summaryrefslogtreecommitdiff
path: root/src/cryptography/hazmat/primitives/serialization/ssh.py
Commit message (Collapse)AuthorAgeFilesLines
* add support for aes256-gcm@openssh.com decryption for SSH keys (#8738)Paul Kehrer2023-04-151-23/+85
| | | | | | | * add support for aes256-gcm@openssh.com decryption for SSH keys * review feedback * skip when bcrypt isn't present
* Use from __future__ import annotations everywhere (#8643)Alex Gaynor2023-03-311-11/+12
|
* Make Union type aliases a documented public API (#8168)Marti Raudsepp2023-03-071-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Rename Union type aliases to CamelCase Many `typing.Union` type aliases were previously using `UPPER_SNAKE_CASE`, but Python's convention is `CamelCase` for these (e.g. https://docs.python.org/3/library/typing.html#type-aliases) * Add utils.deprecated for the old non-underscore type aliases * Added documentation for new type aliases & minor tweaks * Use 'versionadded:: 40.0.0' * Fix CertificatePublicKeyTypes vs CertificateIssuerPublicKeyTypes. Rename CertificatePrivateKeyTypes to CertificateIssuerPrivateKeyTypes * Fix imports (ruff) * Fix one more versionadded * Tweak docs & Reorder: CertificateIssuerPublicKeyTypes before CertificateIssuerPrivateKeyTypes * Fix test mypy errors using cast() * Fix black, oops * Revert "Fix black, oops" This reverts commit 85344e231d697bdc0940e105f7aed729445f9743. * Revert "Fix test mypy errors using cast()" This reverts commit b272d8ca95fbbbc62060663f9e8930a139a7a43e. * Revert type of SubjectKeyIdentifier.from_public_key arg * Changelog tweak
* Enforce max number of SSH certificate principals (#8376)Jake2023-02-231-0/+10
| | | | | | | | | | | | | | | | | | | | * Enforce max number of SSH certificate principals There is an undocumented limit for the maximum number of valid principals accepted by the openssh tooling, as seen at: * https://github.com/openssh/openssh-portable/blob/27267642699342412964aa785b98afd69d952c88/sshkey.h#L108 * https://github.com/openssh/openssh-portable/blob/25c8a2bbcc10c493d27faea57c42a6bf13fa51f2/sshkey.c#L1801 * https://github.com/openssh/openssh-portable/blob/6180b0fa4f7996687678702806257e661fd5931e/ssh-keygen.c#L1833 This change enforces that same restriction as currently a SSH certificate can be generated that is invalid against the default sshd server. Consideration might be given for any non openssh servers that accept openssh certificates, if they exist and want to allow a greater number of principals. Of note, the 256 limit is not found in the spec for SSH certificates as defined at https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.certkeys. It instead seems to be arbitrarily chosen by the project as some limit was needed. * Address formatting error. * Comment on valid_prinicpals size limit plus test added. --------- Co-authored-by: Jake <jake@vaultish.com>
* deprecate the rest of DSA support for SSH (#8013)Paul Kehrer2023-01-091-0/+22
| | | | | * deprecate the rest of DSA support for SSH * review comments
* deprecate support for DSA in load_ssh_public_key (#8009)Paul Kehrer2023-01-081-43/+26
| | | | | * deprecate support for DSA in load_ssh_public_key * try to prevent bad things a bit more
* switch to using integers for valid_after/valid_before in SSH certs (#8007)Paul Kehrer2023-01-081-33/+21
| | | | | | | * switch to using integers for valid_after/valid_before in SSH certs * i know this, it's a unix timestamp * one more review nit
* SSHCertificateBuilder (#8004)Paul Kehrer2023-01-081-0/+407
| | | | | | | | | | | * SSHCertificateBuilder This adds support for generating SSH certificates * add deterministic signing tests and valid_for_all_principals * test another edge * one of these two fixes makes no sense
* support SSH certificate parsing (#7960)Paul Kehrer2023-01-071-1/+277
| | | | | | | | | | | | | * support SSH certificate parsing DSA (deliberately) not supported * make a unified API * Update src/cryptography/hazmat/primitives/serialization/ssh.py Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* small refactor in ssh for key type (#7983)Paul Kehrer2023-01-051-20/+23
| | | this prevents duplicating this logic more times for ssh certs
* update for new mypy (with more accurate typing) (#7785)Alex Gaynor2022-11-081-1/+3
|
* PoC for making key serialization more configurable (#7520)Alex Gaynor2022-08-221-4/+11
|
* remove bizzare dead code (#7444)Alex Gaynor2022-07-221-3/+1
|
* feat: drop max password length of 72 characters from ↵Andrew Pantuso2022-07-201-6/+0
| | | | 'serialize_ssh_private_key' (#7439)
* Convert some old-style formatting to f strings (#6945)Alex Gaynor2022-03-131-4/+4
|
* Remove explicit subclassing of object now that all classes are new-style (#6830)Alex Gaynor2022-01-301-5/+5
| | | As someone who first with Python in 2.4 or so, this habit is going to be hard to break.
* Format for new black (#6828)Alex Gaynor2022-01-291-1/+1
|
* more internal typing for ssh (#6779)Paul Kehrer2022-01-031-25/+63
|
* Swap out the struct module for int methods (#6774)Alex Gaynor2021-12-301-7/+3
| | | If nothing else these are mypy friendly
* More typing of the ssh module internals (#6772)Alex Gaynor2021-12-291-33/+37
| | | | | * More typing of the ssh module internals * old python
* Start typing the internals of the ssh module (#6761)Alex Gaynor2021-12-271-6/+23
|
* add some more mypy flags (#6751)Paul Kehrer2021-12-231-4/+1
| | | | remove some unneeded type ignores. This work found a missing type and added it as well.
* deprecate backend part 10 of n (#6529)Paul Kehrer2021-11-031-28/+21
|
* more typing (#5887)Paul Kehrer2021-03-021-4/+9
| | | | | | | | | | | * backend typing for twofactor package and more otp work * even more typing * style fixes * no generic typing for _get_backend * remove unneeded typing
* add serialization type hinting (#5718)Paul Kehrer2021-01-301-5/+30
| | | | | | | | | * add serialization type hinting * reorganize to prevent circular dependency * review feedback * damn you black
* Introduce the most very basic mypy type checking (#5706)Alex Gaynor2021-01-281-1/+7
| | | Nothing is really annotated, just getting to clean.
* Complete removal of py2 (#5533)Alex Gaynor2020-12-091-4/+2
| | | | | * Drop Python 2 * Black everything
* Remove utils.int_from_bytes (#5609)Alex Gaynor2020-12-091-1/+1
|
* Remove __future__ import from our code (#5610)Alex Gaynor2020-12-091-1/+0
|
* Remove Python2 from CI and code that branched on it (#5607)Alex Gaynor2020-12-081-5/+1
| | | | | | | | | | | | | * Remove Python2 from CI and code that branched on it * Update setup.py Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com> * remove * review feedback Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>
* new black, actually slightly different than the old black (#5429)Paul Kehrer2020-08-261-20/+10
|
* use _get_backend everywhere (#5408)Paul Kehrer2020-08-161-4/+3
| | | | | * use _get_backend everywhere * black
* make backend optional in serialization (#5392)Paul Kehrer2020-08-151-3/+5
|
* Paint it Black by the Rolling Stones (#5324)Alex Gaynor2020-07-201-7/+14
|
* Support OpenSSH private key serialization format (#5146)Marko Kreen2020-06-201-95/+627
| | | | | | | | | * ssh.py contains load/serialize code. * Add PrivateFormat.OpenSSH to .private_bytes() format. * Add load_ssh_private_key(). * Use new code for PublicFormat.OpenSSH too. * load_ssh_public_key() now supports reading signed public keys. * Supported algorithms: rsa, dsa, ec, ed25519. * Optional dependency on 'bcrypt' package via [ssh] extra
* support ed25519 openssh public keys (#4785)Paul Kehrer2019-02-271-1/+12
| | | | | | * support ed25519 openssh public keys * don't need this check
* Compressed point support (#4629)Paul Kehrer2018-12-111-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | * compressed point support * refactor to use oct2point directly * small docs change * remove deprecation for the moment and a bit of review feedback * no backend arg, implicitly import it * missed a spot * double oops * remove superfluous call * use refactored method * use vector file * one last item
* Move SSH serialization to it's own file (#4607)Alex Gaynor2018-11-241-0/+143
* Move SSH serialization to it's own file * flake8
View Lorry Controller Status