sepafm 0.0.2 → 0.1.0

data/lib/sepa/soap_builder.rb

@@ -1,43 +1,40 @@
 module Sepa
   class SoapBuilder
-    # SoapBuilder checks and validates incoming params and creates the SOAP structure
-    def initialize(params)
-
-      check_params(params)
-      # Generate a request ID for the request
-      params[:request_id] = generate_request_id
-
-      # Check if the bank&command need keys/certificates/csr's
-      @params = initialize_certificates_and_csr(params)
-
-      check_if_bank_allows_command(@params)
+    include Utilities
 
-      @ar = ApplicationRequest.new(@params).get_as_base64
+    attr_reader :ar
 
-      @bank = @params.fetch(:bank)
-      find_correct_bank_extension(@bank)
-
-      @template_path = File.expand_path('../xml_templates/soap/', __FILE__)
+    # SoapBuilder creates the SOAP structure.
+    def initialize(params)
+      @bank = params[:bank]
+      @private_key = params[:private_key]
+      @cert = params[:cert]
+      @command = params[:command]
+      @customer_id = params[:customer_id]
+      @environment = params[:environment]
+      @status = params[:status]
+      @target_id = params[:target_id]
+      @language = params[:language]
+      @file_type = params[:file_type]
+      @content = params[:content]
+      @file_reference = params[:file_reference]
+      @enc_cert = params[:enc_cert]
+      @header_template = load_header_template
+      @template = load_body_template SOAP_TEMPLATE_PATH
+      @ar = ApplicationRequest.new(params)
+
+      find_correct_bank_extension
     end
 
     def to_xml
       # Returns a complete SOAP message in xml format
-      find_correct_build(@params).to_xml
-    end
-
-    def get_ar_as_base64
-      @ar
+      find_correct_build.to_xml
     end
 
     private
 
-      def generate_request_id
-        reqid = SecureRandom.random_number(1000).to_s<<SecureRandom.random_number(1000).to_s
-        reqid
-      end
-
-      def find_correct_bank_extension(bank)
-        case bank
+      def find_correct_bank_extension
+        case @bank
         when :danske
           self.extend(DanskeSoapRequest)
         when :nordea
@@ -45,351 +42,64 @@ module Sepa
         end
       end
 
-      # Generic building steps
       def calculate_digest(doc, node)
         sha1 = OpenSSL::Digest::SHA1.new
-
         node = doc.at_css(node)
 
         canon_node = node.canonicalize(
-          mode=Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0,
-          inclusive_namespaces=nil,with_comments=false
+          mode = Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0,
+          inclusive_namespaces = nil, with_comments = false
         )
 
         Base64.encode64(sha1.digest(canon_node)).gsub(/\s+/, "")
       end
 
-      def calculate_signature(doc, node, private_key)
+      def calculate_signature(doc, node)
         sha1 = OpenSSL::Digest::SHA1.new
-
         node = doc.at_css(node)
 
         canon_signed_info_node = node.canonicalize(
-          mode=Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0,inclusive_namespaces=nil,
-          with_comments=false
+          mode = Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0,
+          inclusive_namespaces = nil, with_comments = false
         )
 
-        signature = private_key.sign(sha1, canon_signed_info_node)
-
+        signature = @private_key.sign(sha1, canon_signed_info_node)
         Base64.encode64(signature).gsub(/\s+/, "")
       end
 
-      def load_body_template(command)
-        case command
-        when :download_file_list
-          path = "#{@template_path}/download_file_list.xml"
-        when :get_user_info
-          path = "#{@template_path}/get_user_info.xml"
-        when :upload_file
-          path = "#{@template_path}/upload_file.xml"
-        when :download_file
-          path = "#{@template_path}/download_file.xml"
-        when :get_certificate
-          path = "#{@template_path}/get_certificate.xml"
-        when :get_bank_certificate
-          path = "#{@template_path}/danske_get_bank_certificate.xml"
-        end
-
-        body_template = File.open(path)
-        body = Nokogiri::XML(body_template)
-        body_template.close
-
-        body
+      def load_header_template
+        path = File.open("#{SOAP_TEMPLATE_PATH}/header.xml")
+        Nokogiri::XML(path)
       end
 
       def set_node(doc, node, value)
         doc.at_css(node).content = value
       end
 
-      def add_body_to_header(header, body)
-        body = body.at_css('env|Body')
-        header.root.add_child(body)
-        header
-      end
-
-      def extract_public_key(cert)
-        pkey = cert.public_key
-        pkey = OpenSSL::PKey::RSA.new(pkey)
-
-        pkey
-      end
-
-      def format_cert(cert)
-        cert = cert.to_s
-        cert = cert.split('-----BEGIN CERTIFICATE-----')[1]
-        cert = cert.split('-----END CERTIFICATE-----')[0]
-        cert.gsub!(/\s+/, "")
-      end
-
-      def load_header_template(template_path)
-        header_template = File.open("#{template_path}/header.xml")
-        header = Nokogiri::XML(header_template)
-        header_template.close
-        header
-      end
-
-      def process_header(header, body, private_key, cert)
-        set_node(header, 'wsu|Created', Time.now.iso8601)
-
-        set_node(header, 'wsu|Expires', (Time.now + 3600).iso8601)
-
-        timestamp_digest = calculate_digest(header,'wsu|Timestamp')
-        set_node(header,'dsig|Reference[URI="#dsfg8sdg87dsf678g6dsg6ds7fg"]' \
-                 ' dsig|DigestValue', timestamp_digest)
-
-        body_digest = calculate_digest(body, 'env|Body')
-        set_node(header,'dsig|Reference[URI="#sdf6sa7d86f87s6df786sd87f6s8fsd'\
-                 'a"] dsig|DigestValue', body_digest)
-
-        signature = calculate_signature(header, 'dsig|SignedInfo', private_key)
-        set_node(header, 'dsig|SignatureValue', signature)
-
-        formatted_cert = format_cert(cert)
-        set_node(header, 'wsse|BinarySecurityToken', formatted_cert)
+      def add_body_to_header
+        body = @template.at_css('env|Body')
+        @header_template.root.add_child(body)
+        @header_template
       end
 
-      # Tries to validate the parameters or their presence.
-      def check_params(params)
-        # Universally for all
-        check_params_hash(params)
-        check_certificate_and_key_requirements(params)
-        check_bank(params[:bank])
-        check_env(params[:environment])
-        check_customer_id(params[:customer_id])
+      def process_header
+        set_node(@header_template, 'wsu|Created', iso_time)
+        set_node(@header_template, 'wsu|Expires', (Time.now.utc + 300).iso8601)
 
-        # Generic commands
-        generic_commands = [:download_file,:download_file_list,:get_user_info]
+        timestamp_digest = calculate_digest(@header_template, 'wsu|Timestamp')
+        dsig = 'dsig|Reference[URI="#dsfg8sdg87dsf678g6dsg6ds7fg"] dsig|DigestValue'
+        set_node(@header_template, dsig, timestamp_digest)
 
-        # Depending on command
-        case params[:command]
-        when :get_certificate
-          check_pin(params[:pin])
-          check_service(params[:service])
-        when *generic_commands
-          if params[:bank] == :nordea
-            check_lang(params[:language])
-            check_status(params[:status])
-            check_target_id(params[:target_id])
-            check_file_type(params[:file_type])
-          end
-        when :upload_file
-          check_lang(params[:language])
-          check_target_id(params[:target_id])
-          check_file_type(params[:file_type])
-          check_content(params[:content])
-        when :get_bank_certificate
-          if params[:bank] == :danske
-            # Nothing here
-          end
-        else
-          fail ArgumentError, "Command not supported."
-        end
-      end
+        body_digest = calculate_digest(@template, 'env|Body')
+        dsig = 'dsig|Reference[URI="#sdf6sa7d86f87s6df786sd87f6s8fsda"] dsig|DigestValue'
+        set_node(@header_template, dsig, body_digest)
 
-      def check_csr(csr)
-        unless csr
-          fail ArgumentError, "You didn't provide a certificate signing request"
-        end
-      end
-
-      def check_params_hash(params)
-        unless params.respond_to?(:each_pair)
-          fail ArgumentError, "You didn't provide a proper hash"
-        end
-      end
+        signature = calculate_signature(@header_template, 'dsig|SignedInfo')
+        set_node(@header_template, 'dsig|SignatureValue', signature)
 
-      def check_bank(bank)
-        unless [:nordea, :danske].include?(bank)
-          fail ArgumentError, "You didn't provide a proper bank. " \
-            "Acceptable values are nordea OR danske."
-        end
-      end
-
-      def check_request_id(request_id)
-        if request_id.to_i == 0
-          fail ArgumentError, "Request ID must be a number and not 0"
-        end
-      end
-
-      def check_keygen_type(keygen)
-        unless keygen
-          fail ArgumentError, "You didn't provide any Key Generator Type"
-        end
-      end
-
-      def check_encryption_pkcs10(enc_cert)
-        unless enc_cert
-          fail ArgumentError, "You didn't provide Encrypting certificate PKCS10"
-        end
-      end
-
-      def check_signing_pkcs10(sig_cert)
-        unless sig_cert
-          fail ArgumentError, "You didn't provide Signing certificate PKCS10"
-        end
+        formatted_cert = format_cert(@cert)
+        set_node(@header_template, 'wsse|BinarySecurityToken', formatted_cert)
       end
 
-      def check_pin(pin)
-        unless pin
-          fail ArgumentError, "You didn't provide a secret PIN"
-        end
-      end
-
-      def check_private_key(private_key)
-        unless private_key.respond_to?(:sign)
-          fail ArgumentError, "You didn't provide a proper private key. The " \
-            "key has to be in OpenSSL::PKey::RSA - format."
-        end
-      end
-
-      def check_cert(cert)
-        unless cert.respond_to?(:check_private_key)
-          fail ArgumentError, "You didn't provide a proper certificate. The " \
-            "certificate has to be in OpenSSL::X509::Certificate - format."
-        end
-      end
-
-      def check_customer_id(customer_id)
-        unless customer_id && customer_id.respond_to?(:to_s) &&
-            customer_id.length <= 16
-          fail ArgumentError, "You didn't provide a proper customer id"
-        end
-      end
-
-      def check_env(env)
-        unless ['PRODUCTION', 'TEST', 'customertest'].include?(env)
-          fail ArgumentError, "You didn't provide a proper environment. " \
-            "Acceptable values are PRODUCTION or TEST or customertest."
-        end
-      end
-
-      def check_status(status)
-        unless ['NEW', 'DOWNLOADED', 'ALL'].include?(status)
-          fail ArgumentError, "You didn't provide a proper status. " \
-            "Acceptable values are NEW, DOWNLOADED or ALL."
-        end
-      end
-
-      def check_target_id(target_id)
-        unless target_id && target_id.respond_to?(:to_s) &&
-            target_id.length <= 80
-          fail ArgumentError, "You didn't provide a proper target id"
-        end
-      end
-
-      def check_lang(lang)
-        unless ['FI', 'SE', 'EN'].include?(lang)
-          fail ArgumentError, "You didn't provide a proper language. " \
-            "Acceptable values are FI, SE or EN."
-        end
-      end
-
-      def check_file_type(file_type)
-        unless file_type && file_type.respond_to?(:to_s) &&
-            file_type.length <= 20
-          fail ArgumentError, "You didn't provide a proper file type. Check " \
-            "Your bank's documentation for available file types."
-        end
-      end
-
-      def check_content(content)
-        unless content
-          fail ArgumentError, "You didn't provide any content."
-        end
-      end
-
-      def check_service(service)
-        unless ['service', 'ISSUER', 'MATU'].include?(service)
-          fail ArgumentError, "You didn't provide a proper service."
-        end
-      end
-
-      def check_hmac(hmac)
-        unless hmac
-          fail ArgumentError, "You didn't provide any HMAC."
-        end
-      end
-
-      def check_if_bank_allows_command(params)
-        bank = params.fetch(:bank)
-        command = params.fetch(:command)
-        case bank
-        when :nordea
-          allowed_commands = [:get_certificate,:get_user_info,
-                              :download_file_list,:download_file,:upload_file]
-          unless allowed_commands.include?(command)
-            fail ArgumentError, "You didn't provide a matching bank and service."
-          end
-        when :danske
-          allowed_commands = [:get_bank_certificate]
-          unless allowed_commands.include?(command)
-            fail ArgumentError, "You didn't provide a matching bank and service."
-          end
-        end
-      end
-
-      def check_certificate_and_key_requirements(params)
-        command = params[:command]
-        require_private_and_cert = [:get_user_info,:download_file_list,
-                                    :download_file,:upload_file]
-        require_nothing = [:get_bank_certificate]
-        require_pkcs = [:get_certificate]
-
-        case command
-        when *require_private_and_cert
-          if params[:cert_path] == nil && params[:cert_plain] == nil
-            fail ArgumentError, "You must provide a path to the certificate " \
-              "or certificate in plain text"
-          end
-          if params[:private_key_path] == nil && params[:private_key_plain] == nil
-            fail ArgumentError, "You must provide a path to your private key " \
-              "or private key in plain text"
-          end
-        when *require_nothing
-        when *require_pkcs
-          if params[:csr_path] == nil && params[:csr_plain] == nil
-            fail ArgumentError, "You must provide a path to the CSR or CSR in plain text"
-          end
-        end
-      end
-
-      def initialize_certificates_and_csr(params)
-        begin
-        command = params[:command]
-        require_private_and_cert = [:get_user_info,:download_file_list,
-                                    :download_file,:upload_file]
-        require_nothing = [:get_bank_certificate]
-        require_pkcs = [:get_certificate]
-
-        case command
-        when *require_private_and_cert
-          if params[:cert_path] != nil
-            params[:cert] = OpenSSL::X509::Certificate.new(File.read(params.fetch(:cert_path)))
-          elsif params[:cert_plain] != nil
-            params[:cert] = OpenSSL::X509::Certificate.new(params.fetch(:cert_plain))
-          end
-          if params[:private_key_path] != nil
-            params[:private_key] = OpenSSL::PKey::RSA.new(File.read(params.fetch(:private_key_path)))
-          elsif params[:private_key_plain] != nil
-            params[:private_key] = OpenSSL::PKey::RSA.new(params.fetch(:private_key_plain))
-          end
-          check_private_key(params[:private_key])
-          check_cert(params[:cert])
-        when *require_nothing
-        when *require_pkcs
-          if params[:csr_path] != nil
-            params[:csr] = OpenSSL::X509::Request.new(File.read(params.fetch(:csr_path)))
-          elsif params[:csr_plain] != nil
-            params[:csr] = OpenSSL::X509::Request.new(params.fetch(:csr_plain))
-          end
-          check_csr(params[:csr])
-        else
-          fail ArgumentError, "No matching cases for initialize_certificates_and_csr"
-        end
-         params
-      rescue Exception => e
-        fail ArgumentError, "Parameter failed to initialize, check private key and cert path/plain"
-      end
-      end
   end
 end

data/lib/sepa/utilities.rb

@@ -0,0 +1,132 @@
+module Sepa
+  module Utilities
+
+    def calculate_digest(node)
+      sha1 = OpenSSL::Digest::SHA1.new
+
+      canon_node = node.canonicalize(
+          mode = Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0,
+          inclusive_namespaces = nil, with_comments = false
+      )
+
+      Base64.encode64(sha1.digest(canon_node)).gsub(/\s+/, "")
+    end
+
+    # Takes a certificate, adds begin and end
+    # certificate texts and splits it into multiple lines so that OpenSSL
+    # can read it.
+    def process_cert_value(cert_value)
+      cert = "-----BEGIN CERTIFICATE-----\n"
+      cert += cert_value.to_s.gsub(/\s+/, "").scan(/.{1,64}/).join("\n")
+      cert += "\n"
+      cert + "-----END CERTIFICATE-----"
+    end
+
+    def format_cert(cert)
+      cert = cert.to_s
+      cert = cert.split('-----BEGIN CERTIFICATE-----')[1]
+      cert = cert.split('-----END CERTIFICATE-----')[0]
+      cert.gsub!(/\s+/, "")
+    end
+
+    def format_cert_request(cert_request)
+      cert_request = cert_request.split('-----BEGIN CERTIFICATE REQUEST-----')[1]
+      cert_request = cert_request.split('-----END CERTIFICATE REQUEST-----')[0]
+      cert_request.gsub!(/\s+/, "")
+    end
+
+    def check_validity_against_schema(doc, schema)
+      Dir.chdir(SCHEMA_PATH) do
+        xsd = Nokogiri::XML::Schema(IO.read(schema))
+        unless doc.respond_to?(:canonicalize) && xsd.valid?(doc)
+          errors.add(:base, 'The document did not validate against the schema file')
+        end
+      end
+    end
+
+    # Extracts a certificate from a document and return it as an OpenSSL X509 certificate
+    # Return nil is the node cannot be found
+    def extract_cert(doc, node, namespace)
+      return nil unless doc.respond_to? :at
+
+      cert_raw = doc.at("xmlns|#{node}", 'xmlns' => namespace)
+
+      return nil if cert_raw.nil?
+
+      cert_raw = cert_raw.content.gsub(/\s+/, "")
+
+      cert = process_cert_value(cert_raw)
+
+      begin
+        OpenSSL::X509::Certificate.new(cert)
+      rescue => e
+        fail OpenSSL::X509::CertificateError,
+             "The certificate could not be processed. It's most likely corrupted. OpenSSL had this to say: #{e}."
+      end
+    end
+
+    def cert_request_valid?(cert_request)
+      begin
+        OpenSSL::X509::Request.new cert_request
+      rescue
+        return false
+      end
+
+      true
+    end
+
+    def load_body_template(template)
+      path = "#{template}/"
+
+      case @command
+      when :download_file_list
+        path << "download_file_list.xml"
+      when :get_user_info
+        path << "get_user_info.xml"
+      when :upload_file
+        path << "upload_file.xml"
+      when :download_file
+        path << "download_file.xml"
+      when :get_certificate
+        path << "get_certificate.xml"
+      when :get_bank_certificate
+        path << "danske_get_bank_certificate.xml"
+      when :create_certificate
+        path << "create_certificate.xml"
+      else
+        fail ArgumentError
+      end
+
+      Nokogiri::XML(File.open(path))
+    end
+
+    # Checks that the certificate in the application response is signed with the
+    # private key of the public key of the certificate as parameter.
+    def cert_is_trusted(root_cert)
+      if root_cert.subject == certificate.issuer
+        # Return true or false
+        certificate.verify(root_cert.public_key)
+      else
+        fail SecurityError, "false"
+      end
+    end
+
+    def iso_time
+      @iso_time ||= Time.now.utc.iso8601
+    end
+
+    def hmac(pin, csr)
+      Base64.encode64(OpenSSL::HMAC.digest('sha1', pin, csr)).chop
+    end
+
+    def csr_to_binary(csr)
+      OpenSSL::X509::Request.new(csr).to_der
+    end
+
+    def canonicalized_node(doc, namespace, node)
+      content_node = doc.at("xmlns|#{node}", xmlns: namespace)
+      content_node.canonicalize if content_node
+    end
+
+  end
+end

data/lib/sepa/version.rb

@@ -1,3 +1,3 @@
 module Sepa
-  VERSION = "0.0.2"
+  VERSION = "0.1.0"
 end