1# This file is being contributed to pyasn1-modules software.
2#
3# Created by Russ Housley with assistance from the asn1ate tool, with manual
4#   changes to implement appropriate constraints and added comments.
5# Modified by Russ Housley to add maps for use with opentypes.
6#
7# Copyright (c) 2019, Vigil Security, LLC
8# License: http://snmplabs.com/pyasn1/license.html
9#
10# JWT Claim Constraints and TN Authorization List for certificate extensions.
11#
12# ASN.1 source from:
13# https://www.rfc-editor.org/rfc/rfc8226.txt (with errata corrected)
14
15from pyasn1.type import char
16from pyasn1.type import constraint
17from pyasn1.type import namedtype
18from pyasn1.type import tag
19from pyasn1.type import univ
20
21from pyasn1_modules import rfc5280
22
23MAX = float('inf')
24
25
26def _OID(*components):
27    output = []
28    for x in tuple(components):
29        if isinstance(x, univ.ObjectIdentifier):
30            output.extend(list(x))
31        else:
32            output.append(int(x))
33
34    return univ.ObjectIdentifier(output)
35
36
37class JWTClaimName(char.IA5String):
38    pass
39
40
41class JWTClaimNames(univ.SequenceOf):
42    pass
43
44JWTClaimNames.componentType = JWTClaimName()
45JWTClaimNames.sizeSpec = constraint.ValueSizeConstraint(1, MAX)
46
47
48class JWTClaimPermittedValues(univ.Sequence):
49    pass
50
51JWTClaimPermittedValues.componentType = namedtype.NamedTypes(
52    namedtype.NamedType('claim', JWTClaimName()),
53    namedtype.NamedType('permitted', univ.SequenceOf(
54        componentType=char.UTF8String()).subtype(
55            sizeSpec=constraint.ValueSizeConstraint(1, MAX)))
56)
57
58
59class JWTClaimPermittedValuesList(univ.SequenceOf):
60    pass
61
62JWTClaimPermittedValuesList.componentType = JWTClaimPermittedValues()
63JWTClaimPermittedValuesList.sizeSpec = constraint.ValueSizeConstraint(1, MAX)
64
65
66class JWTClaimConstraints(univ.Sequence):
67    pass
68
69JWTClaimConstraints.componentType = namedtype.NamedTypes(
70    namedtype.OptionalNamedType('mustInclude',
71        JWTClaimNames().subtype(explicitTag=tag.Tag(tag.tagClassContext,
72            tag.tagFormatSimple, 0))),
73    namedtype.OptionalNamedType('permittedValues',
74        JWTClaimPermittedValuesList().subtype(explicitTag=tag.Tag(tag.tagClassContext,
75            tag.tagFormatSimple, 1)))
76)
77
78JWTClaimConstraints.subtypeSpec = constraint.ConstraintsUnion(
79    constraint.WithComponentsConstraint(
80        ('mustInclude', constraint.ComponentPresentConstraint())),
81    constraint.WithComponentsConstraint(
82        ('permittedValues', constraint.ComponentPresentConstraint()))
83)
84
85
86id_pe_JWTClaimConstraints = _OID(1, 3, 6, 1, 5, 5, 7, 1, 27)
87
88
89class ServiceProviderCode(char.IA5String):
90    pass
91
92
93class TelephoneNumber(char.IA5String):
94    pass
95
96TelephoneNumber.subtypeSpec = constraint.ConstraintsIntersection(
97    constraint.ValueSizeConstraint(1, 15),
98    constraint.PermittedAlphabetConstraint(
99        '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '#', '*')
100)
101
102
103class TelephoneNumberRange(univ.Sequence):
104    pass
105
106TelephoneNumberRange.componentType = namedtype.NamedTypes(
107    namedtype.NamedType('start', TelephoneNumber()),
108    namedtype.NamedType('count',
109        univ.Integer().subtype(subtypeSpec=constraint.ValueRangeConstraint(2, MAX)))
110)
111
112
113class TNEntry(univ.Choice):
114    pass
115
116TNEntry.componentType = namedtype.NamedTypes(
117    namedtype.NamedType('spc',
118        ServiceProviderCode().subtype(explicitTag=tag.Tag(tag.tagClassContext,
119            tag.tagFormatSimple, 0))),
120    namedtype.NamedType('range',
121        TelephoneNumberRange().subtype(explicitTag=tag.Tag(tag.tagClassContext,
122            tag.tagFormatConstructed, 1))),
123    namedtype.NamedType('one',
124        TelephoneNumber().subtype(explicitTag=tag.Tag(tag.tagClassContext,
125            tag.tagFormatSimple, 2)))
126)
127
128
129class TNAuthorizationList(univ.SequenceOf):
130    pass
131
132TNAuthorizationList.componentType = TNEntry()
133TNAuthorizationList.sizeSpec = constraint.ValueSizeConstraint(1, MAX)
134
135id_pe_TNAuthList = _OID(1, 3, 6, 1, 5, 5, 7, 1, 26)
136
137
138id_ad_stirTNList = _OID(1, 3, 6, 1, 5, 5, 7, 48, 14)
139
140
141# Map of Certificate Extension OIDs to Extensions added to the
142# ones that are in rfc5280.py
143
144_certificateExtensionsMapUpdate = {
145    id_pe_TNAuthList: TNAuthorizationList(),
146    id_pe_JWTClaimConstraints: JWTClaimConstraints(),
147}
148
149rfc5280.certificateExtensionsMap.update(_certificateExtensionsMapUpdate)
150