Merge pull request #197 from alexanderjordanbaker/ValidityCheckingOfOCSPResponses

Updating Python to support validity with SKEW checking with cryptogra…

Author: alexanderjordanbaker

appstoreserverlibrary/signed_data_verifier.py

@@ -179,6 +179,7 @@ def _decode_signed_object(self, signed_obj: str) -> dict:
 class _ChainVerifier:
     MAXIMUM_CACHE_SIZE = 32 # There are unlikely to be more than a couple keys at once
     CACHE_TIME_LIMIT = 15 * 60 # 15 minutes
+    MAX_SKEW = datetime.timedelta(seconds=60) # Allowable clock skew when validating OCSP response dates
 
     def __init__(self, root_certificates: List[bytes], enable_strict_checks=True):
         self.enable_strict_checks = enable_strict_checks
@@ -327,11 +328,16 @@ def check_ocsp_status(self, cert: crypto.X509, issuer: crypto.X509, root: crypto
                             cert.to_cryptography(), issuer.to_cryptography(), single_response.hash_algorithm
                         )
                         req = builder.build()
+                        now = datetime.datetime.now(datetime.timezone.utc)
                         if (
                             single_response.certificate_status == ocsp.OCSPCertStatus.GOOD
                             and single_response.serial_number == req.serial_number
                             and single_response.issuer_key_hash == req.issuer_key_hash
                             and single_response.issuer_name_hash == req.issuer_name_hash
+                            and single_response.this_update_utc is not None
+                            and now + _ChainVerifier.MAX_SKEW >= single_response.this_update_utc
+                            and single_response.next_update_utc is not None
+                            and single_response.next_update_utc >= now - _ChainVerifier.MAX_SKEW
                         ):
                             # Success
                             return

pyproject.toml

@@ -18,7 +18,7 @@ dependencies = [
     "attrs>=21.3.0",
     "PyJWT>=2.6.0,<3",
     "requests>=2.28.0,<3",
-    "cryptography>=40.0.0",
+    "cryptography>=43.0.0",
     "pyOpenSSL>=23.1.1",
     "asn1==3.2.0",
     "cattrs>=23.1.2",

requirements.txt

@@ -1,7 +1,7 @@
 attrs >= 21.3.0
 PyJWT >= 2.6.0, < 3
 requests >= 2.28.0, < 3
-cryptography >= 40.0.0
+cryptography >= 43.0.0
 pyOpenSSL >= 23.1.1
 asn1==3.2.0
 cattrs >= 23.1.2