Repository: ansible/ansible

Issue:
Allow vmware_inventory to control acceptance of SSL certificates
##### ISSUE TYPE
- Bug Report
##### COMPONENT NAME

vmware_inventory
##### ANSIBLE VERSION

```
c7:~$ ansible --version
ansible 2.2.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides
c7:~$ rpm -q ansible
ansible-2.2.0-100.git201609191602.a801588.HEAD.el7.centos.noarch
```
##### CONFIGURATION
##### OS / ENVIRONMENT

```
c7:~$ cat /etc/centos-release
CentOS Linux release 7.1.1503 (Core) 
```
##### SUMMARY

`vmware_inventory` blindly accepts the SSL certificate at the moment - regardless of it being part of a genuine chain or a self signed cert. Convenient, possibly, but not the height of security. Really we should have an option to accept a certificate or not so people can decide their attitude to risk.
##### STEPS TO REPRODUCE
##### EXPECTED RESULTS

Reject or accept connecting to vsphere over SSL based on an option.
##### ACTUAL RESULTS

Inventory script always connects, no matter what the certificate is.



Discussion:

Resolving patch:
diff --git a/contrib/inventory/vmware_inventory.py b/contrib/inventory/vmware_inventory.py
--- a/contrib/inventory/vmware_inventory.py
+++ b/contrib/inventory/vmware_inventory.py
@@ -186,6 +186,7 @@ def read_settings(self):
             'port': 443,
             'username': '',
             'password': '',
+            'validate_certs': True,
             'ini_path': os.path.join(os.path.dirname(__file__), '%s.ini' % scriptbasename),
             'cache_name': 'ansible-vmware',
             'cache_path': '~/.ansible/tmp',
@@ -228,6 +229,11 @@ def read_settings(self):
         self.port = int(os.environ.get('VMWARE_PORT', config.get('vmware', 'port')))
         self.username = os.environ.get('VMWARE_USERNAME', config.get('vmware', 'username'))
         self.password = os.environ.get('VMWARE_PASSWORD', config.get('vmware', 'password'))
+        self.validate_certs = os.environ.get('VMWARE_VALIDATE_CERTS', config.get('vmware', 'validate_certs'))
+        if self.validate_certs in ['no', 'false', 'False', False]:
+            self.validate_certs = False
+        else:
+            self.validate_certs = True
 
         # behavior control
         self.maxlevel = int(config.get('vmware', 'max_object_level'))
@@ -270,17 +276,12 @@ def get_instances(self):
         instances = []        
 
         kwargs = {'host': self.server,
-                      'user': self.username,
-                      'pwd': self.password,
-                      'port': int(self.port) }
-
-        if hasattr(ssl, 'SSLContext'):
-            # older ssl libs do not have an SSLContext method:
-                #     context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
-            #     AttributeError: 'module' object has no attribute 'SSLContext'
-            # older pyvmomi version also do not have an sslcontext kwarg:
-            # https://github.com/vmware/pyvmomi/commit/92c1de5056be7c5390ac2a28eb08ad939a4b7cdd
-            context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
+                  'user': self.username,
+                  'pwd': self.password,
+                  'port': int(self.port) }
+
+        if hasattr(ssl, 'SSLContext') and not self.validate_certs:
+            context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
             context.verify_mode = ssl.CERT_NONE
             kwargs['sslContext'] = context
 


Test patch: