1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
from typing import Optional
from asn1crypto import x509
from pyhanko_certvalidator.path import ValidationPath
from pyhanko_certvalidator.util import ConsList
class ValProcState:
def __init__(
self,
*,
cert_path_stack: ConsList[ValidationPath],
ee_name_override: Optional[str] = None,
is_side_validation: bool = False,
):
if cert_path_stack.head is None:
raise ValueError("Empty path stack")
self.index: int = 0
self.ee_name_override = ee_name_override
self.is_side_validation = bool(
is_side_validation or cert_path_stack.tail
)
self.cert_path_stack = cert_path_stack
@property
def path_len(self):
"""
Length of the path being validated.
.. note::
This is the path length in the sense of RFC 5280, i.e.
the root doesn't count.
"""
from pyhanko_certvalidator.path import ValidationPath
path = self.cert_path_stack.head
assert isinstance(path, ValidationPath)
return path.pkix_len
@property
def is_ee_cert(self) -> bool:
return self.index == self.path_len
def check_path_verif_recursion(self, ee_cert: x509.Certificate):
"""
Helper method to avoid recursion in indirect CRL validation.
There are some questionable-but-technically-valid CA setups where
a CRL issuer is authorised to assert its own revocation status,
which could cause a naive implementation to recurse.
"""
from pyhanko_certvalidator.path import ValidationPath
path: ValidationPath
for path in self.cert_path_stack:
cert = path.get_ee_cert_safe()
if cert and cert.sha256 == ee_cert.sha256:
return path
return None
def describe_cert(self, def_interm=False, never_def=False):
"""
:return:
A unicode string describing the position of a certificate
in the chain
"""
prefix = not never_def
if self.index < 1 and self.ee_name_override is None:
# catchall default
result = "certificate"
elif not self.is_ee_cert:
prefix &= def_interm
result = f'intermediate certificate {self.index}'
elif self.ee_name_override is not None:
result = self.ee_name_override
else:
result = 'end-entity certificate'
if prefix:
return "the " + result
else:
return result
|
