Ticket #2329: xpra-2.5.2.fips-md5-sha256.patch

unittests/unit/net/HMAC_test.py

@@ -13 +13 @@
     def test_hardcoded(self):
         password = b"71051d81d27745b59c1c56c6e9046c19697e452453e04aa5abbd52c8edc8c232"
         salt = b"99ea464f-7117-4e38-95b3-d3aa80e7b806"
-        hmac_hash = hmac.HMAC(password, salt, digestmod=hashlib.md5)
-        hd = hmac_hash.hexdigest()
-        ed = "dc26a074c9378b1b5735a27563320a26"
+        try:
+            hmac_hash = hmac.HMAC(password, salt, digestmod=hashlib.md5)
+            hd = hmac_hash.hexdigest()
+            ed = "dc26a074c9378b1b5735a27563320a26"
+        except ValueError:
+            hmac_hash = hmac.HMAC(password, salt, digestmod=hashlib.sha1)
+            hd = hmac_hash.hexdigest()
+            ed = "5529d27aef1b7420fb9d696f1c04eaad5dcc1515"
         assert hd == ed, "expected digest %s but got %s" % (ed, hd)
 
 def main():

xpra/client/gtk_base/gtk_client_base.py

@@ -309 +309 @@
         color_str = color_str.replace(":off", "")
         if color_str in ("auto", ""):
             from hashlib import md5
-            m = md5()
+            try:
+                m = md5()
+            except ValueError:
+                from hashlib import sha1
+                m = sha1()
             for x in extra_args:
                 m.update(strtobytes(x))
             color_str = "#%s" % m.hexdigest()[:6]

xpra/client/window_backing_base.py

@@ -585 +585 @@
                 l = options.intget("z.len")
                 if l:
                     assert l==len(img_data), "compressed pixel data failed length integrity check: expected %i bytes but got %i" % (l, len(img_data))
-                md5 = options.strget("z.md5")
-                if md5:
-                    h = hashlib.md5(img_data)
+                try:
+                    chksum = options.get("z.md5")
+                    if chksum:
+                        h = hashlib.md5(img_data)
+                except ValueError:
+                    chksum = options.get("z.sha1")
+                    if chksum:
+                        h = hashlib.sha1(img_data)
+                if h:
                     hd = h.hexdigest()
-                    assert md5==hd, "pixel data failed compressed md5 integrity check: expected %s but got %s" % (md5, hd)
-                deltalog("passed compressed data integrity checks: len=%s, md5=%s (type=%s)", l, md5, type(img_data))
+                    assert chksum==hd, "pixel data failed compressed chksum integrity check: expected %s but got %s" % (chksum, hd)
+                deltalog("passed compressed data integrity checks: len=%s, chksum=%s (type=%s)", l, chksum, type(img_data))
             if coding == "mmap":
                 self.idle_add(self.paint_mmap, img_data, x, y, width, height, rowstride, options, callbacks)
             elif coding in ("rgb24", "rgb32"):

xpra/server/ssh.py

@@ -93 +93 @@
                     log("ignoring line '%s': %s", line, e)
                     continue
                 import hashlib
-                fp_plain = hashlib.md5(key).hexdigest()
+                try:
+                    fp_plain = hashlib.md5(key).hexdigest()
+                except ValueError:
+                    fp_plain = hashlib.sha1(key).hexdigest()
                 log("key(%s)=%s", line, fp_plain)
                 if fp_plain==hex_fingerprint:
                     return paramiko.OPEN_SUCCEEDED

xpra/server/window/window_source.py

@@ -2329 +2329 @@
                 v = data.data
             except AttributeError:
                 v = data
-            md5 = hashlib.md5(v).hexdigest()
-            client_options["z.md5"] = md5
+            try:
+                chksum = hashlib.md5(v).hexdigest()
+                client_options["z.md5"] = chksum
+            except ValueError:
+                chksum = hashlib.sha1().hexdigest()
+                client_options["z.sha1"] = chksum
             client_options["z.len"] = len(data)
-            log("added len and hash of compressed data integrity %19s: %8i / %s", type(v), len(v), md5)
+            log("added len and hash of compressed data integrity %19s: %8i / %s", type(v), len(v), chksum)
         #actual network packet:
         if self.supports_flush and flush not in (None, 0):
             client_options["flush"] = flush