This is an automated email from the ASF dual-hosted git repository. astitcher pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/qpid-proton.git
commit 32d84a4eeeafb94f810ae40977caa72613182bfd Author: Andrew Stitcher <[email protected]> AuthorDate: Mon Feb 21 13:06:56 2022 -0500 PROTON-2502: Stop testing using MD5 SASL mechanisms MD5 based mechanisms are now considered insecure and future systems will be configured without them available. We should stop using them to test Proton so we can build on securely configured machines. --- INSTALL.md | 6 +++--- python/tests/proton_tests/sasl.py | 41 ++++++++++++--------------------------- 2 files changed, 15 insertions(+), 32 deletions(-) diff --git a/INSTALL.md b/INSTALL.md index 56db95885..44974291c 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -10,7 +10,7 @@ Dependencies Cross-platform dependencies - CMake 3.16+ - - Python 3.9+ (required to build core C library) + - Python 3.9+ (required to build core C library and Python binding) - Swig 1.3+ (for the Ruby binding) - Ruby 1.9+ (for the Ruby binding) - Go 1.11+ (for the Go binding) @@ -19,7 +19,7 @@ Linux dependencies - GNU Make 3.81+ - GCC 9+ - - Cyrus SASL 2.1+ (for SASL support) + - Cyrus SASL 2.1.26+ (for SASL support) - OpenSSL 1.0.2a+ (for SSL support) - JsonCpp 1.8+ for C++ connection configuration file support @@ -42,7 +42,7 @@ language. $ yum install openssl-devel # Dependencies needed for Cyrus SASL support - $ yum install cyrus-sasl-devel cyrus-sasl-plain cyrus-sasl-md5 + $ yum install cyrus-sasl-devel cyrus-sasl-plain cyrus-sasl-scram # Dependencies needed for bindings $ yum install swig # Required for ruby binding diff --git a/python/tests/proton_tests/sasl.py b/python/tests/proton_tests/sasl.py index 9125e2004..88899d6aa 100644 --- a/python/tests/proton_tests/sasl.py +++ b/python/tests/proton_tests/sasl.py @@ -324,20 +324,6 @@ class SASLMechTest(Test): self.t2.bind(self.c2) _testSaslMech(self, 'ANONYMOUS', authUser='anonymous') - def testCRAMMD5(self): - common.ensureCanTestExtendedSASL() - - self.t1.bind(self.c1) - self.t2.bind(self.c2) - _testSaslMech(self, 'CRAM-MD5') - - def testDIGESTMD5(self): - common.ensureCanTestExtendedSASL() - - self.t1.bind(self.c1) - self.t2.bind(self.c2) - _testSaslMech(self, 'DIGEST-MD5') - # PLAIN shouldn't work without encryption without special setting def testPLAINfail(self): common.ensureCanTestExtendedSASL() @@ -365,15 +351,12 @@ class SASLMechTest(Test): self.t2.bind(self.c2) _testSaslMech(self, 'PLAIN') -# SCRAM not supported before Cyrus SASL 2.1.26 -# so not universal and hence need a test for support -# to keep it in tests. -# def testSCRAMSHA1(self): -# common.ensureCanTestExtendedSASL() -# -# self.t1.bind(self.c1) -# self.t2.bind(self.c2) -# _testSaslMech(self, 'SCRAM-SHA-1') + def testSCRAMSHA1(self): + common.ensureCanTestExtendedSASL() + + self.t1.bind(self.c1) + self.t2.bind(self.c2) + _testSaslMech(self, 'SCRAM-SHA-1') def _sslConnection(domain, transport, connection): @@ -548,7 +531,7 @@ class SASLEventTest(engine.CollectorTest): self.c1.collect(self.collector) self.t1.bind(self.c1) self.t2.bind(self.c2) - _testSaslMech(self, 'DIGEST-MD5') + _testSaslMech(self, 'SCRAM-SHA-1') self.expect(Event.CONNECTION_INIT, Event.CONNECTION_BOUND, Event.CONNECTION_LOCAL_OPEN, Event.TRANSPORT, Event.CONNECTION_REMOTE_OPEN) @@ -558,7 +541,7 @@ class SASLEventTest(engine.CollectorTest): self.c2.collect(self.collector) self.t1.bind(self.c1) self.t2.bind(self.c2) - _testSaslMech(self, 'DIGEST-MD5') + _testSaslMech(self, 'SCRAM-SHA-1') self.expect(Event.CONNECTION_INIT, Event.CONNECTION_BOUND, Event.CONNECTION_LOCAL_OPEN, Event.TRANSPORT, Event.CONNECTION_REMOTE_OPEN) @@ -570,7 +553,7 @@ class SASLEventTest(engine.CollectorTest): self.c1.collect(self.collector) self.t1.bind(self.c1) self.t2.bind(self.c2) - _testSaslMech(self, 'DIGEST-MD5', clientUser=clientUser, authenticated=False) + _testSaslMech(self, 'SCRAM-SHA-1', clientUser=clientUser, authenticated=False) self.expect(Event.CONNECTION_INIT, Event.CONNECTION_BOUND, Event.CONNECTION_LOCAL_OPEN, Event.TRANSPORT, Event.TRANSPORT_ERROR, @@ -584,7 +567,7 @@ class SASLEventTest(engine.CollectorTest): self.c2.collect(self.collector) self.t1.bind(self.c1) self.t2.bind(self.c2) - _testSaslMech(self, 'DIGEST-MD5', clientUser=clientUser, authenticated=False) + _testSaslMech(self, 'SCRAM-SHA-1', clientUser=clientUser, authenticated=False) self.expect(Event.CONNECTION_INIT, Event.CONNECTION_BOUND, Event.CONNECTION_LOCAL_OPEN, Event.TRANSPORT, Event.TRANSPORT_ERROR, @@ -597,7 +580,7 @@ class SASLEventTest(engine.CollectorTest): self.s2.allowed_mechs('IMPOSSIBLE') self.t1.bind(self.c1) self.t2.bind(self.c2) - _testSaslMech(self, 'DIGEST-MD5', authenticated=False) + _testSaslMech(self, 'SCRAM-SHA-1', authenticated=False) self.expect(Event.CONNECTION_INIT, Event.CONNECTION_BOUND, Event.CONNECTION_LOCAL_OPEN, Event.TRANSPORT, Event.TRANSPORT_ERROR, @@ -609,7 +592,7 @@ class SASLEventTest(engine.CollectorTest): self.s2.allowed_mechs('IMPOSSIBLE') self.t1.bind(self.c1) self.t2.bind(self.c2) - _testSaslMech(self, 'DIGEST-MD5', authenticated=False) + _testSaslMech(self, 'SCRAM-SHA-1', authenticated=False) self.expect(Event.CONNECTION_INIT, Event.CONNECTION_BOUND, Event.CONNECTION_LOCAL_OPEN, Event.TRANSPORT, Event.TRANSPORT_TAIL_CLOSED, --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
