Browse Source
python-cryptography: fix compilation without deprecated OpenSSL APIs
Signed-off-by: Rosen Penev <rosenp@gmail.com>lilik-openwrt-22.03
Rosen Penev
4 years ago
No known key found for this signature in database
GPG Key ID: 36D31CFA845F0E3B
7 changed files with 528 additions and 0 deletions
Split View
Diff Options
-
+37 -0lang/python/python-cryptography/patches/010-Add-new-ASN1_STRING_get0_data-API.patch
-
+63 -0lang/python/python-cryptography/patches/020-Add-compatibility-for-X509_STORE_set_get_issuer.patch
-
+137 -0lang/python/python-cryptography/patches/030-Add-compatibility-for-deprecated-TLS-methods.patch
-
+53 -0lang/python/python-cryptography/patches/040-Replace-EVP_CIPHER_CTX_cleanup-with-EVP_CIPHER_CTX_r.patch
-
+135 -0lang/python/python-cryptography/patches/050-Switch-get_-Update-APIs-to-get0.patch
-
+49 -0lang/python/python-cryptography/patches/060-Add-X509_STORE_CTX_trusted_stack-compatibility-macro.patch
-
+54 -0lang/python/python-cryptography/patches/070-Add-defines-for-totally-deprecated-functions.patch
+ 37
- 0
lang/python/python-cryptography/patches/010-Add-new-ASN1_STRING_get0_data-API.patch
View File
| @ -0,0 +1,37 @@ | |||
| From 1d97b931bf4701fbd3478d2b788ec4310d9eb8e1 Mon Sep 17 00:00:00 2001 | |||
| From: Rosen Penev <rosenp@gmail.com> | |||
| Date: Fri, 7 Jun 2019 18:18:46 -0700 | |||
| Subject: [PATCH] Add new ASN1_STRING_get0_data API | |||
| Introduced with OpenSSL 1.1 | |||
| --- | |||
| src/_cffi_src/openssl/asn1.py | 8 ++++++++ | |||
| 1 file changed, 8 insertions(+) | |||
| diff --git a/src/_cffi_src/openssl/asn1.py b/src/_cffi_src/openssl/asn1.py | |||
| index da55b670..85cd58bd 100644 | |||
| --- a/src/_cffi_src/openssl/asn1.py | |||
| +++ b/src/_cffi_src/openssl/asn1.py | |||
| @@ -45,6 +45,7 @@ void ASN1_OBJECT_free(ASN1_OBJECT *); | |||
| /* ASN1 STRING */ | |||
| unsigned char *ASN1_STRING_data(ASN1_STRING *); | |||
| +const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *); | |||
| int ASN1_STRING_set(ASN1_STRING *, const void *, int); | |||
| /* ASN1 OCTET STRING */ | |||
| @@ -105,4 +106,11 @@ ASN1_NULL *ASN1_NULL_new(void); | |||
| """ | |||
| CUSTOMIZATIONS = """ | |||
| +#if CRYPTOGRAPHY_OPENSSL_LESS_THAN_110 && !CRYPTOGRAPHY_LIBRESSL_27_OR_GREATER | |||
| +#define ASN1_STRING_get0_data ASN1_STRING_data | |||
| +#endif | |||
| + | |||
| +#if (OPENSSL_API_COMPAT >= 0x10100000L) && !CRYPTOGRAPHY_IS_LIBRESSL | |||
| +#define ASN1_STRING_data ASN1_STRING_get0_data | |||
| +#endif | |||
| """ | |||
| -- | |||
| 2.26.2 | |||
+ 63
- 0
lang/python/python-cryptography/patches/020-Add-compatibility-for-X509_STORE_set_get_issuer.patch
View File
| @ -0,0 +1,63 @@ | |||
| From a30684980e8f1f7472d885487880b405608f4122 Mon Sep 17 00:00:00 2001 | |||
| From: Rosen Penev <rosenp@gmail.com> | |||
| Date: Fri, 7 Jun 2019 20:42:04 -0700 | |||
| Subject: [PATCH] Add compatibility for X509_STORE_set_get_issuer | |||
| Deprecated under OpenSSL 1.1. | |||
| --- | |||
| src/_cffi_src/openssl/x509_vfy.py | 8 ++++++++ | |||
| src/cryptography/hazmat/bindings/openssl/_conditional.py | 9 +++++++++ | |||
| 2 files changed, 17 insertions(+) | |||
| diff --git a/src/_cffi_src/openssl/x509_vfy.py b/src/_cffi_src/openssl/x509_vfy.py | |||
| index d2bc5f4e..a1730738 100644 | |||
| --- a/src/_cffi_src/openssl/x509_vfy.py | |||
| +++ b/src/_cffi_src/openssl/x509_vfy.py | |||
| @@ -22,6 +22,7 @@ TYPES = """ | |||
| static const long Cryptography_HAS_102_VERIFICATION; | |||
| static const long Cryptography_HAS_110_VERIFICATION_PARAMS; | |||
| static const long Cryptography_HAS_X509_STORE_CTX_GET_ISSUER; | |||
| +static const long Cryptography_HAS_X509_CB_ISSUER_CHECK; | |||
| typedef ... Cryptography_STACK_OF_ASN1_OBJECT; | |||
| typedef ... Cryptography_STACK_OF_X509_OBJECT; | |||
| @@ -274,4 +275,11 @@ void (*X509_STORE_set_get_issuer)(X509_STORE *, | |||
| #else | |||
| static const long Cryptography_HAS_X509_STORE_CTX_GET_ISSUER = 1; | |||
| #endif | |||
| + | |||
| +#ifndef X509_V_FLAG_CB_ISSUER_CHECK | |||
| +static const long Cryptography_HAS_X509_CB_ISSUER_CHECK = 0; | |||
| +#define X509_V_FLAG_CB_ISSUER_CHECK 0x0 | |||
| +#else | |||
| +static const long Cryptography_HAS_X509_CB_ISSUER_CHECK = 1; | |||
| +#endif | |||
| """ | |||
| diff --git a/src/cryptography/hazmat/bindings/openssl/_conditional.py b/src/cryptography/hazmat/bindings/openssl/_conditional.py | |||
| index 9cf489ac..23dc38a4 100644 | |||
| --- a/src/cryptography/hazmat/bindings/openssl/_conditional.py | |||
| +++ b/src/cryptography/hazmat/bindings/openssl/_conditional.py | |||
| @@ -287,6 +287,12 @@ def cryptography_has_srtp(): | |||
| ] | |||
| +def cryptography_has_x509_cb_issuer_check(): | |||
| + return [ | |||
| + "X509_V_FLAG_CB_ISSUER_CHECK", | |||
| + ] | |||
| + | |||
| + | |||
| # This is a mapping of | |||
| # {condition: function-returning-names-dependent-on-that-condition} so we can | |||
| # loop over them and delete unsupported names at runtime. It will be removed | |||
| @@ -338,4 +344,7 @@ CONDITIONAL_NAMES = { | |||
| "Cryptography_HAS_ENGINE": cryptography_has_engine, | |||
| "Cryptography_HAS_VERIFIED_CHAIN": cryptography_has_verified_chain, | |||
| "Cryptography_HAS_SRTP": cryptography_has_srtp, | |||
| + "Cryptography_HAS_X509_CB_ISSUER_CHECK": ( | |||
| + cryptography_has_x509_cb_issuer_check | |||
| + ), | |||
| } | |||
| -- | |||
| 2.26.2 | |||
+ 137
- 0
lang/python/python-cryptography/patches/030-Add-compatibility-for-deprecated-TLS-methods.patch
View File
| @ -0,0 +1,137 @@ | |||
| From 3f3b85a59d3c2cb021174ad92ad3a43d9eb73e62 Mon Sep 17 00:00:00 2001 | |||
| From: Rosen Penev <rosenp@gmail.com> | |||
| Date: Fri, 7 Jun 2019 21:00:46 -0700 | |||
| Subject: [PATCH] Add compatibility for deprecated TLS methods | |||
| --- | |||
| src/_cffi_src/openssl/ssl.py | 45 +++++++++++++++++-- | |||
| .../hazmat/bindings/openssl/_conditional.py | 36 +++++++++++++++ | |||
| 2 files changed, 77 insertions(+), 4 deletions(-) | |||
| diff --git a/src/_cffi_src/openssl/ssl.py b/src/_cffi_src/openssl/ssl.py | |||
| index c38e309a..e726417d 100644 | |||
| --- a/src/_cffi_src/openssl/ssl.py | |||
| +++ b/src/_cffi_src/openssl/ssl.py | |||
| @@ -15,8 +15,9 @@ static const long Cryptography_HAS_SSL_ST; | |||
| static const long Cryptography_HAS_TLS_ST; | |||
| static const long Cryptography_HAS_SSL2; | |||
| static const long Cryptography_HAS_SSL3_METHOD; | |||
| -static const long Cryptography_HAS_TLSv1_1; | |||
| -static const long Cryptography_HAS_TLSv1_2; | |||
| +static const long Cryptography_HAS_TLS1_METHOD; | |||
| +static const long Cryptography_HAS_TLS1_1_METHOD; | |||
| +static const long Cryptography_HAS_TLS1_2_METHOD; | |||
| static const long Cryptography_HAS_TLSv1_3; | |||
| static const long Cryptography_HAS_SECURE_RENEGOTIATION; | |||
| static const long Cryptography_HAS_TLSEXT_STATUS_REQ_CB; | |||
| @@ -24,6 +25,7 @@ static const long Cryptography_HAS_STATUS_REQ_OCSP_RESP; | |||
| static const long Cryptography_HAS_TLSEXT_STATUS_REQ_TYPE; | |||
| static const long Cryptography_HAS_SSL_CTX_CLEAR_OPTIONS; | |||
| static const long Cryptography_HAS_DTLS; | |||
| +static const long Cryptography_HAS_DTLS1_METHOD; | |||
| static const long Cryptography_HAS_SIGALGS; | |||
| static const long Cryptography_HAS_PSK; | |||
| static const long Cryptography_HAS_CIPHER_DETAILS; | |||
| @@ -596,8 +598,43 @@ static const long Cryptography_HAS_STATUS_REQ_OCSP_RESP = 1; | |||
| static const long Cryptography_HAS_TLSEXT_STATUS_REQ_TYPE = 1; | |||
| static const long Cryptography_HAS_RELEASE_BUFFERS = 1; | |||
| static const long Cryptography_HAS_OP_NO_COMPRESSION = 1; | |||
| -static const long Cryptography_HAS_TLSv1_1 = 1; | |||
| -static const long Cryptography_HAS_TLSv1_2 = 1; | |||
| + | |||
| +#if (OPENSSL_API_COMPAT >= 0x10100000L) && !CRYPTOGRAPHY_IS_LIBRESSL | |||
| +static const long Cryptography_HAS_TLS1_METHOD = 0; | |||
| +const SSL_METHOD* (*TLSv1_method)(void) = NULL; | |||
| +const SSL_METHOD* (*TLSv1_server_method)(void) = NULL; | |||
| +const SSL_METHOD* (*TLSv1_client_method)(void) = NULL; | |||
| +#else | |||
| +static const long Cryptography_HAS_TLS1_METHOD = 1; | |||
| +#endif | |||
| + | |||
| +#if (OPENSSL_API_COMPAT >= 0x10100000L) && !CRYPTOGRAPHY_IS_LIBRESSL | |||
| +static const long Cryptography_HAS_TLS1_1_METHOD = 0; | |||
| +const SSL_METHOD* (*TLSv1_1_method)(void) = NULL; | |||
| +const SSL_METHOD* (*TLSv1_1_server_method)(void) = NULL; | |||
| +const SSL_METHOD* (*TLSv1_1_client_method)(void) = NULL; | |||
| +#else | |||
| +static const long Cryptography_HAS_TLS1_1_METHOD = 1; | |||
| +#endif | |||
| + | |||
| +#if (OPENSSL_API_COMPAT >= 0x10100000L) && !CRYPTOGRAPHY_IS_LIBRESSL | |||
| +static const long Cryptography_HAS_TLS1_2_METHOD = 0; | |||
| +const SSL_METHOD* (*TLSv1_2_method)(void) = NULL; | |||
| +const SSL_METHOD* (*TLSv1_2_server_method)(void) = NULL; | |||
| +const SSL_METHOD* (*TLSv1_2_client_method)(void) = NULL; | |||
| +#else | |||
| +static const long Cryptography_HAS_TLS1_2_METHOD = 1; | |||
| +#endif | |||
| + | |||
| +#if (OPENSSL_API_COMPAT >= 0x10100000L) && !CRYPTOGRAPHY_IS_LIBRESSL | |||
| +static const long Cryptography_HAS_DTLS1_METHOD = 0; | |||
| +const SSL_METHOD* (*DTLSv1_method)(void) = NULL; | |||
| +const SSL_METHOD* (*DTLSv1_server_method)(void) = NULL; | |||
| +const SSL_METHOD* (*DTLSv1_client_method)(void) = NULL; | |||
| +#else | |||
| +static const long Cryptography_HAS_DTLS1_METHOD = 1; | |||
| +#endif | |||
| + | |||
| static const long Cryptography_HAS_SSL_OP_MSIE_SSLV2_RSA_PADDING = 1; | |||
| static const long Cryptography_HAS_SSL_OP_NO_TICKET = 1; | |||
| static const long Cryptography_HAS_SSL_SET_SSL_CTX = 1; | |||
| diff --git a/src/cryptography/hazmat/bindings/openssl/_conditional.py b/src/cryptography/hazmat/bindings/openssl/_conditional.py | |||
| index 23dc38a4..c0dca00a 100644 | |||
| --- a/src/cryptography/hazmat/bindings/openssl/_conditional.py | |||
| +++ b/src/cryptography/hazmat/bindings/openssl/_conditional.py | |||
| @@ -33,6 +33,38 @@ def cryptography_has_ssl3_method(): | |||
| ] | |||
| +def cryptography_has_tls1_method(): | |||
| + return [ | |||
| + "TLSv1_method", | |||
| + "TLSv1_client_method", | |||
| + "TLSv1_server_method", | |||
| + ] | |||
| + | |||
| + | |||
| +def cryptography_has_tls1_1_method(): | |||
| + return [ | |||
| + "TLSv1_1_method", | |||
| + "TLSv1_1_client_method", | |||
| + "TLSv1_1_server_method", | |||
| + ] | |||
| + | |||
| + | |||
| +def cryptography_has_tls1_2_method(): | |||
| + return [ | |||
| + "TLSv1_2_method", | |||
| + "TLSv1_2_client_method", | |||
| + "TLSv1_2_server_method", | |||
| + ] | |||
| + | |||
| + | |||
| +def cryptography_has_dtls1_method(): | |||
| + return [ | |||
| + "DTLSv1_method", | |||
| + "DTLSv1_client_method", | |||
| + "DTLSv1_server_method", | |||
| + ] | |||
| + | |||
| + | |||
| def cryptography_has_102_verification(): | |||
| return [ | |||
| "X509_V_ERR_SUITE_B_INVALID_VERSION", | |||
| @@ -303,6 +335,10 @@ CONDITIONAL_NAMES = { | |||
| "Cryptography_HAS_RSA_OAEP_MD": cryptography_has_rsa_oaep_md, | |||
| "Cryptography_HAS_RSA_OAEP_LABEL": cryptography_has_rsa_oaep_label, | |||
| "Cryptography_HAS_SSL3_METHOD": cryptography_has_ssl3_method, | |||
| + "Cryptography_HAS_TLS1_METHOD": cryptography_has_tls1_method, | |||
| + "Cryptography_HAS_TLS1_1_METHOD": cryptography_has_tls1_1_method, | |||
| + "Cryptography_HAS_TLS1_2_METHOD": cryptography_has_tls1_2_method, | |||
| + "Cryptography_HAS_DTLS1_METHOD": cryptography_has_dtls1_method, | |||
| "Cryptography_HAS_102_VERIFICATION": cryptography_has_102_verification, | |||
| "Cryptography_HAS_110_VERIFICATION_PARAMS": ( | |||
| cryptography_has_110_verification_params | |||
| -- | |||
| 2.26.2 | |||
+ 53
- 0
lang/python/python-cryptography/patches/040-Replace-EVP_CIPHER_CTX_cleanup-with-EVP_CIPHER_CTX_r.patch
View File
| @ -0,0 +1,53 @@ | |||
| From 50c1e937342c8b13c8a80c3bb55ce245aecdcdfe Mon Sep 17 00:00:00 2001 | |||
| From: Rosen Penev <rosenp@gmail.com> | |||
| Date: Sat, 15 Jun 2019 17:49:25 -0700 | |||
| Subject: [PATCH] Replace EVP_CIPHER_CTX_cleanup with EVP_CIPHER_CTX_reset | |||
| Deprecated in OpenSSL 1.1 | |||
| --- | |||
| src/_cffi_src/openssl/evp.py | 10 ++++++++++ | |||
| src/cryptography/hazmat/backends/openssl/ciphers.py | 2 +- | |||
| 2 files changed, 11 insertions(+), 1 deletion(-) | |||
| diff --git a/src/_cffi_src/openssl/evp.py b/src/_cffi_src/openssl/evp.py | |||
| index d7ac93e6..0b3e067d 100644 | |||
| --- a/src/_cffi_src/openssl/evp.py | |||
| +++ b/src/_cffi_src/openssl/evp.py | |||
| @@ -48,6 +48,7 @@ int EVP_CipherUpdate(EVP_CIPHER_CTX *, unsigned char *, int *, | |||
| const unsigned char *, int); | |||
| int EVP_CipherFinal_ex(EVP_CIPHER_CTX *, unsigned char *, int *); | |||
| int EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *); | |||
| +int EVP_CIPHER_CTX_reset(EVP_CIPHER_CTX *); | |||
| EVP_CIPHER_CTX *EVP_CIPHER_CTX_new(void); | |||
| void EVP_CIPHER_CTX_free(EVP_CIPHER_CTX *); | |||
| int EVP_CIPHER_CTX_set_key_length(EVP_CIPHER_CTX *, int); | |||
| @@ -273,4 +274,13 @@ static const long Cryptography_HAS_EVP_DIGESTFINAL_XOF = 1; | |||
| #ifndef EVP_PKEY_POLY1305 | |||
| #define EVP_PKEY_POLY1305 NID_poly1305 | |||
| #endif | |||
| + | |||
| +#if CRYPTOGRAPHY_OPENSSL_LESS_THAN_110 && !CRYPTOGRAPHY_LIBRESSL_27_OR_GREATER | |||
| +#define EVP_CIPHER_CTX_reset EVP_CIPHER_CTX_cleanup | |||
| +#endif | |||
| + | |||
| +#if (OPENSSL_API_COMPAT >= 0x10100000L) && !CRYPTOGRAPHY_IS_LIBRESSL | |||
| +#define EVP_CIPHER_CTX_cleanup EVP_CIPHER_CTX_reset | |||
| +#define OpenSSL_add_all_algorithms() do {} while(0) | |||
| +#endif | |||
| """ | |||
| diff --git a/src/cryptography/hazmat/backends/openssl/ciphers.py b/src/cryptography/hazmat/backends/openssl/ciphers.py | |||
| index 171605a6..4c0504ca 100644 | |||
| --- a/src/cryptography/hazmat/backends/openssl/ciphers.py | |||
| +++ b/src/cryptography/hazmat/backends/openssl/ciphers.py | |||
| @@ -199,7 +199,7 @@ class _CipherContext(object): | |||
| self._backend.openssl_assert(res != 0) | |||
| self._tag = self._backend._ffi.buffer(tag_buf)[:] | |||
| - res = self._backend._lib.EVP_CIPHER_CTX_cleanup(self._ctx) | |||
| + res = self._backend._lib.EVP_CIPHER_CTX_reset(self._ctx) | |||
| self._backend.openssl_assert(res == 1) | |||
| return self._backend._ffi.buffer(buf)[: outlen[0]] | |||
| -- | |||
| 2.26.2 | |||
+ 135
- 0
lang/python/python-cryptography/patches/050-Switch-get_-Update-APIs-to-get0.patch
View File
| @ -0,0 +1,135 @@ | |||
| From 645c30f76bce250772ce4e0b878e7228bd104277 Mon Sep 17 00:00:00 2001 | |||
| From: Rosen Penev <rosenp@gmail.com> | |||
| Date: Sat, 15 Jun 2019 18:47:46 -0700 | |||
| Subject: [PATCH] Switch get_*Update APIs to get0 | |||
| Deprecated in 1.1 | |||
| --- | |||
| src/_cffi_src/openssl/x509.py | 34 ++++++++++++++++--- | |||
| .../hazmat/backends/openssl/backend.py | 4 +-- | |||
| .../hazmat/backends/openssl/x509.py | 8 ++--- | |||
| 3 files changed, 36 insertions(+), 10 deletions(-) | |||
| diff --git a/src/_cffi_src/openssl/x509.py b/src/_cffi_src/openssl/x509.py | |||
| index b88daa1f..54cd66c9 100644 | |||
| --- a/src/_cffi_src/openssl/x509.py | |||
| +++ b/src/_cffi_src/openssl/x509.py | |||
| @@ -202,8 +202,10 @@ long X509_get_version(X509 *); | |||
| ASN1_TIME *X509_get_notBefore(X509 *); | |||
| ASN1_TIME *X509_get_notAfter(X509 *); | |||
| -ASN1_TIME *X509_getm_notBefore(X509 *); | |||
| -ASN1_TIME *X509_getm_notAfter(X509 *); | |||
| +ASN1_TIME *X509_getm_notBefore(const X509 *); | |||
| +ASN1_TIME *X509_getm_notAfter(const X509 *); | |||
| +const ASN1_TIME *X509_get0_notBefore(const X509 *); | |||
| +const ASN1_TIME *X509_get0_notAfter(const X509 *); | |||
| long X509_REQ_get_version(X509_REQ *); | |||
| X509_NAME *X509_REQ_get_subject_name(X509_REQ *); | |||
| @@ -235,6 +237,8 @@ X509_CRL *sk_X509_CRL_value(Cryptography_STACK_OF_X509_CRL *, int); | |||
| long X509_CRL_get_version(X509_CRL *); | |||
| ASN1_TIME *X509_CRL_get_lastUpdate(X509_CRL *); | |||
| ASN1_TIME *X509_CRL_get_nextUpdate(X509_CRL *); | |||
| +const ASN1_TIME *X509_CRL_get0_lastUpdate(const X509_CRL *); | |||
| +const ASN1_TIME *X509_CRL_get0_nextUpdate(const X509_CRL *); | |||
| X509_NAME *X509_CRL_get_issuer(X509_CRL *); | |||
| Cryptography_STACK_OF_X509_REVOKED *X509_CRL_get_REVOKED(X509_CRL *); | |||
| @@ -243,8 +247,11 @@ int X509_CRL_set_lastUpdate(X509_CRL *, ASN1_TIME *); | |||
| int X509_CRL_set_nextUpdate(X509_CRL *, ASN1_TIME *); | |||
| int X509_set_notBefore(X509 *, ASN1_TIME *); | |||
| int X509_set_notAfter(X509 *, ASN1_TIME *); | |||
| -int X509_set1_notBefore(X509 *, ASN1_TIME *); | |||
| -int X509_set1_notAfter(X509 *, ASN1_TIME *); | |||
| + | |||
| +int X509_CRL_set1_lastUpdate(X509_CRL *, const ASN1_TIME *); | |||
| +int X509_CRL_set1_nextUpdate(X509_CRL *, const ASN1_TIME *); | |||
| +int X509_set1_notBefore(X509 *, const ASN1_TIME *); | |||
| +int X509_set1_notAfter(X509 *, const ASN1_TIME *); | |||
| EC_KEY *d2i_EC_PUBKEY_bio(BIO *, EC_KEY **); | |||
| int i2d_EC_PUBKEY_bio(BIO *, EC_KEY *); | |||
| @@ -339,6 +346,25 @@ const ASN1_INTEGER *X509_REVOKED_get0_serialNumber(const X509_REVOKED *x) | |||
| #define X509_set1_notAfter X509_set_notAfter | |||
| #define X509_getm_notAfter X509_get_notAfter | |||
| #define X509_getm_notBefore X509_get_notBefore | |||
| +#define X509_get0_notAfter X509_get_notAfter | |||
| +#define X509_get0_notBefore X509_get_notBefore | |||
| + | |||
| +#define X509_CRL_set1_lastUpdate X509_CRL_set_lastUpdate | |||
| +#define X509_CRL_set1_nextUpdate X509_CRL_set_nextUpdate | |||
| +#define X509_CRL_get0_lastUpdate X509_CRL_get_lastUpdate | |||
| +#define X509_CRL_get0_nextUpdate X509_CRL_get_nextUpdate | |||
| +#endif | |||
| #endif | |||
| + | |||
| +#if (OPENSSL_API_COMPAT >= 0x10100000L) && !CRYPTOGRAPHY_IS_LIBRESSL | |||
| +#define X509_set_notBefore X509_set1_notBefore | |||
| +#define X509_set_notAfter X509_set1_notAfter | |||
| +#define X509_get_notAfter X509_get0_notAfter | |||
| +#define X509_get_notBefore X509_get0_notBefore | |||
| + | |||
| +#define X509_CRL_get_lastUpdate X509_CRL_get0_lastUpdate | |||
| +#define X509_CRL_get_nextUpdate X509_CRL_get0_nextUpdate | |||
| +#define X509_CRL_set_lastUpdate X509_CRL_set1_lastUpdate | |||
| +#define X509_CRL_set_nextUpdate X509_CRL_set1_nextUpdate | |||
| #endif | |||
| """ | |||
| diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py | |||
| index 97c7fd05..891d6309 100644 | |||
| --- a/src/cryptography/hazmat/backends/openssl/backend.py | |||
| +++ b/src/cryptography/hazmat/backends/openssl/backend.py | |||
| @@ -1129,12 +1129,12 @@ class Backend(object): | |||
| # Set the last update time. | |||
| last_update = self._create_asn1_time(builder._last_update) | |||
| - res = self._lib.X509_CRL_set_lastUpdate(x509_crl, last_update) | |||
| + res = self._lib.X509_CRL_set1_lastUpdate(x509_crl, last_update) | |||
| self.openssl_assert(res == 1) | |||
| # Set the next update time. | |||
| next_update = self._create_asn1_time(builder._next_update) | |||
| - res = self._lib.X509_CRL_set_nextUpdate(x509_crl, next_update) | |||
| + res = self._lib.X509_CRL_set1_nextUpdate(x509_crl, next_update) | |||
| self.openssl_assert(res == 1) | |||
| # Add extensions. | |||
| diff --git a/src/cryptography/hazmat/backends/openssl/x509.py b/src/cryptography/hazmat/backends/openssl/x509.py | |||
| index 4d0dac76..074211e6 100644 | |||
| --- a/src/cryptography/hazmat/backends/openssl/x509.py | |||
| +++ b/src/cryptography/hazmat/backends/openssl/x509.py | |||
| @@ -86,12 +86,12 @@ class _Certificate(object): | |||
| @property | |||
| def not_valid_before(self): | |||
| - asn1_time = self._backend._lib.X509_getm_notBefore(self._x509) | |||
| + asn1_time = self._backend._lib.X509_get0_notBefore(self._x509) | |||
| return _parse_asn1_time(self._backend, asn1_time) | |||
| @property | |||
| def not_valid_after(self): | |||
| - asn1_time = self._backend._lib.X509_getm_notAfter(self._x509) | |||
| + asn1_time = self._backend._lib.X509_get0_notAfter(self._x509) | |||
| return _parse_asn1_time(self._backend, asn1_time) | |||
| @property | |||
| @@ -277,13 +277,13 @@ class _CertificateRevocationList(object): | |||
| @property | |||
| def next_update(self): | |||
| - nu = self._backend._lib.X509_CRL_get_nextUpdate(self._x509_crl) | |||
| + nu = self._backend._lib.X509_CRL_get0_nextUpdate(self._x509_crl) | |||
| self._backend.openssl_assert(nu != self._backend._ffi.NULL) | |||
| return _parse_asn1_time(self._backend, nu) | |||
| @property | |||
| def last_update(self): | |||
| - lu = self._backend._lib.X509_CRL_get_lastUpdate(self._x509_crl) | |||
| + lu = self._backend._lib.X509_CRL_get0_lastUpdate(self._x509_crl) | |||
| self._backend.openssl_assert(lu != self._backend._ffi.NULL) | |||
| return _parse_asn1_time(self._backend, lu) | |||
| -- | |||
| 2.26.2 | |||
+ 49
- 0
lang/python/python-cryptography/patches/060-Add-X509_STORE_CTX_trusted_stack-compatibility-macro.patch
View File
| @ -0,0 +1,49 @@ | |||
| From 07fb50eecc3a3a50ac543f53f98c285eb1ceeb1e Mon Sep 17 00:00:00 2001 | |||
| From: Rosen Penev <rosenp@gmail.com> | |||
| Date: Mon, 25 Nov 2019 12:06:16 -0800 | |||
| Subject: [PATCH] Add X509_STORE_CTX_trusted_stack compatibility macro | |||
| Deprecated in 1.1 | |||
| Signed-off-by: Rosen Penev <rosenp@gmail.com> | |||
| --- | |||
| src/_cffi_src/openssl/x509_vfy.py | 17 ++++++++++++++++- | |||
| 1 file changed, 16 insertions(+), 1 deletion(-) | |||
| diff --git a/src/_cffi_src/openssl/x509_vfy.py b/src/_cffi_src/openssl/x509_vfy.py | |||
| index a1730738..cd143ea0 100644 | |||
| --- a/src/_cffi_src/openssl/x509_vfy.py | |||
| +++ b/src/_cffi_src/openssl/x509_vfy.py | |||
| @@ -157,8 +157,12 @@ int X509_STORE_CTX_init(X509_STORE_CTX *, X509_STORE *, X509 *, | |||
| Cryptography_STACK_OF_X509 *); | |||
| void X509_STORE_CTX_trusted_stack(X509_STORE_CTX *, | |||
| Cryptography_STACK_OF_X509 *); | |||
| +void X509_STORE_CTX_set0_trusted_stack(X509_STORE_CTX *, | |||
| + Cryptography_STACK_OF_X509 *); | |||
| void X509_STORE_CTX_set_cert(X509_STORE_CTX *, X509 *); | |||
| -void X509_STORE_CTX_set_chain(X509_STORE_CTX *,Cryptography_STACK_OF_X509 *); | |||
| +void X509_STORE_CTX_set_chain(X509_STORE_CTX *, Cryptography_STACK_OF_X509 *); | |||
| +void X509_STORE_CTX_set0_untrusted(X509_STORE_CTX *, | |||
| + Cryptography_STACK_OF_X509 *); | |||
| X509_VERIFY_PARAM *X509_STORE_CTX_get0_param(X509_STORE_CTX *); | |||
| void X509_STORE_CTX_set0_param(X509_STORE_CTX *, X509_VERIFY_PARAM *); | |||
| int X509_STORE_CTX_set_default(X509_STORE_CTX *, const char *); | |||
| @@ -282,4 +286,15 @@ static const long Cryptography_HAS_X509_CB_ISSUER_CHECK = 0; | |||
| #else | |||
| static const long Cryptography_HAS_X509_CB_ISSUER_CHECK = 1; | |||
| #endif | |||
| + | |||
| +#if CRYPTOGRAPHY_OPENSSL_LESS_THAN_110 && !CRYPTOGRAPHY_IS_LIBRESSL | |||
| +#define X509_STORE_CTX_set0_trusted_stack X509_STORE_CTX_trusted_stack | |||
| +#define X509_STORE_CTX_set0_untrusted X509_STORE_CTX_set_chain | |||
| +#endif | |||
| + | |||
| +#if (OPENSSL_API_COMPAT >= 0x10100000L) && !CRYPTOGRAPHY_IS_LIBRESSL | |||
| +#define X509_STORE_CTX_trusted_stack X509_STORE_CTX_set0_trusted_stack | |||
| +#define X509_STORE_CTX_set_chain X509_STORE_CTX_set0_untrusted | |||
| +#define X509_STORE_CTX_get_chain X509_STORE_CTX_get1_chain | |||
| +#endif | |||
| """ | |||
| -- | |||
| 2.26.2 | |||
+ 54
- 0
lang/python/python-cryptography/patches/070-Add-defines-for-totally-deprecated-functions.patch
View File
| @ -0,0 +1,54 @@ | |||
| From 93317e7835acf40a9b8b0f7af417240b57ab690a Mon Sep 17 00:00:00 2001 | |||
| From: Rosen Penev <rosenp@gmail.com> | |||
| Date: Thu, 5 Dec 2019 12:52:13 -0800 | |||
| Subject: [PATCH] Add defines for totally deprecated functions | |||
| --- | |||
| src/_cffi_src/openssl/conf.py | 4 ++++ | |||
| src/_cffi_src/openssl/crypto.py | 4 ++++ | |||
| src/_cffi_src/openssl/ssl.py | 5 +++++ | |||
| 3 files changed, 13 insertions(+) | |||
| diff --git a/src/_cffi_src/openssl/conf.py b/src/_cffi_src/openssl/conf.py | |||
| index 9db0162a..6b474d42 100644 | |||
| --- a/src/_cffi_src/openssl/conf.py | |||
| +++ b/src/_cffi_src/openssl/conf.py | |||
| @@ -18,4 +18,8 @@ void OPENSSL_no_config(void); | |||
| """ | |||
| CUSTOMIZATIONS = """ | |||
| +#if (OPENSSL_API_COMPAT >= 0x10100000L) && !CRYPTOGRAPHY_IS_LIBRESSL | |||
| +#define OPENSSL_config(x) 0 | |||
| +#define OPENSSL_no_config() 0 | |||
| +#endif | |||
| """ | |||
| diff --git a/src/_cffi_src/openssl/crypto.py b/src/_cffi_src/openssl/crypto.py | |||
| index f3623b21..85541b31 100644 | |||
| --- a/src/_cffi_src/openssl/crypto.py | |||
| +++ b/src/_cffi_src/openssl/crypto.py | |||
| @@ -124,4 +124,8 @@ void *Cryptography_realloc_wrapper(void *ptr, size_t size, const char *path, | |||
| void Cryptography_free_wrapper(void *ptr, const char *path, int line) { | |||
| free(ptr); | |||
| } | |||
| + | |||
| +#if (OPENSSL_API_COMPAT >= 0x10100000L) && !CRYPTOGRAPHY_IS_LIBRESSL | |||
| +#define CRYPTO_get_locking_callback() 0 | |||
| +#endif | |||
| """ | |||
| diff --git a/src/_cffi_src/openssl/ssl.py b/src/_cffi_src/openssl/ssl.py | |||
| index e726417d..68c42160 100644 | |||
| --- a/src/_cffi_src/openssl/ssl.py | |||
| +++ b/src/_cffi_src/openssl/ssl.py | |||
| @@ -792,4 +792,9 @@ int (*SSL_CTX_set_max_early_data)(SSL_CTX *, uint32_t) = NULL; | |||
| #else | |||
| static const long Cryptography_HAS_TLSv1_3 = 1; | |||
| #endif | |||
| + | |||
| +#if (OPENSSL_API_COMPAT >= 0x10100000L) && !CRYPTOGRAPHY_IS_LIBRESSL | |||
| +#define SSL_library_init() 1 | |||
| +#define SSL_load_error_strings() 0 | |||
| +#endif | |||
| """ | |||
| -- | |||
| 2.26.2 | |||