Repository: pyca/cryptography

Issue:
Replace use of manual openssl version checks with our constants
- https://github.com/pyca/cryptography/blob/master/src/cryptography/hazmat/backends/openssl/ciphers.py#L82
- https://github.com/pyca/cryptography/blob/master/src/cryptography/hazmat/backends/openssl/ciphers.py#L145
- https://github.com/pyca/cryptography/blob/master/src/cryptography/hazmat/primitives/ciphers/base.py#L225
- https://github.com/pyca/cryptography/blob/master/tests/hazmat/primitives/test_aes.py#L321
- https://github.com/pyca/cryptography/blob/master/tests/hazmat/primitives/test_aes.py#L375
- https://github.com/pyca/cryptography/blob/master/tests/hazmat/primitives/test_aes.py#L396

These should use one of these constants: https://github.com/pyca/cryptography/blob/master/src/_cffi_src/openssl/cryptography.py#L28-L46


Discussion:

Resolving patch:
diff --git a/src/_cffi_src/openssl/cryptography.py b/src/_cffi_src/openssl/cryptography.py
--- a/src/_cffi_src/openssl/cryptography.py
+++ b/src/_cffi_src/openssl/cryptography.py
@@ -51,6 +51,8 @@
 
 static const int CRYPTOGRAPHY_OPENSSL_LESS_THAN_102I;
 
+static const int CRYPTOGRAPHY_OPENSSL_LESS_THAN_102;
+
 static const int CRYPTOGRAPHY_IS_LIBRESSL;
 """
 
diff --git a/src/cryptography/hazmat/backends/openssl/ciphers.py b/src/cryptography/hazmat/backends/openssl/ciphers.py
--- a/src/cryptography/hazmat/backends/openssl/ciphers.py
+++ b/src/cryptography/hazmat/backends/openssl/ciphers.py
@@ -78,8 +78,11 @@ def __init__(self, backend, cipher, mode, operation):
                 len(iv_nonce), self._backend._ffi.NULL
             )
             self._backend.openssl_assert(res != 0)
-            if operation == self._DECRYPT and \
-                    self._backend.openssl_version_number() < 0x10002000:
+            if (
+                self._operation == self._DECRYPT and
+                self._backend._lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_102 and
+                not self._backend._lib.CRYPTOGRAPHY_IS_LIBRESSL
+            ):
                 if mode.tag is None:
                     raise NotImplementedError(
                         "delayed passing of GCM tag requires OpenSSL >= 1.0.2."
@@ -140,9 +143,14 @@ def finalize(self):
         if isinstance(self._mode, modes.GCM):
             self.update(b"")
 
-        if self._operation == self._DECRYPT and \
-                isinstance(self._mode, modes.ModeWithAuthenticationTag) and \
-                self._backend.openssl_version_number() >= 0x10002000:
+        if (
+            self._operation == self._DECRYPT and
+            isinstance(self._mode, modes.ModeWithAuthenticationTag) and
+            (
+                not self._backend._lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_102 or
+                self._backend._lib.CRYPTOGRAPHY_IS_LIBRESSL
+            )
+        ):
             tag = self._mode.tag
             if tag is None:
                 raise ValueError(
diff --git a/src/cryptography/hazmat/primitives/ciphers/base.py b/src/cryptography/hazmat/primitives/ciphers/base.py
--- a/src/cryptography/hazmat/primitives/ciphers/base.py
+++ b/src/cryptography/hazmat/primitives/ciphers/base.py
@@ -221,8 +221,11 @@ def finalize(self):
         return data
 
     def finalize_with_tag(self, tag):
-        if self._ctx._backend.name == "openssl" and \
-                self._ctx._backend.openssl_version_number() < 0x10002000:
+        if (
+            self._ctx._backend.name == "openssl" and
+            self._ctx._backend._lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_102 and
+            not self._ctx._backend._lib.CRYPTOGRAPHY_IS_LIBRESSL
+        ):
             raise NotImplementedError(
                 "finalize_with_tag requires OpenSSL >= 1.0.2. To use this "
                 "method please update OpenSSL"


Test patch:
diff --git a/tests/hazmat/primitives/test_aes.py b/tests/hazmat/primitives/test_aes.py
--- a/tests/hazmat/primitives/test_aes.py
+++ b/tests/hazmat/primitives/test_aes.py
@@ -317,8 +317,11 @@ def test_gcm_tag_decrypt_none(self, backend):
         encryptor.authenticate_additional_data(aad)
         encryptor.finalize()
 
-        if backend.name == "openssl" and \
-                backend.openssl_version_number() < 0x10002000:
+        if (
+            backend.name == "openssl" and
+            backend._lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_102 and
+            not backend._lib.CRYPTOGRAPHY_IS_LIBRESSL
+        ):
             with pytest.raises(NotImplementedError):
                 decryptor = base.Cipher(
                     algorithms.AES(key),
@@ -371,8 +374,11 @@ def test_gcm_tag_decrypt_finalize(self, backend):
         encryptor.finalize()
         tag = encryptor.tag
 
-        if backend.name == "openssl" and \
-                backend.openssl_version_number() < 0x10002000:
+        if (
+            backend.name == "openssl" and
+            backend._lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_102 and
+            not backend._lib.CRYPTOGRAPHY_IS_LIBRESSL
+        ):
             with pytest.raises(NotImplementedError):
                 decryptor = base.Cipher(
                     algorithms.AES(key),
@@ -392,8 +398,11 @@ def test_gcm_tag_decrypt_finalize(self, backend):
             ).decryptor()
         decryptor.authenticate_additional_data(aad)
 
-        if backend.name == "openssl" and \
-                backend.openssl_version_number() < 0x10002000:
+        if (
+            backend.name == "openssl" and
+            backend._lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_102 and
+            not backend._lib.CRYPTOGRAPHY_IS_LIBRESSL
+        ):
             with pytest.raises(NotImplementedError):
                 decryptor.finalize_with_tag(tag)
             decryptor.finalize()