Class: Mongo::Socket::OcspVerifier Private

Inherits:
Object
  • Object
show all
Includes:
Loggable
Defined in:
lib/mongo/socket/ocsp_verifier.rb

Overview

This class is part of a private API. You should avoid using this class if possible, as it may be removed or be changed in the future.

OCSP endpoint verifier.

After a TLS connection is established, this verifier inspects the certificate presented by the server, and if the certificate contains an OCSP URI, performs the OCSP status request to the specified URI (following up to 5 redirects) to verify the certificate status.

See Also:

Since:

  • 2.0.0

Defined Under Namespace

Classes: Response

Constant Summary

Constants included from Loggable

Loggable::PREFIX

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from Loggable

#log_debug, #log_error, #log_fatal, #log_info, #log_warn, #logger

Constructor Details

#initialize(host_name, cert, ca_cert, cert_store, **opts) ⇒ OcspVerifier

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns a new instance of OcspVerifier.

Parameters:

  • host_name (String) —

    The host name being verified, for diagnostic output.

  • cert (OpenSSL::X509::Certificate) —

    The certificate presented by the server at host_name.

  • ca_cert (OpenSSL::X509::Certificate) —

    The CA certificate presented by the server or resolved locally from the server certificate.

  • cert_store (OpenSSL::X509::Store) —

    The certificate store to use for verifying OCSP response. This should be the same store as used in SSLContext used with the SSLSocket that we are verifying the certificate for. This must NOT be the CA certificate provided by the server (i.e. anything taken out of peer_cert) - otherwise the server would dictate which CA authorities the client trusts.

Since:

  • 2.0.0



64
65
66
67
68
69
70
 
# File 'lib/mongo/socket/ocsp_verifier.rb', line 64

def initialize(host_name, cert, ca_cert, cert_store, **opts)
  @host_name = host_name
  @cert = cert
  @ca_cert = ca_cert
  @cert_store = cert_store
  @options = opts
end

Instance Attribute Details

#ca_cert ⇒ Object (readonly)

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Since:

  • 2.0.0



72
73
74
 
# File 'lib/mongo/socket/ocsp_verifier.rb', line 72

def ca_cert
  @ca_cert
end

#cert ⇒ Object (readonly)

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Since:

  • 2.0.0



72
73
74
 
# File 'lib/mongo/socket/ocsp_verifier.rb', line 72

def cert
  @cert
end

#cert_store ⇒ Object (readonly)

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Since:

  • 2.0.0



72
73
74
 
# File 'lib/mongo/socket/ocsp_verifier.rb', line 72

def cert_store
  @cert_store
end

#host_name ⇒ Object (readonly)

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Since:

  • 2.0.0



72
73
74
 
# File 'lib/mongo/socket/ocsp_verifier.rb', line 72

def host_name
  @host_name
end

#options ⇒ Object (readonly)

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Since:

  • 2.0.0



72
73
74
 
# File 'lib/mongo/socket/ocsp_verifier.rb', line 72

def options
  @options
end

Instance Method Details

#cert_id ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Since:

  • 2.0.0



100
101
102
103
104
105
106
 
# File 'lib/mongo/socket/ocsp_verifier.rb', line 100

def cert_id
  @cert_id ||= OpenSSL::OCSP::CertificateId.new(
    cert,
    ca_cert,
    OpenSSL::Digest.new('SHA1')
  )
end

#ocsp_uris ⇒ Array<String>

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns OCSP URIs in the specified server certificate.

Returns:

  • (Array<String>) —

    OCSP URIs in the specified server certificate.

Since:

  • 2.0.0



79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
 
# File 'lib/mongo/socket/ocsp_verifier.rb', line 79

def ocsp_uris
  @ocsp_uris ||= begin
    # https://tools.ietf.org/html/rfc3546#section-2.3
    # prohibits multiple extensions with the same oid.
    ext = cert.extensions.detect do |ext|
      ext.oid == 'authorityInfoAccess'
    end

    if ext
      # Our test certificates have multiple OCSP URIs.
      ext.value.split("\n").select do |line|
        line.start_with?('OCSP - URI:')
      end.map do |line|
        line.split(':', 2).last
      end
    else
      []
    end
  end
end

#timeout ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Since:

  • 2.0.0



74
75
76
 
# File 'lib/mongo/socket/ocsp_verifier.rb', line 74

def timeout
  options[:timeout] || 5
end

#verify ⇒ true | false

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns Whether the certificate was verified.

Returns:

  • (true | false) —

    Whether the certificate was verified.

Raises:

Since:

  • 2.0.0



127
128
129
130
131
132
133
134
 
# File 'lib/mongo/socket/ocsp_verifier.rb', line 127

def verify
  handle_exceptions do
    return false if ocsp_uris.empty?

    resp, errors = do_verify
    return_ocsp_response(resp, errors)
  end
end

#verify_with_cache ⇒ Object

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Since:

  • 2.0.0



108
109
110
111
112
113
114
115
116
117
118
119
120
121
 
# File 'lib/mongo/socket/ocsp_verifier.rb', line 108

def verify_with_cache
  handle_exceptions do
    return false if ocsp_uris.empty?

    resp = OcspCache.get(cert_id)
    return return_ocsp_response(resp) if resp

    resp, errors = do_verify

    OcspCache.set(cert_id, resp) if resp

    return_ocsp_response(resp, errors)
  end
end