1 2011-04-07 Jean-Paul Calderone <exarkun@twistedmatrix.com>
5 2011-04-06 Jean-Paul Calderone <exarkun@twistedmatrix.com>
7 * OpenSSL/crypto/x509.c: Add get_extension_count and get_extension
8 to the X509 type, allowing read access to certificate extensions.
10 * OpenSSL/crypto/x509ext.c: Add get_short_name and get_data to the
11 X509Extension type, allowing read access to the contents of an
14 2011-03-21 Olivier Hervieu <lp:~ohe>
16 * OpenSSL/ssl/ssl.c: Expose a number of symbolic constants for
17 values passed to the connection "info" callback.
19 2011-01-22 Jean-Paul Calderone <exarkun@twistedmatrix.com>
21 * OpenSSL/ssl/connection.py: Add support for new-style
22 buffers (primarily memoryviews) to Connection.send and
25 2010-11-01 Jean-Paul Calderone <exarkun@twistedmatrix.com>
29 2010-10-07 Jean-Paul Calderone <exarkun@twistedmatrix.com>
31 * Initial support for Python 3.x throughout the codebase.
33 2010-09-14 Jean-Paul Calderone <exarkun@twistedmatrix.com>
35 * OpenSSL/crypto/netscape_spki.c: Fix an off-by-one mistake in the
36 error handling for NetscapeSPKI.verify. Add additional error
37 checking to NetscapeSPKI.sign to handle the case where there is no
40 * OpenSSL/crypto/x509.c: Fix an overflow bug in the subject_name_hash
41 method of the X509 type which would cause it to return negative
42 values on 32 bit systems.
44 * OpenSSL/crypto/x509req.c: Fix an off-by-one mistake in the error
45 handling for X509Req.verify.
47 * OpenSSL/ssl/context.c: Fix the error handling in the load_tmp_dh
48 method of the Context type which would cause it to always raise
49 MemoryError, regardless of the actual error (such as a bad file
52 * OpenSSL/test/: Numerous unit tests added, both for above fixes
53 and for other previously untested code paths.
55 2010-07-27 Jean-Paul Calderone <exarkun@twistedmatrix.com>
57 * Re-arrange the repository so that the package can be built and
58 used in-place without requiring installation.
60 2010-02-27 James Yonan <james@openvpn.net>
62 * src/crypto/crypto.c: Added crypto.sign and crypto.verify methods
63 that wrap EVP_Sign and EVP_Verify function families, using code
64 derived from Dave Cridland's PyOpenSSL branch.
66 * test/test_crypto.py: Added unit tests for crypto.sign and
69 2010-01-27 Jean-Paul Calderone <exarkun@twistedmatrix.com>
71 * src/ssl/connection.c, src/util.h: Apply patch from Sandro Tosi to
72 fix misspellings of "compatibility".
74 2009-11-13 Jean-Paul Calderone <exarkun@twistedmatrix.com>
78 2009-11-07 Žiga Seilnacht, Jean-Paul Calderone <exarkun@twistedmatrix.com>
80 * src/ssl/connection.c, src/ssl/context.c: Add set_client_ca_list,
81 add_client_ca, and get_client_ca_list to Context for manipulating
82 the list of certificate authority names which are sent by servers
83 with the certificate request message.
84 * src/util.h: Add ssize-related defines if the version of Python
85 being used does not have them.
86 * setup.py: Significant changes to the way Windows builds are done,
87 particularly the way OpenSSL headers and libraries are found (with
88 the new --with-openssl argument to build_ext).
90 2009-08-27 Rick Dean <rick@fdd.com>, Jean-Paul Calderone <exarkun@twistedmatrix.com>
92 * src/crypto/pkcs12.c: Add setters to the PKCS12 type for the
93 certificate, private key, ca certificate list, and friendly
94 name, and add a getter for the friendly name. Also add a method
95 for exporting a PKCS12 object as a string.
96 * test/test_crypto.py: Add lots of additional tests for the PKCS12
98 * doc/pyOpenSSL.tex: Documentation for the new PKCS12 methods.
100 2009-07-17 Rick Dean <rick@fdd.com>, Jean-Paul Calderone <exarkun@twistedmatrix.com>
102 * src/crypto/x509ext.c: Add subject and issuer parameters to
103 X509Extension, allowing creation of extensions which require that
104 information. Fixes LP#322813.
106 2009-07-16 Jean-Paul Calderone <exarkun@twistedmatrix.com>
108 * test/util.py: Changed the base TestCase's tearDown to assert that
109 no errors were left in the OpenSSL error queue by the test.
110 * src/crypto/crypto.c: Add a private helper in support of the
111 TestCase.tearDown change.
112 * src/crypto/x509name.c: Changed X509Name's getattr implementation
113 to clean up the error queue. Fixes LP#314814.
114 * test/util.c: Changed flush_error_queue to avoid a reference
115 counting bug caused by macro expansion.
117 2009-07-16 Rick Dean <rick@fdd.com>
119 * src/rand.c: Added OpenSSL.rand.bytes to get random bytes directly.
120 * src/util.c: Added generic exceptions_from_error_queue to replace
121 the various other implementations of this function. Also updated
122 the rest of the codebase to use this version instead.
124 2009-07-05 Jean-Paul Calderone <exarkun@twistedmatrix.com>
126 * test/util.py, test/test_ssl.py, test/test_crypto.py: Fold the
127 Python 2.3 compatibility TestCase mixin into the TestCase defined
130 2009-07-05 Jean-Paul Calderone <exarkun@twistedmatrix.com>
132 * test/util.py, test/test_ssl.py, test/test_crypto.py: Stop trying
133 to use Twisted's TestCase even when it's available. Instead,
134 always use the stdlib TestCase with a few enhancements.
136 2009-07-04 Jean-Paul Calderone <exarkun@twistedmatrix.com>
138 * Changed most extension types so that they can be instantiated
139 using the type object rather than a factory function. The old
140 factory functions are now aliases for the type objects.
143 2009-05-27 Jean-Paul Calderone <exarkun@twistedmatrix.com>
145 * Changed all docstrings in extension modules to be friendlier
146 towards Python programmers. Fixes LP#312787.
148 2009-05-27 Jean-Paul Calderone <exarkun@twistedmatrix.com>
150 * src/crypto/x509ext.c: Correctly deallocate the new Extension
151 instance when there is an error initializing it and it is not
152 going to be returned. Resolves LP#368043.
154 2009-05-11 Jean-Paul Calderone <exarkun@twistedmatrix.com>
156 * test/test_crypto.py: Use binary mode for the pipe to talk to the
157 external openssl binary. The data being transported over this
158 pipe is indeed binary, so previously it would often be truncated
159 or otherwise mangled.
161 * src/ssl/connection.h, src/ssl/connection.c, test/test_ssl.py:
162 Extend the Connection class with support for in-memory BIOs. This
163 allows SSL to be run without a real socket, useful for
164 implementing EAP-TLS or using SSL with Windows IO completion
165 ports, for example. Based heavily on contributions from Rick
168 2009-04-25 Jean-Paul Calderone <exarkun@twistedmatrix.com>
172 2009-04-01 Jean-Paul Calderone <exarkun@twistedmatrix.com>
173 Samuele Pedroni <pedronis@openend.se>
175 * src/util.h: Delete the TLS key before trying to set a new value
176 for it in case the current thread identifier is a recycled one (if
177 it is recycled, the key won't be set because there is already a
178 value from the previous thread to have this identifier and to use
181 2009-04-01 Jean-Paul Calderone <exarkun@twistedmatrix.com>
183 * src/crypto/crypto.c: Add FILETYPE_TEXT for dumping keys and
184 certificates and certificate signature requests to a text format.
186 2008-12-31 Jean-Paul Calderone <exarkun@twistedmatrix.com>
188 * src/crypto/x509ext.c, test/test_crypto.py: Add the get_short_name
189 method to X509Extension based on patch from Alex Stapleton.
191 2008-12-31 Jean-Paul Calderone <exarkun@twistedmatrix.com>
193 * src/crypto/x509ext.c, test/test_crypto.py: Fix X509Extension so
194 that it is possible to instantiate extensions which use s2i or r2i
195 instead of v2i (an extremely obscure extension implementation
198 2008-12-30 Jean-Paul Calderone <exarkun@twistedmatrix.com>
200 * MANIFEST.in, src/crypto/crypto.c, src/crypto/x509.c,
201 src/crypto/x509name.c, src/rand/rand.c, src/ssl/context.c: Changes
202 which eliminate compiler warnings but should not change any
205 2008-12-28 Jean-Paul Calderone <exarkun@twistedmatrix.com>
207 * test/test_ssl.py, src/ssl/ssl.c: Expose DTLS-related constants,
208 OP_NO_QUERY_MTU, OP_COOKIE_EXCHANGE, and OP_NO_TICKET.
210 2008-12-28 Jean-Paul Calderone <exarkun@twistedmatrix.com>
212 * src/ssl/context.c: Add a capath parameter to
213 Context.load_verify_locations to allow Python code to specify
214 either or both arguments to the underlying
215 SSL_CTX_load_verify_locations API.
216 * src/ssl/context.c: Add Context.set_default_verify_paths, a wrapper
217 around SSL_CTX_set_default_verify_paths.
219 2008-12-28 Jean-Paul Calderone <exarkun@twistedmatrix.com>
221 * test/test_crypto.py, src/crypto/x509req.c: Added get_version and
222 set_version_methods to X509ReqType based on patch from Wouter van
223 Bommel. Resolves LP#274418.
225 2008-09-22 Jean-Paul Calderone <exarkun@twistedmatrix.com>
229 2008-10-19 Jean-Paul Calderone <exarkun@twistedmatrix.com>
231 * tsafe.py: Revert the deprecation of the thread-safe Connection
232 wrapper. The Connection class should not segfault if used from
233 multiple threads now, but it generally cannot be relied on to
234 produce correct results if used without the thread-safe wrapper.
235 * doc/pyOpenSSL.tex: Correct the documentation for the set_passwd_cb
236 callback parameter so that it accurately describes the required
239 2008-09-22 Jean-Paul Calderone <exarkun@twistedmatrix.com>
243 2008-09-21 Jean-Paul Calderone <exarkun@twistedmatrix.com>
245 * src/ssl/ssl.h, src/ssl/ssl.c: Add a thread-local storage key
246 which will be used to store and retrieve PyThreadState pointers
247 whenever it is necessary to release or re-acquire the GIL.
249 * src/ssl/context.c: Change global_verify_callback so that it
250 unconditionally manipulates the Python threadstate, rather than
251 checking the tstate field which is now always NULL.
253 2008-04-26 Jean-Paul Calderone <exarkun@twistedmatrix.com>
255 * src/ssl/context.c: Change global_passphrase_callback and
256 global_info_callback so that they acquire the GIL before
257 invoking any CPython APIs and do not release it until after they
258 are finished invoking all of them (based heavily on on patch
260 * src/ssl/crypto.c: Initialize OpenSSL thread support so that it
261 is valid to use OpenSSL APIs from more than one thread (based on
262 patch from Dan Williams).
263 * test/test_crypto.py: Add tests for load_privatekey and
264 dump_privatekey when a passphrase or a passphrase callback is
266 * test/test_ssl.py: Add tests for Context.set_passwd_cb and
267 Context.set_info_callback.
269 2008-04-11 Jean-Paul Calderone <exarkun@twistedmatrix.com>
273 2008-03-26 Jean-Paul Calderone <exarkun@twistedmatrix.com>
275 * src/crypto/x509name.c: Add X509Name.get_components
277 2008-03-25 Jean-Paul Calderone <exarkun@twistedmatrix.com>
279 * src/crypto/x509name.c: Add hash and der methods to X509Name.
280 * src/crypto/x509.c: Fix a bug in X509.get_notBefore and
281 X509.get_notAfter preventing UTCTIME format timestamps from
284 2008-03-12 Jean-Paul Calderone <exarkun@twistedmatrix.com>
286 * Fix coding problems in examples/. Remove keys and certificates
287 and add a note about how to generate new ones.
289 2008-03-09 Jean-Paul Calderone <exarkun@twistedmatrix.com>
291 * src/crypto/x509.c: Add getters and setters for the notBefore and
292 notAfter attributes of X509s.
293 * src/crypto/pkey.h, src/crypto/pkey.c, src/crypto/x509req.c,
294 src/crypto/x509.c: Track the initialized and public/private state
295 of EVP_PKEY structures underlying the crypto_PKeyObj type and
296 reject X509Req signature operations on keys not suitable for the
299 2008-03-06 Jean-Paul Calderone <exarkun@twistedmatrix.com>
301 * src/crypto/x509name.c: Fix tp_compare so it only returns -1, 0, or
302 1. This eliminates a RuntimeWarning emitted by Python.
303 * src/crypto/x509req.c: Fix reference counting for X509Name returned
304 by X509Req.get_subject. This removes a segfault when the subject
305 name outlives the request object.
306 * src/crypto/x509.c: Change get_serial_number and set_serial_number
307 to accept Python longs.
308 * doc/pyOpenSSL.tex: A number of minor corrections.
310 2008-03-03 Jean-Paul Calderone <exarkun@twistedmatrix.com>
312 * src/crypto/crypto.c: Expose X509_verify_cert_error_string. (patch
315 2008-02-22 Jean-Paul Calderone <exarkun@twistedmatrix.com>
317 * src/ssl/connection.c src/ssl/context.c src/ssl/ssl.c: Fix
318 compilation on Windows. (patch from Michael Schneider)
320 2008-02-21 Jean-Paul Calderone <exarkun@twistedmatrix.com>
322 * src/ssl/connection.c: Expose SSL_get_shutdown and
323 SSL_set_shutdown. (patch from James Knight)
324 * src/ssl/ssl.c: Expose SSL_SENT_SHUTDOWN and SSL_RECEIVED_SHUTDOWN.
325 (patch from James Knight)
327 2008-02-19 Jean-Paul Calderone <exarkun@twistedmatrix.com>
329 * src/ssl/context.c: Expose SSL_CTX_add_extra_chain_cert.
330 * src/crypto/x509name.c: Fix memory leaks in __getattr__ and
331 __setattr_ implementations.
332 * src/crypto/x509.c: Fix memory leak in X509.get_pubkey().
333 * leakcheck/: An attempt at a systematic approach to leak
336 2004-08-13 Martin Sjögren <msjogren@gmail.com>
338 * Released version 0.6.
340 2004-08-11 Martin Sjögren <msjogren@gmail.com>
342 * doc/pyOpenSSL.tex: Updates to the docs.
344 2004-08-10 Martin Sjögren <msjogren@gmail.com>
346 * src/crypto/x509.c: Add X509.add_extensions based on a patch
348 * src/ssl/ssl.c: Add more SSL_OP_ constants. Patch from Mihai
351 2004-08-09 Martin Sjögren <msjogren@gmail.com>
353 * setup.py src/crypto/: Add support for Netscape SPKI extensions
354 based on a patch from Tollef Fog Heen.
355 * src/crypto/crypto.c: Add support for python passphrase callbacks
356 based on a patch from Robert Olson.
358 2004-08-03 Martin Sjögren <msjogren@gmail.com>
360 * src/ssl/context.c: Applied patch from Frederic Peters to add
361 Context.use_certificate_chain_file.
362 * src/crypto/x509.c: Applid patch from Tollef Fog Heen to add
363 X509.subject_name_hash and X509.digest.
365 2004-08-02 Martin Sjögren <msjogren@gmail.com>
367 * src/crypto/crypto.c src/ssl/ssl.c: Applied patch from Bastian
368 Kleineidam to fix full names of exceptions.
370 2004-07-19 Martin Sjögren <msjogren@gmail.com>
372 * doc/pyOpenSSL.tex: Fix the errors regarding X509Name's field names.
374 2004-07-18 Martin Sjögren <msjogren@gmail.com>
376 * examples/certgen.py: Fixed wrong attributes in doc string, thanks
378 * __init__.py, setup.py, version.py: Add __version__, as suggested by
379 Ronald Oussoren in SFbug#888729.
380 * examples/proxy.py: Fix typos, thanks Mihai Ibanescu. (SFpatch#895820)
382 2003-01-09 Martin Sjögren <martin@strakt.com>
384 * Use cyclic GC protocol in SSL.Connection, SSL.Context, crypto.PKCS12
387 2002-12-02 Martin Sjögren <martin@strakt.com>
389 * tsafe.py: Add some missing methods.
391 2002-10-06 Martin Sjögren <martin@strakt.com>
393 * __init__.py: Import tsafe too!
395 2002-10-05 Martin Sjögren <martin@strakt.com>
397 * src/crypto/x509name.c: Use unicode strings instead of ordinary
398 strings in getattr/setattr. Note that plain ascii strings should
401 2002-09-17 Martin Sjögren <martin@strakt.com>
403 * Released version 0.5.1.
405 2002-09-09 Martin Sjögren <martin@strakt.com>
407 * setup.cfg: Fixed build requirements for rpms.
409 2002-09-07 Martin Sjögren <martin@strakt.com>
411 * src/ssl/connection.c: Fix sendall() method. It segfaulted because
412 it was too generous about giving away the GIL.
413 * Added SecureXMLRPCServer example, contributed by Michal Wallace.
415 2002-09-06 Martin Sjögren <martin@strakt.com>
417 * setup.cfg: Updated the build requirements.
418 * src/ssl/connection.c: Fix includes for AIX.
420 2002-09-04 Anders Hammarquist <iko@strakt.com>
422 * Added type checks in all the other places where we expect
423 specific types of objects passed.
425 2002-09-04 Martin Sjögren <martin@strakt.com>
427 * src/crypto/crypto.c: Added an explicit type check in the dump_*
428 functions, so that they won't die when e.g. None is passed in.
430 2002-08-25 Martin Sjögren <martin@strakt.com>
432 * doc/pyOpenSSL.tex: Docs for PKCS12.
434 2002-08-24 Martin Sjögren <martin@strakt.com>
436 * src/crypto: Added basic PKCS12 support, thanks to Mark Welch
439 2002-08-16 Martin Sjögren <martin@strakt.com>
441 * D'oh! Fixes for python 1.5 and python 2.1.
443 2002-08-15 Martin Sjögren <martin@strakt.com>
447 2002-07-25 Martin Sjögren <martin@strakt.com>
449 * src/ssl/context.c: Added set_options method.
450 * src/ssl/ssl.c: Added constants for Context.set_options method.
452 2002-07-23 Martin Sjögren <martin@strakt.com>
455 * src/ssl/connection.c: Changed the get_cipher_list method to actually
456 return a list! WARNING: This change makes the API incompatible with
459 2002-07-15 Martin Sjögren <martin@strakt.com>
461 * src/ssl/connection.[ch]: Removed the fileno method, it uses the
462 transport object's fileno instead.
464 2002-07-09 Martin Sjögren <martin@strakt.com>
466 * src/crypto/x509.c src/crypto/x509name.c: Fixed segfault bug where
467 you used an X509Name after its X509 had been destroyed.
468 * src/crypto/crypto.[ch] src/crypto/x509req.c src/crypto/x509ext.[ch]:
469 Added X509 Extension support. Thanks to maas-Maarten Zeeman
471 * src/crypto/pkey.c: Added bits() and type() methods.
473 2002-07-08 Martin Sjögren <martin@strakt.com>
475 * src/ssl/connection.c: Moved the contents of setup_ssl into the
476 constructor, thereby fixing some segfault bugs :)
477 * src/ssl/connection.c: Added connect_ex and sendall methods.
478 * src/crypto/x509name.c: Cleaned up comparisons and NID lookup.
479 Thank you Maas-Maarten Zeeman <maas@awanim.com>
480 * src/rand/rand.c: Fix RAND_screen import.
481 * src/crypto/crypto.c src/crypto/pkcs7.[ch]: Added PKCS7 management,
482 courtesy of Maas-Maarten Zeeman <maas@awanim.com>
483 * src/crypto/x509req.c: Added verify method.
485 2002-06-17 Martin Sjögren <martin@strakt.com>
487 * rpm/, setup.cfg: Added improved RPM-building stuff, thanks to
488 Mihai Ibanescu <misa@redhat.com>
490 2002-06-14 Martin Sjögren <martin@strakt.com>
492 * examples/proxy.py: Example code for using OpenSSL through a proxy
493 contributed by Mihai Ibanescu <misa@redhat.com>
494 * Updated installation instruction and added them to the TeX manual.
496 2002-06-13 Martin Sjögren <martin@strakt.com>
498 * src/ssl/context.c: Changed global_verify_callback so that it uses
499 PyObject_IsTrue instead of requring ints.
500 * Added pymemcompat.h to make the memory management uniform and
501 backwards-compatible.
502 * src/util.h: Added conditional definition of PyModule_AddObject and
503 PyModule_AddIntConstant
504 * src/ssl/connection.c: Socket methods are no longer explicitly
505 wrapped. fileno() is the only method the transport layer object HAS
506 to support, but if you want to use connect, accept or sock_shutdown,
507 then the transport layer object has to supply connect, accept
508 and shutdown respectively.
510 2002-06-12 Martin Sjögren <martin@strakt.com>
512 * Changed comments to docstrings that are visible in Python.
513 * src/ssl/connection.c: Added set_connect_state and set_accept_state
514 methods. Thanks to Mark Welch <mark@collab.net> for this.
516 2002-06-11 Martin Sjögren <martin@strakt.com>
518 * src/ssl/connection.c: accept and connect now use SSL_set_accept_state
519 and SSL_set_connect_state respectively, instead of SSL_accept and
521 * src/ssl/connection.c: Added want_read and want_write methods.
523 2002-06-05 Martin Sjögren <martin@strakt.com>
525 * src/ssl/connection.c: Added error messages for windows. The code is
526 copied from Python's socketmodule.c. Ick.
527 * src/ssl/connection.c: Changed the parameters to the SysCallError. It
528 always has a tuple (number, string) now, even though the number
529 might not always be useful.
531 2002-04-05 Martin Sjögren <md9ms@mdstud.chalmers.se>
533 * Worked more on the Debian packaging, hopefully the packages
534 are getting into the main Debian archive soon.
536 2002-01-10 Martin Sjögren <martin@strakt.com>
538 * Worked some more on the Debian packaging, it's turning out real
540 * Changed format on this file, I'm going to try to be a bit more
541 verbose about my changes, and this format makes it easier.
543 2002-01-08 Martin Sjögren <martin@strakt.com>
546 * Added some example code
547 * Added the thread safe Connection object in the 'tsafe' submodule
548 * New Debian packaging
550 2001-08-09 Martin Sjögren <martin@strakt.com>
553 * Added a compare function for X509Name structures.
554 * Moved the submodules to separate .so files, with tiny C APIs so they
556 * Skeletal OpenSSL/__init__.py
557 * Removed the err submodule, use crypto.Error and SSL.Error instead
559 2001-08-06 Martin Sjögren <martin@strakt.com>
562 * Added more types for dealing with certificates (X509Store, X509Req,
564 * Functionality to load private keys, certificates and certificate
565 requests from memory buffers, and store them too
566 * X509 and X509Name objects can now be modified as well, very neat when
567 creating certificates ;)
568 * Added SSL_MODE_AUTO_RETRY to smooth things for blocking sockets
569 * Added a sock_shutdown() method to the Connection type
570 * I don't understand why, but I can't use Py_InitModule() to create
571 submodules in Python 2.0, the interpreter segfaults on the cleanup
572 process when I do. I added a conditional compile on the version
573 number, falling back to my own routine. It would of course be nice to
574 investigate what is happening, but I don't have the time to do so
575 * Do INCREF on the type objects before inserting them in the
576 dictionary, so they will never reach refcount 0 (they are, after all,
577 statically allocated)
579 2001-07-30 Martin Sjögren <martin@strakt.com>
582 * Lots of tweaking and comments in the code
583 * Now uses distutils instead of the stupid Setup file
584 * Hacked doc/tools/mkhowto, html generation should now work
586 2001-07-16 Martin Sjögren <martin@strakt.com>
588 * Initial release (0.1, don't expect much from this one :-)