From afdbfb13780fb78e7b277b9de07e7636ba9c5119 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Fri, 25 May 2018 05:45:25 +0800 Subject: deprecate pythons without hmac.compare_digest (#4261) * deprecate the constant time bytes comparison path old python 2.7.x uses * pep8 --- src/cryptography/hazmat/primitives/constant_time.py | 9 +++++++++ src/cryptography/utils.py | 1 + 2 files changed, 10 insertions(+) (limited to 'src') diff --git a/src/cryptography/hazmat/primitives/constant_time.py b/src/cryptography/hazmat/primitives/constant_time.py index 5a682ca9..0e987ea7 100644 --- a/src/cryptography/hazmat/primitives/constant_time.py +++ b/src/cryptography/hazmat/primitives/constant_time.py @@ -5,7 +5,9 @@ from __future__ import absolute_import, division, print_function import hmac +import warnings +from cryptography import utils from cryptography.hazmat.bindings._constant_time import lib @@ -17,6 +19,13 @@ if hasattr(hmac, "compare_digest"): return hmac.compare_digest(a, b) else: + warnings.warn( + "Support for your Python version is deprecated. The next version of " + "cryptography will remove support. Please upgrade to a 2.7.x " + "release that supports hmac.compare_digest as soon as possible.", + utils.DeprecatedIn23, + ) + def bytes_eq(a, b): if not isinstance(a, bytes) or not isinstance(b, bytes): raise TypeError("a and b must be bytes.") diff --git a/src/cryptography/utils.py b/src/cryptography/utils.py index 14909c66..3d45a771 100644 --- a/src/cryptography/utils.py +++ b/src/cryptography/utils.py @@ -22,6 +22,7 @@ class CryptographyDeprecationWarning(UserWarning): # cycle ends. PersistentlyDeprecated = CryptographyDeprecationWarning DeprecatedIn21 = CryptographyDeprecationWarning +DeprecatedIn23 = CryptographyDeprecationWarning def _check_bytes(name, value): -- cgit v1.2.3