summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
* release 19.0.0 (#808)19.0.0Paul Kehrer2019-01-211-1/+1
|
* changelog and call it 19 now (#807)Paul Kehrer2019-01-211-1/+1
|
* add key types consts (#776)Igr2019-01-211-0/+2
|
* Fixes incorrect rtype in documentation (#802)Gaurav Malhotra2019-01-211-2/+2
| | | | | rtype for the following was incorrect: X509Req.from_cryptography X509.from_cryptography
* Handle NULL bytes in get_components() values (#804)Romuald Brunet2019-01-211-5/+5
| | | | | | | | | | | * Handle NULL bytes in get_components() values Some old software may generate "bogus" CN with each character preceded by a NULL. This is already handled in commonName, but wasn't in get_components() * review fixes (fix py3 test & avoid unpack/cast)
* Hypothetically fixes pyOpenSSL tests (#805)Paul Kehrer2019-01-211-0/+13
| | | | | | | | | | | | | | | * fix openssl CLI testing for 1.1.1 * various 1.1.1 related fixes some of which are just admitting TLS 1.3 is fundamentally different and pinning the tests to TLS 1.2 * flake8 fixes * allow travis_infra env var through * fix twisted
* Update OpenSSL manpage link to x509v3_config (#789)Cyril Stoller2018-08-271-1/+1
|
* Add note on zero-based certificate version value (#790)Cyril Stoller2018-08-271-1/+2
|
* X509Store.add_cert no longer raises an error on duplicate cert (#787)Paul Kehrer2018-08-231-1/+10
| | | | | | * X509Store.add_cert no longer raises an error on duplicate cert * move changelog entry
* Only allocate exponent in the TYPE_RSA path. (#767)David Benjamin2018-06-051-5/+5
| | | Not much point in making it otherwise.
* Tone down the comment around SSL_set_tlsext_status_ocsp_resp. (#764)David Benjamin2018-05-221-7/+2
| | | | | | | | | The ownership semantics of SSL_set_tlsext_status_ocsp_resp are not as complex as the comment suggests. There's no leak or complex lifetime. It's an ownership transfer of an OPENSSL_malloc'd buffer. The documentation is lacking, and making the copy internally would have been tidier (though less efficient if the OCSP response where generated by i2d_OCSP_RESPONSE), but this sort of thing has precedent in OpenSSL's API.
* Fix SSL_CTX_set_tlsext_servername_callback type signature. (#763)David Benjamin2018-05-221-1/+1
| | | | | | See also https://github.com/pyca/cryptography/pull/4227. I suspect this is a no-op since cffi is probably just generating its own function stubs and every ABI makes const and non-const pointers the same. Still, better to match things.
* reopen master for 18.1 (#761)Paul Kehrer2018-05-161-1/+1
| | | | | | * reopen master for 18.1 * there are four dashes
* 18.0.0 release time (#760)18.0.0Paul Kehrer2018-05-161-1/+1
|
* Add Connection.get_certificate method (#733)Jeremy Lainé2018-05-161-0/+12
| | | | | | | | This makes it possible to retrieve the local certificate (if any) for a Connection. An example where this is useful is when negotiating a DTLS-SRTP connection, the fingerprint of the local certificate needs to be communicated to the remote party out-of-band via SDP.
* Make sure a NotImplementedError is always raised on Connection.makefile() (#744)Ayke2018-05-161-1/+1
| | | | | | | | | | | * Make sure a NotImplementedError is always raised on Connection.makefile With this patch, code which calls (for example) conn.makefile('rb') will get a NotImplementedError instead of a confusing TypeError: TypeError: makefile() takes 1 positional argument but 2 were given * ignore any args/kwargs passed
* Add Context.set_tlsext_use_srtp (#734)Jeremy Lainé2018-05-161-0/+15
| | | | This allows negotiating SRTP keying material, which is useful when using DTLS-SRTP, as WebRTC does for example.
* Always enable auto retry (#753)Paul Kehrer2018-05-141-0/+5
| | | | | | | | | | | | * test using auto retry * add/update changelog and add comment * wordsmithing * Update CHANGELOG.rst * Update CHANGELOG.rst
* Raise minimum cryptography version to 2.2.1, drop python 2.6 (#742)Jeremy Lainé2018-03-211-14/+4
|
* Don't add not supported SSL_ST_* into _all_, fixies #738 (#739)Ondřej Nový2018-03-011-4/+6
| | | | | | | | | Without this patch this fails: >>> from OpenSSL.SSL import * Traceback (most recent call last): File "<string>", line 1, in <module> File "/usr/lib/python2.7/dist-packages/cryptography/utils.py", line 124, in __getattr__ obj = getattr(self._module, attr) AttributeError: 'module' object has no attribute 'SSL_ST_INIT'
* Use autofocus for all module documentation/docstrings (#737)Alex Chan2018-02-152-122/+261
| | | | | | | | * Use autodoc for OpenSSL.crypto * Use autodoc for the SSL.Context class * Use autodoc for SSL.Connection
* open for 17.6.0 (#727)Paul Kehrer2017-12-011-1/+1
|
* 17.5.0 version bump (#726)17.5.0Paul Kehrer2017-11-301-1/+1
|
* Export keying material support (#725)Paul Kehrer2017-11-301-0/+24
| | | | | | | | | | | | | | * added method to export keying material from an ssl connection * updated tests to use bytestrings to avoid breaking python3 tests * added additional comments to test * simplify export_keying_material * add changelog * address review feedback
* fix a memory leak and a potential UAF and also #722 (#723)Paul Kehrer2017-11-302-6/+6
| | | | | | | | * fix a memory leak and a potential UAF and also #722 * sanity check * bump cryptography minimum version, add changelog
* define __all__ to make wildcard import work (#719)Nicolas Karolak2017-11-262-0/+128
|
* reopen master (#718)Paul Kehrer2017-11-211-1/+1
|
* bump to 17.4.0 (#714)17.4.0Paul Kehrer2017-11-211-1/+1
|
* restore a subset of the rand module (#708)Paul Kehrer2017-11-201-0/+40
| | | | | | | | | | * restore a subset of the rand module * flake * remove cleanup, go ahead and assume status will always be 1 * lighten and add power
* Don't use things after they're freed...duh (#709)Alex Gaynor2017-11-202-14/+38
| | | | | | | | * Don't use things after they're freed...duh * changelog * more details
* fix errors with latest flake8 (#710)Alex Gaynor2017-11-201-4/+4
| | | | | | | | | | * fix errors with latest flake8 * Also fix the macOS builds * fix? * allow urllib3 to fail for now
* Improve documentation for passphrase callback (#703)Diego Fernandez2017-10-121-1/+1
| | | Address issue #701
* 17.4.0.dev0 bump (#694)Paul Kehrer2017-09-131-1/+1
|
* bump version and update changelog (#693)17.3.0Paul Kehrer2017-09-131-1/+1
| | | | | | | | * bump version and update changelog * add changelog entries for the memory leak fixes * backticks
* Avoid a double call to X509_STORE_CTX_init as it leaks memory (#691)Jeremy Cline2017-09-141-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes an issue where each instance of ``X509StoreContext`` would leak a small amount of memory, but only if ``verify_certificate`` was called. The reason for this is that ``X509_STORE_CTX_init`` is called in ``X509StoreContext.__init__`` and at the start of ``X509StoreContext.verify_certificate``. According to the man page for ``X509_STORE_CTX_init``: "X509_STORE_CTX_init() sets up ctx for a subsequent verification operation. It must be called before each call to X509_verify_cert(), i.e. a ctx is only good for one call to X509_verify_cert(); if you want to verify a second certificate with the same ctx then you must call X509_STORE_CTX_cleanup() and then X509_STORE_CTX_init() again before the second call to X509_verify_cert()." Prior to this commit, the following script would cause a memory leak: ``` from OpenSSL.crypto import ( X509Store, X509StoreContext, load_certificate, FILETYPE_PEM) certificate = """ -----BEGIN CERTIFICATE----- MIIESTCCA7KgAwIBAgIBAzANBgkqhkiG9w0BAQUFADCBoDELMAkGA1UEBhMCVVMx CzAJBgNVBAgTAk5DMRAwDgYDVQQHEwdSYWxlaWdoMRcwFQYDVQQKEw5GZWRvcmEg UHJvamVjdDEPMA0GA1UECxMGZmVkbXNnMQ8wDQYDVQQDEwZmZWRtc2cxDzANBgNV BCkTBmZlZG1zZzEmMCQGCSqGSIb3DQEJARYXYWRtaW5AZmVkb3JhcHJvamVjdC5v cmcwHhcNMTIwNzE1MjExODUyWhcNMjIwNzEzMjExODUyWjCB2DELMAkGA1UEBhMC VVMxCzAJBgNVBAgTAk5DMRAwDgYDVQQHEwdSYWxlaWdoMRcwFQYDVQQKEw5GZWRv cmEgUHJvamVjdDEPMA0GA1UECxMGZmVkbXNnMSswKQYDVQQDEyJzaGVsbC1hcHAw MS5waHgyLmZlZG9yYXByb2plY3Qub3JnMSswKQYDVQQpEyJzaGVsbC1hcHAwMS5w aHgyLmZlZG9yYXByb2plY3Qub3JnMSYwJAYJKoZIhvcNAQkBFhdhZG1pbkBmZWRv cmFwcm9qZWN0Lm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyV0ydvno pITmFs0kfploKj6nW0/COzp0rDwwvuWZF2KDdl1AeRWzfspOQOWIK5V+o2qxYA6t aiK4bPfylYL1IGIwlVP9ma5zwkRvWketWjGORp5B7g7oECQOBo3gnQt0Uf5TWAQ1 6Wn0bCrIQSqOWVKScK9vUk/oomUlAZbksEcCAwEAAaOCAVcwggFTMAkGA1UdEwQC MAAwLQYJYIZIAYb4QgENBCAWHkVhc3ktUlNBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0 ZTAdBgNVHQ4EFgQUd3FXBbD2JW3qcmq+5VP7GcuxHF4wgdUGA1UdIwSBzTCByoAU AJil1efEVQ6Eo2f+ZkoW4AQV3SGhgaakgaMwgaAxCzAJBgNVBAYTAlVTMQswCQYD VQQIEwJOQzEQMA4GA1UEBxMHUmFsZWlnaDEXMBUGA1UEChMORmVkb3JhIFByb2pl Y3QxDzANBgNVBAsTBmZlZG1zZzEPMA0GA1UEAxMGZmVkbXNnMQ8wDQYDVQQpEwZm ZWRtc2cxJjAkBgkqhkiG9w0BCQEWF2FkbWluQGZlZG9yYXByb2plY3Qub3JnggkA juso2KkTnXwwEwYDVR0lBAwwCgYIKwYBBQUHAwIwCwYDVR0PBAQDAgeAMA0GCSqG SIb3DQEBBQUAA4GBABG1zG/lzYyz/phhROq6nzk3QUVeNGyxFdxxoB57j4xDi60y zy2yAYe9swqlL1Gk94/Zf/lLPFxOM+NinTOh/o6z0bEBBCufwFKiS+ug/pjsI o69vC03F21S0pquM8bQjcdoA5q5pdiY/Bq5HULmosyA+ENu69ovQGZZUiJb/ -----END CERTIFICATE----- """ ca_certificate = """ -----BEGIN CERTIFICATE----- MIIDyzCCAzSgAwIBAgIJAI7rKNipE518MA0GCSqGSIb3DQEBBQUAMIGgMQswCQYD VQQGEwJVUzELMAkGA1UECBMCTkMxEDAOBgNVBAcTB1JhbGVpZ2gxFzAVBgNVBAoT DkZlZG9yYSBQcm9qZWN0MQ8wDQYDVQQLEwZmZWRtc2cxDzANBgNVBAMTBmZlZG1z ZzEPMA0GA1UEKRMGZmVkbXNnMSYwJAYJKoZIhvcNAQkBFhdhZG1pbkBmZWRvcmFw cm9qZWN0Lm9yZzAeFw0xMjA3MTUyMTE4NTFaFw0yMjA3MTMyMTE4NTFaMIGgMQsw CQYDVQQGEwJVUzELMAkGA1UECBMCTkMxEDAOBgNVBAcTB1JhbGVpZ2gxFzAVBgNV BAoTDkZlZG9yYSBQcm9qZWN0MQ8wDQYDVQQLEwZmZWRtc2cxDzANBgNVBAMTBmZl ZG1zZzEPMA0GA1UEKRMGZmVkbXNnMSYwJAYJKoZIhvcNAQkBFhdhZG1pbkBmZWRv cmFwcm9qZWN0Lm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA9J6RmGr1 LzSJ5Fau2wdkVUiS5WXBcd0bNPyUJ9/G7t9SrycnLnEK4GQh2B525p4SCqvsHZtM 8rqii/Y2PPF5PbpgVjJLYsJk4SSv84aH+VPYcaEtYlPClXgHb3J9jgAxgHBHkJMQ 7mvxiIau7frKFqmJGZkxO2M+Sv8eLCKLJP8CAwEAAaOCAQkwggEFMB0GA1UdDgQW BBQAmKXV58RVDoSjZ/5mShbgBBXdITCB1QYDVR0jBIHNMIHKgBQAmKXV58RVDoSj Z/5mShbgBBXdIaGBpqSBozCBoDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk5DMRAw DgYDVQQHEwdSYWxlaWdoMRcwFQYDVQQKEw5GZWRvcmEgUHJvamVjdDEPMA0GA1UE CxMGZmVkbXNnMQ8wDQYDVQQDEwZmZWRtc2cxDzANBgNVBCkTBmZlZG1zZzEmMCQG CSqGSIb3DQEJARYXYWRtaW5AZmVkb3JhcHJvamVjdC5vcmeCCQCO6yjYqROdfDAM BgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAN5r+1rbeTyGDdlelbqWOXBu uS0a9BfusO0uwf3tHK9zeB5CDKFgxdfSZ+Fxg1w2HFRHhCOYoZ2ASPfbyANTzxUF fVAId1uhBD1SlhXpTb3Ndo4uXfalf3W8MrQzFiVHbevvfsyd+RwoVT/PDokE3i4A fftCd0uwvSqVgyE28SFt -----END CERTIFICATE----- """ ca_cert = load_certificate(FILETYPE_PEM, ca_certificate) cert = load_certificate(FILETYPE_PEM, certificate) cert_store = X509Store() cert_store.add_cert(ca_cert) while True: cert_store_context = X509StoreContext(cert_store, cert) cert_store_context.verify_certificate() ``` Moving the creation of ``X509StoreContext`` outside the loop stops the memory leak. Signed-off-by: Jeremy Cline <jeremy@jcline.org>
* Provide a destructor for the CRL object (#690)Jeremy Cline2017-09-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | This frees the memory allocated for the CRL object. Prior to this commit, the following script would leak memory: ``` from OpenSSL.crypto import load_crl, FILETYPE_PEM crl = """ -----BEGIN X509 CRL----- MIIBfDCB5jANBgkqhkiG9w0BAQsFADCBoDELMAkGA1UEBhMCVVMxCzAJBgNVBAgT Ak5DMRAwDgYDVQQHEwdSYWxlaWdoMRcwFQYDVQQKEw5GZWRvcmEgUHJvamVjdDEP MA0GA1UECxMGZmVkbXNnMQ8wDQYDVQQDEwZmZWRtc2cxDzANBgNVBCkTBmZlZG1z ZzEmMCQGCSqGSIb3DQEJARYXYWRtaW5AZmVkb3JhcHJvamVjdC5vcmcXDTE3MDYx NTIxMDMwOFoXDTM3MDYxMDIxMDMwOFowFDASAgECFw0xMjA3MTUyMTE4NTJaMA0G CSqGSIb3DQEBCwUAA4GBAGOBuDxmRFNcYP71LBsCOfFzKij00qpxM01d5/G6+0kM WJT8oTajMQoY6oISvQDq6TkwEoKc1yl6Ld1/XTtCNOhbybzRBAVf/Lxi/nRPP1JO qOdZs5jMLLQq1mRJz+MgKHHTDlnvpbjHMuyTss1RblFDr4iZPHMcBNKPGIj3pmpA -----END X509 CRL----- """ for _ in range(0, 1000000): load_crl(FILETYPE_PEM, crl) ``` Signed-off-by: Jeremy Cline <jeremy@jcline.org>
* Delete rand.py (#675)Alex Gaynor2017-07-252-171/+2
|
* Fixes #655 -- deprecate OpenSSL.tsafe (#673)Alex Gaynor2017-07-221-0/+7
| | | | | | * Fixes #655 -- deprecate OpenSSL.tsafe * changelog
* Start new release cycle (#672)Hynek Schlawack2017-07-201-1/+1
|
* Prepare 17.2.0 (#671)17.2.0Hynek Schlawack2017-07-201-1/+1
| | | | | | * Fix version * Prepare 17.2.0
* (EC)DSA signature fix (#670)Paul Kehrer2017-07-201-3/+4
| | | | | | | | | | | | | * Write a test - signatures with EC keys (#609) * Ask for signature length before allocating a buffer. This fixes a potential heap buffer overflow that may happen when a signature is longer than the private key, as with X9.62 ECDSA (#609). * change approach to EVP_PKEY_size and add changelog * add a small assert
* Bend some recent changes to standards (#669)Hynek Schlawack2017-07-201-1/+1
|
* fix #664 (#665)Paul Kehrer2017-07-191-2/+4
| | | | | | | | | | | | * fix #664 bytes and strings are different things. * update changelog * let's just make the sentinel values byte strings * flake8
* Fixed #631 -- deprecate all of OpenSSL.rand (#658)Alex Gaynor2017-07-061-0/+7
| | | | | | | | * Fixed #631 -- deprecate all of OpenSSL.rand * syntax fix * flake8
* Start new release cycle (#654)Hynek Schlawack2017-06-301-1/+1
|
* Prepare 17.1 (#653)17.1.0Hynek Schlawack2017-06-301-1/+1
| | | | | | * Prepare 17.1.0 * Fix changelog markup
* Removed the deprecated md5 default on CRL.export() (#652)Alex Gaynor2017-06-301-8/+1
| | | | | | | | | | | | | | * Removed the deprecated md5 default on CRL.export() * Doh * unused import * fixed tests * last one * py3k!!!!!
* Kill some commented out code and other cleanups (#649)Alex Gaynor2017-06-302-26/+5
|
* Kill dead code (#647)Alex Gaynor2017-06-291-6/+5
| | | | | | | | | | * Simplify code * dead code * unused... * write imports normally
* try loading trusted certs from a list of fallbacks (#633)Paul Kehrer2017-06-291-0/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * try loading trusted certs from a list of fallbacks pyca/cryptography will shortly begin shipping a wheel. Since SSL_CTX_set_default_verify_paths uses a hardcoded path compiled into the library, this will start failing to load the proper certificates for users on many linux distributions. To avoid this we can use the Go solution of iterating over a list of potential candidates and loading it when found. * capath is lazy loaded so we need to do a lot more checks This now checks to see if env vars are set as well as seeing if the dir exists and has valid certs in it. If either of those are true (or the number of certs is > 0) it won't load the fallback. If it does do the fallback it will also attempt to load certs from a dir as a final fallback * remove an early return * this shouldn't be commented out * oops * very limited testing * sigh, can't use these py3 exceptions of course * expand the tests a bit * coverage! * don't need this now * change the approach to use a pyca/cryptography guard value * test fix * older python sometimes calls itself linux2 * flake8 * add changelog * coverage * slash opt
View Lorry Controller Status