Skip to content

Allow additional critical extensions to be used during validate_path #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Allow additional critical extensions to be used during validate_path #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 31 additions & 1 deletion certvalidator/context.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,10 @@ class ValidationContext():
# options include: "md2", "md5", "sha1"
weak_hash_algos = None

# A set of unicode strings of critical extensions. If an intermediate certificate
# has a critical extension not in this set, it will fail validation.
critical_extensions = None

# A set of byte strings of the SHA-1 hashes of certificates that are whitelisted
_whitelisted_certs = None

Expand Down Expand Up @@ -102,7 +106,7 @@ class ValidationContext():
def __init__(self, trust_roots=None, extra_trust_roots=None, other_certs=None,
whitelisted_certs=None, moment=None, allow_fetching=False, crls=None,
crl_fetch_params=None, ocsps=None, ocsp_fetch_params=None,
revocation_mode="soft-fail", weak_hash_algos=None):
revocation_mode="soft-fail", weak_hash_algos=None, additional_critical_extensions=None):
"""
:param trust_roots:
If the operating system's trust list should not be used, instead
Expand Down Expand Up @@ -329,6 +333,31 @@ def __init__(self, trust_roots=None, extra_trust_roots=None, other_certs=None,
else:
weak_hash_algos = set(['md2', 'md5'])

supported_critical_extensions = set([
'authority_information_access',
'authority_key_identifier',
'basic_constraints',
'crl_distribution_points',
'extended_key_usage',
'freshest_crl',
'key_identifier',
'key_usage',
'ocsp_no_check',
'certificate_policies',
'policy_mappings',
'policy_constraints',
'inhibit_any_policy',
])
if additional_critical_extensions is not None:
if not isinstance(additional_critical_extensions, set):
raise TypeError(pretty_message(
'''
additional_critical_extensions must be a set of unicode strings, not %s
''',
type_name(additional_critical_extensions)
))
supported_critical_extensions |= additional_critical_extensions

self.certificate_registry = CertificateRegistry(
trust_roots,
extra_trust_roots,
Expand Down Expand Up @@ -362,6 +391,7 @@ def __init__(self, trust_roots=None, extra_trust_roots=None, other_certs=None,
self._revocation_mode = revocation_mode
self._soft_fail_exceptions = []
self.weak_hash_algos = weak_hash_algos
self.critical_extensions = supported_critical_extensions

@property
def crls(self):
Expand Down
17 changes: 1 addition & 16 deletions certvalidator/validate.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -664,22 +664,7 @@ def _validate_path(validation_context, path, end_entity_name_override=None):

# Step 3 o
# Check for critical unsupported extensions
supported_extensions = set([
'authority_information_access',
'authority_key_identifier',
'basic_constraints',
'crl_distribution_points',
'extended_key_usage',
'freshest_crl',
'key_identifier',
'key_usage',
'ocsp_no_check',
'certificate_policies',
'policy_mappings',
'policy_constraints',
'inhibit_any_policy',
])
unsupported_critical_extensions = cert.critical_extensions - supported_extensions
unsupported_critical_extensions = cert.critical_extensions - validation_context.critical_extensions
if unsupported_critical_extensions:
raise PathValidationError(pretty_message(
'''
Expand Down