From 33cff21882b6782c20b054e6e8adcf94b5e09561 Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Mon, 5 May 2025 08:53:53 -0400 Subject: [PATCH] Switch to atomic fetch of password in serversession Give an implementation a guarantee of atomic access of the password so that something strange can't happen between the initial check and actual use of the value. Change-Id: I48ae5d8a9c3fb3fea5ec2deeb14fec39aac86ed8 --- pyghmi/ipmi/private/serversession.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pyghmi/ipmi/private/serversession.py b/pyghmi/ipmi/private/serversession.py index 8a75a6fc..ee23d317 100644 --- a/pyghmi/ipmi/private/serversession.py +++ b/pyghmi/ipmi/private/serversession.py @@ -108,7 +108,8 @@ class ServerSession(ipmisession.Session): # ignore null username for now return self.username = bytes(data[28:]) - if self.username.decode('utf-8') not in self.authdata: + password = self.authdata.get(self.username.decode('utf-8')) + if password is None: # don't think about invalid usernames for now return uuidbytes = self.uuid.bytes @@ -118,8 +119,7 @@ class ServerSession(ipmisession.Session): + self.Rm + self.Rc + uuidbytes + bytearray([self.rolem, len(self.username)])) hmacdata += self.username - self.kuid = self.authdata[self.username.decode('utf-8')].encode( - 'utf-8') + self.kuid = password.encode('utf-8') if self.kg is None: self.kg = self.kuid authcode = hmac.new(