Backport of the patch to fix the insecure VIM

This is a backport of the patch: https://review.openstack.org/#/c/532525/4

Change-Id: I17af91d6041c4e41f6d479da742e96ea45ae31f7
Signed-off-by: Manuel Buil <mbuil@suse.com>

.gitreview

@@ -2,3 +2,4 @@
 host=review.openstack.org
 port=29418
 project=openstack/python-tackerclient.git
+defaultbranch=stable/pike

requirements.txt

@@ -2,7 +2,7 @@
 # of appearance. Changing the order has an impact on the overall integration
 # process, which may cause wedges in the gate later.
 pbr!=2.1.0,>=2.0.0 # Apache-2.0
-cliff>=2.6.0 # Apache-2.0
+cliff>=2.8.0 # Apache-2.0
 iso8601>=0.1.11 # MIT
 netaddr!=0.7.16,>=0.7.13 # BSD
 requests>=2.14.2 # Apache-2.0
@@ -16,4 +16,4 @@ oslo.i18n!=3.15.2,>=2.1.0 # Apache-2.0
 oslo.log>=3.22.0 # Apache-2.0
 oslo.utils>=3.20.0 # Apache-2.0
 oslosphinx>=4.7.0 # Apache-2.0
-oslo.serialization>=1.10.0 # Apache-2.0
+oslo.serialization!=2.19.1,>=1.10.0 # Apache-2.0

tackerclient/tacker/v1_0/nfvo/vim_utils.py

@@ -24,6 +24,7 @@ def args2body_vim(config_param, vim):
     :param vim: vim request object
     :return: vim body with args populated
     """
+    cert_verify_type = ['True', 'False']
     vim['vim_project'] = {'name': config_param.pop('project_name', ''),
                           'project_domain_name':
                               config_param.pop('project_domain_name', '')}
@@ -31,10 +32,16 @@ def args2body_vim(config_param, vim):
         raise exceptions.TackerClientException(message='Project name '
                                                        'must be specified',
                                                status_code=404)
+    cert_verify = config_param.pop('cert_verify', 'True')
+    if cert_verify not in cert_verify_type:
+        raise exceptions.TackerClientException(
+            message='Supported cert_verify types: True, False',
+            status_code=400)
     vim['auth_cred'] = {'username': config_param.pop('username', ''),
                         'password': config_param.pop('password', ''),
                         'user_domain_name':
-                            config_param.pop('user_domain_name', '')}
+                            config_param.pop('user_domain_name', ''),
+                        'cert_verify': cert_verify}
 
 
 def validate_auth_url(url):

tackerclient/tacker/v1_0/nfvo/vnffg.py

@@ -96,7 +96,9 @@ class CreateVNFFG(tackerV10.CreateCommand):
             help=_('List of logical VNFD name to VNF instance name mapping.  '
                    'Example: VNF1:my_vnf1,VNF2:my_vnf2'))
         parser.add_argument(
-            '--symmetrical', metavar='{True,False}',
+            '--symmetrical',
+            action='store_true',
+            default=False,
             help=_('Should a reverse path be created for the NFP'))
         parser.add_argument(
             '--param-file',

tackerclient/tests/unit/vm/samples/vim_config_with_false_cert_verify.yaml

@@ -0,0 +1,7 @@
+auth_url: 'http://1.2.3.4:5000'
+username: 'xyz'
+password: '12345'
+project_name: 'abc'
+project_domain_name: 'prj_domain_name'
+user_domain_name: 'user_domain_name'
+cert_verify: 'False'

tackerclient/tests/unit/vm/test_cli10_vim.py

@@ -38,7 +38,8 @@ class CLITestV10VIMJSON(test_cli10.CLITestV10Base):
             'name': 'abc',
             'project_domain_name': 'prj_domain_name'}
         self.auth_cred = {'username': 'xyz', 'password': '12345',
-                          'user_domain_name': 'user_domain_name'}
+                          'user_domain_name': 'user_domain_name',
+                          'cert_verify': 'True'}
         self.auth_url = 'http://1.2.3.4:5000'
 
     def test_register_vim_all_params(self):
@@ -61,6 +62,30 @@ class CLITestV10VIMJSON(test_cli10.CLITestV10Base):
                                    args, position_names, position_values,
                                    extra_body=extra_body)
 
+    def test_register_vim_with_false_cert_verify(self):
+        cmd = vim.CreateVIM(test_cli10.MyApp(sys.stdout), None)
+        name = 'my-name'
+        my_id = 'my-id'
+        # change cert_verify to False
+        self.auth_cred = {'username': 'xyz', 'password': '12345',
+                          'user_domain_name': 'user_domain_name',
+                          'cert_verify': 'False'}
+        description = 'Vim Description'
+        vim_config = utils.get_file_path(
+            'tests/unit/vm/samples/vim_config_with_false_cert_verify.yaml')
+        args = [
+            name,
+            '--config-file', vim_config,
+            '--description', description]
+        position_names = ['auth_cred', 'vim_project', 'auth_url']
+        position_values = [self.auth_cred, self.vim_project,
+                           self.auth_url]
+        extra_body = {'type': 'openstack', 'name': name,
+                      'description': description, 'is_default': False}
+        self._test_create_resource(self._RESOURCE, cmd, None, my_id,
+                                   args, position_names, position_values,
+                                   extra_body=extra_body)
+
     def test_register_vim_with_no_auth_url(self):
         cmd = vim.CreateVIM(test_cli10.MyApp(sys.stdout), None)
         my_id = 'my-id'

tackerclient/tests/unit/vm/test_cli10_vnffg.py

@@ -44,9 +44,9 @@ class CLITestV10VmVNFFGJSON(test_cli10.CLITestV10Base):
             vnffg_name,
             '--vnffgd-id', vnffgd_id,
             '--vnf-mapping', vnf_mapping,
-            '--symmetrical', 'True']
+            '--symmetrical']
         position_names = ['vnffgd_id', 'vnf_mapping', 'symmetrical']
-        position_values = [vnffgd_id, {"VNFD1": "VNF1"}, 'True']
+        position_values = [vnffgd_id, {"VNFD1": "VNF1"}, True]
         extra_body = {'name': vnffg_name, 'attributes': {}}
         self._test_create_resource(self._RESOURCE, cmd, None, my_id,
                                    args, position_names, position_values,
@@ -64,7 +64,8 @@ class CLITestV10VmVNFFGJSON(test_cli10.CLITestV10Base):
         ]
         position_names = ['vnffgd_id']
         position_values = [vnffgd_id]
-        extra_body = {'name': vnffg_name, 'attributes': {}}
+        extra_body = {'symmetrical': False, 'name': vnffg_name,
+                      'attributes': {}}
         self._test_create_resource(self._RESOURCE, cmd, vnffg_name, my_id,
                                    args, position_names, position_values,
                                    extra_body=extra_body,

tackerclient/tests/unit/vm/test_vim_utils.py

@@ -28,6 +28,7 @@ class TestVIMUtils(testtools.TestCase):
                         'username': sentinel.usrname1,
                         'password': sentinel.password1,
                         'project_domain_name': sentinel.prj_domain_name1,
+                        'cert_verify': 'True',
                         'user_domain_name': sentinel.user_domain.name, }
         vim = {}
         auth_cred = config_param.copy()
@@ -43,6 +44,7 @@ class TestVIMUtils(testtools.TestCase):
     def test_args2body_vim_no_project(self):
         config_param = {'username': sentinel.usrname1,
                         'password': sentinel.password1,
+                        'cert_verify': 'True',
                         'user_domain_name': sentinel.user_domain.name, }
         vim = {}
         self.assertRaises(exceptions.TackerClientException,

test-requirements.txt

@@ -8,7 +8,7 @@ flake8<2.6.0,>=2.5.4 # MIT
 pep8==1.5.7 # MIT
 pyflakes==0.8.1 # MIT
 python-subunit>=0.0.18 # Apache-2.0/BSD
-sphinx!=1.6.1,>=1.5.1 # BSD
+sphinx>=1.6.2 # BSD
 testrepository>=0.0.18 # Apache-2.0/BSD
 testtools>=1.4.0 # MIT
 

tox.ini

@@ -11,7 +11,7 @@ setenv = VIRTUAL_ENV={envdir}
          LANGUAGE=en_US:en
          LC_ALL=C
 usedevelop = True
-install_command = {toxinidir}/tools/tox_install.sh {env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt} {opts} {packages}
+install_command = {toxinidir}/tools/tox_install.sh {env:UPPER_CONSTRAINTS_FILE:https://git.openstack.org/cgit/openstack/requirements/plain/upper-constraints.txt?h=stable/pike} {opts} {packages}
 deps = -r{toxinidir}/requirements.txt
        -r{toxinidir}/test-requirements.txt
 commands = python setup.py testr --testr-args='{posargs}'