aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* add _create_asn1_time (#4524)Paul Kehrer2018-10-241-12/+10
|
* refactor set_asn1_time to take a datetime (#4516)Paul Kehrer2018-10-231-14/+7
|
* bind a constant for an error check (#4514)Paul Kehrer2018-10-231-0/+1
| | | I hate it when we have to do this.
* next_update is not a required field on OCSP responses (#4513)Paul Kehrer2018-10-231-2/+4
|
* Fixes #4500 -- use O_CLOEXEC when opening the /dev/urandom file descriptor ↵Alex Gaynor2018-10-231-9/+2
| | | | | | | | (#4507) * Fixes #4500 -- use O_CLOEXEC when opening the /dev/urandom file descriptor * Unused variable
* Remove branch for old libressl versions that we don't support any more (#4505)Alex Gaynor2018-10-201-2/+1
|
* Add definitions that help with hostname checking (#4492)Kai Engert2018-10-103-0/+56
| | | | | | | | | | | | | | * Add definitions for SSL_get0_param and X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS * remove unnecessary parameter name * Add version conditionals and more flags * extend cryptography_has_102_verification_params * X509_CHECK_FLAG_NEVER_CHECK_SUBJECT only available with openssl 1.1.0+ * add missing declaration
* Use our cryptography-specific warning class (#4493)Alex Gaynor2018-10-101-1/+1
|
* OCSP response serialization (#4482)Paul Kehrer2018-10-061-0/+13
| | | | | | * support OCSP response serialization * empty commit, good times
* support extensions in the OCSP request builder (#4481)Paul Kehrer2018-10-063-6/+37
| | | | | | | | | | * support extensions in the OCSP request builder * cover a missed branch * refactor to use new func * review feedback
* Cleanup _encode_asn1_str_gc: don't require the length as an argument (#4484)Alex Gaynor2018-10-072-15/+11
| | | | | | * Cleanup _encode_asn1_str_gc: don't require the length as an argument * Apply the same cleanup to _encode_asn1_str
* add OCSP basic response extension parsing (#4479)Paul Kehrer2018-10-063-1/+23
| | | | | | | | | | * add OCSP basic response extension parsing Just nonce for now. This does not support SINGLERESP extension parsing. * also raises on extensions for non-successful * empty commit
* consolidate the duplicate extension check (#4483)Paul Kehrer2018-10-061-19/+11
|
* additional OCSP bindings for the response builder (#4480)Paul Kehrer2018-10-061-3/+5
| | | | | | * additional OCSP bindings for the response builder * use the OCSP extension funcs that match the rest of x509
* support OCSP response parsing (#4452)Paul Kehrer2018-10-013-4/+262
| | | | | | | | | | | | * support OCSP response parsing * move the decorator to make pep8 happy * add some missing docs * review feedback * more review feedback
* add ed25519 bindings (#4476)Paul Kehrer2018-09-264-0/+50
| | | | | | * add ed25519 bindings * var name
* Remove conditionals for OpenSSL 1.1.1 pre-releases (#4467)Alex Gaynor2018-09-152-8/+3
|
* OCSP request extension parsing (#4464)Paul Kehrer2018-09-097-5/+68
| | | | | | | | | | * add OCSP request parsing support with OCSPNonce * add docs * reprs man * make extensions a cached property
* refactor asn1_time_set to be useful in a future PR (#4465)Paul Kehrer2018-09-091-27/+27
|
* Add flags to error on compile with incompatible pointer type (#4455)Paul Kehrer2018-09-054-21/+26
| | | | | | | | | | | | | | | | * try something a bit different. * newer compiler plz * permute * fix some warnings * fix getters on OpenSSL < 1.1.0 * this is getting involved * given our compiler flags we can't have SSL_CTX_set_cookie_verify_cb
* don't sort the serial numbers in a parsed CRL (#4457)Paul Kehrer2018-09-041-2/+12
| | | | | | | | | | | * don't sort the serial numbers in a parsed CRL OpenSSL sorts them in place and this breaks the signature and more. fixes #4456 * cache the sorted CRL (but create it lazily) * use the cache decorator
* OCSP bindings (#4449)Paul Kehrer2018-09-012-0/+97
| | | | | | | | | | | | | | | * add many OCSP bindings Much of OCSP was opaqued in 1.1.0 so this also adds a bunch of getters for older OpenSSL. However, 1.1.0 itself made it impossible to access certain fields in the opaque struct, so we're forced to de-opaque them for 1.1.0 through 1.1.0i as well as 1.1.1-pre1 through 1.1.1-pre9. There is a patch (openssl/openssl#7082) that fixes this and should be in 1.1.0j and 1.1.1-pre10 (or 1.1.1 final, whichever they choose to issue) * backslashes are sometimes useful * comments
* small refactor of OCSP request parsing (#4447)Paul Kehrer2018-09-011-38/+54
| | | | This allows us to reuse these functions in the OCSPResponse object in the future
* Fixes #4333 -- added support for precert poison extension (#4442)Alex Gaynor2018-08-315-6/+33
| | | | | | | | | | | | | | * Fixes #4333 -- added support for precert poison extension * Make work on all OpenSSL versions * fixed flake8 + docs * fix for older OpenSSLs * document this * spell
* Simplify OCSP no check serialization (#4444)Alex Gaynor2018-08-312-5/+5
|
* OCSP response abstract base classes (#4431)Paul Kehrer2018-08-311-0/+130
| | | | | | | | | | | | * ocsp response abc * collapse SingleReponse into OCSPResponse now that we only support one * split responder_id into two properties, add tbs_response_bytes * typo * rename one method and add a mapping we'll need shortly
* refactor ocsp request parsing and generation to support only one cert (#4439)Paul Kehrer2018-08-313-83/+36
| | | | | | | | * refactor ocsp request parsing and generation to support only one cert * small doc change * notimplementederror
* Fixes #3460 -- deprecate OpenSSL 1.0.1 (#4427)Alex Gaynor2018-08-311-0/+16
| | | | | | | | | | | | * Fixes #3460 -- deprecate OpenSSL 1.0.1 * We need to import warnings * flake8 * words are hard * rephrase
* Fixed two memory leaks in x509 csr extensions (#4434)Alex Gaynor2018-08-313-3/+19
| | | | | | | | | | | | * Fixed a memory leak in x.509 OCSP no check * Fix the _actual_ leak * Speed up symbolizations * Disable backtrace by default, because it doesn't work on Windows * line length
* make an ocsp request (#4402)Paul Kehrer2018-08-303-0/+48
| | | | | | | | | | | | | | | | * make an ocsp request * update test, add docs * make it an OCSPRequestBuilder * review feedback and more tests * make it a class * empty commit to retrigger * type check
* 1.1.0 locks (#4420)Paul Kehrer2018-08-293-2/+7
| | | | | | | | | | | | * Do conditional compiling of Cryptography_setup_ssl_threads * Check Cryptography_HAS_LOCKING_CALLBACKS before initing static locks Check if compiling and initing locking callbacks is necessary PEP8 fix * Make test_crypto_lock_init more complete
* add bindings for SCT creation (#4407)Paul Kehrer2018-08-202-0/+22
|
* OCSP request parsing (#4393)Paul Kehrer2018-08-153-0/+209
| | | | | | | | | | | | * add public_bytes to OCSPRequest * review feedback * OCSP request parsing * change some prose * add __len__ as a required method
* Added missing methods from CRL Interface (#4400)Alex Gaynor2018-08-151-0/+18
|
* Refs #4375 -- integrate wycheproof AES CCM tests (#4379)Alex Gaynor2018-08-021-1/+1
| | | | | | * Refs #4375 -- integrate wycheproof AES CCM tests * Skip these tests if we don't have CCM support
* Add more SSL_CIPHER_* functions, necessary to implement ctx.get_ciphers() in ↵Amaury Forgeot d'Arc2018-07-232-0/+30
| | | | | | | | | | | | | | | | PyPy (#4364) * Add more SSL_CIPHER_* functions, necessary to implement ctx.get_ciphers() added by Python 3.6.1. * Add placeholders for other versions * Remove parameter names * LibreSSL 2.7 has the new functions * Add entries in _conditional.py * SSL_CIPHER_get_id returns int, not char*
* sign is a method (#4362)Paul Kehrer2018-07-201-1/+1
|
* reopen master (#4359)Paul Kehrer2018-07-181-1/+1
|
* bump version and changelog for 2.3 release (#4356)Paul Kehrer2018-07-181-1/+1
|
* also check iv length for GCM nonce in AEAD (#4350)Paul Kehrer2018-07-171-0/+2
| | | | | | * also check iv length for GCM nonce in AEAD * ugh
* raise ValueError on zero length GCM IV (#4348)Paul Kehrer2018-07-171-0/+2
|
* disallow implicit tag truncation with finalize_with_tag (#4342)Paul Kehrer2018-07-172-0/+6
|
* add crl.get_revoked_certificate method (#4331)Paul Kehrer2018-07-163-0/+28
| | | | | | | | * add crl.get_revoked_certificate method * lexicographic is the best ographic * rename
* Change the exception we raise in keywrap unwrapping on invalid length (#4337)Alex Gaynor2018-07-161-3/+3
| | | I believe this can reasonably be considered backwards compatible since other invalid inputs already lead to InvalidUnwrap, and clients shouldn't be distinguishing between these two conditions, and ValueError wasn't documented anyways.
* document one shot AEAD length restrictions (#4322)Paul Kehrer2018-07-141-0/+24
| | | | | | | | | | | | | | * document one shot AEAD length restrictions * write a test that won't consume infinity ram continue to raise OverflowError since that's what cffi did. * this applies to associated_data too * remove unneeded arg * review feedback on docs
* raise valueerror for null x25519 derived keys (#4332)Paul Kehrer2018-07-121-1/+5
| | | | | | | | | * raise valueerror for null x25519 derived keys OpenSSL errors when it hits this edge case and a null shared key is bad anyway so let's raise an error * empty commit
* we don't actually care about the errstack here, it's an invalid signature ↵Paul Kehrer2018-07-101-2/+1
| | | | | | | | | | | | | | (#4325) * we don't actually care about the errstack here, it's an invalid signature We previously had no cases where we could error without getting errors on the error stack, but wycheproof contains test cases that can error without adding anything to the stack. Accordingly, we should clear the stack but raise InvalidSignature no matter what (rather than InternalError if we have no error msgs) * add a test
* fix a memory leak when calling X25519PrivateKey.public_key() (#4326)Paul Kehrer2018-07-101-0/+4
|
* fix encoding BMPString in x509 name entries (#4321)Paul Kehrer2018-07-091-2/+7
| | | | | | | | | | Previously we encoded them as UTF-8, but as best I can tell in reality a BMPString is fixed-width basic multilingual plane big endian encoding. This is basically UCS-2 (aka original Unicode). However, Python doesn't support UCS-2 encoding so we need to use utf_16_be. This means you can encode surrogate code points that are invalid in the context of what a BMPString is supposed to be, but in reality I strongly suspect the sane encoding ship has sailed and dozens if not hundreds of implementations both do this and expect other systems to handle their nonsense.
* Make RelativeDistinguishedName preserve attribtue order (#4306)Marti Raudsepp2018-07-091-3/+8
| | | | Duplicate attributes now raise an error instead of silently discarding duplicates.
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-05 00:48:41 +0000