aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2020-12-14Fix for running on OpenSSL 1.1.0 + CI (#978)Alex Gaynor
* Test on OpenSSL 1.1.0 w/ Debian stretch * Make pyOpenSSL compatible with openssl 1.1.0 again Co-authored-by: Shane Harvey <shnhrv@gmail.com>
2020-12-14remove py2 w/ cryptography master (#977)Alex Gaynor
* remove py2 w/ cryptography master * Update ci.yml
2020-11-29Tox.ini; Test on Python 3.9 and make flake8 stricter (#966)Christian Clauss
* Tox.ini; Test on Python 3.9 and make flake8 stricter * max-line-length = 88 * Remove unused import * Update tox.ini * Use PEP8 line length * Use PEP8 line length
2020-11-27reopen master for next dev cycle (#969)Paul Kehrer
2020-11-2720.0.0 before 2020 is even over (#968)Paul Kehrer
2020-11-27fix a memleak (#967)Paul Kehrer
* fix a memleak * black
2020-11-27Keep reference to SSL verify_call in Connection object (#956)Arne Schwabe
* Keep reference to SSL verify_call in Connection object If a set_verify is used on a context before and after a Connection the reference in the SSL* object still points to the old _verify_helper object. Since this object has no longer any references to it, the callback can result in a segfault. This commit fixes the issues by ensuring that as long as the Connection object/SSL* object lives a reference to the callback function is held. * Add Unit test for set_verify_callback deference
2020-11-27Remove leakcheck (#965)Alex Gaynor
It's not being run anywhere, and plainly doesn't support py3 so it's clearly not important to anyone.
2020-11-23Added dependabot for GHA (#961)Alex Gaynor
2020-11-17Migrate CI to GHA (#960)Alex Gaynor
2020-11-13Fix spelling of set in set_verify docstring (#959)Arne Schwabe
2020-11-12Stop testing py35 with cryptography master (#958)Alex Gaynor
2020-11-12Fix typo in debug command output (#957)Michael Lazar
Co-authored-by: Michael Lazar <mlazar@doctorondemand.com>
2020-10-26Drop CI for OpenSSL 1.0.2 (#953)Alex Gaynor
* Drop CI for OpenSSL 1.0.2 * Delete code for coverage reasons * Bump minimum cryptography version
2020-10-18Fixing issue #798 (#907)jalberdi004
* Fixing issue #798, thanks to @reaperhulk; removing undocumented '%s' option and getting the date in a more robust way Co-authored-by: Joseba Alberdi <j.alberdi@simuneatomistics.com> Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
2020-10-14Correct typos in crypto.py (#949)Felix Yan
2020-10-14fixed tests for twisted change (#950)Alex Gaynor
* fixed tests for twisted change
2020-10-12crypto._PassphraseHelper: pass non-callable passphrase using callback (#947)Huw Jones
* crypto._PassphraseHelper: pass non-callable passphrase using callback Fixes #945 Before this commit, we would pass a bytes passphrase as a null terminated string. This causes issue when a randomly generated key's first byte is null because OpenSSL rightly determines the key length is 0. This commit modifies the passphrase helper to pass the passphrase via the callback * Update changelog to document bug fix
2020-10-12Allow using additional untrusted certificates for chain building in ↵Sándor Oroszi
X509StoreContext (#948) The additional certificates provided in the new `chain` parameter will be untrusted but may be used to build the chain. This makes it easier to validate a certificate against a store which contains only root ca certificates, and the intermediates come from e.g. the same untrusted source as the certificate to be verified. Co-authored-by: Sandor Oroszi <sandor.oroszi@balabit.com>
2020-09-11Allow using an OpenSSL hashed directory for verification in X509Store (#943)Sándor Oroszi
Add X509Store.load_locations() to set a CA bundle file and/or an OpenSSL- style hashed CA/CRL lookup directory, similar to the already existing SSL.Context.load_verify_locations(). Co-authored-by: Sandor Oroszi <sandor.oroszi@balabit.com>
2020-08-26I'm back in black (#941)Alex Gaynor
2020-08-19travis.com now (#939)Paul Kehrer
2020-08-14lock old issues (#937)Alex Gaynor
2020-08-14fixes #934 -- kill dead link (#936)Alex Gaynor
2020-08-13Switch to new notBefore/After APIs (#843)Rosen Penev
Signed-off-by: Rosen Penev <rosenp@gmail.com>
2020-08-07Context.set_verify: allow omission of callback (#933)Maximilian Hils
* Context.set_verify: allow omission of callback * squeeze to 80 chars * make it clear that default callback is used
2020-08-05Allow accessing a connection's verfied certificate chain (#894)Shane Harvey
* Allow accessing a connection's verfied certificate chain Add X509StoreContext.get_verified_chain using X509_STORE_CTX_get1_chain. Add Connection.get_verified_chain using SSL_get0_verified_chain if available (ie OpenSSL 1.1+) and X509StoreContext.get_verified_chain otherwise. Fixes #740. * TLSv1_METHOD -> SSLv23_METHOD * Use X509_up_ref instead of X509_dup * Add _openssl_assert where appropriate * SSL_get_peer_cert_chain should not be null * Reformat with black * Fix <OpenSSL.crypto.X509 object at 0x7fdbb59e8050> != <OpenSSL.crypto.X509 object at 0x7fdbb59daad0> * Add Changelog entry * Remove _add_chain
2020-08-05Deprecated pkcs7 and pkcs12 support (#921)Alex Gaynor
2020-08-05focal time (#929)Paul Kehrer
* focal time * larger dh params, assert on something * urllib3 fix * actually check an error
2020-08-03remove npn support entirely. you should be using alpn (#932)Paul Kehrer
* remove npn support entirely. you should be using alpn * flake8
2020-08-03use SSLv23_METHOD so we get "best TLS" in most tests. (#931)Paul Kehrer
2020-08-03use modern message digests (#930)Paul Kehrer
2020-08-03newer pypy (#928)Paul Kehrer
* newer pypy * missed one * we don't support ancient cffi any more
2020-08-03update cert fixtures and simplify tests (#927)Paul Kehrer
* simplify * generate new certs and keys with 3072-bit RSA * black * add a test to avoid losing coverage
2020-08-03make our CI less frustrating (#926)Paul Kehrer
* make our CI less frustrating * sigh, even less sensitive * can we stop doing this on macos now?
2020-08-03_only_ update the image (#925)Alex Gaynor
* _only_ update the image * Update .travis.yml Co-authored-by: Paul Kehrer <paul.l.kehrer@gmail.com>
2020-08-03use larger keys in ssl tests (#922)Alex Gaynor
2020-08-03Remove RPM build script that we have no idea if it works (#923)Alex Gaynor
* Remove RPM build script that we have no idea if it works * MANIFEST.in as well
2020-07-28Add SSL.Context.set_keylog_callback (#910)Maximilian Hils
* add SSL.Context.set_keylog_callback * don't fail on missing attribute * lint! * make it black
2020-07-23Paint it Black by the Rolling Stones (#920)Alex Gaynor
2020-07-12Fix Travis CI build config validation issues (#918)Christian Clauss
* `sudo` key is deprecated * `os` key is missing * `matrix` is an alias for `jobs`
2020-06-24Fix generated test X.509 certificates. (#917)David Benjamin
From RFC 5280, section 4.1.2.9: [Extensions] MUST only appear if the version is 3 (Section 4.1.2.1). If present, this field is a SEQUENCE of one or more certificate extensions. The format and content of certificate extensions in the Internet PKI are defined in Section 4.2. X509 objects default to v1, so the test certs need a set_version(2) call. (Note v3 is encoded as 2.)
2020-05-22Remove deprecated tsafe module. (#913)Benjamin Peterson
2020-05-21Remove dead examples directory from flake8 invocation. (#914)Benjamin Peterson
2020-04-07Update to a more modern macOS image (#909)Alex Gaynor
2020-04-07Drop OpenSSL 1.0.1 (#908)Alex Gaynor
2020-03-31Remove asserts (#904)Adrián Chaves
2020-03-30Uhhh, fix twisted tests to actually run twisted (wat) (#906)Alex Gaynor
* Uhhh, fix twisted tests to actually run twisted (wat) * Update tox.ini
2020-03-30Run twisted tests under py3 (#905)Alex Gaynor
2020-03-11Fix PKey.check for some broken keys (#897)Mrmaxmeier
* fix PKey.check for some broken keys RSA_check_key is documented to return 1 for valid keys. It (currently) returns 0 or -1 for invalid ones. The previous code accepted invalid keys if RSA_check_key returns -1! * add test
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-07 21:02:52 +0000