- Move _build_ffi.py to scripts/build_ffi.py. Do as little in the global
namespace of the script as possible by putting functionality into functions,
including a new main function.
- Improve feature detection by allowing user_settings.h in addition to
options.h. This is particularly useful on Windows.
- Add the windows directory. This contains subdirectories non_fips and
fips_ready, which each have a user_settings.h. The non_fips user_settings.h is
used by the build script to build on Windows with CMake, when not using
USE_LOCAL_WOLFSSL. The fips_ready user_settings.h is an example user_settings.h
that works with our FIPS Ready code and wolfcrypt-py.
- Improve Windows support. This commit modifies the way we build wolfSSL for
wolfcrypt-py on Windows. Instead of using CMake directly, we use it with
user_settings.h. This is typically how Windows users are building wolfSSL, and
it gets around some shortcoming of wolfSSL's CMake support (e.g. not all
required features are supported). Additionally, USE_LOCAL_WOLFSSL now works
properly on Windows. When using USE_LOCAL_WOLFSSL, it should point to a wolfSSL
source code directory. This works for FIPS bundles, too. Finally, for FIPS on
Windows, we only support DLL builds. The CFFI library (.pyd extension) requires
this DLL to work. build_ffi.py detects this scenario and copies the .dll into
the wolfcrypt package directory. I've modified setup.py to distribute the
.dll with the package.
- Add some missing FIPS gates. Testing against FIPS v2 triggered some errors.
Those are fixed in this commit.
- sign_pss and verify_pss need to digest the data before calling into their
respective wolfCrypt functions. Those wolfCrypt functions expect digests, not
plaintext.
- RsaPrivate make_key should take an optional hash_type parameter for the case
where the key will be used to create PSS signatures.
- test_rsa_pss_sign_verify appears to have been deliberately coded to have the
input plaintext length line up with the digest size, which masked the problem
where we weren't digesting the plaintext. I modified the plaintext so that this
is no longer the case.
wolfSSL's source tree had a stale version of the Python wolfCrypt
wrapper. There were a couple of bits in it that weren't here, so this
ports them accross.
Mostly notably a minor issue where `Random.__del__` can throw a race
condition exception during shutdown.
Makes things a little bit more like similar APIs.
* Hash type is now set in constructor.
* MGF is set automtically or manually with `set_mgf()`
* Label defaults to empty
Some bad assumptions were made during the creation of our Python AES GCM
code. This is now modified to be more in-line with other libraries. This
is an API breaking change on unreleased code.
This now allows for aad data to be used, varying length of
authentication tags and fixes a bug for multipart.
1. Now unified to a single class AesGcmStream()
2. Used `encrypt()` and `decrypt()` instead of `update()` to avoid
confusion over encryption and aad semantics
3. final tag_bytes is configurable in the constructor
4. `set_aad()` added to add the aad data
5. aad data is cleared after first `encrypt()` or `decrypt()` call due
to quirk in the C API.
6. More tests added
Windows had an issue where it was trying to build the CFFI module after
it had already imported the CFFI module. Which caused permissions
errors during builds.
This fix does several things to make the Windows build work properly and
improve the Linux build too:
* The CFFI module is only build when needed, not as part of an sdist
package
* Version numbering spilt out into separate file so __init__.py import
is not required
* Merged _build_ffi.py and _build_wolfssl.py into one file
* Made CFFI only build when called as an executable (which happens
during binary build time)
* Make tox use bdist-wheel instead of sdist
* Fix some path and compiler things for Windows
* Move source code to align better with Python standards
* Have setup.py build wolfSSL and FFI
* Update Python versions in tox
* Add CMake building for Windows build
* Add missing __init__.py for tox
* Make wolfSSL a git submodule
Reda Chouk
Lealem Amedie
Eric Blankenhorn
Daniele Lacamera
Marco Oliverio
Hayden Roche
Hayden Roche
Andrew Hutchings
Moisés Guimarães