fix: complete verify chain on extract_and_update_trust_materials

Author: PascalDR

pyeudiw/trust/handler/x509.py

@@ -4,15 +4,15 @@
 from pyeudiw.trust.handler.interface import TrustHandlerInterface
 from pyeudiw.trust.model.trust_source import TrustSourceData, TrustEvaluationType
 from pyeudiw.trust.handler.exceptions import InvalidTrustHandlerConfiguration
-from pyeudiw.jwk.parse import parse_pem, parse_x5c_keys, parse_certificate
+from pyeudiw.jwk.parse import parse_x5c_keys, parse_certificate
 from cryptojwt.jwk.jwk import key_from_jwk_dict
 from pyeudiw.x509.verify import (
     PEM_cert_to_B64DER_cert,
     to_DER_cert,
     verify_x509_attestation_chain, 
     get_expiry_date_from_x5c, 
-    der_list_to_pem_list, 
-    pem_list_to_der_list, 
+    to_pem_list, 
+    to_der_list, 
     get_x509_info,
     get_trust_anchor_from_x5c,
     get_certificate_type
@@ -94,7 +94,7 @@ def __init__(
                 logger.error(f"Invalid x509 leaf certificate using CA {k}. Unmatching private key, the chain will be removed")
                 continue
 
-            chain = pem_list_to_der_list(v) if type(v[0]) == str and v[0].startswith("-----BEGIN CERTIFICATE-----") else v
+            chain = to_der_list(v)
 
             if verify_x509_attestation_chain(chain):
                 self.relying_party_certificate_chains_by_ca[k] = chain
@@ -104,14 +104,51 @@ def __init__(
 
         self.private_keys = private_keys
 
+    def _verify_chain(self, x5c: list[str]) -> bool:
+        """
+        Verify the x5c chain.
+        :param x5c: The x5c chain to verify.
+        :return: True if the chain is valid, False otherwise.
+        """
+        der_chain = [to_DER_cert(cert) for cert in x5c]
+
+        if len(der_chain) > 1 and not verify_x509_attestation_chain(der_chain):
+            logger.error(f"Invalid x509 certificate chain. Chain validation failed")
+            return False
+
+        issuer = get_trust_anchor_from_x5c(der_chain)
+
+        if not issuer:
+            logger.error("Invalid x509 certificate chain. Issuer not found")
+            return False
+        
+        if not issuer in self.certificate_authorities:
+            logger.error("Invalid x509 certificate chain. Issuer not found in the list of trusted CAs")
+            return False
+        
+        issuer_cert = self.certificate_authorities[issuer]
+
+        try:
+            issuer_jwk = parse_certificate(issuer_cert)
+            chain_jwks = parse_x5c_keys(der_chain)
+        except Exception as e:
+            logger.error(f"Invalid x509 certificate chain. Parsing failed: {e}")
+            return False
+
+        if not issuer_jwk.thumbprint == chain_jwks[-1].thumbprint:
+            logger.error("Invalid x509 certificate chain. Issuer thumbprint does not match")
+            return False
+        
+        return True
+
     def extract_and_update_trust_materials(
         self, issuer: str, trust_source: TrustSourceData
     ) -> TrustSourceData:
         # Return the first valid chain
+
         for ca, chain in self.relying_party_certificate_chains_by_ca.items():
-            if not verify_x509_attestation_chain(chain):
-                logger.error(f"Invalid x509 certificate chain using CA {ca}. Chain validation failed, the chain will be removed")
-                del self.relying_party_certificate_chains_by_ca[ca]
+            if not self._verify_chain(chain):
+                logger.error(f"Invalid x509 certificate chain using CA {ca}. Chain will be ignored")
                 continue
 
             exp = get_expiry_date_from_x5c(chain)
@@ -120,7 +157,7 @@ def extract_and_update_trust_materials(
                 X509Handler._TRUST_TYPE,
                 TrustEvaluationType(
                     attribute_name="x5c",
-                    x5c=der_list_to_pem_list(chain),
+                    x5c=to_pem_list(chain),
                     expiration_date=exp,
                     jwks=self.private_keys,
                     trust_handler_name=self.name,
@@ -136,47 +173,18 @@ def validate_trust_material(
         x5c: list[str],
         trust_source: TrustSourceData,
     ) -> tuple[bool, TrustSourceData]:
-        # TODO: qui c'è del lavoro veramente sporco da fare.
-        #  Bisogna
-        #  (1) normalizzare la rappresentazione della chain a DER; per fare questo bisogna fare inferenza se PEM o Base64+DER
-        #  (2) normalizzare il salvatagggio della chain a PEM
-        #  (3) incrociare le dita che MDOC non si sfasci...
-        der_chain = [to_DER_cert(cert) for cert in x5c]
-        pem_chain = der_list_to_pem_list(der_chain)
-
-        if len(der_chain) > 1 and not verify_x509_attestation_chain(der_chain):
-            logger.error(f"Invalid x509 certificate chain. Chain validation failed")
-            return False, trust_source
-
-        issuer = get_trust_anchor_from_x5c(der_chain)
-
-        if not issuer:
-            logger.error("Invalid x509 certificate chain. Issuer not found")
-            return False, trust_source
-        
-        if not issuer in self.certificate_authorities:
-            logger.error("Invalid x509 certificate chain. Issuer not found in the list of trusted CAs")
-            return False, trust_source
-        
-        issuer_pem = self.certificate_authorities[issuer]
+        chain_jwks = parse_x5c_keys(x5c)
+        valid = self._verify_chain(x5c)
 
-        try:
-            issuer_jwk = parse_pem(issuer_pem)
-            chain_jwks = parse_x5c_keys(x5c)
-        except Exception as e:
-            logger.error("Invalid x509 certificate chain. Parsing failed: {e}")
-            return False, trust_source
-
-        if not issuer_jwk.thumbprint == chain_jwks[-1].thumbprint:
-            logger.error("Invalid x509 certificate chain. Issuer thumbprint does not match")
+        if not valid:
             return False, trust_source
 
         trust_source.add_trust_param(
             "x509",
             TrustEvaluationType(
                 attribute_name=self.get_handled_trust_material_name(),
-                x5c=pem_chain,
-                expiration_date=get_expiry_date_from_x5c(der_chain),
+                x5c=to_pem_list(x5c),
+                expiration_date=get_expiry_date_from_x5c(x5c),
                 jwks=chain_jwks,
                 trust_handler_name=self.name,
             )