Class: OpenSSL::OCSP::SingleResponse (Ruby 2.7.5)
Description: Class : OpenSSL::OCSP::SingleResponse - Ruby 2.7.5

### Home Classes Methods

### In Files

- openssl/ossl_ocsp.c

### Parent

Object

### Methods

- ::new
- #cert_status
- #certid
- #check_validity
- #extensions
- #initialize_copy
- #next_update
- #revocation_reason
- #revocation_time
- #this_update
- #to_der

### Class/Module Index

Quicksearch

- IO
- IO::WaitReadable
- IO::WaitWritable
- Integer
- OpenSSL
- OpenSSL::ASN1
- OpenSSL::ASN1::ASN1Data
- OpenSSL::ASN1::ASN1Error
- OpenSSL::ASN1::Constructive
- OpenSSL::ASN1::ObjectId
- OpenSSL::ASN1::Primitive
- OpenSSL::BN
- OpenSSL::BNError
- OpenSSL::Buffering
- OpenSSL::Cipher
- OpenSSL::Cipher::Cipher
- OpenSSL::Cipher::CipherError
- OpenSSL::Config
- OpenSSL::ConfigError
- OpenSSL::Digest
- OpenSSL::Digest::DigestError
- OpenSSL::Engine
- OpenSSL::Engine::EngineError
- OpenSSL::ExtConfig
- OpenSSL::HMAC
- OpenSSL::HMACError
- OpenSSL::KDF
- OpenSSL::KDF::KDFError
- OpenSSL::Netscape
- OpenSSL::Netscape::SPKI
- OpenSSL::Netscape::SPKIError
- OpenSSL::OCSP
- OpenSSL::OCSP::BasicResponse
- OpenSSL::OCSP::CertificateId
- OpenSSL::OCSP::OCSPError
- OpenSSL::OCSP::Request
- OpenSSL::OCSP::Response
- OpenSSL::OCSP::SingleResponse
- OpenSSL::OpenSSLError
- OpenSSL::PKCS12
- OpenSSL::PKCS12::PKCS12Error
- OpenSSL::PKCS5
- OpenSSL::PKCS7
- OpenSSL::PKCS7::PKCS7Error
- OpenSSL::PKCS7::RecipientInfo
- OpenSSL::PKCS7::SignerInfo
- OpenSSL::PKey
- OpenSSL::PKey::DH
- OpenSSL::PKey::DHError
- OpenSSL::PKey::DSA
- OpenSSL::PKey::DSAError
- OpenSSL::PKey::EC
- OpenSSL::PKey::EC::Group
- OpenSSL::PKey::EC::Group::Error
- OpenSSL::PKey::EC::Point
- OpenSSL::PKey::EC::Point::Error
- OpenSSL::PKey::ECError
- OpenSSL::PKey::PKey
- OpenSSL::PKey::PKeyError
- OpenSSL::PKey::RSA
- OpenSSL::PKey::RSAError
- OpenSSL::Random
- OpenSSL::Random::RandomError
- OpenSSL::SSL
- OpenSSL::SSL::SSLContext
- OpenSSL::SSL::SSLError
- OpenSSL::SSL::SSLErrorWaitReadable
- OpenSSL::SSL::SSLErrorWaitWritable
- OpenSSL::SSL::SSLServer
- OpenSSL::SSL::SSLSocket
- OpenSSL::SSL::Session
- OpenSSL::SSL::Session::SessionError
- OpenSSL::SSL::SocketForwarder
- OpenSSL::X509
- OpenSSL::X509::Attribute
- OpenSSL::X509::AttributeError
- OpenSSL::X509::CRL
- OpenSSL::X509::CRLError
- OpenSSL::X509::Certificate
- OpenSSL::X509::CertificateError
- OpenSSL::X509::Extension
- OpenSSL::X509::ExtensionError
- OpenSSL::X509::ExtensionFactory
- OpenSSL::X509::Name
- OpenSSL::X509::Name::RFC2253DN
- OpenSSL::X509::NameError
- OpenSSL::X509::Request
- OpenSSL::X509::RequestError
- OpenSSL::X509::Revoked
- OpenSSL::X509::RevokedError
- OpenSSL::X509::Store
- OpenSSL::X509::StoreContext
- OpenSSL::X509::StoreError

No matching classes.

# OpenSSL::OCSP::SingleResponse

An `OpenSSL::OCSP::SingleResponse` represents an `OCSP` `SingleResponse` structure, which contains the basic information of the status of the certificate.

### Public Class Methods

OpenSSL::OCSP::SingleResponse.new(der_string) → SingleResponse click to toggle source

Creates a new `SingleResponse` from der_string.

                   static VALUE
    ossl_ocspsres_initialize(VALUE self, VALUE arg)
    {
        OCSP_SINGLERESP *res, *res_new;
        const unsigned char *p;

        arg = ossl_to_der_if_possible(arg);
        StringValue(arg);
        GetOCSPSingleRes(self, res);

        p = (unsigned char*)RSTRING_PTR(arg);
        res_new = d2i_OCSP_SINGLERESP(NULL, &p, RSTRING_LEN(arg));
        if (!res_new)
            ossl_raise(eOCSPError, "d2i_OCSP_SINGLERESP");
        SetOCSPSingleRes(self, res_new);
        OCSP_SINGLERESP_free(res);

        return self;
    }

### Public Instance Methods

cert_status → Integer click to toggle source

Returns the status of the certificate identified by the certid. The return value may be one of these constant:

- V_CERTSTATUS_GOOD

- V_CERTSTATUS_REVOKED

- V_CERTSTATUS_UNKNOWN

When the status is V_CERTSTATUS_REVOKED, the time at which the certificate was revoked can be retrieved by `revocation_time`.

                   static VALUE
    ossl_ocspsres_get_cert_status(VALUE self)
    {
        OCSP_SINGLERESP *sres;
        int status;

        GetOCSPSingleRes(self, sres);
        status = OCSP_single_get0_status(sres, NULL, NULL, NULL, NULL);
        if (status < 0)
            ossl_raise(eOCSPError, "OCSP_single_get0_status");

        return INT2NUM(status);
    }

certid → CertificateId click to toggle source

Returns the `CertificateId` for which this `SingleResponse` is.

                   static VALUE
    ossl_ocspsres_get_certid(VALUE self)
    {
        OCSP_SINGLERESP *sres;
        OCSP_CERTID *id;

        GetOCSPSingleRes(self, sres);
        id = OCSP_CERTID_dup((OCSP_CERTID *)OCSP_SINGLERESP_get0_id(sres)); /* FIXME */

        return ossl_ocspcertid_new(id);
    }

check_validity(nsec = 0, maxsec = -1) → true | false click to toggle source

Checks the validity of thisUpdate and nextUpdate fields of this `SingleResponse`. This checks the current time is within the range thisUpdate to nextUpdate.

It is possible that the `OCSP` request takes a few seconds or the time is not accurate. To avoid rejecting a valid response, this method allows the times to be within nsec seconds of the current time.

Some responders don't set the nextUpdate field. This may cause a very old response to be considered valid. The maxsec parameter can be used to limit the age of responses.

                   static VALUE
    ossl_ocspsres_check_validity(int argc, VALUE *argv, VALUE self)
    {
        OCSP_SINGLERESP *sres;
        ASN1_GENERALIZEDTIME *this_update, *next_update;
        VALUE nsec_v, maxsec_v;
        int nsec, maxsec, status, ret;

        rb_scan_args(argc, argv, "02", &nsec_v, &maxsec_v);
        nsec = NIL_P(nsec_v) ? 0 : NUM2INT(nsec_v);
        maxsec = NIL_P(maxsec_v) ? -1 : NUM2INT(maxsec_v);

        GetOCSPSingleRes(self, sres);
        status = OCSP_single_get0_status(sres, NULL, NULL, &this_update, &next_update);
        if (status < 0)
            ossl_raise(eOCSPError, "OCSP_single_get0_status");

        ret = OCSP_check_validity(this_update, next_update, nsec, maxsec);

        if (ret)
            return Qtrue;
        else {
            ossl_clear_error();
            return Qfalse;
        }
    }

extensions → Array of X509::Extension click to toggle source

                   static VALUE
    ossl_ocspsres_get_extensions(VALUE self)
    {
        OCSP_SINGLERESP *sres;
        X509_EXTENSION *ext;
        int count, i;
        VALUE ary;

        GetOCSPSingleRes(self, sres);

        count = OCSP_SINGLERESP_get_ext_count(sres);
        ary = rb_ary_new2(count);
        for (i = 0; i < count; i++) {
            ext = OCSP_SINGLERESP_get_ext(sres, i);
            rb_ary_push(ary, ossl_x509ext_new(ext)); /* will dup */
        }

        return ary;
    }

initialize_copy(p1) click to toggle source

                   static VALUE
    ossl_ocspsres_initialize_copy(VALUE self, VALUE other)
    {
        OCSP_SINGLERESP *sres, *sres_old, *sres_new;

        rb_check_frozen(self);
        GetOCSPSingleRes(self, sres_old);
        GetOCSPSingleRes(other, sres);

        sres_new = ASN1_item_dup(ASN1_ITEM_rptr(OCSP_SINGLERESP), sres);
        if (!sres_new)
            ossl_raise(eOCSPError, "ASN1_item_dup");

        SetOCSPSingleRes(self, sres_new);
        OCSP_SINGLERESP_free(sres_old);

        return self;
    }

next_update → Time | nil click to toggle source

                   static VALUE
    ossl_ocspsres_get_next_update(VALUE self)
    {
        OCSP_SINGLERESP *sres;
        int status;
        ASN1_GENERALIZEDTIME *time;

        GetOCSPSingleRes(self, sres);
        status = OCSP_single_get0_status(sres, NULL, NULL, NULL, &time);
        if (status < 0)
            ossl_raise(eOCSPError, "OCSP_single_get0_status");
        if (!time)
            return Qnil;

        return asn1time_to_time(time);
    }

revocation_reason → Integer | nil click to toggle source

                   static VALUE
    ossl_ocspsres_get_revocation_reason(VALUE self)
    {
        OCSP_SINGLERESP *sres;
        int status, reason;

        GetOCSPSingleRes(self, sres);
        status = OCSP_single_get0_status(sres, &reason, NULL, NULL, NULL);
        if (status < 0)
            ossl_raise(eOCSPError, "OCSP_single_get0_status");
        if (status != V_OCSP_CERTSTATUS_REVOKED)
            ossl_raise(eOCSPError, "certificate is not revoked");

        return INT2NUM(reason);
    }

revocation_time → Time | nil click to toggle source

                   static VALUE
    ossl_ocspsres_get_revocation_time(VALUE self)
    {
        OCSP_SINGLERESP *sres;
        int status;
        ASN1_GENERALIZEDTIME *time;

        GetOCSPSingleRes(self, sres);
        status = OCSP_single_get0_status(sres, NULL, &time, NULL, NULL);
        if (status < 0)
            ossl_raise(eOCSPError, "OCSP_single_get0_status");
        if (status != V_OCSP_CERTSTATUS_REVOKED)
            ossl_raise(eOCSPError, "certificate is not revoked");
        if (!time)
            return Qnil;

        return asn1time_to_time(time);
    }

this_update → Time click to toggle source

                   static VALUE
    ossl_ocspsres_get_this_update(VALUE self)
    {
        OCSP_SINGLERESP *sres;
        int status;
        ASN1_GENERALIZEDTIME *time;

        GetOCSPSingleRes(self, sres);
        status = OCSP_single_get0_status(sres, NULL, NULL, &time, NULL);
        if (status < 0)
            ossl_raise(eOCSPError, "OCSP_single_get0_status");
        if (!time)
            return Qnil;

        return asn1time_to_time(time);
    }

to_der → String click to toggle source

Encodes this `SingleResponse` into a DER-encoded string.

                   static VALUE
    ossl_ocspsres_to_der(VALUE self)
    {
        OCSP_SINGLERESP *sres;
        VALUE str;
        long len;
        unsigned char *p;

        GetOCSPSingleRes(self, sres);
        if ((len = i2d_OCSP_SINGLERESP(sres, NULL)) <= 0)
            ossl_raise(eOCSPError, NULL);
        str = rb_str_new(0, len);
        p = (unsigned char *)RSTRING_PTR(str);
        if (i2d_OCSP_SINGLERESP(sres, &p) <= 0)
            ossl_raise(eOCSPError, NULL);
        ossl_str_adjust(str, p);

        return str;
    }