28
28
import sys
29
29
import unittest
30
30
from enum import Enum
31
- import dataclasses
31
+ import dataclasses
32
32
from typing import Optional
33
33
34
34
import click
53
53
class RevocationType (Enum ):
54
54
CRL = 1
55
55
56
+
56
57
class CertVerificationResult (Enum ):
57
58
SUCCESS = 1
58
59
SKID_NOT_FOUND = 2
@@ -61,6 +62,7 @@ class CertVerificationResult(Enum):
61
62
ISSUER_MISMATCH = 5
62
63
AKID_MISMATCH = 6
63
64
65
+
64
66
@dataclasses .dataclass
65
67
class RevocationPoint :
66
68
vid : int
@@ -77,6 +79,7 @@ class RevocationPoint:
77
79
schemaVersion : int
78
80
crlSignerDelegator : str
79
81
82
+
80
83
@dataclasses .dataclass
81
84
class RevocationSet :
82
85
type : str
@@ -85,10 +88,10 @@ class RevocationSet:
85
88
revoked_serial_numbers : [str ]
86
89
crl_signer_cert : str
87
90
crl_signer_delegator : str = None
88
-
91
+
89
92
def asDict (self ):
90
93
return dataclasses .asdict (self )
91
-
94
+
92
95
93
96
OID_VENDOR_ID = x509 .ObjectIdentifier ("1.3.6.1.4.1.37244.2.1" )
94
97
OID_PRODUCT_ID = x509 .ObjectIdentifier ("1.3.6.1.4.1.37244.2.2" )
@@ -175,7 +178,8 @@ def is_self_signed_certificate(cert: x509.Certificate) -> bool:
175
178
if result == CertVerificationResult .SUCCESS :
176
179
return True
177
180
else :
178
- logging .debug (f"Certificate with subject: { cert .subject .rfc4514_string ()} is not a valid self-signed certificate. Result: { result .name } " )
181
+ logging .debug (
182
+ f"Certificate with subject: { cert .subject .rfc4514_string ()} is not a valid self-signed certificate. Result: { result .name } " )
179
183
return False
180
184
181
185
@@ -192,18 +196,21 @@ def validate_cert_chain(crl_signer: x509.Certificate, crl_signer_delegator: x509
192
196
if crl_signer_delegator :
193
197
result_signer = verify_cert (crl_signer , crl_signer_delegator )
194
198
if not result_signer == CertVerificationResult .SUCCESS :
195
- logging .debug (f"Cannot verify certificate subject: { crl_signer .subject .rfc4514_string ()} issued by certificate subject: { crl_signer_delegator .subject .rfc4514_string ()} . Result: { result_signer .name } " )
199
+ logging .debug (
200
+ f"Cannot verify certificate subject: { crl_signer .subject .rfc4514_string ()} issued by certificate subject: { crl_signer_delegator .subject .rfc4514_string ()} . Result: { result_signer .name } " )
196
201
return False
197
202
198
203
result_delegator = verify_cert (crl_signer_delegator , paa )
199
204
if not result_delegator == CertVerificationResult .SUCCESS :
200
- logging .debug (f"Cannot verify certificate subject: { crl_signer_delegator .subject .rfc4514_string ()} issued by certificate subject: { paa .subject .rfc4514_string ()} . Result: { result .name } " )
205
+ logging .debug (
206
+ f"Cannot verify certificate subject: { crl_signer_delegator .subject .rfc4514_string ()} issued by certificate subject: { paa .subject .rfc4514_string ()} . Result: { result .name } " )
201
207
return False
202
208
return True
203
209
else :
204
210
result = verify_cert (crl_signer , paa )
205
211
if not result == CertVerificationResult .SUCCESS :
206
- logging .debug (f"Cannot verify certificate subject: { crl_signer .subject .rfc4514_string ()} issued by certificate subject: { paa .subject .rfc4514_string ()} . Result: { result .name } " )
212
+ logging .debug (
213
+ f"Cannot verify certificate subject: { crl_signer .subject .rfc4514_string ()} issued by certificate subject: { paa .subject .rfc4514_string ()} . Result: { result .name } " )
207
214
return False
208
215
return True
209
216
@@ -352,6 +359,7 @@ def fetch_crl_from_url(url: str, timeout: int) -> x509.CertificateRevocationList
352
359
except Exception as e :
353
360
logging .error ('Failed to fetch a valid CRL' , e )
354
361
362
+
355
363
class DclClientInterface :
356
364
'''
357
365
An interface for interacting with DCLD.
@@ -598,7 +606,7 @@ def get_revocation_points(self) -> list[RevocationPoint]:
598
606
'''
599
607
600
608
response = self .send_get_request (f"{ self .rest_node_url } /dcl/pki/revocation-points" )
601
-
609
+
602
610
return [RevocationPoint (** r ) for r in response ["PkiRevocationDistributionPoint" ]]
603
611
604
612
def get_revocation_points_by_skid (self , issuer_subject_key_id ) -> list [RevocationPoint ]:
@@ -666,7 +674,8 @@ def __init__(self, crls: [], dcl_certificates: [], revocation_points_response_fi
666
674
logging .debug (f"Loading crls from { crls } " )
667
675
logging .debug (f"Loading revocation points response from { revocation_points_response_file } " )
668
676
self .crls = self .get_crls (crls )
669
- self .revocation_points = [RevocationPoint (** r ) for r in json .load (revocation_points_response_file )["PkiRevocationDistributionPoint" ]]
677
+ self .revocation_points = [RevocationPoint (** r )
678
+ for r in json .load (revocation_points_response_file )["PkiRevocationDistributionPoint" ]]
670
679
self .authoritative_certs = self .get_authoritative_certificates (dcl_certificates )
671
680
672
681
def get_lookup_key (self , certificate : x509 .Certificate ) -> str :
@@ -842,6 +851,7 @@ def get_crl_file(self,
842
851
return crl
843
852
return None
844
853
854
+
845
855
@click .group ()
846
856
def cli ():
847
857
pass
@@ -985,6 +995,7 @@ def from_dcl(use_main_net_dcld: str, use_test_net_dcld: str, use_main_net_http:
985
995
with open (output , 'w+' ) as outfile :
986
996
json .dump ([revocation .asDict () for revocation in revocation_set ], outfile , indent = 4 )
987
997
998
+
988
999
class TestRevocationSetGeneration (unittest .TestCase ):
989
1000
"""Test class for revocation set generation"""
990
1001
@@ -1051,6 +1062,7 @@ def test_pai_revocation_set(self):
1051
1062
'test/revoked-attestation-certificates/revocation-sets/revocation-set-for-pai.json'
1052
1063
)
1053
1064
1065
+
1054
1066
if __name__ == "__main__" :
1055
1067
if len (sys .argv ) > 1 and sys .argv [1 ] == 'test' :
1056
1068
# Remove the 'test' argument and run tests
0 commit comments