summaryrefslogtreecommitdiff
path: root/src/OpenSSL/SSL.py
Commit message (Collapse)AuthorAgeFilesLines
* cleanup from_buffer now that we just use cffi natively (#989)masterAlex Gaynor2021-01-161-4/+3
|
* Fix for running on OpenSSL 1.1.0 + CI (#978)Alex Gaynor2020-12-141-1/+4
| | | | | | | * Test on OpenSSL 1.1.0 w/ Debian stretch * Make pyOpenSSL compatible with openssl 1.1.0 again Co-authored-by: Shane Harvey <shnhrv@gmail.com>
* Keep reference to SSL verify_call in Connection object (#956)Arne Schwabe2020-11-271-0/+6
| | | | | | | | | | | | | | * Keep reference to SSL verify_call in Connection object If a set_verify is used on a context before and after a Connection the reference in the SSL* object still points to the old _verify_helper object. Since this object has no longer any references to it, the callback can result in a segfault. This commit fixes the issues by ensuring that as long as the Connection object/SSL* object lives a reference to the callback function is held. * Add Unit test for set_verify_callback deference
* Fix spelling of set in set_verify docstring (#959)Arne Schwabe2020-11-131-2/+2
|
* Drop CI for OpenSSL 1.0.2 (#953)Alex Gaynor2020-10-261-39/+6
| | | | | | | * Drop CI for OpenSSL 1.0.2 * Delete code for coverage reasons * Bump minimum cryptography version
* I'm back in black (#941)Alex Gaynor2020-08-261-4/+5
|
* Context.set_verify: allow omission of callback (#933)Maximilian Hils2020-08-071-11/+17
| | | | | | | * Context.set_verify: allow omission of callback * squeeze to 80 chars * make it clear that default callback is used
* Allow accessing a connection's verfied certificate chain (#894)Shane Harvey2020-08-051-7/+54
| | | | | | | | | | | | | | | | | | | | | | | | | * Allow accessing a connection's verfied certificate chain Add X509StoreContext.get_verified_chain using X509_STORE_CTX_get1_chain. Add Connection.get_verified_chain using SSL_get0_verified_chain if available (ie OpenSSL 1.1+) and X509StoreContext.get_verified_chain otherwise. Fixes #740. * TLSv1_METHOD -> SSLv23_METHOD * Use X509_up_ref instead of X509_dup * Add _openssl_assert where appropriate * SSL_get_peer_cert_chain should not be null * Reformat with black * Fix <OpenSSL.crypto.X509 object at 0x7fdbb59e8050> != <OpenSSL.crypto.X509 object at 0x7fdbb59daad0> * Add Changelog entry * Remove _add_chain
* focal time (#929)Paul Kehrer2020-08-051-1/+2
| | | | | | | | | * focal time * larger dh params, assert on something * urllib3 fix * actually check an error
* remove npn support entirely. you should be using alpn (#932)Paul Kehrer2020-08-031-180/+0
| | | | | * remove npn support entirely. you should be using alpn * flake8
* Add SSL.Context.set_keylog_callback (#910)Maximilian Hils2020-07-281-0/+31
| | | | | | | | | * add SSL.Context.set_keylog_callback * don't fail on missing attribute * lint! * make it black
* Paint it Black by the Rolling Stones (#920)Alex Gaynor2020-07-231-161/+196
|
* Drop OpenSSL 1.0.1 (#908)Alex Gaynor2020-04-071-10/+6
|
* Remove asserts (#904)Adrián Chaves2020-03-311-3/+3
|
* Random cleanup around our usage of binary_type (#879)Alex Gaynor2019-11-181-5/+3
|
* ALPN: complete handshake without accepting a client's protocols. (#876)Mark Williams2019-11-181-10/+25
| | | | | | | | | | | | | | | | | | | | | | | | | * ALPN: complete handshake without accepting a client's protocols. The callback passed to `SSL_CTX_set_alpn_select_cb` can return `SSL_TLSEXT_ERR_NOACK` to allow the handshake to continue without accepting any of the client's offered protocols. This commit introduces `NO_OVERLAPPING_PROTOCOLS`, which the Python callback passed to `Context.set_alpn_select_callback` can return to achieve the same thing. It does not change the previous meaning of an empty string, which still terminates the handshake. * Update src/OpenSSL/SSL.py Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com> * Address @alex's review. * Use recorded value in test, fix lint error. * Cover TypeError branch in _ALPNHelper.callback
* use _ffi.from_buffer() to support bytearray (#852)Daniel Holth2019-11-181-37/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * use _ffi.from_buffer(buf) in send, to support bytearray * add bytearray test * update CHANGELOG.rst * move from_buffer before 'buffer too long' check * context-managed from_buffer + black * don't shadow buf in send() * test return count for sendall * test sending an array * fix test * also use from_buffer in bio_write * de-format _util.py * formatting * add simple bio_write tests * wrap line
* Expose OP_NO_TLSv1_3 (#861)Nathaniel J. Smith2019-08-021-0/+5
| | | | | | * Expose OP_NO_TLSv1_3 * Support openssl <1.1.1
* Update SSL.py docstring (#849)Daniel Holth2019-07-051-1/+1
|
* OpenSSL always has SNI (#821)Alex Gaynor2019-02-221-8/+0
|
* Deprecated NPN (#820)Alex Gaynor2019-02-221-0/+9
| | | | | | | | | | * Deprecated NPN * arithmetic is hard * oops * oops
* Raise an Error with "no cipher match" even with TLS 1.3 (#818)Mark Williams2019-02-141-3/+12
| | | | | | | | | | | * Raise an Error with "no cipher match" even with TLS 1.3 This makes Twisted's OpenSSLAcceptableCiphers.fromOpenSSLCipherString and seamlessly work with TLS 1.3: https://github.com/twisted/twisted/pull/1100/files/a5df2fb373ac67b0e3032acc9291ae88dfd0b3b1#diff-df501bac724aab523150498f84749b88R1767 * Split TestContext.test_set_cipher_list_wrong_args into two tests.
* Removed deprecated Type aliases (#814)Alex Gaynor2019-02-071-14/+0
| | | | | | | | | | | | * Removed deprecated Type aliases * typo * typo * missed this somehow * Line wrap
* Hypothetically fixes pyOpenSSL tests (#805)Paul Kehrer2019-01-211-0/+13
| | | | | | | | | | | | | | | * fix openssl CLI testing for 1.1.1 * various 1.1.1 related fixes some of which are just admitting TLS 1.3 is fundamentally different and pinning the tests to TLS 1.2 * flake8 fixes * allow travis_infra env var through * fix twisted
* Tone down the comment around SSL_set_tlsext_status_ocsp_resp. (#764)David Benjamin2018-05-221-7/+2
| | | | | | | | | The ownership semantics of SSL_set_tlsext_status_ocsp_resp are not as complex as the comment suggests. There's no leak or complex lifetime. It's an ownership transfer of an OPENSSL_malloc'd buffer. The documentation is lacking, and making the copy internally would have been tidier (though less efficient if the OCSP response where generated by i2d_OCSP_RESPONSE), but this sort of thing has precedent in OpenSSL's API.
* Fix SSL_CTX_set_tlsext_servername_callback type signature. (#763)David Benjamin2018-05-221-1/+1
| | | | | | See also https://github.com/pyca/cryptography/pull/4227. I suspect this is a no-op since cffi is probably just generating its own function stubs and every ABI makes const and non-const pointers the same. Still, better to match things.
* Add Connection.get_certificate method (#733)Jeremy Lainé2018-05-161-0/+12
| | | | | | | | This makes it possible to retrieve the local certificate (if any) for a Connection. An example where this is useful is when negotiating a DTLS-SRTP connection, the fingerprint of the local certificate needs to be communicated to the remote party out-of-band via SDP.
* Make sure a NotImplementedError is always raised on Connection.makefile() (#744)Ayke2018-05-161-1/+1
| | | | | | | | | | | * Make sure a NotImplementedError is always raised on Connection.makefile With this patch, code which calls (for example) conn.makefile('rb') will get a NotImplementedError instead of a confusing TypeError: TypeError: makefile() takes 1 positional argument but 2 were given * ignore any args/kwargs passed
* Add Context.set_tlsext_use_srtp (#734)Jeremy Lainé2018-05-161-0/+15
| | | | This allows negotiating SRTP keying material, which is useful when using DTLS-SRTP, as WebRTC does for example.
* Always enable auto retry (#753)Paul Kehrer2018-05-141-0/+5
| | | | | | | | | | | | * test using auto retry * add/update changelog and add comment * wordsmithing * Update CHANGELOG.rst * Update CHANGELOG.rst
* Raise minimum cryptography version to 2.2.1, drop python 2.6 (#742)Jeremy Lainé2018-03-211-14/+4
|
* Don't add not supported SSL_ST_* into _all_, fixies #738 (#739)Ondřej Nový2018-03-011-4/+6
| | | | | | | | | Without this patch this fails: >>> from OpenSSL.SSL import * Traceback (most recent call last): File "<string>", line 1, in <module> File "/usr/lib/python2.7/dist-packages/cryptography/utils.py", line 124, in __getattr__ obj = getattr(self._module, attr) AttributeError: 'module' object has no attribute 'SSL_ST_INIT'
* Use autofocus for all module documentation/docstrings (#737)Alex Chan2018-02-151-110/+233
| | | | | | | | * Use autodoc for OpenSSL.crypto * Use autodoc for the SSL.Context class * Use autodoc for SSL.Connection
* Export keying material support (#725)Paul Kehrer2017-11-301-0/+24
| | | | | | | | | | | | | | * added method to export keying material from an ssl connection * updated tests to use bytestrings to avoid breaking python3 tests * added additional comments to test * simplify export_keying_material * add changelog * address review feedback
* fix a memory leak and a potential UAF and also #722 (#723)Paul Kehrer2017-11-301-2/+3
| | | | | | | | * fix a memory leak and a potential UAF and also #722 * sanity check * bump cryptography minimum version, add changelog
* define __all__ to make wildcard import work (#719)Nicolas Karolak2017-11-261-0/+89
|
* Don't use things after they're freed...duh (#709)Alex Gaynor2017-11-201-5/+2
| | | | | | | | * Don't use things after they're freed...duh * changelog * more details
* fix errors with latest flake8 (#710)Alex Gaynor2017-11-201-4/+4
| | | | | | | | | | * fix errors with latest flake8 * Also fix the macOS builds * fix? * allow urllib3 to fail for now
* Improve documentation for passphrase callback (#703)Diego Fernandez2017-10-121-1/+1
| | | Address issue #701
* fix #664 (#665)Paul Kehrer2017-07-191-2/+4
| | | | | | | | | | | | * fix #664 bytes and strings are different things. * update changelog * let's just make the sentinel values byte strings * flake8
* Kill some commented out code and other cleanups (#649)Alex Gaynor2017-06-301-9/+2
|
* Kill dead code (#647)Alex Gaynor2017-06-291-6/+5
| | | | | | | | | | * Simplify code * dead code * unused... * write imports normally
* try loading trusted certs from a list of fallbacks (#633)Paul Kehrer2017-06-291-0/+78
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * try loading trusted certs from a list of fallbacks pyca/cryptography will shortly begin shipping a wheel. Since SSL_CTX_set_default_verify_paths uses a hardcoded path compiled into the library, this will start failing to load the proper certificates for users on many linux distributions. To avoid this we can use the Go solution of iterating over a list of potential candidates and loading it when found. * capath is lazy loaded so we need to do a lot more checks This now checks to see if env vars are set as well as seeing if the dir exists and has valid certs in it. If either of those are true (or the number of certs is > 0) it won't load the fallback. If it does do the fallback it will also attempt to load certs from a dir as a final fallback * remove an early return * this shouldn't be commented out * oops * very limited testing * sigh, can't use these py3 exceptions of course * expand the tests a bit * coverage! * don't need this now * change the approach to use a pyca/cryptography guard value * test fix * older python sometimes calls itself linux2 * flake8 * add changelog * coverage * slash opt
* Fixed #486 -- deprecate the backwards compat names (#643)Alex Gaynor2017-06-291-2/+11
| | | | | | | | * Fixed #486 -- deprecate the backwards compat names * remove the docs for these, pretend they don't exist * CHANGELOG
* Limit SSL_write bufsize to avoid OverflowErrors (#603)Maximilian Hils2017-02-101-1/+9
| | | | | | * limit SSL_write bufsize to avoid OverflowErrors * fix .send() truncation, add test
* Prevent _PassphraseHelper.raise_if_problem() from eating exceptions (#581)Greg Bowser2017-01-251-5/+4
| | | | | | | | | | | | | | | | | | | | | | | * Modify tests to detect empty crypto.Errors from load_privatekey This reproduces #119 and #456. * Prevent _PassphraseHelper.raise_if_problem() from eating exceptions. This resolves #119, resolves #456. `_PassphraseHelper.raise_if_problem()` always flushes the OpenSSL exception queue, but does not always raise an exception. In some cases, other code attempts to raise an error from OpenSSL after `raise_if_problem()` has flushed the queue, thus causing an empty exception to be raised (i.e. `raise Error([])`). This commit modifies `_PassphraseHelper.raise_if_problem` to flush the OpenSSL error queue only if it has en exception to raise. Subsequent code that detects an error should now be able to raise an non-empty exception. * Add CHANGELOG entry for #581.
* Add support for OCSP stapling. (#580)Cory Benfield2017-01-241-0/+206
| | | | | | | | | | | | | | | | | | | | | | | | * Define the OCSPCallbackHelper. * Define set_ocsp_status_callback function. * Reframe this as the "server" helper. * Add OCSP helper. * Allow clients to request OCSP * Some tests for OCSP. * Don't forget to throw callback errors. * Add changelog entry for OCSP stapling. * Require at least cryptography 1.7 * Sorry Flake8, won't happen again. * How does spelling work?
* automatically set SSL_CTX_set_ecdh_auto when available (#575)Paul Kehrer2016-12-191-0/+9
|
* Don't zero memory when we don't have to. (#578)Cory Benfield2016-11-281-7/+8
|
* Convert X509ExtTests to use pytest-style tests (#564)Alex Chan2016-11-181-0/+1
|
View Lorry Controller Status