summaryrefslogtreecommitdiff
path: root/src/cryptography/x509
Commit message (Collapse)AuthorAgeFilesLines
* support X.509 certificate PSS signing (#8888)Paul Kehrer2023-05-101-1/+13
| | | | | | | | | | | | | * support X.509 certificate PSS signing no CSR, CRL, etc * handle PSS.(MAX_LENGTH, DIGEST_LENGTH), review feedback * name the kwarg * test improvements * skip if sha3 isn't supported
* add signature_algorithm_parameters to certificate (#8795)Paul Kehrer2023-05-071-0/+10
| | | | this allows easier verification of cert signatures, but more specifically allows PSS signature verification
* Support msCertificateTemplate extension (#8695)Paul Kehrer2023-04-102-0/+61
| | | | | | | * support ms certificate template * contortions for rust coverage * review feedback
* Use from __future__ import annotations everywhere (#8643)Alex Gaynor2023-03-318-54/+60
|
* Added support for OCSP AcceptableResponses extension (#8617)Alex Gaynor2023-03-272-0/+31
| | | fixes #8589
* Make Union type aliases a documented public API (#8168)Marti Raudsepp2023-03-074-31/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Rename Union type aliases to CamelCase Many `typing.Union` type aliases were previously using `UPPER_SNAKE_CASE`, but Python's convention is `CamelCase` for these (e.g. https://docs.python.org/3/library/typing.html#type-aliases) * Add utils.deprecated for the old non-underscore type aliases * Added documentation for new type aliases & minor tweaks * Use 'versionadded:: 40.0.0' * Fix CertificatePublicKeyTypes vs CertificateIssuerPublicKeyTypes. Rename CertificatePrivateKeyTypes to CertificateIssuerPrivateKeyTypes * Fix imports (ruff) * Fix one more versionadded * Tweak docs & Reorder: CertificateIssuerPublicKeyTypes before CertificateIssuerPrivateKeyTypes * Fix test mypy errors using cast() * Fix black, oops * Revert "Fix black, oops" This reverts commit 85344e231d697bdc0940e105f7aed729445f9743. * Revert "Fix test mypy errors using cast()" This reverts commit b272d8ca95fbbbc62060663f9e8930a139a7a43e. * Revert type of SubjectKeyIdentifier.from_public_key arg * Changelog tweak
* raise UnsupportedAlgorithm instead of ValueError in x509 builder sign (#8397)Paul Kehrer2023-02-261-3/+16
| | | Also change the typing to be an explicit union
* Disallow wildcards in DNSName for name constraints (#8272)gbansaghi2023-02-121-2/+15
| | | | | | | * Disallow wildcards in DNSName for name constraints As discussed in #8253, wildcards are unnecessary according to RFC 5280, and cause issues with at least Firefox. * update changelog
* Use the ruff 'pyupgrade' checks (#8104)Alex Gaynor2023-01-204-37/+37
|
* Add Certificate.verify_signed_by (#8011)Paul Kehrer2023-01-121-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add Certificate.verify_signed_by Verify that the signature on a certificate was created by the private key belonging to another certificate's public key. This code does not validate anything else! It is not a path builder, general x509 validator, etc. * switch to issued_by validate issuer subject matches certificate issuer and refactor * two fixes * signed_by isn't the right target now * coverage * skip test on some *ssls * extensive refactoring * lol * does any of this work * final commit i swear
* Replace deprecated `abstractproperty` (#7943)Viicos2022-12-274-75/+150
| | | | Deprecated since version 3.3, see https://docs.python.org/3/library/abc.html#abc.abstractproperty
* Update formatting for new ruff (#7937)Alex Gaynor2022-12-261-2/+2
|
* Switch from flake8 to ruff (#7920)Alex Gaynor2022-12-217-23/+16
| | | It's more than 60x faster.
* x509: add `load_pem_x509_certificates` (#7878)William Woodruff2022-12-052-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * x509: add `load_pem_x509_certificates` This behaves similarly to `load_pem_x509_certificate`, except that it returns a list of loaded certificates instead of just the first X.509 certificate. It raises if the input contains no PEM-encoded certificates, or if PEM or certificate parsing fail. Signed-off-by: William Woodruff <william@trailofbits.com> * tests/x509: blacken Signed-off-by: William Woodruff <william@trailofbits.com> * Update docs/x509/reference.rst Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> * tests/x509: assert each item in the list is actually a certificate Signed-off-by: William Woodruff <william@trailofbits.com> * bindings: expose `load_pem_x509_certificates` in `x509.pyi` Signed-off-by: William Woodruff <william@trailofbits.com> * tests/x509: test the structure of each cert a bit This has the transitive effect of establishing a fixed order. Signed-off-by: William Woodruff <william@trailofbits.com> * CHANGELOG: record changes Signed-off-by: William Woodruff <william@trailofbits.com> * docs: add PEM to spellcheck allowlist Signed-off-by: William Woodruff <william@trailofbits.com> * docs/x509: document expected param Signed-off-by: William Woodruff <william@trailofbits.com> Signed-off-by: William Woodruff <william@trailofbits.com> Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* Make sure that one of full_name, relative_name or crl_issuer is set in ↵Mathias Ertl2022-10-151-6/+5
| | | | distribution points (#7710)
* add support for creating OCSP requests with precomputed hashes (#7706)Paul Kehrer2022-10-131-4/+40
| | | | | | | | | | | * add support for creating OCSP requests with precomputed hashes * mypy and clippy fixes * flake, fix MSRV * MSRV this time * feedback
* Fix issue #7513 - parsing of RFC4514 strings should reverse the order of ↵Alexandre Machado2022-08-161-1/+9
| | | | | | | | | | | | | | | | | RDNs (#7514) * Fix issue #7513 - parsing of RFC4514 strings should reverse the order of RDNs * Solving code formating issues * Adding comment justifing the reversal of rdns on the RFC4514 parser * Comment changes on CHANGELOG.rst * fixing a typo on method link at CHANGELOG.rst * Removing reference to protected class _RFC4514NameParser from CHANGELOG.rst Co-authored-by: Alexandre Machado <alexandre@softnex.com.br>
* X.509/Certificate: Add `tbs_precertificate_bytes` property (#7279)William Woodruff2022-05-311-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add `tbs_precertificate_bytes` property * docs/x509: document `tbs_precertificate_bytes` Signed-off-by: William Woodruff <william@trailofbits.com> * tests/x509: add two trivial tests Signed-off-by: William Woodruff <william@trailofbits.com> * x509/base: fix lint Signed-off-by: William Woodruff <william@trailofbits.com> * oid: add CERTIFICATE_TRANSPARENCY (1.3.6.1.4.1.11129.2.4.4) Signed-off-by: William Woodruff <william@trailofbits.com> * hazmat/oid: rehome CERTIFICATE_TRANSPARENCY under ExtendedKeyUsageOID Signed-off-by: William Woodruff <william@trailofbits.com> * docs/x509: fix link, help the spellchecker Signed-off-by: William Woodruff <william@trailofbits.com> * x509: Raise ValueError when we can't filter SCT list extension * tests: Expect a `ValueError` when accessing `tbs_precertificate_bytes` in default example * tests, vectors: Add TBS precert vector for test comparison * docs/x509: document the `CERTIFICATE_TRANSPARENCY` OID Signed-off-by: William Woodruff <william@trailofbits.com> * docs/x509: elaborate `tbs_precertificate_bytes` Signed-off-by: William Woodruff <william@trailofbits.com> * rust/x509: remove unused OID Signed-off-by: William Woodruff <william@trailofbits.com> * x509/certificate: tweak error Signed-off-by: William Woodruff <william@trailofbits.com> * tests/x509: reorganize Signed-off-by: William Woodruff <william@trailofbits.com> * Update src/rust/src/x509/certificate.rs Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> * tests/x509: more reorg, rename Signed-off-by: William Woodruff <william@trailofbits.com> * docs: document new testvector Signed-off-by: William Woodruff <william@trailofbits.com> * docs: coax the spellchecker Signed-off-by: William Woodruff <william@trailofbits.com> * tests/x509: use a cert that doesn't require SHA-1 Signed-off-by: William Woodruff <william@trailofbits.com> * tests/x509: test for no extensions at all Signed-off-by: William Woodruff <william@trailofbits.com> Co-authored-by: Alex Cameron <asc@tetsuo.sh> Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* CT: `extensions` -> `extension_bytes` (#7238)William Woodruff2022-05-191-1/+1
| | | Signed-off-by: William Woodruff <william@trailofbits.com>
* CT: add `SignedCertificateTimestamp.extensions` (#7237)William Woodruff2022-05-201-0/+6
| | | Signed-off-by: William Woodruff <william@trailofbits.com>
* x509: fix SignedCertificateTimestamp interface (#7235)William Woodruff2022-05-181-1/+1
| | | | | This didn't get renamed correctly in the last PR. Signed-off-by: William Woodruff <william@yossarian.net>
* x509/CT: expose more SCT internals (#7207)William Woodruff2022-05-131-0/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * WIP * x509: remove TBS work for now Signed-off-by: William Woodruff <william@yossarian.net> * CT: flake8 Signed-off-by: William Woodruff <william@yossarian.net> * CT: remove TODO, add links Signed-off-by: William Woodruff <william@yossarian.net> * CT/SCT: strong enums for HashAlgorithm and SignatureAlgorithm Signed-off-by: William Woodruff <william@yossarian.net> * tests: add SCT hash/signature algorithm tests Signed-off-by: William Woodruff <william@yossarian.net> * tests: fix SignatureAlgorithm test, add signature contents test Signed-off-by: William Woodruff <william@yossarian.net> * rust: unit tests for {Hash,Signature}Algorithm Signed-off-by: William Woodruff <william@yossarian.net> * x509/sct: code coverage shenanigans Signed-off-by: William Woodruff <william@yossarian.net> * asn1, sct: pesky coverage Signed-off-by: William Woodruff <william@yossarian.net> * x509/sct: simplify parsing Signed-off-by: William Woodruff <william@yossarian.net> * docs: document new SCT APIs Signed-off-by: William Woodruff <william@yossarian.net> * docs: add refs to RFC 5246 Signed-off-by: William Woodruff <william@yossarian.net> * SCT: forbid nonsense hash and signature algos No tests, yet. Signed-off-by: William Woodruff <william@yossarian.net> * tests: add invalid hash/sig algo tests Signed-off-by: William Woodruff <william@yossarian.net> * sct: remove ToAttr trait Inline impl into each struct's impl. Signed-off-by: William Woodruff <william@yossarian.net> * sct: remove invalid hash/sig variants These should never appear in the context of SCTs. Signed-off-by: William Woodruff <william@yossarian.net> * sct: collapse matches Handle invalid/unknown variants together. Signed-off-by: William Woodruff <william@yossarian.net> * tests: update SCT tests Signed-off-by: William Woodruff <william@yossarian.net> * sct: add a TODO Signed-off-by: William Woodruff <william@yossarian.net> * sct: return a primitives.hashes object instead of a custom enum Signed-off-by: William Woodruff <william@yossarian.net> Co-authored-by: Alex Cameron <asc@tetsuo.sh>
* Move _CRLREASONFLAGS to be in a sensible place (#7167)Alex Gaynor2022-05-011-0/+11
|
* Fixes #7127 -- added attr_name_overrides on from_rfc4514_string (#7160)Alex Gaynor2022-04-301-4/+13
|
* added octet string tag (#7106)Alex Gaynor2022-04-221-0/+1
| | | fixes #7104
* fixes #7081 -- correctly handle escape sequences in RFC4514 strings (#7083)Alex Gaynor2022-04-161-18/+12
| | | | | * fixes #7081 -- correctly handle escape sequences in RFC4514 strings * Fix multi-digit OID arc parsing
* Implement a parser for RFC4514 strings (#7055)Alex Gaynor2022-04-161-0/+123
| | | | | | | | | | | | | | | | | | | | | | | | | * Initial tests * Implement. Required updating many many tests based on my read of the RFC. Should be reviewed closely. * Fix for py36 * flake8 * Improve coverage on hypothesis test * Remove bad assertion in hypothesis test * Update docs * fix docs * Fixed unicode support * review * docs review
* Added a non-public API for setting the tag on an attribute (#7038)Alex Gaynor2022-04-051-5/+21
| | | fixes #6973
* make ExtensionTypeVar covariant (#7033)Mathias Ertl2022-04-031-1/+3
|
* enforce that GeneralSubtrees for NameConstraints must be None or non-empty ↵Alex Gaynor2022-03-201-0/+8
| | | | (#6983)
* Convert some old-style formatting to f strings (#6945)Alex Gaynor2022-03-131-1/+1
|
* Don't explicitly define __ne__ any longer (#6908)Alex Gaynor2022-02-274-156/+0
| | | At some point it gained a default that was the same as what we were implementing.
* Remove explicit subclassing of object now that all classes are new-style (#6830)Alex Gaynor2022-01-304-17/+17
| | | As someone who first with Python in 2.4 or so, this habit is going to be hard to break.
* Basic support for multiple SINGLERESP messages in one OCSP response, take 2 ↵turettn2022-01-031-0/+66
| | | | | | | | | | | | | | | | | | | | | | | (#6410) * OCSP responses can contain multiple SINGLERESPs Instead of throwing an exception when encountering a OCSP response with multiple SINGLERESPs, throw the exception when attempting to pull a single structure if multiple are present. Add a response_iter property to the OCSP Response object, which allows for iteration through all the SINGLERESPs, and properties to be individually accessed for each. * Small fixes to OCSP multiple response handling. Squash eventually * Docs updates. Should be squashed * Get rid of mutating iterator, replace with separate return object * Fix versionadded strings in docs * Cleanup docs & python bindings.
* consistently use object for other in eq/ne types (#6756)Paul Kehrer2021-12-262-72/+72
| | | | this appears to be best practice and also makes the mypy type-coverage analysis happier
* improvements to public/private key types and misc backend typing (#6734)Paul Kehrer2021-12-233-14/+18
|
* Improve typing of x509.name module (#6726)Alex Gaynor2021-12-221-5/+4
|
* improve typing of x509.bae module (#6727)Alex Gaynor2021-12-221-2/+2
|
* Improve typing of ocsp module (#6721)Alex Gaynor2021-12-221-9/+9
|
* support parsing bitstring values in DNs (#6629)Paul Kehrer2021-11-281-6/+21
| | | | | | | | | | | * support bitstring values in DNs parsing is limited to x500UniqueIdentifier only * Update src/cryptography/x509/name.py Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* allow parsing of nonstandard country name and jurisdiction country name (#6641)Paul Kehrer2021-11-211-2/+15
| | | | | | The spec requires both of these to be exactly two characters to correspond with ISO country codes. Reality is sometimes messier, so this allows parsing (but not encoding) of this invalid data. Parsing will raise a UserWarning if incorrect lengths are detected.
* more typing (#6616)Paul Kehrer2021-11-171-3/+13
|
* support attributes on csrs with an iterable (#6603)Paul Kehrer2021-11-142-2/+76
|
* Allow to serialize extension values as DER bytes strings (#6346)Felix Fontein2021-11-121-0/+95
| | | | | * Allow to serialize extension values as DER bytes string. * Prepare test for SignedCertificateTimestamps.
* allow x25519/x448 public keys in certificatebuilder (#6562)Paul Kehrer2021-11-071-5/+11
| | | | also document that we can return these key types in a certificate, although they can't be self-signed of course
* deprecate backend part 7 of n (#6526)Paul Kehrer2021-11-031-16/+37
| | | | * Move around some code to kill the need for a backend method * Type the backend arg to typing.Any since we just don't care now
* Allow custom attribute shortnames in rfc4514_string (#6490)Marti Raudsepp2021-11-011-10/+25
| | | | | | | | | | | | | `rfc4514_string()` and related methods now have an optional `attr_name_overrides` parameter to supply custom OID to name mappings, which can be used to match vendor-specific extensions. **BACKWARDS INCOMPATIBLE:** Reverted the nonstandard formatting of email address fields as `E` in `rfc4514_string()` methods from version 35.0. The previous behavior can be restored with: `name.rfc4514_string({NameOID.EMAIL_ADDRESS: "E"})` Expanded documentation of `Name.rfc4514_string`.
* Convert CRL creation to Rust (#6496)Alex Gaynor2021-10-311-2/+1
| | | | | | | | | | | * Convert CRL creation to Rust * fixes * small reflows * Delete all teh code * flake8
* Convert CSR creation to Rust (#6495)Alex Gaynor2021-10-311-2/+1
| | | | | | | | | * Convert CSR creation to Rust * put this back * unused * coverage
* Convert x.509 certificate generation to Rust (#6479)Alex Gaynor2021-10-291-1/+1
| | | | | | | | | | | * Convert x.509 certificate generation to Rust * flake8 * Coverage shenangins * moar hashes * moar hashes
View Lorry Controller Status