Class: RightScale::EnrollmentResult

Inherits:
Object
  • Object
show all
Includes:
ProtocolVersionMixin
Defined in:
lib/right_agent/enrollment_result.rb

Defined Under Namespace

Classes: IntegrityFailure, VersionError

Constant Summary collapse

SUPPORTED_VERSIONS =

Versions 5 and above use an identical format for the enrollment result

5..AgentConfig.protocol_version

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Methods included from ProtocolVersionMixin

#can_handle_http?, #can_handle_msgpack_result?, #can_handle_multicast_result?, #can_handle_non_delivery_result?, #can_handle_non_nanite_ids?, #can_handle_request_retries?, #can_put_version_in_packet?, #can_route_to_response_queue?, #can_use_router_query_tags?

Constructor Details

#initialize(r_s_version, timestamp, router_cert, id_cert, id_key, secret) ⇒ EnrollmentResult

Create a new instance of this class

Parameters

timestamp(Time)

Timestamp associated with this result

router_cert(String)

Arbitrary string

id_cert(String)

Arbitrary string

id_key(String)

Arbitrary string

secret(String)

Shared secret with which the result is encrypted



37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
 
# File 'lib/right_agent/enrollment_result.rb', line 37

def initialize(r_s_version, timestamp, router_cert, id_cert, id_key, secret)
  @r_s_version = r_s_version
  @timestamp   = timestamp.utc
  @router_cert = router_cert
  @id_cert     = id_cert
  @id_key      = id_key
  @serializer  = Serializer.new(can_handle_msgpack_result?(r_s_version) ? :msgpack : :json)

  cert_name = can_handle_http?(r_s_version) ? 'router_cert' : 'mapper_cert'
  msg = @serializer.dump({
    cert_name => @router_cert.to_s,
    'id_cert' => @id_cert,
    'id_key'  => @id_key
  })

  key        = EnrollmentResult.derive_key(secret, @timestamp.to_i.to_s)
  #TODO switch to new OpenSSL API once we move to Ruby 1.8.7
  #cipher     = OpenSSL::Cipher.new("aes-256-cbc")
  cipher     = OpenSSL::Cipher::Cipher.new("aes-256-cbc")
  cipher.encrypt
  cipher.key = key
  cipher.iv = @iv = cipher.random_iv

  @ciphertext = cipher.update(msg) + cipher.final

  key   = EnrollmentResult.derive_key(secret.to_s.reverse, @timestamp.to_i.to_s)
  hmac   = OpenSSL::HMAC.new(key, OpenSSL::Digest::SHA1.new)
  hmac.update(@ciphertext)
  @mac  = hmac.digest
end

Instance Attribute Details

#id_cert ⇒ Object (readonly)

Returns the value of attribute id_cert.



26
27
28
 
# File 'lib/right_agent/enrollment_result.rb', line 26

def id_cert
  @id_cert
end

#id_key ⇒ Object (readonly)

Returns the value of attribute id_key.



26
27
28
 
# File 'lib/right_agent/enrollment_result.rb', line 26

def id_key
  @id_key
end

#r_s_version ⇒ Object (readonly)

Returns the value of attribute r_s_version.



26
27
28
 
# File 'lib/right_agent/enrollment_result.rb', line 26

def r_s_version
  @r_s_version
end

#router_cert ⇒ Object (readonly)

Returns the value of attribute router_cert.



26
27
28
 
# File 'lib/right_agent/enrollment_result.rb', line 26

def router_cert
  @router_cert
end

#timestamp ⇒ Object (readonly)

Returns the value of attribute timestamp.



26
27
28
 
# File 'lib/right_agent/enrollment_result.rb', line 26

def timestamp
  @timestamp
end

Class Method Details

.dump(obj) ⇒ Object

Serialize an enrollment result

Parameters

obj(EnrollmentResult)

Object to serialize

Return

(String)

Serialized object

Raises:



111
112
113
114
 
# File 'lib/right_agent/enrollment_result.rb', line 111

def self.dump(obj)
  raise VersionError.new("Unsupported version #{obj.r_s_version}") unless SUPPORTED_VERSIONS.include?(obj.r_s_version)
  obj.to_s
end

.load(string, secret) ⇒ Object

Unserialize the MessagePack encoded enrollment result

Parameters

string(String)

MessagePack representation of the result

secret(String)

Shared secret with which the result is encrypted

Return

result

An instance of EnrollmentResult

Raise

IntegrityFailure

if the message has been tampered with

VersionError

if the specified protocol version is not locally supported

Raises:



129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
 
# File 'lib/right_agent/enrollment_result.rb', line 129

def self.load(string, secret)
  serializer = Serializer.new
  envelope = serializer.load(string)

  r_s_version = envelope['r_s_version'].to_i
  raise VersionError.new("Unsupported version #{r_s_version}") unless SUPPORTED_VERSIONS.include?(r_s_version)

  timestamp  = Time.at(envelope['timestamp'].to_i)
  iv         = Base64::decode64(envelope['iv'])
  ciphertext = Base64::decode64(envelope['ciphertext'])
  mac        = Base64::decode64(envelope['mac'])

  key        = self.derive_key(secret, timestamp.to_i.to_s)
  #TODO switch to new OpenSSL API once we move to Ruby 1.8.7
  #cipher     = OpenSSL::Cipher.new("aes-256-cbc")
  cipher     = OpenSSL::Cipher::Cipher.new("aes-256-cbc")
  cipher.decrypt
  cipher.key = key
  cipher.iv  = iv

  #TODO exclusively use new OpenSSL API (OpenSSL::CipherError) once we move to Ruby 1.8.7
  if defined?(OpenSSL::Cipher::CipherError)
    begin
      plaintext = cipher.update(ciphertext) + cipher.final
    rescue OpenSSL::Cipher::CipherError => e
      raise IntegrityFailure.new(e.message)
    end
  else
    begin
      plaintext = cipher.update(ciphertext) + cipher.final
    rescue OpenSSL::CipherError => e
      raise IntegrityFailure.new(e.message)
    end
  end

  key   = self.derive_key(secret.to_s.reverse, timestamp.to_i.to_s)
  hmac   = OpenSSL::HMAC.new(key, OpenSSL::Digest::SHA1.new)
  hmac.update(ciphertext)
  my_mac  = hmac.digest
  raise IntegrityFailure.new("MAC mismatch: expected #{my_mac}, got #{mac}") unless (mac == my_mac)

  msg = serializer.load(plaintext)
  router_cert = msg['router_cert'] || msg['mapper_cert']
  id_cert   = msg['id_cert']
  id_key    = msg['id_key']

  self.new(r_s_version, timestamp, router_cert, id_cert, id_key, secret)
end

Instance Method Details

#==(o) ⇒ Object

Compare this object to another one. Two results are equal if they have the same payload (certs and keys) and timestamp. The crypto fields are not included in the comparison because they are mutable.

Parameters

o(EnrollmentResult)

Object to compare against

Return

true|false

Whether the objects’ pertinent fields are identical



96
97
98
99
100
101
 
# File 'lib/right_agent/enrollment_result.rb', line 96

def ==(o)
  self.router_cert == o.router_cert &&
  self.id_cert == o.id_cert &&
  self.id_key == o.id_key &&
  self.timestamp.to_i == o.timestamp.to_i
end

#to_s ⇒ Object

Serialize an enrollment result

Parameters

obj(EnrollmentResult)

Object to serialize

Return

(String)

Serialized object



76
77
78
79
80
81
82
83
84
 
# File 'lib/right_agent/enrollment_result.rb', line 76

def to_s
  @serializer.dump({
      'r_s_version' => @r_s_version.to_s,
      'timestamp'   => @timestamp.to_i.to_s,
      'iv'          => Base64::encode64(@iv).chop,
      'ciphertext'  => Base64::encode64(@ciphertext).chop,
      'mac'         => Base64::encode64(@mac).chop
  })
end