commit a5f030cebb43d5b378c67d72bc8a0474d1ea846e
author Paul Kehrer <paul.l.kehrer@gmail.com> Tue Apr 28 08:33:18 2015 -0500
committer Paul Kehrer <paul.l.kehrer@gmail.com> Thu Apr 30 08:10:51 2015 -0500
tree f18b17e61716cc5e8b0f2a860647cb63a94216bd
parent a3527ac922e9b75c0fe6c229ca5c2b1c38910abd

add support for ipaddress to general name parsing

src/cryptography/hazmat/backends/openssl/x509.py

diff --git a/src/cryptography/hazmat/backends/openssl/x509.py b/src/cryptography/hazmat/backends/openssl/x509.py
index 3a660d8..23aa95c 100644
--- a/src/cryptography/hazmat/backends/openssl/x509.py
+++ b/src/cryptography/hazmat/backends/openssl/x509.py
@@ -14,6 +14,7 @@
 from __future__ import absolute_import, division, print_function
 
 import datetime
+import ipaddress
 
 import idna
 
@@ -94,6 +95,14 @@
     elif gn.type == backend._lib.GEN_RID:
         oid = _obj2txt(backend, gn.d.registeredID)
         return x509.RegisteredID(x509.ObjectIdentifier(oid))
+    elif gn.type == backend._lib.GEN_IPADD:
+        return x509.IPAddress(
+            ipaddress.ip_address(
+                backend._ffi.buffer(
+                    gn.d.iPAddress.data, gn.d.iPAddress.length
+                )[:]
+            )
+        )
     else:
         # otherName, x400Address or ediPartyName
         raise x509.UnsupportedGeneralNameType(

tests/test_x509_ext.py

diff --git a/tests/test_x509_ext.py b/tests/test_x509_ext.py
index 881dfbf..5c35c97 100644
--- a/tests/test_x509_ext.py
+++ b/tests/test_x509_ext.py
@@ -809,3 +809,25 @@
             u"lo",
             u"http://someregulardomain.com",
         ]
+
+    def test_ipaddress(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "san_ipaddr.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        ext = cert.extensions.get_extension_for_oid(
+            x509.OID_SUBJECT_ALTERNATIVE_NAME
+        )
+        assert ext is not None
+        assert ext.critical is False
+
+        san = ext.value
+
+        ip = san.get_values_for_type(x509.IPAddress)
+        assert [
+            ipaddress.ip_address(u"127.0.0.1"),
+            ipaddress.ip_address(u"ff::")
+        ] == ip