mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-11-07 05:57:07 -08:00
dev-python/cryptography: Remove old versions
Signed-off-by: Michał Górny <mgorny@gentoo.org>
This commit is contained in:
Michał Górny
@@ -1,76 +0,0 @@
|
||||
From 688e0f673bfbf43fa898994326c6877f00ab19ef Mon Sep 17 00:00:00 2001
|
||||
From: Paul Kehrer <paul.l.kehrer@gmail.com>
|
||||
Date: Tue, 17 Jul 2018 10:47:57 +0800
|
||||
Subject: [PATCH] disallow implicit tag truncation with finalize_with_tag
|
||||
|
||||
---
|
||||
docs/hazmat/primitives/symmetric-encryption.rst | 1 +
|
||||
src/cryptography/hazmat/backends/openssl/ciphers.py | 5 +++++
|
||||
src/cryptography/hazmat/primitives/ciphers/modes.py | 1 +
|
||||
tests/hazmat/primitives/test_aes.py | 16 ++++++++++++++++
|
||||
5 files changed, 28 insertions(+)
|
||||
|
||||
diff --git a/docs/hazmat/primitives/symmetric-encryption.rst b/docs/hazmat/primitives/symmetric-encryption.rst
|
||||
index 5ebcca754..5b6000902 100644
|
||||
--- a/docs/hazmat/primitives/symmetric-encryption.rst
|
||||
+++ b/docs/hazmat/primitives/symmetric-encryption.rst
|
||||
@@ -670,6 +670,7 @@ Interfaces
|
||||
:raises ValueError: This is raised when the data provided isn't
|
||||
a multiple of the algorithm's block size, if ``min_tag_length`` is
|
||||
less than 4, or if ``len(tag) < min_tag_length``.
|
||||
+ ``min_tag_length`` is an argument to the ``GCM`` constructor.
|
||||
:raises NotImplementedError: This is raised if the version of the
|
||||
OpenSSL backend used is 1.0.1 or earlier.
|
||||
|
||||
diff --git a/src/cryptography/hazmat/backends/openssl/ciphers.py b/src/cryptography/hazmat/backends/openssl/ciphers.py
|
||||
index 462ffea25..e0ee06ee2 100644
|
||||
--- a/src/cryptography/hazmat/backends/openssl/ciphers.py
|
||||
+++ b/src/cryptography/hazmat/backends/openssl/ciphers.py
|
||||
@@ -199,6 +199,11 @@ def finalize_with_tag(self, tag):
|
||||
"finalize_with_tag requires OpenSSL >= 1.0.2. To use this "
|
||||
"method please update OpenSSL"
|
||||
)
|
||||
+ if len(tag) < self._mode._min_tag_length:
|
||||
+ raise ValueError(
|
||||
+ "Authentication tag must be {0} bytes or longer.".format(
|
||||
+ self._mode._min_tag_length)
|
||||
+ )
|
||||
res = self._backend._lib.EVP_CIPHER_CTX_ctrl(
|
||||
self._ctx, self._backend._lib.EVP_CTRL_AEAD_SET_TAG,
|
||||
len(tag), tag
|
||||
diff --git a/src/cryptography/hazmat/primitives/ciphers/modes.py b/src/cryptography/hazmat/primitives/ciphers/modes.py
|
||||
index 598dfaa4a..543015fef 100644
|
||||
--- a/src/cryptography/hazmat/primitives/ciphers/modes.py
|
||||
+++ b/src/cryptography/hazmat/primitives/ciphers/modes.py
|
||||
@@ -220,6 +220,7 @@ def __init__(self, initialization_vector, tag=None, min_tag_length=16):
|
||||
min_tag_length)
|
||||
)
|
||||
self._tag = tag
|
||||
+ self._min_tag_length = min_tag_length
|
||||
|
||||
tag = utils.read_only_property("_tag")
|
||||
initialization_vector = utils.read_only_property("_initialization_vector")
|
||||
diff --git a/tests/hazmat/primitives/test_aes.py b/tests/hazmat/primitives/test_aes.py
|
||||
index d6f83ebc2..4ceccf155 100644
|
||||
--- a/tests/hazmat/primitives/test_aes.py
|
||||
+++ b/tests/hazmat/primitives/test_aes.py
|
||||
@@ -439,3 +439,19 @@ def test_gcm_tag_decrypt_finalize(self, backend):
|
||||
decryptor.finalize()
|
||||
else:
|
||||
decryptor.finalize_with_tag(tag)
|
||||
+
|
||||
+ @pytest.mark.supported(
|
||||
+ only_if=lambda backend: (
|
||||
+ not backend._lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_102 or
|
||||
+ backend._lib.CRYPTOGRAPHY_IS_LIBRESSL
|
||||
+ ),
|
||||
+ skip_message="Not supported on OpenSSL 1.0.1",
|
||||
+ )
|
||||
+ def test_gcm_tag_decrypt_finalize_tag_length(self, backend):
|
||||
+ decryptor = base.Cipher(
|
||||
+ algorithms.AES(b"0" * 16),
|
||||
+ modes.GCM(b"0" * 12),
|
||||
+ backend=backend
|
||||
+ ).decryptor()
|
||||
+ with pytest.raises(ValueError):
|
||||
+ decryptor.finalize_with_tag(b"tagtooshort")
|
||||
@@ -1,23 +0,0 @@
|
||||
diff -ur a/src/_cffi_src/openssl/x509.py b/src/_cffi_src/openssl/x509.py
|
||||
--- a/src/_cffi_src/openssl/x509.py 2017-07-27 05:11:29.000000000 +0200
|
||||
+++ b/src/_cffi_src/openssl/x509.py 2018-03-23 10:28:00.387774214 +0100
|
||||
@@ -254,8 +254,7 @@
|
||||
|
||||
const X509_ALGOR *X509_get0_tbs_sigalg(const X509 *);
|
||||
|
||||
-/* in 1.1.0 becomes const ASN1_BIT_STRING, const X509_ALGOR */
|
||||
-void X509_get0_signature(ASN1_BIT_STRING **, X509_ALGOR **, X509 *);
|
||||
+void X509_get0_signature(const ASN1_BIT_STRING **, const X509_ALGOR **, const X509 *);
|
||||
|
||||
long X509_get_version(X509 *);
|
||||
|
||||
@@ -338,7 +337,8 @@
|
||||
CUSTOMIZATIONS = """
|
||||
/* Added in 1.0.2 beta but we need it in all versions now due to the great
|
||||
opaquing. */
|
||||
-#if CRYPTOGRAPHY_OPENSSL_LESS_THAN_102
|
||||
+#if CRYPTOGRAPHY_OPENSSL_LESS_THAN_102 && \
|
||||
+ (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2070000fL)
|
||||
/* from x509/x_x509.c version 1.0.2 */
|
||||
void X509_get0_signature(ASN1_BIT_STRING **psig, X509_ALGOR **palg,
|
||||
const X509 *x)
|
||||
@@ -1,73 +0,0 @@
|
||||
$OpenBSD: patch-src__cffi_src_openssl_x509_vfy_py,v 1.7 2018/02/22 18:49:16 sthen Exp $
|
||||
|
||||
--- a/src/_cffi_src/openssl/x509_vfy.py
|
||||
+++ b/src/_cffi_src/openssl/x509_vfy.py
|
||||
@@ -204,7 +204,7 @@ int sk_X509_OBJECT_num(Cryptography_STACK_OF_X509_OBJE
|
||||
X509_OBJECT *sk_X509_OBJECT_value(Cryptography_STACK_OF_X509_OBJECT *, int);
|
||||
X509_VERIFY_PARAM *X509_STORE_get0_param(X509_STORE *);
|
||||
Cryptography_STACK_OF_X509_OBJECT *X509_STORE_get0_objects(X509_STORE *);
|
||||
-X509 *X509_OBJECT_get0_X509(X509_OBJECT *);
|
||||
+X509 *X509_OBJECT_get0_X509(const X509_OBJECT *);
|
||||
int X509_OBJECT_get_type(const X509_OBJECT *);
|
||||
|
||||
/* added in 1.1.0 */
|
||||
@@ -220,14 +220,11 @@ static const long Cryptography_HAS_102_VERIFICATION_ER
|
||||
static const long Cryptography_HAS_102_VERIFICATION_PARAMS = 1;
|
||||
#else
|
||||
static const long Cryptography_HAS_102_VERIFICATION_ERROR_CODES = 0;
|
||||
+#if LIBRESSL_VERSION_NUMBER >= 0x2070000fL
|
||||
+static const long Cryptography_HAS_102_VERIFICATION_PARAMS = 1;
|
||||
+#else
|
||||
static const long Cryptography_HAS_102_VERIFICATION_PARAMS = 0;
|
||||
|
||||
-static const long X509_V_ERR_SUITE_B_INVALID_VERSION = 0;
|
||||
-static const long X509_V_ERR_SUITE_B_INVALID_ALGORITHM = 0;
|
||||
-static const long X509_V_ERR_SUITE_B_INVALID_CURVE = 0;
|
||||
-static const long X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM = 0;
|
||||
-static const long X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED = 0;
|
||||
-static const long X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256 = 0;
|
||||
/* These 3 defines are unavailable in LibreSSL 2.5.x, but may be added
|
||||
in the future... */
|
||||
#ifndef X509_V_ERR_HOSTNAME_MISMATCH
|
||||
@@ -240,12 +237,6 @@ static const long X509_V_ERR_EMAIL_MISMATCH = 0;
|
||||
static const long X509_V_ERR_IP_ADDRESS_MISMATCH = 0;
|
||||
#endif
|
||||
|
||||
-/* X509_V_FLAG_TRUSTED_FIRST is also new in 1.0.2+, but it is added separately
|
||||
- below because it shows up in some earlier 3rd party OpenSSL packages. */
|
||||
-static const long X509_V_FLAG_SUITEB_128_LOS_ONLY = 0;
|
||||
-static const long X509_V_FLAG_SUITEB_192_LOS = 0;
|
||||
-static const long X509_V_FLAG_SUITEB_128_LOS = 0;
|
||||
-
|
||||
int (*X509_VERIFY_PARAM_set1_host)(X509_VERIFY_PARAM *, const char *,
|
||||
size_t) = NULL;
|
||||
int (*X509_VERIFY_PARAM_set1_email)(X509_VERIFY_PARAM *, const char *,
|
||||
@@ -257,6 +248,19 @@ void (*X509_VERIFY_PARAM_set_hostflags)(X509_VERIFY_PA
|
||||
unsigned int) = NULL;
|
||||
#endif
|
||||
|
||||
+static const long X509_V_ERR_SUITE_B_INVALID_VERSION = 0;
|
||||
+static const long X509_V_ERR_SUITE_B_INVALID_ALGORITHM = 0;
|
||||
+static const long X509_V_ERR_SUITE_B_INVALID_CURVE = 0;
|
||||
+static const long X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM = 0;
|
||||
+static const long X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED = 0;
|
||||
+static const long X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256 = 0;
|
||||
+/* X509_V_FLAG_TRUSTED_FIRST is also new in 1.0.2+, but it is added separately
|
||||
+ below because it shows up in some earlier 3rd party OpenSSL packages. */
|
||||
+static const long X509_V_FLAG_SUITEB_128_LOS_ONLY = 0;
|
||||
+static const long X509_V_FLAG_SUITEB_192_LOS = 0;
|
||||
+static const long X509_V_FLAG_SUITEB_128_LOS = 0;
|
||||
+#endif
|
||||
+
|
||||
/* OpenSSL 1.0.2+ or Solaris's backport */
|
||||
#ifdef X509_V_FLAG_PARTIAL_CHAIN
|
||||
static const long Cryptography_HAS_X509_V_FLAG_PARTIAL_CHAIN = 1;
|
||||
@@ -292,7 +296,7 @@ X509 *X509_STORE_CTX_get0_cert(X509_STORE_CTX *ctx)
|
||||
return ctx->cert;
|
||||
}
|
||||
|
||||
-X509 *X509_OBJECT_get0_X509(X509_OBJECT *x) {
|
||||
+X509 *X509_OBJECT_get0_X509(const X509_OBJECT *x) {
|
||||
return x->data.x509;
|
||||
}
|
||||
#endif
|
||||
Reference in New Issue
Block a user