aboutsummaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2019-04-18Merge commit 'c9a71e1' into importKevin Cheng
pyopenssl 19.0.0 and added in misc files. Bug: 122778810 Test: None Change-Id: Iba5da7e8b2b559ca37912f1892be98f505ef8b6e
2019-01-21release 19.0.0 (#808)Paul Kehrer
2019-01-21changelog and call it 19 now (#807)Paul Kehrer
2019-01-21add key types consts (#776)Igr
2019-01-21Fixes incorrect rtype in documentation (#802)Gaurav Malhotra
rtype for the following was incorrect: X509Req.from_cryptography X509.from_cryptography
2019-01-21Handle NULL bytes in get_components() values (#804)Romuald Brunet
* Handle NULL bytes in get_components() values Some old software may generate "bogus" CN with each character preceded by a NULL. This is already handled in commonName, but wasn't in get_components() * review fixes (fix py3 test & avoid unpack/cast)
2019-01-21Hypothetically fixes pyOpenSSL tests (#805)Paul Kehrer
* fix openssl CLI testing for 1.1.1 * various 1.1.1 related fixes some of which are just admitting TLS 1.3 is fundamentally different and pinning the tests to TLS 1.2 * flake8 fixes * allow travis_infra env var through * fix twisted
2018-08-27Update OpenSSL manpage link to x509v3_config (#789)Cyril Stoller
2018-08-27Add note on zero-based certificate version value (#790)Cyril Stoller
2018-08-23X509Store.add_cert no longer raises an error on duplicate cert (#787)Paul Kehrer
* X509Store.add_cert no longer raises an error on duplicate cert * move changelog entry
2018-06-05Only allocate exponent in the TYPE_RSA path. (#767)David Benjamin
Not much point in making it otherwise.
2018-05-22Tone down the comment around SSL_set_tlsext_status_ocsp_resp. (#764)David Benjamin
The ownership semantics of SSL_set_tlsext_status_ocsp_resp are not as complex as the comment suggests. There's no leak or complex lifetime. It's an ownership transfer of an OPENSSL_malloc'd buffer. The documentation is lacking, and making the copy internally would have been tidier (though less efficient if the OCSP response where generated by i2d_OCSP_RESPONSE), but this sort of thing has precedent in OpenSSL's API.
2018-05-22Fix SSL_CTX_set_tlsext_servername_callback type signature. (#763)David Benjamin
See also https://github.com/pyca/cryptography/pull/4227. I suspect this is a no-op since cffi is probably just generating its own function stubs and every ABI makes const and non-const pointers the same. Still, better to match things.
2018-05-16reopen master for 18.1 (#761)Paul Kehrer
* reopen master for 18.1 * there are four dashes
2018-05-1618.0.0 release time (#760)Paul Kehrer
2018-05-16Add Connection.get_certificate method (#733)Jeremy Lainé
This makes it possible to retrieve the local certificate (if any) for a Connection. An example where this is useful is when negotiating a DTLS-SRTP connection, the fingerprint of the local certificate needs to be communicated to the remote party out-of-band via SDP.
2018-05-16Make sure a NotImplementedError is always raised on Connection.makefile() (#744)Ayke
* Make sure a NotImplementedError is always raised on Connection.makefile With this patch, code which calls (for example) conn.makefile('rb') will get a NotImplementedError instead of a confusing TypeError: TypeError: makefile() takes 1 positional argument but 2 were given * ignore any args/kwargs passed
2018-05-16Add Context.set_tlsext_use_srtp (#734)Jeremy Lainé
This allows negotiating SRTP keying material, which is useful when using DTLS-SRTP, as WebRTC does for example.
2018-05-14Always enable auto retry (#753)Paul Kehrer
* test using auto retry * add/update changelog and add comment * wordsmithing * Update CHANGELOG.rst * Update CHANGELOG.rst
2018-03-21Raise minimum cryptography version to 2.2.1, drop python 2.6 (#742)Jeremy Lainé
2018-03-01Don't add not supported SSL_ST_* into _all_, fixies #738 (#739)Ondřej Nový
Without this patch this fails: >>> from OpenSSL.SSL import * Traceback (most recent call last): File "<string>", line 1, in <module> File "/usr/lib/python2.7/dist-packages/cryptography/utils.py", line 124, in __getattr__ obj = getattr(self._module, attr) AttributeError: 'module' object has no attribute 'SSL_ST_INIT'
2018-02-15Use autofocus for all module documentation/docstrings (#737)Alex Chan
* Use autodoc for OpenSSL.crypto * Use autodoc for the SSL.Context class * Use autodoc for SSL.Connection
2017-12-01open for 17.6.0 (#727)Paul Kehrer
2017-11-3017.5.0 version bump (#726)Paul Kehrer
2017-11-30Export keying material support (#725)Paul Kehrer
* added method to export keying material from an ssl connection * updated tests to use bytestrings to avoid breaking python3 tests * added additional comments to test * simplify export_keying_material * add changelog * address review feedback
2017-11-30fix a memory leak and a potential UAF and also #722 (#723)Paul Kehrer
* fix a memory leak and a potential UAF and also #722 * sanity check * bump cryptography minimum version, add changelog
2017-11-26define __all__ to make wildcard import work (#719)Nicolas Karolak
2017-11-21reopen master (#718)Paul Kehrer
2017-11-21bump to 17.4.0 (#714)Paul Kehrer
2017-11-20restore a subset of the rand module (#708)Paul Kehrer
* restore a subset of the rand module * flake * remove cleanup, go ahead and assume status will always be 1 * lighten and add power
2017-11-20Don't use things after they're freed...duh (#709)Alex Gaynor
* Don't use things after they're freed...duh * changelog * more details
2017-11-20fix errors with latest flake8 (#710)Alex Gaynor
* fix errors with latest flake8 * Also fix the macOS builds * fix? * allow urllib3 to fail for now
2017-10-12Improve documentation for passphrase callback (#703)Diego Fernandez
Address issue #701
2017-09-1317.4.0.dev0 bump (#694)Paul Kehrer
2017-09-13bump version and update changelog (#693)Paul Kehrer
* bump version and update changelog * add changelog entries for the memory leak fixes * backticks
2017-09-14Avoid a double call to X509_STORE_CTX_init as it leaks memory (#691)Jeremy Cline
This fixes an issue where each instance of ``X509StoreContext`` would leak a small amount of memory, but only if ``verify_certificate`` was called. The reason for this is that ``X509_STORE_CTX_init`` is called in ``X509StoreContext.__init__`` and at the start of ``X509StoreContext.verify_certificate``. According to the man page for ``X509_STORE_CTX_init``: "X509_STORE_CTX_init() sets up ctx for a subsequent verification operation. It must be called before each call to X509_verify_cert(), i.e. a ctx is only good for one call to X509_verify_cert(); if you want to verify a second certificate with the same ctx then you must call X509_STORE_CTX_cleanup() and then X509_STORE_CTX_init() again before the second call to X509_verify_cert()." Prior to this commit, the following script would cause a memory leak: ``` from OpenSSL.crypto import ( X509Store, X509StoreContext, load_certificate, FILETYPE_PEM) certificate = """ -----BEGIN CERTIFICATE----- MIIESTCCA7KgAwIBAgIBAzANBgkqhkiG9w0BAQUFADCBoDELMAkGA1UEBhMCVVMx CzAJBgNVBAgTAk5DMRAwDgYDVQQHEwdSYWxlaWdoMRcwFQYDVQQKEw5GZWRvcmEg UHJvamVjdDEPMA0GA1UECxMGZmVkbXNnMQ8wDQYDVQQDEwZmZWRtc2cxDzANBgNV BCkTBmZlZG1zZzEmMCQGCSqGSIb3DQEJARYXYWRtaW5AZmVkb3JhcHJvamVjdC5v cmcwHhcNMTIwNzE1MjExODUyWhcNMjIwNzEzMjExODUyWjCB2DELMAkGA1UEBhMC VVMxCzAJBgNVBAgTAk5DMRAwDgYDVQQHEwdSYWxlaWdoMRcwFQYDVQQKEw5GZWRv cmEgUHJvamVjdDEPMA0GA1UECxMGZmVkbXNnMSswKQYDVQQDEyJzaGVsbC1hcHAw MS5waHgyLmZlZG9yYXByb2plY3Qub3JnMSswKQYDVQQpEyJzaGVsbC1hcHAwMS5w aHgyLmZlZG9yYXByb2plY3Qub3JnMSYwJAYJKoZIhvcNAQkBFhdhZG1pbkBmZWRv cmFwcm9qZWN0Lm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyV0ydvno pITmFs0kfploKj6nW0/COzp0rDwwvuWZF2KDdl1AeRWzfspOQOWIK5V+o2qxYA6t aiK4bPfylYL1IGIwlVP9ma5zwkRvWketWjGORp5B7g7oECQOBo3gnQt0Uf5TWAQ1 6Wn0bCrIQSqOWVKScK9vUk/oomUlAZbksEcCAwEAAaOCAVcwggFTMAkGA1UdEwQC MAAwLQYJYIZIAYb4QgENBCAWHkVhc3ktUlNBIEdlbmVyYXRlZCBDZXJ0aWZpY2F0 ZTAdBgNVHQ4EFgQUd3FXBbD2JW3qcmq+5VP7GcuxHF4wgdUGA1UdIwSBzTCByoAU AJil1efEVQ6Eo2f+ZkoW4AQV3SGhgaakgaMwgaAxCzAJBgNVBAYTAlVTMQswCQYD VQQIEwJOQzEQMA4GA1UEBxMHUmFsZWlnaDEXMBUGA1UEChMORmVkb3JhIFByb2pl Y3QxDzANBgNVBAsTBmZlZG1zZzEPMA0GA1UEAxMGZmVkbXNnMQ8wDQYDVQQpEwZm ZWRtc2cxJjAkBgkqhkiG9w0BCQEWF2FkbWluQGZlZG9yYXByb2plY3Qub3JnggkA juso2KkTnXwwEwYDVR0lBAwwCgYIKwYBBQUHAwIwCwYDVR0PBAQDAgeAMA0GCSqG SIb3DQEBBQUAA4GBABG1zG/lzYyz/phhROq6nzk3QUVeNGyxFdxxoB57j4xDi60y zy2yAYe9swqlL1Gk94/Zf/lLPFxOM+NinTOh/o6z0bEBBCufwFKiS+ug/pjsI o69vC03F21S0pquM8bQjcdoA5q5pdiY/Bq5HULmosyA+ENu69ovQGZZUiJb/ -----END CERTIFICATE----- """ ca_certificate = """ -----BEGIN CERTIFICATE----- MIIDyzCCAzSgAwIBAgIJAI7rKNipE518MA0GCSqGSIb3DQEBBQUAMIGgMQswCQYD VQQGEwJVUzELMAkGA1UECBMCTkMxEDAOBgNVBAcTB1JhbGVpZ2gxFzAVBgNVBAoT DkZlZG9yYSBQcm9qZWN0MQ8wDQYDVQQLEwZmZWRtc2cxDzANBgNVBAMTBmZlZG1z ZzEPMA0GA1UEKRMGZmVkbXNnMSYwJAYJKoZIhvcNAQkBFhdhZG1pbkBmZWRvcmFw cm9qZWN0Lm9yZzAeFw0xMjA3MTUyMTE4NTFaFw0yMjA3MTMyMTE4NTFaMIGgMQsw CQYDVQQGEwJVUzELMAkGA1UECBMCTkMxEDAOBgNVBAcTB1JhbGVpZ2gxFzAVBgNV BAoTDkZlZG9yYSBQcm9qZWN0MQ8wDQYDVQQLEwZmZWRtc2cxDzANBgNVBAMTBmZl ZG1zZzEPMA0GA1UEKRMGZmVkbXNnMSYwJAYJKoZIhvcNAQkBFhdhZG1pbkBmZWRv cmFwcm9qZWN0Lm9yZzCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA9J6RmGr1 LzSJ5Fau2wdkVUiS5WXBcd0bNPyUJ9/G7t9SrycnLnEK4GQh2B525p4SCqvsHZtM 8rqii/Y2PPF5PbpgVjJLYsJk4SSv84aH+VPYcaEtYlPClXgHb3J9jgAxgHBHkJMQ 7mvxiIau7frKFqmJGZkxO2M+Sv8eLCKLJP8CAwEAAaOCAQkwggEFMB0GA1UdDgQW BBQAmKXV58RVDoSjZ/5mShbgBBXdITCB1QYDVR0jBIHNMIHKgBQAmKXV58RVDoSj Z/5mShbgBBXdIaGBpqSBozCBoDELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk5DMRAw DgYDVQQHEwdSYWxlaWdoMRcwFQYDVQQKEw5GZWRvcmEgUHJvamVjdDEPMA0GA1UE CxMGZmVkbXNnMQ8wDQYDVQQDEwZmZWRtc2cxDzANBgNVBCkTBmZlZG1zZzEmMCQG CSqGSIb3DQEJARYXYWRtaW5AZmVkb3JhcHJvamVjdC5vcmeCCQCO6yjYqROdfDAM BgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4GBAN5r+1rbeTyGDdlelbqWOXBu uS0a9BfusO0uwf3tHK9zeB5CDKFgxdfSZ+Fxg1w2HFRHhCOYoZ2ASPfbyANTzxUF fVAId1uhBD1SlhXpTb3Ndo4uXfalf3W8MrQzFiVHbevvfsyd+RwoVT/PDokE3i4A fftCd0uwvSqVgyE28SFt -----END CERTIFICATE----- """ ca_cert = load_certificate(FILETYPE_PEM, ca_certificate) cert = load_certificate(FILETYPE_PEM, certificate) cert_store = X509Store() cert_store.add_cert(ca_cert) while True: cert_store_context = X509StoreContext(cert_store, cert) cert_store_context.verify_certificate() ``` Moving the creation of ``X509StoreContext`` outside the loop stops the memory leak. Signed-off-by: Jeremy Cline <jeremy@jcline.org>
2017-09-07Provide a destructor for the CRL object (#690)Jeremy Cline
This frees the memory allocated for the CRL object. Prior to this commit, the following script would leak memory: ``` from OpenSSL.crypto import load_crl, FILETYPE_PEM crl = """ -----BEGIN X509 CRL----- MIIBfDCB5jANBgkqhkiG9w0BAQsFADCBoDELMAkGA1UEBhMCVVMxCzAJBgNVBAgT Ak5DMRAwDgYDVQQHEwdSYWxlaWdoMRcwFQYDVQQKEw5GZWRvcmEgUHJvamVjdDEP MA0GA1UECxMGZmVkbXNnMQ8wDQYDVQQDEwZmZWRtc2cxDzANBgNVBCkTBmZlZG1z ZzEmMCQGCSqGSIb3DQEJARYXYWRtaW5AZmVkb3JhcHJvamVjdC5vcmcXDTE3MDYx NTIxMDMwOFoXDTM3MDYxMDIxMDMwOFowFDASAgECFw0xMjA3MTUyMTE4NTJaMA0G CSqGSIb3DQEBCwUAA4GBAGOBuDxmRFNcYP71LBsCOfFzKij00qpxM01d5/G6+0kM WJT8oTajMQoY6oISvQDq6TkwEoKc1yl6Ld1/XTtCNOhbybzRBAVf/Lxi/nRPP1JO qOdZs5jMLLQq1mRJz+MgKHHTDlnvpbjHMuyTss1RblFDr4iZPHMcBNKPGIj3pmpA -----END X509 CRL----- """ for _ in range(0, 1000000): load_crl(FILETYPE_PEM, crl) ``` Signed-off-by: Jeremy Cline <jeremy@jcline.org>
2017-07-25Delete rand.py (#675)Alex Gaynor
2017-07-22 Fixes #655 -- deprecate OpenSSL.tsafe (#673)Alex Gaynor
* Fixes #655 -- deprecate OpenSSL.tsafe * changelog
2017-07-20Start new release cycle (#672)Hynek Schlawack
2017-07-20Prepare 17.2.0 (#671)Hynek Schlawack
* Fix version * Prepare 17.2.0
2017-07-20(EC)DSA signature fix (#670)Paul Kehrer
* Write a test - signatures with EC keys (#609) * Ask for signature length before allocating a buffer. This fixes a potential heap buffer overflow that may happen when a signature is longer than the private key, as with X9.62 ECDSA (#609). * change approach to EVP_PKEY_size and add changelog * add a small assert
2017-07-20Bend some recent changes to standards (#669)Hynek Schlawack
2017-07-19fix #664 (#665)Paul Kehrer
* fix #664 bytes and strings are different things. * update changelog * let's just make the sentinel values byte strings * flake8
2017-07-06Fixed #631 -- deprecate all of OpenSSL.rand (#658)Alex Gaynor
* Fixed #631 -- deprecate all of OpenSSL.rand * syntax fix * flake8
2017-06-30Start new release cycle (#654)Hynek Schlawack
2017-06-30Prepare 17.1 (#653)Hynek Schlawack
* Prepare 17.1.0 * Fix changelog markup
2017-06-30Removed the deprecated md5 default on CRL.export() (#652)Alex Gaynor
* Removed the deprecated md5 default on CRL.export() * Doh * unused import * fixed tests * last one * py3k!!!!!
2017-06-30Kill some commented out code and other cleanups (#649)Alex Gaynor
2017-06-29Kill dead code (#647)Alex Gaynor
* Simplify code * dead code * unused... * write imports normally
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-12 18:26:13 +0000