zydronium/internetee-registry
1
0
Fork 0
mirror of https://github.com/internetee/registry.git synced 2025-06-06 20:55:44 +02:00
Code Issues Projects Releases Packages Wiki Activity

Remove redundant api check blocks

Browse source
This commit is contained in:
Karl Erik Õunapuu 2020-05-05 14:06:02 +03:00
parent 0fa7fcc771
commit 2dbcbf1c29
4 changed files with 22 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

3
app/api/repp/api.rb
View file

@ -30,7 +30,8 @@ module Repp
webclient_cert_name = ENV['webclient_cert_common_name'] || 'webclient' webclient_cert_name = ENV['webclient_cert_common_name'] || 'webclient'
error! "Webclient #{message} #{webclient_cert_name}", 401 if webclient_cert_name != request_name error! "Webclient #{message} #{webclient_cert_name}", 401 if webclient_cert_name != request_name
else else
unless @current_user.api_pki_ok?(request.env['HTTP_SSL_CLIENT_CERT'], request.env['HTTP_SSL_CLIENT_S_DN_CN']) unless @current_user.pki_ok?(request.env['HTTP_SSL_CLIENT_CERT'],
request.env['HTTP_SSL_CLIENT_S_DN_CN'])
error! "#{message} #{@current_user.username}", 401 error! "#{message} #{@current_user.username}", 401
end end
end end

3
app/controllers/epp/sessions_controller.rb
View file

@ -26,7 +26,8 @@ module Epp
end end
if !Rails.env.development? && (!webclient_request && @api_user) if !Rails.env.development? && (!webclient_request && @api_user)
unless @api_user.api_pki_ok?(request.env['HTTP_SSL_CLIENT_CERT'], request.env['HTTP_SSL_CLIENT_S_DN_CN']) unless @api_user.pki_ok?(request.env['HTTP_SSL_CLIENT_CERT'],
request.env['HTTP_SSL_CLIENT_S_DN_CN'])
epp_errors << { epp_errors << {
msg: 'Authentication error; server closing connection (certificate is not valid)', msg: 'Authentication error; server closing connection (certificate is not valid)',
code: '2501' code: '2501'

5
app/controllers/registrar/sessions_controller.rb
View file

@ -31,7 +31,8 @@ class Registrar
end end
if @depp_user.pki if @depp_user.pki
unless @api_user.registrar_pki_ok?(request.env['HTTP_SSL_CLIENT_CERT'], request.env['HTTP_SSL_CLIENT_S_DN_CN']) unless @api_user.pki_ok?(request.env['HTTP_SSL_CLIENT_CERT'],
request.env['HTTP_SSL_CLIENT_S_DN_CN'], api: false)
@depp_user.errors.add(:base, :invalid_cert) @depp_user.errors.add(:base, :invalid_cert)
end end
end end
@ -205,4 +206,4 @@ class Registrar
redirect_to new_registrar_user_session_url, alert: @depp_user.errors.full_messages.first redirect_to new_registrar_user_session_url, alert: @depp_user.errors.full_messages.first
end end
end end
end end

32
app/models/api_user.rb
View file

@ -64,26 +64,14 @@ class ApiUser < User
registrar.notifications.unread registrar.notifications.unread
end end
def registrar_pki_ok?(crt, cn) def pki_ok?(crt, com, api: true)
return false if crt.blank? || cn.blank? return false if crt.blank? || com.blank?
crt = crt.split(' ').join("\n") origin = api ? certificates.api : certificates.registrar
crt.gsub!("-----BEGIN\nCERTIFICATE-----\n", "-----BEGIN CERTIFICATE-----\n") cert = machine_readable_certificate(crt)
crt.gsub!("\n-----END\nCERTIFICATE-----", "\n-----END CERTIFICATE-----")
cert = OpenSSL::X509::Certificate.new(crt)
md5 = OpenSSL::Digest::MD5.new(cert.to_der).to_s md5 = OpenSSL::Digest::MD5.new(cert.to_der).to_s
certificates.registrar.exists?(md5: md5, common_name: cn, revoked: false)
end
def api_pki_ok?(crt, cn) origin.exists?(md5: md5, common_name: com, revoked: false)
return false if crt.blank? || cn.blank?
crt = crt.split(' ').join("\n")
crt.gsub!("-----BEGIN\nCERTIFICATE-----\n", "-----BEGIN CERTIFICATE-----\n")
crt.gsub!("\n-----END\nCERTIFICATE-----", "\n-----END CERTIFICATE-----")
cert = OpenSSL::X509::Certificate.new(crt)
md5 = OpenSSL::Digest::MD5.new(cert.to_der).to_s
certificates.api.exists?(md5: md5, common_name: cn, revoked: false)
end end
def linked_users def linked_users
@ -95,4 +83,14 @@ class ApiUser < User
def linked_with?(another_api_user) def linked_with?(another_api_user)
another_api_user.identity_code == self.identity_code another_api_user.identity_code == self.identity_code
end end
private
def machine_readable_certificate(cert)
cert = cert.split(' ').join("\n")
cert.gsub!("-----BEGIN\nCERTIFICATE-----\n", "-----BEGIN CERTIFICATE-----\n")
cert.gsub!("\n-----END\nCERTIFICATE-----", "\n-----END CERTIFICATE-----")
OpenSSL::X509::Certificate.new(cert)
end
end end