Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

gh-61460: Stronger HMAC in multiprocessing#20380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
gpshead merged 5 commits intopython:mainfromtiran:bpo17258-multiproc-md5
May 20, 2023

Conversation

@tiran
Copy link
Member

@tirantiran commentedMay 25, 2020•
edited by gpshead
Loading

ZackerySpytz and stratakis reacted with thumbs up emoji
Signed-off-by: Christian Heimes <christian@python.org>
@tirantiranforce-pushed thebpo17258-multiproc-md5 branch fromf4d7007 toc7f7680CompareNovember 17, 2020 15:17
@florinspatar
Copy link
Contributor

I'm just wondering here, but is this still waiting for reviews before it can be merged?

Copy link
Member

@gpsheadgpshead left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Why jump through all the hoops to specify the digest in the protocol? Don't we always control both ends of the connection so there should never be a situation where negotiation and understanding of what was used is needed?

That'd be a lot less complicated.

And not prone to the potential problem this has of always stooping to the lowest level decided upon out by the challenge initiator rather thanrequiring a specific hash to be used on the channel.

The protocol modification idea remains, but we now take advantage of themessage length as an indicator of legacy vs modern protocol version.  Nomore regular expression usage.  We now default to HMAC-SHA256, but do soin a way that will be compatible when communicating with older clientsor older servers. No protocol transition period is needed.More unittests to verify these claims remain true are required.
@gpsheadgpshead self-assigned thisNov 20, 2022
@gpsheadgpshead marked this pull request as ready for reviewNovember 20, 2022 21:32
@gpsheadgpshead added the type-featureA feature request or enhancement labelNov 20, 2022
@gpsheadgpshead changed the titlebpo-17258: Stronger HMAC in multiprocessinggh-61460: Stronger HMAC in multiprocessingNov 20, 2022
@gpshead
Copy link
Member

I believe this is in much better shape now, reviews appreciated@tiran &@pitrou.

This feature combined with#99309 will close the loop on#97514 - allowing people who oddly want to use Linux abstract namespace sockets for forkserver to do so "safely" again.

@netlify
Copy link

netlifybot commentedDec 11, 2022•
edited
Loading

✅ Deploy Preview forpython-cpython-preview ready!

NameLink
🔨 Latest commitee5e6ff
🔍 Latest deploy loghttps://app.netlify.com/sites/python-cpython-preview/deploys/639526524ecd2e0009172e1f
😎 Deploy Previewhttps://deploy-preview-20380--python-cpython-preview.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to yourNetlify site settings.

@gpsheadgpsheadenabled auto-merge (squash)May 20, 2023 23:24
@gpsheadgpshead merged commit3ed57e4 intopython:mainMay 20, 2023
@gpshead
Copy link
Member

merged, we'll see how this goes during the betas!

@xnox
Copy link

xnox commentedSep 5, 2024

Given this is backwards and forwards compatible, and doesn't change default connectivity methods, has it been considered for backports to earlier python versions? as it would increase overlap as to which servers can interoperate, thus allowing to eventually change the default organically as md5 drops off in availability on the most modern servers/OSes.

@gpshead
Copy link
Member

There's no appetite to do it (see my comment on the original issue, this is a feature, not a bugfix, and not a security fix 3.11 and earlier are security fix only now).

People who think they need this are better off upgrading to 3.12.(the default does change in this PR FWIW, but if someone were backporting it into their own old runtime they could consider makingdeliver_challenge not change its default)

xnox reacted with heart emoji

csabella pushed a commit to DataDog/cpython that referenced this pull requestDec 17, 2024
bpo-17258:  `multiprocessing` now supports stronger HMAC algorithms for inter-process connection authentication rather than only HMAC-MD5.Signed-off-by: Christian Heimes <christian@python.org>gpshead: I Reworked to be more robust while keeping the idea.The protocol modification idea remains, but we now take advantage of themessage length as an indicator of legacy vs modern protocol version.  Nomore regular expression usage.  We now default to HMAC-SHA256, but do soin a way that will be compatible when communicating with older clientsor older servers. No protocol transition period is needed.More integration tests to verify these claims remain true are required. I'munaware of anyone depending on multiprocessing connections betweendifferent Python versions.---------(cherry picked from commit3ed57e4)Co-authored-by: Christian Heimes <christian@python.org>Signed-off-by: Christian Heimes <christian@python.org>Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>
csabella pushed a commit to DataDog/cpython that referenced this pull requestDec 17, 2024
bpo-17258:  `multiprocessing` now supports stronger HMAC algorithms for inter-process connection authentication rather than only HMAC-MD5.Signed-off-by: Christian Heimes <christian@python.org>gpshead: I Reworked to be more robust while keeping the idea.The protocol modification idea remains, but we now take advantage of themessage length as an indicator of legacy vs modern protocol version.  Nomore regular expression usage.  We now default to HMAC-SHA256, but do soin a way that will be compatible when communicating with older clientsor older servers. No protocol transition period is needed.More integration tests to verify these claims remain true are required. I'munaware of anyone depending on multiprocessing connections betweendifferent Python versions.---------(cherry picked from commit3ed57e4)Co-authored-by: Christian Heimes <christian@python.org>Signed-off-by: Christian Heimes <christian@python.org>Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>
csabella added a commit to DataDog/cpython that referenced this pull requestDec 18, 2024
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@gpsheadgpsheadgpshead left review comments

@pitroupitroupitrou left review comments

Assignees

@gpsheadgpshead

Labels

topic-multiprocessingtype-featureA feature request or enhancement

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

9 participants

@tiran@florinspatar@gpshead@xnox@pitrou@vstinner@the-knights-who-say-ni@ezio-melotti@bedevere-bot
[8]ページ先頭
©2009-2025 Movatter.jp