Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.11/site-packages/scapy/layers/x509.py: 84%

1# SPDX-License-Identifier: GPL-2.0-only 

2# This file is part of Scapy 

3# See https://scapy.net/ for more information 

4# Copyright (C) Philippe Biondi <phil@secdev.org> 

5# Acknowledgment: Maxence Tury <maxence.tury@ssi.gouv.fr> 

6 

7# Cool history about this file: http://natisbad.org/scapy/index.html 

8 

9""" 

10X.509 certificates. 

11""" 

12 

13from scapy.asn1.mib import conf # loads conf.mib 

14from scapy.asn1.asn1 import ASN1_Codecs, ASN1_OID, \ 

15 ASN1_IA5_STRING, ASN1_NULL, ASN1_PRINTABLE_STRING, \ 

16 ASN1_UTC_TIME, ASN1_UTF8_STRING 

17from scapy.asn1packet import ASN1_Packet 

18from scapy.asn1fields import ( 

19 ASN1F_BIT_STRING_ENCAPS, 

20 ASN1F_BIT_STRING, 

21 ASN1F_BMP_STRING, 

22 ASN1F_BOOLEAN, 

23 ASN1F_CHOICE, 

24 ASN1F_enum_INTEGER, 

25 ASN1F_ENUMERATED, 

26 ASN1F_field, 

27 ASN1F_FLAGS, 

28 ASN1F_GENERALIZED_TIME, 

29 ASN1F_IA5_STRING, 

30 ASN1F_INTEGER, 

31 ASN1F_ISO646_STRING, 

32 ASN1F_NULL, 

33 ASN1F_OID, 

34 ASN1F_optional, 

35 ASN1F_PACKET, 

36 ASN1F_PRINTABLE_STRING, 

37 ASN1F_SEQUENCE_OF, 

38 ASN1F_SEQUENCE, 

39 ASN1F_SET_OF, 

40 ASN1F_STRING_PacketField, 

41 ASN1F_STRING, 

42 ASN1F_T61_STRING, 

43 ASN1F_UNIVERSAL_STRING, 

44 ASN1F_UTC_TIME, 

45 ASN1F_UTF8_STRING, 

46) 

47from scapy.packet import Packet 

48from scapy.fields import PacketField, MultipleTypeField 

49from scapy.volatile import ZuluTime, GeneralizedTime 

50from scapy.compat import plain_str 

51 

52 

53class ASN1P_OID(ASN1_Packet): 

54 ASN1_codec = ASN1_Codecs.BER 

55 ASN1_root = ASN1F_OID("oid", "0") 

56 

57 

58class ASN1P_INTEGER(ASN1_Packet): 

59 ASN1_codec = ASN1_Codecs.BER 

60 ASN1_root = ASN1F_INTEGER("number", 0) 

61 

62 

63class ASN1P_PRIVSEQ(ASN1_Packet): 

64 # This class gets used in x509.uts 

65 # It showcases the private high-tag decoding capacities of scapy. 

66 ASN1_codec = ASN1_Codecs.BER 

67 ASN1_root = ASN1F_SEQUENCE( 

68 ASN1F_IA5_STRING("str", ""), 

69 ASN1F_STRING("int", 0), 

70 explicit_tag=0, 

71 flexible_tag=True) 

72 

73 

74####################### 

75# RSA packets # 

76####################### 

77# based on RFC 3447 

78 

79# It could be interesting to use os.urandom and try to generate 

80# a new modulus each time RSAPublicKey is called with default values. 

81# (We might have to dig into scapy field initialization mechanisms...) 

82# NEVER rely on the key below, which is provided only for debugging purposes. 

83class RSAPublicKey(ASN1_Packet): 

84 ASN1_codec = ASN1_Codecs.BER 

85 ASN1_root = ASN1F_SEQUENCE( 

86 ASN1F_INTEGER("modulus", 10), 

87 ASN1F_INTEGER("publicExponent", 3)) 

88 

89 

90class RSAOtherPrimeInfo(ASN1_Packet): 

91 ASN1_codec = ASN1_Codecs.BER 

92 ASN1_root = ASN1F_SEQUENCE( 

93 ASN1F_INTEGER("prime", 0), 

94 ASN1F_INTEGER("exponent", 0), 

95 ASN1F_INTEGER("coefficient", 0)) 

96 

97 

98class RSAPrivateKey(ASN1_Packet): 

99 ASN1_codec = ASN1_Codecs.BER 

100 ASN1_root = ASN1F_SEQUENCE( 

101 ASN1F_enum_INTEGER("version", 0, ["two-prime", "multi"]), 

102 ASN1F_INTEGER("modulus", 10), 

103 ASN1F_INTEGER("publicExponent", 3), 

104 ASN1F_INTEGER("privateExponent", 3), 

105 ASN1F_INTEGER("prime1", 2), 

106 ASN1F_INTEGER("prime2", 5), 

107 ASN1F_INTEGER("exponent1", 0), 

108 ASN1F_INTEGER("exponent2", 3), 

109 ASN1F_INTEGER("coefficient", 1), 

110 ASN1F_optional( 

111 ASN1F_SEQUENCE_OF("otherPrimeInfos", None, 

112 RSAOtherPrimeInfo))) 

113 

114#################################### 

115# ECDSA packets # 

116#################################### 

117# based on RFC 3279 & 5480 & 5915 

118 

119 

120class ECFieldID(ASN1_Packet): 

121 # No characteristic-two-field support for now. 

122 ASN1_codec = ASN1_Codecs.BER 

123 ASN1_root = ASN1F_SEQUENCE( 

124 ASN1F_OID("fieldType", "prime-field"), 

125 ASN1F_INTEGER("prime", 0)) 

126 

127 

128class ECCurve(ASN1_Packet): 

129 ASN1_codec = ASN1_Codecs.BER 

130 ASN1_root = ASN1F_SEQUENCE( 

131 ASN1F_STRING("a", ""), 

132 ASN1F_STRING("b", ""), 

133 ASN1F_optional( 

134 ASN1F_BIT_STRING("seed", None))) 

135 

136 

137class ECSpecifiedDomain(ASN1_Packet): 

138 ASN1_codec = ASN1_Codecs.BER 

139 ASN1_root = ASN1F_SEQUENCE( 

140 ASN1F_enum_INTEGER("version", 1, {1: "ecpVer1"}), 

141 ASN1F_PACKET("fieldID", ECFieldID(), ECFieldID), 

142 ASN1F_PACKET("curve", ECCurve(), ECCurve), 

143 ASN1F_STRING("base", ""), 

144 ASN1F_INTEGER("order", 0), 

145 ASN1F_optional( 

146 ASN1F_INTEGER("cofactor", None))) 

147 

148 

149class ECParameters(ASN1_Packet): 

150 ASN1_codec = ASN1_Codecs.BER 

151 ASN1_root = ASN1F_CHOICE("curve", ASN1_OID("ansip384r1"), 

152 ASN1F_OID, # for named curves 

153 ASN1F_NULL, # for implicit curves 

154 ECSpecifiedDomain) 

155 

156 

157class ECDSAPublicKey(ASN1_Packet): 

158 ASN1_codec = ASN1_Codecs.BER 

159 ASN1_root = ASN1F_BIT_STRING("ecPoint", "") 

160 

161 

162class ECDSAPrivateKey(ASN1_Packet): 

163 ASN1_codec = ASN1_Codecs.BER 

164 ASN1_root = ASN1F_SEQUENCE( 

165 ASN1F_enum_INTEGER("version", 1, {1: "ecPrivkeyVer1"}), 

166 ASN1F_STRING("privateKey", ""), 

167 ASN1F_optional( 

168 ASN1F_PACKET("parameters", None, ECParameters, 

169 explicit_tag=0xa0)), 

170 ASN1F_optional( 

171 ASN1F_PACKET("publicKey", None, 

172 ECDSAPublicKey, 

173 explicit_tag=0xa1))) 

174 

175 

176class ECDSASignature(ASN1_Packet): 

177 ASN1_codec = ASN1_Codecs.BER 

178 ASN1_root = ASN1F_SEQUENCE( 

179 ASN1F_INTEGER("r", 0), 

180 ASN1F_INTEGER("s", 0)) 

181 

182 

183#################################### 

184# x25519/x448 packets # 

185#################################### 

186# based on RFC 8410 

187 

188class EdDSAPublicKey(ASN1_Packet): 

189 ASN1_codec = ASN1_Codecs.BER 

190 ASN1_root = ASN1F_BIT_STRING("ecPoint", "") 

191 

192 

193class AlgorithmIdentifier(ASN1_Packet): 

194 ASN1_codec = ASN1_Codecs.BER 

195 ASN1_root = ASN1F_SEQUENCE( 

196 ASN1F_OID("algorithm", None), 

197 ) 

198 

199 

200class EdDSAPrivateKey(ASN1_Packet): 

201 ASN1_codec = ASN1_Codecs.BER 

202 ASN1_root = ASN1F_SEQUENCE( 

203 ASN1F_enum_INTEGER("version", 1, {1: "ecPrivkeyVer1"}), 

204 ASN1F_PACKET("privateKeyAlgorithm", AlgorithmIdentifier(), AlgorithmIdentifier), 

205 ASN1F_STRING("privateKey", ""), 

206 ASN1F_optional( 

207 ASN1F_PACKET("publicKey", None, 

208 ECDSAPublicKey, 

209 explicit_tag=0xa1))) 

210 

211 

212###################### 

213# X509 packets # 

214###################### 

215# based on RFC 5280 

216 

217 

218# Names # 

219 

220class ASN1F_X509_DirectoryString(ASN1F_CHOICE): 

221 # we include ASN1 bit strings and bmp strings for rare instances of x500 addresses 

222 def __init__(self, name, default, **kwargs): 

223 ASN1F_CHOICE.__init__(self, name, default, 

224 ASN1F_PRINTABLE_STRING, ASN1F_UTF8_STRING, 

225 ASN1F_IA5_STRING, ASN1F_T61_STRING, 

226 ASN1F_UNIVERSAL_STRING, ASN1F_BIT_STRING, 

227 ASN1F_BMP_STRING, 

228 **kwargs) 

229 

230 

231class X509_AttributeValue(ASN1_Packet): 

232 ASN1_codec = ASN1_Codecs.BER 

233 ASN1_root = ASN1F_CHOICE("value", ASN1_PRINTABLE_STRING("FR"), 

234 ASN1F_PRINTABLE_STRING, ASN1F_UTF8_STRING, 

235 ASN1F_IA5_STRING, ASN1F_T61_STRING, 

236 ASN1F_UNIVERSAL_STRING) 

237 

238 

239class X509_Attribute(ASN1_Packet): 

240 ASN1_codec = ASN1_Codecs.BER 

241 ASN1_root = ASN1F_SEQUENCE( 

242 ASN1F_OID("type", "2.5.4.6"), 

243 ASN1F_SET_OF("values", 

244 [X509_AttributeValue()], 

245 X509_AttributeValue)) 

246 

247 

248class X509_AttributeTypeAndValue(ASN1_Packet): 

249 ASN1_codec = ASN1_Codecs.BER 

250 ASN1_root = ASN1F_SEQUENCE( 

251 ASN1F_OID("type", "2.5.4.6"), 

252 ASN1F_X509_DirectoryString("value", 

253 ASN1_PRINTABLE_STRING("FR"))) 

254 

255 

256class X509_RDN(ASN1_Packet): 

257 ASN1_codec = ASN1_Codecs.BER 

258 ASN1_root = ASN1F_SET_OF("rdn", [X509_AttributeTypeAndValue()], 

259 X509_AttributeTypeAndValue) 

260 

261 

262class X509_OtherName(ASN1_Packet): 

263 ASN1_codec = ASN1_Codecs.BER 

264 ASN1_root = ASN1F_SEQUENCE( 

265 ASN1F_OID("type_id", "0"), 

266 ASN1F_CHOICE("value", None, 

267 ASN1F_IA5_STRING, ASN1F_ISO646_STRING, 

268 ASN1F_BMP_STRING, ASN1F_UTF8_STRING, 

269 ASN1F_STRING, 

270 explicit_tag=0xa0)) 

271 

272 

273class ASN1F_X509_otherName(ASN1F_SEQUENCE): 

274 # field version of X509_OtherName, for usage in [MS-WCCE] 

275 def __init__(self, **kargs): 

276 seq = [ASN1F_SEQUENCE(*X509_OtherName.ASN1_root.seq, 

277 implicit_tag=0xA0)] 

278 ASN1F_SEQUENCE.__init__(self, *seq, **kargs) 

279 

280 

281class X509_RFC822Name(ASN1_Packet): 

282 ASN1_codec = ASN1_Codecs.BER 

283 ASN1_root = ASN1F_IA5_STRING("rfc822Name", "") 

284 

285 

286class X509_DNSName(ASN1_Packet): 

287 ASN1_codec = ASN1_Codecs.BER 

288 ASN1_root = ASN1F_IA5_STRING("dNSName", "") 

289 

290# XXX write me 

291 

292 

293class X509_X400Address(ASN1_Packet): 

294 ASN1_codec = ASN1_Codecs.BER 

295 ASN1_root = ASN1F_field("x400Address", "") 

296 

297 

298_default_directoryName = [ 

299 X509_RDN(), 

300 X509_RDN( 

301 rdn=[X509_AttributeTypeAndValue( 

302 type=ASN1_OID("2.5.4.10"), 

303 value=ASN1_PRINTABLE_STRING("Scapy, Inc."))]), 

304 X509_RDN( 

305 rdn=[X509_AttributeTypeAndValue( 

306 type=ASN1_OID("2.5.4.3"), 

307 value=ASN1_PRINTABLE_STRING("Scapy Default Name"))]) 

308] 

309 

310 

311class X509_DirectoryName(ASN1_Packet): 

312 ASN1_codec = ASN1_Codecs.BER 

313 ASN1_root = ASN1F_SEQUENCE_OF("directoryName", _default_directoryName, 

314 X509_RDN) 

315 

316 

317class X509_EDIPartyName(ASN1_Packet): 

318 ASN1_codec = ASN1_Codecs.BER 

319 ASN1_root = ASN1F_SEQUENCE( 

320 ASN1F_optional( 

321 ASN1F_X509_DirectoryString("nameAssigner", None, 

322 explicit_tag=0xa0)), 

323 ASN1F_X509_DirectoryString("partyName", None, 

324 explicit_tag=0xa1)) 

325 

326 

327class X509_URI(ASN1_Packet): 

328 ASN1_codec = ASN1_Codecs.BER 

329 ASN1_root = ASN1F_IA5_STRING("uniformResourceIdentifier", "") 

330 

331 

332class X509_IPAddress(ASN1_Packet): 

333 ASN1_codec = ASN1_Codecs.BER 

334 ASN1_root = ASN1F_STRING("iPAddress", "") 

335 

336 

337class X509_RegisteredID(ASN1_Packet): 

338 ASN1_codec = ASN1_Codecs.BER 

339 ASN1_root = ASN1F_OID("registeredID", "") 

340 

341 

342class X509_GeneralName(ASN1_Packet): 

343 ASN1_codec = ASN1_Codecs.BER 

344 ASN1_root = ASN1F_CHOICE("generalName", X509_DirectoryName(), 

345 ASN1F_PACKET("otherName", None, X509_OtherName, 

346 implicit_tag=0xa0), 

347 ASN1F_PACKET("rfc822Name", None, X509_RFC822Name, 

348 implicit_tag=0x81), 

349 ASN1F_PACKET("dNSName", None, X509_DNSName, 

350 implicit_tag=0x82), 

351 ASN1F_PACKET("x400Address", None, X509_X400Address, # noqa: E501 

352 explicit_tag=0xa3), 

353 ASN1F_PACKET("directoryName", None, X509_DirectoryName, # noqa: E501 

354 explicit_tag=0xa4), 

355 ASN1F_PACKET("ediPartyName", None, X509_EDIPartyName, # noqa: E501 

356 explicit_tag=0xa5), 

357 ASN1F_PACKET("uniformResourceIdentifier", None, X509_URI, # noqa: E501 

358 implicit_tag=0x86), 

359 ASN1F_PACKET("ipAddress", None, X509_IPAddress, 

360 implicit_tag=0x87), 

361 ASN1F_PACKET("registeredID", None, X509_RegisteredID, # noqa: E501 

362 implicit_tag=0x88)) 

363 

364 

365# Extensions # 

366 

367class X509_ExtAuthorityKeyIdentifier(ASN1_Packet): 

368 ASN1_codec = ASN1_Codecs.BER 

369 ASN1_root = ASN1F_SEQUENCE( 

370 ASN1F_optional( 

371 ASN1F_STRING("keyIdentifier", b"\xff" * 20, 

372 implicit_tag=0x80)), 

373 ASN1F_optional( 

374 ASN1F_SEQUENCE_OF("authorityCertIssuer", None, 

375 X509_GeneralName, 

376 implicit_tag=0xa1)), 

377 ASN1F_optional( 

378 ASN1F_INTEGER("authorityCertSerialNumber", None, 

379 implicit_tag=0x82))) 

380 

381 

382class X509_ExtSubjectDirectoryAttributes(ASN1_Packet): 

383 ASN1_codec = ASN1_Codecs.BER 

384 ASN1_root = ASN1F_SEQUENCE_OF("subjectDirectoryAttributes", 

385 [X509_Attribute()], 

386 X509_Attribute) 

387 

388 

389class X509_ExtSubjectKeyIdentifier(ASN1_Packet): 

390 ASN1_codec = ASN1_Codecs.BER 

391 ASN1_root = ASN1F_STRING("keyIdentifier", "xff" * 20) 

392 

393 

394class X509_ExtFullName(ASN1_Packet): 

395 ASN1_codec = ASN1_Codecs.BER 

396 ASN1_root = ASN1F_SEQUENCE_OF("fullName", [X509_GeneralName()], 

397 X509_GeneralName, implicit_tag=0xa0) 

398 

399 

400class X509_ExtNameRelativeToCRLIssuer(ASN1_Packet): 

401 ASN1_codec = ASN1_Codecs.BER 

402 ASN1_root = ASN1F_PACKET("nameRelativeToCRLIssuer", X509_RDN(), X509_RDN, 

403 implicit_tag=0xa1) 

404 

405 

406class X509_ExtDistributionPointName(ASN1_Packet): 

407 ASN1_codec = ASN1_Codecs.BER 

408 ASN1_root = ASN1F_CHOICE("distributionPointName", None, 

409 X509_ExtFullName, X509_ExtNameRelativeToCRLIssuer) 

410 

411 

412_reasons_mapping = ["unused", 

413 "keyCompromise", 

414 "cACompromise", 

415 "affiliationChanged", 

416 "superseded", 

417 "cessationOfOperation", 

418 "certificateHold", 

419 "privilegeWithdrawn", 

420 "aACompromise"] 

421 

422 

423class X509_ExtDistributionPoint(ASN1_Packet): 

424 ASN1_codec = ASN1_Codecs.BER 

425 ASN1_root = ASN1F_SEQUENCE( 

426 ASN1F_optional( 

427 ASN1F_PACKET("distributionPoint", 

428 X509_ExtDistributionPointName(), 

429 X509_ExtDistributionPointName, 

430 explicit_tag=0xa0)), 

431 ASN1F_optional( 

432 ASN1F_FLAGS("reasons", None, _reasons_mapping, 

433 implicit_tag=0x81)), 

434 ASN1F_optional( 

435 ASN1F_SEQUENCE_OF("cRLIssuer", None, 

436 X509_GeneralName, 

437 implicit_tag=0xa2))) 

438 

439 

440_ku_mapping = ["digitalSignature", 

441 "nonRepudiation", 

442 "keyEncipherment", 

443 "dataEncipherment", 

444 "keyAgreement", 

445 "keyCertSign", 

446 "cRLSign", 

447 "encipherOnly", 

448 "decipherOnly"] 

449 

450 

451class X509_ExtKeyUsage(ASN1_Packet): 

452 ASN1_codec = ASN1_Codecs.BER 

453 ASN1_root = ASN1F_FLAGS("keyUsage", "101", _ku_mapping) 

454 

455 def get_keyUsage(self): 

456 return self.ASN1_root.get_flags(self) 

457 

458 

459class X509_ExtPrivateKeyUsagePeriod(ASN1_Packet): 

460 ASN1_codec = ASN1_Codecs.BER 

461 ASN1_root = ASN1F_SEQUENCE( 

462 ASN1F_optional( 

463 ASN1F_GENERALIZED_TIME("notBefore", 

464 str(GeneralizedTime(-600)), 

465 implicit_tag=0x80)), 

466 ASN1F_optional( 

467 ASN1F_GENERALIZED_TIME("notAfter", 

468 str(GeneralizedTime(+86400)), 

469 implicit_tag=0x81))) 

470 

471 

472class X509_PolicyMapping(ASN1_Packet): 

473 ASN1_codec = ASN1_Codecs.BER 

474 ASN1_root = ASN1F_SEQUENCE( 

475 ASN1F_OID("issuerDomainPolicy", None), 

476 ASN1F_OID("subjectDomainPolicy", None)) 

477 

478 

479class X509_ExtPolicyMappings(ASN1_Packet): 

480 ASN1_codec = ASN1_Codecs.BER 

481 ASN1_root = ASN1F_SEQUENCE_OF("policyMappings", [], X509_PolicyMapping) 

482 

483 

484class X509_ExtBasicConstraints(ASN1_Packet): 

485 # The cA field should not be optional, but some certs omit it for False. 

486 ASN1_codec = ASN1_Codecs.BER 

487 ASN1_root = ASN1F_SEQUENCE( 

488 ASN1F_optional( 

489 ASN1F_BOOLEAN("cA", False)), 

490 ASN1F_optional( 

491 ASN1F_INTEGER("pathLenConstraint", None))) 

492 

493 

494class X509_ExtCRLNumber(ASN1_Packet): 

495 ASN1_codec = ASN1_Codecs.BER 

496 ASN1_root = ASN1F_INTEGER("cRLNumber", 0) 

497 

498 

499_cRL_reasons = ["unspecified", 

500 "keyCompromise", 

501 "cACompromise", 

502 "affiliationChanged", 

503 "superseded", 

504 "cessationOfOperation", 

505 "certificateHold", 

506 "unused_reasonCode", 

507 "removeFromCRL", 

508 "privilegeWithdrawn", 

509 "aACompromise"] 

510 

511 

512class X509_ExtReasonCode(ASN1_Packet): 

513 ASN1_codec = ASN1_Codecs.BER 

514 ASN1_root = ASN1F_ENUMERATED("cRLReason", 0, _cRL_reasons) 

515 

516 

517class X509_ExtDeltaCRLIndicator(ASN1_Packet): 

518 ASN1_codec = ASN1_Codecs.BER 

519 ASN1_root = ASN1F_INTEGER("deltaCRLIndicator", 0) 

520 

521 

522class X509_ExtIssuingDistributionPoint(ASN1_Packet): 

523 ASN1_codec = ASN1_Codecs.BER 

524 ASN1_root = ASN1F_SEQUENCE( 

525 ASN1F_optional( 

526 ASN1F_PACKET("distributionPoint", 

527 X509_ExtDistributionPointName(), 

528 X509_ExtDistributionPointName, 

529 explicit_tag=0xa0)), 

530 ASN1F_BOOLEAN("onlyContainsUserCerts", False, 

531 implicit_tag=0x81), 

532 ASN1F_BOOLEAN("onlyContainsCACerts", False, 

533 implicit_tag=0x82), 

534 ASN1F_optional( 

535 ASN1F_FLAGS("onlySomeReasons", None, 

536 _reasons_mapping, 

537 implicit_tag=0x83)), 

538 ASN1F_BOOLEAN("indirectCRL", False, 

539 implicit_tag=0x84), 

540 ASN1F_BOOLEAN("onlyContainsAttributeCerts", False, 

541 implicit_tag=0x85)) 

542 

543 

544class X509_ExtCertificateIssuer(ASN1_Packet): 

545 ASN1_codec = ASN1_Codecs.BER 

546 ASN1_root = ASN1F_SEQUENCE_OF("certificateIssuer", [], X509_GeneralName) 

547 

548 

549class X509_ExtInvalidityDate(ASN1_Packet): 

550 ASN1_codec = ASN1_Codecs.BER 

551 ASN1_root = ASN1F_GENERALIZED_TIME("invalidityDate", str(ZuluTime(+86400))) 

552 

553 

554class X509_ExtSubjectAltName(ASN1_Packet): 

555 ASN1_codec = ASN1_Codecs.BER 

556 ASN1_root = ASN1F_SEQUENCE_OF("subjectAltName", [], X509_GeneralName) 

557 

558 

559class X509_ExtIssuerAltName(ASN1_Packet): 

560 ASN1_codec = ASN1_Codecs.BER 

561 ASN1_root = ASN1F_SEQUENCE_OF("issuerAltName", [], X509_GeneralName) 

562 

563 

564class X509_ExtGeneralSubtree(ASN1_Packet): 

565 # 'minimum' is not optional in RFC 5280, yet it is in some implementations. 

566 ASN1_codec = ASN1_Codecs.BER 

567 ASN1_root = ASN1F_SEQUENCE( 

568 ASN1F_PACKET("base", X509_GeneralName(), X509_GeneralName), 

569 ASN1F_optional( 

570 ASN1F_INTEGER("minimum", None, implicit_tag=0x80)), 

571 ASN1F_optional( 

572 ASN1F_INTEGER("maximum", None, implicit_tag=0x81))) 

573 

574 

575class X509_ExtNameConstraints(ASN1_Packet): 

576 ASN1_codec = ASN1_Codecs.BER 

577 ASN1_root = ASN1F_SEQUENCE( 

578 ASN1F_optional( 

579 ASN1F_SEQUENCE_OF("permittedSubtrees", None, 

580 X509_ExtGeneralSubtree, 

581 implicit_tag=0xa0)), 

582 ASN1F_optional( 

583 ASN1F_SEQUENCE_OF("excludedSubtrees", None, 

584 X509_ExtGeneralSubtree, 

585 implicit_tag=0xa1))) 

586 

587 

588class X509_ExtPolicyConstraints(ASN1_Packet): 

589 ASN1_codec = ASN1_Codecs.BER 

590 ASN1_root = ASN1F_SEQUENCE( 

591 ASN1F_optional( 

592 ASN1F_INTEGER("requireExplicitPolicy", None, 

593 implicit_tag=0x80)), 

594 ASN1F_optional( 

595 ASN1F_INTEGER("inhibitPolicyMapping", None, 

596 implicit_tag=0x81))) 

597 

598 

599class X509_ExtExtendedKeyUsage(ASN1_Packet): 

600 ASN1_codec = ASN1_Codecs.BER 

601 ASN1_root = ASN1F_SEQUENCE_OF("extendedKeyUsage", [], ASN1P_OID) 

602 

603 def get_extendedKeyUsage(self): 

604 eku_array = self.extendedKeyUsage 

605 return [eku.oid.oidname for eku in eku_array] 

606 

607 

608class X509_ExtNoticeReference(ASN1_Packet): 

609 ASN1_codec = ASN1_Codecs.BER 

610 ASN1_root = ASN1F_SEQUENCE( 

611 ASN1F_CHOICE("organization", 

612 ASN1_UTF8_STRING("Dummy Organization"), 

613 ASN1F_IA5_STRING, ASN1F_ISO646_STRING, 

614 ASN1F_BMP_STRING, ASN1F_UTF8_STRING), 

615 ASN1F_SEQUENCE_OF("noticeNumbers", [], ASN1P_INTEGER)) 

616 

617 

618class X509_ExtUserNotice(ASN1_Packet): 

619 ASN1_codec = ASN1_Codecs.BER 

620 ASN1_root = ASN1F_SEQUENCE( 

621 ASN1F_optional( 

622 ASN1F_PACKET("noticeRef", None, 

623 X509_ExtNoticeReference)), 

624 ASN1F_optional( 

625 ASN1F_CHOICE("explicitText", 

626 ASN1_UTF8_STRING("Dummy ExplicitText"), 

627 ASN1F_IA5_STRING, ASN1F_ISO646_STRING, 

628 ASN1F_BMP_STRING, ASN1F_UTF8_STRING))) 

629 

630 

631class X509_ExtPolicyQualifierInfo(ASN1_Packet): 

632 ASN1_codec = ASN1_Codecs.BER 

633 ASN1_root = ASN1F_SEQUENCE( 

634 ASN1F_OID("policyQualifierId", "1.3.6.1.5.5.7.2.1"), 

635 ASN1F_CHOICE("qualifier", ASN1_IA5_STRING("cps_str"), 

636 ASN1F_IA5_STRING, X509_ExtUserNotice)) 

637 

638 

639class X509_ExtPolicyInformation(ASN1_Packet): 

640 ASN1_codec = ASN1_Codecs.BER 

641 ASN1_root = ASN1F_SEQUENCE( 

642 ASN1F_OID("policyIdentifier", "2.5.29.32.0"), 

643 ASN1F_optional( 

644 ASN1F_SEQUENCE_OF("policyQualifiers", None, 

645 X509_ExtPolicyQualifierInfo))) 

646 

647 

648class X509_ExtCertificatePolicies(ASN1_Packet): 

649 ASN1_codec = ASN1_Codecs.BER 

650 ASN1_root = ASN1F_SEQUENCE_OF("certificatePolicies", 

651 [X509_ExtPolicyInformation()], 

652 X509_ExtPolicyInformation) 

653 

654 

655class X509_ExtCRLDistributionPoints(ASN1_Packet): 

656 ASN1_codec = ASN1_Codecs.BER 

657 ASN1_root = ASN1F_SEQUENCE_OF("cRLDistributionPoints", 

658 [X509_ExtDistributionPoint()], 

659 X509_ExtDistributionPoint) 

660 

661 

662class X509_ExtInhibitAnyPolicy(ASN1_Packet): 

663 ASN1_codec = ASN1_Codecs.BER 

664 ASN1_root = ASN1F_INTEGER("skipCerts", 0) 

665 

666 

667class X509_ExtFreshestCRL(ASN1_Packet): 

668 ASN1_codec = ASN1_Codecs.BER 

669 ASN1_root = ASN1F_SEQUENCE_OF("cRLDistributionPoints", 

670 [X509_ExtDistributionPoint()], 

671 X509_ExtDistributionPoint) 

672 

673 

674class X509_AccessDescription(ASN1_Packet): 

675 ASN1_codec = ASN1_Codecs.BER 

676 ASN1_root = ASN1F_SEQUENCE( 

677 ASN1F_OID("accessMethod", "0"), 

678 ASN1F_PACKET("accessLocation", X509_GeneralName(), 

679 X509_GeneralName)) 

680 

681 

682class X509_ExtAuthInfoAccess(ASN1_Packet): 

683 ASN1_codec = ASN1_Codecs.BER 

684 ASN1_root = ASN1F_SEQUENCE_OF("authorityInfoAccess", 

685 [X509_AccessDescription()], 

686 X509_AccessDescription) 

687 

688 

689class X509_ExtQcStatement(ASN1_Packet): 

690 ASN1_codec = ASN1_Codecs.BER 

691 ASN1_root = ASN1F_SEQUENCE( 

692 ASN1F_OID("statementId", "0.4.0.1862.1.1"), 

693 ASN1F_optional( 

694 ASN1F_field("statementInfo", None))) 

695 

696 

697class X509_ExtQcStatements(ASN1_Packet): 

698 ASN1_codec = ASN1_Codecs.BER 

699 ASN1_root = ASN1F_SEQUENCE_OF("qcStatements", 

700 [X509_ExtQcStatement()], 

701 X509_ExtQcStatement) 

702 

703 

704class X509_ExtSubjInfoAccess(ASN1_Packet): 

705 ASN1_codec = ASN1_Codecs.BER 

706 ASN1_root = ASN1F_SEQUENCE_OF("subjectInfoAccess", 

707 [X509_AccessDescription()], 

708 X509_AccessDescription) 

709 

710 

711class X509_ExtNetscapeCertType(ASN1_Packet): 

712 ASN1_codec = ASN1_Codecs.BER 

713 ASN1_root = ASN1F_BIT_STRING("netscapeCertType", "") 

714 

715 

716class X509_ExtComment(ASN1_Packet): 

717 ASN1_codec = ASN1_Codecs.BER 

718 ASN1_root = ASN1F_CHOICE("comment", 

719 ASN1_UTF8_STRING("Dummy comment."), 

720 ASN1F_IA5_STRING, ASN1F_ISO646_STRING, 

721 ASN1F_BMP_STRING, ASN1F_UTF8_STRING) 

722 

723 

724class X509_ExtCertificateTemplateName(ASN1_Packet): 

725 ASN1_codec = ASN1_Codecs.BER 

726 ASN1_root = ASN1F_BMP_STRING("Name", b"") 

727 

728 

729class X509_ExtOidNTDSCaSecurity(ASN1_Packet): 

730 ASN1_codec = ASN1_Codecs.BER 

731 ASN1_root = ASN1F_X509_otherName() 

732 type_id = ASN1_OID("1.3.6.1.4.1.311.25.2.1") 

733 value = ASN1_UTF8_STRING("") 

734 

735 

736# oid-info.com shows that some extensions share multiple OIDs. 

737# Here we only reproduce those written in RFC5280. 

738_ext_mapping = { 

739 "2.5.29.9": X509_ExtSubjectDirectoryAttributes, 

740 "2.5.29.14": X509_ExtSubjectKeyIdentifier, 

741 "2.5.29.15": X509_ExtKeyUsage, 

742 "2.5.29.16": X509_ExtPrivateKeyUsagePeriod, 

743 "2.5.29.17": X509_ExtSubjectAltName, 

744 "2.5.29.18": X509_ExtIssuerAltName, 

745 "2.5.29.19": X509_ExtBasicConstraints, 

746 "2.5.29.20": X509_ExtCRLNumber, 

747 "2.5.29.21": X509_ExtReasonCode, 

748 "2.5.29.24": X509_ExtInvalidityDate, 

749 "2.5.29.27": X509_ExtDeltaCRLIndicator, 

750 "2.5.29.28": X509_ExtIssuingDistributionPoint, 

751 "2.5.29.29": X509_ExtCertificateIssuer, 

752 "2.5.29.30": X509_ExtNameConstraints, 

753 "2.5.29.31": X509_ExtCRLDistributionPoints, 

754 "2.5.29.32": X509_ExtCertificatePolicies, 

755 "2.5.29.33": X509_ExtPolicyMappings, 

756 "2.5.29.35": X509_ExtAuthorityKeyIdentifier, 

757 "2.5.29.36": X509_ExtPolicyConstraints, 

758 "2.5.29.37": X509_ExtExtendedKeyUsage, 

759 "2.5.29.46": X509_ExtFreshestCRL, 

760 "2.5.29.54": X509_ExtInhibitAnyPolicy, 

761 "2.16.840.1.113730.1.1": X509_ExtNetscapeCertType, 

762 "2.16.840.1.113730.1.13": X509_ExtComment, 

763 "1.3.6.1.4.1.311.20.2": X509_ExtCertificateTemplateName, 

764 "1.3.6.1.4.1.311.25.2": X509_ExtOidNTDSCaSecurity, 

765 "1.3.6.1.5.5.7.1.1": X509_ExtAuthInfoAccess, 

766 "1.3.6.1.5.5.7.1.3": X509_ExtQcStatements, 

767 "1.3.6.1.5.5.7.1.11": X509_ExtSubjInfoAccess 

768} 

769 

770 

771class _X509_ExtField(ASN1F_STRING_PacketField): 

772 def m2i(self, pkt, s): 

773 val = super(_X509_ExtField, self).m2i(pkt, s) 

774 if not val[0].val: 

775 return val 

776 if pkt.extnID.val in _ext_mapping: 

777 return ( 

778 _ext_mapping[pkt.extnID.val](val[0].val, _underlayer=pkt), 

779 val[1], 

780 ) 

781 return val 

782 

783 

784class ASN1F_EXT_SEQUENCE(ASN1F_SEQUENCE): 

785 def __init__(self, **kargs): 

786 seq = [ASN1F_OID("extnID", "2.5.29.19"), 

787 ASN1F_optional( 

788 ASN1F_BOOLEAN("critical", False)), 

789 _X509_ExtField("extnValue", X509_ExtBasicConstraints())] 

790 ASN1F_SEQUENCE.__init__(self, *seq, **kargs) 

791 

792 

793class X509_Extension(ASN1_Packet): 

794 ASN1_codec = ASN1_Codecs.BER 

795 ASN1_root = ASN1F_EXT_SEQUENCE() 

796 

797 

798class X509_Extensions(ASN1_Packet): 

799 # we use this in OCSP status requests, in tls/handshake.py 

800 ASN1_codec = ASN1_Codecs.BER 

801 ASN1_root = ASN1F_optional( 

802 ASN1F_SEQUENCE_OF("extensions", 

803 None, X509_Extension)) 

804 

805 

806# Public key wrapper # 

807 

808class X509_AlgorithmIdentifier(ASN1_Packet): 

809 ASN1_codec = ASN1_Codecs.BER 

810 ASN1_root = ASN1F_SEQUENCE( 

811 ASN1F_OID("algorithm", "1.2.840.113549.1.1.11"), 

812 ASN1F_optional( 

813 ASN1F_CHOICE("parameters", ASN1_NULL(0), 

814 ASN1F_NULL, ECParameters))) 

815 

816 

817class ASN1F_X509_SubjectPublicKeyInfo(ASN1F_SEQUENCE): 

818 def __init__(self, **kargs): 

819 seq = [ASN1F_PACKET("signatureAlgorithm", 

820 X509_AlgorithmIdentifier(), 

821 X509_AlgorithmIdentifier), 

822 MultipleTypeField( 

823 [ 

824 (ASN1F_BIT_STRING_ENCAPS("subjectPublicKey", 

825 RSAPublicKey(), 

826 RSAPublicKey), 

827 lambda pkt: "rsa" in pkt.signatureAlgorithm.algorithm.oidname.lower()), # noqa: E501 

828 (ASN1F_PACKET("subjectPublicKey", 

829 ECDSAPublicKey(), 

830 ECDSAPublicKey), 

831 lambda pkt: "ecPublicKey" == pkt.signatureAlgorithm.algorithm.oidname), # noqa: E501 

832 (ASN1F_PACKET("subjectPublicKey", 

833 EdDSAPublicKey(), 

834 EdDSAPublicKey), 

835 lambda pkt: pkt.signatureAlgorithm.algorithm.oidname in ["Ed25519", "Ed448"]), # noqa: E501 

836 ], 

837 ASN1F_BIT_STRING("subjectPublicKey", ""))] 

838 ASN1F_SEQUENCE.__init__(self, *seq, **kargs) 

839 

840 

841class X509_SubjectPublicKeyInfo(ASN1_Packet): 

842 ASN1_codec = ASN1_Codecs.BER 

843 ASN1_root = ASN1F_X509_SubjectPublicKeyInfo() 

844 

845 

846# OpenSSL compatibility wrappers # 

847 

848# XXX As ECDSAPrivateKey already uses the structure from RFC 5958, 

849# and as we would prefer encapsulated RSA private keys to be parsed, 

850# this lazy implementation actually supports RSA encoding only. 

851# We'd rather call it RSAPrivateKey_OpenSSL than X509_PrivateKeyInfo. 

852class RSAPrivateKey_OpenSSL(ASN1_Packet): 

853 ASN1_codec = ASN1_Codecs.BER 

854 ASN1_root = ASN1F_SEQUENCE( 

855 ASN1F_enum_INTEGER("version", 0, ["v1", "v2"]), 

856 ASN1F_PACKET("privateKeyAlgorithm", 

857 X509_AlgorithmIdentifier(), 

858 X509_AlgorithmIdentifier), 

859 ASN1F_PACKET("privateKey", 

860 RSAPrivateKey(), 

861 RSAPrivateKey, 

862 explicit_tag=0x04), 

863 ASN1F_optional( 

864 ASN1F_PACKET("parameters", None, ECParameters, 

865 explicit_tag=0xa0)), 

866 ASN1F_optional( 

867 ASN1F_PACKET("publicKey", None, 

868 ECDSAPublicKey, 

869 explicit_tag=0xa1))) 

870 

871# We need this hack because ECParameters parsing below must return 

872# a Padding payload, and making the ASN1_Packet class have Padding 

873# instead of Raw payload would break things... 

874 

875 

876class _PacketFieldRaw(PacketField): 

877 def getfield(self, pkt, s): 

878 i = self.m2i(pkt, s) 

879 remain = "" 

880 if conf.raw_layer in i: 

881 r = i[conf.raw_layer] 

882 del r.underlayer.payload 

883 remain = r.load 

884 return remain, i 

885 

886 

887class ECDSAPrivateKey_OpenSSL(Packet): 

888 name = "ECDSA Params + Private Key" 

889 fields_desc = [_PacketFieldRaw("ecparam", 

890 ECParameters(), 

891 ECParameters), 

892 PacketField("privateKey", 

893 ECDSAPrivateKey(), 

894 ECDSAPrivateKey)]