Mercurial > p > roundup > code
annotate roundup/password.py @ 7752:b2dbab2b34bc
fix(refactor): multiple fixups using ruff linter; more testing.
Converting to using the ruff linter and its rulesets. Fixed a number
of issues.
admin.py:
sort imports
use immutable tuples as default value markers for parameters where a
None value is valid.
reduced some loops to list comprehensions for performance
used ternary to simplify some if statements
named some variables to make them less magic
(e.g. _default_savepoint_setting = 1000)
fixed some tests for argument counts < 2 becomes != 2 so 3 is an
error.
moved exception handlers outside of loops for performance where
exception handler will abort loop anyway.
renamed variables called 'id' or 'dir' as they shadow builtin
commands.
fix translations of form _("string %s" % value) -> _("string %s") %
value so translation will be looked up with the key before
substitution.
end dicts, tuples with a trailing comma to reduce missing comma
errors if modified
simplified sorted(list(self.setting.keys())) to
sorted(self.setting.keys()) as sorted consumes whole list.
in if conditions put compared variable on left and threshold condition
on right. (no yoda conditions)
multiple noqa: suppression
removed unneeded noqa as lint rulesets are a bit different
do_get - refactor output printing logic: Use fast return if not
special formatting is requested; use isinstance with a tuple
rather than two isinstance calls; cleaned up flow and removed
comments on algorithm as it can be easily read from the code.
do_filter, do_find - refactor output printing logic. Reduce
duplicate code.
do_find - renamed variable 'value' that was set inside a loop. The
loop index variable was also named 'value'.
do_pragma - added hint to use list subcommand if setting was not
found. Replaced condition 'type(x) is bool' with 'isinstance(x,
bool)' for various types.
test_admin.py
added testing for do_list
better test coverage for do_get includes: -S and -d for multilinks,
error case for -d with non-link.
better testing for do_find including all output modes
better testing for do_filter including all output modes
fixed expected output for do_pragma that now includes hint to use
pragma list if setting not found.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Fri, 01 Mar 2024 14:53:18 -0500 |
| parents | 70a6ee453ddc |
| children | 897c23876e9f |
| rev | line source |
|---|---|
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
1 # |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
2 # Copyright (c) 2001 Bizar Software Pty Ltd (http://www.bizarsoftware.com.au/) |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
3 # This module is free software, and you may redistribute it and/or modify |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
4 # under the same terms as Python, so long as this copyright message and |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
5 # disclaimer are retained in their original form. |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
6 # |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
7 # IN NO EVENT SHALL BIZAR SOFTWARE PTY LTD BE LIABLE TO ANY PARTY FOR |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
8 # DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
9 # OUT OF THE USE OF THIS CODE, EVEN IF THE AUTHOR HAS BEEN ADVISED OF THE |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
10 # POSSIBILITY OF SUCH DAMAGE. |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
11 # |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
12 # BIZAR SOFTWARE PTY LTD SPECIFICALLY DISCLAIMS ANY WARRANTIES, INCLUDING, |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
13 # BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
14 # FOR A PARTICULAR PURPOSE. THE CODE PROVIDED HEREUNDER IS ON AN "AS IS" |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
15 # BASIS, AND THERE IS NO OBLIGATION WHATSOEVER TO PROVIDE MAINTENANCE, |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
16 # SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS. |
|
3434
1f860b50fa5f
encodePassword: don't trim the salt string...
Alexander Smishlajev <a1s@users.sourceforge.net>
parents:
2277
diff
changeset
|
17 # |
|
2005
fc52d57c6c3e
documentation cleanup
Richard Jones <richard@users.sourceforge.net>
parents:
1905
diff
changeset
|
18 """Password handling (encoding, decoding). |
|
406
bdc2ea127ae9
Added module docstrings to all modules.
Jürgen Hermann <jhermann@users.sourceforge.net>
parents:
302
diff
changeset
|
19 """ |
|
2005
fc52d57c6c3e
documentation cleanup
Richard Jones <richard@users.sourceforge.net>
parents:
1905
diff
changeset
|
20 __docformat__ = 'restructuredtext' |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
21 |
|
7177
d787f7282ea3
Move imports to top of file out of test code path.
John Rouillard <rouilj@ieee.org>
parents:
7167
diff
changeset
|
22 import os |
|
6981
aa629aebac41
flake8 - import order, spacing
John Rouillard <rouilj@ieee.org>
parents:
6717
diff
changeset
|
23 import re |
|
aa629aebac41
flake8 - import order, spacing
John Rouillard <rouilj@ieee.org>
parents:
6717
diff
changeset
|
24 import string |
|
7177
d787f7282ea3
Move imports to top of file out of test code path.
John Rouillard <rouilj@ieee.org>
parents:
7167
diff
changeset
|
25 import sys |
|
6981
aa629aebac41
flake8 - import order, spacing
John Rouillard <rouilj@ieee.org>
parents:
6717
diff
changeset
|
26 import warnings |
|
aa629aebac41
flake8 - import order, spacing
John Rouillard <rouilj@ieee.org>
parents:
6717
diff
changeset
|
27 |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
28 from base64 import b64encode, b64decode |
|
7201
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
29 from hashlib import md5, sha1, sha512 |
|
4982
9ba03348f923
Remove roundup/anypy/hashlib_.py
John Kristensen <john@jerrykan.com>
parents:
4760
diff
changeset
|
30 |
|
7403
770fffae8167
Fix random_ import to use from import rather than import as
John Rouillard <rouilj@ieee.org>
parents:
7300
diff
changeset
|
31 from roundup.anypy import random_ |
|
5416
56c9bcdea47f
Python 3 preparation: unicode.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5415
diff
changeset
|
32 |
|
6981
aa629aebac41
flake8 - import order, spacing
John Rouillard <rouilj@ieee.org>
parents:
6717
diff
changeset
|
33 from roundup.anypy.strings import us2s, b2s, s2b |
|
7167
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
34 from roundup.exceptions import RoundupException |
|
6717
469ad03e6cb8
Ignore crypt deprication warning
John Rouillard <rouilj@ieee.org>
parents:
6626
diff
changeset
|
35 |
|
1229
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
36 try: |
|
6717
469ad03e6cb8
Ignore crypt deprication warning
John Rouillard <rouilj@ieee.org>
parents:
6626
diff
changeset
|
37 with warnings.catch_warnings(): |
|
469ad03e6cb8
Ignore crypt deprication warning
John Rouillard <rouilj@ieee.org>
parents:
6626
diff
changeset
|
38 warnings.filterwarnings("ignore", category=DeprecationWarning) |
|
469ad03e6cb8
Ignore crypt deprication warning
John Rouillard <rouilj@ieee.org>
parents:
6626
diff
changeset
|
39 import crypt |
|
4089
eddb82d0964c
Add compatibility package to allow us to deal with Python versions 2.3..2.6.
Richard Jones <richard@users.sourceforge.net>
parents:
3439
diff
changeset
|
40 except ImportError: |
|
1229
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
41 crypt = None |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
42 |
|
5428
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
43 _bempty = b"" |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
44 _bjoin = _bempty.join |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
45 |
|
7228
07ce4e4110f5
flake8 fixes: whitespace, remove unused imports
John Rouillard <rouilj@ieee.org>
parents:
7220
diff
changeset
|
46 |
|
7167
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
47 class ConfigNotSet(RoundupException): |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
48 pass |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
49 |
|
7228
07ce4e4110f5
flake8 fixes: whitespace, remove unused imports
John Rouillard <rouilj@ieee.org>
parents:
7220
diff
changeset
|
50 |
|
5428
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
51 def bchr(c): |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
52 if bytes == str: |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
53 # Python 2. |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
54 return chr(c) |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
55 else: |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
56 # Python 3. |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
57 return bytes((c,)) |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
58 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
59 |
|
5428
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
60 def bord(c): |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
61 if bytes == str: |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
62 # Python 2. |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
63 return ord(c) |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
64 else: |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
65 # Python 3. Elements of bytes are integers. |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
66 return c |
|
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
67 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
68 |
|
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
69 # NOTE: PBKDF2 hash is using this variant of base64 to minimize encoding size, |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
70 # and have charset that's compatible w/ unix crypt variants |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
71 def h64encode(data): |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
72 """encode using variant of base64""" |
|
5428
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
73 return b2s(b64encode(data, b"./").strip(b"=\n")) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
74 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
75 |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
76 def h64decode(data): |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
77 """decode using variant of base64""" |
|
5428
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
78 data = s2b(data) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
79 off = len(data) % 4 |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
80 if off == 0: |
|
5428
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
81 return b64decode(data, b"./") |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
82 elif off == 1: |
|
4683
2f66d44616ad
windows: Fix failing password tests due to missing crypt module
anatoly techtonik <techtonik@gmail.com>
parents:
4570
diff
changeset
|
83 raise ValueError("Invalid base64 input") |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
84 elif off == 2: |
|
5428
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
85 return b64decode(data + b"==", b"./") |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
86 else: |
|
5428
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
87 return b64decode(data + b"=", b"./") |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
88 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
89 |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
90 try: |
|
5483
3d0f71775e42
use PBKDF2 implementation from Python's hashlib, if available
Christof Meerwald <cmeerw@cmeerw.org>
parents:
5454
diff
changeset
|
91 from hashlib import pbkdf2_hmac |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
92 |
|
5483
3d0f71775e42
use PBKDF2 implementation from Python's hashlib, if available
Christof Meerwald <cmeerw@cmeerw.org>
parents:
5454
diff
changeset
|
93 def _pbkdf2(password, salt, rounds, keylen): |
|
3d0f71775e42
use PBKDF2 implementation from Python's hashlib, if available
Christof Meerwald <cmeerw@cmeerw.org>
parents:
5454
diff
changeset
|
94 return pbkdf2_hmac('sha1', password, salt, rounds, keylen) |
|
7201
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
95 |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
96 def _pbkdf2_sha512(password, salt, rounds, keylen): |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
97 return pbkdf2_hmac('sha512', password, salt, rounds, keylen) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
98 except ImportError: |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
99 # no hashlib.pbkdf2_hmac - make our own pbkdf2 function |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
100 from struct import pack |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
101 from hmac import HMAC |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
102 |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
103 def xor_bytes(left, right): |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
104 "perform bitwise-xor of two byte-strings" |
|
6981
aa629aebac41
flake8 - import order, spacing
John Rouillard <rouilj@ieee.org>
parents:
6717
diff
changeset
|
105 return _bjoin(bchr(bord(l) ^ bord(r)) |
|
aa629aebac41
flake8 - import order, spacing
John Rouillard <rouilj@ieee.org>
parents:
6717
diff
changeset
|
106 for l, r in zip(left, right)) # noqa: E741 |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
107 |
|
7201
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
108 def _pbkdf2(password, salt, rounds, keylen, sha=sha1): |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
109 if sha not in [sha1, sha512]: |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
110 raise ValueError( |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
111 "Invalid sha value passed to _pbkdf2: %s" % sha) |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
112 if sha == sha512: |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
113 digest_size = 64 # sha512 generates 64-byte blocks. |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
114 else: |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
115 digest_size = 20 # sha1 generates 20-byte blocks |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
116 |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
117 total_blocks = int((keylen+digest_size-1)/digest_size) |
|
7201
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
118 hmac_template = HMAC(password, None, sha) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
119 out = _bempty |
|
5391
a391a071d045
Python 3 preparation: use range() instead of xrange().
Joseph Myers <jsm@polyomino.org.uk>
parents:
5378
diff
changeset
|
120 for i in range(1, total_blocks+1): |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
121 hmac = hmac_template.copy() |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
122 hmac.update(salt + pack(">L", i)) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
123 block = tmp = hmac.digest() |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
124 for _j in range(rounds-1): |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
125 hmac = hmac_template.copy() |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
126 hmac.update(tmp) |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
127 tmp = hmac.digest() |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
128 # TODO: need to speed up this call |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
129 block = xor_bytes(block, tmp) |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
130 out += block |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
131 return out[:keylen] |
|
7228
07ce4e4110f5
flake8 fixes: whitespace, remove unused imports
John Rouillard <rouilj@ieee.org>
parents:
7220
diff
changeset
|
132 |
|
7201
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
133 def _pbkdf2_sha512(password, salt, rounds, keylen): |
|
7228
07ce4e4110f5
flake8 fixes: whitespace, remove unused imports
John Rouillard <rouilj@ieee.org>
parents:
7220
diff
changeset
|
134 return _pbkdf2(password, salt, rounds, keylen, sha=sha512) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
135 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
136 |
|
5053
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
137 def ssha(password, salt): |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
138 ''' Make ssha digest from password and salt. |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
139 Based on code of Roberto Aguilar <roberto@baremetal.io> |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
140 https://gist.github.com/rca/7217540 |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
141 ''' |
|
6000
6c3826600610
Bandit - silence old hash warnings.
John Rouillard <rouilj@ieee.org>
parents:
5630
diff
changeset
|
142 shaval = sha1(password) # nosec |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
143 shaval.update(salt) |
|
6146
01e9634b81a4
fixed string encoding of SSHA encoded passwords in Python 3
Christof Meerwald <cmeerw@cmeerw.org>
parents:
6007
diff
changeset
|
144 ssha_digest = b2s(b64encode(shaval.digest() + salt).strip()) |
|
5053
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
145 return ssha_digest |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
146 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
147 |
|
7201
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
148 def pbkdf2_sha512(password, salt, rounds, keylen): |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
149 """PBKDF2-HMAC-SHA512 password-based key derivation |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
150 |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
151 :arg password: passphrase to use to generate key (if unicode, |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
152 converted to utf-8) |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
153 :arg salt: salt bytes to use when generating key |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
154 :param rounds: number of rounds to use to generate key |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
155 :arg keylen: number of bytes to generate |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
156 |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
157 If hashlib supports pbkdf2, uses it's implementation as backend. |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
158 |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
159 Unlike pbkdf2, this uses sha512 not sha1 as it's hash. |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
160 |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
161 :returns: |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
162 raw bytes of generated key |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
163 """ |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
164 password = s2b(us2s(password)) |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
165 if keylen > 64: |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
166 # This statement may be old. - not seeing issues in testing |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
167 # with keylen > 40. |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
168 # |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
169 # NOTE: pbkdf2 allows up to (2**31-1)*20 bytes, |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
170 # but m2crypto has issues on some platforms above 40, |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
171 # and such sizes aren't needed for a password hash anyways... |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
172 raise ValueError("key length too large") |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
173 if rounds < 1: |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
174 raise ValueError("rounds must be positive number") |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
175 return _pbkdf2_sha512(password, salt, rounds, keylen) |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
176 |
|
7228
07ce4e4110f5
flake8 fixes: whitespace, remove unused imports
John Rouillard <rouilj@ieee.org>
parents:
7220
diff
changeset
|
177 |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
178 def pbkdf2(password, salt, rounds, keylen): |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
179 """pkcs#5 password-based key derivation v2.0 |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
180 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
181 :arg password: passphrase to use to generate key (if unicode, |
|
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
182 converted to utf-8) |
|
5428
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
183 :arg salt: salt bytes to use when generating key |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
184 :param rounds: number of rounds to use to generate key |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
185 :arg keylen: number of bytes to generate |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
186 |
|
5483
3d0f71775e42
use PBKDF2 implementation from Python's hashlib, if available
Christof Meerwald <cmeerw@cmeerw.org>
parents:
5454
diff
changeset
|
187 If hashlib supports pbkdf2, uses it's implementation as backend. |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
188 |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
189 :returns: |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
190 raw bytes of generated key |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
191 """ |
|
5416
56c9bcdea47f
Python 3 preparation: unicode.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5415
diff
changeset
|
192 password = s2b(us2s(password)) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
193 if keylen > 40: |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
194 # NOTE: pbkdf2 allows up to (2**31-1)*20 bytes, |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
195 # but m2crypto has issues on some platforms above 40, |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
196 # and such sizes aren't needed for a password hash anyways... |
|
5378
35ea9b1efc14
Python 3 preparation: "raise" syntax.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5356
diff
changeset
|
197 raise ValueError("key length too large") |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
198 if rounds < 1: |
|
5378
35ea9b1efc14
Python 3 preparation: "raise" syntax.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5356
diff
changeset
|
199 raise ValueError("rounds must be positive number") |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
200 return _pbkdf2(password, salt, rounds, keylen) |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
201 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
202 |
|
1905
dc43e339e607
Centralised conversion of user-input data to hyperdb values
Richard Jones <richard@users.sourceforge.net>
parents:
1583
diff
changeset
|
203 class PasswordValueError(ValueError): |
|
4089
eddb82d0964c
Add compatibility package to allow us to deal with Python versions 2.3..2.6.
Richard Jones <richard@users.sourceforge.net>
parents:
3439
diff
changeset
|
204 """ The password value is not valid """ |
|
1905
dc43e339e607
Centralised conversion of user-input data to hyperdb values
Richard Jones <richard@users.sourceforge.net>
parents:
1583
diff
changeset
|
205 pass |
|
dc43e339e607
Centralised conversion of user-input data to hyperdb values
Richard Jones <richard@users.sourceforge.net>
parents:
1583
diff
changeset
|
206 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
207 |
|
4484
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
208 def pbkdf2_unpack(pbkdf2): |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
209 """ unpack pbkdf2 encrypted password into parts, |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
210 assume it has format "{rounds}${salt}${digest} |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
211 """ |
|
5416
56c9bcdea47f
Python 3 preparation: unicode.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5415
diff
changeset
|
212 pbkdf2 = us2s(pbkdf2) |
|
4484
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
213 try: |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
214 rounds, salt, digest = pbkdf2.split("$") |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
215 except ValueError: |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
216 raise PasswordValueError("invalid PBKDF2 hash (wrong number of " |
|
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
217 "separators)") |
|
4484
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
218 if rounds.startswith("0"): |
|
5378
35ea9b1efc14
Python 3 preparation: "raise" syntax.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5356
diff
changeset
|
219 raise PasswordValueError("invalid PBKDF2 hash (zero-padded rounds)") |
|
4484
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
220 try: |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
221 rounds = int(rounds) |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
222 except ValueError: |
|
5378
35ea9b1efc14
Python 3 preparation: "raise" syntax.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5356
diff
changeset
|
223 raise PasswordValueError("invalid PBKDF2 hash (invalid rounds)") |
|
4484
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
224 raw_salt = h64decode(salt) |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
225 return rounds, salt, raw_salt, digest |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
226 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
227 |
|
4486
693c75d56ebe
Add new config-option 'password_pbkdf2_default_rounds'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4485
diff
changeset
|
228 def encodePassword(plaintext, scheme, other=None, config=None): |
|
4089
eddb82d0964c
Add compatibility package to allow us to deal with Python versions 2.3..2.6.
Richard Jones <richard@users.sourceforge.net>
parents:
3439
diff
changeset
|
229 """Encrypt the plaintext password. |
|
eddb82d0964c
Add compatibility package to allow us to deal with Python versions 2.3..2.6.
Richard Jones <richard@users.sourceforge.net>
parents:
3439
diff
changeset
|
230 """ |
|
1343
2e557762ee87
fixed handling of missing password [SF#655632]
Richard Jones <richard@users.sourceforge.net>
parents:
1231
diff
changeset
|
231 if plaintext is None: |
|
2e557762ee87
fixed handling of missing password [SF#655632]
Richard Jones <richard@users.sourceforge.net>
parents:
1231
diff
changeset
|
232 plaintext = "" |
|
7220
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
233 if scheme in ["PBKDF2", "PBKDF2S5"]: # all PBKDF schemes |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
234 if other: |
|
4484
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
235 rounds, salt, raw_salt, digest = pbkdf2_unpack(other) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
236 else: |
|
5488
52cb53eedf77
reworked random number use
Christof Meerwald <cmeerw@cmeerw.org>
parents:
5483
diff
changeset
|
237 raw_salt = random_.token_bytes(20) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
238 salt = h64encode(raw_salt) |
|
4486
693c75d56ebe
Add new config-option 'password_pbkdf2_default_rounds'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4485
diff
changeset
|
239 if config: |
|
693c75d56ebe
Add new config-option 'password_pbkdf2_default_rounds'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4485
diff
changeset
|
240 rounds = config.PASSWORD_PBKDF2_DEFAULT_ROUNDS |
|
7183
2de72f75f2f8
Production PBKDF rounds back to 2M, test 1k; fix empty_form (python2)
John Rouillard <rouilj@ieee.org>
parents:
7177
diff
changeset
|
241 |
|
2de72f75f2f8
Production PBKDF rounds back to 2M, test 1k; fix empty_form (python2)
John Rouillard <rouilj@ieee.org>
parents:
7177
diff
changeset
|
242 # if we are testing |
|
7228
07ce4e4110f5
flake8 fixes: whitespace, remove unused imports
John Rouillard <rouilj@ieee.org>
parents:
7220
diff
changeset
|
243 if ("pytest" in sys.modules and |
|
7183
2de72f75f2f8
Production PBKDF rounds back to 2M, test 1k; fix empty_form (python2)
John Rouillard <rouilj@ieee.org>
parents:
7177
diff
changeset
|
244 "PYTEST_CURRENT_TEST" in os.environ): |
|
2de72f75f2f8
Production PBKDF rounds back to 2M, test 1k; fix empty_form (python2)
John Rouillard <rouilj@ieee.org>
parents:
7177
diff
changeset
|
245 if ("PYTEST_USE_CONFIG" in os.environ): |
|
2de72f75f2f8
Production PBKDF rounds back to 2M, test 1k; fix empty_form (python2)
John Rouillard <rouilj@ieee.org>
parents:
7177
diff
changeset
|
246 rounds = config.PASSWORD_PBKDF2_DEFAULT_ROUNDS |
|
2de72f75f2f8
Production PBKDF rounds back to 2M, test 1k; fix empty_form (python2)
John Rouillard <rouilj@ieee.org>
parents:
7177
diff
changeset
|
247 else: |
|
2de72f75f2f8
Production PBKDF rounds back to 2M, test 1k; fix empty_form (python2)
John Rouillard <rouilj@ieee.org>
parents:
7177
diff
changeset
|
248 # Use 1000 rounds unless the test signals it |
|
7220
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
249 # wants the config number by setting |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
250 # PYTEST_USE_CONFIG. Using the production |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
251 # rounds value of 2,000,000 (for sha1) makes |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
252 # testing increase from 12 minutes to 1 hour in CI. |
|
7183
2de72f75f2f8
Production PBKDF rounds back to 2M, test 1k; fix empty_form (python2)
John Rouillard <rouilj@ieee.org>
parents:
7177
diff
changeset
|
253 rounds = 1000 |
|
4486
693c75d56ebe
Add new config-option 'password_pbkdf2_default_rounds'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4485
diff
changeset
|
254 else: |
|
7167
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
255 if ("pytest" in sys.modules and |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
256 "PYTEST_CURRENT_TEST" in os.environ): |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
257 # Set rounds to 1000 if no config is passed and |
|
7183
2de72f75f2f8
Production PBKDF rounds back to 2M, test 1k; fix empty_form (python2)
John Rouillard <rouilj@ieee.org>
parents:
7177
diff
changeset
|
258 # we are running within a pytest test. |
|
7167
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
259 rounds = 1000 |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
260 else: |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
261 import logging |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
262 # Log and abort. Initialize rounds and log (which |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
263 # will probably be ignored) with traceback in case |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
264 # ConfigNotSet exception is removed in the |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
265 # future. |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
266 rounds = 2000000 |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
267 logger = logging.getLogger('roundup') |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
268 if sys.version_info[0] > 2: |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
269 logger.critical( |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
270 "encodePassword called without config.", |
|
7228
07ce4e4110f5
flake8 fixes: whitespace, remove unused imports
John Rouillard <rouilj@ieee.org>
parents:
7220
diff
changeset
|
271 stack_info=True) |
|
7167
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
272 else: |
| 7240 | 273 import inspect, traceback # noqa: E401 |
|
7167
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
274 where = inspect.currentframe() |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
275 trace = traceback.format_stack(where) |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
276 logger.critical( |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
277 "encodePassword called without config. %s", |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
278 trace[:-1] |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
279 ) |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
280 raise ConfigNotSet("encodePassword called without config.") |
|
f6b24a8524cd
Modify code to reduce runtime when testing
John Rouillard <rouilj@ieee.org>
parents:
7165
diff
changeset
|
281 |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
282 if rounds < 1000: |
|
5378
35ea9b1efc14
Python 3 preparation: "raise" syntax.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5356
diff
changeset
|
283 raise PasswordValueError("invalid PBKDF2 hash (rounds too low)") |
|
7220
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
284 if scheme == "PBKDF2S5": |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
285 raw_digest = pbkdf2_sha512(plaintext, raw_salt, rounds, 64) |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
286 else: |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
287 raw_digest = pbkdf2(plaintext, raw_salt, rounds, 20) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
288 return "%d$%s$%s" % (rounds, salt, h64encode(raw_digest)) |
|
5053
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
289 elif scheme == 'SSHA': |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
290 if other: |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
291 raw_other = b64decode(other) |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
292 salt = raw_other[20:] |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
293 else: |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
294 # new password |
|
5053
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
295 # variable salt length |
|
5488
52cb53eedf77
reworked random number use
Christof Meerwald <cmeerw@cmeerw.org>
parents:
5483
diff
changeset
|
296 salt_len = random_.randbelow(52-36) + 36 |
|
52cb53eedf77
reworked random number use
Christof Meerwald <cmeerw@cmeerw.org>
parents:
5483
diff
changeset
|
297 salt = random_.token_bytes(salt_len) |
|
5454
fbbcbfc6dad0
fix encoding for hash functions
Christof Meerwald <cmeerw@cmeerw.org>
parents:
5428
diff
changeset
|
298 s = ssha(s2b(plaintext), salt) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
299 elif scheme == 'SHA': |
|
6000
6c3826600610
Bandit - silence old hash warnings.
John Rouillard <rouilj@ieee.org>
parents:
5630
diff
changeset
|
300 s = sha1(s2b(plaintext)).hexdigest() # nosec |
|
2277
c9e52addda42
added MD5 scheme for password hiding
Richard Jones <richard@users.sourceforge.net>
parents:
2098
diff
changeset
|
301 elif scheme == 'MD5': |
|
6000
6c3826600610
Bandit - silence old hash warnings.
John Rouillard <rouilj@ieee.org>
parents:
5630
diff
changeset
|
302 s = md5(s2b(plaintext)).hexdigest() # nosec |
|
6626
120b0bb05b6e
issue2551191 - Module deprication PEP 594. crypt
John Rouillard <rouilj@ieee.org>
parents:
6146
diff
changeset
|
303 elif scheme == 'crypt': |
|
120b0bb05b6e
issue2551191 - Module deprication PEP 594. crypt
John Rouillard <rouilj@ieee.org>
parents:
6146
diff
changeset
|
304 if crypt is None: |
|
120b0bb05b6e
issue2551191 - Module deprication PEP 594. crypt
John Rouillard <rouilj@ieee.org>
parents:
6146
diff
changeset
|
305 raise PasswordValueError( |
|
120b0bb05b6e
issue2551191 - Module deprication PEP 594. crypt
John Rouillard <rouilj@ieee.org>
parents:
6146
diff
changeset
|
306 'Unsupported encryption scheme %r' % scheme) |
|
1229
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
307 if other is not None: |
|
3434
1f860b50fa5f
encodePassword: don't trim the salt string...
Alexander Smishlajev <a1s@users.sourceforge.net>
parents:
2277
diff
changeset
|
308 salt = other |
|
1229
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
309 else: |
|
5415
2d6a92c3e212
Python 3 preparation: use string.ascii_letters instead of string.letters.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5414
diff
changeset
|
310 saltchars = './0123456789'+string.ascii_letters |
|
5488
52cb53eedf77
reworked random number use
Christof Meerwald <cmeerw@cmeerw.org>
parents:
5483
diff
changeset
|
311 salt = random_.choice(saltchars) + random_.choice(saltchars) |
|
1229
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
312 s = crypt.crypt(plaintext, salt) |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
313 elif scheme == 'plaintext': |
|
1229
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
314 s = plaintext |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
315 else: |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
316 raise PasswordValueError('Unknown encryption scheme %r' % scheme) |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
317 return s |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
318 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
319 |
|
4760
efdce3d32698
Increase generated password length to 12 symbols.
anatoly techtonik <techtonik@gmail.com>
parents:
4683
diff
changeset
|
320 def generatePassword(length=12): |
|
5415
2d6a92c3e212
Python 3 preparation: use string.ascii_letters instead of string.letters.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5414
diff
changeset
|
321 chars = string.ascii_letters+string.digits |
|
5488
52cb53eedf77
reworked random number use
Christof Meerwald <cmeerw@cmeerw.org>
parents:
5483
diff
changeset
|
322 password = [random_.choice(chars) for x in range(length - 1)] |
|
4760
efdce3d32698
Increase generated password length to 12 symbols.
anatoly techtonik <techtonik@gmail.com>
parents:
4683
diff
changeset
|
323 # make sure there is at least one digit |
|
5488
52cb53eedf77
reworked random number use
Christof Meerwald <cmeerw@cmeerw.org>
parents:
5483
diff
changeset
|
324 digitidx = random_.randbelow(length) |
|
52cb53eedf77
reworked random number use
Christof Meerwald <cmeerw@cmeerw.org>
parents:
5483
diff
changeset
|
325 password[digitidx:digitidx] = [random_.choice(string.digits)] |
|
4760
efdce3d32698
Increase generated password length to 12 symbols.
anatoly techtonik <techtonik@gmail.com>
parents:
4683
diff
changeset
|
326 return ''.join(password) |
|
1583
caae7d8934dc
set new email rego user password to random string
Richard Jones <richard@users.sourceforge.net>
parents:
1343
diff
changeset
|
327 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
328 |
|
4483
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
329 class JournalPassword: |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
330 """ Password dummy instance intended for journal operation. |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
331 We do not store passwords in the journal any longer. The dummy |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
332 version only reads the encryption scheme from the given |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
333 encrypted password. |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
334 """ |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
335 default_scheme = 'PBKDF2' # new encryptions use this scheme |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
336 pwre = re.compile(r'{(\w+)}(.+)') |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
337 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
338 def __init__(self, encrypted=''): |
|
4483
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
339 if isinstance(encrypted, self.__class__): |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
340 self.scheme = encrypted.scheme or self.default_scheme |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
341 else: |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
342 m = self.pwre.match(encrypted) |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
343 if m: |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
344 self.scheme = m.group(1) |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
345 else: |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
346 self.scheme = self.default_scheme |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
347 self.password = '' |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
348 |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
349 def dummystr(self): |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
350 """ return dummy string to store in journal |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
351 - reports scheme, but nothing else |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
352 """ |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
353 return "{%s}*encrypted*" % (self.scheme,) |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
354 |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
355 __str__ = dummystr |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
356 |
|
5414
3fa026621f69
Python 3 preparation: comparisons.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5391
diff
changeset
|
357 def __eq__(self, other): |
|
4483
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
358 """Compare this password against another password.""" |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
359 # check to see if we're comparing instances |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
360 if isinstance(other, self.__class__): |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
361 if self.scheme != other.scheme: |
|
5414
3fa026621f69
Python 3 preparation: comparisons.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5391
diff
changeset
|
362 return False |
|
3fa026621f69
Python 3 preparation: comparisons.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5391
diff
changeset
|
363 return self.password == other.password |
|
4483
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
364 |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
365 # assume password is plaintext |
|
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
366 if self.password is None: |
|
5378
35ea9b1efc14
Python 3 preparation: "raise" syntax.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5356
diff
changeset
|
367 raise ValueError('Password not set') |
|
5414
3fa026621f69
Python 3 preparation: comparisons.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5391
diff
changeset
|
368 return self.password == encodePassword(other, self.scheme, |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
369 self.password or None) |
|
5414
3fa026621f69
Python 3 preparation: comparisons.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5391
diff
changeset
|
370 |
|
3fa026621f69
Python 3 preparation: comparisons.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5391
diff
changeset
|
371 def __ne__(self, other): |
|
3fa026621f69
Python 3 preparation: comparisons.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5391
diff
changeset
|
372 return not self.__eq__(other) |
|
4483
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
373 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
374 |
|
4483
22bc0426e348
Second patch from issue2550688 -- with some changes:
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4480
diff
changeset
|
375 class Password(JournalPassword): |
|
4089
eddb82d0964c
Add compatibility package to allow us to deal with Python versions 2.3..2.6.
Richard Jones <richard@users.sourceforge.net>
parents:
3439
diff
changeset
|
376 """The class encapsulates a Password property type value in the database. |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
377 |
|
2277
c9e52addda42
added MD5 scheme for password hiding
Richard Jones <richard@users.sourceforge.net>
parents:
2098
diff
changeset
|
378 The encoding of the password is one if None, 'SHA', 'MD5' or 'plaintext'. |
|
c9e52addda42
added MD5 scheme for password hiding
Richard Jones <richard@users.sourceforge.net>
parents:
2098
diff
changeset
|
379 The encodePassword function is used to actually encode the password from |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
380 plaintext. The None encoding is used in legacy databases where no |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
381 encoding scheme is identified. |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
382 |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
383 The scheme is stored with the encoded data in the database: |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
384 {scheme}data |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
385 |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
386 Example usage: |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
387 >>> p = Password('sekrit') |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
388 >>> p == 'sekrit' |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
389 1 |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
390 >>> p != 'not sekrit' |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
391 1 |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
392 >>> 'sekrit' == p |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
393 1 |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
394 >>> 'not sekrit' != p |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
395 1 |
|
4089
eddb82d0964c
Add compatibility package to allow us to deal with Python versions 2.3..2.6.
Richard Jones <richard@users.sourceforge.net>
parents:
3439
diff
changeset
|
396 """ |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
397 |
|
7702
70a6ee453ddc
fix: fix failing test when crypt is missing.
John Rouillard <rouilj@ieee.org>
parents:
7568
diff
changeset
|
398 deprecated_schemes = ["SSHA", "SHA", "MD5", "plaintext"] |
|
70a6ee453ddc
fix: fix failing test when crypt is missing.
John Rouillard <rouilj@ieee.org>
parents:
7568
diff
changeset
|
399 if crypt: |
|
70a6ee453ddc
fix: fix failing test when crypt is missing.
John Rouillard <rouilj@ieee.org>
parents:
7568
diff
changeset
|
400 # place just before plaintext if crypt is available |
|
70a6ee453ddc
fix: fix failing test when crypt is missing.
John Rouillard <rouilj@ieee.org>
parents:
7568
diff
changeset
|
401 deprecated_schemes.insert(-1, "crypt") |
| 7240 | 402 experimental_schemes = ["PBKDF2S5"] |
|
7241
78c3f4aced76
issue2551265 - deprecate SSHA password hash method
John Rouillard <rouilj@ieee.org>
parents:
7240
diff
changeset
|
403 known_schemes = ["PBKDF2"] + experimental_schemes + \ |
|
7568
a2ecc31c43ac
flake8: correct continutation line indent
John Rouillard <rouilj@ieee.org>
parents:
7403
diff
changeset
|
404 deprecated_schemes |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
405 |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
406 def __init__(self, plaintext=None, scheme=None, encrypted=None, |
|
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
407 strict=False, config=None): |
|
4089
eddb82d0964c
Add compatibility package to allow us to deal with Python versions 2.3..2.6.
Richard Jones <richard@users.sourceforge.net>
parents:
3439
diff
changeset
|
408 """Call setPassword if plaintext is not None.""" |
|
1229
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
409 if scheme is None: |
|
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
410 scheme = self.default_scheme |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
411 if plaintext is not None: |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
412 self.setPassword(plaintext, scheme, config=config) |
|
2098
18addf2a8596
Implemented proper datatypes in mysql and postgresql backends...
Richard Jones <richard@users.sourceforge.net>
parents:
2005
diff
changeset
|
413 elif encrypted is not None: |
|
4486
693c75d56ebe
Add new config-option 'password_pbkdf2_default_rounds'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4485
diff
changeset
|
414 self.unpack(encrypted, scheme, strict=strict, config=config) |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
415 else: |
|
3439
822a2719b81b
keep plaintext password in Password object property (rfe [SF#1379447])
Alexander Smishlajev <a1s@users.sourceforge.net>
parents:
3434
diff
changeset
|
416 self.scheme = self.default_scheme |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
417 self.password = None |
|
3439
822a2719b81b
keep plaintext password in Password object property (rfe [SF#1379447])
Alexander Smishlajev <a1s@users.sourceforge.net>
parents:
3434
diff
changeset
|
418 self.plaintext = None |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
419 |
|
5630
07abc8d36940
Add etag support to rest interface to prevent multiple users from
John Rouillard <rouilj@ieee.org>
parents:
5490
diff
changeset
|
420 def __repr__(self): |
|
07abc8d36940
Add etag support to rest interface to prevent multiple users from
John Rouillard <rouilj@ieee.org>
parents:
5490
diff
changeset
|
421 return self.__str__() |
|
07abc8d36940
Add etag support to rest interface to prevent multiple users from
John Rouillard <rouilj@ieee.org>
parents:
5490
diff
changeset
|
422 |
|
7165
970cd6d2b8ea
issue2551251 - migrate pbkdf2 passwords if more rounds configured
John Rouillard <rouilj@ieee.org>
parents:
7163
diff
changeset
|
423 def needs_migration(self, config): |
|
4484
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
424 """ Password has insecure scheme or other insecure parameters |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
425 and needs migration to new password scheme |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
426 """ |
|
4485
95aace124a8e
use idea from Eli Collins to use a list of deprecated password encoding schemes
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4484
diff
changeset
|
427 if self.scheme in self.deprecated_schemes: |
|
4484
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
428 return True |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
429 rounds, salt, raw_salt, digest = pbkdf2_unpack(self.password) |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
430 if rounds < 1000: |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
431 return True |
|
7165
970cd6d2b8ea
issue2551251 - migrate pbkdf2 passwords if more rounds configured
John Rouillard <rouilj@ieee.org>
parents:
7163
diff
changeset
|
432 if (self.scheme == "PBKDF2"): |
|
970cd6d2b8ea
issue2551251 - migrate pbkdf2 passwords if more rounds configured
John Rouillard <rouilj@ieee.org>
parents:
7163
diff
changeset
|
433 new_rounds = config.PASSWORD_PBKDF2_DEFAULT_ROUNDS |
| 7240 | 434 if ("pytest" in sys.modules and |
|
7184
8b2287d850c8
Fix round check/settings in needs_migration
John Rouillard <rouilj@ieee.org>
parents:
7183
diff
changeset
|
435 "PYTEST_CURRENT_TEST" in os.environ): |
|
8b2287d850c8
Fix round check/settings in needs_migration
John Rouillard <rouilj@ieee.org>
parents:
7183
diff
changeset
|
436 if ("PYTEST_USE_CONFIG" in os.environ): |
|
8b2287d850c8
Fix round check/settings in needs_migration
John Rouillard <rouilj@ieee.org>
parents:
7183
diff
changeset
|
437 new_rounds = config.PASSWORD_PBKDF2_DEFAULT_ROUNDS |
|
8b2287d850c8
Fix round check/settings in needs_migration
John Rouillard <rouilj@ieee.org>
parents:
7183
diff
changeset
|
438 else: |
|
8b2287d850c8
Fix round check/settings in needs_migration
John Rouillard <rouilj@ieee.org>
parents:
7183
diff
changeset
|
439 # for testing |
|
8b2287d850c8
Fix round check/settings in needs_migration
John Rouillard <rouilj@ieee.org>
parents:
7183
diff
changeset
|
440 new_rounds = 1000 |
|
7165
970cd6d2b8ea
issue2551251 - migrate pbkdf2 passwords if more rounds configured
John Rouillard <rouilj@ieee.org>
parents:
7163
diff
changeset
|
441 if rounds < int(new_rounds): |
|
970cd6d2b8ea
issue2551251 - migrate pbkdf2 passwords if more rounds configured
John Rouillard <rouilj@ieee.org>
parents:
7163
diff
changeset
|
442 return True |
|
4484
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
443 return False |
|
52e13bf0bb40
Add new config-option 'migrate_passwords' in section 'web'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4483
diff
changeset
|
444 |
|
4486
693c75d56ebe
Add new config-option 'password_pbkdf2_default_rounds'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4485
diff
changeset
|
445 def unpack(self, encrypted, scheme=None, strict=False, config=None): |
|
4089
eddb82d0964c
Add compatibility package to allow us to deal with Python versions 2.3..2.6.
Richard Jones <richard@users.sourceforge.net>
parents:
3439
diff
changeset
|
446 """Set the password info from the scheme:<encryted info> string |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
447 (the inverse of __str__) |
|
4089
eddb82d0964c
Add compatibility package to allow us to deal with Python versions 2.3..2.6.
Richard Jones <richard@users.sourceforge.net>
parents:
3439
diff
changeset
|
448 """ |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
449 m = self.pwre.match(encrypted) |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
450 if m: |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
451 self.scheme = m.group(1) |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
452 self.password = m.group(2) |
|
3439
822a2719b81b
keep plaintext password in Password object property (rfe [SF#1379447])
Alexander Smishlajev <a1s@users.sourceforge.net>
parents:
3434
diff
changeset
|
453 self.plaintext = None |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
454 else: |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
455 # currently plaintext - encrypt |
|
4486
693c75d56ebe
Add new config-option 'password_pbkdf2_default_rounds'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4485
diff
changeset
|
456 self.setPassword(encrypted, scheme, config=config) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
457 if strict and self.scheme not in self.known_schemes: |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
458 raise PasswordValueError("Unknown encryption scheme: %r" % |
|
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
459 (self.scheme,)) |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
460 |
|
4486
693c75d56ebe
Add new config-option 'password_pbkdf2_default_rounds'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4485
diff
changeset
|
461 def setPassword(self, plaintext, scheme=None, config=None): |
|
4089
eddb82d0964c
Add compatibility package to allow us to deal with Python versions 2.3..2.6.
Richard Jones <richard@users.sourceforge.net>
parents:
3439
diff
changeset
|
462 """Sets encrypts plaintext.""" |
|
1229
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
463 if scheme is None: |
|
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
464 scheme = self.default_scheme |
|
3439
822a2719b81b
keep plaintext password in Password object property (rfe [SF#1379447])
Alexander Smishlajev <a1s@users.sourceforge.net>
parents:
3434
diff
changeset
|
465 self.scheme = scheme |
|
4486
693c75d56ebe
Add new config-option 'password_pbkdf2_default_rounds'...
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4485
diff
changeset
|
466 self.password = encodePassword(plaintext, scheme, config=config) |
|
3439
822a2719b81b
keep plaintext password in Password object property (rfe [SF#1379447])
Alexander Smishlajev <a1s@users.sourceforge.net>
parents:
3434
diff
changeset
|
467 self.plaintext = plaintext |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
468 |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
469 def __str__(self): |
|
4089
eddb82d0964c
Add compatibility package to allow us to deal with Python versions 2.3..2.6.
Richard Jones <richard@users.sourceforge.net>
parents:
3439
diff
changeset
|
470 """Stringify the encrypted password for database storage.""" |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
471 if self.password is None: |
|
5378
35ea9b1efc14
Python 3 preparation: "raise" syntax.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5356
diff
changeset
|
472 raise ValueError('Password not set') |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
473 return '{%s}%s' % (self.scheme, self.password) |
|
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
474 |
|
6981
aa629aebac41
flake8 - import order, spacing
John Rouillard <rouilj@ieee.org>
parents:
6717
diff
changeset
|
475 |
|
7185
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
476 def test_missing_crypt(config=None): |
|
6981
aa629aebac41
flake8 - import order, spacing
John Rouillard <rouilj@ieee.org>
parents:
6717
diff
changeset
|
477 p = encodePassword('sekrit', 'crypt') # noqa: F841 - test only |
|
aa629aebac41
flake8 - import order, spacing
John Rouillard <rouilj@ieee.org>
parents:
6717
diff
changeset
|
478 |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
479 |
|
7185
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
480 def test(config=None): |
|
1229
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
481 # SHA |
|
7185
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
482 p = Password('sekrit', config=config) |
|
6146
01e9634b81a4
fixed string encoding of SSHA encoded passwords in Python 3
Christof Meerwald <cmeerw@cmeerw.org>
parents:
6007
diff
changeset
|
483 assert Password(encrypted=str(p)) == 'sekrit' |
|
01e9634b81a4
fixed string encoding of SSHA encoded passwords in Python 3
Christof Meerwald <cmeerw@cmeerw.org>
parents:
6007
diff
changeset
|
484 assert 'sekrit' == Password(encrypted=str(p)) |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
485 assert p == 'sekrit' |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
486 assert p != 'not sekrit' |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
487 assert 'sekrit' == p |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
488 assert 'not sekrit' != p |
|
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
489 |
|
2277
c9e52addda42
added MD5 scheme for password hiding
Richard Jones <richard@users.sourceforge.net>
parents:
2098
diff
changeset
|
490 # MD5 |
|
7185
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
491 p = Password('sekrit', 'MD5', config=config) |
|
6146
01e9634b81a4
fixed string encoding of SSHA encoded passwords in Python 3
Christof Meerwald <cmeerw@cmeerw.org>
parents:
6007
diff
changeset
|
492 assert Password(encrypted=str(p)) == 'sekrit' |
|
01e9634b81a4
fixed string encoding of SSHA encoded passwords in Python 3
Christof Meerwald <cmeerw@cmeerw.org>
parents:
6007
diff
changeset
|
493 assert 'sekrit' == Password(encrypted=str(p)) |
|
2277
c9e52addda42
added MD5 scheme for password hiding
Richard Jones <richard@users.sourceforge.net>
parents:
2098
diff
changeset
|
494 assert p == 'sekrit' |
|
c9e52addda42
added MD5 scheme for password hiding
Richard Jones <richard@users.sourceforge.net>
parents:
2098
diff
changeset
|
495 assert p != 'not sekrit' |
|
c9e52addda42
added MD5 scheme for password hiding
Richard Jones <richard@users.sourceforge.net>
parents:
2098
diff
changeset
|
496 assert 'sekrit' == p |
|
c9e52addda42
added MD5 scheme for password hiding
Richard Jones <richard@users.sourceforge.net>
parents:
2098
diff
changeset
|
497 assert 'not sekrit' != p |
|
c9e52addda42
added MD5 scheme for password hiding
Richard Jones <richard@users.sourceforge.net>
parents:
2098
diff
changeset
|
498 |
|
1229
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
499 # crypt |
|
4683
2f66d44616ad
windows: Fix failing password tests due to missing crypt module
anatoly techtonik <techtonik@gmail.com>
parents:
4570
diff
changeset
|
500 if crypt: # not available on Windows |
|
7185
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
501 p = Password('sekrit', 'crypt', config=config) |
|
6146
01e9634b81a4
fixed string encoding of SSHA encoded passwords in Python 3
Christof Meerwald <cmeerw@cmeerw.org>
parents:
6007
diff
changeset
|
502 assert Password(encrypted=str(p)) == 'sekrit' |
|
01e9634b81a4
fixed string encoding of SSHA encoded passwords in Python 3
Christof Meerwald <cmeerw@cmeerw.org>
parents:
6007
diff
changeset
|
503 assert 'sekrit' == Password(encrypted=str(p)) |
|
4683
2f66d44616ad
windows: Fix failing password tests due to missing crypt module
anatoly techtonik <techtonik@gmail.com>
parents:
4570
diff
changeset
|
504 assert p == 'sekrit' |
|
2f66d44616ad
windows: Fix failing password tests due to missing crypt module
anatoly techtonik <techtonik@gmail.com>
parents:
4570
diff
changeset
|
505 assert p != 'not sekrit' |
|
2f66d44616ad
windows: Fix failing password tests due to missing crypt module
anatoly techtonik <techtonik@gmail.com>
parents:
4570
diff
changeset
|
506 assert 'sekrit' == p |
|
2f66d44616ad
windows: Fix failing password tests due to missing crypt module
anatoly techtonik <techtonik@gmail.com>
parents:
4570
diff
changeset
|
507 assert 'not sekrit' != p |
|
1229
5c581b120738
added "crypt" password encoding...
Richard Jones <richard@users.sourceforge.net>
parents:
1090
diff
changeset
|
508 |
|
5053
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
509 # SSHA |
|
7185
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
510 p = Password('sekrit', 'SSHA', config=config) |
|
6146
01e9634b81a4
fixed string encoding of SSHA encoded passwords in Python 3
Christof Meerwald <cmeerw@cmeerw.org>
parents:
6007
diff
changeset
|
511 assert Password(encrypted=str(p)) == 'sekrit' |
|
01e9634b81a4
fixed string encoding of SSHA encoded passwords in Python 3
Christof Meerwald <cmeerw@cmeerw.org>
parents:
6007
diff
changeset
|
512 assert 'sekrit' == Password(encrypted=str(p)) |
|
5053
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
513 assert p == 'sekrit' |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
514 assert p != 'not sekrit' |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
515 assert 'sekrit' == p |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
516 assert 'not sekrit' != p |
|
9792b18e0b19
issue 2550880: Ability to choose password store scheme and SSHA support.
John Rouillard <rouilj@ieee.org>
parents:
4982
diff
changeset
|
517 |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
518 # PBKDF2 - low level function |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
519 from binascii import unhexlify |
|
5428
1f1899658115
Python 3 preparation: use bytes more in password handling.
Joseph Myers <jsm@polyomino.org.uk>
parents:
5416
diff
changeset
|
520 k = pbkdf2("password", b"ATHENA.MIT.EDUraeburn", 1200, 32) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
521 assert k == unhexlify("5c08eb61fdf71e4e4ec3cf6ba1f5512ba7e52ddbc5e5142f708a31e2e62b1e13") |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
522 |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
523 # PBKDF2 - hash function |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
524 h = "5000$7BvbBq.EZzz/O0HuwX3iP.nAG3s$g3oPnFFaga2BJaX5PoPRljl4XIE" |
|
7201
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
525 assert encodePassword("sekrit", "PBKDF2", h, config=config) == h |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
526 |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
527 # PBKDF2 - high level integration |
|
7185
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
528 p = Password('sekrit', 'PBKDF2', config=config) |
|
6146
01e9634b81a4
fixed string encoding of SSHA encoded passwords in Python 3
Christof Meerwald <cmeerw@cmeerw.org>
parents:
6007
diff
changeset
|
529 assert Password(encrypted=str(p)) == 'sekrit' |
|
01e9634b81a4
fixed string encoding of SSHA encoded passwords in Python 3
Christof Meerwald <cmeerw@cmeerw.org>
parents:
6007
diff
changeset
|
530 assert 'sekrit' == Password(encrypted=str(p)) |
|
4480
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
531 assert p == 'sekrit' |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
532 assert p != 'not sekrit' |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
533 assert 'sekrit' == p |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
534 assert 'not sekrit' != p |
|
1613754d2646
Fix first part of Password handling security issue2550688
Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
parents:
4089
diff
changeset
|
535 |
|
7201
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
536 # PBKDF2S5 - high level integration |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
537 p = Password('sekrit', 'PBKDF2S5', config=config) |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
538 print(p) |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
539 assert Password(encrypted=str(p)) == 'sekrit' |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
540 assert 'sekrit' == Password(encrypted=str(p)) |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
541 assert p == 'sekrit' |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
542 assert p != 'not sekrit' |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
543 assert 'sekrit' == p |
|
da751d3a2138
issue2551253 - Modify password PBKDF2 method to use SHA512
John Rouillard <rouilj@ieee.org>
parents:
7185
diff
changeset
|
544 assert 'not sekrit' != p |
|
6007
e27a240430b8
flake8 formatting changes.
John Rouillard <rouilj@ieee.org>
parents:
6000
diff
changeset
|
545 |
| 7240 | 546 |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
547 if __name__ == '__main__': |
|
7220
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
548 # invoking this with: |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
549 # PYTHONPATH=. python2 roundup/password.py |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
550 # or with python3, results in sys.path starting with: |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
551 # ['/path/to/./roundup', |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
552 # '/path/to/.', |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
553 # '/usr/lib/python2.7', |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
554 # which makes import roundup.anypy.html fail in python2 |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
555 # when importing |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
556 # from cgi import escape as html_escape |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
557 # because cgi is not /usr/lib/python2.7/cgi but |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
558 # roundup/cgi. Modify the path to remove the bogus trailing /roundup |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
559 |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
560 sys.path[0] = sys.path[0][:sys.path[0].rindex('/')] |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
561 |
|
4d83f9f751ff
Refeactor PBKDF2 and PBKDF2S5 to reuse code; fix python password.py
John Rouillard <rouilj@ieee.org>
parents:
7201
diff
changeset
|
562 # we continue with our regularly scheduled tests |
|
7185
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
563 from roundup.configuration import CoreConfig |
|
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
564 test(CoreConfig()) |
|
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
565 crypt = None |
|
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
566 exception = None |
|
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
567 try: |
|
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
568 test_missing_crypt(CoreConfig()) |
|
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
569 except PasswordValueError as e: |
|
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
570 exception = e |
| 7240 | 571 assert exception is not None |
|
7185
8e8d111fcdcd
Make in file tests work again. Also allow manual testing without overriding PBKDF rounds
John Rouillard <rouilj@ieee.org>
parents:
7184
diff
changeset
|
572 assert exception.__str__() == "Unsupported encryption scheme 'crypt'" |
|
270
a4241ddd22d7
Added the Password property type.
Richard Jones <richard@users.sourceforge.net>
parents:
diff
changeset
|
573 |
|
3434
1f860b50fa5f
encodePassword: don't trim the salt string...
Alexander Smishlajev <a1s@users.sourceforge.net>
parents:
2277
diff
changeset
|
574 # vim: set filetype=python sts=4 sw=4 et si : |
