Bug 510733 - ipa pwpolicy minclasses: Need to define and enforce acceptable data ranges
ipa pwpolicy minclasses: Need to define and enforce acceptable data ranges
Status: CLOSED ERRATA
Product: freeIPA
Classification: Community
Component: ipa-admintools (Show other bugs)
2.0
All Linux
high Severity medium
: ---
: ---
Assigned To: Dmitri Pal
Chandrasekar Kannan
:
Depends On:
Blocks: 431020
  Show dependency treegraph
 
Reported: 2009-07-10 10:10 EDT by Jenny Galipeau
Modified: 2015-01-04 18:39 EST (History)
4 users (show)

See Also:
Fixed In Version: freeipa-2.0.0-1.fc15
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-03-27 03:12:31 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jenny Galipeau 2009-07-10 10:10:11 EDT
Description of problem:

Right now there is no defined or enforce data ranges for minclasses.  You can define the minimum number of characters classes with positive integers up to 299999999.  There are only so many character classes and we should be limiting to that maximum number of actual supported classes.


[root@jennyv2 ~]# ipa pwpolicy-mod --minclasses=100000000099999999
ipa: ERROR: non-public: TypeError: value: need a <type 'int'>; got 100000000099999999L (a <type 'long'>)
Traceback (most recent call last):
  File "/usr/lib/python2.4/site-packages/ipalib/backend.py", line 110, in execute
    result = self.Command[_name](*args, **options)
  File "/usr/lib/python2.4/site-packages/ipalib/plugable.py", line 410, in __call__
    return self['__call__'](*args, **kw)
  File "/usr/lib/python2.4/site-packages/ipalib/frontend.py", line 396, in __call__
    self.validate(**params)
  File "/usr/lib/python2.4/site-packages/ipalib/frontend.py", line 583, in validate
    param.validate(value)
  File "/usr/lib/python2.4/site-packages/ipalib/parameters.py", line 622, in validate
    self._validate_scalar(value)
  File "/usr/lib/python2.4/site-packages/ipalib/parameters.py", line 630, in _validate_scalar
    raise TypeError(
TypeError: value: need a <type 'int'>; got 100000000099999999L (a <type 'long'>)
ipa: ERROR: an internal error has occurred
[root@jennyv2 ~]# echo $?
135


[root@jennyv2 ~]# ipa pwpolicy-mod --minclasses=1234567890
-------------
pwpolicy-mod:
-------------
Password policy:
  Minimum number of characters classes: 1234567890
-------------------------
Modified password policy.
-------------------------


Version-Release number of selected component (if applicable):
2.0

How reproducible:
always

Steps to Reproduce:
1. see definition for examples
2. 
3.
  
Actual results:
internal error when minclasses is defined over 299999999
values up to 299999999 are accepted

Expected results:
Proper error message and no traceback
only values up to max supported classes are accepted i.e...
  lower case alpha
  upper case alpha
  numberic
  special characters

Additional info:
Comment 1 Rob Crittenden 2009-07-10 10:17:46 EDT
Jason, perhaps we should put a default min/max into some of these classes to prevent this type of error.

We still need to put per-param min/max in this case I think but a default would at least prevent this type of exception.
Comment 2 Pavel Zuna 2009-11-23 08:25:03 EST
No more traceback.

There are 5 character classes according to Kerberos docs:
- lower-case letters 
- upper-case letters
- digits
- punctuation
- all other characters (e.g., control characters)

I'm pretty sure, this was fixed before, but the limit is gone now. Patch coming soon.
Comment 3 Jenny Galipeau 2011-06-10 15:55:52 EDT
verified

# ipa pwpolicy-mod --minclasses=100000000099999999
ipa: ERROR: invalid 'minclasses': can be at most 5

# ipa pwpolicy-mod --minclasses=1234567890
ipa: ERROR: invalid 'minclasses': can be at most 5

# ipa pwpolicy-mod --minclasses=6
ipa: ERROR: invalid 'minclasses': can be at most 5

# ipa pwpolicy-mod --minclasses=-1
ipa: ERROR: invalid 'minclasses': must be at least 0

# rpm -qi ipa-server | head
Name        : ipa-server                   Relocations: (not relocatable)
Version     : 2.0.0                             Vendor: Red Hat, Inc.
Release     : 23.el6                        Build Date: Wed 20 Apr 2011 09:57:13 AM EDT
Install Date: Thu 19 May 2011 12:47:52 PM EDT      Build Host: x86-003.build.bos.redhat.com
Group       : System Environment/Base       Source RPM: ipa-2.0.0-23.el6.src.rpm
Size        : 2565882                          License: GPLv3+
Signature   : RSA/8, Thu 21 Apr 2011 03:48:25 PM EDT, Key ID 199e2f91fd431d51
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
URL         : http://www.freeipa.org/
Summary     : The IPA authentication server

Note You need to log in before you can comment on or make changes to this bug.