r509 0.9.2 → 0.10.0

data/lib/r509/message_digest.rb

@@ -3,13 +3,23 @@ require 'openssl'
 module R509
   #MessageDigest allows you to specify MDs in a more friendly fashion
   class MessageDigest
+    # a list of message digests that this class understands
+    KNOWN_MDS = ['SHA1','SHA224','SHA256','SHA384','SHA512','DSS1','MD5']
+
+    # this constant defines the default message digest if it is not supplied
+    # or an invalid digest is passed
+    DEFAULT_MD = 'SHA1'
+
     attr_reader :name, :digest
 
     # @param [String,OpenSSL::Digest] arg
-    def initialize(arg)
+    def initialize(arg=nil)
       if arg.kind_of?(String)
         @name = arg.downcase
         @digest = translate_name_to_digest
+      elsif arg.nil?
+        @name = DEFAULT_MD
+        @digest = translate_name_to_digest
       else
         @digest = arg
         @name = translate_digest_to_name
@@ -29,8 +39,8 @@ module R509
       when 'md5' then OpenSSL::Digest::MD5.new
       when 'dss1' then OpenSSL::Digest::DSS1.new
       else
-        @name = "sha1"
-        OpenSSL::Digest::SHA1.new
+        @name = DEFAULT_MD.downcase
+        translate_name_to_digest
       end
     end
 

data/lib/r509/oid_mapper.rb

@@ -28,5 +28,19 @@ module R509
       end
       nil
     end
+
+    # Load YAML and register OIDs
+    # @param [String] name Name of the config within the file
+    # @param [String] yaml_data YAML data to load
+    # @example
+    #  custom_oids:
+    #    - :oid: 1.4.3.2.1.2.3.4.4.4.5
+    #      :short_name: testOIDName
+    #    - :oid: 1.4.3.2.1.2.5.4.4.4.5
+    #      :short_name: anotherOIDName
+    def self.register_from_yaml(name, yaml_data)
+      conf = YAML.load(yaml_data)
+      self.batch_register(conf[name])
+    end
   end
 end

data/lib/r509/private_key.rb

@@ -7,9 +7,19 @@ module R509
   class PrivateKey
     include R509::IOHelpers
 
-    # @option opts [Symbol] :type :rsa/:dsa/:ec
-    # @option opts [String] :curve_name ("secp384r1") Only used if :type is :ec
-    # @option opts [Integer] :bit_strength (2048) Only used if :type is :rsa or :dsa.
+    # a list of key types
+    KNOWN_TYPES = ["RSA","DSA","EC"]
+    # the default type
+    DEFAULT_TYPE = "RSA"
+    # default bit length for DSA/RSA
+    DEFAULT_STRENGTH = 2048
+    # default curve name for EC
+    DEFAULT_CURVE = "secp384r1"
+
+    # @option opts [Symbol] :type Defaults to R509::PrivateKey::DEFAULT_TYPE. Allows R509::PrivateKey::KNOWN_TYPES.
+    # @option opts [String] :curve_name ("secp384r1") Only used if :type is EC
+    # @option opts [Integer] :bit_length (2048) Only used if :type is RSA or DSA
+    # @option opts [Integer] :bit_strength (2048) Deprecated, identical to bit_length.
     # @option opts [String] :password
     # @option opts [String,OpenSSL::PKey::RSA,OpenSSL::PKey::DSA,OpenSSL::PKey::EC] :key
     # @option opts [OpenSSL::Engine] :engine
@@ -18,53 +28,12 @@ module R509
       if not opts.kind_of?(Hash)
         raise ArgumentError, 'Must provide a hash of options'
       end
-
-      if opts.has_key?(:engine) and opts.has_key?(:key)
-        raise ArgumentError, 'You can\'t pass both :key and :engine'
-      elsif opts.has_key?(:key_name) and not opts.has_key?(:engine)
-        raise ArgumentError, 'When providing a :key_name you MUST provide an :engine'
-      elsif opts.has_key?(:engine) and not opts.has_key?(:key_name)
-        raise ArgumentError, 'When providing an :engine you MUST provide a :key_name'
-      elsif opts.has_key?(:engine) and opts.has_key?(:key_name)
-        if not opts[:engine].kind_of?(OpenSSL::Engine)
-          raise ArgumentError, 'When providing an engine, it must be of type OpenSSL::Engine'
-        end
-        @engine = opts[:engine]
-        @key_name = opts[:key_name]
-      end
+      validate_engine(opts)
 
       if opts.has_key?(:key)
-        password = opts[:password] || nil
-        #OpenSSL::PKey.read solves this begin/rescue garbage but is only
-        #available to Ruby 1.9.3+ and may not solve the EC portion
-        begin
-          @key = OpenSSL::PKey::RSA.new(opts[:key],password)
-        rescue OpenSSL::PKey::RSAError
-          begin
-            @key = OpenSSL::PKey::DSA.new(opts[:key],password)
-          rescue
-            begin
-              @key = OpenSSL::PKey::EC.new(opts[:key],password)
-            rescue
-              raise R509::R509Error, "Failed to load private key. Invalid key or incorrect password."
-            end
-          end
-        end
+        validate_key(opts)
       else
-        bit_strength = opts[:bit_strength] || 2048
-        type = opts[:type] || :rsa
-        case type
-        when :rsa
-          @key = OpenSSL::PKey::RSA.new(bit_strength)
-        when :dsa
-          @key = OpenSSL::PKey::DSA.new(bit_strength)
-        when :ec
-          curve_name = opts[:curve_name] || "secp384r1"
-          @key = OpenSSL::PKey::EC.new(curve_name)
-          @key.generate_key
-        else
-          raise ArgumentError, 'Must provide :rsa, :dsa , or :ec as type when key or engine is nil'
-        end
+        generate_key(opts)
       end
     end
 
@@ -77,18 +46,19 @@ module R509
     end
 
 
-    # Returns the bit strength of the key
+    # Returns the bit length of the key
     #
     # @return [Integer]
-    def bit_strength
+    def bit_length
       if self.rsa?
         return self.public_key.n.num_bits
       elsif self.dsa?
         return self.public_key.p.num_bits
       elsif self.ec?
-        raise R509::R509Error, 'Bit strength is not available for EC at this time.'
+        raise R509::R509Error, 'Bit length is not available for EC at this time.'
       end
     end
+    alias :bit_strength :bit_length
 
     # Returns the short name of the elliptic curve used to generate the private key
     # if the key is EC. If not, raises an error.
@@ -224,5 +194,59 @@ module R509
     def ec?
       self.key.kind_of?(OpenSSL::PKey::EC)
     end
+
+    private
+
+    def validate_engine(opts)
+      if opts.has_key?(:engine) and opts.has_key?(:key)
+        raise ArgumentError, 'You can\'t pass both :key and :engine'
+      elsif opts.has_key?(:key_name) and not opts.has_key?(:engine)
+        raise ArgumentError, 'When providing a :key_name you MUST provide an :engine'
+      elsif opts.has_key?(:engine) and not opts.has_key?(:key_name)
+        raise ArgumentError, 'When providing an :engine you MUST provide a :key_name'
+      elsif opts.has_key?(:engine) and opts.has_key?(:key_name)
+        if not opts[:engine].kind_of?(OpenSSL::Engine)
+          raise ArgumentError, 'When providing an engine, it must be of type OpenSSL::Engine'
+        end
+        @engine = opts[:engine]
+        @key_name = opts[:key_name]
+      end
+    end
+
+    def validate_key(opts)
+      password = opts[:password] || nil
+      #OpenSSL::PKey.read solves this begin/rescue garbage but is only
+      #available to Ruby 1.9.3+ and may not solve the EC portion
+      begin
+        @key = OpenSSL::PKey::RSA.new(opts[:key],password)
+      rescue OpenSSL::PKey::RSAError
+        begin
+          @key = OpenSSL::PKey::DSA.new(opts[:key],password)
+        rescue
+          begin
+            @key = OpenSSL::PKey::EC.new(opts[:key],password)
+          rescue
+            raise R509::R509Error, "Failed to load private key. Invalid key or incorrect password."
+          end
+        end
+      end
+    end
+
+    def generate_key(opts)
+      bit_length = opts[:bit_length] || opts[:bit_strength] || DEFAULT_STRENGTH
+      type = opts[:type] || DEFAULT_TYPE
+      case type.upcase
+      when "RSA"
+        @key = OpenSSL::PKey::RSA.new(bit_length)
+      when "DSA"
+        @key = OpenSSL::PKey::DSA.new(bit_length)
+      when "EC"
+        curve_name = opts[:curve_name] || DEFAULT_CURVE
+        @key = OpenSSL::PKey::EC.new(curve_name)
+        @key.generate_key
+      else
+        raise ArgumentError, "Must provide #{KNOWN_TYPES.join(", ")} as type when key or engine is nil"
+      end
+    end
   end
 end

data/lib/r509/spki.rb

@@ -1,11 +1,13 @@
 require 'openssl'
 require 'r509/exceptions'
 require 'r509/io_helpers'
+require 'r509/helpers'
 
 module R509
   # class for loading/generating SPKAC/SPKI requests (typically generated by the <keygen> tag
   class SPKI
     include R509::IOHelpers
+    include R509::Helpers
 
     attr_reader :spki, :key
     # @option opts [String,OpenSSL::Netscape::SPKI] :spki the spki you want to parse
@@ -18,45 +20,13 @@ module R509
         raise ArgumentError, 'Must provide either :spki or :key'
       end
 
-      if opts.has_key?(:key)
-        if opts[:key].kind_of?(R509::PrivateKey)
-          @key = opts[:key]
-        else
-          @key = R509::PrivateKey.new(:key => opts[:key])
-        end
-      end
+      @key = load_private_key(opts)
+
       if opts.has_key?(:spki)
-        spki = opts[:spki]
-        # first let's try cleaning up the input a bit so OpenSSL is happy with it
-        # OpenSSL hates SPKAC=
-        spki.sub!("SPKAC=","")
-        # it really hates newlines (Firefox loves 'em)
-        # so let's normalize line endings
-        spki.gsub!(/\r\n?/, "\n")
-        # and nuke 'em
-        spki.gsub!("\n", "")
-        # ...and leading/trailing whitespace
-        spki.strip!
-        @spki = OpenSSL::Netscape::SPKI.new(spki)
-        if not @key.nil? and not @spki.verify(@key.public_key) then
-          raise R509Error, 'Key does not match SPKI.'
-        end
-      end
+        @spki = parse_spki(opts[:spki])
+      else
       # create the SPKI from the private key if it wasn't passed in
-      if @spki.nil?
-        @spki = OpenSSL::Netscape::SPKI.new
-        @spki.public_key = @key.public_key
-        if @key.dsa?
-          #only DSS1 is acceptable for DSA signing in OpenSSL < 1.0
-          #post-1.0 you can sign with anything, but let's be conservative
-          #see: http://www.ruby-doc.org/stdlib-1.9.3/libdoc/openssl/rdoc/OpenSSL/PKey/DSA.html
-          message_digest = R509::MessageDigest.new('dss1')
-        elsif opts.has_key?(:message_digest)
-          message_digest = R509::MessageDigest.new(opts[:message_digest])
-        else
-          message_digest = R509::MessageDigest.new('sha1')
-        end
-        @spki.sign(@key.key,message_digest.digest)
+        @spki = build_spki(opts[:message_digest])
       end
     end
 
@@ -71,94 +41,61 @@ module R509
       @spki.verify(public_key)
     end
 
-    # Converts the SPKI into the PEM format
-    #
-    # @return [String] the SPKI converted into PEM format.
-    def to_pem
-      @spki.to_pem
-    end
-
     alias :to_s :to_pem
 
-    # Converts the SPKI into the DER format
-    #
-    # @return [String] the SPKI converted into DER format.
-    def to_der
-      @spki.to_der
-    end
-
-    # Writes the SPKI into the PEM format
-    #
-    # @param [String, #write] filename_or_io Either a string of the path for
-    #  the file that you'd like to write, or an IO-like object.
-    def write_pem(filename_or_io)
-      write_data(filename_or_io, @spki.to_pem)
-    end
-
-    # Writes the SPKI into the DER format
+    # Returns the signature algorithm (e.g., RSA-SHA1, ecdsa-with-SHA256)
     #
-    # @param [String, #write] filename_or_io Either a string of the path for
-    #  the file that you'd like to write, or an IO-like object.
-    def write_der(filename_or_io)
-      write_data(filename_or_io, @spki.to_der)
+    # @return [String] signature algorithm string
+    def signature_algorithm
+      data = OpenSSL::ASN1.decode(self.to_der)
+      return data.entries[1].value.entries[0].value
     end
 
-    # Returns whether the public key is RSA
-    #
-    # @return [Boolean] true if the public key is RSA, false otherwise
-    def rsa?
-      @spki.public_key.kind_of?(OpenSSL::PKey::RSA)
-    end
-
-    # Returns whether the public key is DSA
-    #
-    # @return [Boolean] true if the public key is DSA, false otherwise
-    def dsa?
-      @spki.public_key.kind_of?(OpenSSL::PKey::DSA)
-    end
-
-    # Returns whether the public key is EC
-    #
-    # @return [Boolean] true if the public key is EC, false otherwise
-    def ec?
-      @spki.public_key.kind_of?(OpenSSL::PKey::EC)
-    end
-
-    # Returns the bit strength of the key used to create the SPKI
-    # @return [Integer] the integer bit strength.
-    def bit_strength
-      if self.rsa?
-        return @spki.public_key.n.num_bits
-      elsif self.dsa?
-        return @spki.public_key.p.num_bits
-      elsif self.ec?
-        raise R509::R509Error, 'Bit strength is not available for EC at this time.'
+    private
+
+    # Tries to clean and parse an inbound SPKI
+    # @param [String] spki string
+    # @return [OpenSSL::Netscape::SPKI] spki object
+    def parse_spki(spki)
+      # first let's try cleaning up the input a bit so OpenSSL is happy with it
+      # OpenSSL hates SPKAC=
+      spki.sub!("SPKAC=","")
+      # it really hates newlines (Firefox loves 'em)
+      # so let's normalize line endings
+      spki.gsub!(/\r\n?/, "\n")
+      # and nuke 'em
+      spki.gsub!("\n", "")
+      # ...and leading/trailing whitespace
+      spki.strip!
+      spki = OpenSSL::Netscape::SPKI.new(spki)
+      if not @key.nil? and not spki.verify(@key.public_key) then
+        raise R509Error, 'Key does not match SPKI.'
       end
+      return spki
     end
 
-    # Returns the short name of the elliptic curve used to generate the public key
-    # if the key is EC. If not, raises an error.
-    #
-    # @return [String] elliptic curve name
-    def curve_name
-      if self.ec?
-        @spki.public_key.group.curve_name
+    # Tries to build an SPKI using an existing private key
+    # @param [String] md optional message digest
+    # @return [OpenSSL::Netscape::SPKI] spki object
+    def build_spki(md)
+      spki = OpenSSL::Netscape::SPKI.new
+      spki.public_key = @key.public_key
+      if @key.dsa?
+        #only DSS1 is acceptable for DSA signing in OpenSSL < 1.0
+        #post-1.0 you can sign with anything, but let's be conservative
+        #see: http://www.ruby-doc.org/stdlib-1.9.3/libdoc/openssl/rdoc/OpenSSL/PKey/DSA.html
+        message_digest = R509::MessageDigest.new('dss1')
       else
-        raise R509::R509Error, 'Curve name is only available with EC SPKIs'
+        message_digest = R509::MessageDigest.new(md)
       end
+      spki.sign(@key.key,message_digest.digest)
+      return spki
     end
 
-    # Returns key algorithm (RSA/DSA)
-    #
-    # @return [String] value of the key algorithm. RSA or DSA
-    def key_algorithm
-      if self.rsa?
-        :rsa
-      elsif self.dsa?
-        :dsa
-      elsif self.ec?
-        :ec
-      end
+    # Returns the proper instance variable
+    def internal_obj
+      @spki
     end
+
   end
 end

data/lib/r509/subject.rb

@@ -1,7 +1,7 @@
 require "openssl"
 
 module R509
-  # subject class. Used for building OpenSSL::X509::Name objects in a sane fashion
+  # The primary subject class. Used for building subject DNs in a sane fashion.
   # @example
   #   subject = R509::Subject.new
   #   subject.CN= "test.test"
@@ -9,6 +9,8 @@ module R509
   # @example
   #   subject = R509::Subject.new([['CN','test.test'],['O','r509 LLC']])
   # @example
+  #   subject = R509::Subject.new(:CN => 'test.test', :O => 'r509 LLC')
+  # @example
   #   # you can also use the friendly getter/setters with custom OIDs
   #   R509::OIDMapper.register("1.2.3.4.5.6.7.8","COI","customOID")
   #   subject = R509::Subject.new
@@ -18,10 +20,12 @@ module R509
   #   # or
   #   subject.custom_oid="test"
   class Subject
-    # @param [Array, OpenSSL::X509::Name, R509::Subject, DER, nil] arg
+    # @param [Array, OpenSSL::X509::Name, R509::Subject, DER, Hash, nil] arg
     def initialize(arg=nil)
       if arg.kind_of?(Array)
         @array = arg
+      elsif arg.kind_of?(Hash)
+        @array = arg.map { |k,v| [k.to_s.upcase,v] }
       elsif arg.kind_of?(OpenSSL::X509::Name)
         sanitizer = R509::NameSanitizer.new
         @array = sanitizer.sanitize(arg)
@@ -97,6 +101,20 @@ module R509
       @array
     end
 
+    # @return [Hash]
+    def to_h
+      hash = {}
+      @array.each do |el|
+        hash[el[0].to_sym] = el[1]
+      end
+      hash
+    end
+
+    # @return [YAML]
+    def to_yaml
+      self.to_h.to_yaml
+    end
+
     # @private
     def respond_to?(method_sym, include_private = false)
       method_sym.to_s =~ /([^=]*)/
@@ -115,6 +133,10 @@ module R509
     # This code will also allow you to set subject items for custom oids
     # defined via R509::OIDMapper
     #
+    # @example
+    #  subject = R509::Subject.new
+    #  subject.CN = 'test' # method built via method missing.
+    #
     def method_missing(method_sym, *args, &block)
       if method_sym.to_s =~ /(.*)=$/
         sn = oid_check($1)