gentoo-overlay/dev-python/elixir/files/elixir-0.7.1-CVE-2012-2146-aes.patch

Upstream patch acquired from
http://sochotni.fedorapeople.org/python-elixir-aes-encryption-addition.patch
Index: elixir/ext/encrypted.py
===================================================================
--- elixir/ext/encrypted.py	(revision 534)
+++ elixir/ext/encrypted.py	(working copy)
@@ -32,7 +32,9 @@
 database row.
 '''
 
-from Crypto.Cipher import Blowfish
+import sys
+import os
+from Crypto.Cipher import Blowfish, AES
 from elixir.statements import Statement
 from sqlalchemy.orm import MapperExtension, EXT_CONTINUE, EXT_STOP
 
@@ -49,7 +51,9 @@
 #
 # encryption and decryption functions
 #
-
+# WARNING!!! Blowfish encryption method is vulnerable to attacks
+# because it doesn't properly use random seed. It is provided just for
+# backward compatibility needed to migrate data. Use AES instead!
 def encrypt_value(value, secret):
     return Blowfish.new(secret, Blowfish.MODE_CFB) \
                    .encrypt(value).encode('string_escape')
@@ -58,14 +62,36 @@
     return Blowfish.new(secret, Blowfish.MODE_CFB) \
                    .decrypt(value.decode('string_escape'))
 
+# Crypto.Cipher.AES is AES128
+def encrypt_value_aes(value, secret):
+    iv = os.urandom(AES.block_size)
 
+    pad_len = AES.block_size - len(value) % AES.block_size
+    padded_value = value + pad_len * chr(pad_len)
+    res = iv + AES.new(secret, AES.MODE_CBC, iv).encrypt(padded_value)
+    return res.encode('string_escape')
+
+def decrypt_value_aes(value, secret):
+    value = value.decode('string_escape')
+    iv = value[:AES.block_size]
+    encrypted = value[AES.block_size:]
+
+    padded_value = AES.new(secret, AES.MODE_CBC, iv).decrypt(encrypted)
+    pad_len = ord(padded_value[-1])
+    assert pad_len >= 1 and pad_len <= AES.block_size
+    return padded_value[:-pad_len]
+
 #
 # acts_as_encrypted statement
 #
 
 class ActsAsEncrypted(object):
 
-    def __init__(self, entity, for_fields=[], with_secret='abcdef'):
+    def __init__(self, entity, for_fields=[], with_secret='abcdef', with_aes=False):
+        if not with_aes:
+            sys.stderr.write("""******* WARNING!!! ********
+Blowfish encryption method is vulnerable to attacks.
+Migrate your data and use with_aes=True\n""")
 
         def perform_encryption(instance, encrypt=True):
             encrypted = getattr(instance, '_elixir_encrypted', None)
@@ -77,9 +103,15 @@
                 instance._elixir_encrypted = encrypt
 
             if encrypt:
-                func = encrypt_value
+                if with_aes:
+                    func = encrypt_value_aes
+                else:
+                    func = encrypt_value
             else:
-                func = decrypt_value
+                if with_aes:
+                    func = decrypt_value_aes
+                else:
+                    func = decrypt_value
 
             for column_name in for_fields:
                 current_value = getattr(instance, column_name)