MB-35254 Verify the CA cert correctly

Previously the CAcert was being handed to the Requests functions
"cert" argument, which is used for client side certificate. It
should have been passed to the "verify" argument.

Change-Id: Ic73639c87e351d7c6e05c62f6cad094b5bfb1023
Reviewed-on: http://review.couchbase.org/112679
Well-Formed: Build Bot <build@couchbase.com>
Reviewed-by: Carlos Gonzalez <carlos.gonzalez@couchbase.com>
Tested-by: Patrick Varley <patrick@couchbase.com>

Author: mcpaddy

cbmgr.py

@@ -440,7 +440,7 @@ def __init__(self, deprecate_username=False, deprecate_password=False, cluster_d
                            help="Use ssl when connecting to Couchbase (Deprecated)")
         group.add_argument("--no-ssl-verify", dest="ssl_verify", action="store_false", default=True,
                            help="Skips SSL verification of certificates against the CA")
-        group.add_argument("--cacert", dest="cacert", default=None,
+        group.add_argument("--cacert", dest="cacert", default=True,
                            help="Verifies the cluster identity with this certificate")
         group.add_argument("-h", "--help", action=CBHelpAction, klass=self,
                            help="Prints the short or long help message")

cluster_manager.py

@@ -39,8 +39,8 @@ def g(*args, **kwargs):
                 'certificates set up in your cluster and use the --cacert flag to specify\n' +
                 'your client certificate.']
             elif str(e).startswith('[SSL]'):
-                return None, ['Unable to connect with the given CA certificate']
-            return None, ['Unable to connect to host at %s' % cm.hostname]
+                return None, ['Unable to connect with the given CA certificate: ', str(e)]
+            return None, ['Unable to connect to host at %s: ' % cm.hostname, str(e)]
         except requests.exceptions.ReadTimeout, e:
             return None, ['Request to host `%s` timed out after %d seconds' % (url, cm.timeout)]
     return g
@@ -57,12 +57,19 @@ class ClusterManager(object):
     """A set of REST API's for managing a Couchbase cluster"""
 
     def __init__(self, hostname, username, password, sslFlag=False, verifyCert=True,
-                 cert=None, debug=False, timeout=DEFAULT_REQUEST_TIMEOUT):
+                 caCert=True, debug=False, timeout=DEFAULT_REQUEST_TIMEOUT, cert=None):
         hostname = hostname.replace("couchbase://", "http://", 1)
         hostname = hostname.replace("couchbases://", "https://", 1)
 
         self.hostname = hostname
+        # verify argument on Request functions can take boolean or a path to a CA if
+        # a path is not provide but the cert still needs to be verified it should use
+        # the system provided CAs
         self.verifyCert = verifyCert
+        self.caCert = caCert
+        if not verifyCert:
+            self.caCert = False
+        # This is for client side certs which is currently not used.
         self.cert = cert
 
         parsed = urlparse.urlparse(hostname)
@@ -77,7 +84,7 @@ def __init__(self, hostname, username, password, sslFlag=False, verifyCert=True,
             # Certificates and verification are not used when the ssl flag is
             # specified.
             self.verifyCert = False
-            self.cert = None
+            self.caCert = False
 
         self.username = username
         self.password = password
@@ -1360,7 +1367,7 @@ def deploy_function(self, function, deploy):
     def _get(self, url):
         if self.debug:
             print "GET %s" % url
-        response = requests.get(url, auth=(self.username, self.password), verify=self.verifyCert,
+        response = requests.get(url, auth=(self.username, self.password), verify=self.caCert,
                                 cert=self.cert, timeout=self.timeout)
         return _handle_response(response, self.debug)
 
@@ -1371,7 +1378,7 @@ def _post_form_encoded(self, url, params):
                 params = {}
             print "POST %s %s" % (url, urllib.urlencode(params))
         response = requests.post(url, auth=(self.username, self.password), data=params,
-                                 cert=self.cert, verify=self.verifyCert, timeout=self.timeout)
+                                 cert=self.cert, verify=self.caCert, timeout=self.timeout)
         return _handle_response(response, self.debug)
 
     @request
@@ -1381,7 +1388,7 @@ def _post_json(self, url, params):
                 params = {}
             print "POST %s %s" % (url, json.dumps(params))
         response = requests.post(url, auth=(self.username, self.password), json=params,
-                                 cert=self.cert, verify=self.verifyCert, timeout=self.timeout)
+                                 cert=self.cert, verify=self.caCert, timeout=self.timeout)
         return _handle_response(response, self.debug)
 
     @request
@@ -1391,7 +1398,7 @@ def _put(self, url, params):
                 params = {}
             print "PUT %s %s" % (url, urllib.urlencode(params))
         response = requests.put(url, params, auth=(self.username, self.password),
-                                cert=None, verify=self.verifyCert, timeout=self.timeout)
+                                cert=None, verify=self.caCert, timeout=self.timeout)
         return _handle_response(response, self.debug)
 
     @request
@@ -1401,7 +1408,7 @@ def _put_json(self, url, params):
                 params = {}
             print "PUT %s %s" % (url, json.dumps(params))
         response = requests.put(url, auth=(self.username, self.password), json=params,
-                                cert=None, verify=self.verifyCert, timeout=self.timeout)
+                                cert=None, verify=self.caCert, timeout=self.timeout)
         return _handle_response(response, self.debug)
 
     @request
@@ -1411,7 +1418,7 @@ def _delete(self, url, params):
                 params = {}
             print "DELETE %s %s" % (url, urllib.urlencode(params))
         response = requests.delete(url, auth=(self.username, self.password), data=params,
-                                   cert=None, verify=self.verifyCert, timeout=self.timeout)
+                                   cert=None, verify=self.caCert, timeout=self.timeout)
         return _handle_response(response, self.debug)