From 5eb42d0b641a394ccb2bc3ad03873dfff8f6ea54 Mon Sep 17 00:00:00 2001 From: Alex Gaynor Date: Tue, 28 Jan 2025 15:32:37 -0500 Subject: [PATCH 1/2] fixes #10808 -- allow empty plaintexts for aes-gcm-siv --- .../bindings/_rust/openssl/__init__.pyi | 1 + src/rust/Cargo.toml | 2 +- src/rust/build.rs | 3 +++ src/rust/src/backend/aead.rs | 1 + src/rust/src/lib.rs | 4 ++++ tests/hazmat/primitives/test_aead.py | 22 ++++++++++++++++--- 6 files changed, 29 insertions(+), 4 deletions(-) diff --git a/src/cryptography/hazmat/bindings/_rust/openssl/__init__.pyi b/src/cryptography/hazmat/bindings/_rust/openssl/__init__.pyi index 320cef10250e..600b48d7de06 100644 --- a/src/cryptography/hazmat/bindings/_rust/openssl/__init__.pyi +++ b/src/cryptography/hazmat/bindings/_rust/openssl/__init__.pyi @@ -50,6 +50,7 @@ CRYPTOGRAPHY_IS_BORINGSSL: bool CRYPTOGRAPHY_OPENSSL_300_OR_GREATER: bool CRYPTOGRAPHY_OPENSSL_309_OR_GREATER: bool CRYPTOGRAPHY_OPENSSL_320_OR_GREATER: bool +CRYPTOGRAPHY_OPENSSL_350_OR_GREATER: bool class Providers: ... diff --git a/src/rust/Cargo.toml b/src/rust/Cargo.toml index 90cfa797f676..b69da58de5ef 100644 --- a/src/rust/Cargo.toml +++ b/src/rust/Cargo.toml @@ -33,4 +33,4 @@ name = "cryptography_rust" crate-type = ["cdylib"] [lints.rust] -unexpected_cfgs = { level = "warn", check-cfg = ['cfg(CRYPTOGRAPHY_OPENSSL_300_OR_GREATER)', 'cfg(CRYPTOGRAPHY_OPENSSL_309_OR_GREATER)', 'cfg(CRYPTOGRAPHY_OPENSSL_320_OR_GREATER)', 'cfg(CRYPTOGRAPHY_IS_LIBRESSL)', 'cfg(CRYPTOGRAPHY_IS_BORINGSSL)', 'cfg(CRYPTOGRAPHY_OSSLCONF, values("OPENSSL_NO_IDEA", "OPENSSL_NO_CAST", "OPENSSL_NO_BF", "OPENSSL_NO_CAMELLIA", "OPENSSL_NO_SEED", "OPENSSL_NO_SM4"))'] } +unexpected_cfgs = { level = "warn", check-cfg = ['cfg(CRYPTOGRAPHY_OPENSSL_300_OR_GREATER)', 'cfg(CRYPTOGRAPHY_OPENSSL_309_OR_GREATER)', 'cfg(CRYPTOGRAPHY_OPENSSL_320_OR_GREATER)', 'cfg(CRYPTOGRAPHY_OPENSSL_350_OR_GREATER)', 'cfg(CRYPTOGRAPHY_IS_LIBRESSL)', 'cfg(CRYPTOGRAPHY_IS_BORINGSSL)', 'cfg(CRYPTOGRAPHY_OSSLCONF, values("OPENSSL_NO_IDEA", "OPENSSL_NO_CAST", "OPENSSL_NO_BF", "OPENSSL_NO_CAMELLIA", "OPENSSL_NO_SEED", "OPENSSL_NO_SM4"))'] } diff --git a/src/rust/build.rs b/src/rust/build.rs index 2d94d8da7ba3..971da8c8bf9b 100644 --- a/src/rust/build.rs +++ b/src/rust/build.rs @@ -18,6 +18,9 @@ fn main() { if version >= 0x3_02_00_00_0 { println!("cargo:rustc-cfg=CRYPTOGRAPHY_OPENSSL_320_OR_GREATER"); } + if version >= 0x3_05_00_00_0 { + println!("cargo:rustc-cfg=CRYPTOGRAPHY_OPENSSL_320_OR_GREATER"); + } } if env::var("DEP_OPENSSL_LIBRESSL_VERSION_NUMBER").is_ok() { diff --git a/src/rust/src/backend/aead.rs b/src/rust/src/backend/aead.rs index 5543dbc43d88..5625561369fb 100644 --- a/src/rust/src/backend/aead.rs +++ b/src/rust/src/backend/aead.rs @@ -1141,6 +1141,7 @@ impl AesGcmSiv { let data_bytes = data.as_bytes(); let aad = associated_data.map(Aad::Single); + #[cfg(not(any(CRYPTOGRAPHY_OPENSSL_350_OR_GREATER, CRYPTOGRAPHY_IS_BORINGSSL)))] if data_bytes.is_empty() { return Err(CryptographyError::from( pyo3::exceptions::PyValueError::new_err("data must not be zero length"), diff --git a/src/rust/src/lib.rs b/src/rust/src/lib.rs index b2642c5ce999..ed3052d3419d 100644 --- a/src/rust/src/lib.rs +++ b/src/rust/src/lib.rs @@ -207,6 +207,10 @@ mod _rust { "CRYPTOGRAPHY_OPENSSL_320_OR_GREATER", cfg!(CRYPTOGRAPHY_OPENSSL_320_OR_GREATER), )?; + openssl_mod.add( + "CRYPTOGRAPHY_OPENSSL_350_OR_GREATER", + cfg!(CRYPTOGRAPHY_OPENSSL_350_OR_GREATER), + )?; openssl_mod.add("CRYPTOGRAPHY_IS_LIBRESSL", cfg!(CRYPTOGRAPHY_IS_LIBRESSL))?; openssl_mod.add("CRYPTOGRAPHY_IS_BORINGSSL", cfg!(CRYPTOGRAPHY_IS_BORINGSSL))?; diff --git a/tests/hazmat/primitives/test_aead.py b/tests/hazmat/primitives/test_aead.py index 8b497890fb12..ac9eb168b9d9 100644 --- a/tests/hazmat/primitives/test_aead.py +++ b/tests/hazmat/primitives/test_aead.py @@ -892,13 +892,29 @@ def test_invalid_nonce_length(self, backend): with pytest.raises(ValueError): aesgcmsiv.decrypt(nonce, pt, None) - def test_no_empty_encryption(self): + def test_empty(self): key = AESGCMSIV.generate_key(256) aesgcmsiv = AESGCMSIV(key) nonce = os.urandom(12) - with pytest.raises(ValueError): - aesgcmsiv.encrypt(nonce, b"", None) + if ( + not rust_openssl.CRYPTOGRAPHY_OPENSSL_350_OR_GREATER + and not rust_openssl.CRYPTOGRAPHY_IS_BORINGSSL + ): + with pytest.raises(ValueError): + aesgcmsiv.encrypt(nonce, b"", None) + else: + # From RFC 8452 + assert ( + AESGCMSIV( + b"\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + ).encrypt( + b"\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", + b"", + b"", + ) + == b"\xdc \xe2\xd8?%p[\xb4\x9eC\x9e\xcaV\xde%" + ) with pytest.raises(InvalidTag): aesgcmsiv.decrypt(nonce, b"", None) From 7c505bcfb4a0f81a53f2f14fcab8d3fdec174720 Mon Sep 17 00:00:00 2001 From: Alex Gaynor Date: Wed, 29 Jan 2025 13:38:50 -0500 Subject: [PATCH 2/2] Update src/rust/build.rs Co-authored-by: Nick Pope --- src/rust/build.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/rust/build.rs b/src/rust/build.rs index 971da8c8bf9b..b6d750c6d827 100644 --- a/src/rust/build.rs +++ b/src/rust/build.rs @@ -19,7 +19,7 @@ fn main() { println!("cargo:rustc-cfg=CRYPTOGRAPHY_OPENSSL_320_OR_GREATER"); } if version >= 0x3_05_00_00_0 { - println!("cargo:rustc-cfg=CRYPTOGRAPHY_OPENSSL_320_OR_GREATER"); + println!("cargo:rustc-cfg=CRYPTOGRAPHY_OPENSSL_350_OR_GREATER"); } }