pimutils / pimutils/vdirsyncer
Make verify_fingerprint work with auth_cert
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.9k
- Forks
- 185
- Avg merge
- 11h 49m
- Merged PRs (30d)
- 1
Description
With the latest git version it is not possible to use both auth_cert and verify_fingerprint.
If you try to do that, you will get this error:
Syncing calendar
debug: ====================
[cut]
debug: Sending request...
error: Unknown error occurred for calendar: 'Fingerprint' object has no attribute 'load_cert_chain'
error: Use `-vdebug` to see the full traceback.
[cut]
debug: File "/usr/lib/python3/dist-packages/vdirsyncer/http.py", line 134, in request
debug: ssl_context.load_cert_chain(*cert)
debug: ^^^^^^^^^^^^^^^^^^^^^^^^^^^
When verify_fingerprint is specified, ssl_context is the return value of
In my understanding, this is the correct way of doing fingerprint pinning using aiohttp, unfortunately the Fingerprint object doesn't have load_cert_chain method.
This is a limitation of aiohttp and there is already an issue that tracks it: https://github.com/aio-libs/aiohttp/issues/3679
Until that issue is resolved, it is possible to make vdirsyncer work by monkey-patching session._connector._make_ssl_context (I can create a PR if this approach is acceptable).
There is a more general security problem when using fingerprint pinning and client certs together in Python: the fingerprint will be checked only after the client cert verification already happened. This problem can't be fixed neither in vdirsyncer nor in aiohttp.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in vdirsyncer/http.py at the SSL context setup around line 83 and the load_cert_chain call at line 134. Reproduce a request using both auth_cert and verify_fingerprint, then review the linked aiohttp limitation and confirm that the chosen change supports both options without the Fingerprint object error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100