|
 |
590d18 |
From 9eae8d891a8b5d5320cb38b8e697681802cbf573 Mon Sep 17 00:00:00 2001
|
|
|
590d18 |
From: Christian Heimes <cheimes@redhat.com>
|
|
|
590d18 |
Date: Thu, 23 Jul 2015 20:30:21 +0200
|
|
|
590d18 |
Subject: [PATCH] Asymmetric vault: validate public key in client
|
|
|
590d18 |
|
|
|
590d18 |
The ipa vault commands now load and validate the public key for
|
|
|
590d18 |
asymmetric encryption, before sending it to the server. This prevents
|
|
|
590d18 |
invalid vaults and prohibits accidental exposure of private key
|
|
|
590d18 |
material.
|
|
|
590d18 |
|
|
|
590d18 |
https://fedorahosted.org/freeipa/ticket/5142
|
|
|
590d18 |
https://fedorahosted.org/freeipa/ticket/5143
|
|
|
590d18 |
|
|
|
590d18 |
Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
|
|
|
590d18 |
---
|
|
|
590d18 |
ipalib/plugins/vault.py | 13 +++++++++++++
|
|
|
590d18 |
1 file changed, 13 insertions(+)
|
|
|
590d18 |
|
|
|
590d18 |
diff --git a/ipalib/plugins/vault.py b/ipalib/plugins/vault.py
|
|
|
590d18 |
index 055e8d00f1616c15b217e7570eeedd46efba7c81..ac608f5c7e2779da138c75a0f02bd5546f4aeffd 100644
|
|
|
590d18 |
--- a/ipalib/plugins/vault.py
|
|
|
590d18 |
+++ b/ipalib/plugins/vault.py
|
|
|
590d18 |
@@ -665,6 +665,19 @@ class vault_add(PKQuery, Local):
|
|
|
590d18 |
name='ipavaultpublickey',
|
|
|
590d18 |
error=_('Missing vault public key'))
|
|
|
590d18 |
|
|
|
590d18 |
+ # validate public key and prevent users from accidentally
|
|
|
590d18 |
+ # sending a private key to the server.
|
|
|
590d18 |
+ try:
|
|
|
590d18 |
+ load_pem_public_key(
|
|
|
590d18 |
+ data=public_key,
|
|
|
590d18 |
+ backend=default_backend()
|
|
|
590d18 |
+ )
|
|
|
590d18 |
+ except ValueError as e:
|
|
|
590d18 |
+ raise errors.ValidationError(
|
|
|
590d18 |
+ name='ipavaultpublickey',
|
|
|
590d18 |
+ error=_('Invalid or unsupported vault public key: %s') % e,
|
|
|
590d18 |
+ )
|
|
|
590d18 |
+
|
|
|
590d18 |
# create vault
|
|
|
590d18 |
response = self.api.Command.vault_add_internal(*args, **options)
|
|
|
590d18 |
|
|
|
590d18 |
--
|
|
|
590d18 |
2.4.3
|
|
|
590d18 |
|