tls: add optional server certificate verification - #5144
Conversation
AI-Assisted: yes (GPT-5.6-Cyber)
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #5144 +/- ##
=======================================
Coverage 80.63% 80.63%
=======================================
Files 390 390
Lines 96936 96982 +46
=======================================
+ Hits 78168 78206 +38
- Misses 18768 18776 +8
🚀 New features to boost your workflow:
|
|
|
||
| import socket | ||
| import binascii | ||
| import ipaddress |
| def _load_trust_anchors(cafile): | ||
| if not conf.crypto_valid or PolicyBuilder is None: | ||
| return [] | ||
| context = ssl.create_default_context(cafile=cafile) | ||
| return [ | ||
| x509.load_der_x509_certificate(der) | ||
| for der in context.get_ca_certs(binary_form=True) | ||
| ] | ||
|
|
||
|
|
||
| def _verify_server_certificate(certificates, trusted_certs, hostname): | ||
| if (not certificates or not trusted_certs or not conf.crypto_valid or | ||
| PolicyBuilder is None): | ||
| return False | ||
| try: | ||
| try: | ||
| subject = x509.IPAddress(ipaddress.ip_address(hostname)) | ||
| except ValueError: | ||
| subject = x509.DNSName(hostname) | ||
| verifier = PolicyBuilder().store( | ||
| Store(trusted_certs) | ||
| ).build_server_verifier(subject) | ||
| verifier.verify( | ||
| x509.load_der_x509_certificate(certificates[0].der), | ||
| [ | ||
| x509.load_der_x509_certificate(cert.der) | ||
| for cert in certificates[1:] | ||
| ], | ||
| ) | ||
| return True | ||
| except Exception: | ||
| return False |
There was a problem hiding this comment.
Could you use 'CertTree' from scapy.layers.tls instead? It should have a verify function, although a bit rudimentary.
There was a problem hiding this comment.
I can do that, and it drops ipaddress. ssl has to stay — it is the only way to find the system trust store. Say if you would rather require a cafile instead.
One thing first, because it changes what the option promises.
CertTree.verify() checks every signature properly; I tampered with one and it failed. But that is all it checks. It never looks at the date, and it never sees the hostname — verify(self, cert) has nowhere to put one. So a certificate issued to someone else passes, and so does one that expired ten days ago. The test in this PR asserts the first of those is rejected.
There is also a trap. Leave out rootCAs and CertTree trusts any self-signed certificate in the list you hand it — and here that list came from the peer. That's basically a non-check...
The other three clients with no_check_certificate — HTTP_Client, LDAP_Client, and Kerberos through HTTP_Client — all fall back to ssl.create_default_context(), which does check the hostname. This one cannot: there is no ssl socket to hand the job to.
So what would you prefer here? I'm thinking one of the following:
- CertTree, plus a name check against subjectAltName and an expiry check. No new imports. Wildcards and IP addresses work; punycode does not.
- CertTree alone, and I rename the option so it does not oversell itself.
- CertTree alone, name unchanged.
Note that 2 and 3 accept expired certificates, which the code they replace rejects... but maybe that's just the nature of Scapy? :-)
There was a problem hiding this comment.
If you (or agents) have the time, 1 with an updated verify() that checks the SAN and expiry would be great. Thanks
2 participants
TLSClientAutomatoncompletes a handshake and sends application data without checking the server'scertificate against a trust store or the hostname it asked for. It is a test client, and it does
not claim otherwise — but there is no way to ask it to check, which makes it awkward to use against
a real service where that is the point.
The relevant states pass the certificate through without a policy:
scapy/layers/tls/automaton_cli.py:118-142takes the server name but has no trust store, and
:396-405advances past a TLS 1.2 Certificatemessage without authenticating it.
The change adds verification and makes it selectable. When enabled, an explicit CA bundle is used if
one is supplied and the system trust store otherwise, the requested hostname is checked, and the
connection closes on failure.
verify=Falsekeeps the current behaviour for the cases wheretalking to an untrusted server is the whole point of the exercise.
The added regressions cover a self-signed server, a valid certificate for the wrong hostname, and a
correct server, asserting the first two close the connection and the third completes. Without the
source change they fail.
On cost. Performance was measured on one computer, before and after the fix, but there is not
much of a "before" to measure: the client performs no verification today, so its valid path does
nothing. Verifying took 2.9 µs per handshake, against 819 ns of test overhead — roughly 2.1 µs
added, once per connection, for a full chain and hostname check. A percentage against a path that
does no work would not mean anything, so none is quoted.