Skip to content

Commit b92c841

Browse files
alexreaperhulkdependabot[bot]
authored
[44.0.x] backports for libressl 4.1.0 support release (#12848)
* FIPS fixes (#12839) * attempt to fix wycheproof in CI on centos stream9 skip RSA PSS with SHA224 * Update test_rsa.py * Update backend.py * fix * make OpenSSL 3.5 FIPS work This replaces the rsa_pss_cert.pem with a new one that uses a salt length matching the digest length (previously it was max length) * simplify * comment * fix * update with new wycheproof --------- Co-authored-by: Alex Gaynor <[email protected]> * chore(deps): bump openssl-sys from 0.9.107 to 0.9.108 (#12832) Bumps [openssl-sys](https://github.com/sfackler/rust-openssl) from 0.9.107 to 0.9.108. - [Release notes](https://github.com/sfackler/rust-openssl/releases) - [Commits](sfackler/rust-openssl@openssl-sys-v0.9.107...openssl-sys-v0.9.108) --- updated-dependencies: - dependency-name: openssl-sys dependency-version: 0.9.108 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * test on libressl 4.1.0 (#12845) * 44.0.3 release * Make wycheproof x25519 and x448 tests more flexible (#12676) * Update test_x448.py * Update test_x25519.py * Update test_x25519.py * Update test_x448.py * fix mitmproxy downstream tests (#12776) * clippy nightly fixes --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Paul Kehrer <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 parent 387ca00 commit b92c841

File tree

57 files changed

+244
-227
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

57 files changed

+244
-227
lines changed

‎.github/actions/fetch-vectors/action.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ runs:
99
with:
1010
repository: "C2SP/wycheproof"
1111
path: "wycheproof"
12-
# Latest commit on the wycheproof master branch, as of Apr 09, 2024.
13-
ref: "cd27d6419bedd83cbd24611ec54b6d4bfdb0cdca" # wycheproof-ref
12+
# Latest commit on the wycheproof master branch, as of May 02, 2025.
13+
ref: "df4e933efef449fc88af0c06e028d425d84a9495" # wycheproof-ref
1414

1515
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1616
with:

‎.github/downstream.d/mitmproxy.sh

+2-1
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@
22

33
case "${1}" in
44
install)
5+
pip install uv
56
git clone --depth=1 https://github.com/mitmproxy/mitmproxy
67
cd mitmproxy
78
git rev-parse HEAD
8-
pip install -e ".[dev]"
9+
uv pip install --system --group dev -e .
910
;;
1011
run)
1112
cd mitmproxy

‎.github/workflows/ci.yml

+2
Original file line numberDiff line numberDiff line change
@@ -42,9 +42,11 @@ jobs:
4242
- {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.2.3", CONFIG_FLAGS: "no-legacy", NO_LEGACY: "1"}}
4343
- {VERSION: "3.12", NOXSESSION: "tests", NOXARGS: "--enable-fips=1", OPENSSL: {TYPE: "openssl", CONFIG_FLAGS: "enable-fips", VERSION: "3.1.7"}}
4444
- {VERSION: "3.12", NOXSESSION: "tests", NOXARGS: "--enable-fips=1", OPENSSL: {TYPE: "openssl", CONFIG_FLAGS: "enable-fips", VERSION: "3.2.3"}}
45+
- {VERSION: "3.12", NOXSESSION: "tests", NOXARGS: "--enable-fips=1", OPENSSL: {TYPE: "openssl", CONFIG_FLAGS: "enable-fips", VERSION: "3.5.0"}}
4546
- {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.4.0"}}
4647
- {VERSION: "3.12", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "libressl", VERSION: "3.9.2"}}
4748
- {VERSION: "3.12", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "libressl", VERSION: "4.0.0"}}
49+
- {VERSION: "3.12", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "libressl", VERSION: "4.1.0"}}
4850
- {VERSION: "3.12", NOXSESSION: "tests-randomorder"}
4951
# Latest commit on the BoringSSL master branch, as of Nov 27, 2024.
5052
- {VERSION: "3.12", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "boringssl", VERSION: "fcef13a49852397a0d39c00be8d7bc2ba1ab6fb9"}}

‎CHANGELOG.rst

+7
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
Changelog
22
=========
33

4+
.. _v44-0-3:
5+
6+
44.0.3 - 2025-05-02
7+
~~~~~~~~~~~~~~~~~~~
8+
9+
* Fixed compilation when using LibreSSL 4.1.0.
10+
411
.. _v44-0-2:
512

613
44.0.2 - 2025-03-01

‎Cargo.lock

+2-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml

+2
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ rust-version = "1.65.0"
2121
[workspace.dependencies]
2222
asn1 = { version = "0.20.0", default-features = false }
2323
pyo3 = { version = "0.23.5", features = ["abi3"] }
24+
openssl = "0.10.72"
25+
openssl-sys = "0.9.108"
2426

2527
[profile.release]
2628
overflow-checks = true

‎pyproject.toml

+2-2
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ build-backend = "maturin"
1414

1515
[project]
1616
name = "cryptography"
17-
version = "44.0.2"
17+
version = "44.0.3"
1818
authors = [
1919
{name = "The Python Cryptographic Authority and individual contributors", email = "[email protected]"}
2020
]
@@ -65,7 +65,7 @@ ssh = ["bcrypt >=3.1.5"]
6565
# All the following are used for our own testing.
6666
nox = ["nox >=2024.04.15", "nox[uv] >=2024.03.02; python_version >= '3.8'"]
6767
test = [
68-
"cryptography_vectors==44.0.2",
68+
"cryptography_vectors==44.0.3",
6969
"pytest >=7.4.0",
7070
"pytest-benchmark >=4.0",
7171
"pytest-cov >=2.10.1",

‎src/cryptography/__about__.py

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"__version__",
1111
]
1212

13-
__version__ = "44.0.2"
13+
__version__ = "44.0.3"
1414

1515

1616
__author__ = "The Python Cryptographic Authority and individual contributors"

‎src/cryptography/hazmat/backends/openssl/backend.py

+10-7
Original file line numberDiff line numberDiff line change
@@ -169,14 +169,17 @@ def rsa_padding_supported(self, padding: AsymmetricPadding) -> bool:
169169
if isinstance(padding, PKCS1v15):
170170
return True
171171
elif isinstance(padding, PSS) and isinstance(padding._mgf, MGF1):
172-
# SHA1 is permissible in MGF1 in FIPS even when SHA1 is blocked
173-
# as signature algorithm.
174-
if self._fips_enabled and isinstance(
175-
padding._mgf._algorithm, hashes.SHA1
172+
# FIPS 186-4 only allows salt length == digest length for PSS
173+
# It is technically acceptable to set an explicit salt length
174+
# equal to the digest length and this will incorrectly fail, but
175+
# since we don't do that in the tests and this method is
176+
# private, we'll ignore that until we need to do otherwise.
177+
if (
178+
self._fips_enabled
179+
and padding._salt_length != PSS.DIGEST_LENGTH
176180
):
177-
return True
178-
else:
179-
return self.hash_supported(padding._mgf._algorithm)
181+
return False
182+
return self.hash_supported(padding._mgf._algorithm)
180183
elif isinstance(padding, OAEP) and isinstance(padding._mgf, MGF1):
181184
return self._oaep_hash_supported(
182185
padding._mgf._algorithm

‎src/rust/cryptography-cffi/build.rs

+1-1
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ fn main() {
7171
// This is because we don't want a potentially random build path to end up in the binary because
7272
// CFFI generated code uses the __FILE__ macro in its debug messages.
7373
if let Some(out_dir_str) = Path::new(&out_dir).to_str() {
74-
build.flag_if_supported(format!("-fmacro-prefix-map={}=.", out_dir_str).as_str());
74+
build.flag_if_supported(format!("-fmacro-prefix-map={out_dir_str}").as_str());
7575
}
7676

7777
for python_include in env::split_paths(&python_includes) {

‎src/rust/cryptography-keepalive/src/lib.rs

+2-1
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,11 @@
44

55
#![deny(rust_2018_idioms, clippy::undocumented_unsafe_blocks)]
66

7-
use pyo3::pybacked::{PyBackedBytes, PyBackedStr};
87
use std::cell::UnsafeCell;
98
use std::ops::Deref;
109

10+
use pyo3::pybacked::{PyBackedBytes, PyBackedStr};
11+
1112
pub struct KeepAlive<T: StableDeref> {
1213
values: UnsafeCell<Vec<T>>,
1314
}

‎src/rust/cryptography-openssl/src/aead.rs

+2-1
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,10 @@
22
// 2.0, and the BSD License. See the LICENSE file in the root of this repository
33
// for complete details.
44

5-
use crate::{cvt, cvt_p, OpenSSLResult};
65
use foreign_types_shared::{ForeignType, ForeignTypeRef};
76

7+
use crate::{cvt, cvt_p, OpenSSLResult};
8+
89
pub enum AeadType {
910
ChaCha20Poly1305,
1011
}

‎src/rust/cryptography-openssl/src/fips.rs

+3-2
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,15 @@
22
// 2.0, and the BSD License. See the LICENSE file in the root of this repository
33
// for complete details.
44

5-
#[cfg(CRYPTOGRAPHY_OPENSSL_300_OR_GREATER)]
6-
use crate::{cvt, OpenSSLResult};
75
#[cfg(all(
86
CRYPTOGRAPHY_OPENSSL_300_OR_GREATER,
97
not(any(CRYPTOGRAPHY_IS_LIBRESSL, CRYPTOGRAPHY_IS_BORINGSSL))
108
))]
119
use std::ptr;
1210

11+
#[cfg(CRYPTOGRAPHY_OPENSSL_300_OR_GREATER)]
12+
use crate::{cvt, OpenSSLResult};
13+
1314
pub fn is_enabled() -> bool {
1415
cfg_if::cfg_if! {
1516
if #[cfg(any(CRYPTOGRAPHY_IS_LIBRESSL, CRYPTOGRAPHY_IS_BORINGSSL))] {

‎src/rust/cryptography-x509-verification/src/lib.rs

+8-12
Original file line numberDiff line numberDiff line change
@@ -16,21 +16,19 @@ use std::fmt::Display;
1616
use std::vec;
1717

1818
use asn1::ObjectIdentifier;
19-
use cryptography_x509::extensions::{DuplicateExtensionsError, Extensions};
20-
use cryptography_x509::{
21-
common::Asn1Read,
22-
extensions::{NameConstraints, SubjectAlternativeName},
23-
name::GeneralName,
24-
oid::{NAME_CONSTRAINTS_OID, SUBJECT_ALTERNATIVE_NAME_OID},
19+
use cryptography_x509::common::Asn1Read;
20+
use cryptography_x509::extensions::{
21+
DuplicateExtensionsError, Extensions, NameConstraints, SubjectAlternativeName,
2522
};
23+
use cryptography_x509::name::GeneralName;
24+
use cryptography_x509::oid::{NAME_CONSTRAINTS_OID, SUBJECT_ALTERNATIVE_NAME_OID};
2625
use types::{RFC822Constraint, RFC822Name};
2726

2827
use crate::certificate::cert_is_self_issued;
2928
use crate::ops::{CryptoOps, VerificationCertificate};
3029
use crate::policy::Policy;
3130
use crate::trust_store::Store;
32-
use crate::types::DNSName;
33-
use crate::types::{DNSConstraint, IPAddress, IPConstraint};
31+
use crate::types::{DNSConstraint, DNSName, IPAddress, IPConstraint};
3432
use crate::ApplyNameConstraintStatus::{Applied, Skipped};
3533

3634
pub enum ValidationErrorKind<'chain, B: CryptoOps> {
@@ -175,12 +173,10 @@ impl<'a, 'chain> NameChain<'a, 'chain> {
175173
) {
176174
(Some(pattern), Some(name)) => Ok(Applied(pattern.matches(&name))),
177175
(_, None) => Err(ValidationError::new(ValidationErrorKind::Other(format!(
178-
"unsatisfiable IP name constraint: malformed SAN {:?}",
179-
name,
176+
"unsatisfiable IP name constraint: malformed SAN {name:?}",
180177
)))),
181178
(None, _) => Err(ValidationError::new(ValidationErrorKind::Other(format!(
182-
"malformed IP name constraints: {:?}",
183-
pattern
179+
"malformed IP name constraints: {pattern:?}",
184180
)))),
185181
}
186182
}

‎src/rust/cryptography-x509-verification/src/ops.rs

+2-1
Original file line numberDiff line numberDiff line change
@@ -90,9 +90,10 @@ pub trait CryptoOps {
9090

9191
#[cfg(test)]
9292
pub(crate) mod tests {
93+
use cryptography_x509::certificate::Certificate;
94+
9395
use super::VerificationCertificate;
9496
use crate::certificate::tests::PublicKeyErrorOps;
95-
use cryptography_x509::certificate::Certificate;
9697

9798
pub(crate) fn v1_cert_pem() -> pem::Pem {
9899
pem::parse(

‎src/rust/cryptography-x509-verification/src/policy/extension.rs

+23-37
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,17 @@
22
// 2.0, and the BSD License. See the LICENSE file in the root of this repository
33
// for complete details.
44

5+
use cryptography_x509::certificate::Certificate;
6+
use cryptography_x509::extensions::{Extension, Extensions};
57
use cryptography_x509::oid::{
68
AUTHORITY_INFORMATION_ACCESS_OID, AUTHORITY_KEY_IDENTIFIER_OID, BASIC_CONSTRAINTS_OID,
79
EXTENDED_KEY_USAGE_OID, KEY_USAGE_OID, NAME_CONSTRAINTS_OID, SUBJECT_ALTERNATIVE_NAME_OID,
810
SUBJECT_KEY_IDENTIFIER_OID,
911
};
10-
use cryptography_x509::{
11-
certificate::Certificate,
12-
extensions::{Extension, Extensions},
13-
};
1412

15-
use crate::{
16-
ops::CryptoOps, policy::Policy, ValidationError, ValidationErrorKind, ValidationResult,
17-
};
13+
use crate::ops::CryptoOps;
14+
use crate::policy::Policy;
15+
use crate::{ValidationError, ValidationErrorKind, ValidationResult};
1816

1917
pub(crate) struct ExtensionPolicy<B: CryptoOps> {
2018
pub(crate) authority_information_access: ExtensionValidator<B>,
@@ -266,17 +264,13 @@ impl<B: CryptoOps> ExtensionValidator<B> {
266264
}
267265

268266
pub(crate) mod ee {
269-
use cryptography_x509::{
270-
certificate::Certificate,
271-
extensions::{
272-
BasicConstraints, ExtendedKeyUsage, Extension, KeyUsage, SubjectAlternativeName,
273-
},
267+
use cryptography_x509::certificate::Certificate;
268+
use cryptography_x509::extensions::{
269+
BasicConstraints, ExtendedKeyUsage, Extension, KeyUsage, SubjectAlternativeName,
274270
};
275271

276-
use crate::{
277-
ops::CryptoOps,
278-
policy::{Policy, ValidationError, ValidationErrorKind, ValidationResult},
279-
};
272+
use crate::ops::CryptoOps;
273+
use crate::policy::{Policy, ValidationError, ValidationErrorKind, ValidationResult};
280274

281275
pub(crate) fn basic_constraints<'chain, B: CryptoOps>(
282276
_policy: &Policy<'_, B>,
@@ -379,20 +373,16 @@ pub(crate) mod ee {
379373
}
380374

381375
pub(crate) mod ca {
382-
use cryptography_x509::{
383-
certificate::Certificate,
384-
common::Asn1Read,
385-
extensions::{
386-
AuthorityKeyIdentifier, BasicConstraints, ExtendedKeyUsage, Extension, KeyUsage,
387-
NameConstraints,
388-
},
389-
oid::EKU_ANY_KEY_USAGE_OID,
376+
use cryptography_x509::certificate::Certificate;
377+
use cryptography_x509::common::Asn1Read;
378+
use cryptography_x509::extensions::{
379+
AuthorityKeyIdentifier, BasicConstraints, ExtendedKeyUsage, Extension, KeyUsage,
380+
NameConstraints,
390381
};
382+
use cryptography_x509::oid::EKU_ANY_KEY_USAGE_OID;
391383

392-
use crate::{
393-
ops::CryptoOps,
394-
policy::{Policy, ValidationError, ValidationErrorKind, ValidationResult},
395-
};
384+
use crate::ops::CryptoOps;
385+
use crate::policy::{Policy, ValidationError, ValidationErrorKind, ValidationResult};
396386

397387
pub(crate) fn authority_key_identifier<'chain, B: CryptoOps>(
398388
_policy: &Policy<'_, B>,
@@ -529,16 +519,12 @@ pub(crate) mod ca {
529519
}
530520

531521
pub(crate) mod common {
532-
use cryptography_x509::{
533-
certificate::Certificate,
534-
common::Asn1Read,
535-
extensions::{Extension, SequenceOfAccessDescriptions},
536-
};
522+
use cryptography_x509::certificate::Certificate;
523+
use cryptography_x509::common::Asn1Read;
524+
use cryptography_x509::extensions::{Extension, SequenceOfAccessDescriptions};
537525

538-
use crate::{
539-
ops::CryptoOps,
540-
policy::{Policy, ValidationResult},
541-
};
526+
use crate::ops::CryptoOps;
527+
use crate::policy::{Policy, ValidationResult};
542528

543529
pub(crate) fn authority_information_access<'chain, B: CryptoOps>(
544530
_policy: &Policy<'_, B>,

‎src/rust/cryptography-x509-verification/src/policy/mod.rs

+6-10
Original file line numberDiff line numberDiff line change
@@ -601,24 +601,20 @@ mod tests {
601601

602602
use asn1::{DateTime, SequenceOfWriter};
603603
use cryptography_x509::common::Time;
604-
use cryptography_x509::{
605-
extensions::SubjectAlternativeName,
606-
name::{GeneralName, UnvalidatedIA5String},
607-
};
604+
use cryptography_x509::extensions::SubjectAlternativeName;
605+
use cryptography_x509::name::{GeneralName, UnvalidatedIA5String};
608606

609607
use super::{
610608
permits_validity_date, ECDSA_SHA256, ECDSA_SHA384, ECDSA_SHA512, RSASSA_PKCS1V15_SHA256,
611609
RSASSA_PKCS1V15_SHA384, RSASSA_PKCS1V15_SHA512, RSASSA_PSS_SHA256, RSASSA_PSS_SHA384,
612610
RSASSA_PSS_SHA512, WEBPKI_PERMITTED_SIGNATURE_ALGORITHMS,
613611
};
614612
use crate::certificate::tests::PublicKeyErrorOps;
615-
use crate::{
616-
policy::{
617-
Subject, SPKI_RSA, SPKI_SECP256R1, SPKI_SECP384R1, SPKI_SECP521R1,
618-
WEBPKI_PERMITTED_SPKI_ALGORITHMS,
619-
},
620-
types::{DNSName, IPAddress},
613+
use crate::policy::{
614+
Subject, SPKI_RSA, SPKI_SECP256R1, SPKI_SECP384R1, SPKI_SECP521R1,
615+
WEBPKI_PERMITTED_SPKI_ALGORITHMS,
621616
};
617+
use crate::types::{DNSName, IPAddress};
622618

623619
#[test]
624620
fn test_webpki_permitted_spki_algorithms_canonical_encodings() {

‎src/rust/cryptography-x509-verification/src/trust_store.rs

+1-2
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@ use std::collections::HashMap;
66

77
use cryptography_x509::name::Name;
88

9-
use crate::CryptoOps;
10-
use crate::VerificationCertificate;
9+
use crate::{CryptoOps, VerificationCertificate};
1110

1211
/// A `Store` represents the core state needed for X.509 path validation.
1312
pub struct Store<'a, B: CryptoOps> {

‎src/rust/cryptography-x509-verification/src/types.rs

+1-2
Original file line numberDiff line numberDiff line change
@@ -400,9 +400,8 @@ impl<'a> RFC822Constraint<'a> {
400400

401401
#[cfg(test)]
402402
mod tests {
403-
use crate::types::{DNSConstraint, DNSName, DNSPattern, IPAddress, IPConstraint, RFC822Name};
404-
405403
use super::RFC822Constraint;
404+
use crate::types::{DNSConstraint, DNSName, DNSPattern, IPAddress, IPConstraint, RFC822Name};
406405

407406
#[test]
408407
fn test_dnsname_debug_trait() {

‎src/rust/cryptography-x509/src/certificate.rs

+2-5
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,9 @@
22
// 2.0, and the BSD License. See the LICENSE file in the root of this repository
33
// for complete details.
44

5-
use crate::common;
6-
use crate::extensions;
7-
use crate::extensions::DuplicateExtensionsError;
8-
use crate::extensions::Extensions;
9-
use crate::name;
5+
use crate::extensions::{DuplicateExtensionsError, Extensions};
106
use crate::name::NameReadable;
7+
use crate::{common, extensions, name};
118

129
#[derive(asn1::Asn1Read, asn1::Asn1Write, Hash, PartialEq, Eq, Clone)]
1310
pub struct Certificate<'a> {

0 commit comments

Comments
 (0)