[master/rhel7] Display a fatal error if unable to encrypt a password. (#1057032)

Vratislav Podzimek vpodzime at redhat.com
Wed Aug 6 13:32:23 UTC 2014


On Wed, 2014-08-06 at 08:44 -0400, David Shea wrote:
> Python's crypt.crypt silently fails if asked to encrypt using an
> unavailable algorithm, such as if MD5 is specified but FIPS-mode is on.
> Instead of crashing in somewhere surprising that can't handle a password
> of None, raise an error through the error dialog.
> ---
>  pyanaconda/errors.py | 14 +++++++++++++-
>  pyanaconda/users.py  |  9 ++++++++-
>  2 files changed, 21 insertions(+), 2 deletions(-)
> 
> diff --git a/pyanaconda/errors.py b/pyanaconda/errors.py
> index 744f0f5..1f228ff 100644
> --- a/pyanaconda/errors.py
> +++ b/pyanaconda/errors.py
> @@ -44,6 +44,11 @@ class ScriptError(Exception):
>  class CmdlineError(Exception):
>      pass
>  
> +class PasswordCryptError(Exception):
> +    def __init__(self, algo):
> +        Exception.__init__(self)
> +        self.algo = algo
> +
>  # These constants are returned by the callback in the ErrorHandler class.
>  # Each represents a different kind of action the caller can take:
>  #
> @@ -228,6 +233,12 @@ class ErrorHandler(object):
>          self.ui.showDetailedError(message, details)
>          return ERROR_RAISE
>  
> +    def _passwordCryptErrorHandler(self, exn):
> +        message = _("Unable to encrypt password: unsupported algorithm %s") % exn.algo
> +
> +        self.ui.showError(message)
> +        return ERROR_RAISE
> +
>      def cb(self, exn, *args, **kwargs):
>          """This method is the callback that all error handling should pass
>             through.  The return value is one of the ERROR_* constants defined
> @@ -260,7 +271,8 @@ class ErrorHandler(object):
>                  "NoSuchPackage": self._noSuchPackageHandler,
>                  "ScriptError": self._scriptErrorHandler,
>                  "PayloadInstallError": self._payloadInstallHandler,
> -                "DependencyError": self._dependencyErrorHandler}
> +                "DependencyError": self._dependencyErrorHandler,
> +                "PasswordCryptError": self._passwordCryptErrorHandler}
>  
>          if exn.__class__.__name__ in _map:
>              kwargs["exception"] = exn
> diff --git a/pyanaconda/users.py b/pyanaconda/users.py
> index 2e40465..f23e987 100644
> --- a/pyanaconda/users.py
> +++ b/pyanaconda/users.py
> @@ -31,6 +31,7 @@ import pwquality
>  import re
>  from pyanaconda.iutil import strip_accents
>  from pyanaconda.i18n import _
> +from pyanaconda.errors import errorHandler, PasswordCryptError, ERROR_RAISE
>  
>  import logging
>  log = logging.getLogger("anaconda")
> @@ -116,7 +117,13 @@ def cryptPassword(password, algo=None):
>          saltstr = saltstr + random.choice (string.letters +
>                                             string.digits + './')
>  
> -    return crypt.crypt (password, saltstr)
> +    cryptpw = crypt.crypt (password, saltstr)
> +    if cryptpw is None:
> +        exn = PasswordCryptError(algo=algo)
> +        if errorHandler.cb(exn) == ERROR_RAISE:
> +            raise exn
> +
> +    return cryptpw
>  
>  def validatePassword(pw, confirm, minlen=6):
>      # Do various steps to validate the password
Looks good to me.

-- 
Vratislav Podzimek

Anaconda Rider | Red Hat, Inc. | Brno - Czech Republic



More information about the anaconda-patches mailing list