-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.rb
171 lines (136 loc) · 4.88 KB
/
main.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
require 'base64'
require 'json'
require 'openssl'
require 'sinatra'
require 'sinatra/json'
require 'sqlite3'
require 'rack/contrib'
require 'sinatra/reloader' if development?
# we need to wrap this whole thing if both fields are not in env, don't want
# to both asking for security at all
if ENV['HTTP_BASIC_USER'] || ENV['HTTP_BASIC_PASS']
use Rack::Auth::Basic, "Restricted Area" do |username, password|
(username == ENV['HTTP_BASIC_USER'] || ENV['HTTP_BASIC_USER'].nil?) &&
(password == ENV['HTTP_BASIC_PASS'] || ENV['HTTP_BASIC_PASS'].nil?)
end
end
$db = SQLite3::Database.new(ENV['SQLITE_FILE_LOCATION'] || "keypairs.db")
$db.execute <<-SQL
CREATE TABLE IF NOT EXISTS keypairs (
id INTEGER PRIMARY KEY,
name text,
public_key text,
private_key text
);
SQL
## if you want to change the key or the cipher, here is the place to do it.
def new_keypair
key = OpenSSL::PKey::RSA.new 2048
public_key = key.public_key.to_pem
if ENV['PRIVATE_KEY_PASSPHRASE']
cipher = OpenSSL::Cipher.new 'AES-128-CBC'
private_key = key.export(cipher, ENV['PRIVATE_KEY_PASSPHRASE'])
else
private_key = key.to_pem
end
[public_key, private_key]
end
def find_keypair id
query = $db.prepare("SELECT * FROM keypairs WHERE id = ?")
query.bind_param 1, id
result = query.execute
record = result.next_hash
not_found(json({ error: "No keypair with id '#{id}' found" })) if record.nil?
record
end
def load_key id
record = find_keypair id
begin
OpenSSL::PKey::RSA.new(record['private_key'], ENV['PRIVATE_KEY_PASSPHRASE'])
rescue OpenSSL::PKey::RSAError
halt(500, json(error:"Cannot unlock private record. Please ensure ENV['PRIVATE_KEY_PASSPHRASE'] was not changed!"))
end
end
def process_payload(operation, id, payload)
if operation == "verify"
halt(422, json(error:"invalid payload - payload must be hash or array")) unless payload.is_a?(Hash) || payload.is_a?(Array)
else
halt(422, json(error:"invalid payload - payload must be string or array")) unless payload.is_a?(String) || payload.is_a?(Array)
end
key = load_key(id)
digest = OpenSSL::Digest::SHA256.new
payload = [payload] if payload.is_a? String
payload = [payload] if payload.is_a? Hash
response = payload.map do |element|
case operation
when "sign"
Base64.encode64(key.sign(digest,element))
when "verify"
halt(422, json(error:"verify must pass in signature and document in hash")) unless element.is_a? Hash
halt(422, json(error:"verify must pass in signature and document in hash")) if element['signature'].nil?
halt(422, json(error:"verify must pass in signature and document in hash")) if element['document'].nil?
key.verify(digest, Base64.decode64(element['signature']), element['document'])
when "encrypt"
Base64.encode64(key.public_encrypt(element))
when "decrypt"
key.private_decrypt(Base64.decode64(element))
else
halt(500, json(error:"Unknown/Invalid operation #{operation}"))
end
end
return response.first if response.length == 1
response
end
use Rack::PostBodyContentTypeParser
# suppress sinatras jazzy 404 page (sorry sinatra)
not_found do
"Not Found"
end
get '/' do
'<html><head><title>Pubkey RESTful Microservice</title><body><img src="https://www.puppyfaqs.com/wp-content/uploads/2018/09/how-much-do-puppies-sleep-at-8-weeks-1020x520.jpg"></body></html>'
end
post '/' do
public_key, private_key = new_keypair
query = $db.execute("INSERT INTO keypairs (name, public_key, private_key) VALUES ( ?, ?, ?)", params['name'], public_key, private_key )
id = $db.last_insert_row_id
json( {key: { id: id, name: params['name'], public_key: public_key }})
end
get '/:id' do
record = find_keypair(params[:id])
record.delete('private_key')
record.delete('public_key')
json(record)
end
get '/:id/public_key' do
content_type 'text/plain'
record = find_keypair(params[:id])
record['public_key']
end
get '/:id/checksum' do
content_type 'text/plain'
record = find_keypair(params[:id])
sha256 = OpenSSL::Digest::SHA256.new
sha256.hexdigest(record['private_key'])
end
if ENV['PRIVATE_KEY_ACCESSIBLE'] == 'true'
get '/:id/private_key' do
record = find_keypair(params[:id])
record['private_key']
end
end
post '/:id/sign' do
halt(422, json(error:"Missing payload")) if params['payload'].nil?
json(result: process_payload('sign', params['id'], params['payload']))
end
post '/:id/verify' do
halt(422, json(error:"Missing payload")) if params['payload'].nil?
json(result: process_payload('verify', params['id'], params['payload']))
end
post '/:id/encrypt' do
halt(422, json(error:"Missing payload")) if params['payload'].nil?
json(result: process_payload('encrypt', params['id'], params['payload']))
end
post '/:id/decrypt' do
halt(422, json(error:"Missing payload")) if params['payload'].nil?
json(result: process_payload('decrypt', params['id'], params['payload']))
end