Skip to content

Commit f2068f1

Browse files
authored
Deprecate X509Extension (#1255)
1 parent 35d1e87 commit f2068f1

File tree

4 files changed

+31
-10
lines changed

4 files changed

+31
-10
lines changed

CHANGELOG.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ Deprecations:
2525
- Deprecated ``OpenSSL.crypto.Revoked``
2626
- Deprecated ``OpenSSL.crypto.load_crl`` and ``OpenSSL.crypto.dump_crl``
2727
- Deprecated ``OpenSSL.crypto.sign`` and ``OpenSSL.crypto.verify``
28+
- Deprecated ``OpenSSL.crypto.X509Extension``
2829

2930
Changes:
3031
^^^^^^^^

src/OpenSSL/crypto.py

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -941,6 +941,19 @@ def get_data(self) -> bytes:
941941
return _ffi.buffer(char_result, result_length)[:]
942942

943943

944+
_X509ExtensionInternal = X509Extension
945+
utils.deprecated(
946+
X509Extension,
947+
__name__,
948+
(
949+
"X509Extension support in pyOpenSSL is deprecated. You should use the "
950+
"APIs in cryptography."
951+
),
952+
DeprecationWarning,
953+
name="X509Extension",
954+
)
955+
956+
944957
class X509Req:
945958
"""
946959
An X.509 certificate signing requests.
@@ -1063,7 +1076,9 @@ def get_subject(self) -> X509Name:
10631076

10641077
return name
10651078

1066-
def add_extensions(self, extensions: Iterable[X509Extension]) -> None:
1079+
def add_extensions(
1080+
self, extensions: Iterable[_X509ExtensionInternal]
1081+
) -> None:
10671082
"""
10681083
Add extensions to the certificate signing request.
10691084
@@ -1077,7 +1092,7 @@ def add_extensions(self, extensions: Iterable[X509Extension]) -> None:
10771092
stack = _ffi.gc(stack, _lib.sk_X509_EXTENSION_free)
10781093

10791094
for ext in extensions:
1080-
if not isinstance(ext, X509Extension):
1095+
if not isinstance(ext, _X509ExtensionInternal):
10811096
raise ValueError("One of the elements is not an X509Extension")
10821097

10831098
# TODO push can fail (here and elsewhere)
@@ -1086,7 +1101,7 @@ def add_extensions(self, extensions: Iterable[X509Extension]) -> None:
10861101
add_result = _lib.X509_REQ_add_extensions(self._req, stack)
10871102
_openssl_assert(add_result == 1)
10881103

1089-
def get_extensions(self) -> List[X509Extension]:
1104+
def get_extensions(self) -> List[_X509ExtensionInternal]:
10901105
"""
10911106
Get X.509 extensions in the certificate signing request.
10921107
@@ -1106,7 +1121,7 @@ def get_extensions(self) -> List[X509Extension]:
11061121
)
11071122

11081123
for i in range(_lib.sk_X509_EXTENSION_num(native_exts_obj)):
1109-
ext = X509Extension.__new__(X509Extension)
1124+
ext = _X509ExtensionInternal.__new__(_X509ExtensionInternal)
11101125
extension = _lib.X509_EXTENSION_dup(
11111126
_lib.sk_X509_EXTENSION_value(native_exts_obj, i)
11121127
)
@@ -1600,7 +1615,9 @@ def get_extension_count(self) -> int:
16001615
"""
16011616
return _lib.X509_get_ext_count(self._x509)
16021617

1603-
def add_extensions(self, extensions: Iterable[X509Extension]) -> None:
1618+
def add_extensions(
1619+
self, extensions: Iterable[_X509ExtensionInternal]
1620+
) -> None:
16041621
"""
16051622
Add extensions to the certificate.
16061623
@@ -1609,14 +1626,14 @@ def add_extensions(self, extensions: Iterable[X509Extension]) -> None:
16091626
:return: ``None``
16101627
"""
16111628
for ext in extensions:
1612-
if not isinstance(ext, X509Extension):
1629+
if not isinstance(ext, _X509ExtensionInternal):
16131630
raise ValueError("One of the elements is not an X509Extension")
16141631

16151632
add_result = _lib.X509_add_ext(self._x509, ext._extension, -1)
16161633
if not add_result:
16171634
_raise_current_error()
16181635

1619-
def get_extension(self, index: int) -> X509Extension:
1636+
def get_extension(self, index: int) -> _X509ExtensionInternal:
16201637
"""
16211638
Get a specific extension of the certificate by index.
16221639
@@ -1630,7 +1647,7 @@ def get_extension(self, index: int) -> X509Extension:
16301647
16311648
.. versionadded:: 0.12
16321649
"""
1633-
ext = X509Extension.__new__(X509Extension)
1650+
ext = _X509ExtensionInternal.__new__(_X509ExtensionInternal)
16341651
ext._extension = _lib.X509_get_ext(self._x509, index)
16351652
if ext._extension == _ffi.NULL:
16361653
raise IndexError("extension index out of bounds")

tests/test_crypto.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
X509,
2828
Error,
2929
PKey,
30-
X509Extension,
3130
X509Name,
3231
X509Req,
3332
X509Store,
@@ -54,6 +53,7 @@
5453
PKCS12,
5554
NetscapeSPKI,
5655
Revoked,
56+
X509Extension,
5757
dump_crl,
5858
load_crl,
5959
)

tests/test_ssl.py

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,17 @@
4949
TYPE_RSA,
5050
X509,
5151
PKey,
52-
X509Extension,
5352
X509Store,
5453
dump_certificate,
5554
dump_privatekey,
5655
get_elliptic_curves,
5756
load_certificate,
5857
load_privatekey,
5958
)
59+
60+
with pytest.warns(DeprecationWarning):
61+
from OpenSSL.crypto import X509Extension
62+
6063
from OpenSSL.SSL import (
6164
DTLS_METHOD,
6265
MODE_RELEASE_BUFFERS,

0 commit comments

Comments
 (0)