restore a subset of the rand module by reaperhulk · Pull Request #708 · pyca/pyopenssl

reaperhulk · 2017-11-20T07:18:05Z

fixes #706

We should bikeshed on the changelog language probably.

codecov · 2017-11-20T07:25:21Z

Codecov Report

Merging #708 into master will increase coverage by 0.16%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master     #708      +/-   ##
==========================================
+ Coverage   96.86%   97.03%   +0.16%     
==========================================
  Files          16       18       +2     
  Lines        5647     5667      +20     
  Branches      392      394       +2     
==========================================
+ Hits         5470     5499      +29     
+ Misses        118      112       -6     
+ Partials       59       56       -3

Impacted Files	Coverage Δ
tests/test_rand.py	`100% <100%> (ø)`
src/OpenSSL/rand.py	`100% <100%> (ø)`
tests/test_ssl.py	`99.11% <0%> (+0.33%)`	⬆️
src/OpenSSL/SSL.py	`94.87% <0%> (+0.33%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4aa52c3...6afda82. Read the comment docs.

alex · 2017-11-20T12:21:42Z

The error stuff appers unused?

alex · 2017-11-20T13:35:37Z

+from OpenSSL._util import lib as _lib
+
+
+_builtin_bytes = bytes


This isn't needed, just use bytes below.

alex · 2017-11-20T13:36:04Z

+    return _lib.RAND_status()
+
+
+def cleanup():


Do we really need this?

Probably not. As of 1.1.0 this is already a noop

alex · 2017-11-20T13:36:26Z

+        # It's hard to know what it is actually going to return.  Different
+        # OpenSSL random engines decide differently whether they have enough
+        # entropy or not.
+        assert rand.status() in (0, 1)


Surely this should actually always be 1?

Maybe it's possible to trigger a 0 when calling cleanup and not adding enough back...? I don't know. This is just a restoration of the code that was previously there, but this test is not particularly useful. I'd be fine changing it to assert 1. Plus as an added bonus we'll get to find out some insane edge case if it turns out 1 isn't always true in the tests.

169: Scheduled weekly dependency update for week 48 r=mithrandi a=pyup-bot ## Updates Here's a list of all the updates bundled in this pull request. I've added some links to make it easier for you to find all the information you need. <table align="center"> <tr> <td><b>hypothesis</b></td> <td align="center">3.38.0</td> <td align="center">»</td> <td align="center">3.38.5</td> <td> <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pypi.python.org/pypi/hypothesis">PyPI</a" rel="nofollow">https://pypi.python.org/pypi/hypothesis">PyPI</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyup.io/changelogs/hypothesis/">Changelog</a" rel="nofollow">https://pyup.io/changelogs/hypothesis/">Changelog</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://github.com/HypothesisWorks/hypothesis/issues">Repo</a">https://github.com/HypothesisWorks/hypothesis/issues">Repo</a> </td> <tr> <td><b>pyasn1-modules</b></td> <td align="center">0.1.5</td> <td align="center">»</td> <td align="center">0.2.1</td> <td> <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pypi.python.org/pypi/pyasn1-modules">PyPI</a" rel="nofollow">https://pypi.python.org/pypi/pyasn1-modules">PyPI</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyup.io/changelogs/pyasn1-modules/">Changelog</a" rel="nofollow">https://pyup.io/changelogs/pyasn1-modules/">Changelog</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://github.com/etingof/pyasn1-modules">Repo</a">https://github.com/etingof/pyasn1-modules">Repo</a> </td> <tr> <td><b>pyasn1</b></td> <td align="center">0.3.7</td> <td align="center">»</td> <td align="center">0.4.2</td> <td> <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pypi.python.org/pypi/pyasn1">PyPI</a" rel="nofollow">https://pypi.python.org/pypi/pyasn1">PyPI</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyup.io/changelogs/pyasn1/">Changelog</a" rel="nofollow">https://pyup.io/changelogs/pyasn1/">Changelog</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://github.com/etingof/pyasn1">Repo</a">https://github.com/etingof/pyasn1">Repo</a> </td> <tr> <td><b>pyopenssl</b></td> <td align="center">17.3.0</td> <td align="center">»</td> <td align="center">17.4.0</td> <td> <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pypi.python.org/pypi/pyopenssl">PyPI</a" rel="nofollow">https://pypi.python.org/pypi/pyopenssl">PyPI</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyup.io/changelogs/pyopenssl/">Changelog</a" rel="nofollow">https://pyup.io/changelogs/pyopenssl/">Changelog</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyopenssl.org/">Homepage</a" rel="nofollow">https://pyopenssl.org/">Homepage</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"http://pythonhosted.org/pyOpenSSL/">Docs</a" rel="nofollow">http://pythonhosted.org/pyOpenSSL/">Docs</a> </td> <tr> <td><b>pyrsistent</b></td> <td align="center">0.14.0</td> <td align="center">»</td> <td align="center">0.14.1</td> <td> <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pypi.python.org/pypi/pyrsistent">PyPI</a" rel="nofollow">https://pypi.python.org/pypi/pyrsistent">PyPI</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyup.io/changelogs/pyrsistent/">Changelog</a" rel="nofollow">https://pyup.io/changelogs/pyrsistent/">Changelog</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"http://github.com/tobgu/pyrsistent/">Repo</a">http://github.com/tobgu/pyrsistent/">Repo</a> </td> </tr> </table> ## Changelogs ### hypothesis 3.38.0 -> 3.38.5 >### 3.38.5 >------------------- >This fixes the repr of strategies using lambda that are defined inside >decorators to include the lambda source. >This would mostly have been visible when using the >:ref:`statistics <statistics>` functionality - lambdas used for e.g. filtering >would have shown up with a ``<unknown>`` as their body. This can still happen, >but it should happen less often now. >------------------- >### 3.38.4 >------------------- >This release updates the reported :ref:`statistics <statistics>` so that they >show approximately what fraction of your test run time is spent in data >generation (as opposed to test execution). >This work was funded by `Smarkets <https://smarkets.com/>`_. >------------------- >### 3.38.3 >------------------- >This is a documentation release, which ensures code examples are up to date >by running them as doctests in CI (:issue:`711`). >------------------- >### 3.38.2 >------------------- >This release changes the behaviour of the :attr:`~hypothesis.settings.deadline` >setting when used with :func:`~hypothesis.strategies.data`: Time spent inside >calls to ``data.draw`` will no longer be counted towards the deadline time. >As a side effect of some refactoring required for this work, the way flaky >tests are handled has changed slightly. You are unlikely to see much difference >from this, but some error messages will have changed. >This work was funded by `Smarkets <https://smarkets.com/>`_. >------------------- >### 3.38.1 >------------------- >This patch has a variety of non-user-visible refactorings, removing various >minor warts ranging from indirect imports to typos in comments. >------------------- ### pyopenssl 17.3.0 -> 17.4.0 >### 17.4.0 >------------------- >Backward-incompatible changes: >^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >*none* >Deprecations: >^^^^^^^^^^^^^ >*none* >Changes: >^^^^^^^^ >- Re-added a subset of the ``OpenSSL.rand`` module. > This subset allows conscientious users to reseed the OpenSSL CSPRNG after fork. > `708 <https://github.com/pyca/pyopenssl/pull/708>`_ >- Corrected a use-after-free when reusing an issuer or subject from an ``X509`` object after the underlying object has been mutated. > `709 <https://github.com/pyca/pyopenssl/pull/709>`_ >---- ### pyrsistent 0.14.0 -> 0.14.1 >### 0.14.1 > * Equality check performance improvements for pvectors and pmaps. Thanks dtomas for this! > * Avoid calling factories multiple times for fields that do not change, see PR 120 for for > details. Thanks teepark for this! That's it for now! Happy merging! 🤖

162: Scheduled weekly dependency update for week 48 r=mithrandi a=pyup-bot ## Updates Here's a list of all the updates bundled in this pull request. I've added some links to make it easier for you to find all the information you need. <table align="center"> <tr> <td><b>pyasn1-modules</b></td> <td align="center">0.1.5</td> <td align="center">»</td> <td align="center">0.2.1</td> <td> <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pypi.python.org/pypi/pyasn1-modules">PyPI</a" rel="nofollow">https://pypi.python.org/pypi/pyasn1-modules">PyPI</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyup.io/changelogs/pyasn1-modules/">Changelog</a" rel="nofollow">https://pyup.io/changelogs/pyasn1-modules/">Changelog</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://github.com/etingof/pyasn1-modules">Repo</a">https://github.com/etingof/pyasn1-modules">Repo</a> </td> <tr> <td><b>pyasn1</b></td> <td align="center">0.3.7</td> <td align="center">»</td> <td align="center">0.4.2</td> <td> <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pypi.python.org/pypi/pyasn1">PyPI</a" rel="nofollow">https://pypi.python.org/pypi/pyasn1">PyPI</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyup.io/changelogs/pyasn1/">Changelog</a" rel="nofollow">https://pyup.io/changelogs/pyasn1/">Changelog</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://github.com/etingof/pyasn1">Repo</a">https://github.com/etingof/pyasn1">Repo</a> </td> <tr> <td><b>pyopenssl</b></td> <td align="center">17.3.0</td> <td align="center">»</td> <td align="center">17.4.0</td> <td> <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pypi.python.org/pypi/pyopenssl">PyPI</a" rel="nofollow">https://pypi.python.org/pypi/pyopenssl">PyPI</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyup.io/changelogs/pyopenssl/">Changelog</a" rel="nofollow">https://pyup.io/changelogs/pyopenssl/">Changelog</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyopenssl.org/">Homepage</a" rel="nofollow">https://pyopenssl.org/">Homepage</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"http://pythonhosted.org/pyOpenSSL/">Docs</a" rel="nofollow">http://pythonhosted.org/pyOpenSSL/">Docs</a> </td> <tr> <td><b>pyrsistent</b></td> <td align="center">0.14.0</td> <td align="center">»</td> <td align="center">0.14.1</td> <td> <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pypi.python.org/pypi/pyrsistent">PyPI</a" rel="nofollow">https://pypi.python.org/pypi/pyrsistent">PyPI</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyup.io/changelogs/pyrsistent/">Changelog</a" rel="nofollow">https://pyup.io/changelogs/pyrsistent/">Changelog</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"http://github.com/tobgu/pyrsistent/">Repo</a">http://github.com/tobgu/pyrsistent/">Repo</a> </td> </tr> </table> ## Changelogs ### pyopenssl 17.3.0 -> 17.4.0 >### 17.4.0 >------------------- >Backward-incompatible changes: >^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >*none* >Deprecations: >^^^^^^^^^^^^^ >*none* >Changes: >^^^^^^^^ >- Re-added a subset of the ``OpenSSL.rand`` module. > This subset allows conscientious users to reseed the OpenSSL CSPRNG after fork. > `708 <https://github.com/pyca/pyopenssl/pull/708>`_ >- Corrected a use-after-free when reusing an issuer or subject from an ``X509`` object after the underlying object has been mutated. > `709 <https://github.com/pyca/pyopenssl/pull/709>`_ >---- ### pyrsistent 0.14.0 -> 0.14.1 >### 0.14.1 > * Equality check performance improvements for pvectors and pmaps. Thanks dtomas for this! > * Avoid calling factories multiple times for fields that do not change, see PR 120 for for > details. Thanks teepark for this! That's it for now! Happy merging! 🤖

120: Scheduled weekly dependency update for week 48 r=mithrandi a=pyup-bot ## Updates Here's a list of all the updates bundled in this pull request. I've added some links to make it easier for you to find all the information you need. <table align="center"> <tr> <td><b>pyasn1-modules</b></td> <td align="center">0.1.5</td> <td align="center">»</td> <td align="center">0.2.1</td> <td> <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pypi.python.org/pypi/pyasn1-modules">PyPI</a" rel="nofollow">https://pypi.python.org/pypi/pyasn1-modules">PyPI</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyup.io/changelogs/pyasn1-modules/">Changelog</a" rel="nofollow">https://pyup.io/changelogs/pyasn1-modules/">Changelog</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://github.com/etingof/pyasn1-modules">Repo</a">https://github.com/etingof/pyasn1-modules">Repo</a> </td> <tr> <td><b>pyasn1</b></td> <td align="center">0.3.7</td> <td align="center">»</td> <td align="center">0.4.2</td> <td> <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pypi.python.org/pypi/pyasn1">PyPI</a" rel="nofollow">https://pypi.python.org/pypi/pyasn1">PyPI</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyup.io/changelogs/pyasn1/">Changelog</a" rel="nofollow">https://pyup.io/changelogs/pyasn1/">Changelog</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://github.com/etingof/pyasn1">Repo</a">https://github.com/etingof/pyasn1">Repo</a> </td> <tr> <td><b>pyopenssl</b></td> <td align="center">17.3.0</td> <td align="center">»</td> <td align="center">17.4.0</td> <td> <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pypi.python.org/pypi/pyopenssl">PyPI</a" rel="nofollow">https://pypi.python.org/pypi/pyopenssl">PyPI</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyup.io/changelogs/pyopenssl/">Changelog</a" rel="nofollow">https://pyup.io/changelogs/pyopenssl/">Changelog</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"https://pyopenssl.org/">Homepage</a" rel="nofollow">https://pyopenssl.org/">Homepage</a> | <a href="proxy.php?url=https%3A%2F%2Fgithub-redirect.dependabot.com%2F%3Ca+href%3D"http://pythonhosted.org/pyOpenSSL/">Docs</a" rel="nofollow">http://pythonhosted.org/pyOpenSSL/">Docs</a> </td> </tr> </table> ## Changelogs ### pyopenssl 17.3.0 -> 17.4.0 >### 17.4.0 >------------------- >Backward-incompatible changes: >^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >*none* >Deprecations: >^^^^^^^^^^^^^ >*none* >Changes: >^^^^^^^^ >- Re-added a subset of the ``OpenSSL.rand`` module. > This subset allows conscientious users to reseed the OpenSSL CSPRNG after fork. > `708 <https://github.com/pyca/pyopenssl/pull/708>`_ >- Corrected a use-after-free when reusing an issuer or subject from an ``X509`` object after the underlying object has been mutated. > `709 <https://github.com/pyca/pyopenssl/pull/709>`_ >---- That's it for now! Happy merging! 🤖

reaperhulk mentioned this pull request Nov 20, 2017

Security Implications of #675 (Delete rand.py) #706

Closed

reaperhulk force-pushed the restore-rand branch from e4287c8 to 5cc4c2c Compare November 20, 2017 13:21

alex reviewed Nov 20, 2017

View reviewed changes

alex previously approved these changes Nov 20, 2017

View reviewed changes

reaperhulk added 3 commits November 20, 2017 22:05

restore a subset of the rand module

ced2d04

flake

121f4e5

remove cleanup, go ahead and assume status will always be 1

909aa27

reaperhulk dismissed alex’s stale review via 723c80c November 20, 2017 14:05

reaperhulk force-pushed the restore-rand branch from 6e8869e to 723c80c Compare November 20, 2017 14:05

lighten and add power

6afda82

reaperhulk force-pushed the restore-rand branch from 723c80c to 6afda82 Compare November 20, 2017 14:06

alex approved these changes Nov 20, 2017

View reviewed changes

alex merged commit acbd662 into pyca:master Nov 20, 2017

github-actions Bot locked as resolved and limited conversation to collaborators Aug 16, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

restore a subset of the rand module#708

restore a subset of the rand module#708
alex merged 4 commits intopyca:masterfrom
reaperhulk:restore-rand

reaperhulk commented Nov 20, 2017

Uh oh!

codecov Bot commented Nov 20, 2017 •

edited

Loading

Uh oh!

alex commented Nov 20, 2017

Uh oh!

alex Nov 20, 2017

Uh oh!

alex Nov 20, 2017

Uh oh!

reaperhulk Nov 20, 2017

Uh oh!

alex Nov 20, 2017

Uh oh!

reaperhulk Nov 20, 2017

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

reaperhulk commented Nov 20, 2017

Uh oh!

codecov Bot commented Nov 20, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

alex commented Nov 20, 2017

Uh oh!

alex Nov 20, 2017

Choose a reason for hiding this comment

Uh oh!

alex Nov 20, 2017

Choose a reason for hiding this comment

Uh oh!

reaperhulk Nov 20, 2017

Choose a reason for hiding this comment

Uh oh!

alex Nov 20, 2017

Choose a reason for hiding this comment

Uh oh!

reaperhulk Nov 20, 2017

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

codecov Bot commented Nov 20, 2017 •

edited

Loading