certmeister 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 45294a93b1babeea90937ee91c345bddefa60b25
-  data.tar.gz: 1c0f12426788ad03d9952e2e3532128951d9575e
+  metadata.gz: 4a9c4caa4ce477f7481e1357d98f142638e9a531
+  data.tar.gz: c81a795d5f84058b66cdbb0f9a7ae8f2adc94554
 SHA512:
-  metadata.gz: 763ed829a24c1002c00e3732b41db17d013195ad61686f6552d07424ed4ba101f5ff18545c47a1caa50c81228cb46961dac32048227b2ec9fcc164b69aab91cb
-  data.tar.gz: a953b468dddfdf2a27f381b1c9b316926ee7397011b9e28cbb9fd9834cfd439073ccf7a8c52fdeb98985785479ebe4b510f0ead3a791872aa31128239a05d463
+  metadata.gz: 2e11877e3183bd036e954a0b8f961ba4ca6941c74785b04929db9ae1f02d8cf3cca0f602f233d162494e7fe4414f09e165fe54ff4bd5728724fb35dfa2d59b67
+  data.tar.gz: 1fbe2145d82e9a3d41441ec3d3806b9e94497bd94f438680e0f7ea93b1a267cb5d37b7e4192146099864c1f6fdf902986d5bbbe9c4d773ee5182a780c3b23aee

data/Gemfile.lock

@@ -1,9 +1,9 @@
 PATH
   remote: .
   specs:
-    certmeister (0.1.0)
-    certmeister-redis (0.1.0)
-      certmeister (= 0.1.0)
+    certmeister (0.2.0)
+    certmeister-redis (0.2.0)
+      certmeister (= 0.2.0)
       redis-sentinel (~> 1.4)
 
 GEM

data/lib/certmeister/policy/ip.rb

@@ -0,0 +1,35 @@
+require 'certmeister/policy/response'
+require 'ipaddr'
+
+module Certmeister
+
+  module Policy
+
+    class IP
+
+      def initialize(networks)
+        @networks = networks.map { |n| IPAddr.new(n) }
+      end
+
+      def authenticate(request)
+        begin
+          if !request[:ip]
+            Certmeister::Policy::Response.new(false, "missing ip")
+          else
+            ip = IPAddr.new(request[:ip])
+            if @networks.any? { |n| n.include?(ip) }
+              Certmeister::Policy::Response.new(true, nil)
+            else
+              Certmeister::Policy::Response.new(false, "unauthorized ip")
+            end
+          end
+        rescue IPAddr::Error
+          Certmeister::Policy::Response.new(false, "invalid ip")
+        end
+      end
+
+    end
+
+  end
+
+end

data/lib/certmeister/version.rb

@@ -1,5 +1,5 @@
 module Certmeister
 
-  VERSION = '0.1.0' unless defined?(VERSION)
+  VERSION = '0.2.0' unless defined?(VERSION)
   
 end

data/spec/certmeister/policy/ip_spec.rb

@@ -0,0 +1,36 @@
+require 'spec_helper'
+
+require 'certmeister/policy/ip'
+
+describe Certmeister::Policy::IP do
+
+  subject { Certmeister::Policy::IP.new(['127.0.0.0/8', '192.168.0.0/23']) }
+
+  it "demands a request" do
+    expect { subject.authenticate }.to raise_error(ArgumentError)
+  end
+
+  it "refuses to authenticate a request with a missing ip" do
+    response = subject.authenticate(cn: 'localhost')
+    expect(response).to_not be_authenticated
+    expect(response.error).to eql "missing ip"
+  end
+
+  it "refuses to authenticate a request with a malformed ip" do
+    response = subject.authenticate(cn: 'localhost', ip: '127.1')
+    expect(response).to_not be_authenticated
+    expect(response.error).to eql "invalid ip"
+  end
+
+  it "refuses to authenticate an IP outside the configured list of networks" do
+    response = subject.authenticate(cn: 'localhost', ip: '172.16.0.1')
+    expect(response).to_not be_authenticated
+    expect(response.error).to eql "unauthorized ip"
+  end
+
+  it "allows an IP inside a configured network" do
+    response = subject.authenticate(cn: 'localhost', ip: '192.168.0.1')
+    expect(response).to be_authenticated
+  end
+
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: certmeister
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Sheldon Hearn
@@ -96,6 +96,7 @@ files:
 - lib/certmeister/policy/domain.rb
 - lib/certmeister/policy/existing.rb
 - lib/certmeister/policy/fcrdns.rb
+- lib/certmeister/policy/ip.rb
 - lib/certmeister/policy/noop.rb
 - lib/certmeister/policy/psk.rb
 - lib/certmeister/policy/response.rb
@@ -112,6 +113,7 @@ files:
 - spec/certmeister/policy/domain_spec.rb
 - spec/certmeister/policy/existing_spec.rb
 - spec/certmeister/policy/fcrdns_spec.rb
+- spec/certmeister/policy/ip_spec.rb
 - spec/certmeister/policy/noop_spec.rb
 - spec/certmeister/policy/psk_spec.rb
 - spec/certmeister/policy/response_spec.rb
@@ -155,6 +157,7 @@ test_files:
 - spec/certmeister/policy/domain_spec.rb
 - spec/certmeister/policy/existing_spec.rb
 - spec/certmeister/policy/fcrdns_spec.rb
+- spec/certmeister/policy/ip_spec.rb
 - spec/certmeister/policy/noop_spec.rb
 - spec/certmeister/policy/psk_spec.rb
 - spec/certmeister/policy/response_spec.rb