1# This file is being contributed to pyasn1-modules software. 2# 3# Created by Russ Housley with assistance from the asn1ate tool, with manual 4# changes to implement appropriate constraints and added comments. 5# Modified by Russ Housley to add maps for use with opentypes. 6# 7# Copyright (c) 2019, Vigil Security, LLC 8# License: http://snmplabs.com/pyasn1/license.html 9# 10# JWT Claim Constraints and TN Authorization List for certificate extensions. 11# 12# ASN.1 source from: 13# https://www.rfc-editor.org/rfc/rfc8226.txt (with errata corrected) 14 15from pyasn1.type import char 16from pyasn1.type import constraint 17from pyasn1.type import namedtype 18from pyasn1.type import tag 19from pyasn1.type import univ 20 21 22MAX = float('inf') 23 24 25def _OID(*components): 26 output = [] 27 for x in tuple(components): 28 if isinstance(x, univ.ObjectIdentifier): 29 output.extend(list(x)) 30 else: 31 output.append(int(x)) 32 33 return univ.ObjectIdentifier(output) 34 35 36class JWTClaimName(char.IA5String): 37 pass 38 39 40class JWTClaimNames(univ.SequenceOf): 41 pass 42 43JWTClaimNames.componentType = JWTClaimName() 44JWTClaimNames.sizeSpec = constraint.ValueSizeConstraint(1, MAX) 45 46 47class JWTClaimPermittedValues(univ.Sequence): 48 pass 49 50JWTClaimPermittedValues.componentType = namedtype.NamedTypes( 51 namedtype.NamedType('claim', JWTClaimName()), 52 namedtype.NamedType('permitted', univ.SequenceOf( 53 componentType=char.UTF8String()).subtype( 54 sizeSpec=constraint.ValueSizeConstraint(1, MAX))) 55) 56 57 58class JWTClaimPermittedValuesList(univ.SequenceOf): 59 pass 60 61JWTClaimPermittedValuesList.componentType = JWTClaimPermittedValues() 62JWTClaimPermittedValuesList.sizeSpec = constraint.ValueSizeConstraint(1, MAX) 63 64 65class JWTClaimConstraints(univ.Sequence): 66 pass 67 68JWTClaimConstraints.componentType = namedtype.NamedTypes( 69 namedtype.OptionalNamedType('mustInclude', 70 JWTClaimNames().subtype(explicitTag=tag.Tag(tag.tagClassContext, 71 tag.tagFormatSimple, 0))), 72 namedtype.OptionalNamedType('permittedValues', 73 JWTClaimPermittedValuesList().subtype(explicitTag=tag.Tag(tag.tagClassContext, 74 tag.tagFormatSimple, 1))) 75) 76 77 78JWTClaimConstraints.sizeSpec = univ.Sequence.sizeSpec + constraint.ValueSizeConstraint(1, 2) 79 80 81id_pe_JWTClaimConstraints = _OID(1, 3, 6, 1, 5, 5, 7, 1, 27) 82 83 84class ServiceProviderCode(char.IA5String): 85 pass 86 87 88class TelephoneNumber(char.IA5String): 89 pass 90 91TelephoneNumber.subtypeSpec = constraint.ConstraintsIntersection( 92 constraint.ValueSizeConstraint(1, 15), 93 constraint.PermittedAlphabetConstraint( 94 '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '#', '*') 95) 96 97 98class TelephoneNumberRange(univ.Sequence): 99 pass 100 101TelephoneNumberRange.componentType = namedtype.NamedTypes( 102 namedtype.NamedType('start', TelephoneNumber()), 103 namedtype.NamedType('count', 104 univ.Integer().subtype(subtypeSpec=constraint.ValueRangeConstraint(2, MAX))) 105) 106 107 108class TNEntry(univ.Choice): 109 pass 110 111TNEntry.componentType = namedtype.NamedTypes( 112 namedtype.NamedType('spc', 113 ServiceProviderCode().subtype(explicitTag=tag.Tag(tag.tagClassContext, 114 tag.tagFormatSimple, 0))), 115 namedtype.NamedType('range', 116 TelephoneNumberRange().subtype(explicitTag=tag.Tag(tag.tagClassContext, 117 tag.tagFormatConstructed, 1))), 118 namedtype.NamedType('one', 119 TelephoneNumber().subtype(explicitTag=tag.Tag(tag.tagClassContext, 120 tag.tagFormatSimple, 2))) 121) 122 123 124class TNAuthorizationList(univ.SequenceOf): 125 pass 126 127TNAuthorizationList.componentType = TNEntry() 128TNAuthorizationList.sizeSpec = constraint.ValueSizeConstraint(1, MAX) 129 130id_pe_TNAuthList = _OID(1, 3, 6, 1, 5, 5, 7, 1, 26) 131 132 133id_ad_stirTNList = _OID(1, 3, 6, 1, 5, 5, 7, 48, 14) 134 135 136# Map of Certificate Extension OIDs to Extensions 137# To be added to the ones that are in rfc5280.py 138 139certificateExtensionsMapUpdate = { 140 id_pe_TNAuthList: TNAuthorizationList(), 141 id_pe_JWTClaimConstraints: JWTClaimConstraints(), 142} 143 144