rfc4210.py 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803
  1. #
  2. # This file is part of pyasn1-modules software.
  3. #
  4. # Copyright (c) 2005-2020, Ilya Etingof <etingof@gmail.com>
  5. # License: http://snmplabs.com/pyasn1/license.html
  6. #
  7. # Certificate Management Protocol structures as per RFC4210
  8. #
  9. # Based on Alex Railean's work
  10. #
  11. from pyasn1.type import char
  12. from pyasn1.type import constraint
  13. from pyasn1.type import namedtype
  14. from pyasn1.type import namedval
  15. from pyasn1.type import tag
  16. from pyasn1.type import univ
  17. from pyasn1.type import useful
  18. from pyasn1_modules import rfc2314
  19. from pyasn1_modules import rfc2459
  20. from pyasn1_modules import rfc2511
  21. MAX = float('inf')
  22. class KeyIdentifier(univ.OctetString):
  23. pass
  24. class CMPCertificate(rfc2459.Certificate):
  25. pass
  26. class OOBCert(CMPCertificate):
  27. pass
  28. class CertAnnContent(CMPCertificate):
  29. pass
  30. class PKIFreeText(univ.SequenceOf):
  31. """
  32. PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String
  33. """
  34. componentType = char.UTF8String()
  35. sizeSpec = univ.SequenceOf.sizeSpec + constraint.ValueSizeConstraint(1, MAX)
  36. class PollRepContent(univ.SequenceOf):
  37. """
  38. PollRepContent ::= SEQUENCE OF SEQUENCE {
  39. certReqId INTEGER,
  40. checkAfter INTEGER, -- time in seconds
  41. reason PKIFreeText OPTIONAL
  42. }
  43. """
  44. class CertReq(univ.Sequence):
  45. componentType = namedtype.NamedTypes(
  46. namedtype.NamedType('certReqId', univ.Integer()),
  47. namedtype.NamedType('checkAfter', univ.Integer()),
  48. namedtype.OptionalNamedType('reason', PKIFreeText())
  49. )
  50. componentType = CertReq()
  51. class PollReqContent(univ.SequenceOf):
  52. """
  53. PollReqContent ::= SEQUENCE OF SEQUENCE {
  54. certReqId INTEGER
  55. }
  56. """
  57. class CertReq(univ.Sequence):
  58. componentType = namedtype.NamedTypes(
  59. namedtype.NamedType('certReqId', univ.Integer())
  60. )
  61. componentType = CertReq()
  62. class InfoTypeAndValue(univ.Sequence):
  63. """
  64. InfoTypeAndValue ::= SEQUENCE {
  65. infoType OBJECT IDENTIFIER,
  66. infoValue ANY DEFINED BY infoType OPTIONAL
  67. }"""
  68. componentType = namedtype.NamedTypes(
  69. namedtype.NamedType('infoType', univ.ObjectIdentifier()),
  70. namedtype.OptionalNamedType('infoValue', univ.Any())
  71. )
  72. class GenRepContent(univ.SequenceOf):
  73. componentType = InfoTypeAndValue()
  74. class GenMsgContent(univ.SequenceOf):
  75. componentType = InfoTypeAndValue()
  76. class PKIConfirmContent(univ.Null):
  77. pass
  78. class CRLAnnContent(univ.SequenceOf):
  79. componentType = rfc2459.CertificateList()
  80. class CAKeyUpdAnnContent(univ.Sequence):
  81. """
  82. CAKeyUpdAnnContent ::= SEQUENCE {
  83. oldWithNew CMPCertificate,
  84. newWithOld CMPCertificate,
  85. newWithNew CMPCertificate
  86. }
  87. """
  88. componentType = namedtype.NamedTypes(
  89. namedtype.NamedType('oldWithNew', CMPCertificate()),
  90. namedtype.NamedType('newWithOld', CMPCertificate()),
  91. namedtype.NamedType('newWithNew', CMPCertificate())
  92. )
  93. class RevDetails(univ.Sequence):
  94. """
  95. RevDetails ::= SEQUENCE {
  96. certDetails CertTemplate,
  97. crlEntryDetails Extensions OPTIONAL
  98. }
  99. """
  100. componentType = namedtype.NamedTypes(
  101. namedtype.NamedType('certDetails', rfc2511.CertTemplate()),
  102. namedtype.OptionalNamedType('crlEntryDetails', rfc2459.Extensions())
  103. )
  104. class RevReqContent(univ.SequenceOf):
  105. componentType = RevDetails()
  106. class CertOrEncCert(univ.Choice):
  107. """
  108. CertOrEncCert ::= CHOICE {
  109. certificate [0] CMPCertificate,
  110. encryptedCert [1] EncryptedValue
  111. }
  112. """
  113. componentType = namedtype.NamedTypes(
  114. namedtype.NamedType('certificate', CMPCertificate().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
  115. namedtype.NamedType('encryptedCert', rfc2511.EncryptedValue().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1)))
  116. )
  117. class CertifiedKeyPair(univ.Sequence):
  118. """
  119. CertifiedKeyPair ::= SEQUENCE {
  120. certOrEncCert CertOrEncCert,
  121. privateKey [0] EncryptedValue OPTIONAL,
  122. publicationInfo [1] PKIPublicationInfo OPTIONAL
  123. }
  124. """
  125. componentType = namedtype.NamedTypes(
  126. namedtype.NamedType('certOrEncCert', CertOrEncCert()),
  127. namedtype.OptionalNamedType('privateKey', rfc2511.EncryptedValue().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))),
  128. namedtype.OptionalNamedType('publicationInfo', rfc2511.PKIPublicationInfo().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1)))
  129. )
  130. class POPODecKeyRespContent(univ.SequenceOf):
  131. componentType = univ.Integer()
  132. class Challenge(univ.Sequence):
  133. """
  134. Challenge ::= SEQUENCE {
  135. owf AlgorithmIdentifier OPTIONAL,
  136. witness OCTET STRING,
  137. challenge OCTET STRING
  138. }
  139. """
  140. componentType = namedtype.NamedTypes(
  141. namedtype.OptionalNamedType('owf', rfc2459.AlgorithmIdentifier()),
  142. namedtype.NamedType('witness', univ.OctetString()),
  143. namedtype.NamedType('challenge', univ.OctetString())
  144. )
  145. class PKIStatus(univ.Integer):
  146. """
  147. PKIStatus ::= INTEGER {
  148. accepted (0),
  149. grantedWithMods (1),
  150. rejection (2),
  151. waiting (3),
  152. revocationWarning (4),
  153. revocationNotification (5),
  154. keyUpdateWarning (6)
  155. }
  156. """
  157. namedValues = namedval.NamedValues(
  158. ('accepted', 0),
  159. ('grantedWithMods', 1),
  160. ('rejection', 2),
  161. ('waiting', 3),
  162. ('revocationWarning', 4),
  163. ('revocationNotification', 5),
  164. ('keyUpdateWarning', 6)
  165. )
  166. class PKIFailureInfo(univ.BitString):
  167. """
  168. PKIFailureInfo ::= BIT STRING {
  169. badAlg (0),
  170. badMessageCheck (1),
  171. badRequest (2),
  172. badTime (3),
  173. badCertId (4),
  174. badDataFormat (5),
  175. wrongAuthority (6),
  176. incorrectData (7),
  177. missingTimeStamp (8),
  178. badPOP (9),
  179. certRevoked (10),
  180. certConfirmed (11),
  181. wrongIntegrity (12),
  182. badRecipientNonce (13),
  183. timeNotAvailable (14),
  184. unacceptedPolicy (15),
  185. unacceptedExtension (16),
  186. addInfoNotAvailable (17),
  187. badSenderNonce (18),
  188. badCertTemplate (19),
  189. signerNotTrusted (20),
  190. transactionIdInUse (21),
  191. unsupportedVersion (22),
  192. notAuthorized (23),
  193. systemUnavail (24),
  194. systemFailure (25),
  195. duplicateCertReq (26)
  196. """
  197. namedValues = namedval.NamedValues(
  198. ('badAlg', 0),
  199. ('badMessageCheck', 1),
  200. ('badRequest', 2),
  201. ('badTime', 3),
  202. ('badCertId', 4),
  203. ('badDataFormat', 5),
  204. ('wrongAuthority', 6),
  205. ('incorrectData', 7),
  206. ('missingTimeStamp', 8),
  207. ('badPOP', 9),
  208. ('certRevoked', 10),
  209. ('certConfirmed', 11),
  210. ('wrongIntegrity', 12),
  211. ('badRecipientNonce', 13),
  212. ('timeNotAvailable', 14),
  213. ('unacceptedPolicy', 15),
  214. ('unacceptedExtension', 16),
  215. ('addInfoNotAvailable', 17),
  216. ('badSenderNonce', 18),
  217. ('badCertTemplate', 19),
  218. ('signerNotTrusted', 20),
  219. ('transactionIdInUse', 21),
  220. ('unsupportedVersion', 22),
  221. ('notAuthorized', 23),
  222. ('systemUnavail', 24),
  223. ('systemFailure', 25),
  224. ('duplicateCertReq', 26)
  225. )
  226. class PKIStatusInfo(univ.Sequence):
  227. """
  228. PKIStatusInfo ::= SEQUENCE {
  229. status PKIStatus,
  230. statusString PKIFreeText OPTIONAL,
  231. failInfo PKIFailureInfo OPTIONAL
  232. }
  233. """
  234. componentType = namedtype.NamedTypes(
  235. namedtype.NamedType('status', PKIStatus()),
  236. namedtype.OptionalNamedType('statusString', PKIFreeText()),
  237. namedtype.OptionalNamedType('failInfo', PKIFailureInfo())
  238. )
  239. class ErrorMsgContent(univ.Sequence):
  240. """
  241. ErrorMsgContent ::= SEQUENCE {
  242. pKIStatusInfo PKIStatusInfo,
  243. errorCode INTEGER OPTIONAL,
  244. -- implementation-specific error codes
  245. errorDetails PKIFreeText OPTIONAL
  246. -- implementation-specific error details
  247. }
  248. """
  249. componentType = namedtype.NamedTypes(
  250. namedtype.NamedType('pKIStatusInfo', PKIStatusInfo()),
  251. namedtype.OptionalNamedType('errorCode', univ.Integer()),
  252. namedtype.OptionalNamedType('errorDetails', PKIFreeText())
  253. )
  254. class CertStatus(univ.Sequence):
  255. """
  256. CertStatus ::= SEQUENCE {
  257. certHash OCTET STRING,
  258. certReqId INTEGER,
  259. statusInfo PKIStatusInfo OPTIONAL
  260. }
  261. """
  262. componentType = namedtype.NamedTypes(
  263. namedtype.NamedType('certHash', univ.OctetString()),
  264. namedtype.NamedType('certReqId', univ.Integer()),
  265. namedtype.OptionalNamedType('statusInfo', PKIStatusInfo())
  266. )
  267. class CertConfirmContent(univ.SequenceOf):
  268. componentType = CertStatus()
  269. class RevAnnContent(univ.Sequence):
  270. """
  271. RevAnnContent ::= SEQUENCE {
  272. status PKIStatus,
  273. certId CertId,
  274. willBeRevokedAt GeneralizedTime,
  275. badSinceDate GeneralizedTime,
  276. crlDetails Extensions OPTIONAL
  277. }
  278. """
  279. componentType = namedtype.NamedTypes(
  280. namedtype.NamedType('status', PKIStatus()),
  281. namedtype.NamedType('certId', rfc2511.CertId()),
  282. namedtype.NamedType('willBeRevokedAt', useful.GeneralizedTime()),
  283. namedtype.NamedType('badSinceDate', useful.GeneralizedTime()),
  284. namedtype.OptionalNamedType('crlDetails', rfc2459.Extensions())
  285. )
  286. class RevRepContent(univ.Sequence):
  287. """
  288. RevRepContent ::= SEQUENCE {
  289. status SEQUENCE SIZE (1..MAX) OF PKIStatusInfo,
  290. revCerts [0] SEQUENCE SIZE (1..MAX) OF CertId
  291. OPTIONAL,
  292. crls [1] SEQUENCE SIZE (1..MAX) OF CertificateList
  293. OPTIONAL
  294. """
  295. componentType = namedtype.NamedTypes(
  296. namedtype.NamedType(
  297. 'status', univ.SequenceOf(
  298. componentType=PKIStatusInfo(),
  299. sizeSpec=constraint.ValueSizeConstraint(1, MAX)
  300. )
  301. ),
  302. namedtype.OptionalNamedType(
  303. 'revCerts', univ.SequenceOf(componentType=rfc2511.CertId()).subtype(
  304. sizeSpec=constraint.ValueSizeConstraint(1, MAX),
  305. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0)
  306. )
  307. ),
  308. namedtype.OptionalNamedType(
  309. 'crls', univ.SequenceOf(componentType=rfc2459.CertificateList()).subtype(
  310. sizeSpec=constraint.ValueSizeConstraint(1, MAX),
  311. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1)
  312. )
  313. )
  314. )
  315. class KeyRecRepContent(univ.Sequence):
  316. """
  317. KeyRecRepContent ::= SEQUENCE {
  318. status PKIStatusInfo,
  319. newSigCert [0] CMPCertificate OPTIONAL,
  320. caCerts [1] SEQUENCE SIZE (1..MAX) OF
  321. CMPCertificate OPTIONAL,
  322. keyPairHist [2] SEQUENCE SIZE (1..MAX) OF
  323. CertifiedKeyPair OPTIONAL
  324. }
  325. """
  326. componentType = namedtype.NamedTypes(
  327. namedtype.NamedType('status', PKIStatusInfo()),
  328. namedtype.OptionalNamedType(
  329. 'newSigCert', CMPCertificate().subtype(
  330. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0)
  331. )
  332. ),
  333. namedtype.OptionalNamedType(
  334. 'caCerts', univ.SequenceOf(componentType=CMPCertificate()).subtype(
  335. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1),
  336. sizeSpec=constraint.ValueSizeConstraint(1, MAX)
  337. )
  338. ),
  339. namedtype.OptionalNamedType('keyPairHist', univ.SequenceOf(componentType=CertifiedKeyPair()).subtype(
  340. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2),
  341. sizeSpec=constraint.ValueSizeConstraint(1, MAX))
  342. )
  343. )
  344. class CertResponse(univ.Sequence):
  345. """
  346. CertResponse ::= SEQUENCE {
  347. certReqId INTEGER,
  348. status PKIStatusInfo,
  349. certifiedKeyPair CertifiedKeyPair OPTIONAL,
  350. rspInfo OCTET STRING OPTIONAL
  351. }
  352. """
  353. componentType = namedtype.NamedTypes(
  354. namedtype.NamedType('certReqId', univ.Integer()),
  355. namedtype.NamedType('status', PKIStatusInfo()),
  356. namedtype.OptionalNamedType('certifiedKeyPair', CertifiedKeyPair()),
  357. namedtype.OptionalNamedType('rspInfo', univ.OctetString())
  358. )
  359. class CertRepMessage(univ.Sequence):
  360. """
  361. CertRepMessage ::= SEQUENCE {
  362. caPubs [1] SEQUENCE SIZE (1..MAX) OF CMPCertificate
  363. OPTIONAL,
  364. response SEQUENCE OF CertResponse
  365. }
  366. """
  367. componentType = namedtype.NamedTypes(
  368. namedtype.OptionalNamedType(
  369. 'caPubs', univ.SequenceOf(
  370. componentType=CMPCertificate()
  371. ).subtype(sizeSpec=constraint.ValueSizeConstraint(1, MAX),
  372. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1))
  373. ),
  374. namedtype.NamedType('response', univ.SequenceOf(componentType=CertResponse()))
  375. )
  376. class POPODecKeyChallContent(univ.SequenceOf):
  377. componentType = Challenge()
  378. class OOBCertHash(univ.Sequence):
  379. """
  380. OOBCertHash ::= SEQUENCE {
  381. hashAlg [0] AlgorithmIdentifier OPTIONAL,
  382. certId [1] CertId OPTIONAL,
  383. hashVal BIT STRING
  384. }
  385. """
  386. componentType = namedtype.NamedTypes(
  387. namedtype.OptionalNamedType(
  388. 'hashAlg', rfc2459.AlgorithmIdentifier().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0))
  389. ),
  390. namedtype.OptionalNamedType(
  391. 'certId', rfc2511.CertId().subtype(explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1))
  392. ),
  393. namedtype.NamedType('hashVal', univ.BitString())
  394. )
  395. # pyasn1 does not naturally handle recursive definitions, thus this hack:
  396. # NestedMessageContent ::= PKIMessages
  397. class NestedMessageContent(univ.SequenceOf):
  398. """
  399. NestedMessageContent ::= PKIMessages
  400. """
  401. componentType = univ.Any()
  402. class DHBMParameter(univ.Sequence):
  403. """
  404. DHBMParameter ::= SEQUENCE {
  405. owf AlgorithmIdentifier,
  406. -- AlgId for a One-Way Function (SHA-1 recommended)
  407. mac AlgorithmIdentifier
  408. -- the MAC AlgId (e.g., DES-MAC, Triple-DES-MAC [PKCS11],
  409. } -- or HMAC [RFC2104, RFC2202])
  410. """
  411. componentType = namedtype.NamedTypes(
  412. namedtype.NamedType('owf', rfc2459.AlgorithmIdentifier()),
  413. namedtype.NamedType('mac', rfc2459.AlgorithmIdentifier())
  414. )
  415. id_DHBasedMac = univ.ObjectIdentifier('1.2.840.113533.7.66.30')
  416. class PBMParameter(univ.Sequence):
  417. """
  418. PBMParameter ::= SEQUENCE {
  419. salt OCTET STRING,
  420. owf AlgorithmIdentifier,
  421. iterationCount INTEGER,
  422. mac AlgorithmIdentifier
  423. }
  424. """
  425. componentType = namedtype.NamedTypes(
  426. namedtype.NamedType(
  427. 'salt', univ.OctetString().subtype(subtypeSpec=constraint.ValueSizeConstraint(0, 128))
  428. ),
  429. namedtype.NamedType('owf', rfc2459.AlgorithmIdentifier()),
  430. namedtype.NamedType('iterationCount', univ.Integer()),
  431. namedtype.NamedType('mac', rfc2459.AlgorithmIdentifier())
  432. )
  433. id_PasswordBasedMac = univ.ObjectIdentifier('1.2.840.113533.7.66.13')
  434. class PKIProtection(univ.BitString):
  435. pass
  436. # pyasn1 does not naturally handle recursive definitions, thus this hack:
  437. # NestedMessageContent ::= PKIMessages
  438. nestedMessageContent = NestedMessageContent().subtype(
  439. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 20))
  440. class PKIBody(univ.Choice):
  441. """
  442. PKIBody ::= CHOICE { -- message-specific body elements
  443. ir [0] CertReqMessages, --Initialization Request
  444. ip [1] CertRepMessage, --Initialization Response
  445. cr [2] CertReqMessages, --Certification Request
  446. cp [3] CertRepMessage, --Certification Response
  447. p10cr [4] CertificationRequest, --imported from [PKCS10]
  448. popdecc [5] POPODecKeyChallContent, --pop Challenge
  449. popdecr [6] POPODecKeyRespContent, --pop Response
  450. kur [7] CertReqMessages, --Key Update Request
  451. kup [8] CertRepMessage, --Key Update Response
  452. krr [9] CertReqMessages, --Key Recovery Request
  453. krp [10] KeyRecRepContent, --Key Recovery Response
  454. rr [11] RevReqContent, --Revocation Request
  455. rp [12] RevRepContent, --Revocation Response
  456. ccr [13] CertReqMessages, --Cross-Cert. Request
  457. ccp [14] CertRepMessage, --Cross-Cert. Response
  458. ckuann [15] CAKeyUpdAnnContent, --CA Key Update Ann.
  459. cann [16] CertAnnContent, --Certificate Ann.
  460. rann [17] RevAnnContent, --Revocation Ann.
  461. crlann [18] CRLAnnContent, --CRL Announcement
  462. pkiconf [19] PKIConfirmContent, --Confirmation
  463. nested [20] NestedMessageContent, --Nested Message
  464. genm [21] GenMsgContent, --General Message
  465. genp [22] GenRepContent, --General Response
  466. error [23] ErrorMsgContent, --Error Message
  467. certConf [24] CertConfirmContent, --Certificate confirm
  468. pollReq [25] PollReqContent, --Polling request
  469. pollRep [26] PollRepContent --Polling response
  470. """
  471. componentType = namedtype.NamedTypes(
  472. namedtype.NamedType(
  473. 'ir', rfc2511.CertReqMessages().subtype(
  474. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 0)
  475. )
  476. ),
  477. namedtype.NamedType(
  478. 'ip', CertRepMessage().subtype(
  479. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1)
  480. )
  481. ),
  482. namedtype.NamedType(
  483. 'cr', rfc2511.CertReqMessages().subtype(
  484. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 2)
  485. )
  486. ),
  487. namedtype.NamedType(
  488. 'cp', CertRepMessage().subtype(
  489. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 3)
  490. )
  491. ),
  492. namedtype.NamedType(
  493. 'p10cr', rfc2314.CertificationRequest().subtype(
  494. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 4)
  495. )
  496. ),
  497. namedtype.NamedType(
  498. 'popdecc', POPODecKeyChallContent().subtype(
  499. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 5)
  500. )
  501. ),
  502. namedtype.NamedType(
  503. 'popdecr', POPODecKeyRespContent().subtype(
  504. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 6)
  505. )
  506. ),
  507. namedtype.NamedType(
  508. 'kur', rfc2511.CertReqMessages().subtype(
  509. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 7)
  510. )
  511. ),
  512. namedtype.NamedType(
  513. 'kup', CertRepMessage().subtype(
  514. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 8)
  515. )
  516. ),
  517. namedtype.NamedType(
  518. 'krr', rfc2511.CertReqMessages().subtype(
  519. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 9)
  520. )
  521. ),
  522. namedtype.NamedType(
  523. 'krp', KeyRecRepContent().subtype(
  524. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 10)
  525. )
  526. ),
  527. namedtype.NamedType(
  528. 'rr', RevReqContent().subtype(
  529. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 11)
  530. )
  531. ),
  532. namedtype.NamedType(
  533. 'rp', RevRepContent().subtype(
  534. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 12)
  535. )
  536. ),
  537. namedtype.NamedType(
  538. 'ccr', rfc2511.CertReqMessages().subtype(
  539. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 13)
  540. )
  541. ),
  542. namedtype.NamedType(
  543. 'ccp', CertRepMessage().subtype(
  544. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 14)
  545. )
  546. ),
  547. namedtype.NamedType(
  548. 'ckuann', CAKeyUpdAnnContent().subtype(
  549. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 15)
  550. )
  551. ),
  552. namedtype.NamedType(
  553. 'cann', CertAnnContent().subtype(
  554. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 16)
  555. )
  556. ),
  557. namedtype.NamedType(
  558. 'rann', RevAnnContent().subtype(
  559. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 17)
  560. )
  561. ),
  562. namedtype.NamedType(
  563. 'crlann', CRLAnnContent().subtype(
  564. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 18)
  565. )
  566. ),
  567. namedtype.NamedType(
  568. 'pkiconf', PKIConfirmContent().subtype(
  569. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 19)
  570. )
  571. ),
  572. namedtype.NamedType(
  573. 'nested', nestedMessageContent
  574. ),
  575. # namedtype.NamedType('nested', NestedMessageContent().subtype(
  576. # explicitTag=tag.Tag(tag.tagClassContext,tag.tagFormatConstructed,20)
  577. # )
  578. # ),
  579. namedtype.NamedType(
  580. 'genm', GenMsgContent().subtype(
  581. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 21)
  582. )
  583. ),
  584. namedtype.NamedType(
  585. 'gen', GenRepContent().subtype(
  586. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 22)
  587. )
  588. ),
  589. namedtype.NamedType(
  590. 'error', ErrorMsgContent().subtype(
  591. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 23)
  592. )
  593. ),
  594. namedtype.NamedType(
  595. 'certConf', CertConfirmContent().subtype(
  596. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 24)
  597. )
  598. ),
  599. namedtype.NamedType(
  600. 'pollReq', PollReqContent().subtype(
  601. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 25)
  602. )
  603. ),
  604. namedtype.NamedType(
  605. 'pollRep', PollRepContent().subtype(
  606. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 26)
  607. )
  608. )
  609. )
  610. class PKIHeader(univ.Sequence):
  611. """
  612. PKIHeader ::= SEQUENCE {
  613. pvno INTEGER { cmp1999(1), cmp2000(2) },
  614. sender GeneralName,
  615. recipient GeneralName,
  616. messageTime [0] GeneralizedTime OPTIONAL,
  617. protectionAlg [1] AlgorithmIdentifier OPTIONAL,
  618. senderKID [2] KeyIdentifier OPTIONAL,
  619. recipKID [3] KeyIdentifier OPTIONAL,
  620. transactionID [4] OCTET STRING OPTIONAL,
  621. senderNonce [5] OCTET STRING OPTIONAL,
  622. recipNonce [6] OCTET STRING OPTIONAL,
  623. freeText [7] PKIFreeText OPTIONAL,
  624. generalInfo [8] SEQUENCE SIZE (1..MAX) OF
  625. InfoTypeAndValue OPTIONAL
  626. }
  627. """
  628. componentType = namedtype.NamedTypes(
  629. namedtype.NamedType(
  630. 'pvno', univ.Integer(
  631. namedValues=namedval.NamedValues(('cmp1999', 1), ('cmp2000', 2))
  632. )
  633. ),
  634. namedtype.NamedType('sender', rfc2459.GeneralName()),
  635. namedtype.NamedType('recipient', rfc2459.GeneralName()),
  636. namedtype.OptionalNamedType('messageTime', useful.GeneralizedTime().subtype(
  637. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
  638. namedtype.OptionalNamedType('protectionAlg', rfc2459.AlgorithmIdentifier().subtype(
  639. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1))),
  640. namedtype.OptionalNamedType('senderKID', rfc2459.KeyIdentifier().subtype(
  641. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 2))),
  642. namedtype.OptionalNamedType('recipKID', rfc2459.KeyIdentifier().subtype(
  643. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 3))),
  644. namedtype.OptionalNamedType('transactionID', univ.OctetString().subtype(
  645. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 4))),
  646. namedtype.OptionalNamedType('senderNonce', univ.OctetString().subtype(
  647. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 5))),
  648. namedtype.OptionalNamedType('recipNonce', univ.OctetString().subtype(
  649. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 6))),
  650. namedtype.OptionalNamedType('freeText', PKIFreeText().subtype(
  651. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 7))),
  652. namedtype.OptionalNamedType('generalInfo',
  653. univ.SequenceOf(
  654. componentType=InfoTypeAndValue().subtype(
  655. sizeSpec=constraint.ValueSizeConstraint(1, MAX)
  656. )
  657. ).subtype(
  658. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 8))
  659. )
  660. )
  661. class ProtectedPart(univ.Sequence):
  662. """
  663. ProtectedPart ::= SEQUENCE {
  664. header PKIHeader,
  665. body PKIBody
  666. }
  667. """
  668. componentType = namedtype.NamedTypes(
  669. namedtype.NamedType('header', PKIHeader()),
  670. namedtype.NamedType('infoValue', PKIBody())
  671. )
  672. class PKIMessage(univ.Sequence):
  673. """
  674. PKIMessage ::= SEQUENCE {
  675. header PKIHeader,
  676. body PKIBody,
  677. protection [0] PKIProtection OPTIONAL,
  678. extraCerts [1] SEQUENCE SIZE (1..MAX) OF CMPCertificate
  679. OPTIONAL
  680. }"""
  681. componentType = namedtype.NamedTypes(
  682. namedtype.NamedType('header', PKIHeader()),
  683. namedtype.NamedType('body', PKIBody()),
  684. namedtype.OptionalNamedType('protection', PKIProtection().subtype(
  685. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatSimple, 0))),
  686. namedtype.OptionalNamedType('extraCerts',
  687. univ.SequenceOf(
  688. componentType=CMPCertificate()
  689. ).subtype(
  690. sizeSpec=constraint.ValueSizeConstraint(1, MAX),
  691. explicitTag=tag.Tag(tag.tagClassContext, tag.tagFormatConstructed, 1)
  692. )
  693. )
  694. )
  695. class PKIMessages(univ.SequenceOf):
  696. """
  697. PKIMessages ::= SEQUENCE SIZE (1..MAX) OF PKIMessage
  698. """
  699. componentType = PKIMessage()
  700. sizeSpec = univ.SequenceOf.sizeSpec + constraint.ValueSizeConstraint(1, MAX)
  701. # pyasn1 does not naturally handle recursive definitions, thus this hack:
  702. # NestedMessageContent ::= PKIMessages
  703. NestedMessageContent._componentType = PKIMessages()
  704. nestedMessageContent._componentType = PKIMessages()