I don't really see what the advantage of a CryptError is. It seems to me
that the result of that is that a user might try to handle it, when there's
no sane way to handle it in the general case because it could mean
*anything*. I'm good to add the reason string to the message though.


On Fri, Nov 22, 2013 at 2:29 PM, Paul Kehrer <notifications@github.com>wrote:

> In cryptography/hazmat/bindings/openssl/backend.py:
>
> > @@ -193,6 +193,24 @@ def create_symmetric_encryption_ctx(self, cipher, mode):
> >      def create_symmetric_decryption_ctx(self, cipher, mode):
> >          return _CipherContext(self, cipher, mode, _CipherContext._DECRYPT)
> >
> > +    def _handle_error(self):
> > +        code = self.lib.ERR_get_error()
> > +        assert code != 0
> > +        lib = self.lib.ERR_GET_LIB(code)
> > +        func = self.lib.ERR_GET_FUNC(code)
> > +        reason = self.lib.ERR_GET_REASON(code)
> > +
> > +        if lib == self.lib.ERR_LIB_EVP:
> > +            if func == self.lib.EVP_F_EVP_ENCRYPTFINAL_EX:
> > +                if reason == self.lib.EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH:
> > +                    raise IncorrectPadding
> > +            elif func == self.lib.EVP_F_EVP_DECRYPTFINAL_EX:
> > +                if reason == self.lib.EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH:
> > +                    raise IncorrectPadding
> > +        raise SystemError(
>
> As mentioned on IRC, I'd prefer the fallback to be a generic CryptError
> (or some better name) that gets the ERR_reason_error_string if available.
>
>     def _handle_error(self):
>         code = self.lib.ERR_get_error()
>         lib = self.lib.ERR_GET_LIB(code)
>         func = self.lib.ERR_GET_FUNC(code)
>         reason = self.lib.ERR_GET_REASON(code)
>
>         if lib == self.lib.ERR_LIB_EVP:
>             if func == self.lib.EVP_F_EVP_ENCRYPTFINAL_EX:
>                 if reason == self.lib.EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH:
>                     raise IncorrectPadding
>             elif func == self.lib.EVP_F_EVP_DECRYPTFINAL_EX:
>                 if reason == self.lib.EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH:
>                     raise IncorrectPadding
>         if code:
>             reason_string = self.ffi.string(
>                 self.lib.ERR_reason_error_string(code)
>             )
>         else:
>             reason_string = None
>         raise CryptError(reason_string)
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/pyca/cryptography/pull/274/files#r7870964>
> .
>



-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: 125F 5C67 DFE9 4084