|
@@ -15,13 +15,20 @@
|
|
|
# See the License for the specific language governing permissions and
|
|
# See the License for the specific language governing permissions and
|
|
|
# limitations under the License.
|
|
# limitations under the License.
|
|
|
|
|
|
|
|
|
|
+import hashlib
|
|
|
|
|
+import imp
|
|
|
|
|
+import importlib
|
|
|
|
|
+import logging
|
|
|
import re
|
|
import re
|
|
|
|
|
+import sys
|
|
|
|
|
|
|
|
from django.conf import settings
|
|
from django.conf import settings
|
|
|
from django.core.validators import RegexValidator
|
|
from django.core.validators import RegexValidator
|
|
|
from django.template.context import RequestContext
|
|
from django.template.context import RequestContext
|
|
|
from django.utils.module_loading import import_string
|
|
from django.utils.module_loading import import_string
|
|
|
|
|
|
|
|
|
|
+LOG = logging.getLogger(__name__)
|
|
|
|
|
+
|
|
|
|
|
|
|
|
def monkey_patch_username_validator():
|
|
def monkey_patch_username_validator():
|
|
|
"""
|
|
"""
|
|
@@ -47,20 +54,22 @@ def monkey_patch_username_validator():
|
|
|
_standard_context_processors = None
|
|
_standard_context_processors = None
|
|
|
_builtin_context_processors = ('django.template.context_processors.csrf',)
|
|
_builtin_context_processors = ('django.template.context_processors.csrf',)
|
|
|
|
|
|
|
|
|
|
+
|
|
|
# This is a function rather than module-level procedural code because we only
|
|
# This is a function rather than module-level procedural code because we only
|
|
|
# want it to execute if somebody uses RequestContext.
|
|
# want it to execute if somebody uses RequestContext.
|
|
|
def get_standard_processors():
|
|
def get_standard_processors():
|
|
|
- global _standard_context_processors
|
|
|
|
|
- if _standard_context_processors is None:
|
|
|
|
|
- processors = []
|
|
|
|
|
- collect = []
|
|
|
|
|
- collect.extend(_builtin_context_processors)
|
|
|
|
|
- collect.extend(settings.GTEMPLATE_CONTEXT_PROCESSORS)
|
|
|
|
|
- for path in collect:
|
|
|
|
|
- func = import_string(path)
|
|
|
|
|
- processors.append(func)
|
|
|
|
|
- _standard_context_processors = tuple(processors)
|
|
|
|
|
- return _standard_context_processors
|
|
|
|
|
|
|
+ global _standard_context_processors
|
|
|
|
|
+ if _standard_context_processors is None:
|
|
|
|
|
+ processors = []
|
|
|
|
|
+ collect = []
|
|
|
|
|
+ collect.extend(_builtin_context_processors)
|
|
|
|
|
+ collect.extend(settings.GTEMPLATE_CONTEXT_PROCESSORS)
|
|
|
|
|
+ for path in collect:
|
|
|
|
|
+ func = import_string(path)
|
|
|
|
|
+ processors.append(func)
|
|
|
|
|
+ _standard_context_processors = tuple(processors)
|
|
|
|
|
+ return _standard_context_processors
|
|
|
|
|
+
|
|
|
|
|
|
|
|
def monkey_patch_request_context_init(self, request, dict_=None, processors=None, use_l10n=None, use_tz=None, autoescape=True):
|
|
def monkey_patch_request_context_init(self, request, dict_=None, processors=None, use_l10n=None, use_tz=None, autoescape=True):
|
|
|
super(RequestContext, self).__init__(
|
|
super(RequestContext, self).__init__(
|
|
@@ -74,3 +83,32 @@ def monkey_patch_request_context_init(self, request, dict_=None, processors=None
|
|
|
for processor in get_standard_processors():
|
|
for processor in get_standard_processors():
|
|
|
updates.update(processor(request))
|
|
updates.update(processor(request))
|
|
|
self.update(updates)
|
|
self.update(updates)
|
|
|
|
|
+
|
|
|
|
|
+
|
|
|
|
|
+def monkey_patch_md5(modules_to_patch):
|
|
|
|
|
+ """Monkey-patch calls to MD5 that aren't used for security purposes.
|
|
|
|
|
+
|
|
|
|
|
+ Sets RHEL's custom flag `usedforsecurity` to False allowing MD5 in FIPS mode.
|
|
|
|
|
+ `modules_to_patch` must be an iterable of module names (strings).
|
|
|
|
|
+ Modules must use `import hashlib` and not `from hashlib import md5`.
|
|
|
|
|
+ """
|
|
|
|
|
+ orig_hashlib_md5 = hashlib.md5
|
|
|
|
|
+ def _non_security_md5(*args, **kwargs):
|
|
|
|
|
+ kwargs['usedforsecurity'] = False
|
|
|
|
|
+ return orig_hashlib_md5(*args, **kwargs)
|
|
|
|
|
+
|
|
|
|
|
+ LOG.debug("Start monkey patch md5 ...")
|
|
|
|
|
+ if sys.version_info[0] > 2:
|
|
|
|
|
+ hashlib_spec = importlib.util.find_spec('hashlib')
|
|
|
|
|
+ patched_hashlib = importlib.util.module_from_spec(hashlib_spec)
|
|
|
|
|
+ hashlib_spec.loader.exec_module(patched_hashlib)
|
|
|
|
|
+ else:
|
|
|
|
|
+ patched_hashlib = imp.load_module('hashlib', *imp.find_module('hashlib'))
|
|
|
|
|
+
|
|
|
|
|
+ patched_hashlib.md5 = _non_security_md5
|
|
|
|
|
+
|
|
|
|
|
+ # Inject the patched hashlib for all requested modules
|
|
|
|
|
+ for module_name in modules_to_patch:
|
|
|
|
|
+ module = importlib.import_module(module_name)
|
|
|
|
|
+ module.hashlib = patched_hashlib
|
|
|
|
|
+ LOG.debug("Finish monkey patch md5 ...")
|