x509-ocsp 0.4.0.0 → 0.4.0.1
raw patch · 3 files changed
+36/−41 lines, 3 filesPVP ok
version bump matches the API change (PVP)
API changes (from Hackage documentation)
Files
- Changelog.md +10/−3
- Data/X509/OCSP.hs +25/−37
- x509-ocsp.cabal +1/−1
Changelog.md view
@@ -1,9 +1,16 @@+### 0.4.0.1++- Ensure that the list of certificates in the OCSP response comprises the+ correct ASN.1 sequence.+- Refactor function *getOCSPResponseVerificationData'*.+ ### 0.4.0.0 - Field *ocspRespCerts* of *OCSPResponseVerificationData* now contains a list- of *signed certificates* augmented by *DER*-encoded *tbsCertificate* as defined- in *rfc5280*. This enables check of the OCSP Signature Authority Delegation.- See a basic implementation of the check in the *client-ocsp* example.+ of *signed certificates* augmented by *DER*-encoded *tbsCertificate* as+ defined in *rfc5280*. This enables check of the OCSP Signature Authority+ Delegation. See a basic implementation of the check in the *client-ocsp*+ example. ### 0.3.1.0
Data/X509/OCSP.hs view
@@ -292,7 +292,7 @@ , ocspRespSignature :: ByteString -- ^ Signature , ocspRespCerts :: [(Signed Certificate, ByteString)]- -- ^ List of signed certificates+ -- ^ List of signed certificates with DER-encoded certificate data } deriving (Show, Eq) -- | Get verification data from OCSP response.@@ -313,43 +313,31 @@ getOCSPResponseVerificationData' :: [ASN1] -- ^ OCSP response payload -> Maybe OCSPResponseVerificationData-getOCSPResponseVerificationData' (Start Sequence : Start Sequence : c1) = do- let (wrapInSequence -> resp'', next) = getConstructedEnd 0 c1- der = encodeASN1' DER resp''- case next of- Start Sequence : c2 -> do- let (wrapInSequence -> alg, next') = getConstructedEnd 0 c2- (alg', []) <- fromASN1' alg- case next' of- BitString (BitArray _ sig) : c3- | c3 == [End Sequence] ->- Just $ OCSPResponseVerificationData- der alg' sig []- | Start (Container Context 0)- : Start Sequence- : certs <- getCurrentContainerContents c3 -> do- certs' <- reverse <$> collectCerts certs []- Just $ OCSPResponseVerificationData- der alg' sig certs'- _ -> Nothing- _ -> Nothing+getOCSPResponseVerificationData' (Start Sequence : Start Sequence : c1)+ | (resp, Start Sequence : c2) <- getConstructedEnd 0 c1+ , (alg, BitString (BitArray _ sig) : c3) <- getConstructedEnd 0 c2 = do+ (alg', []) <- fromASN1' $ wrapInSequence alg+ let der = encodeASN1' DER $ wrapInSequence resp+ case c3 of+ [End Sequence] -> Just []+ _ | Start (Container Context 0)+ : Start Sequence+ : certs@(Start Sequence : _) <-+ getCurrentContainerContents c3 ->+ reverse <$> collectCerts certs []+ | otherwise -> Nothing+ >>= Just . OCSPResponseVerificationData der alg' sig where collectCerts (Start Sequence : c4) certs- | (Start Sequence : cert, c5) <- getConstructedEnd 0 c4 = do- let (cert', next) = getConstructedEnd 0 cert- case next of- Start Sequence : cc1 -> do- let (wrapInSequence -> alg, next') =- getConstructedEnd 0 cc1- (alg', []) <- fromASN1' alg- case next' of- [BitString (BitArray _ sig)] -> do- (cert'', []) <- fromASN1' cert'- collectCerts c5 $- ( Signed cert'' alg' sig- , encodeASN1' DER $ wrapInSequence cert'- ) : certs- _ -> Nothing- _ -> Nothing+ | (Start Sequence : cert, c5) <- getConstructedEnd 0 c4+ , (cert', Start Sequence : c6) <- getConstructedEnd 0 cert+ , (alg, [BitString (BitArray _ sig)]) <-+ getConstructedEnd 0 c6 = do+ (alg', []) <- fromASN1' $ wrapInSequence alg+ (cert'', []) <- fromASN1' cert'+ collectCerts c5 $+ ( Signed cert'' alg' sig+ , encodeASN1' DER $ wrapInSequence cert'+ ) : certs collectCerts [End Sequence, End (Container Context 0)] certs = Just certs collectCerts _ _ =
x509-ocsp.cabal view
@@ -1,7 +1,7 @@ cabal-version: 2.4 name: x509-ocsp-version: 0.4.0.0+version: 0.4.0.1 synopsis: Basic X509 OCSP implementation description: Build X509 OCSP requests and parse responses homepage: https://github.com/lyokha/x509-ocsp