diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/cryptography/hazmat/backends/openssl/x509.py | 29 | ||||
| -rw-r--r-- | src/cryptography/hazmat/bindings/openssl/x509.py | 1 | ||||
| -rw-r--r-- | src/cryptography/x509.py | 51 |
3 files changed, 73 insertions, 8 deletions
diff --git a/src/cryptography/hazmat/backends/openssl/x509.py b/src/cryptography/hazmat/backends/openssl/x509.py index 76dcf32f..b712f1f9 100644 --- a/src/cryptography/hazmat/backends/openssl/x509.py +++ b/src/cryptography/hazmat/backends/openssl/x509.py @@ -16,6 +16,7 @@ from __future__ import absolute_import, division, print_function import datetime from cryptography import utils, x509 +from cryptography.exceptions import UnsupportedAlgorithm from cryptography.hazmat.primitives import hashes @@ -121,14 +122,7 @@ class _Certificate(object): buf, lambda buf: self._backend._lib.OPENSSL_free(buf[0]) ) value = self._backend._ffi.buffer(buf[0], res)[:].decode('utf8') - # Set to 80 on the recommendation of - # https://www.openssl.org/docs/crypto/OBJ_nid2ln.html - buf_len = 80 - buf = self._backend._ffi.new("char[]", buf_len) - res = self._backend._lib.OBJ_obj2txt(buf, buf_len, obj, 1) - assert res > 0 - oid = self._backend._ffi.buffer(buf, res)[:].decode() - + oid = self._obj2txt(obj) attributes.append( x509.NameAttribute( x509.ObjectIdentifier(oid), value @@ -136,3 +130,22 @@ class _Certificate(object): ) return x509.Name(attributes) + + def _obj2txt(self, obj): + # Set to 80 on the recommendation of + # https://www.openssl.org/docs/crypto/OBJ_nid2ln.html#return_values + buf_len = 80 + buf = self._backend._ffi.new("char[]", buf_len) + res = self._backend._lib.OBJ_obj2txt(buf, buf_len, obj, 1) + assert res > 0 + return self._backend._ffi.buffer(buf, res)[:].decode() + + @property + def signature_hash_algorithm(self): + oid = self._obj2txt(self._x509.sig_alg.algorithm) + try: + return x509._SIG_OIDS_TO_HASH[oid] + except KeyError: + raise UnsupportedAlgorithm( + "Signature algorithm OID:{0} not recognized".format(oid) + ) diff --git a/src/cryptography/hazmat/bindings/openssl/x509.py b/src/cryptography/hazmat/bindings/openssl/x509.py index 585a2e90..f5638da7 100644 --- a/src/cryptography/hazmat/bindings/openssl/x509.py +++ b/src/cryptography/hazmat/bindings/openssl/x509.py @@ -65,6 +65,7 @@ typedef struct { } X509_CRL; typedef struct { + X509_ALGOR *sig_alg; X509_CINF *cert_info; ...; } X509; diff --git a/src/cryptography/x509.py b/src/cryptography/x509.py index 8a6ecc8d..ad7ebbe0 100644 --- a/src/cryptography/x509.py +++ b/src/cryptography/x509.py @@ -10,6 +10,7 @@ from enum import Enum import six from cryptography import utils +from cryptography.hazmat.primitives import hashes _OID_NAMES = { @@ -28,6 +29,19 @@ _OID_NAMES = { "2.5.4.65": "pseudonym", "0.9.2342.19200300.100.1.25": "domainComponent", "1.2.840.113549.1.9.1": "emailAddress", + "1.2.840.113549.1.1.4": "md5WithRSAEncryption", + "1.2.840.113549.1.1.5": "sha1WithRSAEncryption", + "1.2.840.113549.1.1.14": "sha224WithRSAEncryption", + "1.2.840.113549.1.1.11": "sha256WithRSAEncryption", + "1.2.840.113549.1.1.12": "sha384WithRSAEncryption", + "1.2.840.113549.1.1.13": "sha512WithRSAEncryption", + "1.2.840.10045.4.3.1": "ecdsa-with-SHA224", + "1.2.840.10045.4.3.2": "ecdsa-with-SHA256", + "1.2.840.10045.4.3.3": "ecdsa-with-SHA384", + "1.2.840.10045.4.3.4": "ecdsa-with-SHA512", + "1.2.840.10040.4.3": "dsa-with-sha1", + "2.16.840.1.101.3.4.3.1": "dsa-with-sha224", + "2.16.840.1.101.3.4.3.2": "dsa-with-sha256", } @@ -143,6 +157,36 @@ OID_PSEUDONYM = ObjectIdentifier("2.5.4.65") OID_DOMAIN_COMPONENT = ObjectIdentifier("0.9.2342.19200300.100.1.25") OID_EMAIL_ADDRESS = ObjectIdentifier("1.2.840.113549.1.9.1") +OID_RSA_WITH_MD5 = ObjectIdentifier("1.2.840.113549.1.1.4") +OID_RSA_WITH_SHA1 = ObjectIdentifier("1.2.840.113549.1.1.5") +OID_RSA_WITH_SHA224 = ObjectIdentifier("1.2.840.113549.1.1.14") +OID_RSA_WITH_SHA256 = ObjectIdentifier("1.2.840.113549.1.1.11") +OID_RSA_WITH_SHA384 = ObjectIdentifier("1.2.840.113549.1.1.12") +OID_RSA_WITH_SHA512 = ObjectIdentifier("1.2.840.113549.1.1.13") +OID_ECDSA_WITH_SHA224 = ObjectIdentifier("1.2.840.10045.4.3.1") +OID_ECDSA_WITH_SHA256 = ObjectIdentifier("1.2.840.10045.4.3.2") +OID_ECDSA_WITH_SHA384 = ObjectIdentifier("1.2.840.10045.4.3.3") +OID_ECDSA_WITH_SHA512 = ObjectIdentifier("1.2.840.10045.4.3.4") +OID_DSA_WITH_SHA1 = ObjectIdentifier("1.2.840.10040.4.3") +OID_DSA_WITH_SHA224 = ObjectIdentifier("2.16.840.1.101.3.4.3.1") +OID_DSA_WITH_SHA256 = ObjectIdentifier("2.16.840.1.101.3.4.3.2") + +_SIG_OIDS_TO_HASH = { + OID_RSA_WITH_MD5.dotted_string: hashes.MD5(), + OID_RSA_WITH_SHA1.dotted_string: hashes.SHA1(), + OID_RSA_WITH_SHA224.dotted_string: hashes.SHA224(), + OID_RSA_WITH_SHA256.dotted_string: hashes.SHA256(), + OID_RSA_WITH_SHA384.dotted_string: hashes.SHA384(), + OID_RSA_WITH_SHA512.dotted_string: hashes.SHA512(), + OID_ECDSA_WITH_SHA224.dotted_string: hashes.SHA224(), + OID_ECDSA_WITH_SHA256.dotted_string: hashes.SHA256(), + OID_ECDSA_WITH_SHA384.dotted_string: hashes.SHA384(), + OID_ECDSA_WITH_SHA512.dotted_string: hashes.SHA512(), + OID_DSA_WITH_SHA1.dotted_string: hashes.SHA1(), + OID_DSA_WITH_SHA224.dotted_string: hashes.SHA224(), + OID_DSA_WITH_SHA256.dotted_string: hashes.SHA256() +} + @six.add_metaclass(abc.ABCMeta) class Certificate(object): @@ -193,3 +237,10 @@ class Certificate(object): """ Returns the subject name object. """ + + @abc.abstractproperty + def signature_hash_algorithm(self): + """ + Returns a HashAlgorithm corresponding to the type of the digest signed + in the certificate. + """ |