From 80efddfabbee4cc18e33e40ec61ad1ff47b47a6c Mon Sep 17 00:00:00 2001 From: Leon Anavi Date: Fri, 25 Sep 2020 14:23:21 +0300 Subject: python3-pycrypto: Consolidate in a single file Consolidate inc and bb files into a single bb file. Signed-off-by: Leon Anavi Acked-by: Trevor Gamblin Signed-off-by: Khem Raj --- .../recipes-devtools/python/python-pycrypto.inc | 21 ----- .../python/python-pycrypto/CVE-2013-7459.patch | 98 ---------------------- .../python/python-pycrypto/cross-compiling.patch | 23 ----- .../python/python3-pycrypto/CVE-2013-7459.patch | 98 ++++++++++++++++++++++ .../python/python3-pycrypto/cross-compiling.patch | 23 +++++ .../python/python3-pycrypto_2.6.1.bb | 24 +++++- 6 files changed, 142 insertions(+), 145 deletions(-) delete mode 100644 meta-python/recipes-devtools/python/python-pycrypto.inc delete mode 100644 meta-python/recipes-devtools/python/python-pycrypto/CVE-2013-7459.patch delete mode 100644 meta-python/recipes-devtools/python/python-pycrypto/cross-compiling.patch create mode 100644 meta-python/recipes-devtools/python/python3-pycrypto/CVE-2013-7459.patch create mode 100644 meta-python/recipes-devtools/python/python3-pycrypto/cross-compiling.patch (limited to 'meta-python/recipes-devtools/python') diff --git a/meta-python/recipes-devtools/python/python-pycrypto.inc b/meta-python/recipes-devtools/python/python-pycrypto.inc deleted file mode 100644 index 232cdb7116..0000000000 --- a/meta-python/recipes-devtools/python/python-pycrypto.inc +++ /dev/null @@ -1,21 +0,0 @@ -DESCRIPTION = "Cryptographic modules for Python." -HOMEPAGE = "http://www.pycrypto.org/" -LICENSE = "PSFv2" -LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=35f354d199e8cb7667b059a23578e63d" - -FILESEXTRAPATHS_prepend := "${THISDIR}/python-pycrypto:" - -DEPENDS += " gmp" - -inherit pypi autotools-brokensep - -SRC_URI += "file://cross-compiling.patch \ - file://CVE-2013-7459.patch \ - " - -SRC_URI[md5sum] = "55a61a054aa66812daf5161a0d5d7eda" -SRC_URI[sha256sum] = "f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c" - -do_compile[noexec] = "1" - -BBCLASSEXTEND = "native nativesdk" diff --git a/meta-python/recipes-devtools/python/python-pycrypto/CVE-2013-7459.patch b/meta-python/recipes-devtools/python/python-pycrypto/CVE-2013-7459.patch deleted file mode 100644 index 9006c5c350..0000000000 --- a/meta-python/recipes-devtools/python/python-pycrypto/CVE-2013-7459.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4 Mon Sep 17 00:00:00 2001 -From: Legrandin -Date: Sun, 22 Dec 2013 22:24:46 +0100 -Subject: [PATCH] Throw exception when IV is used with ECB or CTR - -The IV parameter is currently ignored when initializing -a cipher in ECB or CTR mode. - -For CTR mode, it is confusing: it takes some time to see -that a different parameter is needed (the counter). - -For ECB mode, it is outright dangerous. - -This patch forces an exception to be raised. - -Upstream-Status: Backport -[https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4] - -CVE: CVE-2013-7459 - -Signed-off-by: Yi Zhao ---- - lib/Crypto/SelfTest/Cipher/common.py | 31 +++++++++++++++++++++++-------- - src/block_template.c | 11 +++++++++++ - 2 files changed, 34 insertions(+), 8 deletions(-) - -diff --git a/lib/Crypto/SelfTest/Cipher/common.py b/lib/Crypto/SelfTest/Cipher/common.py -index 8bebed9..91ec743 100644 ---- a/lib/Crypto/SelfTest/Cipher/common.py -+++ b/lib/Crypto/SelfTest/Cipher/common.py -@@ -239,19 +239,34 @@ class RoundtripTest(unittest.TestCase): - return """%s .decrypt() output of .encrypt() should not be garbled""" % (self.module_name,) - - def runTest(self): -- for mode in (self.module.MODE_ECB, self.module.MODE_CBC, self.module.MODE_CFB, self.module.MODE_OFB, self.module.MODE_OPENPGP): -+ -+ ## ECB mode -+ mode = self.module.MODE_ECB -+ encryption_cipher = self.module.new(a2b_hex(self.key), mode) -+ ciphertext = encryption_cipher.encrypt(self.plaintext) -+ decryption_cipher = self.module.new(a2b_hex(self.key), mode) -+ decrypted_plaintext = decryption_cipher.decrypt(ciphertext) -+ self.assertEqual(self.plaintext, decrypted_plaintext) -+ -+ ## OPENPGP mode -+ mode = self.module.MODE_OPENPGP -+ encryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv) -+ eiv_ciphertext = encryption_cipher.encrypt(self.plaintext) -+ eiv = eiv_ciphertext[:self.module.block_size+2] -+ ciphertext = eiv_ciphertext[self.module.block_size+2:] -+ decryption_cipher = self.module.new(a2b_hex(self.key), mode, eiv) -+ decrypted_plaintext = decryption_cipher.decrypt(ciphertext) -+ self.assertEqual(self.plaintext, decrypted_plaintext) -+ -+ ## All other non-AEAD modes (but CTR) -+ for mode in (self.module.MODE_CBC, self.module.MODE_CFB, self.module.MODE_OFB): - encryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv) - ciphertext = encryption_cipher.encrypt(self.plaintext) -- -- if mode != self.module.MODE_OPENPGP: -- decryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv) -- else: -- eiv = ciphertext[:self.module.block_size+2] -- ciphertext = ciphertext[self.module.block_size+2:] -- decryption_cipher = self.module.new(a2b_hex(self.key), mode, eiv) -+ decryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv) - decrypted_plaintext = decryption_cipher.decrypt(ciphertext) - self.assertEqual(self.plaintext, decrypted_plaintext) - -+ - class PGPTest(unittest.TestCase): - def __init__(self, module, params): - unittest.TestCase.__init__(self) -diff --git a/src/block_template.c b/src/block_template.c -index c36b316..8746948 100644 ---- a/src/block_template.c -+++ b/src/block_template.c -@@ -170,6 +170,17 @@ ALGnew(PyObject *self, PyObject *args, PyObject *kwdict) - "Key cannot be the null string"); - return NULL; - } -+ if (IVlen != 0 && mode == MODE_ECB) -+ { -+ PyErr_Format(PyExc_ValueError, "ECB mode does not use IV"); -+ return NULL; -+ } -+ if (IVlen != 0 && mode == MODE_CTR) -+ { -+ PyErr_Format(PyExc_ValueError, -+ "CTR mode needs counter parameter, not IV"); -+ return NULL; -+ } - if (IVlen != BLOCK_SIZE && mode != MODE_ECB && mode != MODE_CTR) - { - PyErr_Format(PyExc_ValueError, --- -2.7.4 - diff --git a/meta-python/recipes-devtools/python/python-pycrypto/cross-compiling.patch b/meta-python/recipes-devtools/python/python-pycrypto/cross-compiling.patch deleted file mode 100644 index 712f3e8dde..0000000000 --- a/meta-python/recipes-devtools/python/python-pycrypto/cross-compiling.patch +++ /dev/null @@ -1,23 +0,0 @@ -Index: pycrypto-2.6/setup.py -=================================================================== ---- pycrypto-2.6.orig/setup.py -+++ pycrypto-2.6/setup.py -@@ -271,7 +271,8 @@ class PCTBuildConfigure(Command): - if not os.path.exists("config.status"): - if os.system("chmod 0755 configure") != 0: - raise RuntimeError("chmod error") -- cmd = "sh configure" # we use "sh" here so that it'll work on mingw32 with standard python.org binaries -+ host = os.environ.get("HOST_SYS") -+ cmd = "ac_cv_func_malloc_0_nonnull=yes sh configure --host " + host # we use "sh" here so that it'll work on mingw32 with standard python.org binaries - if self.verbose < 1: - cmd += " -q" - if os.system(cmd) != 0: -@@ -370,7 +371,7 @@ kw = {'name':"pycrypto", - 'ext_modules': plat_ext + [ - # _fastmath (uses GNU mp library) - Extension("Crypto.PublicKey._fastmath", -- include_dirs=['src/','/usr/include/'], -+ include_dirs=['src/'], - libraries=['gmp'], - sources=["src/_fastmath.c"]), - diff --git a/meta-python/recipes-devtools/python/python3-pycrypto/CVE-2013-7459.patch b/meta-python/recipes-devtools/python/python3-pycrypto/CVE-2013-7459.patch new file mode 100644 index 0000000000..9006c5c350 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-pycrypto/CVE-2013-7459.patch @@ -0,0 +1,98 @@ +From 8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4 Mon Sep 17 00:00:00 2001 +From: Legrandin +Date: Sun, 22 Dec 2013 22:24:46 +0100 +Subject: [PATCH] Throw exception when IV is used with ECB or CTR + +The IV parameter is currently ignored when initializing +a cipher in ECB or CTR mode. + +For CTR mode, it is confusing: it takes some time to see +that a different parameter is needed (the counter). + +For ECB mode, it is outright dangerous. + +This patch forces an exception to be raised. + +Upstream-Status: Backport +[https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4] + +CVE: CVE-2013-7459 + +Signed-off-by: Yi Zhao +--- + lib/Crypto/SelfTest/Cipher/common.py | 31 +++++++++++++++++++++++-------- + src/block_template.c | 11 +++++++++++ + 2 files changed, 34 insertions(+), 8 deletions(-) + +diff --git a/lib/Crypto/SelfTest/Cipher/common.py b/lib/Crypto/SelfTest/Cipher/common.py +index 8bebed9..91ec743 100644 +--- a/lib/Crypto/SelfTest/Cipher/common.py ++++ b/lib/Crypto/SelfTest/Cipher/common.py +@@ -239,19 +239,34 @@ class RoundtripTest(unittest.TestCase): + return """%s .decrypt() output of .encrypt() should not be garbled""" % (self.module_name,) + + def runTest(self): +- for mode in (self.module.MODE_ECB, self.module.MODE_CBC, self.module.MODE_CFB, self.module.MODE_OFB, self.module.MODE_OPENPGP): ++ ++ ## ECB mode ++ mode = self.module.MODE_ECB ++ encryption_cipher = self.module.new(a2b_hex(self.key), mode) ++ ciphertext = encryption_cipher.encrypt(self.plaintext) ++ decryption_cipher = self.module.new(a2b_hex(self.key), mode) ++ decrypted_plaintext = decryption_cipher.decrypt(ciphertext) ++ self.assertEqual(self.plaintext, decrypted_plaintext) ++ ++ ## OPENPGP mode ++ mode = self.module.MODE_OPENPGP ++ encryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv) ++ eiv_ciphertext = encryption_cipher.encrypt(self.plaintext) ++ eiv = eiv_ciphertext[:self.module.block_size+2] ++ ciphertext = eiv_ciphertext[self.module.block_size+2:] ++ decryption_cipher = self.module.new(a2b_hex(self.key), mode, eiv) ++ decrypted_plaintext = decryption_cipher.decrypt(ciphertext) ++ self.assertEqual(self.plaintext, decrypted_plaintext) ++ ++ ## All other non-AEAD modes (but CTR) ++ for mode in (self.module.MODE_CBC, self.module.MODE_CFB, self.module.MODE_OFB): + encryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv) + ciphertext = encryption_cipher.encrypt(self.plaintext) +- +- if mode != self.module.MODE_OPENPGP: +- decryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv) +- else: +- eiv = ciphertext[:self.module.block_size+2] +- ciphertext = ciphertext[self.module.block_size+2:] +- decryption_cipher = self.module.new(a2b_hex(self.key), mode, eiv) ++ decryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv) + decrypted_plaintext = decryption_cipher.decrypt(ciphertext) + self.assertEqual(self.plaintext, decrypted_plaintext) + ++ + class PGPTest(unittest.TestCase): + def __init__(self, module, params): + unittest.TestCase.__init__(self) +diff --git a/src/block_template.c b/src/block_template.c +index c36b316..8746948 100644 +--- a/src/block_template.c ++++ b/src/block_template.c +@@ -170,6 +170,17 @@ ALGnew(PyObject *self, PyObject *args, PyObject *kwdict) + "Key cannot be the null string"); + return NULL; + } ++ if (IVlen != 0 && mode == MODE_ECB) ++ { ++ PyErr_Format(PyExc_ValueError, "ECB mode does not use IV"); ++ return NULL; ++ } ++ if (IVlen != 0 && mode == MODE_CTR) ++ { ++ PyErr_Format(PyExc_ValueError, ++ "CTR mode needs counter parameter, not IV"); ++ return NULL; ++ } + if (IVlen != BLOCK_SIZE && mode != MODE_ECB && mode != MODE_CTR) + { + PyErr_Format(PyExc_ValueError, +-- +2.7.4 + diff --git a/meta-python/recipes-devtools/python/python3-pycrypto/cross-compiling.patch b/meta-python/recipes-devtools/python/python3-pycrypto/cross-compiling.patch new file mode 100644 index 0000000000..712f3e8dde --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-pycrypto/cross-compiling.patch @@ -0,0 +1,23 @@ +Index: pycrypto-2.6/setup.py +=================================================================== +--- pycrypto-2.6.orig/setup.py ++++ pycrypto-2.6/setup.py +@@ -271,7 +271,8 @@ class PCTBuildConfigure(Command): + if not os.path.exists("config.status"): + if os.system("chmod 0755 configure") != 0: + raise RuntimeError("chmod error") +- cmd = "sh configure" # we use "sh" here so that it'll work on mingw32 with standard python.org binaries ++ host = os.environ.get("HOST_SYS") ++ cmd = "ac_cv_func_malloc_0_nonnull=yes sh configure --host " + host # we use "sh" here so that it'll work on mingw32 with standard python.org binaries + if self.verbose < 1: + cmd += " -q" + if os.system(cmd) != 0: +@@ -370,7 +371,7 @@ kw = {'name':"pycrypto", + 'ext_modules': plat_ext + [ + # _fastmath (uses GNU mp library) + Extension("Crypto.PublicKey._fastmath", +- include_dirs=['src/','/usr/include/'], ++ include_dirs=['src/'], + libraries=['gmp'], + sources=["src/_fastmath.c"]), + diff --git a/meta-python/recipes-devtools/python/python3-pycrypto_2.6.1.bb b/meta-python/recipes-devtools/python/python3-pycrypto_2.6.1.bb index a20eafec43..78a1ef2ac0 100644 --- a/meta-python/recipes-devtools/python/python3-pycrypto_2.6.1.bb +++ b/meta-python/recipes-devtools/python/python3-pycrypto_2.6.1.bb @@ -1,7 +1,23 @@ -inherit distutils3 -require python-pycrypto.inc +DESCRIPTION = "Cryptographic modules for Python." +HOMEPAGE = "http://www.pycrypto.org/" +LICENSE = "PSFv2" +LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=35f354d199e8cb7667b059a23578e63d" -SRC_URI += "file://0001-Replace-time.clock-with-time.process_time.patch" +DEPENDS += " gmp" + +export HOST_SYS + +inherit pypi autotools-brokensep distutils3 + +SRC_URI += "file://cross-compiling.patch \ + file://CVE-2013-7459.patch \ + file://0001-Replace-time.clock-with-time.process_time.patch \ + " + +SRC_URI[md5sum] = "55a61a054aa66812daf5161a0d5d7eda" +SRC_URI[sha256sum] = "f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c" + +do_compile[noexec] = "1" # We explicitly call distutils_do_install, since we want it to run, but # *don't* want the autotools install to run, since this package doesn't @@ -9,3 +25,5 @@ SRC_URI += "file://0001-Replace-time.clock-with-time.process_time.patch" do_install() { distutils3_do_install } + +BBCLASSEXTEND = "native nativesdk" -- cgit v1.2.3-54-g00ecf