Change in vdsm[master]: password: Allow pickling of protected password

danken at redhat.com danken at redhat.com
Tue Jul 7 22:46:36 UTC 2015


Dan Kenigsberg has submitted this change and it was merged.

Change subject: password: Allow pickling of protected password
......................................................................


password: Allow pickling of protected password

In commit 862d6440176c (password: Prevent password logging and
persisting), we bloked pickling of protected passwords, to prevent
accidental persisting of sensitive information.

Turns out that when using iSCSI CHAP authentication, supervdsm is
running iscsi.readSessionInfo(), returning a protected password. Under
the hood, it tries to pickle the results and fails.

We raise a very clear error when trying to pickle a ProtectePassword:

    TypeError: ProtectedPassword object cannot be pickled

However, this error is swallowed in supervdsm or in the underlying
multiprocessing magic, and we get this unhelpful error in vdsm:

    RuntimeError: Broken communication with supervdsm. Failed call to
    readSessionInfo

Since we run lot of code via supervdsm, and returning objects
transparently is extremely convenient, it seems that blocking pickling
was not a good idea.

This patch enables pickling of ProtectedPassword, fixing iSCSI storage
when using CHAP authentication.

Change-Id: I198f418d88348a2bae33b71e323a9741ae295d30
Signed-off-by: Nir Soffer <nsoffer at redhat.com>
Reviewed-on: https://gerrit.ovirt.org/43256
Continuous-Integration: Jenkins CI
Reviewed-by: Piotr Kliczewski <piotr.kliczewski at gmail.com>
Reviewed-by: Dan Kenigsberg <danken at redhat.com>
---
M lib/vdsm/password.py
M tests/passwordsTests.py
2 files changed, 3 insertions(+), 6 deletions(-)

Approvals:
  Piotr Kliczewski: Looks good to me, but someone else must approve
  Nir Soffer: Verified
  Jenkins CI: Passed CI tests
  Dan Kenigsberg: Looks good to me, approved



-- 
To view, visit https://gerrit.ovirt.org/43256
To unsubscribe, visit https://gerrit.ovirt.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: I198f418d88348a2bae33b71e323a9741ae295d30
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Dan Kenigsberg <danken at redhat.com>
Gerrit-Reviewer: Jenkins CI
Gerrit-Reviewer: Nir Soffer <nsoffer at redhat.com>
Gerrit-Reviewer: Piotr Kliczewski <piotr.kliczewski at gmail.com>
Gerrit-Reviewer: automation at ovirt.org


More information about the vdsm-patches mailing list