|
|
c5b9d7 |
From 0d4515001c99025c024d773f34d3eb97833d0b5d Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Charalampos Stratakis <cstratak@redhat.com>
|
|
|
c5b9d7 |
Date: Fri, 29 Jan 2021 14:16:21 +0100
|
|
|
c5b9d7 |
Subject: [PATCH 01/13] Use python's fall backs for the crypto it implements
|
|
|
c5b9d7 |
only if we are not in FIPS mode
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Lib/hashlib.py | 194 +++++++++++++++------------------------
|
|
|
c5b9d7 |
Lib/test/test_hashlib.py | 1 +
|
|
|
c5b9d7 |
2 files changed, 76 insertions(+), 119 deletions(-)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/hashlib.py b/Lib/hashlib.py
|
|
|
c5b9d7 |
index 58c340d56e3..1fd80c7d4fd 100644
|
|
|
c5b9d7 |
--- a/Lib/hashlib.py
|
|
|
c5b9d7 |
+++ b/Lib/hashlib.py
|
|
|
c5b9d7 |
@@ -68,8 +68,6 @@ __all__ = __always_supported + ('new', 'algorithms_guaranteed',
|
|
|
c5b9d7 |
'algorithms_available', 'pbkdf2_hmac')
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
-__builtin_constructor_cache = {}
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
# Prefer our blake2 implementation
|
|
|
c5b9d7 |
# OpenSSL 1.1.0 comes with a limited implementation of blake2b/s. The OpenSSL
|
|
|
c5b9d7 |
# implementations neither support keyed blake2 (blake2 MAC) nor advanced
|
|
|
c5b9d7 |
@@ -79,54 +77,64 @@ __block_openssl_constructor = {
|
|
|
c5b9d7 |
'blake2b', 'blake2s',
|
|
|
c5b9d7 |
}
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
-def __get_builtin_constructor(name):
|
|
|
c5b9d7 |
- cache = __builtin_constructor_cache
|
|
|
c5b9d7 |
- constructor = cache.get(name)
|
|
|
c5b9d7 |
- if constructor is not None:
|
|
|
c5b9d7 |
- return constructor
|
|
|
c5b9d7 |
- try:
|
|
|
c5b9d7 |
- if name in {'SHA1', 'sha1'}:
|
|
|
c5b9d7 |
- import _sha1
|
|
|
c5b9d7 |
- cache['SHA1'] = cache['sha1'] = _sha1.sha1
|
|
|
c5b9d7 |
- elif name in {'MD5', 'md5'}:
|
|
|
c5b9d7 |
- import _md5
|
|
|
c5b9d7 |
- cache['MD5'] = cache['md5'] = _md5.md5
|
|
|
c5b9d7 |
- elif name in {'SHA256', 'sha256', 'SHA224', 'sha224'}:
|
|
|
c5b9d7 |
- import _sha256
|
|
|
c5b9d7 |
- cache['SHA224'] = cache['sha224'] = _sha256.sha224
|
|
|
c5b9d7 |
- cache['SHA256'] = cache['sha256'] = _sha256.sha256
|
|
|
c5b9d7 |
- elif name in {'SHA512', 'sha512', 'SHA384', 'sha384'}:
|
|
|
c5b9d7 |
- import _sha512
|
|
|
c5b9d7 |
- cache['SHA384'] = cache['sha384'] = _sha512.sha384
|
|
|
c5b9d7 |
- cache['SHA512'] = cache['sha512'] = _sha512.sha512
|
|
|
c5b9d7 |
- elif name in {'blake2b', 'blake2s'}:
|
|
|
c5b9d7 |
- import _blake2
|
|
|
c5b9d7 |
- cache['blake2b'] = _blake2.blake2b
|
|
|
c5b9d7 |
- cache['blake2s'] = _blake2.blake2s
|
|
|
c5b9d7 |
- elif name in {'sha3_224', 'sha3_256', 'sha3_384', 'sha3_512'}:
|
|
|
c5b9d7 |
- import _sha3
|
|
|
c5b9d7 |
- cache['sha3_224'] = _sha3.sha3_224
|
|
|
c5b9d7 |
- cache['sha3_256'] = _sha3.sha3_256
|
|
|
c5b9d7 |
- cache['sha3_384'] = _sha3.sha3_384
|
|
|
c5b9d7 |
- cache['sha3_512'] = _sha3.sha3_512
|
|
|
c5b9d7 |
- elif name in {'shake_128', 'shake_256'}:
|
|
|
c5b9d7 |
- import _sha3
|
|
|
c5b9d7 |
- cache['shake_128'] = _sha3.shake_128
|
|
|
c5b9d7 |
- cache['shake_256'] = _sha3.shake_256
|
|
|
c5b9d7 |
- except ImportError:
|
|
|
c5b9d7 |
- pass # no extension module, this hash is unsupported.
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
- constructor = cache.get(name)
|
|
|
c5b9d7 |
- if constructor is not None:
|
|
|
c5b9d7 |
- return constructor
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
- raise ValueError('unsupported hash type ' + name)
|
|
|
c5b9d7 |
+try:
|
|
|
c5b9d7 |
+ from _hashlib import get_fips_mode
|
|
|
c5b9d7 |
+except ImportError:
|
|
|
c5b9d7 |
+ def get_fips_mode():
|
|
|
c5b9d7 |
+ return 0
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+if not get_fips_mode():
|
|
|
c5b9d7 |
+ __builtin_constructor_cache = {}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ def __get_builtin_constructor(name):
|
|
|
c5b9d7 |
+ cache = __builtin_constructor_cache
|
|
|
c5b9d7 |
+ constructor = cache.get(name)
|
|
|
c5b9d7 |
+ if constructor is not None:
|
|
|
c5b9d7 |
+ return constructor
|
|
|
c5b9d7 |
+ try:
|
|
|
c5b9d7 |
+ if name in {'SHA1', 'sha1'}:
|
|
|
c5b9d7 |
+ import _sha1
|
|
|
c5b9d7 |
+ cache['SHA1'] = cache['sha1'] = _sha1.sha1
|
|
|
c5b9d7 |
+ elif name in {'MD5', 'md5'}:
|
|
|
c5b9d7 |
+ import _md5
|
|
|
c5b9d7 |
+ cache['MD5'] = cache['md5'] = _md5.md5
|
|
|
c5b9d7 |
+ elif name in {'SHA256', 'sha256', 'SHA224', 'sha224'}:
|
|
|
c5b9d7 |
+ import _sha256
|
|
|
c5b9d7 |
+ cache['SHA224'] = cache['sha224'] = _sha256.sha224
|
|
|
c5b9d7 |
+ cache['SHA256'] = cache['sha256'] = _sha256.sha256
|
|
|
c5b9d7 |
+ elif name in {'SHA512', 'sha512', 'SHA384', 'sha384'}:
|
|
|
c5b9d7 |
+ import _sha512
|
|
|
c5b9d7 |
+ cache['SHA384'] = cache['sha384'] = _sha512.sha384
|
|
|
c5b9d7 |
+ cache['SHA512'] = cache['sha512'] = _sha512.sha512
|
|
|
c5b9d7 |
+ elif name in {'blake2b', 'blake2s'}:
|
|
|
c5b9d7 |
+ import _blake2
|
|
|
c5b9d7 |
+ cache['blake2b'] = _blake2.blake2b
|
|
|
c5b9d7 |
+ cache['blake2s'] = _blake2.blake2s
|
|
|
c5b9d7 |
+ elif name in {'sha3_224', 'sha3_256', 'sha3_384', 'sha3_512'}:
|
|
|
c5b9d7 |
+ import _sha3
|
|
|
c5b9d7 |
+ cache['sha3_224'] = _sha3.sha3_224
|
|
|
c5b9d7 |
+ cache['sha3_256'] = _sha3.sha3_256
|
|
|
c5b9d7 |
+ cache['sha3_384'] = _sha3.sha3_384
|
|
|
c5b9d7 |
+ cache['sha3_512'] = _sha3.sha3_512
|
|
|
c5b9d7 |
+ elif name in {'shake_128', 'shake_256'}:
|
|
|
c5b9d7 |
+ import _sha3
|
|
|
c5b9d7 |
+ cache['shake_128'] = _sha3.shake_128
|
|
|
c5b9d7 |
+ cache['shake_256'] = _sha3.shake_256
|
|
|
c5b9d7 |
+ except ImportError:
|
|
|
c5b9d7 |
+ pass # no extension module, this hash is unsupported.
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ constructor = cache.get(name)
|
|
|
c5b9d7 |
+ if constructor is not None:
|
|
|
c5b9d7 |
+ return constructor
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ raise ValueError('unsupported hash type ' + name)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def __get_openssl_constructor(name):
|
|
|
c5b9d7 |
- if name in __block_openssl_constructor:
|
|
|
c5b9d7 |
- # Prefer our builtin blake2 implementation.
|
|
|
c5b9d7 |
- return __get_builtin_constructor(name)
|
|
|
c5b9d7 |
+ if not get_fips_mode():
|
|
|
c5b9d7 |
+ if name in __block_openssl_constructor:
|
|
|
c5b9d7 |
+ # Prefer our builtin blake2 implementation.
|
|
|
c5b9d7 |
+ return __get_builtin_constructor(name)
|
|
|
c5b9d7 |
try:
|
|
|
c5b9d7 |
# MD5, SHA1, and SHA2 are in all supported OpenSSL versions
|
|
|
c5b9d7 |
# SHA3/shake are available in OpenSSL 1.1.1+
|
|
|
c5b9d7 |
@@ -141,21 +149,23 @@ def __get_openssl_constructor(name):
|
|
|
c5b9d7 |
return __get_builtin_constructor(name)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
-def __py_new(name, data=b'', **kwargs):
|
|
|
c5b9d7 |
- """new(name, data=b'', **kwargs) - Return a new hashing object using the
|
|
|
c5b9d7 |
- named algorithm; optionally initialized with data (which must be
|
|
|
c5b9d7 |
- a bytes-like object).
|
|
|
c5b9d7 |
- """
|
|
|
c5b9d7 |
- return __get_builtin_constructor(name)(data, **kwargs)
|
|
|
c5b9d7 |
+if not get_fips_mode():
|
|
|
c5b9d7 |
+ def __py_new(name, data=b'', **kwargs):
|
|
|
c5b9d7 |
+ """new(name, data=b'', **kwargs) - Return a new hashing object using the
|
|
|
c5b9d7 |
+ named algorithm; optionally initialized with data (which must be
|
|
|
c5b9d7 |
+ a bytes-like object).
|
|
|
c5b9d7 |
+ """
|
|
|
c5b9d7 |
+ return __get_builtin_constructor(name)(data, **kwargs)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def __hash_new(name, data=b'', **kwargs):
|
|
|
c5b9d7 |
"""new(name, data=b'') - Return a new hashing object using the named algorithm;
|
|
|
c5b9d7 |
optionally initialized with data (which must be a bytes-like object).
|
|
|
c5b9d7 |
"""
|
|
|
c5b9d7 |
- if name in __block_openssl_constructor:
|
|
|
c5b9d7 |
- # Prefer our builtin blake2 implementation.
|
|
|
c5b9d7 |
- return __get_builtin_constructor(name)(data, **kwargs)
|
|
|
c5b9d7 |
+ if not get_fips_mode():
|
|
|
c5b9d7 |
+ if name in __block_openssl_constructor:
|
|
|
c5b9d7 |
+ # Prefer our builtin blake2 implementation.
|
|
|
c5b9d7 |
+ return __get_builtin_constructor(name)(data, **kwargs)
|
|
|
c5b9d7 |
try:
|
|
|
c5b9d7 |
return _hashlib.new(name, data, **kwargs)
|
|
|
c5b9d7 |
except ValueError:
|
|
|
c5b9d7 |
@@ -163,6 +173,8 @@ def __hash_new(name, data=b'', **kwargs):
|
|
|
c5b9d7 |
# hash, try using our builtin implementations.
|
|
|
c5b9d7 |
# This allows for SHA224/256 and SHA384/512 support even though
|
|
|
c5b9d7 |
# the OpenSSL library prior to 0.9.8 doesn't provide them.
|
|
|
c5b9d7 |
+ if get_fips_mode():
|
|
|
c5b9d7 |
+ raise
|
|
|
c5b9d7 |
return __get_builtin_constructor(name)(data)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
@@ -173,72 +185,14 @@ try:
|
|
|
c5b9d7 |
algorithms_available = algorithms_available.union(
|
|
|
c5b9d7 |
_hashlib.openssl_md_meth_names)
|
|
|
c5b9d7 |
except ImportError:
|
|
|
c5b9d7 |
+ if get_fips_mode:
|
|
|
c5b9d7 |
+ raise
|
|
|
c5b9d7 |
new = __py_new
|
|
|
c5b9d7 |
__get_hash = __get_builtin_constructor
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
-try:
|
|
|
c5b9d7 |
- # OpenSSL's PKCS5_PBKDF2_HMAC requires OpenSSL 1.0+ with HMAC and SHA
|
|
|
c5b9d7 |
- from _hashlib import pbkdf2_hmac
|
|
|
c5b9d7 |
-except ImportError:
|
|
|
c5b9d7 |
- _trans_5C = bytes((x ^ 0x5C) for x in range(256))
|
|
|
c5b9d7 |
- _trans_36 = bytes((x ^ 0x36) for x in range(256))
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
- def pbkdf2_hmac(hash_name, password, salt, iterations, dklen=None):
|
|
|
c5b9d7 |
- """Password based key derivation function 2 (PKCS #5 v2.0)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- This Python implementations based on the hmac module about as fast
|
|
|
c5b9d7 |
- as OpenSSL's PKCS5_PBKDF2_HMAC for short passwords and much faster
|
|
|
c5b9d7 |
- for long passwords.
|
|
|
c5b9d7 |
- """
|
|
|
c5b9d7 |
- if not isinstance(hash_name, str):
|
|
|
c5b9d7 |
- raise TypeError(hash_name)
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
- if not isinstance(password, (bytes, bytearray)):
|
|
|
c5b9d7 |
- password = bytes(memoryview(password))
|
|
|
c5b9d7 |
- if not isinstance(salt, (bytes, bytearray)):
|
|
|
c5b9d7 |
- salt = bytes(memoryview(salt))
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
- # Fast inline HMAC implementation
|
|
|
c5b9d7 |
- inner = new(hash_name)
|
|
|
c5b9d7 |
- outer = new(hash_name)
|
|
|
c5b9d7 |
- blocksize = getattr(inner, 'block_size', 64)
|
|
|
c5b9d7 |
- if len(password) > blocksize:
|
|
|
c5b9d7 |
- password = new(hash_name, password).digest()
|
|
|
c5b9d7 |
- password = password + b'\x00' * (blocksize - len(password))
|
|
|
c5b9d7 |
- inner.update(password.translate(_trans_36))
|
|
|
c5b9d7 |
- outer.update(password.translate(_trans_5C))
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
- def prf(msg, inner=inner, outer=outer):
|
|
|
c5b9d7 |
- # PBKDF2_HMAC uses the password as key. We can re-use the same
|
|
|
c5b9d7 |
- # digest objects and just update copies to skip initialization.
|
|
|
c5b9d7 |
- icpy = inner.copy()
|
|
|
c5b9d7 |
- ocpy = outer.copy()
|
|
|
c5b9d7 |
- icpy.update(msg)
|
|
|
c5b9d7 |
- ocpy.update(icpy.digest())
|
|
|
c5b9d7 |
- return ocpy.digest()
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
- if iterations < 1:
|
|
|
c5b9d7 |
- raise ValueError(iterations)
|
|
|
c5b9d7 |
- if dklen is None:
|
|
|
c5b9d7 |
- dklen = outer.digest_size
|
|
|
c5b9d7 |
- if dklen < 1:
|
|
|
c5b9d7 |
- raise ValueError(dklen)
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
- dkey = b''
|
|
|
c5b9d7 |
- loop = 1
|
|
|
c5b9d7 |
- from_bytes = int.from_bytes
|
|
|
c5b9d7 |
- while len(dkey) < dklen:
|
|
|
c5b9d7 |
- prev = prf(salt + loop.to_bytes(4, 'big'))
|
|
|
c5b9d7 |
- # endianness doesn't matter here as long to / from use the same
|
|
|
c5b9d7 |
- rkey = int.from_bytes(prev, 'big')
|
|
|
c5b9d7 |
- for i in range(iterations - 1):
|
|
|
c5b9d7 |
- prev = prf(prev)
|
|
|
c5b9d7 |
- # rkey = rkey ^ prev
|
|
|
c5b9d7 |
- rkey ^= from_bytes(prev, 'big')
|
|
|
c5b9d7 |
- loop += 1
|
|
|
c5b9d7 |
- dkey += rkey.to_bytes(inner.digest_size, 'big')
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
- return dkey[:dklen]
|
|
|
c5b9d7 |
+# OpenSSL's PKCS5_PBKDF2_HMAC requires OpenSSL 1.0+ with HMAC and SHA
|
|
|
c5b9d7 |
+from _hashlib import pbkdf2_hmac
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
try:
|
|
|
c5b9d7 |
# OpenSSL's scrypt requires OpenSSL 1.1+
|
|
|
c5b9d7 |
@@ -259,4 +213,6 @@ for __func_name in __always_supported:
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
# Cleanup locals()
|
|
|
c5b9d7 |
del __always_supported, __func_name, __get_hash
|
|
|
c5b9d7 |
-del __py_new, __hash_new, __get_openssl_constructor
|
|
|
c5b9d7 |
+del __hash_new, __get_openssl_constructor
|
|
|
c5b9d7 |
+if not get_fips_mode():
|
|
|
c5b9d7 |
+ del __py_new
|
|
|
c5b9d7 |
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
index 86f31a55878..8235505092b 100644
|
|
|
c5b9d7 |
--- a/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
+++ b/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
@@ -1039,6 +1039,7 @@ class KDFTests(unittest.TestCase):
|
|
|
c5b9d7 |
iterations=1, dklen=None)
|
|
|
c5b9d7 |
self.assertEqual(out, self.pbkdf2_results['sha1'][0][0])
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ @unittest.skip("The python implementation of pbkdf2_hmac has been removed")
|
|
|
c5b9d7 |
@unittest.skipIf(builtin_hashlib is None, "test requires builtin_hashlib")
|
|
|
c5b9d7 |
def test_pbkdf2_hmac_py(self):
|
|
|
c5b9d7 |
self._test_pbkdf2_hmac(builtin_hashlib.pbkdf2_hmac, builtin_hashes)
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
From 8a174c9a8d4180a5a7b19f4419b98c63b91b13ab Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Petr Viktorin <pviktori@redhat.com>
|
|
|
c5b9d7 |
Date: Thu, 25 Jul 2019 17:19:06 +0200
|
|
|
c5b9d7 |
Subject: [PATCH 02/13] Disable Python's hash implementations in FIPS mode,
|
|
|
c5b9d7 |
forcing OpenSSL
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Include/_hashopenssl.h | 66 ++++++++++++++++++++++++++++++++++
|
|
|
c5b9d7 |
Modules/_blake2/blake2b_impl.c | 5 +++
|
|
|
c5b9d7 |
Modules/_blake2/blake2module.c | 3 ++
|
|
|
c5b9d7 |
Modules/_blake2/blake2s_impl.c | 5 +++
|
|
|
c5b9d7 |
Modules/_hashopenssl.c | 35 +-----------------
|
|
|
c5b9d7 |
setup.py | 28 ++++++++++-----
|
|
|
c5b9d7 |
6 files changed, 99 insertions(+), 43 deletions(-)
|
|
|
c5b9d7 |
create mode 100644 Include/_hashopenssl.h
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Include/_hashopenssl.h b/Include/_hashopenssl.h
|
|
|
c5b9d7 |
new file mode 100644
|
|
|
c5b9d7 |
index 00000000000..a726c0d3fbf
|
|
|
c5b9d7 |
--- /dev/null
|
|
|
c5b9d7 |
+++ b/Include/_hashopenssl.h
|
|
|
c5b9d7 |
@@ -0,0 +1,66 @@
|
|
|
c5b9d7 |
+#ifndef Py_HASHOPENSSL_H
|
|
|
c5b9d7 |
+#define Py_HASHOPENSSL_H
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#include "Python.h"
|
|
|
c5b9d7 |
+#include <openssl/crypto.h>
|
|
|
c5b9d7 |
+#include <openssl/err.h>
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+/* LCOV_EXCL_START */
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_setException(PyObject *exc)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ unsigned long errcode;
|
|
|
c5b9d7 |
+ const char *lib, *func, *reason;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ errcode = ERR_peek_last_error();
|
|
|
c5b9d7 |
+ if (!errcode) {
|
|
|
c5b9d7 |
+ PyErr_SetString(exc, "unknown reasons");
|
|
|
c5b9d7 |
+ return NULL;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ ERR_clear_error();
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ lib = ERR_lib_error_string(errcode);
|
|
|
c5b9d7 |
+ func = ERR_func_error_string(errcode);
|
|
|
c5b9d7 |
+ reason = ERR_reason_error_string(errcode);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ if (lib && func) {
|
|
|
c5b9d7 |
+ PyErr_Format(exc, "[%s: %s] %s", lib, func, reason);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ else if (lib) {
|
|
|
c5b9d7 |
+ PyErr_Format(exc, "[%s] %s", lib, reason);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ else {
|
|
|
c5b9d7 |
+ PyErr_SetString(exc, reason);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ return NULL;
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+/* LCOV_EXCL_STOP */
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+__attribute__((__unused__))
|
|
|
c5b9d7 |
+static int
|
|
|
c5b9d7 |
+_Py_hashlib_fips_error(char *name) {
|
|
|
c5b9d7 |
+ int result = FIPS_mode();
|
|
|
c5b9d7 |
+ if (result == 0) {
|
|
|
c5b9d7 |
+ // "If the library was built without support of the FIPS Object Module,
|
|
|
c5b9d7 |
+ // then the function will return 0 with an error code of
|
|
|
c5b9d7 |
+ // CRYPTO_R_FIPS_MODE_NOT_SUPPORTED (0x0f06d065)."
|
|
|
c5b9d7 |
+ // But 0 is also a valid result value.
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ unsigned long errcode = ERR_peek_last_error();
|
|
|
c5b9d7 |
+ if (errcode) {
|
|
|
c5b9d7 |
+ _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ return 1;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ return 0;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ PyErr_Format(PyExc_ValueError, "%s is not available in FIPS mode",
|
|
|
c5b9d7 |
+ name);
|
|
|
c5b9d7 |
+ return 1;
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#define FAIL_RETURN_IN_FIPS_MODE(name) do { \
|
|
|
c5b9d7 |
+ if (_Py_hashlib_fips_error(name)) return NULL; \
|
|
|
c5b9d7 |
+} while (0)
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#endif // !Py_HASHOPENSSL_H
|
|
|
c5b9d7 |
diff --git a/Modules/_blake2/blake2b_impl.c b/Modules/_blake2/blake2b_impl.c
|
|
|
c5b9d7 |
index 7fb1296f8b2..67620afcad2 100644
|
|
|
c5b9d7 |
--- a/Modules/_blake2/blake2b_impl.c
|
|
|
c5b9d7 |
+++ b/Modules/_blake2/blake2b_impl.c
|
|
|
c5b9d7 |
@@ -14,6 +14,7 @@
|
|
|
c5b9d7 |
*/
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
#include "Python.h"
|
|
|
c5b9d7 |
+#include "_hashopenssl.h"
|
|
|
c5b9d7 |
#include "pystrhex.h"
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
#include "../hashlib.h"
|
|
|
c5b9d7 |
@@ -96,6 +97,8 @@ py_blake2b_new_impl(PyTypeObject *type, PyObject *data, int digest_size,
|
|
|
c5b9d7 |
BLAKE2bObject *self = NULL;
|
|
|
c5b9d7 |
Py_buffer buf;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ FAIL_RETURN_IN_FIPS_MODE("_blake2");
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
self = new_BLAKE2bObject(type);
|
|
|
c5b9d7 |
if (self == NULL) {
|
|
|
c5b9d7 |
goto error;
|
|
|
c5b9d7 |
@@ -274,6 +277,8 @@ _blake2_blake2b_update(BLAKE2bObject *self, PyObject *data)
|
|
|
c5b9d7 |
{
|
|
|
c5b9d7 |
Py_buffer buf;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ FAIL_RETURN_IN_FIPS_MODE("_blake2");
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
GET_BUFFER_VIEW_OR_ERROUT(data, &buf;;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
if (self->lock == NULL && buf.len >= HASHLIB_GIL_MINSIZE)
|
|
|
c5b9d7 |
diff --git a/Modules/_blake2/blake2module.c b/Modules/_blake2/blake2module.c
|
|
|
c5b9d7 |
index ff142c9f3ed..bc67529cb5e 100644
|
|
|
c5b9d7 |
--- a/Modules/_blake2/blake2module.c
|
|
|
c5b9d7 |
+++ b/Modules/_blake2/blake2module.c
|
|
|
c5b9d7 |
@@ -9,6 +9,7 @@
|
|
|
c5b9d7 |
*/
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
#include "Python.h"
|
|
|
c5b9d7 |
+#include "_hashopenssl.h"
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
#include "impl/blake2.h"
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
@@ -57,6 +58,8 @@ PyInit__blake2(void)
|
|
|
c5b9d7 |
PyObject *m;
|
|
|
c5b9d7 |
PyObject *d;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ FAIL_RETURN_IN_FIPS_MODE("blake2");
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
m = PyModule_Create(&blake2_module);
|
|
|
c5b9d7 |
if (m == NULL)
|
|
|
c5b9d7 |
return NULL;
|
|
|
c5b9d7 |
diff --git a/Modules/_blake2/blake2s_impl.c b/Modules/_blake2/blake2s_impl.c
|
|
|
c5b9d7 |
index e3e90d0587b..57c0f3fcbd7 100644
|
|
|
c5b9d7 |
--- a/Modules/_blake2/blake2s_impl.c
|
|
|
c5b9d7 |
+++ b/Modules/_blake2/blake2s_impl.c
|
|
|
c5b9d7 |
@@ -14,6 +14,7 @@
|
|
|
c5b9d7 |
*/
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
#include "Python.h"
|
|
|
c5b9d7 |
+#include "_hashopenssl.h"
|
|
|
c5b9d7 |
#include "pystrhex.h"
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
#include "../hashlib.h"
|
|
|
c5b9d7 |
@@ -96,6 +97,8 @@ py_blake2s_new_impl(PyTypeObject *type, PyObject *data, int digest_size,
|
|
|
c5b9d7 |
BLAKE2sObject *self = NULL;
|
|
|
c5b9d7 |
Py_buffer buf;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ FAIL_RETURN_IN_FIPS_MODE("_blake2");
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
self = new_BLAKE2sObject(type);
|
|
|
c5b9d7 |
if (self == NULL) {
|
|
|
c5b9d7 |
goto error;
|
|
|
c5b9d7 |
@@ -274,6 +277,8 @@ _blake2_blake2s_update(BLAKE2sObject *self, PyObject *data)
|
|
|
c5b9d7 |
{
|
|
|
c5b9d7 |
Py_buffer buf;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ FAIL_RETURN_IN_FIPS_MODE("_blake2");
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
GET_BUFFER_VIEW_OR_ERROUT(data, &buf;;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
if (self->lock == NULL && buf.len >= HASHLIB_GIL_MINSIZE)
|
|
|
c5b9d7 |
diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c
|
|
|
c5b9d7 |
index adc86537732..deecc077ef8 100644
|
|
|
c5b9d7 |
--- a/Modules/_hashopenssl.c
|
|
|
c5b9d7 |
+++ b/Modules/_hashopenssl.c
|
|
|
c5b9d7 |
@@ -16,6 +16,7 @@
|
|
|
c5b9d7 |
#include "Python.h"
|
|
|
c5b9d7 |
#include "hashlib.h"
|
|
|
c5b9d7 |
#include "pystrhex.h"
|
|
|
c5b9d7 |
+#include "_hashopenssl.h"
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
/* EVP is the preferred interface to hashing in OpenSSL */
|
|
|
c5b9d7 |
@@ -24,9 +25,6 @@
|
|
|
c5b9d7 |
#include <openssl/crypto.h>
|
|
|
c5b9d7 |
/* We use the object interface to discover what hashes OpenSSL supports. */
|
|
|
c5b9d7 |
#include <openssl/objects.h>
|
|
|
c5b9d7 |
-#include "openssl/err.h"
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
-#include <openssl/crypto.h> // FIPS_mode()
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
#ifndef OPENSSL_THREADS
|
|
|
c5b9d7 |
# error "OPENSSL_THREADS is not defined, Python requires thread-safe OpenSSL"
|
|
|
c5b9d7 |
@@ -118,37 +116,6 @@ class _hashlib.HMAC "HMACobject *" "((_hashlibstate *)PyModule_GetState(module))
|
|
|
c5b9d7 |
/*[clinic end generated code: output=da39a3ee5e6b4b0d input=7df1bcf6f75cb8ef]*/
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
-/* LCOV_EXCL_START */
|
|
|
c5b9d7 |
-static PyObject *
|
|
|
c5b9d7 |
-_setException(PyObject *exc)
|
|
|
c5b9d7 |
-{
|
|
|
c5b9d7 |
- unsigned long errcode;
|
|
|
c5b9d7 |
- const char *lib, *func, *reason;
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
- errcode = ERR_peek_last_error();
|
|
|
c5b9d7 |
- if (!errcode) {
|
|
|
c5b9d7 |
- PyErr_SetString(exc, "unknown reasons");
|
|
|
c5b9d7 |
- return NULL;
|
|
|
c5b9d7 |
- }
|
|
|
c5b9d7 |
- ERR_clear_error();
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
- lib = ERR_lib_error_string(errcode);
|
|
|
c5b9d7 |
- func = ERR_func_error_string(errcode);
|
|
|
c5b9d7 |
- reason = ERR_reason_error_string(errcode);
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
- if (lib && func) {
|
|
|
c5b9d7 |
- PyErr_Format(exc, "[%s: %s] %s", lib, func, reason);
|
|
|
c5b9d7 |
- }
|
|
|
c5b9d7 |
- else if (lib) {
|
|
|
c5b9d7 |
- PyErr_Format(exc, "[%s] %s", lib, reason);
|
|
|
c5b9d7 |
- }
|
|
|
c5b9d7 |
- else {
|
|
|
c5b9d7 |
- PyErr_SetString(exc, reason);
|
|
|
c5b9d7 |
- }
|
|
|
c5b9d7 |
- return NULL;
|
|
|
c5b9d7 |
-}
|
|
|
c5b9d7 |
-/* LCOV_EXCL_STOP */
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
/* {Py_tp_new, NULL} doesn't block __new__ */
|
|
|
c5b9d7 |
static PyObject *
|
|
|
c5b9d7 |
_disabled_new(PyTypeObject *type, PyObject *args, PyObject *kwargs)
|
|
|
c5b9d7 |
diff --git a/setup.py b/setup.py
|
|
|
c5b9d7 |
index bd5f7369244..89edbb627fa 100644
|
|
|
c5b9d7 |
--- a/setup.py
|
|
|
c5b9d7 |
+++ b/setup.py
|
|
|
c5b9d7 |
@@ -2306,7 +2306,7 @@ class PyBuildExt(build_ext):
|
|
|
c5b9d7 |
sources=sources,
|
|
|
c5b9d7 |
depends=depends))
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- def detect_openssl_hashlib(self):
|
|
|
c5b9d7 |
+ def detect_openssl_args(self):
|
|
|
c5b9d7 |
# Detect SSL support for the socket module (via _ssl)
|
|
|
c5b9d7 |
config_vars = sysconfig.get_config_vars()
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
@@ -2327,7 +2327,7 @@ class PyBuildExt(build_ext):
|
|
|
c5b9d7 |
if not openssl_libs:
|
|
|
c5b9d7 |
# libssl and libcrypto not found
|
|
|
c5b9d7 |
self.missing.extend(['_ssl', '_hashlib'])
|
|
|
c5b9d7 |
- return None, None
|
|
|
c5b9d7 |
+ raise ValueError('Cannot build for RHEL without OpenSSL')
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
# Find OpenSSL includes
|
|
|
c5b9d7 |
ssl_incs = find_file(
|
|
|
c5b9d7 |
@@ -2335,7 +2335,7 @@ class PyBuildExt(build_ext):
|
|
|
c5b9d7 |
)
|
|
|
c5b9d7 |
if ssl_incs is None:
|
|
|
c5b9d7 |
self.missing.extend(['_ssl', '_hashlib'])
|
|
|
c5b9d7 |
- return None, None
|
|
|
c5b9d7 |
+ raise ValueError('Cannot build for RHEL without OpenSSL')
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
# OpenSSL 1.0.2 uses Kerberos for KRB5 ciphers
|
|
|
c5b9d7 |
krb5_h = find_file(
|
|
|
c5b9d7 |
@@ -2345,12 +2345,23 @@ class PyBuildExt(build_ext):
|
|
|
c5b9d7 |
if krb5_h:
|
|
|
c5b9d7 |
ssl_incs.extend(krb5_h)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ ssl_args = {
|
|
|
c5b9d7 |
+ 'include_dirs': openssl_includes,
|
|
|
c5b9d7 |
+ 'library_dirs': openssl_libdirs,
|
|
|
c5b9d7 |
+ 'libraries': ['ssl', 'crypto'],
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ return ssl_args
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ def detect_openssl_hashlib(self):
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ config_vars = sysconfig.get_config_vars()
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
if config_vars.get("HAVE_X509_VERIFY_PARAM_SET1_HOST"):
|
|
|
c5b9d7 |
self.add(Extension(
|
|
|
c5b9d7 |
'_ssl', ['_ssl.c'],
|
|
|
c5b9d7 |
- include_dirs=openssl_includes,
|
|
|
c5b9d7 |
- library_dirs=openssl_libdirs,
|
|
|
c5b9d7 |
- libraries=openssl_libs,
|
|
|
c5b9d7 |
+ **self.detect_openssl_args(),
|
|
|
c5b9d7 |
depends=['socketmodule.h', '_ssl/debughelpers.c'])
|
|
|
c5b9d7 |
)
|
|
|
c5b9d7 |
else:
|
|
|
c5b9d7 |
@@ -2358,9 +2369,7 @@ class PyBuildExt(build_ext):
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
self.add(Extension('_hashlib', ['_hashopenssl.c'],
|
|
|
c5b9d7 |
depends=['hashlib.h'],
|
|
|
c5b9d7 |
- include_dirs=openssl_includes,
|
|
|
c5b9d7 |
- library_dirs=openssl_libdirs,
|
|
|
c5b9d7 |
- libraries=openssl_libs))
|
|
|
c5b9d7 |
+ **self.detect_openssl_args()) )
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def detect_hash_builtins(self):
|
|
|
c5b9d7 |
# By default we always compile these even when OpenSSL is available
|
|
|
c5b9d7 |
@@ -2417,6 +2426,7 @@ class PyBuildExt(build_ext):
|
|
|
c5b9d7 |
'_blake2/blake2b_impl.c',
|
|
|
c5b9d7 |
'_blake2/blake2s_impl.c'
|
|
|
c5b9d7 |
],
|
|
|
c5b9d7 |
+ **self.detect_openssl_args(),
|
|
|
c5b9d7 |
depends=blake2_deps
|
|
|
c5b9d7 |
))
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
From 56171083467bd5798adcb1946cfc0b1d68403755 Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Charalampos Stratakis <cstratak@redhat.com>
|
|
|
c5b9d7 |
Date: Thu, 12 Dec 2019 16:58:31 +0100
|
|
|
c5b9d7 |
Subject: [PATCH 03/13] Expose all hashes available to OpenSSL
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Include/_hashopenssl.h | 11 ++--
|
|
|
c5b9d7 |
Modules/_blake2/blake2b_impl.c | 4 +-
|
|
|
c5b9d7 |
Modules/_blake2/blake2module.c | 2 +-
|
|
|
c5b9d7 |
Modules/_blake2/blake2s_impl.c | 4 +-
|
|
|
c5b9d7 |
Modules/_hashopenssl.c | 43 +++++++++++++
|
|
|
c5b9d7 |
Modules/clinic/_hashopenssl.c.h | 106 +++++++++++++++++++++++++++++++-
|
|
|
c5b9d7 |
6 files changed, 158 insertions(+), 12 deletions(-)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Include/_hashopenssl.h b/Include/_hashopenssl.h
|
|
|
c5b9d7 |
index a726c0d3fbf..47ed0030422 100644
|
|
|
c5b9d7 |
--- a/Include/_hashopenssl.h
|
|
|
c5b9d7 |
+++ b/Include/_hashopenssl.h
|
|
|
c5b9d7 |
@@ -39,7 +39,7 @@ _setException(PyObject *exc)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
__attribute__((__unused__))
|
|
|
c5b9d7 |
static int
|
|
|
c5b9d7 |
-_Py_hashlib_fips_error(char *name) {
|
|
|
c5b9d7 |
+_Py_hashlib_fips_error(PyObject *exc, char *name) {
|
|
|
c5b9d7 |
int result = FIPS_mode();
|
|
|
c5b9d7 |
if (result == 0) {
|
|
|
c5b9d7 |
// "If the library was built without support of the FIPS Object Module,
|
|
|
c5b9d7 |
@@ -49,18 +49,17 @@ _Py_hashlib_fips_error(char *name) {
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
unsigned long errcode = ERR_peek_last_error();
|
|
|
c5b9d7 |
if (errcode) {
|
|
|
c5b9d7 |
- _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ _setException(exc);
|
|
|
c5b9d7 |
return 1;
|
|
|
c5b9d7 |
}
|
|
|
c5b9d7 |
return 0;
|
|
|
c5b9d7 |
}
|
|
|
c5b9d7 |
- PyErr_Format(PyExc_ValueError, "%s is not available in FIPS mode",
|
|
|
c5b9d7 |
- name);
|
|
|
c5b9d7 |
+ PyErr_Format(exc, "%s is not available in FIPS mode", name);
|
|
|
c5b9d7 |
return 1;
|
|
|
c5b9d7 |
}
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
-#define FAIL_RETURN_IN_FIPS_MODE(name) do { \
|
|
|
c5b9d7 |
- if (_Py_hashlib_fips_error(name)) return NULL; \
|
|
|
c5b9d7 |
+#define FAIL_RETURN_IN_FIPS_MODE(exc, name) do { \
|
|
|
c5b9d7 |
+ if (_Py_hashlib_fips_error(exc, name)) return NULL; \
|
|
|
c5b9d7 |
} while (0)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
#endif // !Py_HASHOPENSSL_H
|
|
|
c5b9d7 |
diff --git a/Modules/_blake2/blake2b_impl.c b/Modules/_blake2/blake2b_impl.c
|
|
|
c5b9d7 |
index 67620afcad2..9e125dcbf43 100644
|
|
|
c5b9d7 |
--- a/Modules/_blake2/blake2b_impl.c
|
|
|
c5b9d7 |
+++ b/Modules/_blake2/blake2b_impl.c
|
|
|
c5b9d7 |
@@ -97,7 +97,7 @@ py_blake2b_new_impl(PyTypeObject *type, PyObject *data, int digest_size,
|
|
|
c5b9d7 |
BLAKE2bObject *self = NULL;
|
|
|
c5b9d7 |
Py_buffer buf;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- FAIL_RETURN_IN_FIPS_MODE("_blake2");
|
|
|
c5b9d7 |
+ FAIL_RETURN_IN_FIPS_MODE(PyExc_ValueError, "_blake2");
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
self = new_BLAKE2bObject(type);
|
|
|
c5b9d7 |
if (self == NULL) {
|
|
|
c5b9d7 |
@@ -277,7 +277,7 @@ _blake2_blake2b_update(BLAKE2bObject *self, PyObject *data)
|
|
|
c5b9d7 |
{
|
|
|
c5b9d7 |
Py_buffer buf;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- FAIL_RETURN_IN_FIPS_MODE("_blake2");
|
|
|
c5b9d7 |
+ FAIL_RETURN_IN_FIPS_MODE(PyExc_ValueError, "_blake2");
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
GET_BUFFER_VIEW_OR_ERROUT(data, &buf;;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Modules/_blake2/blake2module.c b/Modules/_blake2/blake2module.c
|
|
|
c5b9d7 |
index bc67529cb5e..79a9eed5c13 100644
|
|
|
c5b9d7 |
--- a/Modules/_blake2/blake2module.c
|
|
|
c5b9d7 |
+++ b/Modules/_blake2/blake2module.c
|
|
|
c5b9d7 |
@@ -58,7 +58,7 @@ PyInit__blake2(void)
|
|
|
c5b9d7 |
PyObject *m;
|
|
|
c5b9d7 |
PyObject *d;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- FAIL_RETURN_IN_FIPS_MODE("blake2");
|
|
|
c5b9d7 |
+ FAIL_RETURN_IN_FIPS_MODE(PyExc_ImportError, "blake2");
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
m = PyModule_Create(&blake2_module);
|
|
|
c5b9d7 |
if (m == NULL)
|
|
|
c5b9d7 |
diff --git a/Modules/_blake2/blake2s_impl.c b/Modules/_blake2/blake2s_impl.c
|
|
|
c5b9d7 |
index 57c0f3fcbd7..b59624d7d98 100644
|
|
|
c5b9d7 |
--- a/Modules/_blake2/blake2s_impl.c
|
|
|
c5b9d7 |
+++ b/Modules/_blake2/blake2s_impl.c
|
|
|
c5b9d7 |
@@ -97,7 +97,7 @@ py_blake2s_new_impl(PyTypeObject *type, PyObject *data, int digest_size,
|
|
|
c5b9d7 |
BLAKE2sObject *self = NULL;
|
|
|
c5b9d7 |
Py_buffer buf;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- FAIL_RETURN_IN_FIPS_MODE("_blake2");
|
|
|
c5b9d7 |
+ FAIL_RETURN_IN_FIPS_MODE(PyExc_ValueError, "_blake2");
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
self = new_BLAKE2sObject(type);
|
|
|
c5b9d7 |
if (self == NULL) {
|
|
|
c5b9d7 |
@@ -277,7 +277,7 @@ _blake2_blake2s_update(BLAKE2sObject *self, PyObject *data)
|
|
|
c5b9d7 |
{
|
|
|
c5b9d7 |
Py_buffer buf;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- FAIL_RETURN_IN_FIPS_MODE("_blake2");
|
|
|
c5b9d7 |
+ FAIL_RETURN_IN_FIPS_MODE(PyExc_ValueError, "_blake2");
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
GET_BUFFER_VIEW_OR_ERROUT(data, &buf;;
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c
|
|
|
c5b9d7 |
index deecc077ef8..a805183721b 100644
|
|
|
c5b9d7 |
--- a/Modules/_hashopenssl.c
|
|
|
c5b9d7 |
+++ b/Modules/_hashopenssl.c
|
|
|
c5b9d7 |
@@ -253,6 +253,12 @@ py_digest_by_name(const char *name)
|
|
|
c5b9d7 |
else if (!strcmp(name, "blake2b512")) {
|
|
|
c5b9d7 |
digest = EVP_blake2b512();
|
|
|
c5b9d7 |
}
|
|
|
c5b9d7 |
+ else if (!strcmp(name, "blake2s")) {
|
|
|
c5b9d7 |
+ digest = EVP_blake2s256();
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ else if (!strcmp(name, "blake2b")) {
|
|
|
c5b9d7 |
+ digest = EVP_blake2b512();
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
#endif
|
|
|
c5b9d7 |
}
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
@@ -946,6 +952,41 @@ _hashlib_openssl_sha512_impl(PyObject *module, PyObject *data_obj,
|
|
|
c5b9d7 |
}
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+/*[clinic input]
|
|
|
c5b9d7 |
+_hashlib.openssl_blake2b
|
|
|
c5b9d7 |
+ string as data_obj: object(py_default="b''") = NULL
|
|
|
c5b9d7 |
+ *
|
|
|
c5b9d7 |
+ usedforsecurity: bool = True
|
|
|
c5b9d7 |
+Returns a blake2b hash object; optionally initialized with a string
|
|
|
c5b9d7 |
+[clinic start generated code]*/
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hashlib_openssl_blake2b_impl(PyObject *module, PyObject *data_obj,
|
|
|
c5b9d7 |
+ int usedforsecurity)
|
|
|
c5b9d7 |
+/*[clinic end generated code: output=7a838b1643cde13e input=4ad7fd54268f3689]*/
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ return EVP_fast_new(module, data_obj, EVP_blake2b512(), usedforsecurity);
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+/*[clinic input]
|
|
|
c5b9d7 |
+_hashlib.openssl_blake2s
|
|
|
c5b9d7 |
+ string as data_obj: object(py_default="b''") = NULL
|
|
|
c5b9d7 |
+ *
|
|
|
c5b9d7 |
+ usedforsecurity: bool = True
|
|
|
c5b9d7 |
+Returns a blake2s hash object; optionally initialized with a string
|
|
|
c5b9d7 |
+[clinic start generated code]*/
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hashlib_openssl_blake2s_impl(PyObject *module, PyObject *data_obj,
|
|
|
c5b9d7 |
+ int usedforsecurity)
|
|
|
c5b9d7 |
+/*[clinic end generated code: output=4eda6b40757471da input=1ed39481ffa4e26a]*/
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ return EVP_fast_new(module, data_obj, EVP_blake2s256(), usedforsecurity);
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
#ifdef PY_OPENSSL_HAS_SHA3
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
/*[clinic input]
|
|
|
c5b9d7 |
@@ -1931,6 +1972,8 @@ static struct PyMethodDef EVP_functions[] = {
|
|
|
c5b9d7 |
_HASHLIB_OPENSSL_SHA256_METHODDEF
|
|
|
c5b9d7 |
_HASHLIB_OPENSSL_SHA384_METHODDEF
|
|
|
c5b9d7 |
_HASHLIB_OPENSSL_SHA512_METHODDEF
|
|
|
c5b9d7 |
+ _HASHLIB_OPENSSL_BLAKE2B_METHODDEF
|
|
|
c5b9d7 |
+ _HASHLIB_OPENSSL_BLAKE2S_METHODDEF
|
|
|
c5b9d7 |
_HASHLIB_OPENSSL_SHA3_224_METHODDEF
|
|
|
c5b9d7 |
_HASHLIB_OPENSSL_SHA3_256_METHODDEF
|
|
|
c5b9d7 |
_HASHLIB_OPENSSL_SHA3_384_METHODDEF
|
|
|
c5b9d7 |
diff --git a/Modules/clinic/_hashopenssl.c.h b/Modules/clinic/_hashopenssl.c.h
|
|
|
c5b9d7 |
index 68aa765e529..2957ae2e135 100644
|
|
|
c5b9d7 |
--- a/Modules/clinic/_hashopenssl.c.h
|
|
|
c5b9d7 |
+++ b/Modules/clinic/_hashopenssl.c.h
|
|
|
c5b9d7 |
@@ -540,6 +540,110 @@ exit:
|
|
|
c5b9d7 |
return return_value;
|
|
|
c5b9d7 |
}
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+PyDoc_STRVAR(_hashlib_openssl_blake2b__doc__,
|
|
|
c5b9d7 |
+"openssl_blake2b($module, /, string=b\'\', *, usedforsecurity=True)\n"
|
|
|
c5b9d7 |
+"--\n"
|
|
|
c5b9d7 |
+"\n"
|
|
|
c5b9d7 |
+"Returns a blake2b hash object; optionally initialized with a string");
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#define _HASHLIB_OPENSSL_BLAKE2B_METHODDEF \
|
|
|
c5b9d7 |
+ {"openssl_blake2b", (PyCFunction)(void(*)(void))_hashlib_openssl_blake2b, METH_FASTCALL|METH_KEYWORDS, _hashlib_openssl_blake2b__doc__},
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hashlib_openssl_blake2b_impl(PyObject *module, PyObject *data_obj,
|
|
|
c5b9d7 |
+ int usedforsecurity);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hashlib_openssl_blake2b(PyObject *module, PyObject *const *args, Py_ssize_t nargs, PyObject *kwnames)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ PyObject *return_value = NULL;
|
|
|
c5b9d7 |
+ static const char * const _keywords[] = {"string", "usedforsecurity", NULL};
|
|
|
c5b9d7 |
+ static _PyArg_Parser _parser = {NULL, _keywords, "openssl_blake2b", 0};
|
|
|
c5b9d7 |
+ PyObject *argsbuf[2];
|
|
|
c5b9d7 |
+ Py_ssize_t noptargs = nargs + (kwnames ? PyTuple_GET_SIZE(kwnames) : 0) - 0;
|
|
|
c5b9d7 |
+ PyObject *data_obj = NULL;
|
|
|
c5b9d7 |
+ int usedforsecurity = 1;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ args = _PyArg_UnpackKeywords(args, nargs, NULL, kwnames, &_parser, 0, 1, 0, argsbuf);
|
|
|
c5b9d7 |
+ if (!args) {
|
|
|
c5b9d7 |
+ goto exit;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ if (!noptargs) {
|
|
|
c5b9d7 |
+ goto skip_optional_pos;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ if (args[0]) {
|
|
|
c5b9d7 |
+ data_obj = args[0];
|
|
|
c5b9d7 |
+ if (!--noptargs) {
|
|
|
c5b9d7 |
+ goto skip_optional_pos;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+skip_optional_pos:
|
|
|
c5b9d7 |
+ if (!noptargs) {
|
|
|
c5b9d7 |
+ goto skip_optional_kwonly;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ usedforsecurity = PyObject_IsTrue(args[1]);
|
|
|
c5b9d7 |
+ if (usedforsecurity < 0) {
|
|
|
c5b9d7 |
+ goto exit;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+skip_optional_kwonly:
|
|
|
c5b9d7 |
+ return_value = _hashlib_openssl_blake2b_impl(module, data_obj, usedforsecurity);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+exit:
|
|
|
c5b9d7 |
+ return return_value;
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+PyDoc_STRVAR(_hashlib_openssl_blake2s__doc__,
|
|
|
c5b9d7 |
+"openssl_blake2s($module, /, string=b\'\', *, usedforsecurity=True)\n"
|
|
|
c5b9d7 |
+"--\n"
|
|
|
c5b9d7 |
+"\n"
|
|
|
c5b9d7 |
+"Returns a blake2s hash object; optionally initialized with a string");
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#define _HASHLIB_OPENSSL_BLAKE2S_METHODDEF \
|
|
|
c5b9d7 |
+ {"openssl_blake2s", (PyCFunction)(void(*)(void))_hashlib_openssl_blake2s, METH_FASTCALL|METH_KEYWORDS, _hashlib_openssl_blake2s__doc__},
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hashlib_openssl_blake2s_impl(PyObject *module, PyObject *data_obj,
|
|
|
c5b9d7 |
+ int usedforsecurity);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hashlib_openssl_blake2s(PyObject *module, PyObject *const *args, Py_ssize_t nargs, PyObject *kwnames)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ PyObject *return_value = NULL;
|
|
|
c5b9d7 |
+ static const char * const _keywords[] = {"string", "usedforsecurity", NULL};
|
|
|
c5b9d7 |
+ static _PyArg_Parser _parser = {NULL, _keywords, "openssl_blake2s", 0};
|
|
|
c5b9d7 |
+ PyObject *argsbuf[2];
|
|
|
c5b9d7 |
+ Py_ssize_t noptargs = nargs + (kwnames ? PyTuple_GET_SIZE(kwnames) : 0) - 0;
|
|
|
c5b9d7 |
+ PyObject *data_obj = NULL;
|
|
|
c5b9d7 |
+ int usedforsecurity = 1;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ args = _PyArg_UnpackKeywords(args, nargs, NULL, kwnames, &_parser, 0, 1, 0, argsbuf);
|
|
|
c5b9d7 |
+ if (!args) {
|
|
|
c5b9d7 |
+ goto exit;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ if (!noptargs) {
|
|
|
c5b9d7 |
+ goto skip_optional_pos;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ if (args[0]) {
|
|
|
c5b9d7 |
+ data_obj = args[0];
|
|
|
c5b9d7 |
+ if (!--noptargs) {
|
|
|
c5b9d7 |
+ goto skip_optional_pos;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+skip_optional_pos:
|
|
|
c5b9d7 |
+ if (!noptargs) {
|
|
|
c5b9d7 |
+ goto skip_optional_kwonly;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ usedforsecurity = PyObject_IsTrue(args[1]);
|
|
|
c5b9d7 |
+ if (usedforsecurity < 0) {
|
|
|
c5b9d7 |
+ goto exit;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+skip_optional_kwonly:
|
|
|
c5b9d7 |
+ return_value = _hashlib_openssl_blake2s_impl(module, data_obj, usedforsecurity);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+exit:
|
|
|
c5b9d7 |
+ return return_value;
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
#if defined(PY_OPENSSL_HAS_SHA3)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
PyDoc_STRVAR(_hashlib_openssl_sha3_224__doc__,
|
|
|
c5b9d7 |
@@ -1442,4 +1546,4 @@ exit:
|
|
|
c5b9d7 |
#ifndef _HASHLIB_GET_FIPS_MODE_METHODDEF
|
|
|
c5b9d7 |
#define _HASHLIB_GET_FIPS_MODE_METHODDEF
|
|
|
c5b9d7 |
#endif /* !defined(_HASHLIB_GET_FIPS_MODE_METHODDEF) */
|
|
|
c5b9d7 |
-/*[clinic end generated code: output=b6b280e46bf0b139 input=a9049054013a1b77]*/
|
|
|
c5b9d7 |
+/*[clinic end generated code: output=4f8cc45bf0337f8e input=a9049054013a1b77]*/
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
From e024cae691bffa2d093a63f8e2058331fce94d2a Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Petr Viktorin <pviktori@redhat.com>
|
|
|
c5b9d7 |
Date: Thu, 25 Jul 2019 18:13:45 +0200
|
|
|
c5b9d7 |
Subject: [PATCH 04/13] Fix tests
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Lib/test/test_hashlib.py | 5 +++++
|
|
|
c5b9d7 |
1 file changed, 5 insertions(+)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
index 8235505092b..a838bcee2a8 100644
|
|
|
c5b9d7 |
--- a/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
+++ b/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
@@ -354,6 +354,11 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
# 2 is for hashlib.name(...) and hashlib.new(name, ...)
|
|
|
c5b9d7 |
self.assertGreaterEqual(len(constructors), 2)
|
|
|
c5b9d7 |
for hash_object_constructor in constructors:
|
|
|
c5b9d7 |
+ if (
|
|
|
c5b9d7 |
+ kwargs
|
|
|
c5b9d7 |
+ and hash_object_constructor.__name__.startswith('openssl_')
|
|
|
c5b9d7 |
+ ):
|
|
|
c5b9d7 |
+ return
|
|
|
c5b9d7 |
m = hash_object_constructor(data, **kwargs)
|
|
|
c5b9d7 |
computed = m.hexdigest() if not shake else m.hexdigest(length)
|
|
|
c5b9d7 |
self.assertEqual(
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
From 3e87bf1c3d32c09a50385d8576b1164cafce4158 Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Petr Viktorin <pviktori@redhat.com>
|
|
|
c5b9d7 |
Date: Fri, 26 Jul 2019 15:41:10 +0200
|
|
|
c5b9d7 |
Subject: [PATCH 05/13] Implement hmac.new using new built-in module,
|
|
|
c5b9d7 |
_hmacopenssl
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
Make _hmacopenssl.HMAC subclassable; subclass it as hmac.HMAC under FIPS
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
This removes the _hmacopenssl.new function.
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Lib/hmac.py | 37 +++
|
|
|
c5b9d7 |
Lib/test/test_hmac.py | 28 ++
|
|
|
c5b9d7 |
Modules/_hmacopenssl.c | 459 ++++++++++++++++++++++++++++++++
|
|
|
c5b9d7 |
Modules/clinic/_hmacopenssl.c.h | 104 ++++++++
|
|
|
c5b9d7 |
setup.py | 4 +
|
|
|
c5b9d7 |
5 files changed, 632 insertions(+)
|
|
|
c5b9d7 |
create mode 100644 Modules/_hmacopenssl.c
|
|
|
c5b9d7 |
create mode 100644 Modules/clinic/_hmacopenssl.c.h
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/hmac.py b/Lib/hmac.py
|
|
|
c5b9d7 |
index 180bc378b52..482e443bfe4 100644
|
|
|
c5b9d7 |
--- a/Lib/hmac.py
|
|
|
c5b9d7 |
+++ b/Lib/hmac.py
|
|
|
c5b9d7 |
@@ -14,6 +14,8 @@ else:
|
|
|
c5b9d7 |
_openssl_md_meths = frozenset(_hashopenssl.openssl_md_meth_names)
|
|
|
c5b9d7 |
compare_digest = _hashopenssl.compare_digest
|
|
|
c5b9d7 |
import hashlib as _hashlib
|
|
|
c5b9d7 |
+import _hashlib as _hashlibopenssl
|
|
|
c5b9d7 |
+import _hmacopenssl
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
trans_5C = bytes((x ^ 0x5C) for x in range(256))
|
|
|
c5b9d7 |
trans_36 = bytes((x ^ 0x36) for x in range(256))
|
|
|
c5b9d7 |
@@ -48,6 +50,11 @@ class HMAC:
|
|
|
c5b9d7 |
msg argument. Passing it as a keyword argument is
|
|
|
c5b9d7 |
recommended, though not required for legacy API reasons.
|
|
|
c5b9d7 |
"""
|
|
|
c5b9d7 |
+ if _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+ raise ValueError(
|
|
|
c5b9d7 |
+ 'This class is not available in FIPS mode. '
|
|
|
c5b9d7 |
+ + 'Use hmac.new().'
|
|
|
c5b9d7 |
+ )
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
if not isinstance(key, (bytes, bytearray)):
|
|
|
c5b9d7 |
raise TypeError("key: expected bytes or bytearray, but got %r" % type(key).__name__)
|
|
|
c5b9d7 |
@@ -110,6 +117,8 @@ class HMAC:
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def update(self, msg):
|
|
|
c5b9d7 |
"""Feed data from msg into this hashing object."""
|
|
|
c5b9d7 |
+ if _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+ raise ValueError('hmac.HMAC is not available in FIPS mode')
|
|
|
c5b9d7 |
self._inner.update(msg)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def copy(self):
|
|
|
c5b9d7 |
@@ -150,6 +159,34 @@ class HMAC:
|
|
|
c5b9d7 |
h = self._current()
|
|
|
c5b9d7 |
return h.hexdigest()
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+def _get_openssl_name(digestmod):
|
|
|
c5b9d7 |
+ if isinstance(digestmod, str):
|
|
|
c5b9d7 |
+ return digestmod.lower()
|
|
|
c5b9d7 |
+ elif callable(digestmod):
|
|
|
c5b9d7 |
+ digestmod = digestmod(b'')
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ if not isinstance(digestmod, _hashlibopenssl.HASH):
|
|
|
c5b9d7 |
+ raise TypeError(
|
|
|
c5b9d7 |
+ 'Only OpenSSL hashlib hashes are accepted in FIPS mode.')
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ return digestmod.name.lower().replace('_', '-')
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+class HMAC_openssl(_hmacopenssl.HMAC):
|
|
|
c5b9d7 |
+ def __new__(cls, key, msg = None, digestmod = None):
|
|
|
c5b9d7 |
+ if not isinstance(key, (bytes, bytearray)):
|
|
|
c5b9d7 |
+ raise TypeError("key: expected bytes or bytearray, but got %r" % type(key).__name__)
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ name = _get_openssl_name(digestmod)
|
|
|
c5b9d7 |
+ result = _hmacopenssl.HMAC.__new__(cls, key, digestmod=name)
|
|
|
c5b9d7 |
+ if msg:
|
|
|
c5b9d7 |
+ result.update(msg)
|
|
|
c5b9d7 |
+ return result
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+if _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+ HMAC = HMAC_openssl
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
def new(key, msg=None, digestmod=''):
|
|
|
c5b9d7 |
"""Create a new hashing object and return it.
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/test/test_hmac.py b/Lib/test/test_hmac.py
|
|
|
c5b9d7 |
index 6daf22ca06f..544ec7cb411 100644
|
|
|
c5b9d7 |
--- a/Lib/test/test_hmac.py
|
|
|
c5b9d7 |
+++ b/Lib/test/test_hmac.py
|
|
|
c5b9d7 |
@@ -322,6 +322,7 @@ class TestVectorsTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
def test_sha512_rfc4231(self):
|
|
|
c5b9d7 |
self._rfc4231_test_cases(hashlib.sha512, 'sha512', 64, 128)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ @unittest.skipIf(hashlib.get_fips_mode(), 'MockCrazyHash unacceptable in FIPS mode.')
|
|
|
c5b9d7 |
@hashlib_helper.requires_hashdigest('sha256')
|
|
|
c5b9d7 |
def test_legacy_block_size_warnings(self):
|
|
|
c5b9d7 |
class MockCrazyHash(object):
|
|
|
c5b9d7 |
@@ -371,6 +372,14 @@ class ConstructorTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
except Exception:
|
|
|
c5b9d7 |
self.fail("Standard constructor call raised exception.")
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ def test_normal_digestmod(self):
|
|
|
c5b9d7 |
+ # Standard constructor call.
|
|
|
c5b9d7 |
+ failed = 0
|
|
|
c5b9d7 |
+ try:
|
|
|
c5b9d7 |
+ h = hmac.HMAC(b"key", digestmod='sha1')
|
|
|
c5b9d7 |
+ except Exception:
|
|
|
c5b9d7 |
+ self.fail("Standard constructor call raised exception.")
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
@hashlib_helper.requires_hashdigest('sha256')
|
|
|
c5b9d7 |
def test_with_str_key(self):
|
|
|
c5b9d7 |
# Pass a key of type str, which is an error, because it expects a key
|
|
|
c5b9d7 |
@@ -446,6 +455,7 @@ class SanityTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
class CopyTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ @unittest.skipIf(hashlib.get_fips_mode(), "Internal attributes unavailable in FIPS mode")
|
|
|
c5b9d7 |
@hashlib_helper.requires_hashdigest('sha256')
|
|
|
c5b9d7 |
def test_attributes(self):
|
|
|
c5b9d7 |
# Testing if attributes are of same type.
|
|
|
c5b9d7 |
@@ -458,6 +468,8 @@ class CopyTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
self.assertEqual(type(h1._outer), type(h2._outer),
|
|
|
c5b9d7 |
"Types of outer don't match.")
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ @unittest.skipIf(hashlib.get_fips_mode(), "Internal attributes unavailable in FIPS mode")
|
|
|
c5b9d7 |
@hashlib_helper.requires_hashdigest('sha256')
|
|
|
c5b9d7 |
def test_realcopy(self):
|
|
|
c5b9d7 |
# Testing if the copy method created a real copy.
|
|
|
c5b9d7 |
@@ -473,6 +485,7 @@ class CopyTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
self.assertEqual(h1._outer, h1.outer)
|
|
|
c5b9d7 |
self.assertEqual(h1._digest_cons, h1.digest_cons)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ @unittest.skipIf(hashlib.get_fips_mode(), "Internal attributes unavailable in FIPS mode")
|
|
|
c5b9d7 |
@hashlib_helper.requires_hashdigest('sha256')
|
|
|
c5b9d7 |
def test_properties(self):
|
|
|
c5b9d7 |
# deprecated properties
|
|
|
c5b9d7 |
@@ -481,6 +494,21 @@ class CopyTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
self.assertEqual(h1._outer, h1.outer)
|
|
|
c5b9d7 |
self.assertEqual(h1._digest_cons, h1.digest_cons)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ def test_realcopy_by_digest(self):
|
|
|
c5b9d7 |
+ # Testing if the copy method created a real copy.
|
|
|
c5b9d7 |
+ h1 = hmac.HMAC(b"key", digestmod="sha1")
|
|
|
c5b9d7 |
+ h2 = h1.copy()
|
|
|
c5b9d7 |
+ # Using id() in case somebody has overridden __eq__/__ne__.
|
|
|
c5b9d7 |
+ self.assertTrue(id(h1) != id(h2), "No real copy of the HMAC instance.")
|
|
|
c5b9d7 |
+ old_digest = h1.digest()
|
|
|
c5b9d7 |
+ assert h1.digest() == h2.digest()
|
|
|
c5b9d7 |
+ h1.update(b'hi')
|
|
|
c5b9d7 |
+ assert h1.digest() != h2.digest()
|
|
|
c5b9d7 |
+ assert h2.digest() == old_digest
|
|
|
c5b9d7 |
+ new_digest = h1.digest()
|
|
|
c5b9d7 |
+ h2.update(b'hi')
|
|
|
c5b9d7 |
+ assert h1.digest() == h2.digest() == new_digest
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
@hashlib_helper.requires_hashdigest('sha256')
|
|
|
c5b9d7 |
def test_equality(self):
|
|
|
c5b9d7 |
# Testing if the copy has the same digests.
|
|
|
c5b9d7 |
diff --git a/Modules/_hmacopenssl.c b/Modules/_hmacopenssl.c
|
|
|
c5b9d7 |
new file mode 100644
|
|
|
c5b9d7 |
index 00000000000..c31d233fbe4
|
|
|
c5b9d7 |
--- /dev/null
|
|
|
c5b9d7 |
+++ b/Modules/_hmacopenssl.c
|
|
|
c5b9d7 |
@@ -0,0 +1,459 @@
|
|
|
c5b9d7 |
+/* Module that wraps all OpenSSL MHAC algorithm */
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+/* Copyright (C) 2019 Red Hat, Inc. Red Hat, Inc. and/or its affiliates
|
|
|
c5b9d7 |
+ *
|
|
|
c5b9d7 |
+ * Based on _hashopenssl.c, which is:
|
|
|
c5b9d7 |
+ * Copyright (C) 2005-2010 Gregory P. Smith (greg@krypto.org)
|
|
|
c5b9d7 |
+ * Licensed to PSF under a Contributor Agreement.
|
|
|
c5b9d7 |
+ *
|
|
|
c5b9d7 |
+ * Derived from a skeleton of shamodule.c containing work performed by:
|
|
|
c5b9d7 |
+ *
|
|
|
c5b9d7 |
+ * Andrew Kuchling (amk@amk.ca)
|
|
|
c5b9d7 |
+ * Greg Stein (gstein@lyra.org)
|
|
|
c5b9d7 |
+ *
|
|
|
c5b9d7 |
+ */
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#define PY_SSIZE_T_CLEAN
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#include "Python.h"
|
|
|
c5b9d7 |
+#include "structmember.h"
|
|
|
c5b9d7 |
+#include "hashlib.h"
|
|
|
c5b9d7 |
+#include "pystrhex.h"
|
|
|
c5b9d7 |
+#include "_hashopenssl.h"
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+typedef struct hmacopenssl_state {
|
|
|
c5b9d7 |
+ PyTypeObject *HmacType;
|
|
|
c5b9d7 |
+} hmacopenssl_state;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#include <openssl/hmac.h>
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+typedef struct {
|
|
|
c5b9d7 |
+ PyObject_HEAD
|
|
|
c5b9d7 |
+ PyObject *name; /* name of the hash algorithm */
|
|
|
c5b9d7 |
+ HMAC_CTX *ctx; /* OpenSSL hmac context */
|
|
|
c5b9d7 |
+ PyThread_type_lock lock; /* HMAC context lock */
|
|
|
c5b9d7 |
+} HmacObject;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#include "clinic/_hmacopenssl.c.h"
|
|
|
c5b9d7 |
+/*[clinic input]
|
|
|
c5b9d7 |
+module _hmacopenssl
|
|
|
c5b9d7 |
+class _hmacopenssl.HMAC "HmacObject *" "((hmacopenssl_state *)PyModule_GetState(module))->HmacType"
|
|
|
c5b9d7 |
+[clinic start generated code]*/
|
|
|
c5b9d7 |
+/*[clinic end generated code: output=da39a3ee5e6b4b0d input=9fe07a087adc2cf9]*/
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+Hmac_new(PyTypeObject *subtype, PyObject *args, PyObject *kwds)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ static char *kwarg_names[] = {"key", "digestmod", NULL};
|
|
|
c5b9d7 |
+ Py_buffer key = {NULL, NULL};
|
|
|
c5b9d7 |
+ char *digestmod = NULL;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ int ret = PyArg_ParseTupleAndKeywords(
|
|
|
c5b9d7 |
+ args, kwds, "y*|$s:_hmacopenssl.HMAC", kwarg_names,
|
|
|
c5b9d7 |
+ &key, &digestmod);
|
|
|
c5b9d7 |
+ if (ret == 0) {
|
|
|
c5b9d7 |
+ return NULL;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ if (digestmod == NULL) {
|
|
|
c5b9d7 |
+ PyErr_SetString(PyExc_ValueError, "digestmod must be specified");
|
|
|
c5b9d7 |
+ return NULL;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ /* name must be lowercase */
|
|
|
c5b9d7 |
+ for (int i=0; digestmod[i]; i++) {
|
|
|
c5b9d7 |
+ if (
|
|
|
c5b9d7 |
+ ((digestmod[i] < 'a') || (digestmod[i] > 'z'))
|
|
|
c5b9d7 |
+ && ((digestmod[i] < '0') || (digestmod[i] > '9'))
|
|
|
c5b9d7 |
+ && digestmod[i] != '-'
|
|
|
c5b9d7 |
+ ) {
|
|
|
c5b9d7 |
+ PyErr_SetString(PyExc_ValueError, "digestmod must be lowercase");
|
|
|
c5b9d7 |
+ return NULL;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ const EVP_MD *digest = EVP_get_digestbyname(digestmod);
|
|
|
c5b9d7 |
+ if (!digest) {
|
|
|
c5b9d7 |
+ PyErr_SetString(PyExc_ValueError, "unknown hash function");
|
|
|
c5b9d7 |
+ return NULL;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ PyObject *name = NULL;
|
|
|
c5b9d7 |
+ HMAC_CTX *ctx = NULL;
|
|
|
c5b9d7 |
+ HmacObject *retval = NULL;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ name = PyUnicode_FromFormat("hmac-%s", digestmod);
|
|
|
c5b9d7 |
+ if (name == NULL) {
|
|
|
c5b9d7 |
+ goto error;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ ctx = HMAC_CTX_new();
|
|
|
c5b9d7 |
+ if (ctx == NULL) {
|
|
|
c5b9d7 |
+ _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ goto error;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ int r = HMAC_Init_ex(
|
|
|
c5b9d7 |
+ ctx,
|
|
|
c5b9d7 |
+ (const char*)key.buf,
|
|
|
c5b9d7 |
+ key.len,
|
|
|
c5b9d7 |
+ digest,
|
|
|
c5b9d7 |
+ NULL /*impl*/);
|
|
|
c5b9d7 |
+ if (r == 0) {
|
|
|
c5b9d7 |
+ _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ goto error;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ PyBuffer_Release(&key);
|
|
|
c5b9d7 |
+ key.buf = NULL;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ retval = (HmacObject *)subtype->tp_alloc(subtype, 0);
|
|
|
c5b9d7 |
+ if (retval == NULL) {
|
|
|
c5b9d7 |
+ goto error;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ retval->name = name;
|
|
|
c5b9d7 |
+ retval->ctx = ctx;
|
|
|
c5b9d7 |
+ retval->lock = NULL;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ return (PyObject*)retval;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+error:
|
|
|
c5b9d7 |
+ if (ctx) HMAC_CTX_free(ctx);
|
|
|
c5b9d7 |
+ if (name) Py_DECREF(name);
|
|
|
c5b9d7 |
+ if (retval) PyObject_Del(name);
|
|
|
c5b9d7 |
+ if (key.buf) PyBuffer_Release(&key);
|
|
|
c5b9d7 |
+ return NULL;
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+/*[clinic input]
|
|
|
c5b9d7 |
+_hmacopenssl.HMAC.copy
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+Return a copy (“clone”) of the HMAC object.
|
|
|
c5b9d7 |
+[clinic start generated code]*/
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_HMAC_copy_impl(HmacObject *self)
|
|
|
c5b9d7 |
+/*[clinic end generated code: output=fe5ee41faf30dcf0 input=f5ed20feec42d8d0]*/
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ HmacObject *retval;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ HMAC_CTX *ctx = HMAC_CTX_new();
|
|
|
c5b9d7 |
+ if (ctx == NULL) {
|
|
|
c5b9d7 |
+ return _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ int r = HMAC_CTX_copy(ctx, self->ctx);
|
|
|
c5b9d7 |
+ if (r == 0) {
|
|
|
c5b9d7 |
+ HMAC_CTX_free(ctx);
|
|
|
c5b9d7 |
+ return _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ retval = (HmacObject *)Py_TYPE(self)->tp_alloc(Py_TYPE(self), 0);
|
|
|
c5b9d7 |
+ if (retval == NULL) {
|
|
|
c5b9d7 |
+ HMAC_CTX_free(ctx);
|
|
|
c5b9d7 |
+ return NULL;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ retval->ctx = ctx;
|
|
|
c5b9d7 |
+ Py_INCREF(self->name);
|
|
|
c5b9d7 |
+ retval->name = self->name;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ retval->lock = NULL;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ return (PyObject *)retval;
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static void
|
|
|
c5b9d7 |
+_hmac_dealloc(HmacObject *self)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ if (self->lock != NULL) {
|
|
|
c5b9d7 |
+ PyThread_free_lock(self->lock);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ HMAC_CTX_free(self->ctx);
|
|
|
c5b9d7 |
+ Py_CLEAR(self->name);
|
|
|
c5b9d7 |
+ Py_TYPE(self)->tp_free(self);
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmac_repr(HmacObject *self)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ return PyUnicode_FromFormat("<%U HMAC object @ %p>", self->name, self);
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+/*[clinic input]
|
|
|
c5b9d7 |
+_hmacopenssl.HMAC.update
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ msg: Py_buffer
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+Update the HMAC object with msg.
|
|
|
c5b9d7 |
+[clinic start generated code]*/
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_HMAC_update_impl(HmacObject *self, Py_buffer *msg)
|
|
|
c5b9d7 |
+/*[clinic end generated code: output=0efeee663a98cee5 input=0683d64f35808cb9]*/
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ if (self->lock == NULL && msg->len >= HASHLIB_GIL_MINSIZE) {
|
|
|
c5b9d7 |
+ self->lock = PyThread_allocate_lock();
|
|
|
c5b9d7 |
+ /* fail? lock = NULL and we fail over to non-threaded code. */
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ int r;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ if (self->lock != NULL) {
|
|
|
c5b9d7 |
+ Py_BEGIN_ALLOW_THREADS
|
|
|
c5b9d7 |
+ PyThread_acquire_lock(self->lock, 1);
|
|
|
c5b9d7 |
+ r = HMAC_Update(self->ctx, (const unsigned char*)msg->buf, msg->len);
|
|
|
c5b9d7 |
+ PyThread_release_lock(self->lock);
|
|
|
c5b9d7 |
+ Py_END_ALLOW_THREADS
|
|
|
c5b9d7 |
+ } else {
|
|
|
c5b9d7 |
+ r = HMAC_Update(self->ctx, (const unsigned char*)msg->buf, msg->len);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ if (r == 0) {
|
|
|
c5b9d7 |
+ _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ return NULL;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ Py_RETURN_NONE;
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static unsigned int
|
|
|
c5b9d7 |
+_digest_size(HmacObject *self)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ const EVP_MD *md = HMAC_CTX_get_md(self->ctx);
|
|
|
c5b9d7 |
+ if (md == NULL) {
|
|
|
c5b9d7 |
+ _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ return 0;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ return EVP_MD_size(md);
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static int
|
|
|
c5b9d7 |
+_digest(HmacObject *self, unsigned char *buf, unsigned int len)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ HMAC_CTX *temp_ctx = HMAC_CTX_new();
|
|
|
c5b9d7 |
+ if (temp_ctx == NULL) {
|
|
|
c5b9d7 |
+ PyErr_NoMemory();
|
|
|
c5b9d7 |
+ return 0;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ int r = HMAC_CTX_copy(temp_ctx, self->ctx);
|
|
|
c5b9d7 |
+ if (r == 0) {
|
|
|
c5b9d7 |
+ _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ return 0;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ r = HMAC_Final(temp_ctx, buf, &len;;
|
|
|
c5b9d7 |
+ HMAC_CTX_free(temp_ctx);
|
|
|
c5b9d7 |
+ if (r == 0) {
|
|
|
c5b9d7 |
+ _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ return 0;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ return 1;
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+/*[clinic input]
|
|
|
c5b9d7 |
+_hmacopenssl.HMAC.digest
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+Return the digest of the bytes passed to the update() method so far.
|
|
|
c5b9d7 |
+[clinic start generated code]*/
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_HMAC_digest_impl(HmacObject *self)
|
|
|
c5b9d7 |
+/*[clinic end generated code: output=3aa6dbfc46ec4957 input=bf769a10b1d9edd9]*/
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ unsigned int digest_size = _digest_size(self);
|
|
|
c5b9d7 |
+ if (digest_size == 0) {
|
|
|
c5b9d7 |
+ return _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ unsigned char buf[digest_size]; /* FIXME: C99 feature */
|
|
|
c5b9d7 |
+ int r = _digest(self, buf, digest_size);
|
|
|
c5b9d7 |
+ if (r == 0) {
|
|
|
c5b9d7 |
+ return NULL;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ return PyBytes_FromStringAndSize((const char *)buf, digest_size);
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+/*[clinic input]
|
|
|
c5b9d7 |
+_hmacopenssl.HMAC.hexdigest
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+Return hexadecimal digest of the bytes passed to the update() method so far.
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+This may be used to exchange the value safely in email or other non-binary
|
|
|
c5b9d7 |
+environments.
|
|
|
c5b9d7 |
+[clinic start generated code]*/
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_HMAC_hexdigest_impl(HmacObject *self)
|
|
|
c5b9d7 |
+/*[clinic end generated code: output=630f6fa89f9f1e48 input=b8e60ec8b811c4cd]*/
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ unsigned int digest_size = _digest_size(self);
|
|
|
c5b9d7 |
+ if (digest_size == 0) {
|
|
|
c5b9d7 |
+ return _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ unsigned char buf[digest_size]; /* FIXME: C99 feature */
|
|
|
c5b9d7 |
+ int r = _digest(self, buf, digest_size);
|
|
|
c5b9d7 |
+ if (r == 0) {
|
|
|
c5b9d7 |
+ return NULL;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ return _Py_strhex((const char *)buf, digest_size);
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_get_digest_size(HmacObject *self, void *closure)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ unsigned int digest_size = _digest_size(self);
|
|
|
c5b9d7 |
+ if (digest_size == 0) {
|
|
|
c5b9d7 |
+ return _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ return PyLong_FromLong(digest_size);
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_get_block_size(HmacObject *self, void *closure)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ const EVP_MD *md = HMAC_CTX_get_md(self->ctx);
|
|
|
c5b9d7 |
+ if (md == NULL) {
|
|
|
c5b9d7 |
+ return _setException(PyExc_ValueError);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ return PyLong_FromLong(EVP_MD_block_size(md));
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyMethodDef Hmac_methods[] = {
|
|
|
c5b9d7 |
+ _HMACOPENSSL_HMAC_UPDATE_METHODDEF
|
|
|
c5b9d7 |
+ _HMACOPENSSL_HMAC_DIGEST_METHODDEF
|
|
|
c5b9d7 |
+ _HMACOPENSSL_HMAC_HEXDIGEST_METHODDEF
|
|
|
c5b9d7 |
+ _HMACOPENSSL_HMAC_COPY_METHODDEF
|
|
|
c5b9d7 |
+ {NULL, NULL} /* sentinel */
|
|
|
c5b9d7 |
+};
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyGetSetDef Hmac_getset[] = {
|
|
|
c5b9d7 |
+ {"digest_size", (getter)_hmacopenssl_get_digest_size, NULL, NULL, NULL},
|
|
|
c5b9d7 |
+ {"block_size", (getter)_hmacopenssl_get_block_size, NULL, NULL, NULL},
|
|
|
c5b9d7 |
+ {NULL} /* Sentinel */
|
|
|
c5b9d7 |
+};
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyMemberDef Hmac_members[] = {
|
|
|
c5b9d7 |
+ {"name", T_OBJECT, offsetof(HmacObject, name), READONLY, PyDoc_STR("HMAC name")},
|
|
|
c5b9d7 |
+ {NULL} /* Sentinel */
|
|
|
c5b9d7 |
+};
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+PyDoc_STRVAR(hmactype_doc,
|
|
|
c5b9d7 |
+"The object used to calculate HMAC of a message.\n\
|
|
|
c5b9d7 |
+\n\
|
|
|
c5b9d7 |
+Methods:\n\
|
|
|
c5b9d7 |
+\n\
|
|
|
c5b9d7 |
+update() -- updates the current digest with an additional string\n\
|
|
|
c5b9d7 |
+digest() -- return the current digest value\n\
|
|
|
c5b9d7 |
+hexdigest() -- return the current digest as a string of hexadecimal digits\n\
|
|
|
c5b9d7 |
+copy() -- return a copy of the current hash object\n\
|
|
|
c5b9d7 |
+\n\
|
|
|
c5b9d7 |
+Attributes:\n\
|
|
|
c5b9d7 |
+\n\
|
|
|
c5b9d7 |
+name -- the name, including the hash algorithm used by this object\n\
|
|
|
c5b9d7 |
+digest_size -- number of bytes in digest() output\n");
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyType_Slot HmacType_slots[] = {
|
|
|
c5b9d7 |
+ {Py_tp_doc, (char*)hmactype_doc},
|
|
|
c5b9d7 |
+ {Py_tp_repr, (reprfunc)_hmac_repr},
|
|
|
c5b9d7 |
+ {Py_tp_dealloc,(destructor)_hmac_dealloc},
|
|
|
c5b9d7 |
+ {Py_tp_methods, Hmac_methods},
|
|
|
c5b9d7 |
+ {Py_tp_getset, Hmac_getset},
|
|
|
c5b9d7 |
+ {Py_tp_members, Hmac_members},
|
|
|
c5b9d7 |
+ {Py_tp_new, Hmac_new},
|
|
|
c5b9d7 |
+ {0, NULL}
|
|
|
c5b9d7 |
+};
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+PyType_Spec HmacType_spec = {
|
|
|
c5b9d7 |
+ "_hmacopenssl.HMAC", /* name */
|
|
|
c5b9d7 |
+ sizeof(HmacObject), /* basicsize */
|
|
|
c5b9d7 |
+ .flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,
|
|
|
c5b9d7 |
+ .slots = HmacType_slots,
|
|
|
c5b9d7 |
+};
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static int
|
|
|
c5b9d7 |
+hmacopenssl_traverse(PyObject *self, visitproc visit, void *arg)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ hmacopenssl_state *state;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ state = PyModule_GetState(self);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ if (state) {
|
|
|
c5b9d7 |
+ Py_VISIT(state->HmacType);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ return 0;
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static int
|
|
|
c5b9d7 |
+hmacopenssl_clear(PyObject *self)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ hmacopenssl_state *state;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ state = PyModule_GetState(self);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ if (state) {
|
|
|
c5b9d7 |
+ Py_CLEAR(state->HmacType);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ return 0;
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+/* Initialize this module. */
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static int
|
|
|
c5b9d7 |
+hmacopenssl_exec(PyObject *m) {
|
|
|
c5b9d7 |
+ /* TODO build EVP_functions openssl_* entries dynamically based
|
|
|
c5b9d7 |
+ * on what hashes are supported rather than listing many
|
|
|
c5b9d7 |
+ * and having some unsupported. Only init appropriate
|
|
|
c5b9d7 |
+ * constants. */
|
|
|
c5b9d7 |
+ PyObject *temp = NULL;
|
|
|
c5b9d7 |
+ hmacopenssl_state *state;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ temp = PyType_FromSpec(&HmacType_spec);
|
|
|
c5b9d7 |
+ if (temp == NULL) {
|
|
|
c5b9d7 |
+ goto fail;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ if (PyModule_AddObject(m, "HMAC", temp) == -1) {
|
|
|
c5b9d7 |
+ goto fail;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ state = PyModule_GetState(m);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ state->HmacType = (PyTypeObject *)temp;
|
|
|
c5b9d7 |
+ Py_INCREF(temp);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ return 0;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+fail:
|
|
|
c5b9d7 |
+ Py_XDECREF(temp);
|
|
|
c5b9d7 |
+ return -1;
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyModuleDef_Slot hmacopenssl_slots[] = {
|
|
|
c5b9d7 |
+ {Py_mod_exec, hmacopenssl_exec},
|
|
|
c5b9d7 |
+ {0, NULL},
|
|
|
c5b9d7 |
+};
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static struct PyModuleDef _hmacopenssl_def = {
|
|
|
c5b9d7 |
+ PyModuleDef_HEAD_INIT, /* m_base */
|
|
|
c5b9d7 |
+ .m_name = "_hmacopenssl",
|
|
|
c5b9d7 |
+ .m_slots = hmacopenssl_slots,
|
|
|
c5b9d7 |
+ .m_size = sizeof(hmacopenssl_state),
|
|
|
c5b9d7 |
+ .m_traverse = hmacopenssl_traverse,
|
|
|
c5b9d7 |
+ .m_clear = hmacopenssl_clear
|
|
|
c5b9d7 |
+};
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+PyMODINIT_FUNC
|
|
|
c5b9d7 |
+PyInit__hmacopenssl(void)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ return PyModuleDef_Init(&_hmacopenssl_def);
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
diff --git a/Modules/clinic/_hmacopenssl.c.h b/Modules/clinic/_hmacopenssl.c.h
|
|
|
c5b9d7 |
new file mode 100644
|
|
|
c5b9d7 |
index 00000000000..a2af550838a
|
|
|
c5b9d7 |
--- /dev/null
|
|
|
c5b9d7 |
+++ b/Modules/clinic/_hmacopenssl.c.h
|
|
|
c5b9d7 |
@@ -0,0 +1,104 @@
|
|
|
c5b9d7 |
+/*[clinic input]
|
|
|
c5b9d7 |
+preserve
|
|
|
c5b9d7 |
+[clinic start generated code]*/
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+PyDoc_STRVAR(_hmacopenssl_HMAC_copy__doc__,
|
|
|
c5b9d7 |
+"copy($self, /)\n"
|
|
|
c5b9d7 |
+"--\n"
|
|
|
c5b9d7 |
+"\n"
|
|
|
c5b9d7 |
+"Return a copy (“clone”) of the HMAC object.");
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#define _HMACOPENSSL_HMAC_COPY_METHODDEF \
|
|
|
c5b9d7 |
+ {"copy", (PyCFunction)_hmacopenssl_HMAC_copy, METH_NOARGS, _hmacopenssl_HMAC_copy__doc__},
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_HMAC_copy_impl(HmacObject *self);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_HMAC_copy(HmacObject *self, PyObject *Py_UNUSED(ignored))
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ return _hmacopenssl_HMAC_copy_impl(self);
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+PyDoc_STRVAR(_hmacopenssl_HMAC_update__doc__,
|
|
|
c5b9d7 |
+"update($self, /, msg)\n"
|
|
|
c5b9d7 |
+"--\n"
|
|
|
c5b9d7 |
+"\n"
|
|
|
c5b9d7 |
+"Update the HMAC object with msg.");
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#define _HMACOPENSSL_HMAC_UPDATE_METHODDEF \
|
|
|
c5b9d7 |
+ {"update", (PyCFunction)(void(*)(void))_hmacopenssl_HMAC_update, METH_FASTCALL|METH_KEYWORDS, _hmacopenssl_HMAC_update__doc__},
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_HMAC_update_impl(HmacObject *self, Py_buffer *msg);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_HMAC_update(HmacObject *self, PyObject *const *args, Py_ssize_t nargs, PyObject *kwnames)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ PyObject *return_value = NULL;
|
|
|
c5b9d7 |
+ static const char * const _keywords[] = {"msg", NULL};
|
|
|
c5b9d7 |
+ static _PyArg_Parser _parser = {NULL, _keywords, "update", 0};
|
|
|
c5b9d7 |
+ PyObject *argsbuf[1];
|
|
|
c5b9d7 |
+ Py_buffer msg = {NULL, NULL};
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ args = _PyArg_UnpackKeywords(args, nargs, NULL, kwnames, &_parser, 1, 1, 0, argsbuf);
|
|
|
c5b9d7 |
+ if (!args) {
|
|
|
c5b9d7 |
+ goto exit;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ if (PyObject_GetBuffer(args[0], &msg, PyBUF_SIMPLE) != 0) {
|
|
|
c5b9d7 |
+ goto exit;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ if (!PyBuffer_IsContiguous(&msg, 'C')) {
|
|
|
c5b9d7 |
+ _PyArg_BadArgument("update", "argument 'msg'", "contiguous buffer", args[0]);
|
|
|
c5b9d7 |
+ goto exit;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ return_value = _hmacopenssl_HMAC_update_impl(self, &msg;;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+exit:
|
|
|
c5b9d7 |
+ /* Cleanup for msg */
|
|
|
c5b9d7 |
+ if (msg.obj) {
|
|
|
c5b9d7 |
+ PyBuffer_Release(&msg;;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ return return_value;
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+PyDoc_STRVAR(_hmacopenssl_HMAC_digest__doc__,
|
|
|
c5b9d7 |
+"digest($self, /)\n"
|
|
|
c5b9d7 |
+"--\n"
|
|
|
c5b9d7 |
+"\n"
|
|
|
c5b9d7 |
+"Return the digest of the bytes passed to the update() method so far.");
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#define _HMACOPENSSL_HMAC_DIGEST_METHODDEF \
|
|
|
c5b9d7 |
+ {"digest", (PyCFunction)_hmacopenssl_HMAC_digest, METH_NOARGS, _hmacopenssl_HMAC_digest__doc__},
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_HMAC_digest_impl(HmacObject *self);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_HMAC_digest(HmacObject *self, PyObject *Py_UNUSED(ignored))
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ return _hmacopenssl_HMAC_digest_impl(self);
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+PyDoc_STRVAR(_hmacopenssl_HMAC_hexdigest__doc__,
|
|
|
c5b9d7 |
+"hexdigest($self, /)\n"
|
|
|
c5b9d7 |
+"--\n"
|
|
|
c5b9d7 |
+"\n"
|
|
|
c5b9d7 |
+"Return hexadecimal digest of the bytes passed to the update() method so far.\n"
|
|
|
c5b9d7 |
+"\n"
|
|
|
c5b9d7 |
+"This may be used to exchange the value safely in email or other non-binary\n"
|
|
|
c5b9d7 |
+"environments.");
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#define _HMACOPENSSL_HMAC_HEXDIGEST_METHODDEF \
|
|
|
c5b9d7 |
+ {"hexdigest", (PyCFunction)_hmacopenssl_HMAC_hexdigest, METH_NOARGS, _hmacopenssl_HMAC_hexdigest__doc__},
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_HMAC_hexdigest_impl(HmacObject *self);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static PyObject *
|
|
|
c5b9d7 |
+_hmacopenssl_HMAC_hexdigest(HmacObject *self, PyObject *Py_UNUSED(ignored))
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ return _hmacopenssl_HMAC_hexdigest_impl(self);
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+/*[clinic end generated code: output=e0c910f3c9ed523e input=a9049054013a1b77]*/
|
|
|
c5b9d7 |
diff --git a/setup.py b/setup.py
|
|
|
c5b9d7 |
index 89edbb627fa..5c2cbd665af 100644
|
|
|
c5b9d7 |
--- a/setup.py
|
|
|
c5b9d7 |
+++ b/setup.py
|
|
|
c5b9d7 |
@@ -2371,6 +2371,10 @@ class PyBuildExt(build_ext):
|
|
|
c5b9d7 |
depends=['hashlib.h'],
|
|
|
c5b9d7 |
**self.detect_openssl_args()) )
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ self.add(Extension('_hmacopenssl', ['_hmacopenssl.c'],
|
|
|
c5b9d7 |
+ depends = ['hashlib.h'],
|
|
|
c5b9d7 |
+ **self.detect_openssl_args()) )
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
def detect_hash_builtins(self):
|
|
|
c5b9d7 |
# By default we always compile these even when OpenSSL is available
|
|
|
c5b9d7 |
# (issue #14693). It's harmless and the object code is tiny
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
From a6d7c4268a6e305b1178b633e59dde7b5c8a1069 Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Petr Viktorin <pviktori@redhat.com>
|
|
|
c5b9d7 |
Date: Thu, 1 Aug 2019 17:57:05 +0200
|
|
|
c5b9d7 |
Subject: [PATCH 06/13] Use a stronger hash in multiprocessing handshake
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
Adapted from patch by David Malcolm,
|
|
|
c5b9d7 |
https://bugs.python.org/issue17258
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Lib/multiprocessing/connection.py | 8 ++++++--
|
|
|
c5b9d7 |
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/multiprocessing/connection.py b/Lib/multiprocessing/connection.py
|
|
|
c5b9d7 |
index 510e4b5aba4..b68f2fb837a 100644
|
|
|
c5b9d7 |
--- a/Lib/multiprocessing/connection.py
|
|
|
c5b9d7 |
+++ b/Lib/multiprocessing/connection.py
|
|
|
c5b9d7 |
@@ -42,6 +42,10 @@ BUFSIZE = 8192
|
|
|
c5b9d7 |
# A very generous timeout when it comes to local connections...
|
|
|
c5b9d7 |
CONNECTION_TIMEOUT = 20.
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+# The hmac module implicitly defaults to using MD5.
|
|
|
c5b9d7 |
+# Support using a stronger algorithm for the challenge/response code:
|
|
|
c5b9d7 |
+HMAC_DIGEST_NAME='sha256'
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
_mmap_counter = itertools.count()
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
default_family = 'AF_INET'
|
|
|
c5b9d7 |
@@ -741,7 +745,7 @@ def deliver_challenge(connection, authkey):
|
|
|
c5b9d7 |
"Authkey must be bytes, not {0!s}".format(type(authkey)))
|
|
|
c5b9d7 |
message = os.urandom(MESSAGE_LENGTH)
|
|
|
c5b9d7 |
connection.send_bytes(CHALLENGE + message)
|
|
|
c5b9d7 |
- digest = hmac.new(authkey, message, 'md5').digest()
|
|
|
c5b9d7 |
+ digest = hmac.new(authkey, message, HMAC_DIGEST_NAME).digest()
|
|
|
c5b9d7 |
response = connection.recv_bytes(256) # reject large message
|
|
|
c5b9d7 |
if response == digest:
|
|
|
c5b9d7 |
connection.send_bytes(WELCOME)
|
|
|
c5b9d7 |
@@ -757,7 +761,7 @@ def answer_challenge(connection, authkey):
|
|
|
c5b9d7 |
message = connection.recv_bytes(256) # reject large message
|
|
|
c5b9d7 |
assert message[:len(CHALLENGE)] == CHALLENGE, 'message = %r' % message
|
|
|
c5b9d7 |
message = message[len(CHALLENGE):]
|
|
|
c5b9d7 |
- digest = hmac.new(authkey, message, 'md5').digest()
|
|
|
c5b9d7 |
+ digest = hmac.new(authkey, message, HMAC_DIGEST_NAME).digest()
|
|
|
c5b9d7 |
connection.send_bytes(digest)
|
|
|
c5b9d7 |
response = connection.recv_bytes(256) # reject large message
|
|
|
c5b9d7 |
if response != WELCOME:
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
From 86868ca46c47112f771d54a54ee89e2d6c00f56f Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Charalampos Stratakis <cstratak@redhat.com>
|
|
|
c5b9d7 |
Date: Wed, 31 Jul 2019 15:43:43 +0200
|
|
|
c5b9d7 |
Subject: [PATCH 07/13] Add initial tests for various hashes under FIPS mode
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Lib/test/test_fips.py | 31 +++++++++++++++++++++++++++++++
|
|
|
c5b9d7 |
1 file changed, 31 insertions(+)
|
|
|
c5b9d7 |
create mode 100644 Lib/test/test_fips.py
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/test/test_fips.py b/Lib/test/test_fips.py
|
|
|
c5b9d7 |
new file mode 100644
|
|
|
c5b9d7 |
index 00000000000..fe4ea72296e
|
|
|
c5b9d7 |
--- /dev/null
|
|
|
c5b9d7 |
+++ b/Lib/test/test_fips.py
|
|
|
c5b9d7 |
@@ -0,0 +1,31 @@
|
|
|
c5b9d7 |
+import unittest
|
|
|
c5b9d7 |
+import hmac, _hmacopenssl
|
|
|
c5b9d7 |
+import hashlib, _hashlib
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+class HashlibFipsTests(unittest.TestCase):
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ @unittest.skipUnless(hashlib.get_fips_mode(), "Test only when FIPS is enabled")
|
|
|
c5b9d7 |
+ def test_fips_imports(self):
|
|
|
c5b9d7 |
+ """blake2s and blake2b should fail to import in FIPS mode
|
|
|
c5b9d7 |
+ """
|
|
|
c5b9d7 |
+ with self.assertRaises(ValueError, msg='blake2s not available in FIPS'):
|
|
|
c5b9d7 |
+ m = hashlib.blake2s()
|
|
|
c5b9d7 |
+ with self.assertRaises(ValueError, msg='blake2b not available in FIPS'):
|
|
|
c5b9d7 |
+ m = hashlib.blake2b()
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ @unittest.skipIf(hashlib.get_fips_mode(), "blake2 hashes are not available under FIPS")
|
|
|
c5b9d7 |
+ def test_blake2_hashes(self):
|
|
|
c5b9d7 |
+ self.assertEqual(hashlib.blake2b(b'abc').hexdigest(), _hashlib.openssl_blake2b(b'abc').hexdigest())
|
|
|
c5b9d7 |
+ self.assertEqual(hashlib.blake2s(b'abc').hexdigest(), _hashlib.openssl_blake2s(b'abc').hexdigest())
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ def test_hmac_digests(self):
|
|
|
c5b9d7 |
+ self.assertEqual(_hmacopenssl.HMAC(b'My hovercraft is full of eels', digestmod='sha384').hexdigest(),
|
|
|
c5b9d7 |
+ hmac.new(b'My hovercraft is full of eels', digestmod='sha384').hexdigest())
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+if __name__ == "__main__":
|
|
|
c5b9d7 |
+ unittest.main()
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
From 5badab85d3fc725b56a19658f1e9b16aeb0ed663 Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Petr Viktorin <pviktori@redhat.com>
|
|
|
c5b9d7 |
Date: Mon, 5 Aug 2019 18:23:57 +0200
|
|
|
c5b9d7 |
Subject: [PATCH 08/13] Make hashlib tests pass in FIPS mode
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Lib/test/test_hashlib.py | 27 ++++++++++++++++++++++++---
|
|
|
c5b9d7 |
1 file changed, 24 insertions(+), 3 deletions(-)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
index a838bcee2a8..6f60ad4b8fb 100644
|
|
|
c5b9d7 |
--- a/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
+++ b/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
@@ -44,6 +44,12 @@ if builtin_hashes == default_builtin_hashes:
|
|
|
c5b9d7 |
else:
|
|
|
c5b9d7 |
builtin_hashlib = None
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+if hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+ FIPS_DISABLED = {'md5', 'MD5', 'blake2b', 'blake2s'}
|
|
|
c5b9d7 |
+else:
|
|
|
c5b9d7 |
+ FIPS_DISABLED = set()
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
try:
|
|
|
c5b9d7 |
from _hashlib import HASH, HASHXOF, openssl_md_meth_names
|
|
|
c5b9d7 |
except ImportError:
|
|
|
c5b9d7 |
@@ -106,6 +112,7 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
# Issue #14693: fallback modules are always compiled under POSIX
|
|
|
c5b9d7 |
_warn_on_extension_import = os.name == 'posix' or COMPILED_WITH_PYDEBUG
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
def _conditional_import_module(self, module_name):
|
|
|
c5b9d7 |
"""Import a module and return a reference to it or None on failure."""
|
|
|
c5b9d7 |
try:
|
|
|
c5b9d7 |
@@ -113,6 +120,9 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
except ModuleNotFoundError as error:
|
|
|
c5b9d7 |
if self._warn_on_extension_import and module_name in builtin_hashes:
|
|
|
c5b9d7 |
warnings.warn('Did a C extension fail to compile? %s' % error)
|
|
|
c5b9d7 |
+ except ImportError as error:
|
|
|
c5b9d7 |
+ if not hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+ raise
|
|
|
c5b9d7 |
return None
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def __init__(self, *args, **kwargs):
|
|
|
c5b9d7 |
@@ -211,7 +221,7 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
c.hexdigest()
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def test_algorithms_guaranteed(self):
|
|
|
c5b9d7 |
- self.assertEqual(hashlib.algorithms_guaranteed,
|
|
|
c5b9d7 |
+ self.assertEqual(hashlib.algorithms_guaranteed - FIPS_DISABLED,
|
|
|
c5b9d7 |
set(_algo for _algo in self.supported_hash_names
|
|
|
c5b9d7 |
if _algo.islower()))
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
@@ -250,6 +260,12 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
def test_new_upper_to_lower(self):
|
|
|
c5b9d7 |
self.assertEqual(hashlib.new("SHA256").name, "sha256")
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ @unittest.skipUnless(hashlib.get_fips_mode(), "Builtin constructor only unavailable in FIPS mode")
|
|
|
c5b9d7 |
+ def test_get_builtin_constructor_fips(self):
|
|
|
c5b9d7 |
+ with self.assertRaises(AttributeError):
|
|
|
c5b9d7 |
+ hashlib.__get_builtin_constructor
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ @unittest.skipIf(hashlib.get_fips_mode(), "No builtin constructors in FIPS mode")
|
|
|
c5b9d7 |
def test_get_builtin_constructor(self):
|
|
|
c5b9d7 |
get_builtin_constructor = getattr(hashlib,
|
|
|
c5b9d7 |
'__get_builtin_constructor')
|
|
|
c5b9d7 |
@@ -380,7 +396,8 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
self.assertRaises(TypeError, hash_object_constructor, 'spam')
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def test_no_unicode(self):
|
|
|
c5b9d7 |
- self.check_no_unicode('md5')
|
|
|
c5b9d7 |
+ if not hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+ self.check_no_unicode('md5')
|
|
|
c5b9d7 |
self.check_no_unicode('sha1')
|
|
|
c5b9d7 |
self.check_no_unicode('sha224')
|
|
|
c5b9d7 |
self.check_no_unicode('sha256')
|
|
|
c5b9d7 |
@@ -421,7 +438,8 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
self.assertIn(name.split("_")[0], repr(m))
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def test_blocksize_name(self):
|
|
|
c5b9d7 |
- self.check_blocksize_name('md5', 64, 16)
|
|
|
c5b9d7 |
+ if not hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+ self.check_blocksize_name('md5', 64, 16)
|
|
|
c5b9d7 |
self.check_blocksize_name('sha1', 64, 20)
|
|
|
c5b9d7 |
self.check_blocksize_name('sha224', 64, 28)
|
|
|
c5b9d7 |
self.check_blocksize_name('sha256', 64, 32)
|
|
|
c5b9d7 |
@@ -463,18 +481,21 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
self.check_blocksize_name('blake2b', 128, 64)
|
|
|
c5b9d7 |
self.check_blocksize_name('blake2s', 64, 32)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ @unittest.skipIf(hashlib.get_fips_mode(), "md5 unacceptable in FIPS mode")
|
|
|
c5b9d7 |
def test_case_md5_0(self):
|
|
|
c5b9d7 |
self.check(
|
|
|
c5b9d7 |
'md5', b'', 'd41d8cd98f00b204e9800998ecf8427e',
|
|
|
c5b9d7 |
usedforsecurity=False
|
|
|
c5b9d7 |
)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ @unittest.skipIf(hashlib.get_fips_mode(), "md5 unacceptable in FIPS mode")
|
|
|
c5b9d7 |
def test_case_md5_1(self):
|
|
|
c5b9d7 |
self.check(
|
|
|
c5b9d7 |
'md5', b'abc', '900150983cd24fb0d6963f7d28e17f72',
|
|
|
c5b9d7 |
usedforsecurity=False
|
|
|
c5b9d7 |
)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ @unittest.skipIf(hashlib.get_fips_mode(), "md5 unacceptable in FIPS mode")
|
|
|
c5b9d7 |
def test_case_md5_2(self):
|
|
|
c5b9d7 |
self.check(
|
|
|
c5b9d7 |
'md5',
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
From 0f7a3094bc4cf691ae0dd093567ceea149e14e8a Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Petr Viktorin <pviktori@redhat.com>
|
|
|
c5b9d7 |
Date: Mon, 26 Aug 2019 19:09:39 +0200
|
|
|
c5b9d7 |
Subject: [PATCH 09/13] Test the usedforsecurity flag
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Lib/test/test_hashlib.py | 66 +++++++++++++++++++++++++---------------
|
|
|
c5b9d7 |
1 file changed, 42 insertions(+), 24 deletions(-)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
index 6f60ad4b8fb..f306ba33b20 100644
|
|
|
c5b9d7 |
--- a/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
+++ b/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
@@ -20,6 +20,7 @@ import warnings
|
|
|
c5b9d7 |
from test import support
|
|
|
c5b9d7 |
from test.support import _4G, bigmemtest, import_fresh_module
|
|
|
c5b9d7 |
from http.client import HTTPException
|
|
|
c5b9d7 |
+from functools import partial
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
# Were we compiled --with-pydebug or with #define Py_DEBUG?
|
|
|
c5b9d7 |
COMPILED_WITH_PYDEBUG = hasattr(sys, 'gettotalrefcount')
|
|
|
c5b9d7 |
@@ -46,8 +47,10 @@ else:
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
if hashlib.get_fips_mode():
|
|
|
c5b9d7 |
- FIPS_DISABLED = {'md5', 'MD5', 'blake2b', 'blake2s'}
|
|
|
c5b9d7 |
+ FIPS_UNAVAILABLE = {'blake2b', 'blake2s'}
|
|
|
c5b9d7 |
+ FIPS_DISABLED = {'md5', 'MD5', *FIPS_UNAVAILABLE}
|
|
|
c5b9d7 |
else:
|
|
|
c5b9d7 |
+ FIPS_UNAVAILABLE = set()
|
|
|
c5b9d7 |
FIPS_DISABLED = set()
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
try:
|
|
|
c5b9d7 |
@@ -98,6 +101,14 @@ def read_vectors(hash_name):
|
|
|
c5b9d7 |
parts[0] = bytes.fromhex(parts[0])
|
|
|
c5b9d7 |
yield parts
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+def _is_openssl_constructor(constructor):
|
|
|
c5b9d7 |
+ if getattr(constructor, '__name__', '').startswith('openssl_'):
|
|
|
c5b9d7 |
+ return True
|
|
|
c5b9d7 |
+ if isinstance(constructor, partial):
|
|
|
c5b9d7 |
+ if constructor.func.__name__.startswith('openssl_'):
|
|
|
c5b9d7 |
+ return True
|
|
|
c5b9d7 |
+ return False
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
supported_hash_names = ( 'md5', 'MD5', 'sha1', 'SHA1',
|
|
|
c5b9d7 |
@@ -128,8 +139,8 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
def __init__(self, *args, **kwargs):
|
|
|
c5b9d7 |
algorithms = set()
|
|
|
c5b9d7 |
for algorithm in self.supported_hash_names:
|
|
|
c5b9d7 |
- algorithms.add(algorithm.lower())
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
+ if algorithm not in FIPS_UNAVAILABLE:
|
|
|
c5b9d7 |
+ algorithms.add(algorithm.lower())
|
|
|
c5b9d7 |
_blake2 = self._conditional_import_module('_blake2')
|
|
|
c5b9d7 |
if _blake2:
|
|
|
c5b9d7 |
algorithms.update({'blake2b', 'blake2s'})
|
|
|
c5b9d7 |
@@ -138,15 +149,21 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
for algorithm in algorithms:
|
|
|
c5b9d7 |
self.constructors_to_test[algorithm] = set()
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ def _add_constructor(algorithm, constructor):
|
|
|
c5b9d7 |
+ constructors.add(partial(constructor, usedforsecurity=False))
|
|
|
c5b9d7 |
+ if algorithm not in FIPS_DISABLED:
|
|
|
c5b9d7 |
+ constructors.add(constructor)
|
|
|
c5b9d7 |
+ constructors.add(partial(constructor, usedforsecurity=True))
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
# For each algorithm, test the direct constructor and the use
|
|
|
c5b9d7 |
# of hashlib.new given the algorithm name.
|
|
|
c5b9d7 |
for algorithm, constructors in self.constructors_to_test.items():
|
|
|
c5b9d7 |
- constructors.add(getattr(hashlib, algorithm))
|
|
|
c5b9d7 |
+ _add_constructor(algorithm, getattr(hashlib, algorithm))
|
|
|
c5b9d7 |
def _test_algorithm_via_hashlib_new(data=None, _alg=algorithm, **kwargs):
|
|
|
c5b9d7 |
if data is None:
|
|
|
c5b9d7 |
return hashlib.new(_alg, **kwargs)
|
|
|
c5b9d7 |
return hashlib.new(_alg, data, **kwargs)
|
|
|
c5b9d7 |
- constructors.add(_test_algorithm_via_hashlib_new)
|
|
|
c5b9d7 |
+ _add_constructor(algorithm, _test_algorithm_via_hashlib_new)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
_hashlib = self._conditional_import_module('_hashlib')
|
|
|
c5b9d7 |
self._hashlib = _hashlib
|
|
|
c5b9d7 |
@@ -158,13 +175,7 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
for algorithm, constructors in self.constructors_to_test.items():
|
|
|
c5b9d7 |
constructor = getattr(_hashlib, 'openssl_'+algorithm, None)
|
|
|
c5b9d7 |
if constructor:
|
|
|
c5b9d7 |
- try:
|
|
|
c5b9d7 |
- constructor()
|
|
|
c5b9d7 |
- except ValueError:
|
|
|
c5b9d7 |
- # default constructor blocked by crypto policy
|
|
|
c5b9d7 |
- pass
|
|
|
c5b9d7 |
- else:
|
|
|
c5b9d7 |
- constructors.add(constructor)
|
|
|
c5b9d7 |
+ _add_constructor(algorithm, constructor)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def add_builtin_constructor(name):
|
|
|
c5b9d7 |
constructor = getattr(hashlib, "__get_builtin_constructor")(name)
|
|
|
c5b9d7 |
@@ -221,7 +232,7 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
c.hexdigest()
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def test_algorithms_guaranteed(self):
|
|
|
c5b9d7 |
- self.assertEqual(hashlib.algorithms_guaranteed - FIPS_DISABLED,
|
|
|
c5b9d7 |
+ self.assertEqual(hashlib.algorithms_guaranteed,
|
|
|
c5b9d7 |
set(_algo for _algo in self.supported_hash_names
|
|
|
c5b9d7 |
if _algo.islower()))
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
@@ -326,10 +337,9 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
self.assertIn(h.name, self.supported_hash_names)
|
|
|
c5b9d7 |
else:
|
|
|
c5b9d7 |
self.assertNotIn(h.name, self.supported_hash_names)
|
|
|
c5b9d7 |
- self.assertEqual(
|
|
|
c5b9d7 |
- h.name,
|
|
|
c5b9d7 |
- hashlib.new(h.name, usedforsecurity=False).name
|
|
|
c5b9d7 |
- )
|
|
|
c5b9d7 |
+ if h.name not in FIPS_DISABLED:
|
|
|
c5b9d7 |
+ self.assertEqual(h.name, hashlib.new(h.name).name)
|
|
|
c5b9d7 |
+ self.assertEqual(h.name, hashlib.new(h.name, usedforsecurity=False).name)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def test_large_update(self):
|
|
|
c5b9d7 |
aas = b'a' * 128
|
|
|
c5b9d7 |
@@ -371,9 +381,11 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
self.assertGreaterEqual(len(constructors), 2)
|
|
|
c5b9d7 |
for hash_object_constructor in constructors:
|
|
|
c5b9d7 |
if (
|
|
|
c5b9d7 |
- kwargs
|
|
|
c5b9d7 |
- and hash_object_constructor.__name__.startswith('openssl_')
|
|
|
c5b9d7 |
+ (kwargs.keys() - {'usedforsecurity'})
|
|
|
c5b9d7 |
+ and _is_openssl_constructor(hash_object_constructor)
|
|
|
c5b9d7 |
):
|
|
|
c5b9d7 |
+ # Don't check openssl constructors with
|
|
|
c5b9d7 |
+ # any extra keys (except usedforsecurity)
|
|
|
c5b9d7 |
return
|
|
|
c5b9d7 |
m = hash_object_constructor(data, **kwargs)
|
|
|
c5b9d7 |
computed = m.hexdigest() if not shake else m.hexdigest(length)
|
|
|
c5b9d7 |
@@ -481,21 +493,18 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
self.check_blocksize_name('blake2b', 128, 64)
|
|
|
c5b9d7 |
self.check_blocksize_name('blake2s', 64, 32)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- @unittest.skipIf(hashlib.get_fips_mode(), "md5 unacceptable in FIPS mode")
|
|
|
c5b9d7 |
def test_case_md5_0(self):
|
|
|
c5b9d7 |
self.check(
|
|
|
c5b9d7 |
'md5', b'', 'd41d8cd98f00b204e9800998ecf8427e',
|
|
|
c5b9d7 |
usedforsecurity=False
|
|
|
c5b9d7 |
)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- @unittest.skipIf(hashlib.get_fips_mode(), "md5 unacceptable in FIPS mode")
|
|
|
c5b9d7 |
def test_case_md5_1(self):
|
|
|
c5b9d7 |
self.check(
|
|
|
c5b9d7 |
'md5', b'abc', '900150983cd24fb0d6963f7d28e17f72',
|
|
|
c5b9d7 |
usedforsecurity=False
|
|
|
c5b9d7 |
)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- @unittest.skipIf(hashlib.get_fips_mode(), "md5 unacceptable in FIPS mode")
|
|
|
c5b9d7 |
def test_case_md5_2(self):
|
|
|
c5b9d7 |
self.check(
|
|
|
c5b9d7 |
'md5',
|
|
|
c5b9d7 |
@@ -507,12 +516,12 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
@unittest.skipIf(sys.maxsize < _4G + 5, 'test cannot run on 32-bit systems')
|
|
|
c5b9d7 |
@bigmemtest(size=_4G + 5, memuse=1, dry_run=False)
|
|
|
c5b9d7 |
def test_case_md5_huge(self, size):
|
|
|
c5b9d7 |
- self.check('md5', b'A'*size, 'c9af2dff37468ce5dfee8f2cfc0a9c6d')
|
|
|
c5b9d7 |
+ self.check('md5', b'A'*size, 'c9af2dff37468ce5dfee8f2cfc0a9c6d', usedforsecurity=False)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
@unittest.skipIf(sys.maxsize < _4G - 1, 'test cannot run on 32-bit systems')
|
|
|
c5b9d7 |
@bigmemtest(size=_4G - 1, memuse=1, dry_run=False)
|
|
|
c5b9d7 |
def test_case_md5_uintmax(self, size):
|
|
|
c5b9d7 |
- self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3')
|
|
|
c5b9d7 |
+ self.check('md5', b'A'*size, '28138d306ff1b8281f1a9067e1a1a2b3', usedforsecurity=False)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
# use the three examples from Federal Information Processing Standards
|
|
|
c5b9d7 |
# Publication 180-1, Secure Hash Standard, 1995 April 17
|
|
|
c5b9d7 |
@@ -958,6 +967,15 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
):
|
|
|
c5b9d7 |
HASHXOF()
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ @unittest.skipUnless(hashlib.get_fips_mode(), 'Needs FIPS mode.')
|
|
|
c5b9d7 |
+ def test_usedforsecurity_repeat(self):
|
|
|
c5b9d7 |
+ """Make sure usedforsecurity flag isn't copied to other contexts"""
|
|
|
c5b9d7 |
+ for i in range(3):
|
|
|
c5b9d7 |
+ for cons in hashlib.md5, partial(hashlib.new, 'md5'):
|
|
|
c5b9d7 |
+ self.assertRaises(ValueError, cons)
|
|
|
c5b9d7 |
+ self.assertRaises(ValueError, partial(cons, usedforsecurity=True))
|
|
|
c5b9d7 |
+ self.assertEqual(cons(usedforsecurity=False).hexdigest(),
|
|
|
c5b9d7 |
+ 'd41d8cd98f00b204e9800998ecf8427e')
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
class KDFTests(unittest.TestCase):
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
From 5feafbf68d297e3f4fcafe4cbeff97817c592c53 Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Petr Viktorin <pviktori@redhat.com>
|
|
|
c5b9d7 |
Date: Mon, 26 Aug 2019 19:39:48 +0200
|
|
|
c5b9d7 |
Subject: [PATCH 10/13] Don't re-export get_fips_mode from hashlib
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1745685
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Lib/hashlib.py | 22 +++++++++-------------
|
|
|
c5b9d7 |
Lib/hmac.py | 6 +++---
|
|
|
c5b9d7 |
Lib/test/test_fips.py | 4 ++--
|
|
|
c5b9d7 |
Lib/test/test_hashlib.py | 16 +++++++++-------
|
|
|
c5b9d7 |
Lib/test/test_hmac.py | 9 +++++----
|
|
|
c5b9d7 |
Lib/test/test_urllib2_localnet.py | 1 +
|
|
|
c5b9d7 |
6 files changed, 29 insertions(+), 29 deletions(-)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/hashlib.py b/Lib/hashlib.py
|
|
|
c5b9d7 |
index 1fd80c7d4fd..6121d251267 100644
|
|
|
c5b9d7 |
--- a/Lib/hashlib.py
|
|
|
c5b9d7 |
+++ b/Lib/hashlib.py
|
|
|
c5b9d7 |
@@ -53,6 +53,8 @@ More condensed:
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
"""
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+import _hashlib
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
# This tuple and __get_builtin_constructor() must be modified if a new
|
|
|
c5b9d7 |
# always available algorithm is added.
|
|
|
c5b9d7 |
__always_supported = ('md5', 'sha1', 'sha224', 'sha256', 'sha384', 'sha512',
|
|
|
c5b9d7 |
@@ -77,13 +79,7 @@ __block_openssl_constructor = {
|
|
|
c5b9d7 |
'blake2b', 'blake2s',
|
|
|
c5b9d7 |
}
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
-try:
|
|
|
c5b9d7 |
- from _hashlib import get_fips_mode
|
|
|
c5b9d7 |
-except ImportError:
|
|
|
c5b9d7 |
- def get_fips_mode():
|
|
|
c5b9d7 |
- return 0
|
|
|
c5b9d7 |
-
|
|
|
c5b9d7 |
-if not get_fips_mode():
|
|
|
c5b9d7 |
+if not _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
__builtin_constructor_cache = {}
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def __get_builtin_constructor(name):
|
|
|
c5b9d7 |
@@ -131,7 +127,7 @@ if not get_fips_mode():
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def __get_openssl_constructor(name):
|
|
|
c5b9d7 |
- if not get_fips_mode():
|
|
|
c5b9d7 |
+ if not _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
if name in __block_openssl_constructor:
|
|
|
c5b9d7 |
# Prefer our builtin blake2 implementation.
|
|
|
c5b9d7 |
return __get_builtin_constructor(name)
|
|
|
c5b9d7 |
@@ -149,7 +145,7 @@ def __get_openssl_constructor(name):
|
|
|
c5b9d7 |
return __get_builtin_constructor(name)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
-if not get_fips_mode():
|
|
|
c5b9d7 |
+if not _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
def __py_new(name, data=b'', **kwargs):
|
|
|
c5b9d7 |
"""new(name, data=b'', **kwargs) - Return a new hashing object using the
|
|
|
c5b9d7 |
named algorithm; optionally initialized with data (which must be
|
|
|
c5b9d7 |
@@ -162,7 +158,7 @@ def __hash_new(name, data=b'', **kwargs):
|
|
|
c5b9d7 |
"""new(name, data=b'') - Return a new hashing object using the named algorithm;
|
|
|
c5b9d7 |
optionally initialized with data (which must be a bytes-like object).
|
|
|
c5b9d7 |
"""
|
|
|
c5b9d7 |
- if not get_fips_mode():
|
|
|
c5b9d7 |
+ if not _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
if name in __block_openssl_constructor:
|
|
|
c5b9d7 |
# Prefer our builtin blake2 implementation.
|
|
|
c5b9d7 |
return __get_builtin_constructor(name)(data, **kwargs)
|
|
|
c5b9d7 |
@@ -173,7 +169,7 @@ def __hash_new(name, data=b'', **kwargs):
|
|
|
c5b9d7 |
# hash, try using our builtin implementations.
|
|
|
c5b9d7 |
# This allows for SHA224/256 and SHA384/512 support even though
|
|
|
c5b9d7 |
# the OpenSSL library prior to 0.9.8 doesn't provide them.
|
|
|
c5b9d7 |
- if get_fips_mode():
|
|
|
c5b9d7 |
+ if _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
raise
|
|
|
c5b9d7 |
return __get_builtin_constructor(name)(data)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
@@ -185,7 +181,7 @@ try:
|
|
|
c5b9d7 |
algorithms_available = algorithms_available.union(
|
|
|
c5b9d7 |
_hashlib.openssl_md_meth_names)
|
|
|
c5b9d7 |
except ImportError:
|
|
|
c5b9d7 |
- if get_fips_mode:
|
|
|
c5b9d7 |
+ if _hashlib.get_fips_mode:
|
|
|
c5b9d7 |
raise
|
|
|
c5b9d7 |
new = __py_new
|
|
|
c5b9d7 |
__get_hash = __get_builtin_constructor
|
|
|
c5b9d7 |
@@ -214,5 +210,5 @@ for __func_name in __always_supported:
|
|
|
c5b9d7 |
# Cleanup locals()
|
|
|
c5b9d7 |
del __always_supported, __func_name, __get_hash
|
|
|
c5b9d7 |
del __hash_new, __get_openssl_constructor
|
|
|
c5b9d7 |
-if not get_fips_mode():
|
|
|
c5b9d7 |
+if not _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
del __py_new
|
|
|
c5b9d7 |
diff --git a/Lib/hmac.py b/Lib/hmac.py
|
|
|
c5b9d7 |
index 482e443bfe4..ff466322d7b 100644
|
|
|
c5b9d7 |
--- a/Lib/hmac.py
|
|
|
c5b9d7 |
+++ b/Lib/hmac.py
|
|
|
c5b9d7 |
@@ -50,7 +50,7 @@ class HMAC:
|
|
|
c5b9d7 |
msg argument. Passing it as a keyword argument is
|
|
|
c5b9d7 |
recommended, though not required for legacy API reasons.
|
|
|
c5b9d7 |
"""
|
|
|
c5b9d7 |
- if _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+ if _hashlibopenssl.get_fips_mode():
|
|
|
c5b9d7 |
raise ValueError(
|
|
|
c5b9d7 |
'This class is not available in FIPS mode. '
|
|
|
c5b9d7 |
+ 'Use hmac.new().'
|
|
|
c5b9d7 |
@@ -117,7 +117,7 @@ class HMAC:
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def update(self, msg):
|
|
|
c5b9d7 |
"""Feed data from msg into this hashing object."""
|
|
|
c5b9d7 |
- if _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+ if _hashlibopenssl.get_fips_mode():
|
|
|
c5b9d7 |
raise ValueError('hmac.HMAC is not available in FIPS mode')
|
|
|
c5b9d7 |
self._inner.update(msg)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
@@ -183,7 +183,7 @@ class HMAC_openssl(_hmacopenssl.HMAC):
|
|
|
c5b9d7 |
return result
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
-if _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+if _hashlibopenssl.get_fips_mode():
|
|
|
c5b9d7 |
HMAC = HMAC_openssl
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/test/test_fips.py b/Lib/test/test_fips.py
|
|
|
c5b9d7 |
index fe4ea72296e..6b50f8b45d4 100644
|
|
|
c5b9d7 |
--- a/Lib/test/test_fips.py
|
|
|
c5b9d7 |
+++ b/Lib/test/test_fips.py
|
|
|
c5b9d7 |
@@ -6,7 +6,7 @@ import hashlib, _hashlib
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
class HashlibFipsTests(unittest.TestCase):
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- @unittest.skipUnless(hashlib.get_fips_mode(), "Test only when FIPS is enabled")
|
|
|
c5b9d7 |
+ @unittest.skipUnless(_hashlib.get_fips_mode(), "Test only when FIPS is enabled")
|
|
|
c5b9d7 |
def test_fips_imports(self):
|
|
|
c5b9d7 |
"""blake2s and blake2b should fail to import in FIPS mode
|
|
|
c5b9d7 |
"""
|
|
|
c5b9d7 |
@@ -15,7 +15,7 @@ class HashlibFipsTests(unittest.TestCase):
|
|
|
c5b9d7 |
with self.assertRaises(ValueError, msg='blake2b not available in FIPS'):
|
|
|
c5b9d7 |
m = hashlib.blake2b()
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- @unittest.skipIf(hashlib.get_fips_mode(), "blake2 hashes are not available under FIPS")
|
|
|
c5b9d7 |
+ @unittest.skipIf(_hashlib.get_fips_mode(), "blake2 hashes are not available under FIPS")
|
|
|
c5b9d7 |
def test_blake2_hashes(self):
|
|
|
c5b9d7 |
self.assertEqual(hashlib.blake2b(b'abc').hexdigest(), _hashlib.openssl_blake2b(b'abc').hexdigest())
|
|
|
c5b9d7 |
self.assertEqual(hashlib.blake2s(b'abc').hexdigest(), _hashlib.openssl_blake2s(b'abc').hexdigest())
|
|
|
c5b9d7 |
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
index f306ba33b20..03cfb6b2fb4 100644
|
|
|
c5b9d7 |
--- a/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
+++ b/Lib/test/test_hashlib.py
|
|
|
c5b9d7 |
@@ -46,7 +46,9 @@ else:
|
|
|
c5b9d7 |
builtin_hashlib = None
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
-if hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+from _hashlib import get_fips_mode as _get_fips_mode
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+if _get_fips_mode():
|
|
|
c5b9d7 |
FIPS_UNAVAILABLE = {'blake2b', 'blake2s'}
|
|
|
c5b9d7 |
FIPS_DISABLED = {'md5', 'MD5', *FIPS_UNAVAILABLE}
|
|
|
c5b9d7 |
else:
|
|
|
c5b9d7 |
@@ -132,7 +134,7 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
if self._warn_on_extension_import and module_name in builtin_hashes:
|
|
|
c5b9d7 |
warnings.warn('Did a C extension fail to compile? %s' % error)
|
|
|
c5b9d7 |
except ImportError as error:
|
|
|
c5b9d7 |
- if not hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+ if not _get_fips_mode():
|
|
|
c5b9d7 |
raise
|
|
|
c5b9d7 |
return None
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
@@ -271,12 +273,12 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
def test_new_upper_to_lower(self):
|
|
|
c5b9d7 |
self.assertEqual(hashlib.new("SHA256").name, "sha256")
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- @unittest.skipUnless(hashlib.get_fips_mode(), "Builtin constructor only unavailable in FIPS mode")
|
|
|
c5b9d7 |
+ @unittest.skipUnless(_get_fips_mode(), "Builtin constructor only unavailable in FIPS mode")
|
|
|
c5b9d7 |
def test_get_builtin_constructor_fips(self):
|
|
|
c5b9d7 |
with self.assertRaises(AttributeError):
|
|
|
c5b9d7 |
hashlib.__get_builtin_constructor
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- @unittest.skipIf(hashlib.get_fips_mode(), "No builtin constructors in FIPS mode")
|
|
|
c5b9d7 |
+ @unittest.skipIf(_get_fips_mode(), "No builtin constructors in FIPS mode")
|
|
|
c5b9d7 |
def test_get_builtin_constructor(self):
|
|
|
c5b9d7 |
get_builtin_constructor = getattr(hashlib,
|
|
|
c5b9d7 |
'__get_builtin_constructor')
|
|
|
c5b9d7 |
@@ -408,7 +410,7 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
self.assertRaises(TypeError, hash_object_constructor, 'spam')
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def test_no_unicode(self):
|
|
|
c5b9d7 |
- if not hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+ if not _get_fips_mode():
|
|
|
c5b9d7 |
self.check_no_unicode('md5')
|
|
|
c5b9d7 |
self.check_no_unicode('sha1')
|
|
|
c5b9d7 |
self.check_no_unicode('sha224')
|
|
|
c5b9d7 |
@@ -450,7 +452,7 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
self.assertIn(name.split("_")[0], repr(m))
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def test_blocksize_name(self):
|
|
|
c5b9d7 |
- if not hashlib.get_fips_mode():
|
|
|
c5b9d7 |
+ if not _get_fips_mode():
|
|
|
c5b9d7 |
self.check_blocksize_name('md5', 64, 16)
|
|
|
c5b9d7 |
self.check_blocksize_name('sha1', 64, 20)
|
|
|
c5b9d7 |
self.check_blocksize_name('sha224', 64, 28)
|
|
|
c5b9d7 |
@@ -967,7 +969,7 @@ class HashLibTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
):
|
|
|
c5b9d7 |
HASHXOF()
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- @unittest.skipUnless(hashlib.get_fips_mode(), 'Needs FIPS mode.')
|
|
|
c5b9d7 |
+ @unittest.skipUnless(_get_fips_mode(), 'Needs FIPS mode.')
|
|
|
c5b9d7 |
def test_usedforsecurity_repeat(self):
|
|
|
c5b9d7 |
"""Make sure usedforsecurity flag isn't copied to other contexts"""
|
|
|
c5b9d7 |
for i in range(3):
|
|
|
c5b9d7 |
diff --git a/Lib/test/test_hmac.py b/Lib/test/test_hmac.py
|
|
|
c5b9d7 |
index 544ec7cb411..2d4484911c2 100644
|
|
|
c5b9d7 |
--- a/Lib/test/test_hmac.py
|
|
|
c5b9d7 |
+++ b/Lib/test/test_hmac.py
|
|
|
c5b9d7 |
@@ -5,6 +5,7 @@ import hashlib
|
|
|
c5b9d7 |
import unittest
|
|
|
c5b9d7 |
import unittest.mock
|
|
|
c5b9d7 |
import warnings
|
|
|
c5b9d7 |
+from _hashlib import get_fips_mode
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
from test.support import hashlib_helper
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
@@ -322,7 +323,7 @@ class TestVectorsTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
def test_sha512_rfc4231(self):
|
|
|
c5b9d7 |
self._rfc4231_test_cases(hashlib.sha512, 'sha512', 64, 128)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- @unittest.skipIf(hashlib.get_fips_mode(), 'MockCrazyHash unacceptable in FIPS mode.')
|
|
|
c5b9d7 |
+ @unittest.skipIf(get_fips_mode(), 'MockCrazyHash unacceptable in FIPS mode.')
|
|
|
c5b9d7 |
@hashlib_helper.requires_hashdigest('sha256')
|
|
|
c5b9d7 |
def test_legacy_block_size_warnings(self):
|
|
|
c5b9d7 |
class MockCrazyHash(object):
|
|
|
c5b9d7 |
@@ -455,7 +456,7 @@ class SanityTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
class CopyTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- @unittest.skipIf(hashlib.get_fips_mode(), "Internal attributes unavailable in FIPS mode")
|
|
|
c5b9d7 |
+ @unittest.skipIf(get_fips_mode(), "Internal attributes unavailable in FIPS mode")
|
|
|
c5b9d7 |
@hashlib_helper.requires_hashdigest('sha256')
|
|
|
c5b9d7 |
def test_attributes(self):
|
|
|
c5b9d7 |
# Testing if attributes are of same type.
|
|
|
c5b9d7 |
@@ -469,7 +470,7 @@ class CopyTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
"Types of outer don't match.")
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- @unittest.skipIf(hashlib.get_fips_mode(), "Internal attributes unavailable in FIPS mode")
|
|
|
c5b9d7 |
+ @unittest.skipIf(get_fips_mode(), "Internal attributes unavailable in FIPS mode")
|
|
|
c5b9d7 |
@hashlib_helper.requires_hashdigest('sha256')
|
|
|
c5b9d7 |
def test_realcopy(self):
|
|
|
c5b9d7 |
# Testing if the copy method created a real copy.
|
|
|
c5b9d7 |
@@ -485,7 +486,7 @@ class CopyTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
self.assertEqual(h1._outer, h1.outer)
|
|
|
c5b9d7 |
self.assertEqual(h1._digest_cons, h1.digest_cons)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
- @unittest.skipIf(hashlib.get_fips_mode(), "Internal attributes unavailable in FIPS mode")
|
|
|
c5b9d7 |
+ @unittest.skipIf(get_fips_mode(), "Internal attributes unavailable in FIPS mode")
|
|
|
c5b9d7 |
@hashlib_helper.requires_hashdigest('sha256')
|
|
|
c5b9d7 |
def test_properties(self):
|
|
|
c5b9d7 |
# deprecated properties
|
|
|
c5b9d7 |
diff --git a/Lib/test/test_urllib2_localnet.py b/Lib/test/test_urllib2_localnet.py
|
|
|
c5b9d7 |
index ed426b05a71..faec6844f9a 100644
|
|
|
c5b9d7 |
--- a/Lib/test/test_urllib2_localnet.py
|
|
|
c5b9d7 |
+++ b/Lib/test/test_urllib2_localnet.py
|
|
|
c5b9d7 |
@@ -7,6 +7,7 @@ import http.server
|
|
|
c5b9d7 |
import threading
|
|
|
c5b9d7 |
import unittest
|
|
|
c5b9d7 |
import hashlib
|
|
|
c5b9d7 |
+from _hashlib import get_fips_mode
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
from test import support
|
|
|
c5b9d7 |
from test.support import hashlib_helper
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
From 3e314b647bc316dda3cef1f611fbac9170ed1030 Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Christian Heimes <christian@python.org>
|
|
|
c5b9d7 |
Date: Wed, 20 Nov 2019 10:59:25 +0100
|
|
|
c5b9d7 |
Subject: [PATCH 11/13] Use FIPS compliant CSPRNG
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
Kernel's getrandom() source is not yet FIPS compliant. Use OpenSSL's
|
|
|
c5b9d7 |
DRBG in FIPS mode and disable os.getrandom() function.
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
Signed-off-by: Christian Heimes <christian@python.org>
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Lib/test/test_os.py | 6 ++++++
|
|
|
c5b9d7 |
Makefile.pre.in | 2 +-
|
|
|
c5b9d7 |
Modules/posixmodule.c | 8 +++++++
|
|
|
c5b9d7 |
Python/bootstrap_hash.c | 48 +++++++++++++++++++++++++++++++++++++++++
|
|
|
c5b9d7 |
4 files changed, 63 insertions(+), 1 deletion(-)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/test/test_os.py b/Lib/test/test_os.py
|
|
|
c5b9d7 |
index bf1cb5f5112..d3b1d9c8969 100644
|
|
|
c5b9d7 |
--- a/Lib/test/test_os.py
|
|
|
c5b9d7 |
+++ b/Lib/test/test_os.py
|
|
|
c5b9d7 |
@@ -29,6 +29,7 @@ import types
|
|
|
c5b9d7 |
import unittest
|
|
|
c5b9d7 |
import uuid
|
|
|
c5b9d7 |
import warnings
|
|
|
c5b9d7 |
+from _hashlib import get_fips_mode
|
|
|
c5b9d7 |
from test import support
|
|
|
c5b9d7 |
from test.support import socket_helper
|
|
|
c5b9d7 |
from platform import win32_is_iot
|
|
|
c5b9d7 |
@@ -1661,6 +1662,11 @@ class GetRandomTests(unittest.TestCase):
|
|
|
c5b9d7 |
raise unittest.SkipTest("getrandom() syscall fails with ENOSYS")
|
|
|
c5b9d7 |
else:
|
|
|
c5b9d7 |
raise
|
|
|
c5b9d7 |
+ except ValueError as exc:
|
|
|
c5b9d7 |
+ if get_fips_mode() and exc.args[0] == "getrandom is not FIPS compliant":
|
|
|
c5b9d7 |
+ raise unittest.SkipTest("Skip in FIPS mode")
|
|
|
c5b9d7 |
+ else:
|
|
|
c5b9d7 |
+ raise
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
def test_getrandom_type(self):
|
|
|
c5b9d7 |
data = os.getrandom(16)
|
|
|
c5b9d7 |
diff --git a/Makefile.pre.in b/Makefile.pre.in
|
|
|
c5b9d7 |
index f128444b985..3ea348a5461 100644
|
|
|
c5b9d7 |
--- a/Makefile.pre.in
|
|
|
c5b9d7 |
+++ b/Makefile.pre.in
|
|
|
c5b9d7 |
@@ -116,7 +116,7 @@ PY_STDMODULE_CFLAGS= $(PY_CFLAGS) $(PY_CFLAGS_NODIST) $(PY_CPPFLAGS) $(CFLAGSFOR
|
|
|
c5b9d7 |
PY_BUILTIN_MODULE_CFLAGS= $(PY_STDMODULE_CFLAGS) -DPy_BUILD_CORE_BUILTIN
|
|
|
c5b9d7 |
PY_CORE_CFLAGS= $(PY_STDMODULE_CFLAGS) -DPy_BUILD_CORE
|
|
|
c5b9d7 |
# Linker flags used for building the interpreter object files
|
|
|
c5b9d7 |
-PY_CORE_LDFLAGS=$(PY_LDFLAGS) $(PY_LDFLAGS_NODIST)
|
|
|
c5b9d7 |
+PY_CORE_LDFLAGS=$(PY_LDFLAGS) $(PY_LDFLAGS_NODIST) -lcrypto
|
|
|
c5b9d7 |
# Strict or non-strict aliasing flags used to compile dtoa.c, see above
|
|
|
c5b9d7 |
CFLAGS_ALIASING=@CFLAGS_ALIASING@
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Modules/posixmodule.c b/Modules/posixmodule.c
|
|
|
c5b9d7 |
index 12f72f525f7..d244d264d8a 100644
|
|
|
c5b9d7 |
--- a/Modules/posixmodule.c
|
|
|
c5b9d7 |
+++ b/Modules/posixmodule.c
|
|
|
c5b9d7 |
@@ -495,6 +495,9 @@ extern char *ctermid_r(char *);
|
|
|
c5b9d7 |
# define MODNAME "posix"
|
|
|
c5b9d7 |
#endif
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+/* for FIPS check in os.getrandom() */
|
|
|
c5b9d7 |
+#include <openssl/crypto.h>
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
#if defined(__sun)
|
|
|
c5b9d7 |
/* Something to implement in autoconf, not present in autoconf 2.69 */
|
|
|
c5b9d7 |
# define HAVE_STRUCT_STAT_ST_FSTYPE 1
|
|
|
c5b9d7 |
@@ -14171,6 +14174,11 @@ os_getrandom_impl(PyObject *module, Py_ssize_t size, int flags)
|
|
|
c5b9d7 |
return posix_error();
|
|
|
c5b9d7 |
}
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ if (FIPS_mode()) {
|
|
|
c5b9d7 |
+ PyErr_SetString(PyExc_ValueError, "getrandom is not FIPS compliant");
|
|
|
c5b9d7 |
+ return NULL;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
bytes = PyBytes_FromStringAndSize(NULL, size);
|
|
|
c5b9d7 |
if (bytes == NULL) {
|
|
|
c5b9d7 |
PyErr_NoMemory();
|
|
|
c5b9d7 |
diff --git a/Python/bootstrap_hash.c b/Python/bootstrap_hash.c
|
|
|
c5b9d7 |
index a212f69870e..6333cd446dc 100644
|
|
|
c5b9d7 |
--- a/Python/bootstrap_hash.c
|
|
|
c5b9d7 |
+++ b/Python/bootstrap_hash.c
|
|
|
c5b9d7 |
@@ -429,6 +429,50 @@ dev_urandom_close(void)
|
|
|
c5b9d7 |
}
|
|
|
c5b9d7 |
#endif /* !MS_WINDOWS */
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+#include <openssl/rand.h>
|
|
|
c5b9d7 |
+#include <_hashopenssl.h>
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+#if (OPENSSL_VERSION_NUMBER < 0x10101000L) || defined(LIBRESSL_VERSION_NUMBER)
|
|
|
c5b9d7 |
+# error "py_openssl_drbg_urandom requires OpenSSL 1.1.1 for fork safety"
|
|
|
c5b9d7 |
+#endif
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+static int
|
|
|
c5b9d7 |
+py_openssl_drbg_urandom(char *buffer, Py_ssize_t size, int raise)
|
|
|
c5b9d7 |
+{
|
|
|
c5b9d7 |
+ int res;
|
|
|
c5b9d7 |
+ static int init = 0;
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ if (!init) {
|
|
|
c5b9d7 |
+ init = 1;
|
|
|
c5b9d7 |
+ res = OPENSSL_init_crypto(OPENSSL_INIT_ATFORK, NULL);
|
|
|
c5b9d7 |
+ if (res == 0) {
|
|
|
c5b9d7 |
+ if (raise) {
|
|
|
c5b9d7 |
+ _setException(PyExc_RuntimeError);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ return 0;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ if (size > INT_MAX) {
|
|
|
c5b9d7 |
+ if (raise) {
|
|
|
c5b9d7 |
+ PyErr_Format(PyExc_OverflowError,
|
|
|
c5b9d7 |
+ "RAND_bytes() size is limited to 2GB.");
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ return -1;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ res = RAND_bytes((unsigned char*)buffer, (int)size);
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
+ if (res == 1) {
|
|
|
c5b9d7 |
+ return 1;
|
|
|
c5b9d7 |
+ } else {
|
|
|
c5b9d7 |
+ if (raise) {
|
|
|
c5b9d7 |
+ _setException(PyExc_RuntimeError);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+ return 0;
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+}
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
/* Fill buffer with pseudo-random bytes generated by a linear congruent
|
|
|
c5b9d7 |
generator (LCG):
|
|
|
c5b9d7 |
@@ -513,6 +557,10 @@ pyurandom(void *buffer, Py_ssize_t size, int blocking, int raise)
|
|
|
c5b9d7 |
return 0;
|
|
|
c5b9d7 |
}
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ if (FIPS_mode()) {
|
|
|
c5b9d7 |
+ return py_openssl_drbg_urandom(buffer, size, raise);
|
|
|
c5b9d7 |
+ }
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
#ifdef MS_WINDOWS
|
|
|
c5b9d7 |
return win32_urandom((unsigned char *)buffer, size, raise);
|
|
|
c5b9d7 |
#else
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
From 16b9a981697b94c348fdc0d73d2d12e12b1b4227 Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Petr Viktorin <pviktori@redhat.com>
|
|
|
c5b9d7 |
Date: Tue, 7 Apr 2020 15:16:45 +0200
|
|
|
c5b9d7 |
Subject: [PATCH 12/13] Pass kwargs (like usedforsecurity) through __hash_new
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Lib/hashlib.py | 2 +-
|
|
|
c5b9d7 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/hashlib.py b/Lib/hashlib.py
|
|
|
c5b9d7 |
index 6121d251267..00794adffc1 100644
|
|
|
c5b9d7 |
--- a/Lib/hashlib.py
|
|
|
c5b9d7 |
+++ b/Lib/hashlib.py
|
|
|
c5b9d7 |
@@ -171,7 +171,7 @@ def __hash_new(name, data=b'', **kwargs):
|
|
|
c5b9d7 |
# the OpenSSL library prior to 0.9.8 doesn't provide them.
|
|
|
c5b9d7 |
if _hashlib.get_fips_mode():
|
|
|
c5b9d7 |
raise
|
|
|
c5b9d7 |
- return __get_builtin_constructor(name)(data)
|
|
|
c5b9d7 |
+ return __get_builtin_constructor(name)(data, **kwargs)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
try:
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
From 48fb6366a0fcb95c8565be35495b25a23dc03896 Mon Sep 17 00:00:00 2001
|
|
|
c5b9d7 |
From: Charalampos Stratakis <cstratak@redhat.com>
|
|
|
c5b9d7 |
Date: Fri, 24 Apr 2020 19:57:16 +0200
|
|
|
c5b9d7 |
Subject: [PATCH 13/13] Skip the test_with_digestmod_no_default under FIPS
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
Also add a new test for testing the error values of
|
|
|
c5b9d7 |
the digestmod parameter misuse under FIPS mode.
|
|
|
c5b9d7 |
---
|
|
|
c5b9d7 |
Lib/test/test_hmac.py | 13 +++++++++++++
|
|
|
c5b9d7 |
1 file changed, 13 insertions(+)
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
diff --git a/Lib/test/test_hmac.py b/Lib/test/test_hmac.py
|
|
|
c5b9d7 |
index 2d4484911c2..e0a5b6a053b 100644
|
|
|
c5b9d7 |
--- a/Lib/test/test_hmac.py
|
|
|
c5b9d7 |
+++ b/Lib/test/test_hmac.py
|
|
|
c5b9d7 |
@@ -347,6 +347,7 @@ class TestVectorsTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
hmac.HMAC(b'a', b'b', digestmod=MockCrazyHash)
|
|
|
c5b9d7 |
self.fail('Expected warning about small block_size')
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ @unittest.skipIf(get_fips_mode(), "digestmod misuse raises different errors under FIPS mode")
|
|
|
c5b9d7 |
def test_with_digestmod_no_default(self):
|
|
|
c5b9d7 |
"""The digestmod parameter is required as of Python 3.8."""
|
|
|
c5b9d7 |
with self.assertRaisesRegex(TypeError, r'required.*digestmod'):
|
|
|
c5b9d7 |
@@ -358,6 +359,18 @@ class TestVectorsTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
with self.assertRaisesRegex(TypeError, r'required.*digestmod'):
|
|
|
c5b9d7 |
hmac.HMAC(key, msg=data, digestmod='')
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
+ @unittest.skipIf(not get_fips_mode(), "test is run only under FIPS mode")
|
|
|
c5b9d7 |
+ def test_with_digestmod_no_default_under_fips(self):
|
|
|
c5b9d7 |
+ """Test the error values of digestmod misuse under FIPS mode."""
|
|
|
c5b9d7 |
+ with self.assertRaises(TypeError):
|
|
|
c5b9d7 |
+ key = b"\x0b" * 16
|
|
|
c5b9d7 |
+ data = b"Hi There"
|
|
|
c5b9d7 |
+ hmac.HMAC(key, data, digestmod=None)
|
|
|
c5b9d7 |
+ with self.assertRaises(ValueError):
|
|
|
c5b9d7 |
+ hmac.new(key, data)
|
|
|
c5b9d7 |
+ with self.assertRaises(ValueError):
|
|
|
c5b9d7 |
+ hmac.HMAC(key, msg=data, digestmod='')
|
|
|
c5b9d7 |
+
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
class ConstructorTestCase(unittest.TestCase):
|
|
|
c5b9d7 |
|
|
|
c5b9d7 |
--
|
|
|
c5b9d7 |
2.26.2
|
|
|
c5b9d7 |
|