sparoid 1.0.0

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml ADDED
@@ -0,0 +1,7 @@
1
+ ---
2
+ SHA256:
3
+ metadata.gz: 97ffed008109eb32f070fc300c536cd29f000c6ff943b67bff64658c218f70ce
4
+ data.tar.gz: 87fcc661eb04ee0a79b9d9cbd4ef12b5f80c8a4c1856569076f1eac57a37c41b
5
+ SHA512:
6
+ metadata.gz: ded717258409725cbf49b97fd9c704dbbe550a024f4ce09b484640306079f67ccfd43f64d063326c787ed700cef4db09179b6facb98c7403304dad0a861216ea
7
+ data.tar.gz: 180a6a9ae33549e198130f73e3e4bd5e9ce4e63727668e6ea2124e22ade18b4e7324efb15abf00053fc22b0728a05d17f49cff353a6f68cdf6b3bf9709b5fab4
@@ -0,0 +1,18 @@
1
+ name: Ruby
2
+
3
+ on: [push,pull_request]
4
+
5
+ jobs:
6
+ build:
7
+ runs-on: ubuntu-latest
8
+ steps:
9
+ - uses: actions/checkout@v2
10
+ - name: Set up Ruby
11
+ uses: ruby/setup-ruby@v1
12
+ with:
13
+ ruby-version: 2.7.2
14
+ - name: Run the default task
15
+ run: |
16
+ gem install bundler -v 2.2.14
17
+ bundle install
18
+ bundle exec rake
data/.gitignore ADDED
@@ -0,0 +1,8 @@
1
+ /.bundle/
2
+ /.yardoc
3
+ /_yardoc/
4
+ /coverage/
5
+ /doc/
6
+ /pkg/
7
+ /spec/reports/
8
+ /tmp/
data/.rubocop.yml ADDED
@@ -0,0 +1,14 @@
1
+ AllCops:
2
+ TargetRubyVersion: 2.4
3
+ NewCops: enable
4
+
5
+ Style/StringLiterals:
6
+ Enabled: true
7
+ EnforcedStyle: double_quotes
8
+
9
+ Style/StringLiteralsInInterpolation:
10
+ Enabled: true
11
+ EnforcedStyle: double_quotes
12
+
13
+ Layout/LineLength:
14
+ Max: 120
data/CHANGELOG.md ADDED
@@ -0,0 +1,5 @@
1
+ ## [Unreleased]
2
+
3
+ ## [1.0.0] - 2021-03-11
4
+
5
+ - Initial release
data/Gemfile ADDED
@@ -0,0 +1,16 @@
1
+ # frozen_string_literal: true
2
+
3
+ source "https://rubygems.org"
4
+
5
+ # Specify your gem's dependencies in sparoid.gemspec
6
+ gemspec
7
+
8
+ gem "rake", "~> 13.0"
9
+
10
+ gem "minitest", "~> 5.0"
11
+
12
+ gem "rubocop", "~> 1.7"
13
+
14
+ gem "rubocop-minitest", require: false
15
+
16
+ gem "rubocop-rake", require: false
data/LICENSE.txt ADDED
@@ -0,0 +1,21 @@
1
+ The MIT License (MIT)
2
+
3
+ Copyright (c) 2021 Carl Hörberg
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in
13
+ all copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
21
+ THE SOFTWARE.
data/README.md ADDED
@@ -0,0 +1,37 @@
1
+ # SPAroid
2
+
3
+ Single Packet Authorization client implementation in Ruby, both a library and a CLI app. SPA sends a single encrypted and HMACed UDP package to a server, the server upon receiving it verifies and decrypts it and then executes a command, most often opening the firewall for the client that sent the package. This allows you to employ a reject-all firewall but open the firewall for e.g. SSH access. It's a first line of defence, in the case of 0-day attacks on SSH or similar.
4
+
5
+ ## Installation
6
+
7
+ Add this line to your application's Gemfile:
8
+
9
+ ```ruby
10
+ gem 'sparoid'
11
+ ```
12
+
13
+ And then execute:
14
+
15
+ $ bundle install
16
+
17
+ Or install it yourself as:
18
+
19
+ $ gem install sparoid
20
+
21
+ ## Usage
22
+
23
+ TODO: Write usage instructions here
24
+
25
+ ## Development
26
+
27
+ After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
28
+
29
+ To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
30
+
31
+ ## Contributing
32
+
33
+ Bug reports and pull requests are welcome on GitHub at https://github.com/84codes/sparoid.rb.
34
+
35
+ ## License
36
+
37
+ The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).
data/Rakefile ADDED
@@ -0,0 +1,16 @@
1
+ # frozen_string_literal: true
2
+
3
+ require "bundler/gem_tasks"
4
+ require "rake/testtask"
5
+
6
+ Rake::TestTask.new(:test) do |t|
7
+ t.libs << "test"
8
+ t.libs << "lib"
9
+ t.test_files = FileList["test/**/*_test.rb"]
10
+ end
11
+
12
+ require "rubocop/rake_task"
13
+
14
+ RuboCop::RakeTask.new
15
+
16
+ task default: %i[test rubocop]
data/bin/console ADDED
@@ -0,0 +1,15 @@
1
+ #!/usr/bin/env ruby
2
+ # frozen_string_literal: true
3
+
4
+ require "bundler/setup"
5
+ require "sparoid"
6
+
7
+ # You can add fixtures and/or initialization code here to make experimenting
8
+ # with your gem easier. You can also use a different console, if you like.
9
+
10
+ # (If you use this, don't forget to add pry to your Gemfile!)
11
+ # require "pry"
12
+ # Pry.start
13
+
14
+ require "irb"
15
+ IRB.start(__FILE__)
data/bin/setup ADDED
@@ -0,0 +1,8 @@
1
+ #!/usr/bin/env bash
2
+ set -euo pipefail
3
+ IFS=$'\n\t'
4
+ set -vx
5
+
6
+ bundle install
7
+
8
+ # Do any other automated setup that you need to do here
data/exe/sparoid ADDED
@@ -0,0 +1,5 @@
1
+ #!/usr/bin/env ruby
2
+ # frozen_string_literal: true
3
+
4
+ require_relative "../lib/sparoid/cli"
5
+ Sparoid::CLI.start
data/lib/sparoid.rb ADDED
@@ -0,0 +1,72 @@
1
+ # frozen_string_literal: true
2
+
3
+ require_relative "sparoid/version"
4
+ require "socket"
5
+ require "openssl"
6
+ require "resolv"
7
+
8
+ # Single Packet Authorisation client
9
+ module Sparoid
10
+ def self.send(key, hmac_key, host, port)
11
+ msg = message(public_ip)
12
+ data = prefix_hmac(hmac_key, encrypt(key, msg))
13
+ udp_send(host, port, data)
14
+ end
15
+
16
+ def self.udp_send(host, port, data)
17
+ socket = UDPSocket.new
18
+ socket.connect host, port
19
+ socket.send data, 0
20
+ socket.close
21
+ end
22
+
23
+ def self.encrypt(key, data)
24
+ key = [key].pack("H*") # hexstring to bytes
25
+ raise ArgumentError, "Key must be 32 bytes hex encoded" if key.bytesize != 32
26
+
27
+ cipher = OpenSSL::Cipher.new("aes-256-cbc")
28
+ cipher.encrypt
29
+ iv = cipher.random_iv
30
+ cipher.key = key
31
+ cipher.iv = iv
32
+ output = iv
33
+ output << cipher.update(data)
34
+ output << cipher.final
35
+ end
36
+
37
+ def self.prefix_hmac(hmac_key, data)
38
+ hmac_key = [hmac_key].pack("H*") # hexstring to bytes
39
+ raise ArgumentError, "HMAC key must be 32 bytes hex encoded" if hmac_key.bytesize != 32
40
+
41
+ hmac = OpenSSL::HMAC.digest("SHA256", hmac_key, data)
42
+ hmac + data
43
+ end
44
+
45
+ def self.message(ip)
46
+ version = 1
47
+ ts = (Time.now.utc.to_f * 1000).floor
48
+ nounce = OpenSSL::Random.random_bytes(16)
49
+ [version, ts, nounce, ip.address].pack("Nq>a16a4")
50
+ end
51
+
52
+ def self.public_ip
53
+ Resolv::DNS.open(nameserver: ["resolver1.opendns.com"]) do |dns|
54
+ dns.each_address("myip.opendns.com") do |resolv|
55
+ case resolv
56
+ when Resolv::IPv4 then return resolv
57
+ end
58
+ end
59
+ raise Error, "No public IPv4 address found"
60
+ end
61
+ end
62
+
63
+ def self.keygen
64
+ cipher = OpenSSL::Cipher.new("aes-256-cbc")
65
+ key = cipher.random_key.unpack1("H*")
66
+ hmac_key = OpenSSL::Random.random_bytes(32).unpack1("H*")
67
+ puts "key = #{key}"
68
+ puts "hmac-key = #{hmac_key}"
69
+ end
70
+
71
+ class Error < StandardError; end
72
+ end
@@ -0,0 +1,37 @@
1
+ # frozen_string_literal: true
2
+
3
+ require "thor"
4
+ require_relative "../sparoid"
5
+
6
+ module Sparoid
7
+ # CLI
8
+ class CLI < Thor
9
+ desc "send HOST [PORT]", "Send a packet"
10
+ method_option :config, default: "~/.sparoid.ini"
11
+ def send(host, port = 8484)
12
+ abort "Config not found" unless File.exist? options[:config]
13
+
14
+ key, hmac_key = get_keys(parse_ini(options[:config]))
15
+ Sparoid.send(key, hmac_key, host, port.to_i)
16
+ end
17
+
18
+ desc "keygen", "Generate an encryption key and a HMAC key"
19
+ def keygen
20
+ Sparoid.keygen
21
+ end
22
+
23
+ def self.exit_on_failure?
24
+ true
25
+ end
26
+
27
+ private
28
+
29
+ def parse_ini(path)
30
+ File.readlines(path).map! { |l| l.split("=", 2).map!(&:strip) }.to_h
31
+ end
32
+
33
+ def get_keys(config)
34
+ config.values_at("key", "hmac-key")
35
+ end
36
+ end
37
+ end
@@ -0,0 +1,5 @@
1
+ # frozen_string_literal: true
2
+
3
+ module Sparoid
4
+ VERSION = "1.0.0"
5
+ end
data/sparoid.gemspec ADDED
@@ -0,0 +1,30 @@
1
+ # frozen_string_literal: true
2
+
3
+ require_relative "lib/sparoid/version"
4
+
5
+ Gem::Specification.new do |spec|
6
+ spec.name = "sparoid"
7
+ spec.version = Sparoid::VERSION
8
+ spec.authors = ["Carl Hörberg"]
9
+ spec.email = ["carl@84codes.com"]
10
+
11
+ spec.summary = "Single Packet Authorisation client"
12
+ spec.homepage = "https://github.com/84codes/sparoid.rb"
13
+ spec.license = "MIT"
14
+ spec.required_ruby_version = Gem::Requirement.new(">= 2.4.0")
15
+
16
+ spec.metadata["homepage_uri"] = spec.homepage
17
+ spec.metadata["source_code_uri"] = spec.homepage
18
+ spec.metadata["changelog_uri"] = "https://raw.githubusercontent.com/84codes/sparoid.rb/main/CHANGELOG.md"
19
+
20
+ # Specify which files should be added to the gem when it is released.
21
+ # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
22
+ spec.files = Dir.chdir(File.expand_path(__dir__)) do
23
+ `git ls-files -z`.split("\x0").reject { |f| f.match(%r{\A(?:test|spec|features)/}) }
24
+ end
25
+ spec.bindir = "exe"
26
+ spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
27
+ spec.require_paths = ["lib"]
28
+
29
+ spec.add_dependency "thor"
30
+ end
metadata ADDED
@@ -0,0 +1,76 @@
1
+ --- !ruby/object:Gem::Specification
2
+ name: sparoid
3
+ version: !ruby/object:Gem::Version
4
+ version: 1.0.0
5
+ platform: ruby
6
+ authors:
7
+ - Carl Hörberg
8
+ autorequire:
9
+ bindir: exe
10
+ cert_chain: []
11
+ date: 2021-03-11 00:00:00.000000000 Z
12
+ dependencies:
13
+ - !ruby/object:Gem::Dependency
14
+ name: thor
15
+ requirement: !ruby/object:Gem::Requirement
16
+ requirements:
17
+ - - ">="
18
+ - !ruby/object:Gem::Version
19
+ version: '0'
20
+ type: :runtime
21
+ prerelease: false
22
+ version_requirements: !ruby/object:Gem::Requirement
23
+ requirements:
24
+ - - ">="
25
+ - !ruby/object:Gem::Version
26
+ version: '0'
27
+ description:
28
+ email:
29
+ - carl@84codes.com
30
+ executables:
31
+ - sparoid
32
+ extensions: []
33
+ extra_rdoc_files: []
34
+ files:
35
+ - ".github/workflows/main.yml"
36
+ - ".gitignore"
37
+ - ".rubocop.yml"
38
+ - CHANGELOG.md
39
+ - Gemfile
40
+ - LICENSE.txt
41
+ - README.md
42
+ - Rakefile
43
+ - bin/console
44
+ - bin/setup
45
+ - exe/sparoid
46
+ - lib/sparoid.rb
47
+ - lib/sparoid/cli.rb
48
+ - lib/sparoid/version.rb
49
+ - sparoid.gemspec
50
+ homepage: https://github.com/84codes/sparoid.rb
51
+ licenses:
52
+ - MIT
53
+ metadata:
54
+ homepage_uri: https://github.com/84codes/sparoid.rb
55
+ source_code_uri: https://github.com/84codes/sparoid.rb
56
+ changelog_uri: https://raw.githubusercontent.com/84codes/sparoid.rb/main/CHANGELOG.md
57
+ post_install_message:
58
+ rdoc_options: []
59
+ require_paths:
60
+ - lib
61
+ required_ruby_version: !ruby/object:Gem::Requirement
62
+ requirements:
63
+ - - ">="
64
+ - !ruby/object:Gem::Version
65
+ version: 2.4.0
66
+ required_rubygems_version: !ruby/object:Gem::Requirement
67
+ requirements:
68
+ - - ">="
69
+ - !ruby/object:Gem::Version
70
+ version: '0'
71
+ requirements: []
72
+ rubygems_version: 3.1.4
73
+ signing_key:
74
+ specification_version: 4
75
+ summary: Single Packet Authorisation client
76
+ test_files: []