smaak 0.0.6 → 0.0.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 79837f66e4da4cd06c198b68f4ed72c059b3f0b5
-  data.tar.gz: ce28822db26ceb509362dd03e66da05971b14e8f
+  metadata.gz: b1fa033c8f361f4af863c394544ffd64c8a9d9d0
+  data.tar.gz: fcccba2f5edd21f6112754588e86f34fccc72871
 SHA512:
-  metadata.gz: 887a641de2a26636eb03a6ffba6f8fde13f43bd2d7563380688fe0d4d129d4630c66594b1ab1aa65d9d3f7d22894b779bd87797ccce42202d2f5039caaf0f7b6
-  data.tar.gz: cde62c30f2a56a78acd2de3df92b349e563bfe3c4c34384ff593692a45c4a32d80f7ea575069bfecee62b28b146b8a5f580ddf044b0e0cde289162a63cd4973b
+  metadata.gz: 3e70ec242a2eb128ae0e63363b4828f7f35bec12057f5be3cd9110063b6fbcf16327c6554571044906ed35a6ca9c7e4145f29f1167c5b5a0893589ee9f374618
+  data.tar.gz: 3a77ea6150c62382e5c01ebcb6e7362a5f8d926660cf212828f782d994aa51d316eaf7c337d683843c87a4efd1db50169c6bad65450953c975df425a63ea913e

data/README.md

@@ -18,11 +18,11 @@ Or install it yourself as:
 
 ## Use cases
 
-This gem and mechanism is attempts to alleviate the following attacks and concerns for inter-service communication. This is not a public client/server mechanism.
+This gem and mechanism attempts to alleviate the following attacks and concerns for inter-service communication. This is not a public client/server mechanism.
 
 Man-in-the-middle attack:
 
-Use this gem to communicate inside an HTTP tunnel that you trust. For internal private networks, place a secure CA on your network.
+Use this gem to communicate inside an HTTPS tunnel that you trust. For internal private networks, place a secure CA on your network.
 
 Masquerading:
 
@@ -36,7 +36,9 @@ Replay:
 
 The request is signed with an expiry and a nonce.
 
-Designing for future protocol security requirements. The nonce and expiry are optional features. Passing in a RequestData object for signing, and a RequestSigningValidator object that validates the data content includes all that is required for security, allows us to, in future, cater for man-in-the-middle attacks as well if, for example, the validator requires timestamp, url, form data/querystring, method, etc. to be in the data. If this is all signed, a device in the middle cannot modify the request without the source's private key, and man-in-the-middle is defeated.
+Designing for future protocol security requirements. The nonce and expiry becomes an optional feature (timestamp header signed could replace these). Passing in a RequestData object for signing, and a RequestSigningValidator object that validates the data content includes all that is required for security, allows us to, in future, cater for man-in-the-middle attacks as well if, for example, the validator requires timestamp, url, form data/querystring, method, etc. to be in the data. If this is all signed, a device in the middle cannot modify the request without the source's private key, and man-in-the-middle is defeated.
+
+Though arbitrary data can be added for signature and an arbitrary validator provided to ensure the data and headers required are included for signing on request, on the server side the payload is not automatically checked by the Smaak::Server class. Ensure after verification of signature that you look in message_data['data'] and verify your payload has what you require to prove no man-in-the middle modification. This could be automated in a future release.
 
 ## Usage
 

data/lib/smaak/client.rb

@@ -1,5 +1,6 @@
 require 'smaak.rb'
 require 'smaak/associate.rb'
+require 'smaak/request_signing_validator.rb'
 
 module Smaak
   class Client < Associate
@@ -14,11 +15,15 @@ module Smaak
       @identity = identity
     end
 
-    def build_auth_header(associate_identity, request_signing_data = nil, request_signing_data_validator = nil)
+    def build_auth_header(associate_identity,
+                          request_signing_data = {},
+                          request_signing_data_validator = RequestSigningValidator.new)
       raise ArgumentError.new("Associate invalid") if not validate_associate(associate_identity)
+      request_signing_data_validator.validate(request_signing_data)
       associate = @association_store[associate_identity]
-      message_data = Smaak::compile_auth_message_data(associate['public_key'], associate['psk'], @token_life, @identity)
+      message_data = Smaak::compile_auth_message_data(associate['public_key'], associate['psk'], @token_life, @identity, request_signing_data)
       signature = Smaak::sign_message_data(message_data, @key)
+      #TBD add request_signing_data approved by validator here
       message = Smaak::build_message(message_data)
       auth_body = { 'message' => message,
                     'signature' => Base64.encode64(signature) }

data/lib/smaak/request_signing_validator.rb

@@ -0,0 +1,20 @@
+module Smaak
+  class RequestSigningValidator
+    def validate(data)
+      raise ArgumentError.new("Request data needs to be a Hash") if not data.is_a? Hash
+      ensure_present(data, "HTTPRequestMethod")
+      ensure_present(data, "CanonicalURI")
+      ensure_present(data, "CanonicalQueryString")
+      ensure_present(data, "CanonicalHeaders")
+      ensure_present(data, "SignedHeaders")
+      ensure_present(data, "RequestPayload")
+    end
+
+    private
+
+    def ensure_present(data, key)
+#      raise ArgumentError.new("Request data needs to include #{key}") if data[key].nil?
+      puts "WARNING: Request data needs to include #{key}" if data[key].nil?
+    end
+  end
+end

data/lib/smaak/version.rb

@@ -1,3 +1,3 @@
 module Smaak
-  VERSION = "0.0.6"
+  VERSION = "0.0.7"
 end

data/lib/smaak.rb

@@ -22,12 +22,13 @@ module Smaak
     SecureRandom::random_number(10000000000)
   end
 
-  def self.compile_auth_message_data(recipient_public_key, recipient_psk, token_life, identity)
+  def self.compile_auth_message_data(recipient_public_key, recipient_psk, token_life, identity, request_signing_data)
     { 'recipient' => recipient_public_key.export,
       'identity' => identity,
       'psk' => Smaak::obfuscate_psk(recipient_psk),
       'expires' => Time.now.to_i + token_life,
-      'nonce' => Smaak::generate_nonce }
+      'nonce' => Smaak::generate_nonce,
+      'data' => request_signing_data }
   end
 end
 

data/spec/lib/smaak/client_spec.rb

@@ -8,6 +8,7 @@ describe Smaak::Client do
     @test_client_private_key = OpenSSL::PKey::RSA.new(4096)
     @test_service_private_key = OpenSSL::PKey::RSA.new(4096)
     @test_service_public_key = @test_service_private_key.public_key
+    @test_data = {}
     @iut = Smaak::Client.new
     @test_identity = 'test-client'
     @test_token_life = 5
@@ -37,13 +38,13 @@ describe Smaak::Client do
     end
 
     it "should compile the auth message data using the associate details" do
-      expect(Smaak).to receive(:compile_auth_message_data).with(@test_service_public_key, @test_service_psk, @test_token_life, @test_identity)
+      expect(Smaak).to receive(:compile_auth_message_data).with(@test_service_public_key, @test_service_psk, @test_token_life, @test_identity, @test_data)
       @iut.build_auth_header(@test_service_identity)
     end
 
     it "should build the message" do
       expect(Smaak).to receive(:generate_nonce).twice().and_return(12345)
-      test_message_data = Smaak::compile_auth_message_data(@test_service_public_key, @test_service_psk, @test_token_life, @test_identity)
+      test_message_data = Smaak::compile_auth_message_data(@test_service_public_key, @test_service_psk, @test_token_life, @test_identity, @test_data)
       expect(Smaak).to receive(:build_message).with(test_message_data)
       expect{
         @iut.build_auth_header(@test_service_identity)
@@ -52,7 +53,7 @@ describe Smaak::Client do
 
     it "should sign the message" do
       expect(Smaak).to receive(:generate_nonce).twice().and_return(12345)
-      test_message_data = Smaak::compile_auth_message_data(@test_service_public_key, @test_service_psk, @test_token_life, @test_identity)
+      test_message_data = Smaak::compile_auth_message_data(@test_service_public_key, @test_service_psk, @test_token_life, @test_identity, @test_data)
       expect(Smaak).to receive(:sign_message_data).with(test_message_data, @test_client_private_key)
       expect{
         @iut.build_auth_header(@test_service_identity)
@@ -61,7 +62,7 @@ describe Smaak::Client do
 
     it "should place the message and its signature (encoded base64) in a JSON dictionary" do
       expect(Smaak).to receive(:generate_nonce).twice().and_return(12345)
-      test_message_data = Smaak::compile_auth_message_data(@test_service_public_key, @test_service_psk, @test_token_life, @test_identity)
+      test_message_data = Smaak::compile_auth_message_data(@test_service_public_key, @test_service_psk, @test_token_life, @test_identity, @test_data)
       test_signature = Smaak::sign_message_data(test_message_data, @test_client_private_key)
       test_message = Smaak::build_message(test_message_data)
       test_envelope = { 'message' => test_message, 'signature' => Base64.encode64(test_signature) }.to_json

data/spec/lib/smaak_spec.rb

@@ -57,10 +57,11 @@ describe Smaak do
       @associate_psk = 'sharedsecret'
       @token_life = 3
       @identity = 'test-service'
+      @test_data = {}
     end
 
     before :each do
-      @iut = Smaak::compile_auth_message_data(@associate_public_key, @associate_psk, @token_life, @identity)
+      @iut = Smaak::compile_auth_message_data(@associate_public_key, @associate_psk, @token_life, @identity, @test_data)
       @timestamp = Time.now.to_i
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: smaak
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.0.7
 platform: ruby
 authors:
 - Ernst van Graan
@@ -140,6 +140,7 @@ files:
 - lib/smaak/associate.rb
 - lib/smaak/auth_message.rb
 - lib/smaak/client.rb
+- lib/smaak/request_signing_validator.rb
 - lib/smaak/server.rb
 - lib/smaak/version.rb
 - smaak.gemspec