add eq/ne support to NameConstraints

2 files changed, 41 insertions, 0 deletions

diff --git a/src/cryptography/x509.py b/src/cryptography/x509.py
index 4dbe3da1..1d705e70 100644
--- a/src/cryptography/x509.py
+++ b/src/cryptography/x509.py
@@ -709,6 +709,18 @@ class NameConstraints(object):
         self._permitted_subtrees = permitted_subtrees
         self._excluded_subtrees = excluded_subtrees
 
+    def __eq__(self, other):
+        if not isinstance(other, NameConstraints):
+            return NotImplemented
+
+        return (
+            self.excluded_subtrees == other.excluded_subtrees and
+            self.permitted_subtrees == other.permitted_subtrees
+        )
+
+    def __ne__(self, other):
+        return not self == other
+
     def _validate_ip_name(self, tree):
         if any(isinstance(name, IPAddress) and not isinstance(
             name.value, (ipaddress.IPv4Network, ipaddress.IPv6Network)
diff --git a/tests/test_x509_ext.py b/tests/test_x509_ext.py
index a5747c37..cacc0573 100644
--- a/tests/test_x509_ext.py
+++ b/tests/test_x509_ext.py
@@ -1972,6 +1972,35 @@ class TestNameConstraints(object):
             ", <DNSName(value=name2.local)>], excluded_subtrees=None)>"
         )
 
+    def test_eq(self):
+        nc = x509.NameConstraints(
+            permitted_subtrees=[x509.DNSName(u"name.local")],
+            excluded_subtrees=[x509.DNSName(u"name2.local")]
+        )
+        nc2 = x509.NameConstraints(
+            permitted_subtrees=[x509.DNSName(u"name.local")],
+            excluded_subtrees=[x509.DNSName(u"name2.local")]
+        )
+        assert nc == nc2
+
+    def test_ne(self):
+        nc = x509.NameConstraints(
+            permitted_subtrees=[x509.DNSName(u"name.local")],
+            excluded_subtrees=[x509.DNSName(u"name2.local")]
+        )
+        nc2 = x509.NameConstraints(
+            permitted_subtrees=[x509.DNSName(u"name.local")],
+            excluded_subtrees=None
+        )
+        nc3 = x509.NameConstraints(
+            permitted_subtrees=None,
+            excluded_subtrees=[x509.DNSName(u"name2.local")]
+        )
+
+        assert nc != nc2
+        assert nc != nc3
+        assert nc != object()
+
 
 class TestDistributionPoint(object):
     def test_distribution_point_full_name_not_general_names(self):