class GP::Proxy
Constants
- CERT_START
Attributes
proxy_payload[R]
Public Class Methods
new(proxy_payload, username_prefix = 'plg')
click to toggle source
# File lib/grid-proxy/proxy.rb, line 7 def initialize(proxy_payload, username_prefix = 'plg') @proxy_payload = proxy_payload @username_prefix = username_prefix end
Public Instance Methods
proxycert()
click to toggle source
# File lib/grid-proxy/proxy.rb, line 12 def proxycert @proxycert ||= cert_for_element(1) end
proxykey()
click to toggle source
# File lib/grid-proxy/proxy.rb, line 16 def proxykey begin @proxykey ||= OpenSSL::PKey.read(proxy_element(1)) rescue nil end end
revoked?(crl_payload)
click to toggle source
# File lib/grid-proxy/proxy.rb, line 62 def revoked?(crl_payload) # crl should to be verified with ca cert # crl(crl_payload).verify() #check for usercert serial in list of all revoked certs revoked_cert = crl(crl_payload).revoked().detect do |revoked| revoked.serial == usercert.serial end return revoked_cert != nil ? true : false end
usercert()
click to toggle source
# File lib/grid-proxy/proxy.rb, line 24 def usercert @usercert ||= cert_for_element(2) end
username()
click to toggle source
# File lib/grid-proxy/proxy.rb, line 75 def username username_entry = usercert.subject.to_a.detect do |el| el[0] == 'CN' && el[1].start_with?(@username_prefix) end username_entry ? username_entry[1] : nil end
valid?(ca_cert_payload, crl_payload = nil)
click to toggle source
# File lib/grid-proxy/proxy.rb, line 53 def valid?(ca_cert_payload, crl_payload = nil) begin verify! ca_cert_payload, crl_payload true rescue GP::ProxyValidationError false end end
verify!(ca_cert_payload, crl_payload = nil)
click to toggle source
# File lib/grid-proxy/proxy.rb, line 28 def verify!(ca_cert_payload, crl_payload = nil) now = Time.now raise GP::ProxyValidationError.new('Proxy is not valid yet') if now < proxycert.not_before raise GP::ProxyValidationError.new('Proxy expired') if now > proxycert.not_after raise GP::ProxyValidationError.new('Usercert not signed with trusted certificate') unless ca_cert_payload && usercert.verify(cert(ca_cert_payload).public_key) raise GP::ProxyValidationError.new('Proxy not signed with user certificate') unless proxycert.verify(usercert.public_key) proxycert_issuer = proxycert.issuer.to_s proxycert_subject = proxycert.subject.to_s raise GP::ProxyValidationError.new('Proxy and user cert mismatch') unless proxycert_issuer == usercert.subject.to_s raise GP::ProxyValidationError.new("Proxy subject must begin with the issuer") unless proxycert_subject.to_s.index(proxycert_issuer) == 0 raise GP::ProxyValidationError.new("Couldn't find '/CN=' in DN, not a proxy") unless proxycert_subject.to_s[proxycert_issuer.size, proxycert_subject.to_s.size].to_s.include?('/CN=') raise GP::ProxyValidationError.new("Private proxy key missing") unless proxykey raise GP::ProxyValidationError.new("Private proxy key and cert mismatch") unless proxycert.check_private_key(proxykey) raise GP::ProxyValidationError.new("User cert was revoked") if crl_payload != nil and revoked? crl_payload if now < usercert.not_before || now > usercert.not_after raise GP::ProxyValidationError. new('Proxy signed by outdated certificate') end end
Private Instance Methods
cert(payload)
click to toggle source
# File lib/grid-proxy/proxy.rb, line 93 def cert(payload) OpenSSL::X509::Certificate.new payload end
cert_for_element(element_nr)
click to toggle source
# File lib/grid-proxy/proxy.rb, line 85 def cert_for_element(element_nr) cert(proxy_element(element_nr)) end
crl(payload)
click to toggle source
# File lib/grid-proxy/proxy.rb, line 97 def crl(payload) OpenSSL::X509::CRL.new payload end
proxy_element(element_nr)
click to toggle source
# File lib/grid-proxy/proxy.rb, line 89 def proxy_element(element_nr) "#{CERT_START}#{@proxy_payload.split(CERT_START)[element_nr]}" end