Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
C
caucase
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Labels
Merge Requests
2
Merge Requests
2
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Analytics
Analytics
CI / CD
Repository
Value Stream
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Jobs
Commits
Open sidebar
nexedi
caucase
Commits
5af137b4
Commit
5af137b4
authored
May 17, 2019
by
Łukasz Nowak
Committed by
Vincent Pelletier
May 22, 2019
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Feature/registered oid
Replaces
!7
/reviewed-on
!9
parent
7a737172
Changes
3
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
41 additions
and
9 deletions
+41
-9
caucase/ca.py
caucase/ca.py
+20
-6
caucase/test.py
caucase/test.py
+4
-0
caucase/utils.py
caucase/utils.py
+17
-3
No files found.
caucase/ca.py
View file @
5af137b4
...
...
@@ -411,14 +411,28 @@ class CertificateAuthority(object):
critical
=
False
,
# (no recommendations)
)
else
:
if
auto_signed
==
_AUTO_SIGNED_PASSTHROUGH
:
# Caller is asking us to let all through, so do this.
policy_list
=
certificate_policies
.
value
else
:
# Prevent any caucase extension from being smuggled, especiall the
policy_list
=
[]
for
policy
in
certificate_policies
.
value
:
if
policy
.
policy_identifier
.
dotted_string
.
startswith
(
utils
.
CAUCASE_LEGACY_OID_TOP
):
# Always migrate CAUCASE_LEGACY_OID_TOP to CAUCASE_OID_TOP
# by copying current policy and replacing its prefix to the new
# OID prefix
identifier_suffix
=
policy
.
policy_identifier
.
dotted_string
[
len
(
utils
.
CAUCASE_LEGACY_OID_TOP
):
]
policy
=
x509
.
PolicyInformation
(
x509
.
oid
.
ObjectIdentifier
(
utils
.
CAUCASE_OID_TOP
+
identifier_suffix
),
policy
.
policy_qualifiers
,
)
policy_list
.
append
(
policy
)
if
auto_signed
!=
_AUTO_SIGNED_PASSTHROUGH
:
# Prevent any caucase extension from being smuggled, especially the
# "auto-signed" one...
policy_list
=
[
x
for
x
in
certificate_policies
.
value
x
for
x
in
policy_list
if
not
x
.
policy_identifier
.
dotted_string
.
startswith
(
utils
.
CAUCASE_OID_TOP
,
)
...
...
caucase/test.py
View file @
5af137b4
...
...
@@ -1281,6 +1281,10 @@ class CaucaseTest(unittest.TestCase):
x509
.
IPAddress
(
ipaddress
.
IPv6Network
(
u'::/64'
)),
])
requested_policies
=
x509
.
CertificatePolicies
([
x509
.
PolicyInformation
(
x509
.
oid
.
ObjectIdentifier
(
utils
.
CAUCASE_LEGACY_OID_RESERVED
),
None
,
),
x509
.
PolicyInformation
(
x509
.
oid
.
ObjectIdentifier
(
utils
.
CAUCASE_OID_RESERVED
),
None
,
...
...
caucase/utils.py
View file @
5af137b4
...
...
@@ -55,8 +55,9 @@ del _checkDefaultDigestsAvailable
_cryptography_backend
=
default_backend
()
# Registration-less OID under 2.25 tree (aka uuid tree)
CAUCASE_OID_TOP
=
'2.25.285541874270823339875695650038637483517'
# Registration-less OID under 1.3.6.1.4.1.37476.9000 tree (aka ViaThinkSoft
# tree for open source project: https://oidplus.viathinksoft.com )
CAUCASE_OID_TOP
=
'1.3.6.1.4.1.37476.9000.70.0'
CAUCASE_OID_AUTO_SIGNED
=
CAUCASE_OID_TOP
+
'.0'
# Reserved for tests: no meaning, always stripped but never specificaly
# checked for in the code.
...
...
@@ -71,6 +72,16 @@ CAUCASE_POLICY_INFORMATION_AUTO_SIGNED = x509.PolicyInformation(
),
]
)
# Registration-less OID under 2.25 tree (aka uuid tree)
# Sadly, many implementations break when encountering 128-bits OIDs, making
# these certificates difficult to use.
CAUCASE_LEGACY_OID_TOP
=
'2.25.285541874270823339875695650038637483517'
CAUCASE_LEGACY_OID_AUTO_SIGNED
=
CAUCASE_LEGACY_OID_TOP
+
'.0'
CAUCASE_LEGACY_OID_RESERVED
=
CAUCASE_LEGACY_OID_TOP
+
'.999'
_CAUCASE_LEGACY_OID_AUTO_SIGNED
=
x509
.
oid
.
ObjectIdentifier
(
CAUCASE_LEGACY_OID_AUTO_SIGNED
,
)
def
isCertificateAutoSigned
(
crt
):
"""
...
...
@@ -90,7 +101,10 @@ def isCertificateAutoSigned(crt):
pass
else
:
for
policy_information
in
extension
.
value
:
if
policy_information
.
policy_identifier
==
_CAUCASE_OID_AUTO_SIGNED
:
if
policy_information
.
policy_identifier
in
(
_CAUCASE_OID_AUTO_SIGNED
,
_CAUCASE_LEGACY_OID_AUTO_SIGNED
,
# BBB
):
return
True
return
False
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment