Compare commits
No commits in common. "imports/c9-beta/python-cryptography-3.4.7-8.el9" and "c8" have entirely different histories.
imports/c9
...
c8
|
|
@ -1,2 +1 @@
|
|||
SOURCES/cryptography-3.4.7-vendor.tar.bz2
|
||||
SOURCES/cryptography-3.4.7.tar.gz
|
||||
SOURCES/cryptography-3.2.1.tar.gz
|
||||
|
|
|
|||
|
|
@ -1,2 +1 @@
|
|||
bbc8da55813a9176b9c9ccf33700903c5f6c107f SOURCES/cryptography-3.4.7-vendor.tar.bz2
|
||||
fff48841f1f4b756a6093bdcc376a3c513ba5aaf SOURCES/cryptography-3.4.7.tar.gz
|
||||
20708a4955dcf7e2bb53d05418273d2bc0f80ab4 SOURCES/cryptography-3.2.1.tar.gz
|
||||
|
|
|
|||
|
|
@ -0,0 +1,254 @@
|
|||
From e3e043ab363387033ddfdcaf3c15d8cf8dda17ed Mon Sep 17 00:00:00 2001
|
||||
From: Christian Heimes <cheimes@redhat.com>
|
||||
Date: Tue, 27 Oct 2020 16:42:15 +0100
|
||||
Subject: [PATCH 1] Re-add deprecated and removed features
|
||||
|
||||
* encode_rfc6979_signature()
|
||||
* decode_rfc6979_signature()
|
||||
* Certificate.serial property
|
||||
* MACContext
|
||||
* osrandom engine is disabled
|
||||
|
||||
Signed-off-by: Christian Heimes <cheimes@redhat.com>
|
||||
---
|
||||
.../hazmat/backends/openssl/cmac.py | 3 +-
|
||||
.../hazmat/backends/openssl/hmac.py | 3 +-
|
||||
.../hazmat/backends/openssl/x509.py | 4 ++
|
||||
.../hazmat/primitives/asymmetric/utils.py | 8 ++++
|
||||
src/cryptography/hazmat/primitives/cmac.py | 3 +-
|
||||
src/cryptography/hazmat/primitives/hmac.py | 3 +-
|
||||
src/cryptography/hazmat/primitives/mac.py | 37 +++++++++++++++++++
|
||||
src/cryptography/x509/extensions.py | 6 ++-
|
||||
tests/hazmat/backends/test_openssl.py | 3 ++
|
||||
tests/hazmat/primitives/test_asym_utils.py | 9 +++++
|
||||
tests/x509/test_x509.py | 1 +
|
||||
tests/x509/test_x509_ext.py | 5 +++
|
||||
12 files changed, 80 insertions(+), 5 deletions(-)
|
||||
create mode 100644 src/cryptography/hazmat/primitives/mac.py
|
||||
|
||||
diff --git a/src/cryptography/hazmat/backends/openssl/cmac.py b/src/cryptography/hazmat/backends/openssl/cmac.py
|
||||
index 195fc230f..5281f634d 100644
|
||||
--- a/src/cryptography/hazmat/backends/openssl/cmac.py
|
||||
+++ b/src/cryptography/hazmat/backends/openssl/cmac.py
|
||||
@@ -11,10 +11,11 @@ from cryptography.exceptions import (
|
||||
UnsupportedAlgorithm,
|
||||
_Reasons,
|
||||
)
|
||||
-from cryptography.hazmat.primitives import constant_time
|
||||
+from cryptography.hazmat.primitives import constant_time, mac
|
||||
from cryptography.hazmat.primitives.ciphers.modes import CBC
|
||||
|
||||
|
||||
+@utils.register_interface(mac.MACContext)
|
||||
class _CMACContext(object):
|
||||
def __init__(self, backend, algorithm, ctx=None):
|
||||
if not backend.cmac_algorithm_supported(algorithm):
|
||||
diff --git a/src/cryptography/hazmat/backends/openssl/hmac.py b/src/cryptography/hazmat/backends/openssl/hmac.py
|
||||
index 5024223b2..11c850e10 100644
|
||||
--- a/src/cryptography/hazmat/backends/openssl/hmac.py
|
||||
+++ b/src/cryptography/hazmat/backends/openssl/hmac.py
|
||||
@@ -11,9 +11,10 @@ from cryptography.exceptions import (
|
||||
UnsupportedAlgorithm,
|
||||
_Reasons,
|
||||
)
|
||||
-from cryptography.hazmat.primitives import constant_time, hashes
|
||||
+from cryptography.hazmat.primitives import constant_time, hashes, mac
|
||||
|
||||
|
||||
+@utils.register_interface(mac.MACContext)
|
||||
@utils.register_interface(hashes.HashContext)
|
||||
class _HMACContext(object):
|
||||
def __init__(self, backend, key, algorithm, ctx=None):
|
||||
diff --git a/src/cryptography/hazmat/backends/openssl/x509.py b/src/cryptography/hazmat/backends/openssl/x509.py
|
||||
index 4d0dac764..c9074f59e 100644
|
||||
--- a/src/cryptography/hazmat/backends/openssl/x509.py
|
||||
+++ b/src/cryptography/hazmat/backends/openssl/x509.py
|
||||
@@ -73,6 +73,10 @@ class _Certificate(object):
|
||||
self._backend.openssl_assert(asn1_int != self._backend._ffi.NULL)
|
||||
return _asn1_integer_to_int(self._backend, asn1_int)
|
||||
|
||||
+ @property
|
||||
+ def serial(self):
|
||||
+ return self.serial_number
|
||||
+
|
||||
def public_key(self):
|
||||
pkey = self._backend._lib.X509_get_pubkey(self._x509)
|
||||
if pkey == self._backend._ffi.NULL:
|
||||
diff --git a/src/cryptography/hazmat/primitives/asymmetric/utils.py b/src/cryptography/hazmat/primitives/asymmetric/utils.py
|
||||
index 5f9b67786..886d7565b 100644
|
||||
--- a/src/cryptography/hazmat/primitives/asymmetric/utils.py
|
||||
+++ b/src/cryptography/hazmat/primitives/asymmetric/utils.py
|
||||
@@ -39,3 +39,11 @@ class Prehashed(object):
|
||||
self._digest_size = algorithm.digest_size
|
||||
|
||||
digest_size = utils.read_only_property("_digest_size")
|
||||
+
|
||||
+
|
||||
+def decode_rfc6979_signature(signature):
|
||||
+ return decode_dss_signature(signature)
|
||||
+
|
||||
+
|
||||
+def encode_rfc6979_signature(r, s):
|
||||
+ return encode_dss_signature(r, s)
|
||||
diff --git a/src/cryptography/hazmat/primitives/cmac.py b/src/cryptography/hazmat/primitives/cmac.py
|
||||
index bf962c906..7f37f13cc 100644
|
||||
--- a/src/cryptography/hazmat/primitives/cmac.py
|
||||
+++ b/src/cryptography/hazmat/primitives/cmac.py
|
||||
@@ -12,9 +12,10 @@ from cryptography.exceptions import (
|
||||
)
|
||||
from cryptography.hazmat.backends import _get_backend
|
||||
from cryptography.hazmat.backends.interfaces import CMACBackend
|
||||
-from cryptography.hazmat.primitives import ciphers
|
||||
+from cryptography.hazmat.primitives import ciphers, mac
|
||||
|
||||
|
||||
+@utils.register_interface(mac.MACContext)
|
||||
class CMAC(object):
|
||||
def __init__(self, algorithm, backend=None, ctx=None):
|
||||
backend = _get_backend(backend)
|
||||
diff --git a/src/cryptography/hazmat/primitives/hmac.py b/src/cryptography/hazmat/primitives/hmac.py
|
||||
index 8c421dc68..6f03a1071 100644
|
||||
--- a/src/cryptography/hazmat/primitives/hmac.py
|
||||
+++ b/src/cryptography/hazmat/primitives/hmac.py
|
||||
@@ -12,9 +12,10 @@ from cryptography.exceptions import (
|
||||
)
|
||||
from cryptography.hazmat.backends import _get_backend
|
||||
from cryptography.hazmat.backends.interfaces import HMACBackend
|
||||
-from cryptography.hazmat.primitives import hashes
|
||||
+from cryptography.hazmat.primitives import hashes, mac
|
||||
|
||||
|
||||
+@utils.register_interface(mac.MACContext)
|
||||
@utils.register_interface(hashes.HashContext)
|
||||
class HMAC(object):
|
||||
def __init__(self, key, algorithm, backend=None, ctx=None):
|
||||
diff --git a/src/cryptography/hazmat/primitives/mac.py b/src/cryptography/hazmat/primitives/mac.py
|
||||
new file mode 100644
|
||||
index 000000000..4c95190ba
|
||||
--- /dev/null
|
||||
+++ b/src/cryptography/hazmat/primitives/mac.py
|
||||
@@ -0,0 +1,37 @@
|
||||
+# This file is dual licensed under the terms of the Apache License, Version
|
||||
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
+# for complete details.
|
||||
+
|
||||
+from __future__ import absolute_import, division, print_function
|
||||
+
|
||||
+import abc
|
||||
+
|
||||
+import six
|
||||
+
|
||||
+
|
||||
+@six.add_metaclass(abc.ABCMeta)
|
||||
+class MACContext(object):
|
||||
+ @abc.abstractmethod
|
||||
+ def update(self, data):
|
||||
+ """
|
||||
+ Processes the provided bytes.
|
||||
+ """
|
||||
+
|
||||
+ @abc.abstractmethod
|
||||
+ def finalize(self):
|
||||
+ """
|
||||
+ Returns the message authentication code as bytes.
|
||||
+ """
|
||||
+
|
||||
+ @abc.abstractmethod
|
||||
+ def copy(self):
|
||||
+ """
|
||||
+ Return a MACContext that is a copy of the current context.
|
||||
+ """
|
||||
+
|
||||
+ @abc.abstractmethod
|
||||
+ def verify(self, signature):
|
||||
+ """
|
||||
+ Checks if the generated message authentication code matches the
|
||||
+ signature.
|
||||
+ """
|
||||
diff --git a/src/cryptography/x509/extensions.py b/src/cryptography/x509/extensions.py
|
||||
index 130ba69b8..ddbccdf3b 100644
|
||||
--- a/src/cryptography/x509/extensions.py
|
||||
+++ b/src/cryptography/x509/extensions.py
|
||||
@@ -218,8 +218,12 @@ class AuthorityKeyIdentifier(object):
|
||||
|
||||
@classmethod
|
||||
def from_issuer_subject_key_identifier(cls, ski):
|
||||
+ if isinstance(ski, SubjectKeyIdentifier):
|
||||
+ digest = ski.digest
|
||||
+ else:
|
||||
+ digest = ski.value.digest
|
||||
return cls(
|
||||
- key_identifier=ski.digest,
|
||||
+ key_identifier=digest,
|
||||
authority_cert_issuer=None,
|
||||
authority_cert_serial_number=None,
|
||||
)
|
||||
diff --git a/tests/hazmat/backends/test_openssl.py b/tests/hazmat/backends/test_openssl.py
|
||||
index 2f7e7bebf..73c17d84f 100644
|
||||
--- a/tests/hazmat/backends/test_openssl.py
|
||||
+++ b/tests/hazmat/backends/test_openssl.py
|
||||
@@ -301,6 +301,9 @@ class TestOpenSSLRandomEngine(object):
|
||||
res = backend._lib.ENGINE_free(e)
|
||||
assert res == 1
|
||||
|
||||
+ def test_rhel8_no_osrandom(self):
|
||||
+ pytest.fail("osrandom engine is not FIPS compliant, see RHBZ#1762667")
|
||||
+
|
||||
|
||||
@pytest.mark.skipif(
|
||||
backend._lib.CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINE,
|
||||
diff --git a/tests/hazmat/primitives/test_asym_utils.py b/tests/hazmat/primitives/test_asym_utils.py
|
||||
index 70bff012f..334b459b5 100644
|
||||
--- a/tests/hazmat/primitives/test_asym_utils.py
|
||||
+++ b/tests/hazmat/primitives/test_asym_utils.py
|
||||
@@ -10,6 +10,8 @@ from cryptography.hazmat.primitives.asymmetric.utils import (
|
||||
Prehashed,
|
||||
decode_dss_signature,
|
||||
encode_dss_signature,
|
||||
+ encode_rfc6979_signature,
|
||||
+ decode_rfc6979_signature
|
||||
)
|
||||
|
||||
|
||||
@@ -75,3 +77,10 @@ def test_decode_dss_invalid_asn1():
|
||||
def test_pass_invalid_prehashed_arg():
|
||||
with pytest.raises(TypeError):
|
||||
Prehashed(object())
|
||||
+
|
||||
+
|
||||
+def test_deprecated_rfc6979_signature():
|
||||
+ sig = encode_rfc6979_signature(1, 1)
|
||||
+ assert sig == b"0\x06\x02\x01\x01\x02\x01\x01"
|
||||
+ decoded = decode_rfc6979_signature(sig)
|
||||
+ assert decoded == (1, 1)
|
||||
diff --git a/tests/x509/test_x509.py b/tests/x509/test_x509.py
|
||||
index 11c80816c..e5bdf17d4 100644
|
||||
--- a/tests/x509/test_x509.py
|
||||
+++ b/tests/x509/test_x509.py
|
||||
@@ -685,6 +685,7 @@ class TestRSACertificate(object):
|
||||
)
|
||||
assert isinstance(cert, x509.Certificate)
|
||||
assert cert.serial_number == 11559813051657483483
|
||||
+ assert cert.serial == cert.serial_number
|
||||
fingerprint = binascii.hexlify(cert.fingerprint(hashes.SHA1()))
|
||||
assert fingerprint == b"2b619ed04bfc9c3b08eb677d272192286a0947a8"
|
||||
assert isinstance(cert.signature_hash_algorithm, hashes.SHA1)
|
||||
diff --git a/tests/x509/test_x509_ext.py b/tests/x509/test_x509_ext.py
|
||||
index 2cd216fb6..ac2b2c03d 100644
|
||||
--- a/tests/x509/test_x509_ext.py
|
||||
+++ b/tests/x509/test_x509_ext.py
|
||||
@@ -3442,6 +3442,11 @@ class TestAuthorityKeyIdentifierExtension(object):
|
||||
)
|
||||
assert ext.value == aki
|
||||
|
||||
+ aki = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(
|
||||
+ ski_ext
|
||||
+ )
|
||||
+ assert ext.value == aki
|
||||
+
|
||||
|
||||
class TestNameConstraints(object):
|
||||
def test_ipaddress_wrong_type(self):
|
||||
--
|
||||
2.26.2
|
||||
|
||||
|
|
@ -1,130 +0,0 @@
|
|||
From cb1908043d5daa7c5c38945c048c4a2477a46221 Mon Sep 17 00:00:00 2001
|
||||
From: Paul Kehrer <paul.l.kehrer@gmail.com>
|
||||
Date: Sun, 28 Feb 2021 16:06:11 -0600
|
||||
Subject: [PATCH 1/3] fix pkcs12 parse ordering. fixes #5872 (#5879)
|
||||
|
||||
* fix pkcs12 parse ordering. fixes #5872
|
||||
|
||||
* remove an unneeded print
|
||||
|
||||
* simplify the test a bit more
|
||||
|
||||
* index
|
||||
|
||||
* black
|
||||
|
||||
* Update tests/hazmat/primitives/test_pkcs12.py
|
||||
|
||||
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
|
||||
|
||||
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
|
||||
---
|
||||
.../hazmat/backends/openssl/backend.py | 5 +-
|
||||
tests/hazmat/primitives/test_pkcs12.py | 58 ++++++++++++++++++-
|
||||
2 files changed, 59 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py
|
||||
index 271873d9..a96d08d8 100644
|
||||
--- a/src/cryptography/hazmat/backends/openssl/backend.py
|
||||
+++ b/src/cryptography/hazmat/backends/openssl/backend.py
|
||||
@@ -6,6 +6,7 @@
|
||||
import collections
|
||||
import contextlib
|
||||
import itertools
|
||||
+import typing
|
||||
import warnings
|
||||
from contextlib import contextmanager
|
||||
|
||||
@@ -2562,9 +2563,7 @@ class Backend(object):
|
||||
sk_x509 = self._lib.sk_X509_new_null()
|
||||
sk_x509 = self._ffi.gc(sk_x509, self._lib.sk_X509_free)
|
||||
|
||||
- # reverse the list when building the stack so that they're encoded
|
||||
- # in the order they were originally provided. it is a mystery
|
||||
- for ca in reversed(cas):
|
||||
+ for ca in cas:
|
||||
res = self._lib.sk_X509_push(sk_x509, ca._x509)
|
||||
backend.openssl_assert(res >= 1)
|
||||
|
||||
diff --git a/tests/hazmat/primitives/test_pkcs12.py b/tests/hazmat/primitives/test_pkcs12.py
|
||||
index b5de09f9..b1759a1b 100644
|
||||
--- a/tests/hazmat/primitives/test_pkcs12.py
|
||||
+++ b/tests/hazmat/primitives/test_pkcs12.py
|
||||
@@ -4,13 +4,15 @@
|
||||
|
||||
|
||||
import os
|
||||
+from datetime import datetime
|
||||
|
||||
import pytest
|
||||
|
||||
from cryptography import x509
|
||||
from cryptography.hazmat.backends.interfaces import DERSerializationBackend
|
||||
from cryptography.hazmat.backends.openssl.backend import _RC2
|
||||
-from cryptography.hazmat.primitives import serialization
|
||||
+from cryptography.hazmat.primitives import hashes, serialization
|
||||
+from cryptography.hazmat.primitives.asymmetric import ec
|
||||
from cryptography.hazmat.primitives.serialization import load_pem_private_key
|
||||
from cryptography.hazmat.primitives.serialization.pkcs12 import (
|
||||
load_key_and_certificates,
|
||||
@@ -273,3 +275,57 @@ class TestPKCS12Creation(object):
|
||||
DummyKeySerializationEncryption(),
|
||||
)
|
||||
assert str(exc.value) == "Unsupported key encryption type"
|
||||
+
|
||||
+
|
||||
+def test_pkcs12_ordering():
|
||||
+ """
|
||||
+ In OpenSSL < 3.0.0 PKCS12 parsing reverses the order. However, we
|
||||
+ accidentally thought it was **encoding** that did it, leading to bug
|
||||
+ https://github.com/pyca/cryptography/issues/5872
|
||||
+ This test ensures our ordering is correct going forward.
|
||||
+ """
|
||||
+
|
||||
+ def make_cert(name):
|
||||
+ key = ec.generate_private_key(ec.SECP256R1())
|
||||
+ subject = x509.Name(
|
||||
+ [
|
||||
+ x509.NameAttribute(x509.NameOID.COMMON_NAME, name),
|
||||
+ ]
|
||||
+ )
|
||||
+ now = datetime.utcnow()
|
||||
+ cert = (
|
||||
+ x509.CertificateBuilder()
|
||||
+ .subject_name(subject)
|
||||
+ .issuer_name(subject)
|
||||
+ .public_key(key.public_key())
|
||||
+ .serial_number(x509.random_serial_number())
|
||||
+ .not_valid_before(now)
|
||||
+ .not_valid_after(now)
|
||||
+ .sign(key, hashes.SHA256())
|
||||
+ )
|
||||
+ return (key, cert)
|
||||
+
|
||||
+ # Make some certificates with distinct names.
|
||||
+ a_name = "A" * 20
|
||||
+ b_name = "B" * 20
|
||||
+ c_name = "C" * 20
|
||||
+ a_key, a_cert = make_cert(a_name)
|
||||
+ _, b_cert = make_cert(b_name)
|
||||
+ _, c_cert = make_cert(c_name)
|
||||
+
|
||||
+ # Bundle them in a PKCS#12 file in order A, B, C.
|
||||
+ p12 = serialize_key_and_certificates(
|
||||
+ b"p12", a_key, a_cert, [b_cert, c_cert], serialization.NoEncryption()
|
||||
+ )
|
||||
+
|
||||
+ # Parse them out. The API should report them in the same order.
|
||||
+ (key, cert, certs) = load_key_and_certificates(p12, None)
|
||||
+ assert cert == a_cert
|
||||
+ assert certs == [b_cert, c_cert]
|
||||
+
|
||||
+ # The ordering in the PKCS#12 file itself should also match.
|
||||
+ a_idx = p12.index(a_name.encode("utf-8"))
|
||||
+ b_idx = p12.index(b_name.encode("utf-8"))
|
||||
+ c_idx = p12.index(c_name.encode("utf-8"))
|
||||
+
|
||||
+ assert a_idx < b_idx < c_idx
|
||||
--
|
||||
2.30.2
|
||||
|
||||
|
|
@ -0,0 +1,86 @@
|
|||
From c1c1b14d359b1360e7d14a7c0687bef9ed6fc17c Mon Sep 17 00:00:00 2001
|
||||
From: Christian Heimes <cheimes@redhat.com>
|
||||
Date: Wed, 28 Oct 2020 14:27:55 +0100
|
||||
Subject: [PATCH 2] Support pytest 3.4.2
|
||||
|
||||
---
|
||||
setup.py | 3 ++-
|
||||
tests/conftest.py | 4 ++--
|
||||
tests/test_utils.py | 4 ++--
|
||||
tests/utils.py | 2 +-
|
||||
4 files changed, 7 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/setup.py b/setup.py
|
||||
index 82800a96e..5678db004 100644
|
||||
--- a/setup.py
|
||||
+++ b/setup.py
|
||||
@@ -93,7 +93,8 @@ setup(
|
||||
extras_require={
|
||||
":python_version < '3'": ["enum34", "ipaddress"],
|
||||
"test": [
|
||||
- "pytest>=3.6.0,!=3.9.0,!=3.9.1,!=3.9.2",
|
||||
+ "pytest>=3.4.2,<3.6",
|
||||
+ "attrs>=17.4.0,<18.0",
|
||||
"pretend",
|
||||
"iso8601",
|
||||
"pytz",
|
||||
diff --git a/tests/conftest.py b/tests/conftest.py
|
||||
index 4e3124fa7..53c194830 100644
|
||||
--- a/tests/conftest.py
|
||||
+++ b/tests/conftest.py
|
||||
@@ -42,7 +42,7 @@ def pytest_generate_tests(metafunc):
|
||||
|
||||
def pytest_runtest_setup(item):
|
||||
if openssl_backend._fips_enabled:
|
||||
- for marker in item.iter_markers(name="skip_fips"):
|
||||
+ for marker in item.get_marker(name="skip_fips") or []:
|
||||
pytest.skip(marker.kwargs["reason"])
|
||||
|
||||
|
||||
@@ -50,7 +50,7 @@ def pytest_runtest_setup(item):
|
||||
def backend(request):
|
||||
required_interfaces = [
|
||||
mark.kwargs["interface"]
|
||||
- for mark in request.node.iter_markers("requires_backend_interface")
|
||||
+ for mark in request.node.get_marker("requires_backend_interface") or []
|
||||
]
|
||||
if not all(
|
||||
isinstance(openssl_backend, iface) for iface in required_interfaces
|
||||
diff --git a/tests/test_utils.py b/tests/test_utils.py
|
||||
index d6afa3b34..e0a1be4f5 100644
|
||||
--- a/tests/test_utils.py
|
||||
+++ b/tests/test_utils.py
|
||||
@@ -43,7 +43,7 @@ def test_check_backend_support_skip():
|
||||
supported = pretend.stub(
|
||||
kwargs={"only_if": lambda backend: False, "skip_message": "Nope"}
|
||||
)
|
||||
- node = pretend.stub(iter_markers=lambda x: [supported])
|
||||
+ node = pretend.stub(get_marker=lambda x: [supported])
|
||||
item = pretend.stub(node=node)
|
||||
with pytest.raises(pytest.skip.Exception) as exc_info:
|
||||
check_backend_support(True, item)
|
||||
@@ -54,7 +54,7 @@ def test_check_backend_support_no_skip():
|
||||
supported = pretend.stub(
|
||||
kwargs={"only_if": lambda backend: True, "skip_message": "Nope"}
|
||||
)
|
||||
- node = pretend.stub(iter_markers=lambda x: [supported])
|
||||
+ node = pretend.stub(get_marker=lambda x: [supported])
|
||||
item = pretend.stub(node=node)
|
||||
assert check_backend_support(None, item) is None
|
||||
|
||||
diff --git a/tests/utils.py b/tests/utils.py
|
||||
index 5d98af00e..a08f79c34 100644
|
||||
--- a/tests/utils.py
|
||||
+++ b/tests/utils.py
|
||||
@@ -27,7 +27,7 @@ KeyedHashVector = collections.namedtuple(
|
||||
|
||||
|
||||
def check_backend_support(backend, item):
|
||||
- for mark in item.node.iter_markers("supported"):
|
||||
+ for mark in item.node.get_marker("supported") or []:
|
||||
if not mark.kwargs["only_if"](backend):
|
||||
pytest.skip("{} ({})".format(mark.kwargs["skip_message"], backend))
|
||||
|
||||
--
|
||||
2.26.2
|
||||
|
||||
|
|
@ -1,415 +0,0 @@
|
|||
From a0bece343e38d73d038d4f3a62c2a9638608ac9c Mon Sep 17 00:00:00 2001
|
||||
From: Paul Kehrer <paul.l.kehrer@gmail.com>
|
||||
Date: Thu, 22 Apr 2021 19:16:38 -0500
|
||||
Subject: [PATCH 2/3] [WIP] 3.0.0 support (#5250)
|
||||
|
||||
* 3.0.0 support
|
||||
|
||||
* almost...there...
|
||||
|
||||
* make mypy happy
|
||||
---
|
||||
.github/workflows/ci.yml | 7 ++--
|
||||
src/_cffi_src/build_openssl.py | 1 +
|
||||
src/_cffi_src/openssl/cryptography.py | 3 ++
|
||||
src/_cffi_src/openssl/err.py | 6 +++
|
||||
src/_cffi_src/openssl/fips.py | 2 +-
|
||||
src/_cffi_src/openssl/provider.py | 40 ++++++++++++++++++
|
||||
.../hazmat/backends/openssl/backend.py | 42 ++++++++++++++++---
|
||||
.../hazmat/backends/openssl/ciphers.py | 15 ++++++-
|
||||
.../hazmat/bindings/openssl/_conditional.py | 11 +++++
|
||||
.../hazmat/bindings/openssl/binding.py | 20 +++++++++
|
||||
tests/hazmat/backends/test_openssl_memleak.py | 6 ++-
|
||||
tests/hazmat/bindings/test_openssl.py | 4 +-
|
||||
tests/hazmat/primitives/test_dh.py | 24 ++++++++++-
|
||||
13 files changed, 167 insertions(+), 14 deletions(-)
|
||||
create mode 100644 src/_cffi_src/openssl/provider.py
|
||||
|
||||
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
|
||||
index cd967a3a..747f84c1 100644
|
||||
--- a/.github/workflows/ci.yml
|
||||
+++ b/.github/workflows/ci.yml
|
||||
@@ -18,9 +18,10 @@ jobs:
|
||||
- {VERSION: "3.9", TOXENV: "flake,rust,docs", COVERAGE: "false"}
|
||||
- {VERSION: "pypy3", TOXENV: "pypy3"}
|
||||
- {VERSION: "3.9", TOXENV: "py39", OPENSSL: {TYPE: "openssl", VERSION: "1.1.0l"}}
|
||||
- - {VERSION: "3.9", TOXENV: "py39", OPENSSL: {TYPE: "openssl", VERSION: "1.1.1i"}}
|
||||
- - {VERSION: "3.9", TOXENV: "py39-ssh", OPENSSL: {TYPE: "openssl", VERSION: "1.1.1i"}}
|
||||
- - {VERSION: "3.9", TOXENV: "py39", OPENSSL: {TYPE: "openssl", VERSION: "1.1.1i", CONFIG_FLAGS: "no-engine no-rc2 no-srtp no-ct"}}
|
||||
+ - {VERSION: "3.9", TOXENV: "py39", OPENSSL: {TYPE: "openssl", VERSION: "1.1.1j"}}
|
||||
+ - {VERSION: "3.9", TOXENV: "py39-ssh", OPENSSL: {TYPE: "openssl", VERSION: "1.1.1j"}}
|
||||
+ - {VERSION: "3.9", TOXENV: "py39", OPENSSL: {TYPE: "openssl", VERSION: "1.1.1j", CONFIG_FLAGS: "no-engine no-rc2 no-srtp no-ct"}}
|
||||
+ - {VERSION: "3.9", TOXENV: "py39", OPENSSL: {TYPE: "openssl", VERSION: "3.0.0-alpha15"}}
|
||||
- {VERSION: "3.9", TOXENV: "py39", OPENSSL: {TYPE: "libressl", VERSION: "2.9.2"}}
|
||||
- {VERSION: "3.9", TOXENV: "py39", OPENSSL: {TYPE: "libressl", VERSION: "3.0.2"}}
|
||||
- {VERSION: "3.9", TOXENV: "py39", OPENSSL: {TYPE: "libressl", VERSION: "3.1.5"}}
|
||||
diff --git a/src/_cffi_src/build_openssl.py b/src/_cffi_src/build_openssl.py
|
||||
index 08499d66..557296ed 100644
|
||||
--- a/src/_cffi_src/build_openssl.py
|
||||
+++ b/src/_cffi_src/build_openssl.py
|
||||
@@ -104,6 +104,7 @@ ffi = build_ffi_for_binding(
|
||||
"osrandom_engine",
|
||||
"pem",
|
||||
"pkcs12",
|
||||
+ "provider",
|
||||
"rand",
|
||||
"rsa",
|
||||
"ssl",
|
||||
diff --git a/src/_cffi_src/openssl/cryptography.py b/src/_cffi_src/openssl/cryptography.py
|
||||
index e2b5a132..06d1e778 100644
|
||||
--- a/src/_cffi_src/openssl/cryptography.py
|
||||
+++ b/src/_cffi_src/openssl/cryptography.py
|
||||
@@ -34,6 +34,8 @@ INCLUDES = """
|
||||
|
||||
#define CRYPTOGRAPHY_OPENSSL_110F_OR_GREATER \
|
||||
(OPENSSL_VERSION_NUMBER >= 0x1010006f && !CRYPTOGRAPHY_IS_LIBRESSL)
|
||||
+#define CRYPTOGRAPHY_OPENSSL_300_OR_GREATER \
|
||||
+ (OPENSSL_VERSION_NUMBER >= 0x30000000 && !CRYPTOGRAPHY_IS_LIBRESSL)
|
||||
|
||||
#define CRYPTOGRAPHY_OPENSSL_LESS_THAN_110J \
|
||||
(OPENSSL_VERSION_NUMBER < 0x101000af || CRYPTOGRAPHY_IS_LIBRESSL)
|
||||
@@ -53,6 +55,7 @@ INCLUDES = """
|
||||
|
||||
TYPES = """
|
||||
static const int CRYPTOGRAPHY_OPENSSL_110F_OR_GREATER;
|
||||
+static const int CRYPTOGRAPHY_OPENSSL_300_OR_GREATER;
|
||||
|
||||
static const int CRYPTOGRAPHY_OPENSSL_LESS_THAN_111;
|
||||
static const int CRYPTOGRAPHY_OPENSSL_LESS_THAN_111B;
|
||||
diff --git a/src/_cffi_src/openssl/err.py b/src/_cffi_src/openssl/err.py
|
||||
index 0634b656..8cfeaf5b 100644
|
||||
--- a/src/_cffi_src/openssl/err.py
|
||||
+++ b/src/_cffi_src/openssl/err.py
|
||||
@@ -18,6 +18,7 @@ static const int EVP_R_UNKNOWN_PBE_ALGORITHM;
|
||||
|
||||
static const int ERR_LIB_EVP;
|
||||
static const int ERR_LIB_PEM;
|
||||
+static const int ERR_LIB_PROV;
|
||||
static const int ERR_LIB_ASN1;
|
||||
static const int ERR_LIB_PKCS12;
|
||||
|
||||
@@ -45,4 +46,9 @@ int ERR_GET_REASON(unsigned long);
|
||||
"""
|
||||
|
||||
CUSTOMIZATIONS = """
|
||||
+/* This define is tied to provider support and is conditionally
|
||||
+ removed if Cryptography_HAS_PROVIDERS is false */
|
||||
+#ifndef ERR_LIB_PROV
|
||||
+#define ERR_LIB_PROV 0
|
||||
+#endif
|
||||
"""
|
||||
diff --git a/src/_cffi_src/openssl/fips.py b/src/_cffi_src/openssl/fips.py
|
||||
index b9d0d64d..23c10af9 100644
|
||||
--- a/src/_cffi_src/openssl/fips.py
|
||||
+++ b/src/_cffi_src/openssl/fips.py
|
||||
@@ -17,7 +17,7 @@ int FIPS_mode(void);
|
||||
"""
|
||||
|
||||
CUSTOMIZATIONS = """
|
||||
-#if CRYPTOGRAPHY_IS_LIBRESSL
|
||||
+#if CRYPTOGRAPHY_IS_LIBRESSL || CRYPTOGRAPHY_OPENSSL_300_OR_GREATER
|
||||
static const long Cryptography_HAS_FIPS = 0;
|
||||
int (*FIPS_mode_set)(int) = NULL;
|
||||
int (*FIPS_mode)(void) = NULL;
|
||||
diff --git a/src/_cffi_src/openssl/provider.py b/src/_cffi_src/openssl/provider.py
|
||||
new file mode 100644
|
||||
index 00000000..d7d659ea
|
||||
--- /dev/null
|
||||
+++ b/src/_cffi_src/openssl/provider.py
|
||||
@@ -0,0 +1,40 @@
|
||||
+# This file is dual licensed under the terms of the Apache License, Version
|
||||
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
+# for complete details.
|
||||
+
|
||||
+
|
||||
+INCLUDES = """
|
||||
+#if CRYPTOGRAPHY_OPENSSL_300_OR_GREATER
|
||||
+#include <openssl/provider.h>
|
||||
+#include <openssl/proverr.h>
|
||||
+#endif
|
||||
+"""
|
||||
+
|
||||
+TYPES = """
|
||||
+static const long Cryptography_HAS_PROVIDERS;
|
||||
+
|
||||
+typedef ... OSSL_PROVIDER;
|
||||
+typedef ... OSSL_LIB_CTX;
|
||||
+
|
||||
+static const long PROV_R_BAD_DECRYPT;
|
||||
+static const long PROV_R_WRONG_FINAL_BLOCK_LENGTH;
|
||||
+"""
|
||||
+
|
||||
+FUNCTIONS = """
|
||||
+OSSL_PROVIDER *OSSL_PROVIDER_load(OSSL_LIB_CTX *, const char *);
|
||||
+int OSSL_PROVIDER_unload(OSSL_PROVIDER *prov);
|
||||
+"""
|
||||
+
|
||||
+CUSTOMIZATIONS = """
|
||||
+#if CRYPTOGRAPHY_OPENSSL_300_OR_GREATER
|
||||
+static const long Cryptography_HAS_PROVIDERS = 1;
|
||||
+#else
|
||||
+static const long Cryptography_HAS_PROVIDERS = 0;
|
||||
+typedef void OSSL_PROVIDER;
|
||||
+typedef void OSSL_LIB_CTX;
|
||||
+static const long PROV_R_BAD_DECRYPT = 0;
|
||||
+static const long PROV_R_WRONG_FINAL_BLOCK_LENGTH = 0;
|
||||
+OSSL_PROVIDER *(*OSSL_PROVIDER_load)(OSSL_LIB_CTX *, const char *) = NULL;
|
||||
+int (*OSSL_PROVIDER_unload)(OSSL_PROVIDER *) = NULL;
|
||||
+#endif
|
||||
+"""
|
||||
diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py
|
||||
index a96d08d8..86e8f0a8 100644
|
||||
--- a/src/cryptography/hazmat/backends/openssl/backend.py
|
||||
+++ b/src/cryptography/hazmat/backends/openssl/backend.py
|
||||
@@ -1281,6 +1281,11 @@ class Backend(object):
|
||||
def _evp_pkey_from_der_traditional_key(self, bio_data, password):
|
||||
key = self._lib.d2i_PrivateKey_bio(bio_data.bio, self._ffi.NULL)
|
||||
if key != self._ffi.NULL:
|
||||
+ # In OpenSSL 3.0.0-alpha15 there exist scenarios where the key will
|
||||
+ # successfully load but errors are still put on the stack. Tracked
|
||||
+ # as https://github.com/openssl/openssl/issues/14996
|
||||
+ self._consume_errors()
|
||||
+
|
||||
key = self._ffi.gc(key, self._lib.EVP_PKEY_free)
|
||||
if password is not None:
|
||||
raise TypeError(
|
||||
@@ -1448,6 +1453,11 @@ class Backend(object):
|
||||
else:
|
||||
self._handle_key_loading_error()
|
||||
|
||||
+ # In OpenSSL 3.0.0-alpha15 there exist scenarios where the key will
|
||||
+ # successfully load but errors are still put on the stack. Tracked
|
||||
+ # as https://github.com/openssl/openssl/issues/14996
|
||||
+ self._consume_errors()
|
||||
+
|
||||
evp_pkey = self._ffi.gc(evp_pkey, self._lib.EVP_PKEY_free)
|
||||
|
||||
if password is not None and userdata.called == 0:
|
||||
@@ -1470,11 +1480,22 @@ class Backend(object):
|
||||
"incorrect format or it may be encrypted with an unsupported "
|
||||
"algorithm."
|
||||
)
|
||||
- elif errors[0]._lib_reason_match(
|
||||
- self._lib.ERR_LIB_EVP, self._lib.EVP_R_BAD_DECRYPT
|
||||
- ) or errors[0]._lib_reason_match(
|
||||
- self._lib.ERR_LIB_PKCS12,
|
||||
- self._lib.PKCS12_R_PKCS12_CIPHERFINAL_ERROR,
|
||||
+
|
||||
+ elif (
|
||||
+ errors[0]._lib_reason_match(
|
||||
+ self._lib.ERR_LIB_EVP, self._lib.EVP_R_BAD_DECRYPT
|
||||
+ )
|
||||
+ or errors[0]._lib_reason_match(
|
||||
+ self._lib.ERR_LIB_PKCS12,
|
||||
+ self._lib.PKCS12_R_PKCS12_CIPHERFINAL_ERROR,
|
||||
+ )
|
||||
+ or (
|
||||
+ self._lib.Cryptography_HAS_PROVIDERS
|
||||
+ and errors[0]._lib_reason_match(
|
||||
+ self._lib.ERR_LIB_PROV,
|
||||
+ self._lib.PROV_R_BAD_DECRYPT,
|
||||
+ )
|
||||
+ )
|
||||
):
|
||||
raise ValueError("Bad decrypt. Incorrect password?")
|
||||
|
||||
@@ -2520,7 +2541,16 @@ class Backend(object):
|
||||
if sk_x509_ptr[0] != self._ffi.NULL:
|
||||
sk_x509 = self._ffi.gc(sk_x509_ptr[0], self._lib.sk_X509_free)
|
||||
num = self._lib.sk_X509_num(sk_x509_ptr[0])
|
||||
- for i in range(num):
|
||||
+
|
||||
+ # In OpenSSL < 3.0.0 PKCS12 parsing reverses the order of the
|
||||
+ # certificates.
|
||||
+ indices: typing.Iterable[int]
|
||||
+ if self._lib.CRYPTOGRAPHY_OPENSSL_300_OR_GREATER:
|
||||
+ indices = range(num)
|
||||
+ else:
|
||||
+ indices = reversed(range(num))
|
||||
+
|
||||
+ for i in indices:
|
||||
x509 = self._lib.sk_X509_value(sk_x509, i)
|
||||
self.openssl_assert(x509 != self._ffi.NULL)
|
||||
x509 = self._ffi.gc(x509, self._lib.X509_free)
|
||||
diff --git a/src/cryptography/hazmat/backends/openssl/ciphers.py b/src/cryptography/hazmat/backends/openssl/ciphers.py
|
||||
index 0f96795f..a2dd6894 100644
|
||||
--- a/src/cryptography/hazmat/backends/openssl/ciphers.py
|
||||
+++ b/src/cryptography/hazmat/backends/openssl/ciphers.py
|
||||
@@ -145,7 +145,13 @@ class _CipherContext(object):
|
||||
res = self._backend._lib.EVP_CipherUpdate(
|
||||
self._ctx, outbuf, outlen, inbuf, inlen
|
||||
)
|
||||
- self._backend.openssl_assert(res != 0)
|
||||
+ if res == 0 and isinstance(self._mode, modes.XTS):
|
||||
+ raise ValueError(
|
||||
+ "In XTS mode you must supply at least a full block in the "
|
||||
+ "first update call. For AES this is 16 bytes."
|
||||
+ )
|
||||
+ else:
|
||||
+ self._backend.openssl_assert(res != 0)
|
||||
data_processed += inlen
|
||||
total_out += outlen[0]
|
||||
|
||||
@@ -174,6 +180,13 @@ class _CipherContext(object):
|
||||
errors[0]._lib_reason_match(
|
||||
self._backend._lib.ERR_LIB_EVP,
|
||||
self._backend._lib.EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH,
|
||||
+ )
|
||||
+ or (
|
||||
+ self._backend._lib.Cryptography_HAS_PROVIDERS
|
||||
+ and errors[0]._lib_reason_match(
|
||||
+ self._backend._lib.ERR_LIB_PROV,
|
||||
+ self._backend._lib.PROV_R_WRONG_FINAL_BLOCK_LENGTH,
|
||||
+ )
|
||||
),
|
||||
errors=errors,
|
||||
)
|
||||
diff --git a/src/cryptography/hazmat/bindings/openssl/_conditional.py b/src/cryptography/hazmat/bindings/openssl/_conditional.py
|
||||
index 86548357..1f42c7be 100644
|
||||
--- a/src/cryptography/hazmat/bindings/openssl/_conditional.py
|
||||
+++ b/src/cryptography/hazmat/bindings/openssl/_conditional.py
|
||||
@@ -270,6 +270,16 @@ def cryptography_has_get_proto_version():
|
||||
]
|
||||
|
||||
|
||||
+def cryptography_has_providers():
|
||||
+ return [
|
||||
+ "OSSL_PROVIDER_load",
|
||||
+ "OSSL_PROVIDER_unload",
|
||||
+ "ERR_LIB_PROV",
|
||||
+ "PROV_R_WRONG_FINAL_BLOCK_LENGTH",
|
||||
+ "PROV_R_BAD_DECRYPT",
|
||||
+ ]
|
||||
+
|
||||
+
|
||||
# This is a mapping of
|
||||
# {condition: function-returning-names-dependent-on-that-condition} so we can
|
||||
# loop over them and delete unsupported names at runtime. It will be removed
|
||||
@@ -318,4 +328,5 @@ CONDITIONAL_NAMES = {
|
||||
"Cryptography_HAS_VERIFIED_CHAIN": cryptography_has_verified_chain,
|
||||
"Cryptography_HAS_SRTP": cryptography_has_srtp,
|
||||
"Cryptography_HAS_GET_PROTO_VERSION": cryptography_has_get_proto_version,
|
||||
+ "Cryptography_HAS_PROVIDERS": cryptography_has_providers,
|
||||
}
|
||||
diff --git a/src/cryptography/hazmat/bindings/openssl/binding.py b/src/cryptography/hazmat/bindings/openssl/binding.py
|
||||
index a2bc36a8..6dcec26a 100644
|
||||
--- a/src/cryptography/hazmat/bindings/openssl/binding.py
|
||||
+++ b/src/cryptography/hazmat/bindings/openssl/binding.py
|
||||
@@ -113,6 +113,8 @@ class Binding(object):
|
||||
ffi = ffi
|
||||
_lib_loaded = False
|
||||
_init_lock = threading.Lock()
|
||||
+ _legacy_provider: typing.Any = None
|
||||
+ _default_provider: typing.Any = None
|
||||
|
||||
def __init__(self):
|
||||
self._ensure_ffi_initialized()
|
||||
@@ -140,6 +142,24 @@ class Binding(object):
|
||||
# adds all ciphers/digests for EVP
|
||||
cls.lib.OpenSSL_add_all_algorithms()
|
||||
cls._register_osrandom_engine()
|
||||
+ # As of OpenSSL 3.0.0 we must register a legacy cipher provider
|
||||
+ # to get RC2 (needed for junk asymmetric private key
|
||||
+ # serialization), RC4, Blowfish, IDEA, SEED, etc. These things
|
||||
+ # are ugly legacy, but we aren't going to get rid of them
|
||||
+ # any time soon.
|
||||
+ if cls.lib.CRYPTOGRAPHY_OPENSSL_300_OR_GREATER:
|
||||
+ cls._legacy_provider = cls.lib.OSSL_PROVIDER_load(
|
||||
+ cls.ffi.NULL, b"legacy"
|
||||
+ )
|
||||
+ _openssl_assert(
|
||||
+ cls.lib, cls._legacy_provider != cls.ffi.NULL
|
||||
+ )
|
||||
+ cls._default_provider = cls.lib.OSSL_PROVIDER_load(
|
||||
+ cls.ffi.NULL, b"default"
|
||||
+ )
|
||||
+ _openssl_assert(
|
||||
+ cls.lib, cls._default_provider != cls.ffi.NULL
|
||||
+ )
|
||||
|
||||
@classmethod
|
||||
def init_static_locks(cls):
|
||||
diff --git a/tests/hazmat/backends/test_openssl_memleak.py b/tests/hazmat/backends/test_openssl_memleak.py
|
||||
index 0c96516f..0316b5d9 100644
|
||||
--- a/tests/hazmat/backends/test_openssl_memleak.py
|
||||
+++ b/tests/hazmat/backends/test_openssl_memleak.py
|
||||
@@ -82,7 +82,7 @@ def main(argv):
|
||||
assert result == 1
|
||||
|
||||
# Trigger a bunch of initialization stuff.
|
||||
- import cryptography.hazmat.backends.openssl
|
||||
+ from cryptography.hazmat.backends.openssl.backend import backend
|
||||
|
||||
start_heap = set(heap)
|
||||
|
||||
@@ -91,6 +91,10 @@ def main(argv):
|
||||
gc.collect()
|
||||
gc.collect()
|
||||
|
||||
+ if lib.CRYPTOGRAPHY_OPENSSL_300_OR_GREATER:
|
||||
+ lib.OSSL_PROVIDER_unload(backend._binding._legacy_provider)
|
||||
+ lib.OSSL_PROVIDER_unload(backend._binding._default_provider)
|
||||
+
|
||||
if lib.Cryptography_HAS_OPENSSL_CLEANUP:
|
||||
lib.OPENSSL_cleanup()
|
||||
|
||||
diff --git a/tests/hazmat/bindings/test_openssl.py b/tests/hazmat/bindings/test_openssl.py
|
||||
index fb9a1e36..4d1e3b55 100644
|
||||
--- a/tests/hazmat/bindings/test_openssl.py
|
||||
+++ b/tests/hazmat/bindings/test_openssl.py
|
||||
@@ -91,7 +91,9 @@ class TestOpenSSL(object):
|
||||
_openssl_assert(b.lib, False)
|
||||
|
||||
error = exc_info.value.err_code[0]
|
||||
- assert error.code == 101183626
|
||||
+ # As of 3.0.0 OpenSSL sets func codes to 0, so the combined
|
||||
+ # code is a different value
|
||||
+ assert error.code in (101183626, 50331786)
|
||||
assert error.lib == b.lib.ERR_LIB_EVP
|
||||
assert error.func == b.lib.EVP_F_EVP_ENCRYPTFINAL_EX
|
||||
assert error.reason == b.lib.EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH
|
||||
diff --git a/tests/hazmat/primitives/test_dh.py b/tests/hazmat/primitives/test_dh.py
|
||||
index 131807fc..bb29919f 100644
|
||||
--- a/tests/hazmat/primitives/test_dh.py
|
||||
+++ b/tests/hazmat/primitives/test_dh.py
|
||||
@@ -180,7 +180,23 @@ class TestDH(object):
|
||||
params = dh.DHParameterNumbers(p, int(vector["g"]))
|
||||
param = params.parameters(backend)
|
||||
key = param.generate_private_key()
|
||||
- assert key.private_numbers().public_numbers.parameter_numbers == params
|
||||
+ # In OpenSSL 3.0.0 OpenSSL maps to known groups. This results in
|
||||
+ # a scenario where loading a known group with p and g returns a
|
||||
+ # re-serialized form that has q as well (the Sophie Germain prime of
|
||||
+ # that group). This makes a naive comparison of the parameter numbers
|
||||
+ # objects fail, so we have to be a bit smarter
|
||||
+ serialized_params = (
|
||||
+ key.private_numbers().public_numbers.parameter_numbers
|
||||
+ )
|
||||
+ if serialized_params.q is None:
|
||||
+ # This is the path OpenSSL < 3.0 takes
|
||||
+ assert serialized_params == params
|
||||
+ else:
|
||||
+ assert serialized_params.p == params.p
|
||||
+ assert serialized_params.g == params.g
|
||||
+ # p = 2q + 1 since it is a Sophie Germain prime, so we can compute
|
||||
+ # what we expect OpenSSL to have done here.
|
||||
+ assert serialized_params.q == (params.p - 1) // 2
|
||||
|
||||
@pytest.mark.skip_fips(reason="non-FIPS parameters")
|
||||
@pytest.mark.parametrize(
|
||||
@@ -382,6 +398,12 @@ class TestDH(object):
|
||||
assert symkey1 != symkey2
|
||||
|
||||
@pytest.mark.skip_fips(reason="key_size too small for FIPS")
|
||||
+ @pytest.mark.supported(
|
||||
+ only_if=lambda backend: (
|
||||
+ not backend._lib.CRYPTOGRAPHY_OPENSSL_300_OR_GREATER
|
||||
+ ),
|
||||
+ skip_message="256-bit DH keys are not supported in OpenSSL 3.0.0+",
|
||||
+ )
|
||||
def test_load_256bit_key_from_pkcs8(self, backend):
|
||||
data = load_vectors_from_file(
|
||||
os.path.join("asymmetric", "DH", "dh_key_256.pem"),
|
||||
--
|
||||
2.30.2
|
||||
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
From bea141d25bd2bc4eea7527e2d6ec1d85b2b3806d Mon Sep 17 00:00:00 2001
|
||||
From: Christian Heimes <cheimes@redhat.com>
|
||||
Date: Thu, 29 Oct 2020 09:21:06 +0100
|
||||
Subject: [PATCH 3] Skip iso8601 test cases
|
||||
|
||||
---
|
||||
tests/test_fernet.py | 15 ++++++++++++++-
|
||||
1 file changed, 14 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/tests/test_fernet.py b/tests/test_fernet.py
|
||||
index 38409b03e..343f3e4ec 100644
|
||||
--- a/tests/test_fernet.py
|
||||
+++ b/tests/test_fernet.py
|
||||
@@ -10,7 +10,10 @@ import json
|
||||
import os
|
||||
import time
|
||||
|
||||
-import iso8601
|
||||
+try:
|
||||
+ import iso8601
|
||||
+except ImportError:
|
||||
+ iso8601 = None
|
||||
|
||||
import pytest
|
||||
|
||||
@@ -24,6 +27,12 @@ from cryptography.hazmat.primitives.ciphers import algorithms, modes
|
||||
import cryptography_vectors
|
||||
|
||||
|
||||
+skip_iso8601 = pytest.mark.skipif(
|
||||
+ iso8601 is None,
|
||||
+ reason="is8601 is not available"
|
||||
+)
|
||||
+
|
||||
+
|
||||
def json_parametrize(keys, filename):
|
||||
vector_file = cryptography_vectors.open_vector_file(
|
||||
os.path.join("fernet", filename), "r"
|
||||
@@ -49,6 +58,7 @@ def test_default_backend():
|
||||
skip_message="Does not support AES CBC",
|
||||
)
|
||||
class TestFernet(object):
|
||||
+ @skip_iso8601
|
||||
@json_parametrize(
|
||||
("secret", "now", "iv", "src", "token"),
|
||||
"generate.json",
|
||||
@@ -62,6 +72,7 @@ class TestFernet(object):
|
||||
)
|
||||
assert actual_token == token.encode("ascii")
|
||||
|
||||
+ @skip_iso8601
|
||||
@json_parametrize(
|
||||
("secret", "now", "src", "ttl_sec", "token"),
|
||||
"verify.json",
|
||||
@@ -81,6 +92,7 @@ class TestFernet(object):
|
||||
payload = f.decrypt(token.encode("ascii"), ttl=ttl_sec)
|
||||
assert payload == src.encode("ascii")
|
||||
|
||||
+ @skip_iso8601
|
||||
@json_parametrize(("secret", "token", "now", "ttl_sec"), "invalid.json")
|
||||
def test_invalid(self, secret, token, now, ttl_sec, backend, monkeypatch):
|
||||
f = Fernet(secret.encode("ascii"), backend=backend)
|
||||
@@ -117,6 +129,7 @@ class TestFernet(object):
|
||||
with pytest.raises(TypeError):
|
||||
f.decrypt(u"")
|
||||
|
||||
+ @skip_iso8601
|
||||
def test_timestamp_ignored_no_ttl(self, monkeypatch, backend):
|
||||
f = Fernet(base64.urlsafe_b64encode(b"\x00" * 32), backend=backend)
|
||||
pt = b"encrypt me"
|
||||
--
|
||||
2.26.2
|
||||
|
||||
|
|
@ -1,151 +0,0 @@
|
|||
From 29cf9b8d63ef3437ba11aa29502af8773faa17a7 Mon Sep 17 00:00:00 2001
|
||||
From: Paul Kehrer <paul.l.kehrer@gmail.com>
|
||||
Date: Wed, 14 Apr 2021 13:15:57 -0500
|
||||
Subject: [PATCH 3/3] switch to using EVP_PKEY_derive instead of DH_compute_key
|
||||
in DH (#5972)
|
||||
|
||||
* switch to using EVP_PKEY_derive instead of DH_compute_key in DH
|
||||
|
||||
Where checks are occurring is changing in OpenSSL 3.0 and this makes it
|
||||
easier to be consistent (and is the API we should be using anyway). The
|
||||
tests change because EVP_PKEY_derive now verifies that we have shared
|
||||
parameters, which the test previously only verified by asserting that
|
||||
the derived keys didn't match
|
||||
|
||||
* review feedback
|
||||
|
||||
* type ignores required for typeerror tests. some day i will remember this
|
||||
---
|
||||
src/_cffi_src/openssl/dh.py | 1 -
|
||||
.../hazmat/backends/openssl/dh.py | 57 ++++++++++++-------
|
||||
tests/hazmat/primitives/test_dh.py | 19 ++++---
|
||||
3 files changed, 45 insertions(+), 32 deletions(-)
|
||||
|
||||
diff --git a/src/_cffi_src/openssl/dh.py b/src/_cffi_src/openssl/dh.py
|
||||
index 979dafa9..50989e45 100644
|
||||
--- a/src/_cffi_src/openssl/dh.py
|
||||
+++ b/src/_cffi_src/openssl/dh.py
|
||||
@@ -18,7 +18,6 @@ DH *DH_new(void);
|
||||
void DH_free(DH *);
|
||||
int DH_size(const DH *);
|
||||
int DH_generate_key(DH *);
|
||||
-int DH_compute_key(unsigned char *, const BIGNUM *, DH *);
|
||||
DH *DHparams_dup(DH *);
|
||||
|
||||
/* added in 1.1.0 when the DH struct was opaqued */
|
||||
diff --git a/src/cryptography/hazmat/backends/openssl/dh.py b/src/cryptography/hazmat/backends/openssl/dh.py
|
||||
index 65ddaeec..b928f024 100644
|
||||
--- a/src/cryptography/hazmat/backends/openssl/dh.py
|
||||
+++ b/src/cryptography/hazmat/backends/openssl/dh.py
|
||||
@@ -127,35 +127,48 @@ class _DHPrivateKey(dh.DHPrivateKey):
|
||||
)
|
||||
|
||||
def exchange(self, peer_public_key: dh.DHPublicKey) -> bytes:
|
||||
- buf = self._backend._ffi.new("unsigned char[]", self._key_size_bytes)
|
||||
- pub_key = self._backend._ffi.new("BIGNUM **")
|
||||
- self._backend._lib.DH_get0_key(
|
||||
- peer_public_key._dh_cdata, # type: ignore[attr-defined]
|
||||
- pub_key,
|
||||
- self._backend._ffi.NULL,
|
||||
+ if not isinstance(peer_public_key, _DHPublicKey):
|
||||
+ raise TypeError("peer_public_key must be a DHPublicKey")
|
||||
+
|
||||
+ ctx = self._backend._lib.EVP_PKEY_CTX_new(
|
||||
+ self._evp_pkey, self._backend._ffi.NULL
|
||||
)
|
||||
- self._backend.openssl_assert(pub_key[0] != self._backend._ffi.NULL)
|
||||
- res = self._backend._lib.DH_compute_key(
|
||||
- buf, pub_key[0], self._dh_cdata
|
||||
+ self._backend.openssl_assert(ctx != self._backend._ffi.NULL)
|
||||
+ ctx = self._backend._ffi.gc(ctx, self._backend._lib.EVP_PKEY_CTX_free)
|
||||
+ res = self._backend._lib.EVP_PKEY_derive_init(ctx)
|
||||
+ self._backend.openssl_assert(res == 1)
|
||||
+ res = self._backend._lib.EVP_PKEY_derive_set_peer(
|
||||
+ ctx, peer_public_key._evp_pkey
|
||||
+ )
|
||||
+ # Invalid kex errors here in OpenSSL 3.0 because checks were moved
|
||||
+ # to EVP_PKEY_derive_set_peer
|
||||
+ self._exchange_assert(res == 1)
|
||||
+ keylen = self._backend._ffi.new("size_t *")
|
||||
+ res = self._backend._lib.EVP_PKEY_derive(
|
||||
+ ctx, self._backend._ffi.NULL, keylen
|
||||
)
|
||||
+ # Invalid kex errors here in OpenSSL < 3
|
||||
+ self._exchange_assert(res == 1)
|
||||
+ self._backend.openssl_assert(keylen[0] > 0)
|
||||
+ buf = self._backend._ffi.new("unsigned char[]", keylen[0])
|
||||
+ res = self._backend._lib.EVP_PKEY_derive(ctx, buf, keylen)
|
||||
+ self._backend.openssl_assert(res == 1)
|
||||
|
||||
- if res == -1:
|
||||
+ key = self._backend._ffi.buffer(buf, keylen[0])[:]
|
||||
+ pad = self._key_size_bytes - len(key)
|
||||
+
|
||||
+ if pad > 0:
|
||||
+ key = (b"\x00" * pad) + key
|
||||
+
|
||||
+ return key
|
||||
+
|
||||
+ def _exchange_assert(self, ok):
|
||||
+ if not ok:
|
||||
errors_with_text = self._backend._consume_errors_with_text()
|
||||
raise ValueError(
|
||||
- "Error computing shared key. Public key is likely invalid "
|
||||
- "for this exchange.",
|
||||
+ "Error computing shared key.",
|
||||
errors_with_text,
|
||||
)
|
||||
- else:
|
||||
- self._backend.openssl_assert(res >= 1)
|
||||
-
|
||||
- key = self._backend._ffi.buffer(buf)[:res]
|
||||
- pad = self._key_size_bytes - len(key)
|
||||
-
|
||||
- if pad > 0:
|
||||
- key = (b"\x00" * pad) + key
|
||||
-
|
||||
- return key
|
||||
|
||||
def public_key(self) -> dh.DHPublicKey:
|
||||
dh_cdata = _dh_params_dup(self._dh_cdata, self._backend)
|
||||
diff --git a/tests/hazmat/primitives/test_dh.py b/tests/hazmat/primitives/test_dh.py
|
||||
index bb29919f..2914f7e7 100644
|
||||
--- a/tests/hazmat/primitives/test_dh.py
|
||||
+++ b/tests/hazmat/primitives/test_dh.py
|
||||
@@ -296,6 +296,12 @@ class TestDH(object):
|
||||
assert isinstance(key.private_numbers(), dh.DHPrivateNumbers)
|
||||
assert isinstance(key.parameters(), dh.DHParameters)
|
||||
|
||||
+ def test_exchange_wrong_type(self, backend):
|
||||
+ parameters = FFDH3072_P.parameters(backend)
|
||||
+ key1 = parameters.generate_private_key()
|
||||
+ with pytest.raises(TypeError):
|
||||
+ key1.exchange(b"invalidtype") # type: ignore[arg-type]
|
||||
+
|
||||
def test_exchange(self, backend):
|
||||
parameters = FFDH3072_P.parameters(backend)
|
||||
assert isinstance(parameters, dh.DHParameters)
|
||||
@@ -386,16 +392,11 @@ class TestDH(object):
|
||||
key2 = private2.private_key(backend)
|
||||
pub_key2 = key2.public_key()
|
||||
|
||||
- if pub_key2.public_numbers().y >= parameters1.p:
|
||||
- with pytest.raises(ValueError):
|
||||
- key1.exchange(pub_key2)
|
||||
- else:
|
||||
- symkey1 = key1.exchange(pub_key2)
|
||||
- assert symkey1
|
||||
-
|
||||
- symkey2 = key2.exchange(pub_key1)
|
||||
+ with pytest.raises(ValueError):
|
||||
+ key1.exchange(pub_key2)
|
||||
|
||||
- assert symkey1 != symkey2
|
||||
+ with pytest.raises(ValueError):
|
||||
+ key2.exchange(pub_key1)
|
||||
|
||||
@pytest.mark.skip_fips(reason="key_size too small for FIPS")
|
||||
@pytest.mark.supported(
|
||||
--
|
||||
2.30.2
|
||||
|
||||
|
|
@ -1,84 +0,0 @@
|
|||
From 417984a48106626b5f6a62763113c0ed1f741f5b Mon Sep 17 00:00:00 2001
|
||||
From: Paul Kehrer <paul.l.kehrer@gmail.com>
|
||||
Date: Wed, 30 Jun 2021 06:14:42 -0500
|
||||
Subject: [PATCH 4/5] 3.0.0 deprecated func and it isn't useful to us in
|
||||
general (#6148)
|
||||
|
||||
remove it everywhere and assert on the code/lib/reason
|
||||
---
|
||||
src/cryptography/hazmat/bindings/openssl/binding.py | 11 ++++-------
|
||||
tests/hazmat/bindings/test_openssl.py | 5 ++---
|
||||
2 files changed, 6 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/src/cryptography/hazmat/bindings/openssl/binding.py b/src/cryptography/hazmat/bindings/openssl/binding.py
|
||||
index 6dcec26a..f651ab67 100644
|
||||
--- a/src/cryptography/hazmat/bindings/openssl/binding.py
|
||||
+++ b/src/cryptography/hazmat/bindings/openssl/binding.py
|
||||
@@ -15,15 +15,14 @@ from cryptography.hazmat.bindings._openssl import ffi, lib
|
||||
from cryptography.hazmat.bindings.openssl._conditional import CONDITIONAL_NAMES
|
||||
|
||||
_OpenSSLErrorWithText = collections.namedtuple(
|
||||
- "_OpenSSLErrorWithText", ["code", "lib", "func", "reason", "reason_text"]
|
||||
+ "_OpenSSLErrorWithText", ["code", "lib", "reason", "reason_text"]
|
||||
)
|
||||
|
||||
|
||||
class _OpenSSLError(object):
|
||||
- def __init__(self, code, lib, func, reason):
|
||||
+ def __init__(self, code, lib, reason):
|
||||
self._code = code
|
||||
self._lib = lib
|
||||
- self._func = func
|
||||
self._reason = reason
|
||||
|
||||
def _lib_reason_match(self, lib, reason):
|
||||
@@ -31,7 +30,6 @@ class _OpenSSLError(object):
|
||||
|
||||
code = utils.read_only_property("_code")
|
||||
lib = utils.read_only_property("_lib")
|
||||
- func = utils.read_only_property("_func")
|
||||
reason = utils.read_only_property("_reason")
|
||||
|
||||
|
||||
@@ -43,10 +41,9 @@ def _consume_errors(lib):
|
||||
break
|
||||
|
||||
err_lib = lib.ERR_GET_LIB(code)
|
||||
- err_func = lib.ERR_GET_FUNC(code)
|
||||
err_reason = lib.ERR_GET_REASON(code)
|
||||
|
||||
- errors.append(_OpenSSLError(code, err_lib, err_func, err_reason))
|
||||
+ errors.append(_OpenSSLError(code, err_lib, err_reason))
|
||||
|
||||
return errors
|
||||
|
||||
@@ -60,7 +57,7 @@ def _errors_with_text(errors):
|
||||
|
||||
errors_with_text.append(
|
||||
_OpenSSLErrorWithText(
|
||||
- err.code, err.lib, err.func, err.reason, err_text_reason
|
||||
+ err.code, err.lib, err.reason, err_text_reason
|
||||
)
|
||||
)
|
||||
|
||||
diff --git a/tests/hazmat/bindings/test_openssl.py b/tests/hazmat/bindings/test_openssl.py
|
||||
index 4d1e3b55..1d9b87ba 100644
|
||||
--- a/tests/hazmat/bindings/test_openssl.py
|
||||
+++ b/tests/hazmat/bindings/test_openssl.py
|
||||
@@ -91,11 +91,10 @@ class TestOpenSSL(object):
|
||||
_openssl_assert(b.lib, False)
|
||||
|
||||
error = exc_info.value.err_code[0]
|
||||
- # As of 3.0.0 OpenSSL sets func codes to 0, so the combined
|
||||
- # code is a different value
|
||||
+ # As of 3.0.0 OpenSSL no longer sets func codes (which we now also
|
||||
+ # ignore), so the combined code is a different value
|
||||
assert error.code in (101183626, 50331786)
|
||||
assert error.lib == b.lib.ERR_LIB_EVP
|
||||
- assert error.func == b.lib.EVP_F_EVP_ENCRYPTFINAL_EX
|
||||
assert error.reason == b.lib.EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH
|
||||
assert b"data not multiple of block length" in error.reason_text
|
||||
|
||||
--
|
||||
2.31.1
|
||||
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
From e8ed37e0d24a1cc7482ab816ed5f25243395b2ef Mon Sep 17 00:00:00 2001
|
||||
From: Christian Heimes <cheimes@redhat.com>
|
||||
Date: Mon, 14 Dec 2020 14:13:53 +0100
|
||||
Subject: [PATCH] Revert "remove NPN bindings -- you should be using ALPN!
|
||||
(#4765)"
|
||||
|
||||
This reverts commit 99bf4e4605cbe54bad597da1ebe4cc323909083c.
|
||||
---
|
||||
src/_cffi_src/openssl/ssl.py | 20 +++++++++++++++++++-
|
||||
tests/hazmat/bindings/test_openssl.py | 4 ++++
|
||||
2 files changed, 23 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/_cffi_src/openssl/ssl.py b/src/_cffi_src/openssl/ssl.py
|
||||
index c38e309a1..fa854f5dd 100644
|
||||
--- a/src/_cffi_src/openssl/ssl.py
|
||||
+++ b/src/_cffi_src/openssl/ssl.py
|
||||
@@ -138,6 +138,8 @@ static const long SSL3_RANDOM_SIZE;
|
||||
static const long TLS_ST_BEFORE;
|
||||
static const long TLS_ST_OK;
|
||||
|
||||
+static const long OPENSSL_NPN_NEGOTIATED;
|
||||
+
|
||||
typedef ... SSL_METHOD;
|
||||
typedef ... SSL_CTX;
|
||||
|
||||
@@ -401,9 +403,25 @@ SRTP_PROTECTION_PROFILE *SSL_get_selected_srtp_profile(SSL *);
|
||||
|
||||
long SSL_session_reused(SSL *);
|
||||
|
||||
+void SSL_CTX_set_next_protos_advertised_cb(SSL_CTX *,
|
||||
+ int (*)(SSL *,
|
||||
+ const unsigned char **,
|
||||
+ unsigned int *,
|
||||
+ void *),
|
||||
+ void *);
|
||||
+void SSL_CTX_set_next_proto_select_cb(SSL_CTX *,
|
||||
+ int (*)(SSL *,
|
||||
+ unsigned char **,
|
||||
+ unsigned char *,
|
||||
+ const unsigned char *,
|
||||
+ unsigned int,
|
||||
+ void *),
|
||||
+ void *);
|
||||
int SSL_select_next_proto(unsigned char **, unsigned char *,
|
||||
const unsigned char *, unsigned int,
|
||||
const unsigned char *, unsigned int);
|
||||
+void SSL_get0_next_proto_negotiated(const SSL *,
|
||||
+ const unsigned char **, unsigned *);
|
||||
|
||||
int sk_SSL_CIPHER_num(Cryptography_STACK_OF_SSL_CIPHER *);
|
||||
const SSL_CIPHER *sk_SSL_CIPHER_value(Cryptography_STACK_OF_SSL_CIPHER *, int);
|
||||
@@ -601,7 +619,7 @@ static const long Cryptography_HAS_TLSv1_2 = 1;
|
||||
static const long Cryptography_HAS_SSL_OP_MSIE_SSLV2_RSA_PADDING = 1;
|
||||
static const long Cryptography_HAS_SSL_OP_NO_TICKET = 1;
|
||||
static const long Cryptography_HAS_SSL_SET_SSL_CTX = 1;
|
||||
-static const long Cryptography_HAS_NEXTPROTONEG = 0;
|
||||
+static const long Cryptography_HAS_NEXTPROTONEG = 1;
|
||||
static const long Cryptography_HAS_ALPN = 1;
|
||||
|
||||
#if CRYPTOGRAPHY_IS_LIBRESSL
|
||||
diff --git a/tests/hazmat/bindings/test_openssl.py b/tests/hazmat/bindings/test_openssl.py
|
||||
index ecee34091..aeb12a0dc 100644
|
||||
--- a/tests/hazmat/bindings/test_openssl.py
|
||||
+++ b/tests/hazmat/bindings/test_openssl.py
|
||||
@@ -137,3 +137,7 @@ class TestOpenSSL(object):
|
||||
)
|
||||
with pytest.raises(RuntimeError):
|
||||
_verify_openssl_version(lib)
|
||||
+
|
||||
+ def test_npn_binding(self):
|
||||
+ b = Binding()
|
||||
+ assert b.lib.Cryptography_HAS_NEXTPROTONEG
|
||||
--
|
||||
2.29.2
|
||||
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
From 962eac3925c7184fb5dc174357823223beba0d85 Mon Sep 17 00:00:00 2001
|
||||
From: Paul Kehrer <paul.l.kehrer@gmail.com>
|
||||
Date: Sun, 7 Feb 2021 11:04:43 -0600
|
||||
Subject: [PATCH] port changelog and fix back to master for CVE-2020-36242
|
||||
|
||||
diff --git a/src/cryptography/hazmat/backends/openssl/ciphers.py b/src/cryptography/hazmat/backends/openssl/ciphers.py
|
||||
index 2b10681b31..0f96795fdc 100644
|
||||
--- a/src/cryptography/hazmat/backends/openssl/ciphers.py
|
||||
+++ b/src/cryptography/hazmat/backends/openssl/ciphers.py
|
||||
@@ -16,7 +16,7 @@
|
||||
class _CipherContext(object):
|
||||
_ENCRYPT = 1
|
||||
_DECRYPT = 0
|
||||
- _MAX_CHUNK_SIZE = 2 ** 31 - 1
|
||||
+ _MAX_CHUNK_SIZE = 2 ** 30 - 1
|
||||
|
||||
def __init__(self, backend, cipher, mode, operation):
|
||||
self._backend = backend
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
From 4df2a650e2f8be0dc118128d39aebe6f32d06d43 Mon Sep 17 00:00:00 2001
|
||||
From: Paul Kehrer <paul.l.kehrer@gmail.com>
|
||||
Date: Wed, 30 Jun 2021 21:12:46 -0500
|
||||
Subject: [PATCH 5/5] remove unneeded binding (#6150)
|
||||
|
||||
---
|
||||
src/_cffi_src/openssl/err.py | 1 -
|
||||
1 file changed, 1 deletion(-)
|
||||
|
||||
diff --git a/src/_cffi_src/openssl/err.py b/src/_cffi_src/openssl/err.py
|
||||
index 8cfeaf5b..8d838d4f 100644
|
||||
--- a/src/_cffi_src/openssl/err.py
|
||||
+++ b/src/_cffi_src/openssl/err.py
|
||||
@@ -40,7 +40,6 @@ void ERR_clear_error(void);
|
||||
void ERR_put_error(int, int, int, const char *, int);
|
||||
|
||||
int ERR_GET_LIB(unsigned long);
|
||||
-int ERR_GET_FUNC(unsigned long);
|
||||
int ERR_GET_REASON(unsigned long);
|
||||
|
||||
"""
|
||||
--
|
||||
2.31.1
|
||||
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
From 94a50a9731f35405f0357fa5f3b177d46a726ab3 Mon Sep 17 00:00:00 2001
|
||||
From: Alex Gaynor <alex.gaynor@gmail.com>
|
||||
Date: Tue, 31 Jan 2023 08:33:54 -0500
|
||||
Subject: [PATCH] Don't allow update_into to mutate immutable objects
|
||||
|
||||
---
|
||||
src/cryptography/hazmat/backends/openssl/ciphers.py | 2 +-
|
||||
tests/hazmat/primitives/test_ciphers.py | 8 ++++++++
|
||||
2 files changed, 9 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/cryptography/hazmat/backends/openssl/ciphers.py b/src/cryptography/hazmat/backends/openssl/ciphers.py
|
||||
index 286583f9325..075d68fb905 100644
|
||||
--- a/src/cryptography/hazmat/backends/openssl/ciphers.py
|
||||
+++ b/src/cryptography/hazmat/backends/openssl/ciphers.py
|
||||
@@ -156,7 +156,7 @@ def update_into(self, data: bytes, buf: bytes) -> int:
|
||||
data_processed = 0
|
||||
total_out = 0
|
||||
outlen = self._backend._ffi.new("int *")
|
||||
- baseoutbuf = self._backend._ffi.from_buffer(buf)
|
||||
+ baseoutbuf = self._backend._ffi.from_buffer(buf, require_writable=True)
|
||||
baseinbuf = self._backend._ffi.from_buffer(data)
|
||||
|
||||
while data_processed != total_data_len:
|
||||
diff --git a/tests/hazmat/primitives/test_ciphers.py b/tests/hazmat/primitives/test_ciphers.py
|
||||
index 02127dd9cab..bf3b047dec2 100644
|
||||
--- a/tests/hazmat/primitives/test_ciphers.py
|
||||
+++ b/tests/hazmat/primitives/test_ciphers.py
|
||||
@@ -318,6 +318,14 @@ def test_update_into_buffer_too_small(self, backend):
|
||||
with pytest.raises(ValueError):
|
||||
encryptor.update_into(b"testing", buf)
|
||||
|
||||
+ def test_update_into_immutable(self, backend):
|
||||
+ key = b"\x00" * 16
|
||||
+ c = ciphers.Cipher(AES(key), modes.ECB(), backend)
|
||||
+ encryptor = c.encryptor()
|
||||
+ buf = b"\x00" * 32
|
||||
+ with pytest.raises((TypeError, BufferError)):
|
||||
+ encryptor.update_into(b"testing", buf)
|
||||
+
|
||||
@pytest.mark.supported(
|
||||
only_if=lambda backend: backend.cipher_supported(
|
||||
AES(b"\x00" * 16), modes.GCM(b"\x00" * 12)
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
From 076560a9507bbe26180f499adf750bc3851b97e8 Mon Sep 17 00:00:00 2001
|
||||
From: Alex Gaynor <alex.gaynor@gmail.com>
|
||||
Date: Mon, 11 Oct 2021 09:43:28 -0400
|
||||
Subject: [PATCH] Specify the out length when obtaining the tag for poly1305
|
||||
|
||||
---
|
||||
src/cryptography/hazmat/backends/openssl/poly1305.py | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/cryptography/hazmat/backends/openssl/poly1305.py b/src/cryptography/hazmat/backends/openssl/poly1305.py
|
||||
index 35f6819ce8..2ddae9847a 100644
|
||||
--- a/src/cryptography/hazmat/backends/openssl/poly1305.py
|
||||
+++ b/src/cryptography/hazmat/backends/openssl/poly1305.py
|
||||
@@ -51,7 +51,7 @@ def update(self, data):
|
||||
|
||||
def finalize(self):
|
||||
buf = self._backend._ffi.new("unsigned char[]", _POLY1305_TAG_SIZE)
|
||||
- outlen = self._backend._ffi.new("size_t *")
|
||||
+ outlen = self._backend._ffi.new("size_t *", _POLY1305_TAG_SIZE)
|
||||
res = self._backend._lib.EVP_DigestSignFinal(self._ctx, buf, outlen)
|
||||
self._backend.openssl_assert(res != 0)
|
||||
self._backend.openssl_assert(outlen[0] == _POLY1305_TAG_SIZE)
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
|
||||
class Skipper:
|
||||
"""Skip iso8601 and pretend tests
|
||||
|
||||
RHEL buildroot doesn't have python-iso8601 and python-pretend. Skip
|
||||
all tests that use the excluded modules.
|
||||
"""
|
||||
|
||||
def parse_date(self, datestring):
|
||||
pytest.skip(f"iso8601 module is not available.")
|
||||
|
||||
def stub(self, **kwargs):
|
||||
pytest.skip(f"pretend module is not available.")
|
||||
|
||||
def raiser(self, exc):
|
||||
pytest.skip(f"pretend module is not available.")
|
||||
|
||||
|
||||
import sys
|
||||
|
||||
sys.modules["iso8601"] = sys.modules["pretend"] = Skipper()
|
||||
|
||||
|
|
@ -1,123 +1,84 @@
|
|||
%bcond_without tests
|
||||
|
||||
%{!?python3_pkgversion:%global python3_pkgversion 3}
|
||||
|
||||
%global srcname cryptography
|
||||
%global pyo3_version 0.13.1
|
||||
# rhbz#2172416: from_buffer(..., require_writable=True)
|
||||
%global cffi_version 1.11.5-6
|
||||
|
||||
Name: python-%{srcname}
|
||||
Version: 3.4.7
|
||||
Release: 8%{?dist}
|
||||
Version: 3.2.1
|
||||
Release: 7%{?dist}
|
||||
Summary: PyCA's cryptography library
|
||||
|
||||
Group: Development/Libraries
|
||||
License: ASL 2.0 or BSD
|
||||
URL: https://cryptography.io/en/latest/
|
||||
Source0: https://github.com/pyca/cryptography/archive/%{version}/%{srcname}-%{version}.tar.gz
|
||||
# created by ./vendor_rust.py helper script
|
||||
Source1: cryptography-%{version}-vendor.tar.bz2
|
||||
Source2: conftest-skipper.py
|
||||
Source0: https://pypi.io/packages/source/c/%{srcname}/%{srcname}-%{version}.tar.gz
|
||||
|
||||
# OpenSSL 3.0.0 patches
|
||||
Patch1: 0001-fix-pkcs12-parse-ordering.-fixes-5872-5879.patch
|
||||
Patch2: 0002-WIP-3.0.0-support-5250.patch
|
||||
Patch3: 0003-switch-to-using-EVP_PKEY_derive-instead-of-DH_comput.patch
|
||||
Patch4: 0004-3.0.0-deprecated-func-and-it-isn-t-useful-to-us-in-g.patch
|
||||
Patch5: 0005-remove-unneeded-binding-6150.patch
|
||||
# OpenSSL 3.0.1 patches
|
||||
Patch6: 0006-Specify-the-out-length-for-poly1305.patch
|
||||
|
||||
ExclusiveArch: %{rust_arches}
|
||||
Patch0001: 0001-Re-add-deprecated-and-removed-features.patch
|
||||
Patch0002: 0002-Support-pytest-3.4.2.patch
|
||||
Patch0003: 0003-Skip-iso8601-test-cases.patch
|
||||
Patch0004: 0004-Revert-remove-NPN-bindings.patch
|
||||
Patch0005: 0005-CVE-2020-36242.patch
|
||||
# https://github.com/pyca/cryptography/pull/8230
|
||||
Patch0006: 0006-CVE-2023-23931.patch
|
||||
|
||||
BuildRequires: openssl-devel
|
||||
BuildRequires: gcc
|
||||
BuildRequires: gnupg2
|
||||
%if 0%{?fedora}
|
||||
BuildRequires: rust-packaging
|
||||
%else
|
||||
BuildRequires: rust-toolset
|
||||
%endif
|
||||
|
||||
BuildRequires: python%{python3_pkgversion}-cffi >= 1.7
|
||||
BuildRequires: python%{python3_pkgversion}-devel
|
||||
BuildRequires: python%{python3_pkgversion}-pytest >= 3.4.2
|
||||
BuildRequires: python%{python3_pkgversion}-setuptools
|
||||
BuildRequires: python%{python3_pkgversion}-setuptools-rust >= 0.11.3
|
||||
BuildRequires: python%{python3_pkgversion}-six >= 1.4.1
|
||||
|
||||
%if %{with tests}
|
||||
%if 0%{?fedora}
|
||||
BuildRequires: python%{python3_pkgversion}-hypothesis >= 1.11.4
|
||||
BuildRequires: python%{python3_pkgversion}-iso8601
|
||||
BuildRequires: python%{python3_pkgversion}-pretend
|
||||
BuildRequires: python%{python3_pkgversion}-pytest-xdist
|
||||
%endif
|
||||
BuildRequires: python%{python3_pkgversion}-pytest >= 6.0
|
||||
BuildRequires: python%{python3_pkgversion}-pytest-subtests >= 0.3.2
|
||||
# BuildRequires: python{python3_pkgversion}-iso8601
|
||||
BuildRequires: python%{python3_pkgversion}-cryptography-vectors = %{version}
|
||||
BuildRequires: python%{python3_pkgversion}-pytz
|
||||
%endif
|
||||
BuildRequires: python%{python3_pkgversion}-six >= 1.4.1
|
||||
BuildRequires: python%{python3_pkgversion}-cffi >= %{cffi_version}
|
||||
|
||||
%description
|
||||
cryptography is a package designed to expose cryptographic primitives and
|
||||
recipes to Python developers.
|
||||
|
||||
%package -n python%{python3_pkgversion}-%{srcname}
|
||||
Group: Development/Libraries
|
||||
Summary: PyCA's cryptography library
|
||||
%{?python_provide:%python_provide python%{python3_pkgversion}-%{srcname}}
|
||||
|
||||
Requires: openssl-libs
|
||||
Requires: python%{python3_pkgversion}-six >= 1.4.1
|
||||
Requires: python%{python3_pkgversion}-cffi >= 1.7
|
||||
%if 0%{?fedora} >= 35 || 0%{?rhel} >= 9
|
||||
# Can be safely removed in Fedora 37
|
||||
Obsoletes: python%{python3_pkgversion}-cryptography-vectors < 3.4.7
|
||||
%endif
|
||||
Requires: python%{python3_pkgversion}-cffi >= %{cffi_version}
|
||||
Conflicts: python%{python3_pkgversion}-cryptography-vectors < %{version}
|
||||
Conflicts: python%{python3_pkgversion}-cryptography-vectors > %{version}
|
||||
|
||||
%description -n python%{python3_pkgversion}-%{srcname}
|
||||
cryptography is a package designed to expose cryptographic primitives and
|
||||
recipes to Python developers.
|
||||
|
||||
|
||||
%prep
|
||||
%autosetup -p1 -n %{srcname}-%{version}
|
||||
|
||||
%generate_buildrequires
|
||||
|
||||
%if 0%{?fedora}
|
||||
# Fedora: use cargo macros to make use of RPMified crates
|
||||
%cargo_prep
|
||||
cd src/rust
|
||||
rm -f Cargo.lock
|
||||
%cargo_generate_buildrequires
|
||||
cd ../..
|
||||
%else
|
||||
# RHEL: use vendored Rust crates
|
||||
%cargo_prep -V 1
|
||||
%endif
|
||||
|
||||
%build
|
||||
%py3_build
|
||||
|
||||
|
||||
%install
|
||||
# Actually other *.c and *.h are appropriate
|
||||
# see https://github.com/pyca/cryptography/issues/1463
|
||||
find . -name .keep -print -delete
|
||||
%py3_install
|
||||
|
||||
%check
|
||||
%if %{with tests}
|
||||
%if 0%{?rhel}
|
||||
# skip hypothesis tests on RHEL
|
||||
rm -rf tests/hypothesis
|
||||
# append skipper to skip iso8601 and pretend tests
|
||||
cat < %{SOURCE2} >> tests/conftest.py
|
||||
%endif
|
||||
|
||||
# see https://github.com/pyca/cryptography/issues/4885 and
|
||||
# see https://bugzilla.redhat.com/show_bug.cgi?id=1761194 for deselected tests
|
||||
# see rhbz#2042413 for memleak. It's unstable with openssl 3.0.1 and makes
|
||||
# not much sense for downstream testing.
|
||||
PYTHONPATH=${PWD}/vectors:%{buildroot}%{python3_sitearch} \
|
||||
%check
|
||||
# workaround for pytest 3.2.0 bug https://github.com/pytest-dev/pytest/issues/2644
|
||||
rm -f tests/hazmat/primitives/test_padding.py
|
||||
# don't run hypothesis tests
|
||||
rm -rf tests/hypothesis
|
||||
PYTHONPATH=%{buildroot}%{python3_sitearch} \
|
||||
%{__python3} -m pytest \
|
||||
-k "not (test_buffer_protocol_alternate_modes or test_dh_parameters_supported or test_load_ecdsa_no_named_curve or test_openssl_memleak)"
|
||||
%endif
|
||||
-k "not test_decrypt_invalid_decrypt"
|
||||
|
||||
|
||||
%files -n python%{python3_pkgversion}-%{srcname}
|
||||
%doc README.rst docs
|
||||
|
|
@ -125,158 +86,52 @@ PYTHONPATH=${PWD}/vectors:%{buildroot}%{python3_sitearch} \
|
|||
%{python3_sitearch}/%{srcname}
|
||||
%{python3_sitearch}/%{srcname}-%{version}-py*.egg-info
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue Feb 08 2022 Tomas Orsava <torsava@redhat.com> - 3.4.7-8
|
||||
- Skip unstable memleak tests, backported from Fedora (BZ#2042413)
|
||||
- Related: rhbz#1990421
|
||||
* Fri Dec 01 2023 Christian Heimes <cheimes@redhat.com> - 3.2.1-7
|
||||
- Fix FTBFS caused by rsa_pkcs1_implicit_rejection OpenSSL feature, resolves: RHEL-17873
|
||||
|
||||
* Tue Feb 08 2022 Tomas Orsava <torsava@redhat.com> - 3.4.7-7
|
||||
- Add automatically generated Obsoletes tag with the python39- prefix
|
||||
for smoother upgrade from RHEL8
|
||||
- Related: rhbz#1990421
|
||||
* Wed Feb 22 2023 Christian Heimes <cheimes@redhat.com> - 3.2.1-6
|
||||
- Fix CVE-2023-23931: Don't allow update_into to mutate immutable objects, resolves rhbz#2172404
|
||||
|
||||
* Tue Jan 18 2022 Christian Heimes <cheimes@redhat.com> - 3.4.7-6
|
||||
- Fix gating issues, resolves: rhbz#2039768
|
||||
- Fix poly1305 test, resolves: rhbz#2043582
|
||||
* Tue Jun 08 2021 Christian Heimes <cheimes@redhat.com> - 3.2.1-5
|
||||
- Rebuild for RHEL 8.5
|
||||
- Resolves: rhbz#1933071
|
||||
|
||||
* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 3.4.7-5
|
||||
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
|
||||
Related: rhbz#1991688
|
||||
* Tue Feb 09 2021 Christian Heimes <cheimes@redhat.com> - 3.2.1-4
|
||||
- CVE-2020-36242: Fixed a bug where certain sequences of update() calls
|
||||
when symmetrically encrypting very large payloads (>2GB) could result
|
||||
in an integer overflow, leading to buffer overflows.
|
||||
- Resolves: rhbz#1926528
|
||||
|
||||
* Sun Aug 08 2021 Christian Heimes <cheimes@redhat.com> - 3.4.7-4
|
||||
- Remove bindings to ERR_GET_FUNC, which has been removed in 3.0.0-beta2
|
||||
- Resolves: rhbz#1953446
|
||||
* Mon Dec 14 17:24:01 CET 2020 Christian Heimes <cheimes@redhat.com> - 3.2.1-3
|
||||
- Conflict with non-matching vector package
|
||||
|
||||
* Tue Jun 15 2021 Mohan Boddu <mboddu@redhat.com> - 3.4.7-3
|
||||
- Rebuilt for RHEL 9 BETA for openssl 3.0
|
||||
- Related: rhbz#1971065
|
||||
|
||||
* Mon Apr 26 2021 Christian Heimes <cheimes@redhat.com> - 3.4.7-2
|
||||
- Add backports of OpenSSL 3.0.0 fixes (upstream PR #6000)
|
||||
- Resolves: rhbz#1953446
|
||||
|
||||
* Wed Apr 21 2021 Christian Heimes <cheimes@redhat.com> - 3.4.7-1
|
||||
- Update to 3.4.7
|
||||
- Remove dependency on python-cryptography-vectors package and use vectors
|
||||
directly from Github source tar ball. Related: rhbz#1952343
|
||||
|
||||
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 3.4.6-2
|
||||
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
|
||||
|
||||
* Wed Mar 03 2021 Christian Heimes <cheimes@redhat.com> - 3.4.6-1
|
||||
- Update to 3.4.6 (#1927044)
|
||||
|
||||
* Mon Feb 15 2021 Christian Heimes <cheimes@redhat.com> - 3.4.5-1
|
||||
- Update to 3.4.5 (#1927044)
|
||||
|
||||
* Fri Feb 12 2021 Christian Heimes <cheimes@redhat.com> - 3.4.4-3
|
||||
- Skip iso8601 and pretend tests on RHEL
|
||||
|
||||
* Fri Feb 12 2021 Christian Heimes <cheimes@redhat.com> - 3.4.4-2
|
||||
- Provide RHEL build infrastructure
|
||||
|
||||
* Wed Feb 10 2021 Christian Heimes <cheimes@redhat.com> - 3.4.4-1
|
||||
- Update to 3.4.4 (#1927044)
|
||||
|
||||
* Mon Feb 08 2021 Christian Heimes <cheimes@redhat.com> - 3.4.2-1
|
||||
- Update to 3.4.2 (#1926339)
|
||||
- Package no longer depends on Rust (#1926181)
|
||||
|
||||
* Mon Feb 08 2021 Fabio Valentini <decathorpe@gmail.com> - 3.4.1-2
|
||||
- Use dynamically generated BuildRequires for PyO3 Rust module.
|
||||
- Drop unnecessary CARGO_NET_OFFLINE environment variable.
|
||||
|
||||
* Sun Feb 07 2021 Christian Heimes <cheimes@redhat.com> - 3.4.1-1
|
||||
- Update to 3.4.1 (#1925953)
|
||||
|
||||
* Sun Feb 07 2021 Christian Heimes <cheimes@redhat.com> - 3.4-2
|
||||
- Add missing abi3 and pytest dependencies
|
||||
|
||||
* Sun Feb 07 2021 Christian Heimes <cheimes@redhat.com> - 3.4-1
|
||||
- Update to 3.4 (#1925953)
|
||||
- Remove Python 2 support
|
||||
- Remove unused python-idna dependency
|
||||
- Add Rust support
|
||||
|
||||
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.1-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||
|
||||
* Thu Dec 10 2020 Christian Heimes <cheimes@redhat.com> - 3.3.1-1
|
||||
- Update to 3.3.1 (#1905756)
|
||||
* Mon Dec 14 14:19:42 CET 2020 Christian Heimes <cheimes@redhat.com> - 3.2.1-2
|
||||
- Re-add remove NPN bindings, required for pyOpenSSL
|
||||
- Resolves: rhbz#1907429
|
||||
|
||||
* Wed Oct 28 2020 Christian Heimes <cheimes@redhat.com> - 3.2.1-1
|
||||
- Update to 3.2.1 (#1892153)
|
||||
- Rebase to upstream release 3.2.1
|
||||
- Resolves: rhbz#1873581
|
||||
- Resolves: rhbz#1778939
|
||||
- Removed dependencies on python-asn1crypto, python-idna
|
||||
|
||||
* Mon Oct 26 2020 Christian Heimes <cheimes@redhat.com> - 3.2-1
|
||||
- Update to 3.2 (#1891378)
|
||||
|
||||
* Mon Sep 07 2020 Christian Heimes <cheimes@redhat.com> - 3.1-1
|
||||
- Update to 3.1 (#1872978)
|
||||
|
||||
* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.0-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Tue Jul 21 2020 Christian Heimes <cheimes@redhat.com> - 3.0-1
|
||||
- Update to 3.0 (#185897)
|
||||
|
||||
* Sat May 23 2020 Miro Hrončok <mhroncok@redhat.com> - 2.9-3
|
||||
- Rebuilt for Python 3.9
|
||||
|
||||
* Tue May 12 2020 Felix Schwarz <fschwarz@fedoraproject.org> - 2.9-2
|
||||
- add source file verification
|
||||
|
||||
* Fri Apr 03 2020 Christian Heimes <cheimes@redhat.com> - 2.9-1
|
||||
- Update to 2.9 (#1820348)
|
||||
|
||||
* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||
|
||||
* Mon Jan 13 2020 Christian Heimes <cheimes@redhat.com> - 2.8-2
|
||||
- cryptography 2.8+ no longer depends on python-asn1crypto
|
||||
|
||||
* Thu Oct 17 2019 Christian Heimes <cheimes@redhat.com> - 2.8-1
|
||||
- Update to 2.8
|
||||
- Resolves: rhbz#1762779
|
||||
|
||||
* Sun Oct 13 2019 Christian Heimes <cheimes@redhat.com> - 2.7-3
|
||||
- Skip unit tests that fail with OpenSSL 1.1.1.d
|
||||
- Resolves: rhbz#1761194
|
||||
- Fix and simplify Python 3 packaging
|
||||
|
||||
* Sat Oct 12 2019 Christian Heimes <cheimes@redhat.com> - 2.7-2
|
||||
- Drop Python 2 package
|
||||
- Resolves: rhbz#1761081
|
||||
|
||||
* Tue Sep 03 2019 Randy Barlow <bowlofeggs@fedoraproject.org> - 2.7-1
|
||||
- Update to 2.7 (#1715680).
|
||||
|
||||
* Fri Aug 16 2019 Miro Hrončok <mhroncok@redhat.com> - 2.6.1-3
|
||||
- Rebuilt for Python 3.8
|
||||
|
||||
* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.1-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||
|
||||
* Thu Feb 28 2019 Christian Heimes <cheimes@redhat.com> - 2.6.1-1
|
||||
- New upstream release 2.6.1, resolves RHBZ#1683691
|
||||
|
||||
* Wed Feb 13 2019 Alfredo Moralejo <amoralej@redhat.com> - 2.5-1
|
||||
- Updated to 2.5.
|
||||
|
||||
* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.3-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||
* Tue Nov 12 2019 Christian Heimes <cheimes@redhat.com> - 2.3-3
|
||||
- Don't activate custom osrandom engine for FIPS compliance
|
||||
- Resolves: rhbz#1762667
|
||||
|
||||
* Mon Aug 13 2018 Christian Heimes <cheimes@redhat.com> - 2.3-2
|
||||
- Use TLSv1.2 in test as workaround for RHBZ#1615143
|
||||
- Use TLSv1.2 in test as workaround for RHBZ#1615099
|
||||
- Resolves: RHBZ#1611738
|
||||
|
||||
* Wed Jul 18 2018 Christian Heimes <cheimes@redhat.com> - 2.3-1
|
||||
- New upstream release 2.3
|
||||
- Fix AEAD tag truncation bug, RHBZ#1602752
|
||||
- Fix AEAD tag truncation bug, CVE-2018-10903, RHBZ#1602755, RHBZ#1602932
|
||||
|
||||
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.1-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||
|
||||
* Fri Jun 15 2018 Miro Hrončok <mhroncok@redhat.com> - 2.2.1-2
|
||||
- Rebuilt for Python 3.7
|
||||
* Tue Jun 19 2018 Christian Heimes <cheimes@redhat.com> - 2.2.1-2
|
||||
- Drop Python 2 subpackages from RHEL 8, fixes RHBZ#1589754
|
||||
- Remove unnecessary copy and shebang mangling
|
||||
|
||||
* Wed Mar 21 2018 Christian Heimes <cheimes@redhat.com> - 2.2.1-1
|
||||
- New upstream release 2.2.1
|
||||
|
|
@ -293,3 +148,130 @@ PYTHONPATH=${PWD}/vectors:%{buildroot}%{python3_sitearch} \
|
|||
|
||||
* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.3-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
||||
|
||||
* Thu Nov 23 2017 Haïkel Guémar <hguemar@fedoraproject.org> - 2.1.3-1
|
||||
- Upstream 2.1.3
|
||||
|
||||
* Tue Oct 24 2017 Christian Heimes <cheimes@redhat.com> - 2.1-2
|
||||
- Change Requires to openssl-libs
|
||||
|
||||
* Thu Oct 12 2017 Christian Heimes <cheimes@redhat.com> - 2.1-1
|
||||
- New upstream release 2.1
|
||||
|
||||
* Wed Sep 27 2017 Troy Dawson <tdawson@redhat.com> - 2.0.2-3
|
||||
- Cleanup spec file conditionals
|
||||
|
||||
* Thu Aug 03 2017 Christian Heimes <cheimes@redhat.com> - 2.0.2-2
|
||||
- Add workaround for pytest bug
|
||||
|
||||
* Thu Aug 03 2017 Christian Heimes <cheimes@redhat.com> - 2.0.2-1
|
||||
- New upstream release 2.0.2
|
||||
- Modernize spec
|
||||
|
||||
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.9-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
|
||||
|
||||
* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.9-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
|
||||
|
||||
* Tue Jun 27 2017 Christian Heimes <cheimes@redhat.com> - 1.9-1
|
||||
- Upstream release 1.9
|
||||
|
||||
* Wed Feb 15 2017 Christian Heimes <cheimes@redhat.com> - 1.7.2-1
|
||||
- Update to latest upstream
|
||||
|
||||
* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.1-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
|
||||
|
||||
* Thu Jan 05 2017 Matěj Cepl <mcepl@redhat.com> - 1.7.1-1
|
||||
- Update to the latest upstream.
|
||||
- Add a patch from https://github.com/pyca/cryptography/pull/3328
|
||||
|
||||
* Tue Dec 13 2016 Charalampos Stratakis <cstratak@redhat.com> - 1.5.3-5
|
||||
- Enable tests
|
||||
|
||||
* Mon Dec 12 2016 Charalampos Stratakis <cstratak@redhat.com> - 1.5.3-4
|
||||
- Rebuild for Python 3.6
|
||||
- Disable python3 tests for now
|
||||
|
||||
* Thu Nov 10 2016 Nathaniel McCallum <npmccallum@redhat.com> - 1.5.3-3
|
||||
- Revert previous change
|
||||
|
||||
* Thu Nov 10 2016 Nathaniel McCallum <npmccallum@redhat.com> - 1.5.3-2
|
||||
- Disable tests on releases earlier than 24
|
||||
|
||||
* Mon Nov 07 2016 Nathaniel McCallum <npmccallum@redhat.com> - 1.5.3-1
|
||||
- Update to v1.5.3
|
||||
- Update source URL
|
||||
- Add BR for pytz
|
||||
|
||||
* Tue Jul 19 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.1-4
|
||||
- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
|
||||
|
||||
* Tue May 10 2016 Nathaniel McCallum <npmccallum@redhat.com> - 1.3.1-3
|
||||
- Remove versioned setuptools dependency
|
||||
|
||||
* Tue May 10 2016 Nathaniel McCallum <npmccallum@redhat.com> - 1.3.1-2
|
||||
- Make it easier to build on EL7
|
||||
|
||||
* Tue May 03 2016 Nathaniel McCallum <npmccallum@redhat.com> - 1.3.1-1
|
||||
- Update to v1.3.1
|
||||
|
||||
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.2.1-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
|
||||
|
||||
* Mon Jan 11 2016 Nathaniel McCallum <npmccallum@redhat.com> - 1.2.1-2
|
||||
- Move python-cryptograph => python2-cryptography
|
||||
|
||||
* Sat Jan 09 2016 Nathaniel McCallum <npmccallum@redhat.com> - 1.2.1-1
|
||||
- Update to v1.2.1
|
||||
|
||||
* Wed Nov 11 2015 Robert Kuska <rkuska@redhat.com> - 1.1-1
|
||||
- Update to v1.1
|
||||
|
||||
* Wed Nov 04 2015 Robert Kuska <rkuska@redhat.com> - 1.0.2-2
|
||||
- Rebuilt for Python3.5 rebuild
|
||||
|
||||
* Wed Sep 30 2015 Matěj Cepl <mcepl@redhat.com> - 1.0.2-1
|
||||
- New upstream release (fix #1267548)
|
||||
|
||||
* Wed Aug 12 2015 Nathaniel McCallum <npmccallum@redhat.com> - 1.0-1
|
||||
- New upstream release
|
||||
|
||||
* Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.9-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
|
||||
|
||||
* Thu May 14 2015 Nathaniel McCallum <npmccallum@redhat.com> - 0.9-1
|
||||
- New upstream release
|
||||
- Run tests on RHEL
|
||||
- New deps: python-idna, python-ipaddress
|
||||
|
||||
* Fri Apr 17 2015 Nathaniel McCallum <npmccallum@redhat.com> - 0.8.2-1
|
||||
- New upstream release
|
||||
- Add python3-pyasn1 Requires (#1211073)
|
||||
|
||||
* Tue Apr 14 2015 Matej Cepl <mcepl@redhat.com> - 0.8-2
|
||||
- Add python-pyasn1 Requires (#1211073)
|
||||
|
||||
* Fri Mar 13 2015 Nathaniel McCallum <npmccallum@redhat.com> - 0.8-1
|
||||
- New upstream release
|
||||
- Remove upstreamed patch
|
||||
|
||||
* Wed Mar 04 2015 Nathaniel McCallum <npmccallum@redhat.com> - 0.7.2-2
|
||||
- Add python3-cryptography-vectors build requires
|
||||
- Add python-enum34 requires
|
||||
|
||||
* Tue Feb 03 2015 Nathaniel McCallum <npmccallum@redhat.com> - 0.7.2-1
|
||||
- New upstream release. BSD is now an optional license.
|
||||
- Fix test running on python3
|
||||
- Add upstream patch to fix test paths
|
||||
|
||||
* Fri Nov 07 2014 Matej Cepl <mcepl@redhat.com> - 0.6.1-2
|
||||
- Fix requires, for reasons why other development files were not
|
||||
eliminated see https://github.com/pyca/cryptography/issues/1463.
|
||||
|
||||
* Wed Nov 05 2014 Matej Cepl <mcepl@redhat.com> - 0.6.1-1
|
||||
- New upstream release.
|
||||
|
||||
* Sun Jun 29 2014 Terry Chia <terrycwk1994@gmail.com> 0.4-1
|
||||
- initial version
|
||||
|
|
|
|||
Loading…
Reference in New Issue