scapy.layers.tls.cert
High-level methods for PKI objects (X.509 certificates, CRLs, asymmetric keys). Supports both RSA and ECDSA objects.
The classes below are wrappers for the ASN.1 objects defined in x509.py. By collecting their attributes, we bypass the ASN.1 structure, hence there is no direct method for exporting a new full DER-encoded version of a Cert instance after its serial has been modified (for example). If you need to modify an import, just use the corresponding ASN1_Packet.
For instance, here is what you could do in order to modify the serial of ‘cert’ and then resign it with whatever ‘key’:
f = open('cert.der')
c = X509_Cert(f.read())
c.tbsCertificate.serialNumber = 0x4B1D
k = PrivKey('key.pem')
new_x509_cert = k.resignCert(c)
No need for obnoxious openssl tweaking anymore. :)
- class scapy.layers.tls.cert.CRL(cert_path)[source]
Bases:
objectWrapper for the X509_CRL from layers/x509.py. Use the ‘x509CRL’ attribute to access original object.
- class scapy.layers.tls.cert.Cert(cert_path)[source]
Bases:
objectWrapper for the X509_Cert from layers/x509.py. Use the ‘x509Cert’ attribute to access original object.
- export(filename, fmt='DER')[source]
Export certificate in ‘fmt’ format (DER or PEM) to file ‘filename’
- isIssuerCert(other)[source]
- True if ‘other’ issued ‘self’, i.e.:
self.issuer == other.subject
self is signed by other
- isRevoked(crl_list)[source]
Given a list of trusted CRL (their signature has already been verified with trusted anchors), this function returns True if the certificate is marked as revoked by one of those CRL.
Note that if the Certificate was on hold in a previous CRL and is now valid again in a new CRL and bot are in the list, it will be considered revoked: this is because _all_ CRLs are checked (not only the freshest) and revocation status is not handled.
Also note that the check on the issuer is performed on the Authority Key Identifier if available in _both_ the CRL and the Cert. Otherwise, the issuers are simply compared.
- isSelfSigned()[source]
- Return True if the certificate is self-signed:
issuer and subject are the same
the signature of the certificate is valid.
- remainingDays(now=None)[source]
Based on the value of notAfter field, returns the number of days the certificate will still be valid. The date used for the comparison is the current and local date, as returned by time.localtime(), except if ‘now’ argument is provided another one. ‘now’ argument can be given as either a time tuple or a string representing the date. Accepted format for the string version are:
‘%b %d %H:%M:%S %Y %Z’ e.g. ‘Jan 30 07:38:59 2008 GMT’
‘%m/%d/%y’ e.g. ‘01/30/08’ (less precise)
If the certificate is no more valid at the date considered, then a negative value is returned representing the number of days since it has expired.
The number of days is returned as a float to deal with the unlikely case of certificates that are still just valid.
- class scapy.layers.tls.cert.Chain(certList, cert0=None)[source]
Bases:
listBasically, an enhanced array of Cert.
- verifyChain(anchors, untrusted=None)[source]
Perform verification of certificate chains for that certificate. A list of anchors is required. The certificates in the optional untrusted list may be used as additional elements to the final chain. On par with chain instantiation, only one chain constructed with the untrusted candidates will be retained. Eventually, dates are checked.
- verifyChainFromCAFile(cafile, untrusted_file=None)[source]
Does the same job as .verifyChain() but using the list of anchors from the cafile. As for .verifyChain(), a list of untrusted certificates can be passed (as a file, this time).
- verifyChainFromCAPath(capath, untrusted_file=None)[source]
Does the same job as .verifyChainFromCAFile() but using the list of anchors in capath directory. The directory should (only) contain certificates files in PEM format. As for .verifyChainFromCAFile(), a list of untrusted certificates can be passed as a file (concatenation of the certificates in PEM format).
- class scapy.layers.tls.cert.PrivKey(key_path=None)[source]
Bases:
objectParent class for both PrivKeyRSA and PrivKeyECDSA. Provides common signTBSCert() and resignCert() methods.
- signTBSCert(tbsCert, h='sha256')[source]
Note that this will always copy the signature field from the tbsCertificate into the signatureAlgorithm field of the result, regardless of the coherence between its contents (which might indicate ecdsa-with-SHA512) and the result (e.g. RSA signing MD2).
There is a small inheritance trick for the computation of sigVal below: in order to use a sign() method which would apply to both PrivKeyRSA and PrivKeyECDSA, the sign() methods of the subclasses accept any argument, be it from the RSA or ECDSA world, and then they keep the ones they’re interested in. Here, t will be passed eventually to pkcs1._DecryptAndSignRSA.sign().
- class scapy.layers.tls.cert.PrivKeyECDSA(key_path=None)[source]
Bases:
PrivKeyWrapper for ECDSA keys based on SigningKey from ecdsa library. Use the ‘key’ attribute to access original object.
- class scapy.layers.tls.cert.PrivKeyRSA(key_path=None)[source]
Bases:
PrivKey,_EncryptAndVerifyRSA,_DecryptAndSignRSAWrapper for RSA keys based on _DecryptAndSignRSA from crypto/pkcs1.py Use the ‘key’ attribute to access original object.
- class scapy.layers.tls.cert.PubKey(key_path=None)[source]
Bases:
objectParent class for both PubKeyRSA and PubKeyECDSA. Provides a common verifyCert() method.
- class scapy.layers.tls.cert.PubKeyECDSA(key_path=None)[source]
Bases:
PubKeyWrapper for ECDSA keys based on the cryptography library. Use the ‘key’ attribute to access original object.
- class scapy.layers.tls.cert.PubKeyRSA(key_path=None)[source]
Bases:
PubKey,_EncryptAndVerifyRSAWrapper for RSA keys based on _EncryptAndVerifyRSA from crypto/pkcs1.py Use the ‘key’ attribute to access original object.