wbond / wbond/certvalidator

'Void' object has no attribute 'human_friendly'

Open
#37 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
115
Forks
34
PR merge metrics
No merged PRs in 30d

Description

When run on revoked.badssl.com

    ctx = ValidationContext(allow_fetching=True, revocation_mode='hard-fail', weak_hash_algos=set(["md2", "md5", "sha1"]))
    validator = CertificateValidator(pem, validation_context=ctx, intermediate_certs=intermediate_certs)
    validator.validate_usage(
        key_usage=set(validator_key_usage),
        extended_key_usage=set(validator_extended_key_usage),
    )

full self-enclosed test:

from socket import socket, AF_INET, SOCK_STREAM
from certvalidator import CertificateValidator, ValidationContext
import idna
from OpenSSL import SSL
from OpenSSL.crypto import dump_certificate, FILETYPE_PEM

host = 'revoked.badssl.com'
ctx = SSL.Context(method=SSL.TLSv1_2_METHOD)
ctx.check_hostname = False
ctx.verify_mode = SSL.VERIFY_NONE
conn = SSL.Connection(ctx, socket(AF_INET, SOCK_STREAM))
conn.connect((host, 443))
conn.settimeout(3)
conn.set_tlsext_host_name(idna.encode(host))
conn.setblocking(1)
conn.do_handshake()
x509 = conn.get_peer_certificate()
intermediate_certs = []
for (_, cert) in enumerate(conn.get_peer_cert_chain()):
    intermediate_certs.append(dump_certificate(FILETYPE_PEM, cert))
conn.close()
pem = dump_certificate(FILETYPE_PEM, x509)
ctx = ValidationContext(allow_fetching=True, revocation_mode='hard-fail', weak_hash_algos=set(["md2", "md5", "sha1"]))
validator = CertificateValidator(pem, validation_context=ctx, intermediate_certs=intermediate_certs)
validator.validate_usage(
    key_usage=set(['digital_signature', 'key_encipherment']),
    extended_key_usage=set(['server_auth']),
)

full trace

Traceback (most recent call last):
  File "<redacted>/src/main.py", line 39, in <module>
    validator.validate_usage(
  File "<redacted>/.venv/lib/python3.9/site-packages/certvalidator/__init__.py", line 193, in validate_usage
    self._validate_path()
  File "<redacted>/.venv/lib/python3.9/site-packages/certvalidator/__init__.py", line 121, in _validate_path
    validate_path(self._context, candidate_path)
  File "<redacted>/.venv/lib/python3.9/site-packages/certvalidator/validate.py", line 50, in validate_path
    return _validate_path(validation_context, path)
  File "<redacted>/.venv/lib/python3.9/site-packages/certvalidator/validate.py", line 376, in _validate_path
    verify_ocsp_response(
  File "<redacted>/.venv/lib/python3.9/site-packages/certvalidator/validate.py", line 1101, in verify_ocsp_response
    reason = revocation_info['revocation_reason'].human_friendly
AttributeError: 'Void' object has no attribute 'human_friendly'

Via pip certvalidator==0.11.1

** Expected

Your docs explain I should see RevokedError not AttributeError which seems more about a source code bug within CertificateValidator then an actual error realted to OCSP revocation.

You may want to do some testing against badssl.com if you don't have something better

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the self-contained example against revoked.badssl.com, then inspect certvalidator/validate.py at verify_ocsp_response(), where the traceback accesses revocation_info['revocation_reason'].human_friendly. The done condition is for this revoked certificate to produce the documented RevokedError instead of AttributeError.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.