firetv & fix some RDEPEND

2018-12-22 23:43:30 +01:00
parent 5d32761cf4
commit cd26bfb332
16 changed files with 297 additions and 3 deletions
@@ -0,0 +1,4 @@
+AUX rsa-3.2.3-CVE-2016-1494.patch 3843 BLAKE2B 94721282f4079aa0a77813dd8ad1c0aefd0924272d4e2b3e8a6ad745375bafb6b6fe5e50af621232df632a1f2261be097fde92b5ad3f57b74ff7976c22daa9bc SHA512 9150b25bc1a9dacc8eee0fb93d46b9d024c868d540097b9166be9a7879fe116d8fd47cacaaf5614b86cd44e7cd10602a0ad290eb2ef116539683101d4057a231
+DIST rsa-4.0.tar.gz 37385 BLAKE2B 2621ee732f15ea12283b723efb5e88847d3e030e8115bb4a3e986099fc94adc3409202d54b4350b0888deefd8dc801d8d3e57fef9e85f386ead53e4412da6d05 SHA512 e11106741cc4275246c986d39b3f028b5a4df6fbffdd08a78072ac3d3a9a7ade7a39789c504a2705f54d858a9bdbf03981251f32f9c45baba71e4a986e14b24e
+EBUILD rsa-4.0.ebuild 734 BLAKE2B c5a3e8a16df0e3436b23f5e618a9e78c857bc5858fdf0ef4f94b281db019e08e38ba2baad6a80bd595a425d9fd40db0f66b12ff9230f8698a03a3aee1e60987d SHA512 02480e21887fa3b4aac5c10b13eace48d11440fcb668c7cfd9d816ecb3d0a4303c11ac4ed92afbbe8b8c7bf30adcd08d56e2d2c07ee95196788ed896989a88ea
+MISC metadata.xml 316 BLAKE2B fd1e4f7bdee45f5ab99e67cc3918634b9ac5ecfad75167aad5f2ee33cea308f99d8d03aab5b5e0c01e8c1bf41ca8a45f67146c5126f84af4b6d914f58af0ea38 SHA512 4d8c48ae8e4360727f5c4b83e426f42a597a175dfa2a965c9f966e5824a83291c78d3e8e636d21b4f28d73f7e912abc7db1b09078baaa0e3a1b25713abd3d0a1
@@ -0,0 +1,104 @@
+# HG changeset patch
+# User Filippo Valsorda <hi@filippo.io>
+# Date 1450226563 0
+# Node ID 0cbcc529926afd61c6df4f50cfc29971beafd2c2
+# Parent  2baab06c8b867b01ec82b02118d4872a931a0437
+Fix BB'06 attack in verify() by switching from parsing to comparison
+
+diff --git a/rsa/pkcs1.py b/rsa/pkcs1.py
+--- a/rsa/pkcs1.py
+++ b/rsa/pkcs1.py
+@@ -22,10 +22,10 @@
+ At least 8 bytes of random padding is used when encrypting a message. This makes
+ these methods much more secure than the ones in the ``rsa`` module.
+ 
+-WARNING: this module leaks information when decryption or verification fails.
+-The exceptions that are raised contain the Python traceback information, which
+-can be used to deduce where in the process the failure occurred. DO NOT PASS
+-SUCH INFORMATION to your users.
+WARNING: this module leaks information when decryption fails. The exceptions
+that are raised contain the Python traceback information, which can be used to
+deduce where in the process the failure occurred. DO NOT PASS SUCH INFORMATION
+to your users.
+ '''
+ 
+ import hashlib
+@@ -288,37 +288,23 @@
+     :param pub_key: the :py:class:`rsa.PublicKey` of the person signing the message.
+     :raise VerificationError: when the signature doesn't match the message.
+ 
+-    .. warning::
+-
+-        Never display the stack trace of a
+-        :py:class:`rsa.pkcs1.VerificationError` exception. It shows where in
+-        the code the exception occurred, and thus leaks information about the
+-        key. It's only a tiny bit of information, but every bit makes cracking
+-        the keys easier.
+-
+     '''
+     
+-    blocksize = common.byte_size(pub_key.n)
+    keylength = common.byte_size(pub_key.n)
+     encrypted = transform.bytes2int(signature)
+     decrypted = core.decrypt_int(encrypted, pub_key.e, pub_key.n)
+-    clearsig = transform.int2bytes(decrypted, blocksize)
+-
+-    # If we can't find the signature  marker, verification failed.
+-    if clearsig[0:2] != b('\x00\x01'):
+-        raise VerificationError('Verification failed')
+    clearsig = transform.int2bytes(decrypted, keylength)
+     
+-    # Find the 00 separator between the padding and the payload
+-    try:
+-        sep_idx = clearsig.index(b('\x00'), 2)
+-    except ValueError:
+-        raise VerificationError('Verification failed')
+-    
+-    # Get the hash and the hash method
+-    (method_name, signature_hash) = _find_method_hash(clearsig[sep_idx+1:])
+    # Get the hash method
+    method_name = _find_method_hash(clearsig)
+     message_hash = _hash(message, method_name)
+ 
+-    # Compare the real hash to the hash in the signature
+-    if message_hash != signature_hash:
+    # Reconstruct the expected padded hash
+    cleartext = HASH_ASN1[method_name] + message_hash
+    expected = _pad_for_signing(cleartext, keylength)
+
+    # Compare with the signed one
+    if expected != clearsig:
+         raise VerificationError('Verification failed')
+ 
+     return True
+@@ -351,24 +337,20 @@
+     return hasher.digest()
+ 
+ 
+-def _find_method_hash(method_hash):
+-    '''Finds the hash method and the hash itself.
+def _find_method_hash(clearsig):
+    '''Finds the hash method.
+     
+-    :param method_hash: ASN1 code for the hash method concatenated with the
+-        hash itself.
+    :param clearsig: full padded ASN1 and hash.
+     
+-    :return: tuple (method, hash) where ``method`` is the used hash method, and
+-        ``hash`` is the hash itself.
+    :return: the used hash method.
+     
+     :raise VerificationFailed: when the hash method cannot be found
+ 
+     '''
+ 
+     for (hashname, asn1code) in HASH_ASN1.items():
+-        if not method_hash.startswith(asn1code):
+-            continue
+-        
+-        return (hashname, method_hash[len(asn1code):])
+        if asn1code in clearsig:
+            return hashname
+     
+     raise VerificationError('Verification failed')
+ 
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="project">
+    <email>python@gentoo.org</email>
+    <name>Python</name>
+  </maintainer>
+  <upstream>
+    <remote-id type="pypi">rsa</remote-id>
+  </upstream>
+</pkgmetadata>
@@ -0,0 +1,33 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+PYTHON_COMPAT=( python2_7 python3_{4,5,6} pypy )
+
+inherit distutils-r1
+
+DESCRIPTION="Pure-Python RSA implementation"
+HOMEPAGE="https://stuvel.eu/rsa https://pypi.org/project/rsa/"
+SRC_URI="mirror://pypi/${P:0:1}/${PN}/${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+IUSE="test"
+
+RDEPEND="
+	>=dev-python/pyasn1-0.4.4[${PYTHON_USEDEP}]
+	dev-python/traceback2[${PYTHON_USEDEP}]
+	"
+DEPEND="${RDEPEND}
+	>=dev-python/setuptools-0.6.10[${PYTHON_USEDEP}]
+	test? (
+		dev-python/nose[${PYTHON_USEDEP}]
+		dev-python/unittest2[${PYTHON_USEDEP}]
+		)
+	"
+
+python_test() {
+	nosetests --verbose || die
+}