|
|
|
@ -1,82 +1,48 @@ |
|
|
|
diff -up Python-2.7.2/Lib/hashlib.py.hashlib-fips Python-2.7.2/Lib/hashlib.py |
|
|
|
diff --git a/Lib/hashlib.py b/Lib/hashlib.py |
|
|
|
--- Python-2.7.2/Lib/hashlib.py.hashlib-fips 2011-06-11 11:46:24.000000000 -0400 |
|
|
|
index 316cece..b7ad879 100644 |
|
|
|
+++ Python-2.7.2/Lib/hashlib.py 2011-09-14 00:21:26.194252001 -0400 |
|
|
|
--- a/Lib/hashlib.py |
|
|
|
@@ -6,9 +6,12 @@ |
|
|
|
+++ b/Lib/hashlib.py |
|
|
|
|
|
|
|
@@ -23,6 +23,16 @@ the zlib module. |
|
|
|
__doc__ = """hashlib module - A common interface to many hash functions. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
-new(name, string='') - returns a new hash object implementing the |
|
|
|
|
|
|
|
- given hash function; initializing the hash |
|
|
|
|
|
|
|
- using the given string data. |
|
|
|
|
|
|
|
+new(name, string='', usedforsecurity=True) |
|
|
|
|
|
|
|
+ - returns a new hash object implementing the given hash function; |
|
|
|
|
|
|
|
+ initializing the hash using the given string data. |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
+ "usedforsecurity" is a non-standard extension for better supporting |
|
|
|
|
|
|
|
+ FIPS-compliant environments (see below) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Named constructor functions are also available, these are much faster |
|
|
|
|
|
|
|
than using new(): |
|
|
|
|
|
|
|
@@ -24,6 +27,20 @@ the zlib module. |
|
|
|
|
|
|
|
Choose your hash function wisely. Some have known collision weaknesses. |
|
|
|
Choose your hash function wisely. Some have known collision weaknesses. |
|
|
|
sha384 and sha512 will be slow on 32 bit platforms. |
|
|
|
sha384 and sha512 will be slow on 32 bit platforms. |
|
|
|
|
|
|
|
|
|
|
|
+Our implementation of hashlib uses OpenSSL. |
|
|
|
+If the underlying implementation supports "FIPS mode", and this is enabled, it |
|
|
|
+ |
|
|
|
+may restrict the available hashes to only those that are compliant with FIPS |
|
|
|
+OpenSSL has a "FIPS mode", which, if enabled, may restrict the available hashes |
|
|
|
+regulations. For example, it may deny the use of MD5, on the grounds that this |
|
|
|
+to only those that are compliant with FIPS regulations. For example, it may |
|
|
|
+is not secure for uses such as authentication, system integrity checking, or |
|
|
|
+deny the use of MD5, on the grounds that this is not secure for uses such as |
|
|
|
+digital signatures. If you need to use such a hash for non-security purposes |
|
|
|
+authentication, system integrity checking, or digital signatures. |
|
|
|
+(such as indexing into a data structure for speed), you can override the keyword |
|
|
|
+ |
|
|
|
+argument "usedforsecurity" from True to False to signify that your code is not |
|
|
|
+If you need to use such a hash for non-security purposes (such as indexing into |
|
|
|
+relying on the hash for security purposes, and this will allow the hash to be |
|
|
|
+a data structure for speed), you can override the keyword argument |
|
|
|
+usable even in FIPS mode. |
|
|
|
+"usedforsecurity" from True to False to signify that your code is not relying |
|
|
|
|
|
|
|
+on the hash for security purposes, and this will allow the hash to be usable |
|
|
|
|
|
|
|
+even in FIPS mode. This is not a standard feature of Python 2.7's hashlib, and |
|
|
|
|
|
|
|
+is included here to better support FIPS mode. |
|
|
|
|
|
|
|
+ |
|
|
|
+ |
|
|
|
Hash objects have these methods: |
|
|
|
Hash objects have these methods: |
|
|
|
- update(arg): Update the hash object with the string arg. Repeated calls |
|
|
|
- update(arg): Update the hash object with the bytes in arg. Repeated calls |
|
|
|
are equivalent to a single call with the concatenation of all |
|
|
|
are equivalent to a single call with the concatenation of all |
|
|
|
@@ -63,74 +80,39 @@ algorithms = __always_supported |
|
|
|
@@ -62,6 +72,18 @@ algorithms_available = set(__always_supported) |
|
|
|
__all__ = __always_supported + ('new', 'algorithms') |
|
|
|
__all__ = __always_supported + ('new', 'algorithms_guaranteed', |
|
|
|
|
|
|
|
'algorithms_available', 'pbkdf2_hmac') |
|
|
|
|
|
|
|
|
|
|
|
-def __get_builtin_constructor(name): |
|
|
|
+import functools |
|
|
|
- try: |
|
|
|
+def __ignore_usedforsecurity(func): |
|
|
|
- if name in ('SHA1', 'sha1'): |
|
|
|
+ """Used for sha3_* functions. Until OpenSSL implements them, we want |
|
|
|
- import _sha |
|
|
|
+ to use them from Python _sha3 module, but we want them to accept |
|
|
|
- return _sha.new |
|
|
|
+ usedforsecurity argument too.""" |
|
|
|
- elif name in ('MD5', 'md5'): |
|
|
|
+ # TODO: remove this function when OpenSSL implements sha3 |
|
|
|
- import _md5 |
|
|
|
+ @functools.wraps(func) |
|
|
|
- return _md5.new |
|
|
|
+ def inner(*args, **kwargs): |
|
|
|
- elif name in ('SHA256', 'sha256', 'SHA224', 'sha224'): |
|
|
|
+ if 'usedforsecurity' in kwargs: |
|
|
|
- import _sha256 |
|
|
|
+ kwargs.pop('usedforsecurity') |
|
|
|
- bs = name[3:] |
|
|
|
+ return func(*args, **kwargs) |
|
|
|
- if bs == '256': |
|
|
|
+ return inner |
|
|
|
- return _sha256.sha256 |
|
|
|
|
|
|
|
- elif bs == '224': |
|
|
|
__builtin_constructor_cache = {} |
|
|
|
- return _sha256.sha224 |
|
|
|
|
|
|
|
- elif name in ('SHA512', 'sha512', 'SHA384', 'sha384'): |
|
|
|
@@ -100,31 +122,39 @@ def __get_openssl_constructor(name): |
|
|
|
- import _sha512 |
|
|
|
|
|
|
|
- bs = name[3:] |
|
|
|
|
|
|
|
- if bs == '512': |
|
|
|
|
|
|
|
- return _sha512.sha512 |
|
|
|
|
|
|
|
- elif bs == '384': |
|
|
|
|
|
|
|
- return _sha512.sha384 |
|
|
|
|
|
|
|
- except ImportError: |
|
|
|
|
|
|
|
- pass # no extension module, this hash is unsupported. |
|
|
|
|
|
|
|
- |
|
|
|
|
|
|
|
- raise ValueError('unsupported hash type ' + name) |
|
|
|
|
|
|
|
- |
|
|
|
|
|
|
|
- |
|
|
|
|
|
|
|
def __get_openssl_constructor(name): |
|
|
|
|
|
|
|
try: |
|
|
|
|
|
|
|
f = getattr(_hashlib, 'openssl_' + name) |
|
|
|
f = getattr(_hashlib, 'openssl_' + name) |
|
|
|
# Allow the C module to raise ValueError. The function will be |
|
|
|
# Allow the C module to raise ValueError. The function will be |
|
|
|
# defined but the hash not actually available thanks to OpenSSL. |
|
|
|
# defined but the hash not actually available thanks to OpenSSL. |
|
|
|
- f() |
|
|
|
- f() |
|
|
|
+ # |
|
|
|
|
|
|
|
+ # We pass "usedforsecurity=False" to disable FIPS-based restrictions: |
|
|
|
+ # We pass "usedforsecurity=False" to disable FIPS-based restrictions: |
|
|
|
+ # at this stage we're merely seeing if the function is callable, |
|
|
|
+ # at this stage we're merely seeing if the function is callable, |
|
|
|
+ # rather than using it for actual work. |
|
|
|
+ # rather than using it for actual work. |
|
|
|
@ -84,61 +50,76 @@ diff -up Python-2.7.2/Lib/hashlib.py.hashlib-fips Python-2.7.2/Lib/hashlib.py |
|
|
|
# Use the C function directly (very fast) |
|
|
|
# Use the C function directly (very fast) |
|
|
|
return f |
|
|
|
return f |
|
|
|
except (AttributeError, ValueError): |
|
|
|
except (AttributeError, ValueError): |
|
|
|
- return __get_builtin_constructor(name) |
|
|
|
+ # TODO: We want to just raise here when OpenSSL implements sha3 |
|
|
|
+ raise |
|
|
|
+ # because we want to make sure that Fedora uses everything from OpenSSL |
|
|
|
|
|
|
|
return __get_builtin_constructor(name) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
-def __py_new(name, data=b''): |
|
|
|
|
|
|
|
- """new(name, data=b'') - Return a new hashing object using the named algorithm; |
|
|
|
|
|
|
|
- optionally initialized with data (which must be bytes). |
|
|
|
|
|
|
|
+def __py_new(name, data=b'', usedforsecurity=True): |
|
|
|
|
|
|
|
+ """new(name, data=b'', usedforsecurity=True) - Return a new hashing object using |
|
|
|
|
|
|
|
+ the named algorithm; optionally initialized with data (which must be bytes). |
|
|
|
|
|
|
|
+ The 'usedforsecurity' keyword argument does nothing, and is for compatibilty |
|
|
|
|
|
|
|
+ with the OpenSSL implementation |
|
|
|
|
|
|
|
""" |
|
|
|
|
|
|
|
return __get_builtin_constructor(name)(data) |
|
|
|
|
|
|
|
|
|
|
|
- |
|
|
|
|
|
|
|
-def __py_new(name, string=''): |
|
|
|
-def __hash_new(name, data=b''): |
|
|
|
- """new(name, string='') - Return a new hashing object using the named algorithm; |
|
|
|
- """new(name, data=b'') - Return a new hashing object using the named algorithm; |
|
|
|
- optionally initialized with a string. |
|
|
|
- optionally initialized with data (which must be bytes). |
|
|
|
- """ |
|
|
|
+def __hash_new(name, data=b'', usedforsecurity=True): |
|
|
|
- return __get_builtin_constructor(name)(string) |
|
|
|
+ """new(name, data=b'', usedforsecurity=True) - Return a new hashing object using |
|
|
|
- |
|
|
|
+ the named algorithm; optionally initialized with data (which must be bytes). |
|
|
|
- |
|
|
|
+ |
|
|
|
-def __hash_new(name, string=''): |
|
|
|
|
|
|
|
+def __hash_new(name, string='', usedforsecurity=True): |
|
|
|
|
|
|
|
"""new(name, string='') - Return a new hashing object using the named algorithm; |
|
|
|
|
|
|
|
optionally initialized with a string. |
|
|
|
|
|
|
|
+ Override 'usedforsecurity' to False when using for non-security purposes in |
|
|
|
+ Override 'usedforsecurity' to False when using for non-security purposes in |
|
|
|
+ a FIPS environment |
|
|
|
+ a FIPS environment |
|
|
|
""" |
|
|
|
""" |
|
|
|
try: |
|
|
|
try: |
|
|
|
- return _hashlib.new(name, string) |
|
|
|
- return _hashlib.new(name, data) |
|
|
|
+ return _hashlib.new(name, string, usedforsecurity) |
|
|
|
+ return _hashlib.new(name, data, usedforsecurity) |
|
|
|
except ValueError: |
|
|
|
except ValueError: |
|
|
|
- # If the _hashlib module (OpenSSL) doesn't support the named |
|
|
|
- # If the _hashlib module (OpenSSL) doesn't support the named |
|
|
|
- # hash, try using our builtin implementations. |
|
|
|
- # hash, try using our builtin implementations. |
|
|
|
- # This allows for SHA224/256 and SHA384/512 support even though |
|
|
|
- # This allows for SHA224/256 and SHA384/512 support even though |
|
|
|
- # the OpenSSL library prior to 0.9.8 doesn't provide them. |
|
|
|
- # the OpenSSL library prior to 0.9.8 doesn't provide them. |
|
|
|
- return __get_builtin_constructor(name)(string) |
|
|
|
+ # TODO: We want to just raise here when OpenSSL implements sha3 |
|
|
|
- |
|
|
|
+ # because we want to make sure that Fedora uses everything from OpenSSL |
|
|
|
+ raise |
|
|
|
return __get_builtin_constructor(name)(data) |
|
|
|
|
|
|
|
|
|
|
|
try: |
|
|
|
|
|
|
|
import _hashlib |
|
|
|
|
|
|
|
new = __hash_new |
|
|
|
|
|
|
|
__get_hash = __get_openssl_constructor |
|
|
|
|
|
|
|
except ImportError: |
|
|
|
|
|
|
|
- new = __py_new |
|
|
|
|
|
|
|
- __get_hash = __get_builtin_constructor |
|
|
|
|
|
|
|
+ # We don't build the legacy modules |
|
|
|
|
|
|
|
+ raise |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
for __func_name in __always_supported: |
|
|
|
|
|
|
|
# try them all, some may not work due to the OpenSSL |
|
|
|
|
|
|
|
@@ -143,4 +125,4 @@ for __func_name in __always_supported: |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@@ -207,7 +237,10 @@ for __func_name in __always_supported: |
|
|
|
|
|
|
|
# try them all, some may not work due to the OpenSSL |
|
|
|
|
|
|
|
# version not supporting that algorithm. |
|
|
|
|
|
|
|
try: |
|
|
|
|
|
|
|
- globals()[__func_name] = __get_hash(__func_name) |
|
|
|
|
|
|
|
+ func = __get_hash(__func_name) |
|
|
|
|
|
|
|
+ if 'sha3_' in __func_name: |
|
|
|
|
|
|
|
+ func = __ignore_usedforsecurity(func) |
|
|
|
|
|
|
|
+ globals()[__func_name] = func |
|
|
|
|
|
|
|
except ValueError: |
|
|
|
|
|
|
|
import logging |
|
|
|
|
|
|
|
logging.exception('code for hash %s was not found.', __func_name) |
|
|
|
|
|
|
|
@@ -215,3 +248,4 @@ for __func_name in __always_supported: |
|
|
|
# Cleanup locals() |
|
|
|
# Cleanup locals() |
|
|
|
del __always_supported, __func_name, __get_hash |
|
|
|
del __always_supported, __func_name, __get_hash |
|
|
|
-del __py_new, __hash_new, __get_openssl_constructor |
|
|
|
del __py_new, __hash_new, __get_openssl_constructor |
|
|
|
+del __hash_new, __get_openssl_constructor |
|
|
|
+del __ignore_usedforsecurity |
|
|
|
diff -up Python-2.7.2/Lib/test/test_hashlib.py.hashlib-fips Python-2.7.2/Lib/test/test_hashlib.py |
|
|
|
\ No newline at end of file |
|
|
|
--- Python-2.7.2/Lib/test/test_hashlib.py.hashlib-fips 2011-06-11 11:46:25.000000000 -0400 |
|
|
|
diff --git a/Lib/test/test_hashlib.py b/Lib/test/test_hashlib.py |
|
|
|
+++ Python-2.7.2/Lib/test/test_hashlib.py 2011-09-14 01:08:55.525254195 -0400 |
|
|
|
index c9b113e..60e2392 100644 |
|
|
|
@@ -32,6 +32,19 @@ def hexstr(s): |
|
|
|
--- a/Lib/test/test_hashlib.py |
|
|
|
r = r + h[(i >> 4) & 0xF] + h[i & 0xF] |
|
|
|
+++ b/Lib/test/test_hashlib.py |
|
|
|
return r |
|
|
|
@@ -24,7 +24,22 @@ from test.support import _4G, bigmemtest, import_fresh_module |
|
|
|
|
|
|
|
COMPILED_WITH_PYDEBUG = hasattr(sys, 'gettotalrefcount') |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
c_hashlib = import_fresh_module('hashlib', fresh=['_hashlib']) |
|
|
|
|
|
|
|
-py_hashlib = import_fresh_module('hashlib', blocked=['_hashlib']) |
|
|
|
|
|
|
|
+# skipped on Fedora, since we always use OpenSSL implementation |
|
|
|
|
|
|
|
+# py_hashlib = import_fresh_module('hashlib', blocked=['_hashlib']) |
|
|
|
|
|
|
|
+ |
|
|
|
+def openssl_enforces_fips(): |
|
|
|
+def openssl_enforces_fips(): |
|
|
|
+ # Use the "openssl" command (if present) to try to determine if the local |
|
|
|
+ # Use the "openssl" command (if present) to try to determine if the local |
|
|
|
+ # OpenSSL is configured to enforce FIPS |
|
|
|
+ # OpenSSL is configured to enforce FIPS |
|
|
|
@ -153,122 +134,80 @@ diff -up Python-2.7.2/Lib/test/test_hashlib.py.hashlib-fips Python-2.7.2/Lib/tes |
|
|
|
+ return b'unknown cipher' in stderr |
|
|
|
+ return b'unknown cipher' in stderr |
|
|
|
+OPENSSL_ENFORCES_FIPS = openssl_enforces_fips() |
|
|
|
+OPENSSL_ENFORCES_FIPS = openssl_enforces_fips() |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def hexstr(s): |
|
|
|
|
|
|
|
assert isinstance(s, bytes), repr(s) |
|
|
|
|
|
|
|
@@ -34,6 +49,16 @@ def hexstr(s): |
|
|
|
|
|
|
|
r += h[(i >> 4) & 0xF] + h[i & 0xF] |
|
|
|
|
|
|
|
return r |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
+# hashlib and _hashlib-based functions support a "usedforsecurity" keyword |
|
|
|
|
|
|
|
+# argument, and FIPS mode requires that it be used overridden with a False |
|
|
|
|
|
|
|
+# value for these selftests to work. Other cryptographic code within Python |
|
|
|
|
|
|
|
+# doesn't support this keyword. |
|
|
|
|
|
|
|
+# Modify a function to one in which "usedforsecurity=False" is added to the |
|
|
|
|
|
|
|
+# keyword arguments: |
|
|
|
|
|
|
|
+def suppress_fips(f): |
|
|
|
|
|
|
|
+ def g(*args, **kwargs): |
|
|
|
|
|
|
|
+ return f(*args, usedforsecurity=False, **kwargs) |
|
|
|
|
|
|
|
+ return g |
|
|
|
|
|
|
|
|
|
|
|
class HashLibTestCase(unittest.TestCase): |
|
|
|
class HashLibTestCase(unittest.TestCase): |
|
|
|
supported_hash_names = ( 'md5', 'MD5', 'sha1', 'SHA1', |
|
|
|
supported_hash_names = ( 'md5', 'MD5', 'sha1', 'SHA1', |
|
|
|
@@ -61,10 +74,10 @@ class HashLibTestCase(unittest.TestCase) |
|
|
|
@@ -63,11 +88,11 @@ class HashLibTestCase(unittest.TestCase): |
|
|
|
|
|
|
|
# For each algorithm, test the direct constructor and the use |
|
|
|
# of hashlib.new given the algorithm name. |
|
|
|
# of hashlib.new given the algorithm name. |
|
|
|
for algorithm, constructors in self.constructors_to_test.items(): |
|
|
|
for algorithm, constructors in self.constructors_to_test.items(): |
|
|
|
constructors.add(getattr(hashlib, algorithm)) |
|
|
|
- constructors.add(getattr(hashlib, algorithm)) |
|
|
|
- def _test_algorithm_via_hashlib_new(data=None, _alg=algorithm): |
|
|
|
+ constructors.add(suppress_fips(getattr(hashlib, algorithm))) |
|
|
|
+ def _test_algorithm_via_hashlib_new(data=None, _alg=algorithm, usedforsecurity=True): |
|
|
|
def _test_algorithm_via_hashlib_new(data=None, _alg=algorithm): |
|
|
|
if data is None: |
|
|
|
if data is None: |
|
|
|
- return hashlib.new(_alg) |
|
|
|
- return hashlib.new(_alg) |
|
|
|
- return hashlib.new(_alg, data) |
|
|
|
- return hashlib.new(_alg, data) |
|
|
|
+ return hashlib.new(_alg, usedforsecurity=usedforsecurity) |
|
|
|
+ return suppress_fips(hashlib.new)(_alg) |
|
|
|
+ return hashlib.new(_alg, data, usedforsecurity=usedforsecurity) |
|
|
|
+ return suppress_fips(hashlib.new)(_alg, data) |
|
|
|
constructors.add(_test_algorithm_via_hashlib_new) |
|
|
|
constructors.add(_test_algorithm_via_hashlib_new) |
|
|
|
|
|
|
|
|
|
|
|
_hashlib = self._conditional_import_module('_hashlib') |
|
|
|
_hashlib = self._conditional_import_module('_hashlib') |
|
|
|
@@ -78,28 +91,13 @@ class HashLibTestCase(unittest.TestCase) |
|
|
|
@@ -79,27 +104,12 @@ class HashLibTestCase(unittest.TestCase): |
|
|
|
|
|
|
|
for algorithm, constructors in self.constructors_to_test.items(): |
|
|
|
|
|
|
|
constructor = getattr(_hashlib, 'openssl_'+algorithm, None) |
|
|
|
if constructor: |
|
|
|
if constructor: |
|
|
|
constructors.add(constructor) |
|
|
|
- constructors.add(constructor) |
|
|
|
|
|
|
|
+ constructors.add(suppress_fips(constructor)) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def add_builtin_constructor(name): |
|
|
|
|
|
|
|
constructor = getattr(hashlib, "__get_builtin_constructor")(name) |
|
|
|
|
|
|
|
self.constructors_to_test[name].add(constructor) |
|
|
|
|
|
|
|
|
|
|
|
- _md5 = self._conditional_import_module('_md5') |
|
|
|
- _md5 = self._conditional_import_module('_md5') |
|
|
|
- if _md5: |
|
|
|
- if _md5: |
|
|
|
- self.constructors_to_test['md5'].add(_md5.new) |
|
|
|
- add_builtin_constructor('md5') |
|
|
|
- _sha = self._conditional_import_module('_sha') |
|
|
|
- _sha1 = self._conditional_import_module('_sha1') |
|
|
|
- if _sha: |
|
|
|
- if _sha1: |
|
|
|
- self.constructors_to_test['sha1'].add(_sha.new) |
|
|
|
- add_builtin_constructor('sha1') |
|
|
|
- _sha256 = self._conditional_import_module('_sha256') |
|
|
|
- _sha256 = self._conditional_import_module('_sha256') |
|
|
|
- if _sha256: |
|
|
|
- if _sha256: |
|
|
|
- self.constructors_to_test['sha224'].add(_sha256.sha224) |
|
|
|
- add_builtin_constructor('sha224') |
|
|
|
- self.constructors_to_test['sha256'].add(_sha256.sha256) |
|
|
|
- add_builtin_constructor('sha256') |
|
|
|
- _sha512 = self._conditional_import_module('_sha512') |
|
|
|
- _sha512 = self._conditional_import_module('_sha512') |
|
|
|
- if _sha512: |
|
|
|
- if _sha512: |
|
|
|
- self.constructors_to_test['sha384'].add(_sha512.sha384) |
|
|
|
- add_builtin_constructor('sha384') |
|
|
|
- self.constructors_to_test['sha512'].add(_sha512.sha512) |
|
|
|
- add_builtin_constructor('sha512') |
|
|
|
- |
|
|
|
- |
|
|
|
super(HashLibTestCase, self).__init__(*args, **kwargs) |
|
|
|
super(HashLibTestCase, self).__init__(*args, **kwargs) |
|
|
|
|
|
|
|
|
|
|
|
def test_hash_array(self): |
|
|
|
@property |
|
|
|
a = array.array("b", range(10)) |
|
|
|
@@ -148,9 +158,6 @@ class HashLibTestCase(unittest.TestCase): |
|
|
|
constructors = self.constructors_to_test.itervalues() |
|
|
|
else: |
|
|
|
for cons in itertools.chain.from_iterable(constructors): |
|
|
|
del sys.modules['_md5'] |
|
|
|
- c = cons(a) |
|
|
|
self.assertRaises(TypeError, get_builtin_constructor, 3) |
|
|
|
+ c = cons(a, usedforsecurity=False) |
|
|
|
- constructor = get_builtin_constructor('md5') |
|
|
|
c.hexdigest() |
|
|
|
- self.assertIs(constructor, _md5.md5) |
|
|
|
|
|
|
|
- self.assertEqual(sorted(builtin_constructor_cache), ['MD5', 'md5']) |
|
|
|
def test_algorithms_attribute(self): |
|
|
|
|
|
|
|
@@ -115,28 +113,9 @@ class HashLibTestCase(unittest.TestCase) |
|
|
|
|
|
|
|
self.assertRaises(ValueError, hashlib.new, 'spam spam spam spam spam') |
|
|
|
|
|
|
|
self.assertRaises(TypeError, hashlib.new, 1) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- def test_get_builtin_constructor(self): |
|
|
|
|
|
|
|
- get_builtin_constructor = hashlib.__dict__[ |
|
|
|
|
|
|
|
- '__get_builtin_constructor'] |
|
|
|
|
|
|
|
- self.assertRaises(ValueError, get_builtin_constructor, 'test') |
|
|
|
|
|
|
|
- try: |
|
|
|
|
|
|
|
- import _md5 |
|
|
|
|
|
|
|
- except ImportError: |
|
|
|
|
|
|
|
- pass |
|
|
|
|
|
|
|
- # This forces an ImportError for "import _md5" statements |
|
|
|
|
|
|
|
- sys.modules['_md5'] = None |
|
|
|
|
|
|
|
- try: |
|
|
|
|
|
|
|
- self.assertRaises(ValueError, get_builtin_constructor, 'md5') |
|
|
|
|
|
|
|
- finally: |
|
|
|
|
|
|
|
- if '_md5' in locals(): |
|
|
|
|
|
|
|
- sys.modules['_md5'] = _md5 |
|
|
|
|
|
|
|
- else: |
|
|
|
|
|
|
|
- del sys.modules['_md5'] |
|
|
|
|
|
|
|
- self.assertRaises(TypeError, get_builtin_constructor, 3) |
|
|
|
|
|
|
|
- |
|
|
|
|
|
|
|
def test_hexdigest(self): |
|
|
|
def test_hexdigest(self): |
|
|
|
for name in self.supported_hash_names: |
|
|
|
for cons in self.hash_constructors: |
|
|
|
- h = hashlib.new(name) |
|
|
|
@@ -433,6 +440,64 @@ class HashLibTestCase(unittest.TestCase): |
|
|
|
+ h = hashlib.new(name, usedforsecurity=False) |
|
|
|
|
|
|
|
self.assertTrue(hexstr(h.digest()) == h.hexdigest()) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_large_update(self): |
|
|
|
|
|
|
|
@@ -145,16 +125,16 @@ class HashLibTestCase(unittest.TestCase) |
|
|
|
|
|
|
|
abcs = aas + bees + cees |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
for name in self.supported_hash_names: |
|
|
|
|
|
|
|
- m1 = hashlib.new(name) |
|
|
|
|
|
|
|
+ m1 = hashlib.new(name, usedforsecurity=False) |
|
|
|
|
|
|
|
m1.update(aas) |
|
|
|
|
|
|
|
m1.update(bees) |
|
|
|
|
|
|
|
m1.update(cees) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- m2 = hashlib.new(name) |
|
|
|
|
|
|
|
+ m2 = hashlib.new(name, usedforsecurity=False) |
|
|
|
|
|
|
|
m2.update(abcs) |
|
|
|
|
|
|
|
self.assertEqual(m1.digest(), m2.digest(), name+' update problem.') |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- m3 = hashlib.new(name, abcs) |
|
|
|
|
|
|
|
+ m3 = hashlib.new(name, abcs, usedforsecurity=False) |
|
|
|
|
|
|
|
self.assertEqual(m1.digest(), m3.digest(), name+' new problem.') |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def check(self, name, data, digest): |
|
|
|
|
|
|
|
@@ -162,7 +142,7 @@ class HashLibTestCase(unittest.TestCase) |
|
|
|
|
|
|
|
# 2 is for hashlib.name(...) and hashlib.new(name, ...) |
|
|
|
|
|
|
|
self.assertGreaterEqual(len(constructors), 2) |
|
|
|
|
|
|
|
for hash_object_constructor in constructors: |
|
|
|
|
|
|
|
- computed = hash_object_constructor(data).hexdigest() |
|
|
|
|
|
|
|
+ computed = hash_object_constructor(data, usedforsecurity=False).hexdigest() |
|
|
|
|
|
|
|
self.assertEqual( |
|
|
|
|
|
|
|
computed, digest, |
|
|
|
|
|
|
|
"Hash algorithm %s constructed using %s returned hexdigest" |
|
|
|
|
|
|
|
@@ -172,7 +152,8 @@ class HashLibTestCase(unittest.TestCase) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def check_unicode(self, algorithm_name): |
|
|
|
|
|
|
|
# Unicode objects are not allowed as input. |
|
|
|
|
|
|
|
- expected = hashlib.new(algorithm_name, str(u'spam')).hexdigest() |
|
|
|
|
|
|
|
+ expected = hashlib.new(algorithm_name, str(u'spam'), |
|
|
|
|
|
|
|
+ usedforsecurity=False).hexdigest() |
|
|
|
|
|
|
|
self.check(algorithm_name, u'spam', expected) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_unicode(self): |
|
|
|
|
|
|
|
@@ -354,6 +335,70 @@ class HashLibTestCase(unittest.TestCase) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
self.assertEqual(expected_hash, hasher.hexdigest()) |
|
|
|
self.assertEqual(expected_hash, hasher.hexdigest()) |
|
|
|
|
|
|
|
|
|
|
|
@ -288,70 +227,74 @@ diff -up Python-2.7.2/Lib/test/test_hashlib.py.hashlib-fips Python-2.7.2/Lib/tes |
|
|
|
+ m = hashlib.new('md5', b'abc\n', usedforsecurity=False) |
|
|
|
+ m = hashlib.new('md5', b'abc\n', usedforsecurity=False) |
|
|
|
+ self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1") |
|
|
|
+ self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1") |
|
|
|
+ |
|
|
|
+ |
|
|
|
+ def assertRaisesUnknownCipher(self, callable_obj=None, *args, **kwargs): |
|
|
|
|
|
|
|
+ try: |
|
|
|
|
|
|
|
+ callable_obj(*args, **kwargs) |
|
|
|
|
|
|
|
+ except ValueError, e: |
|
|
|
|
|
|
|
+ if not e.args[0].endswith('unknown cipher'): |
|
|
|
|
|
|
|
+ self.fail('Incorrect exception raised') |
|
|
|
|
|
|
|
+ else: |
|
|
|
|
|
|
|
+ self.fail('Exception was not raised') |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
+ @unittest.skipUnless(OPENSSL_ENFORCES_FIPS, |
|
|
|
+ @unittest.skipUnless(OPENSSL_ENFORCES_FIPS, |
|
|
|
+ 'FIPS enforcement required for this test.') |
|
|
|
+ 'FIPS enforcement required for this test.') |
|
|
|
+ def test_hashlib_fips_mode(self): |
|
|
|
+ def test_hashlib_fips_mode(self): |
|
|
|
+ # Ensure that we raise a ValueError on vanilla attempts to use MD5 |
|
|
|
+ # Ensure that we raise a ValueError on vanilla attempts to use MD5 |
|
|
|
+ # in hashlib in a FIPS-enforced setting: |
|
|
|
+ # in hashlib in a FIPS-enforced setting: |
|
|
|
+ self.assertRaisesUnknownCipher(hashlib.md5) |
|
|
|
+ with self.assertRaisesRegexp(ValueError, '.*unknown cipher'): |
|
|
|
+ self.assertRaisesUnknownCipher(hashlib.new, 'md5') |
|
|
|
+ m = hashlib.md5() |
|
|
|
|
|
|
|
+ |
|
|
|
|
|
|
|
+ if not self._conditional_import_module('_md5'): |
|
|
|
|
|
|
|
+ with self.assertRaisesRegexp(ValueError, '.*unknown cipher'): |
|
|
|
|
|
|
|
+ m = hashlib.new('md5') |
|
|
|
+ |
|
|
|
+ |
|
|
|
+ @unittest.skipUnless(OPENSSL_ENFORCES_FIPS, |
|
|
|
+ @unittest.skipUnless(OPENSSL_ENFORCES_FIPS, |
|
|
|
+ 'FIPS enforcement required for this test.') |
|
|
|
+ 'FIPS enforcement required for this test.') |
|
|
|
+ def test_hashopenssl_fips_mode(self): |
|
|
|
+ def test_hashopenssl_fips_mode(self): |
|
|
|
+ # Verify the _hashlib module's handling of md5: |
|
|
|
+ # Verify the _hashlib module's handling of md5: |
|
|
|
+ import _hashlib |
|
|
|
+ _hashlib = self._conditional_import_module('_hashlib') |
|
|
|
+ |
|
|
|
+ if _hashlib: |
|
|
|
+ assert hasattr(_hashlib, 'openssl_md5') |
|
|
|
+ assert hasattr(_hashlib, 'openssl_md5') |
|
|
|
+ |
|
|
|
+ |
|
|
|
+ # Ensure that _hashlib raises a ValueError on vanilla attempts to |
|
|
|
+ # Ensure that _hashlib raises a ValueError on vanilla attempts to |
|
|
|
+ # use MD5 in a FIPS-enforced setting: |
|
|
|
+ # use MD5 in a FIPS-enforced setting: |
|
|
|
+ self.assertRaisesUnknownCipher(_hashlib.openssl_md5) |
|
|
|
+ with self.assertRaisesRegexp(ValueError, '.*unknown cipher'): |
|
|
|
+ self.assertRaisesUnknownCipher(_hashlib.new, 'md5') |
|
|
|
+ m = _hashlib.openssl_md5() |
|
|
|
+ |
|
|
|
+ with self.assertRaisesRegexp(ValueError, '.*unknown cipher'): |
|
|
|
+ # Ensure that in such a setting we can whitelist a callsite with |
|
|
|
+ m = _hashlib.new('md5') |
|
|
|
+ # usedforsecurity=False and have it succeed: |
|
|
|
+ |
|
|
|
+ m = _hashlib.openssl_md5(usedforsecurity=False) |
|
|
|
+ # Ensure that in such a setting we can whitelist a callsite with |
|
|
|
+ m.update('abc\n') |
|
|
|
+ # usedforsecurity=False and have it succeed: |
|
|
|
+ self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1") |
|
|
|
+ m = _hashlib.openssl_md5(usedforsecurity=False) |
|
|
|
+ |
|
|
|
+ m.update(b'abc\n') |
|
|
|
+ m = _hashlib.new('md5', usedforsecurity=False) |
|
|
|
+ self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1") |
|
|
|
+ m.update('abc\n') |
|
|
|
+ |
|
|
|
+ self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1") |
|
|
|
+ m = _hashlib.new('md5', usedforsecurity=False) |
|
|
|
+ |
|
|
|
+ m.update(b'abc\n') |
|
|
|
+ m = _hashlib.openssl_md5('abc\n', usedforsecurity=False) |
|
|
|
+ self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1") |
|
|
|
+ self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1") |
|
|
|
+ |
|
|
|
+ |
|
|
|
+ m = _hashlib.openssl_md5(b'abc\n', usedforsecurity=False) |
|
|
|
+ m = _hashlib.new('md5', 'abc\n', usedforsecurity=False) |
|
|
|
+ self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1") |
|
|
|
+ self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1") |
|
|
|
+ |
|
|
|
+ |
|
|
|
+ m = _hashlib.new('md5', b'abc\n', usedforsecurity=False) |
|
|
|
+ |
|
|
|
+ self.assertEquals(m.hexdigest(), "0bee89b07a248e27c83fc3d5951213c1") |
|
|
|
+ |
|
|
|
|
|
|
|
def test_main(): |
|
|
|
class KDFTests(unittest.TestCase): |
|
|
|
test_support.run_unittest(HashLibTestCase) |
|
|
|
|
|
|
|
|
|
|
|
@@ -516,7 +581,7 @@ class KDFTests(unittest.TestCase): |
|
|
|
|
|
|
|
out = pbkdf2(hash_name='sha1', password=b'password', salt=b'salt', |
|
|
|
|
|
|
|
iterations=1, dklen=None) |
|
|
|
|
|
|
|
self.assertEqual(out, self.pbkdf2_results['sha1'][0][0]) |
|
|
|
|
|
|
|
- |
|
|
|
|
|
|
|
+ @unittest.skip('skipped on Fedora, as we always use OpenSSL pbkdf2_hmac') |
|
|
|
|
|
|
|
def test_pbkdf2_hmac_py(self): |
|
|
|
|
|
|
|
self._test_pbkdf2_hmac(py_hashlib.pbkdf2_hmac) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c |
|
|
|
|
|
|
|
index 44765ac..b8cf490 100644 |
|
|
|
|
|
|
|
--- a/Modules/_hashopenssl.c |
|
|
|
|
|
|
|
+++ b/Modules/_hashopenssl.c |
|
|
|
|
|
|
|
@@ -20,6 +20,8 @@ |
|
|
|
|
|
|
|
|
|
|
|
diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_hashopenssl.c |
|
|
|
|
|
|
|
--- Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips 2011-06-11 11:46:26.000000000 -0400 |
|
|
|
|
|
|
|
+++ Python-2.7.2/Modules/_hashopenssl.c 2011-09-14 00:21:26.199252001 -0400 |
|
|
|
|
|
|
|
@@ -36,6 +36,8 @@ |
|
|
|
|
|
|
|
#endif |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* EVP is the preferred interface to hashing in OpenSSL */ |
|
|
|
/* EVP is the preferred interface to hashing in OpenSSL */ |
|
|
|
+#include <openssl/ssl.h> |
|
|
|
+#include <openssl/ssl.h> |
|
|
|
+#include <openssl/err.h> |
|
|
|
+#include <openssl/err.h> |
|
|
|
#include <openssl/evp.h> |
|
|
|
#include <openssl/evp.h> |
|
|
|
|
|
|
|
#include <openssl/hmac.h> |
|
|
|
#define MUNCH_SIZE INT_MAX |
|
|
|
/* We use the object interface to discover what hashes OpenSSL supports. */ |
|
|
|
@@ -65,11 +67,19 @@ typedef struct { |
|
|
|
@@ -45,11 +47,19 @@ typedef struct { |
|
|
|
|
|
|
|
|
|
|
|
static PyTypeObject EVPtype; |
|
|
|
static PyTypeObject EVPtype; |
|
|
|
|
|
|
|
|
|
|
|
@ -375,7 +318,7 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
|
|
|
|
|
|
|
|
DEFINE_CONSTS_FOR_NEW(md5) |
|
|
|
DEFINE_CONSTS_FOR_NEW(md5) |
|
|
|
DEFINE_CONSTS_FOR_NEW(sha1) |
|
|
|
DEFINE_CONSTS_FOR_NEW(sha1) |
|
|
|
@@ -115,6 +125,48 @@ EVP_hash(EVPobject *self, const void *vp |
|
|
|
@@ -92,6 +102,48 @@ EVP_hash(EVPobject *self, const void *vp, Py_ssize_t len) |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
@ -406,7 +349,7 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
+ errstr = ERR_error_string(ERR_peek_last_error(), NULL); |
|
|
|
+ errstr = ERR_error_string(ERR_peek_last_error(), NULL); |
|
|
|
+ ERR_clear_error(); |
|
|
|
+ ERR_clear_error(); |
|
|
|
+ |
|
|
|
+ |
|
|
|
+ return PyString_FromString(errstr); /* Can be NULL */ |
|
|
|
+ return PyUnicode_FromString(errstr); /* Can be NULL */ |
|
|
|
+} |
|
|
|
+} |
|
|
|
+ |
|
|
|
+ |
|
|
|
+static void |
|
|
|
+static void |
|
|
|
@ -424,27 +367,28 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
/* Internal methods for a hash object */ |
|
|
|
/* Internal methods for a hash object */ |
|
|
|
|
|
|
|
|
|
|
|
static void |
|
|
|
static void |
|
|
|
@@ -313,14 +365,15 @@ EVP_repr(PyObject *self) |
|
|
|
@@ -259,15 +311,16 @@ EVP_repr(EVPobject *self) |
|
|
|
static int |
|
|
|
static int |
|
|
|
EVP_tp_init(EVPobject *self, PyObject *args, PyObject *kwds) |
|
|
|
EVP_tp_init(EVPobject *self, PyObject *args, PyObject *kwds) |
|
|
|
{ |
|
|
|
{ |
|
|
|
- static char *kwlist[] = {"name", "string", NULL}; |
|
|
|
- static char *kwlist[] = {"name", "string", NULL}; |
|
|
|
+ static char *kwlist[] = {"name", "string", "usedforsecurity", NULL}; |
|
|
|
+ static char *kwlist[] = {"name", "string", "usedforsecurity", NULL}; |
|
|
|
PyObject *name_obj = NULL; |
|
|
|
PyObject *name_obj = NULL; |
|
|
|
|
|
|
|
PyObject *data_obj = NULL; |
|
|
|
+ int usedforsecurity = 1; |
|
|
|
+ int usedforsecurity = 1; |
|
|
|
Py_buffer view = { 0 }; |
|
|
|
Py_buffer view; |
|
|
|
char *nameStr; |
|
|
|
char *nameStr; |
|
|
|
const EVP_MD *digest; |
|
|
|
const EVP_MD *digest; |
|
|
|
|
|
|
|
|
|
|
|
- if (!PyArg_ParseTupleAndKeywords(args, kwds, "O|s*:HASH", kwlist, |
|
|
|
- if (!PyArg_ParseTupleAndKeywords(args, kwds, "O|O:HASH", kwlist, |
|
|
|
- &name_obj, &view)) { |
|
|
|
- &name_obj, &data_obj)) { |
|
|
|
+ if (!PyArg_ParseTupleAndKeywords(args, kwds, "O|s*i:HASH", kwlist, |
|
|
|
+ if (!PyArg_ParseTupleAndKeywords(args, kwds, "O|Oi:HASH", kwlist, |
|
|
|
+ &name_obj, &view, &usedforsecurity)) { |
|
|
|
+ &name_obj, &data_obj, &usedforsecurity)) { |
|
|
|
return -1; |
|
|
|
return -1; |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
@@ -336,7 +389,12 @@ EVP_tp_init(EVPobject *self, PyObject *a |
|
|
|
@@ -288,7 +341,12 @@ EVP_tp_init(EVPobject *self, PyObject *args, PyObject *kwds) |
|
|
|
PyBuffer_Release(&view); |
|
|
|
PyBuffer_Release(&view); |
|
|
|
return -1; |
|
|
|
return -1; |
|
|
|
} |
|
|
|
} |
|
|
|
- EVP_DigestInit(&self->ctx, digest); |
|
|
|
- EVP_DigestInit(&self->ctx, digest); |
|
|
|
@ -457,7 +401,7 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
|
|
|
|
|
|
|
|
self->name = name_obj; |
|
|
|
self->name = name_obj; |
|
|
|
Py_INCREF(self->name); |
|
|
|
Py_INCREF(self->name); |
|
|
|
@@ -420,7 +478,8 @@ static PyTypeObject EVPtype = { |
|
|
|
@@ -372,7 +430,8 @@ static PyTypeObject EVPtype = { |
|
|
|
static PyObject * |
|
|
|
static PyObject * |
|
|
|
EVPnew(PyObject *name_obj, |
|
|
|
EVPnew(PyObject *name_obj, |
|
|
|
const EVP_MD *digest, const EVP_MD_CTX *initial_ctx, |
|
|
|
const EVP_MD *digest, const EVP_MD_CTX *initial_ctx, |
|
|
|
@ -467,7 +411,7 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
{ |
|
|
|
{ |
|
|
|
EVPobject *self; |
|
|
|
EVPobject *self; |
|
|
|
|
|
|
|
|
|
|
|
@@ -435,7 +494,12 @@ EVPnew(PyObject *name_obj, |
|
|
|
@@ -387,7 +446,12 @@ EVPnew(PyObject *name_obj, |
|
|
|
if (initial_ctx) { |
|
|
|
if (initial_ctx) { |
|
|
|
EVP_MD_CTX_copy(&self->ctx, initial_ctx); |
|
|
|
EVP_MD_CTX_copy(&self->ctx, initial_ctx); |
|
|
|
} else { |
|
|
|
} else { |
|
|
|
@ -481,7 +425,7 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
if (cp && len) { |
|
|
|
if (cp && len) { |
|
|
|
@@ -459,20 +523,28 @@ PyDoc_STRVAR(EVP_new__doc__, |
|
|
|
@@ -411,21 +475,29 @@ PyDoc_STRVAR(EVP_new__doc__, |
|
|
|
An optional string argument may be provided and will be\n\ |
|
|
|
An optional string argument may be provided and will be\n\ |
|
|
|
automatically hashed.\n\ |
|
|
|
automatically hashed.\n\ |
|
|
|
\n\ |
|
|
|
\n\ |
|
|
|
@ -501,29 +445,32 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
- static char *kwlist[] = {"name", "string", NULL}; |
|
|
|
- static char *kwlist[] = {"name", "string", NULL}; |
|
|
|
+ static char *kwlist[] = {"name", "string", "usedforsecurity", NULL}; |
|
|
|
+ static char *kwlist[] = {"name", "string", "usedforsecurity", NULL}; |
|
|
|
PyObject *name_obj = NULL; |
|
|
|
PyObject *name_obj = NULL; |
|
|
|
|
|
|
|
PyObject *data_obj = NULL; |
|
|
|
|
|
|
|
+ int usedforsecurity = 1; |
|
|
|
Py_buffer view = { 0 }; |
|
|
|
Py_buffer view = { 0 }; |
|
|
|
PyObject *ret_obj; |
|
|
|
PyObject *ret_obj; |
|
|
|
char *name; |
|
|
|
char *name; |
|
|
|
const EVP_MD *digest; |
|
|
|
const EVP_MD *digest; |
|
|
|
+ int usedforsecurity = 1; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- if (!PyArg_ParseTupleAndKeywords(args, kwdict, "O|s*:new", kwlist, |
|
|
|
- if (!PyArg_ParseTupleAndKeywords(args, kwdict, "O|O:new", kwlist, |
|
|
|
- &name_obj, &view)) { |
|
|
|
- &name_obj, &data_obj)) { |
|
|
|
+ if (!PyArg_ParseTupleAndKeywords(args, kwdict, "O|s*i:new", kwlist, |
|
|
|
+ if (!PyArg_ParseTupleAndKeywords(args, kwdict, "O|Oi:new", kwlist, |
|
|
|
+ &name_obj, &view, &usedforsecurity)) { |
|
|
|
+ &name_obj, &data_obj, &usedforsecurity)) { |
|
|
|
return NULL; |
|
|
|
return NULL; |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
@@ -484,58 +556,118 @@ EVP_new(PyObject *self, PyObject *args, |
|
|
|
@@ -439,7 +511,8 @@ EVP_new(PyObject *self, PyObject *args, PyObject *kwdict) |
|
|
|
|
|
|
|
|
|
|
|
digest = EVP_get_digestbyname(name); |
|
|
|
digest = EVP_get_digestbyname(name); |
|
|
|
|
|
|
|
|
|
|
|
ret_obj = EVPnew(name_obj, digest, NULL, (unsigned char*)view.buf, |
|
|
|
- ret_obj = EVPnew(name_obj, digest, NULL, (unsigned char*)view.buf, view.len); |
|
|
|
- view.len); |
|
|
|
+ ret_obj = EVPnew(name_obj, digest, NULL, (unsigned char*)view.buf, view.len, |
|
|
|
+ view.len, usedforsecurity); |
|
|
|
+ usedforsecurity); |
|
|
|
PyBuffer_Release(&view); |
|
|
|
|
|
|
|
|
|
|
|
if (data_obj) |
|
|
|
|
|
|
|
PyBuffer_Release(&view); |
|
|
|
|
|
|
|
@@ -722,57 +795,114 @@ generate_hash_name_list(void) |
|
|
|
|
|
|
|
|
|
|
|
return ret_obj; |
|
|
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* |
|
|
|
/* |
|
|
|
- * This macro generates constructor function definitions for specific |
|
|
|
- * This macro generates constructor function definitions for specific |
|
|
|
@ -539,25 +486,32 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
#define GEN_CONSTRUCTOR(NAME) \ |
|
|
|
#define GEN_CONSTRUCTOR(NAME) \ |
|
|
|
static PyObject * \ |
|
|
|
static PyObject * \ |
|
|
|
- EVP_new_ ## NAME (PyObject *self, PyObject *args) \ |
|
|
|
- EVP_new_ ## NAME (PyObject *self, PyObject *args) \ |
|
|
|
+ EVP_new_ ## NAME (PyObject *self, PyObject *args, PyObject *kwdict) \ |
|
|
|
+ EVP_new_ ## NAME (PyObject *self, PyObject *args, PyObject *kwdict) \ |
|
|
|
{ \ |
|
|
|
{ \ |
|
|
|
|
|
|
|
- PyObject *data_obj = NULL; \ |
|
|
|
- Py_buffer view = { 0 }; \ |
|
|
|
- Py_buffer view = { 0 }; \ |
|
|
|
- PyObject *ret_obj; \ |
|
|
|
- PyObject *ret_obj; \ |
|
|
|
- \ |
|
|
|
- \ |
|
|
|
- if (!PyArg_ParseTuple(args, "|s*:" #NAME , &view)) { \ |
|
|
|
- if (!PyArg_ParseTuple(args, "|O:" #NAME , &data_obj)) { \ |
|
|
|
- return NULL; \ |
|
|
|
- return NULL; \ |
|
|
|
- } \ |
|
|
|
- } \ |
|
|
|
- \ |
|
|
|
- \ |
|
|
|
|
|
|
|
- if (data_obj) \ |
|
|
|
|
|
|
|
- GET_BUFFER_VIEW_OR_ERROUT(data_obj, &view); \ |
|
|
|
|
|
|
|
- \ |
|
|
|
- ret_obj = EVPnew( \ |
|
|
|
- ret_obj = EVPnew( \ |
|
|
|
- CONST_ ## NAME ## _name_obj, \ |
|
|
|
- CONST_ ## NAME ## _name_obj, \ |
|
|
|
- NULL, \ |
|
|
|
- NULL, \ |
|
|
|
- CONST_new_ ## NAME ## _ctx_p, \ |
|
|
|
- CONST_new_ ## NAME ## _ctx_p, \ |
|
|
|
- (unsigned char*)view.buf, view.len); \ |
|
|
|
- (unsigned char*)view.buf, \ |
|
|
|
- PyBuffer_Release(&view); \ |
|
|
|
- view.len); \ |
|
|
|
|
|
|
|
- \ |
|
|
|
|
|
|
|
- if (data_obj) \ |
|
|
|
|
|
|
|
- PyBuffer_Release(&view); \ |
|
|
|
- return ret_obj; \ |
|
|
|
- return ret_obj; \ |
|
|
|
+ return implement_specific_EVP_new(self, args, kwdict, \ |
|
|
|
+ return implement_specific_EVP_new(self, args, kwdict, \ |
|
|
|
+ "|s*i:" #NAME, \ |
|
|
|
+ "|Oi:" #NAME, \ |
|
|
|
+ &cached_info_ ## NAME ); \ |
|
|
|
+ &cached_info_ ## NAME ); \ |
|
|
|
} |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
+static PyObject * |
|
|
|
+static PyObject * |
|
|
|
@ -566,6 +520,7 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
+ EVPCachedInfo *cached_info) |
|
|
|
+ EVPCachedInfo *cached_info) |
|
|
|
+{ |
|
|
|
+{ |
|
|
|
+ static char *kwlist[] = {"string", "usedforsecurity", NULL}; |
|
|
|
+ static char *kwlist[] = {"string", "usedforsecurity", NULL}; |
|
|
|
|
|
|
|
+ PyObject *data_obj = NULL; |
|
|
|
+ Py_buffer view = { 0 }; |
|
|
|
+ Py_buffer view = { 0 }; |
|
|
|
+ int usedforsecurity = 1; |
|
|
|
+ int usedforsecurity = 1; |
|
|
|
+ int idx; |
|
|
|
+ int idx; |
|
|
|
@ -574,10 +529,13 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
+ assert(cached_info); |
|
|
|
+ assert(cached_info); |
|
|
|
+ |
|
|
|
+ |
|
|
|
+ if (!PyArg_ParseTupleAndKeywords(args, kwdict, format, kwlist, |
|
|
|
+ if (!PyArg_ParseTupleAndKeywords(args, kwdict, format, kwlist, |
|
|
|
+ &view, &usedforsecurity)) { |
|
|
|
+ &data_obj, &usedforsecurity)) { |
|
|
|
+ return NULL; |
|
|
|
+ return NULL; |
|
|
|
+ } |
|
|
|
+ } |
|
|
|
+ |
|
|
|
+ |
|
|
|
|
|
|
|
+ if (data_obj) |
|
|
|
|
|
|
|
+ GET_BUFFER_VIEW_OR_ERROUT(data_obj, &view); |
|
|
|
|
|
|
|
+ |
|
|
|
+ idx = usedforsecurity ? 1 : 0; |
|
|
|
+ idx = usedforsecurity ? 1 : 0; |
|
|
|
+ |
|
|
|
+ |
|
|
|
+ /* |
|
|
|
+ /* |
|
|
|
@ -600,9 +558,10 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
+ } else { |
|
|
|
+ } else { |
|
|
|
+ PyErr_SetString(PyExc_ValueError, "Error initializing hash"); |
|
|
|
+ PyErr_SetString(PyExc_ValueError, "Error initializing hash"); |
|
|
|
+ } |
|
|
|
+ } |
|
|
|
+ } |
|
|
|
+ } |
|
|
|
+ |
|
|
|
+ |
|
|
|
+ PyBuffer_Release(&view); |
|
|
|
+ if (data_obj) |
|
|
|
|
|
|
|
+ PyBuffer_Release(&view); |
|
|
|
+ |
|
|
|
+ |
|
|
|
+ return ret_obj; |
|
|
|
+ return ret_obj; |
|
|
|
+} |
|
|
|
+} |
|
|
|
@ -611,7 +570,7 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
#define CONSTRUCTOR_METH_DEF(NAME) \ |
|
|
|
#define CONSTRUCTOR_METH_DEF(NAME) \ |
|
|
|
- {"openssl_" #NAME, (PyCFunction)EVP_new_ ## NAME, METH_VARARGS, \ |
|
|
|
- {"openssl_" #NAME, (PyCFunction)EVP_new_ ## NAME, METH_VARARGS, \ |
|
|
|
+ {"openssl_" #NAME, (PyCFunction)EVP_new_ ## NAME, \ |
|
|
|
+ {"openssl_" #NAME, (PyCFunction)EVP_new_ ## NAME, \ |
|
|
|
+ METH_VARARGS |METH_KEYWORDS, \ |
|
|
|
+ METH_VARARGS|METH_KEYWORDS, \ |
|
|
|
PyDoc_STR("Returns a " #NAME \ |
|
|
|
PyDoc_STR("Returns a " #NAME \ |
|
|
|
" hash object; optionally initialized with a string") \ |
|
|
|
" hash object; optionally initialized with a string") \ |
|
|
|
} |
|
|
|
} |
|
|
|
@ -620,7 +579,7 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
- constructor constants if they haven't been initialized already. */ |
|
|
|
- constructor constants if they haven't been initialized already. */ |
|
|
|
-#define INIT_CONSTRUCTOR_CONSTANTS(NAME) do { \ |
|
|
|
-#define INIT_CONSTRUCTOR_CONSTANTS(NAME) do { \ |
|
|
|
- if (CONST_ ## NAME ## _name_obj == NULL) { \ |
|
|
|
- if (CONST_ ## NAME ## _name_obj == NULL) { \ |
|
|
|
- CONST_ ## NAME ## _name_obj = PyString_FromString(#NAME); \ |
|
|
|
- CONST_ ## NAME ## _name_obj = PyUnicode_FromString(#NAME); \ |
|
|
|
- if (EVP_get_digestbyname(#NAME)) { \ |
|
|
|
- if (EVP_get_digestbyname(#NAME)) { \ |
|
|
|
- CONST_new_ ## NAME ## _ctx_p = &CONST_new_ ## NAME ## _ctx; \ |
|
|
|
- CONST_new_ ## NAME ## _ctx_p = &CONST_new_ ## NAME ## _ctx; \ |
|
|
|
- EVP_DigestInit(CONST_new_ ## NAME ## _ctx_p, EVP_get_digestbyname(#NAME)); \ |
|
|
|
- EVP_DigestInit(CONST_new_ ## NAME ## _ctx_p, EVP_get_digestbyname(#NAME)); \ |
|
|
|
@ -632,18 +591,17 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
+ Try to initialize a context for each hash twice, once with |
|
|
|
+ Try to initialize a context for each hash twice, once with |
|
|
|
+ EVP_MD_CTX_FLAG_NON_FIPS_ALLOW and once without. |
|
|
|
+ EVP_MD_CTX_FLAG_NON_FIPS_ALLOW and once without. |
|
|
|
+ |
|
|
|
+ |
|
|
|
+ Any that have errors during initialization will end up wit a NULL ctx_ptrs |
|
|
|
+ Any that have errors during initialization will end up with a NULL ctx_ptrs |
|
|
|
+ entry, and err_msgs will be set (unless we're very low on memory) |
|
|
|
+ entry, and err_msgs will be set (unless we're very low on memory) |
|
|
|
+*/ |
|
|
|
+*/ |
|
|
|
+#define INIT_CONSTRUCTOR_CONSTANTS(NAME) do { \ |
|
|
|
+#define INIT_CONSTRUCTOR_CONSTANTS(NAME) do { \ |
|
|
|
+ init_constructor_constant(&cached_info_ ## NAME, #NAME); \ |
|
|
|
+ init_constructor_constant(&cached_info_ ## NAME, #NAME); \ |
|
|
|
} while (0); |
|
|
|
} while (0); |
|
|
|
|
|
|
|
|
|
|
|
+static void |
|
|
|
+static void |
|
|
|
+init_constructor_constant(EVPCachedInfo *cached_info, const char *name) |
|
|
|
+init_constructor_constant(EVPCachedInfo *cached_info, const char *name) |
|
|
|
+{ |
|
|
|
+{ |
|
|
|
+ assert(cached_info); |
|
|
|
+ assert(cached_info); |
|
|
|
+ cached_info->name_obj = PyString_FromString(name); |
|
|
|
+ cached_info->name_obj = PyUnicode_FromString(name); |
|
|
|
+ if (EVP_get_digestbyname(name)) { |
|
|
|
+ if (EVP_get_digestbyname(name)) { |
|
|
|
+ int i; |
|
|
|
+ int i; |
|
|
|
+ for (i=0; i<2; i++) { |
|
|
|
+ for (i=0; i<2; i++) { |
|
|
|
@ -654,76 +612,29 @@ diff -up Python-2.7.2/Modules/_hashopenssl.c.hashlib-fips Python-2.7.2/Modules/_ |
|
|
|
+ cached_info->ctx_ptrs[i] = &cached_info->ctxs[i]; |
|
|
|
+ cached_info->ctx_ptrs[i] = &cached_info->ctxs[i]; |
|
|
|
+ } else { |
|
|
|
+ } else { |
|
|
|
+ /* Failure: */ |
|
|
|
+ /* Failure: */ |
|
|
|
+ cached_info->ctx_ptrs[i] = NULL; |
|
|
|
+ cached_info->ctx_ptrs[i] = NULL; |
|
|
|
+ cached_info->error_msgs[i] = error_msg_for_last_error(); |
|
|
|
+ cached_info->error_msgs[i] = error_msg_for_last_error(); |
|
|
|
+ } |
|
|
|
+ } |
|
|
|
+ } |
|
|
|
+ } |
|
|
|
+ } |
|
|
|
+ } |
|
|
|
+} |
|
|
|
+} |
|
|
|
+ |
|
|
|
|
|
|
|
GEN_CONSTRUCTOR(md5) |
|
|
|
GEN_CONSTRUCTOR(md5) |
|
|
|
GEN_CONSTRUCTOR(sha1) |
|
|
|
GEN_CONSTRUCTOR(sha1) |
|
|
|
#ifdef _OPENSSL_SUPPORTS_SHA2 |
|
|
|
@@ -819,13 +949,10 @@ PyInit__hashlib(void) |
|
|
|
@@ -565,13 +700,10 @@ init_hashlib(void) |
|
|
|
|
|
|
|
{ |
|
|
|
{ |
|
|
|
PyObject *m; |
|
|
|
PyObject *m, *openssl_md_meth_names; |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- OpenSSL_add_all_digests(); |
|
|
|
|
|
|
|
- ERR_load_crypto_strings(); |
|
|
|
+ SSL_load_error_strings(); |
|
|
|
+ SSL_load_error_strings(); |
|
|
|
+ SSL_library_init(); |
|
|
|
+ SSL_library_init(); |
|
|
|
OpenSSL_add_all_digests(); |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- /* TODO build EVP_functions openssl_* entries dynamically based |
|
|
|
- /* TODO build EVP_functions openssl_* entries dynamically based |
|
|
|
- * on what hashes are supported rather than listing many |
|
|
|
- * on what hashes are supported rather than listing many |
|
|
|
- * but having some be unsupported. Only init appropriate |
|
|
|
- * but having some be unsupported. Only init appropriate |
|
|
|
- * constants. */ |
|
|
|
- * constants. */ |
|
|
|
- |
|
|
|
+ OpenSSL_add_all_digests(); |
|
|
|
|
|
|
|
|
|
|
|
Py_TYPE(&EVPtype) = &PyType_Type; |
|
|
|
Py_TYPE(&EVPtype) = &PyType_Type; |
|
|
|
if (PyType_Ready(&EVPtype) < 0) |
|
|
|
if (PyType_Ready(&EVPtype) < 0) |
|
|
|
return; |
|
|
|
|
|
|
|
diff -up Python-2.7.2/Modules/Setup.dist.hashlib-fips Python-2.7.2/Modules/Setup.dist |
|
|
|
|
|
|
|
--- Python-2.7.2/Modules/Setup.dist.hashlib-fips 2011-09-14 00:21:26.163252001 -0400 |
|
|
|
|
|
|
|
+++ Python-2.7.2/Modules/Setup.dist 2011-09-14 00:21:26.201252001 -0400 |
|
|
|
|
|
|
|
@@ -248,14 +248,14 @@ imageop imageop.c # Operations on images |
|
|
|
|
|
|
|
# Message-Digest Algorithm, described in RFC 1321. The necessary files |
|
|
|
|
|
|
|
# md5.c and md5.h are included here. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
-_md5 md5module.c md5.c |
|
|
|
|
|
|
|
+#_md5 md5module.c md5.c |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# The _sha module implements the SHA checksum algorithms. |
|
|
|
|
|
|
|
# (NIST's Secure Hash Algorithms.) |
|
|
|
|
|
|
|
-_sha shamodule.c |
|
|
|
|
|
|
|
-_sha256 sha256module.c |
|
|
|
|
|
|
|
-_sha512 sha512module.c |
|
|
|
|
|
|
|
+#_sha shamodule.c |
|
|
|
|
|
|
|
+#_sha256 sha256module.c |
|
|
|
|
|
|
|
+#_sha512 sha512module.c |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# SGI IRIX specific modules -- off by default. |
|
|
|
|
|
|
|
diff -up Python-2.7.2/setup.py.hashlib-fips Python-2.7.2/setup.py |
|
|
|
|
|
|
|
--- Python-2.7.2/setup.py.hashlib-fips 2011-09-14 00:21:25.722252001 -0400 |
|
|
|
|
|
|
|
+++ Python-2.7.2/setup.py 2011-09-14 00:21:26.203252001 -0400 |
|
|
|
|
|
|
|
@@ -768,21 +768,6 @@ class PyBuildExt(build_ext): |
|
|
|
|
|
|
|
print ("warning: openssl 0x%08x is too old for _hashlib" % |
|
|
|
|
|
|
|
openssl_ver) |
|
|
|
|
|
|
|
missing.append('_hashlib') |
|
|
|
|
|
|
|
- if COMPILED_WITH_PYDEBUG or not have_usable_openssl: |
|
|
|
|
|
|
|
- # The _sha module implements the SHA1 hash algorithm. |
|
|
|
|
|
|
|
- exts.append( Extension('_sha', ['shamodule.c']) ) |
|
|
|
|
|
|
|
- # The _md5 module implements the RSA Data Security, Inc. MD5 |
|
|
|
|
|
|
|
- # Message-Digest Algorithm, described in RFC 1321. The |
|
|
|
|
|
|
|
- # necessary files md5.c and md5.h are included here. |
|
|
|
|
|
|
|
- exts.append( Extension('_md5', |
|
|
|
|
|
|
|
- sources = ['md5module.c', 'md5.c'], |
|
|
|
|
|
|
|
- depends = ['md5.h']) ) |
|
|
|
|
|
|
|
- |
|
|
|
|
|
|
|
- min_sha2_openssl_ver = 0x00908000 |
|
|
|
|
|
|
|
- if COMPILED_WITH_PYDEBUG or openssl_ver < min_sha2_openssl_ver: |
|
|
|
|
|
|
|
- # OpenSSL doesn't do these until 0.9.8 so we'll bring our own hash |
|
|
|
|
|
|
|
- exts.append( Extension('_sha256', ['sha256module.c']) ) |
|
|
|
|
|
|
|
- exts.append( Extension('_sha512', ['sha512module.c']) ) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Modules that provide persistent dictionary-like semantics. You will |
|
|
|
|
|
|
|
# probably want to arrange for at least one of them to be available on |
|
|
|
|
|
|
|
|
basebuilder_pel7ppc64lebuilder0
5 years ago