From: Ondrej Lichtner <olichtne(a)redhat.com>
Loading from nonexistent files or not properly formatted files will
cause exceptions that need to be handled properly. This patch adds
try/except blocks around all load_.*_key functions that we use.
Signed-off-by: Ondrej Lichtner <olichtne(a)redhat.com>
---
lnst/Controller/CtlSecSocket.py | 23 +++++++++++++++++-----
lnst/Slave/SlaveSecSocket.py | 42 +++++++++++++++++++++++++++++++----------
2 files changed, 50 insertions(+), 15 deletions(-)
diff --git a/lnst/Controller/CtlSecSocket.py b/lnst/Controller/CtlSecSocket.py
index 8ffe440..d92a8c6 100644
--- a/lnst/Controller/CtlSecSocket.py
+++ b/lnst/Controller/CtlSecSocket.py
@@ -184,10 +184,16 @@ class CtlSecSocket(SecureSocket):
with open(ssh_dir_path+"/known_hosts", 'r') as f:
for line in f.readlines():
key = line[line.find(' ')+1:]
- known_hosts.append(load_ssh_public_key(key, backend))
+ try:
+ known_hosts.append(load_ssh_public_key(key, backend))
+ except:
+ continue
- with open(ssh_dir_path+"/id_rsa", 'r') as f:
- ctl_ssh_key = load_pem_private_key(f.read(), None, backend)
+ try:
+ with open(ssh_dir_path+"/id_rsa", 'r') as f:
+ ctl_ssh_key = load_pem_private_key(f.read(), None, backend)
+ except:
+ ctl_ssh_key = None
if not ctl_ssh_key:
raise SecSocketException("Handshake failed.")
@@ -205,7 +211,10 @@ class CtlSecSocket(SecureSocket):
raise SecSocketException("Handshake failed.")
srv_ssh_pubkeys = []
for key in msg["srv_ssh_pubkeys"]:
- srv_ssh_pubkeys.append(load_pem_public_key(key, backend))
+ try:
+ srv_ssh_pubkeys.append(load_pem_public_key(key, backend))
+ except:
+ continue
srv_ssh_pubkey = None
i = 0
@@ -258,7 +267,11 @@ class CtlSecSocket(SecureSocket):
if msg["type"] != "pubkey_server_hello":
raise SecSocketException("Handshake failed.")
- srv_pubkey = load_pem_public_key(msg["srv_pubkey"], backend)
+ try:
+ srv_pubkey = load_pem_public_key(msg["srv_pubkey"], backend)
+ except:
+ raise SecSocketException("Handshake failed.")
+
if not self._cmp_pub_keys(local_srv_pubkey, srv_pubkey):
raise SecSocketException("Handshake failed.")
diff --git a/lnst/Slave/SlaveSecSocket.py b/lnst/Slave/SlaveSecSocket.py
index 3ba3fef..fa4a59d 100644
--- a/lnst/Slave/SlaveSecSocket.py
+++ b/lnst/Slave/SlaveSecSocket.py
@@ -90,16 +90,23 @@ class SlaveSecSocket(SecureSocket):
elif sec_params["auth_types"] == "pubkey":
cryptography_imports()
srv_key = None
- with open(sec_params["privkey"], 'r') as f:
- srv_key = load_pem_private_key(f.read(), None, backend)
+ try:
+ with open(sec_params["privkey"], 'r') as f:
+ srv_key = load_pem_private_key(f.read(), None, backend)
+ except:
+ srv_key = None
ctl_pubkeys = {}
for fname in os.listdir(sec_params["ctl_pubkeys"]):
path = os.path.join(sec_params["ctl_pubkeys"], fname)
if not os.path.isfile(path):
continue
- with open(path, 'r') as f:
- ctl_pubkeys[fname] = load_pem_public_key(f.read(), backend)
+ try:
+ with open(path, 'r') as f:
+ ctl_pubkeys[fname] = load_pem_public_key(f.read(),
+ backend)
+ except:
+ continue
self._pubkey_handshake(srv_key, ctl_pubkeys)
elif sec_params["auth_types"] == "password":
@@ -179,18 +186,30 @@ class SlaveSecSocket(SecureSocket):
"/etc/ssh/ssh_host_ecdsa_key"]
ssh_dir_path = os.path.expanduser("~/.ssh")
for f_name in sshd_key_paths:
- with open(f_name, 'r') as f:
- srv_keys.append(load_pem_private_key(f.read(), None, backend))
- srv_pubkeys.append(srv_keys[-1].public_key())
+ try:
+ with open(f_name, 'r') as f:
+ srv_keys.append(load_pem_private_key(f.read(),
+ None,
+ backend))
+ srv_pubkeys.append(srv_keys[-1].public_key())
+ except:
+ continue
with open(ssh_dir_path+"/authorized_keys", 'r') as f:
for line in f.readlines():
- authorized_keys.append(load_ssh_public_key(line, backend))
+ try:
+ authorized_keys.append(load_ssh_public_key(line, backend))
+ except:
+ continue
msg = self.recv_msg()
if msg["type"] != "ssh_client_hello":
raise SecSocketException("Handshake failed.")
- ctl_ssh_pubkey = load_pem_public_key(msg["ctl_ssh_pubkey"], backend)
+ try:
+ ctl_ssh_pubkey = load_pem_public_key(msg["ctl_ssh_pubkey"],
+ backend)
+ except:
+ raise SecSocketException("Handshake failed.")
authorized = False
for key in authorized_keys:
@@ -240,7 +259,10 @@ class SlaveSecSocket(SecureSocket):
if msg["type"] != "pubkey_client_hello":
raise SecSocketException("Handshake failed.")
ctl_identity = msg["identity"]
- ctl_pubkey = load_pem_public_key(msg["ctl_pubkey"], backend)
+ try:
+ ctl_pubkey = load_pem_public_key(msg["ctl_pubkey"], backend)
+ except:
+ raise SecSocketException("Handshake failed.")
local_ctl_pubkey = client_pubkeys[ctl_identity]
--
2.7.2