only support all Variant, or all non-Variant types

Signed-off-by: Facundo Tuesca <facundo.tuesca@trailofbits.com>

Author: facutuesca

src/cryptography/hazmat/asn1/asn1.py

@@ -187,6 +187,27 @@ def _normalize_field_type(
                 for arg in union_args
                 if arg is not type(None)
             ]
+
+            # Union types should either be all Variants
+            # (`Variant[..] | Variant[..] | etc`) or all non Variants
+            are_union_types_tagged = variants[0].tag_name is not None
+            if any(
+                (v.tag_name is not None) != are_union_types_tagged
+                for v in variants
+            ):
+                raise TypeError(
+                    "When using `asn1.Variant` in a union, all the other "
+                    "types in the union must also be `asn1.Variant`"
+                )
+
+            if are_union_types_tagged:
+                tags = [v.tag_name for v in variants]
+                if len(tags) != len(set(tags)):
+                    raise TypeError(
+                        "When using `asn1.Variant` in a union, the tags used "
+                        "must be unique"
+                    )
+
             rust_choice_type = declarative_asn1.Type.Choice(variants)
             # If None is part of the union types, this is an OPTIONAL CHOICE
             rust_field_type = (

tests/hazmat/asn1/test_api.py

@@ -312,6 +312,37 @@ class Example2:
                     Annotated[int, asn1.Default(value=9)], None
                 ]
 
+    def test_fail_choice_with_inconsistent_types(self) -> None:
+        with pytest.raises(
+            TypeError,
+            match=re.escape(
+                "When using `asn1.Variant` in a union, all the other "
+                "types in the union must also be `asn1.Variant`"
+            ),
+        ):
+
+            @asn1.sequence
+            class Example2:
+                invalid: typing.Union[
+                    int, asn1.Variant[bool, typing.Literal["myTag"]]
+                ]
+
+    def test_fail_choice_with_duplicate_tags(self) -> None:
+        with pytest.raises(
+            TypeError,
+            match=re.escape(
+                "When using `asn1.Variant` in a union, the tags used "
+                "must be unique"
+            ),
+        ):
+
+            @asn1.sequence
+            class Example2:
+                invalid: typing.Union[
+                    asn1.Variant[int, typing.Literal["myTag"]],
+                    asn1.Variant[bool, typing.Literal["myTag"]],
+                ]
+
     def test_fields_of_variant_type(self) -> None:
         from cryptography.hazmat.bindings._rust import declarative_asn1