slosilo 0.1.2 → 0.2.2

data/lib/slosilo/adapters/file_adapter.rb

@@ -0,0 +1,34 @@
+require 'slosilo/adapters/abstract_adapter'
+
+module Slosilo
+  module Adapters
+    class FileAdapter < AbstractAdapter
+      attr_reader :dir
+      
+      def initialize(dir)
+        @dir = dir
+        @keys = {}
+        Dir[File.join(@dir, "*.key")].each do |f|
+          key = Slosilo::EncryptedAttributes.decrypt File.read(f)
+          @keys[File.basename(f, '.key')] = key
+        end
+      end
+      
+      def put_key id, value
+        raise "id should not contain a period" if id.index('.')
+        fname = File.join(dir, "#{id}.key")
+        File.write(fname, Slosilo::EncryptedAttributes.encrypt(value))
+        File.chmod(0400, fname)
+        @keys[id] = value
+      end
+      
+      def get_key id
+        @keys[id]
+      end
+      
+      def each(&block)
+        @keys.each(&block)
+      end
+    end
+  end
+end

data/lib/slosilo/adapters/sequel_adapter/migration.rb

@@ -15,7 +15,10 @@ module Slosilo
 
     # Create the table for holding keys
     def create_keystore_table
-      create_table keystore_table do
+      # docs say to not use create_table? in migration;
+      # but we really want this to be robust in case there are any previous installs
+      # and we can't use table_exists? because it rolls back
+      create_table? keystore_table do
         String :id, primary_key: true
         # Note: currently only postgres is supported
         bytea :key, null: false

data/lib/slosilo/attr_encrypted.rb

@@ -56,4 +56,4 @@ module Slosilo
   end
 end
 
-Object.send:include, Slosilo::EncryptedAttributes
+Object.send :include, Slosilo::EncryptedAttributes

data/lib/slosilo/key.rb

@@ -58,12 +58,15 @@ module Slosilo
     def signed_token data
       token = { "data" => data, "timestamp" => Time.new.utc.to_s }
       token["signature"] = Base64::urlsafe_encode64(sign token)
+      token["key"] = fingerprint
       token
     end
     
     def token_valid? token, expiry = 8 * 60
       token = token.clone
       signature = Base64::urlsafe_decode64(token.delete "signature")
+      expected_key = token.delete "key"
+      return false if expected_key and expected_key != fingerprint
       (Time.parse(token["timestamp"]) + expiry > Time.now) && verify_signature(token, signature)
     end
     
@@ -72,6 +75,10 @@ module Slosilo
       key.private_encrypt(hash_function.digest(_salt + value)) + _salt
     end
     
+    def fingerprint
+      OpenSSL::Digest::MD5.hexdigest key.public_key.to_der
+    end
+    
     private
     def stringify value
       case value

data/lib/slosilo/keystore.rb

@@ -15,18 +15,15 @@ module Slosilo
       key && Key.new(key)
     end
     
-    def each(&block)
-      adapter.each(&block)
+    def each &_
+      adapter.each { |k, v| yield k, Key.new(v) }
     end
     
     def any? &block
-      catch :found do
-        adapter.each do |id, k|
-          throw :found if block.call(Key.new(k))
-        end
-        return false
+      each do |_, k|
+        return true if yield k
       end
-      true
+      return false
     end
   end
   
@@ -51,6 +48,13 @@ module Slosilo
       keystore.any? { |k| k.token_valid? token }
     end
     
+    def token_signer token
+      each do |id, key|
+        return id if key.token_valid? token
+      end
+      return nil
+    end
+    
     attr_accessor :adapter
     
     private

data/lib/slosilo/version.rb

@@ -1,3 +1,3 @@
 module Slosilo
-  VERSION = "0.1.2"
+  VERSION = "0.2.2"
 end

data/spec/file_adapter_spec.rb

@@ -0,0 +1,72 @@
+require 'spec_helper'
+
+require 'slosilo/adapters/file_adapter'
+
+describe Slosilo::Adapters::FileAdapter do
+  let(:dir) {
+    require 'tmpdir' 
+    Dir.mktmpdir 
+  }
+  let(:adapter) { Slosilo::Adapters::FileAdapter.new dir }
+  subject { adapter }
+  
+  describe "#get_key" do
+    context "when given key does not exist" do
+      it "returns nil" do
+        subject.get_key(:whatever).should_not be
+      end
+    end
+  end
+  
+  describe "#put_key" do
+    let(:key) { "key" }
+    context "unacceptable id" do
+      let(:id) { "foo.bar" }
+      it "isn't accepted" do
+        lambda { subject.put_key id, key }.should raise_error
+      end    
+    end
+    context "acceptable id" do
+      let(:id) { "id" }
+      let(:key_encrypted) { "encrypted key" }
+      let(:fname) { "#{dir}/#{id}.key" }
+      it "creates the key" do
+        Slosilo::EncryptedAttributes.should_receive(:encrypt).with(key).and_return key_encrypted
+        File.should_receive(:write).with(fname, key_encrypted)
+        File.should_receive(:chmod).with(0400, fname)
+        subject.put_key id, key
+        subject.instance_variable_get("@keys")[id].should == key
+      end    
+    end
+  end
+  
+  describe "#each" do
+    before { adapter.instance_variable_set("@keys", one: :onek, two: :twok) }
+    
+    it "iterates over each key" do
+      results = []
+      adapter.each { |id,k| results << { id => k } }
+      results.should == [ { one: :onek}, {two: :twok } ]
+    end
+  end
+  
+  describe 'key store' do
+    let(:key) { 'fake key' }
+    let(:id) { 'some id' }
+
+    before do
+      Slosilo::encryption_key = Slosilo::Symmetric.new.random_key
+      pre_adapter = Slosilo::Adapters::FileAdapter.new dir
+      pre_adapter.put_key(id, key)
+    end
+      
+    it "loads and decrypts the key" do
+      adapter.get_key(id).should == key
+    end
+    it "enumerates the keys" do
+      results = []
+      adapter.each { |id,k| results << { id => k } }
+      results.should == [ { id => key } ]
+    end
+  end
+end

data/spec/key_spec.rb

@@ -6,6 +6,7 @@ describe Slosilo::Key do
   subject { key }
   its(:to_der) { should == rsa.to_der }
   its(:to_s) { should == rsa.public_key.to_pem }
+  its(:fingerprint) { should == key_fingerprint }
   
   let(:plaintext) { 'quick brown fox jumped over the lazy dog' }
   describe '#encrypt' do
@@ -79,7 +80,7 @@ describe Slosilo::Key do
     let(:signature) { "signature" }
     let(:salt) { 'a pinch of salt' }
     let(:expected_signature) { Base64::urlsafe_encode64 "\xB0\xCE{\x9FP\xEDV\x9C\xE7b\x8B[\xFAil\x87^\x96\x17Z\x97\x1D\xC2?B\x96\x9C\x8Ep-\xDF_\x8F\xC21\xD9^\xBC\n\x16\x04\x8DJ\xF6\xAF-\xEC\xAD\x03\xF9\xEE:\xDF\xB5\x8F\xF9\xF6\x81m\xAB\x9C\xAB1\x1E\x837\x8C\xFB\xA8P\xA8<\xEA\x1Dx\xCEd\xED\x84f\xA7\xB5t`\x96\xCC\x0F\xA9t\x8B\x9Fo\xBF\x92K\xFA\xFD\xC5?\x8F\xC68t\xBC\x9F\xDE\n$\xCA\xD2\x8F\x96\x0EtX2\x8Cl\x1E\x8Aa\r\x8D\xCAi\x86\x1A\xBD\x1D\xF7\xBC\x8561j\x91YlO\xFA(\x98\x10iq\xCC\xAF\x9BV\xC6\v\xBC\x10Xm\xCD\xFE\xAD=\xAA\x95,\xB4\xF7\xE8W\xB8\x83;\x81\x88\xE6\x01\xBA\xA5F\x91\x17\f\xCE\x80\x8E\v\x83\x9D<\x0E\x83\xF6\x8D\x03\xC0\xE8A\xD7\x90i\x1D\x030VA\x906D\x10\xA0\xDE\x12\xEF\x06M\xD8\x8B\xA9W\xC8\x9DTc\x8AJ\xA4\xC0\xD3!\xFA\x14\x89\xD1p\xB4J7\xA5\x04\xC2l\xDC8<\x04Y\xD8\xA4\xFB[\x89\xB1\xEC\xDA\xB8\xD7\xEA\x03Ja pinch of salt" }
-    let(:expected_token) { { "data" => data, "timestamp" => "2012-01-01 01:01:01 UTC", "signature" => expected_signature } }
+    let(:expected_token) { token_to_sign.merge "signature" => expected_signature, "key" => key_fingerprint }
     before do
       key.stub salt: salt
       Time.stub new: time
@@ -95,6 +96,15 @@ describe Slosilo::Key do
     before { Time.stub now: Time.new(2012,1,1,1,2,1,0) }
     subject { key.token_valid? token }
     it { should be_true }
+    
+    it "doesn't check signature on the advisory key field" do
+      key.token_valid?(token.merge "key" => key_fingerprint).should be_true
+    end
+    
+    it "rejects the token if the key field is present and doesn't match" do
+      key.token_valid?(token.merge "key" => "this is not the key you are looking for").should_not be_true
+    end
+    
     context "when token is 1 hour old" do
       before { Time.stub now: Time.new(2012,1,1,2,1,1,0) }
       it { should be_false }

data/spec/slosilo_spec.rb

@@ -55,4 +55,23 @@ describe Slosilo do
       it { should be_true }
     end
   end
+  
+  describe '.token_signer' do
+    let(:token) { double "token" }
+    let(:key_one) { double "key", token_valid?: false }
+    let(:other_key) { double "another key", token_valid?: false }
+    
+    before do
+      subject.stub(:each).and_yield('test', key_one).and_yield('other', other_key)
+    end
+    
+    it "returns nil when token doesn't have a valid signature from any known key" do
+      subject.token_signer(token).should_not be
+    end
+    
+    it "returns the name of the key which validates the token" do
+      other_key.stub(:token_valid?).with(token).and_return true
+      subject.token_signer(token).to_s.should == 'other'
+    end
+  end
 end

data/spec/spec_helper.rb

@@ -41,6 +41,7 @@ Dg1ikwi8GUF4HPZe9DyhXgDhg19wM/qcpjX8bSypsUWHWP+FanhjdWU=
 -----END RSA PRIVATE KEY-----
         """ }
   let (:key) { Slosilo::Key.new rsa.to_der }
+  let (:key_fingerprint) { "d28e3a347e368416b3129a40c1b887fe" }
   
   def self.mock_own_key
     before { Slosilo.stub(:[]).with(:own).and_return key }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: slosilo
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.2
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-03-12 00:00:00.000000000 Z
+date: 2013-04-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -122,6 +122,7 @@ files:
 - Rakefile
 - lib/slosilo.rb
 - lib/slosilo/adapters/abstract_adapter.rb
+- lib/slosilo/adapters/file_adapter.rb
 - lib/slosilo/adapters/mock_adapter.rb
 - lib/slosilo/adapters/sequel_adapter.rb
 - lib/slosilo/adapters/sequel_adapter/migration.rb
@@ -135,6 +136,7 @@ files:
 - lib/slosilo/version.rb
 - lib/tasks/slosilo.rake
 - slosilo.gemspec
+- spec/file_adapter_spec.rb
 - spec/http_request_spec.rb
 - spec/http_stack_spec.rb
 - spec/key_spec.rb
@@ -165,7 +167,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 40977695530656319
+      hash: 2238471852209156981
 requirements: []
 rubyforge_project: 
 rubygems_version: 1.8.24
@@ -173,6 +175,7 @@ signing_key:
 specification_version: 3
 summary: Store SSL keys in a database
 test_files:
+- spec/file_adapter_spec.rb
 - spec/http_request_spec.rb
 - spec/http_stack_spec.rb
 - spec/key_spec.rb