"reg_ssl_verify=0" boot parameter disables SSL checks (part of bnc#87…

…4745)

src/lib/registration/helpers.rb

@@ -209,5 +209,23 @@ def self.slp_discovery_feedback
       end
     end
 
+    # check if insecure registration is requested
+    # (the "reg_ssl_verify=0" boot commandline option is used)
+    def self.insecure_registration
+      # check the boot parameter only at installation/update
+      return false unless Yast::Mode.installation || Yast::Mode.update
+
+      parameters = Yast::Linuxrc.InstallInf("Cmdline")
+      return false unless parameters
+
+      reg_ssl_verify_param = parameters.split.grep(/\Areg_ssl_verify=/i).last
+      return false unless reg_ssl_verify_param
+
+      reg_ssl_verify = reg_ssl_verify_param.split('=', 2).last
+      log.info "Boot reg_ssl_verify option: #{reg_ssl_verify.inspect}"
+
+      reg_ssl_verify == "0"
+    end
+
   end
 end

src/lib/registration/registration.rb

@@ -114,6 +114,11 @@ def connect_params(params)
         default_params[:url] = @url
       end
 
+      if Helpers.insecure_registration
+        log.warn "SSL certificate check disabled via reg_ssl boot parameter"
+        default_params[:insecure] = true
+      end
+
       default_params.merge(params)
     end
   end

test/helpers_spec.rb

@@ -157,4 +157,49 @@
       expect(Registration::Helpers.base_version("12-1")).to eq("12")
     end
   end
+
+  describe ".insecure_registration" do
+    let(:yast_mode) { double("Yast::Mode") }
+    let(:yast_linuxrc) { double("Yast::Linuxrc") }
+
+    before do
+      stub_const("Yast::Mode", yast_mode)
+      stub_const("Yast::Linuxrc", yast_linuxrc)
+    end
+
+    context "outside installation/update" do
+      before do
+        allow(yast_mode).to receive(:installation).and_return(false)
+        allow(yast_mode).to receive(:update).and_return(false)
+      end
+
+      it "returns false and does not check boot parameters" do
+        expect(yast_linuxrc).to receive(:InstallInf).never
+        expect(Registration::Helpers.insecure_registration).to eq(false)
+      end
+    end
+
+    context "at installation" do
+      before do
+        allow(yast_mode).to receive(:installation).and_return(true)
+        allow(yast_mode).to receive(:update).and_return(false)
+      end
+
+      it "returns false when reg_ssl_verify option is not used at boot commandline" do
+        expect(yast_linuxrc).to receive(:InstallInf).with("Cmdline").and_return("splash=silent vga=0x314")
+        expect(Registration::Helpers.insecure_registration).to eq(false)
+      end
+
+      it "returns false when reg_ssl_verify=1 boot option is used" do
+        expect(yast_linuxrc).to receive(:InstallInf).with("Cmdline").and_return("splash=silent reg_ssl_verify=1 vga=0x314")
+        expect(Registration::Helpers.insecure_registration).to eq(false)
+      end
+
+      it "returns true when reg_ssl_verify=0 boot option is used" do
+        expect(yast_linuxrc).to receive(:InstallInf).with("Cmdline").and_return("splash=silent reg_ssl_verify=0 vga=0x314")
+        expect(Registration::Helpers.insecure_registration).to eq(true)
+      end
+    end
+  end
+
 end

test/registration_spec.rb

@@ -21,6 +21,7 @@
       reg_code = "reg_code"
 
       expect(Registration::SwMgmt).to receive(:zypp_config_writable!)
+      expect(Registration::Helpers).to receive(:insecure_registration).and_return(false)
       SUSE::Connect::Credentials.any_instance.should_receive(:write)
       expect(SUSE::Connect::YaST).to(receive(:announce_system)
         .with(hash_including(:token => reg_code))
@@ -30,7 +31,7 @@
       Registration::Registration.new.register("email", reg_code, "sles-12-x86_64")
     end
   end
-  
+
   describe ".register_products" do
     it "registers the selected product and returns added zypp services" do
       product = {
@@ -39,7 +40,7 @@
         "version" => "12",
         "release_type" => "DVD"
       }
-      
+
       source = SUSE::Connect::Source.new("service", "https://example.com")
       service = SUSE::Connect::Service.new([source], [], [])
 
@@ -54,10 +55,12 @@
           ))
         .and_return(service)
       )
+
+      expect(Registration::Helpers).to receive(:insecure_registration).and_return(false)
       expect(Registration::SwMgmt).to receive(:add_services)
       expect(SUSE::Connect::Credentials).to receive(:read)
         .with(SUSE::Connect::Credentials::GLOBAL_CREDENTIALS_FILE)
-      
+
       service_list = Registration::Registration.new.register_products([product])
       expect(service_list).to eq([service])
     end