Class: R509::OCSP::Helper::RequestChecker

62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91

# File 'lib/r509/ocsp/signer.rb', line 62

def initialize(configs, validity_checker)
  unless configs.kind_of?(R509::Config::CAConfigPool)
    raise R509::R509Error, "Must pass R509::Config::CAConfigPool object"
  end
  if configs.all.empty?
    raise R509::R509Error, "Must be at least one R509::Config object"
  end
  @configs = configs.all
  test_cid = OpenSSL::OCSP::CertificateId.new(OpenSSL::X509::Certificate.new,OpenSSL::X509::Certificate.new)
  if test_cid.respond_to?(:issuer_key_hash)
    @configs_hash = {}
    @configs.each do |config|
      ee_cert = OpenSSL::X509::Certificate.new
      ee_cert.issuer = config.ca_cert.cert.subject.name
      # per RFC 5019
      # Clients MUST use SHA1 as the hashing algorithm for the
      # CertID.issuerNameHash and the CertID.issuerKeyHash values.
      # so we can safely assume that our inbound hashes will be SHA1
      issuer_certid = OpenSSL::OCSP::CertificateId.new(ee_cert,config.ca_cert.cert,OpenSSL::Digest::SHA1.new)
      @configs_hash[issuer_certid.issuer_key_hash] = config
    end
  end
  @validity_checker = validity_checker
  if @validity_checker.nil?
    raise R509::R509Error, "Must supply a R509::Validity::Checker"
  end
  if not @validity_checker.respond_to?(:check)
    raise R509::R509Error, "The validity checker must have a check method"
  end
end

97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118

# File 'lib/r509/ocsp/signer.rb', line 97

def check_statuses(request)
  request.certid.map { |certid|
    if certid.respond_to?(:issuer_key_hash)
      validated_config = @configs_hash[certid.issuer_key_hash]
    else
      validated_config = @configs.find do |config|
        #we need to create an OCSP::CertificateId object that has the right
        #issuer so we can pass it to #cmp_issuer. This is annoying because
        #CertificateId wants a cert and its issuer, but we don't want to
        #force users to provide an end entity cert just to make this comparison
        #work. So, we create a fake new cert and pass it in.
        ee_cert = OpenSSL::X509::Certificate.new
        ee_cert.issuer = config.ca_cert.cert.subject
        issuer_certid = OpenSSL::OCSP::CertificateId.new(ee_cert,config.ca_cert.cert)
        certid.cmp_issuer(issuer_certid)
      end
    end

    log.info "#{validated_config.ca_cert.subject.to_s} found for issuer" if validated_config
    check_status(certid, validated_config)
  }
end