{"action":"created","issue":{"url":"https://api.github.com/repos/secdev/scapy/issues/1662","repository_url":"https://api.github.com/repos/secdev/scapy","labels_url":"https://api.github.com/repos/secdev/scapy/issues/1662/labels{/name}","comments_url":"https://api.github.com/repos/secdev/scapy/issues/1662/comments","events_url":"https://api.github.com/repos/secdev/scapy/issues/1662/events","html_url":"https://github.com/secdev/scapy/issues/1662","id":373751659,"node_id":"MDU6SXNzdWUzNzM3NTE2NTk=","number":1662,"title":"Scapy does not support generalized time format in certificate while dissecting TLS packet.","user":{"login":"rbo-ktw","id":43962167,"node_id":"MDQ6VXNlcjQzOTYyMTY3","avatar_url":"https://avatars2.githubusercontent.com/u/43962167?v=4","gravatar_id":"","url":"https://api.github.com/users/rbo-ktw","html_url":"https://github.com/rbo-ktw","followers_url":"https://api.github.com/users/rbo-ktw/followers","following_url":"https://api.github.com/users/rbo-ktw/following{/other_user}","gists_url":"https://api.github.com/users/rbo-ktw/gists{/gist_id}","starred_url":"https://api.github.com/users/rbo-ktw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rbo-ktw/subscriptions","organizations_url":"https://api.github.com/users/rbo-ktw/orgs","repos_url":"https://api.github.com/users/rbo-ktw/repos","events_url":"https://api.github.com/users/rbo-ktw/events{/privacy}","received_events_url":"https://api.github.com/users/rbo-ktw/received_events","type":"User","site_admin":false},"labels":[{"id":267691054,"node_id":"MDU6TGFiZWwyNjc2OTEwNTQ=","url":"https://api.github.com/repos/secdev/scapy/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-10-25T02:48:51Z","updated_at":"2019-03-27T17:09:15Z","closed_at":null,"author_association":"NONE","body":"Scapy does not support generalized time format in certificate while dissecting TLS packet. UTC time format is hardcoded:\r\nhttps://github.com/secdev/scapy/blob/e64b2617c2ca4eced0d31cafb0dc05f4827aaefd/scapy/layers/tls/cert.py#L617\r\n\r\nThat's why each [TLS][TLS Handshake - Certificate] packet containig a date with year >= 2050 ends up as [TLS][Raw] packet.\r\n\r\nAccording to RFC 5280 (Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile):\r\n```\r\n4.1.  Basic Certificate Fields\r\n\r\n[...]\r\n\r\nValidity ::= SEQUENCE {\r\n        notBefore      Time,\r\n        notAfter       Time }\r\n\r\nTime ::= CHOICE {\r\n        utcTime        UTCTime,\r\n        generalTime    GeneralizedTime }\r\n\r\n[...]\r\n\r\n4.1.2.5.  Validity\r\n\r\n[...]\r\n\r\n   CAs conforming to this profile MUST always encode certificate\r\n   validity dates through the year 2049 as UTCTime; certificate validity\r\n   dates in 2050 or later MUST be encoded as GeneralizedTime.\r\n   Conforming applications MUST be able to process validity dates that\r\n   are encoded in either UTCTime or GeneralizedTime.\r\n```\r\n\r\nThis workaround solves the problem, but I think that a better (object-oriented) solution is needed:\r\n```\r\n68a69,79\r\n> def strptime_utc_generalized(string):\r\n>     \"\"\"Parse a UTC/Generalized time string to a time tuple.\"\"\"\r\n>     str_length = len(string)\r\n>     if str_length == 12:\r\n>         fmt = \"%y%m%d%H%M%S\"\r\n>     elif str_length == 14:\r\n>         fmt = \"%Y%m%d%H%M%S\"\r\n>     else:\r\n>         raise ValueError(\"Time data '{}' does not match any supported format.\".format(string))\r\n>     return time.strptime(string, fmt)\r\n>\r\n606c617\r\n<             self.notBefore = time.strptime(notBefore, \"%y%m%d%H%M%S\")\r\n---\r\n>             self.notBefore = strptime_utc_generalized(notBefore)\r\n616c627\r\n<             self.notAfter = time.strptime(notAfter, \"%y%m%d%H%M%S\")\r\n---\r\n>             self.notAfter = strptime_utc_generalized(notAfter)\r\n```\r\nMy proposition is to replace:\r\n``` \r\n       notAfter = tbsCert.validity.not_after.val\r\n        if notAfter[-1] == \"Z\":\r\n            notAfter = notAfter[:-1]\r\n        try:\r\n            self.notAfter = time.strptime(notAfter, \"%y%m%d%H%M%S\")\r\n        except:\r\n            raise Exception(error_msg)\r\n        self.notAfter_str_simple = time.strftime(\"%x\", self.notAfter)\r\n```\r\nwith something like this:\r\n```\r\nself.notAfter_str_simple = tbsCert.validity.not_after.to_simple_str()  # to_simple_str() to be implemented\r\n```"},"comment":{"url":"https://api.github.com/repos/secdev/scapy/issues/comments/477259198","html_url":"https://github.com/secdev/scapy/issues/1662#issuecomment-477259198","issue_url":"https://api.github.com/repos/secdev/scapy/issues/1662","id":477259198,"node_id":"MDEyOklzc3VlQ29tbWVudDQ3NzI1OTE5OA==","user":{"login":"guedou","id":11683796,"node_id":"MDQ6VXNlcjExNjgzNzk2","avatar_url":"https://avatars1.githubusercontent.com/u/11683796?v=4","gravatar_id":"","url":"https://api.github.com/users/guedou","html_url":"https://github.com/guedou","followers_url":"https://api.github.com/users/guedou/followers","following_url":"https://api.github.com/users/guedou/following{/other_user}","gists_url":"https://api.github.com/users/guedou/gists{/gist_id}","starred_url":"https://api.github.com/users/guedou/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guedou/subscriptions","organizations_url":"https://api.github.com/users/guedou/orgs","repos_url":"https://api.github.com/users/guedou/repos","events_url":"https://api.github.com/users/guedou/events{/privacy}","received_events_url":"https://api.github.com/users/guedou/received_events","type":"User","site_admin":false},"created_at":"2019-03-27T17:09:15Z","updated_at":"2019-03-27T17:09:15Z","author_association":"MEMBER","body":"Here is a script that strips data from a certificate:\r\n```\r\nfrom scapy.all import *\r\n\r\nload_layer(\"tls\")\r\n\r\ncert = Cert(\"Certum_Trusted_Network_CA_2.pem\")\r\n\r\nx509_cert = cert.x509Cert\r\nx509_cert.tbsCertificate.version = b\"\"\r\nx509_cert.tbsCertificate.serialNumber = 0\r\nx509_cert.tbsCertificate.issuer = b\"\"\r\nx509_cert.tbsCertificate.subject = b\"\"\r\nx509_cert.tbsCertificate.subjectPublicKeyInfo.subjectPublicKey.modulus = 0\r\nx509_cert.tbsCertificate.extensions = b\"\"\r\nx509_cert.signatureValue = b\"\"\r\n\r\ndata = raw(x509_cert)\r\nx = X509_Cert(data)\r\nx.show()\r\n```"}}
{"actor":{"display_login":"guedou"}}