certificate-transparency 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9d4d276d39e865c024a5ceada2a373fa28a6e000
-  data.tar.gz: d4fdbbbbb5370044a45e0b142a3b53bbe6f0bf71
+  metadata.gz: a79a012d5182f45a32441f36a7d01853babefce5
+  data.tar.gz: 52007f0dd5ee5ae0f695709ab333e146525aaaf3
 SHA512:
-  metadata.gz: bdc16768f058da4261e5847c0d7eaffd0b2fd239184bd213cb4f5d22f095f3a98b7adc4039beb373b80aecf064857820c323141929872f133aae73c6464f1841
-  data.tar.gz: c436c791481f67c184359634609d89c9a9989d529fda9c21487dd4033a889b022549d58bd3c550a4e5d4e53e57f793b1731844d2ac311b53207e7bbca4fc7da3
+  metadata.gz: 6deb537a51d4c064214b2017dbfacfd93ba430836bcaf1adb78d0f1bb28dd5c40233adc8d7591534189a394b8f7194129323640a3068bbbc2cf15386a446c184
+  data.tar.gz: 2e0805987f1c1a2f69fc8cbda8cce94d0685bcf8339210fe4e38f6cb5d6d3a4c4aee4ef23c37a763f98168cbb2bdf51d738dcf556d94a9343ac354cb72f780c2

data/lib/certificate-transparency.rb

@@ -31,6 +31,7 @@ end
 require_relative 'certificate-transparency/extensions/string'
 require_relative 'certificate-transparency/extensions/time'
 
+require_relative 'certificate-transparency/certificate_chain'
 require_relative 'certificate-transparency/log_entry'
 require_relative 'certificate-transparency/merkle_tree_leaf'
 require_relative 'certificate-transparency/pre_cert'

data/lib/certificate-transparency/certificate_chain.rb

@@ -0,0 +1,53 @@
+# A chain of certificates, from an end-entity certificate to a root certificate
+# presumably trusted by the log.
+#
+# This is a fairly thin wrapper around an `Array`, with methods for serialization
+# and deserialization.
+#
+class CertificateTransparency::CertificateChain
+	extend Forwardable
+
+	def_delegators :@chain, :length, :<<, :each
+
+	include Enumerable
+
+	# Create a {CT::CertificateChain} instance from a binary blob.
+	#
+	# You have to be slightly careful with this; for different types of `MerkleTreeLeaf`,
+	# the serialized data that comes out of `/get-entries` is different.
+	#
+	# @param blob [String]
+	#
+	# @return [CT::CertificateChain}
+	#
+	def self.from_blob(blob)
+		new.tap do |cc|
+			chain, rest = TLS::Opaque.from_blob(blob, 2**24-1)
+
+			unless rest.empty?
+				raise ArgumentError,
+				      "Malformed CertificateChain blob: " +
+				      "unexpected additional data: #{rest.inspect}"
+			end
+
+			chain = chain.value
+			until chain.empty?
+				cert_blob, chain = TLS::Opaque.from_blob(chain, 2**24-1)
+
+				cc << OpenSSL::X509::Certificate.new(cert_blob.value)
+			end
+		end
+	end
+
+	def initialize
+		@chain = []
+	end
+
+	# Generate an encoded blob of this certificate chain.
+	#
+	# @return [String]
+	#
+	def to_blob
+		TLS::Opaque.new(@chain.map { |c| TLS::Opaque.new(c.to_der, 2**24-1).to_blob }.join, 2**24-1).to_blob
+	end
+end

data/lib/certificate-transparency/log_entry.rb

@@ -1,13 +1,32 @@
 require 'json'
 require 'tls'
 
-# An element of a CT get-entries array (RFC6962 s4.6).  Note that this is
-# **not** the `LogEntry` type defined in RFC6962 s3.1, because that type is
-# never actually used anywhere, so I stole its name.
+# An element of a CT get-entries array (RFC6962 s4.6).
+#
+# @note This is **not** the `LogEntry` type defined in RFC6962 s3.1, because
+#   that type is never actually used anywhere, so I stole its name.
+#
+# @note Unlike most other classes, the instance methods on this type are
+#   *not* a 1:1 mapping to the elements of the source data structure.  The
+#   `extra_data` key in the JSON is a grotty amalgam of several other
+#   things.  Those pieces are available via {#certificate_chain} and
+#   {#precertificate}.
 #
 class CertificateTransparency::LogEntry
+	# @return [CT::MerkleTreeLeaf]
+	#
 	attr_accessor :leaf_input
-	attr_accessor :extra_data
+
+	# @return [CT::CertificateChain]
+	#
+	attr_accessor :certificate_chain
+
+	# The precertificate if this log entry is for a precert, or `nil`
+	# otherwise.
+	#
+	# @return [OpenSSL::X509::Certificate]
+	#
+	attr_accessor :precertificate
 
 	# Create a new LogEntry instance from a single member of the
 	# `"entries"` array returned by `/ct/v1/get-entries`.
@@ -19,25 +38,36 @@ class CertificateTransparency::LogEntry
 			le_blob = doc["leaf_input"].unpack("m").first
 			sth.leaf_input = CT::MerkleTreeLeaf.from_blob(le_blob)
 
-			sth.extra_data = []
 			ed_blob = doc["extra_data"].unpack("m").first
+
 			if sth.leaf_input.timestamped_entry.entry_type == :precert_entry
-				pre_cert_blob, ed_blob = TLS::Opaque.from_blob(ed_blob, 2**24-1)
+				precert_blob, ed_blob = TLS::Opaque.from_blob(ed_blob, 2**24-1)
 
-				sth.extra_data << OpenSSL::X509::Certificate.new(pre_cert_blob.value)
+				sth.precertificate = OpenSSL::X509::Certificate.new(precert_blob.value)
 			end
 
-			ed_blob, rest = TLS::Opaque.from_blob(ed_blob, 2**24-1)
-			unless rest.empty?
-				raise ArgumentError,
-				      "Unexpected garbage after certificate_chain: #{rest.inspect}"
-			end
+			sth.certificate_chain = CT::CertificateChain.from_blob(ed_blob)
+		end
+	end
 
-			ed_blob = ed_blob.value
-			until ed_blob.empty?
-				cert_blob, ed_blob = TLS::Opaque.from_blob(ed_blob, 2**24-1)
-				sth.extra_data << OpenSSL::X509::Certificate.new(cert_blob.value)
-			end
+	# Return a JSON string that represents this log entry, as it would
+	# exist in a response from `/get-entries`.
+	#
+	# @return [String]
+	#
+	def to_json
+		json = { :leaf_input => [leaf_input.to_blob].pack("m0") }
+
+		ed_blob = ""
+
+		if leaf_input.timestamped_entry.entry_type == :precert_entry
+			ed_blob += TLS::Opaque.new(precertificate.to_der, 2**24-1).to_blob
 		end
+
+		ed_blob += certificate_chain.to_blob
+
+		json[:extra_data] = [ed_blob].pack("m0")
+
+		json.to_json
 	end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: certificate-transparency
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Matt Palmer
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-06-11 00:00:00.000000000 Z
+date: 2015-06-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -157,6 +157,7 @@ files:
 - lib/.gitkeep
 - lib/certificate-transparency-client.rb
 - lib/certificate-transparency.rb
+- lib/certificate-transparency/certificate_chain.rb
 - lib/certificate-transparency/extensions/string.rb
 - lib/certificate-transparency/extensions/time.rb
 - lib/certificate-transparency/log_entry.rb