PyDERASN: ndakanyora sei ASN.1 raibhurari ine slots uye blobs

ASN.1 iyi ndiyo chiyero (ISO, ITU-T, GOST) yemutauro unotsanangura ruzivo rwakarongwa, pamwe chete nemitemo yekukodha ruzivo urwu. Kwandiri, semugadziri wepurogiramu, iyi ingori imwe fomati yekuisa uye kuburitsa data, pamwe neJSON, XML, XDR nevamwe. Zvakanyanya kuitika muhupenyu hwedu hwemazuva ese, uye vanhu vazhinji vanosangana nazvo: mumaserura, nhare, VoIP kutaurirana (UMTS, LTE, WiMAX, SS7, H.323), mumambure etiweki (LDAP, SNMP, Kerberos), mune zvese zvinonetsa cryptography (X.509, CMS, PKCS zviyero), mumakadhi ebhangi uye biometric passports, nezvimwe zvakawanda.

Chinyorwa ichi chinobata ne PyDERASN: Python ASN.1 raibhurari inoshandiswa zvakanyanya mumapurojekiti ane hukama necryptography mukati Atlas.

Kazhinji, ASN.1 haina kukodzera kurumbidza kune cryptographic mabasa: ASN.1 uye macodecs ayo akaoma. Izvi zvinoreva kuti kodhi haizove nyore, uye iyi inogara iri yekuwedzera kurwisa vector. Ingotarisa kune rondedzero kusasimba mumaraibhurari eASN.1. Bruce Schneier mune yake Cryptography engineering inorayirawo kusashandisa chiyero ichi nekuda kwekuoma kwacho: "TLV inonyanyozivikanwa encoding ndeye ASN.1, asi yakaoma zvikuru uye tinoinyenyeredza." Asi, zvinosuruvarisa, nhasi tine zvivakwa zvakakosha zveveruzhinji mavari kushandiswa nesimba X.509 zvitupa, CRL, OCSP, TSP, CMP mitemo, CMC, mameseji CMS, uye yakawanda mipimo PKCS. Nokudaro, iwe unofanirwa kukwanisa kushanda neASN.1 kana uri kuita chero chinhu chine chokuita necryptography.

ASN.1 inogona kukodha nenzira dzakasiyana siyana/codecs:

• BER (Basic Encoding Mitemo)
• Cer (Canonical Encoding Mitemo)
• DER (Distinguished Encoding Mitemo)
• GSER (Generic String Encoding Mitemo)
• JER (JSON Encoding Mitemo)
• LWER (Chiedza Weight Encoding Mitemo)
• REO (Octet Encoding Mitemo)
• PER (Packed Encoding Rules)
• SER (Kusaina yakananga Encoding Mitemo)
• VADZIDZI (XML Encoding Mitemo)

nevamwe vakati wandei. Asi mu cryptographic mabasa, mukuita, maviri anoshandiswa: BER uye DER. Kunyangwe mumasaini akasainwa eXML magwaro (XMLDSig, XAdES) pachange paine Base64-encoded ASN.1 DER zvinhu, sezviri muJSON-oriented protocol acme kubva Let's Encrypt. Unogona kunzwisisa zvirinani ese aya macodecs uye BER/CER/DER misimboti yekukodha muzvinyorwa nemabhuku: ASN.1 mumashoko ari nyore, ASN.1 - Kukurukurirana pakati pemaitiro akasiyana-siyana naOlivier Dubuisson, ASN.1 Yakapedzwa naProf John Larmouth.

BER ibhinari byte-yakatarisana (semuenzaniso PER, yakakurumbira muserura kutaurirana - bit-oriented) TLV fomati. Chimwe nechimwe chinhu chakaiswa encoded se: tag (Tag), kuratidza rudzi rwechinhu chinofanira kuiswa encoded (integer, tambo, zuva, nezvimwewo), kureba (Length) zvirimo uye zvirimo pachazvo (Value). BER nerusaruro inokutendera kuti usatsanangure kukosha kwehurefu nekuisa yakakosha hurefu husingaverengeki kukosha uye kupedzisa End-Of-Octets meseji ine Kupera-Kwe-Octets chiratidzo. Kunze kwekureba encoding, BER ine zvakawanda zvakasiyana-siyana munzira iyo inokodha mhando dzedata, dzakadai se:

• INTEGER, OBJECT IDENTIFIER, BIT STRING uye kureba kwechimwe chinhu kunogona kunge kusiri kwakajairwa (kwete kuvharirwa mune diki fomu);
• BOOLEAN ndeyechokwadi kune chero isiri-zero yemukati;
• BIT STRING inogona kunge iine "yakawedzerwa" zero bits;
• BIT STRING, OCTET STRING uye ese akadzikwa tambo mhando, kusanganisira zuva/nguva, inogona kudimburwa kuita machunks akareba-akareba, kureba kwacho kusingazivikanwe pachine nguva panguva ye (de) encoding;
• UTCTime/GeneralizedTime inogona kunge iine nzira dzakasiyana dzekutsanangudza nguva yenguva yekubvisa uye "yakawedzera" zero zvikamu zvemasekondi;
• DEFAULT SEQUENCE maitiro anogona kana kusave encoded;
• Iwo akadanwa maitiro emabhiti ekupedzisira muBIT STRING anogona kuve asina kuvharwa;
• SEQUENCE (ZVE)/SET (YE) inogona kuve nechero kurongeka kwezvinhu.

Nekuda kwezvose zviri pamusoro, encoding data kuitira kuti ifanane neiyo fomu yekutanga haigoneke nguva dzose. Nokudaro, chikamu chemitemo chakagadzirwa: DER - kunyatsogadzirisa nzira imwe chete yekodhidhi yekodhi, iyo inokosha pamabasa e-cryptographic apo, semuenzaniso, kuchinja imwe bhiti kuchaita kuti siginicha kana checksum isashande. DER ine yakashata yakakosha: kureba kwezvinhu zvese kunofanirwa kuzivikanwa pachine nguva panguva yekukodha, izvo zvisingatenderi kuyerera kwedata. Iyo CER codec haina chidzoreso ichi, zvakafanana ichivimbisa kumiririrwa kwe data. Nehurombo (kana kuti irombo here kuti isu hatina mamwe madhikodha akaomesesa?), haina kuve yakakurumbira. Naizvozvo, mukuita tinosangana ne "musanganiswa" kushandiswa kweBER uye DER encoded data. Sezvo ese CER neDER ari subset yeBER, chero BER decoder inogona kuzvibata.

Matambudziko ne pyasn1

Kubasa tinonyora akawanda ePython zvirongwa zvine chekuita necryptography. Uye makore mashoma apfuura pakanga pasina sarudzo yemaraibhurari emahara: angave aya ari akaderera-chikamu maraibhurari anokutendera iwe kuti ungoencode / decode, semuenzaniso, nhamba uye musoro wechimiro, kana raibhurari iyi. pyasn1. Takagara pairi kwemakore anoverengeka uye pakutanga takafara zvikuru, sezvo inokubvumira kushanda neASN.1 zvivakwa seine zvinhu zvepamusoro-soro: semuenzaniso, decoded X.509 certificate chinhu chinokubvumira kuti uwane minda yayo kuburikidza. chiratidziro cheduramazwi: cert[“tbsCertificate”] ["serialNumber"] ichatiratidza nhamba dzinoverengeka dzechitupa ichi. Saizvozvowo, iwe unogona "kuunganidza" zvinhu zvakaoma nekushanda navo sezvinyorwa, maduramazwi, uye wobva wangoti pyasn1.codec.der.encoder.encode basa uye uwane serialized kumiririra kwegwaro.

Zvisinei, zvikanganiso, matambudziko uye miganhu zvakaratidzwa. Paive uye, zvinosuruvarisa, zvichiri zvikanganiso mu pyasn1: panguva yekunyora, imwe yemhando dzekutanga mu pyasn1 ndeye GeneralizedTime, zvisiri izvo decoded uye encoded.

Mumapurojekiti edu, kuchengetedza nzvimbo, isu tinowanzo chengetedza chete faira nzira, kureba uye kureba mumabhayiti echinhu chatinoda kunongedzera. Semuenzaniso, faira rakasainwa zvisina tsarukano rinogona kunge riri muCMS SignedData ASN.1 chimiro:

  0     [1,3,1018]  ContentInfo SEQUENCE
  4     [1,1,   9]   . contentType: ContentType OBJECT IDENTIFIER 1.2.840.113549.1.7.2 (id_signedData)
 19-4   [0,0,1003]   . content: [0] EXPLICIT [UNIV 16] ANY
 19     [1,3, 999]   . . DEFINED BY id_signedData: SignedData SEQUENCE
 23     [1,1,   1]   . . . version: CMSVersion INTEGER v3 (03)
 26     [1,1,  19]   . . . digestAlgorithms: DigestAlgorithmIdentifiers SET OF
                           [...]
 47     [1,3, 769]   . . . encapContentInfo: EncapsulatedContentInfo SEQUENCE
 51     [1,1,   8]   . . . . eContentType: ContentType OBJECT IDENTIFIER 1.3.6.1.5.5.7.12.2 (id_cct_PKIData)
 65-4   [1,3, 751]   . . . . eContent: [0] EXPLICIT OCTET STRING 751 bytes OPTIONAL

                 ТУТ СОДЕРЖИМОЕ ПОДПИСЫВАЕМОГО ФАЙЛА РАЗМЕРОМ 751 байт

820     [1,2, 199]   . . . signerInfos: SignerInfos SET OF
823     [1,2, 196]   . . . . 0: SignerInfo SEQUENCE
826     [1,1,   1]   . . . . . version: CMSVersion INTEGER v3 (03)
829     [0,0,  22]   . . . . . sid: SignerIdentifier CHOICE subjectKeyIdentifier
                               [...]
956     [1,1,  64]   . . . . . signature: SignatureValue OCTET STRING 64 bytes
                     . . . . . . C1:B3:88:BA:F8:92:1C:E6:3E:41:9B:E0:D3:E9:AF:D8
                     . . . . . . 47:4A:8A:9D:94:5D:56:6B:F0:C1:20:38:D2:72:22:12
                     . . . . . . 9F:76:46:F6:51:5F:9A:8D:BF:D7:A6:9B:FD:C5:DA:D2
                     . . . . . . F3:6B:00:14:A4:9D:D7:B5:E1:A6:86:44:86:A7:E8:C9

uye tinokwanisa kuwana faira rekutanga rakasainwa pa offset 65 bytes, 751 bytes kureba. pyasn1 haichengete ruzivo urwu muzvinhu zvayo zvakatemwa. Iyo inodaidzwa kuti TLVSeeker yakanyorwa - raibhurari diki iyo inokutendera kuti utore ma tag uye kureba kwechinhu, mune iyo interface yatakaraira "enda kune inotevera tag", "enda mukati me tag" (pinda mukati meSEQUENCE chinhu), "enda kune iyo inotevera tag", "taura chigadziro chako uye kureba kwechinhu patiri." Iyi yaive "manual" kufamba kuburikidza neASN.1 DER-serialized data. Asi zvanga zvisingaite kushanda neBER-serialized data nenzira iyi, sezvo, semuenzaniso, iyo OCTET STRING byte tambo yaigona kukodha muchimiro che akati wandei chunks.

Imwe dhizaini yemabasa edu e pyasn1 kusakwanisa kunzwisisa kubva kuzvinhu zvakatemwa kuti munda wakapihwa waivapo muSEQUENCE kana kuti kwete. Semuyenzaniso, kana chimiro chine Munda SEQUENCE OF Smth OPTIONAL ndima, inogona kunge isipo zvachose kubva kune data rinouya (OPTIONAL), kana kuti inogona kunge iripo, asi iine zero kureba (isina rondedzero). Kazhinji, izvi hazvina kukwanisa kutsanangurwa. Uye izvi zvakakosha pakusimbisa kwakasimba kwechokwadi che data yakagamuchirwa. Fungidzira kuti imwe chiremera chekupa chitupa chaizoburitsa chitupa chine data iyo "isina zvachose" inoshanda kubva pakuona kweASN.1 zvirongwa! Semuyenzaniso, chiremera chetifiketi "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı" yakapfuura miganhu inotenderwa mumudzi wayo chitupa. RFC 5280 miganhu pahurefu hwechikamu chechikamu - haigone kutendeseka decoded maererano nechirongwa. Iyo DER codec inoda kuti munda une kukosha kwakaenzana ne DEFAULT usavharwe panguva yekufambisa - magwaro akadaro anoitika muhupenyu, uye yekutanga vhezheni yePyDERASN yakatombobvumira nemaune maitiro akadaro (kubva paDER point of view) maitiro nekuda kwe kumashure kugarisana.

Chimwe chidziviso kusakwanisa kuziva zviri nyore muchimiro chipi (BER/DER) chimwe chinhu chakaiswa muchimiro. Semuenzaniso, chiyero cheCMS chinoti meseji iri BER-yakavharwa, asi iyo yakasainaAttrs ndima, iyo iyo cryptographic siginecha inogadzirwa, inofanira kunge iri muDER. Kana tikasarudza neDER, tinokundikana mukugadziriswa kweCMS pachayo; kana tikasarudza neBER, hatizoziva kuti iyo signAttrs yaive muchimiro chipi. Nekuda kweizvozvo, TLVSeeker (iyo isina analogue mu pyasn1) ichafanirwa kutsvaga nzvimbo yeimwe neimwe yeakasainaAttrs minda, uye zvakasiyana, ichiitora kunze kweiyo serialized inomiririra, decode iyo neDER.

Iko kugona kuita otomatiki KUTSANANGURWA NEminda, inoitika kazhinji, yaidiwa kwazvo kwatiri. Mushure mekugadzirisa chimiro cheASN.1, tinogona kusara tine ZVIMWE minda inofanira kugadziriswa mberi maererano nechirongwa chakasarudzwa zvichienderana ne OBJECT IDENTIFIER inotsanangurwa mumunda wekugadzirisa. MuPython kodhi, izvi zvinoreva kunyora kana uye wofonera decoder yeIYO ndima.

Kubuda kwePyDERASN

PaAtlas, tinogara tichitumira zvigamba kumusoro kana tawana mamwe matambudziko kana kuvandudza zvirongwa zvemahara zvatinoshandisa. Takaendesa kuvandudzwa ku pyasn1 kakawanda, asi pyasn1's kodhi haisi iyo iri nyore kunzwisisa uye dzimwe nguva pakanga paine isingaenderane API shanduko yaitirova pasi. Uyezve, isu takajaira kunyora bvunzo ne generative test, izvo zvaive zvisiri izvo mu pyasn1.

Rimwe zuva rakanaka ndakafunga kuti ndaive nezvaringana uye yaive nguva yekuedza kunyora raibhurari yangu ne __slot__s, offsets uye mabhurobhu airatidzwa zvinoyevedza! Kungogadzira ASN.1 kodeki kwaisazokwana - tinoda kuendesa mapurojekiti edu ese kwairi, uye aya mazana ezviuru zvemitsara yekodhi yakazara nebasa neASN.1 zvimiro. Ndiko kuti, chimwe chezvinodiwa pairi: kusununguka kwekushandura kwezvino pyasn1 code. Ndapedza zororo rangu rose, ndakanyora raibhurari iyi uye ndakaendesa mapurojekiti ese kwairi. Sezvo vaine 100% yekuvharirwa nemiyedzo, izvi zvaireva kuti raibhurari yaishanda zvizere.

PyDERASN, zvakafanana, ine ingangoita 100% bvunzo yekuvhara. Inoshandisa generative test neraibhurari huru hypothesis. Zvakaitwawo fuzzing py-afl- Ndinodya pamashini enyukireya makumi matatu nemaviri. Zvisinei nekuti isu hatina kodhi yePython32 yasara, PyDERASN ichiri kuenderana nayo uye nekuda kweizvi ine chete. nhanhatu kupindwa muropa. Uyezve, inoedzwa ichipikisa ASN.1:2008 compliance test suite.

Nheyo yekushanda nayo yakafanana ne pyasn1 - kushanda nepamusoro-soro Python zvinhu. Tsanangudzo ye ASN.1 zvirongwa zvakafanana.

class TBSCertificate(Sequence):
    schema = (
        ("version", Version(expl=tag_ctxc(0), default="v1")),
        ("serialNumber", CertificateSerialNumber()),
        ("signature", AlgorithmIdentifier()),
        ("issuer", Name()),
        ("validity", Validity()),
        ("subject", Name()),
        ("subjectPublicKeyInfo", SubjectPublicKeyInfo()),
        ("issuerUniqueID", UniqueIdentifier(impl=tag_ctxp(1), optional=True)),
        ("subjectUniqueID", UniqueIdentifier(impl=tag_ctxp(2), optional=True)),
        ("extensions", Extensions(expl=tag_ctxc(3), optional=True)),
    )

Nekudaro, PyDERASN ine kumwe kutaridzika kwekunyora kwakasimba. Mu pyasn1, kana munda wanga uri werudzi CMSVersion(INTEGER), waigona kupihwa int kana INTEGER. PyDERASN inoda chaizvo kuti chinhu chakapihwa ive chaiyo CMSVersion. Pamusoro pekunyora Python3 kodhi, isu tinoshandisawo kutaipa zvirevo, saka mabasa edu haazove neakavanzika nharo senge def func(serial, zvirimo), asi def func(serial: CertificateSerialNumber, zvirimo: EncapsulatedContentInfo), uye PyDERASN inobatsira kuchengetedza kodhi yakadaro.

Panguva imwecheteyo, PyDERASN ine zvibvumirano zviri nyore kune iyi yekutaipa. pyasn1 haina kubvumidza iyo SubjectKeyIdentifier().subtype(implicitTag=Tag(...))) kuti ipe chinhu kuSubjectKeyIdentifier() (pasina IMPLICIT TAG inodiwa) uye zvanga zvakafanira kazhinji kukopa nekugadzira patsva zvinhu nekuda kwe iyo yakashandurwa IMPLICIT/EXPLICIT tags. PyDERASN inotarisisa chete mhando yepasi - inozongotsiva ma tags kubva kune yatovepo ASN.1 schema yechimiro. Izvi zvinorerutsa kodhi yekushandisa.

Kana kukanganisa kukaitika panguva yekunyora, saka mu pyasn1 hazvisi nyore kunzwisisa kuti zvakaitika kupi chaizvo. Semuyenzaniso, muchitiketi cheTurkey chatotaurwa pamusoro apa, tichagamuchira chikanganiso chinotevera: UTF8String (tbsCertificate:issuer:rdnSequence:3:0:value:DEFINED BY 2.5.4.10:utf8String) (pa138) zvisingagutsikane miganhu: 1 ⇐ 77 ⇐ 64 Pakunyora ASN .1 zvimiro vanhu vanogona kukanganisa, uye izvi zvinoita kuti zvive nyore kugadzirisa maapplication kana kuona matambudziko nemagwaro erimwe bato.

Yekutanga vhezheni yePyDERASN haina kutsigira BER encoding. Yakazoonekwa gare gare uye haitsigire kugadzirisa UTCTime/GeneralizedTime ine nguva dzenguva. Izvi zvichauya mune ramangwana, nokuti purojekiti yakanyorwa kunyanya munguva yangu yekusununguka.

Zvakare, mushanduro yekutanga pakanga pasina basa neDEFINED BY minda. Mwedzi mishoma gare gare izvi mukana wakamuka uye yakatanga kushandiswa nesimba, ichideredza zvakanyanya kodhi yekushandisa - mune imwe decoding oparesheni zvaive zvichikwanisika kuwana chimiro chese chakaparadzaniswa kusvika pakadzika. Kuti uite izvi, schema inotsanangura kuti ndeapi minda "inotsanangura" chii. Semuenzaniso, tsananguro yeCMS scheme:

class ContentInfo(Sequence):
    schema = (
        ("contentType", ContentType(defines=((("content",), {
            id_authenticatedData: AuthenticatedData(),
            id_digestedData: DigestedData(),
            id_encryptedData: EncryptedData(),
            id_envelopedData: EnvelopedData(),
            id_signedData: SignedData(),
        }),))),
        ("content", Any(expl=tag_ctxc(0))),
    )

inoti kana contentType iine OID ine value id_signedData, ipapo ndima yemukati (iri muSEQUENCE imwechete) inofanira kudhindwa zvinoenderana neSignedData scheme. Nei kune maparentheses akawanda kudaro? Munda unogona "kutsanangura" akati wandei minda panguva imwe chete, sezvazviri mune EnvelopedData zvimiro. Minda yakatsanangurwa inocherechedzwa neinonzi decode nzira - inotsanangura nzvimbo chaiyo yechero chinhu muzvimiro zvese.

Iwe hausi kugara uchida kana kusagara uine mukana wekukurumidza kuwedzera izvi zvinotsanangurwa kudhizaini. Panogona kunge paine kesi-chaiyo kesi kana OID uye zvimiro zvinozivikanwa chete mune yechitatu-bato chirongwa. PyDERASN inopa kugona kuseta izvi zvinotsanangura panguva yekumisikidza chimiro:

ContentInfo().decode(data, ctx={"defines_by_path": ((
    (
        "content", DecodePathDefBy(id_signedData),
        "certificates", any, "certificate", "tbsCertificate",
        "extensions", any, "extnID",
    ),
    ((("extnValue",), {
        id_ce_authorityKeyIdentifier: AuthorityKeyIdentifier(),
        id_ce_basicConstraints: BasicConstraints(),
        [...]
        id_ru_subjectSignTool: SubjectSignTool(),
    }),),
),)})

Pano tinoti muCMS SignedData yezvitupa zvese zvakanamirwa, sarudza zvese zvakawedzerwa (AuthorityKeyIdentifier, BasicConstraints, SubjectSignTool, nezvimwewo). Isu tinoratidza kuburikidza nenzira yedecode iyo chinhu chinoda "kutsiviwa" nematsanangudzo, sekunge chakatsanangurwa mu schema.

Pakupedzisira, PyDERASN ine kugona kumhanya kubva rairo yekuraira for decoding ASN.1 mafaira uye ane mupfumi kudhinda kwakanaka. Iwe unogona kudhidha yekupokana ASN.1, kana iwe unogona kutsanangura chirongwa chakajeka uye woona chimwe chinhu chakadai:

Ruzivo rwakaratidzwa: chinhu chinodzikiswa, tag kureba, kureba kwemukati, kuvepo kweEOC (kupera-kwe-octets), BER encoding hunhu, isingaperi-kureba encoding hunhu, kureba uye kumisa kweEXPLICIT tag (kana iripo), nesting kudzika kwe. chinhu chiri muzvimiro, IMPLICIT/EXPLICIT tag value, zita rechinhu maererano nechirongwa, hwaro hwaro ASN.1 mhando, nhamba yekutevedzana mukati SEQUENCE/SET OF, CHOICE kukosha (kana iripo), zita rinoverengwa nevanhu INTEGER/ENUMERATED/BIT STRING maererano nechirongwa, kukosha kwemhando ipi zvayo yepasi , DEFAULT / OPTIONAL mureza kubva pachirongwa, chiratidzo chokuti chinhu chacho chakanyatsogadziriswa seKUTSANANGURWA NE uye nekuda kweOID iyi yakaitika, OID inoverengwa nevanhu.

Iyo yakanaka yekudhinda sisitimu yakanyatsogadzirwa kuitira kuti igadzire kutevedzana kwezvinhu zvePP zvinoonekwa zvichishandiswa zvakasiyana maturusi. Iyo skrini inoratidza muratidziri mune yakapfava mavara mavara. Kune zvakare vashanduri muJSON/HTML fomati, kuitira kuti ionekwe neyakajeka muASN.1 browser, sezviri mu asn1js project.

Mamwe maraibhurari

Ichi chaive chisiri chinangwa, asi PyDERASN yakabuda zvakanyanya faster kupfuura pyasn1. Semuenzaniso, decoding CRL mafaera ema megabyte saizi anogona kutora nguva yakareba zvekuti iwe unofanirwa kufunga nezve epakati data ekuchengetedza mafomati (nekukurumidza) uye shandura dhizaini rekushandisa. pyasn1 decodes CRL CACert.org palaptop yangu inotora anopfuura maminetsi makumi maviri, nepo PyDERASN inotora masekondi makumi maviri nemasere chete! Pane chirongwa asn1crypto, yakanangana nekushanda nekukurumidza nemakriptographic structures: inosarudza (zvakakwana, kwete neusimbe) iyo CRL yakafanana mumasekonzi makumi maviri nepfumbamwe, asi inoshandisa kanenge kaviri RAM yakawanda kana ichimhanya pasi pePython29 (3 MiB versus 983), uye mu498 nguva pasi pePython3.5 (2) maringe ne1677), nepo pyasn488 ichidya zvakapetwa ka1 (4.3 maringe ne2093).

Hatina kufunga asn1crypto, yandakataura, nokuti purojekiti yakanga ichiri mucheche uye isu hatina kunzwa nezvazvo. Ikozvino isu taisazotarisa kudivi rake, sezvo ini ndakabva ndaona kuti imwe chete GeneralizedTime haitore fomu yekupokana, uye panguva yekuteedzera inobvisa chinyararire chikamu chesekondi. Izvi zvinotenderwa kushanda nezvitupa zveX.509, asi kazhinji hazvishande.

Parizvino, PyDERASN ndiyo yakanyanya kuomarara yemahara Python/Go DER decoder yandinoziva. Mu encoding/asn1 raibhurari yemudiwa wangu Go kwete cheki yakasimba OBJECT IDENTIFIER uye UTCTime/GeneralizedTime tambo. Dzimwe nguva kuomarara kunogona kupinda munzira (kunyanya nekuda kwekudzokera kumashure kuenderana nezvikumbiro zvekare izvo pasina anozogadzirisa), saka PyDERASN inogona kupfuura. zvirongwa zvakasiyana-siyana macheki anopera simba.

Iyo kodhi yeprojekiti inoedza kuve nyore sezvinobvira. Raibhurari yese ifaira rimwe chete. Iyo kodhi yakanyorwa nekusimbisa kwekureruka kwekunzwisisa, pasina kusakosha kwekuita optimizations uye DRY kodhi. Izvo hazvi, sezvandambotaura, kutsigira yakazara BER decoding yeUTCTime/GeneralizedTime tambo, pamwe neREAL, RELATIVE OID, EXTERNAL, INSTANCE OF, EMBEDDED PDV, CHARACTER STRING data mhando. Mune zvimwe zviitiko zvese, ini pachangu handisi kuona chinangwa chekushandisa mamwe maraibhurari muPython.

Kufanana nemapurojekiti angu ese, senge PyGOST, GoGOST, NCCP, GoVPN, PyDERASN yakakwana software yemahara, yakagoverwa pasi pemitemo LGPLv3+, uye iripo yekudhawunirodha mahara. Pane mienzaniso yekushandisa pano and in PyGOST miedzo.

Sergey Matveev, cypherpunk, nhengo SPO Foundation, Python/Go mugadziri, nyanzvi huru FSUE "STC "Atlas".

Source: www.habr.com