From 822f3d358a5a1ee922be33df9afc4266c804fd79 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Thu, 6 Aug 2015 11:47:32 +0100 Subject: add oid attribute to all extension types --- docs/x509/reference.rst | 105 +++++++++++++++++++++++++++++++++++++++++++++++ src/cryptography/x509.py | 26 +++++++++++- 2 files changed, 130 insertions(+), 1 deletion(-) diff --git a/docs/x509/reference.rst b/docs/x509/reference.rst index 61971fed..29b82680 100644 --- a/docs/x509/reference.rst +++ b/docs/x509/reference.rst @@ -918,6 +918,14 @@ X.509 Extensions be used for more than one operation is to be restricted. It corresponds to :data:`OID_KEY_USAGE`. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + .. attribute:: digital_signature :type: bool @@ -1010,6 +1018,14 @@ X.509 Extensions length restrictions may exist. It corresponds to :data:`OID_BASIC_CONSTRAINTS`. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + .. attribute:: ca :type: bool @@ -1038,6 +1054,15 @@ X.509 Extensions purposes indicated in the key usage extension. The object is iterable to obtain the list of :ref:`extended key usage OIDs `. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + + .. class:: OCSPNoCheck .. versionadded:: 1.0 @@ -1051,6 +1076,14 @@ X.509 Extensions extension is only relevant when the certificate is an authorized OCSP responder. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + .. class:: NameConstraints .. versionadded:: 1.0 @@ -1060,6 +1093,14 @@ X.509 Extensions beneath the CA certificate must (or must not) be in. For specific details on the way this extension should be processed see :rfc:`5280`. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + .. attribute:: permitted_subtrees :type: list of :class:`GeneralName` objects or None @@ -1087,6 +1128,14 @@ X.509 Extensions certificate chain. For more information about generation and use of this extension see `RFC 5280 section 4.2.1.1`_. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + .. attribute:: key_identifier :type: bytes @@ -1113,6 +1162,14 @@ X.509 Extensions The subject key identifier extension provides a means of identifying certificates that contain a particular public key. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + .. attribute:: digest :type: bytes @@ -1128,6 +1185,14 @@ X.509 Extensions of identities for which the certificate is valid. The object is iterable to get every element. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + .. method:: get_values_for_type(type) :param type: A :class:`GeneralName` provider. This is one of the @@ -1158,6 +1223,14 @@ X.509 Extensions of identities for the certificate issuer. The object is iterable to get every element. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + .. method:: get_values_for_type(type) :param type: A :class:`GeneralName` provider. This is one of the @@ -1176,6 +1249,14 @@ X.509 Extensions validation services (such as OCSP) and issuer data. It is an iterable, containing one or more :class:`AccessDescription` instances. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + .. class:: AccessDescription @@ -1206,6 +1287,14 @@ X.509 Extensions obtained. It is an iterable, containing one or more :class:`DistributionPoint` instances. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + .. class:: DistributionPoint .. versionadded:: 0.9 @@ -1304,6 +1393,14 @@ X.509 Extensions certificates issued by the subject of this certificate, but not in additional certificates in the path. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + .. attribute:: skip_certs :type: int @@ -1315,6 +1412,14 @@ X.509 Extensions The certificate policies extension is an iterable, containing one or more :class:`PolicyInformation` instances. + .. attribute:: oid + + .. versionadded:: 1.0 + + :type: :class:`ObjectIdentifier` + + The OID associated with this extension type. + Certificate Policies Classes ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/src/cryptography/x509.py b/src/cryptography/x509.py index 0ddff728..c8380b1a 100644 --- a/src/cryptography/x509.py +++ b/src/cryptography/x509.py @@ -314,6 +314,8 @@ class Extension(object): class ExtendedKeyUsage(object): + oid = OID_EXTENDED_KEY_USAGE + def __init__(self, usages): if not all(isinstance(x, ObjectIdentifier) for x in usages): raise TypeError( @@ -342,10 +344,12 @@ class ExtendedKeyUsage(object): class OCSPNoCheck(object): - pass + oid = OID_OCSP_NO_CHECK class BasicConstraints(object): + oid = OID_BASIC_CONSTRAINTS + def __init__(self, ca, path_length): if not isinstance(ca, bool): raise TypeError("ca must be a boolean value") @@ -382,6 +386,8 @@ class BasicConstraints(object): class KeyUsage(object): + oid = OID_KEY_USAGE + def __init__(self, digital_signature, content_commitment, key_encipherment, data_encipherment, key_agreement, key_cert_sign, crl_sign, encipher_only, decipher_only): @@ -465,6 +471,8 @@ class KeyUsage(object): class AuthorityInformationAccess(object): + oid = OID_AUTHORITY_INFORMATION_ACCESS + def __init__(self, descriptions): if not all(isinstance(x, AccessDescription) for x in descriptions): raise TypeError( @@ -529,6 +537,8 @@ class AccessDescription(object): class CertificatePolicies(object): + oid = OID_CERTIFICATE_POLICIES + def __init__(self, policies): if not all(isinstance(x, PolicyInformation) for x in policies): raise TypeError( @@ -666,6 +676,8 @@ class NoticeReference(object): class SubjectKeyIdentifier(object): + oid = OID_SUBJECT_KEY_IDENTIFIER + def __init__(self, digest): self._digest = digest @@ -687,6 +699,8 @@ class SubjectKeyIdentifier(object): class NameConstraints(object): + oid = OID_NAME_CONSTRAINTS + def __init__(self, permitted_subtrees, excluded_subtrees): if permitted_subtrees is not None: if not all( @@ -751,6 +765,8 @@ class NameConstraints(object): class CRLDistributionPoints(object): + oid = OID_CRL_DISTRIBUTION_POINTS + def __init__(self, distribution_points): if not all( isinstance(x, DistributionPoint) for x in distribution_points @@ -871,6 +887,8 @@ class ReasonFlags(Enum): class InhibitAnyPolicy(object): + oid = OID_INHIBIT_ANY_POLICY + def __init__(self, skip_certs): if not isinstance(skip_certs, six.integer_types): raise TypeError("skip_certs must be an integer") @@ -1161,6 +1179,8 @@ class GeneralNames(object): class SubjectAlternativeName(object): + oid = OID_SUBJECT_ALTERNATIVE_NAME + def __init__(self, general_names): self._general_names = GeneralNames(general_names) @@ -1187,6 +1207,8 @@ class SubjectAlternativeName(object): class IssuerAlternativeName(object): + oid = OID_ISSUER_ALTERNATIVE_NAME + def __init__(self, general_names): self._general_names = GeneralNames(general_names) @@ -1213,6 +1235,8 @@ class IssuerAlternativeName(object): class AuthorityKeyIdentifier(object): + oid = OID_AUTHORITY_KEY_IDENTIFIER + def __init__(self, key_identifier, authority_cert_issuer, authority_cert_serial_number): if authority_cert_issuer or authority_cert_serial_number: -- cgit v1.2.3 From 14f0bd0947c61d80d4809f6caec7400d79cd9210 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Thu, 6 Aug 2015 11:55:18 +0100 Subject: add ExtensionType interface --- docs/x509/reference.rst | 7 +++++++ src/cryptography/x509.py | 22 ++++++++++++++++++++++ 2 files changed, 29 insertions(+) diff --git a/docs/x509/reference.rst b/docs/x509/reference.rst index 29b82680..2f997ae2 100644 --- a/docs/x509/reference.rst +++ b/docs/x509/reference.rst @@ -909,6 +909,13 @@ X.509 Extensions Returns an instance of the extension type corresponding to the OID. +.. class:: ExtensionType + + .. versionadded:: 1.0 + + This is the interface against which all the following extension types are + registered. + .. class:: KeyUsage .. versionadded:: 0.9 diff --git a/src/cryptography/x509.py b/src/cryptography/x509.py index c8380b1a..b8c6d4ed 100644 --- a/src/cryptography/x509.py +++ b/src/cryptography/x509.py @@ -313,6 +313,16 @@ class Extension(object): return not self == other +@six.add_metaclass(abc.ABCMeta) +class ExtensionType(object): + @abc.abstractproperty + def oid(self): + """ + Returns the oid associated with the given extension type. + """ + + +@utils.register_interface(ExtensionType) class ExtendedKeyUsage(object): oid = OID_EXTENDED_KEY_USAGE @@ -343,10 +353,12 @@ class ExtendedKeyUsage(object): return not self == other +@utils.register_interface(ExtensionType) class OCSPNoCheck(object): oid = OID_OCSP_NO_CHECK +@utils.register_interface(ExtensionType) class BasicConstraints(object): oid = OID_BASIC_CONSTRAINTS @@ -385,6 +397,7 @@ class BasicConstraints(object): return not self == other +@utils.register_interface(ExtensionType) class KeyUsage(object): oid = OID_KEY_USAGE @@ -470,6 +483,7 @@ class KeyUsage(object): return not self == other +@utils.register_interface(ExtensionType) class AuthorityInformationAccess(object): oid = OID_AUTHORITY_INFORMATION_ACCESS @@ -536,6 +550,7 @@ class AccessDescription(object): access_location = utils.read_only_property("_access_location") +@utils.register_interface(ExtensionType) class CertificatePolicies(object): oid = OID_CERTIFICATE_POLICIES @@ -675,6 +690,7 @@ class NoticeReference(object): notice_numbers = utils.read_only_property("_notice_numbers") +@utils.register_interface(ExtensionType) class SubjectKeyIdentifier(object): oid = OID_SUBJECT_KEY_IDENTIFIER @@ -698,6 +714,7 @@ class SubjectKeyIdentifier(object): return not self == other +@utils.register_interface(ExtensionType) class NameConstraints(object): oid = OID_NAME_CONSTRAINTS @@ -764,6 +781,7 @@ class NameConstraints(object): excluded_subtrees = utils.read_only_property("_excluded_subtrees") +@utils.register_interface(ExtensionType) class CRLDistributionPoints(object): oid = OID_CRL_DISTRIBUTION_POINTS @@ -886,6 +904,7 @@ class ReasonFlags(Enum): remove_from_crl = "removeFromCRL" +@utils.register_interface(ExtensionType) class InhibitAnyPolicy(object): oid = OID_INHIBIT_ANY_POLICY @@ -1178,6 +1197,7 @@ class GeneralNames(object): return not self == other +@utils.register_interface(ExtensionType) class SubjectAlternativeName(object): oid = OID_SUBJECT_ALTERNATIVE_NAME @@ -1206,6 +1226,7 @@ class SubjectAlternativeName(object): return not self == other +@utils.register_interface(ExtensionType) class IssuerAlternativeName(object): oid = OID_ISSUER_ALTERNATIVE_NAME @@ -1234,6 +1255,7 @@ class IssuerAlternativeName(object): return not self == other +@utils.register_interface(ExtensionType) class AuthorityKeyIdentifier(object): oid = OID_AUTHORITY_KEY_IDENTIFIER -- cgit v1.2.3 From b33de936180bd5fe827fea52fecaf74c35daf150 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Thu, 6 Aug 2015 23:41:05 +0100 Subject: update oid attribute docs to say which OID it will return also doc a missing OID --- docs/x509/reference.rst | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/docs/x509/reference.rst b/docs/x509/reference.rst index 2f997ae2..eb90bc47 100644 --- a/docs/x509/reference.rst +++ b/docs/x509/reference.rst @@ -922,8 +922,7 @@ X.509 Extensions The key usage extension defines the purpose of the key contained in the certificate. The usage restriction might be employed when a key that could - be used for more than one operation is to be restricted. It corresponds to - :data:`OID_KEY_USAGE`. + be used for more than one operation is to be restricted. .. attribute:: oid @@ -931,7 +930,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_KEY_USAGE`. .. attribute:: digital_signature @@ -1022,8 +1021,7 @@ X.509 Extensions Basic constraints is an X.509 extension type that defines whether a given certificate is allowed to sign additional certificates and what path - length restrictions may exist. It corresponds to - :data:`OID_BASIC_CONSTRAINTS`. + length restrictions may exist. .. attribute:: oid @@ -1031,7 +1029,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_BASIC_CONSTRAINTS`. .. attribute:: ca @@ -1067,7 +1065,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_EXTENDED_KEY_USAGE`. .. class:: OCSPNoCheck @@ -1106,7 +1104,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_NAME_CONSTRAINTS`. .. attribute:: permitted_subtrees @@ -1141,7 +1139,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_AUTHORITY_KEY_IDENTIFIER`. .. attribute:: key_identifier @@ -1175,7 +1173,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_SUBJECT_KEY_IDENTIFIER`. .. attribute:: digest @@ -1198,7 +1196,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_SUBJECT_ALTERNATIVE_NAME`. .. method:: get_values_for_type(type) @@ -1236,7 +1234,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_ISSUER_ALTERNATIVE_NAME`. .. method:: get_values_for_type(type) @@ -1262,7 +1260,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_AUTHORITY_INFORMATION_ACCESS`. .. class:: AccessDescription @@ -1300,7 +1298,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_CRL_DISTRIBUTION_POINTS`. .. class:: DistributionPoint @@ -1406,7 +1404,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_INHIBIT_ANY_POLICY`. .. attribute:: skip_certs @@ -1425,7 +1423,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_CERTIFICATE_POLICIES`. Certificate Policies Classes ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -1780,6 +1778,11 @@ Extension OIDs Corresponds to the dotted string ``"1.3.6.1.5.5.7.1.1"``. The identifier for the :class:`AuthorityInformationAccess` extension type. +.. data:: OID_INHIBIT_ANY_POLICY + + Corresponds to the dotted string ``"2.5.29.54"``. The identifier + for the :class:`InhibitAnyPolicy` extension type. + .. data:: OID_OCSP_NO_CHECK Corresponds to the dotted string ``"1.3.6.1.5.5.7.48.1.5"``. The identifier -- cgit v1.2.3 From 3cee872d4222359b966e526f1e52afbcf81724d6 Mon Sep 17 00:00:00 2001 From: Paul Kehrer Date: Fri, 7 Aug 2015 13:47:28 -0500 Subject: fix missed change for OID docs --- docs/x509/reference.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/x509/reference.rst b/docs/x509/reference.rst index eb90bc47..baf8b1e5 100644 --- a/docs/x509/reference.rst +++ b/docs/x509/reference.rst @@ -1087,7 +1087,7 @@ X.509 Extensions :type: :class:`ObjectIdentifier` - The OID associated with this extension type. + Returns :data:`OID_OCSP_NO_CHECK`. .. class:: NameConstraints -- cgit v1.2.3