upstream/certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-06-06 07:12:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

check recipient string before hashcash to produce more useful error message

Browse source 
This is more work for the server but if we don't do it in this
order we always get a hashcash error instead of a recipient error
if the client is confused about what server it meant to query.
Giving the wrong error in this sense is OK from a protocol point
of view but quite frustrating for a human being on the client end
trying to figure out why the server is rejecting its apparently
perfectly valid hashcash...
This commit is contained in:
Seth Schoen 2012-07-14 17:35:22 -07:00
parent 1756a29a6a
commit f2d755d3d5
1 changed files with 11 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
server-ca/chocolate.py
View file

@ -212,6 +212,17 @@ class session(object):
# It is mandatory to make a signing request at the outset of a session.
self.die(r, r.BadRequest, uri="https://ca.example.com/failures/missingrequest")
return
timestamp = m.request.timestamp
recipient = m.request.recipient
csr = m.request.csr
sig = m.request.sig
# Check whether we are the intended recipient of the request. Doing this
# before the hashcash check is more work for the server but gives a more
# helpful error message (because the hashcash will be wrong automatically
# if it's addressed to a different server!).
if recipient != chocolate_server_name:
self.die(r, r.BadRequest, uri="https://ca.example.com/failures/recipient")
return
# Check hashcash before doing any crypto or database access.
if not m.request.clientpuzzle or not self.check_hashcash(m.request.clientpuzzle):
self.die(r, r.NeedClientPuzzle, uri="https://ca.example.com/failures/hashcash")
@ -223,10 +234,6 @@ class session(object):
self.die(r, r.BadRequest, uri="https://ca.example.com/failures/priorrequest")
return
# Process the request.
timestamp = m.request.timestamp
recipient = m.request.recipient
csr = m.request.csr
sig = m.request.sig
if not all([safe("recipient", recipient), safe("csr", csr)]):
self.die(r, r.BadRequest, uri="https://ca.example.com/failures/illegalcharacter")
return
@ -236,9 +243,6 @@ class session(object):
if time.time() - timestamp > 100:
self.die(r, r.BadRequest, uri="https://ca.example.com/failures/past")
return
if recipient != chocolate_server_name:
self.die(r, r.BadRequest, uri="https://ca.example.com/failures/recipient")
return
if not CSR.parse(csr):
self.die(r, r.BadCSR)
return