Repository: ansible/ansible

Issue:
panos_import module ignores certificate validation
<!---
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release, and devel branch are affected too.
-->

##### ISSUE TYPE
<!--- Pick one below and delete the rest -->
 - Bug Report


##### COMPONENT NAME
<!---
Name of the module, plugin, task or feature
Do not include extra details here, e.g. "vyos_command" not "the network module vyos_command" or the full path
-->
panos_import

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes below -->
```
ansible 2.3.1.0
  config file = 
  configured module search path = Default w/o overrides
  python version = 2.7.13 (default, Feb  1 2017, 13:04:42) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)]
```

##### CONFIGURATION
<!---
If using Ansible 2.4 or above, paste the results of "ansible-config dump --only-changed"
Otherwise, mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).
-->

##### OS / ENVIRONMENT
<!---
Mention the OS you are running Ansible from, and the OS you are
managing, or say "N/A" for anything that is not platform-specific.
Also mention the specific version of what you are trying to control,
e.g. if this is a network bug the version of firmware on the network device.
-->
Mac OS X 10.12.6

##### SUMMARY
<!--- Explain the problem briefly -->
The panos_import module ignores certificate validation

https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/network/panos/panos_import.py#L122

In the panos_import, it uses python-requests to make a post request to an API.  However, it passes False for the verify parameter, which is should never be done.  This code is vulnerable to a MITM attach as a result.  

##### STEPS TO REPRODUCE
<!---
For bugs, show exactly how to reproduce the problem, using a minimal test-case.
For new features, show how the feature would be used.
-->
N/A - this bug was found through code inspection.

<!--- Paste example playbooks or commands between quotes below -->
```yaml

```

<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- What did you expect to happen when running the steps above? -->

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes below -->
```

```



Discussion:
Files identified in the description:
* [lib/ansible/modules/network/panos/panos_import.py](https://github.com/ansible/ansible/blob/devel/lib/ansible/modules/network/panos/panos_import.py)

If these files are inaccurate, please update the `component name` section of the description or use the `!component` bot command.

[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: components_banner --->
cc @ivanbojer @jtschichold
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
@ericwb I don't maintain this module, but saw this issue. Are you comfortable with it being an option passed as a parameter, but it defaults to True?
Note, this affects 2.4, likely future versions as it's the same in devel.
@ericwb I'm having problems testing this on my system today but I have a new file. Can I send you the file so you can test?
Sorry, I don't have the means to test it out.  I opened the issue as a result of code inspection, not actually by running the module.

Resolving patch:
diff --git a/lib/ansible/modules/network/panos/panos_import.py b/lib/ansible/modules/network/panos/panos_import.py
--- a/lib/ansible/modules/network/panos/panos_import.py
+++ b/lib/ansible/modules/network/panos/panos_import.py
@@ -25,6 +25,9 @@
 short_description: import file on PAN-OS devices
 description:
     - Import file on PAN-OS device
+notes:
+    - API reference documentation can be read from the C(/api/) directory of your appliance
+    - Certificate validation is enabled by default as of Ansible 2.6. This may break existing playbooks but should be disabled with caution.
 author: "Luigi Mori (@jtschichold), Ivan Bojer (@ivanbojer)"
 version_added: "2.3"
 requirements:
@@ -47,6 +50,7 @@
     category:
         description:
             - Category of file uploaded. The default is software.
+            - See API > Import section of the API reference for category options.
         default: software
     file:
         description:
@@ -54,6 +58,12 @@
     url:
         description:
             - URL of the file that will be imported to device.
+    validate_certs:
+        description:
+            - If C(no), SSL certificates will not be validated. Disabling certificate validation is not recommended.
+        default: yes
+        type: bool
+        version_added: "2.6"
 '''
 
 EXAMPLES = '''
@@ -113,7 +123,7 @@ def import_file(xapi, module, ip_address, file_, category):
 
     r = requests.post(
         'https://' + ip_address + '/api/',
-        verify=False,
+        verify=module.params['validate_certs'],
         params=params,
         headers={'Content-Type': mef.content_type},
         data=mef
@@ -150,7 +160,8 @@ def main():
         username=dict(default='admin'),
         category=dict(default='software'),
         file=dict(),
-        url=dict()
+        url=dict(),
+        validate_certs=dict(type='bool', default=True),
     )
     module = AnsibleModule(argument_spec=argument_spec, supports_check_mode=False, required_one_of=[['file', 'url']])
     if not HAS_LIB:


Test patch: