Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.11/site-packages/scapy/layers/x509.py: 88%
Shortcuts on this page
r m x toggle line displays
j k next/prev highlighted chunk
0 (zero) top of page
1 (one) first highlighted chunk
1# SPDX-License-Identifier: GPL-2.0-only
2# This file is part of Scapy
3# See https://scapy.net/ for more information
4# Copyright (C) Philippe Biondi <phil@secdev.org>
5# Acknowledgment: Arnaud Ebalard & Maxence Tury
7# Cool history about this file: http://natisbad.org/scapy/index.html
9"""
10X.509 certificates, OCSP, CRL, CMS and other crypto-related ASN.1 structures
11"""
13from scapy.asn1.ber import BER_Decoding_Error
14from scapy.asn1.mib import conf # loads conf.mib
15from scapy.asn1.asn1 import (
16 ASN1_Codecs,
17 ASN1_IA5_STRING,
18 ASN1_OID,
19 ASN1_PRINTABLE_STRING,
20 ASN1_UTC_TIME,
21 ASN1_UTF8_STRING,
22)
23from scapy.asn1packet import ASN1_Packet
24from scapy.asn1fields import (
25 ASN1F_BIT_STRING_ENCAPS,
26 ASN1F_BIT_STRING,
27 ASN1F_BMP_STRING,
28 ASN1F_BOOLEAN,
29 ASN1F_CHOICE,
30 ASN1F_enum_INTEGER,
31 ASN1F_ENUMERATED,
32 ASN1F_field,
33 ASN1F_FLAGS,
34 ASN1F_GENERALIZED_TIME,
35 ASN1F_IA5_STRING,
36 ASN1F_INTEGER,
37 ASN1F_ISO646_STRING,
38 ASN1F_NULL,
39 ASN1F_OID,
40 ASN1F_omit,
41 ASN1F_optional,
42 ASN1F_PACKET,
43 ASN1F_PRINTABLE_STRING,
44 ASN1F_SEQUENCE_OF,
45 ASN1F_SEQUENCE,
46 ASN1F_SET_OF,
47 ASN1F_STRING_ENCAPS,
48 ASN1F_STRING_PacketField,
49 ASN1F_STRING,
50 ASN1F_T61_STRING,
51 ASN1F_UNIVERSAL_STRING,
52 ASN1F_UTC_TIME,
53 ASN1F_UTF8_STRING,
54)
55from scapy.packet import Packet
56from scapy.fields import (
57 MultipleTypeField,
58 PacketField,
59)
60from scapy.volatile import ZuluTime, GeneralizedTime
61from scapy.compat import plain_str
63from scapy.layers.tpm import KeyAttestationStatement
66class ASN1P_OID(ASN1_Packet):
67 ASN1_codec = ASN1_Codecs.BER
68 ASN1_root = ASN1F_OID("oid", "0")
71class ASN1P_INTEGER(ASN1_Packet):
72 ASN1_codec = ASN1_Codecs.BER
73 ASN1_root = ASN1F_INTEGER("number", 0)
76class ASN1P_PRIVSEQ(ASN1_Packet):
77 # This class gets used in x509.uts
78 # It showcases the private high-tag decoding capacities of scapy.
79 ASN1_codec = ASN1_Codecs.BER
80 ASN1_root = ASN1F_SEQUENCE(
81 ASN1F_IA5_STRING("str", ""),
82 ASN1F_STRING("int", 0),
83 explicit_tag=0,
84 flexible_tag=True,
85 )
88#######################
89# RSA packets #
90#######################
91# based on RFC 3447
94# It could be interesting to use os.urandom and try to generate
95# a new modulus each time RSAPublicKey is called with default values.
96# (We might have to dig into scapy field initialization mechanisms...)
97# NEVER rely on the key below, which is provided only for debugging purposes.
98class RSAPublicKey(ASN1_Packet):
99 ASN1_codec = ASN1_Codecs.BER
100 ASN1_root = ASN1F_SEQUENCE(
101 ASN1F_INTEGER("modulus", 10),
102 ASN1F_INTEGER("publicExponent", 3),
103 )
106class RSAOtherPrimeInfo(ASN1_Packet):
107 ASN1_codec = ASN1_Codecs.BER
108 ASN1_root = ASN1F_SEQUENCE(
109 ASN1F_INTEGER("prime", 0),
110 ASN1F_INTEGER("exponent", 0),
111 ASN1F_INTEGER("coefficient", 0),
112 )
115class RSAPrivateKey(ASN1_Packet):
116 ASN1_codec = ASN1_Codecs.BER
117 ASN1_root = ASN1F_SEQUENCE(
118 ASN1F_enum_INTEGER("version", 0, ["two-prime", "multi"]),
119 ASN1F_INTEGER("modulus", 10),
120 ASN1F_INTEGER("publicExponent", 3),
121 ASN1F_INTEGER("privateExponent", 3),
122 ASN1F_INTEGER("prime1", 2),
123 ASN1F_INTEGER("prime2", 5),
124 ASN1F_INTEGER("exponent1", 0),
125 ASN1F_INTEGER("exponent2", 3),
126 ASN1F_INTEGER("coefficient", 1),
127 ASN1F_optional(ASN1F_SEQUENCE_OF("otherPrimeInfos", None, RSAOtherPrimeInfo)),
128 )
131####################################
132# Diffie Hellman Packets #
133####################################
134# From X9.42 (or RFC3279)
137class ValidationParms(ASN1_Packet):
138 ASN1_codec = ASN1_Codecs.BER
139 ASN1_root = ASN1F_SEQUENCE(
140 ASN1F_BIT_STRING("seed", b""),
141 ASN1F_INTEGER("pgenCounter", 0),
142 )
145class DomainParameters(ASN1_Packet):
146 ASN1_codec = ASN1_Codecs.BER
147 ASN1_root = ASN1F_SEQUENCE(
148 ASN1F_INTEGER("p", 0),
149 ASN1F_INTEGER("g", 0),
150 ASN1F_INTEGER("q", 0),
151 ASN1F_optional(ASN1F_INTEGER("j", 0)),
152 ASN1F_optional(
153 ASN1F_PACKET("validationParms", None, ValidationParms),
154 ),
155 )
158class DHPublicKey(ASN1_Packet):
159 ASN1_codec = ASN1_Codecs.BER
160 ASN1_root = ASN1F_INTEGER("y", 0)
163####################################
164# ECDSA packets #
165####################################
166# based on RFC 3279 & 5480 & 5915
169class ECFieldID(ASN1_Packet):
170 # No characteristic-two-field support for now.
171 ASN1_codec = ASN1_Codecs.BER
172 ASN1_root = ASN1F_SEQUENCE(
173 ASN1F_OID("fieldType", "prime-field"), ASN1F_INTEGER("prime", 0)
174 )
177class ECCurve(ASN1_Packet):
178 ASN1_codec = ASN1_Codecs.BER
179 ASN1_root = ASN1F_SEQUENCE(
180 ASN1F_STRING("a", ""),
181 ASN1F_STRING("b", ""),
182 ASN1F_optional(ASN1F_BIT_STRING("seed", None)),
183 )
186class ECSpecifiedDomain(ASN1_Packet):
187 ASN1_codec = ASN1_Codecs.BER
188 ASN1_root = ASN1F_SEQUENCE(
189 ASN1F_enum_INTEGER("version", 1, {1: "ecpVer1"}),
190 ASN1F_PACKET("fieldID", ECFieldID(), ECFieldID),
191 ASN1F_PACKET("curve", ECCurve(), ECCurve),
192 ASN1F_STRING("base", ""),
193 ASN1F_INTEGER("order", 0),
194 ASN1F_optional(ASN1F_INTEGER("cofactor", None)),
195 )
198class ECParameters(ASN1_Packet):
199 ASN1_codec = ASN1_Codecs.BER
200 ASN1_root = ASN1F_CHOICE(
201 "curve",
202 ASN1_OID("ansip384r1"),
203 ASN1F_OID, # for named curves
204 ASN1F_NULL, # for implicit curves
205 ECSpecifiedDomain,
206 )
209class ECDSAPublicKey(ASN1_Packet):
210 ASN1_codec = ASN1_Codecs.BER
211 ASN1_root = ASN1F_BIT_STRING("ecPoint", b"")
214class ECDSAPrivateKey(ASN1_Packet):
215 ASN1_codec = ASN1_Codecs.BER
216 ASN1_root = ASN1F_SEQUENCE(
217 ASN1F_enum_INTEGER("version", 1, {1: "ecPrivkeyVer1"}),
218 ASN1F_STRING("privateKey", ""),
219 ASN1F_optional(
220 ASN1F_PACKET("parameters", None, ECParameters, explicit_tag=0xA0)
221 ),
222 ASN1F_optional(
223 ASN1F_PACKET("publicKey", None, ECDSAPublicKey, explicit_tag=0xA1)
224 ),
225 )
228class ECDSASignature(ASN1_Packet):
229 ASN1_codec = ASN1_Codecs.BER
230 ASN1_root = ASN1F_SEQUENCE(ASN1F_INTEGER("r", 0), ASN1F_INTEGER("s", 0))
233####################################
234# Diffie Hellman Exchange Packets #
235####################################
236# based on PKCS#3
238# PKCS#3 sect 9
241class DHParameter(ASN1_Packet):
242 ASN1_codec = ASN1_Codecs.BER
243 ASN1_root = ASN1F_SEQUENCE(
244 ASN1F_INTEGER("p", 0),
245 ASN1F_INTEGER("g", 0),
246 ASN1F_optional(ASN1F_INTEGER("l", 0)), # aka. 'privateValueLength'
247 )
250####################################
251# x25519/x448 packets #
252####################################
253# based on RFC 8410
256class EdDSAPublicKey(ASN1_Packet):
257 ASN1_codec = ASN1_Codecs.BER
258 ASN1_root = ASN1F_BIT_STRING("edKey", b"")
261class CurvePrivateKey(ASN1_Packet):
262 ASN1_codec = ASN1_Codecs.BER
263 ASN1_root = ASN1F_STRING("privateKey", "")
266EdDSAPrivateKey = CurvePrivateKey
269####################################
270# ML-DSA packets #
271####################################
272# based on RFC 9881
275class MLDSAPublicKey(ASN1_Packet):
276 ASN1_codec = ASN1_Codecs.BER
277 ASN1_root = ASN1F_BIT_STRING("mlKey", b"")
280class MLDSAPrivateKeySeed(ASN1_Packet):
281 ASN1_codec = ASN1_Codecs.BER
282 ASN1_root = ASN1F_STRING("seed", "", implicit_tag=0x80)
285class MLDSAPrivateKeyExpandedKey(ASN1_Packet):
286 ASN1_codec = ASN1_Codecs.BER
287 ASN1_root = ASN1F_STRING("expandedKey", "")
290class MLDSAPrivateKeyBoth(ASN1_Packet):
291 ASN1_codec = ASN1_Codecs.BER
292 ASN1_root = ASN1F_SEQUENCE(
293 ASN1F_STRING("seed", ""),
294 ASN1F_STRING("expandedKey", ""),
295 )
298class MLDSAPrivateKey(ASN1_Packet):
299 ASN1_codec = ASN1_Codecs.BER
300 ASN1_root = ASN1F_CHOICE(
301 "privateKey",
302 MLDSAPrivateKeyExpandedKey(),
303 MLDSAPrivateKeySeed,
304 MLDSAPrivateKeyExpandedKey,
305 MLDSAPrivateKeyBoth,
306 )
309######################
310# X509 packets #
311######################
312# based on RFC 5280
315# Names #
318class ASN1F_X509_DirectoryString(ASN1F_CHOICE):
319 # we include ASN1 bit strings and bmp strings for rare instances of x500 addresses
320 def __init__(self, name, default, **kwargs):
321 ASN1F_CHOICE.__init__(
322 self,
323 name,
324 default,
325 ASN1F_PRINTABLE_STRING,
326 ASN1F_UTF8_STRING,
327 ASN1F_IA5_STRING,
328 ASN1F_T61_STRING,
329 ASN1F_UNIVERSAL_STRING,
330 ASN1F_BIT_STRING,
331 ASN1F_BMP_STRING,
332 **kwargs,
333 )
336# More details on attributes in PKCS#9
337_X509_ATTRIBUTE_TYPE = {}
340class _AttributeValue_Field(ASN1F_field):
341 def m2i(self, pkt, s):
342 # Some types have special structures
343 if pkt.underlayer:
344 attrType = pkt.underlayer.type.val
345 if attrType in _X509_ATTRIBUTE_TYPE:
346 return self.extract_packet(
347 _X509_ATTRIBUTE_TYPE[attrType],
348 s,
349 _underlayer=pkt,
350 )
351 try:
352 return super(_AttributeValue_Field, self).m2i(pkt, s)
353 except BER_Decoding_Error:
354 # Do not fail on special attributes
355 return s, b""
357 def i2m(self, pkt, x):
358 # The special structures should be just bytes()
359 if pkt.underlayer and pkt.underlayer.type.val in _X509_ATTRIBUTE_TYPE:
360 return bytes(x)
361 return super(_AttributeValue_Field, self).i2m(pkt, x)
364class X509_AttributeValue(ASN1_Packet):
365 ASN1_codec = ASN1_Codecs.BER
366 ASN1_root = _AttributeValue_Field("value", ASN1_PRINTABLE_STRING("FR"))
369class X509_Attribute(ASN1_Packet):
370 ASN1_codec = ASN1_Codecs.BER
371 ASN1_root = ASN1F_SEQUENCE(
372 ASN1F_OID("type", "2.5.4.6"),
373 ASN1F_SET_OF("values", [X509_AttributeValue()], X509_AttributeValue),
374 )
377class X509_AttributeTypeAndValue(ASN1_Packet):
378 ASN1_codec = ASN1_Codecs.BER
379 ASN1_root = ASN1F_SEQUENCE(
380 ASN1F_OID("type", "2.5.4.6"),
381 ASN1F_X509_DirectoryString("value", ASN1_PRINTABLE_STRING("FR")),
382 )
385class X509_RDN(ASN1_Packet):
386 ASN1_codec = ASN1_Codecs.BER
387 ASN1_root = ASN1F_SET_OF(
388 "rdn", [X509_AttributeTypeAndValue()], X509_AttributeTypeAndValue
389 )
392class X509_OtherName(ASN1_Packet):
393 ASN1_codec = ASN1_Codecs.BER
394 ASN1_root = ASN1F_SEQUENCE(
395 ASN1F_OID("type_id", "0"),
396 ASN1F_CHOICE(
397 "value",
398 None,
399 ASN1F_IA5_STRING,
400 ASN1F_ISO646_STRING,
401 ASN1F_BMP_STRING,
402 ASN1F_UTF8_STRING,
403 ASN1F_STRING,
404 explicit_tag=0xA0,
405 ),
406 )
409class ASN1F_X509_otherName(ASN1F_SEQUENCE):
410 # field version of X509_OtherName, for usage in [MS-WCCE]
411 def __init__(self, **kargs):
412 seq = [ASN1F_SEQUENCE(*X509_OtherName.ASN1_root.seq, implicit_tag=0xA0)]
413 ASN1F_SEQUENCE.__init__(self, *seq, **kargs)
416class X509_RFC822Name(ASN1_Packet):
417 ASN1_codec = ASN1_Codecs.BER
418 ASN1_root = ASN1F_IA5_STRING("rfc822Name", "")
421class X509_DNSName(ASN1_Packet):
422 ASN1_codec = ASN1_Codecs.BER
423 ASN1_root = ASN1F_IA5_STRING("dNSName", "")
426# XXX write me
429class X509_X400Address(ASN1_Packet):
430 ASN1_codec = ASN1_Codecs.BER
431 ASN1_root = ASN1F_field("x400Address", "")
434_default_directoryName = [
435 X509_RDN(),
436 X509_RDN(
437 rdn=[
438 X509_AttributeTypeAndValue(
439 type=ASN1_OID("2.5.4.10"), value=ASN1_PRINTABLE_STRING("Scapy, Inc.")
440 )
441 ]
442 ),
443 X509_RDN(
444 rdn=[
445 X509_AttributeTypeAndValue(
446 type=ASN1_OID("2.5.4.3"),
447 value=ASN1_PRINTABLE_STRING("Scapy Default Name"),
448 )
449 ]
450 ),
451]
454class X509_DirectoryName(ASN1_Packet):
455 ASN1_codec = ASN1_Codecs.BER
456 ASN1_root = ASN1F_SEQUENCE_OF("directoryName", _default_directoryName, X509_RDN)
459class X509_EDIPartyName(ASN1_Packet):
460 ASN1_codec = ASN1_Codecs.BER
461 ASN1_root = ASN1F_SEQUENCE(
462 ASN1F_optional(
463 ASN1F_X509_DirectoryString("nameAssigner", None, explicit_tag=0xA0)
464 ),
465 ASN1F_X509_DirectoryString("partyName", None, explicit_tag=0xA1),
466 )
469class X509_URI(ASN1_Packet):
470 ASN1_codec = ASN1_Codecs.BER
471 ASN1_root = ASN1F_IA5_STRING("uniformResourceIdentifier", "")
474class X509_IPAddress(ASN1_Packet):
475 ASN1_codec = ASN1_Codecs.BER
476 ASN1_root = ASN1F_STRING("iPAddress", "")
479class X509_RegisteredID(ASN1_Packet):
480 ASN1_codec = ASN1_Codecs.BER
481 ASN1_root = ASN1F_OID("registeredID", "")
484class X509_GeneralName(ASN1_Packet):
485 ASN1_codec = ASN1_Codecs.BER
486 ASN1_root = ASN1F_CHOICE(
487 "generalName",
488 X509_DirectoryName(),
489 ASN1F_PACKET("otherName", None, X509_OtherName, implicit_tag=0xA0),
490 ASN1F_PACKET("rfc822Name", None, X509_RFC822Name, implicit_tag=0x81),
491 ASN1F_PACKET("dNSName", None, X509_DNSName, implicit_tag=0x82),
492 ASN1F_PACKET(
493 "x400Address", None, X509_X400Address, explicit_tag=0xA3
494 ),
495 ASN1F_PACKET(
496 "directoryName", None, X509_DirectoryName, explicit_tag=0xA4
497 ),
498 ASN1F_PACKET(
499 "ediPartyName", None, X509_EDIPartyName, explicit_tag=0xA5
500 ),
501 ASN1F_PACKET(
502 "uniformResourceIdentifier", None, X509_URI, implicit_tag=0x86
503 ),
504 ASN1F_PACKET("ipAddress", None, X509_IPAddress, implicit_tag=0x87),
505 ASN1F_PACKET(
506 "registeredID", None, X509_RegisteredID, implicit_tag=0x88
507 ),
508 )
511# Extensions #
514class X509_ExtAuthorityKeyIdentifier(ASN1_Packet):
515 ASN1_codec = ASN1_Codecs.BER
516 ASN1_root = ASN1F_SEQUENCE(
517 ASN1F_optional(ASN1F_STRING("keyIdentifier", b"\xff" * 20, implicit_tag=0x80)),
518 ASN1F_optional(
519 ASN1F_SEQUENCE_OF(
520 "authorityCertIssuer", None, X509_GeneralName, implicit_tag=0xA1
521 )
522 ),
523 ASN1F_optional(
524 ASN1F_INTEGER("authorityCertSerialNumber", None, implicit_tag=0x82)
525 ),
526 )
529class X509_ExtSubjectDirectoryAttributes(ASN1_Packet):
530 ASN1_codec = ASN1_Codecs.BER
531 ASN1_root = ASN1F_SEQUENCE_OF(
532 "subjectDirectoryAttributes", [X509_Attribute()], X509_Attribute
533 )
536class X509_ExtSubjectKeyIdentifier(ASN1_Packet):
537 ASN1_codec = ASN1_Codecs.BER
538 ASN1_root = ASN1F_STRING("keyIdentifier", "xff" * 20)
541class X509_ExtFullName(ASN1_Packet):
542 ASN1_codec = ASN1_Codecs.BER
543 ASN1_root = ASN1F_SEQUENCE_OF(
544 "fullName", [X509_GeneralName()], X509_GeneralName, implicit_tag=0xA0
545 )
548class X509_ExtNameRelativeToCRLIssuer(ASN1_Packet):
549 ASN1_codec = ASN1_Codecs.BER
550 ASN1_root = ASN1F_PACKET(
551 "nameRelativeToCRLIssuer", X509_RDN(), X509_RDN, implicit_tag=0xA1
552 )
555class X509_ExtDistributionPointName(ASN1_Packet):
556 ASN1_codec = ASN1_Codecs.BER
557 ASN1_root = ASN1F_CHOICE(
558 "distributionPointName", None, X509_ExtFullName, X509_ExtNameRelativeToCRLIssuer
559 )
562_reasons_mapping = [
563 "unused",
564 "keyCompromise",
565 "cACompromise",
566 "affiliationChanged",
567 "superseded",
568 "cessationOfOperation",
569 "certificateHold",
570 "privilegeWithdrawn",
571 "aACompromise",
572]
575class X509_ExtDistributionPoint(ASN1_Packet):
576 ASN1_codec = ASN1_Codecs.BER
577 ASN1_root = ASN1F_SEQUENCE(
578 ASN1F_optional(
579 ASN1F_PACKET(
580 "distributionPoint",
581 X509_ExtDistributionPointName(),
582 X509_ExtDistributionPointName,
583 explicit_tag=0xA0,
584 )
585 ),
586 ASN1F_optional(
587 ASN1F_FLAGS("reasons", None, _reasons_mapping, implicit_tag=0x81)
588 ),
589 ASN1F_optional(
590 ASN1F_SEQUENCE_OF("cRLIssuer", None, X509_GeneralName, implicit_tag=0xA2)
591 ),
592 )
595_ku_mapping = [
596 "digitalSignature",
597 "nonRepudiation",
598 "keyEncipherment",
599 "dataEncipherment",
600 "keyAgreement",
601 "keyCertSign",
602 "cRLSign",
603 "encipherOnly",
604 "decipherOnly",
605]
608class X509_ExtKeyUsage(ASN1_Packet):
609 ASN1_codec = ASN1_Codecs.BER
610 ASN1_root = ASN1F_FLAGS("keyUsage", "101", _ku_mapping)
612 def get_keyUsage(self):
613 return self.ASN1_root.get_flags(self)
616class X509_ExtPrivateKeyUsagePeriod(ASN1_Packet):
617 ASN1_codec = ASN1_Codecs.BER
618 ASN1_root = ASN1F_SEQUENCE(
619 ASN1F_optional(
620 ASN1F_GENERALIZED_TIME(
621 "notBefore", str(GeneralizedTime(-600)), implicit_tag=0x80
622 )
623 ),
624 ASN1F_optional(
625 ASN1F_GENERALIZED_TIME(
626 "notAfter", str(GeneralizedTime(+86400)), implicit_tag=0x81
627 )
628 ),
629 )
632class X509_PolicyMapping(ASN1_Packet):
633 ASN1_codec = ASN1_Codecs.BER
634 ASN1_root = ASN1F_SEQUENCE(
635 ASN1F_OID("issuerDomainPolicy", None), ASN1F_OID("subjectDomainPolicy", None)
636 )
639class X509_ExtPolicyMappings(ASN1_Packet):
640 ASN1_codec = ASN1_Codecs.BER
641 ASN1_root = ASN1F_SEQUENCE_OF("policyMappings", [], X509_PolicyMapping)
644class X509_ExtBasicConstraints(ASN1_Packet):
645 # The cA field should not be optional, but some certs omit it for False.
646 ASN1_codec = ASN1_Codecs.BER
647 ASN1_root = ASN1F_SEQUENCE(
648 ASN1F_optional(ASN1F_BOOLEAN("cA", False)),
649 ASN1F_optional(ASN1F_INTEGER("pathLenConstraint", None)),
650 )
653class X509_ExtCRLNumber(ASN1_Packet):
654 ASN1_codec = ASN1_Codecs.BER
655 ASN1_root = ASN1F_INTEGER("cRLNumber", 0)
658_cRL_reasons = [
659 "unspecified",
660 "keyCompromise",
661 "cACompromise",
662 "affiliationChanged",
663 "superseded",
664 "cessationOfOperation",
665 "certificateHold",
666 "unused_reasonCode",
667 "removeFromCRL",
668 "privilegeWithdrawn",
669 "aACompromise",
670]
673class X509_ExtReasonCode(ASN1_Packet):
674 ASN1_codec = ASN1_Codecs.BER
675 ASN1_root = ASN1F_ENUMERATED("cRLReason", 0, _cRL_reasons)
678class X509_ExtDeltaCRLIndicator(ASN1_Packet):
679 ASN1_codec = ASN1_Codecs.BER
680 ASN1_root = ASN1F_INTEGER("deltaCRLIndicator", 0)
683class X509_ExtIssuingDistributionPoint(ASN1_Packet):
684 ASN1_codec = ASN1_Codecs.BER
685 ASN1_root = ASN1F_SEQUENCE(
686 ASN1F_optional(
687 ASN1F_PACKET(
688 "distributionPoint",
689 X509_ExtDistributionPointName(),
690 X509_ExtDistributionPointName,
691 explicit_tag=0xA0,
692 )
693 ),
694 ASN1F_BOOLEAN("onlyContainsUserCerts", False, implicit_tag=0x81),
695 ASN1F_BOOLEAN("onlyContainsCACerts", False, implicit_tag=0x82),
696 ASN1F_optional(
697 ASN1F_FLAGS("onlySomeReasons", None, _reasons_mapping, implicit_tag=0x83)
698 ),
699 ASN1F_BOOLEAN("indirectCRL", False, implicit_tag=0x84),
700 ASN1F_BOOLEAN("onlyContainsAttributeCerts", False, implicit_tag=0x85),
701 )
704class X509_ExtCertificateIssuer(ASN1_Packet):
705 ASN1_codec = ASN1_Codecs.BER
706 ASN1_root = ASN1F_SEQUENCE_OF("certificateIssuer", [], X509_GeneralName)
709class X509_ExtInvalidityDate(ASN1_Packet):
710 ASN1_codec = ASN1_Codecs.BER
711 ASN1_root = ASN1F_GENERALIZED_TIME("invalidityDate", str(ZuluTime(+86400)))
714class X509_ExtSubjectAltName(ASN1_Packet):
715 ASN1_codec = ASN1_Codecs.BER
716 ASN1_root = ASN1F_SEQUENCE_OF("subjectAltName", [], X509_GeneralName)
719class X509_ExtIssuerAltName(ASN1_Packet):
720 ASN1_codec = ASN1_Codecs.BER
721 ASN1_root = ASN1F_SEQUENCE_OF("issuerAltName", [], X509_GeneralName)
724class X509_ExtGeneralSubtree(ASN1_Packet):
725 # 'minimum' is not optional in RFC 5280, yet it is in some implementations.
726 ASN1_codec = ASN1_Codecs.BER
727 ASN1_root = ASN1F_SEQUENCE(
728 ASN1F_PACKET("base", X509_GeneralName(), X509_GeneralName),
729 ASN1F_optional(ASN1F_INTEGER("minimum", None, implicit_tag=0x80)),
730 ASN1F_optional(ASN1F_INTEGER("maximum", None, implicit_tag=0x81)),
731 )
734class X509_ExtNameConstraints(ASN1_Packet):
735 ASN1_codec = ASN1_Codecs.BER
736 ASN1_root = ASN1F_SEQUENCE(
737 ASN1F_optional(
738 ASN1F_SEQUENCE_OF(
739 "permittedSubtrees", None, X509_ExtGeneralSubtree, implicit_tag=0xA0
740 )
741 ),
742 ASN1F_optional(
743 ASN1F_SEQUENCE_OF(
744 "excludedSubtrees", None, X509_ExtGeneralSubtree, implicit_tag=0xA1
745 )
746 ),
747 )
750class X509_ExtPolicyConstraints(ASN1_Packet):
751 ASN1_codec = ASN1_Codecs.BER
752 ASN1_root = ASN1F_SEQUENCE(
753 ASN1F_optional(ASN1F_INTEGER("requireExplicitPolicy", None, implicit_tag=0x80)),
754 ASN1F_optional(ASN1F_INTEGER("inhibitPolicyMapping", None, implicit_tag=0x81)),
755 )
758class X509_ExtExtendedKeyUsage(ASN1_Packet):
759 ASN1_codec = ASN1_Codecs.BER
760 ASN1_root = ASN1F_SEQUENCE_OF("extendedKeyUsage", [], ASN1P_OID)
762 def get_extendedKeyUsage(self):
763 eku_array = self.extendedKeyUsage
764 return [eku.oid.oidname for eku in eku_array]
767class X509_ExtNoticeReference(ASN1_Packet):
768 ASN1_codec = ASN1_Codecs.BER
769 ASN1_root = ASN1F_SEQUENCE(
770 ASN1F_CHOICE(
771 "organization",
772 ASN1_UTF8_STRING("Dummy Organization"),
773 ASN1F_IA5_STRING,
774 ASN1F_ISO646_STRING,
775 ASN1F_BMP_STRING,
776 ASN1F_UTF8_STRING,
777 ),
778 ASN1F_SEQUENCE_OF("noticeNumbers", [], ASN1P_INTEGER),
779 )
782class X509_ExtUserNotice(ASN1_Packet):
783 ASN1_codec = ASN1_Codecs.BER
784 ASN1_root = ASN1F_SEQUENCE(
785 ASN1F_optional(ASN1F_PACKET("noticeRef", None, X509_ExtNoticeReference)),
786 ASN1F_optional(
787 ASN1F_CHOICE(
788 "explicitText",
789 ASN1_UTF8_STRING("Dummy ExplicitText"),
790 ASN1F_IA5_STRING,
791 ASN1F_ISO646_STRING,
792 ASN1F_BMP_STRING,
793 ASN1F_UTF8_STRING,
794 )
795 ),
796 )
799class X509_ExtPolicyQualifierInfo(ASN1_Packet):
800 ASN1_codec = ASN1_Codecs.BER
801 ASN1_root = ASN1F_SEQUENCE(
802 ASN1F_OID("policyQualifierId", "1.3.6.1.5.5.7.2.1"),
803 ASN1F_CHOICE(
804 "qualifier",
805 ASN1_IA5_STRING("cps_str"),
806 ASN1F_IA5_STRING,
807 X509_ExtUserNotice,
808 ),
809 )
812class X509_ExtPolicyInformation(ASN1_Packet):
813 ASN1_codec = ASN1_Codecs.BER
814 ASN1_root = ASN1F_SEQUENCE(
815 ASN1F_OID("policyIdentifier", "2.5.29.32.0"),
816 ASN1F_optional(
817 ASN1F_SEQUENCE_OF("policyQualifiers", None, X509_ExtPolicyQualifierInfo)
818 ),
819 )
822class X509_ExtCertificatePolicies(ASN1_Packet):
823 ASN1_codec = ASN1_Codecs.BER
824 ASN1_root = ASN1F_SEQUENCE_OF(
825 "certificatePolicies", [X509_ExtPolicyInformation()], X509_ExtPolicyInformation
826 )
829class X509_ExtCRLDistributionPoints(ASN1_Packet):
830 ASN1_codec = ASN1_Codecs.BER
831 ASN1_root = ASN1F_SEQUENCE_OF(
832 "cRLDistributionPoints",
833 [X509_ExtDistributionPoint()],
834 X509_ExtDistributionPoint,
835 )
838class X509_ExtInhibitAnyPolicy(ASN1_Packet):
839 ASN1_codec = ASN1_Codecs.BER
840 ASN1_root = ASN1F_INTEGER("skipCerts", 0)
843class X509_ExtFreshestCRL(ASN1_Packet):
844 ASN1_codec = ASN1_Codecs.BER
845 ASN1_root = ASN1F_SEQUENCE_OF(
846 "cRLDistributionPoints",
847 [X509_ExtDistributionPoint()],
848 X509_ExtDistributionPoint,
849 )
852class X509_AccessDescription(ASN1_Packet):
853 ASN1_codec = ASN1_Codecs.BER
854 ASN1_root = ASN1F_SEQUENCE(
855 ASN1F_OID("accessMethod", "0"),
856 ASN1F_PACKET("accessLocation", X509_GeneralName(), X509_GeneralName),
857 )
860class X509_ExtAuthInfoAccess(ASN1_Packet):
861 ASN1_codec = ASN1_Codecs.BER
862 ASN1_root = ASN1F_SEQUENCE_OF(
863 "authorityInfoAccess", [X509_AccessDescription()], X509_AccessDescription
864 )
867class X509_ExtQcStatement(ASN1_Packet):
868 ASN1_codec = ASN1_Codecs.BER
869 ASN1_root = ASN1F_SEQUENCE(
870 ASN1F_OID("statementId", "0.4.0.1862.1.1"),
871 ASN1F_optional(ASN1F_field("statementInfo", None)),
872 )
875class X509_ExtQcStatements(ASN1_Packet):
876 ASN1_codec = ASN1_Codecs.BER
877 ASN1_root = ASN1F_SEQUENCE_OF(
878 "qcStatements", [X509_ExtQcStatement()], X509_ExtQcStatement
879 )
882class X509_ExtSubjInfoAccess(ASN1_Packet):
883 ASN1_codec = ASN1_Codecs.BER
884 ASN1_root = ASN1F_SEQUENCE_OF(
885 "subjectInfoAccess", [X509_AccessDescription()], X509_AccessDescription
886 )
889class X509_ExtNetscapeCertType(ASN1_Packet):
890 ASN1_codec = ASN1_Codecs.BER
891 ASN1_root = ASN1F_BIT_STRING("netscapeCertType", b"")
894class X509_ExtComment(ASN1_Packet):
895 ASN1_codec = ASN1_Codecs.BER
896 ASN1_root = ASN1F_CHOICE(
897 "comment",
898 ASN1_UTF8_STRING("Dummy comment."),
899 ASN1F_IA5_STRING,
900 ASN1F_ISO646_STRING,
901 ASN1F_BMP_STRING,
902 ASN1F_UTF8_STRING,
903 )
906class X509_ExtCertificateTemplateName(ASN1_Packet):
907 ASN1_codec = ASN1_Codecs.BER
908 ASN1_root = ASN1F_BMP_STRING("Name", b"")
911class X509_ExtOidNTDSCaSecurity(ASN1_Packet):
912 ASN1_codec = ASN1_Codecs.BER
913 ASN1_root = ASN1F_X509_otherName()
914 type_id = ASN1_OID("1.3.6.1.4.1.311.25.2.1")
915 value = ASN1_UTF8_STRING("")
918# [MS-WCCE] sect 2.2.2.7.7.2
921class X509_ExtCertificateTemplateOID(ASN1_Packet):
922 ASN1_codec = ASN1_Codecs.BER
923 ASN1_root = ASN1F_SEQUENCE(
924 ASN1F_OID("templateID", "0"),
925 ASN1F_optional(
926 ASN1F_INTEGER("templateMajorVersion", 0),
927 ),
928 ASN1F_optional(
929 ASN1F_INTEGER("templateMinorVersion", 0),
930 ),
931 )
934# oid-info.com shows that some extensions share multiple OIDs.
935# Here we only reproduce those written in RFC5280.
936_ext_mapping = {
937 "2.5.29.9": X509_ExtSubjectDirectoryAttributes,
938 "2.5.29.14": X509_ExtSubjectKeyIdentifier,
939 "2.5.29.15": X509_ExtKeyUsage,
940 "2.5.29.16": X509_ExtPrivateKeyUsagePeriod,
941 "2.5.29.17": X509_ExtSubjectAltName,
942 "2.5.29.18": X509_ExtIssuerAltName,
943 "2.5.29.19": X509_ExtBasicConstraints,
944 "2.5.29.20": X509_ExtCRLNumber,
945 "2.5.29.21": X509_ExtReasonCode,
946 "2.5.29.24": X509_ExtInvalidityDate,
947 "2.5.29.27": X509_ExtDeltaCRLIndicator,
948 "2.5.29.28": X509_ExtIssuingDistributionPoint,
949 "2.5.29.29": X509_ExtCertificateIssuer,
950 "2.5.29.30": X509_ExtNameConstraints,
951 "2.5.29.31": X509_ExtCRLDistributionPoints,
952 "2.5.29.32": X509_ExtCertificatePolicies,
953 "2.5.29.33": X509_ExtPolicyMappings,
954 "2.5.29.35": X509_ExtAuthorityKeyIdentifier,
955 "2.5.29.36": X509_ExtPolicyConstraints,
956 "2.5.29.37": X509_ExtExtendedKeyUsage,
957 "2.5.29.46": X509_ExtFreshestCRL,
958 "2.5.29.54": X509_ExtInhibitAnyPolicy,
959 "2.16.840.1.113730.1.1": X509_ExtNetscapeCertType,
960 "2.16.840.1.113730.1.13": X509_ExtComment,
961 "1.3.6.1.4.1.311.20.2": X509_ExtCertificateTemplateName,
962 "1.3.6.1.4.1.311.21.7": X509_ExtCertificateTemplateOID,
963 "1.3.6.1.4.1.311.21.10": X509_ExtCertificatePolicies,
964 "1.3.6.1.4.1.311.25.2": X509_ExtOidNTDSCaSecurity,
965 "1.3.6.1.5.5.7.1.1": X509_ExtAuthInfoAccess,
966 "1.3.6.1.5.5.7.1.3": X509_ExtQcStatements,
967 "1.3.6.1.5.5.7.1.11": X509_ExtSubjInfoAccess,
968}
971class _X509_ExtField(ASN1F_STRING_PacketField):
972 def m2i(self, pkt, s):
973 val = super(_X509_ExtField, self).m2i(pkt, s)
974 if not val[0].val:
975 return val
976 if pkt.extnID.val in _ext_mapping:
977 return (
978 _ext_mapping[pkt.extnID.val](val[0].val, _underlayer=pkt),
979 val[1],
980 )
981 return val
984class ASN1F_EXT_SEQUENCE(ASN1F_SEQUENCE):
985 def __init__(self, **kargs):
986 seq = [
987 ASN1F_OID("extnID", "2.5.29.19"),
988 ASN1F_optional(ASN1F_BOOLEAN("critical", False)),
989 _X509_ExtField("extnValue", X509_ExtBasicConstraints()),
990 ]
991 ASN1F_SEQUENCE.__init__(self, *seq, **kargs)
994class X509_Extension(ASN1_Packet):
995 ASN1_codec = ASN1_Codecs.BER
996 ASN1_root = ASN1F_EXT_SEQUENCE()
999class X509_Extensions(ASN1_Packet):
1000 # we use this in OCSP status requests, in tls/handshake.py
1001 ASN1_codec = ASN1_Codecs.BER
1002 ASN1_root = ASN1F_optional(ASN1F_SEQUENCE_OF("extensions", None, X509_Extension))
1005# Aka 'ExtensionReq' in CMS
1006_X509_ATTRIBUTE_TYPE["1.2.840.113549.1.9.14"] = X509_Extensions
1009# Public key wrapper #
1012class X509_AlgorithmIdentifier(ASN1_Packet):
1013 ASN1_codec = ASN1_Codecs.BER
1014 ASN1_root = ASN1F_SEQUENCE(
1015 ASN1F_OID("algorithm", "1.2.840.113549.1.1.11"),
1016 MultipleTypeField(
1017 [
1018 (
1019 # RFC4055:
1020 # "The correct encoding is to omit the parameters field"
1021 # "All implementations MUST accept both NULL and absent
1022 # parameters as legal and equivalent encodings."
1023 # RFC8017:
1024 # "should generally be omitted, but if present, it shall have a
1025 # value of type NULL."
1026 ASN1F_optional(ASN1F_NULL("parameters", None)),
1027 lambda pkt: (
1028 pkt.algorithm.val[:19] == "1.2.840.113549.1.1."
1029 or pkt.algorithm.val[:21] == "2.16.840.1.101.3.4.2."
1030 or pkt.algorithm.val[:11] == "1.3.14.3.2."
1031 ),
1032 ),
1033 (
1034 # RFC5758:
1035 # "the encoding MUST omit the parameters field"
1036 # RFC8410:
1037 # "For all of the OIDs, the parameters MUST be absent."
1038 # RFC9881:
1039 # "The parameters of these signature algorithms MUST be absent"
1040 ASN1F_omit("parameters", None),
1041 lambda pkt: (
1042 pkt.algorithm.val[:16] == "1.2.840.10045.4."
1043 or pkt.algorithm.val in ["1.3.101.112", "1.3.101.113"]
1044 or pkt.algorithm.val[:21] == "2.16.840.1.101.3.4.3."
1045 ),
1046 ),
1047 # RFC5480
1048 (
1049 ASN1F_PACKET(
1050 "parameters",
1051 ECParameters(),
1052 ECParameters,
1053 ),
1054 lambda pkt: pkt.algorithm.val == "1.2.840.10045.2.1",
1055 ),
1056 # RFC3279
1057 (
1058 ASN1F_PACKET(
1059 "parameters",
1060 DomainParameters(),
1061 DomainParameters,
1062 ),
1063 lambda pkt: pkt.algorithm.val == "1.2.840.10046.2.1",
1064 ),
1065 # PKCS#3
1066 (
1067 ASN1F_PACKET(
1068 "parameters",
1069 DHParameter(),
1070 DHParameter,
1071 ),
1072 lambda pkt: pkt.algorithm.val == "1.2.840.113549.1.3.1",
1073 ),
1074 # TripleDES
1075 (
1076 ASN1F_STRING(
1077 "parameters",
1078 "",
1079 ),
1080 lambda pkt: pkt.algorithm.val == "1.2.840.113549.3.7",
1081 ),
1082 ],
1083 # Default: fail, probably. This is most likely unimplemented.
1084 ASN1F_NULL("parameters", 0),
1085 ),
1086 )
1089class ASN1F_X509_PublicKeyField(MultipleTypeField):
1090 def __init__(self, name, getoid, optional=False, **kwargs):
1091 super(ASN1F_X509_PublicKeyField, self).__init__(
1092 [
1093 (
1094 ASN1F_BIT_STRING_ENCAPS(
1095 name,
1096 None if optional else RSAPublicKey(),
1097 RSAPublicKey,
1098 **kwargs,
1099 ),
1100 lambda pkt: "rsa" in getoid(pkt).lower(),
1101 ),
1102 (
1103 ASN1F_BIT_STRING_ENCAPS(
1104 name,
1105 None if optional else DHPublicKey(),
1106 DHPublicKey,
1107 **kwargs,
1108 ),
1109 lambda pkt: "dhpublicnumber" == getoid(pkt),
1110 ),
1111 (
1112 ASN1F_PACKET(
1113 name,
1114 None if optional else ECDSAPublicKey(),
1115 ECDSAPublicKey,
1116 **kwargs,
1117 ),
1118 lambda pkt: "ecPublicKey" == getoid(pkt),
1119 ),
1120 (
1121 ASN1F_PACKET(
1122 name,
1123 None if optional else EdDSAPublicKey(),
1124 EdDSAPublicKey,
1125 **kwargs,
1126 ),
1127 lambda pkt: getoid(pkt) in ["Ed25519", "Ed448"],
1128 ),
1129 (
1130 ASN1F_PACKET(
1131 name,
1132 None if optional else MLDSAPublicKey(),
1133 MLDSAPublicKey,
1134 **kwargs,
1135 ),
1136 lambda pkt: "ml-dsa" in getoid(pkt),
1137 ),
1138 ],
1139 ASN1F_BIT_STRING(name, b""),
1140 )
1143class X509_SubjectPublicKeyInfo(ASN1_Packet):
1144 ASN1_codec = ASN1_Codecs.BER
1145 ASN1_root = ASN1F_SEQUENCE(
1146 ASN1F_PACKET(
1147 "signatureAlgorithm",
1148 X509_AlgorithmIdentifier(),
1149 X509_AlgorithmIdentifier,
1150 ),
1151 ASN1F_X509_PublicKeyField(
1152 "subjectPublicKey",
1153 getoid=lambda pkt: pkt.signatureAlgorithm.algorithm.oidname,
1154 ),
1155 )
1158# RFC 5958 private key wrapper #
1161class X509_OneAsymmetricKey(ASN1_Packet):
1162 ASN1_codec = ASN1_Codecs.BER
1163 ASN1_root = ASN1F_SEQUENCE(
1164 ASN1F_INTEGER("version", 0),
1165 ASN1F_PACKET(
1166 "privateKeyAlgorithm",
1167 X509_AlgorithmIdentifier(),
1168 X509_AlgorithmIdentifier,
1169 ),
1170 MultipleTypeField(
1171 [
1172 (
1173 ASN1F_STRING_ENCAPS(
1174 "privateKey",
1175 CurvePrivateKey(),
1176 CurvePrivateKey,
1177 ),
1178 lambda pkt: pkt.privateKeyAlgorithm.algorithm.oidname
1179 in ["Ed25519", "Ed448"],
1180 ),
1181 (
1182 ASN1F_STRING_ENCAPS(
1183 "privateKey",
1184 MLDSAPrivateKey(),
1185 MLDSAPrivateKey,
1186 ),
1187 lambda pkt: "ml-dsa" in pkt.privateKeyAlgorithm.algorithm.oidname,
1188 ),
1189 ],
1190 ASN1F_STRING("privateKey", b""),
1191 ),
1192 ASN1F_optional(
1193 ASN1F_X509_PublicKeyField(
1194 "publicKey",
1195 getoid=lambda pkt: pkt.privateKeyAlgorithm.algorithm.oidname,
1196 optional=True,
1197 explicit_tag=0xA1,
1198 )
1199 ),
1200 )
1203# OpenSSL compatibility wrappers #
1206# XXX As ECDSAPrivateKey already uses the structure from RFC 5958,
1207# and as we would prefer encapsulated RSA private keys to be parsed,
1208# this lazy implementation actually supports RSA encoding only.
1209# We'd rather call it RSAPrivateKey_OpenSSL than X509_PrivateKeyInfo.
1210class RSAPrivateKey_OpenSSL(ASN1_Packet):
1211 ASN1_codec = ASN1_Codecs.BER
1212 ASN1_root = ASN1F_SEQUENCE(
1213 ASN1F_enum_INTEGER("version", 0, ["v1", "v2"]),
1214 ASN1F_PACKET(
1215 "privateKeyAlgorithm", X509_AlgorithmIdentifier(), X509_AlgorithmIdentifier
1216 ),
1217 ASN1F_PACKET("privateKey", RSAPrivateKey(), RSAPrivateKey, explicit_tag=0x04),
1218 ASN1F_optional(
1219 ASN1F_PACKET("parameters", None, ECParameters, explicit_tag=0xA0)
1220 ),
1221 ASN1F_optional(
1222 ASN1F_PACKET("publicKey", None, ECDSAPublicKey, explicit_tag=0xA1)
1223 ),
1224 )
1227# We need this hack because ECParameters parsing below must return
1228# a Padding payload, and making the ASN1_Packet class have Padding
1229# instead of Raw payload would break things...
1232class _PacketFieldRaw(PacketField):
1233 def getfield(self, pkt, s):
1234 i = self.m2i(pkt, s)
1235 remain = ""
1236 if conf.raw_layer in i:
1237 r = i[conf.raw_layer]
1238 del r.underlayer.payload
1239 remain = r.load
1240 return remain, i
1243class ECDSAPrivateKey_OpenSSL(Packet):
1244 name = "ECDSA Params + Private Key"
1245 fields_desc = [
1246 _PacketFieldRaw("ecparam", ECParameters(), ECParameters),
1247 PacketField("privateKey", ECDSAPrivateKey(), ECDSAPrivateKey),
1248 ]
1251# TBSCertificate & Certificate #
1253_default_issuer = [
1254 X509_RDN(),
1255 X509_RDN(
1256 rdn=[
1257 X509_AttributeTypeAndValue(
1258 type=ASN1_OID("2.5.4.10"), value=ASN1_PRINTABLE_STRING("Scapy, Inc.")
1259 )
1260 ]
1261 ),
1262 X509_RDN(
1263 rdn=[
1264 X509_AttributeTypeAndValue(
1265 type=ASN1_OID("2.5.4.3"),
1266 value=ASN1_PRINTABLE_STRING("Scapy Default Issuer"),
1267 )
1268 ]
1269 ),
1270]
1272_default_subject = [
1273 X509_RDN(),
1274 X509_RDN(
1275 rdn=[
1276 X509_AttributeTypeAndValue(
1277 type=ASN1_OID("2.5.4.10"), value=ASN1_PRINTABLE_STRING("Scapy, Inc.")
1278 )
1279 ]
1280 ),
1281 X509_RDN(
1282 rdn=[
1283 X509_AttributeTypeAndValue(
1284 type=ASN1_OID("2.5.4.3"),
1285 value=ASN1_PRINTABLE_STRING("Scapy Default Subject"),
1286 )
1287 ]
1288 ),
1289]
1292class _IssuerUtils:
1293 def get_issuer(self):
1294 attrs = self.issuer
1295 attrsDict = {}
1296 for attr in attrs:
1297 # we assume there is only one name in each rdn ASN1_SET
1298 attrsDict[attr.rdn[0].type.oidname] = plain_str(
1299 attr.rdn[0].value.val
1300 )
1301 return attrsDict
1303 def get_issuer_str(self):
1304 """
1305 Returns a one-line string containing every type/value
1306 in a rather specific order. sorted() built-in ensures unicity.
1307 """
1308 name_str = ""
1309 attrsDict = self.get_issuer()
1310 for attrType, attrSymbol in _attrName_mapping:
1311 if attrType in attrsDict:
1312 name_str += "/" + attrSymbol + "="
1313 name_str += attrsDict[attrType]
1314 for attrType in sorted(attrsDict):
1315 if attrType not in _attrName_specials:
1316 name_str += "/" + attrType + "="
1317 name_str += attrsDict[attrType]
1318 return name_str
1321class X509_Validity(ASN1_Packet):
1322 ASN1_codec = ASN1_Codecs.BER
1323 ASN1_root = ASN1F_SEQUENCE(
1324 ASN1F_CHOICE(
1325 "not_before",
1326 ASN1_UTC_TIME(str(ZuluTime(-600))),
1327 ASN1F_UTC_TIME,
1328 ASN1F_GENERALIZED_TIME,
1329 ),
1330 ASN1F_CHOICE(
1331 "not_after",
1332 ASN1_UTC_TIME(str(ZuluTime(+86400))),
1333 ASN1F_UTC_TIME,
1334 ASN1F_GENERALIZED_TIME,
1335 ),
1336 )
1339_attrName_mapping = [
1340 ("countryName", "C"),
1341 ("stateOrProvinceName", "ST"),
1342 ("localityName", "L"),
1343 ("organizationName", "O"),
1344 ("organizationUnitName", "OU"),
1345 ("commonName", "CN"),
1346]
1347_attrName_specials = [name for name, symbol in _attrName_mapping]
1350class X509_TBSCertificate(ASN1_Packet, _IssuerUtils):
1351 ASN1_codec = ASN1_Codecs.BER
1352 ASN1_root = ASN1F_SEQUENCE(
1353 ASN1F_optional(
1354 ASN1F_enum_INTEGER("version", 0x2, ["v1", "v2", "v3"], explicit_tag=0xA0)
1355 ),
1356 ASN1F_INTEGER("serialNumber", 1),
1357 ASN1F_PACKET("signature", X509_AlgorithmIdentifier(), X509_AlgorithmIdentifier),
1358 ASN1F_SEQUENCE_OF("issuer", _default_issuer, X509_RDN),
1359 ASN1F_PACKET("validity", X509_Validity(), X509_Validity),
1360 ASN1F_SEQUENCE_OF("subject", _default_subject, X509_RDN),
1361 ASN1F_PACKET(
1362 "subjectPublicKeyInfo",
1363 X509_SubjectPublicKeyInfo(),
1364 X509_SubjectPublicKeyInfo,
1365 ),
1366 ASN1F_optional(ASN1F_BIT_STRING("issuerUniqueID", None, implicit_tag=0x81)),
1367 ASN1F_optional(ASN1F_BIT_STRING("subjectUniqueID", None, implicit_tag=0x82)),
1368 ASN1F_optional(
1369 ASN1F_SEQUENCE_OF(
1370 "extensions", [X509_Extension()], X509_Extension, explicit_tag=0xA3
1371 )
1372 ),
1373 )
1375 def get_subject(self):
1376 attrs = self.subject
1377 attrsDict = {}
1378 for attr in attrs:
1379 # we assume there is only one name in each rdn ASN1_SET
1380 attrsDict[attr.rdn[0].type.oidname] = plain_str(
1381 attr.rdn[0].value.val
1382 )
1383 return attrsDict
1385 def get_subject_str(self):
1386 name_str = ""
1387 attrsDict = self.get_subject()
1388 for attrType, attrSymbol in _attrName_mapping:
1389 if attrType in attrsDict:
1390 name_str += "/" + attrSymbol + "="
1391 name_str += attrsDict[attrType]
1392 for attrType in sorted(attrsDict):
1393 if attrType not in _attrName_specials:
1394 name_str += "/" + attrType + "="
1395 name_str += attrsDict[attrType]
1396 return name_str
1399class ASN1F_X509_Cert(ASN1F_SEQUENCE):
1400 def __init__(self, **kargs):
1401 seq = [
1402 ASN1F_PACKET("tbsCertificate", X509_TBSCertificate(), X509_TBSCertificate),
1403 ASN1F_PACKET(
1404 "signatureAlgorithm",
1405 X509_AlgorithmIdentifier(),
1406 X509_AlgorithmIdentifier,
1407 ),
1408 MultipleTypeField(
1409 [
1410 (
1411 ASN1F_BIT_STRING_ENCAPS(
1412 "signatureValue", ECDSASignature(), ECDSASignature
1413 ),
1414 lambda pkt: "ecdsa"
1415 in pkt.signatureAlgorithm.algorithm.oidname.lower(),
1416 ),
1417 ],
1418 ASN1F_BIT_STRING("signatureValue", b"defaultsignature" * 2),
1419 ),
1420 ]
1421 ASN1F_SEQUENCE.__init__(self, *seq, **kargs)
1424class X509_Cert(ASN1_Packet):
1425 ASN1_codec = ASN1_Codecs.BER
1426 ASN1_root = ASN1F_X509_Cert()
1429# TBSCertList & CRL #
1432class X509_RevokedCertificate(ASN1_Packet):
1433 ASN1_codec = ASN1_Codecs.BER
1434 ASN1_root = ASN1F_SEQUENCE(
1435 ASN1F_INTEGER("serialNumber", 1),
1436 ASN1F_UTC_TIME("revocationDate", str(ZuluTime(+86400))),
1437 ASN1F_optional(ASN1F_SEQUENCE_OF("crlEntryExtensions", None, X509_Extension)),
1438 )
1441class X509_TBSCertList(ASN1_Packet, _IssuerUtils):
1442 ASN1_codec = ASN1_Codecs.BER
1443 ASN1_root = ASN1F_SEQUENCE(
1444 ASN1F_optional(ASN1F_enum_INTEGER("version", 1, ["v1", "v2"])),
1445 ASN1F_PACKET("signature", X509_AlgorithmIdentifier(), X509_AlgorithmIdentifier),
1446 ASN1F_SEQUENCE_OF("issuer", _default_issuer, X509_RDN),
1447 ASN1F_UTC_TIME("this_update", str(ZuluTime(-1))),
1448 ASN1F_optional(ASN1F_UTC_TIME("next_update", None)),
1449 ASN1F_optional(
1450 ASN1F_SEQUENCE_OF("revokedCertificates", None, X509_RevokedCertificate)
1451 ),
1452 ASN1F_optional(
1453 ASN1F_SEQUENCE_OF("crlExtensions", None, X509_Extension, explicit_tag=0xA0)
1454 ),
1455 )
1458class ASN1F_X509_CRL(ASN1F_SEQUENCE):
1459 def __init__(self, **kargs):
1460 seq = [
1461 ASN1F_PACKET("tbsCertList", X509_TBSCertList(), X509_TBSCertList),
1462 ASN1F_PACKET(
1463 "signatureAlgorithm",
1464 X509_AlgorithmIdentifier(),
1465 X509_AlgorithmIdentifier,
1466 ),
1467 MultipleTypeField(
1468 [
1469 (
1470 ASN1F_BIT_STRING_ENCAPS(
1471 "signatureValue", ECDSASignature(), ECDSASignature
1472 ),
1473 lambda pkt: "ecdsa"
1474 in pkt.signatureAlgorithm.algorithm.oidname.lower(),
1475 ),
1476 ],
1477 ASN1F_BIT_STRING("signatureValue", b"defaultsignature" * 2),
1478 ),
1479 ]
1480 ASN1F_SEQUENCE.__init__(self, *seq, **kargs)
1483class X509_CRL(ASN1_Packet):
1484 ASN1_codec = ASN1_Codecs.BER
1485 ASN1_root = ASN1F_X509_CRL()
1488#####################
1489# CMS packets #
1490#####################
1491# based on RFC 3852
1493CMSVersion = ASN1F_INTEGER
1495# RFC3852 sect 5.2
1497# Other layers should store the structures that can be encapsulated
1498# by CMS here, referred by their OIDs.
1499_CMS_ENCAPSULATED = {}
1502class _EncapsulatedContent_Field(ASN1F_STRING_PacketField):
1503 def m2i(self, pkt, s):
1504 val = super(_EncapsulatedContent_Field, self).m2i(pkt, s)
1505 if not val[0].val:
1506 return val
1508 # Get encapsulated value from its type
1509 if pkt.eContentType.val in _CMS_ENCAPSULATED:
1510 return (
1511 _CMS_ENCAPSULATED[pkt.eContentType.val](val[0].val, _underlayer=pkt),
1512 val[1],
1513 )
1515 return val
1518class CMS_EncapsulatedContentInfo(ASN1_Packet):
1519 ASN1_codec = ASN1_Codecs.BER
1520 ASN1_root = ASN1F_SEQUENCE(
1521 ASN1F_OID("eContentType", "0"),
1522 ASN1F_optional(
1523 _EncapsulatedContent_Field("eContent", None, explicit_tag=0xA0),
1524 ),
1525 )
1528# RFC3852 sect 10.2.1
1531class CMS_RevocationInfoChoice(ASN1_Packet):
1532 ASN1_codec = ASN1_Codecs.BER
1533 ASN1_root = ASN1F_CHOICE(
1534 "crl",
1535 None,
1536 ASN1F_PACKET("crl", X509_CRL(), X509_Cert),
1537 # -- TODO: 1
1538 )
1541# RFC3852 sect 10.2.2
1544class CMS_CertificateChoices(ASN1_Packet):
1545 ASN1_codec = ASN1_Codecs.BER
1546 ASN1_root = ASN1F_CHOICE(
1547 "certificate",
1548 None,
1549 ASN1F_PACKET("certificate", X509_Cert(), X509_Cert),
1550 # -- TODO: 0, 1, 2
1551 )
1554# RFC3852 sect 10.2.4
1557class CMS_IssuerAndSerialNumber(ASN1_Packet, _IssuerUtils):
1558 ASN1_codec = ASN1_Codecs.BER
1559 ASN1_root = ASN1F_SEQUENCE(
1560 ASN1F_SEQUENCE_OF("issuer", _default_issuer, X509_RDN),
1561 ASN1F_INTEGER("serialNumber", 0),
1562 )
1565# RFC3852 sect 10.2.7
1568class CMS_OtherKeyAttribute(ASN1_Packet):
1569 ASN1_codec = ASN1_Codecs.BER
1570 ASN1_root = ASN1F_SEQUENCE(
1571 ASN1F_OID("keyAttrId", "0"),
1572 ASN1F_field("keyAttr", 0),
1573 )
1576# RFC3852 sect 5.3
1579class CMS_SubjectKeyIdentifier(ASN1_Packet):
1580 ASN1_codec = ASN1_Codecs.BER
1581 ASN1_root = ASN1F_STRING("sid", "")
1584class CMS_SignerInfo(ASN1_Packet):
1585 ASN1_codec = ASN1_Codecs.BER
1586 ASN1_root = ASN1F_SEQUENCE(
1587 CMSVersion("version", 1),
1588 ASN1F_CHOICE(
1589 "sid",
1590 CMS_IssuerAndSerialNumber(),
1591 ASN1F_PACKET("sid", CMS_IssuerAndSerialNumber(), CMS_IssuerAndSerialNumber),
1592 ASN1F_PACKET(
1593 "sid",
1594 CMS_SubjectKeyIdentifier(),
1595 CMS_SubjectKeyIdentifier,
1596 implicit_tag=0x80,
1597 ),
1598 ),
1599 ASN1F_PACKET(
1600 "digestAlgorithm", X509_AlgorithmIdentifier(), X509_AlgorithmIdentifier
1601 ),
1602 ASN1F_optional(
1603 ASN1F_SET_OF(
1604 "signedAttrs",
1605 None,
1606 X509_Attribute,
1607 implicit_tag=0xA0,
1608 )
1609 ),
1610 ASN1F_PACKET(
1611 "signatureAlgorithm", X509_AlgorithmIdentifier(), X509_AlgorithmIdentifier
1612 ),
1613 ASN1F_STRING("signature", ASN1_UTF8_STRING("")),
1614 ASN1F_optional(
1615 ASN1F_SET_OF(
1616 "unsignedAttrs",
1617 None,
1618 X509_Attribute,
1619 implicit_tag=0xA1,
1620 )
1621 ),
1622 )
1625# RFC3852 sect 5.4
1628class CMS_SignedAttrsForSignature(ASN1_Packet):
1629 ASN1_codec = ASN1_Codecs.BER
1630 ASN1_root = ASN1F_SET_OF(
1631 "signedAttrs",
1632 None,
1633 X509_Attribute,
1634 )
1637# RFC3852 sect 5.1
1640class CMS_SignedData(ASN1_Packet):
1641 ASN1_codec = ASN1_Codecs.BER
1642 ASN1_root = ASN1F_SEQUENCE(
1643 CMSVersion("version", 1),
1644 ASN1F_SET_OF("digestAlgorithms", [], X509_AlgorithmIdentifier),
1645 ASN1F_PACKET(
1646 "encapContentInfo",
1647 CMS_EncapsulatedContentInfo(),
1648 CMS_EncapsulatedContentInfo,
1649 ),
1650 ASN1F_optional(
1651 ASN1F_SET_OF(
1652 "certificates",
1653 None,
1654 CMS_CertificateChoices,
1655 implicit_tag=0xA0,
1656 )
1657 ),
1658 ASN1F_optional(
1659 ASN1F_SET_OF(
1660 "crls",
1661 None,
1662 CMS_RevocationInfoChoice,
1663 implicit_tag=0xA1,
1664 )
1665 ),
1666 ASN1F_SET_OF(
1667 "signerInfos",
1668 [],
1669 CMS_SignerInfo,
1670 ),
1671 )
1674# RFC3852 sect 6.2.1
1677class CMS_KeyTransRecipientInfo(ASN1_Packet):
1678 ASN1_codec = ASN1_Codecs.BER
1679 ASN1_root = ASN1F_SEQUENCE(
1680 CMSVersion("version", 0),
1681 ASN1F_CHOICE(
1682 "rid",
1683 CMS_IssuerAndSerialNumber(),
1684 ASN1F_PACKET("rid", CMS_IssuerAndSerialNumber(), CMS_IssuerAndSerialNumber),
1685 ASN1F_PACKET(
1686 "rid",
1687 CMS_SubjectKeyIdentifier(),
1688 CMS_SubjectKeyIdentifier,
1689 implicit_tag=0x80,
1690 ),
1691 ),
1692 ASN1F_PACKET(
1693 "keyEncryptionAlgorithm",
1694 X509_AlgorithmIdentifier(),
1695 X509_AlgorithmIdentifier,
1696 ),
1697 ASN1F_STRING("encryptedKey", ""),
1698 )
1701# RFC3852 sect 6.2.2
1704class CMS_OriginatorPublicKey(ASN1_Packet):
1705 ASN1_codec = ASN1_Codecs.BER
1706 ASN1_root = ASN1F_SEQUENCE(
1707 ASN1F_PACKET("algorithm", X509_AlgorithmIdentifier(), X509_AlgorithmIdentifier),
1708 ASN1F_BIT_STRING("publicKey", b""),
1709 )
1712class CMS_OriginatorIdentifierOrKey(ASN1_Packet):
1713 ASN1_codec = ASN1_Codecs.BER
1714 ASN1_root = ASN1F_CHOICE(
1715 "originator",
1716 CMS_IssuerAndSerialNumber(),
1717 ASN1F_PACKET(
1718 "issuerAndSerialNumber",
1719 CMS_IssuerAndSerialNumber(),
1720 CMS_IssuerAndSerialNumber,
1721 ),
1722 ASN1F_PACKET(
1723 "subjectKeyIdentifier",
1724 CMS_SubjectKeyIdentifier(),
1725 CMS_SubjectKeyIdentifier,
1726 implicit_tag=0x80,
1727 ),
1728 ASN1F_PACKET(
1729 "originatorKey",
1730 CMS_OriginatorPublicKey(),
1731 CMS_OriginatorPublicKey,
1732 implicit_tag=0xA1,
1733 ),
1734 )
1737class CMS_RecipientEncryptedKey(ASN1_Packet):
1738 ASN1_codec = ASN1_Codecs.BER
1739 ASN1_root = ASN1F_SEQUENCE(
1740 ASN1F_PACKET(
1741 "subjectKeyIdentifier", CMS_SubjectKeyIdentifier(), CMS_SubjectKeyIdentifier
1742 ),
1743 ASN1F_optional(
1744 ASN1F_GENERALIZED_TIME("date", ""),
1745 ),
1746 ASN1F_optional(
1747 ASN1F_PACKET("other", CMS_OtherKeyAttribute(), CMS_OtherKeyAttribute),
1748 ),
1749 )
1752class CMS_KeyAgreeRecipientInfo(ASN1_Packet):
1753 ASN1_codec = ASN1_Codecs.BER
1754 ASN1_root = ASN1F_SEQUENCE(
1755 CMSVersion("version", 3),
1756 ASN1F_PACKET(
1757 "originator",
1758 CMS_OriginatorIdentifierOrKey(),
1759 CMS_OriginatorIdentifierOrKey,
1760 explicit_tag=0xA0,
1761 ),
1762 ASN1F_optional(
1763 ASN1F_STRING("ukm", None, "", explicit_tag=0x81),
1764 ),
1765 ASN1F_PACKET(
1766 "keyEncryptionAlgorithm",
1767 X509_AlgorithmIdentifier(),
1768 X509_AlgorithmIdentifier,
1769 ),
1770 ASN1F_SEQUENCE_OF("recipientEncryptedKeys", [], CMS_RecipientEncryptedKey),
1771 )
1774# RFC3852 sect 6.2
1777class CMS_RecipientInfo(ASN1_Packet):
1778 ASN1_codec = ASN1_Codecs.BER
1779 ASN1_root = ASN1F_CHOICE(
1780 "recipientInfo",
1781 CMS_KeyTransRecipientInfo(),
1782 ASN1F_PACKET("ktri", CMS_KeyTransRecipientInfo(), CMS_KeyTransRecipientInfo),
1783 ASN1F_PACKET(
1784 "kari",
1785 CMS_KeyAgreeRecipientInfo(),
1786 CMS_KeyAgreeRecipientInfo,
1787 implicit_tag=0xA1,
1788 ),
1789 )
1792# RFC3852 sect 6.1
1795class CMS_OriginatorInfo(ASN1_Packet):
1796 ASN1_codec = ASN1_Codecs.BER
1797 ASN1_root = ASN1F_SEQUENCE(
1798 ASN1F_optional(
1799 ASN1F_SET_OF(
1800 "certs",
1801 None,
1802 CMS_CertificateChoices,
1803 implicit_tag=0xA0,
1804 )
1805 ),
1806 ASN1F_optional(
1807 ASN1F_SET_OF(
1808 "crls",
1809 None,
1810 CMS_RevocationInfoChoice,
1811 implicit_tag=0xA1,
1812 )
1813 ),
1814 )
1817class CMS_EncryptedContentInfo(ASN1_Packet):
1818 ASN1_codec = ASN1_Codecs.BER
1819 ASN1_root = ASN1F_SEQUENCE(
1820 ASN1F_OID("contentType", "1.2.840.113549.1.7.2"),
1821 ASN1F_PACKET(
1822 "contentEncryptionAlgorithm",
1823 X509_AlgorithmIdentifier(),
1824 X509_AlgorithmIdentifier,
1825 ),
1826 ASN1F_optional(
1827 ASN1F_STRING("encryptedContent", "", implicit_tag=0x80),
1828 ),
1829 )
1832class CMS_EnvelopedData(ASN1_Packet):
1833 ASN1_codec = ASN1_Codecs.BER
1834 ASN1_root = ASN1F_SEQUENCE(
1835 CMSVersion("version", 1),
1836 ASN1F_optional(
1837 ASN1F_PACKET("originatorInfo", None, CMS_OriginatorInfo, implicit_tag=0xA0),
1838 ),
1839 ASN1F_SET_OF("recipientInfos", CMS_RecipientInfo(), CMS_RecipientInfo),
1840 ASN1F_PACKET(
1841 "encryptedContentInfo", CMS_EncryptedContentInfo(), CMS_EncryptedContentInfo
1842 ),
1843 ASN1F_optional(
1844 ASN1F_SET_OF("unprotectedAttrs", [], X509_Attribute, implicit_tag=0xA1),
1845 ),
1846 )
1849# RFC3852 sect 3
1852class CMS_ContentInfo(ASN1_Packet):
1853 ASN1_codec = ASN1_Codecs.BER
1854 ASN1_root = ASN1F_SEQUENCE(
1855 ASN1F_OID("contentType", "1.2.840.113549.1.7.2"),
1856 MultipleTypeField(
1857 [
1858 (
1859 ASN1F_PACKET("content", None, CMS_SignedData, explicit_tag=0xA0),
1860 lambda pkt: pkt.contentType.oidname == "id-signedData",
1861 ),
1862 (
1863 ASN1F_PACKET("content", None, CMS_EnvelopedData, explicit_tag=0xA0),
1864 lambda pkt: pkt.contentType.oidname == "id-envelopedData",
1865 ),
1866 ],
1867 ASN1F_BIT_STRING("content", b"", explicit_tag=0xA0),
1868 ),
1869 )
1872#####################
1873# CSR packets #
1874#####################
1876# based on PKCS#10 #
1879class PKCS10_CertificationRequestInfo(ASN1_Packet):
1880 ASN1_codec = ASN1_Codecs.BER
1881 ASN1_root = ASN1F_SEQUENCE(
1882 ASN1F_INTEGER("version", 0),
1883 ASN1F_SEQUENCE_OF("subject", _default_subject, X509_RDN),
1884 ASN1F_PACKET(
1885 "subjectPublicKeyInfo",
1886 X509_SubjectPublicKeyInfo(),
1887 X509_SubjectPublicKeyInfo,
1888 ),
1889 ASN1F_SET_OF("attributes", [], X509_Attribute, implicit_tag=0xA0),
1890 )
1892 get_subject = X509_TBSCertificate.get_subject
1893 get_subject_str = X509_TBSCertificate.get_subject_str
1896class PKCS10_CertificationRequest(ASN1_Packet):
1897 ASN1_codec = ASN1_Codecs.BER
1898 ASN1_root = ASN1F_SEQUENCE(
1899 ASN1F_PACKET(
1900 "certificationRequestInfo",
1901 PKCS10_CertificationRequestInfo(),
1902 PKCS10_CertificationRequestInfo,
1903 ),
1904 ASN1F_PACKET(
1905 "signatureAlgorithm", X509_AlgorithmIdentifier(), X509_AlgorithmIdentifier
1906 ),
1907 ASN1F_BIT_STRING("signature", b""),
1908 )
1911# based on CMC #
1913# RFC 5272 sect 3.2.1.1
1916class CMC_TaggedAttribute(ASN1_Packet):
1917 ASN1_codec = ASN1_Codecs.BER
1918 ASN1_root = ASN1F_SEQUENCE(
1919 ASN1F_INTEGER("bodyPartID", 0),
1920 ASN1F_OID("type", "0"), # attrType for compat
1921 ASN1F_SET_OF("attrValues", [], X509_AttributeValue),
1922 )
1925# RFC 5272 sect 3.2.1.2.1
1928class CMC_TaggedCertificationRequest(ASN1_Packet):
1929 ASN1_codec = ASN1_Codecs.BER
1930 ASN1_root = ASN1F_SEQUENCE(
1931 ASN1F_INTEGER("bodyPartID", 0),
1932 ASN1F_PACKET(
1933 "certificationRequest",
1934 PKCS10_CertificationRequest(),
1935 PKCS10_CertificationRequest,
1936 ),
1937 )
1940# RFC 5272 sect 3.2.1.2
1943class CMC_TaggedRequest(ASN1_Packet):
1944 ASN1_codec = ASN1_Codecs.BER
1945 ASN1_root = ASN1F_CHOICE(
1946 "request",
1947 CMC_TaggedCertificationRequest(),
1948 ASN1F_PACKET(
1949 "tcr",
1950 CMC_TaggedCertificationRequest(),
1951 CMC_TaggedCertificationRequest,
1952 implicit_tag=0xA0,
1953 ),
1954 # XXX there are others
1955 )
1958# RFC 5272 sect 3.2.1.3
1961class CMC_TaggedContentInfo(ASN1_Packet):
1962 ASN1_codec = ASN1_Codecs.BER
1963 ASN1_root = ASN1F_SEQUENCE(
1964 ASN1F_INTEGER("bodyPartID", 0),
1965 ASN1F_PACKET("contentInfo", CMS_ContentInfo(), CMS_ContentInfo),
1966 )
1969# RFC 5272 sect 3.2.1.4
1972class CMC_OtherMsg(ASN1_Packet):
1973 ASN1_codec = ASN1_Codecs.BER
1974 ASN1_root = ASN1F_SEQUENCE(
1975 ASN1F_INTEGER("bodyPartID", 0),
1976 ASN1F_OID("otherMsgType", "0"),
1977 ASN1F_field("otherMsgValue", ""),
1978 )
1981# RFC 5272 sect 3.2.1
1984class CMC_PKIData(ASN1_Packet):
1985 ASN1_codec = ASN1_Codecs.BER
1986 ASN1_root = ASN1F_SEQUENCE(
1987 ASN1F_SEQUENCE_OF("controlSequence", [], CMC_TaggedAttribute),
1988 ASN1F_SEQUENCE_OF("reqSequence", [], CMC_TaggedRequest),
1989 ASN1F_SEQUENCE_OF("cmsSequence", [], CMC_TaggedContentInfo),
1990 ASN1F_SEQUENCE_OF("otherMsgSequence", [], CMC_OtherMsg),
1991 )
1994_CMS_ENCAPSULATED["1.3.6.1.5.5.7.12.2"] = CMC_PKIData
1997# Windows extensions #
1999# https://learn.microsoft.com/en-us/windows/win32/seccertenroll/cmc-extensions
2002class CMC_AddExtensions(ASN1_Packet):
2003 ASN1_codec = ASN1_Codecs.BER
2004 ASN1_root = ASN1F_SEQUENCE(
2005 ASN1F_INTEGER("pkiDataReference", 0),
2006 ASN1F_SEQUENCE_OF("certReferences", [], ASN1F_INTEGER),
2007 ASN1F_PACKET("extensions", X509_Extensions(), X509_Extensions),
2008 )
2011_X509_ATTRIBUTE_TYPE["1.3.6.1.5.5.7.7.8"] = CMC_AddExtensions
2014# https://learn.microsoft.com/en-us/windows/win32/seccertenroll/cmc-attributes
2017class CMC_AddAttributes(ASN1_Packet):
2018 ASN1_codec = ASN1_Codecs.BER
2019 ASN1_root = ASN1F_SEQUENCE(
2020 ASN1F_INTEGER("pkiDataReference", 0),
2021 ASN1F_SEQUENCE_OF("certReferences", [], ASN1F_INTEGER),
2022 ASN1F_SET_OF("attributes", X509_Attribute(), X509_Attribute),
2023 )
2026_X509_ATTRIBUTE_TYPE["1.3.6.1.4.1.311.10.10.1"] = CMC_AddAttributes
2029# [MS-WCCE] sect 2.2.2.7.2
2032class CMC_ENROLLMENT_CSP_PROVIDER(ASN1_Packet):
2033 ASN1_codec = ASN1_Codecs.BER
2034 ASN1_root = ASN1F_SEQUENCE(
2035 ASN1F_INTEGER("KeySpec", 0),
2036 ASN1F_BMP_STRING("ProviderName", ""),
2037 ASN1F_BIT_STRING("Signature", b""),
2038 )
2041_X509_ATTRIBUTE_TYPE["1.3.6.1.4.1.311.13.2.2"] = CMC_ENROLLMENT_CSP_PROVIDER
2044# [MS-WCCE] sect 2.2.2.7.4
2047class CMC_REQUEST_CLIENT_INFO(ASN1_Packet):
2048 ASN1_codec = ASN1_Codecs.BER
2049 ASN1_root = ASN1F_SEQUENCE(
2050 ASN1F_INTEGER("clientId", 0),
2051 ASN1F_UTF8_STRING("MachineName", ""),
2052 ASN1F_UTF8_STRING("UserName", ""),
2053 ASN1F_UTF8_STRING("ProcessName", ""),
2054 )
2057_X509_ATTRIBUTE_TYPE["1.3.6.1.4.1.311.21.20"] = CMC_REQUEST_CLIENT_INFO
2060# [MS-WCCE] sect 2.2.2.7.10
2063class CMC_EnrollmentNameValuePair(ASN1_Packet):
2064 ASN1_codec = ASN1_Codecs.BER
2065 ASN1_root = ASN1F_SEQUENCE(
2066 ASN1F_BMP_STRING("Name", ""),
2067 ASN1F_BMP_STRING("Value", ""),
2068 )
2071_X509_ATTRIBUTE_TYPE["1.3.6.1.4.1.311.13.2.1"] = CMC_EnrollmentNameValuePair
2074# [MS-WCCE] sect 2.2.2.7.12
2077class CMC_ENROLL_ATTESTATION_STATEMENT(ASN1_Packet):
2078 ASN1_codec = ASN1_Codecs.BER
2079 ASN1_root = ASN1F_STRING_ENCAPS(
2080 "kas", KeyAttestationStatement(), KeyAttestationStatement
2081 )
2084_X509_ATTRIBUTE_TYPE["1.3.6.1.4.1.311.21.24"] = CMC_ENROLL_ATTESTATION_STATEMENT
2087# [MS-WCCE] sect 2.2.2.7.13
2089_X509_ATTRIBUTE_TYPE["1.3.6.1.4.1.311.21.23"] = CMS_ContentInfo
2092#############################
2093# OCSP Status packets #
2094#############################
2095# based on RFC 6960
2098class OCSP_CertID(ASN1_Packet):
2099 ASN1_codec = ASN1_Codecs.BER
2100 ASN1_root = ASN1F_SEQUENCE(
2101 ASN1F_PACKET(
2102 "hashAlgorithm", X509_AlgorithmIdentifier(), X509_AlgorithmIdentifier
2103 ),
2104 ASN1F_STRING("issuerNameHash", ""),
2105 ASN1F_STRING("issuerKeyHash", ""),
2106 ASN1F_INTEGER("serialNumber", 0),
2107 )
2110class OCSP_GoodInfo(ASN1_Packet):
2111 ASN1_codec = ASN1_Codecs.BER
2112 ASN1_root = ASN1F_NULL("info", 0)
2115class OCSP_RevokedInfo(ASN1_Packet):
2116 ASN1_codec = ASN1_Codecs.BER
2117 ASN1_root = ASN1F_SEQUENCE(
2118 ASN1F_GENERALIZED_TIME("revocationTime", ""),
2119 ASN1F_optional(
2120 ASN1F_PACKET(
2121 "revocationReason", None, X509_ExtReasonCode, explicit_tag=0xA0
2122 )
2123 ),
2124 )
2127class OCSP_UnknownInfo(ASN1_Packet):
2128 ASN1_codec = ASN1_Codecs.BER
2129 ASN1_root = ASN1F_NULL("info", 0)
2132class OCSP_CertStatus(ASN1_Packet):
2133 ASN1_codec = ASN1_Codecs.BER
2134 ASN1_root = ASN1F_CHOICE(
2135 "certStatus",
2136 None,
2137 ASN1F_PACKET("good", OCSP_GoodInfo(), OCSP_GoodInfo, implicit_tag=0x80),
2138 ASN1F_PACKET(
2139 "revoked", OCSP_RevokedInfo(), OCSP_RevokedInfo, implicit_tag=0xA1
2140 ),
2141 ASN1F_PACKET(
2142 "unknown", OCSP_UnknownInfo(), OCSP_UnknownInfo, implicit_tag=0x82
2143 ),
2144 )
2147class OCSP_SingleResponse(ASN1_Packet):
2148 ASN1_codec = ASN1_Codecs.BER
2149 ASN1_root = ASN1F_SEQUENCE(
2150 ASN1F_PACKET("certID", OCSP_CertID(), OCSP_CertID),
2151 ASN1F_PACKET(
2152 "certStatus", OCSP_CertStatus(certStatus=OCSP_GoodInfo()), OCSP_CertStatus
2153 ),
2154 ASN1F_GENERALIZED_TIME("thisUpdate", ""),
2155 ASN1F_optional(ASN1F_GENERALIZED_TIME("nextUpdate", "", explicit_tag=0xA0)),
2156 ASN1F_optional(
2157 ASN1F_SEQUENCE_OF(
2158 "singleExtensions", None, X509_Extension, explicit_tag=0xA1
2159 )
2160 ),
2161 )
2164class OCSP_ByName(ASN1_Packet):
2165 ASN1_codec = ASN1_Codecs.BER
2166 ASN1_root = ASN1F_SEQUENCE_OF("byName", [], X509_RDN)
2169class OCSP_ByKey(ASN1_Packet):
2170 ASN1_codec = ASN1_Codecs.BER
2171 ASN1_root = ASN1F_STRING("byKey", "")
2174class OCSP_ResponderID(ASN1_Packet):
2175 ASN1_codec = ASN1_Codecs.BER
2176 ASN1_root = ASN1F_CHOICE(
2177 "responderID",
2178 None,
2179 ASN1F_PACKET("byName", OCSP_ByName(), OCSP_ByName, explicit_tag=0xA1),
2180 ASN1F_PACKET("byKey", OCSP_ByKey(), OCSP_ByKey, explicit_tag=0xA2),
2181 )
2184class OCSP_ResponseData(ASN1_Packet):
2185 ASN1_codec = ASN1_Codecs.BER
2186 ASN1_root = ASN1F_SEQUENCE(
2187 ASN1F_optional(ASN1F_enum_INTEGER("version", 0, {0: "v1"}, explicit_tag=0x80)),
2188 ASN1F_PACKET(
2189 "responderID", OCSP_ResponderID(responderID=OCSP_ByName()), OCSP_ResponderID
2190 ),
2191 ASN1F_GENERALIZED_TIME("producedAt", str(GeneralizedTime())),
2192 ASN1F_SEQUENCE_OF("responses", [], OCSP_SingleResponse),
2193 ASN1F_optional(
2194 ASN1F_SEQUENCE_OF(
2195 "responseExtensions", None, X509_Extension, explicit_tag=0xA1
2196 )
2197 ),
2198 )
2201class ASN1F_OCSP_BasicResponse(ASN1F_SEQUENCE):
2202 def __init__(self, **kargs):
2203 seq = [
2204 ASN1F_PACKET("tbsResponseData", OCSP_ResponseData(), OCSP_ResponseData),
2205 ASN1F_PACKET(
2206 "signatureAlgorithm",
2207 X509_AlgorithmIdentifier(),
2208 X509_AlgorithmIdentifier,
2209 ),
2210 MultipleTypeField(
2211 [
2212 (
2213 ASN1F_BIT_STRING_ENCAPS(
2214 "signature", ECDSASignature(), ECDSASignature
2215 ),
2216 lambda pkt: "ecdsa"
2217 in pkt.signatureAlgorithm.algorithm.oidname.lower(),
2218 ),
2219 ],
2220 ASN1F_BIT_STRING("signature", b"defaultsignature" * 2),
2221 ),
2222 ASN1F_optional(
2223 ASN1F_SEQUENCE_OF("certs", None, X509_Cert, explicit_tag=0xA0)
2224 ),
2225 ]
2226 ASN1F_SEQUENCE.__init__(self, *seq, **kargs)
2229class OCSP_ResponseBytes(ASN1_Packet):
2230 ASN1_codec = ASN1_Codecs.BER
2231 ASN1_root = ASN1F_SEQUENCE(
2232 ASN1F_OID("responseType", "1.3.6.1.5.5.7.48.1.1"),
2233 ASN1F_OCSP_BasicResponse(explicit_tag=0x04),
2234 )
2237_responseStatus_mapping = [
2238 "successful",
2239 "malformedRequest",
2240 "internalError",
2241 "tryLater",
2242 "notUsed",
2243 "sigRequired",
2244 "unauthorized",
2245]
2248class OCSP_Response(ASN1_Packet):
2249 ASN1_codec = ASN1_Codecs.BER
2250 ASN1_root = ASN1F_SEQUENCE(
2251 ASN1F_ENUMERATED("responseStatus", 0, _responseStatus_mapping),
2252 ASN1F_optional(
2253 ASN1F_PACKET("responseBytes", None, OCSP_ResponseBytes, explicit_tag=0xA0)
2254 ),
2255 )