1Changelog 2========= 3 4Versions are year-based with a strict backward-compatibility policy. 5The third digit is only for regressions. 6 720.0.1 (2020-12-15) 8------------------- 9 10Backward-incompatible changes: 11^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 12 13Deprecations: 14^^^^^^^^^^^^^ 15 16Changes: 17^^^^^^^^ 18 19- Fixed compatibility with OpenSSL 1.1.0. 20 2120.0.0 (2020-11-27) 22------------------- 23 24 25Backward-incompatible changes: 26^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 27 28- The minimum ``cryptography`` version is now 3.2. 29- Remove deprecated ``OpenSSL.tsafe`` module. 30- Removed deprecated ``OpenSSL.SSL.Context.set_npn_advertise_callback``, ``OpenSSL.SSL.Context.set_npn_select_callback``, and ``OpenSSL.SSL.Connection.get_next_proto_negotiated``. 31- Drop support for Python 3.4 32- Drop support for OpenSSL 1.0.1 and 1.0.2 33 34Deprecations: 35^^^^^^^^^^^^^ 36 37- Deprecated ``OpenSSL.crypto.loads_pkcs7`` and ``OpenSSL.crypto.loads_pkcs12``. 38 39Changes: 40^^^^^^^^ 41 42- Added a new optional ``chain`` parameter to ``OpenSSL.crypto.X509StoreContext()`` 43 where additional untrusted certificates can be specified to help chain building. 44 `#948 <https://github.com/pyca/pyopenssl/pull/948>`_ 45- Added ``OpenSSL.crypto.X509Store.load_locations`` to set trusted 46 certificate file bundles and/or directories for verification. 47 `#943 <https://github.com/pyca/pyopenssl/pull/943>`_ 48- Added ``Context.set_keylog_callback`` to log key material. 49 `#910 <https://github.com/pyca/pyopenssl/pull/910>`_ 50- Added ``OpenSSL.SSL.Connection.get_verified_chain`` to retrieve the 51 verified certificate chain of the peer. 52 `#894 <https://github.com/pyca/pyopenssl/pull/894>`_. 53- Make verification callback optional in ``Context.set_verify``. 54 If omitted, OpenSSL's default verification is used. 55 `#933 <https://github.com/pyca/pyopenssl/pull/933>`_ 56- Fixed a bug that could truncate or cause a zero-length key error due to a 57 null byte in private key passphrase in ``OpenSSL.crypto.load_privatekey`` 58 and ``OpenSSL.crypto.dump_privatekey``. 59 `#947 <https://github.com/pyca/pyopenssl/pull/947>`_ 60 6119.1.0 (2019-11-18) 62------------------- 63 64 65Backward-incompatible changes: 66^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 67 68- Removed deprecated ``ContextType``, ``ConnectionType``, ``PKeyType``, ``X509NameType``, ``X509ReqType``, ``X509Type``, ``X509StoreType``, ``CRLType``, ``PKCS7Type``, ``PKCS12Type``, and ``NetscapeSPKIType`` aliases. 69 Use the classes without the ``Type`` suffix instead. 70 `#814 <https://github.com/pyca/pyopenssl/pull/814>`_ 71- The minimum ``cryptography`` version is now 2.8 due to issues on macOS with a transitive dependency. 72 `#875 <https://github.com/pyca/pyopenssl/pull/875>`_ 73 74Deprecations: 75^^^^^^^^^^^^^ 76 77- Deprecated ``OpenSSL.SSL.Context.set_npn_advertise_callback``, ``OpenSSL.SSL.Context.set_npn_select_callback``, and ``OpenSSL.SSL.Connection.get_next_proto_negotiated``. 78 ALPN should be used instead. 79 `#820 <https://github.com/pyca/pyopenssl/pull/820>`_ 80 81 82Changes: 83^^^^^^^^ 84 85- Support ``bytearray`` in ``SSL.Connection.send()`` by using cffi's from_buffer. 86 `#852 <https://github.com/pyca/pyopenssl/pull/852>`_ 87- The ``OpenSSL.SSL.Context.set_alpn_select_callback`` can return a new ``NO_OVERLAPPING_PROTOCOLS`` sentinel value 88 to allow a TLS handshake to complete without an application protocol. 89 90 91---- 92 9319.0.0 (2019-01-21) 94------------------- 95 96 97Backward-incompatible changes: 98^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 99 100- ``X509Store.add_cert`` no longer raises an error if you add a duplicate cert. 101 `#787 <https://github.com/pyca/pyopenssl/pull/787>`_ 102 103 104Deprecations: 105^^^^^^^^^^^^^ 106 107*none* 108 109 110Changes: 111^^^^^^^^ 112 113- pyOpenSSL now works with OpenSSL 1.1.1. 114 `#805 <https://github.com/pyca/pyopenssl/pull/805>`_ 115- pyOpenSSL now handles NUL bytes in ``X509Name.get_components()`` 116 `#804 <https://github.com/pyca/pyopenssl/pull/804>`_ 117 118 119 120---- 121 12218.0.0 (2018-05-16) 123------------------- 124 125 126Backward-incompatible changes: 127^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 128 129- The minimum ``cryptography`` version is now 2.2.1. 130- Support for Python 2.6 has been dropped. 131 132 133Deprecations: 134^^^^^^^^^^^^^ 135 136*none* 137 138 139Changes: 140^^^^^^^^ 141 142- Added ``Connection.get_certificate`` to retrieve the local certificate. 143 `#733 <https://github.com/pyca/pyopenssl/pull/733>`_ 144- ``OpenSSL.SSL.Connection`` now sets ``SSL_MODE_AUTO_RETRY`` by default. 145 `#753 <https://github.com/pyca/pyopenssl/pull/753>`_ 146- Added ``Context.set_tlsext_use_srtp`` to enable negotiation of SRTP keying material. 147 `#734 <https://github.com/pyca/pyopenssl/pull/734>`_ 148 149 150---- 151 15217.5.0 (2017-11-30) 153------------------- 154 155 156Backward-incompatible changes: 157^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 158 159- The minimum ``cryptography`` version is now 2.1.4. 160 161 162Deprecations: 163^^^^^^^^^^^^^ 164 165*none* 166 167 168Changes: 169^^^^^^^^ 170 171- Fixed a potential use-after-free in the verify callback and resolved a memory leak when loading PKCS12 files with ``cacerts``. 172 `#723 <https://github.com/pyca/pyopenssl/pull/723>`_ 173- Added ``Connection.export_keying_material`` for RFC 5705 compatible export of keying material. 174 `#725 <https://github.com/pyca/pyopenssl/pull/725>`_ 175 176---- 177 178 179 18017.4.0 (2017-11-21) 181------------------- 182 183 184Backward-incompatible changes: 185^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 186 187*none* 188 189 190Deprecations: 191^^^^^^^^^^^^^ 192 193*none* 194 195 196Changes: 197^^^^^^^^ 198 199 200- Re-added a subset of the ``OpenSSL.rand`` module. 201 This subset allows conscientious users to reseed the OpenSSL CSPRNG after fork. 202 `#708 <https://github.com/pyca/pyopenssl/pull/708>`_ 203- Corrected a use-after-free when reusing an issuer or subject from an ``X509`` object after the underlying object has been mutated. 204 `#709 <https://github.com/pyca/pyopenssl/pull/709>`_ 205 206---- 207 208 20917.3.0 (2017-09-14) 210------------------- 211 212 213Backward-incompatible changes: 214^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 215 216- Dropped support for Python 3.3. 217 `#677 <https://github.com/pyca/pyopenssl/pull/677>`_ 218- Removed the deprecated ``OpenSSL.rand`` module. 219 This is being done ahead of our normal deprecation schedule due to its lack of use and the fact that it was becoming a maintenance burden. 220 ``os.urandom()`` should be used instead. 221 `#675 <https://github.com/pyca/pyopenssl/pull/675>`_ 222 223 224Deprecations: 225^^^^^^^^^^^^^ 226 227- Deprecated ``OpenSSL.tsafe``. 228 `#673 <https://github.com/pyca/pyopenssl/pull/673>`_ 229 230Changes: 231^^^^^^^^ 232 233- Fixed a memory leak in ``OpenSSL.crypto.CRL``. 234 `#690 <https://github.com/pyca/pyopenssl/pull/690>`_ 235- Fixed a memory leak when verifying certificates with ``OpenSSL.crypto.X509StoreContext``. 236 `#691 <https://github.com/pyca/pyopenssl/pull/691>`_ 237 238 239---- 240 241 24217.2.0 (2017-07-20) 243------------------- 244 245 246Backward-incompatible changes: 247^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 248 249*none* 250 251 252Deprecations: 253^^^^^^^^^^^^^ 254 255- Deprecated ``OpenSSL.rand`` - callers should use ``os.urandom()`` instead. 256 `#658 <https://github.com/pyca/pyopenssl/pull/658>`_ 257 258 259Changes: 260^^^^^^^^ 261 262- Fixed a bug causing ``Context.set_default_verify_paths()`` to not work with cryptography ``manylinux1`` wheels on Python 3.x. 263 `#665 <https://github.com/pyca/pyopenssl/pull/665>`_ 264- Fixed a crash with (EC)DSA signatures in some cases. 265 `#670 <https://github.com/pyca/pyopenssl/pull/670>`_ 266 267 268---- 269 270 27117.1.0 (2017-06-30) 272------------------- 273 274 275Backward-incompatible changes: 276^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 277 278- Removed the deprecated ``OpenSSL.rand.egd()`` function. 279 Applications should prefer ``os.urandom()`` for random number generation. 280 `#630 <https://github.com/pyca/pyopenssl/pull/630>`_ 281- Removed the deprecated default ``digest`` argument to ``OpenSSL.crypto.CRL.export()``. 282 Callers must now always pass an explicit ``digest``. 283 `#652 <https://github.com/pyca/pyopenssl/pull/652>`_ 284- Fixed a bug with ``ASN1_TIME`` casting in ``X509.set_notBefore()``, 285 ``X509.set_notAfter()``, ``Revoked.set_rev_date()``, ``Revoked.set_nextUpdate()``, 286 and ``Revoked.set_lastUpdate()``. You must now pass times in the form 287 ``YYYYMMDDhhmmssZ``. ``YYYYMMDDhhmmss+hhmm`` and ``YYYYMMDDhhmmss-hhmm`` 288 will no longer work. `#612 <https://github.com/pyca/pyopenssl/pull/612>`_ 289 290 291Deprecations: 292^^^^^^^^^^^^^ 293 294 295- Deprecated the legacy "Type" aliases: ``ContextType``, ``ConnectionType``, ``PKeyType``, ``X509NameType``, ``X509ExtensionType``, ``X509ReqType``, ``X509Type``, ``X509StoreType``, ``CRLType``, ``PKCS7Type``, ``PKCS12Type``, ``NetscapeSPKIType``. 296 The names without the "Type"-suffix should be used instead. 297 298 299Changes: 300^^^^^^^^ 301 302- Added ``OpenSSL.crypto.X509.from_cryptography()`` and ``OpenSSL.crypto.X509.to_cryptography()`` for converting X.509 certificate to and from pyca/cryptography objects. 303 `#640 <https://github.com/pyca/pyopenssl/pull/640>`_ 304- Added ``OpenSSL.crypto.X509Req.from_cryptography()``, ``OpenSSL.crypto.X509Req.to_cryptography()``, ``OpenSSL.crypto.CRL.from_cryptography()``, and ``OpenSSL.crypto.CRL.to_cryptography()`` for converting X.509 CSRs and CRLs to and from pyca/cryptography objects. 305 `#645 <https://github.com/pyca/pyopenssl/pull/645>`_ 306- Added ``OpenSSL.debug`` that allows to get an overview of used library versions (including linked OpenSSL) and other useful runtime information using ``python -m OpenSSL.debug``. 307 `#620 <https://github.com/pyca/pyopenssl/pull/620>`_ 308- Added a fallback path to ``Context.set_default_verify_paths()`` to accommodate the upcoming release of ``cryptography`` ``manylinux1`` wheels. 309 `#633 <https://github.com/pyca/pyopenssl/pull/633>`_ 310 311 312---- 313 314 31517.0.0 (2017-04-20) 316------------------- 317 318Backward-incompatible changes: 319^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 320 321*none* 322 323 324Deprecations: 325^^^^^^^^^^^^^ 326 327*none* 328 329 330Changes: 331^^^^^^^^ 332 333- Added ``OpenSSL.X509Store.set_time()`` to set a custom verification time when verifying certificate chains. 334 `#567 <https://github.com/pyca/pyopenssl/pull/567>`_ 335- Added a collection of functions for working with OCSP stapling. 336 None of these functions make it possible to validate OCSP assertions, only to staple them into the handshake and to retrieve the stapled assertion if provided. 337 Users will need to write their own code to handle OCSP assertions. 338 We specifically added: ``Context.set_ocsp_server_callback()``, ``Context.set_ocsp_client_callback()``, and ``Connection.request_ocsp()``. 339 `#580 <https://github.com/pyca/pyopenssl/pull/580>`_ 340- Changed the ``SSL`` module's memory allocation policy to avoid zeroing memory it allocates when unnecessary. 341 This reduces CPU usage and memory allocation time by an amount proportional to the size of the allocation. 342 For applications that process a lot of TLS data or that use very lage allocations this can provide considerable performance improvements. 343 `#578 <https://github.com/pyca/pyopenssl/pull/578>`_ 344- Automatically set ``SSL_CTX_set_ecdh_auto()`` on ``OpenSSL.SSL.Context``. 345 `#575 <https://github.com/pyca/pyopenssl/pull/575>`_ 346- Fix empty exceptions from ``OpenSSL.crypto.load_privatekey()``. 347 `#581 <https://github.com/pyca/pyopenssl/pull/581>`_ 348 349 350---- 351 352 35316.2.0 (2016-10-15) 354------------------- 355 356Backward-incompatible changes: 357^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 358 359*none* 360 361 362Deprecations: 363^^^^^^^^^^^^^ 364 365*none* 366 367 368Changes: 369^^^^^^^^ 370 371- Fixed compatibility errors with OpenSSL 1.1.0. 372- Fixed an issue that caused failures with subinterpreters and embedded Pythons. 373 `#552 <https://github.com/pyca/pyopenssl/pull/552>`_ 374 375 376---- 377 378 37916.1.0 (2016-08-26) 380------------------- 381 382Backward-incompatible changes: 383^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 384 385*none* 386 387 388Deprecations: 389^^^^^^^^^^^^^ 390 391- Dropped support for OpenSSL 0.9.8. 392 393 394Changes: 395^^^^^^^^ 396 397- Fix memory leak in ``OpenSSL.crypto.dump_privatekey()`` with ``FILETYPE_TEXT``. 398 `#496 <https://github.com/pyca/pyopenssl/pull/496>`_ 399- Enable use of CRL (and more) in verify context. 400 `#483 <https://github.com/pyca/pyopenssl/pull/483>`_ 401- ``OpenSSL.crypto.PKey`` can now be constructed from ``cryptography`` objects and also exported as such. 402 `#439 <https://github.com/pyca/pyopenssl/pull/439>`_ 403- Support newer versions of ``cryptography`` which use opaque structs for OpenSSL 1.1.0 compatibility. 404 405 406---- 407 408 40916.0.0 (2016-03-19) 410------------------- 411 412This is the first release under full stewardship of PyCA. 413We have made *many* changes to make local development more pleasing. 414The test suite now passes both on Linux and OS X with OpenSSL 0.9.8, 1.0.1, and 1.0.2. 415It has been moved to `pytest <https://docs.pytest.org/>`_, all CI test runs are part of `tox <https://tox.readthedocs.io/>`_ and the source code has been made fully `flake8 <https://flake8.readthedocs.io/>`_ compliant. 416 417We hope to have lowered the barrier for contributions significantly but are open to hear about any remaining frustrations. 418 419 420Backward-incompatible changes: 421^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 422 423- Python 3.2 support has been dropped. 424 It never had significant real world usage and has been dropped by our main dependency ``cryptography``. 425 Affected users should upgrade to Python 3.3 or later. 426 427 428Deprecations: 429^^^^^^^^^^^^^ 430 431- The support for EGD has been removed. 432 The only affected function ``OpenSSL.rand.egd()`` now uses ``os.urandom()`` to seed the internal PRNG instead. 433 Please see `pyca/cryptography#1636 <https://github.com/pyca/cryptography/pull/1636>`_ for more background information on this decision. 434 In accordance with our backward compatibility policy ``OpenSSL.rand.egd()`` will be *removed* no sooner than a year from the release of 16.0.0. 435 436 Please note that you should `use urandom <https://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/>`_ for all your secure random number needs. 437- Python 2.6 support has been deprecated. 438 Our main dependency ``cryptography`` deprecated 2.6 in version 0.9 (2015-05-14) with no time table for actually dropping it. 439 pyOpenSSL will drop Python 2.6 support once ``cryptography`` does. 440 441 442Changes: 443^^^^^^^^ 444 445- Fixed ``OpenSSL.SSL.Context.set_session_id``, ``OpenSSL.SSL.Connection.renegotiate``, ``OpenSSL.SSL.Connection.renegotiate_pending``, and ``OpenSSL.SSL.Context.load_client_ca``. 446 They were lacking an implementation since 0.14. 447 `#422 <https://github.com/pyca/pyopenssl/pull/422>`_ 448- Fixed segmentation fault when using keys larger than 4096-bit to sign data. 449 `#428 <https://github.com/pyca/pyopenssl/pull/428>`_ 450- Fixed ``AttributeError`` when ``OpenSSL.SSL.Connection.get_app_data()`` was called before setting any app data. 451 `#304 <https://github.com/pyca/pyopenssl/pull/304>`_ 452- Added ``OpenSSL.crypto.dump_publickey()`` to dump ``OpenSSL.crypto.PKey`` objects that represent public keys, and ``OpenSSL.crypto.load_publickey()`` to load such objects from serialized representations. 453 `#382 <https://github.com/pyca/pyopenssl/pull/382>`_ 454- Added ``OpenSSL.crypto.dump_crl()`` to dump a certificate revocation list out to a string buffer. 455 `#368 <https://github.com/pyca/pyopenssl/pull/368>`_ 456- Added ``OpenSSL.SSL.Connection.get_state_string()`` using the OpenSSL binding ``state_string_long``. 457 `#358 <https://github.com/pyca/pyopenssl/pull/358>`_ 458- Added support for the ``socket.MSG_PEEK`` flag to ``OpenSSL.SSL.Connection.recv()`` and ``OpenSSL.SSL.Connection.recv_into()``. 459 `#294 <https://github.com/pyca/pyopenssl/pull/294>`_ 460- Added ``OpenSSL.SSL.Connection.get_protocol_version()`` and ``OpenSSL.SSL.Connection.get_protocol_version_name()``. 461 `#244 <https://github.com/pyca/pyopenssl/pull/244>`_ 462- Switched to ``utf8string`` mask by default. 463 OpenSSL formerly defaulted to a ``T61String`` if there were UTF-8 characters present. 464 This was changed to default to ``UTF8String`` in the config around 2005, but the actual code didn't change it until late last year. 465 This will default us to the setting that actually works. 466 To revert this you can call ``OpenSSL.crypto._lib.ASN1_STRING_set_default_mask_asc(b"default")``. 467 `#234 <https://github.com/pyca/pyopenssl/pull/234>`_ 468 469 470---- 471 472 473Older Changelog Entries 474----------------------- 475 476The changes from before release 16.0.0 are preserved in the `repository <https://github.com/pyca/pyopenssl/blob/master/doc/ChangeLog_old.txt>`_. 477