Skip to content

bpo-38270: Check for hash digest algorithms and avoid MD5#16382

Merged
miss-islington merged 5 commits into
python:masterfrom
tiran:bpo-38270-md5
Sep 25, 2019
Merged

bpo-38270: Check for hash digest algorithms and avoid MD5#16382
miss-islington merged 5 commits into
python:masterfrom
tiran:bpo-38270-md5

Conversation

@tiran

@tiran tiran commented Sep 25, 2019 •
edited by miss-islington
Loading

Copy link
Copy Markdown
Member

Make it easier to run and test Python on systems with restrict crypto policies:

  • add requires_hashdigest to test.support to check if a hash digest algorithm is available and working
  • avoid MD5 in test_hmac
  • replace MD5 with SHA256 in test_tarfile
  • mark network tests that require MD5 for MD5-based digest auth or CRAM-MD5

https://bugs.python.org/issue38270

Automerge-Triggered-By: @tiran

Automerge-Triggered-By: @tiran

@tiran
bpo-38270: Add test.support.requires_hashdigest()
2c44f02 
The new test helper requires_hashdigest() marks tests that require a
specific hashlib algorithm. If the algorithm is not available or blocked
by a security policy, the test case is skipped.

Signed-off-by: Christian Heimes <christian@python.org>
@tiran
bpo-38270: avoid MD5 in hmac test
539e248 
test_hmac now uses SHA256 instead of MD5 for default constructor tests.
All tests now use requires_hashdigest(), too.

Signed-off-by: Christian Heimes <christian@python.org>
@tiran
bpo-38270: Replace MD5 with SHA256 in test_tarfile
c0532c3 
Signed-off-by: Christian Heimes <christian@python.org>
@tiran
bpo-38270: Mark network tests that require MD5
0b213c3 
Some test cases for imaplib, poplib, smptlib, and urllib2 require MD5 to
perform digest auth / CRAM-MD5 auth testing. These tests are now marked
as requiring MD5 and skipped when MD5 is not available.

Signed-off-by: Christian Heimes <christian@python.org>
@tiran tiran added tests Tests in the Lib/test dir needs backport to 3.7 labels Sep 25, 2019
@tiran tiran requested a review from a team as a code owner September 25, 2019 10:25
vstinner
vstinner approved these changes Sep 25, 2019
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I just have a minor suggestion on the NEWS entry.

Comment thread Misc/NEWS.d/next/Tests/2019-09-25-12-18-31.bpo-38270._x-9uH.rst Outdated
@tiran
bpo-38270: blurb
0ad9fe2 
Signed-off-by: Christian Heimes <christian@python.org>
vstinner
vstinner approved these changes Sep 25, 2019
View reviewed changes

@vstinner vstinner left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. The updated NEWS entry is even better ;-)

@miss-islington miss-islington merged commit c64a1a6 into python:master Sep 25, 2019
@miss-islington

miss-islington commented Sep 25, 2019

Copy link
Copy Markdown
Contributor

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7, 3.8.
🐍🍒⛏🤖

@miss-islington

miss-islington commented Sep 25, 2019

Copy link
Copy Markdown
Contributor

I'm having trouble backporting to 3.8. Reason: 'Error 110 while writing to socket. Connection timed out.'. Please retry by removing and re-adding the needs backport to 3.8 label.

@miss-islington

miss-islington commented Sep 25, 2019

Copy link
Copy Markdown
Contributor

Sorry, @tiran, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker c64a1a61e6fc542cada40eb069a239317e1af36e 3.7

@miss-islington miss-islington self-assigned this Sep 25, 2019
@miss-islington

miss-islington commented Sep 25, 2019

Copy link
Copy Markdown
Contributor

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8.
🐍🍒⛏🤖

@miss-islington

miss-islington commented Sep 25, 2019

Copy link
Copy Markdown
Contributor

Sorry @tiran, I had trouble checking out the 3.8 backport branch.
Please backport using cherry_picker on command line.
cherry_picker c64a1a61e6fc542cada40eb069a239317e1af36e 3.8

@miss-islington

miss-islington commented Sep 25, 2019

Copy link
Copy Markdown
Contributor

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 25, 2019
@tiran @miss-islington
bpo-38270: Check for hash digest algorithms and avoid MD5 (pythonGH-1…
51ecc58 
…6382)

Make it easier to run and test Python on systems with restrict crypto policies:

* add requires_hashdigest to test.support to check if a hash digest algorithm is available and working
* avoid MD5 in test_hmac
* replace MD5 with SHA256 in test_tarfile
* mark network tests that require MD5 for MD5-based digest auth or CRAM-MD5

https://bugs.python.org/issue38270
(cherry picked from commit c64a1a6)

Co-authored-by: Christian Heimes <christian@python.org>
@bedevere-bot

bedevere-bot commented Sep 25, 2019

Copy link
Copy Markdown

GH-16393 is a backport of this pull request to the 3.8 branch.

miss-islington added a commit that referenced this pull request Sep 25, 2019
@miss-islington
[3.8] bpo-38270: Check for hash digest algorithms and avoid MD5 (GH-1…
66cd041 
…6382) (GH-16393)

Make it easier to run and test Python on systems with restrict crypto policies:

* add requires_hashdigest to test.support to check if a hash digest algorithm is available and working
* avoid MD5 in test_hmac
* replace MD5 with SHA256 in test_tarfile
* mark network tests that require MD5 for MD5-based digest auth or CRAM-MD5


https://bugs.python.org/issue38270
(cherry picked from commit c64a1a6)


Co-authored-by: Christian Heimes <christian@python.org>


https://bugs.python.org/issue38270



Automerge-Triggered-By: @tiran
stratakis pushed a commit to stratakis/cpython that referenced this pull request Dec 2, 2019
@miss-islington @stratakis
[3.8] bpo-38270: Check for hash digest algorithms and avoid MD5 (pyth…
53d108c 
…onGH-16382) (pythonGH-16393)

Make it easier to run and test Python on systems with restrict crypto policies:

* add requires_hashdigest to test.support to check if a hash digest algorithm is available and working
* avoid MD5 in test_hmac
* replace MD5 with SHA256 in test_tarfile
* mark network tests that require MD5 for MD5-based digest auth or CRAM-MD5

https://bugs.python.org/issue38270
(cherry picked from commit c64a1a6)

Co-authored-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue38270

Automerge-Triggered-By: @tiran
jacobneiltaylor pushed a commit to jacobneiltaylor/cpython that referenced this pull request Dec 5, 2019
@tiran
bpo-38270: Check for hash digest algorithms and avoid MD5 (pythonGH-1…
a4f2afb 
…6382)

Make it easier to run and test Python on systems with restrict crypto policies:

* add requires_hashdigest to test.support to check if a hash digest algorithm is available and working
* avoid MD5 in test_hmac
* replace MD5 with SHA256 in test_tarfile
* mark network tests that require MD5 for MD5-based digest auth or CRAM-MD5


https://bugs.python.org/issue38270
stratakis pushed a commit to stratakis/cpython that referenced this pull request May 5, 2020
@miss-islington @stratakis
[3.8] bpo-38270: Check for hash digest algorithms and avoid MD5 (pyth…
edf2fde 
…onGH-16382) (pythonGH-16393)

Make it easier to run and test Python on systems with restrict crypto policies:

* add requires_hashdigest to test.support to check if a hash digest algorithm is available and working
* avoid MD5 in test_hmac
* replace MD5 with SHA256 in test_tarfile
* mark network tests that require MD5 for MD5-based digest auth or CRAM-MD5

https://bugs.python.org/issue38270
(cherry picked from commit c64a1a6)

Co-authored-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue38270

Automerge-Triggered-By: @tiran
@tiran tiran mentioned this pull request Sep 9, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vstinner vstinner vstinner approved these changes

Assignees

@miss-islington miss-islington

Labels

tests Tests in the Lib/test dir

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@tiran @miss-islington @bedevere-bot @vstinner @the-knights-who-say-ni