valid_until must be later than valid_from

[hanymorcos]

I'm getting validation error that valid_until must be later than valid_from. I"m running the STIX elevator command like so "stix2_elevator -v 2.1 stix.file"

Thanks,
H

[X] indicator--598acda8-c76d-4f57-b21f-5ec205a91466: 'valid_until' (9999-12-31T00:00:00.000000Z) must be later than 'valid_from' (9999-12-31T00:00:00.000000Z)		

STIX Indicator Object:
<indicator:Observable id="ob-08-1">
<cybox:Object id="obj-08-1">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false" is_destination="true" is_spoofed="false">
AddressObj:Address_Value5.50.50.10</AddressObj:Address_Value>
</cybox:Properties>
cybox:Related_Objects
<cybox:Related_Object id="rel-obj-08-1">
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false" is_destination="true" is_spoofed="false">
AddressObj:Address_Value5.50.50.11</AddressObj:Address_Value>
</cybox:Properties>
<cybox:Relationship xsi:type="cyboxVocabs:ObjectRelationshipVocab-1.1">Redirects_To</cybox:Relationship>
</cybox:Related_Object>
</cybox:Related_Objects>
</cybox:Object>
</indicator:Observable>

Translated to:

{
"confidence": 50,
"created": "9999-12-31T00:00:00.000Z",
"id": "indicator--598acda8-c76d-4f57-b21f-5ec205a91466",
"indicator_types": [
"ip-watchlist"
],
"kill_chain_phases": [
{
"kill_chain_name": "LM Cyber Kill Chain",
"phase_name": "Delivery"
}
],
"modified": "9999-12-31T00:00:00.000Z",
"object_marking_refs": [
"marking-definition--c8e034d5-329a-4229-9fe2-05d55ee6b6ae"
],
"pattern": "[(ipv4-addr:value = '5.50.50.11' AND ipv4-addr:value = '5.50.50.10')]",
"spec_version": "2.1",
"type": "indicator",
"valid_from": "9999-12-31T00:00:00.000000Z",
"valid_until": "9999-12-31T00:00:00.000000Z"
},

[rpiazza]

Hi @hanymorcos,

An corner case that we didn't consider - thanks for pointing it out!

@clenk: The validator should probably test for <=.

[clenk]

The specification says this about valid_until:

This MUST be greater than the timestamp in the valid_from property.

This is why the validator gives this error. Looking at the STIX 1 XML I'm not sure where the "9999" date came from.