certificate_authority 0.1.2 → 1.0.0

data/lib/certificate_authority/key_material.rb

@@ -3,60 +3,114 @@ module CertificateAuthority
     def public_key
       raise "Required implementation"
     end
-    
+
     def private_key
       raise "Required implementation"
     end
-    
+
     def is_in_hardware?
       raise "Required implementation"
     end
-    
+
     def is_in_memory?
       raise "Required implementation"
     end
+
+    def self.from_x509_key_pair(pair,password=nil)
+      if password.nil?
+        key = OpenSSL::PKey::RSA.new(pair)
+      else
+        key = OpenSSL::PKey::RSA.new(pair,password)
+      end
+      mem_key = MemoryKeyMaterial.new
+      mem_key.public_key = key.public_key
+      mem_key.private_key = key
+      mem_key
+    end
+
+    def self.from_x509_public_key(public_key_pem)
+      key = OpenSSL::PKey::RSA.new(public_key_pem)
+      signing_request_key = SigningRequestKeyMaterial.new
+      signing_request_key.public_key = key.public_key
+      signing_request_key
+    end
   end
-  
+
   class MemoryKeyMaterial
     include KeyMaterial
-    include ActiveModel::Validations
-    
+    include Validations
+
     attr_accessor :keypair
     attr_accessor :private_key
     attr_accessor :public_key
-    
+
     def initialize
     end
-    
-    validates_each :private_key do |record, attr, value|
-        record.errors.add :private_key, "cannot be blank" if record.private_key.nil?
-    end
-    validates_each :public_key do |record, attr, value|
-      record.errors.add :public_key, "cannot be blank" if record.public_key.nil?
+
+    def validate
+      if private_key.nil?
+        errors.add :private_key, "cannot be blank"
+      end
+      if public_key.nil?
+        errors.add :public_key, "cannot be blank"
+      end
     end
-        
+
     def is_in_hardware?
       false
     end
-    
+
     def is_in_memory?
       true
     end
-    
-    def generate_key(modulus_bits=1024)
+
+    def generate_key(modulus_bits=2048)
       self.keypair = OpenSSL::PKey::RSA.new(modulus_bits)
       self.private_key = keypair
       self.public_key = keypair.public_key
       self.keypair
     end
-    
+
     def private_key
       @private_key
     end
-    
+
+    def public_key
+      @public_key
+    end
+  end
+
+  class SigningRequestKeyMaterial
+    include KeyMaterial
+    include Validations
+
+    def validate
+      errors.add :public_key, "cannot be blank" if public_key.nil?
+    end
+
+    attr_accessor :public_key
+
+    def initialize(request=nil)
+      if request.is_a? OpenSSL::X509::Request
+        raise "Invalid certificate signing request" unless request.verify request.public_key
+        self.public_key = request.public_key
+      end
+    end
+
+    def is_in_hardware?
+      false
+    end
+
+    def is_in_memory?
+      true
+    end
+
+    def private_key
+      nil
+    end
+
     def public_key
       @public_key
     end
-    
   end
-end
+end

data/lib/certificate_authority/ocsp_handler.rb

@@ -1,77 +1,147 @@
 module CertificateAuthority
+  class OCSPResponseBuilder
+    attr_accessor :ocsp_response
+    attr_accessor :verification_mechanism
+    attr_accessor :ocsp_request_reader
+    attr_accessor :parent
+    attr_accessor :next_update
+
+    GOOD = OpenSSL::OCSP::V_CERTSTATUS_GOOD
+    REVOKED = OpenSSL::OCSP::V_CERTSTATUS_REVOKED
+
+    NO_REASON=0
+    KEY_COMPROMISED=OpenSSL::OCSP::REVOKED_STATUS_KEYCOMPROMISE
+    UNSPECIFIED=OpenSSL::OCSP::REVOKED_STATUS_UNSPECIFIED
+
+    def build_response()
+      raise "Requires a parent for signing" if @parent.nil?
+      if @verification_mechanism.nil?
+        ## If no verification callback is provided we're marking it GOOD
+        @verification_mechanism = lambda {|cert_id| [GOOD,NO_REASON] }
+      end
+
+      @ocsp_request_reader.ocsp_request.certid.each do |cert_id|
+        result,reason = verification_mechanism.call(cert_id.serial)
+
+        ## cert_id, status, reason, rev_time, this update, next update, ext
+        ## - unit of time is seconds
+        ## - rev_time is currently set to "now"
+        @ocsp_response.add_status(cert_id,
+        result, reason,
+          0, 0, @next_update, nil)
+      end
+
+      @ocsp_response.sign(OpenSSL::X509::Certificate.new(@parent.to_pem), @parent.key_material.private_key, nil, nil)
+      OpenSSL::OCSP::Response.create(OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL, @ocsp_response)
+    end
+
+    def self.from_request_reader(request_reader,verification_mechanism=nil)
+      response_builder = OCSPResponseBuilder.new
+      response_builder.ocsp_request_reader = request_reader
+
+      ocsp_response = OpenSSL::OCSP::BasicResponse.new
+      ocsp_response.copy_nonce(request_reader.ocsp_request)
+      response_builder.ocsp_response = ocsp_response
+      response_builder.next_update = 60*15 #Default of 15 minutes
+      response_builder
+    end
+  end
+
+  class OCSPRequestReader
+    attr_accessor :raw_ocsp_request
+    attr_accessor :ocsp_request
+
+    def serial_numbers
+      @ocsp_request.certid.collect do |cert_id|
+        cert_id.serial
+      end
+    end
+
+    def self.from_der(request_body)
+      reader = OCSPRequestReader.new
+      reader.raw_ocsp_request = request_body
+      reader.ocsp_request = OpenSSL::OCSP::Request.new(request_body)
+
+      reader
+    end
+  end
+
+  ## DEPRECATED
   class OCSPHandler
-    include ActiveModel::Validations
-    
+    include Validations
+
     attr_accessor :ocsp_request
     attr_accessor :certificate_ids
-    
+
     attr_accessor :certificates
     attr_accessor :parent
-    
+
     attr_accessor :ocsp_response_body
-    
-    validate do |crl|
+
+    def validate
       errors.add :parent, "A parent entity must be set" if parent.nil?
+      all_certificates_available
     end
-    validate :all_certificates_available
-    
+
     def initialize
       self.certificates = {}
     end
-    
+
     def <<(cert)
       self.certificates[cert.serial_number.number.to_s] = cert
     end
-    
+
     def extract_certificate_serials
-      raise "No valid OCSP request was supplied" if self.ocsp_request.nil?
-      openssl_request = OpenSSL::OCSP::Request.new(self.ocsp_request)
-      
+      openssl_request = OpenSSL::OCSP::Request.new(@ocsp_request)
+
+      if openssl_request.certid.nil?
+        raise "Invalid openssl request"
+      end
       self.certificate_ids = openssl_request.certid.collect do |cert_id|
         cert_id.serial
       end
-      
+
       self.certificate_ids
     end
-    
-    
+
+
     def response
       raise "Invalid response" unless valid?
-      
+
       openssl_ocsp_response = OpenSSL::OCSP::BasicResponse.new
       openssl_ocsp_request = OpenSSL::OCSP::Request.new(self.ocsp_request)
       openssl_ocsp_response.copy_nonce(openssl_ocsp_request)
-      
+
       openssl_ocsp_request.certid.each do |cert_id|
         certificate = self.certificates[cert_id.serial.to_s]
-        
-        openssl_ocsp_response.add_status(cert_id, 
-        OpenSSL::OCSP::V_CERTSTATUS_GOOD, 0, 
+
+        openssl_ocsp_response.add_status(cert_id,
+        OpenSSL::OCSP::V_CERTSTATUS_GOOD, 0,
           0, 0, 30, nil)
       end
-      
-      
+
+
       openssl_ocsp_response.sign(OpenSSL::X509::Certificate.new(self.parent.to_pem), self.parent.key_material.private_key, nil, nil)
       final_response = OpenSSL::OCSP::Response.create(OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL, openssl_ocsp_response)
       self.ocsp_response_body = final_response
       self.ocsp_response_body
     end
-    
+
     def to_der
       raise "No signed OCSP response body available" if self.ocsp_response_body.nil?
       self.ocsp_response_body.to_der
     end
-    
+
     private
-    
+
     def all_certificates_available
       openssl_ocsp_request = OpenSSL::OCSP::Request.new(self.ocsp_request)
-      
+
       openssl_ocsp_request.certid.each do |cert_id|
         certificate = self.certificates[cert_id.serial.to_s]
         errors.add(:base, "Certificate #{cert_id.serial} has not been added yet") if certificate.nil?
       end
     end
-    
+
   end
-end
+end

data/lib/certificate_authority/pkcs11_key_material.rb

@@ -1,45 +1,43 @@
 module CertificateAuthority
   class Pkcs11KeyMaterial
     include KeyMaterial
-    include ActiveModel::Validations
-    include ActiveModel::Serialization
-    
+
     attr_accessor :engine
     attr_accessor :token_id
     attr_accessor :pkcs11_lib
     attr_accessor :openssl_pkcs11_engine_lib
     attr_accessor :pin
-    
+
     def initialize(attributes = {})
       @attributes = attributes
       initialize_engine
     end
-        
+
     def is_in_hardware?
       true
     end
-    
+
     def is_in_memory?
       false
     end
-    
+
     def generate_key(modulus_bits=1024)
       puts "Key generation is not currently supported in hardware"
       nil
     end
-    
+
     def private_key
       initialize_engine
       self.engine.load_private_key(self.token_id)
     end
-    
+
     def public_key
       initialize_engine
       self.engine.load_public_key(self.token_id)
     end
-    
+
     private
-    
+
     def initialize_engine
       ## We're going to return early and try again later if params weren't passed in
       ## at initialization.  Any attempt at getting a public/private key will try
@@ -47,7 +45,7 @@ module CertificateAuthority
       return false if self.openssl_pkcs11_engine_lib.nil? or self.pkcs11_lib.nil?
       return self.engine unless self.engine.nil?
       OpenSSL::Engine.load
-      
+
       pkcs11 = OpenSSL::Engine.by_id("dynamic") do |e|
         e.ctrl_cmd("SO_PATH",self.openssl_pkcs11_engine_lib)
         e.ctrl_cmd("ID","pkcs11")
@@ -56,10 +54,10 @@ module CertificateAuthority
         e.ctrl_cmd("PIN",self.pin) unless self.pin.nil? or self.pin == ""
         e.ctrl_cmd("MODULE_PATH",self.pkcs11_lib)
       end
-      
+
       self.engine = pkcs11
       pkcs11
     end
-    
+
   end
-end
+end

data/lib/certificate_authority/revocable.rb

@@ -0,0 +1,14 @@
+module CertificateAuthority
+  module Revocable
+    attr_accessor :revoked_at
+
+    def revoke!(time=Time.now)
+      @revoked_at = time
+    end
+
+    def revoked?
+      # If we have a time, then we're revoked
+      !@revoked_at.nil?
+    end
+  end
+end

data/lib/certificate_authority/serial_number.rb

@@ -1,9 +1,22 @@
+require 'securerandom'
+
 module CertificateAuthority
   class SerialNumber
-    include ActiveModel::Validations
-    
+    include Validations
+    include Revocable
+
     attr_accessor :number
-    
-    validates :number, :presence => true, :numericality => {:greater_than => 0}
+
+    def validate
+      if self.number.nil?
+        errors.add :number, "must not be empty"
+      elsif self.number.to_i <= 0
+        errors.add :number, "must be greater than zero"
+      end
+    end
+
+    def initialize
+      self.number = SecureRandom.random_number(2**128-1)
+    end
   end
-end
+end

data/lib/certificate_authority/signing_entity.rb

@@ -1,18 +1,16 @@
 module CertificateAuthority
   module SigningEntity
-    
+
     def self.included(mod)
       mod.class_eval do
-        attr_accessor :signing_entity 
+        attr_accessor :signing_entity
       end
     end
-    
+
     def signing_entity=(val)
       raise "invalid param" unless [true,false].include?(val)
       @signing_entity = val
     end
-    
-    
-    
+
   end
-end
+end