summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Bump dessant/lock-threads from 2.1.2 to 3dependabot/github_actions/dessant/lock-threads-3dependabot[bot]2021-09-281-1/+1
| | | | | | | | | | | | | | | Bumps [dessant/lock-threads](https://github.com/dessant/lock-threads) from 2.1.2 to 3. - [Release notes](https://github.com/dessant/lock-threads/releases) - [Changelog](https://github.com/dessant/lock-threads/blob/master/CHANGELOG.md) - [Commits](https://github.com/dessant/lock-threads/compare/v2.1.2...v3) --- updated-dependencies: - dependency-name: dessant/lock-threads dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
* Fill in notBefore/notAfter in X509 _PKeyInteractionTestsMixin tests (#1039)David Benjamin2021-09-071-2/+7
| | | | | | | | While the tests currently pass without it, this is because OpenSSL's encoder doesn't notice that it is emitting garbage. See https://github.com/openssl/openssl/issues/16538 Fill in a placeholder validity period so the tests both better mirror real X.509 signing code and do not rely on this bug.
* Don't try to serialize invalid objects in tests (#1037)David Benjamin2021-08-221-0/+5
| | | | | | | | | | | | | | | | | | | | | A default-constructed X509_REQ or NETSCAPE_SPKI contains empty values for all its fields, notably the OIDs in public keys. This initial state is incomplete and not yet a valid object. The ASN.1 structures make the public key mandatory. When serializing, OpenSSL would previously silently omit the field, which doesn't actually produce a valid structure. As of https://github.com/openssl/openssl/pull/16027, OpenSSL will notice this and return an error rather than serialize garbage. Sadly, that had to be reverted on 1.1.1, but it is present in the 3.0 branch. With that change, some of pyOpenSSL's tests fail. The bug here is in pyOpenSSL: pyOpenSSL tests are trying to serialize incomplete objects. Instead, fill in the public key. While not syntactically necessary (the empty string is a BIT STRING), also fill in the signature for NetscapeSPKI, to better align with real code. Tested by running pyOpenSSL tests against a copy of OpenSSL 1.1.1's dev branch, prior to the changes getting reverted.
* Bump dessant/lock-threads from 2.1.1 to 2.1.2 (#1036)dependabot[bot]2021-08-181-1/+1
| | | | | | | | | | | | | | | | | Bumps [dessant/lock-threads](https://github.com/dessant/lock-threads) from 2.1.1 to 2.1.2. - [Release notes](https://github.com/dessant/lock-threads/releases) - [Changelog](https://github.com/dessant/lock-threads/blob/master/CHANGELOG.md) - [Commits](https://github.com/dessant/lock-threads/compare/v2.1.1...v2.1.2) --- updated-dependencies: - dependency-name: dessant/lock-threads dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* use public interfaces for all cryptography<->pyopenssl translations (#1030)Paul Kehrer2021-07-251-26/+50
|
* Bump dessant/lock-threads from 2.0.3 to 2.1.1 (#1028)dependabot[bot]2021-07-121-1/+1
| | | | | | | | | | | | | | | | | Bumps [dessant/lock-threads](https://github.com/dessant/lock-threads) from 2.0.3 to 2.1.1. - [Release notes](https://github.com/dessant/lock-threads/releases) - [Changelog](https://github.com/dessant/lock-threads/blob/master/CHANGELOG.md) - [Commits](https://github.com/dessant/lock-threads/compare/v2.0.3...v2.1.1) --- updated-dependencies: - dependency-name: dessant/lock-threads dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* add `NO_OVERLAPPING_PROTOCOLS` to `__all__` (#1025)Maximilian Hils2021-06-301-0/+1
|
* Bump dessant/lock-threads from 2 to 2.0.3 (#1016)dependabot[bot]2021-05-121-1/+1
| | | | | | | | | | Bumps [dessant/lock-threads](https://github.com/dessant/lock-threads) from 2 to 2.0.3. - [Release notes](https://github.com/dessant/lock-threads/releases) - [Changelog](https://github.com/dessant/lock-threads/blob/master/CHANGELOG.md) - [Commits](https://github.com/dessant/lock-threads/compare/v2...v2.0.3) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump actions/setup-python from 2 to 2.2.2 (#1015)dependabot[bot]2021-05-121-1/+1
| | | | | | | | | Bumps [actions/setup-python](https://github.com/actions/setup-python) from 2 to 2.2.2. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v2...v2.2.2) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump actions/checkout from 2 to 2.3.4 (#1017)dependabot[bot]2021-05-121-2/+2
| | | | | | | | | | Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 2.3.4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v2...v2.3.4) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fix CI for new Ubuntu release (#1018)Alex Gaynor2021-05-121-1/+1
|
* Remove vestigal line (#1004)Alex Gaynor2021-03-251-1/+0
|
* Attempt to test with system OpenSSL on recent Ubuntu (#1003)Alex Gaynor2021-03-192-2/+17
| | | | | * Attempt to test with system OpenSSL on recent Ubuntu * attempted fix for this test
* Add SSL_CTX_set_min_proto_version/SSL_CTX_set_max_proto_version bindings (#985)Maximilian Hils2021-03-108-15/+115
| | | | | | | | | | | | | | | | | | | * add Context.set_*_proto_version, fix #860 * docs: add new openssl tls methods * accept the fact that nothing can be taken for granted * bump minimum required cryptography version to 3.3 * drop support for Python 3.5 * use binary wheels for cryptography * Revert "use binary wheels for cryptography" This reverts commit 91a04c612ed1d0dd9fd541dfefe21cac7c25b1c1. * docker ci: compile cryptography with rust
* remove CB_ISSUER_CHECK (#982)Rosen Penev2021-02-202-2/+0
| | | | | Deprecated under OpenSSL 1.1 Signed-off-by: Rosen Penev <rosenp@gmail.com>
* fix rtd docs build (#994)Paul Kehrer2021-02-202-1/+5
| | | | | * fix rtd docs build * manifest
* Check return code of SSL_[CTX_]set_alpn_protos (#993)Maximilian Hils2021-02-173-2/+31
| | | | | | | * check return code of SSL_CTX_set_alpn_protos, fix #992 * paint it black! * fix line lengths as well :upside_down_face:
* rename main branch (#991)Paul Kehrer2021-02-132-7/+6
| | | | | * rename main branch * travis is gone, link GHA
* cleanup from_buffer now that we just use cffi natively (#989)masterAlex Gaynor2021-01-162-7/+3
|
* reopen master for dev (#980)Paul Kehrer2020-12-152-1/+13
|
* Prepare for 20.0.1 release (#979)20.0.1Alex Gaynor2020-12-152-2/+4
|
* Fix for running on OpenSSL 1.1.0 + CI (#978)Alex Gaynor2020-12-142-1/+23
| | | | | | | * Test on OpenSSL 1.1.0 w/ Debian stretch * Make pyOpenSSL compatible with openssl 1.1.0 again Co-authored-by: Shane Harvey <shnhrv@gmail.com>
* remove py2 w/ cryptography master (#977)Alex Gaynor2020-12-141-2/+0
| | | | | * remove py2 w/ cryptography master * Update ci.yml
* Tox.ini; Test on Python 3.9 and make flake8 stricter (#966)Christian Clauss2020-11-292-11/+9
| | | | | | | | | | | | | * Tox.ini; Test on Python 3.9 and make flake8 stricter * max-line-length = 88 * Remove unused import * Update tox.ini * Use PEP8 line length * Use PEP8 line length
* reopen master for next dev cycle (#969)Paul Kehrer2020-11-272-1/+13
|
* 20.0.0 before 2020 is even over (#968)20.0.0Paul Kehrer2020-11-273-3/+4
|
* fix a memleak (#967)Paul Kehrer2020-11-272-1/+15
| | | | | * fix a memleak * black
* Keep reference to SSL verify_call in Connection object (#956)Arne Schwabe2020-11-272-0/+52
| | | | | | | | | | | | | | * Keep reference to SSL verify_call in Connection object If a set_verify is used on a context before and after a Connection the reference in the SSL* object still points to the old _verify_helper object. Since this object has no longer any references to it, the callback can result in a segfault. This commit fixes the issues by ensuring that as long as the Connection object/SSL* object lives a reference to the callback function is held. * Add Unit test for set_verify_callback deference
* Remove leakcheck (#965)Alex Gaynor2020-11-278-568/+1
| | | It's not being run anywhere, and plainly doesn't support py3 so it's clearly not important to anyone.
* Added dependabot for GHA (#961)Alex Gaynor2020-11-231-0/+6
|
* Migrate CI to GHA (#960)Alex Gaynor2020-11-173-127/+62
|
* Fix spelling of set in set_verify docstring (#959)Arne Schwabe2020-11-131-2/+2
|
* Stop testing py35 with cryptography master (#958)Alex Gaynor2020-11-121-3/+0
|
* Fix typo in debug command output (#957)Michael Lazar2020-11-121-1/+1
| | | Co-authored-by: Michael Lazar <mlazar@doctorondemand.com>
* Drop CI for OpenSSL 1.0.2 (#953)Alex Gaynor2020-10-268-95/+15
| | | | | | | * Drop CI for OpenSSL 1.0.2 * Delete code for coverage reasons * Bump minimum cryptography version
* Fixing issue #798 (#907)jalberdi0042020-10-181-1/+4
| | | | | | * Fixing issue #798, thanks to @reaperhulk; removing undocumented '%s' option and getting the date in a more robust way Co-authored-by: Joseba Alberdi <j.alberdi@simuneatomistics.com> Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* Correct typos in crypto.py (#949)Felix Yan2020-10-141-2/+2
|
* fixed tests for twisted change (#950)Alex Gaynor2020-10-141-5/+1
| | | * fixed tests for twisted change
* crypto._PassphraseHelper: pass non-callable passphrase using callback (#947)Huw Jones2020-10-123-11/+68
| | | | | | | | | | | | * crypto._PassphraseHelper: pass non-callable passphrase using callback Fixes #945 Before this commit, we would pass a bytes passphrase as a null terminated string. This causes issue when a randomly generated key's first byte is null because OpenSSL rightly determines the key length is 0. This commit modifies the passphrase helper to pass the passphrase via the callback * Update changelog to document bug fix
* Allow using additional untrusted certificates for chain building in ↵Sándor Oroszi2020-10-123-2/+176
| | | | | | | | | | | | X509StoreContext (#948) The additional certificates provided in the new `chain` parameter will be untrusted but may be used to build the chain. This makes it easier to validate a certificate against a store which contains only root ca certificates, and the intermediates come from e.g. the same untrusted source as the certificate to be verified. Co-authored-by: Sandor Oroszi <sandor.oroszi@balabit.com>
* Allow using an OpenSSL hashed directory for verification in X509Store (#943)Sándor Oroszi2020-09-113-1/+186
| | | | | | | Add X509Store.load_locations() to set a CA bundle file and/or an OpenSSL- style hashed CA/CRL lookup directory, similar to the already existing SSL.Context.load_verify_locations(). Co-authored-by: Sandor Oroszi <sandor.oroszi@balabit.com>
* I'm back in black (#941)Alex Gaynor2020-08-262-9/+21
|
* travis.com now (#939)Paul Kehrer2020-08-191-2/+2
|
* lock old issues (#937)Alex Gaynor2020-08-141-0/+14
|
* fixes #934 -- kill dead link (#936)Alex Gaynor2020-08-141-1/+0
|
* Switch to new notBefore/After APIs (#843)Rosen Penev2020-08-131-6/+6
| | | Signed-off-by: Rosen Penev <rosenp@gmail.com>
* Context.set_verify: allow omission of callback (#933)Maximilian Hils2020-08-073-16/+46
| | | | | | | * Context.set_verify: allow omission of callback * squeeze to 80 chars * make it clear that default callback is used
* Allow accessing a connection's verfied certificate chain (#894)Shane Harvey2020-08-055-11/+190
| | | | | | | | | | | | | | | | | | | | | | | | | * Allow accessing a connection's verfied certificate chain Add X509StoreContext.get_verified_chain using X509_STORE_CTX_get1_chain. Add Connection.get_verified_chain using SSL_get0_verified_chain if available (ie OpenSSL 1.1+) and X509StoreContext.get_verified_chain otherwise. Fixes #740. * TLSv1_METHOD -> SSLv23_METHOD * Use X509_up_ref instead of X509_dup * Add _openssl_assert where appropriate * SSL_get_peer_cert_chain should not be null * Reformat with black * Fix <OpenSSL.crypto.X509 object at 0x7fdbb59e8050> != <OpenSSL.crypto.X509 object at 0x7fdbb59daad0> * Add Changelog entry * Remove _add_chain
* Deprecated pkcs7 and pkcs12 support (#921)Alex Gaynor2020-08-052-1/+25
|
* focal time (#929)Paul Kehrer2020-08-053-8/+14
| | | | | | | | | * focal time * larger dh params, assert on something * urllib3 fix * actually check an error
View Lorry Controller Status