aboutsummaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2021-02-12[LSC] Add LOCAL_LICENSE_KINDS to external/python/pyopensslandroid-s-preview-1Bob Badour
Added SPDX-license-identifier-Apache-2.0 to: Android.bp src/OpenSSL/Android.bp Bug: 68860345 Bug: 151177513 Bug: 151953481 Test: m all Exempt-From-Owner-Approval: janitorial work Change-Id: Ie0212b5c649e8e7e05eea24d5b3de8732f8017f1
2020-12-15Upgrade python/pyopenssl to 20.0.1Haibo Huang
Test: make Change-Id: Icdf65bde24f056bd011ee39635e7d66662ef4d4d
2020-12-15Prepare for 20.0.1 release (#979)Alex Gaynor
2020-12-14Fix for running on OpenSSL 1.1.0 + CI (#978)Alex Gaynor
* Test on OpenSSL 1.1.0 w/ Debian stretch * Make pyOpenSSL compatible with openssl 1.1.0 again Co-authored-by: Shane Harvey <shnhrv@gmail.com>
2020-11-27reopen master for next dev cycle (#969)Paul Kehrer
2020-11-2720.0.0 before 2020 is even over (#968)Paul Kehrer
2020-11-27fix a memleak (#967)Paul Kehrer
* fix a memleak * black
2020-11-27Keep reference to SSL verify_call in Connection object (#956)Arne Schwabe
* Keep reference to SSL verify_call in Connection object If a set_verify is used on a context before and after a Connection the reference in the SSL* object still points to the old _verify_helper object. Since this object has no longer any references to it, the callback can result in a segfault. This commit fixes the issues by ensuring that as long as the Connection object/SSL* object lives a reference to the callback function is held. * Add Unit test for set_verify_callback deference
2020-11-13Fix spelling of set in set_verify docstring (#959)Arne Schwabe
2020-11-12Fix typo in debug command output (#957)Michael Lazar
Co-authored-by: Michael Lazar <mlazar@doctorondemand.com>
2020-10-26Drop CI for OpenSSL 1.0.2 (#953)Alex Gaynor
* Drop CI for OpenSSL 1.0.2 * Delete code for coverage reasons * Bump minimum cryptography version
2020-10-18Fixing issue #798 (#907)jalberdi004
* Fixing issue #798, thanks to @reaperhulk; removing undocumented '%s' option and getting the date in a more robust way Co-authored-by: Joseba Alberdi <j.alberdi@simuneatomistics.com> Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
2020-10-14Correct typos in crypto.py (#949)Felix Yan
2020-10-12crypto._PassphraseHelper: pass non-callable passphrase using callback (#947)Huw Jones
* crypto._PassphraseHelper: pass non-callable passphrase using callback Fixes #945 Before this commit, we would pass a bytes passphrase as a null terminated string. This causes issue when a randomly generated key's first byte is null because OpenSSL rightly determines the key length is 0. This commit modifies the passphrase helper to pass the passphrase via the callback * Update changelog to document bug fix
2020-10-12Allow using additional untrusted certificates for chain building in ↵Sándor Oroszi
X509StoreContext (#948) The additional certificates provided in the new `chain` parameter will be untrusted but may be used to build the chain. This makes it easier to validate a certificate against a store which contains only root ca certificates, and the intermediates come from e.g. the same untrusted source as the certificate to be verified. Co-authored-by: Sandor Oroszi <sandor.oroszi@balabit.com>
2020-09-11Allow using an OpenSSL hashed directory for verification in X509Store (#943)Sándor Oroszi
Add X509Store.load_locations() to set a CA bundle file and/or an OpenSSL- style hashed CA/CRL lookup directory, similar to the already existing SSL.Context.load_verify_locations(). Co-authored-by: Sandor Oroszi <sandor.oroszi@balabit.com>
2020-08-26I'm back in black (#941)Alex Gaynor
2020-08-13Switch to new notBefore/After APIs (#843)Rosen Penev
Signed-off-by: Rosen Penev <rosenp@gmail.com>
2020-08-07Context.set_verify: allow omission of callback (#933)Maximilian Hils
* Context.set_verify: allow omission of callback * squeeze to 80 chars * make it clear that default callback is used
2020-08-05Allow accessing a connection's verfied certificate chain (#894)Shane Harvey
* Allow accessing a connection's verfied certificate chain Add X509StoreContext.get_verified_chain using X509_STORE_CTX_get1_chain. Add Connection.get_verified_chain using SSL_get0_verified_chain if available (ie OpenSSL 1.1+) and X509StoreContext.get_verified_chain otherwise. Fixes #740. * TLSv1_METHOD -> SSLv23_METHOD * Use X509_up_ref instead of X509_dup * Add _openssl_assert where appropriate * SSL_get_peer_cert_chain should not be null * Reformat with black * Fix <OpenSSL.crypto.X509 object at 0x7fdbb59e8050> != <OpenSSL.crypto.X509 object at 0x7fdbb59daad0> * Add Changelog entry * Remove _add_chain
2020-08-05Deprecated pkcs7 and pkcs12 support (#921)Alex Gaynor
2020-08-05focal time (#929)Paul Kehrer
* focal time * larger dh params, assert on something * urllib3 fix * actually check an error
2020-08-03remove npn support entirely. you should be using alpn (#932)Paul Kehrer
* remove npn support entirely. you should be using alpn * flake8
2020-08-03newer pypy (#928)Paul Kehrer
* newer pypy * missed one * we don't support ancient cffi any more
2020-07-28Add SSL.Context.set_keylog_callback (#910)Maximilian Hils
* add SSL.Context.set_keylog_callback * don't fail on missing attribute * lint! * make it black
2020-07-23Paint it Black by the Rolling Stones (#920)Alex Gaynor
2020-05-22Remove deprecated tsafe module. (#913)Benjamin Peterson
2020-04-07Drop OpenSSL 1.0.1 (#908)Alex Gaynor
2020-03-31Remove asserts (#904)Adrián Chaves
2020-03-11Fix PKey.check for some broken keys (#897)Mrmaxmeier
* fix PKey.check for some broken keys RSA_check_key is documented to return 1 for valid keys. It (currently) returns 0 or -1 for invalid ones. The previous code accepted invalid keys if RSA_check_key returns -1! * add test
2019-11-18Make the code slightly resillient to python4 (#880)Alex Gaynor
2019-11-18Random cleanup around our usage of binary_type (#879)Alex Gaynor
2019-11-18reopen master, call it 20.0 because let's be honest with ourselves (#878)Paul Kehrer
2019-11-17version bump for 19.1 release (#877)Paul Kehrer
2019-11-18ALPN: complete handshake without accepting a client's protocols. (#876)Mark Williams
* ALPN: complete handshake without accepting a client's protocols. The callback passed to `SSL_CTX_set_alpn_select_cb` can return `SSL_TLSEXT_ERR_NOACK` to allow the handshake to continue without accepting any of the client's offered protocols. This commit introduces `NO_OVERLAPPING_PROTOCOLS`, which the Python callback passed to `Context.set_alpn_select_callback` can return to achieve the same thing. It does not change the previous meaning of an empty string, which still terminates the handshake. * Update src/OpenSSL/SSL.py Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com> * Address @alex's review. * Use recorded value in test, fix lint error. * Cover TypeError branch in _ALPNHelper.callback
2019-11-18use _ffi.from_buffer() to support bytearray (#852)Daniel Holth
* use _ffi.from_buffer(buf) in send, to support bytearray * add bytearray test * update CHANGELOG.rst * move from_buffer before 'buffer too long' check * context-managed from_buffer + black * don't shadow buf in send() * test return count for sendall * test sending an array * fix test * also use from_buffer in bio_write * de-format _util.py * formatting * add simple bio_write tests * wrap line
2019-08-29Fix for Python 4 (#862)Hugo van Kemenade
* Fix for Python 4 * Fix for Python 4
2019-08-02Expose OP_NO_TLSv1_3 (#861)Nathaniel J. Smith
* Expose OP_NO_TLSv1_3 * Support openssl <1.1.1
2019-07-05Update SSL.py docstring (#849)Daniel Holth
2019-04-18Merge commit 'c9a71e1' into importKevin Cheng
pyopenssl 19.0.0 and added in misc files. Bug: 122778810 Test: None Change-Id: Iba5da7e8b2b559ca37912f1892be98f505ef8b6e
2019-02-22OpenSSL always has SNI (#821)Alex Gaynor
2019-02-22Deprecated NPN (#820)Alex Gaynor
* Deprecated NPN * arithmetic is hard * oops * oops
2019-02-14Raise an Error with "no cipher match" even with TLS 1.3 (#818)Mark Williams
* Raise an Error with "no cipher match" even with TLS 1.3 This makes Twisted's OpenSSLAcceptableCiphers.fromOpenSSLCipherString and seamlessly work with TLS 1.3: https://github.com/twisted/twisted/pull/1100/files/a5df2fb373ac67b0e3032acc9291ae88dfd0b3b1#diff-df501bac724aab523150498f84749b88R1767 * Split TestContext.test_set_cipher_list_wrong_args into two tests.
2019-02-07Removed deprecated Type aliases (#814)Alex Gaynor
* Removed deprecated Type aliases * typo * typo * missed this somehow * Line wrap
2019-01-30Provide a valid digest option (#811)Wayne Werner
2566 is not a valid digest, whoops!
2019-01-21Reopen master for 19.1 (#810)Alex Gaynor
2019-01-21release 19.0.0 (#808)Paul Kehrer
2019-01-21changelog and call it 19 now (#807)Paul Kehrer
2019-01-21add key types consts (#776)Igr
2019-01-21Fixes incorrect rtype in documentation (#802)Gaurav Malhotra
rtype for the following was incorrect: X509Req.from_cryptography X509.from_cryptography
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-02 23:24:10 +0000