| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
| |
* remove X509StoreFlags.NOTIFY_POLICY
fixes #1212
* also fix twisted
* more CI fixes, sigh
|
|
|
|
|
|
|
|
|
|
|
| |
* Reject invalid versions in X509Req.set_version
* Update CHANGELOG.rst
Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>
---------
Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>
|
|
|
|
|
| |
* port changelog
* forward port the nid2sn workaround
|
|
|
|
|
| |
* Reformat code using black 23.x
* fix compat with tox 4
|
|
|
|
|
|
|
| |
* fixes #1173
make the x509extension docs more clear
* Update crypto.py
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Fix CRL nextUpdate handling.
When setting the nextUpdate field of a CRL, this code grabbed the
nextUpdate ASN1_TIME field from the CRL and set its time. But nextUpdate
is optional in a CRL so that field is usually NULL. But OpenSSL's
ASN1_TIME_set_string succeeds when the destination argument is NULL, so
it was silently a no-op.
Given that, the call in a test to set the nextUpdate field suddenly
starts working and sets the time to 2018, thus causing the CRL to be
considered expired and breaking the test. So this change also changes
the expiry year far into the future.
Additionally, the other CRL and Revoked setters violate const in the
API.
Fixes #1168.
* Replace self-check with an assert for coverage
* Update src/OpenSSL/crypto.py
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
|
|
|
|
| |
The bio was never freed, or used. sometime is never freed. While I'm
here, check return values for all the functions called here.
|
|
|
|
|
|
|
|
|
| |
* Add support for X509_V_FLAG_PARTIAL_CHAIN
* Remove unneeded import
* Update changelog to add PR number.
* Fix whitespace issue identified by black
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Switch to the new utils.deprecation spelling
The new spelling was introduced in
https://github.com/pyca/cryptography/pull/6923 and is more friendly to
type checkers.
Version-wise, that PR appears to be in cryptography 37.0.0, which is now
beyond the minimum version for pyOpenSSL.
* reformat
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* OpenSSL/crypto: make X509StoreContextError's message friendlier
Closes #1132.
Signed-off-by: William Woodruff <william@trailofbits.com>
* tests: update exception tests
Signed-off-by: William Woodruff <william@trailofbits.com>
* OpenSSL/crypto: blacken
Signed-off-by: William Woodruff <william@trailofbits.com>
* CHANGELOG: record changes
Signed-off-by: William Woodruff <william@trailofbits.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* crypto: Add type annotations
* Don’t redefine var
mypy complains about the redefinition
* _util: Add type annotations
* rand: Add type annotations
* Prepare package & CI for running mypy
* fix toxenv name
Co-authored-by: Maximilian Hils <github@maximilianhils.com>
|
|
|
|
|
|
| |
get_notAfter() can return None.
Instead of raising a NoneType error, raise a ValueError which tells
us why it failed.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Certificate versions go up to v3 (numeric value 2), CRLs go up to v2
(numeric value 1), and CSRs go up to v1 (numeric value 0). This CL fixes
the following issues:
- Add a missing check to the return value of X509_set_version
- Fix crlDataUnsupportedExtension which had an invalid CRL version.
- Switch TestX509.test_version to test valid versions, so it doesn't
prevent OpenSSL or an OpenSSL derivative from checking for invalid
versions.
- Make TestX509Req.test_version tolerate set_version(1) failing on CSRs.
Since there's nothing useful to test otherwise, I've made the test
work for either possible backend behavior.
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
* flake8-import-order
* make sure bad import orders fail
* flake8-import-order
* add application name to flake8 section
* correct import order for openssl as application
|
|
|
|
|
|
|
| |
* don't block ec/ed keys from_cryptography_key()
* clean up test comments
* properly describe test
|
| |
|
| |
|
|
|
|
|
|
|
| |
X509Name does only inherit from object, which has no __getattr__() method.
By accident this also raised an AttributeError but the error message
is confusing.
This commit now raises the AttributeError with a descriptive message.
|
|
|
|
|
|
|
|
|
|
|
| |
* X509Name: Use functools.totalordering for comparisons
- Reduce the magic
- Make it more readable
- Make it easier to add type annotations in the future
* Correctly return NotImplemented
* Add new comparison test case
|
|
|
| |
In python3 all classes inherit by default from object
|
|
|
|
| |
- hex() returns always str
- don’t redefine variable
|
| |
|
| |
|
| |
|
|
|
| |
Instead just decode stuff at the call-sites -- 100% of which were passing bytes
|
|
|
|
|
| |
* use more functions guaranteed available in cryptography 35.0
* these are also guaranteed
|
|
|
|
|
|
|
|
|
|
|
| |
* py27 going, going, gone
* black
* more black
* ok then
* forgot to remove pypy2
|
| |
|
|
|
|
|
| |
Deprecated under OpenSSL 1.1
Signed-off-by: Rosen Penev <rosenp@gmail.com>
|
|
|
|
|
| |
* fix a memleak
* black
|
|
|
|
|
|
|
| |
* Drop CI for OpenSSL 1.0.2
* Delete code for coverage reasons
* Bump minimum cryptography version
|
|
|
|
|
|
| |
* Fixing issue #798, thanks to @reaperhulk; removing undocumented '%s' option and getting the date in a more robust way
Co-authored-by: Joseba Alberdi <j.alberdi@simuneatomistics.com>
Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
* crypto._PassphraseHelper: pass non-callable passphrase using callback
Fixes #945
Before this commit, we would pass a bytes passphrase as a null terminated string.
This causes issue when a randomly generated key's first byte is null because
OpenSSL rightly determines the key length is 0.
This commit modifies the passphrase helper to pass the passphrase via the
callback
* Update changelog to document bug fix
|
|
|
|
|
|
|
|
|
|
|
|
| |
X509StoreContext (#948)
The additional certificates provided in the new `chain` parameter will be
untrusted but may be used to build the chain.
This makes it easier to validate a certificate against a store which
contains only root ca certificates, and the intermediates come from e.g.
the same untrusted source as the certificate to be verified.
Co-authored-by: Sandor Oroszi <sandor.oroszi@balabit.com>
|
|
|
|
|
|
|
| |
Add X509Store.load_locations() to set a CA bundle file and/or an OpenSSL-
style hashed CA/CRL lookup directory, similar to the already existing
SSL.Context.load_verify_locations().
Co-authored-by: Sandor Oroszi <sandor.oroszi@balabit.com>
|
|
|
| |
Signed-off-by: Rosen Penev <rosenp@gmail.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Allow accessing a connection's verfied certificate chain
Add X509StoreContext.get_verified_chain using X509_STORE_CTX_get1_chain.
Add Connection.get_verified_chain using SSL_get0_verified_chain if
available (ie OpenSSL 1.1+) and X509StoreContext.get_verified_chain
otherwise.
Fixes #740.
* TLSv1_METHOD -> SSLv23_METHOD
* Use X509_up_ref instead of X509_dup
* Add _openssl_assert where appropriate
* SSL_get_peer_cert_chain should not be null
* Reformat with black
* Fix <OpenSSL.crypto.X509 object at 0x7fdbb59e8050> != <OpenSSL.crypto.X509 object at 0x7fdbb59daad0>
* Add Changelog entry
* Remove _add_chain
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
| |
* fix PKey.check for some broken keys
RSA_check_key is documented to return 1 for valid keys.
It (currently) returns 0 or -1 for invalid ones.
The previous code accepted invalid keys if RSA_check_key returns -1!
* add test
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Removed deprecated Type aliases
* typo
* typo
* missed this somehow
* Line wrap
|
|
|
| |
2566 is not a valid digest, whoops!
|
| |
|