aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Declare that 2.1 is the last version to support Python 2.6 (#3944)Alex Gaynor2017-10-011-1/+1
| | | | | | * Declare that 2.1 is the last version to support Python 2.6 * It's the Final Countdown!
* add ChaCha20 support (#3919)Paul Kehrer2017-09-283-1/+32
| | | | | | | | | | * add ChaCha20 support * review feedback * 256 divided by 8 is what again? * ...
* Expose FIPS funcs for OpenSSL. (#3939)Scott Sturdivant2017-09-273-0/+37
| | | | | | | | | | | | | * Expose FIPS funcs for OpenSSL. * Remove FIPS customization / conditionals. It seems that the FIPS functions are always defined, regardless of if the FIPS module is present. * Do not include FIPS_selftest_check func. * Libressl does not have FIPS.
* both parse and encode the ASN1 string type for Name attributes (#3896)Paul Kehrer2017-09-254-23/+47
| | | | | | | | | | | | | | | * both parse and encode the ASN1 string type for Name attributes Previously cryptography encoded everything (except country names) as UTF8String. This caused problems with chain building in libraries like NSS where the subject and issuer are expected to match byte-for-byte. With this change we now parse and store the ASN1 string type as a private _type in NameAttribute. We then use this to encode when issuing a new certificate. This allows the CertificateBuilder to properly construct an identical issuer and fixes the issue with NSS. * make the sentinel private too
* FreshestCRL extension support (#3937)Paul Kehrer2017-09-234-7/+61
| | | | | | | | | | * add freshest CRL support * add tests * add changelog * add tests for FreshestCRL generation
* support delta crl indicator extension (#3936)Paul Kehrer2017-09-225-5/+44
| | | This is an extension for CRLs
* refactor rsa signature/verification logic to remove duplication (#3903)Paul Kehrer2017-09-211-91/+34
|
* implement __hash__ on DistributionPoint and CRLDistributionPoints (#3915)Paul Kehrer2017-09-131-0/+16
|
* add __hash__ to GeneralNames, SAN, IAN, and CertificateIssuer (#3916)Paul Kehrer2017-09-131-0/+12
|
* add __hash__ to PolicyConstraints and Extension (#3917)Paul Kehrer2017-09-131-0/+8
|
* implement __hash__ on KeyUsage and ExtendedKeyUsage (#3913)Paul Kehrer2017-09-131-0/+12
| | | | | | * implement __hash__ on KeyUsage and ExtendedKeyUsage * properly use private values and alter test to catch that bug
* implement __hash__ on CertificatePolicies and its child classes (#3914)Paul Kehrer2017-09-131-0/+17
|
* add aki hash (#3910)Paul Kehrer2017-09-131-0/+9
| | | | | | | | | | * Implement __hash__ on AuthorityKeyIdentifier * Adding dirname to fix build issue on AuthorityKeyIdentifier test * .authority_cert_issuer to str * use a tuple and not a str repr
* name constraints __hash__ (#3912)Paul Kehrer2017-09-131-0/+13
|
* AIA hashing (#3911)Paul Kehrer2017-09-131-0/+3
|
* remove u-label conversion during general name decode (#3905)Paul Kehrer2017-09-131-49/+4
| | | | We support directly passing bytes now and these code paths are duplicated in the deprecated value attributes.
* fix a bug with URI value when parsing a string with no hostname (#3909)Paul Kehrer2017-09-132-2/+4
| | | | | strings of the form "scheme:///anything" would incorrectly have two slashes dropped. This is fixed in two code paths in this PR but one of those code paths will be entirely removed in a followup PR.
* implement __hash__ on all GeneralName types (#3907)Paul Kehrer2017-09-131-2/+17
| | | Needed to implement __hash__ on AuthorityKeyIdentifier
* compare against bytes values, not the U-label decoded ones (#3906)Paul Kehrer2017-09-121-2/+2
| | | | We need to add one small test to cover a case that is no longer covered with this switch.
* refactor AES keywrap into a wrap core and unwrap core (#3901)Paul Kehrer2017-09-111-23/+30
| | | | | | | | * refactor AES keywrap into a wrap core and unwrap core This refactor makes adding AES keywrap with padding much simpler. * remove an unneeded arg
* [WIP] add support for the TLSFeature extension in x509 (#3899)Paul Kehrer2017-09-105-9/+95
| | | | | | | | | | | | | | | | | | * add support for the TLSFeature extension in x509 This extension is used for OCSP Must-Staple. * fix changelog link * pep8 * refactor to support the sequence properly and add status_request_v2 * update some language * add test vector, implement eq/ne/hash on TLSFeature * address review comments
* RSA OAEP label support for OpenSSL 1.0.2+ (#3897)Paul Kehrer2017-09-082-4/+20
| | | | | | | | | | * RSA OAEP label support for OpenSSL 1.0.2+ * changelog * move around tests, address review feedback, use backend supported method * unsupported padding catches this now
* add set0_rsa_oaep_label binding (#3894)Paul Kehrer2017-09-072-0/+17
|
* add OCSP binding for obtaining information from CertID structure (#3888)Paul Kehrer2017-09-061-0/+2
| | | | | | * add OCSP binding for obtaining information from CertID structure * empty commit
* added binding support for rfc 5705 (#3878)Kelby Ludwig2017-08-291-0/+2
| | | | | | | | | | | | | | * added binding support for rfc 5705 * WIP: testing some cffi updates * added openssl version check * updated cffi defs to align with pep8 * removed superfluous version checks * remove more unecessary boilerplate
* add blake2b/blake2s support for hmac (#3873)Paul Kehrer2017-08-221-4/+3
| | | | | | | | | | * add blake2b/blake2s support for hmac This was a bug, but it turns out the noise protocol suggests using the HMAC construction with BLAKE2 (rather than BLAKE2's own keyed functionality) for a few reasons, so we should support it. * actually test the thing
* Remove branches for 1.0.2 betas. (#3870)Alex Gaynor2017-08-203-8/+6
| | | There's no sense in which we actually support them
* Add is_signature_valid method on CertificateRevocationList (#3849)Vincent Pelletier2017-08-122-0/+22
|
* Fix weak linking of getentropy when compiling on older macOS (#3841)Paul Kehrer2017-08-031-0/+3
| | | | | | | | | | | | | * Fix weak linking of getentropy when compiling on older macOS We use weak linking in macOS to determine if the getentropy symbol is available. However, to do that we need to have a declaration that states the function is __attribute((weak_import)) at compile time. On macOS 10.12 this is provided in sys/random.h, but on older macOS the declaration doesn't exist at all, so we need to forward declare it ourselves. * update a comment and a style nit
* deprecate unicode input for RFC822Name (#3836)Paul Kehrer2017-08-012-15/+51
| | | | | | * deprecate unicode input for RFC822Name * pep8...?
* deprecate auto-idna on UniformResourceIdentifier (#3832)Paul Kehrer2017-08-012-11/+64
| | | | | | | | | | * deprecate auto-idna on UniformResourceIdentifier * fix repr test * docs * some updated language
* Begin the deprecation of auto-idna for x509.DNSName (#3830)Alex Gaynor2017-07-304-37/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * Begin the deprecation of auto-idna for x509.DNSName Refs #3357 * fix warning * py3k fixes * fix docs * sigh * flake8 * these are words * words * tests for coverage * another test * do idna things * more idna things
* fix for latest flake8 (#3829)Alex Gaynor2017-07-271-1/+1
|
* fix compilation on openbsd (#3814)Paul Kehrer2017-07-261-0/+2
| | | | the getentropy fallback is only possible on macOS, wrap it in a define to remove it entirely on the BSDs.
* Fixed #3798 -- use the correct stacklevel on this warning (#3803)Alex Gaynor2017-07-211-1/+1
|
* remove deprecated items (#3794)Paul Kehrer2017-07-204-61/+1
| | | | | | | | | | * remove deprecated items whirlpool, ripemd160, unsupportedextension, and the old interfaces * flake8 and remove a test generator we no longe use * make it clear we warned you about these things
* Open master for 2.1 (#3788)Alex Gaynor2017-07-171-1/+1
|
* 2.0 version bump and changelog (#3787)Paul Kehrer2017-07-171-1/+1
| | | | | | * 2.0 version bump and changelog * dates are just an illusion
* Remove DH generator size constraint (#3364)mtury2017-07-171-2/+2
| | | | | | * Remove DH generator size constraint * Check that g > 1
* add AESGCM AEAD support (#3785)Paul Kehrer2017-07-172-3/+47
| | | | | | | | * add AESGCM AEAD support * remove stray newline * move AESGCM docs above CCM
* move tag_length to the AESCCM constructor (#3783)Paul Kehrer2017-07-161-14/+16
| | | | | | * move tag_length to the AESCCM constructor * review feedback
* AESCCM support (#3700)Paul Kehrer2017-07-162-9/+110
|
* allow p % 24 == 23 when generator == 2 in DH_check (#3768)Paul Kehrer2017-07-092-2/+17
| | | | | | | | | | * allow p % 24 == 23 when generator == 2 in DH_check * short url * update and expand comments * even better language!
* use an instance in aead_cipher_supported (#3772)Paul Kehrer2017-07-093-16/+13
| | | | | | | | * use an instance in aead_cipher_supported * test for chacha20poly1305 compatibility via init exception * pep8
* Fixed #3747 -- cache extensions on x.509 objects (#3769)Alex Gaynor2017-07-082-4/+18
| | | | | | | | | | * Fixed #3747 -- cache extensions on x.509 objects * be kind to cpython, save a dict lookup * flake8 * changelog
* remove egd (#3771)Paul Kehrer2017-07-082-20/+0
| | | | | | | | | | | * remove egd * oops * keep Cryptography_HAS_EGD for compat just in case This shouldn't really be necessary but maybe we can fully remove it in 2018 or 2019...
* remove cryptodev (#3770)Paul Kehrer2017-07-082-17/+0
| | | | | | * remove cryptodev * oops
* Attempt to use coverage to quantify how many of the CONDITIONAL_NAMES we ↵Alex Gaynor2017-07-082-65/+185
| | | | | | | | | | | | | | | | | | really use (#3763) * Attempt to use coverage to quantify how many of the CONDITIONAL_NAMES we really use * rewrite file to improve coverage * Write it this way so we can use line coverage * lost this one :-( * fix comment and flake8 * update the docs as well * flake8
* Remove conditionals we never use. (#3766)Alex Gaynor2017-07-082-10/+0
| | | | | | | | * Remove conditionals we never use. Refs #3763 * put this back
* stop using backend methods for chacha (#3765)Paul Kehrer2017-07-083-22/+20
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-14 09:32:29 +0000