<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Some thoughts inline.</div><p style="color:#000;">On May 11, 2015 at 3:49:20 PM, Erik Trauschke (<a href="mailto:erik.trauschke@gmail.com">erik.trauschke@gmail.com</a>) wrote:</p> <div><blockquote type="cite" class="clean_bq" style="color: rgb(0, 0, 0); font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><div><div></div><div>Hi all,<span class="Apple-converted-space"> </span><br><br>I'm trying to find a good way to model the extensions for the Revoked<span class="Apple-converted-space"> </span><br>object (crl_reason, crl_issuer, invalidity_date) into the current<span class="Apple-converted-space"> </span><br>interface.<span class="Apple-converted-space"> </span><br>Currently it seems we already have a lot of layers you'd have to<span class="Apple-converted-space"> </span><br>unwrap to get to an actual extension value and I don't think we want<span class="Apple-converted-space"> </span><br>to have an object abstraction for every single thing the x509 standard<span class="Apple-converted-space"> </span><br>supports.<span class="Apple-converted-space"> </span><br><br>So I was thinking of returning the crl_reason directly:<span class="Apple-converted-space"> </span><br>if code == 1:<span class="Apple-converted-space"> </span><br>return ReasonFlags.key_compromise<span class="Apple-converted-space"> </span><br>...<span class="Apple-converted-space"> </span><br><br>(I'm still thinking we should have the numerical value in there<span class="Apple-converted-space"> </span><br>somewhere. Right now, if someone writes code using this interface<span class="Apple-converted-space"> </span><br>she'd have to test against a string representation. If someone ever<span class="Apple-converted-space"> </span><br>changes these strings in cryptography, this code will break. Also,<span class="Apple-converted-space"> </span><br>someone would have to look up what the string representation in<span class="Apple-converted-space"> </span><br>cryptography actually is because it's not exactly the same as in the<span class="Apple-converted-space"> </span><br>RFC.)<span class="Apple-converted-space"> </span></div></div></span></blockquote></div><p>Why couldn't we just assert that all comparisons must be done using the enum? Even if we change the "value" in the enum (which would be an API break so we're more likely to create a new object and deprecate the old one if that is ever required) you can still do an identity check using the enum:</p><p>for revoked in crl:</p><p><span class="Apple-tab-span" style="white-space:pre"> </span>if revoked.code is x509.ReasonFlags.key_compromise:</p><p><span class="Apple-tab-span" style="white-space:pre"> </span>print("{} is revoked due to key compromise".format(revoked.serial_number))</p><p><br></p><div><div><blockquote type="cite" class="clean_bq" style="color: rgb(0, 0, 0); font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><div><div><br><br>The invalidity date returns just a datetime object, like other date functions.<span class="Apple-converted-space"> </span><br><br>For the crl_issuer (which is of type GENERAL_NAMES) I was thinking of<span class="Apple-converted-space"> </span><br>renaming x509.SubjectAlternativeName() to x509.GeneralNames and make<span class="Apple-converted-space"> </span><br>it multi-use. To be honest, the SubjectAlternativeName() doesn't do<span class="Apple-converted-space"> </span><br>anything specific which wouldn't be appropriate for any other usage.<span class="Apple-converted-space"> </span><br>So I think we could just have one class representing multiple general<span class="Apple-converted-space"> </span><br>names.<span class="Apple-converted-space"> </span></div></div></span></blockquote></div><p>We've been representing GENERAL_NAMES (outside of SAN obviously) as a list of objects with the GeneralName interface, but this might be a reasonable approach. My primary concern is with documentation, but if the class becomes a GeneralNames class we could still have a SAN section that says it is an instance of GeneralNames. Interested in other opinions here too.</p><div><blockquote type="cite" class="clean_bq" style="color: rgb(0, 0, 0); font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><div><div><br><br>Let me know if you think that's a good idea.<span class="Apple-converted-space"> </span><br><br>Erik<span class="Apple-converted-space"> </span><br><br>On Mon, May 11, 2015 at 12:43 PM, Erik Trauschke<span class="Apple-converted-space"> </span><br><erik.trauschke@gmail.com> wrote:<span class="Apple-converted-space"> </span><br>> Ok, I'll get on that then.<span class="Apple-converted-space"> </span><br>><span class="Apple-converted-space"> </span><br>> Erik<span class="Apple-converted-space"> </span><br>><span class="Apple-converted-space"> </span><br>><span class="Apple-converted-space"> </span><br>> On May 11, 2015 11:50:48 AM PDT, Paul Kehrer <paul.l.kehrer@gmail.com><span class="Apple-converted-space"> </span><br>> wrote:<span class="Apple-converted-space"> </span><br>>><span class="Apple-converted-space"> </span><br>>> If you'd like to create a branch for the CRL work that'd be great. Thanks<span class="Apple-converted-space"> </span><br>>> for your help so far!<span class="Apple-converted-space"> </span><br>>><span class="Apple-converted-space"> </span><br>>> -Paul<span class="Apple-converted-space"> </span><br>>><span class="Apple-converted-space"> </span><br>>> On May 11, 2015 at 12:12:07 PM, Erik Trauschke (erik.trauschke@gmail.com)<span class="Apple-converted-space"> </span><br>>> wrote:<span class="Apple-converted-space"> </span><br>>><span class="Apple-converted-space"> </span><br>>> Hi Paul,<span class="Apple-converted-space"> </span><br>>><span class="Apple-converted-space"> </span><br>>> So I see all the CRLDistributionList extension code got put back. Are<span class="Apple-converted-space"> </span><br>>> you already working on the CRL processing code or do you want me to<span class="Apple-converted-space"> </span><br>>> create my own branch for this and file a pull request?<span class="Apple-converted-space"> </span><br>>><span class="Apple-converted-space"> </span><br>>> Erik<span class="Apple-converted-space"> </span><br>>><span class="Apple-converted-space"> </span><br>>> On Sat, May 9, 2015 at 1:50 PM, André Caron <andre.l.caron@gmail.com><span class="Apple-converted-space"> </span><br>>> wrote:<span class="Apple-converted-space"> </span><br>>> > Hi Erik,<span class="Apple-converted-space"> </span><br>>> ><span class="Apple-converted-space"> </span><br>>> > I update mu pull request to add a basic interface for CRLs. It comes<span class="Apple-converted-space"> </span><br>>> > with<span class="Apple-converted-space"> </span><br>>> > an implementation of the OpenSSL backend for it too.<span class="Apple-converted-space"> </span><br>>> ><span class="Apple-converted-space"> </span><br>>> > I haven't tackled the CRL distribution points extension yet. Since those<span class="Apple-converted-space"> </span><br>>> > interfaces are somewhat independent from mine, I guess Paul's interfaces<span class="Apple-converted-space"> </span><br>>> > can<span class="Apple-converted-space"> </span><br>>> > come independently (obviously, I'll need them at one point to be able to<span class="Apple-converted-space"> </span><br>>> > implement my CA though :-).<span class="Apple-converted-space"> </span><br>>> ><span class="Apple-converted-space"> </span><br>>> > Cheers,<span class="Apple-converted-space"> </span><br>>> ><span class="Apple-converted-space"> </span><br>>> > André<span class="Apple-converted-space"> </span><br>>> ><span class="Apple-converted-space"> </span><br>>> > On Sat, May 9, 2015 at 1:18 AM, Erik Trauschke<span class="Apple-converted-space"> </span><br>>> > <erik.trauschke@gmail.com><span class="Apple-converted-space"> </span><br>>> > wrote:<span class="Apple-converted-space"> </span><br>>> >><span class="Apple-converted-space"> </span><br>>> >> The plan is that Paul puts back his interface definitions for<span class="Apple-converted-space"> </span><br>>> >> CRLDistributionPoints first. Then I can add the OpenSSL backend code<span class="Apple-converted-space"> </span><br>>> >> for that. Next are the interfaces for the CRL object and the OpenSSL<span class="Apple-converted-space"> </span><br>>> >> backend code for it.<span class="Apple-converted-space"> </span><br>>> >> It's interesting that it seems like we have a few people working on<span class="Apple-converted-space"> </span><br>>> >> the same thing at the same time, so i guess we just have to coordinate<span class="Apple-converted-space"> </span><br>>> >> things a bit.<span class="Apple-converted-space"> </span><br>>> >><span class="Apple-converted-space"> </span><br>>> >> Erik<span class="Apple-converted-space"> </span><br>>> >><span class="Apple-converted-space"> </span><br>>> >> On Fri, May 8, 2015 at 9:33 PM, André Caron <andre.l.caron@gmail.com><span class="Apple-converted-space"> </span><br>>> >> wrote:<span class="Apple-converted-space"> </span><br>>> >> > Hi Erik,<span class="Apple-converted-space"> </span><br>>> >> ><span class="Apple-converted-space"> </span><br>>> >> > I've put up a pull request with preliminary support for CA<span class="Apple-converted-space"> </span><br>>> >> > operations.<span class="Apple-converted-space"> </span><br>>> >> > My<span class="Apple-converted-space"> </span><br>>> >> > pull request contains a builder for generating CRLs (but not for<span class="Apple-converted-space"> </span><br>>> >> > reading<span class="Apple-converted-space"> </span><br>>> >> > or<span class="Apple-converted-space"> </span><br>>> >> > processing them).<span class="Apple-converted-space"> </span><br>>> >> ><span class="Apple-converted-space"> </span><br>>> >> > I see your patch contains new interfaces for CRL processing. I hope<span class="Apple-converted-space"> </span><br>>> >> > you<span class="Apple-converted-space"> </span><br>>> >> > can<span class="Apple-converted-space"> </span><br>>> >> > get that patch moving forward with a pull request so that I can base<span class="Apple-converted-space"> </span><br>>> >> > my<span class="Apple-converted-space"> </span><br>>> >> > changes on them!<span class="Apple-converted-space"> </span><br>>> >> ><span class="Apple-converted-space"> </span><br>>> >> > Cheers,<span class="Apple-converted-space"> </span><br>>> >> ><span class="Apple-converted-space"> </span><br>>> >> > André<span class="Apple-converted-space"> </span><br>>> >> ><span class="Apple-converted-space"> </span><br>>> >> > On Thu, May 7, 2015 at 4:19 PM, Erik Trauschke<span class="Apple-converted-space"> </span><br>>> >> > <erik.trauschke@gmail.com><span class="Apple-converted-space"> </span><br>>> >> > wrote:<span class="Apple-converted-space"> </span><br>>> >> >><span class="Apple-converted-space"> </span><br>>> >> >> Hi Paul,<span class="Apple-converted-space"> </span><br>>> >> >><span class="Apple-converted-space"> </span><br>>> >> >> Ok, I'll wait until this goes back. Meanwhile there are a few other<span class="Apple-converted-space"> </span><br>>> >> >> interfaces I need and I'll work on them. I'll also have a look at<span class="Apple-converted-space"> </span><br>>> >> >> how<span class="Apple-converted-space"> </span><br>>> >> >> to create my own branch in github.<span class="Apple-converted-space"> </span><br>>> >> >><span class="Apple-converted-space"> </span><br>>> >> >> Erik<span class="Apple-converted-space"> </span><br>>> >> >><span class="Apple-converted-space"> </span><br>>> >> >> On Thu, May 7, 2015 at 12:05 PM, Paul Kehrer<span class="Apple-converted-space"> </span><br>>> >> >> <paul.l.kehrer@gmail.com><span class="Apple-converted-space"> </span><br>>> >> >> wrote:<span class="Apple-converted-space"> </span><br>>> >> >> > Hi Erik,<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > Thank you for your contribution! Some of your work overlaps with<span class="Apple-converted-space"> </span><br>>> >> >> > the<span class="Apple-converted-space"> </span><br>>> >> >> > interfaces we're currently building<span class="Apple-converted-space"> </span><br>>> >> >> > (https://github.com/pyca/cryptography/pull/1906/), but there is<span class="Apple-converted-space"> </span><br>>> >> >> > implementation work and other interfaces that will be very useful.<span class="Apple-converted-space"> </span><br>>> >> >> > Incidentally, your approach to fullname/relativename is one of the<span class="Apple-converted-space"> </span><br>>> >> >> > discussions underway on that PR right now.<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > The normal way we do contribution and code review is via pull<span class="Apple-converted-space"> </span><br>>> >> >> > requests<span class="Apple-converted-space"> </span><br>>> >> >> > on<span class="Apple-converted-space"> </span><br>>> >> >> > GitHub. You can put your initial work up for discussion by doing<span class="Apple-converted-space"> </span><br>>> >> >> > the<span class="Apple-converted-space"> </span><br>>> >> >> > following:<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > * Fork the project to your own account on github and check it out<span class="Apple-converted-space"> </span><br>>> >> >> > * Branch, commit, and push the branch to your own repository<span class="Apple-converted-space"> </span><br>>> >> >> > * Open a pull request against pyca/cryptography by following these<span class="Apple-converted-space"> </span><br>>> >> >> > instructions<span class="Apple-converted-space"> </span><br>>> >> >> > (https://help.github.com/articles/creating-a-pull-request/)<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > We're also available on freenode in #cryptography-dev to chat any<span class="Apple-converted-space"> </span><br>>> >> >> > time.<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > I personally would say this work should probably wait on merging<span class="Apple-converted-space"> </span><br>>> >> >> > #1906,<span class="Apple-converted-space"> </span><br>>> >> >> > at<span class="Apple-converted-space"> </span><br>>> >> >> > which point we can pull in the CRLDistributionPoints OpenSSL<span class="Apple-converted-space"> </span><br>>> >> >> > implementation,<span class="Apple-converted-space"> </span><br>>> >> >> > then follow that up with a PR for the CRL object, and finally the<span class="Apple-converted-space"> </span><br>>> >> >> > OpenSSL<span class="Apple-converted-space"> </span><br>>> >> >> > implementation of a parser to build the CRL object.<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > -Paul<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > On May 7, 2015 at 12:01:15 PM, Erik Trauschke<span class="Apple-converted-space"> </span><br>>> >> >> > (erik.trauschke@gmail.com)<span class="Apple-converted-space"> </span><br>>> >> >> > wrote:<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > Hi all,<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > For my project I need cryptography to support basic handling of<span class="Apple-converted-space"> </span><br>>> >> >> > CRLs,<span class="Apple-converted-space"> </span><br>>> >> >> > revoked certificates and CRLDistributionPoints.<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > I attached a patch which adds these interfaces, including test<span class="Apple-converted-space"> </span><br>>> >> >> > cases<span class="Apple-converted-space"> </span><br>>> >> >> > for it. I have never provided patches to a github project so I'm<span class="Apple-converted-space"> </span><br>>> >> >> > not<span class="Apple-converted-space"> </span><br>>> >> >> > sure how the process works.<span class="Apple-converted-space"> </span><br>>> >> >> > Do you have a separate place for code reviews (I haven't seen code<span class="Apple-converted-space"> </span><br>>> >> >> > review discussions on this list)?<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > I would appreciate if someone could look at my changes and put<span class="Apple-converted-space"> </span><br>>> >> >> > them<span class="Apple-converted-space"> </span><br>>> >> >> > back to the gate, but let me know if I need to approach this<span class="Apple-converted-space"> </span><br>>> >> >> > differently.<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > Thanks<span class="Apple-converted-space"> </span><br>>> >> >> > Erik<span class="Apple-converted-space"> </span><br>>> >> >> > ________________________________<span class="Apple-converted-space"> </span><br>>> >> >> > _______________________________________________<span class="Apple-converted-space"> </span><br>>> >> >> > Cryptography-dev mailing list<span class="Apple-converted-space"> </span><br>>> >> >> > Cryptography-dev@python.org<span class="Apple-converted-space"> </span><br>>> >> >> > https://mail.python.org/mailman/listinfo/cryptography-dev<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> > _______________________________________________<span class="Apple-converted-space"> </span><br>>> >> >> > Cryptography-dev mailing list<span class="Apple-converted-space"> </span><br>>> >> >> > Cryptography-dev@python.org<span class="Apple-converted-space"> </span><br>>> >> >> > https://mail.python.org/mailman/listinfo/cryptography-dev<span class="Apple-converted-space"> </span><br>>> >> >> ><span class="Apple-converted-space"> </span><br>>> >> >> _______________________________________________<span class="Apple-converted-space"> </span><br>>> >> >> Cryptography-dev mailing list<span class="Apple-converted-space"> </span><br>>> >> >> Cryptography-dev@python.org<span class="Apple-converted-space"> </span><br>>> >> >> https://mail.python.org/mailman/listinfo/cryptography-dev<span class="Apple-converted-space"> </span><br>>> >> ><span class="Apple-converted-space"> </span><br>>> >> ><span class="Apple-converted-space"> </span><br>>> >> ><span class="Apple-converted-space"> </span><br>>> >> > _______________________________________________<span class="Apple-converted-space"> </span><br>>> >> > Cryptography-dev mailing list<span class="Apple-converted-space"> </span><br>>> >> > Cryptography-dev@python.org<span class="Apple-converted-space"> </span><br>>> >> > https://mail.python.org/mailman/listinfo/cryptography-dev<span class="Apple-converted-space"> </span><br>>> >> ><span class="Apple-converted-space"> </span><br>>> >> _______________________________________________<span class="Apple-converted-space"> </span><br>>> >> Cryptography-dev mailing list<span class="Apple-converted-space"> </span><br>>> >> Cryptography-dev@python.org<span class="Apple-converted-space"> </span><br>>> >> https://mail.python.org/mailman/listinfo/cryptography-dev<span class="Apple-converted-space"> </span><br>>> ><span class="Apple-converted-space"> </span><br>>> ><span class="Apple-converted-space"> </span><br>>> ><span class="Apple-converted-space"> </span><br>>> > _______________________________________________<span class="Apple-converted-space"> </span><br>>> > Cryptography-dev mailing list<span class="Apple-converted-space"> </span><br>>> > Cryptography-dev@python.org<span class="Apple-converted-space"> </span><br>>> > https://mail.python.org/mailman/listinfo/cryptography-dev<span class="Apple-converted-space"> </span><br>>> ><span class="Apple-converted-space"> </span><br>>> _______________________________________________<span class="Apple-converted-space"> </span><br>>> Cryptography-dev mailing list<span class="Apple-converted-space"> </span><br>>> Cryptography-dev@python.org<span class="Apple-converted-space"> </span><br>>> https://mail.python.org/mailman/listinfo/cryptography-dev<span class="Apple-converted-space"> </span><br>>><span class="Apple-converted-space"> </span><br>>> ________________________________<span class="Apple-converted-space"> </span><br>>><span class="Apple-converted-space"> </span><br>>> Cryptography-dev mailing list<span class="Apple-converted-space"> </span><br>>> Cryptography-dev@python.org<span class="Apple-converted-space"> </span><br>>> https://mail.python.org/mailman/listinfo/cryptography-dev<span class="Apple-converted-space"> </span><br></div></div></span></blockquote></div></div></body></html>