summaryrefslogtreecommitdiff
path: root/passlib/utils
Commit message (Collapse)AuthorAgeFilesLines
* passlib.handlers.scrypt: created scrypt hash handler, complete with UTs and docsEli Collins2016-06-105-662/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | * scrypt kdf code - relocated scrypt kdf code to passlib.crypto.scrypt - py3 compat fixes - split UTs out into separate file - removed "non-power of 2" support, not needed. - added wrapper which can toggle between builtin backend, and extenrnal scrypt package. - factored out n/r/p validation code so it can be used independantly of calling kdf itself. * passlib.handlers.scrypt: added scrypt handler which wraps the kdf. - added some custom test strings, as well as adapted some reference values from the scrypt whitepaper. - added documentation page - integrated scrypt kdf wrapper w/ hash's HasManyBackends api
* Merge from defaultEli Collins2016-06-1011-3261/+799
|\
| * passlib.utils.handlers / HasRounds: the 'rounds' keyword is now treatedEli Collins2016-06-101-3/+7
| | | | | | | | | | | | | | | | | | | | | | as a fallback for 'default_rounds', 'min_rounds', and 'max_rounds'. this makes it easier to specify a django-style policy of "deprecate all hashes which have a differing rounds value". * removed special handling from 'rounds' from CryptContext parser * tweaked affected CryptContext serialization tests * added test for new behavior
| * bugfix: plaintext, htdigest, unix_disabled hashes: added missing .using() ↵Eli Collins2016-06-101-19/+35
| | | | | | | | | | | | | | | | | | | | | | implementation these all derived directly from PasswordHash, and lacked a working .using(). * added UT to check for a working .using() method * factored out GenericHandler's .using() into another base class which these three hashes could inherit from.
| * deprecating the 'vary_rounds' option -- *very* little security benefit,Eli Collins2016-06-101-0/+3
| | | | | | | | | | | | | | and not worth the amount of code it requires to support it. * stripped out vary_rounds from all internal presets * added deprecation warning if it's ever used
| * passlib.context: now that Handler.using() is fully implemented,Eli Collins2016-06-101-2/+1
| | | | | | | | | | removed _CryptRecord proxy object completely. CryptContext now just worked with custom handler instances directly.
| * passlib.utils.handlers: HasSalt.using() implemented to support customizingEli Collins2016-06-101-0/+76
| | | | | | | | default salt size, added UTs.
| * passlib.utils.handlers: some fixes to HasManyIdent.using(), added more UTsEli Collins2016-06-101-0/+1
| |
| * passlib.utils.handlers: some fixes to HasRounds.using(), added more UTsEli Collins2016-06-101-3/+3
| | | | | | | | | | | | | | | | | | * HasRounds: now parses vary_rounds="0.x" format correctly * PrefixWrapper: now exposes "vary_rounds" attr * handler tests: split HasRounds.using() into multiple tests, one for each property (max_rounds, min_rounds, etc) * context tests: added checks that custom handler is being configured correctly, since actual behavior is now being checked by handler tests.
| * passlib.crypto: relocated bcrypt backend code from passlib.utilsEli Collins2016-06-104-1584/+0
| |
| * .encrypt() method renamed to .hash(), other api cleanupsEli Collins2016-06-102-59/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | .encrypt() ---------- hash.encrypt() & context.encrypt() have been renamed to .hash(). this should take care of the long-standing issue 21 (the poor naming of .encrypt). per docs, legacy aliases will remain in place until passlib 2.0. .genhash() / .genconfig() ------------------------- taking advantage of this reorganization to also deprecate .genconfig() and .genhash() -- they're not really useful in a modern system, nor as needed for historical support as initially thought: .genconfig() will be retired completely in passlib 2.0; .genhash() is rolled into the new .hash() method along with .encrypt().
| * passlib.pwd: big cleanup pass, removing code that won't be ready for releaseEli Collins2016-02-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * split generate() into genword() & genphrase() -- APIs are just too different to keep combined. * renamed internal calc funcs to better reflect their purpose. * commented out PhraseGenerator's min_chars code, can't confirm it's doing correct thing. * commented out password strength estimator, too half-baked. * tried to simplify SequenceGenerator attributes. * genword(): defined some base charsets to work with * genphrase(): wordsets now stored uncompressed (not really that big, and .whl will compress everything for transport). * fleshed out UTs for genword() & genphrase() * updated docs
| * relocated many of the crypto routes inside passlib.utils,Eli Collins2016-02-105-1509/+105
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and moved them to a separate passlib.crypto subpackage. along with this move, made a few api cleanups: * unified all code that's looking up hashes to use new passlib.crypto.lookup_hash() wrapper, which takes care of hash name normalization, loading fallback implementations, and alg metadata inspection, all hidden behind a memoized function. * deprecated pbkdf2() in favor of pbkdf2_hmac() -- only real use, and new signature matches stdlib function. additionally, this version is a bit faster, due to some assumptions that can be made due to the PRF always being HMAC based. * added compile_hmac() helper which does an even more efficient job of pre-compiling a keyed HMAC function; this helped speed up pbkdf2 a bit more.
| * passlib.totp: factored out SequenceMixin for general use in passlibEli Collins2016-02-101-0/+26
| |
| * Merge with stableEli Collins2016-02-091-5/+35
| |\
| | * bugfix: PrefixWrapper wasn't initializing parse_rounds() for lazy-loaded ↵Eli Collins2016-02-081-8/+11
| | | | | | | | | | | | handlers.
| | * PasswordHash ifc: added temporarily helper .parse_rounds(),Eli Collins2016-02-081-0/+27
| | | | | | | | | | | | which abstracts out job of parsing rounds value from hash.
| * | bugfix: PrefixWrapper: proxy the new min/max_desired_rounds attrs.Eli Collins2015-07-261-0/+2
| | | | | | | | | | | | (may need to do bigger overhaul of PrefixWrapper at some point)
| * | HasManyBackends: methods now handle backend loader throwing ↵Eli Collins2015-07-261-3/+31
| | | | | | | | | | | | | | | | | | | | | PasslibSecurityError. now treated like the backend isn't available in most cases; rather than throwing unexpected security error.
| * | misc test bugfixesEli Collins2015-07-261-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * test_handlers: fix py3 u() compat issue * test_totp: clean norm_hash_name() caches so warnings repeat per-test, added/fixed some warnings checks. * HandlerCase: HasRounds.using() test: hack so bsdi_crypt can pass (the 'odd rounds only' was playing havoc w/ the test's expectations) * HandlerCase: effective_rounds() / effective_ident() helpers now unwrap PrefixWrappers first; wrappers aren't callable like classes. * HandlerCase: HasRounds.using() test: don't check min_rounds-1 if min_rounds is 0. * HandlerCase: multithreaded fuzz test -- detect & log errors if stalled thread, rather than main thread stalling forever. reduced thread count down to 10. * reset_warning_filter() context manager -- simplified __exit__() cleanup code
| * | HasRounds.using() improved, added UTs.Eli Collins2015-07-251-78/+104
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * added UTs for basic min/max/default options. still needs vary_rounds & alias tests * clarified error/warning condtions for some cases, handled implicit min/max policy settings. * All HasRounds.using() options now accept values as strings, to help CryptContext. * Replaced some dup code in _norm_rounds w/ a call to _clip_to_valid_rounds * departing from previous CryptContext behavior, passing an explicit rounds value to encrypt() will now override the policy limits (w/ a warning)
| * | HasManyIdents.using() -- fleshed out, added UTsEli Collins2015-07-251-12/+27
| | |
| * | py32 fix: avoid 'int < None' comparisonEli Collins2015-07-231-1/+1
| | |
| * | added PrefixWrapper.using() implementation which takes care of proxyingEli Collins2015-07-231-1/+12
| | | | | | | | | | | | the using() call; and added PrefixWrapper.needs_update() proxy wrapper.
| * | comments & doc updatesEli Collins2015-07-232-0/+20
| | |
| * | removed HasManyBackends._try_alternate_backends() -- complexity is uneededEli Collins2015-07-231-39/+0
| | | | | | | | | | | | for the few simple uses that we have.
| * | passlib.tests -- clean ups of os_crypt & general backend handlingEli Collins2015-07-231-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * moved utils.patchAttr() function to TestCase.patchAttr(), redid a bunch of manual monkeypatches to use .patchAttr() method. * temporary_backend() hack replaced by subcls.using(), so temporary backend use will be threadsafe (needed for concurrent tests). * HandlerCase.create_backend_cases() replaced with HandlerCase.create_backend_case(), all calls split out to make individual calls for each backend. Easier to read in diffs going forward when backends added/removed. * moved os_crypt specific code w/in create_backend_case() to OsCryptMixin, which just subclasses the method it needs to modify. allowed removing find_crypt_replacement() method entirely; decision to skip backend now directly uses OsCryptMixin's own logic. * fuzz_verifier_crypt() cleanups - moved to OsCryptMixin; removing .using_patched_crypt ref from HandlerCase - has_crypt_support() helper rolled into method, was only caller. - os_supports_ident() refactored into crypt_supports_variant(). fuzz_verified_crypt() is (now) the only caller. * bcrypt's crypt_supports_variant() now uses actual test of crypt() rather than hardcoded list of supported values. * fuzz verifier now handlers hashes throwing SkipTest. * utils.has_crypt_support() rolled into
| * | Merge from stableEli Collins2015-07-221-12/+8
| |\ \ | | |/
| | * bunch of bcrypt updates, centered around the bsd wraparound bug.Eli Collins2015-07-211-12/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | bcrypt ------ * added support & UT for $2b$ hash format. not making it the default yet, for backward compat. * large refactor of how bcrypt backends are loaded: instead of per-backend workarounds within each _calc_checksum_<backend>() function: now using runtime detection of specific capabilities & workarounds, that runs whenever set_backend() is called, combined with consolidated workaround code within _calc_checksum(), controlled by the flags set by set_backend(). this detection now looks for: - the 8bit bug: throws a PasslibSecurityError - the wraparound bug: issues warning, sets flag enabling a workaround. - support for 2/2y/2b: if backend lacks support for particular variants, sets flag enabling workaround to add support. * os_crypt backend now just issues error if it can't handle a password encoding; rather than trying fallbacks first -- edge case anyways, and likely to not have any fallbacks when it does happen. simplifies backend code. * added UTs to make sure wraparound-vulnerable passwords are hashed correctly (as a 72char string, not a 1-3 char string that's repeated). * internal blowfish code's ident parsing clarified. other ----- * added exc.PasslibSecurityError for fatal runtime errors. * test framework: os_crypt backends no longer expected to use *any* backend as fallback, just ones with lower priority than os_crypt. * test framework: crypt_stub() wrapper now subclasses the handler, so it can use an independant backend, instead of changing global backend for duration of call (made parallel testing hard) docs ---- * added entry to bcrypt page, writing down wraparound bug details, and how passlib is handling it. * all versions of pybcrypt & bcryptor seem to be vulnerable to wraparound bug. starting process of deprecating these backends: marked bcrypt backend as 'preferred' throughout the documentation.
| * | Merge from stableEli Collins2015-01-271-0/+2
| |\ \ | | |/
| | * replaced a bunch of ``isinstance(xxx, str)`` checks withEli Collins2015-01-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | ``isinstance(xxx, native_string_types)`` checks, to handle str or unicode under py2. this should explicitly take care of issue 54, but not closing that until checking deeper into the unicode handling. should allow str/unicode anywhere the inputs are program values (e.g. config options), not user-provided values.
| * | simplify _CryptRecord handler construction.Eli Collins2015-01-271-0/+5
| | |
| * | _CryptRecord: removed _bind_needs_update() frameworkEli Collins2015-01-271-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * relocated all hash._bind_needs_update() into the new hash.needs_update() interface. * des_crypt._generate_rounds() now makes default_rounds odd, even if vary_round is unset (to prevent cyclic issue w/ needs_update). * CryptRecord.needs_update() is now direct proxy for hash.needs_update().
| * | move special-case for bsdi_crypt rounds generation to bsdi_cryptEli Collins2015-01-271-7/+0
| | |
| * | skip unwanted min_desired_rounds warnings from HasRounds._norm_rounds()Eli Collins2015-01-271-4/+7
| | |
| * | made passlib.utils.compat a package, moved _ordered_dict backport inside it.Eli Collins2015-01-272-2/+2
| | |
| * | _CryptRecord refactoring: removed encrypt() & genconfig() wrappersEli Collins2015-01-271-0/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | * removed _CryptRecord._init_encrypt_and_genconfig() -- it was just wrapping some default options around encrypt() and genconfig(). now passing these straight to handler.using(). * HasManyIdents.using() implemented, to support CryptContext passing default ident=xxx values.
| * | _CryptRecord refactoring -- moved rounds management code to hashesEli Collins2015-01-271-7/+281
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is first part of relocation seeking to move most of the functionality from inside the _CryptRecord class, into a public interface of the PasswordHash class. This would give a number of benefits, including reducing the amount of hash-specific hacks contained within CryptContext's internals. * added PasswordHash.using(), which creates a subclass configured with CryptContext options. Mixins can then provide helpers to customize based on various parameters. * added PasswordHash.needs_update(), a frontend for checking if a hash needs updating per configuration provided via using(). * moved all the rounds generation code from _CryptRecord to HasRounds.using()'s wrapper, and HasRounds._generate_rounds(). * moved all the rounds needs_update() code to HasRounds._calc_needs_update(). * _CryptRecord now calls hash.using() to configure rounds behavior, and uses the methods of that custom handler, instead of the original, so that rounds are taken into account.
| * | renamed compat helper 'base_string_types' -> 'unicode_or_bytes_types' for ↵Eli Collins2015-01-232-7/+7
| | | | | | | | | | | | clarity.
| * | more post-py25/31 cleanupsEli Collins2015-01-232-22/+19
| | | | | | | | | | | | | | | | | | | | | | | | * removed exc_err() compat helper, can now use "Exception as err" * next_method_attr replaced by nextgetter(), which seems a little cleaner * removed py30/31 alias for SafeConfigParser * put some PY26 features behind PY26 compat flag * removed PY25 from setup classifiers
* | | Merge with defaultEli Collins2015-01-1311-1016/+1635
|\ \ \ | |/ /
| * | fix in test harness: _use_mock_crypt() reworked so it doesn't disable ↵Eli Collins2015-01-101-1/+1
| | | | | | | | | | | | | | | | | | _load_backend() entirely, was causing problems with new _load_backend() framework.
| * | added the official OrderedDict backport, replaced existing refsEli Collins2015-01-102-0/+253
| | |
| * | removed a LOT of compatibility shims -- dropped python 2.5, 3.0, and 3.1 ↵Eli Collins2015-01-108-98/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | support; as well as PyPy 1.x and Jython 2.5. shims removed ------------- * b() shim replaced with b'' (py25) * 'bytes' alias no longer needed (py25) * callable() shim no longer needed (py30,31) * PY_MIN_32 flag replaced with PY3 flag (py30,31) * removed 'abc' module stub used by passlib.ifc (py25) * removed chain_from_iterable() backport (py25) * tests: removed catch_warnings() backport, replaced refs with real warnings.catch_warnings() (py25) * tests: removed unittest2 backports (py25, py30, py31) -- now throw hard error if unittest2 not present under py26 (the only release remaining which lacks the unittest2 features) * removed SUPPORTS_DIR_METHOD conditional (py25, pypy 1.x) * some other minor workarounds other ----- * added check in passlib.compat which now throws error telling user version isn't supported (to prevent spurious errors later)
| * | comment & doc updates, removed some extraneous try/except clauses from ↵Eli Collins2013-12-281-1/+1
| | | | | | | | | | | | des_crypt code
| * | Merge from stableEli Collins2013-12-274-166/+421
| |\ \ | | |/ | |/|
| | * Merge from stableEli Collins2013-12-273-14/+20
| | |\
| | * \ Merge password generation helpers into default (not completed, but will be ↵Eli Collins2013-05-069-166/+264
| | |\ \ | | | | | | | | | | | | | | | before 1.7 release)
| | | * | pbkdf cleanupsEli Collins2013-04-101-32/+24
| | | | | | | | | | | | | | | | | | | | | | | | | * updated sha1_crypt to use get_keyed_prf(), should be ~10% faster * documented get_hash_info() and get_keyed_prf()
| | | * | concurrency testingEli Collins2013-04-101-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * added multi-thread fuzz testing to shared PasswordHash test suite * added code to detect pybcrypt <0.3, issue warning, and implement thread-lock to workaround it's fatal concurrency issue. * TODO: audit rest of passlib for threading issues (shouldn't be any major ones)
View Lorry Controller Status