tttls1.3 0.2.10 → 0.2.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a88e723a99666a675766294bcd4693baad9d49f9d8d2c95e2c9361d74ea74e0a
-  data.tar.gz: e7c18f7242cf74229ae99232366d18854c898ce18e9f5805af8ca5694666e7bc
+  metadata.gz: 8f5aa81468afa7bdfe5706ab689499342070b9ccba1c3407e4aef7e7f5f2a6fc
+  data.tar.gz: 62b65e459cb2f1a0f14e1be474ab711aeb83d313e14cfdafc3b75dba44ddaf95
 SHA512:
-  metadata.gz: a36f3a4f8dc7884a3927572285773390e0076ff6f154366aeb85dbda10ed1edbdb0964ab2201b236b77f1b7c862cd61796a5eae9574883790da83b5e2c52c375
-  data.tar.gz: 88688015bd166a0c93bf2c6663eda3649719362228c496a7662bf162e236f1a0a04d7f5aa18d477cb18a3986c97fe9e7cab89fd7c04ba09caa1dd92c70441433
+  metadata.gz: f11b5d1dae32d9e9aca363fee567840d0bf2da02a95e4f7930965c03ac3d53b4751d65cfd4eb709ab47a04cb51d4c14a28783e8519ffe0e9a7e479890b017520
+  data.tar.gz: e24b2a06489681198c28e1b5def42bd512102591c232fa7ccb847d5742a52cb3c62dd7289bfc4012be45f743f176bf945863f03c785805e2eb53412acbad291f

data/README.md

@@ -111,6 +111,7 @@ tttls1.3 server is configurable using keyword arguments.
 | key | type | default value | description |
 |-----|------|---------------|-------------|
 | `:crt_file` | String | nil | Path to the certificate file. This is a required setting. |
+| `:chain_files` | Array of OpenSSL::X509::Certificate | nil | Paths to the itermediate certificate files. |
 | `:key_file` | String | nil | Path to the private key file. This is a required setting. |
 | `:cipher_suites` | Array of TTTLS13::CipherSuite constant | `TLS_AES_256_GCM_SHA384`, `TLS_CHACHA20_POLY1305_SHA256`, `TLS_AES_128_GCM_SHA256` | List of supported cipher suites. |
 | `:signature_algorithms` | Array of TTTLS13::SignatureScheme constant | `ECDSA_SECP256R1_SHA256`, `ECDSA_SECP384R1_SHA384`, `ECDSA_SECP521R1_SHA512`, `RSA_PSS_RSAE_SHA256`, `RSA_PSS_RSAE_SHA384`, `RSA_PSS_RSAE_SHA512`, `RSA_PKCS1_SHA256`, `RSA_PKCS1_SHA384`, `RSA_PKCS1_SHA512` | List of supported signature algorithms. |

data/lib/tttls1.3/server.rb

@@ -46,6 +46,7 @@ module TTTLS13
 
   DEFAULT_SERVER_SETTINGS = {
     crt_file: nil,
+    chain_files: nil,
     key_file: nil,
     cipher_suites: DEFAULT_SP_CIPHER_SUITES,
     signature_algorithms: DEFAULT_SP_SIGNATURE_ALGORITHMS,
@@ -75,6 +76,14 @@ module TTTLS13
       klass = @crt.public_key.class
       @key = klass.new(File.read(@settings[:key_file]))
       raise Error::ConfigError unless @crt.check_private_key(@key)
+
+      @chain = @settings[:chain_files]&.map do |f|
+        OpenSSL::X509::Certificate.new(File.read(f))
+      end
+      @chain ||= []
+      ([@crt] + @chain).each_cons(2) do |cert, sign|
+        raise Error::ConfigError unless cert.verify(sign.public_key)
+      end
     end
 
     # NOTE:
@@ -230,7 +239,7 @@ module TTTLS13
             unless ch.extensions[Message::ExtensionType::RECORD_SIZE_LIMIT].nil?
           ee = transcript[EE] = gen_encrypted_extensions(ch, @alpn, rsl)
           # TODO: [Send CertificateRequest]
-          ct = transcript[CT] = gen_certificate(@crt)
+          ct = transcript[CT] = gen_certificate(@crt, @chain)
           digest = CipherSuite.digest(@cipher_suite)
           cv = transcript[CV] = gen_certificate_verify(
             @key,
@@ -394,11 +403,13 @@ module TTTLS13
     end
 
     # @param crt [OpenSSL::X509::Certificate]
+    # @param chain [Array of OpenSSL::X509::Certificate]
     #
     # @return [TTTLS13::Message::Certificate, nil]
-    def gen_certificate(crt)
-      ce = Message::CertificateEntry.new(crt)
-      Message::Certificate.new(certificate_list: [ce])
+    def gen_certificate(crt, chain = [])
+      ces = [crt] + (chain || [])
+      ces.map! { |c| Message::CertificateEntry.new(c) }
+      Message::Certificate.new(certificate_list: ces)
     end
 
     # @param key [OpenSSL::PKey::PKey]

data/lib/tttls1.3/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module TTTLS13
-  VERSION = '0.2.10'
+  VERSION = '0.2.11'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tttls1.3
 version: !ruby/object:Gem::Version
-  version: 0.2.10
+  version: 0.2.11
 platform: ruby
 authors:
 - thekuwayama
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-11-09 00:00:00.000000000 Z
+date: 2019-12-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler