pimutils / pimutils/vdirsyncer

Make verify_fingerprint work with auth_cert

Open
#1,098 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
1.9k
Forks
185
Avg merge
11h 49m
Merged PRs (30d)
1

Description

With the latest git version it is not possible to use both auth_cert and verify_fingerprint.
If you try to do that, you will get this error:

Syncing calendar
debug: ====================
[cut]
debug: Sending request...
error: Unknown error occurred for calendar: 'Fingerprint' object has no attribute 'load_cert_chain'
error: Use `-vdebug` to see the full traceback.
[cut]
debug:   File "/usr/lib/python3/dist-packages/vdirsyncer/http.py", line 134, in request
debug:     ssl_context.load_cert_chain(*cert)
debug:     ^^^^^^^^^^^^^^^^^^^^^^^^^^^

When verify_fingerprint is specified, ssl_context is the return value of

https://github.com/pimutils/vdirsyncer/blob/d1f93ea0becfa4966ef73c05ec6bc75b2bdf42bf/vdirsyncer/http.py#L83

In my understanding, this is the correct way of doing fingerprint pinning using aiohttp, unfortunately the Fingerprint object doesn't have load_cert_chain method.
This is a limitation of aiohttp and there is already an issue that tracks it: https://github.com/aio-libs/aiohttp/issues/3679

Until that issue is resolved, it is possible to make vdirsyncer work by monkey-patching session._connector._make_ssl_context (I can create a PR if this approach is acceptable).

There is a more general security problem when using fingerprint pinning and client certs together in Python: the fingerprint will be checked only after the client cert verification already happened. This problem can't be fixed neither in vdirsyncer nor in aiohttp.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in vdirsyncer/http.py at the SSL context setup around line 83 and the load_cert_chain call at line 134. Reproduce a request using both auth_cert and verify_fingerprint, then review the linked aiohttp limitation and confirm that the chosen change supports both options without the Fingerprint object error.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.