aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* backwards incompatible change to RFC822Name (#3953)Paul Kehrer2017-10-105-85/+79
| | | | | | | | | | | | | | | * backwards incompatible change to RFC822Name During this release cycle we decided to officially deprecate passing U-labels to our GeneralName constructors. At first we tried changing this in a purely backwards compatible way but get_values_for_type made that untenable. This PR modifies RFC822Name to accept two types: U-label strings (which raises a deprecation warning) and A-label strings (the new preferred type). There is also a constructor for RFC822Name that bypasses validation so we can parse garbage out of certificates (and round trip it if necessary) * whoops
* Backwards incompatible change to DNSName (#3951)Paul Kehrer2017-10-107-194/+193
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Backwards incompatible change to DNSName During this release cycle we decided to officially deprecate passing U-labels to our GeneralName constructors. At first we tried changing this in a purely backwards compatible way but get_values_for_type made that untenable. This PR modifies DNSName to take three different types. U-label strings (which raises a deprecation warning), A-label strings (the new preferred type), and bytes (which are assumed to be decodable to unicode strings). The latter, while supported, is primarily intended for use by our parser and allows us to return the actual encoded data in a certificate even if it has not been properly encoded to A-label before the certificate is created. (Of course, if the certificate contains invalid utf8 sequences this will still fail, but let's handle one catastrophic failure at a time). * coverage * don't delete that asterisk from a test. it does things. * no bytes in DNSName. Private constructor for bypassing validation * test unicode in dnsname (yuck) * fix docs * empty commit, you disappoint me codecov * CI is the worst
* add utf8 DNSName x509 vector (#3952)Paul Kehrer2017-10-092-0/+43
|
* update security docs to indicate we staticaly link openssl on linux too (#3949)Alex Gaynor2017-10-051-4/+4
| | | | | | * update security docs to indicate we staticaly link openssl there too * spelling
* do downstream builds as part of our normal parallel jenkins pipeline (#3948)Paul Kehrer2017-10-031-7/+3
| | | | | | * do downstream builds as part of our normal parallel jenkins pipeline * empty
* disable smart quotes in sphinx to workaround a spellchecker issue (#3946)Paul Kehrer2017-10-032-1/+3
| | | | This makes it so we don't have to pin sphinx while we wait for sphinxcontrib-spelling to properly handle smart quotes
* Add support for AES XTS (#3900)Paul Kehrer2017-10-019-11/+168
| | | | | | | | | | | | | | | | | | | | | | | | * Add support for AES XTS We drop the non-byte aligned test vectors because according to NIST http://csrc.nist.gov/groups/STM/cavp/documents/aes/XTSVS.pdf "An implementation may support a data unit length that is not a multiple of 8 bits." OpenSSL does not support this, so we can't use those test vectors. * fix docs and pep8 * docs fix * the spellchecker is so frustrating * add note about AES 192 for XTS (it's not supported) * docs work * enforce key length on ECB mode in AES as well (thanks XTS) * a few more words about why we exclude some test vectors for XTS
* Declare that 2.1 is the last version to support Python 2.6 (#3944)Alex Gaynor2017-10-013-3/+5
| | | | | | * Declare that 2.1 is the last version to support Python 2.6 * It's the Final Countdown!
* add ChaCha20 support (#3919)Paul Kehrer2017-09-286-1/+146
| | | | | | | | | | * add ChaCha20 support * review feedback * 256 divided by 8 is what again? * ...
* Expose FIPS funcs for OpenSSL. (#3939)Scott Sturdivant2017-09-273-0/+37
| | | | | | | | | | | | | * Expose FIPS funcs for OpenSSL. * Remove FIPS customization / conditionals. It seems that the FIPS functions are always defined, regardless of if the FIPS module is present. * Do not include FIPS_selftest_check func. * Libressl does not have FIPS.
* Update the list of macOS versions we test on to match reality (#3942)Alex Gaynor2017-09-271-1/+1
|
* both parse and encode the ASN1 string type for Name attributes (#3896)Paul Kehrer2017-09-256-23/+107
| | | | | | | | | | | | | | | * both parse and encode the ASN1 string type for Name attributes Previously cryptography encoded everything (except country names) as UTF8String. This caused problems with chain building in libraries like NSS where the subject and issuer are expected to match byte-for-byte. With this change we now parse and store the ASN1 string type as a private _type in NameAttribute. We then use this to encode when issuing a new certificate. This allows the CertificateBuilder to properly construct an identical issuer and fixes the issue with NSS. * make the sentinel private too
* blacklist yet another version of sphinx (#3940)Alex Gaynor2017-09-261-1/+1
|
* FreshestCRL extension support (#3937)Paul Kehrer2017-09-238-7/+344
| | | | | | | | | | * add freshest CRL support * add tests * add changelog * add tests for FreshestCRL generation
* support delta crl indicator extension (#3936)Paul Kehrer2017-09-2210-5/+121
| | | This is an extension for CRLs
* refactor rsa signature/verification logic to remove duplication (#3903)Paul Kehrer2017-09-211-91/+34
|
* parametrize a bunch of x509 extension tests that were identical (#3931)Paul Kehrer2017-09-211-377/+139
|
* docs for what bytes means for DNSName, URI, and RFC822Name (#3904)Paul Kehrer2017-09-202-9/+41
|
* add Freshest CRL and Delta CRL Indicator test vectors (#3932)Paul Kehrer2017-09-203-0/+34
|
* Mark our custom sphinx extension as parallel safe (#3935)Alex Gaynor2017-09-201-0/+4
|
* correct the docs for CRLReason (#3930)Paul Kehrer2017-09-201-2/+1
|
* Switch NIST PDFs from nvlpubs to csrc which is HTTPS (#3929)Alex Gaynor2017-09-205-8/+8
|
* disable travis mac builders and add a mac jenkins build (#3933)Paul Kehrer2017-09-202-41/+41
| | | | we'll re-enable mac builders when travis recovers and remove the jenkins build
* Update the rest of the NIST urls to their new HTTPS homes (#3928)Alex Gaynor2017-09-203-4/+4
|
* add unique identifier test vector (#3925)Paul Kehrer2017-09-192-2/+15
| | | | | | * add unique identifier test vector * wrap a line I didn't even touch...
* remove py26 windows and macOS wheels (#3921)Paul Kehrer2017-09-191-5/+3
| | | The wheel package is starting to drop support and download counts for them represent less than .02% of downloads for the month.
* Update PKITS link (#3923)Alex Gaynor2017-09-201-1/+1
|
* Update NIST CAVP url (#3922)Alex Gaynor2017-09-191-1/+1
|
* bump libressl version (#3920)Alex Gaynor2017-09-151-1/+1
|
* add chacha20 test vectors from RFC 7539 (#3918)Paul Kehrer2017-09-142-0/+24
|
* implement __hash__ on DistributionPoint and CRLDistributionPoints (#3915)Paul Kehrer2017-09-132-0/+90
|
* add __hash__ to GeneralNames, SAN, IAN, and CertificateIssuer (#3916)Paul Kehrer2017-09-132-0/+46
|
* add __hash__ to PolicyConstraints and Extension (#3917)Paul Kehrer2017-09-132-0/+34
|
* implement __hash__ on KeyUsage and ExtendedKeyUsage (#3913)Paul Kehrer2017-09-132-0/+60
| | | | | | * implement __hash__ on KeyUsage and ExtendedKeyUsage * properly use private values and alter test to catch that bug
* implement __hash__ on CertificatePolicies and its child classes (#3914)Paul Kehrer2017-09-132-0/+62
|
* add aki hash (#3910)Paul Kehrer2017-09-132-1/+19
| | | | | | | | | | * Implement __hash__ on AuthorityKeyIdentifier * Adding dirname to fix build issue on AuthorityKeyIdentifier test * .authority_cert_issuer to str * use a tuple and not a str repr
* name constraints __hash__ (#3912)Paul Kehrer2017-09-132-0/+34
|
* AIA hashing (#3911)Paul Kehrer2017-09-132-0/+37
|
* remove u-label conversion during general name decode (#3905)Paul Kehrer2017-09-131-49/+4
| | | | We support directly passing bytes now and these code paths are duplicated in the deprecated value attributes.
* fix a bug with URI value when parsing a string with no hostname (#3909)Paul Kehrer2017-09-133-6/+9
| | | | | strings of the form "scheme:///anything" would incorrectly have two slashes dropped. This is fixed in two code paths in this PR but one of those code paths will be entirely removed in a followup PR.
* implement __hash__ on all GeneralName types (#3907)Paul Kehrer2017-09-132-2/+58
| | | Needed to implement __hash__ on AuthorityKeyIdentifier
* coverage pin test part deux (#3908)Paul Kehrer2017-09-123-1/+6
| | | | | | * we pinned coverage for xml generation...let's try everywhere * add so many comments
* compare against bytes values, not the U-label decoded ones (#3906)Paul Kehrer2017-09-122-2/+7
| | | | We need to add one small test to cover a case that is no longer covered with this switch.
* add a faq note about having a compiler that is too old (#3902)Paul Kehrer2017-09-111-0/+9
| | | | | | | | | * add a faq note about having a compiler that is too old Also add a bit of text explaining what to do on OpenBSD 6.1 and earlier since that is the most likely place this will occur. * I always forget it spell checks titles
* refactor AES keywrap into a wrap core and unwrap core (#3901)Paul Kehrer2017-09-111-23/+30
| | | | | | | | * refactor AES keywrap into a wrap core and unwrap core This refactor makes adding AES keywrap with padding much simpler. * remove an unneeded arg
* [WIP] add support for the TLSFeature extension in x509 (#3899)Paul Kehrer2017-09-109-10/+258
| | | | | | | | | | | | | | | | | | * add support for the TLSFeature extension in x509 This extension is used for OCSP Must-Staple. * fix changelog link * pep8 * refactor to support the sequence properly and add status_request_v2 * update some language * add test vector, implement eq/ne/hash on TLSFeature * address review comments
* RSA OAEP label support for OpenSSL 1.0.2+ (#3897)Paul Kehrer2017-09-085-18/+153
| | | | | | | | | | * RSA OAEP label support for OpenSSL 1.0.2+ * changelog * move around tests, address review feedback, use backend supported method * unsupported padding catches this now
* add X509 test vector with a TLS Feature (RFC 7633) extension (#3898)Paul Kehrer2017-09-082-0/+36
|
* oaep label vector (#3895)Paul Kehrer2017-09-072-0/+10
| | | | | | | | | | * oaep label vector * add count so we can use the nist vector loader * add RSA key from the boring vectors as well https://boringssl.googlesource.com/boringssl/+/ce3773f9fe25c3b54390bc51d72572f251c7d7e6/crypto/evp/evp_tests.txt#8
* add initial OCSP request test vector (#3890)Paul Kehrer2017-09-072-0/+5
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-16 05:11:11 +0000