Class: R509::Config::CAConfig

395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488

# File 'lib/r509/config.rb', line 395

def self.load_from_hash(conf, opts = {})
  if conf.nil?
    raise ArgumentError, "conf not found"
  end
  unless conf.kind_of?(Hash)
    raise ArgumentError, "conf must be a Hash"
  end

  ca_root_path = Pathname.new(opts[:ca_root_path] || FileUtils.getwd)

  unless File.directory?(ca_root_path)
    raise R509Error, "ca_root_path is not a directory: #{ca_root_path}"
  end

  ca_cert_hash = conf['ca_cert']

  if ca_cert_hash.has_key?('engine')
    ca_cert = self.load_with_engine(ca_cert_hash,ca_root_path)
  end

  if ca_cert.nil? and ca_cert_hash.has_key?('pkcs12')
    ca_cert = self.load_with_pkcs12(ca_cert_hash,ca_root_path)
  end

  if ca_cert.nil? and ca_cert_hash.has_key?('cert')
    ca_cert = self.load_with_key(ca_cert_hash,ca_root_path)
  end

  if conf.has_key?("ocsp_cert")
    if conf["ocsp_cert"].has_key?('engine')
      ocsp_cert = self.load_with_engine(conf["ocsp_cert"],ca_root_path)
    end

    if ocsp_cert.nil? and conf["ocsp_cert"].has_key?('pkcs12')
      ocsp_cert = self.load_with_pkcs12(conf["ocsp_cert"],ca_root_path)
    end

    if ocsp_cert.nil? and conf["ocsp_cert"].has_key?('cert')
      ocsp_cert = self.load_with_key(conf["ocsp_cert"],ca_root_path)
    end
  end

  ocsp_chain = []
  if conf.has_key?("ocsp_chain")
    ocsp_chain_data = read_data(ca_root_path+conf["ocsp_chain"])
    cert_regex = /-----BEGIN CERTIFICATE-----.+?-----END CERTIFICATE-----/m
    ocsp_chain_data.scan(cert_regex) do |cert|
      ocsp_chain.push(OpenSSL::X509::Certificate.new(cert))
    end
  end

  opts = {
    :ca_cert => ca_cert,
    :ocsp_cert => ocsp_cert,
    :ocsp_chain => ocsp_chain,
    :crl_validity_hours => conf['crl_validity_hours'],
    :ocsp_validity_hours => conf['ocsp_validity_hours'],
    :ocsp_start_skew_seconds => conf['ocsp_start_skew_seconds'],
    :ocsp_location => conf['ocsp_location'],
    :ca_issuers_location => conf['ca_issuers_location'],
    :cdp_location => conf['cdp_location'],
    :message_digest => conf['message_digest'],
  }

  if conf.has_key?("crl_list")
    opts[:crl_list_file] = (ca_root_path + conf['crl_list']).to_s
  end

  if conf.has_key?("crl_number")
    opts[:crl_number_file] = (ca_root_path + conf['crl_number']).to_s
  end


  profs = {}
  conf['profiles'].keys.each do |profile|
    data = conf['profiles'][profile]
    if not data["subject_item_policy"].nil?
      subject_item_policy = R509::Config::SubjectItemPolicy.new(data["subject_item_policy"])
    end
    profs[profile] = R509::Config::CAProfile.new(:key_usage => data["key_usage"],
                       :extended_key_usage => data["extended_key_usage"],
                       :basic_constraints => data["basic_constraints"],
                       :certificate_policies => data["certificate_policies"],
                       :ocsp_no_check => data["ocsp_no_check"],
                       :inhibit_any_policy => data["inhibit_any_policy"],
                       :policy_constraints => data["policy_constraints"],
                       :name_constraints => data["name_constraints"],
                       :subject_item_policy => subject_item_policy)
  end unless conf['profiles'].nil?
  opts[:profiles] = profs

  # Create the instance.
  self.new(opts)
end

494
495
496
497

# File 'lib/r509/config.rb', line 494

def self.load_yaml(conf_name, yaml_file, opts = {})
  conf = YAML.load_file(yaml_file)
  self.load_from_hash(conf[conf_name], opts)
end

360
361
362

# File 'lib/r509/config.rb', line 360

def ocsp_cert
  if @ocsp_cert.nil? then @ca_cert else @ocsp_cert end
end

375
376
377
378
379
380

# File 'lib/r509/config.rb', line 375

def profile(prof)
  if !@profiles.has_key?(prof)
    raise R509::R509Error, "unknown profile '#{prof}'"
  end
  @profiles[prof]
end

366
367
368
369
370
371

# File 'lib/r509/config.rb', line 366

def set_profile(name, prof)
  unless prof.is_a?(R509::Config::CAProfile)
    raise TypeError, "profile is supposed to be a R509::Config::CAProfile"
  end
  @profiles[name] = prof
end