certmeister 2.1.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6cc20cbf2bb5c2b4b721280da39d1f83ca04ac0a
-  data.tar.gz: aa0e73207c9f71d79ee4ebdf69df41c65dd47829
+  metadata.gz: 799bbad30dae1a1c0f05c7e3ba59dc4b3cc47467
+  data.tar.gz: 447321524cd2661a7f439d5c19fa056efbc699b5
 SHA512:
-  metadata.gz: 68c617c0234008b6900ddedc66a6ac08a2a5d296e46a8bf1583c5f5aa059b5c827c3f6060908920a7c9862de8b02faa2f924b7693ea6e820266784340b2e4248
-  data.tar.gz: 37bd6723f00a8defd6121d50bcb77c01e881e54c543abe408cbdc2f2fb561863160d9c472ea666cb01fb7bded26ba049392ba96d55e9a2769dbc2e754c3aaf07
+  metadata.gz: c98b95cad7ff3960438ac4e8f1a4c73d5458f6774a3743a77694f85fbae21ba39be424176961276b243f7c51d703d4bf5c5cb646f3a515881eb5d7c631db1036
+  data.tar.gz: bd53076b8e6b89f3ea3bcc493a5565698aa399e36cac58aa534e7d777f0f3a7071d99b5ff7e4c5dd2a490348ea973390a524928df420abc9a245da0af1044bf6

data/Rakefile

@@ -1,4 +1,6 @@
 require "rspec/core/rake_task"
+
+$LOAD_PATH.unshift File.join(File.dirname(__FILE__), 'lib')
 require "certmeister/version"
 
 desc 'Build gem into the pkg directory'

data/fixtures/kbits_1024.csr

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIBrzCCARgCAQAwbzELMAkGA1UEBhMCWkExFTATBgNVBAgMDFdlc3Rlcm4gQ2Fw
+ZTESMBAGA1UEBwwJQ2FwZSBUb3duMRgwFgYDVQQKDA9IZXR6bmVyIFBUWSBMdGQx
+GzAZBgNVBAMMEmF4bC5oZXR6bmVyLmFmcmljYTCBnzANBgkqhkiG9w0BAQEFAAOB
+jQAwgYkCgYEAq14FktEw9Zilzj5DUKTI2Mix66A0Za5lTAeRmP1Ms9Hmjc+RnnCm
+u5L6zPoHY8s6/8tbxewtu86L7v2SfKkJjLSKxZQLFxBEzMHOgzziHTyZ1zU5SPWv
+Co8AQdlbZI8Wmai7dkxwdaA2xaWR4elHlgT78xDdYZXwRL75wfmkF/kCAwEAAaAA
+MA0GCSqGSIb3DQEBBQUAA4GBAKHHpelQzMYFBXYa0VOWFiqRd1HXJfnUbo8D5xup
+RzveAVlGTj83slgKvGigUupWdfk1S4KiUG1HsAyLcwl8lgOCO77CrdNPZC0qjB4+
+pK3Xp2FMsK4+lp24FNR0tM31FA03DU8uhL8v5cvExHBn4idBEwO2W4OWPKVYKrtm
+w9ne
+-----END CERTIFICATE REQUEST-----

data/fixtures/kbits_4096.csr

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIEtDCCApwCAQAwbzELMAkGA1UEBhMCWkExFTATBgNVBAgMDFdlc3Rlcm4gQ2Fw
+ZTESMBAGA1UEBwwJQ2FwZSBUb3duMRgwFgYDVQQKDA9IZXR6bmVyIFBUWSBMdGQx
+GzAZBgNVBAMMEmF4bC5oZXR6bmVyLmFmcmljYTCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBALVi/dpNu31zZ+Wvxf4DXEaxLwsUbzsaLCxt770RkzEo8OdU
+DElf1WM7X+rdOJC3BDZ499Bigw5efpEhg2m2BmDl8DG1XmTvVKxIY6fvx9NWqTEt
+KcvOni7g/OFzmUXHoesoc6gz2flwD4lmdSR+S1N2RwwlOG2ZpBKy35mtmDdq/MJG
+Xj4rUafT4n9Pnmwzo9PPn54hjg7c7yQwUFWk0lOrsl7uhK1LMtQORME23oG0gK3N
+zhtY9f0+6YJAbzJ3EI2/i7Oso4XiW9eHpujKhaMYO8ezm3KuYgdEoOTaH4mruSjE
+34kmsTNonktiUdGMn/HqARgQKyVTyHmP+ocVcY8POzlJDcxMRVTYxQ4I9U1bz/eG
+ugHiCw0YnxrXpClXT3RVfydV/B7+srw+Tw8ff+m7WSzYeDjDLVotlnGrXLKLHm6d
+IA7n+fwBhliSSDNTu3ZVA5Vp72AEDqmfbRIcO4twIfkyu3TB3f2lf3g4LLebLDj3
+b3NwNwu0p/uq47eEYOKdILxXsZQRVKr8OZfhjPHIEw7d/6EpCCxG9I9Zj6KFAdga
+s8rquCKvb/8aXnL2Zz+QOhUGX9aAIpZJ7lNM95C1yjmRW/HcNonXcxBHqdi9+swO
+quagOBimj5BkUMRDWtMmr5bXDBGfxMeh6t1BrfcgtQgZy/FLkhjioObqD+WHAgMB
+AAGgADANBgkqhkiG9w0BAQsFAAOCAgEAR1ogHg6V59JwM0+EN4LhN8m7eDiCkYM+
+hmko5gTdzOe3Z+n/eVMoyqJ9qnzQEkO0n4aWTiaO2gLKEtXFo3Qu1wjWEJqxD8/b
+YdH64Gp8sFKlrM8o8mACG6jPo8ueFxI0o9Brl2Q6pUkOlepXUaLzMw0txm1Nm/9c
+O29p1XGAPVEdi9OMqbT+eAnxgSTy/AWR33+1BrZF42zBIaM62yquEPyJ1O1igTio
+MV3ZxhX061z02+5B/6cit41pUClZabII6f/tHAPxxxn3zNHkmYn6eQ3DsZT3Stuf
+lXw8j0e2sFXpvOSk1otYEOVYUiTp4SpmCjdUV1qUPlbQ94qGP75dv5uYn5pN/hJ5
+UO/lGETzK1/ycUcoedDCzr7sQhfXB1Z47/NQ+RL4NVem941ujIfn8MKHyx99zKnT
+OI73Pn6Y7n1hZxoV6krRl7C3gzkI7Eo0bFQEwiZbRC7U30WaiFurfKi0puMlU1K3
+vdOPTy0rq6zGp3r1J6oITHiD/h+CxRxJTrGu9GbCUQlaoQfPqwXAdI7GQcwsSPto
+l1643eqDR3lST821TPE0Ln+Lvs8aQzYNVFaV79nhgncJHyPpP7j9/2k6CtsGAtVv
+qPOTJbxnOfwRDfbyDLWBoqHNxmfhq3KtE6ktVxyP9hUyGnAf8yAn3zaDx4V980N6
+9FNkBniZB+Y=
+-----END CERTIFICATE REQUEST-----

data/lib/certmeister/policy/key_bits.rb

@@ -0,0 +1,46 @@
+require 'certmeister/policy/response'
+require 'openssl'
+
+module Certmeister
+
+  module Policy
+
+    class KeyBits
+
+      DEFAULT_MIN_KEY_BITS = 4096
+
+      attr_reader :min_key_bits
+
+      def initialize(min_key_bits = DEFAULT_MIN_KEY_BITS)
+        validate_min_key_bits(min_key_bits)
+        @min_key_bits = min_key_bits
+      end
+
+      def authenticate(request)
+        if not request[:pem]
+          Certmeister::Policy::Response.new(false, "missing pem")
+        else
+          cert = OpenSSL::X509::Request.new(request[:pem])
+          pkey = cert.public_key
+          kbits = pkey.n.num_bytes * 8
+          if kbits < @min_key_bits
+            Certmeister::Policy::Response.new(false, "weak key")
+          else
+            Certmeister::Policy::Response.new(true, nil)
+          end
+        end
+      end
+
+      private
+
+      def validate_min_key_bits(min_key_bits)
+        unless min_key_bits.is_a?(Integer)
+          raise ArgumentError.new("invalid minimum key size")
+        end
+      end
+
+    end
+
+  end
+
+end

data/lib/certmeister/version.rb

@@ -1,5 +1,5 @@
 module Certmeister
 
-  VERSION = '2.1.0' unless defined?(VERSION)
+  VERSION = '2.2.0' unless defined?(VERSION)
 
 end

data/spec/certmeister/policy/key_bits_spec.rb

@@ -0,0 +1,48 @@
+require 'spec_helper'
+
+require 'certmeister/policy/key_bits'
+
+describe Certmeister::Policy::KeyBits do
+
+  subject { Certmeister::Policy::KeyBits.new(4096) }
+
+  it "may be configured with a minimum key size in bits" do
+    expect { Certmeister::Policy::KeyBits.new("hamster") }.to raise_error(ArgumentError, "invalid minimum key size")
+    expect { Certmeister::Policy::KeyBits.new(4096) }.to_not raise_error
+  end
+
+  it "defaults to #{Certmeister::Policy::KeyBits::DEFAULT_MIN_KEY_BITS} bits minimum key size" do
+    expect(described_class.new.min_key_bits).to eql Certmeister::Policy::KeyBits::DEFAULT_MIN_KEY_BITS
+  end
+
+  it "demands a request" do
+    expect { subject.authenticate }.to raise_error(ArgumentError)
+  end
+
+  it "refuses to authenticate a request with a missing pem" do
+    response = subject.authenticate({anything: 'something'})
+    expect(response).to_not be_authenticated
+    expect(response.error).to eql "missing pem"
+  end
+
+  it "refuses to authenticate an invalid request" do
+    pem = File.read('fixtures/kbits_1024.csr')
+    response = subject.authenticate({pem: pem})
+    expect(response).to_not be_authenticated
+    expect(response.error).to eql "weak key"
+  end
+
+  it "refuses to authenticate a request for a key with too few bits" do
+    pem = File.read('fixtures/kbits_1024.csr')
+    response = subject.authenticate({pem: pem})
+    expect(response).to_not be_authenticated
+    expect(response.error).to eql "weak key"
+  end
+
+  it "authenticates a request for a key with sufficient bits" do
+    pem = File.read('fixtures/kbits_4096.csr')
+    response = subject.authenticate({pem: pem})
+    expect(response).to be_authenticated
+  end
+
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: certmeister
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.2.0
 platform: ruby
 authors:
 - Sheldon Hearn
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-04-28 00:00:00.000000000 Z
+date: 2016-01-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -78,6 +78,8 @@ files:
 - fixtures/client.crt
 - fixtures/client.csr
 - fixtures/client.key
+- fixtures/kbits_1024.csr
+- fixtures/kbits_4096.csr
 - lib/certmeister.rb
 - lib/certmeister/base.rb
 - lib/certmeister/config.rb
@@ -90,6 +92,7 @@ files:
 - lib/certmeister/policy/existing.rb
 - lib/certmeister/policy/fcrdns.rb
 - lib/certmeister/policy/ip.rb
+- lib/certmeister/policy/key_bits.rb
 - lib/certmeister/policy/noop.rb
 - lib/certmeister/policy/psk.rb
 - lib/certmeister/policy/response.rb
@@ -108,6 +111,7 @@ files:
 - spec/certmeister/policy/existing_spec.rb
 - spec/certmeister/policy/fcrdns_spec.rb
 - spec/certmeister/policy/ip_spec.rb
+- spec/certmeister/policy/key_bits_spec.rb
 - spec/certmeister/policy/noop_spec.rb
 - spec/certmeister/policy/psk_spec.rb
 - spec/certmeister/policy/response_spec.rb
@@ -139,7 +143,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.5.1
 signing_key: 
 specification_version: 4
 summary: Conditionally autosigning certificate authority.
@@ -154,6 +158,7 @@ test_files:
 - spec/certmeister/policy/existing_spec.rb
 - spec/certmeister/policy/fcrdns_spec.rb
 - spec/certmeister/policy/ip_spec.rb
+- spec/certmeister/policy/key_bits_spec.rb
 - spec/certmeister/policy/noop_spec.rb
 - spec/certmeister/policy/psk_spec.rb
 - spec/certmeister/policy/response_spec.rb