rcredstash 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 54924cbb3ef0b7e9e664afc6fe17bf2ed7f8b083
-  data.tar.gz: d97592afae4bb20e1bc0550275ae35866ab35c46
+  metadata.gz: a910b2a8a3b77bc116c1466ce17a04bee4e0f54c
+  data.tar.gz: 1b6b12222a108f089ff5759e646b9381626c1b2f
 SHA512:
-  metadata.gz: b07368c741370d224b0027fecf4dddd63d9dcf87785f0ff3c2eb5e2d9c819da7cfdc6b8c4f6178252379816f751e0d6a0022c091d1d005d1b4d911ada29c4bcd
-  data.tar.gz: 259753ebbadb4e6e6c0c49819e68b5f78b250e1074b77dd459cf39788f6882a83e513cf95ace9ff9b764f338a848c43fa2a3b94e7b18663aa0a58068b803d45c
+  metadata.gz: 4e72395c9949808360df91414c3c0be3cf8d97a7addc8492ac72959a9fa4a7400afb328ac7d17009378e466ad2f86e18839a5f8d5de9c5ac3a9e307dbb676d1e
+  data.tar.gz: 0a0cd2c952afeabdfcefa06719aa0bde40f416b0032b245c2252e319464b8cfc7a13836ca3719384916083e00732ee1fa9d640f617cad68a5aba7a00a5f7b0e9

data/lib/cred_stash/cipher.rb

@@ -0,0 +1,35 @@
+require 'openssl'
+
+class CredStash::Cipher
+  def initialize(key)
+    @key = key
+  end
+
+  def encrypt(value)
+    run(mode: :encrypt, value: value)
+  end
+
+  def decrypt(value)
+    run(mode: :decrypt, value: value).force_encoding("UTF-8")
+  end
+
+  private
+
+  def run(mode:, value:)
+    cipher = OpenSSL::Cipher::AES.new(256, "CTR")
+
+    case mode
+    when :encrypt
+      cipher.encrypt
+    when :decrypt
+      cipher.decrypt
+    else
+      raise ArgumentError, "Unknown mode: #{mode}"
+    end
+
+    cipher.key = @key
+    # FIXME It is better to generate and store initial counter
+    cipher.iv = %w(0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1).map(&:hex).pack('C' * 16)
+    cipher.update(value) + cipher.final
+  end
+end

data/lib/cred_stash/cipher_key.rb

@@ -0,0 +1,39 @@
+class CredStash::CipherKey
+  attr_reader :data_key, :hmac_key, :wrapped_key
+
+  def self.generate(client: Aws::KMS::Client.new)
+    res = client.generate_data_key(key_id: 'alias/credstash', number_of_bytes: 64)
+    new(
+      data_key: res.plaintext[0...32],
+      hmac_key: res.plaintext[32..-1],
+      wrapped_key: res.ciphertext_blob
+    )
+  end
+
+  def self.decrypt(wrapped_key, client: Aws::KMS::Client.new)
+    res = client.decrypt(ciphertext_blob: wrapped_key)
+    new(
+      data_key: res.plaintext[0...32],
+      hmac_key: res.plaintext[32..-1],
+      wrapped_key: wrapped_key
+    )
+  end
+
+  def initialize(data_key:, hmac_key:, wrapped_key:)
+    @data_key = data_key
+    @hmac_key = hmac_key
+    @wrapped_key = wrapped_key
+  end
+
+  def hmac(message)
+    OpenSSL::HMAC.hexdigest("SHA256", hmac_key, message)
+  end
+
+  def encrypt(message)
+    CredStash::Cipher.new(data_key).encrypt(message)
+  end
+
+  def decrypt(message)
+    CredStash::Cipher.new(data_key).decrypt(message)
+  end
+end

data/lib/cred_stash/error.rb

@@ -0,0 +1,5 @@
+module CredStash
+  class Error < StandardError; end
+
+  class ItemNotFound < Error; end
+end

data/lib/cred_stash/repository.rb

@@ -0,0 +1,110 @@
+class CredStash::Repository
+  class Item
+    attr_reader :key, :contents, :name, :version, :hmac
+
+    def initialize(key: nil, contents: nil, name: nil, version: nil, hmac: nil)
+      @key = key
+      @contents = contents
+      @name = name
+      @version = version
+      @hmac = hmac
+    end
+  end
+
+  class DynamoDB
+    def initialize(client: nil)
+      @client = client || Aws::DynamoDB::Client.new
+    end
+
+    def get(name)
+      select(name, limit: 1).first.tap do |item|
+        unless item
+          raise CredStash::ItemNotFound, "#{name} is not found"
+        end
+      end
+    end
+
+    def select(name, pluck: nil, limit: nil)
+      params = {
+        table_name:  'credential-store',
+        consistent_read: true,
+        key_condition_expression: "#name = :name",
+        expression_attribute_names: { "#name" => "name"},
+        expression_attribute_values: { ":name" => name }
+      }
+
+      if pluck
+        params[:projection_expression] = pluck
+      end
+
+      if limit
+        params[:limit] = limit
+        params[:scan_index_forward] = false
+      end
+
+      @client.query(params).items.map do |item|
+        Item.new(
+          key: item["key"],
+          contents: item["contents"],
+          name: item["name"],
+          version: item["version"]
+        )
+      end
+    end
+
+    def put(item)
+      @client.put_item(
+        table_name:  'credential-store',
+        item: {
+          name: item.name,
+          version: item.version,
+          key: item.key,
+          contents: item.contents,
+          hmac: item.hmac
+        },
+        condition_expression: "attribute_not_exists(#name)",
+        expression_attribute_names: { "#name" => "name" },
+      )
+    end
+
+    def list
+      @client.scan(
+        table_name:  'credential-store',
+        projection_expression: '#name, version',
+        expression_attribute_names: { "#name" => "name" },
+      ).items.map do |item|
+        Item.new(name: item['name'], version: item['version'])
+      end
+    end
+
+    def delete(item)
+      @client.delete_item(
+        table_name:  'credential-store',
+        key: {
+          name: item.name,
+          version: item.version
+        }
+      )
+    end
+  end
+
+  def self.default_storage
+    DynamoDB.new
+  end
+
+  def initialize(storage: CredStash::Repository.default_storage)
+    @storage = storage
+  end
+
+  def get(name)
+    @storage.get(name)
+  end
+
+  def put(item)
+    @storage.put(item)
+  end
+
+  def select(name, pluck: nil, limit: nil)
+    @storage.select(name, pluck: pluck, limit: limit)
+  end
+end

data/lib/cred_stash/secret.rb

@@ -0,0 +1,67 @@
+class CredStash::Secret
+  attr_reader :name, :value, :key, :encrypted_value, :hmac
+
+  def initialize(name:, value: nil, key: nil, encrypted_value: nil, hmac: nil)
+    @name = name
+    @value = value
+    @key = key
+    @encrypted_value = encrypted_value
+    @hmac = hmac
+  end
+
+  def encrypt!
+    @key = CredStash::CipherKey.generate
+    @encrypted_value = @key.encrypt(@value)
+    @hmac = @key.hmac(@encrypted_value)
+  end
+
+  def save
+    self.class.repository.put(to_item)
+  end
+
+  def falsified?
+    @key.hmac(@encrypted_value) == @hmac
+  end
+
+  def decrypted_value
+    @key.decrypt(@encrypted_value)
+  end
+
+  class << self
+    def find(name)
+      item = repository.get(name)
+      new(
+        name: name,
+        key: CredStash::CipherKey.decrypt(Base64.decode64(item.key)),
+        encrypted_value: Base64.decode64(item.contents),
+        hmac: item.hmac
+      )
+    end
+
+    def repository
+      CredStash::Repository.new
+    end
+  end
+
+
+  private
+
+  def to_item
+    CredStash::Repository::Item.new(
+      name: name,
+      version: "%019d" % (current_version + 1),
+      key: Base64.encode64(key.wrapped_key),
+      contents: Base64.encode64(encrypted_value),
+      hmac: hmac
+    )
+  end
+
+  def current_version
+    item = CredStash::Repository.new.select(name, pluck: 'version', limit: 1).first
+    if item
+      item.version.to_i
+    else
+      0
+    end
+  end
+end

data/lib/cred_stash/version.rb

@@ -1,3 +1,3 @@
 module CredStash
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/lib/cred_stash.rb

@@ -3,125 +3,50 @@ require 'aws-sdk'
 module CredStash
   class << self
     def get(name)
-      dynamodb = Aws::DynamoDB::Client.new
-      res = dynamodb.query(
-        table_name:  'credential-store',
-        limit: 1,
-        consistent_read: true,
-        scan_index_forward: false,
-        key_condition_expression: "#name = :name",
-        expression_attribute_names: { "#name" => "name"},
-        expression_attribute_values: { ":name" => name }
-      )
-      material = res.items.first
-      data = Base64.decode64(material["key"])
-      contents = Base64.decode64(material["contents"])
+      secret = Secret.find(name)
 
-      kms = Aws::KMS::Client.new
-      kms_res = kms.decrypt(ciphertext_blob: data)
-
-      key = kms_res.plaintext[0..32]
-      hmackey = kms_res.plaintext[32..-1]
-
-      unless OpenSSL::HMAC.hexdigest("sha256", hmackey, contents) == material["hmac"]
-        raise "invalid"
+      if secret.falsified?
+        raise "Invalid secret. #{name} has falsified"
       end
 
-      cipher = OpenSSL::Cipher::AES.new(256, "CTR")
-      cipher.decrypt
-      cipher.key = key
-      # FIXME It is better to generate and store initial counter
-      cipher.iv = %w(0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1).map(&:hex).pack('C' * 16)
-      value = cipher.update(contents) + cipher.final
-      value.force_encoding("UTF-8")
+      secret.decrypted_value
+
+    rescue CredStash::ItemNotFound
+      nil
     end
 
     def put(name, value)
-      kms = Aws::KMS::Client.new
-      kms_res = kms.generate_data_key(key_id: 'alias/credstash', number_of_bytes: 64)
-      data_key = kms_res.plaintext[0..32]
-      hmac_key = kms_res.plaintext[32..-1]
-      wrapped_key = kms_res.ciphertext_blob
-
-      cipher = OpenSSL::Cipher::AES.new(256, "CTR")
-      cipher.encrypt
-      cipher.key = data_key
-      # FIXME It is better to generate and store initial counter
-      cipher.iv = %w(0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1).map(&:hex).pack('C' * 16)
-      contents = cipher.update(value) + cipher.final
-
-      hmac = OpenSSL::HMAC.hexdigest("sha256", hmac_key, contents)
-
-      version = get_highest_version(name) + 1
-
-      dynamodb = Aws::DynamoDB::Client.new
-      dynamodb.put_item(
-        table_name:  'credential-store',
-        item: {
-          name: name,
-          version: "%019d" % version,
-          key: Base64.encode64(wrapped_key),
-          contents: Base64.encode64(contents),
-          hmac: hmac
-        },
-        condition_expression: "attribute_not_exists(#name)",
-        expression_attribute_names: { "#name" => "name" },
-      )
+      secret = Secret.new(name: name, value: value)
+      secret.encrypt!
+      secret.save
     end
 
     def list
-      dynamodb = Aws::DynamoDB::Client.new
-      res = dynamodb.scan(
-        table_name:  'credential-store',
-        projection_expression: '#name, version',
-        expression_attribute_names: { "#name" => "name" },
-      )
-      res.items.inject({}) {|h, i| h[i['name']] = i['version']; h }
+      Repository.new.list.inject({}) {|h, item| h[item.name] = item.version; h }
     end
 
     def delete(name)
-      dynamodb = Aws::DynamoDB::Client.new
-      res = dynamodb.query(
-        table_name:  'credential-store',
-        consistent_read: true,
-        key_condition_expression: "#name = :name",
-        expression_attribute_names: { "#name" => "name"},
-        expression_attribute_values: { ":name" => name }
-      )
       # TODO needs delete target version option
-
-      item = res.items.first
-      dynamodb.delete_item(
-        table_name:  'credential-store',
-        key: {
-          name: item['name'],
-          version: item['version'],
-        }
-      )
+      repository = Repository.new
+      item = repository.select(name).first
+      repository.delete(item)
     end
 
     private
 
     def get_highest_version(name)
-      dynamodb = Aws::DynamoDB::Client.new
-      res = dynamodb.query(
-        table_name:  'credential-store',
-        limit: 1,
-        consistent_read: true,
-        scan_index_forward: false,
-        key_condition_expression: "#name = :name",
-        expression_attribute_names: { "#name" => "name"},
-        expression_attribute_values: { ":name" => name },
-        projection_expression: 'version',
-      )
-
-      item = res.items.first
-
+      item = Repository.new.select(name, pluck: 'version', limit: 1).first
       if item
-        item['version'].to_i
+        item.version.to_i
       else
         0
       end
     end
   end
 end
+
+require 'cred_stash/cipher_key'
+require 'cred_stash/cipher'
+require 'cred_stash/error'
+require 'cred_stash/repository'
+require 'cred_stash/secret'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rcredstash
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - adorechic
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-06-16 00:00:00.000000000 Z
+date: 2016-06-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk
@@ -84,9 +84,13 @@ files:
 - bin/setup
 - exe/rcredstash
 - lib/cred_stash.rb
+- lib/cred_stash/cipher.rb
+- lib/cred_stash/cipher_key.rb
+- lib/cred_stash/error.rb
+- lib/cred_stash/repository.rb
+- lib/cred_stash/secret.rb
 - lib/cred_stash/version.rb
 - lib/rcredstash.rb
-- lib/rcredstash/version.rb
 - rcredstash.gemspec
 homepage: https://github.com/adorechic/rcredstash
 licenses:
@@ -113,4 +117,3 @@ signing_key:
 specification_version: 4
 summary: A Ruby port of CredStash
 test_files: []
-has_rdoc: 

data/lib/rcredstash/version.rb

@@ -1,3 +0,0 @@
-module Rcredstash
-  VERSION = "0.1.0"
-end