fenris 0.0.5 → 0.0.6

data/lib/fenris/client.rb

@@ -109,8 +109,13 @@ module Fenris
       OpenSSL::Digest::SHA1.new(obj.to_der).to_s
     end
 
-    def generate_csr
-      subject = OpenSSL::X509::Name.parse "/DC=org/DC=fenris/CN=#{user_name}"
+    def generate_csr(provider)
+      if provider == :self
+        subject = OpenSSL::X509::Name.parse "/DC=org/DC=fenris/CN=#{user_name}"
+      else
+        subject = OpenSSL::X509::Name.parse "/DC=org/DC=fenris/CN=#{user_name}:#{provider}"
+      end
+      log "CSR: #{subject}"
       digest = OpenSSL::Digest::SHA1.new
       req = OpenSSL::X509::Request.new
       req.version = 0
@@ -130,13 +135,16 @@ module Fenris
       cert_cn = get_cn(consumer_cert)
       valid_peer_names = [ peer_name ] if peer_name
       valid_peer_names ||= consumers.map { |c| c["name"] }
-      cn_ok = !!valid_peer_names.detect { |name| name == cert_cn }
+      consumer_cn,provider_cn = cert_cn.split ":"
+      provider_cn_ok = !!user_name
+      consumer_cn_ok = !!valid_peer_names.detect { |name| name == consumer_cn }
       cert_ok = !!consumer_cert.verify(broker.public_key)
-      log "Consumer Cert CN '#{cert_cn}' in allowed_list? #{cn_ok}"
+      log "Consumer Cert CN '#{cert_cn}' displays correct provider? #{provider_cn_ok}"
+      log "Consumer Cert CN '#{cert_cn}' in allowed_list? #{consumer_cn_ok}"
       log "Consumer Cert Signed By Broker? '#{cert_ok}'"
-      result = cn_ok and cert_ok
+      result = consumer_cn_ok and provider_cn_ok and cert_ok
       unless result
-        log "Certificate verification failed.  connection closed [#{cn_ok}] [#{cert_ok}]"
+        log "Certificate verification failed.  connection closed [#{consumer_cn_ok}] [#{provider_cn_ok}] [#{cert_ok}]"
         peer_connection.close_connection if peer_connection
       end
       result
@@ -147,7 +155,8 @@ module Fenris
         log "Deleting socket '#{provider["binding"]}'."
         File.delete provider["binding"] if File.exists? provider["binding"]
       end
-      [ cert_path, key_path ].each do |f|
+      ## TODO - gawd! ugly!
+      [ *providers.map { |c| c["name"] }.map { |provider| cert_path(provider) }, cert_path, key_path ].each do |f|
         if File.exists? f
           log "Deleting file #{f}"
           File.delete f
@@ -156,12 +165,15 @@ module Fenris
     end
 
     def save_keys
+      providers.map { |c| c["name"] }.each do |provider|
+        File.open(cert_path(provider),"w") { |f| f.write cert(provider).to_pem } unless File.exists? cert_path(provider)
+      end
       File.open(cert_path,"w") { |f| f.write cert.to_pem } unless File.exists? cert_path
       File.open(key_path,"w") { |f| f.write key.to_pem } unless File.exists? key_path
     end
 
-    def gen_cert
-      cert = OpenSSL::X509::Certificate.new(RestClient.post("#{@url}cert", :csr => generate_csr))
+    def gen_cert(provider)
+      cert = OpenSSL::X509::Certificate.new(RestClient.post("#{@url}cert", :csr => generate_csr(provider)))
       log "new cert received     #{digest cert}"
       cert
     end
@@ -182,9 +194,10 @@ module Fenris
       @broker ||= OpenSSL::X509::Certificate.new(RestClient.get("#{@url}cert"))
     end
 
-    def cert
-      @cert ||= OpenSSL::X509::Certificate.new(File.read(cert_path)) rescue nil
-      @cert ||= gen_cert
+    def cert(provider = :self)
+      @cert ||= {}
+      @cert[provider] ||= OpenSSL::X509::Certificate.new(File.read(cert_path(provider))) rescue nil
+      @cert[provider] ||= gen_cert(provider)
     end
 
     def key
@@ -192,8 +205,12 @@ module Fenris
       @key ||= gen_key
     end
 
-    def cert_path
-      ".#{user_name}.cert"
+    def cert_path(provider = :self)
+      if provider == :self
+        ".#{user_name}.cert"
+      else
+        ".#{user_name}:#{provider}.cert"
+      end
     end
 
     def key_path

data/lib/fenris/em.rb

@@ -69,6 +69,7 @@ module Fenris
           EventMachine::__send__ *mkbinding(:connect, internal), Fenris::Connection do |provider|
             client.log "start proxying"
             provider.proxy consumer; consumer.proxy provider
+            provider.on_unbind { client.log "Connection closed" }
           end
         end
       end
@@ -119,7 +120,7 @@ module Fenris
         EventMachine::__send__ *mkbinding(:connect, provider), Fenris::Connection do |provider|
           client.log "Connection to the server made, starting ssl"
           provider.validate_peer { |pem| client.validate_peer pem, consumer, provider_name }
-          provider.begin_ssl :key_file =>  client.key_path , :cert_file => client.cert_path do
+          provider.begin_ssl :key_file =>  client.key_path , :cert_file => client.cert_path(provider_name) do
             client.log "SSL complete - start proxying"
             provider.proxy consumer; consumer.proxy provider
           end

data/lib/fenris/version.rb

@@ -1,3 +1,3 @@
 module Fenris
-  VERSION = "0.0.5"
+  VERSION = "0.0.6"
 end

metadata

@@ -1,11 +1,11 @@
 --- !ruby/object:Gem::Specification
 name: fenris
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.0.6
   segments:
   - 0
   - 0
-  - 5
+  - 6
   prerelease: false
 platform: ruby
 authors:
@@ -13,12 +13,12 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2011-10-25 00:00:00.000000000 -07:00
+date: 2011-10-26 00:00:00.000000000 -07:00
 default_executable: 
 dependencies:
 - !ruby/object:Gem::Dependency
   name: eventmachine
-  requirement: &2155110000 !ruby/object:Gem::Requirement
+  requirement: &2153842880 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -30,10 +30,10 @@ dependencies:
         - 10
   type: :runtime
   prerelease: false
-  version_requirements: *2155110000
+  version_requirements: *2153842880
 - !ruby/object:Gem::Dependency
   name: rest-client
-  requirement: &2155108480 !ruby/object:Gem::Requirement
+  requirement: &2153842060 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -45,10 +45,10 @@ dependencies:
         - 7
   type: :runtime
   prerelease: false
-  version_requirements: *2155108480
+  version_requirements: *2153842060
 - !ruby/object:Gem::Dependency
   name: multi_json
-  requirement: &2155106900 !ruby/object:Gem::Requirement
+  requirement: &2153841300 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -60,7 +60,7 @@ dependencies:
         - 3
   type: :runtime
   prerelease: false
-  version_requirements: *2155106900
+  version_requirements: *2153841300
 description: An authentication and service location service.
 email: orion.henry@gmail.com
 executables: