瀏覽代碼

HUE-9494 [core] Patch hashlib md5 for FIPS

Ying Chen 5 年之前
父節點
當前提交
6013b1057a
共有 2 個文件被更改,包括 64 次插入11 次删除
  1. 49 11
      desktop/core/src/desktop/monkey_patches.py
  2. 15 0
      desktop/core/src/desktop/settings.py

+ 49 - 11
desktop/core/src/desktop/monkey_patches.py

@@ -15,13 +15,20 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import hashlib
+import imp
+import importlib
+import logging
 import re
+import sys
 
 from django.conf import settings
 from django.core.validators import RegexValidator
 from django.template.context import RequestContext
 from django.utils.module_loading import import_string
 
+LOG = logging.getLogger(__name__)
+
 
 def monkey_patch_username_validator():
   """
@@ -47,20 +54,22 @@ def monkey_patch_username_validator():
 _standard_context_processors = None
 _builtin_context_processors = ('django.template.context_processors.csrf',)
 
+
 # This is a function rather than module-level procedural code because we only
 # want it to execute if somebody uses RequestContext.
 def get_standard_processors():
-    global _standard_context_processors
-    if _standard_context_processors is None:
-        processors = []
-        collect = []
-        collect.extend(_builtin_context_processors)
-        collect.extend(settings.GTEMPLATE_CONTEXT_PROCESSORS)
-        for path in collect:
-            func = import_string(path)
-            processors.append(func)
-        _standard_context_processors = tuple(processors)
-    return _standard_context_processors
+  global _standard_context_processors
+  if _standard_context_processors is None:
+    processors = []
+    collect = []
+    collect.extend(_builtin_context_processors)
+    collect.extend(settings.GTEMPLATE_CONTEXT_PROCESSORS)
+    for path in collect:
+      func = import_string(path)
+      processors.append(func)
+    _standard_context_processors = tuple(processors)
+  return _standard_context_processors
+
 
 def monkey_patch_request_context_init(self, request, dict_=None, processors=None, use_l10n=None, use_tz=None, autoescape=True):
   super(RequestContext, self).__init__(
@@ -74,3 +83,32 @@ def monkey_patch_request_context_init(self, request, dict_=None, processors=None
   for processor in get_standard_processors():
     updates.update(processor(request))
   self.update(updates)
+
+
+def monkey_patch_md5(modules_to_patch):
+  """Monkey-patch calls to MD5 that aren't used for security purposes.
+
+  Sets RHEL's custom flag `usedforsecurity` to False allowing MD5 in FIPS mode.
+  `modules_to_patch` must be an iterable of module names (strings).
+  Modules must use `import hashlib` and not `from hashlib import md5`.
+  """
+  orig_hashlib_md5 = hashlib.md5
+  def _non_security_md5(*args, **kwargs):
+    kwargs['usedforsecurity'] = False
+    return orig_hashlib_md5(*args, **kwargs)
+
+  LOG.debug("Start monkey patch md5 ...")
+  if sys.version_info[0] > 2:
+    hashlib_spec = importlib.util.find_spec('hashlib')
+    patched_hashlib = importlib.util.module_from_spec(hashlib_spec)
+    hashlib_spec.loader.exec_module(patched_hashlib)
+  else:
+    patched_hashlib = imp.load_module('hashlib', *imp.find_module('hashlib'))
+
+  patched_hashlib.md5 = _non_security_md5
+
+  # Inject the patched hashlib for all requested modules
+  for module_name in modules_to_patch:
+    module = importlib.import_module(module_name)
+    module.hashlib = patched_hashlib
+  LOG.debug("Finish monkey patch md5 ...")

+ 15 - 0
desktop/core/src/desktop/settings.py

@@ -795,3 +795,18 @@ if desktop.conf.TRACING.ENABLED.get():
   OPENTRACING_TRACED_ATTRIBUTES = ['META']  # Only valid if OPENTRACING_TRACE_ALL == True
   if desktop.conf.TRACING.TRACE_ALL.get():
     MIDDLEWARE_CLASSES.insert(0, 'django_opentracing.OpenTracingMiddleware')
+
+MODULES_TO_PATCH = (
+    'django.contrib.staticfiles.storage',
+    'django.core.cache.backends.filebased',
+    'django.core.cache.utils',
+    'django.db.backends.utils',
+    'django.utils.cache',
+)
+
+try:
+  import hashlib
+  hashlib.md5()
+except ValueError:
+  from desktop.monkey_patches import monkey_patch_md5
+  monkey_patch_md5(MODULES_TO_PATCH)