implement __hash__ on KeyUsage and ExtendedKeyUsage (#3913)

* implement __hash__ on KeyUsage and ExtendedKeyUsage

* properly use private values and alter test to catch that bug

2 files changed, 60 insertions, 0 deletions

diff --git a/src/cryptography/x509/extensions.py b/src/cryptography/x509/extensions.py
index 9d6b3e79..f6957b9d 100644
--- a/src/cryptography/x509/extensions.py
+++ b/src/cryptography/x509/extensions.py
@@ -755,6 +755,9 @@ class ExtendedKeyUsage(object):
     def __ne__(self, other):
         return not self == other
 
+    def __hash__(self):
+        return hash(tuple(self._usages))
+
 
 @utils.register_interface(ExtensionType)
 class OCSPNoCheck(object):
@@ -933,6 +936,15 @@ class KeyUsage(object):
     def __ne__(self, other):
         return not self == other
 
+    def __hash__(self):
+        return hash((
+            self.digital_signature, self.content_commitment,
+            self.key_encipherment, self.data_encipherment,
+            self.key_agreement, self.key_cert_sign,
+            self.crl_sign, self._encipher_only,
+            self._decipher_only
+        ))
+
 
 @utils.register_interface(ExtensionType)
 class NameConstraints(object):
diff --git a/tests/x509/test_x509_ext.py b/tests/x509/test_x509_ext.py
index 8d13753d..62ce9050 100644
--- a/tests/x509/test_x509_ext.py
+++ b/tests/x509/test_x509_ext.py
@@ -896,6 +896,43 @@ class TestKeyUsage(object):
         assert ku != ku2
         assert ku != object()
 
+    def test_hash(self):
+        ku = x509.KeyUsage(
+            digital_signature=False,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=True,
+            key_cert_sign=False,
+            crl_sign=False,
+            encipher_only=False,
+            decipher_only=True
+        )
+        ku2 = x509.KeyUsage(
+            digital_signature=False,
+            content_commitment=False,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=True,
+            key_cert_sign=False,
+            crl_sign=False,
+            encipher_only=False,
+            decipher_only=True
+        )
+        ku3 = x509.KeyUsage(
+            digital_signature=False,
+            content_commitment=True,
+            key_encipherment=False,
+            data_encipherment=False,
+            key_agreement=False,
+            key_cert_sign=False,
+            crl_sign=False,
+            encipher_only=False,
+            decipher_only=False
+        )
+        assert hash(ku) == hash(ku2)
+        assert hash(ku) != hash(ku3)
+
 
 class TestSubjectKeyIdentifier(object):
     def test_properties(self):
@@ -1177,6 +1214,17 @@ class TestExtendedKeyUsage(object):
         assert eku != eku2
         assert eku != object()
 
+    def test_hash(self):
+        eku = x509.ExtendedKeyUsage([
+            x509.ObjectIdentifier("1.3.6"), x509.ObjectIdentifier("1.3.7")
+        ])
+        eku2 = x509.ExtendedKeyUsage([
+            x509.ObjectIdentifier("1.3.6"), x509.ObjectIdentifier("1.3.7")
+        ])
+        eku3 = x509.ExtendedKeyUsage([x509.ObjectIdentifier("1.3.6")])
+        assert hash(eku) == hash(eku2)
+        assert hash(eku) != hash(eku3)
+
 
 @pytest.mark.requires_backend_interface(interface=RSABackend)
 @pytest.mark.requires_backend_interface(interface=X509Backend)