| 37 | } |
| 38 | |
| 39 | func NewCertAuth(param_url *url.URL, logger *clog.CondLogger) (*CertAuth, error) { |
| 40 | values, err := url.ParseQuery(param_url.RawQuery) |
| 41 | if err != nil { |
| 42 | return nil, err |
| 43 | } |
| 44 | |
| 45 | auth := &CertAuth{ |
| 46 | blacklistFilename: values.Get("blacklist"), |
| 47 | logger: logger, |
| 48 | stopChan: make(chan struct{}), |
| 49 | } |
| 50 | auth.blacklist.Store(new(serialNumberSetFile)) |
| 51 | |
| 52 | reloadInterval := 15 * time.Second |
| 53 | if reloadIntervalOption := values.Get("reload"); reloadIntervalOption != "" { |
| 54 | parsedInterval, err := time.ParseDuration(reloadIntervalOption) |
| 55 | if err != nil { |
| 56 | logger.Warning("unable to parse reload interval: %v. using default value.", err) |
| 57 | } |
| 58 | reloadInterval = parsedInterval |
| 59 | } |
| 60 | if auth.blacklistFilename != "" { |
| 61 | if err := auth.reload(); err != nil { |
| 62 | return nil, fmt.Errorf("unable to load initial certificate blacklist: %w", err) |
| 63 | } |
| 64 | if reloadInterval > 0 { |
| 65 | go auth.reloadLoop(reloadInterval) |
| 66 | } |
| 67 | } |
| 68 | if nextAuth := values.Get("next"); nextAuth != "" { |
| 69 | nap, err := NewAuth(nextAuth, logger) |
| 70 | if err != nil { |
| 71 | defer auth.Close() |
| 72 | return nil, fmt.Errorf("chained auth provider construction failed: %w", err) |
| 73 | } |
| 74 | auth.next = nap |
| 75 | } |
| 76 | if nextAuth := values.Get("else"); nextAuth != "" { |
| 77 | nap, err := NewAuth(nextAuth, logger) |
| 78 | if err != nil { |
| 79 | defer auth.Close() |
| 80 | return nil, fmt.Errorf("chained auth provider construction failed: %w", err) |
| 81 | } |
| 82 | auth.reject = nap |
| 83 | } |
| 84 | |
| 85 | return auth, nil |
| 86 | } |
| 87 | |
| 88 | func (auth *CertAuth) handleReject(ctx context.Context, wr http.ResponseWriter, req *http.Request) (string, bool) { |
| 89 | if auth.reject != nil { |