forked from rpms/leapp-repository
96 lines
4.7 KiB
Diff
96 lines
4.7 KiB
Diff
From 4105452bc89b36359124f5a20d17b73b7512a928 Mon Sep 17 00:00:00 2001
|
|
From: karolinku <kkula@redhat.com>
|
|
Date: Mon, 15 Dec 2025 12:16:03 +0100
|
|
Subject: [PATCH 087/111] Handle invalid values for case-sensitive SSH options
|
|
|
|
Catch ModelViolationError when parsing sshd configuration files that
|
|
contain invalid values for case-sensitive options like PermitRootLogin
|
|
and UsePrivilegeSeparation.
|
|
|
|
This change provides a clear error message
|
|
explaining that arguments are case-sensitive and lists the valid values
|
|
based on the model definition.
|
|
|
|
Jira: RHEL-19247
|
|
---
|
|
.../libraries/readopensshconfig.py | 26 ++++++++++++++++++-
|
|
..._readopensshconfig_opensshconfigscanner.py | 13 ++++++++++
|
|
2 files changed, 38 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/repos/system_upgrade/common/actors/opensshconfigscanner/libraries/readopensshconfig.py b/repos/system_upgrade/common/actors/opensshconfigscanner/libraries/readopensshconfig.py
|
|
index 50e37092..f467676b 100644
|
|
--- a/repos/system_upgrade/common/actors/opensshconfigscanner/libraries/readopensshconfig.py
|
|
+++ b/repos/system_upgrade/common/actors/opensshconfigscanner/libraries/readopensshconfig.py
|
|
@@ -7,6 +7,7 @@ from leapp.exceptions import StopActorExecutionError
|
|
from leapp.libraries.common.rpms import check_file_modification
|
|
from leapp.libraries.stdlib import api
|
|
from leapp.models import OpenSshConfig, OpenSshPermitRootLogin
|
|
+from leapp.models.fields import ModelViolationError
|
|
|
|
CONFIG = '/etc/ssh/sshd_config'
|
|
DEPRECATED_DIRECTIVES = ['showpatchlevel']
|
|
@@ -60,12 +61,35 @@ def parse_config(config, base_config=None, current_cfg_depth=0):
|
|
# convert deprecated alias
|
|
if value == "without-password":
|
|
value = "prohibit-password"
|
|
- v = OpenSshPermitRootLogin(value=value, in_match=in_match)
|
|
+ try:
|
|
+ v = OpenSshPermitRootLogin(value=value, in_match=in_match)
|
|
+ except ModelViolationError:
|
|
+ valid_values = OpenSshPermitRootLogin.value.serialize()['choices']
|
|
+ raise StopActorExecutionError(
|
|
+ 'Invalid SSH configuration: Invalid value for PermitRootLogin',
|
|
+ details={
|
|
+ 'details': 'Invalid value "{}" for PermitRootLogin in {}. '
|
|
+ 'Arguments for SSH configuration options are case-sensitive. '
|
|
+ 'Valid values are: {}.'
|
|
+ .format(value, CONFIG, ', '.join(valid_values))
|
|
+ }
|
|
+ )
|
|
ret.permit_root_login.append(v)
|
|
|
|
elif el[0].lower() == 'useprivilegeseparation':
|
|
# Record only first occurrence, which is effective
|
|
if not ret.use_privilege_separation:
|
|
+ valid_values = OpenSshConfig.use_privilege_separation.serialize()['choices']
|
|
+ if value not in valid_values:
|
|
+ raise StopActorExecutionError(
|
|
+ 'Invalid SSH configuration: Invalid value for UsePrivilegeSeparation',
|
|
+ details={
|
|
+ 'details': 'Invalid value "{}" for UsePrivilegeSeparation in {}. '
|
|
+ 'Arguments for SSH configuration options are case-sensitive. '
|
|
+ 'Valid values are: {}.'
|
|
+ .format(value, CONFIG, ', '.join(valid_values))
|
|
+ }
|
|
+ )
|
|
ret.use_privilege_separation = value
|
|
|
|
elif el[0].lower() == 'protocol':
|
|
diff --git a/repos/system_upgrade/common/actors/opensshconfigscanner/tests/test_readopensshconfig_opensshconfigscanner.py b/repos/system_upgrade/common/actors/opensshconfigscanner/tests/test_readopensshconfig_opensshconfigscanner.py
|
|
index 64c16f7f..1a6a1c9f 100644
|
|
--- a/repos/system_upgrade/common/actors/opensshconfigscanner/tests/test_readopensshconfig_opensshconfigscanner.py
|
|
+++ b/repos/system_upgrade/common/actors/opensshconfigscanner/tests/test_readopensshconfig_opensshconfigscanner.py
|
|
@@ -351,6 +351,19 @@ def test_produce_config():
|
|
assert cfg.subsystem_sftp == 'internal-sftp'
|
|
|
|
|
|
+@pytest.mark.parametrize('config_line,option_name,invalid_value', [
|
|
+ ('PermitRootLogin NO', 'PermitRootLogin', 'NO'),
|
|
+ ('UsePrivilegeSeparation YES', 'UsePrivilegeSeparation', 'YES'),
|
|
+])
|
|
+def test_parse_config_invalid_option_case(config_line, option_name, invalid_value):
|
|
+ config = [config_line]
|
|
+
|
|
+ with pytest.raises(StopActorExecutionError) as err:
|
|
+ parse_config(config)
|
|
+
|
|
+ assert str(err.value).startswith('Invalid SSH configuration')
|
|
+
|
|
+
|
|
def test_actor_execution(current_actor_context):
|
|
current_actor_context.run()
|
|
assert current_actor_context.consume(OpenSshConfig)
|
|
--
|
|
2.52.0
|
|
|