fernet 2.0.rc2 → 2.0
Sign up to get free protection for your applications and to get access to all the features.
- data/README.md +2 -2
- data/lib/fernet.rb +24 -21
- data/lib/fernet/configuration.rb +5 -5
- data/lib/fernet/encryption.rb +17 -17
- data/lib/fernet/generator.rb +13 -12
- data/lib/fernet/token.rb +12 -9
- data/lib/fernet/verifier.rb +6 -5
- data/lib/fernet/version.rb +1 -1
- metadata +5 -5
data/README.md
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
# Fernet
|
2
2
|
|
3
|
-
[![Build Status](https://secure.travis-ci.org/
|
4
|
-
[![Code Climate](https://codeclimate.com/github/
|
3
|
+
[![Build Status](https://secure.travis-ci.org/fernet/fernet-rb.png)](http://travis-ci.org/fernet/fernet-rb)
|
4
|
+
[![Code Climate](https://codeclimate.com/github/fernet/fernet-rb.png)](https://codeclimate.com/github/fernet/fernet-rb)
|
5
5
|
|
6
6
|
Fernet allows you to easily generate and verify **HMAC based authentication
|
7
7
|
tokens** for issuing API requests between remote servers. It also **encrypts**
|
data/lib/fernet.rb
CHANGED
@@ -15,12 +15,12 @@ module Fernet
|
|
15
15
|
# secret - a base64 encoded, 32 byte string
|
16
16
|
# message - the message being secured in plain text
|
17
17
|
#
|
18
|
-
# Returns the fernet token as a string
|
19
|
-
#
|
20
18
|
# Examples
|
21
19
|
#
|
22
20
|
# secret = ...
|
23
21
|
# token = Fernet.generate(secret, 'my secrets')
|
22
|
+
#
|
23
|
+
# Returns the fernet token as a string
|
24
24
|
def self.generate(secret, message = '', opts = {})
|
25
25
|
Generator.new(opts.merge({secret: secret, message: message})).
|
26
26
|
generate
|
@@ -30,36 +30,39 @@ module Fernet
|
|
30
30
|
#
|
31
31
|
# secret - the secret used to generate the token
|
32
32
|
# token - the token to verify as a string
|
33
|
-
# opts
|
34
|
-
#
|
35
|
-
#
|
33
|
+
# opts - an optional hash containing
|
34
|
+
# * enforce_ttl - whether to enforce TTL in this verification
|
35
|
+
# * ttl - number of seconds token is valid
|
36
36
|
#
|
37
37
|
# Both enforce_ttl and ttl can be configured globally via Configuration
|
38
38
|
#
|
39
|
-
# Returns a verifier object, which responds to valid? and message
|
40
|
-
#
|
41
39
|
# Raises Fernet::Token::InvalidToken if token is invalid and message
|
42
40
|
# is attempted to be extracted
|
43
41
|
#
|
44
42
|
# Examples
|
45
43
|
#
|
46
|
-
#
|
47
|
-
#
|
48
|
-
#
|
49
|
-
#
|
50
|
-
#
|
51
|
-
#
|
44
|
+
# secret = ...
|
45
|
+
# token = ...
|
46
|
+
# verifier = Fernet.verifier(secret, old_token, enforce_ttl: false)
|
47
|
+
# if verifier.valid?
|
48
|
+
# verifier.message # original message in plain text
|
49
|
+
# end
|
50
|
+
#
|
51
|
+
# verifier = Fernet.verifier(secret, old_token)
|
52
|
+
# if verifier.valid?
|
53
|
+
# verifier.message
|
54
|
+
# else
|
55
|
+
# verifier.errors
|
56
|
+
# # => { issued_timestamp: "is too far in the past: token expired" }
|
57
|
+
# verifier.error_messages
|
58
|
+
# # => ["issued_timestamp is too far in the past: token expired"]
|
59
|
+
# end
|
52
60
|
#
|
53
|
-
#
|
54
|
-
# if verifier.valid?
|
61
|
+
# verifier = Fernet.verifier(secret, old_token)
|
55
62
|
# verifier.message
|
56
|
-
#
|
57
|
-
# verifier.errors
|
58
|
-
# # -> { issued_timestamp: "is too far in the past: token expired" }
|
59
|
-
# verifier.error_messages
|
60
|
-
# # -> ["issued_timestamp is too far in the past: token expired"]
|
61
|
-
# end
|
63
|
+
# # => raises Fernet::Token::InvalidToken if token too old or invalid
|
62
64
|
#
|
65
|
+
# Returns a verifier object, which responds to `#valid?` and `#message`
|
63
66
|
def self.verifier(secret, token, opts = {})
|
64
67
|
Verifier.new(opts.merge({secret: secret, token: token}))
|
65
68
|
end
|
data/lib/fernet/configuration.rb
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
require 'singleton'
|
2
2
|
module Fernet
|
3
|
-
# Public
|
4
|
-
#
|
3
|
+
# Public: singleton class used to globally set various
|
4
|
+
# configuration defaults
|
5
5
|
class Configuration
|
6
6
|
include Singleton
|
7
7
|
|
@@ -24,9 +24,9 @@ module Fernet
|
|
24
24
|
#
|
25
25
|
# Examples
|
26
26
|
#
|
27
|
-
#
|
28
|
-
#
|
29
|
-
#
|
27
|
+
# Fernet::Configuration.run do |config|
|
28
|
+
# config.enforce_ttl = false
|
29
|
+
# end
|
30
30
|
def self.run
|
31
31
|
self.instance.enforce_ttl = true
|
32
32
|
self.instance.ttl = 60
|
data/lib/fernet/encryption.rb
CHANGED
@@ -9,17 +9,17 @@ module Fernet
|
|
9
9
|
# random IV and the provided encryption key
|
10
10
|
#
|
11
11
|
# opts - a hash containing
|
12
|
-
#
|
13
|
-
#
|
14
|
-
#
|
15
|
-
#
|
16
|
-
# Returns a two-element array containing the ciphertext and the random IV
|
12
|
+
# * message - the message to encrypt
|
13
|
+
# * key - the encryption key
|
14
|
+
# * iv - override for the random IV, only used for testing
|
17
15
|
#
|
18
16
|
# Examples
|
19
17
|
#
|
20
|
-
#
|
21
|
-
#
|
22
|
-
#
|
18
|
+
# ciphertext, iv = Fernet::Encryption.encrypt(
|
19
|
+
# message: 'this is a secret', key: encryption_key
|
20
|
+
# )
|
21
|
+
#
|
22
|
+
# Returns a two-element array containing the ciphertext and the random IV
|
23
23
|
def self.encrypt(opts)
|
24
24
|
cipher = OpenSSL::Cipher.new('AES-128-CBC')
|
25
25
|
cipher.encrypt
|
@@ -33,17 +33,17 @@ module Fernet
|
|
33
33
|
# the provided IV and encryption key
|
34
34
|
#
|
35
35
|
# opts - a hash containing
|
36
|
-
#
|
37
|
-
#
|
38
|
-
#
|
39
|
-
#
|
40
|
-
# Returns a two-element array containing the ciphertext and the random IV
|
36
|
+
# * ciphertext - encrypted message
|
37
|
+
# * key - encryption key used to encrypt the message
|
38
|
+
# * iv - initialization vector used in the ciphertext's cipher
|
41
39
|
#
|
42
40
|
# Examples
|
43
41
|
#
|
44
|
-
#
|
45
|
-
#
|
46
|
-
#
|
42
|
+
# ciphertext, iv = Fernet::Encryption.encrypt(
|
43
|
+
# message: 'this is a secret', key: encryption_key
|
44
|
+
# )
|
45
|
+
#
|
46
|
+
# Returns a two-element array containing the ciphertext and the random IV
|
47
47
|
def self.decrypt(opts)
|
48
48
|
decipher = OpenSSL::Cipher.new('AES-128-CBC')
|
49
49
|
decipher.decrypt
|
@@ -55,7 +55,7 @@ module Fernet
|
|
55
55
|
# Internal: Creates an HMAC signature (sha356 hashing) of the given bytes
|
56
56
|
# with the provided signing key
|
57
57
|
#
|
58
|
-
# key
|
58
|
+
# key - the signing key
|
59
59
|
# bytes - blob of bytes to sign
|
60
60
|
#
|
61
61
|
# Returns the HMAC signature as a string
|
data/lib/fernet/generator.rb
CHANGED
@@ -6,14 +6,14 @@ require 'date'
|
|
6
6
|
module Fernet
|
7
7
|
# Internal: Generates Fernet tokens
|
8
8
|
class Generator
|
9
|
-
# Returns the token's message
|
9
|
+
# Internal: Returns the token's message
|
10
10
|
attr_accessor :message
|
11
11
|
|
12
12
|
# Internal: Initializes a generator
|
13
13
|
#
|
14
14
|
# opts - a hash containing the following keys:
|
15
|
-
#
|
16
|
-
#
|
15
|
+
# * secret - a string containing a secret, optionally Base64 encoded
|
16
|
+
# * message - the message
|
17
17
|
def initialize(opts)
|
18
18
|
@secret = opts.fetch(:secret)
|
19
19
|
@message = opts[:message]
|
@@ -25,17 +25,18 @@ module Fernet
|
|
25
25
|
#
|
26
26
|
# Yields itself, useful for setting or overriding the message
|
27
27
|
#
|
28
|
-
# Returns the token as a string
|
29
|
-
#
|
30
28
|
# Examples
|
31
|
-
# generator = Generator.new(secret: some_secret)
|
32
|
-
# token = generator.generate do |g|
|
33
|
-
# g.message = 'this is my message'
|
34
|
-
# end
|
35
29
|
#
|
36
|
-
#
|
37
|
-
#
|
38
|
-
#
|
30
|
+
# generator = Generator.new(secret: some_secret)
|
31
|
+
# token = generator.generate do |g|
|
32
|
+
# g.message = 'this is my message'
|
33
|
+
# end
|
34
|
+
#
|
35
|
+
# generator = Generator.new(secret: some_secret,
|
36
|
+
# message: 'this is my message')
|
37
|
+
# token = generator.generate
|
38
|
+
#
|
39
|
+
# Returns the token as a string
|
39
40
|
def generate
|
40
41
|
yield self if block_given?
|
41
42
|
|
data/lib/fernet/token.rb
CHANGED
@@ -18,10 +18,11 @@ module Fernet
|
|
18
18
|
#
|
19
19
|
# token - the string representation of this token
|
20
20
|
# opts - a has containing
|
21
|
-
#
|
22
|
-
#
|
23
|
-
#
|
24
|
-
#
|
21
|
+
# * secret - the secret, optionally base 64 encoded (required)
|
22
|
+
# * enforce_ttl - whether to enforce TTL upon validation. Defaults to
|
23
|
+
# value set in Configuration.enforce_ttl
|
24
|
+
# * ttl - number of seconds token is valid, defaults to
|
25
|
+
# Configuration.ttl
|
25
26
|
def initialize(token, opts = {})
|
26
27
|
@token = token
|
27
28
|
@secret = Secret.new(opts.fetch(:secret))
|
@@ -65,16 +66,18 @@ module Fernet
|
|
65
66
|
# Internal: generates a Fernet Token
|
66
67
|
#
|
67
68
|
# opts - a hash containing
|
68
|
-
#
|
69
|
-
#
|
69
|
+
# * secret - a string containing the secret, optionally base64 encoded
|
70
|
+
# * message - the message in plain text
|
70
71
|
def self.generate(opts)
|
71
72
|
unless opts[:secret]
|
72
73
|
raise ArgumentError, 'Secret not provided'
|
73
74
|
end
|
74
75
|
secret = Secret.new(opts.fetch(:secret))
|
75
|
-
encrypted_message, iv = Encryption.encrypt(
|
76
|
-
|
77
|
-
|
76
|
+
encrypted_message, iv = Encryption.encrypt(
|
77
|
+
key: secret.encryption_key,
|
78
|
+
message: opts[:message],
|
79
|
+
iv: opts[:iv]
|
80
|
+
)
|
78
81
|
issued_timestamp = (opts[:now] || Time.now).to_i
|
79
82
|
|
80
83
|
payload = [DEFAULT_VERSION].pack("C") +
|
data/lib/fernet/verifier.rb
CHANGED
@@ -14,10 +14,10 @@ module Fernet
|
|
14
14
|
# Internal: initializes a Verifier
|
15
15
|
#
|
16
16
|
# opts - a hash containing
|
17
|
-
#
|
18
|
-
#
|
19
|
-
#
|
20
|
-
#
|
17
|
+
# * secret - the secret used to create the token (required)
|
18
|
+
# * token - the fernet token string (required)
|
19
|
+
# * enforce_ttl - whether to enforce TTL, defaults to Configuration.enforce_ttl
|
20
|
+
# * ttl - number of seconds the token is valid
|
21
21
|
def initialize(opts = {})
|
22
22
|
enforce_ttl = opts.has_key?(:enforce_ttl) ? opts[:enforce_ttl] : Configuration.enforce_ttl
|
23
23
|
@token = Token.new(opts.fetch(:token),
|
@@ -46,7 +46,8 @@ module Fernet
|
|
46
46
|
message
|
47
47
|
end
|
48
48
|
|
49
|
-
# Public: String representation of this verifier, masks the secret to avoid
|
49
|
+
# Public: String representation of this verifier, masks the secret to avoid
|
50
|
+
# leaks
|
50
51
|
def inspect
|
51
52
|
"#<Fernet::Verifier @secret=[masked] @token=#{@token} @message=#{@message.inspect} @ttl=#{@ttl} @enforce_ttl=#{@enforce_ttl}>"
|
52
53
|
end
|
data/lib/fernet/version.rb
CHANGED
metadata
CHANGED
@@ -1,15 +1,15 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: fernet
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 2.0
|
5
|
-
prerelease:
|
4
|
+
version: '2.0'
|
5
|
+
prerelease:
|
6
6
|
platform: ruby
|
7
7
|
authors:
|
8
8
|
- Harold Giménez
|
9
9
|
autorequire:
|
10
10
|
bindir: bin
|
11
11
|
cert_chain: []
|
12
|
-
date: 2013-
|
12
|
+
date: 2013-12-16 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
15
|
name: valcro
|
@@ -91,9 +91,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
91
91
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
92
92
|
none: false
|
93
93
|
requirements:
|
94
|
-
- - ! '
|
94
|
+
- - ! '>='
|
95
95
|
- !ruby/object:Gem::Version
|
96
|
-
version:
|
96
|
+
version: '0'
|
97
97
|
requirements: []
|
98
98
|
rubyforge_project:
|
99
99
|
rubygems_version: 1.8.23
|