xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2024-11-22 17:43:14 +00:00
Code Issues Projects Releases Wiki Activity

Add message when insecure is needed

Browse Source 
Practically speaking, this will be only choice for most people, but we
must make sure that the user acknowledges the risk.
This commit is contained in:
Jarrod Johnson 2020-03-12 17:42:56 -04:00
parent e97214ca50
commit 1bfc949466
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
confluent_server/confluent/discovery/protocols/pxe.py
View File

@ -23,6 +23,7 @@
# option 97 = UUID (wireformat)
import confluent.config.configmanager as cfm
import confluent.log as log
import ctypes
import ctypes.util
import eventlet.green.socket as socket
@ -302,9 +303,17 @@ def remap_nodes(nodeattribs, configmanager):
def check_reply(node, info, packet, sock, cfg):
cfd = cfg.get_node_attributes(node, ('deployment.*'))
profile = cfd.get(node, {}).get('deployment.pendingprofile', {}).get('value', None)
if not profile:
return
insecuremode = cfd.get(node, {}).get('deployment.useinsecureprotocols', 'never')
if insecuremode == 'never' and info['architecture'] != 'uefi-httpboot':
print('Ignoring request')
log.log(
{'info': 'Boot attempt by {0} detected in insecure mode, but '
'insecure mode is disabled. Set the attribute '
'`deployment.useinsecureprotocols` to `firmware` or '
'`always` to enable support, or use UEFI HTTP boot '
'with HTTPS.'.format(node)})
return
print('Thinking about reply to {0}'.format(node))