add: handle the 'noOCSP' feature in the include section

[cassiopeia.git] / src / crypto / sslUtil.h

diff --git a/src/crypto/sslUtil.h b/src/crypto/sslUtil.h
index 4a451b3a1903aae6d251c1579f5e71efbe89c79a..f0eaaf6e6e3d0ccf7584bf227a391b2f75f06b28 100644 (file)
--- a/src/crypto/sslUtil.h
+++ b/src/crypto/sslUtil.h
@@ -2,9 +2,11 @@
 
 #include <memory>
 #include <string>
+#include <string.h>
 #include <vector>
 #include <cinttypes>
 #include <ctime>
+#include <unordered_set>
 
 #include <openssl/ssl.h>
 
@@ -33,14 +35,23 @@ struct Profile {
 
     std::vector<std::shared_ptr<CAConfig>> ca;
     std::time_t maxValidity;
+    std::unordered_set<std::string> include;
     std::shared_ptr<CAConfig> getCA() {
+        std::shared_ptr<CAConfig> min = nullptr;
+
         for( auto it = ca.rbegin(); it != ca.rend(); it++ ) {
             if( X509_cmp_current_time( ( *it )->notBefore.get() ) < 0 ) {
-                return *it;
+                if( min != nullptr ) {
+                    if( strcmp( min->name.c_str(), ( *it )->name.c_str() ) < 0 ) {
+                        min = *it;
+                    }
+                } else {
+                    min = *it;
+                }
             }
         }
 
-        return ca[0];
+        return min ? min : ca[0];
     }
 };