* Revert "don't allow GeneralNames to be an empty list (#4128)" (#4161)
This breaks the urllib3 tests, as well as several in-the-wild certs
This reverts commit 388d1bd3e9.
* changelog
* Don't reference undocumented class
* implement AES KW with padding (RFC 5649)
fixes#3791
* oops, 2.2
* make sure this is the right valueerror
* more match
* make key padding easier to read
* review feedback
* review feedback
* change our manylinux1 and macos wheel builders to build limited api
pip does not currently support the--py-limited-api cli flag that wheel
uses so we have to switch to downloading and then building via
setup.py bdist_wheel for now.
However, we can get rid of everything but the py34 builder on
mac/linux/linux32, saving us 6 wheels now (and soon 9 with the release
of python 3.7)
* some newlines
* review feedback
* added brainpool ec-curves key_length >= 256bit
* limit brainpool curves to the set that appear required + docs
* oops
* typos all around me
* add brainpool ECDH kex tests
* switch to using rfc 7027 vectors
* review feedback
* empty commits are the best
The ouput of execstack -q is one line per file, either:
- starting with a '-' (dash) if the file does not require an executable stack
- start with an 'X' if the file *does* require an executable stack
We check there are no files which require an executable stack.
* Remove unused bindings from asn1.py
This also includes a couple removals from x509v3.py which also reference
ASN1_ITEM_EXP.
* re-add int ASN1_STRING_set_default_mask_asc(char *);
* also re-add static const int MBSTRING_UTF8
Currently we only expose SSL_get_peer_certificate, which allows you
to retrieve the remote party's certificate. This adds the symetrical
binding to retrieve the local party's certificate.
The motivation for this additional binding is to make it possible to
query the local certificate regardless of the method which was used to
load the certificate into the SSL connection (from a file, from an
in-memory object). An example where this is useful is when negotiating
a DTLS-SRTP connection, the fingerprint of the local certificate needs
to be communicated to the remote party out-of-band via SDP.
This binding can be exposed in pyopenssl as Connection.get_certificate().
* The HKDF limit is actually 255 * digest_length_in_bytes
Previously we had a bug where we divided digest_size by 8...but
HashAlgorithm.digest_size is already in bytes.
* test longer output
* changelog
