update windows build to Python 3.7
This commit is contained in:
parent
73105fa71e
commit
ddc59ab92d
5761 changed files with 750298 additions and 213405 deletions
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,5 +0,0 @@
|
|||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import absolute_import, division, print_function
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
# This file is dual licensed under the terms of the Apache License, Version
|
||||
# 2.0, and the BSD License. See the LICENSE file in the root of this repository
|
||||
# for complete details.
|
||||
|
||||
from __future__ import absolute_import, division, print_function
|
||||
|
||||
from cryptography.hazmat.bindings._commoncrypto import ffi, lib
|
||||
|
||||
|
||||
class Binding(object):
|
||||
"""
|
||||
CommonCrypto API wrapper.
|
||||
"""
|
||||
lib = lib
|
||||
ffi = ffi
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -4,363 +4,78 @@
|
|||
|
||||
from __future__ import absolute_import, division, print_function
|
||||
|
||||
# This is a temporary copy of all the CONDITIONAL_NAMES from _cffi_src so
|
||||
# we can loop over them and delete them at runtime. It will be removed when
|
||||
# cffi supports #if in cdef
|
||||
|
||||
CONDITIONAL_NAMES = {
|
||||
"Cryptography_HAS_AES_WRAP": [
|
||||
"AES_wrap_key",
|
||||
"AES_unwrap_key",
|
||||
],
|
||||
"Cryptography_HAS_CMAC": [
|
||||
"CMAC_CTX_new",
|
||||
"CMAC_Init",
|
||||
"CMAC_Update",
|
||||
"CMAC_Final",
|
||||
"CMAC_CTX_copy",
|
||||
"CMAC_CTX_free",
|
||||
],
|
||||
"Cryptography_HAS_CMS": [
|
||||
"BIO_new_CMS",
|
||||
"i2d_CMS_bio_stream",
|
||||
"PEM_write_bio_CMS_stream",
|
||||
"CMS_final",
|
||||
"CMS_sign",
|
||||
"CMS_verify",
|
||||
"CMS_encrypt",
|
||||
"CMS_decrypt",
|
||||
"CMS_add1_signer",
|
||||
"CMS_TEXT",
|
||||
"CMS_NOCERTS",
|
||||
"CMS_NO_CONTENT_VERIFY",
|
||||
"CMS_NO_ATTR_VERIFY",
|
||||
"CMS_NOSIGS",
|
||||
"CMS_NOINTERN",
|
||||
"CMS_NO_SIGNER_CERT_VERIFY",
|
||||
"CMS_NOVERIFY",
|
||||
"CMS_DETACHED",
|
||||
"CMS_BINARY",
|
||||
"CMS_NOATTR",
|
||||
"CMS_NOSMIMECAP",
|
||||
"CMS_NOOLDMIMETYPE",
|
||||
"CMS_CRLFEOL",
|
||||
"CMS_STREAM",
|
||||
"CMS_NOCRL",
|
||||
"CMS_PARTIAL",
|
||||
"CMS_REUSE_DIGEST",
|
||||
"CMS_USE_KEYID",
|
||||
"CMS_DEBUG_DECRYPT",
|
||||
],
|
||||
"Cryptography_HAS_CMS_BIO_FUNCTIONS": [
|
||||
"BIO_new_CMS",
|
||||
"i2d_CMS_bio_stream",
|
||||
"PEM_write_bio_CMS_stream",
|
||||
],
|
||||
"Cryptography_HAS_EC": [
|
||||
"OPENSSL_EC_NAMED_CURVE",
|
||||
"EC_GROUP_new",
|
||||
"EC_GROUP_free",
|
||||
"EC_GROUP_clear_free",
|
||||
"EC_GROUP_new_curve_GFp",
|
||||
"EC_GROUP_new_by_curve_name",
|
||||
"EC_GROUP_set_curve_GFp",
|
||||
"EC_GROUP_get_curve_GFp",
|
||||
"EC_GROUP_method_of",
|
||||
"EC_GROUP_get0_generator",
|
||||
"EC_GROUP_get_curve_name",
|
||||
"EC_GROUP_get_degree",
|
||||
"EC_GROUP_set_asn1_flag",
|
||||
"EC_GROUP_set_point_conversion_form",
|
||||
"EC_KEY_new",
|
||||
"EC_KEY_free",
|
||||
"EC_get_builtin_curves",
|
||||
"EC_KEY_new_by_curve_name",
|
||||
"EC_KEY_copy",
|
||||
"EC_KEY_dup",
|
||||
"EC_KEY_up_ref",
|
||||
"EC_KEY_set_group",
|
||||
"EC_KEY_get0_private_key",
|
||||
"EC_KEY_set_private_key",
|
||||
"EC_KEY_set_public_key",
|
||||
"EC_KEY_get_enc_flags",
|
||||
"EC_KEY_set_enc_flags",
|
||||
"EC_KEY_set_conv_form",
|
||||
"EC_KEY_get_key_method_data",
|
||||
"EC_KEY_insert_key_method_data",
|
||||
"EC_KEY_set_asn1_flag",
|
||||
"EC_KEY_precompute_mult",
|
||||
"EC_KEY_generate_key",
|
||||
"EC_KEY_check_key",
|
||||
"EC_POINT_new",
|
||||
"EC_POINT_free",
|
||||
"EC_POINT_clear_free",
|
||||
"EC_POINT_copy",
|
||||
"EC_POINT_dup",
|
||||
"EC_POINT_method_of",
|
||||
"EC_POINT_set_to_infinity",
|
||||
"EC_POINT_set_Jprojective_coordinates_GFp",
|
||||
"EC_POINT_get_Jprojective_coordinates_GFp",
|
||||
"EC_POINT_set_affine_coordinates_GFp",
|
||||
"EC_POINT_get_affine_coordinates_GFp",
|
||||
"EC_POINT_set_compressed_coordinates_GFp",
|
||||
"EC_POINT_point2oct",
|
||||
"EC_POINT_oct2point",
|
||||
"EC_POINT_point2bn",
|
||||
"EC_POINT_bn2point",
|
||||
"EC_POINT_point2hex",
|
||||
"EC_POINT_hex2point",
|
||||
"EC_POINT_add",
|
||||
"EC_POINT_dbl",
|
||||
"EC_POINT_invert",
|
||||
"EC_POINT_is_at_infinity",
|
||||
"EC_POINT_is_on_curve",
|
||||
"EC_POINT_cmp",
|
||||
"EC_POINT_make_affine",
|
||||
"EC_POINTs_make_affine",
|
||||
"EC_POINTs_mul",
|
||||
"EC_POINT_mul",
|
||||
"EC_GROUP_precompute_mult",
|
||||
"EC_GROUP_have_precompute_mult",
|
||||
"EC_GFp_simple_method",
|
||||
"EC_GFp_mont_method",
|
||||
"EC_GFp_nist_method",
|
||||
"EC_METHOD_get_field_type",
|
||||
"EVP_PKEY_assign_EC_KEY",
|
||||
"EVP_PKEY_get1_EC_KEY",
|
||||
"EVP_PKEY_set1_EC_KEY",
|
||||
"PEM_write_bio_ECPrivateKey",
|
||||
"i2d_EC_PUBKEY",
|
||||
"d2i_EC_PUBKEY",
|
||||
"d2i_EC_PUBKEY_bio",
|
||||
"i2d_EC_PUBKEY_bio",
|
||||
"d2i_ECPrivateKey",
|
||||
"d2i_ECPrivateKey_bio",
|
||||
"i2d_ECPrivateKey",
|
||||
"i2d_ECPrivateKey_bio",
|
||||
"i2o_ECPublicKey",
|
||||
"o2i_ECPublicKey",
|
||||
"SSL_CTX_set_tmp_ecdh",
|
||||
"POINT_CONVERSION_COMPRESSED",
|
||||
"POINT_CONVERSION_UNCOMPRESSED",
|
||||
"POINT_CONVERSION_HYBRID",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_EC_1_0_1": [
|
||||
"EC_KEY_get_flags",
|
||||
"EC_KEY_set_flags",
|
||||
"EC_KEY_clear_flags",
|
||||
"EC_KEY_set_public_key_affine_coordinates",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_EC2M": [
|
||||
"EC_GF2m_simple_method",
|
||||
def cryptography_has_ec2m():
|
||||
return [
|
||||
"EC_POINT_set_affine_coordinates_GF2m",
|
||||
"EC_POINT_get_affine_coordinates_GF2m",
|
||||
"EC_POINT_set_compressed_coordinates_GF2m",
|
||||
"EC_GROUP_set_curve_GF2m",
|
||||
"EC_GROUP_get_curve_GF2m",
|
||||
"EC_GROUP_new_curve_GF2m",
|
||||
],
|
||||
]
|
||||
|
||||
"Cryptography_HAS_EC_1_0_2": [
|
||||
|
||||
def cryptography_has_ec_1_0_2():
|
||||
return [
|
||||
"EC_curve_nid2nist",
|
||||
],
|
||||
"Cryptography_HAS_ECDH": [
|
||||
"ECDH_compute_key",
|
||||
"ECDH_get_ex_new_index",
|
||||
"ECDH_set_ex_data",
|
||||
"ECDH_get_ex_data",
|
||||
],
|
||||
"Cryptography_HAS_ECDSA": [
|
||||
"ECDSA_SIG_new",
|
||||
"ECDSA_SIG_free",
|
||||
"i2d_ECDSA_SIG",
|
||||
"d2i_ECDSA_SIG",
|
||||
"ECDSA_do_sign",
|
||||
"ECDSA_do_sign_ex",
|
||||
"ECDSA_do_verify",
|
||||
"ECDSA_sign_setup",
|
||||
"ECDSA_sign",
|
||||
"ECDSA_sign_ex",
|
||||
"ECDSA_verify",
|
||||
"ECDSA_size",
|
||||
"ECDSA_OpenSSL",
|
||||
"ECDSA_set_default_method",
|
||||
"ECDSA_get_default_method",
|
||||
"ECDSA_set_method",
|
||||
"ECDSA_get_ex_new_index",
|
||||
"ECDSA_set_ex_data",
|
||||
"ECDSA_get_ex_data",
|
||||
],
|
||||
"Cryptography_HAS_ENGINE_CRYPTODEV": [
|
||||
"ENGINE_load_cryptodev"
|
||||
],
|
||||
"Cryptography_HAS_REMOVE_THREAD_STATE": [
|
||||
"ERR_remove_thread_state"
|
||||
],
|
||||
"Cryptography_HAS_098H_ERROR_CODES": [
|
||||
"ASN1_F_B64_READ_ASN1",
|
||||
"ASN1_F_B64_WRITE_ASN1",
|
||||
"ASN1_F_SMIME_READ_ASN1",
|
||||
"ASN1_F_SMIME_TEXT",
|
||||
"ASN1_R_NO_CONTENT_TYPE",
|
||||
"ASN1_R_NO_MULTIPART_BODY_FAILURE",
|
||||
"ASN1_R_NO_MULTIPART_BOUNDARY",
|
||||
],
|
||||
"Cryptography_HAS_098C_CAMELLIA_CODES": [
|
||||
"EVP_F_CAMELLIA_INIT_KEY",
|
||||
"EVP_R_CAMELLIA_KEY_SETUP_FAILED"
|
||||
],
|
||||
"Cryptography_HAS_EC_CODES": [
|
||||
"EC_R_UNKNOWN_GROUP",
|
||||
"EC_F_EC_GROUP_NEW_BY_CURVE_NAME"
|
||||
],
|
||||
"Cryptography_HAS_RSA_R_PKCS_DECODING_ERROR": [
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_set_ecdh_auto():
|
||||
return [
|
||||
"SSL_CTX_set_ecdh_auto",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_rsa_r_pkcs_decoding_error():
|
||||
return [
|
||||
"RSA_R_PKCS_DECODING_ERROR"
|
||||
],
|
||||
"Cryptography_HAS_GCM": [
|
||||
"EVP_CTRL_GCM_GET_TAG",
|
||||
"EVP_CTRL_GCM_SET_TAG",
|
||||
"EVP_CTRL_GCM_SET_IVLEN",
|
||||
],
|
||||
"Cryptography_HAS_PBKDF2_HMAC": [
|
||||
"PKCS5_PBKDF2_HMAC"
|
||||
],
|
||||
"Cryptography_HAS_PKEY_CTX": [
|
||||
"EVP_PKEY_CTX_new",
|
||||
"EVP_PKEY_CTX_new_id",
|
||||
"EVP_PKEY_CTX_dup",
|
||||
"EVP_PKEY_CTX_free",
|
||||
"EVP_PKEY_sign",
|
||||
"EVP_PKEY_sign_init",
|
||||
"EVP_PKEY_verify",
|
||||
"EVP_PKEY_verify_init",
|
||||
"Cryptography_EVP_PKEY_encrypt",
|
||||
"EVP_PKEY_encrypt_init",
|
||||
"Cryptography_EVP_PKEY_decrypt",
|
||||
"EVP_PKEY_decrypt_init",
|
||||
"EVP_PKEY_CTX_set_signature_md",
|
||||
"EVP_PKEY_id",
|
||||
"EVP_PKEY_CTX_set_rsa_padding",
|
||||
"EVP_PKEY_CTX_set_rsa_pss_saltlen",
|
||||
],
|
||||
"Cryptography_HAS_ECDSA_SHA2_NIDS": [
|
||||
"NID_ecdsa_with_SHA224",
|
||||
"NID_ecdsa_with_SHA256",
|
||||
"NID_ecdsa_with_SHA384",
|
||||
"NID_ecdsa_with_SHA512",
|
||||
],
|
||||
"Cryptography_HAS_EGD": [
|
||||
"RAND_egd",
|
||||
"RAND_egd_bytes",
|
||||
"RAND_query_egd_bytes",
|
||||
],
|
||||
"Cryptography_HAS_PSS_PADDING": [
|
||||
"RSA_PKCS1_PSS_PADDING",
|
||||
],
|
||||
"Cryptography_HAS_MGF1_MD": [
|
||||
"EVP_PKEY_CTX_set_rsa_mgf1_md",
|
||||
],
|
||||
"Cryptography_HAS_TLSv1_1": [
|
||||
"SSL_OP_NO_TLSv1_1",
|
||||
"TLSv1_1_method",
|
||||
"TLSv1_1_server_method",
|
||||
"TLSv1_1_client_method",
|
||||
],
|
||||
]
|
||||
|
||||
"Cryptography_HAS_TLSv1_2": [
|
||||
"SSL_OP_NO_TLSv1_2",
|
||||
"TLSv1_2_method",
|
||||
"TLSv1_2_server_method",
|
||||
"TLSv1_2_client_method",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_SSL3_METHOD": [
|
||||
def cryptography_has_rsa_oaep_md():
|
||||
return [
|
||||
"EVP_PKEY_CTX_set_rsa_oaep_md",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_rsa_oaep_label():
|
||||
return [
|
||||
"EVP_PKEY_CTX_set0_rsa_oaep_label",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_ssl3_method():
|
||||
return [
|
||||
"SSLv3_method",
|
||||
"SSLv3_client_method",
|
||||
"SSLv3_server_method",
|
||||
],
|
||||
]
|
||||
|
||||
"Cryptography_HAS_TLSEXT_HOSTNAME": [
|
||||
"SSL_set_tlsext_host_name",
|
||||
"SSL_get_servername",
|
||||
"SSL_CTX_set_tlsext_servername_callback",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_TLSEXT_STATUS_REQ_CB": [
|
||||
"SSL_CTX_set_tlsext_status_cb",
|
||||
"SSL_CTX_set_tlsext_status_arg"
|
||||
],
|
||||
|
||||
"Cryptography_HAS_STATUS_REQ_OCSP_RESP": [
|
||||
"SSL_set_tlsext_status_ocsp_resp",
|
||||
"SSL_get_tlsext_status_ocsp_resp",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_TLSEXT_STATUS_REQ_TYPE": [
|
||||
"SSL_set_tlsext_status_type",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_RELEASE_BUFFERS": [
|
||||
"SSL_MODE_RELEASE_BUFFERS",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_OP_NO_COMPRESSION": [
|
||||
"SSL_OP_NO_COMPRESSION",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_SSL_OP_MSIE_SSLV2_RSA_PADDING": [
|
||||
"SSL_OP_MSIE_SSLV2_RSA_PADDING",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_SSL_OP_NO_TICKET": [
|
||||
"SSL_OP_NO_TICKET",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_SSL_SET_SSL_CTX": [
|
||||
"SSL_set_SSL_CTX",
|
||||
"TLSEXT_NAMETYPE_host_name",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_NETBSD_D1_METH": [
|
||||
"DTLSv1_method",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_NEXTPROTONEG": [
|
||||
"SSL_CTX_set_next_protos_advertised_cb",
|
||||
"SSL_CTX_set_next_proto_select_cb",
|
||||
"SSL_select_next_proto",
|
||||
"SSL_get0_next_proto_negotiated",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_SECURE_RENEGOTIATION": [
|
||||
"SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION",
|
||||
"SSL_OP_LEGACY_SERVER_CONNECT",
|
||||
"SSL_get_secure_renegotiation_support",
|
||||
],
|
||||
|
||||
"Cryptography_HAS_ALPN": [
|
||||
def cryptography_has_alpn():
|
||||
return [
|
||||
"SSL_CTX_set_alpn_protos",
|
||||
"SSL_set_alpn_protos",
|
||||
"SSL_CTX_set_alpn_select_cb",
|
||||
"SSL_get0_alpn_selected",
|
||||
],
|
||||
]
|
||||
|
||||
"Cryptography_HAS_COMPRESSION": [
|
||||
|
||||
def cryptography_has_compression():
|
||||
return [
|
||||
"SSL_get_current_compression",
|
||||
"SSL_get_current_expansion",
|
||||
"SSL_COMP_get_name",
|
||||
],
|
||||
]
|
||||
|
||||
"Cryptography_HAS_GET_SERVER_TMP_KEY": [
|
||||
|
||||
def cryptography_has_get_server_tmp_key():
|
||||
return [
|
||||
"SSL_get_server_tmp_key",
|
||||
],
|
||||
]
|
||||
|
||||
"Cryptography_HAS_SSL_CTX_SET_CLIENT_CERT_ENGINE": [
|
||||
"SSL_CTX_set_client_cert_engine",
|
||||
],
|
||||
"Cryptography_HAS_102_VERIFICATION_ERROR_CODES": [
|
||||
|
||||
def cryptography_has_102_verification_error_codes():
|
||||
return [
|
||||
'X509_V_ERR_SUITE_B_INVALID_VERSION',
|
||||
'X509_V_ERR_SUITE_B_INVALID_ALGORITHM',
|
||||
'X509_V_ERR_SUITE_B_INVALID_CURVE',
|
||||
|
|
@ -370,8 +85,11 @@ CONDITIONAL_NAMES = {
|
|||
'X509_V_ERR_HOSTNAME_MISMATCH',
|
||||
'X509_V_ERR_EMAIL_MISMATCH',
|
||||
'X509_V_ERR_IP_ADDRESS_MISMATCH'
|
||||
],
|
||||
"Cryptography_HAS_102_VERIFICATION_PARAMS": [
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_102_verification_params():
|
||||
return [
|
||||
"X509_V_FLAG_SUITEB_128_LOS_ONLY",
|
||||
"X509_V_FLAG_SUITEB_192_LOS",
|
||||
"X509_V_FLAG_SUITEB_128_LOS",
|
||||
|
|
@ -380,35 +98,269 @@ CONDITIONAL_NAMES = {
|
|||
"X509_VERIFY_PARAM_set1_ip",
|
||||
"X509_VERIFY_PARAM_set1_ip_asc",
|
||||
"X509_VERIFY_PARAM_set_hostflags",
|
||||
],
|
||||
"Cryptography_HAS_X509_V_FLAG_TRUSTED_FIRST": [
|
||||
"SSL_get0_param",
|
||||
"X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT",
|
||||
"X509_CHECK_FLAG_NO_WILDCARDS",
|
||||
"X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS",
|
||||
"X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS",
|
||||
"X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS"
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_110_verification_params():
|
||||
return [
|
||||
"X509_CHECK_FLAG_NEVER_CHECK_SUBJECT"
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_x509_v_flag_trusted_first():
|
||||
return [
|
||||
"X509_V_FLAG_TRUSTED_FIRST",
|
||||
],
|
||||
"Cryptography_HAS_X509_V_FLAG_PARTIAL_CHAIN": [
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_x509_v_flag_partial_chain():
|
||||
return [
|
||||
"X509_V_FLAG_PARTIAL_CHAIN",
|
||||
],
|
||||
"Cryptography_HAS_100_VERIFICATION_ERROR_CODES": [
|
||||
'X509_V_ERR_DIFFERENT_CRL_SCOPE',
|
||||
'X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE',
|
||||
'X509_V_ERR_UNNESTED_RESOURCE',
|
||||
'X509_V_ERR_PERMITTED_VIOLATION',
|
||||
'X509_V_ERR_EXCLUDED_VIOLATION',
|
||||
'X509_V_ERR_SUBTREE_MINMAX',
|
||||
'X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE',
|
||||
'X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX',
|
||||
'X509_V_ERR_UNSUPPORTED_NAME_SYNTAX',
|
||||
'X509_V_ERR_CRL_PATH_VALIDATION_ERROR',
|
||||
],
|
||||
"Cryptography_HAS_100_VERIFICATION_PARAMS": [
|
||||
"Cryptography_HAS_100_VERIFICATION_PARAMS",
|
||||
"X509_V_FLAG_EXTENDED_CRL_SUPPORT",
|
||||
"X509_V_FLAG_USE_DELTAS",
|
||||
],
|
||||
"Cryptography_HAS_X509_V_FLAG_CHECK_SS_SIGNATURE": [
|
||||
"X509_V_FLAG_CHECK_SS_SIGNATURE",
|
||||
],
|
||||
"Cryptography_HAS_SET_CERT_CB": [
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_set_cert_cb():
|
||||
return [
|
||||
"SSL_CTX_set_cert_cb",
|
||||
"SSL_set_cert_cb",
|
||||
],
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_ssl_st():
|
||||
return [
|
||||
"SSL_ST_BEFORE",
|
||||
"SSL_ST_OK",
|
||||
"SSL_ST_INIT",
|
||||
"SSL_ST_RENEGOTIATE",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_tls_st():
|
||||
return [
|
||||
"TLS_ST_BEFORE",
|
||||
"TLS_ST_OK",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_locking_callbacks():
|
||||
return [
|
||||
"CRYPTO_LOCK",
|
||||
"CRYPTO_UNLOCK",
|
||||
"CRYPTO_READ",
|
||||
"CRYPTO_LOCK_SSL",
|
||||
"CRYPTO_lock",
|
||||
"Cryptography_setup_ssl_threads",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_scrypt():
|
||||
return [
|
||||
"EVP_PBE_scrypt",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_generic_dtls_method():
|
||||
return [
|
||||
"DTLS_method",
|
||||
"DTLS_server_method",
|
||||
"DTLS_client_method",
|
||||
"SSL_OP_NO_DTLSv1",
|
||||
"SSL_OP_NO_DTLSv1_2",
|
||||
"DTLS_set_link_mtu",
|
||||
"DTLS_get_link_min_mtu",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_evp_pkey_dhx():
|
||||
return [
|
||||
"EVP_PKEY_DHX",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_mem_functions():
|
||||
return [
|
||||
"Cryptography_CRYPTO_set_mem_functions",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_sct():
|
||||
return [
|
||||
"SCT_get_version",
|
||||
"SCT_get_log_entry_type",
|
||||
"SCT_get0_log_id",
|
||||
"SCT_get0_signature",
|
||||
"SCT_get_timestamp",
|
||||
"SCT_set_source",
|
||||
"sk_SCT_num",
|
||||
"sk_SCT_value",
|
||||
"SCT_LIST_free",
|
||||
"sk_SCT_push",
|
||||
"sk_SCT_new_null",
|
||||
"SCT_new",
|
||||
"SCT_set1_log_id",
|
||||
"SCT_set_timestamp",
|
||||
"SCT_set_version",
|
||||
"SCT_set_log_entry_type",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_x509_store_ctx_get_issuer():
|
||||
return [
|
||||
"X509_STORE_get_get_issuer",
|
||||
"X509_STORE_set_get_issuer",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_x25519():
|
||||
return [
|
||||
"EVP_PKEY_X25519",
|
||||
"NID_X25519",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_ed25519():
|
||||
return [
|
||||
"NID_ED25519",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_oneshot_evp_digest_sign_verify():
|
||||
return [
|
||||
"EVP_DigestSign",
|
||||
"EVP_DigestVerify",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_evp_pkey_get_set_tls_encodedpoint():
|
||||
return [
|
||||
"EVP_PKEY_get1_tls_encodedpoint",
|
||||
"EVP_PKEY_set1_tls_encodedpoint",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_fips():
|
||||
return [
|
||||
"FIPS_set_mode",
|
||||
"FIPS_mode",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_ssl_sigalgs():
|
||||
return [
|
||||
"SSL_CTX_set1_sigalgs_list",
|
||||
"SSL_get_sigalgs",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_psk():
|
||||
return [
|
||||
"SSL_CTX_use_psk_identity_hint",
|
||||
"SSL_CTX_set_psk_server_callback",
|
||||
"SSL_CTX_set_psk_client_callback",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_custom_ext():
|
||||
return [
|
||||
"SSL_CTX_add_client_custom_ext",
|
||||
"SSL_CTX_add_server_custom_ext",
|
||||
"SSL_extension_supported",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_openssl_cleanup():
|
||||
return [
|
||||
"OPENSSL_cleanup",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_cipher_details():
|
||||
return [
|
||||
"SSL_CIPHER_is_aead",
|
||||
"SSL_CIPHER_get_cipher_nid",
|
||||
"SSL_CIPHER_get_digest_nid",
|
||||
"SSL_CIPHER_get_kx_nid",
|
||||
"SSL_CIPHER_get_auth_nid",
|
||||
]
|
||||
|
||||
|
||||
def cryptography_has_tlsv13():
|
||||
return [
|
||||
"SSL_OP_NO_TLSv1_3",
|
||||
"SSL_VERIFY_POST_HANDSHAKE",
|
||||
"SSL_CTX_set_ciphersuites",
|
||||
"SSL_verify_client_post_handshake",
|
||||
"SSL_CTX_set_post_handshake_auth",
|
||||
"SSL_set_post_handshake_auth",
|
||||
]
|
||||
|
||||
|
||||
# This is a mapping of
|
||||
# {condition: function-returning-names-dependent-on-that-condition} so we can
|
||||
# loop over them and delete unsupported names at runtime. It will be removed
|
||||
# when cffi supports #if in cdef. We use functions instead of just a dict of
|
||||
# lists so we can use coverage to measure which are used.
|
||||
CONDITIONAL_NAMES = {
|
||||
"Cryptography_HAS_EC2M": cryptography_has_ec2m,
|
||||
"Cryptography_HAS_EC_1_0_2": cryptography_has_ec_1_0_2,
|
||||
"Cryptography_HAS_SET_ECDH_AUTO": cryptography_has_set_ecdh_auto,
|
||||
"Cryptography_HAS_RSA_R_PKCS_DECODING_ERROR": (
|
||||
cryptography_has_rsa_r_pkcs_decoding_error
|
||||
),
|
||||
"Cryptography_HAS_RSA_OAEP_MD": cryptography_has_rsa_oaep_md,
|
||||
"Cryptography_HAS_RSA_OAEP_LABEL": cryptography_has_rsa_oaep_label,
|
||||
"Cryptography_HAS_SSL3_METHOD": cryptography_has_ssl3_method,
|
||||
"Cryptography_HAS_ALPN": cryptography_has_alpn,
|
||||
"Cryptography_HAS_COMPRESSION": cryptography_has_compression,
|
||||
"Cryptography_HAS_GET_SERVER_TMP_KEY": cryptography_has_get_server_tmp_key,
|
||||
"Cryptography_HAS_102_VERIFICATION_ERROR_CODES": (
|
||||
cryptography_has_102_verification_error_codes
|
||||
),
|
||||
"Cryptography_HAS_102_VERIFICATION_PARAMS": (
|
||||
cryptography_has_102_verification_params
|
||||
),
|
||||
"Cryptography_HAS_110_VERIFICATION_PARAMS": (
|
||||
cryptography_has_110_verification_params
|
||||
),
|
||||
"Cryptography_HAS_X509_V_FLAG_TRUSTED_FIRST": (
|
||||
cryptography_has_x509_v_flag_trusted_first
|
||||
),
|
||||
"Cryptography_HAS_X509_V_FLAG_PARTIAL_CHAIN": (
|
||||
cryptography_has_x509_v_flag_partial_chain
|
||||
),
|
||||
"Cryptography_HAS_SET_CERT_CB": cryptography_has_set_cert_cb,
|
||||
"Cryptography_HAS_SSL_ST": cryptography_has_ssl_st,
|
||||
"Cryptography_HAS_TLS_ST": cryptography_has_tls_st,
|
||||
"Cryptography_HAS_LOCKING_CALLBACKS": cryptography_has_locking_callbacks,
|
||||
"Cryptography_HAS_SCRYPT": cryptography_has_scrypt,
|
||||
"Cryptography_HAS_GENERIC_DTLS_METHOD": (
|
||||
cryptography_has_generic_dtls_method
|
||||
),
|
||||
"Cryptography_HAS_EVP_PKEY_DHX": cryptography_has_evp_pkey_dhx,
|
||||
"Cryptography_HAS_MEM_FUNCTIONS": cryptography_has_mem_functions,
|
||||
"Cryptography_HAS_SCT": cryptography_has_sct,
|
||||
"Cryptography_HAS_X509_STORE_CTX_GET_ISSUER": (
|
||||
cryptography_has_x509_store_ctx_get_issuer
|
||||
),
|
||||
"Cryptography_HAS_X25519": cryptography_has_x25519,
|
||||
"Cryptography_HAS_ED25519": cryptography_has_ed25519,
|
||||
"Cryptography_HAS_ONESHOT_EVP_DIGEST_SIGN_VERIFY": (
|
||||
cryptography_has_oneshot_evp_digest_sign_verify
|
||||
),
|
||||
"Cryptography_HAS_EVP_PKEY_get_set_tls_encodedpoint": (
|
||||
cryptography_has_evp_pkey_get_set_tls_encodedpoint
|
||||
),
|
||||
"Cryptography_HAS_FIPS": cryptography_has_fips,
|
||||
"Cryptography_HAS_SIGALGS": cryptography_has_ssl_sigalgs,
|
||||
"Cryptography_HAS_PSK": cryptography_has_psk,
|
||||
"Cryptography_HAS_CUSTOM_EXT": cryptography_has_custom_ext,
|
||||
"Cryptography_HAS_OPENSSL_CLEANUP": cryptography_has_openssl_cleanup,
|
||||
"Cryptography_HAS_CIPHER_DETAILS": cryptography_has_cipher_details,
|
||||
"Cryptography_HAS_TLSv1_3": cryptography_has_tlsv13,
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5,17 +5,34 @@
|
|||
from __future__ import absolute_import, division, print_function
|
||||
|
||||
import collections
|
||||
import os
|
||||
import threading
|
||||
import types
|
||||
import warnings
|
||||
|
||||
from cryptography import utils
|
||||
from cryptography.exceptions import InternalError
|
||||
from cryptography.hazmat.bindings._openssl import ffi, lib
|
||||
from cryptography.hazmat.bindings.openssl._conditional import CONDITIONAL_NAMES
|
||||
|
||||
_OpenSSLError = collections.namedtuple("_OpenSSLError",
|
||||
["code", "lib", "func", "reason"])
|
||||
_OpenSSLErrorWithText = collections.namedtuple(
|
||||
"_OpenSSLErrorWithText", ["code", "lib", "func", "reason", "reason_text"]
|
||||
)
|
||||
|
||||
|
||||
class _OpenSSLError(object):
|
||||
def __init__(self, code, lib, func, reason):
|
||||
self._code = code
|
||||
self._lib = lib
|
||||
self._func = func
|
||||
self._reason = reason
|
||||
|
||||
def _lib_reason_match(self, lib, reason):
|
||||
return lib == self.lib and reason == self.reason
|
||||
|
||||
code = utils.read_only_property("_code")
|
||||
lib = utils.read_only_property("_lib")
|
||||
func = utils.read_only_property("_func")
|
||||
reason = utils.read_only_property("_reason")
|
||||
|
||||
|
||||
def _consume_errors(lib):
|
||||
|
|
@ -30,60 +47,44 @@ def _consume_errors(lib):
|
|||
err_reason = lib.ERR_GET_REASON(code)
|
||||
|
||||
errors.append(_OpenSSLError(code, err_lib, err_func, err_reason))
|
||||
|
||||
return errors
|
||||
|
||||
|
||||
def _openssl_assert(lib, ok):
|
||||
if not ok:
|
||||
errors = _consume_errors(lib)
|
||||
errors_with_text = []
|
||||
for err in errors:
|
||||
buf = ffi.new("char[]", 256)
|
||||
lib.ERR_error_string_n(err.code, buf, len(buf))
|
||||
err_text_reason = ffi.string(buf)
|
||||
|
||||
errors_with_text.append(
|
||||
_OpenSSLErrorWithText(
|
||||
err.code, err.lib, err.func, err.reason, err_text_reason
|
||||
)
|
||||
)
|
||||
|
||||
raise InternalError(
|
||||
"Unknown OpenSSL error. Please file an issue at https://github.com"
|
||||
"/pyca/cryptography/issues with information on how to reproduce "
|
||||
"this. ({0!r})".format(errors),
|
||||
errors
|
||||
"Unknown OpenSSL error. This error is commonly encountered when "
|
||||
"another library is not cleaning up the OpenSSL error stack. If "
|
||||
"you are using cryptography with another library that uses "
|
||||
"OpenSSL try disabling it before reporting a bug. Otherwise "
|
||||
"please file an issue at https://github.com/pyca/cryptography/"
|
||||
"issues with information on how to reproduce "
|
||||
"this. ({0!r})".format(errors_with_text),
|
||||
errors_with_text
|
||||
)
|
||||
|
||||
|
||||
def ffi_callback(signature, name, **kwargs):
|
||||
"""Callback dispatcher
|
||||
|
||||
The ffi_callback() dispatcher keeps callbacks compatible between dynamic
|
||||
and static callbacks.
|
||||
"""
|
||||
def wrapper(func):
|
||||
if lib.Cryptography_STATIC_CALLBACKS:
|
||||
# def_extern() returns a decorator that sets the internal
|
||||
# function pointer and returns the original function unmodified.
|
||||
ffi.def_extern(name=name, **kwargs)(func)
|
||||
callback = getattr(lib, name)
|
||||
else:
|
||||
# callback() wraps the function in a cdata function.
|
||||
callback = ffi.callback(signature, **kwargs)(func)
|
||||
return callback
|
||||
return wrapper
|
||||
|
||||
|
||||
@ffi_callback("int (*)(unsigned char *, int)",
|
||||
name="Cryptography_rand_bytes",
|
||||
error=-1)
|
||||
def _osrandom_rand_bytes(buf, size):
|
||||
signed = ffi.cast("char *", buf)
|
||||
result = os.urandom(size)
|
||||
signed[0:size] = result
|
||||
return 1
|
||||
|
||||
|
||||
@ffi_callback("int (*)(void)", name="Cryptography_rand_status")
|
||||
def _osrandom_rand_status():
|
||||
return 1
|
||||
|
||||
|
||||
def build_conditional_library(lib, conditional_names):
|
||||
conditional_lib = types.ModuleType("lib")
|
||||
conditional_lib._original_lib = lib
|
||||
excluded_names = set()
|
||||
for condition, names in conditional_names.items():
|
||||
for condition, names_cb in conditional_names.items():
|
||||
if not getattr(lib, condition):
|
||||
excluded_names |= set(names)
|
||||
excluded_names.update(names_cb())
|
||||
|
||||
for attr in dir(lib):
|
||||
if attr not in excluded_names:
|
||||
|
|
@ -99,47 +100,24 @@ class Binding(object):
|
|||
lib = None
|
||||
ffi = ffi
|
||||
_lib_loaded = False
|
||||
_locks = None
|
||||
_lock_cb_handle = None
|
||||
_init_lock = threading.Lock()
|
||||
_lock_init_lock = threading.Lock()
|
||||
|
||||
_osrandom_engine_id = ffi.new("const char[]", b"osrandom")
|
||||
_osrandom_engine_name = ffi.new("const char[]", b"osrandom_engine")
|
||||
_osrandom_method = ffi.new(
|
||||
"RAND_METHOD *",
|
||||
dict(bytes=_osrandom_rand_bytes,
|
||||
pseudorand=_osrandom_rand_bytes,
|
||||
status=_osrandom_rand_status)
|
||||
)
|
||||
|
||||
def __init__(self):
|
||||
self._ensure_ffi_initialized()
|
||||
|
||||
@classmethod
|
||||
def _register_osrandom_engine(cls):
|
||||
_openssl_assert(cls.lib, cls.lib.ERR_peek_error() == 0)
|
||||
|
||||
engine = cls.lib.ENGINE_new()
|
||||
_openssl_assert(cls.lib, engine != cls.ffi.NULL)
|
||||
try:
|
||||
result = cls.lib.ENGINE_set_id(engine, cls._osrandom_engine_id)
|
||||
_openssl_assert(cls.lib, result == 1)
|
||||
result = cls.lib.ENGINE_set_name(engine, cls._osrandom_engine_name)
|
||||
_openssl_assert(cls.lib, result == 1)
|
||||
result = cls.lib.ENGINE_set_RAND(engine, cls._osrandom_method)
|
||||
_openssl_assert(cls.lib, result == 1)
|
||||
result = cls.lib.ENGINE_add(engine)
|
||||
if result != 1:
|
||||
errors = _consume_errors(cls.lib)
|
||||
_openssl_assert(
|
||||
cls.lib,
|
||||
errors[0].reason == cls.lib.ENGINE_R_CONFLICTING_ENGINE_ID
|
||||
)
|
||||
|
||||
finally:
|
||||
result = cls.lib.ENGINE_free(engine)
|
||||
_openssl_assert(cls.lib, result == 1)
|
||||
# Clear any errors extant in the queue before we start. In many
|
||||
# scenarios other things may be interacting with OpenSSL in the same
|
||||
# process space and it has proven untenable to assume that they will
|
||||
# reliably clear the error queue. Once we clear it here we will
|
||||
# error on any subsequent unexpected item in the stack.
|
||||
cls.lib.ERR_clear_error()
|
||||
cls._osrandom_engine_id = cls.lib.Cryptography_osrandom_engine_id
|
||||
cls._osrandom_engine_name = cls.lib.Cryptography_osrandom_engine_name
|
||||
result = cls.lib.Cryptography_add_osrandom_engine()
|
||||
_openssl_assert(cls.lib, result in (1, 2))
|
||||
|
||||
@classmethod
|
||||
def _ensure_ffi_initialized(cls):
|
||||
|
|
@ -159,42 +137,31 @@ class Binding(object):
|
|||
def init_static_locks(cls):
|
||||
with cls._lock_init_lock:
|
||||
cls._ensure_ffi_initialized()
|
||||
|
||||
if not cls._lock_cb_handle:
|
||||
wrapper = ffi_callback(
|
||||
"void(int, int, const char *, int)",
|
||||
name="Cryptography_locking_cb",
|
||||
)
|
||||
cls._lock_cb_handle = wrapper(cls._lock_cb)
|
||||
|
||||
# Use Python's implementation if available, importing _ssl triggers
|
||||
# the setup for this.
|
||||
__import__("_ssl")
|
||||
|
||||
if cls.lib.CRYPTO_get_locking_callback() != cls.ffi.NULL:
|
||||
if (not cls.lib.Cryptography_HAS_LOCKING_CALLBACKS or
|
||||
cls.lib.CRYPTO_get_locking_callback() != cls.ffi.NULL):
|
||||
return
|
||||
|
||||
# If nothing else has setup a locking callback already, we set up
|
||||
# our own
|
||||
num_locks = cls.lib.CRYPTO_num_locks()
|
||||
cls._locks = [threading.Lock() for n in range(num_locks)]
|
||||
res = lib.Cryptography_setup_ssl_threads()
|
||||
_openssl_assert(cls.lib, res == 1)
|
||||
|
||||
cls.lib.CRYPTO_set_locking_callback(cls._lock_cb_handle)
|
||||
|
||||
@classmethod
|
||||
def _lock_cb(cls, mode, n, file, line):
|
||||
lock = cls._locks[n]
|
||||
|
||||
if mode & cls.lib.CRYPTO_LOCK:
|
||||
lock.acquire()
|
||||
elif mode & cls.lib.CRYPTO_UNLOCK:
|
||||
lock.release()
|
||||
else:
|
||||
raise RuntimeError(
|
||||
"Unknown lock mode {0}: lock={1}, file={2}, line={3}.".format(
|
||||
mode, n, file, line
|
||||
)
|
||||
)
|
||||
def _verify_openssl_version(lib):
|
||||
if (
|
||||
lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_102 and
|
||||
not lib.CRYPTOGRAPHY_IS_LIBRESSL
|
||||
):
|
||||
warnings.warn(
|
||||
"OpenSSL version 1.0.1 is no longer supported by the OpenSSL "
|
||||
"project, please upgrade. A future version of cryptography will "
|
||||
"drop support for it.",
|
||||
utils.CryptographyDeprecationWarning
|
||||
)
|
||||
|
||||
|
||||
# OpenSSL is not thread safe until the locks are initialized. We call this
|
||||
|
|
@ -204,10 +171,4 @@ class Binding(object):
|
|||
# is per module so this approach will not work.
|
||||
Binding.init_static_locks()
|
||||
|
||||
if Binding.lib.SSLeay() < 0x10001000:
|
||||
warnings.warn(
|
||||
"OpenSSL versions less than 1.0.1 are no longer supported by the "
|
||||
"OpenSSL project, please upgrade. A future version of cryptography "
|
||||
"will drop support for these versions.",
|
||||
DeprecationWarning
|
||||
)
|
||||
_verify_openssl_version(Binding.lib)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue