linzer 0.6.5 → 0.7.0.beta1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d5b1a0dfcd7d402e3a5bf2e22102271e3273e1f7092e4dad09ae7078e04dcf3
-  data.tar.gz: 197933c6728e55678e7f29e5161b57fecd0ca39bacb586260412674a538cd8b1
+  metadata.gz: 9a19b05f41aa933779f504056b56b00fc1a8a6cda19bb26065dce56177caf0c2
+  data.tar.gz: 25d7d8b4afbd60a3e6e872064d92f9be22670466292e23a6ba8010ca546cdf23
 SHA512:
-  metadata.gz: f6da1cd0829f06c15f1a5cf66af191836294ffeea666e15f969f28c7171bf2b8e887b1fb5aa405fbfc7c840719ce82cc6cdae3b7238f987bb00f6c71e238c930
-  data.tar.gz: 047a03b94451dcffe5982165bc14acc7c6419fe4d8ff9f72e2d4510a77fae87c5960fabdaa0ff129d89724b0185a37454e3a6d9ec6ea903192eadc013e1abb64
+  metadata.gz: 527fd9a73a1605b706fc7ca597ce14f4f5c95be099907bf61832aa698b11fe51dbf25a5eaf70d48d7c6715c91c27bfa391482a88a67f0e932c5f60ff8f3f16df
+  data.tar.gz: 2b30454801734973711afe81559ad18f09f6d08f473796241d56e1b13d5619971a697945703b85012e18ae969059ca5a3718e677fc71716151bd46e795eac8a7

data/.standard.yml

@@ -8,3 +8,4 @@ ignore:
     - Layout/HashAlignment
     - Layout/ArgumentAlignment
     - Style/EmptyCaseCondition
+    - Style/RescueModifier

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 ## [Unreleased]
 
+## [0.7.0.beta1] - 2025-04-12
+
+- Introduce Rack::Auth::Signature middleware.
+
 ## [0.6.5] - 2025-04-09
 
 - Add support for RSA (RSASSA-PKCS1-V1_5) and improve RSASSA-PSS handling.

data/README.md

@@ -21,6 +21,33 @@ Or just `gem install linzer`.
 
 ## Usage
 
+### TL;DR: I just want to protect my application!!
+
+Add the following middleware to you run Rack application, e.g.:
+
+```ruby
+# config.ru
+use Rack::Auth::Signature, except: "/login",
+  default_key: {"key" => IO.read("app/config/pubkey.pem"), "alg" => "ed25519"}
+```
+
+or on more complex scenarios:
+
+```ruby
+# config.ru
+use Rack::Auth::Signature, except: "/login",
+  config_path: "app/configuration/http-signatures.yml"
+```
+
+And that's it, all routes in the example app (except `/login`) above will
+require a valid signature created with the respective private key held by a
+client. For more details on what configuration options are available, take a
+look at
+[examples/sinatra/http-signatures.yml](https://github.com/nomadium/linzer/tree/master/examples/sinatra/http-signatures.yml) to get started and/or
+[lib/rack/auth/signature.rb](https://github.com/nomadium/linzer/tree/master/lib/rack/auth/signature.rb) for full implementation details.
+
+To learn about more specific scenarios or use cases, keep reading on below.
+
 ### To sign a HTTP message:
 
 ```ruby

data/examples/sinatra/Gemfile

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+gem "sinatra",      "~> 4.0"
+gem "rackup",       "~> 2.1"
+gem "webrick",      "~> 1.9"
+gem "rack-contrib", "~> 2.4"
+gem "linzer",       "~> 0.7.0.beta1"

data/examples/sinatra/config.ru

@@ -0,0 +1,11 @@
+require "rack"
+require "rack/contrib"
+require "linzer"
+require_relative "myapp"
+
+set :root, File.dirname(__FILE__)
+
+use Rack::Auth::Signature, except: "/",
+  config_path: "http-signatures.yml"
+
+run Sinatra::Application

data/examples/sinatra/http-signatures.yml

@@ -0,0 +1,26 @@
+---
+no_older_than: 6000
+created_required: true
+keyid_required: true
+# nonce_required: false
+# alg_required: false
+# tag_required: false
+# expires_required: false
+covered_components:
+- "@method"
+- "@request-target"
+- date
+known_keys:
+  foo:
+    alg: ed25519
+    key: |
+      -----BEGIN PUBLIC KEY-----
+      MCowBQYDK2VwAyEAMEH9bSanwgAWE5qxUEaXjK6qei8z2hiHT0nlr7ljG0Y=
+      -----END PUBLIC KEY-----
+  bar:
+    alg: hmac-sha256
+    key: !binary |-
+      KuOR/Q8U1Crgp0WsFqW+5ZuC+KbN41dIlXWp71UhPEeJcRfuxZEy6XAUE9nf0yl4jt55yRASBnD0kQKucO6SfA==
+  baz:
+    alg: rsa-pss-sha512
+    path: rsa.pem

data/examples/sinatra/myapp.rb

@@ -0,0 +1,10 @@
+# myapp.rb
+require "sinatra"
+
+get "/" do
+  "Hello world!"
+end
+
+get "/protected" do
+  "secure area"
+end

data/lib/linzer/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Linzer
-  VERSION = "0.6.5"
+  VERSION = "0.7.0.beta1"
 end

data/lib/linzer.rb

@@ -21,6 +21,7 @@ require_relative "linzer/ecdsa"
 require_relative "linzer/key/helper"
 require_relative "linzer/signer"
 require_relative "linzer/verifier"
+require_relative "rack/auth/signature"
 
 module Linzer
   class Error < StandardError; end

data/lib/rack/auth/signature.rb

@@ -0,0 +1,206 @@
+require "linzer"
+require "logger"
+require "yaml"
+
+# Rack::Auth::Signature implements HTTP Message Signatures, as per RFC 9421.
+#
+# Initialize with the Rack application that you want protecting.
+# A hash with options and a block can be passed to customize, enhance
+# or disable security checks applied to incoming requests.
+#
+module Rack
+  module Auth
+    class Signature
+      def initialize(app, options = {}, &block)
+        @app = app
+        @options = load_options(options)
+        instance_eval(&block) if block
+      end
+
+      def call(env)
+        @request = Rack::Request.new(env)
+
+        if excluded? || allowed?
+          @app.call(env)
+        else
+          response = options[:error_response].values
+          Rack::Response.new(*response).finish
+        end
+      end
+
+      private
+
+      def excluded?
+        return false if !request
+        Array(options[:except]).include?(request.path_info)
+      end
+
+      def allowed?
+        has_signature? && acceptable? && verifiable?
+      end
+
+      DEFAULT_OPTIONS = {
+        no_older_than: 900,
+        created_required: true,
+        nonce_required:   false,
+        alg_required:     false,
+        tag_required:     false,
+        expires_required: false,
+        keyid_required:   false,
+        known_keys:       {},
+        covered_components: %w[@method @request-target @authority date],
+        error_response: {body: [], status: 401, headers: {}}
+      }
+
+      private_constant :DEFAULT_OPTIONS
+
+      attr_reader :request, :options
+
+      def params
+        @signature.parameters || {}
+      end
+
+      def logger
+        @logger ||= request.logger || ::Logger.new($stderr)
+      end
+
+      def has_signature?
+        @message = Linzer::Message.new(request)
+        @signature = Linzer::Signature.build(@message.headers)
+        request.env["rack.signature"] = @signature
+        (@signature.to_h.keys & %w[signature signature-input]).size == 2
+      rescue => ex
+        logger.error ex.message
+        false
+      end
+
+      def created?
+        required = options[:created_required]
+        if required
+          params.key?("created") && Integer(params["created"])
+        else
+          !required
+        end
+      end
+
+      def expires?
+        required = options[:expires_required]
+        if required
+          params.key?("expires") && Integer(params["expires"]) > Time.now.to_i
+        else
+          !required
+        end
+      end
+
+      def keyid?
+        required = options[:keyid_required]
+        required ? params.key?("keyid") : !required
+      end
+
+      def nonce?
+        required = options[:nonce_required]
+        required ? params.key?("nonce") : !required
+      end
+
+      def alg?
+        required = options[:alg_required]
+        required ? params.key?("alg") : !required
+      end
+
+      def tag?
+        required = options[:tag_required]
+        required ? params.key?("tag") : !required
+      end
+
+      def has_required_params?
+        created? && expires? && keyid? && nonce? && alg? && tag?
+      rescue => ex
+        logger.error ex.message
+        false
+      end
+
+      def has_required_components?
+        components         = @signature.components || []
+        covered_components = options[:covered_components]
+        warning = "Insufficient coverage by signature. Consult S 7.2.1. in RFC"
+        logger.warn warning if covered_components.empty?
+        (covered_components || []).all? { |c| components.include?(c) }
+      end
+
+      def acceptable?
+        has_required_params? && has_required_components?
+      end
+
+      def verifiable?
+        verify_opts = {}
+
+        warning = "Risk of signature replay! (Consult S 7.2.2. in RFC)"
+        logger.warn warning unless options[:no_older_than]
+
+        if options[:no_older_than]
+          age = Integer(options[:no_older_than])
+          verify_opts[:no_older_than] = age
+        end
+
+        Linzer.verify(key, @message, @signature, **verify_opts)
+      rescue => ex
+        logger.error ex.message
+        false
+      end
+
+      def key
+        build_key(params["keyid"] || :default)
+      end
+
+      def build_key(keyid)
+        material = if keyid == :default
+          options[:default_key]
+        else
+          key_data = options[:known_keys][keyid] || {}
+          if !key_data.key?("key") && key_data.key?("path")
+            key_data["key"] = IO.read(key_data["path"]) rescue nil
+          end
+          key_data
+        end
+
+        key_not_found = "Key not found. Signature cannot be verified."
+        raise Linzer::Error.new key_not_found if !material || !material["key"]
+
+        alg = @signature.parameters["alg"] || material["alg"] || :unknown
+        instantiate_key(keyid, alg, material)
+      end
+
+      def instantiate_key(keyid, alg, material)
+        key_methods = {
+          "rsa-pss-sha512"    => :new_rsa_pss_sha512_key,
+          "rsa-v1_5-sha256"   => :new_rsa_v1_5_sha256_key,
+          "hmac-sha256"       => :new_hmac_sha256_key,
+          "ecdsa-p256-sha256" => :new_ecdsa_p256_sha256_key,
+          "ecdsa-p384-sha384" => :new_ecdsa_p384_sha384_key,
+          "ed25519"           => :new_ed25519_public_key
+        }
+        method = key_methods[alg]
+
+        alg_error = "Unsupported or unknown signature algorithm"
+        raise Linzer::Error.new alg_error unless method
+
+        Linzer.public_send(method, material["key"], keyid.to_s)
+      end
+
+      def load_options(options)
+        DEFAULT_OPTIONS
+          .merge(load_options_from_config_file(options))
+          .merge(Hash(options)) || {}
+      end
+
+      def load_options_from_config_file(options)
+        config_path = options[:config_path]
+        YAML
+          .safe_load_file(config_path)
+          .transform_keys(&:to_sym)
+      rescue
+        {}
+      end
+    end
+  end
+end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: linzer
 version: !ruby/object:Gem::Version
-  version: 0.6.5
+  version: 0.7.0.beta1
 platform: ruby
 authors:
 - Miguel Landaeta
 bindir: exe
 cert_chain: []
-date: 2025-04-09 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: openssl
@@ -103,6 +103,26 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.1.2
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.7'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.7.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.7'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.7.0
 email:
 - miguel@miguel.cc
 executables: []
@@ -116,6 +136,10 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- examples/sinatra/Gemfile
+- examples/sinatra/config.ru
+- examples/sinatra/http-signatures.yml
+- examples/sinatra/myapp.rb
 - lib/linzer.rb
 - lib/linzer/common.rb
 - lib/linzer/ecdsa.rb
@@ -132,6 +156,7 @@ files:
 - lib/linzer/signer.rb
 - lib/linzer/verifier.rb
 - lib/linzer/version.rb
+- lib/rack/auth/signature.rb
 homepage: https://github.com/nomadium/linzer
 licenses:
 - MIT
@@ -153,7 +178,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.6.7
 specification_version: 4
 summary: An implementation of HTTP Messages Signatures (RFC9421)
 test_files: []