Repository navigation
fix: [tools] Validation of mac-eui-64, mac-address and SHA256 ssh-fingerprint values - #1504
Open
bacescuandrei wants to merge 1 commit into
Open
bacescuandrei wants to merge 1 commit into
bacescuandrei wants to merge 1 commit into
Conversation
…gerprint values mac-eui-64 values were truncated to 6 octets and checked with a wrong regex, so they never validated; mac-address values longer than 6 octets were truncated and accepted; SHA256 ssh-fingerprints in the unpadded form printed by OpenSSH were rejected. Whitespace in SHA256 fingerprints is ignored, as in MISP. The tests now require validate() to return True instead of any truthy value.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These are differences from MISP's
app/Lib/Tools/AttributeValidationTool.php:mac-eui-64values never validated.modifyBeforeValidationkept only the first 6 octets, andMAC_EUI_64_REhad an extra:afterff:fe. MISP uses^([a-f0-9]{2}:){3}ff:fe(:[a-f0-9]{2}){3}$and keeps all octets.mac-addressvalues were silently truncated. The same normalisation cutmac-addressvalues with more than 6 octets down to 6, so invalid values were accepted and altered. MISP rejects them.SHA256:SSH fingerprints, as printed by OpenSSH, have no base64 padding, andb64decoderejected them. They are now padded and decoded strictly, as MISP's strictbase64_decodedoes. Whitespace inside the fingerprint is ignored, as in MISP. Non-base64 characters, whichb64decodeused to discard silently, are now rejected, as in MISP.These problems were not caught because
_should_be_validusedassertTrue, which also passes for the error message returned byvalidate. The test helper now checksassertIs(..., True). That stricter check showed that two existing test values were not valid (AS '1.1'before normalisation, and a 60-character onion address), so they are corrected.tests/test_attributevalidationtool.py: 31 passed. Without the change, 3 tests fail (mac, mac-eui-64 intest_validate_networking, ssh-fingerprint).mypyis clean on the changed file.