aboutsummaryrefslogtreecommitdiffstats
path: root/src/cryptography/x509
Commit message (Collapse)AuthorAgeFilesLines
* Allow NameAttribute.value to be an empty string (#5109)Andrea De Pasquale2020-03-191-3/+3
| | | | | | | | | | | | * Allow NameAttribute.value to be an empty string RFC 4514 https://tools.ietf.org/html/rfc4514 does not mention that "AttributeValue" can not be an empty (zero-length) string. Fixes #5106 * reverse order to match fix from another PR Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>
* Reversed the order of RDNs in x509.Name.rfc4514_string() (#5120)Thomas Erbesdobler2020-03-021-4/+8
| | | | RFC4514 requires in section 2.1 that RDNs are converted to string representation in reversed order.
* Use literals for collections and comprehensions. (#5091)Mads Jensen2020-01-122-3/+3
|
* Use dict literals. (#5080)Mads Jensen2019-12-021-1/+1
|
* Parse single_extensions in OCSP responses (#5059)Paul Kehrer2019-11-111-0/+6
| | | | | | | | | | | | * add single_extensions to OCSPResponse (#4753) * new vector, updateed docs, more stringent parser, changelog, etc * simplify PR (no SCT for now) * add a comment * finish pulling out the sct stuff so tests might actually run
* Simplify implementing sequence methods (#4987)Alex Gaynor2019-09-101-94/+31
| | | | | | * Simplify implementing sequence methods * flake8
* Finish ed25519 and ed448 support in x509 module (#4972)Marko Kreen2019-09-093-4/+18
| | | | | | | | | | | | | | | | | | * Support ed25519 in csr/crl creation * Tests for ed25519/x509 * Support ed448 in crt/csr/crl creation * Tests for ed448/x509 * Support ed25519/ed448 in OCSPResponseBuilder * Tests for eddsa in OCSPResponseBuilder * Builder check missing in create_x509_csr * Documentation update for ed25519+ed448 in x509
* Make DER reader into a context manager (#4957)Alex Gaynor2019-07-281-9/+9
| | | | | | | | * Make DER reader into a context manager * Added another test case * flake8
* Remove asn1crypto dependency (#4941)David Benjamin2019-07-281-3/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Remove non-test dependencies on asn1crypto. cryptography.io actually contains two OpenSSL bindings right now, the expected cffi one, and an optional one hidden in asn1crypto. asn1crypto contains a lot of things that cryptography.io doesn't use, including a BER parser and a hand-rolled and not constant-time EC implementation. Instead, check in a much small DER-only parser in cryptography/hazmat. A quick benchmark suggests this parser is also faster than asn1crypto: from __future__ import absolute_import, division, print_function import timeit print(timeit.timeit( "decode_dss_signature(sig)", setup=r""" from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature sig=b"\x30\x2d\x02\x15\x00\xb5\xaf\x30\x78\x67\xfb\x8b\x54\x39\x00\x13\xcc\x67\x02\x0d\xdf\x1f\x2c\x0b\x81\x02\x14\x62\x0d\x3b\x22\xab\x50\x31\x44\x0c\x3e\x35\xea\xb6\xf4\x81\x29\x8f\x9e\x9f\x08" """, number=10000)) Python 2.7: asn1crypto: 0.25 _der.py: 0.098 Python 3.5: asn1crypto: 0.17 _der.py: 0.10 * Remove test dependencies on asn1crypto. The remaining use of asn1crypto was some sanity-checking of Certificates. Add a minimal X.509 parser to extract the relevant fields. * Add a read_single_element helper function. The outermost read is a little tedious. * Address flake8 warnings * Fix test for long-form vs short-form lengths. Testing a zero length trips both this check and the non-minimal long form check. Use a one-byte length to cover the missing branch. * Remove support for negative integers. These never come up in valid signatures. Note, however, this does change public API. * Update src/cryptography/hazmat/primitives/asymmetric/utils.py Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com> * Review comments * Avoid hardcoding the serialization of NULL in decode_asn1.py too.
* ed25519 support in x509 certificate builder (#4937)Paul Kehrer2019-07-062-4/+8
| | | | | | | | | | * ed25519 support in x509 certificate builder This adds minimal ed25519 support. More to come. * Apply suggestions from code review Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com>
* add name for ExtensionOID.PRECERT_POISON (#4853)redshiftzero2019-05-191-0/+1
| | | | | | | | * test: ensure all public members of ExtensionOID have names defined * add name for ExtensionOID.PRECERT_POISON ref: https://github.com/google/certificate-transparency/blob/5fce65cb60cfe7808afc98de23c7dd5ddbfa1509/python/ct/crypto/asn1/oid.py#L338
* fix from_issuer_subject_key_identifier to take the right type (#4864)Paul Kehrer2019-05-041-1/+15
| | | | | | | | | | * fix from_issuer_subject_key_identifier to take the right type deprecate passing the old Extension wrapper object * don't use a try:except: * hilarious contortions to satisfy doc8
* 4810 bugfix: avoid UnicodeEncodeError on python 2 (#4846)redshiftzero2019-04-161-1/+4
| | | | | | | | * test: regression test for UnicodeEncodeError in x509 name in #4810 added utf8 encoding at the top of the file due to PEP 263 * bugfix: #4810 resolve UnicodeEncodeError in x509 name
* fix != comparison in py2 (fixes #4821) (#4822)Mathias Ertl2019-03-251-0/+6
| | | | | | | | * fix != comparison in py2 (fixes #4821) * remove blank line b/c pep8 * move __ne__ next to __eq__ as per review request
* implement eq__, __hash__ and __repr__ for OCSPNoCheck and PrecertPoison (#4819)Mathias Ertl2019-03-251-0/+24
|
* Simplify string formatting (#4757)Alex Gaynor2019-02-203-23/+23
|
* Fixes #4734 -- Deal with deprecated things (#4736)Alex Gaynor2019-01-231-3/+3
| | | | | | | | | | * Fixes #4734 -- Deal with deprecated things - Make year based aliases of PersistentlyDeprecated so we can easily assess age - Removed encode/decode rfc6979 signature - Removed Certificate.serial * Unused import
* allow asn1 times of 1950-01-01 and later. (#4728)Paul Kehrer2019-01-222-20/+20
| | | | | | | | * allow asn1 times of 1950-01-01 and later. * add a test * pretty up the test
* deprecate encode_point and migrate all internal callers (#4720)Paul Kehrer2019-01-201-1/+4
|
* add signature_hash_algorithm to OCSPResponse (#4681)Paul Kehrer2019-01-101-0/+6
| | | | | | * add signature_hash_algorithm to OCSPResponse * fix pointless asserts
* Remove spaces from RFC 4514 strings for better compliance (#4643) (#4646)Marti Raudsepp2018-12-181-1/+1
| | | | | | RFC 4514 does not explicitly allow whitespace between separators: https://tools.ietf.org/html/rfc4514 Reported-by: David Arnold <dar@xoe.solutions>
* Add RFC 4514 Distinguished Name formatting for Name, RDN and NameAttribute ↵Marti Raudsepp2018-12-082-4/+70
| | | | (#4304)
* remove idna as a primary dependency (#4624)Paul Kehrer2018-12-061-12/+17
| | | | | | | | | | * remove idna as a primary dependency * empty commit * dynamodb test fix (thanks to Matt Bullock) * review feedback
* IssuingDistributionPoint support (parse only) (#4552)Paul Kehrer2018-11-302-3/+134
| | | | | | | | | | | | | | | | | | | | | | * IssuingDistributionPoint support h/t to Irina Renteria for the initial work here * python 2 unfortunately still exists * py2 repr * typo caught by flake8 * add docs * review feedback * reorder args, other fixes * use the alex name * add changelog
* Import idna lazily to reduce our memory consumption (#4601)Alex Gaynor2018-11-231-2/+12
| | | We only use idna in deprecated paths at this point, so we shouldn't make people pay for it.
* Remove unnecessary use of six.binary_type (#4569)Jon Dufresne2018-11-111-1/+1
| | | | | All supported Pythons have type bytes. On Python 2, it is an alias of str, same as six.binary_type. Makes the code slightly more forward compatible and removes some indirection.
* move ObjectIdentifier to break an upcoming import cycle (#4550)Paul Kehrer2018-10-301-59/+1
|
* Add eq/ne/hash to PrecertificateSignedCertificateTimestamps (#4534)Paul Kehrer2018-10-291-0/+15
| | | | | | | | | | | | | | * Add eq/ne/hash to PrecertificateSignedCertificateTimestamps This requires adding it to SignedCertificateTimestamps as well * slightly more consistent * right, these need to be conditional * compare by signature * don't use private API
* OCSP response builder (#4485)Paul Kehrer2018-10-281-9/+172
| | | | | | | | * ocsp response builder * better prose * review changes
* add IDP OID and docs (#4533)Paul Kehrer2018-10-281-0/+4
|
* support extensions in the OCSP request builder (#4481)Paul Kehrer2018-10-061-5/+18
| | | | | | | | | | * support extensions in the OCSP request builder * cover a missed branch * refactor to use new func * review feedback
* add OCSP basic response extension parsing (#4479)Paul Kehrer2018-10-061-0/+6
| | | | | | | | | | * add OCSP basic response extension parsing Just nonce for now. This does not support SINGLERESP extension parsing. * also raises on extensions for non-successful * empty commit
* consolidate the duplicate extension check (#4483)Paul Kehrer2018-10-061-19/+11
|
* support OCSP response parsing (#4452)Paul Kehrer2018-10-011-0/+8
| | | | | | | | | | | | * support OCSP response parsing * move the decorator to make pep8 happy * add some missing docs * review feedback * more review feedback
* OCSP request extension parsing (#4464)Paul Kehrer2018-09-094-3/+43
| | | | | | | | | | * add OCSP request parsing support with OCSPNonce * add docs * reprs man * make extensions a cached property
* Fixes #4333 -- added support for precert poison extension (#4442)Alex Gaynor2018-08-313-1/+11
| | | | | | | | | | | | | | * Fixes #4333 -- added support for precert poison extension * Make work on all OpenSSL versions * fixed flake8 + docs * fix for older OpenSSLs * document this * spell
* OCSP response abstract base classes (#4431)Paul Kehrer2018-08-311-0/+130
| | | | | | | | | | | | * ocsp response abc * collapse SingleReponse into OCSPResponse now that we only support one * split responder_id into two properties, add tbs_response_bytes * typo * rename one method and add a mapping we'll need shortly
* refactor ocsp request parsing and generation to support only one cert (#4439)Paul Kehrer2018-08-311-33/+14
| | | | | | | | * refactor ocsp request parsing and generation to support only one cert * small doc change * notimplementederror
* make an ocsp request (#4402)Paul Kehrer2018-08-301-0/+30
| | | | | | | | | | | | | | | | * make an ocsp request * update test, add docs * make it an OCSPRequestBuilder * review feedback and more tests * make it a class * empty commit to retrigger * type check
* OCSP request parsing (#4393)Paul Kehrer2018-08-151-0/+79
| | | | | | | | | | | | * add public_bytes to OCSPRequest * review feedback * OCSP request parsing * change some prose * add __len__ as a required method
* Added missing methods from CRL Interface (#4400)Alex Gaynor2018-08-151-0/+18
|
* add crl.get_revoked_certificate method (#4331)Paul Kehrer2018-07-161-0/+7
| | | | | | | | * add crl.get_revoked_certificate method * lexicographic is the best ographic * rename
* Make RelativeDistinguishedName preserve attribtue order (#4306)Marti Raudsepp2018-07-091-3/+8
| | | | Duplicate attributes now raise an error instead of silently discarding duplicates.
* Add OID for RSASSA-PSS X.509 signature algorithm (RFC 4055) (#4294)Marti Raudsepp2018-06-292-0/+3
| | | | | | | | | | | | In 2005, IETF devised a more secure padding scheme to replace PKCS #1 v1.5. To make sure that nobody can easily support or use it, they mandated lots of complicated parameters in the certificate, unlike any other X.509 signature scheme. https://tools.ietf.org/html/rfc4055 `_SIG_OIDS_TO_HASH` and `Certificate.signature_hash_algorithm` cannot be supported as-is, because the hash algorithm is defined in the signature algorithm parameters, not by the OID itself.
* adding name so that 1.3.6.1.4.1.11129.2.4.2 is no longer and 'Unknown OID' ↵Joshua Crowgey2018-05-071-0/+3
| | | | (#4218)
* Revert "don't allow GeneralNames to be an empty list (#4128)" (#4161)Alex Gaynor2018-03-201-3/+0
| | | | | This breaks the urllib3 tests, as well as several in-the-wild certs This reverts commit 388d1bd3e9cd953fcc948edbc152d5d140c87eb8.
* don't allow GeneralNames to be an empty list (#4128)Paul Kehrer2018-03-051-0/+3
| | | | | | * don't allow GeneralNames to be an empty list * flake8
* Fix ASN1 string type encoding for several Name OIDs (#4035)Paul Kehrer2017-11-301-7/+15
| | | | | | | | | | | | | | | | | | | * Fix ASN1 string type encoding for several Name OIDs When we changed over to the new type encoding system we didn't verify that the new code exactly matched the ASN1 string types that OpenSSL was previously choosing. This caused serialNumber, dnQualifier, emailAddress, and domainComponent to change from their proper encodings to UTF8String as of version 2.1. Now we check to see if there's a sentinel value (indicating no custom type has been passed) and then check if the OID has a different default than UTF8. If it does, we set it. This PR also adds tests for the ASN1 string type of ever supported NameOID. * review feedback
* nit: remove double space in deprecation warning (#4018)Alex Gaynor2017-11-111-2/+2
|
* Fix a few new flake8 issues (#4008)Alex Gaynor2017-11-021-1/+0
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-28 09:42:29 +0000