Change in vdsm[master]: password: Allow pickling of protected password
danken at redhat.com
danken at redhat.com
Tue Jul 7 22:46:36 UTC 2015
Dan Kenigsberg has submitted this change and it was merged.
Change subject: password: Allow pickling of protected password
......................................................................
password: Allow pickling of protected password
In commit 862d6440176c (password: Prevent password logging and
persisting), we bloked pickling of protected passwords, to prevent
accidental persisting of sensitive information.
Turns out that when using iSCSI CHAP authentication, supervdsm is
running iscsi.readSessionInfo(), returning a protected password. Under
the hood, it tries to pickle the results and fails.
We raise a very clear error when trying to pickle a ProtectePassword:
TypeError: ProtectedPassword object cannot be pickled
However, this error is swallowed in supervdsm or in the underlying
multiprocessing magic, and we get this unhelpful error in vdsm:
RuntimeError: Broken communication with supervdsm. Failed call to
readSessionInfo
Since we run lot of code via supervdsm, and returning objects
transparently is extremely convenient, it seems that blocking pickling
was not a good idea.
This patch enables pickling of ProtectedPassword, fixing iSCSI storage
when using CHAP authentication.
Change-Id: I198f418d88348a2bae33b71e323a9741ae295d30
Signed-off-by: Nir Soffer <nsoffer at redhat.com>
Reviewed-on: https://gerrit.ovirt.org/43256
Continuous-Integration: Jenkins CI
Reviewed-by: Piotr Kliczewski <piotr.kliczewski at gmail.com>
Reviewed-by: Dan Kenigsberg <danken at redhat.com>
---
M lib/vdsm/password.py
M tests/passwordsTests.py
2 files changed, 3 insertions(+), 6 deletions(-)
Approvals:
Piotr Kliczewski: Looks good to me, but someone else must approve
Nir Soffer: Verified
Jenkins CI: Passed CI tests
Dan Kenigsberg: Looks good to me, approved
--
To view, visit https://gerrit.ovirt.org/43256
To unsubscribe, visit https://gerrit.ovirt.org/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I198f418d88348a2bae33b71e323a9741ae295d30
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Piotr Kliczewski <piotr.kliczewski at gmail.com>
Gerrit-Reviewer: automation at ovirt.org
More information about the vdsm-patches
mailing list