Decode certificate policies

Decode certificate policies

[ekasper, 2014-01-07 14:50:58]

Policies are used to check EV, see

https://code.google.com/p/chromium/codesearch#chromium/src/net/cert/ev_root_c...

[Ben Laurie (Google), 2014-01-07 16:48:52]

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/asn1/...
File src/python/ct/crypto/asn1/x509_extension.py (right):

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/asn1/...
src/python/ct/crypto/asn1/x509_extension.py:82: class
NoticeNumbers(types.SequenceOf):
Where do these things come from? Might be useful to reference RFCs for each
extension? Does everything in this file come from RFC 2459?

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/cert.py
File src/python/ct/crypto/cert.py (right):

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/cert....
src/python/ct/crypto/cert.py:554: oid.ID_CE_CERTIFICATE_POLICIES)
Should be _get_decoded_extension_values?

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/cert....
src/python/ct/crypto/cert.py:555: return policies or []
surely if policies is falsey it is already []? (Assuming the correction above).

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/cert....
src/python/ct/crypto/cert.py:567: oid.ID_CE_CERTIFICATE_POLICIES)
Again, should be values?

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/cert_...
File src/python/ct/crypto/cert_test.py (right):

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/cert_...
src/python/ct/crypto/cert_test.py:489: def test_policies(self):
Add test for more than one policy?

[ekasper, 2014-01-07 17:25:15]

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/asn1/...
File src/python/ct/crypto/asn1/x509_extension.py (right):

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/asn1/...
src/python/ct/crypto/asn1/x509_extension.py:82: class
NoticeNumbers(types.SequenceOf):
On 2014/01/07 16:48:52, Ben Laurie (Google) wrote:
> Where do these things come from? Might be useful to reference RFCs for each
> extension? Does everything in this file come from RFC 2459?

RFC5280, but yes. Added a comment to the top.

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/cert.py
File src/python/ct/crypto/cert.py (right):

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/cert....
src/python/ct/crypto/cert.py:554: oid.ID_CE_CERTIFICATE_POLICIES)
On 2014/01/07 16:48:52, Ben Laurie (Google) wrote:
> Should be _get_decoded_extension_values?

No, singular. CertificatePolicies is a single extension value containing a list
of policies.

Multiple extension values are forbidden by the RFC, only tolerated in non-strict
mode and generally, trigger an exception when you try to inspect the extension
value.

The exception is SANs where, in non-strict mode, we currently return a
concatenation of all listed names. This seemed helpful for monitoring but if the
inconsistency is confusing then we should probably raise there, too.

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/cert....
src/python/ct/crypto/cert.py:555: return policies or []
On 2014/01/07 16:48:52, Ben Laurie (Google) wrote:
> surely if policies is falsey it is already []? (Assuming the correction
above).

This is a None -> [] conversion.

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/cert....
src/python/ct/crypto/cert.py:567: oid.ID_CE_CERTIFICATE_POLICIES)
On 2014/01/07 16:48:52, Ben Laurie (Google) wrote:
> Again, should be values?

See above. Simplified a bit to use policies() here directly.

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/cert_...
File src/python/ct/crypto/cert_test.py (right):

https://codereview.appspot.com/47920044/diff/20001/src/python/ct/crypto/cert_...
src/python/ct/crypto/cert_test.py:489: def test_policies(self):
On 2014/01/07 16:48:52, Ben Laurie (Google) wrote:
> Add test for more than one policy?

Done.

[Ben Laurie (Google), 2014-01-07 18:07:26]

LGTM.

https://codereview.appspot.com/47920044/diff/40001/src/python/ct/crypto/cert.py
File src/python/ct/crypto/cert.py (right):

https://codereview.appspot.com/47920044/diff/40001/src/python/ct/crypto/cert....
src/python/ct/crypto/cert.py:591: return True if self.policy(policy_oid) is not
None else False
return self.policy(policy_oid) is not None?