Extra rules:
All E pycodestyle error rules
C4 flake8-comprehensions
DTZ flake8-datetimez
EXE flake8-executable
FA flake8-future-annotations
INT flake8-gettext
ISC flake8-implicit-str-concat
ICN flake8-import-conventions
LOG flake8-logging
G flake8-logging-format
RSE flake8-raise
SLOT flake8-slots
TID flake8-tidy-imports
TC flake8-type-checking
FLY flynt
PERF Perflint
W pycodestyle warnings
FURB refurb
Ignore E501: line too long
printf-style string formatting has a number of quirks, and leads to less
readable code than using str.format calls or f-strings.
In general, prefer the newer str.format and f-strings constructs over
printf-style string formatting.
F-3340: AesGcmStream.final decrypt path passed len(authTag) straight to
wc_AesGcmDecryptFinal, letting a caller truncate the verification window
(forgery probability ~2^-32 instead of 2^-128 for a 4-byte tag against a
16-byte configuration). Reject len(authTag) != self._tag_bytes and pass
self._tag_bytes to wolfSSL, mirroring ChaCha20Poly1305.decrypt. Added
test_decrypt_rejects_wrong_tag_length. Also fixed test_encrypt_short_tag
which was relying on the bug (decrypt side defaulted to tag_bytes=16
against a 12-byte tag).
F-3089: Declare label as const byte* in the wc_RsaPublicEncrypt_ex and
wc_RsaPrivateDecrypt_ex cdefs so CFFI can accept Python bytes without
exposing a writable pointer into immutable memory. wolfSSL does not
modify label.
F-3090: Declare nonce as const byte* in the wc_InitRngNonce and
wc_InitRngNonce_ex cdefs for the same reason.
F-1983, F-1984: Add minimum + upper bounds to requirements/{prod,test,
docs}.txt so a hijacked release of cffi, tox, pytest, types-cffi,
Sphinx, or sphinx_rtd_theme does not get pulled silently on the next
pip install. setup.txt resolves transitively via prod.txt.
- Move _build_ffi.py to scripts/build_ffi.py. Do as little in the global
namespace of the script as possible by putting functionality into functions,
including a new main function.
- Improve feature detection by allowing user_settings.h in addition to
options.h. This is particularly useful on Windows.
- Add the windows directory. This contains subdirectories non_fips and
fips_ready, which each have a user_settings.h. The non_fips user_settings.h is
used by the build script to build on Windows with CMake, when not using
USE_LOCAL_WOLFSSL. The fips_ready user_settings.h is an example user_settings.h
that works with our FIPS Ready code and wolfcrypt-py.
- Improve Windows support. This commit modifies the way we build wolfSSL for
wolfcrypt-py on Windows. Instead of using CMake directly, we use it with
user_settings.h. This is typically how Windows users are building wolfSSL, and
it gets around some shortcoming of wolfSSL's CMake support (e.g. not all
required features are supported). Additionally, USE_LOCAL_WOLFSSL now works
properly on Windows. When using USE_LOCAL_WOLFSSL, it should point to a wolfSSL
source code directory. This works for FIPS bundles, too. Finally, for FIPS on
Windows, we only support DLL builds. The CFFI library (.pyd extension) requires
this DLL to work. build_ffi.py detects this scenario and copies the .dll into
the wolfcrypt package directory. I've modified setup.py to distribute the
.dll with the package.
- Add some missing FIPS gates. Testing against FIPS v2 triggered some errors.
Those are fixed in this commit.
Windows had an issue where it was trying to build the CFFI module after
it had already imported the CFFI module. Which caused permissions
errors during builds.
This fix does several things to make the Windows build work properly and
improve the Linux build too:
* The CFFI module is only build when needed, not as part of an sdist
package
* Version numbering spilt out into separate file so __init__.py import
is not required
* Merged _build_ffi.py and _build_wolfssl.py into one file
* Made CFFI only build when called as an executable (which happens
during binary build time)
* Make tox use bdist-wheel instead of sdist
* Fix some path and compiler things for Windows
* Move source code to align better with Python standards
* Have setup.py build wolfSSL and FFI
* Update Python versions in tox
* Add CMake building for Windows build
* Add missing __init__.py for tox
* Make wolfSSL a git submodule
sebastian-carpenter
Robert de Vries
David Garske
Andrew Hutchings
Marco Oliverio
Hayden Roche
Daniele Lacamera
Chris Conlon
Moisés Guimarães de Medeiros
Moisés Guimarães