SSLContext.load_verify_locations accepts some cases of trailing data in DER #100372
Comments
davidben
added a commit
to davidben/cpython
that referenced
this issue
Dec 20, 2022
In PEM, we need to parse until error and then suppress PEM_R_NO_START_LINE, because PEM allows arbitrary leading and trailing data. DER, however, does not. Parsing until error and suppressing ASN1_R_HEADER_TOO_LONG doesn't quite work because that error also covers some cases that should be rejected. Instead, check BIO_eof early and stop the loop that way.
miss-islington
pushed a commit
that referenced
this issue
Mar 24, 2023
In PEM, we need to parse until error and then suppress `PEM_R_NO_START_LINE`, because PEM allows arbitrary leading and trailing data. DER, however, does not. Parsing until error and suppressing `ASN1_R_HEADER_TOO_LONG` doesn't quite work because that error also covers some cases that should be rejected. Instead, check `BIO_eof` early and stop the loop that way. Automerge-Triggered-By: GH:Yhg1s
Fidget-Spinner
pushed a commit
to Fidget-Spinner/cpython
that referenced
this issue
Mar 27, 2023
…honGH-100373) In PEM, we need to parse until error and then suppress `PEM_R_NO_START_LINE`, because PEM allows arbitrary leading and trailing data. DER, however, does not. Parsing until error and suppressing `ASN1_R_HEADER_TOO_LONG` doesn't quite work because that error also covers some cases that should be rejected. Instead, check `BIO_eof` early and stop the loop that way. Automerge-Triggered-By: GH:Yhg1s
warsaw
pushed a commit
to warsaw/cpython
that referenced
this issue
Apr 11, 2023
…honGH-100373) In PEM, we need to parse until error and then suppress `PEM_R_NO_START_LINE`, because PEM allows arbitrary leading and trailing data. DER, however, does not. Parsing until error and suppressing `ASN1_R_HEADER_TOO_LONG` doesn't quite work because that error also covers some cases that should be rejected. Instead, check `BIO_eof` early and stop the loop that way. Automerge-Triggered-By: GH:Yhg1s
Open
2 tasks
|
@Yhg1s: I'm having an issue in I'm not sure about the process around backports. Do you need a new PR? Is this normally done using this PR? If needed: I can create a new PR... |
bh1428
added a commit
to bh1428/cpython
that referenced
this issue
Sep 15, 2023
In PEM, we need to parse until error and then suppress `PEM_R_NO_START_LINE`, because PEM allows arbitrary leading and trailing data. DER, however, does not. Parsing until error and suppressing `ASN1_R_HEADER_TOO_LONG` doesn't quite work because that error also covers some cases that should be rejected. Instead, check `BIO_eof` early and stop the loop that way.
|
Closing per #100373 (comment). Thanks for the issue and PR! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Bug report
SSLContext.load_verify_locationsdetects EOF by looking forPEM_R_NO_START_LINEandASN1_R_HEADER_TOO_LONGin PEM and DER, respectively. The former is correct. PEM allows arbitrary trailing data before and after and the OpenSSL API involves looking for that particular error code.ASN1_R_HEADER_TOO_LONG, however doesn't appear anywhere in OpenSSL's documentation and isn't the right way to detect EOF for a sequence of DER elements. It's signaled whenever there weren't enough bytes to read a full ASN.1 header. That could be because of EOF, but it could also be there was one byte, or any other truncated ASN.1 header. (It could also happen inside a deeply nested ASN.1 structure, but OpenSSL happens to pushERR_R_NESTED_ASN1_ERRORin that case, so that case doesn't confuse CPython.)To repro, add this test to
test_load_verify_cadata. It should fail.The fix is instead to stop at
BIO_eoffor DER, as there's no need to skip surrounding data. I'll upload a PR shortly to do that.Your environment
Linked PRs
The text was updated successfully, but these errors were encountered: