internet_security_event 1.0.2 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c45d13b633f75d73835bc5df4366f4c7dc778637124b04dfcca841d170062bb8
-  data.tar.gz: 51012612ff7d23ae2019471663f7c16b50d04665f467efad9a13abd377662cbc
+  metadata.gz: 2d93be47b6e84cb8d7e40c2f604732ee48ba6582235253710dd473e0634099c1
+  data.tar.gz: b58978d3f62628a1239a03e60438ca5f516f19ac59ff6946987c4541080b90ca
 SHA512:
-  metadata.gz: ba96b78855a50ce723f9f26c869d9b65a4f0261d79730139c16bac20c56ffd9bfd01921f3152cd94c10648d7ae262474cadda190f5c433e48913a00f9a6b62ab
-  data.tar.gz: c77cf433031d25d2c61089e098db1a097853432449060bd1600e66ef5d2a6c37a0a3065182ffb2dcb623222da708898dfe6ffb5b5ccc5a59301adbc1308a7446
+  metadata.gz: c936050537ef4665d970fea58906b3c1de303a80abe73a082a09040801ebfda12c0826d055c89345591c7844472c82bfb8ccce01bed48dd79618f3a89b78f2e5
+  data.tar.gz: e03ee5ccf138e9d4a9bc6534dcfa3987f631fca669ed1cf0f450d159536c88a43405de338abb71508abb8297f05689818b7ace1abcab97238f6122ecf2519c86

data/.rspec

@@ -1,3 +1 @@
---format documentation
---color
 --require spec_helper

data/CHANGELOG.md

@@ -0,0 +1,24 @@
+# Changelog
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.1.0] - 2019-02-21
+### Added
+- Add basic suport for TLSA events.
+
+## [1.0.2] - 2019-02-21
+
+### Changed
+- Fix checking of TLS hostnames with wildcard certificates.
+
+## [1.0.1] - 2019-02-18
+
+### Changed
+- Improve the way TLS certificates state is computed.
+
+[Unreleased]: https://github.com/smortex/internet_security_event/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/smortex/internet_security_event/compare/v1.0.2...v1.1.0
+[1.0.2]: https://github.com/smortex/internet_security_event/compare/v1.0.1...v1.0.2
+[1.0.1]: https://github.com/smortex/internet_security_event/compare/v1.0.0...v1.0.1

data/lib/internet_security_event/tlsa_status.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require 'resolv'
+
+module InternetSecurityEvent
+  class TLSAStatus
+    attr_reader :record, :certificate
+
+    def initialize(record, certificate)
+      @record = record
+      @certificate = certificate
+
+      @resolv = Resolv::DNS.new
+    end
+
+    def self.build(record, certificate)
+      obj = new(record, certificate)
+      obj.to_e
+    end
+
+    def to_e
+      {
+        state:       state,
+        description: description,
+      }
+    end
+
+    def certificate_association_data(selector, matching_type)
+      certificate_association_data_digest(certificate_association_data_certificate_bytes(selector), matching_type)
+    end
+
+    def certificate_match_tlsa_record?
+      certificate_association_data(record.selector, record.matching_type) == record.certificate_association_data
+    end
+
+    private
+
+    def certificate_association_data_certificate_bytes(selector)
+      case selector
+      when Resolv::DNS::Resource::IN::TLSA::Selector::CERT
+        certificate.to_der
+      when Resolv::DNS::Resource::IN::TLSA::Selector::SPKI
+        certificate.public_key.to_der
+      end
+    end
+
+    def certificate_association_data_digest(bytes, matching_type)
+      case matching_type
+      when Resolv::DNS::Resource::IN::TLSA::MatchingType::FULL
+        bytes.unpack1('H*')
+      when Resolv::DNS::Resource::IN::TLSA::MatchingType::SHA2_256
+        Digest::SHA256.hexdigest(bytes)
+      when Resolv::DNS::Resource::IN::TLSA::MatchingType::SHA2_512
+        Digest::SHA512.hexdigest(bytes)
+      end
+    end
+
+    def state
+      return 'critical' unless record
+
+      return nil unless record.end_entity?
+
+      return 'ok' if certificate_match_tlsa_record?
+
+      'critical'
+    end
+
+    def description
+      if record.end_entity?
+        if certificate_match_tlsa_record?
+          'certificate match TLSA record'
+        else
+          'certificate does not match TLSA record'
+        end
+      else
+        # FIXME: For now, we only check the certificate, not the CA
+        'Unsupported certificate usage'
+      end
+    end
+  end
+end

data/lib/internet_security_event/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module InternetSecurityEvent
-  VERSION = '1.0.2'
+  VERSION = '1.1.0'
 end

data/lib/internet_security_event.rb

@@ -2,4 +2,6 @@
 
 require 'internet_security_event/now'
 require 'internet_security_event/tls_status'
+require 'internet_security_event/tlsa_status'
 require 'internet_security_event/x509_status'
+require 'resolv/dns/resource/in/tlsa'

data/lib/resolv/dns/resource/in/tlsa.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+class Resolv
+  class DNS
+    class Resource
+      module IN
+        class TLSA
+          module CertificateUsage
+            PKIX_TA = 0
+            PKIX_EE = 1
+            DANE_TA = 2
+            DANE_EE = 3
+          end
+
+          module Selector
+            CERT = 0
+            SPKI = 1
+          end
+
+          module MatchingType
+            FULL = 0
+            SHA2_256 = 1
+            SHA2_512 = 2
+          end
+
+          def initialize(data)
+            @certificate_usage, @selector, @matching_type, @certificate_association_data = data.unpack('CCCH*')
+          end
+
+          attr_reader :certificate_usage, :selector, :matching_type, :certificate_association_data
+
+          def end_entity?
+            [CertificateUsage::PKIX_EE, CertificateUsage::DANE_EE].include?(certificate_usage)
+          end
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: internet_security_event
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.1.0
 platform: ruby
 authors:
 - Romain Tartière
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-02-21 00:00:00.000000000 Z
+date: 2019-02-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionview
@@ -104,6 +104,7 @@ files:
 - ".gitignore"
 - ".rspec"
 - ".travis.yml"
+- CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
 - LICENSE.txt
@@ -115,8 +116,10 @@ files:
 - lib/internet_security_event.rb
 - lib/internet_security_event/now.rb
 - lib/internet_security_event/tls_status.rb
+- lib/internet_security_event/tlsa_status.rb
 - lib/internet_security_event/version.rb
 - lib/internet_security_event/x509_status.rb
+- lib/resolv/dns/resource/in/tlsa.rb
 homepage: https://github.com/smortex/internet_security_event
 licenses:
 - MIT