search

r509 / r509-ocsp-responder

An OCSP responder written in Ruby. Uses r509 and Sinatra.
http://langui.sh
Other
31 stars 17 forks source link

Fixing #<TypeError: no implicit conversion of String into Integer> #16

Closed podz closed 8 years ago

podz commented 8 years ago

I had a revoked cert with revocation reason 0, while using r509-validity-crl as the information source.

Checking the status of good certs resulted in a a response, whereas checking the status of a revoked certed resulted in 500 internal server error:

E, [2016-02-26T20:54:17.154753 #26930] ERROR -- : /usr/local/share/gems/gems/r509-ocsp-responder-0.3.3/lib/r509/ocsp/signer.rb:198:in `add_status'

Explicitly casting status[:revocation_reason] to an integer solved the problem and the revoked response was returned to the client.

reaperhulk commented 8 years ago

The string that's being cast to int here comes from here (by way of this). It looks like ruby is returning a human readable string for value in this case (e.g. "Key Compromise" or "Unspecified") rather than an integer mapping. That's a lousy return value, but the ruby API doesn't provide a way to easily get the integer.

There are a few ways we could fix this, but the easiest without breaking the existing API (which, while stupid, is probably something people depend on) would be to add an :int_reason key to the revocation hash. Then r509-validity-crl can be updated to use that.

podz commented 8 years ago

Closing this as I have implemented changes in R509 and R509-validity-crl according to the above comments.