zydronium/internetee-registry
1
0
Fork 0
mirror of https://github.com/internetee/registry.git synced 2025-05-17 17:59:47 +02:00
Code Issues Projects Releases Packages Wiki Activity

Check webclient cert in EPP when connecting from local network #2765

Browse source
This commit is contained in:
Martin Lensment 2015-07-13 13:53:12 +03:00
parent cac73b1224
commit 9fd38f161a
2 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
app/controllers/epp/sessions_controller.rb
View file

@ -13,6 +13,15 @@ class Epp::SessionsController < EppController
success = true
@api_user = ApiUser.find_by(login_params)
if request.ip == ENV['webclient_ip'] && !Rails.env.test?
client_md5 = Certificate.parse_md_from_string(request.env['HTTP_SSL_CLIENT_CERT'])
server_md5 = Certificate.parse_md_from_string(File.read(ENV['cert_path']))
if client_md5 != server_md5
@msg = 'Authentication error; server closing connection (certificate is not valid)'
success = false
end
end
if request.ip != ENV['webclient_ip'] && @api_user
unless @api_user.api_pki_ok?(request.env['HTTP_SSL_CLIENT_CERT'], request.env['HTTP_SSL_CLIENT_S_DN_CN'])
@msg = 'Authentication error; server closing connection (certificate is not valid)'

9
app/models/certificate.rb
View file

@ -200,5 +200,14 @@ class Certificate < ActiveRecord::Base
_out, _err, _st = Open3.capture3("sudo /etc/init.d/apache2 reload")
STDOUT << "#{Time.zone.now.utc} - Apache reloaded\n"
end
def parse_md_from_string(crt)
return nil if crt.blank?
crt = crt.split(' ').join("\n")
crt.gsub!("-----BEGIN\nCERTIFICATE-----\n", "-----BEGIN CERTIFICATE-----\n")
crt.gsub!("\n-----END\nCERTIFICATE-----", "\n-----END CERTIFICATE-----")
cert = OpenSSL::X509::Certificate.new(crt)
OpenSSL::Digest::MD5.new(cert.to_der).to_s
end
end
end