Add support for custom extension subclasses

[ralphje]

Implementing custom extensions for certificates (and CRLs for that matter) on top of the ASN.1 parsing mechanism is being preferred over implementing native support for them in cryptography's souce code (see #15379 for a related discussion and the initial suggestion for this issue).

Currently, writing and using custom extensions is tedious, as the extension can only be retrieved by using get_extension_for_oid, then the attribute UnrecognizedExtension.value must be inspected, then ran through asn1.decode_der and then the parsed value can be acted upon. This is less type-safe and more tedious than for built-in extensions, where get_extension_for_class works automatically and in a type-safe way.

It would be very helpful if cryptography was able to provide some pluggable way of using custom extension classes. A nice way to start could probably be something like extending get_extension_for_class to accept custom Extension subclasses. Perhaps something like:

class PolicyMappings(CustomExtension):
    oid = ExtensionOID.POLICY_MAPPINGS
    _value: list[PolicyMapping]  # the parsed ASN.1 value

    __len__, __iter__, __getitem__ = _make_sequence_methods("_value")

cert.extensions.get_extension_for_class(PolicyMappings)

Perhaps it would also be possible to inject custom Extension subclasses into the iterations of the Extensions object, so that get_extension_by_oid and iter() also work in the same way with custom extensions, instead of having to route through UnrecognizedExtension.

[kayveonares26]

Currently unknown oids are always wrapped as UnrecognizedExtension before the user can call get_extension_for_oid then inspect .value and run asn1.decode_der so extending get_extension_for_class alone won't make the PolicyMappings subclass appear in iter() or get_extension_by_oid.

[alex]

Making get_extension_for_class work should be straight forward. I don't see a good pattern for making iter() work though.

Something like the following should be easy enough

@asn1.sequence
class PolicyMapping:
    issuer_domain_policy: ObjectIdentifier
    subject_domain_policy: ObjectIdentifier

class PolicyMappings(x509.CustomExtensionType[list[PolicyMapping]]):
    oid = ExtensionOID.POLICY_MAPPINGS

ext = cert.extensions.get_extension_for_class(PolicyMappings)
ext.value.value  # list[PolicyMapping]

Other other option would be giving UnknownExtension a parse() method that takes an ASN.1 type, so you could do cert.extensions.get_extension_for_oid(POLICY_MAPPINGS).value.parse(PolicyMapping).