ ++ ++ Count of attempts to retry power on ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/tests/data/metadata/fence_ilo_ssh.xml b/tests/data/metadata/fence_ilo_ssh.xml +new file mode 100644 +index 0000000..a9bd1d3 +--- /dev/null ++++ b/tests/data/metadata/fence_ilo_ssh.xml +@@ -0,0 +1,136 @@ ++ ++ ++ ++ ++fence_ilo_ssh is a fence agent that connects to iLO device. It logs into device via ssh and reboot a specified outlet. ++http://www.hp.com ++ ++ ++ ++ ++ TCP/UDP port to use for connection with device ++ ++ ++ ++ ++ IP Address or Hostname ++ ++ ++ ++ ++ SSH connection ++ ++ ++ ++ ++ Force Python regex for command prompt ++ ++ ++ ++ ++ Forces agent to use IPv6 addresses only ++ ++ ++ ++ ++ Identity file for ssh ++ ++ ++ ++ ++ Forces agent to use IPv4 addresses only ++ ++ ++ ++ ++ ++ Method to fence (onoff|cycle) ++ ++ ++ ++ ++ Script to retrieve password ++ ++ ++ ++ ++ Login password or passphrase ++ ++ ++ ++ ++ SSH options to use ++ ++ ++ ++ ++ Fencing Action ++ ++ ++ ++ ++ Login Name ++ ++ ++ ++ ++ Verbose mode ++ ++ ++ ++ ++ Write debug information to given file ++ ++ ++ ++ ++ Display version information and exit ++ ++ ++ ++ ++ Display help and exit ++ ++ ++ ++ ++ Wait X seconds after issuing ON/OFF ++ ++ ++ ++ ++ Wait X seconds for cmd prompt after login ++ ++ ++ ++ ++ Test X seconds for status change after ON/OFF ++ ++ ++ ++ ++ Wait X seconds before fencing is started ++ ++ ++ ++ ++ Wait X seconds for cmd prompt after issuing command ++ ++ ++ ++ ++ Count of attempts to retry power on ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +-- +1.9.3 + diff --git a/SPECS/fence-agents.spec b/SPECS/fence-agents.spec index fab72e9..05bbee6 100644 --- a/SPECS/fence-agents.spec +++ b/SPECS/fence-agents.spec @@ -16,7 +16,7 @@ Name: fence-agents Summary: Fence Agents for Red Hat Cluster Version: 4.0.11 -Release: 10%{?alphatag:.%{alphatag}}%{?dist} +Release: 11%{?alphatag:.%{alphatag}}%{?dist} License: GPLv2+ and LGPLv2+ Group: System Environment/Base URL: http://sourceware.org/cluster/wiki/ @@ -39,6 +39,10 @@ Patch14: bz1121122-3.5-delay_test.patch Patch15: bz1121122-4-symlink_ilo34_ssh.patch Patch16: bz1121122-5-symlink_ilo34_ssh.patch Patch17: bz1173178-1-rewrite_fence_zvmip.patch +Patch18: tests-01.patch +Patch19: tests-02.patch +Patch20: bz1199970-fence_ilo_support_tls10.patch +Patch21: bz1203877-fence_ipmilan-default_cipher.patch %if 0%{?rhel} %global supportedagents apc apc_snmp bladecenter brocade cisco_mds cisco_ucs drac5 eaton_snmp eps hpblade ibmblade ifmib ilo ilo_mp ilo_ssh intelmodular ipdu ipmilan kdump rhevm rsb scsi vmware_soap wti @@ -82,6 +86,10 @@ BuildRequires: autoconf automake libtool %patch15 -p1 -b .bz1121122-4 %patch16 -p1 -b .bz1121122-5 %patch17 -p1 -b .bz1173178-1 +%patch18 -p1 -b .tests-01 +%patch19 -p1 -b .tests-02 +%patch20 -p1 -b .bz1199970-1 +%patch21 -p1 -b .bz1203877-1 %build ./autogen.sh @@ -594,6 +602,13 @@ The fence-agents-zvm package contains a fence agent for z/VM hypervisors %endif %changelog +* Wed Mar 25 2015 Marek Grac - 4.0.11-11 +- fence_ipmilan: Unset default cipher + Resolves: rhbz#1206294 +- fence_ilo2: Add --tls1.0 + Resolves: rhbz#1206293 +- update scripts so 'make check' is working again + * Mon Jan 05 2015 Marek Grac - 4.0.11-10 - fence_zvmip: Add fence_zvmip ported to fencing library Resolves: rhbz#1173178