RubyGems - catflap - Versions diffs - 0.0.2 → 1.0.1 - Mend

catflap 0.0.2 → 1.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (34) hide show

data/.gitignore +18 -0
data/.rspec +2 -0
data/.rubocop.yml +21 -0
data/.rubocop_todo.yml +7 -0
data/CODE_OF_CONDUCT.md +49 -0
data/Gemfile +7 -0
data/Gemfile.lock +49 -0
data/LICENSE +20 -0
data/README.md +134 -0
data/Rakefile +6 -0
data/bin/catflap +71 -64
data/bin/console +14 -0
data/bin/setup +8 -0
data/catflap.gemspec +32 -0
data/etc/config.yaml +30 -0
data/etc/init.d/catflap +89 -0
data/etc/passfile.yaml +7 -0
data/lib/catflap.rb +108 -64
data/lib/catflap/command.rb +102 -0
data/lib/catflap/firewall.rb +56 -0
data/lib/catflap/http.rb +288 -0
data/lib/catflap/netfilter/writer.rb +127 -0
data/lib/catflap/plugins/firewall/iptables.rb +104 -0
data/lib/catflap/plugins/firewall/netfilter.rb +114 -0
data/lib/catflap/plugins/firewall/plugin.rb +67 -0
data/lib/catflap/version.rb +5 -0
data/lib/netfilter/writer.rb +125 -0
data/ui/css/catflap.css +44 -0
data/ui/images/catflap.png +0 -0
data/ui/index.rhtml +23 -0
data/ui/js/catflap.js +85 -0
data/ui/js/sha256.js +166 -0
metadata +109 -11
data/lib/catflap-http.rb +0 -111

data/ui/images/catflap.png ADDED

Binary file

data/ui/index.rhtml ADDED

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<script src="https://code.jquery.com/jquery-2.2.0.min.js"></script>
+<script src="/js/sha256.js"></script>
+<script src="/js/catflap.js"></script>
+<link rel="stylesheet" href="/css/catflap.css" />
+<title>Catflap | No dogs allowed!</title>
+</head>
+<body id="home">
+<div id="logo-wrapper"><img id="logo" class="centered" src="/images/catflap.png" /></div>
+<div id="passphrase-form-wrapper" class="centered">
+    <input id="passphrase" name="passphrase" type="text" class="default-value" value="Enter your pass phrase here." />
+    <div id="message-wrapper" class="centered">
+      <div id="locked-message" class="message centered">The site you are trying to access is locked. You must enter a valid pass phrase
+  to enter the site.</div>
+      <div id="failed-message" class="message centered hidden">Sorry, but we don't recognize that pass phrase. Please try again and if you
+        are still having trouble email your contact for further instructions.</div>
+    </div>
+</div>
+</body>
+</html>

data/ui/js/catflap.js ADDED

@@ -0,0 +1,85 @@
+(function($) { $(document).ready(function() {
+  // Hide default text
+  $('.default-value').each(function() {
+      var default_value = this.value;
+      $(this).focus(function() {
+          if(this.value === default_value) {
+              this.value = '';
+          }
+      });
+      $(this).blur(function() {
+          if(this.value === '') {
+              this.value = default_value;
+          }
+      });
+  });
+  // Bind token input field with 'enter' keypress.
+  $('input#passphrase').keypress(function(e) {
+    if(e.which == 13) {
+      var pass = $('input#passphrase').val();
+      // Get the first word to send as the key for the pass phrase.
+      // The first word is any part that comes before a special
+      // character (including spaces) other than the underscore.
+      var matches = pass.match(/^(\w+)\W+/);
+      // If there is nothing that looks like a key then don't make
+      // an authentication request.
+      if (matches === null) {
+        return;
+      }
+      // Handshake with the Catflap server by requesting a timestamp.
+      ts = 0;
+      $.ajax({
+        url: '/catflap/sync',
+        method: 'POST',
+        success: function(jsonData){
+          data = JSON.parse(jsonData);
+          ts = data.Timestamp;
+          // Construct our data packet to send to the server.
+          var data = {
+            "_key" : matches[1],
+            "ts" : ts
+          };
+          data.token = Sha256.hash(pass + ts);
+          $.ajax({
+            url: '/catflap/knock',
+            method: 'POST',
+            data: data,
+            success: function(jsonData){
+              data = JSON.parse(jsonData);
+              switch (data.StatusCode) {
+                case 200:
+                  if (data.RedirectUrl == "reload") {
+                    location.reload(true);
+                  } else {
+                    $(location).attr('href', data.RedirectUrl);
+                  }
+                  break;
+                default:
+                  $('#passphrase').addClass('failed');
+                  $('#locked-message').hide();
+                  $('#failed-message').show();
+                  break;
+              }
+            }
+          })
+          .fail(function(jsonData){
+            console.log('Unable to authenticate with the server: ' + jsonData);
+          });
+        }
+      })
+      .fail(function(jsonData){
+        console.log('Sync handshake failed: ' + jsonData);
+        return;
+      });
+    }
+  });
+});
+})(jQuery);

data/ui/js/sha256.js ADDED

@@ -0,0 +1,166 @@
+/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  */
+/*  SHA-256 implementation in JavaScript                (c) Chris Veness 2002-2014 / MIT Licence  */
+/*                                                                                                */
+/*  - see http://csrc.nist.gov/groups/ST/toolkit/secure_hashing.html                              */
+/*        http://csrc.nist.gov/groups/ST/toolkit/examples.html                                    */
+/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  */
+/* jshint node:true *//* global define, escape, unescape */
+'use strict';
+/**
+ * SHA-256 hash function reference implementation.
+ *
+ * @namespace
+ */
+var Sha256 = {};
+/**
+ * Generates SHA-256 hash of string.
+ *
+ * @param   {string} msg - String to be hashed
+ * @returns {string} Hash of msg as hex character string
+ */
+Sha256.hash = function(msg) {
+    // convert string to UTF-8, as SHA only deals with byte-streams
+    msg = msg.utf8Encode();
+    // constants [§4.2.2]
+    var K = [
+        0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+        0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+        0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+        0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+        0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+        0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+        0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+        0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2 ];
+    // initial hash value [§5.3.1]
+    var H = [
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19 ];
+    // PREPROCESSING
+    msg += String.fromCharCode(0x80);  // add trailing '1' bit (+ 0's padding) to string [§5.1.1]
+    // convert string msg into 512-bit/16-integer blocks arrays of ints [§5.2.1]
+    var l = msg.length/4 + 2; // length (in 32-bit integers) of msg + ‘1’ + appended length
+    var N = Math.ceil(l/16);  // number of 16-integer-blocks required to hold 'l' ints
+    var M = new Array(N);
+    for (var i=0; i<N; i++) {
+        M[i] = new Array(16);
+        for (var j=0; j<16; j++) {  // encode 4 chars per integer, big-endian encoding
+            M[i][j] = (msg.charCodeAt(i*64+j*4)<<24) | (msg.charCodeAt(i*64+j*4+1)<<16) |
+                      (msg.charCodeAt(i*64+j*4+2)<<8) | (msg.charCodeAt(i*64+j*4+3));
+        } // note running off the end of msg is ok 'cos bitwise ops on NaN return 0
+    }
+    // add length (in bits) into final pair of 32-bit integers (big-endian) [§5.1.1]
+    // note: most significant word would be (len-1)*8 >>> 32, but since JS converts
+    // bitwise-op args to 32 bits, we need to simulate this by arithmetic operators
+    M[N-1][14] = ((msg.length-1)*8) / Math.pow(2, 32); M[N-1][14] = Math.floor(M[N-1][14]);
+    M[N-1][15] = ((msg.length-1)*8) & 0xffffffff;
+    // HASH COMPUTATION [§6.1.2]
+    var W = new Array(64); var a, b, c, d, e, f, g, h;
+    for (var i=0; i<N; i++) {
+        // 1 - prepare message schedule 'W'
+        for (var t=0;  t<16; t++) W[t] = M[i][t];
+        for (var t=16; t<64; t++) W[t] = (Sha256.σ1(W[t-2]) + W[t-7] + Sha256.σ0(W[t-15]) + W[t-16]) & 0xffffffff;
+        // 2 - initialise working variables a, b, c, d, e, f, g, h with previous hash value
+        a = H[0]; b = H[1]; c = H[2]; d = H[3]; e = H[4]; f = H[5]; g = H[6]; h = H[7];
+        // 3 - main loop (note 'addition modulo 2^32')
+        for (var t=0; t<64; t++) {
+            var T1 = h + Sha256.Σ1(e) + Sha256.Ch(e, f, g) + K[t] + W[t];
+            var T2 =     Sha256.Σ0(a) + Sha256.Maj(a, b, c);
+            h = g;
+            g = f;
+            f = e;
+            e = (d + T1) & 0xffffffff;
+            d = c;
+            c = b;
+            b = a;
+            a = (T1 + T2) & 0xffffffff;
+        }
+         // 4 - compute the new intermediate hash value (note 'addition modulo 2^32')
+        H[0] = (H[0]+a) & 0xffffffff;
+        H[1] = (H[1]+b) & 0xffffffff;
+        H[2] = (H[2]+c) & 0xffffffff;
+        H[3] = (H[3]+d) & 0xffffffff;
+        H[4] = (H[4]+e) & 0xffffffff;
+        H[5] = (H[5]+f) & 0xffffffff;
+        H[6] = (H[6]+g) & 0xffffffff;
+        H[7] = (H[7]+h) & 0xffffffff;
+    }
+    return Sha256.toHexStr(H[0]) + Sha256.toHexStr(H[1]) + Sha256.toHexStr(H[2]) + Sha256.toHexStr(H[3]) +
+           Sha256.toHexStr(H[4]) + Sha256.toHexStr(H[5]) + Sha256.toHexStr(H[6]) + Sha256.toHexStr(H[7]);
+};
+/**
+ * Rotates right (circular right shift) value x by n positions [§3.2.4].
+ * @private
+ */
+Sha256.ROTR = function(n, x) {
+    return (x >>> n) | (x << (32-n));
+};
+/**
+ * Logical functions [§4.1.2].
+ * @private
+ */
+Sha256.Σ0  = function(x) { return Sha256.ROTR(2,  x) ^ Sha256.ROTR(13, x) ^ Sha256.ROTR(22, x); };
+Sha256.Σ1  = function(x) { return Sha256.ROTR(6,  x) ^ Sha256.ROTR(11, x) ^ Sha256.ROTR(25, x); };
+Sha256.σ0  = function(x) { return Sha256.ROTR(7,  x) ^ Sha256.ROTR(18, x) ^ (x>>>3);  };
+Sha256.σ1  = function(x) { return Sha256.ROTR(17, x) ^ Sha256.ROTR(19, x) ^ (x>>>10); };
+Sha256.Ch  = function(x, y, z) { return (x & y) ^ (~x & z); };
+Sha256.Maj = function(x, y, z) { return (x & y) ^ (x & z) ^ (y & z); };
+/**
+ * Hexadecimal representation of a number.
+ * @private
+ */
+Sha256.toHexStr = function(n) {
+    // note can't use toString(16) as it is implementation-dependant,
+    // and in IE returns signed numbers when used on full words
+    var s="", v;
+    for (var i=7; i>=0; i--) { v = (n>>>(i*4)) & 0xf; s += v.toString(16); }
+    return s;
+};
+/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  */
+/** Extend String object with method to encode multi-byte string to utf8
+ *  - monsur.hossa.in/2012/07/20/utf-8-in-javascript.html */
+if (typeof String.prototype.utf8Encode == 'undefined') {
+    String.prototype.utf8Encode = function() {
+        return unescape( encodeURIComponent( this ) );
+    };
+}
+/** Extend String object with method to decode utf8 string to multi-byte */
+if (typeof String.prototype.utf8Decode == 'undefined') {
+    String.prototype.utf8Decode = function() {
+        try {
+            return decodeURIComponent( escape( this ) );
+        } catch (e) {
+            return this; // invalid UTF-8? return as-is
+        }
+    };
+}
+/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  */
+if (typeof module != 'undefined' && module.exports) module.exports = Sha256; // CommonJs export
+if (typeof define == 'function' && define.amd) define([], function() { return Sha256; }); // AMD

metadata CHANGED

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: catflap
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 1.0.1
   prerelease:
 platform: ruby
 authors:
@@ -9,19 +9,116 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2013-12-08 00:00:00.000000000 Z
-dependencies: []
-description: A simple solution to provide on-demand service access (e.g. port 80 on
-  webserver), where a more robust and secure VPN solution is not available.
-email: nyk@demotix.com
+date: 2016-03-14 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 1.8.3
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 1.8.3
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.11'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '1.11'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: '3.0'
+description: ! "A simple solution to provide on-demand service access (e.g.\n  port
+  80 on webserver), where a more robust and secure VPN solution is not\n  available.
+  Essentially, it is a more user-friendly form of \"port knocking\".\n  The original
+  proof-of-concept implementation was run for almost three years\n  by Demotix, to
+  protect development and staging servers from search engine\n  crawlers and other
+  unwanted traffic."
+email: nykcowham@gmail.com
 executables:
 - catflap
 extensions: []
 extra_rdoc_files: []
 files:
-- lib/catflap.rb
-- lib/catflap-http.rb
+- .gitignore
+- .rspec
+- .rubocop.yml
+- .rubocop_todo.yml
+- CODE_OF_CONDUCT.md
+- Gemfile
+- Gemfile.lock
+- LICENSE
+- README.md
+- Rakefile
 - bin/catflap
+- bin/console
+- bin/setup
+- catflap.gemspec
+- etc/config.yaml
+- etc/init.d/catflap
+- etc/passfile.yaml
+- lib/catflap.rb
+- lib/catflap/command.rb
+- lib/catflap/firewall.rb
+- lib/catflap/http.rb
+- lib/catflap/netfilter/writer.rb
+- lib/catflap/plugins/firewall/iptables.rb
+- lib/catflap/plugins/firewall/netfilter.rb
+- lib/catflap/plugins/firewall/plugin.rb
+- lib/catflap/version.rb
+- lib/netfilter/writer.rb
+- ui/css/catflap.css
+- ui/images/catflap.png
+- ui/index.rhtml
+- ui/js/catflap.js
+- ui/js/sha256.js
 homepage: https://github.com/nyk/catflap
 licenses:
 - MIT
@@ -44,9 +141,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements:
 - NetFilters (iptables) installed and working.
 rubyforge_project:
-rubygems_version: 1.8.11
+rubygems_version: 1.8.23
 signing_key:
 specification_version: 3
-summary: Manage NetFilter-based rules to grant port access on-demand via commandline
-  or REST API requests.
+summary: Manage NetFilter-based rules to grant port access on-demand commandline or
+  REST API requests.
 test_files: []
+has_rdoc:

data/lib/catflap-http.rb DELETED

@@ -1,111 +0,0 @@
-#!/usr/bin/env ruby
-require 'catflap'
-require 'webrick'
-include WEBrick
-module CatflapWebserver
-  def self.generate_server port
-    config = {:Port => port}
-    server = HTTPServer.new(config)
-    yield server if block_given?
-    ['INT', 'TERM'].each {|signal|
-      trap(signal) {server.shutdown}
-    }
-    server.start
-  end
-  def self.start_server cf
-    generate_server cf.port do |server|
-      server.mount '/', Servlet, cf
-    end
-  end
-  class Servlet < HTTPServlet::AbstractServlet
-    def initialize server, cf
-      super server
-      @cf = cf
-    end
-    def do_GET req, resp
-      # Split the path into piece
-      path = req.path[1..-1].split('/')
-      raise HTTPStatus::OK if path[0] == 'favicon.ico'
-      response_class = CatflapRestService.const_get 'Service'
-      if response_class and response_class.is_a? Class
-        # There was a method given
-        if path[0]
-          response_method = path[0].to_sym
-          # Make sure the method exists in the class
-          raise HTTPStatus::NotFound if !response_class.respond_to? response_method
-          if path[0] == "enter"
-            url = response_class.send response_method, req, resp, @cf
-            resp.set_redirect HTTPStatus::Redirect, url
-          end
-          # Remaining path segments get passed in as arguments to the method
-          if path.length > 1
-            resp.body = response_class.send response_method, req, resp, @cf, path[1..-1]
-          else
-            resp.body = response_class.send response_method, req, resp, @cf
-          end
-          raise HTTPStatus::OK
-        # No method was given, so check for an "index" method instead
-        else
-          raise HTTPStatus::NotFound if !response_class.respond_to? :index
-          resp.body = response_class.send :index
-          raise HTTPStatus::OK
-        end
-      else
-        raise HTTPStatus::NotFound
-      end
-    end
-  end
-end
-module CatflapRestService
-  class Service
-    def self.index
-      return "hello world"
-    end
-    def self.enter req, resp, cf
-      ip = req.peeraddr.pop
-      host = req.addr[2]
-      cf.add_address! ip unless cf.check_address ip
-      return "http://" << host << ":80"
-    end
-    def self.add req, resp, cf, args
-      ip = args[0]
-      unless cf.check_address ip
-        cf.add_address! ip
-        return "#{ip} has been granted access"
-      else
-        return "#{ip} already has access"
-      end
-    end
-    def self.remove req, resp, cf, args
-      ip = args[0]
-      cf.delete_address! ip
-      return "Access granted to #{ip} has been removed"
-    end
-    def self.check req, resp, cf, args
-      ip = args[0]
-      if cf.check_address ip
-        return "#{ip} has access to ports: #{cf.dports}"
-      else
-        return "#{ip} does not have access to ports: #{cf.dports}"
-      end
-    end
-  end
-end