wbond / wbond/certvalidator

Validation fails with TypeError

Open
#9 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
115
Forks
34
PR merge metrics
No merged PRs in 30d

Description

Given an individual PEM-encoded certificate cert, I want to validate it against a certification chain located in ./cc_certs/PT.pem which I open to build a list of intermediate certificates:

def validate(cert):
    intermediates = []
    with open('./cc_certs/PT.pem', 'rb') as f:
        for _, _, der_bytes in pem.unarmor(f.read(), multiple=True):
            intermediates.append(der_bytes)

    validator = CertificateValidator(cert, intermediates)
    validator.validate_usage(set(['digital_signature']))

Simple use-case that's well documented. However when running this it blows up complaining about a TypeError

Traceback (most recent call last):
  File "client.py", line 114, in <module>
    smartcard.validate(cc_cert)
  File "/Users/fabio/Code/security2017-p1g2/src/chat/smartcard.py", line 38, in validate
    validator.validate_usage(set(['digital_signature']))
  File "/usr/local/lib/python3.6/site-packages/certvalidator/__init__.py", line 193, in validate_usage
    self._validate_path()
  File "/usr/local/lib/python3.6/site-packages/certvalidator/__init__.py", line 121, in _validate_path
    validate_path(self._context, candidate_path)
  File "/usr/local/lib/python3.6/site-packages/certvalidator/validate.py", line 50, in validate_path
    return _validate_path(validation_context, path)
  File "/usr/local/lib/python3.6/site-packages/certvalidator/validate.py", line 407, in _validate_path
    end_entity_name_override=end_entity_name_override
  File "/usr/local/lib/python3.6/site-packages/certvalidator/validate.py", line 1243, in verify_crl
    if isinstance(distribution_point['crl_issuer'], x509.GeneralNames):
TypeError: string indices must be integers

Sometimes the error also happens to be

Traceback (most recent call last):
  File "client.py", line 114, in <module>
    smartcard.validate(cc_cert)
  File "/Users/fabio/Code/security2017-p1g2/src/chat/smartcard.py", line 39, in validate
    validator.validate_usage(set(['digital_signature']))
  File "/usr/local/lib/python3.6/site-packages/certvalidator/__init__.py", line 193, in validate_usage
    self._validate_path()
  File "/usr/local/lib/python3.6/site-packages/certvalidator/__init__.py", line 121, in _validate_path
    validate_path(self._context, candidate_path)
  File "/usr/local/lib/python3.6/site-packages/certvalidator/validate.py", line 50, in validate_path
    return _validate_path(validation_context, path)
  File "/usr/local/lib/python3.6/site-packages/certvalidator/validate.py", line 386, in _validate_path
    end_entity_name_override=end_entity_name_override
  File "/usr/local/lib/python3.6/site-packages/certvalidator/validate.py", line 956, in verify_ocsp_response
    if moment > cert_response['next_update'].native:
TypeError: '>' not supported between instances of 'datetime.datetime' and 'NoneType'

What do these errors mean? Or why does the error appear to be random? I tried to trace the exception in the source code but I don't know why it's being raised.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the validation call in client.py and smartcard.py, then inspect certvalidator/validate.py at verify_crl() and verify_ocsp_response(), the traceback locations named in the report. Reproduce the provided certificate-chain validation flow and examine the differing CRL and OCSP data that reaches those checks. Done means identifying why the input types or missing values vary and documenting or correcting the resulting validation behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.