Repository: pyca/cryptography

Issue:
Add method to check if cert is in CRL?
Hi,

I am using `cryptography` to check certificates against CRLs, to see if they are revoked, and I find the current CRL implementation a little lacking. To check if a certificate is revoked, I have to retrieve all the `RevokedCertificate` from the `CertificateRevocationList` and see if any of them has the same serial as the certificate in question (if there's a better way, please let me know!). This is time consuming on big CRLs.

I have played around with `X509_CRL_get0_by_serial()` and `X509_CRL_get0_by_cert()` from OpenSSL, and have found them to drastically improve performance.

So, what do you think about adding a function to `CertificateRevocationList` that checks if a specified certificate is in the CRL? I'm thinking `is_certificate_revoked` or `get_revoked_certificate` which can return a `RevokedCertificate`.

Thanks for making cryptography!


Discussion:
`get_revoked_certificate` sounds like a good method to add. So it would return `None` or an instance of `RevokedCertificate` corresponding to the serial number provided? I don't see a reason to require users to pass an entire `Certificate` object for this purpose.

Resolving patch:
diff --git a/src/_cffi_src/openssl/x509.py b/src/_cffi_src/openssl/x509.py
--- a/src/_cffi_src/openssl/x509.py
+++ b/src/_cffi_src/openssl/x509.py
@@ -238,6 +238,8 @@
 X509_EXTENSION *X509_CRL_get_ext(X509_CRL *, int);
 int X509_CRL_get_ext_count(X509_CRL *);
 
+int X509_CRL_get0_by_serial(X509_CRL *, X509_REVOKED **, ASN1_INTEGER *);
+
 /* these CRYPTO_EX_DATA functions became macros in 1.1.0 */
 int X509_get_ex_new_index(long, void *, CRYPTO_EX_new *, CRYPTO_EX_dup *,
                           CRYPTO_EX_free *);
diff --git a/src/cryptography/hazmat/backends/openssl/x509.py b/src/cryptography/hazmat/backends/openssl/x509.py
--- a/src/cryptography/hazmat/backends/openssl/x509.py
+++ b/src/cryptography/hazmat/backends/openssl/x509.py
@@ -16,6 +16,9 @@
     _REVOKED_CERTIFICATE_EXTENSION_PARSER, _asn1_integer_to_int,
     _asn1_string_to_bytes, _decode_x509_name, _obj2txt, _parse_asn1_time
 )
+from cryptography.hazmat.backends.openssl.encode_asn1 import (
+    _encode_asn1_int_gc
+)
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import dsa, ec, rsa
 
@@ -235,6 +238,22 @@ def fingerprint(self, algorithm):
         h.update(der)
         return h.finalize()
 
+    def get_revoked_certificate_by_serial_number(self, serial_number):
+        revoked = self._backend._ffi.new("X509_REVOKED **")
+        asn1_int = _encode_asn1_int_gc(self._backend, serial_number)
+        res = self._backend._lib.X509_CRL_get0_by_serial(
+            self._x509_crl, revoked, asn1_int
+        )
+        if res == 0:
+            return None
+        else:
+            self._backend.openssl_assert(
+                revoked[0] != self._backend._ffi.NULL
+            )
+            return _RevokedCertificate(
+                self._backend, self._x509_crl, revoked[0]
+            )
+
     @property
     def signature_hash_algorithm(self):
         oid = self.signature_algorithm_oid
diff --git a/src/cryptography/x509/base.py b/src/cryptography/x509/base.py
--- a/src/cryptography/x509/base.py
+++ b/src/cryptography/x509/base.py
@@ -189,6 +189,13 @@ def fingerprint(self, algorithm):
         Returns bytes using digest passed.
         """
 
+    @abc.abstractmethod
+    def get_revoked_certificate_by_serial_number(self, serial_number):
+        """
+        Returns an instance of RevokedCertificate or None if the serial_number
+        is not in the CRL.
+        """
+
     @abc.abstractproperty
     def signature_hash_algorithm(self):
         """


Test patch:
diff --git a/tests/x509/test_x509.py b/tests/x509/test_x509.py
--- a/tests/x509/test_x509.py
+++ b/tests/x509/test_x509.py
@@ -181,6 +181,18 @@ def test_revoked_cert_retrieval(self, backend):
         # Check that len() works for CRLs.
         assert len(crl) == 12
 
+    def test_get_revoked_certificate_by_serial_number(self, backend):
+        crl = _load_cert(
+            os.path.join(
+                "x509", "PKITS_data", "crls", "LongSerialNumberCACRL.crl"),
+            x509.load_der_x509_crl,
+            backend
+        )
+        serial_number = 725064303890588110203033396814564464046290047507
+        revoked = crl.get_revoked_certificate_by_serial_number(serial_number)
+        assert revoked.serial_number == serial_number
+        assert crl.get_revoked_certificate_by_serial_number(500) is None
+
     def test_revoked_cert_retrieval_retain_only_revoked(self, backend):
         """
         This test attempts to trigger the crash condition described in