Method verify

scapy/layers/tls/cert.py:1818–1915

Verify a CMS message against the list of trusted certificates, and return the unpacked message if the verification succeeds. :param contentInfo: the ContentInfo whose signature to verify :param eContentType: if provided, verifies that the content type is valid

(
        self,
        contentInfo: CMS_ContentInfo,
        eContentType: Optional[ASN1_OID] = None,
    )

        )

    def verify(
        self,
        contentInfo: CMS_ContentInfo,
        eContentType: Optional[ASN1_OID] = None,
    ):
        """
        Verify a CMS message against the list of trusted certificates,
        and return the unpacked message if the verification succeeds.

        :param contentInfo: the ContentInfo whose signature to verify
        :param eContentType: if provided, verifies that the content type is valid
        """
        if contentInfo.contentType.oidname != "id-signedData":
            raise ValueError("ContentInfo isn't signed !")

        signeddata = contentInfo.content

        # Build the certificate chain
        certificates = []
        if signeddata.certificates:
            certificates = [Cert(x.certificate) for x in signeddata.certificates]
        certTree = CertTree(certificates, self.store)

        # Check there's at least one signature
        if not signeddata.signerInfos:
            raise ValueError("ContentInfo contained no signature !")

        # Check all signatures
        for signerInfo in signeddata.signerInfos:
            # Find certificate in the chain that did this
            cert: Cert = certTree.findCertBySid(signerInfo.sid)

            # Verify certificate signature
            certTree.verify(cert)

            # Verify the message hash
            if signerInfo.signedAttrs:
                # Verify the contentType
                try:
                    contentType = next(
                        x.values[0].value
                        for x in signerInfo.signedAttrs
                        if x.type.oidname == "contentType"
                    )

                    if contentType != signeddata.encapContentInfo.eContentType:
                        raise ValueError(
                            "Inconsistent 'contentType' was detected in packet !"
                        )

                    if eContentType is not None and eContentType != contentType:
                        raise ValueError(
                            "Expected '%s' but got '%s' contentType !"
                            % (
                                eContentType,
                                contentType,
                            )
                        )