add eq/ne support to NameConstraints
diff --git a/src/cryptography/x509.py b/src/cryptography/x509.py
index 4dbe3da..1d705e7 100644
--- a/src/cryptography/x509.py
+++ b/src/cryptography/x509.py
@@ -709,6 +709,18 @@
self._permitted_subtrees = permitted_subtrees
self._excluded_subtrees = excluded_subtrees
+ def __eq__(self, other):
+ if not isinstance(other, NameConstraints):
+ return NotImplemented
+
+ return (
+ self.excluded_subtrees == other.excluded_subtrees and
+ self.permitted_subtrees == other.permitted_subtrees
+ )
+
+ def __ne__(self, other):
+ return not self == other
+
def _validate_ip_name(self, tree):
if any(isinstance(name, IPAddress) and not isinstance(
name.value, (ipaddress.IPv4Network, ipaddress.IPv6Network)
diff --git a/tests/test_x509_ext.py b/tests/test_x509_ext.py
index a5747c3..cacc057 100644
--- a/tests/test_x509_ext.py
+++ b/tests/test_x509_ext.py
@@ -1972,6 +1972,35 @@
", <DNSName(value=name2.local)>], excluded_subtrees=None)>"
)
+ def test_eq(self):
+ nc = x509.NameConstraints(
+ permitted_subtrees=[x509.DNSName(u"name.local")],
+ excluded_subtrees=[x509.DNSName(u"name2.local")]
+ )
+ nc2 = x509.NameConstraints(
+ permitted_subtrees=[x509.DNSName(u"name.local")],
+ excluded_subtrees=[x509.DNSName(u"name2.local")]
+ )
+ assert nc == nc2
+
+ def test_ne(self):
+ nc = x509.NameConstraints(
+ permitted_subtrees=[x509.DNSName(u"name.local")],
+ excluded_subtrees=[x509.DNSName(u"name2.local")]
+ )
+ nc2 = x509.NameConstraints(
+ permitted_subtrees=[x509.DNSName(u"name.local")],
+ excluded_subtrees=None
+ )
+ nc3 = x509.NameConstraints(
+ permitted_subtrees=None,
+ excluded_subtrees=[x509.DNSName(u"name2.local")]
+ )
+
+ assert nc != nc2
+ assert nc != nc3
+ assert nc != object()
+
class TestDistributionPoint(object):
def test_distribution_point_full_name_not_general_names(self):