| OLD | NEW |
| (Empty) |
| 1 # | |
| 2 # OCSP request/response syntax | |
| 3 # | |
| 4 # Derived from a minimal OCSP library (RFC2560) code written by | |
| 5 # Bud P. Bruegger <bud@ancitel.it> | |
| 6 # Copyright: Ancitel, S.p.a, Rome, Italy | |
| 7 # License: BSD | |
| 8 # | |
| 9 | |
| 10 # | |
| 11 # current limitations: | |
| 12 # * request and response works only for a single certificate | |
| 13 # * only some values are parsed out of the response | |
| 14 # * the request does't set a nonce nor signature | |
| 15 # * there is no signature validation of the response | |
| 16 # * dates are left as strings in GeneralizedTime format -- datetime.datetime | |
| 17 # would be nicer | |
| 18 # | |
| 19 from pyasn1.type import tag, namedtype, namedval, univ, constraint, useful | |
| 20 from pyasn1_modules import rfc2459 | |
| 21 | |
| 22 # Start of OCSP module definitions | |
| 23 | |
| 24 # This should be in directory Authentication Framework (X.509) module | |
| 25 | |
| 26 class CRLReason(univ.Enumerated): | |
| 27 namedValues = namedval.NamedValues( | |
| 28 ('unspecified', 0), | |
| 29 ('keyCompromise', 1), | |
| 30 ('cACompromise', 2), | |
| 31 ('affiliationChanged', 3), | |
| 32 ('superseded', 4), | |
| 33 ('cessationOfOperation', 5), | |
| 34 ('certificateHold', 6), | |
| 35 ('removeFromCRL', 8), | |
| 36 ('privilegeWithdrawn', 9), | |
| 37 ('aACompromise', 10) | |
| 38 ) | |
| 39 | |
| 40 # end of directory Authentication Framework (X.509) module | |
| 41 | |
| 42 # This should be in PKIX Certificate Extensions module | |
| 43 | |
| 44 class GeneralName(univ.OctetString): pass | |
| 45 | |
| 46 # end of PKIX Certificate Extensions module | |
| 47 | |
| 48 id_kp_OCSPSigning = univ.ObjectIdentifier((1, 3, 6, 1, 5, 5, 7, 3, 9)) | |
| 49 id_pkix_ocsp = univ.ObjectIdentifier((1, 3, 6, 1, 5, 5, 7, 48, 1)) | |
| 50 id_pkix_ocsp_basic = univ.ObjectIdentifier((1, 3, 6, 1, 5, 5, 7, 48, 1, 1)) | |
| 51 id_pkix_ocsp_nonce = univ.ObjectIdentifier((1, 3, 6, 1, 5, 5, 7, 48, 1, 2)) | |
| 52 id_pkix_ocsp_crl = univ.ObjectIdentifier((1, 3, 6, 1, 5, 5, 7, 48, 1, 3)) | |
| 53 id_pkix_ocsp_response = univ.ObjectIdentifier((1, 3, 6, 1, 5, 5, 7, 48, 1, 4)) | |
| 54 id_pkix_ocsp_nocheck = univ.ObjectIdentifier((1, 3, 6, 1, 5, 5, 7, 48, 1, 5)) | |
| 55 id_pkix_ocsp_archive_cutoff = univ.ObjectIdentifier((1, 3, 6, 1, 5, 5, 7, 48, 1,
6)) | |
| 56 id_pkix_ocsp_service_locator = univ.ObjectIdentifier((1, 3, 6, 1, 5, 5, 7, 48, 1
, 7)) | |
| 57 | |
| 58 class AcceptableResponses(univ.SequenceOf): | |
| 59 componentType = univ.ObjectIdentifier() | |
| 60 | |
| 61 class ArchiveCutoff(useful.GeneralizedTime): pass | |
| 62 | |
| 63 class UnknownInfo(univ.Null): pass | |
| 64 | |
| 65 class RevokedInfo(univ.Sequence): | |
| 66 componentType = namedtype.NamedTypes( | |
| 67 namedtype.NamedType('revocationTime', useful.GeneralizedTime()), | |
| 68 namedtype.OptionalNamedType('revocationReason', CRLReason().subtype(expl
icitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) | |
| 69 ) | |
| 70 | |
| 71 class CertID(univ.Sequence): | |
| 72 componentType = namedtype.NamedTypes( | |
| 73 namedtype.NamedType('hashAlgorithm', rfc2459.AlgorithmIdentifier()), | |
| 74 namedtype.NamedType('issuerNameHash', univ.OctetString()), | |
| 75 namedtype.NamedType('issuerKeyHash', univ.OctetString()), | |
| 76 namedtype.NamedType('serialNumber', rfc2459.CertificateSerialNumber()) | |
| 77 ) | |
| 78 | |
| 79 class CertStatus(univ.Choice): | |
| 80 componentType = namedtype.NamedTypes( | |
| 81 namedtype.NamedType('good', univ.Null().subtype(implicitTag=tag.Tag(tag.
tagClassContext, tag.tagFormatSimple, 0))), | |
| 82 namedtype.NamedType('revoked', RevokedInfo().subtype(implicitTag=tag.Tag
(tag.tagClassContext, tag.tagFormatSimple, 1))), | |
| 83 namedtype.NamedType('unknown', UnknownInfo().subtype(implicitTag=tag.Tag
(tag.tagClassContext, tag.tagFormatSimple, 2))) | |
| 84 ) | |
| 85 | |
| 86 class SingleResponse(univ.Sequence): | |
| 87 componentType = namedtype.NamedTypes( | |
| 88 namedtype.NamedType('certID', CertID()), | |
| 89 namedtype.NamedType('certStatus', CertStatus()), | |
| 90 namedtype.NamedType('thisUpdate', useful.GeneralizedTime()), | |
| 91 namedtype.OptionalNamedType('nextUpdate', useful.GeneralizedTime().subty
pe(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), | |
| 92 namedtype.OptionalNamedType('singleExtensions', rfc2459.Extensions().sub
type(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) | |
| 93 ) | |
| 94 | |
| 95 class KeyHash(univ.OctetString): pass | |
| 96 | |
| 97 class ResponderID(univ.Choice): | |
| 98 componentType = namedtype.NamedTypes( | |
| 99 namedtype.NamedType('byName', rfc2459.Name().subtype(implicitTag=tag.Tag
(tag.tagClassContext, tag.tagFormatSimple, 1))), | |
| 100 namedtype.NamedType('byKey', KeyHash().subtype(implicitTag=tag.Tag(tag.t
agClassContext, tag.tagFormatSimple, 2))) | |
| 101 ) | |
| 102 | |
| 103 class Version(univ.Integer): | |
| 104 namedValues = namedval.NamedValues(('v1', 0)) | |
| 105 | |
| 106 class ResponseData(univ.Sequence): | |
| 107 componentType = namedtype.NamedTypes( | |
| 108 namedtype.DefaultedNamedType('version', Version('v1').subtype(explicitTa
g=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), | |
| 109 namedtype.NamedType('responderID', ResponderID()), | |
| 110 namedtype.NamedType('producedAt', useful.GeneralizedTime()), | |
| 111 namedtype.NamedType('responses', univ.SequenceOf(SingleResponse())), | |
| 112 namedtype.OptionalNamedType('responseExtensions', rfc2459.Extensions().s
ubtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))) | |
| 113 ) | |
| 114 | |
| 115 class BasicOCSPResponse(univ.Sequence): | |
| 116 componentType = namedtype.NamedTypes( | |
| 117 namedtype.NamedType('tbsResponseData', ResponseData()), | |
| 118 namedtype.NamedType('signatureAlgorithm', rfc2459.AlgorithmIdentifier())
, | |
| 119 namedtype.NamedType('signature', univ.BitString()), | |
| 120 namedtype.OptionalNamedType('certs', univ.SequenceOf(rfc2459.Certificate
()).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) | |
| 121 ) | |
| 122 | |
| 123 class ResponseBytes(univ.Sequence): | |
| 124 componentType = namedtype.NamedTypes( | |
| 125 namedtype.NamedType('responseType', univ.ObjectIdentifier()), | |
| 126 namedtype.NamedType('response', univ.OctetString()) | |
| 127 ) | |
| 128 | |
| 129 class OCSPResponseStatus(univ.Enumerated): | |
| 130 namedValues = namedval.NamedValues( | |
| 131 ('successful', 0), | |
| 132 ('malformedRequest', 1), | |
| 133 ('internalError', 2), | |
| 134 ('tryLater', 3), | |
| 135 ('undefinedStatus', 4), # should never occur | |
| 136 ('sigRequired', 5), | |
| 137 ('unauthorized', 6) | |
| 138 ) | |
| 139 | |
| 140 class OCSPResponse(univ.Sequence): | |
| 141 componentType = namedtype.NamedTypes( | |
| 142 namedtype.NamedType('responseStatus', OCSPResponseStatus()), | |
| 143 namedtype.OptionalNamedType('responseBytes', ResponseBytes().subtype(exp
licitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) | |
| 144 ) | |
| 145 | |
| 146 class Request(univ.Sequence): | |
| 147 componentType = namedtype.NamedTypes( | |
| 148 namedtype.NamedType('reqCert', CertID()), | |
| 149 namedtype.OptionalNamedType('singleRequestExtensions', rfc2459.Extension
s().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) | |
| 150 ) | |
| 151 | |
| 152 class Signature(univ.Sequence): | |
| 153 componentType = namedtype.NamedTypes( | |
| 154 namedtype.NamedType('signatureAlgorithm', rfc2459.AlgorithmIdentifier())
, | |
| 155 namedtype.NamedType('signature', univ.BitString()), | |
| 156 namedtype.OptionalNamedType('certs', univ.SequenceOf(rfc2459.Certificate
()).subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) | |
| 157 ) | |
| 158 | |
| 159 class TBSRequest(univ.Sequence): | |
| 160 componentType = namedtype.NamedTypes( | |
| 161 namedtype.DefaultedNamedType('version', Version('v1').subtype(explicitTa
g=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))), | |
| 162 namedtype.OptionalNamedType('requestorName', GeneralName().subtype(expli
citTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 1))), | |
| 163 namedtype.NamedType('requestList', univ.SequenceOf(Request())), | |
| 164 namedtype.OptionalNamedType('requestExtensions', rfc2459.Extensions().su
btype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))) | |
| 165 ) | |
| 166 | |
| 167 class OCSPRequest(univ.Sequence): | |
| 168 componentType = namedtype.NamedTypes( | |
| 169 namedtype.NamedType('tbsRequest', TBSRequest()), | |
| 170 namedtype.OptionalNamedType('optionalSignature', Signature().subtype(exp
licitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))) | |
| 171 ) | |
| OLD | NEW |