kybus-ssl 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: e2bf5e7b4893134432a12134b41fb41b318b7ef6928e5690a4ec2a978b06cebe
+  data.tar.gz: 9576e4b32580447fc71678eec7ee7f56e5a7a5c6f34e8d6015aee3d846a00bb1
+SHA512:
+  metadata.gz: 726fae80d20e37cc77fe945a33cbee37f093d39e862bb1228c0397c624c476144e91a26ddfefae7e2200c5a05aeaafba483c60c3c3986d31b83dd63afe080a09
+  data.tar.gz: c7adaeedef2ea71b15c948eb79eb70c8a10082a550aceba4b9a0965b974b6005b26169bc259872d0f7c9342645c25b8ee1d7826158b5999d9d1bd218371423e0

data/lib/kybus/ssl.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+require_relative 'ssl/inventory'
+require_relative 'ssl/version'

data/lib/kybus/ssl/certificate.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require 'openssl'
+
+module Kybus
+  module SSL
+    # Stores a X509 certificate.
+    class Certificate
+      attr_reader :cert, :key
+
+      def initialize(config, inventory)
+        @config = config
+        @inventory = inventory
+        @key = OpenSSL::PKey::RSA.new(@config['key_size'])
+        @cert = OpenSSL::X509::Certificate.new
+        @cert.public_key = @key.public_key
+        @extensions = OpenSSL::X509::ExtensionFactory.new
+        @extensions.subject_certificate = @cert
+      end
+
+      def create!
+        return if File.file?(@config.key_path)
+
+        @ca = @inventory.ca(@config['parent'])
+        configure_details!
+        configure_extensions!
+        sign!
+        save!
+      end
+
+      def configure_details!
+        @config.configure_cert_details!(@cert)
+      end
+
+      def configure_extensions!
+        @extensions.issuer_certificate = @ca.cert
+        @config.configure_extensions!(@cert, @extensions)
+      end
+
+      def sign!
+        @cert.issuer = @ca.cert.subject
+        @cert.sign(@ca.key, OpenSSL::Digest::SHA256.new)
+      end
+
+      def save!
+        File.write(@config.key_path, @key.to_s)
+        File.write(@config.crt_path, @cert.to_s)
+      end
+
+      def ca_name
+        @config['ca']
+      end
+    end
+  end
+end

data/lib/kybus/ssl/configuration.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Kybus
+  module SSL
+    # Stores a configuration for a certificate
+    class Configuration
+      ONE_YEAR = 60 * 60 * 24 * 365
+
+      def initialize(root, group, cert)
+        @config = root.merge(group).merge(cert)
+      end
+
+      def saving_directory(type)
+        path = @config['saving_directory']
+        serial = @config['serial']
+        "#{path}/#{serial}.#{type}.pem"
+      end
+
+      def crt_path
+        saving_directory('crt')
+      end
+
+      def key_path
+        saving_directory('key')
+      end
+
+      def subject_string
+        "/C=#{@config['country']}/ST=#{@config['state']}" \
+        "/L=#{@config['city']}/O=#{@config['organization']}" \
+        "/OU=#{@config['team']}/CN=#{@config['name']}"
+      end
+
+      def configure_cert_details!(cert)
+        cert.version = 2
+        cert.serial = @config['serial']
+        cert.subject = OpenSSL::X509::Name.parse(subject_string)
+        cert.not_before = Time.now
+        cert.not_after = cert.not_before + ONE_YEAR * @config['expiration']
+      end
+
+      def configure_extensions!(cert, extension_factory)
+        @config['extensions'].each do |name, details|
+          extension = extension_factory.create_extension(
+            name,
+            details['details'],
+            details['critical']
+          )
+          cert.add_extension(extension)
+        end
+      end
+
+      def [](key)
+        @config[key]
+      end
+    end
+  end
+end

data/lib/kybus/ssl/inventory.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require_relative 'configuration'
+require_relative 'certificate'
+require_relative 'revocation_list'
+
+require 'fileutils'
+
+module Kybus
+  module SSL
+    # This provides a full inventory of PKI.
+    # It is composed of:
+    # - Authorities
+    # - Clients
+    # - Servers
+    class Inventory
+      attr_reader :defaults
+
+      def initialize(defaults, auth, clients, servers)
+        @defaults = defaults
+        @authorities = SubInventory.new(auth, self)
+        @clients = SubInventory.new(clients, self)
+        @servers = SubInventory.new(servers, self)
+      end
+
+      def create_certificates!
+        validate_inventories!
+        create_directory!
+        [@authorities, @clients, @servers].each(&:create_certificates!)
+      end
+
+      # TODO: Implement validation of inventories
+      def validate_inventories!
+        true
+      end
+
+      def create_directory!
+        FileUtils.mkdir_p(@defaults['saving_directory'])
+      end
+
+      def ca(name)
+        @authorities.ca(name)
+      end
+    end
+
+    # Implements a single inventory. It creates certificates using similar
+    # configurations.
+    class SubInventory
+      def initialize(configs, inventory)
+        defaults = configs['defaults']
+        @parent = inventory
+        @certificates = configs['certificates'].map do |cert|
+          configuration = Configuration.new(
+            inventory.defaults,
+            defaults,
+            cert
+          )
+          Certificate.new(configuration, inventory)
+        end
+      end
+
+      def create_certificates!
+        @certificates.each(&:create!)
+      end
+
+      def ca(name)
+        @certificates.find { |cert| cert.ca_name == name }
+      end
+    end
+  end
+end

data/lib/kybus/ssl/revocation_list.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Kybus
+  module SSL
+    # Generates revocation list after revocating a list of certs
+    # TODO: Implement CRL
+    class RevocationList
+    end
+  end
+end

data/lib/kybus/ssl/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Kybus
+  module SSL
+    VERSION = '0.1.0'
+  end
+end

metadata

@@ -0,0 +1,133 @@
+--- !ruby/object:Gem::Specification
+name: kybus-ssl
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Gilberto Vargas
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2021-06-15 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.11'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.11'
+- !ruby/object:Gem::Dependency
+  name: pry
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.12'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.12'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+- !ruby/object:Gem::Dependency
+  name: rdoc
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '6.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '6.1'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.16'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.16'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.5'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.5'
+description: Package for creating self signed certificates for development purpose
+email:
+- tachoguitar@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/kybus/ssl.rb
+- lib/kybus/ssl/certificate.rb
+- lib/kybus/ssl/configuration.rb
+- lib/kybus/ssl/inventory.rb
+- lib/kybus/ssl/revocation_list.rb
+- lib/kybus/ssl/version.rb
+homepage: https://github.com/KueskiEngineering/ruby-kybus-server
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.4
+signing_key: 
+specification_version: 4
+summary: Kybus SSL tools
+test_files: []