rfc6402-1.py 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627
  1. # coding: utf-8
  2. #
  3. # This file is part of pyasn1-modules software.
  4. #
  5. # Created by Stanisław Pitucha with asn1ate tool.
  6. # Modified by Russ Housley to add a maps for CMC Control Attributes
  7. # and CMC Content Types for use with opentypes.
  8. #
  9. # Copyright (c) 2005-2019, Ilya Etingof <etingof@gmail.com>
  10. # License: http://snmplabs.com/pyasn1/license.html
  11. #
  12. # Certificate Management over CMS (CMC) Updates
  13. #
  14. # ASN.1 source from:
  15. # https://www.rfc-editor.org/rfc/rfc6402.txt
  16. #
  17. from pyasn1.type import char
  18. from pyasn1.type import constraint
  19. from pyasn1.type import namedtype
  20. from pyasn1.type import namedval
  21. from pyasn1.type import opentype
  22. from pyasn1.type import tag
  23. from pyasn1.type import univ
  24. from pyasn1.type import useful
  25. from pyasn1_modules import rfc4211
  26. from pyasn1_modules import rfc5280
  27. from pyasn1_modules import rfc5652
  28. MAX = float('inf')
  29. def _buildOid(*components):
  30. output = []
  31. for x in tuple(components):
  32. if isinstance(x, univ.ObjectIdentifier):
  33. output.extend(list(x))
  34. else:
  35. output.append(int(x))
  36. return univ.ObjectIdentifier(output)
  37. cmcControlAttributesMap = { }
  38. class ChangeSubjectName(univ.Sequence):
  39. pass
  40. ChangeSubjectName.componentType = namedtype.NamedTypes(
  41. namedtype.OptionalNamedType('subject', rfc5280.Name()),
  42. namedtype.OptionalNamedType('subjectAlt', rfc5280.GeneralNames())
  43. )
  44. class AttributeValue(univ.Any):
  45. pass
  46. class CMCStatus(univ.Integer):
  47. pass
  48. CMCStatus.namedValues = namedval.NamedValues(
  49. ('success', 0),
  50. ('failed', 2),
  51. ('pending', 3),
  52. ('noSupport', 4),
  53. ('confirmRequired', 5),
  54. ('popRequired', 6),
  55. ('partial', 7)
  56. )
  57. class PendInfo(univ.Sequence):
  58. pass
  59. PendInfo.componentType = namedtype.NamedTypes(
  60. namedtype.NamedType('pendToken', univ.OctetString()),
  61. namedtype.NamedType('pendTime', useful.GeneralizedTime())
  62. )
  63. bodyIdMax = univ.Integer(4294967295)
  64. class BodyPartID(univ.Integer):
  65. pass
  66. BodyPartID.subtypeSpec = constraint.ValueRangeConstraint(0, bodyIdMax)
  67. class BodyPartPath(univ.SequenceOf):
  68. pass
  69. BodyPartPath.componentType = BodyPartID()
  70. BodyPartPath.sizeSpec = constraint.ValueSizeConstraint(1, MAX)
  71. class BodyPartReference(univ.Choice):
  72. pass
  73. BodyPartReference.componentType = namedtype.NamedTypes(
  74. namedtype.NamedType('bodyPartID', BodyPartID()),
  75. namedtype.NamedType('bodyPartPath', BodyPartPath())
  76. )
  77. class CMCFailInfo(univ.Integer):
  78. pass
  79. CMCFailInfo.namedValues = namedval.NamedValues(
  80. ('badAlg', 0),
  81. ('badMessageCheck', 1),
  82. ('badRequest', 2),
  83. ('badTime', 3),
  84. ('badCertId', 4),
  85. ('unsupportedExt', 5),
  86. ('mustArchiveKeys', 6),
  87. ('badIdentity', 7),
  88. ('popRequired', 8),
  89. ('popFailed', 9),
  90. ('noKeyReuse', 10),
  91. ('internalCAError', 11),
  92. ('tryLater', 12),
  93. ('authDataFail', 13)
  94. )
  95. class CMCStatusInfoV2(univ.Sequence):
  96. pass
  97. CMCStatusInfoV2.componentType = namedtype.NamedTypes(
  98. namedtype.NamedType('cMCStatus', CMCStatus()),
  99. namedtype.NamedType('bodyList', univ.SequenceOf(componentType=BodyPartReference())),
  100. namedtype.OptionalNamedType('statusString', char.UTF8String()),
  101. namedtype.OptionalNamedType(
  102. 'otherInfo', univ.Choice(
  103. componentType=namedtype.NamedTypes(
  104. namedtype.NamedType('failInfo', CMCFailInfo()),
  105. namedtype.NamedType('pendInfo', PendInfo()),
  106. namedtype.NamedType(
  107. 'extendedFailInfo', univ.Sequence(
  108. componentType=namedtype.NamedTypes(
  109. namedtype.NamedType('failInfoOID', univ.ObjectIdentifier()),
  110. namedtype.NamedType('failInfoValue', AttributeValue()))
  111. )
  112. )
  113. )
  114. )
  115. )
  116. )
  117. class GetCRL(univ.Sequence):
  118. pass
  119. GetCRL.componentType = namedtype.NamedTypes(
  120. namedtype.NamedType('issuerName', rfc5280.Name()),
  121. namedtype.OptionalNamedType('cRLName', rfc5280.GeneralName()),
  122. namedtype.OptionalNamedType('time', useful.GeneralizedTime()),
  123. namedtype.OptionalNamedType('reasons', rfc5280.ReasonFlags())
  124. )
  125. id_pkix = _buildOid(1, 3, 6, 1, 5, 5, 7)
  126. id_cmc = _buildOid(id_pkix, 7)
  127. id_cmc_batchResponses = _buildOid(id_cmc, 29)
  128. id_cmc_popLinkWitness = _buildOid(id_cmc, 23)
  129. class PopLinkWitnessV2(univ.Sequence):
  130. pass
  131. PopLinkWitnessV2.componentType = namedtype.NamedTypes(
  132. namedtype.NamedType('keyGenAlgorithm', rfc5280.AlgorithmIdentifier()),
  133. namedtype.NamedType('macAlgorithm', rfc5280.AlgorithmIdentifier()),
  134. namedtype.NamedType('witness', univ.OctetString())
  135. )
  136. id_cmc_popLinkWitnessV2 = _buildOid(id_cmc, 33)
  137. id_cmc_identityProofV2 = _buildOid(id_cmc, 34)
  138. id_cmc_revokeRequest = _buildOid(id_cmc, 17)
  139. id_cmc_recipientNonce = _buildOid(id_cmc, 7)
  140. class ControlsProcessed(univ.Sequence):
  141. pass
  142. ControlsProcessed.componentType = namedtype.NamedTypes(
  143. namedtype.NamedType('bodyList', univ.SequenceOf(componentType=BodyPartReference()))
  144. )
  145. class CertificationRequest(univ.Sequence):
  146. pass
  147. CertificationRequest.componentType = namedtype.NamedTypes(
  148. namedtype.NamedType(
  149. 'certificationRequestInfo', univ.Sequence(
  150. componentType=namedtype.NamedTypes(
  151. namedtype.NamedType('version', univ.Integer()),
  152. namedtype.NamedType('subject', rfc5280.Name()),
  153. namedtype.NamedType(
  154. 'subjectPublicKeyInfo', univ.Sequence(
  155. componentType=namedtype.NamedTypes(
  156. namedtype.NamedType('algorithm', rfc5280.AlgorithmIdentifier()),
  157. namedtype.NamedType('subjectPublicKey', univ.BitString())
  158. )
  159. )
  160. ),
  161. namedtype.NamedType(
  162. 'attributes', univ.SetOf(
  163. componentType=rfc5652.Attribute()).subtype(
  164. implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))
  165. )
  166. )
  167. )
  168. ),
  169. namedtype.NamedType('signatureAlgorithm', rfc5280.AlgorithmIdentifier()),
  170. namedtype.NamedType('signature', univ.BitString())
  171. )
  172. class TaggedCertificationRequest(univ.Sequence):
  173. pass
  174. TaggedCertificationRequest.componentType = namedtype.NamedTypes(
  175. namedtype.NamedType('bodyPartID', BodyPartID()),
  176. namedtype.NamedType('certificationRequest', CertificationRequest())
  177. )
  178. class TaggedRequest(univ.Choice):
  179. pass
  180. TaggedRequest.componentType = namedtype.NamedTypes(
  181. namedtype.NamedType('tcr', TaggedCertificationRequest().subtype(
  182. implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
  183. namedtype.NamedType('crm',
  184. rfc4211.CertReqMsg().subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))),
  185. namedtype.NamedType('orm', univ.Sequence(componentType=namedtype.NamedTypes(
  186. namedtype.NamedType('bodyPartID', BodyPartID()),
  187. namedtype.NamedType('requestMessageType', univ.ObjectIdentifier()),
  188. namedtype.NamedType('requestMessageValue', univ.Any())
  189. ))
  190. .subtype(implicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2)))
  191. )
  192. id_cmc_popLinkRandom = _buildOid(id_cmc, 22)
  193. id_cmc_statusInfo = _buildOid(id_cmc, 1)
  194. id_cmc_trustedAnchors = _buildOid(id_cmc, 26)
  195. id_cmc_transactionId = _buildOid(id_cmc, 5)
  196. id_cmc_encryptedPOP = _buildOid(id_cmc, 9)
  197. class PublishTrustAnchors(univ.Sequence):
  198. pass
  199. PublishTrustAnchors.componentType = namedtype.NamedTypes(
  200. namedtype.NamedType('seqNumber', univ.Integer()),
  201. namedtype.NamedType('hashAlgorithm', rfc5280.AlgorithmIdentifier()),
  202. namedtype.NamedType('anchorHashes', univ.SequenceOf(componentType=univ.OctetString()))
  203. )
  204. class RevokeRequest(univ.Sequence):
  205. pass
  206. RevokeRequest.componentType = namedtype.NamedTypes(
  207. namedtype.NamedType('issuerName', rfc5280.Name()),
  208. namedtype.NamedType('serialNumber', univ.Integer()),
  209. namedtype.NamedType('reason', rfc5280.CRLReason()),
  210. namedtype.OptionalNamedType('invalidityDate', useful.GeneralizedTime()),
  211. namedtype.OptionalNamedType('passphrase', univ.OctetString()),
  212. namedtype.OptionalNamedType('comment', char.UTF8String())
  213. )
  214. id_cmc_senderNonce = _buildOid(id_cmc, 6)
  215. id_cmc_authData = _buildOid(id_cmc, 27)
  216. class TaggedContentInfo(univ.Sequence):
  217. pass
  218. TaggedContentInfo.componentType = namedtype.NamedTypes(
  219. namedtype.NamedType('bodyPartID', BodyPartID()),
  220. namedtype.NamedType('contentInfo', rfc5652.ContentInfo())
  221. )
  222. class IdentifyProofV2(univ.Sequence):
  223. pass
  224. IdentifyProofV2.componentType = namedtype.NamedTypes(
  225. namedtype.NamedType('proofAlgID', rfc5280.AlgorithmIdentifier()),
  226. namedtype.NamedType('macAlgId', rfc5280.AlgorithmIdentifier()),
  227. namedtype.NamedType('witness', univ.OctetString())
  228. )
  229. class CMCPublicationInfo(univ.Sequence):
  230. pass
  231. CMCPublicationInfo.componentType = namedtype.NamedTypes(
  232. namedtype.NamedType('hashAlg', rfc5280.AlgorithmIdentifier()),
  233. namedtype.NamedType('certHashes', univ.SequenceOf(componentType=univ.OctetString())),
  234. namedtype.NamedType('pubInfo', rfc4211.PKIPublicationInfo())
  235. )
  236. id_kp_cmcCA = _buildOid(rfc5280.id_kp, 27)
  237. id_cmc_confirmCertAcceptance = _buildOid(id_cmc, 24)
  238. id_cmc_raIdentityWitness = _buildOid(id_cmc, 35)
  239. id_ExtensionReq = _buildOid(1, 2, 840, 113549, 1, 9, 14)
  240. id_cct = _buildOid(id_pkix, 12)
  241. id_cct_PKIData = _buildOid(id_cct, 2)
  242. id_kp_cmcRA = _buildOid(rfc5280.id_kp, 28)
  243. class CMCStatusInfo(univ.Sequence):
  244. pass
  245. CMCStatusInfo.componentType = namedtype.NamedTypes(
  246. namedtype.NamedType('cMCStatus', CMCStatus()),
  247. namedtype.NamedType('bodyList', univ.SequenceOf(componentType=BodyPartID())),
  248. namedtype.OptionalNamedType('statusString', char.UTF8String()),
  249. namedtype.OptionalNamedType(
  250. 'otherInfo', univ.Choice(
  251. componentType=namedtype.NamedTypes(
  252. namedtype.NamedType('failInfo', CMCFailInfo()),
  253. namedtype.NamedType('pendInfo', PendInfo())
  254. )
  255. )
  256. )
  257. )
  258. class DecryptedPOP(univ.Sequence):
  259. pass
  260. DecryptedPOP.componentType = namedtype.NamedTypes(
  261. namedtype.NamedType('bodyPartID', BodyPartID()),
  262. namedtype.NamedType('thePOPAlgID', rfc5280.AlgorithmIdentifier()),
  263. namedtype.NamedType('thePOP', univ.OctetString())
  264. )
  265. id_cmc_addExtensions = _buildOid(id_cmc, 8)
  266. id_cmc_modCertTemplate = _buildOid(id_cmc, 31)
  267. class TaggedAttribute(univ.Sequence):
  268. pass
  269. TaggedAttribute.componentType = namedtype.NamedTypes(
  270. namedtype.NamedType('bodyPartID', BodyPartID()),
  271. namedtype.NamedType('attrType', univ.ObjectIdentifier()),
  272. namedtype.NamedType('attrValues', univ.SetOf(componentType=AttributeValue()),
  273. openType=opentype.OpenType('attrType', cmcControlAttributesMap)
  274. )
  275. )
  276. class OtherMsg(univ.Sequence):
  277. pass
  278. OtherMsg.componentType = namedtype.NamedTypes(
  279. namedtype.NamedType('bodyPartID', BodyPartID()),
  280. namedtype.NamedType('otherMsgType', univ.ObjectIdentifier()),
  281. namedtype.NamedType('otherMsgValue', univ.Any())
  282. )
  283. class PKIData(univ.Sequence):
  284. pass
  285. PKIData.componentType = namedtype.NamedTypes(
  286. namedtype.NamedType('controlSequence', univ.SequenceOf(componentType=TaggedAttribute())),
  287. namedtype.NamedType('reqSequence', univ.SequenceOf(componentType=TaggedRequest())),
  288. namedtype.NamedType('cmsSequence', univ.SequenceOf(componentType=TaggedContentInfo())),
  289. namedtype.NamedType('otherMsgSequence', univ.SequenceOf(componentType=OtherMsg()))
  290. )
  291. class BodyPartList(univ.SequenceOf):
  292. pass
  293. BodyPartList.componentType = BodyPartID()
  294. BodyPartList.sizeSpec = constraint.ValueSizeConstraint(1, MAX)
  295. id_cmc_responseBody = _buildOid(id_cmc, 37)
  296. class AuthPublish(BodyPartID):
  297. pass
  298. class CMCUnsignedData(univ.Sequence):
  299. pass
  300. CMCUnsignedData.componentType = namedtype.NamedTypes(
  301. namedtype.NamedType('bodyPartPath', BodyPartPath()),
  302. namedtype.NamedType('identifier', univ.ObjectIdentifier()),
  303. namedtype.NamedType('content', univ.Any())
  304. )
  305. class CMCCertId(rfc5652.IssuerAndSerialNumber):
  306. pass
  307. class PKIResponse(univ.Sequence):
  308. pass
  309. PKIResponse.componentType = namedtype.NamedTypes(
  310. namedtype.NamedType('controlSequence', univ.SequenceOf(componentType=TaggedAttribute())),
  311. namedtype.NamedType('cmsSequence', univ.SequenceOf(componentType=TaggedContentInfo())),
  312. namedtype.NamedType('otherMsgSequence', univ.SequenceOf(componentType=OtherMsg()))
  313. )
  314. class ResponseBody(PKIResponse):
  315. pass
  316. id_cmc_statusInfoV2 = _buildOid(id_cmc, 25)
  317. id_cmc_lraPOPWitness = _buildOid(id_cmc, 11)
  318. class ModCertTemplate(univ.Sequence):
  319. pass
  320. ModCertTemplate.componentType = namedtype.NamedTypes(
  321. namedtype.NamedType('pkiDataReference', BodyPartPath()),
  322. namedtype.NamedType('certReferences', BodyPartList()),
  323. namedtype.DefaultedNamedType('replace', univ.Boolean().subtype(value=1)),
  324. namedtype.NamedType('certTemplate', rfc4211.CertTemplate())
  325. )
  326. id_cmc_regInfo = _buildOid(id_cmc, 18)
  327. id_cmc_identityProof = _buildOid(id_cmc, 3)
  328. class ExtensionReq(univ.SequenceOf):
  329. pass
  330. ExtensionReq.componentType = rfc5280.Extension()
  331. ExtensionReq.sizeSpec = constraint.ValueSizeConstraint(1, MAX)
  332. id_kp_cmcArchive = _buildOid(rfc5280.id_kp, 28)
  333. id_cmc_publishCert = _buildOid(id_cmc, 30)
  334. id_cmc_dataReturn = _buildOid(id_cmc, 4)
  335. class LraPopWitness(univ.Sequence):
  336. pass
  337. LraPopWitness.componentType = namedtype.NamedTypes(
  338. namedtype.NamedType('pkiDataBodyid', BodyPartID()),
  339. namedtype.NamedType('bodyIds', univ.SequenceOf(componentType=BodyPartID()))
  340. )
  341. id_aa = _buildOid(1, 2, 840, 113549, 1, 9, 16, 2)
  342. id_aa_cmc_unsignedData = _buildOid(id_aa, 34)
  343. id_cmc_getCert = _buildOid(id_cmc, 15)
  344. id_cmc_batchRequests = _buildOid(id_cmc, 28)
  345. id_cmc_decryptedPOP = _buildOid(id_cmc, 10)
  346. id_cmc_responseInfo = _buildOid(id_cmc, 19)
  347. id_cmc_changeSubjectName = _buildOid(id_cmc, 36)
  348. class GetCert(univ.Sequence):
  349. pass
  350. GetCert.componentType = namedtype.NamedTypes(
  351. namedtype.NamedType('issuerName', rfc5280.GeneralName()),
  352. namedtype.NamedType('serialNumber', univ.Integer())
  353. )
  354. id_cmc_identification = _buildOid(id_cmc, 2)
  355. id_cmc_queryPending = _buildOid(id_cmc, 21)
  356. class AddExtensions(univ.Sequence):
  357. pass
  358. AddExtensions.componentType = namedtype.NamedTypes(
  359. namedtype.NamedType('pkiDataReference', BodyPartID()),
  360. namedtype.NamedType('certReferences', univ.SequenceOf(componentType=BodyPartID())),
  361. namedtype.NamedType('extensions', univ.SequenceOf(componentType=rfc5280.Extension()))
  362. )
  363. class EncryptedPOP(univ.Sequence):
  364. pass
  365. EncryptedPOP.componentType = namedtype.NamedTypes(
  366. namedtype.NamedType('request', TaggedRequest()),
  367. namedtype.NamedType('cms', rfc5652.ContentInfo()),
  368. namedtype.NamedType('thePOPAlgID', rfc5280.AlgorithmIdentifier()),
  369. namedtype.NamedType('witnessAlgID', rfc5280.AlgorithmIdentifier()),
  370. namedtype.NamedType('witness', univ.OctetString())
  371. )
  372. id_cmc_getCRL = _buildOid(id_cmc, 16)
  373. id_cct_PKIResponse = _buildOid(id_cct, 3)
  374. id_cmc_controlProcessed = _buildOid(id_cmc, 32)
  375. class NoSignatureValue(univ.OctetString):
  376. pass
  377. id_ad_cmc = _buildOid(rfc5280.id_ad, 12)
  378. id_alg_noSignature = _buildOid(id_pkix, 6, 2)
  379. # Map of CMC Control OIDs to CMC Control Attributes
  380. _cmcControlAttributesMapUpdate = {
  381. id_cmc_statusInfo: CMCStatusInfo(),
  382. id_cmc_statusInfoV2: CMCStatusInfoV2(),
  383. id_cmc_identification: char.UTF8String(),
  384. id_cmc_identityProof: univ.OctetString(),
  385. id_cmc_identityProofV2: IdentifyProofV2(),
  386. id_cmc_dataReturn: univ.OctetString(),
  387. id_cmc_transactionId: univ.Integer(),
  388. id_cmc_senderNonce: univ.OctetString(),
  389. id_cmc_recipientNonce: univ.OctetString(),
  390. id_cmc_addExtensions: AddExtensions(),
  391. id_cmc_encryptedPOP: EncryptedPOP(),
  392. id_cmc_decryptedPOP: DecryptedPOP(),
  393. id_cmc_lraPOPWitness: LraPopWitness(),
  394. id_cmc_getCert: GetCert(),
  395. id_cmc_getCRL: GetCRL(),
  396. id_cmc_revokeRequest: RevokeRequest(),
  397. id_cmc_regInfo: univ.OctetString(),
  398. id_cmc_responseInfo: univ.OctetString(),
  399. id_cmc_queryPending: univ.OctetString(),
  400. id_cmc_popLinkRandom: univ.OctetString(),
  401. id_cmc_popLinkWitness: univ.OctetString(),
  402. id_cmc_popLinkWitnessV2: PopLinkWitnessV2(),
  403. id_cmc_confirmCertAcceptance: CMCCertId(),
  404. id_cmc_trustedAnchors: PublishTrustAnchors(),
  405. id_cmc_authData: AuthPublish(),
  406. id_cmc_batchRequests: BodyPartList(),
  407. id_cmc_batchResponses: BodyPartList(),
  408. id_cmc_publishCert: CMCPublicationInfo(),
  409. id_cmc_modCertTemplate: ModCertTemplate(),
  410. id_cmc_controlProcessed: ControlsProcessed(),
  411. id_ExtensionReq: ExtensionReq(),
  412. }
  413. cmcControlAttributesMap.update(_cmcControlAttributesMapUpdate)
  414. # Map of CMC Content Type OIDs to CMC Content Types are added to
  415. # the ones that are in rfc5652.py
  416. _cmsContentTypesMapUpdate = {
  417. id_cct_PKIData: PKIData(),
  418. id_cct_PKIResponse: PKIResponse(),
  419. }
  420. rfc5652.cmsContentTypesMap.update(_cmsContentTypesMapUpdate)