feature gate aes decryption

Cargo.toml

@@ -11,15 +11,15 @@ Library to support the reading and writing of zip files.
 edition = "2018"
 
 [dependencies]
-aes = "0.5.0"
+aes = { version = "0.5.0", optional = true }
 byteorder = "1.3"
 bzip2 = { version = "0.4", optional = true }
-constant_time_eq = "0.1.5"
+constant_time_eq = { version = "0.1.5", optional = true }
 crc32fast = "1.0"
 flate2 = { version = "1.0.0", default-features = false, optional = true }
-hmac = "0.9.0"
+hmac = {version = "0.9.0", optional = true }
-pbkdf2 = "0.5.0"
+pbkdf2 = {version = "0.5.0", optional = true }
-sha-1 = "0.9.1"
+sha-1 = {version = "0.9.1", optional = true }
 thiserror = "1.0"
 time = { version = "0.1", optional = true }
 
@@ -29,6 +29,7 @@ rand = "0.7"
 walkdir = "2"
 
 [features]
+aes-crypto = [ "aes", "constant_time_eq", "hmac", "pbkdf2", "sha-1" ]
 deflate = ["flate2/rust_backend"]
 deflate-miniz = ["flate2/default"]
 deflate-zlib = ["flate2/zlib"]

src/aes.rs

@@ -1,5 +1,4 @@
 use crate::aes_ctr;
-use crate::types::AesMode;
 use constant_time_eq::constant_time_eq;
 use hmac::{Hmac, Mac, NewMac};
 use sha1::Sha1;
@@ -23,7 +22,38 @@ fn cipher_from_mode(aes_mode: AesMode, key: &[u8]) -> Box<dyn aes_ctr::AesCipher
     }
 }
 
-// an aes encrypted file starts with a salt, whose length depends on the used aes mode
+#[cfg(feature = "aes-crypto")]
+#[derive(Copy, Clone, Debug)]
+pub enum AesVendorVersion {
+    Ae1,
+    Ae2,
+}
+
+#[cfg(feature = "aes-crypto")]
+/// AES variant used.
+#[derive(Copy, Clone, Debug)]
+pub enum AesMode {
+    Aes128,
+    Aes192,
+    Aes256,
+}
+
+#[cfg(feature = "aes-crypto")]
+impl AesMode {
+    pub fn salt_length(&self) -> usize {
+        self.key_length() / 2
+    }
+
+    pub fn key_length(&self) -> usize {
+        match self {
+            Self::Aes128 => 16,
+            Self::Aes192 => 24,
+            Self::Aes256 => 32,
+        }
+    }
+}
+
+// An aes encrypted file starts with a salt, whose length depends on the used aes mode
 // followed by a 2 byte password verification value
 // then the variable length encrypted data
 // and lastly a 10 byte authentication code

src/aes_ctr.rs

@@ -152,7 +152,6 @@ mod tests {
             0x18, 0x55, 0x24, 0xa3, 0x9e, 0x0e, 0x40, 0xe7, 0x92, 0xad, 0xb2, 0x8a, 0x48, 0xf4,
             0x5c, 0xd0, 0xc0, 0x54,
         ];
-        eprintln!("{}", key.len());
 
         let mut key_stream = AesCtrZipKeyStream::<Aes256>::new(&key);
 
@@ -174,7 +173,6 @@ mod tests {
             0xe0, 0x25, 0x7b, 0x57, 0x97, 0x6a, 0xa4, 0x23, 0xab, 0x94, 0xaa, 0x44, 0xfd, 0x47,
             0x4f, 0xa5,
         ];
-        eprintln!("{}", key.len());
 
         let mut key_stream = AesCtrZipKeyStream::<Aes128>::new(&key);
 
@@ -196,7 +194,6 @@ mod tests {
             0xe4, 0x4a, 0x88, 0x52, 0x8f, 0xf7, 0x0b, 0x81, 0x7b, 0x75, 0xf1, 0x74, 0x21, 0x37,
             0x8c, 0x90, 0xad, 0xbe, 0x4a, 0x65, 0xa8, 0x96, 0x0e, 0xcc,
         ];
-        eprintln!("{}", key.len());
 
         let mut key_stream = AesCtrZipKeyStream::<Aes192>::new(&key);
 
@@ -219,7 +216,6 @@ mod tests {
             0xa5, 0xee, 0x3a, 0x4f, 0x0f, 0x4b, 0x29, 0xbd, 0xe9, 0xb8, 0x41, 0x9c, 0x41, 0xa5,
             0x15, 0xb2, 0x86, 0xab,
         ];
-        eprintln!("{}", key.len());
 
         let mut key_stream = AesCtrZipKeyStream::<Aes256>::new(&key);
 
@@ -245,7 +241,6 @@ mod tests {
             0x43, 0x2b, 0x6d, 0xbe, 0x05, 0x76, 0x6c, 0x9e, 0xde, 0xca, 0x3b, 0xf8, 0xaf, 0x5d,
             0x81, 0xb6,
         ];
-        eprintln!("{}", key.len());
 
         let mut key_stream = AesCtrZipKeyStream::<Aes128>::new(&key);
 
@@ -271,7 +266,6 @@ mod tests {
             0xac, 0x92, 0x41, 0xba, 0xde, 0xd9, 0x02, 0xfe, 0x40, 0x92, 0x20, 0xf6, 0x56, 0x03,
             0xfe, 0xae, 0x1b, 0xba, 0x01, 0x97, 0x97, 0x79, 0xbb, 0xa6,
         ];
-        eprintln!("{}", key.len());
 
         let mut key_stream = AesCtrZipKeyStream::<Aes192>::new(&key);
 
@@ -298,7 +292,6 @@ mod tests {
             0xe1, 0x4d, 0x4a, 0x77, 0xd4, 0xeb, 0x9e, 0x3d, 0x75, 0xce, 0x9a, 0x3e, 0x10, 0x50,
             0xc2, 0x07, 0x36, 0xb6,
         ];
-        eprintln!("{}", key.len());
 
         let mut key_stream = AesCtrZipKeyStream::<Aes256>::new(&key);
 

src/crc32.rs

@@ -10,6 +10,7 @@ pub struct Crc32Reader<R> {
     inner: R,
     hasher: Hasher,
     check: u32,
+    #[cfg(feature = "aes-crypto")]
     /// Signals if `inner` stores aes encrypted data.
     /// AE-2 encrypted data doesn't use crc and sets the value to 0.
     ae2_encrypted: bool,
@@ -18,11 +19,16 @@ pub struct Crc32Reader<R> {
 impl<R> Crc32Reader<R> {
     /// Get a new Crc32Reader which checks the inner reader against checksum.
     /// The check is disabled if `ae2_encrypted == true`.
-    pub fn new(inner: R, checksum: u32, ae2_encrypted: bool) -> Crc32Reader<R> {
+    pub(crate) fn new(
+        inner: R,
+        checksum: u32,
+        #[cfg(feature = "aes-crypto")] ae2_encrypted: bool,
+    ) -> Crc32Reader<R> {
         Crc32Reader {
             inner,
             hasher: Hasher::new(),
             check: checksum,
+            #[cfg(feature = "aes-crypto")]
             ae2_encrypted,
         }
     }
@@ -38,8 +44,12 @@ impl<R> Crc32Reader<R> {
 
 impl<R: Read> Read for Crc32Reader<R> {
     fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+        let invalid_check = !buf.is_empty() && !self.check_matches();
+        #[cfg(feature = "aes-crypto")]
+        let invalid_check = invalid_check && !self.ae2_encrypted;
+
         let count = match self.inner.read(buf) {
-            Ok(0) if !buf.is_empty() && !self.check_matches() && !self.ae2_encrypted => {
+            Ok(0) if invalid_check => {
                 return Err(io::Error::new(io::ErrorKind::Other, "Invalid checksum"))
             }
             Ok(n) => n,
@@ -60,10 +70,20 @@ mod test {
         let data: &[u8] = b"";
         let mut buf = [0; 1];
 
-        let mut reader = Crc32Reader::new(data, 0, false);
+        let mut reader = Crc32Reader::new(
+            data,
+            0,
+            #[cfg(feature = "aes-crypto")]
+            false,
+        );
         assert_eq!(reader.read(&mut buf).unwrap(), 0);
 
-        let mut reader = Crc32Reader::new(data, 1, false);
+        let mut reader = Crc32Reader::new(
+            data,
+            1,
+            #[cfg(feature = "aes-crypto")]
+            false,
+        );
         assert!(reader
             .read(&mut buf)
             .unwrap_err()
@@ -76,7 +96,12 @@ mod test {
         let data: &[u8] = b"1234";
         let mut buf = [0; 1];
 
-        let mut reader = Crc32Reader::new(data, 0x9be3e0a3, false);
+        let mut reader = Crc32Reader::new(
+            data,
+            0x9be3e0a3,
+            #[cfg(feature = "aes-crypto")]
+            false,
+        );
         assert_eq!(reader.read(&mut buf).unwrap(), 1);
         assert_eq!(reader.read(&mut buf).unwrap(), 1);
         assert_eq!(reader.read(&mut buf).unwrap(), 1);
@@ -91,7 +116,12 @@ mod test {
         let data: &[u8] = b"1234";
         let mut buf = [0; 5];
 
-        let mut reader = Crc32Reader::new(data, 0x9be3e0a3, false);
+        let mut reader = Crc32Reader::new(
+            data,
+            0x9be3e0a3,
+            #[cfg(feature = "aes-crypto")]
+            false,
+        );
         assert_eq!(reader.read(&mut buf[..0]).unwrap(), 0);
         assert_eq!(reader.read(&mut buf).unwrap(), 4);
     }

src/lib.rs

@@ -10,7 +10,9 @@ pub use crate::read::ZipArchive;
 pub use crate::types::DateTime;
 pub use crate::write::ZipWriter;
 
+#[cfg(feature = "aes-crypto")]
 mod aes;
+#[cfg(feature = "aes-crypto")]
 mod aes_ctr;
 mod compression;
 mod cp437;

src/read.rs

@@ -1,12 +1,13 @@
 //! Types for reading ZIP archives
 
-use crate::aes::{AesReader, AesReaderValid};
+#[cfg(feature = "aes-crypto")]
+use crate::aes::{AesMode, AesReader, AesReaderValid, AesVendorVersion};
 use crate::compression::CompressionMethod;
 use crate::cp437::FromCp437;
 use crate::crc32::Crc32Reader;
 use crate::result::{InvalidPassword, ZipError, ZipResult};
 use crate::spec;
-use crate::types::{AesMode, AesVendorVersion, DateTime, System, ZipFileData};
+use crate::types::{DateTime, System, ZipFileData};
 use crate::zipcrypto::{ZipCryptoReader, ZipCryptoReaderValid, ZipCryptoValidator};
 use byteorder::{LittleEndian, ReadBytesExt};
 use std::borrow::Cow;
@@ -58,6 +59,7 @@ pub struct ZipArchive<R> {
 enum CryptoReader<'a> {
     Plaintext(io::Take<&'a mut dyn Read>),
     ZipCrypto(ZipCryptoReaderValid<io::Take<&'a mut dyn Read>>),
+    #[cfg(feature = "aes-crypto")]
     Aes {
         reader: AesReaderValid<io::Take<&'a mut dyn Read>>,
         vendor_version: AesVendorVersion,
@@ -69,6 +71,7 @@ impl<'a> Read for CryptoReader<'a> {
         match self {
             CryptoReader::Plaintext(r) => r.read(buf),
             CryptoReader::ZipCrypto(r) => r.read(buf),
+            #[cfg(feature = "aes-crypto")]
             CryptoReader::Aes { reader: r, .. } => r.read(buf),
         }
     }
@@ -80,6 +83,7 @@ impl<'a> CryptoReader<'a> {
         match self {
             CryptoReader::Plaintext(r) => r,
             CryptoReader::ZipCrypto(r) => r.into_inner(),
+            #[cfg(feature = "aes-crypto")]
             CryptoReader::Aes { reader: r, .. } => r.into_inner(),
         }
     }
@@ -171,8 +175,8 @@ fn make_crypto_reader<'a>(
     using_data_descriptor: bool,
     reader: io::Take<&'a mut dyn io::Read>,
     password: Option<&[u8]>,
-    aes_info: Option<(AesMode, AesVendorVersion)>,
+    #[cfg(feature = "aes-crypto")] aes_info: Option<(AesMode, AesVendorVersion)>,
-    compressed_size: u64,
+    #[cfg(feature = "aes-crypto")] compressed_size: u64,
 ) -> ZipResult<Result<CryptoReader<'a>, InvalidPassword>> {
     #[allow(deprecated)]
     {
@@ -181,8 +185,20 @@ fn make_crypto_reader<'a>(
         }
     }
 
+    #[cfg(not(feature = "aes-crypto"))]
+    let aes_info: Option<()> = None;
+
     let reader = match (password, aes_info) {
-        (None, _) => CryptoReader::Plaintext(reader),
+        #[cfg(feature = "aes-crypto")]
+        (Some(password), Some((aes_mode, vendor_version))) => {
+            match AesReader::new(reader, aes_mode, compressed_size).validate(&password)? {
+                None => return Ok(Err(InvalidPassword)),
+                Some(r) => CryptoReader::Aes {
+                    reader: r,
+                    vendor_version,
+                },
+            }
+        }
         (Some(password), None) => {
             let validator = if using_data_descriptor {
                 ZipCryptoValidator::InfoZipMsdosTime(last_modified_time.timepart())
@@ -194,15 +210,7 @@ fn make_crypto_reader<'a>(
                 Some(r) => CryptoReader::ZipCrypto(r),
             }
         }
-        (Some(password), Some((aes_mode, vendor_version))) => {
+        _ => CryptoReader::Plaintext(reader),
-            match AesReader::new(reader, aes_mode, compressed_size).validate(&password)? {
-                None => return Ok(Err(InvalidPassword)),
-                Some(r) => CryptoReader::Aes {
-                    reader: r,
-                    vendor_version,
-                },
-            }
-        }
     };
     Ok(Ok(reader))
 }
@@ -212,14 +220,19 @@ fn make_reader<'a>(
     crc32: u32,
     reader: CryptoReader<'a>,
 ) -> ZipFileReader<'a> {
+    #[cfg(feature = "aes-crypto")]
     let ae2_encrypted = matches!(reader, CryptoReader::Aes {
         vendor_version: AesVendorVersion::Ae2,
         ..
     });
+
     match compression_method {
-        CompressionMethod::Stored => {
+        CompressionMethod::Stored => ZipFileReader::Stored(Crc32Reader::new(
-            ZipFileReader::Stored(Crc32Reader::new(reader, crc32, ae2_encrypted))
+            reader,
-        }
+            crc32,
+            #[cfg(feature = "aes-crypto")]
+            ae2_encrypted,
+        )),
         #[cfg(any(
             feature = "deflate",
             feature = "deflate-miniz",
@@ -227,12 +240,22 @@ fn make_reader<'a>(
         ))]
         CompressionMethod::Deflated => {
             let deflate_reader = DeflateDecoder::new(reader);
-            ZipFileReader::Deflated(Crc32Reader::new(deflate_reader, crc32, ae2_encrypted))
+            ZipFileReader::Deflated(Crc32Reader::new(
+                deflate_reader,
+                crc32,
+                #[cfg(feature = "aes-crypto")]
+                ae2_encrypted,
+            ))
         }
         #[cfg(feature = "bzip2")]
         CompressionMethod::Bzip2 => {
             let bzip2_reader = BzDecoder::new(reader);
-            ZipFileReader::Bzip2(Crc32Reader::new(bzip2_reader, crc32, ae2_encrypted))
+            ZipFileReader::Bzip2(Crc32Reader::new(
+                bzip2_reader,
+                crc32,
+                #[cfg(feature = "aes-crypto")]
+                ae2_encrypted,
+            ))
         }
         _ => panic!("Compression method not supported"),
     }
@@ -526,7 +549,9 @@ impl<R: Read + io::Seek> ZipArchive<R> {
             data.using_data_descriptor,
             limit_reader,
             password,
+            #[cfg(feature = "aes-crypto")]
             data.aes_mode,
+            #[cfg(feature = "aes-crypto")]
             data.compressed_size,
         ) {
             Ok(Ok(crypto_reader)) => Ok(Ok(ZipFile {
@@ -621,6 +646,7 @@ pub(crate) fn central_header_to_zip_file<R: Read + io::Seek>(
         data_start: 0,
         external_attributes: external_file_attributes,
         large_file: false,
+        #[cfg(feature = "aes-crypto")]
         aes_mode: None,
     };
 
@@ -629,11 +655,14 @@ pub(crate) fn central_header_to_zip_file<R: Read + io::Seek>(
         Err(e) => return Err(e),
     }
 
-    let aes_enabled = result.compression_method == CompressionMethod::AES;
+    #[cfg(feature = "aes-crypto")]
-    if aes_enabled && result.aes_mode.is_none() {
+    {
-        return Err(ZipError::InvalidArchive(
+        let aes_enabled = result.compression_method == CompressionMethod::AES;
-            "AES encryption without AES extra data field",
+        if aes_enabled && result.aes_mode.is_none() {
-        ));
+            return Err(ZipError::InvalidArchive(
+                "AES encryption without AES extra data field",
+            ));
+        }
     }
 
     // Account for shifted zip offsets.
@@ -667,6 +696,7 @@ fn parse_extra_field(file: &mut ZipFileData) -> ZipResult<()> {
                     len_left -= 8;
                 }
             }
+            #[cfg(feature = "aes-crypto")]
             0x9901 => {
                 // AES
                 if len != 7 {
@@ -1018,6 +1048,7 @@ pub fn read_zipfile_from_stream<'a, R: io::Read>(
         // from standard input, this field is set to zero.'
         external_attributes: 0,
         large_file: false,
+        #[cfg(feature = "aes-crypto")]
         aes_mode: None,
     };
 
@@ -1044,7 +1075,9 @@ pub fn read_zipfile_from_stream<'a, R: io::Read>(
         result.using_data_descriptor,
         limit_reader,
         None,
+        #[cfg(feature = "aes-crypto")]
         None,
+        #[cfg(feature = "aes-crypto")]
         result.compressed_size,
     )?
     .unwrap();

src/types.rs

@@ -1,5 +1,8 @@
 //! Types that specify what is contained in a ZIP.
 
+#[cfg(feature = "aes-crypto")]
+use crate::aes::{AesMode, AesVendorVersion};
+
 #[derive(Clone, Copy, Debug, PartialEq)]
 pub enum System {
     Dos = 0,
@@ -248,6 +251,7 @@ pub struct ZipFileData {
     pub external_attributes: u32,
     /// Reserve local ZIP64 extra field
     pub large_file: bool,
+    #[cfg(feature = "aes-crypto")]
     /// AES mode if applicable
     pub aes_mode: Option<(AesMode, AesVendorVersion)>,
 }
@@ -297,34 +301,6 @@ impl ZipFileData {
     }
 }
 
-#[derive(Copy, Clone, Debug)]
-pub enum AesVendorVersion {
-    Ae1,
-    Ae2,
-}
-
-/// AES variant used.
-#[derive(Copy, Clone, Debug)]
-pub enum AesMode {
-    Aes128,
-    Aes192,
-    Aes256,
-}
-
-impl AesMode {
-    pub fn salt_length(&self) -> usize {
-        self.key_length() / 2
-    }
-
-    pub fn key_length(&self) -> usize {
-        match self {
-            Self::Aes128 => 16,
-            Self::Aes192 => 24,
-            Self::Aes256 => 32,
-        }
-    }
-}
-
 #[cfg(test)]
 mod test {
     #[test]
@@ -359,6 +335,7 @@ mod test {
             central_header_start: 0,
             external_attributes: 0,
             large_file: false,
+            #[cfg(feature = "aes-crypto")]
             aes_mode: None,
         };
         assert_eq!(

src/write.rs

@@ -334,6 +334,7 @@ impl<W: Write + io::Seek> ZipWriter<W> {
                 central_header_start: 0,
                 external_attributes: permissions << 16,
                 large_file: options.large_file,
+                #[cfg(feature = "aes-crypto")]
                 aes_mode: None,
             };
             write_local_file_header(writer, &file)?;