yubikey 1.3.1 → 1.4.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: e4aaad8f3b9a983633ccfe8f0b0a1ad3cfef9e8c
+  data.tar.gz: f2ed25594b25522b8110ce194b25852d5743bacb
+SHA512:
+  metadata.gz: 7eae97ec5cca53de8b555e582a296191a1b91b86db8e89a7a33345e6bff11bb8296a891c9793089b1a379c47f6323aa31609ffa1d4be889484c249beb34c04ab
+  data.tar.gz: f1c7c525aa464b54072d46cdc17f83a93e9ac33da1dd4f9bbf1a147740b10ffa4d679d91d5ea96e7131f8d5c23d365da7006e265a53f1a75289ab6c4af630807

data/lib/yubikey/configuration.rb

@@ -4,14 +4,22 @@ module Yubikey
     # An array of valid keys in the options hash when configuring a Yubikey::OTP::Verify
     VALID_OPTIONS_KEYS = [
       :api_id,
+      :url,
       :api_key,
+      :certificate_chain,
     ].freeze
 
+    # By default, we want to point to Yubicloud
+    DEFAULT_API_URL           = 'https://api.yubico.com/wsapi/2.0/'
+
     # By default, don't have an api_id
-    DEFAULT_API_ID = nil
+    DEFAULT_API_ID            = nil
 
     # By default, don't have an api_key
-    DEFAULT_API_KEY = nil
+    DEFAULT_API_KEY           = nil
+
+    # Default location of the Yubico certificate chain
+    DEFAULT_CERTIFICATE_CHAIN = File.join(File.dirname(__FILE__), '../cert/chain.pem')
 
     # @private
     attr_accessor *VALID_OPTIONS_KEYS
@@ -35,8 +43,10 @@ module Yubikey
 
     # Reset all configuration options to defaults
     def reset
-      self.api_id  = DEFAULT_API_ID
-      self.api_key = DEFAULT_API_KEY
+      self.api_id            = DEFAULT_API_ID
+      self.url               = DEFAULT_API_URL
+      self.api_key           = DEFAULT_API_KEY
+      self.certificate_chain = DEFAULT_CERTIFICATE_CHAIN
     end
   end
-end
+end

data/lib/yubikey/otp.rb

@@ -22,6 +22,8 @@ class Yubikey::OTP
   # [+otp+] ModHex encoded Yubikey OTP (at least 32 characters)
   # [+key+] 32-character hex AES key
   def initialize(otp, key)
+    raise InvalidOTPError, 'OTP must be at least 32 characters of modhex' unless otp.modhex? && otp.length >= 32
+    raise InvalidKeyError, 'Key must be 32 hex characters' unless key.hex? && key.length == 32
 
     # Get the public ID first
     @public_id = otp[0, 12]
@@ -29,10 +31,6 @@ class Yubikey::OTP
     # Strip prefix so otp will decode (following from yubico-c library)
     otp = otp[-32,32] if otp.length > 32
 
-    raise InvalidOTPError, 'OTP must be at least 32 characters of modhex' unless otp.modhex? && otp.length >= 32
-    raise InvalidKeyError, 'Key must be 32 hex characters' unless key.hex? && key.length == 32
-
-
     @token = Yubikey::ModHex.decode(otp[-32,32])
     @aes_key = key.to_bin
 

data/lib/yubikey/otp_verify.rb

@@ -1,10 +1,10 @@
 require 'base64'
 require 'securerandom'
+require "net/http"
+require "uri"
 
 module Yubikey
   
-  API_URL = 'https://api.yubico.com/wsapi/2.0/'
-
   class OTP::Verify
     # The raw status from the Yubico server
     attr_reader :status
@@ -12,14 +12,18 @@ module Yubikey
     def initialize(args)
       @api_key = args[:api_key] || Yubikey.api_key
       @api_id  = args[:api_id]  || Yubikey.api_id
+      
       raise(ArgumentError, "Must supply API ID") if @api_id.nil?
       raise(ArgumentError, "Must supply API Key") if @api_key.nil?
-
       raise(ArgumentError, "Must supply OTP") if args[:otp].nil?
 
-      @url = args[:url] || API_URL
+      @url = args[:url] || Yubikey.url
       @nonce = args[:nonce] || OTP::Verify.generate_nonce(32)
-
+      
+      @certificate_chain = args[:certificate_chain] || Yubikey.certificate_chain
+      @cert_store = OpenSSL::X509::Store.new
+      @cert_store.add_file @certificate_chain
+      
       verify(args)
     end
     
@@ -41,7 +45,8 @@ module Yubikey
       
       http = Net::HTTP.new(uri.host, uri.port)
       http.use_ssl = true
-      http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+      http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+      http.cert_store = @cert_store
       
       req = Net::HTTP::Get.new(uri.request_uri)
       result = http.request(req).body
@@ -59,7 +64,6 @@ module Yubikey
     end
 
     def verify_response(result)
-
       signature = result[/^h=(.+)$/, 1].strip
       returned_nonce = result[/nonce=(.+)$/, 1]
       returned_nonce.strip! unless returned_nonce.nil?

metadata

@@ -1,8 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yubikey
 version: !ruby/object:Gem::Version
-  version: 1.3.1
-  prerelease: 
+  version: 1.4.0
 platform: ruby
 authors:
 - Jonathan Rudenberg
@@ -32,6 +31,7 @@ files:
 - README.md
 homepage: https://github.com/titanous/yubikey
 licenses: []
+metadata: {}
 post_install_message: 
 rdoc_options:
 - --title
@@ -41,21 +41,20 @@ rdoc_options:
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: yubikey
-rubygems_version: 1.8.25
+rubygems_version: 2.0.14
 signing_key: 
-specification_version: 3
+specification_version: 4
 summary: Yubikey library for Ruby
 test_files: []
+has_rdoc: