summaryrefslogtreecommitdiff
path: root/admin
Commit message (Collapse)AuthorAgeFilesLines
* cleanup old python compat -- replaced "unicode" alias in favor of "str"Eli Collins2020-10-061-2/+1
|
* cleanup old python compat -- removed PY2 & PY3 conditionalsEli Collins2020-10-061-4/+0
|
* cleanup old python compat -- removed all "from __future__" importsEli Collins2020-10-064-5/+0
|
* Merge from stableEli Collins2019-11-101-1/+1
|\
| * docs: pypi redirect msg replaced w/ cloud_sptheme's auto_redirect helper,Eli Collins2017-04-051-1/+1
| | | | | | | | building now uses $SPHINX_BUILD_TAGS env var.
* | compat cleanup: removed print_() compat helper now that py25 support dropped.Eli Collins2017-02-171-4/+5
| |
* | compat cleanup: replaced all u("") instances with u""Eli Collins2017-02-171-6/+6
| | | | | | | | | | | | | | realized can do this now that we're requiring python3 >= 3.3. had to keep u() helper around for u(r"") instances, since py3 doesn't have ur"". but switched it to use ascii decoding for py2, to make sure things are clean.
* | Merge with stableEli Collins2017-01-302-1/+114
|\ \ | |/
| * bumped to 1.7.1, related doc updates1.7.1Eli Collins2017-01-301-1/+1
| |
| * Per issue 83, all "harden_verify" code is now deprecated & a noop.Eli Collins2017-01-291-0/+113
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | will be removed completely in 1.8. Rationale: Aside from the arguments in issue 83, performed a timing analysis, and decided harden_verify framework wasn't going to be easily workable to prevent a timing attack anyways (see attached admin/plot_verify_timing.py script). Changes: * dummy_verify() has been kept around, but now uses .verify() against a dummy hash, which is guaranteed to have correct timing (though wastes cpu cycles). * Removed most harden_verify code, treating it as NOOP just like min_verify_time. Similarly, removed most documentation references to.
* | Merge from stableEli Collins2016-12-191-1/+1
|\ \ | |/
| * setup.py: fixed hg revision stamping so builds from sdist don't try toEli Collins2016-12-051-1/+1
| | | | | | | | re-append hg revision; relocated code to ._setup helper package.
* | general: went ahead and removed a bunch of deprecated features that were ↵Eli Collins2016-11-281-18/+5
|/ | | | | | | | | scheduled for removal in v1.8. this removes CryptPolicy, unix_fallback, some old HtpasswdFile methods, and more. tests were updated as well. see history/1.8 for a complete list.
* setup: refresh of build scripts, updated version stamping procedureEli Collins2016-11-221-3/+5
|
* hash: fix PyCharm autocompletion of passlib.hashEli Collins2016-11-101-0/+106
| | | | | | | | | | | | Issue for a while has been that IDEs such as PyCharm can't detect autocompletion in 'passlib.hash', because the module is replaced w/ a lazy-loading object, that breaks it's source inspection. As workaround, that module now contains a block listing all the imports explicitly. This block is trapped in a "if False:" block so it will do nothing, but that seems sufficient for PyCharm to autocomplete with. Script "admin/regen.py" can be used to autogenerate this list when registry.py changes.
* pbkdf2: removed support for M2Crypto backend -- was only useful for sha1Eli Collins2016-06-201-15/+0
| | | | | (a border case anyways), and hashlib or fastpbkdf2 are much better choices for this use case.
* pbkdf2_hmac: now supports hashlib.pbkdf2_hmac() and fastpbkdf2 as backends.Eli Collins2016-06-201-2/+2
| | | | | | | * digest code now checks for fastpbkdf2 & hashlib backends * tests: added some more test vectors from fastpbkdf2 * to match hashlib, now throwing OverflowError on large keylens, not ValueError. * to match hashlib, now throwing ValueError on keylen=0, previously returned b""
* crypto/pbkdf2: refactored to use 3 different builtin backends, added ↵Eli Collins2016-06-181-0/+167
| | | | | | benchmark tests. this includes some temp code, committing to test on various systems.
* renamed PasswordHandler.replace() back to PasswordHandler.using()Eli Collins2016-06-151-4/+4
| | | | | this basically reversed rev 5c41b0153d4f; after using it a bit more, decided the name didn't indicate as well what the method was doing.
* PasswordHash.hash() api shift: deprecating passing settings kwds into hash() --Eli Collins2016-06-151-16/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | callers should use handler.replace(**settings).hash() instead. this is being done because it greatly streamlines the internals of the .hash() implementation, and allows some redundant configuration parsing to be extracted from the .hash() methods and merged in with existing code in .replace(). this also opens things up for alternate code architectures for implementing new hashers, making it easier to wrap existing libraries (e.g. argon2). internals --------- * replaced a bunch of internal .hash(**settings) calls * GenericHandler - stripped out 'relaxed' keyword from constructor, since it's no longer passed by hash() etc. - _norm_checksum() now only invoked if checksum is specified (simplifies logic). keeping support for 'relaxed' mode, but only as explicit keyword. - removed some unused comments about .from_string() & .to_string() * HasSalt mixin: - .replace() now supports 'salt' keyword, creates variant which has a fixed salt string. - 'salt size' keyword removed from ctor, now handled by .replace() call - _norm_salt() converted to class method so it can be used by .replace() 'salt' keyword code. - per-instance bits of _norm_salt() relocated to HasSalt.__init__ proper - _generate_salt() converted to class method, since no longer depends on instance config. * HasRounds mixin: - similar to HasSalt, relocates per-instance bits of _norm_rounds() into HasRounds.__init__() proper. - remainder of _norm_rounds() turned into class method, merged with ._clip_to_valid_rounds() helper to reduce duplication. - _generate_rounds() converted to class method, since no longer depends on instance config. hashers ------- * fshp: added support for 'variant' keyword to replace() * unix_disabled: added support for 'marker' keyword to replace(), added UTs. * cisco_type7: to match HasSalt, added support for 'salt' keyword to replace(), added UTs. * sha256/512_crypt: now uses custom salt & rounds parsing, rather than relaxed kwd, to handle correctable-but-invalid config strings. unittests --------- * removed checks for PasslibConfigWarning when setting hash(rounds=) out of policy bounds, since that now *is* setting the policy. * adapted some handler ctor to deal w/ lack of 'relaxed' kwd docs ---- * updated docstrings listing hash() keywords for each scheme to list them as .replace() keywords. * updated example code to use .replace() * fleshed out api docs about the change
* deprecating the 'vary_rounds' option -- *very* little security benefit,Eli Collins2016-06-101-1/+0
| | | | | | | and not worth the amount of code it requires to support it. * stripped out vary_rounds from all internal presets * added deprecation warning if it's ever used
* passlib.tests.test_totp: use proper timing tool for runtime measurement,Eli Collins2016-06-101-18/+2
| | | | prevents some spurious test failures when under erratic system load
* .encrypt() method renamed to .hash(), other api cleanupsEli Collins2016-06-101-7/+7
| | | | | | | | | | | | | | | | .encrypt() ---------- hash.encrypt() & context.encrypt() have been renamed to .hash(). this should take care of the long-standing issue 21 (the poor naming of .encrypt). per docs, legacy aliases will remain in place until passlib 2.0. .genhash() / .genconfig() ------------------------- taking advantage of this reorganization to also deprecate .genconfig() and .genhash() -- they're not really useful in a modern system, nor as needed for historical support as initially thought: .genconfig() will be retired completely in passlib 2.0; .genhash() is rolled into the new .hash() method along with .encrypt().
* passlib.pwd: big cleanup pass, removing code that won't be ready for releaseEli Collins2016-02-111-5/+5
| | | | | | | | | | | | | | | | | | | | | | | * split generate() into genword() & genphrase() -- APIs are just too different to keep combined. * renamed internal calc funcs to better reflect their purpose. * commented out PhraseGenerator's min_chars code, can't confirm it's doing correct thing. * commented out password strength estimator, too half-baked. * tried to simplify SequenceGenerator attributes. * genword(): defined some base charsets to work with * genphrase(): wordsets now stored uncompressed (not really that big, and .whl will compress everything for transport). * fleshed out UTs for genword() & genphrase() * updated docs
* relocated many of the crypto routes inside passlib.utils,Eli Collins2016-02-101-4/+4
| | | | | | | | | | | | | | | | | | | and moved them to a separate passlib.crypto subpackage. along with this move, made a few api cleanups: * unified all code that's looking up hashes to use new passlib.crypto.lookup_hash() wrapper, which takes care of hash name normalization, loading fallback implementations, and alg metadata inspection, all hidden behind a memoized function. * deprecated pbkdf2() in favor of pbkdf2_hmac() -- only real use, and new signature matches stdlib function. additionally, this version is a bit faster, due to some assumptions that can be made due to the PRF always being HMAC based. * added compile_hmac() helper which does an even more efficient job of pre-compiling a keyed HMAC function; this helped speed up pbkdf2 a bit more.
* Merge from stableEli Collins2015-07-251-48/+3
|\
| * stripped out some remaining googlecode references in docsEli Collins2015-07-251-48/+3
| |
* | Merge with stableEli Collins2013-12-281-7/+29
|\ \ | |/ |/|
| * Merge from stableEli Collins2013-12-271-0/+26
| |\
| * \ Merge password generation helpers into default (not completed, but will be ↵Eli Collins2013-05-061-11/+19
| |\ \ | | | | | | | | | | | | before 1.7 release)
| | * | pbkdf cleanupsEli Collins2013-04-101-0/+10
| | | | | | | | | | | | | | | | | | | | * updated sha1_crypt to use get_keyed_prf(), should be ~10% faster * documented get_hash_info() and get_keyed_prf()
| | * | removed some unused importsEli Collins2013-04-091-3/+1
| | | |
| | * | style cleanupsEli Collins2013-04-091-8/+8
| | | |
| * | | consolidated entropy helper functionsEli Collins2013-05-061-0/+14
| |/ /
| * | Merge from stableEli Collins2013-01-231-11/+7
| |\ \
| * | | pbkdf2() sped up ~20% by precomputing intermediate hmac hashesEli Collins2013-01-231-7/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * also added get_hash_info(), get_keyed_prf() helpers (which still need their own docs & unittests) * a few more tweaks to simplify code paths in pbkdf2.py
* | | | combine pypi & gc upload scriptsEli Collins2013-12-283-56/+97
| | | |
* | | | style cleanups (transplant of rc94c6072a652 in default)Eli Collins2013-12-271-8/+8
| |_|/ |/| |
* | | added bcrypt helpers to benchmark scriptEli Collins2013-12-221-0/+26
| |/ |/|
* | various documentation updatesEli Collins2012-09-201-17/+20
|/
* project-wide whitespace & comment cleanup (it's been a couple of years)Eli Collins2012-08-011-2/+2
|
* _CryptConfig now pre-calculates default scheme for each category, checks ↵Eli Collins2012-07-091-1/+3
| | | | | | | against deprecated list (closes issue 39) * also added some unittests to catch 3 cases covered in issue 39, and some others as well.
* removed some unused files, tweaked some internal commentsEli Collins2012-06-271-256/+0
|
* tweaked release scripts - not pushing eggs again (at least until C extensions)Eli Collins2012-05-012-6/+37
|
* assorted bugfixes & additional test coverageEli Collins2012-04-301-1/+1
|
* assorted small details that weren't covered in the last few mergesEli Collins2012-04-271-2/+13
|
* sped up pbkdf2 implementation by 60% or so - upped the rounds for all pbkdf2 ↵Eli Collins2012-04-191-1/+14
| | | | hashes
* updated tox config, moved GAE helper into tests module to silence tox warningEli Collins2012-04-171-9/+0
|
* CryptPolicy deprecation, part 5 - updated docs, changelog, benchmark scriptEli Collins2012-04-171-83/+174
|
* clarify behavior for secret=None and hash=NoneEli Collins2012-04-111-2/+2
| | | | | | | | | | | | | | | | | | | | | | | * passing a non-string secret or non-string hash to any CryptContext or handler method will now reliably result in a TypeError. previously, passing hash=None to many handler identify() and verify() methods would return False, while others would raise a TypeError. other handler methods would alternately throw ValueError or TypeError when passed a value that wasn't unicode or bytes. the various CryptContext methods also behaved inconsistently, depending on the behavior of the underlying handler. all of these behaviors are gone, they should all raise the same TypeError. * redid many of the from_string() methods to verify the hash type. * moved secret type & size validation to GenericHandler's encrypt/genhash/verify methods. this cheaply made the secret validation global to all hashes, and lets _calc_digest() implementations trust that the secret is valid. * updated the CryptContext and handler unittests to verify the above behavior is adhered to.
View Lorry Controller Status