mirror/naiveproxy
1
0
Fork 0
mirror of https://github.com/klzgrad/naiveproxy.git synced 2024-11-28 16:26:10 +03:00
Code Issues Projects Releases Wiki Activity
315928efa9
naiveproxy/net/tools/testserver/minica.py
klzgrad 46caed9b9c Import chromium-70.0.3538.110
2018-12-09 21:59:24 -05:00

570 lines
22 KiB
Python
Raw Blame History

# Copyright (c) 2012 The Chromium Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
import asn1
import datetime
import hashlib
import itertools
import os
import time
GENERALIZED_TIME_FORMAT = "%Y%m%d%H%M%SZ"
OCSP_STATE_GOOD = 1
OCSP_STATE_REVOKED = 2
OCSP_STATE_INVALID_RESPONSE = 3
OCSP_STATE_UNAUTHORIZED = 4
OCSP_STATE_UNKNOWN = 5
OCSP_STATE_TRY_LATER = 6
OCSP_STATE_INVALID_RESPONSE_DATA = 7
OCSP_STATE_MISMATCHED_SERIAL = 8
OCSP_DATE_VALID = 1
OCSP_DATE_OLD = 2
OCSP_DATE_EARLY = 3
OCSP_DATE_LONG = 4
OCSP_DATE_LONGER = 5
OCSP_PRODUCED_VALID = 1
OCSP_PRODUCED_BEFORE_CERT = 2
OCSP_PRODUCED_AFTER_CERT = 3
# This file implements very minimal certificate and OCSP generation. It's
# designed to test revocation checking.
def RandomNumber(length_in_bytes):
'''RandomNumber returns a random number of length 8*|length_in_bytes| bits'''
rand = os.urandom(length_in_bytes)
n = 0
for x in rand:
n <<= 8
n |= ord(x)
return n
def ModExp(n, e, p):
'''ModExp returns n^e mod p'''
r = 1
while e != 0:
if e & 1:
r = (r*n) % p
e >>= 1
n = (n*n) % p
return r
# PKCS1v15_SHA256_PREFIX is the ASN.1 prefix for a SHA256 signature.
PKCS1v15_SHA256_PREFIX = '3031300d060960864801650304020105000420'.decode('hex')
class RSA(object):
def __init__(self, modulus, e, d):
self.m = modulus
self.e = e
self.d = d
self.modlen = 0
m = modulus
while m != 0:
self.modlen += 1
m >>= 8
def Sign(self, message):
digest = hashlib.sha256(message).digest()
prefix = PKCS1v15_SHA256_PREFIX
em = ['\xff'] * (self.modlen - 1 - len(prefix) - len(digest))
em[0] = '\x00'
em[1] = '\x01'
em += "\x00" + prefix + digest
n = 0
for x in em:
n <<= 8
n |= ord(x)
s = ModExp(n, self.d, self.m)
out = []
while s != 0:
out.append(s & 0xff)
s >>= 8
out.reverse()
return '\x00' * (self.modlen - len(out)) + asn1.ToBytes(out)
def ToDER(self):
return asn1.ToDER(asn1.SEQUENCE([self.m, self.e]))
def Name(cn):
return asn1.SEQUENCE([
asn1.SET([
asn1.SEQUENCE([
COMMON_NAME, cn,
])
])
])
# The private key and root certificate name are hard coded here:
# This is the root private key
ROOT_KEY = RSA(0x00c1541fac63d3b969aa231a02cb2e0d9ee7b26724f136c121b2c28bdae5caa87733cc407ad83842ef20ec67d941b448a1ce3557cf5ddebf3c9bde8f36f253ee73e670d1c4c6631d1ddc0e39cbde09b833f66347ea379c3fa891d61a0ca005b38b0b2cad1058e3589c9f30600be81e4ff4ac220972c17b74f92f03d72b496f643543d0b27a5227f1efee13c138888b23cb101877b3b4dc091f0b3bb6fc3c792187b05ab38e97862f8af6156bcbfbb824385132c6741e6c65cfcd5f13142421a210b95185884c4866f3ea644dfb8006133d14e72a4704f3e700cf827ca5ffd2ef74c2ab6a5259ffff40f0f7f607891388f917fc9fc9e65742df1bfa0b322140bb65,
65537,
0x00980f2db66ef249e4954074a5fbdf663135363a3071554ac4d19079661bd5b179c890ffaa5fc4a8c8e3116e81104fd7cd049f2a48dd2165332bb9fad511f6f817cb09b3c45cf1fa25d13e9331099c8578c173c74dae9dc3e83784ba0a7216e9e8144af8786221b741c167d033ad47a245e4da04aa710a44aff5cdc480b48adbba3575d1315555690f081f9f69691e801e34c21240bcd3df9573ec5f9aa290c5ed19404fb911ab28b7680e0be086487273db72da6621f24d8c66197a5f1b7687efe1d9e3b6655af2891d4540482e1246ff5f62ce61b8b5dcb2c66ade6bb41e0bf071445fb8544aa0a489780f770a6f1031ee19347641794f4ad17354d579a9d061)
# Root certificate CN
ROOT_CN = "Testing CA"
# All certificates are issued under this policy OID, in the Google arc:
CERT_POLICY_OID = asn1.OID([1, 3, 6, 1, 4, 1, 11129, 2, 4, 1])
# These result in the following root certificate:
# -----BEGIN CERTIFICATE-----
# MIIC1DCCAbygAwIBAgIBATANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwpUZXN0
# aW5nIENBMB4XDTEwMDEwMTA2MDAwMFoXDTMyMTIwMTA2MDAwMFowFTETMBEGA1UE
# AxMKVGVzdGluZyBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMFU
# H6xj07lpqiMaAssuDZ7nsmck8TbBIbLCi9rlyqh3M8xAetg4Qu8g7GfZQbRIoc41
# V89d3r88m96PNvJT7nPmcNHExmMdHdwOOcveCbgz9mNH6jecP6iR1hoMoAWziwss
# rRBY41icnzBgC+geT/SsIglywXt0+S8D1ytJb2Q1Q9CyelIn8e/uE8E4iIsjyxAY
# d7O03AkfCzu2/Dx5IYewWrOOl4YvivYVa8v7uCQ4UTLGdB5sZc/NXxMUJCGiELlR
# hYhMSGbz6mRN+4AGEz0U5ypHBPPnAM+CfKX/0u90wqtqUln//0Dw9/YHiROI+Rf8
# n8nmV0LfG/oLMiFAu2UCAwEAAaMvMC0wEgYDVR0TAQH/BAgwBgEB/wIBATAXBgNV
# HSAEEDAOMAwGCisGAQQB1nkCBAEwDQYJKoZIhvcNAQELBQADggEBADNrvoAyqAVm
# bydPBBfLRqyH4DXt2vuMVmnSdnWnOxYiEezGmNSNiO1k1ZFBwVSsd+JHrT24lax9
# kvU1yQDW//PBu3ijfZOCaIUleQiGXHMGfV4MjzgYbxpvHOvEUC6IXmYCsIEwcZgK
# lrwnfJQ3MVU4hOgGTlOTWYPtCwvTsBObNRLdIs+ifMQiWmzPBlM8XeX4e5acDjTb
# emcN4szU3EcgmCA0LvBIRI4F6NWpaIJl2WnLyMUDyKq4vjpRJOZkNwAC+525duDr
# JFE4PKR2Lh53nJQIJv6mcTZQkX1mmw0yzqWxcGCoHACma3TgSwOHryvSopL+t26+
# ZlQvP2ygwqY=
# -----END CERTIFICATE-----
# If you update any of the above, you can generate a new root by running this
# file as a script.
INTERMEDIATE_KEY = RSA(0x00c661afcc659f88855a83ade8fb792dc13d0cf388b17bece9149cf0b8556d27b19101d081fb2a842d13a2ac95d8308ddd66783843ecc5806513959eb6b30dd69b2845d97e10d0bbbf653d686dc8828935022cc96f9e030b567157257d3d6526734080bb9727cee0d30f4209d5820e1d662f358fc789c0e9366d84f89adf1beb8d843f74e6f325876ac35d5c11691fcb296967c06edf69450c16bb2314c14599fe90725d5ec90f2db6698afae72bba0cfbf77967c7e8b49f2172f9381827c27ab7f9471c62bd8da4a6c657966ec1385cf41d739449835888f30d64971619dcd380408cd74f25c3be19833a92620c9cf710da67e15ac8cef69bc7e4e5e7f813c1ed,
65537,
0x77c5e2edf52d2cafd6c649e9b06aa9455226cfa26805fa337f4e81c7c94bedfb3721715208e2d28aa4a042b2f5a3db03212ad44dae564ffeb6a44efedf7c2b65e21aca056301a3591b36c82600394fbdc16268fc0adaabadb5207871f4ef6d17888a30b84240955cd889768681cf23d0de0fe88f008c8841643e341acd397e2d1104a23242e566088b7617c26ae8b48a85b6c9b7dc64ef1fa5e9b124ff8c1659a82d8225f28a820cc6ca07beff0354364c631a9142309fea1d8b054f6e00e23c54b493a21fcbe89a646b39d1acba5bc2ace9bba0252671d42a15202f3afccc912114d6c20eb3131e74289f2c744c5b39e7d3780fe21402ab1c3ae65854fee401)
# Intermediate certificate CN prefix (random serial number is added to the CN
# in order to avoid caching issues.)
INTERMEDIATE_CN_PREFIX = "Testing Intermediate CA"
LEAF_KEY = RSA(0x00cd12d317b39cfbb160fb1dc9c9f0dc8fef3604dda4d8c557392ce1d616483713f78216cadbefd1c76ea0f3bbbe410e24b233b1b73583922b09314e249b2cfde1be0995e13f160fb630c10d447750da20ffaa4880006717feaa3e4db602e4f511b5cc312f770f44b037784effec62640f948aa189c3769f03bdd0e22a36ecfa5951f5577de195a4fba33c879b657968b79138fd7ab389a9968522f7389c6052be1ff78bc168d3ea961e132a044eba33ac07ead95367c7b815e91eca924d914fd0d811349b8bf500707ba71a43a2901a545f34e1792e72654f6649fab9716f4ba17379ee8042186bbba9b9bac416a60474cc60686f0e6e4b01259cc3cb5873edf9,
65537,
0x009c23e81bd4c30314743dded9646b82d408937db2f0afa7d9988be6cba59d886a287aa13605ad9c7117776efc94885de76cd3554da46e301d9a5b331f4613449edb9ddac36cd0345848d8c46c4bd880acbd5cfee48ee9efe813e16a33da124fd213348c8292494ac84d03ca4aabc5e25fc67ea32e0c6845fc884b01d8988768b8b931c41de49708dbcd5fcb61823f9a1f7507c6f364be4cb5a8cf24af4925997030dd4f67a0c9c6813401cc8b2f5d1971ee0022770239b7042fde8228c33942e9c0a0b18854cb1b5542be928338ab33ac936bbba174e55457007b16f36011dbb8f4258abe64e42b1cfa79803d30170b7ecf3e7c595d42003fff72591e07acd9cd)
LEAF_KEY_PEM = '''-----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEAzRLTF7Oc+7Fg+x3JyfDcj+82BN2k2MVXOSzh1hZINxP3ghbK
2+/Rx26g87u+QQ4ksjOxtzWDkisJMU4kmyz94b4JleE/Fg+2MMENRHdQ2iD/qkiA
AGcX/qo+TbYC5PURtcwxL3cPRLA3eE7/7GJkD5SKoYnDdp8DvdDiKjbs+llR9Vd9
4ZWk+6M8h5tleWi3kTj9erOJqZaFIvc4nGBSvh/3i8Fo0+qWHhMqBE66M6wH6tlT
Z8e4FekeypJNkU/Q2BE0m4v1AHB7pxpDopAaVF804XkucmVPZkn6uXFvS6Fzee6A
Qhhru6m5usQWpgR0zGBobw5uSwElnMPLWHPt+QIDAQABAoIBAQCcI+gb1MMDFHQ9
3tlka4LUCJN9svCvp9mYi+bLpZ2Iaih6oTYFrZxxF3du/JSIXeds01VNpG4wHZpb
Mx9GE0Se253aw2zQNFhI2MRsS9iArL1c/uSO6e/oE+FqM9oST9ITNIyCkklKyE0D
ykqrxeJfxn6jLgxoRfyISwHYmIdouLkxxB3klwjbzV/LYYI/mh91B8bzZL5MtajP
JK9JJZlwMN1PZ6DJxoE0AcyLL10Zce4AIncCObcEL96CKMM5QunAoLGIVMsbVUK+
koM4qzOsk2u7oXTlVFcAexbzYBHbuPQlir5k5Csc+nmAPTAXC37PPnxZXUIAP/9y
WR4HrNnNAoGBAPmOqTe7ntto6rDEsU1cKOJFKIZ7UVcSByyz8aLrvj1Rb2mkrNJU
SdTqJvtqrvDXgO0HuGtFOzsZrRV9+XRPd2P0mP0uhfRiYGWT8hnILGyI2+7zlC/w
HDtLEefelhtdOVKgUaLQXptSn7aGalUHghZKWjRNT5ah+U85MoI2ZkDbAoGBANJe
KvrBBPSFLj+x2rsMhG+ksK0I6tivapVvSTtDV3ME1DvA/4BIMV/nIZyoH4AYI72c
m/vD66+eCqh75cq5BzbVD63tR+ZRi/VdT1HJcl2IFXynk6eaBw8v7gpQyx6t3iSK
lx/dIdpLt1BQuR4qI6x1wYp7Utn98soEkiFXzgq7AoGBAJTLBYPQXvgNBxlcPSaV
016Nw4rjTe0vN43kwCbWjjf7LQV9BPnm/Zpv/cwboLDCnQE2gDOdNKKZPYS59pjt
pI65UNpr+bxrR3RpEIlku2/+7br8ChfG/t4vdT6djTxFih8ErYf42t+bFNT8Mbv+
3QYzULMsgU6bxo0A2meezbrPAoGBAK/IxmtQXP6iRxosWRUSCZxs5sFAgVVdh1el
bXEa/Xj8IQhpZlbgfHmh3oFULzZPdZYcxm7jsQ7HpipRlZwHbtLPyNFSRFFd9PCr
7vrttSYY77OBKC3V1G5JY8S07HYPXV/1ewDCPGZ3/I8dVQKyvap/n6FDGeFUhctv
dFhuUZq/AoGAWLXlbcIl1cvOhfFJ5owohJhzh9oW9tlCtjV5/dlix2RaE5CtDZWS
oMm4sQu9HiA8jLDP1MEEMRFPrPXdrZnxnSqVd1DgabSegD1/ZCb1QlWwQWkk5QU+
wotPOMI33L50kZqUaDP+1XSL0Dyfo/pYpm4tYy/5QmP6WKXCtFUXybI=
-----END RSA PRIVATE KEY-----
'''
# Various OIDs
AIA_OCSP = asn1.OID([1, 3, 6, 1, 5, 5, 7, 48, 1])
AIA_CA_ISSUERS = asn1.OID([1, 3, 6, 1, 5, 5, 7, 48, 2])
AUTHORITY_INFORMATION_ACCESS = asn1.OID([1, 3, 6, 1, 5, 5, 7, 1, 1])
BASIC_CONSTRAINTS = asn1.OID([2, 5, 29, 19])
CERT_POLICIES = asn1.OID([2, 5, 29, 32])
COMMON_NAME = asn1.OID([2, 5, 4, 3])
COUNTRY = asn1.OID([2, 5, 4, 6])
HASH_SHA1 = asn1.OID([1, 3, 14, 3, 2, 26])
OCSP_TYPE_BASIC = asn1.OID([1, 3, 6, 1, 5, 5, 7, 48, 1, 1])
ORGANIZATION = asn1.OID([2, 5, 4, 10])
PUBLIC_KEY_RSA = asn1.OID([1, 2, 840, 113549, 1, 1, 1])
SHA256_WITH_RSA_ENCRYPTION = asn1.OID([1, 2, 840, 113549, 1, 1, 11])
SUBJECT_ALTERNATIVE_NAME = asn1.OID([2, 5, 29, 17])
def MakeCertificate(
issuer_cn, subject_cn, serial, pubkey, privkey, ocsp_url = None,
ca_issuers_url = None, is_ca=False, path_len=None, ip_sans=None,
dns_sans=None):
'''MakeCertificate returns a DER encoded certificate, signed by privkey.'''
extensions = asn1.SEQUENCE([])
if is_ca:
# Root certificate.
c = None
o = None
extensions.children.append(
asn1.SEQUENCE([
BASIC_CONSTRAINTS,
True,
asn1.OCTETSTRING(asn1.ToDER(asn1.SEQUENCE([
True, # IsCA
] + ([path_len] if path_len is not None else []) # Path len
))),
]))
if ip_sans is not None or dns_sans is not None:
sans = []
if dns_sans is not None:
for dns_name in dns_sans:
sans.append(
asn1.Raw(asn1.TagAndLength(0x82, len(dns_name)) + dns_name))
if ip_sans is not None:
for ip_addr in ip_sans:
sans.append(
asn1.Raw(asn1.TagAndLength(0x87, len(ip_addr)) + ip_addr))
extensions.children.append(
asn1.SEQUENCE([
SUBJECT_ALTERNATIVE_NAME,
# There is implicitly a critical=False here. Since false is the
# default, encoding the value would be invalid DER.
asn1.OCTETSTRING(asn1.ToDER(asn1.SEQUENCE(sans)))
]))
if ocsp_url is not None or ca_issuers_url is not None:
aia_entries = []
if ocsp_url is not None:
aia_entries.append(
asn1.SEQUENCE([
AIA_OCSP,
asn1.Raw(asn1.TagAndLength(0x86, len(ocsp_url)) + ocsp_url),
]))
if ca_issuers_url is not None:
aia_entries.append(
asn1.SEQUENCE([
AIA_CA_ISSUERS,
asn1.Raw(asn1.TagAndLength(0x86,
len(ca_issuers_url)) + ca_issuers_url),
]))
extensions.children.append(
asn1.SEQUENCE([
AUTHORITY_INFORMATION_ACCESS,
# There is implicitly a critical=False here. Since false is the default,
# encoding the value would be invalid DER.
asn1.OCTETSTRING(asn1.ToDER(asn1.SEQUENCE(aia_entries))),
]))
extensions.children.append(
asn1.SEQUENCE([
CERT_POLICIES,
# There is implicitly a critical=False here. Since false is the default,
# encoding the value would be invalid DER.
asn1.OCTETSTRING(asn1.ToDER(asn1.SEQUENCE([
asn1.SEQUENCE([ # PolicyInformation
CERT_POLICY_OID,
]),
]))),
])
)
tbsCert = asn1.ToDER(asn1.SEQUENCE([
asn1.Explicit(0, 2), # Version
serial,
asn1.SEQUENCE([SHA256_WITH_RSA_ENCRYPTION, None]), # SignatureAlgorithm
Name(cn = issuer_cn), # Issuer
asn1.SEQUENCE([ # Validity
asn1.UTCTime("100101060000Z"), # NotBefore
asn1.UTCTime("321201060000Z"), # NotAfter
]),
Name(cn = subject_cn), # Subject
asn1.SEQUENCE([ # SubjectPublicKeyInfo
asn1.SEQUENCE([ # Algorithm
PUBLIC_KEY_RSA,
None,
]),
asn1.BitString(asn1.ToDER(pubkey)),
]),
asn1.Explicit(3, extensions),
]))
return asn1.ToDER(asn1.SEQUENCE([
asn1.Raw(tbsCert),
asn1.SEQUENCE([
SHA256_WITH_RSA_ENCRYPTION,
None,
]),
asn1.BitString(privkey.Sign(tbsCert)),
]))
def MakeOCSPSingleResponse(
issuer_name_hash, issuer_key_hash, serial, ocsp_state, ocsp_date):
cert_status = None
if ocsp_state == OCSP_STATE_REVOKED:
cert_status = asn1.Explicit(1, asn1.GeneralizedTime("20100101060000Z"))
elif ocsp_state == OCSP_STATE_UNKNOWN:
cert_status = asn1.Raw(asn1.TagAndLength(0x80 | 2, 0))
elif ocsp_state == OCSP_STATE_GOOD:
cert_status = asn1.Raw(asn1.TagAndLength(0x80 | 0, 0))
elif ocsp_state == OCSP_STATE_MISMATCHED_SERIAL:
cert_status = asn1.Raw(asn1.TagAndLength(0x80 | 0, 0))
serial -= 1
else:
raise ValueError('Bad OCSP state: ' + str(ocsp_state))
now = datetime.datetime.fromtimestamp(time.mktime(time.gmtime()))
if ocsp_date == OCSP_DATE_VALID:
thisUpdate = now - datetime.timedelta(days=1)
nextUpdate = thisUpdate + datetime.timedelta(weeks=1)
elif ocsp_date == OCSP_DATE_OLD:
thisUpdate = now - datetime.timedelta(days=1, weeks=1)
nextUpdate = thisUpdate + datetime.timedelta(weeks=1)
elif ocsp_date == OCSP_DATE_EARLY:
thisUpdate = now + datetime.timedelta(days=1)
nextUpdate = thisUpdate + datetime.timedelta(weeks=1)
elif ocsp_date == OCSP_DATE_LONG:
thisUpdate = now - datetime.timedelta(days=365)
nextUpdate = thisUpdate + datetime.timedelta(days=366)
elif ocsp_date == OCSP_DATE_LONGER:
thisUpdate = now - datetime.timedelta(days=367)
nextUpdate = thisUpdate + datetime.timedelta(days=368)
else:
raise ValueError('Bad OCSP date: ' + str(ocsp_date))
return asn1.SEQUENCE([ # SingleResponse
asn1.SEQUENCE([ # CertID
asn1.SEQUENCE([ # hashAlgorithm
HASH_SHA1,
None,
]),
issuer_name_hash,
issuer_key_hash,
serial,
]),
cert_status,
asn1.GeneralizedTime( # thisUpdate
thisUpdate.strftime(GENERALIZED_TIME_FORMAT)
),
asn1.Explicit( # nextUpdate
0,
asn1.GeneralizedTime(nextUpdate.strftime(GENERALIZED_TIME_FORMAT))
),
])
def MakeOCSPResponse(
issuer_cn, issuer_key, serial, ocsp_states, ocsp_dates, ocsp_produced):
if ocsp_states[0] == OCSP_STATE_UNAUTHORIZED:
return unauthorizedDER
elif ocsp_states[0] == OCSP_STATE_INVALID_RESPONSE:
return '3'
elif ocsp_states[0] == OCSP_STATE_TRY_LATER:
resp = asn1.SEQUENCE([
asn1.ENUMERATED(3),
])
return asn1.ToDER(resp)
elif ocsp_states[0] == OCSP_STATE_INVALID_RESPONSE_DATA:
invalid_data = asn1.ToDER(asn1.OCTETSTRING('not ocsp data'))
basic_resp = asn1.SEQUENCE([
asn1.Raw(invalid_data),
asn1.SEQUENCE([
SHA256_WITH_RSA_ENCRYPTION,
None,
]),
asn1.BitString(ROOT_KEY.Sign(invalid_data)),
])
resp = asn1.SEQUENCE([
asn1.ENUMERATED(0),
asn1.Explicit(0, asn1.SEQUENCE([
OCSP_TYPE_BASIC,
asn1.OCTETSTRING(asn1.ToDER(basic_resp)),
])),
])
return asn1.ToDER(resp)
# https://tools.ietf.org/html/rfc2560
issuer_name_hash = asn1.OCTETSTRING(
hashlib.sha1(asn1.ToDER(Name(cn = issuer_cn))).digest())
issuer_key_hash = asn1.OCTETSTRING(
hashlib.sha1(asn1.ToDER(issuer_key)).digest())
now = datetime.datetime.fromtimestamp(time.mktime(time.gmtime()))
if ocsp_produced == OCSP_PRODUCED_VALID:
producedAt = now - datetime.timedelta(days=1)
elif ocsp_produced == OCSP_PRODUCED_BEFORE_CERT:
producedAt = datetime.datetime.strptime(
"19100101050000Z", GENERALIZED_TIME_FORMAT)
elif ocsp_produced == OCSP_PRODUCED_AFTER_CERT:
producedAt = datetime.datetime.strptime(
"20321201070000Z", GENERALIZED_TIME_FORMAT)
else:
raise ValueError('Bad OCSP produced: ' + str(ocsp_produced))
single_responses = [
MakeOCSPSingleResponse(issuer_name_hash, issuer_key_hash, serial,
ocsp_state, ocsp_date)
for ocsp_state, ocsp_date in itertools.izip(ocsp_states, ocsp_dates)
]
basic_resp_data_der = asn1.ToDER(asn1.SEQUENCE([
asn1.Explicit(2, issuer_key_hash),
asn1.GeneralizedTime(producedAt.strftime(GENERALIZED_TIME_FORMAT)),
asn1.SEQUENCE(single_responses),
]))
basic_resp = asn1.SEQUENCE([
asn1.Raw(basic_resp_data_der),
asn1.SEQUENCE([
SHA256_WITH_RSA_ENCRYPTION,
None,
]),
asn1.BitString(issuer_key.Sign(basic_resp_data_der)),
])
resp = asn1.SEQUENCE([
asn1.ENUMERATED(0),
asn1.Explicit(0, asn1.SEQUENCE([
OCSP_TYPE_BASIC,
asn1.OCTETSTRING(asn1.ToDER(basic_resp)),
]))
])
return asn1.ToDER(resp)
def DERToPEM(der):
pem = '-----BEGIN CERTIFICATE-----\n'
pem += der.encode('base64')
pem += '-----END CERTIFICATE-----\n'
return pem
# unauthorizedDER is an OCSPResponse with a status of 6:
# SEQUENCE { ENUM(6) }
unauthorizedDER = '30030a0106'.decode('hex')
def GenerateCertKeyAndOCSP(subject = "127.0.0.1",
ocsp_url = "http://127.0.0.1",
ocsp_states = None,
ocsp_dates = None,
ocsp_produced = OCSP_PRODUCED_VALID,
ocsp_intermediate_url = None,
ocsp_intermediate_states = None,
ocsp_intermediate_dates = None,
ocsp_intermediate_produced = OCSP_PRODUCED_VALID,
ip_sans = ["\x7F\x00\x00\x01"],
dns_sans = None,
serial = 0):
'''GenerateCertKeyAndOCSP returns a (cert_and_key_pem,
(ocsp_der, ocsp_intermediate_der)) where:
* cert_and_key_pem contains a certificate and private key in PEM format
with the given subject common name and OCSP URL.
It also contains the intermediate certificate PEM if
ocsp_intermediate_url is not None.
* ocsp_der contains a DER encoded OCSP response or None if ocsp_url is
None
* ocsp_intermediate_der contains a DER encoded OCSP response for the
intermediate or None if ocsp_intermediate_url is None'''
if ocsp_states is None:
ocsp_states = [OCSP_STATE_GOOD]
if ocsp_dates is None:
ocsp_dates = [OCSP_DATE_VALID]
issuer_cn = ROOT_CN
issuer_key = ROOT_KEY
intermediate_pem = ''
intermediate_ocsp_der = None
if ocsp_intermediate_url is not None:
ocsp_intermediate_url = bytes(ocsp_intermediate_url)
if ocsp_intermediate_states is None:
ocsp_intermediate_states = [OCSP_STATE_GOOD]
if ocsp_intermediate_dates is None:
ocsp_intermediate_dates = [OCSP_DATE_VALID]
intermediate_serial = RandomNumber(16)
intermediate_cn = "%s %X" % (INTERMEDIATE_CN_PREFIX, intermediate_serial)
intermediate_cert_der = MakeCertificate(ROOT_CN, intermediate_cn,
intermediate_serial,
INTERMEDIATE_KEY, ROOT_KEY,
ocsp_intermediate_url,
is_ca=True)
intermediate_pem = DERToPEM(intermediate_cert_der)
issuer_cn = intermediate_cn
issuer_key = INTERMEDIATE_KEY
intermediate_ocsp_der = MakeOCSPResponse(
ROOT_CN, ROOT_KEY, intermediate_serial, ocsp_intermediate_states,
ocsp_intermediate_dates, ocsp_intermediate_produced)
if serial == 0:
serial = RandomNumber(16)
if ocsp_url is not None:
ocsp_url = bytes(ocsp_url)
cert_der = MakeCertificate(issuer_cn, bytes(subject), serial, LEAF_KEY,
issuer_key, ocsp_url, ip_sans=ip_sans,
dns_sans=dns_sans)
cert_pem = DERToPEM(cert_der)
ocsp_der = None
if ocsp_url is not None:
ocsp_der = MakeOCSPResponse(
issuer_cn, issuer_key, serial, ocsp_states, ocsp_dates, ocsp_produced)
return cert_pem + LEAF_KEY_PEM + intermediate_pem, (ocsp_der,
intermediate_ocsp_der)
def GenerateCertKeyAndIntermediate(subject,
ca_issuers_url,
ip_sans=None,
dns_sans=None,
serial=0):
'''Returns a (cert_and_key_pem, intermediate_cert_pem) where:
* cert_and_key_pem contains a certificate and private key in PEM format
with the given subject common name and caIssuers URL.
* intermediate_cert_pem contains a PEM encoded certificate that signed
cert_and_key_pem and was signed by ocsp-test-root.pem.'''
if serial == 0:
serial = RandomNumber(16)
intermediate_serial = RandomNumber(16)
intermediate_cn = "%s %X" % (INTERMEDIATE_CN_PREFIX, intermediate_serial)
target_cert_der = MakeCertificate(intermediate_cn, bytes(subject), serial,
LEAF_KEY, INTERMEDIATE_KEY,
ip_sans=ip_sans, dns_sans=dns_sans,
ca_issuers_url=bytes(ca_issuers_url))
target_cert_pem = DERToPEM(target_cert_der)
intermediate_cert_der = MakeCertificate(ROOT_CN, intermediate_cn,
intermediate_serial,
INTERMEDIATE_KEY, ROOT_KEY,
is_ca=True)
return target_cert_pem + LEAF_KEY_PEM, intermediate_cert_der
if __name__ == '__main__':
def bin_to_array(s):
return ' '.join(['0x%02x,'%ord(c) for c in s])
import sys
sys.path.append(os.path.join(os.path.dirname(os.path.abspath(__file__)), '..',
'..', 'data', 'ssl', 'scripts'))
import crlsetutil
der_root = MakeCertificate(ROOT_CN, ROOT_CN, 1, ROOT_KEY, ROOT_KEY,
is_ca=True, path_len=1)
print 'ocsp-test-root.pem:'
print DERToPEM(der_root)
print
print 'kOCSPTestCertFingerprint:'
print bin_to_array(hashlib.sha1(der_root).digest())
print
print 'kOCSPTestCertSPKI:'
print bin_to_array(crlsetutil.der_cert_to_spki_hash(der_root))
Reference in New Issue View Git Blame Copy Permalink