X509 Verification Custom Extension Policies

[deivse]

Sorry for the very long wait, I know a lot of folks are interested in these features.
The PR is still a bit rough around the edges, and I definitely don't expect the coverage to be 100%, but I decided it's best to get it out there in some form, so I can get some feedback sooner rather than later (especially since this is my first time writing anything relatively major in Rust).

[deivse]

PS: This is based on the branch with docs changes that I created before, I don't want if we want to keep it like that, so everything is in here, or if we want to keep it split so that the conversations in the previous PR (#11800) don't become forgotten

[alex]

Almost certainly we'll want to split it up, but @reaperhulk and I will take a look this week and we can try to suggest some ways to split it up! Thanks for your work on this.

…

On Wed, Jan 29, 2025 at 9:33 AM Ivan Desiatov ***@***.***> wrote: PS: This is based on the branch with docs changes that I created before, I don't want if we want to keep it like that, so everything is in here, or if we want to keep it split so that the conversations in the previous PR ( #11800 <#11800>) don't become forgotten — Reply to this email directly, view it on GitHub <#12360 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBAEOHP3ELNOSBU7LVD2NDRFBAVCNFSM6AAAAABWC77U42VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMMRRHAZDIMJWG4> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

-- All that is necessary for evil to succeed is for good people to do nothing.

[deivse]

Yeah definitely, I expected that. I think we discussed it before and decided that I should just make a big PR first and you guys can help decide how to break it up.

[reaperhulk]

Good timing as we’re sprinting a bit on cryptography in the upcoming week 😄

[alex]

Ok, @reaperhulk and I have given this an initial pass. I think there's probably a bunch of places we didn't review in enough depth, so this probably will not be the end of the comments :-)

I wanted to provide a few ideas for pieces that should be easy-ish to split into their own PRs:

• Policy object + attributing moving
• ExtensionsPolicy builder Python API
• Rust Extension policy refactor

[deivse]

• Policy object + attributing moving

By this you mean the PyPolicy struct and the change to ClientVerifier and ServerVerifier where the attributes are now accessible via the policy field?

[alex]

Yes, exactly that! Thanks again for all your work on this.

[deivse]

Hi, just fyi, I still haven't abandoned this, but I did get sick 😅
Still, I'm hoping to get everything merged by the end of next week, and will try to push the next PR in the coming days depending on how I will be feeling.

[alex]

Get well soon!

…

On Fri, Feb 7, 2025 at 7:31 AM Ivan Desiatov ***@***.***> wrote: Hi, just fyi, I still haven't abandoned this, but I did get sick 😅 Still, I'm hoping to get everything merged by the end of next week, and will try to push the next PR in the coming days depending on how I will be feeling. — Reply to this email directly, view it on GitHub <#12360 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBH6NEQBOOELR3FUSGL2OSRQVAVCNFSM6AAAAABWC77U42VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMNBSG44TGOBRHA> . You are receiving this because you commented.Message ID: ***@***.***>

-- All that is necessary for evil to succeed is for good people to do nothing.

[deivse]

I will close this now since all the conversations have been addressed, and everything else will be addressed in the smaller PRs.