reyes 1.2.1 → 1.2.2

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    YjY2OTM2MzJiMTg1MTJjYzkzY2JiZjU4YzFhOTc5MmUxNWY4MDZlZQ==
+    MWNhNWYxOTI2NzcxY2Q4YWY5OWJkOWMxZTVlYjA0ZjdjMTgxY2IyMw==
   data.tar.gz: !binary |-
-    NzJiNTU1ODI2MmU5NTljOWRiMTA0OTRlMzFkZTkyMmZmMDU2ZTIzYQ==
+    YjgzYzZmNzkyY2VmY2Y4OGIxZmQ3N2VlNTg2OTdlODFiODM2NzVkYQ==
 SHA512:
   metadata.gz: !binary |-
-    ZDRjNmVjZjczZmY1NjZkNWY5YjMyNjA3ODc3NTA4ZDZjMzExZDI3NmYyYTMy
-    OTVmYjMzZjZmZjQ4M2I3MjNkYjljNTAxN2E1NTg2NmE4YzQ4ZTgyY2YwOGIz
-    OWRhNjkwOTg4NTJiM2Q5ZjI2YzE0MTc4ZWZkYThjZjRhYmM0YWI=
+    ZTVlMzI4YWM1OGMxOTI0ZTNjMTNiMThjZTAzMTdjM2VhMzJmMjRjMDViZWIw
+    ZGNlY2NhNWJmMjRjODY5NGI0M2U1YTU4ZDFhMDY5YjQ3NmNlOWNiOTUzNGEz
+    Y2VjZDBmNTkyNTVmNzgzY2I2MmNhZjhhN2ExMmI2MTkyODU2OTI=
   data.tar.gz: !binary |-
-    ZDgzYTdkZjRmN2YyMTliNDZlYmQzYmYzY2RkNzQ1ZmQ4NDg3YjdmZDc1NGY1
-    YmRjZDVlNmZmMjdiNDMwZGNhOTMzYWQyN2ZiMTZkMjY2NGY3OTUwYzYxNThl
-    ZmE0ZGY0YzAxODVkNzEyNGZhNGQ2OTQ1ZTVjZjgxZmZhNTljOGM=
+    MTNlZmQ1ZTExMmJkNjRkOTQwNGVhY2NmYzhmYmM3Yzk3YjcyMGMyNzlhNGUw
+    N2MzZGJiOTc2ODUxMmUzODBkNGNhMWFlYjRmYzRkYjdlNWRmZDI5NDExNjU2
+    OTcxNDEwNmUxMjY0YzRmMjY1YWJhMGMxOGUxYTgyZjM1ZmY0ZjM=

data/bin/reyes

@@ -15,7 +15,8 @@ def command_fetch(region, instance_id, options)
   armoured_rules = s3.fetch_rules
   cleartext_rules = wrapper.verify!(armoured_rules)
 
-  fake = Reyes::FakeAws.new(JSON.load cleartext_rules)
+  fake = Reyes::FakeAws.new(JSON.load(cleartext_rules),
+                            options.fetch(:fake_aws_options))
   g = Reyes::GroupManager.new(fake, region, instance_id)
   r = Reyes::RunManager.new(g)
 
@@ -34,7 +35,7 @@ def command_install(json_file, region, instance_id, options)
 
   data = JSON.load(File.open(json_file, 'r'))
   generated_time = data.fetch("metadata").fetch("generated_stamp")
-  fake = Reyes::FakeAws.new(data)
+  fake = Reyes::FakeAws.new(data, options.fetch(:fake_aws_options))
   g = Reyes::GroupManager.new(fake, region, instance_id)
 
   if Time.new(generated_time) > g.run_generation_time
@@ -75,6 +76,7 @@ def parse_args
     :gen_options => {},
     :apply_options => {},
     :fetch_options => {},
+    :fake_aws_options => {},
   }
 
   optparse = OptionParser.new do |opts|
@@ -151,6 +153,10 @@ Options:
       options[:apply_options][:log_drop] = arg
     end
 
+    opts.on('--ignore-not-after', "Don't check sig not_after") do
+      options[:fake_aws_options][:check_not_after] = false
+    end
+
     opts.on('-v', '--version', 'Display version number and exit') do
       puts "reyes version #{Reyes::VERSION}"
       exit 0

data/lib/reyes/aws_manager.rb

@@ -8,6 +8,9 @@ module Reyes
 
     include Chalk::Log
 
+    # Validity period for signed JSON documents
+    JSON_NOT_AFTER = 3600
+
     # Short names for AWS regions to save space in ipset names
     RegionShortNames = {
       'us-east-1' => 'VA',
@@ -216,6 +219,7 @@ module Reyes
           'generated_stamp' => start.to_i,
           'hostname' => Socket.gethostname,
           'pid' => Process.pid,
+          'not_after_stamp' => Time.now.to_i + JSON_NOT_AFTER,
         },
         'vpcs' => {},
         'classic_cidr_blocks' => aws_config.fetch('classic_cidr_blocks'),

data/lib/reyes/fake_aws.rb

@@ -5,8 +5,14 @@ module Reyes
     include Chalk::Log
 
     # @param data [Hash]
-    # @param assert_version [Boolean]
-    def initialize(data, assert_version=true)
+    # @param options [Hash]
+    #
+    # @option options :assert_version [Boolean] (true)
+    # @option options :check_not_after [Boolean] (true)
+    #
+    def initialize(data, options={})
+      options = {assert_version: true, check_not_after: true}.merge(options)
+
       @data = data
       log.info("Initialized FakeAws with metadata: #{metadata.inspect}")
 
@@ -15,10 +21,20 @@ module Reyes
         msg = "JSON format_version #{version.inspect} " \
               "differs from our version #{Reyes::JSON_FORMAT_VERSION}"
         log.error('WARNING: ' + msg)
-        if assert_version
+        if options.fetch(:assert_version)
           raise Error.new(msg)
         end
       end
+
+      if options.fetch(:check_not_after)
+        not_after = Time.at(metadata.fetch('not_after_stamp')).utc
+        if Time.now.utc > not_after
+          log.error('JSON data has expired')
+          log.error("Current time: #{Time.now.utc}")
+          log.error("JSON not_after: #{not_after}")
+          raise Error.new("JSON data expired at #{not_after}")
+        end
+      end
     end
 
     def region_data(region)

data/lib/reyes/version.rb

@@ -1,6 +1,6 @@
 module Reyes
   # The Reyes version number
-  VERSION = '1.2.1' unless defined?(self::VERSION)
+  VERSION = '1.2.2' unless defined?(self::VERSION)
 
   # Number defining the JSON serialization format
   JSON_FORMAT_VERSION = 2 unless defined?(self::JSON_FORMAT_VERSION)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: reyes
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.2.2
 platform: ruby
 authors:
 - Andy Brody
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-03-05 00:00:00.000000000 Z
+date: 2015-03-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk