Method signOrRejectRequest

sign_certd.go:535–613

(rw http.ResponseWriter, req *http.Request)

}

func (h *certRequestHandler) signOrRejectRequest(rw http.ResponseWriter, req *http.Request) {
	requestID := mux.Vars(req)["requestID"]
	h.stateMutex.RLock()
	originalRequest, ok := h.state[requestID]
	h.stateMutex.RUnlock()
	if !ok {
		http.Error(rw, "Unknown request id", http.StatusNotFound)
		return
	}
	if originalRequest.certSigned {
		http.Error(rw, "Request already signed.", http.StatusConflict)
		return
	}
	if originalRequest.certRejected {
		http.Error(rw, "Request already rejected.", http.StatusConflict)
		return
	}

	err := req.ParseForm()
	if err != nil {
		http.Error(rw, fmt.Sprintf("%v", err), http.StatusBadRequest)
		return
	}

	envConfig, ok := h.Config[originalRequest.environment]
	if !ok {
		http.Error(rw, "Original request found to have an invalid env. Weird.", http.StatusBadRequest)
		return
	}

	signedCert, err := h.extractCertFromRequest(req)
	if err != nil {
		log.Printf("Unable to extract certificate signing request from %s, ignoring", req.RemoteAddr)
		http.Error(rw, fmt.Sprintf("%v", err), http.StatusBadRequest)
		return
	}
	err = h.validateCert(signedCert, envConfig.AuthorizedSigners)
	if err != nil {
		log.Printf("Invalid certificate signing request received from %s, ignoring", req.RemoteAddr)
		http.Error(rw, fmt.Sprintf("%v", err), http.StatusBadRequest)
		return
	}

	signerFp := ssh_ca_util.MakeFingerprint(signedCert.SignatureKey.Marshal())

	// Verifying that the cert being posted to us here matches the one in the
	// request. That is, that an attacker isn't using an old signature to sign a
	// new/different request id
	h.stateMutex.RLock()
	requestedCert := h.state[requestID].request
	h.stateMutex.RUnlock()
	if !compareCerts(requestedCert, signedCert) {
		log.Printf("Signature was valid, but cert didn't match from %s.", req.RemoteAddr)
		log.Printf("Orig req: %#v\n", requestedCert)
		log.Printf("Sign req: %#v\n", signedCert)
		http.Error(rw, "Signature was valid, but cert didn't match.", http.StatusBadRequest)
		return
	}