一般来说,对于pyasn1(pyasn1 0.4.8,pyasn1-modules 0.2.8)和ASN.1还是相当陌生,我正在尝试构建GeneralName
:
>>> from pyasn1.codec.der.encoder import encode
>>> from pyasn1.type import char
>>> from pyasn1_modules import rfc2459
>>> from pyasn1_modules.rfc2459 import (
... AttributeTypeAndValue, GeneralName, Name, RelativeDistinguishedName, RDNSequence)
>>>
>>> rdn = RelativeDistinguishedName()
>>> attr_type_and_value = AttributeTypeAndValue()
>>> attr_type_and_value['type'] = rfc2459.id_at_countryName
>>> attr_type_and_value['value'] = encode(char.UTF8String('DE'))
>>> rdn.append(attr_type_and_value)
>>>
>>> rdn_sequence = RDNSequence()
>>> rdn_sequence.append(rdn)
>>>
>>> name = Name()
>>> name[0] = rdn_sequence
>>>
>>> general_name = GeneralName()
>>> general_name['directoryName'] = name
Traceback (most recent call last):
File "/usr/lib/python3.6/site-packages/pyasn1/type/univ.py", line 2246, in __setitem__
self.setComponentByName(idx, value)
File "/usr/lib/python3.6/site-packages/pyasn1/type/univ.py", line 2413, in setComponentByName
idx, value, verifyConstraints, matchTags, matchConstraints
File "/usr/lib/python3.6/site-packages/pyasn1/type/univ.py", line 3119, in setComponentByPosition
Set.setComponentByPosition(self, idx, value, verifyConstraints, matchTags, matchConstraints)
File "/usr/lib/python3.6/site-packages/pyasn1/type/univ.py", line 2601, in setComponentByPosition
raise error.PyAsn1Error('Component value is tag-incompatible: %r vs %r' % (value, componentType))
pyasn1.error.PyAsn1Error: Component value is tag-incompatible: <Name value object, tagSet=<TagSet object, untagged>, [...]
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/usr/lib/python3.6/site-packages/pyasn1/type/univ.py", line 2250, in __setitem__
raise KeyError(sys.exc_info()[1])
KeyError: PyAsn1Error('Component value is tag-incompatible: <Name value object, tagSet=<TagSet object, untagged>, [...]
我截断了很长的异常消息。据我了解,其本质是,所提供的Name对象是未标记的,而某些标记是期望的。我可以使用general_name.setComponentByName('directoryName', name, matchTags=False)
解决该异常,但是我不确定这是否只是关闭了所需的/重要的检查,并且以后会咬我。 pyasn1 Tag
和TagSet
文档并没有启发我,但这可能是因为我还没有真正理解ASN.1中标签的用途。
所以,我的主要问题是:如何使用pyasn1正确创建一个GeneralName
?子问题:
UTF8String
。解码使用OpenSSL创建的时间戳响应后,我发现PrintableString
中使用了GeneralName
。我凭直觉选择了前者,但这会导致问题(取决于使用环境)吗?我认为这是pyasn1的错误或局限性
我不知道这是否与此有关:https://github.com/etingof/pyasn1/issues/179
spec说
GeneralName ::= CHOICE {
otherName [0] OtherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER}
Name ::= CHOICE { -- only one possibility for now --
rdnSequence RDNSequence }
RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
对于ASN.1,通常有一个生成一些代码的编译步骤。使用pyasn1,您可以自己编写代码或包含一些模块。
当您包含pyasn1_modules.rfc2459时,唯一的工作就是使用这些类。
您的文字看起来很合法
>>> rdn_sequence = RDNSequence()
>>> rdn_sequence.append(rdn)
>>>
>>> name = Name()
>>> name[0] = rdn_sequence
>>>
>>> general_name = GeneralName()
>>> general_name['directoryName'] = name
但是似乎pyasn1只允许速记访问
>>> rdn_sequence = RDNSequence()
>>> rdn_sequence.append(rdn)
>>>
>>> general_name = GeneralName()
>>> general_name['directoryName'][''] = rdn_sequence
我认为两者都应允许...
至于标签:当您使用pyasn1模块时,您不必担心它们。当编码形式为标签/长度/值(因此,BER,CER和DER ASN.1编码规则)时,需要它们来对消息进行编码。
至于类型(如UTF8String):您不能更改它们,它们必须是您从ASN.1规范中读取的类型。它们具有与它们相关联的(所谓的通用)标签,并且接收者无法理解您的编码消息。
请注意,名称的实现与规范之间存在细微的差异(规范的名称为Type,而实现的名称为No)。过去允许这样做。
class Name(univ.Choice):
componentType = namedtype.NamedTypes(
namedtype.NamedType('', RDNSequence())
)
但是我不认为这是个问题。