Ticket #10 (new defect)
Opened 2 months ago
md5 replaced by hashlib
| Reported by: | jh | Owned by: | |
|---|---|---|---|
| Priority: | major | Milestone: | |
| Component: | MSRP relay | Version: | 1.0 |
| Severity: | Critical | Keywords: | |
| Cc: |
Description
when i started msrp relay on debian squeeze, i got an error message about deprecated import of md5, which has been replaced by hashlib. below is a diff of digest.py that makes the change.
-- juha
*** digest.py.orig 2009-08-03 22:14:14.000000000 +0300 --- digest.py 2010-07-07 14:57:28.000000000 +0300 *************** *** 15,21 ****
# with this program; if not, write to the Free Software Foundation, Inc., # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
! import md5
from time import time from base64 import b64encode, b64decode from os import urandom
--- 15,21 ----
# with this program; if not, write to the Free Software Foundation, Inc., # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
! import hashlib
from time import time from base64 import b64encode, b64decode from os import urandom
*************** *** 25,43 ****
def calc_ha1(**parameters):
ha1_text = "%(username)s:%(realm)s:%(password)s" % parameters
! return md5.new(ha1_text).hexdigest()
def calc_ha2_response(**parameters):
ha2_text = "%(method)s:%(uri)s" % parameters
! return md5.new(ha2_text).hexdigest()
def calc_ha2_rspauth(**parameters):
ha2_text = ":%(uri)s" % parameters
! return md5.new(ha2_text).hexdigest()
def calc_hash(**parameters):
hash_text = "%(ha1)s:%(nonce)s:%(nc)s:%(cnonce)s:auth:%(ha2)s" % parameters
! return md5.new(hash_text).hexdigest()
def calc_responses(**parameters):
if parameters.has_key("ha1"):
--- 25,43 ----
def calc_ha1(**parameters):
ha1_text = "%(username)s:%(realm)s:%(password)s" % parameters
! return hashlib.md5(ha1_text).hexdigest()
def calc_ha2_response(**parameters):
ha2_text = "%(method)s:%(uri)s" % parameters
! return hashlib.md5(ha2_text).hexdigest()
def calc_ha2_rspauth(**parameters):
ha2_text = ":%(uri)s" % parameters
! return hashlib.md5(ha2_text).hexdigest()
def calc_hash(**parameters):
hash_text = "%(ha1)s:%(nonce)s:%(nc)s:%(cnonce)s:auth:%(ha2)s" % parameters
! return hashlib.md5(hash_text).hexdigest()
def calc_responses(**parameters):
if parameters.has_key("ha1"):
*************** *** 81,87 ****
www_authenticateqop? = "auth" nonce = urandom(16) + "%.3f:%s" % (time(), peer_ip) www_authenticatenonce? = b64encode(nonce)
! opaque = md5.new(nonce + self.key)
www_authenticateopaque? = opaque.hexdigest() return www_authenticate
--- 81,87 ----
www_authenticateqop? = "auth" nonce = urandom(16) + "%.3f:%s" % (time(), peer_ip) www_authenticatenonce? = b64encode(nonce)
! opaque = hashlib.md5(nonce + self.key)
www_authenticateopaque? = opaque.hexdigest() return www_authenticate
*************** *** 109,115 ****
raise LoginFailed("Could not decode nonce")
if nonce_ip != peer_ip:
raise LoginFailed("This challenge was not issued to you")
! expected_opaque = md5.new(nonce_dec + self.key).hexdigest()
if opaque != expected_opaque:
raise LoginFailed("This nonce/opaque combination was not issued by me")
if issued + self.expire_time < time():
--- 109,115 ----
raise LoginFailed("Could not decode nonce")
if nonce_ip != peer_ip:
raise LoginFailed("This challenge was not issued to you")
! expected_opaque = hashlib.md5(nonce_dec + self.key).hexdigest()
if opaque != expected_opaque:
raise LoginFailed("This nonce/opaque combination was not issued by me")
if issued + self.expire_time < time():
jh@rautu:~$
