-
Notifications
You must be signed in to change notification settings - Fork 34
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Land #169, Add pkcs12 private data type
- Loading branch information
Showing
10 changed files
with
302 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,84 @@ | ||
require 'openssl' | ||
require 'base64' | ||
|
||
# A private Pkcs12 file. | ||
class Metasploit::Credential::Pkcs12 < Metasploit::Credential::Private | ||
# | ||
# Attributes | ||
# | ||
|
||
# @!attribute data | ||
# A private pkcs12 file, base64 encoded - i.e. starting with 'MIIMhgIBAzCCDFAGCSqGSIb3DQEHAaCC....' | ||
# | ||
# @return [String] | ||
|
||
# | ||
# | ||
# Validations | ||
# | ||
# | ||
|
||
# | ||
# Attribute Validations | ||
# | ||
|
||
validates :data, | ||
presence: true | ||
# | ||
# Method Validations | ||
# | ||
|
||
validate :readable | ||
|
||
# | ||
# Instance Methods | ||
# | ||
|
||
# Converts the private pkcs12 data in {#data} to an `OpenSSL::PKCS12` instance. | ||
# | ||
# @return [OpenSSL::PKCS12] | ||
# @raise [ArgumentError] if {#data} cannot be loaded | ||
def openssl_pkcs12 | ||
if data | ||
begin | ||
password = '' | ||
OpenSSL::PKCS12.new(Base64.strict_decode64(data), password) | ||
rescue OpenSSL::PKCS12::PKCS12Error => error | ||
raise ArgumentError.new(error) | ||
end | ||
end | ||
end | ||
|
||
# The {#data key data}'s fingerprint, suitable for displaying to the | ||
# user. | ||
# | ||
# @return [String] | ||
def to_s | ||
return '' unless data | ||
|
||
cert = openssl_pkcs12.certificate | ||
result = [] | ||
result << "subject:#{cert.subject.to_s}" | ||
result << "issuer:#{cert.issuer.to_s}" | ||
result.join(',') | ||
end | ||
|
||
private | ||
|
||
# | ||
# Validates that {#data} can be read by OpenSSL and a `OpenSSL::PKCS12` can be created from {#data}. Any exception | ||
# raised will be reported as a validation error. | ||
# | ||
# @return [void] | ||
def readable | ||
if data | ||
begin | ||
openssl_pkcs12 | ||
rescue => error | ||
errors.add(:data, "#{error.class} #{error}") | ||
end | ||
end | ||
end | ||
|
||
Metasploit::Concern.run(self) | ||
end |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
32 changes: 32 additions & 0 deletions
32
db/migrate/20221209005658_create_index_on_private_data_and_type_for_pkcs12.rb
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,32 @@ | ||
class CreateIndexOnPrivateDataAndTypeForPkcs12 < ActiveRecord::Migration[6.1] | ||
def up | ||
# Drop the existing index created by 20161107153145_recreate_index_on_private_data_and_type.rb, and recreate it | ||
# with Metasploit::Credential::Pkcs12 ignored | ||
remove_index :metasploit_credential_privates, [:type, :data], if_exists: true | ||
change_table :metasploit_credential_privates do |t| | ||
t.index [:type, :data], | ||
unique: true, | ||
where: "NOT (type = 'Metasploit::Credential::SSHKey' or type = 'Metasploit::Credential::Pkcs12')" | ||
end | ||
|
||
# Create a new index similar to 20161107203710_create_index_on_private_data_and_type_for_ssh_key.rb | ||
sql = <<~EOF | ||
CREATE UNIQUE INDEX IF NOT EXISTS "index_metasploit_credential_privates_on_type_and_data_pkcs12" ON | ||
"metasploit_credential_privates" ("type", decode(md5(data), 'hex')) | ||
WHERE type in ('Metasploit::Credential::Pkcs12') | ||
EOF | ||
execute(sql) | ||
end | ||
|
||
def down | ||
# Restore the original metasploit_credential_privates index from /Users/adfoster/Documents/code/metasploit-credential/db/migrate/20161107153145_recreate_index_on_private_data_and_type.rb | ||
# XXX: this would crash if there are any Pkcs12 entries present, so for the simplicity of avoiding a data migration we keep the pkcs12 type ommitted from the index | ||
remove_index :metasploit_credential_privates, [:type, :data], if_exists: true | ||
change_table :metasploit_credential_privates do |t| | ||
t.index [:type, :data], | ||
unique: true, | ||
where: "NOT (type = 'Metasploit::Credential::SSHKey' or type = 'Metasploit::Credential::Pkcs12')" | ||
end | ||
remove_index :metasploit_credential_privates, name: :index_metasploit_credential_privates_on_type_and_data_pkcs12, if_exists: true | ||
end | ||
end |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,37 @@ | ||
FactoryBot.define do | ||
factory :metasploit_credential_pkcs12, | ||
class: Metasploit::Credential::Pkcs12 do | ||
transient do | ||
# key size tuned for speed. DO NOT use for production, it is below current recommended key size of 2048 | ||
key_size { 1024 } | ||
# signing algorithm for the pkcs12 cert | ||
signing_algorithm { 'SHA256' } | ||
# the cert subject | ||
subject { '/C=BE/O=Test/OU=Test/CN=Test' } | ||
# the cert issuer | ||
issuer { '/C=BE/O=Test/OU=Test/CN=Test' } | ||
end | ||
|
||
data { | ||
password = '' | ||
pkcs12_name = '' | ||
|
||
private_key = OpenSSL::PKey::RSA.new(key_size) | ||
public_key = private_key.public_key | ||
|
||
cert = OpenSSL::X509::Certificate.new | ||
cert.subject = OpenSSL::X509::Name.parse(subject) | ||
cert.issuer = OpenSSL::X509::Name.parse(issuer) | ||
cert.not_before = Time.now | ||
cert.not_after = Time.now + 365 * 24 * 60 * 60 | ||
cert.public_key = public_key | ||
cert.serial = 0x0 | ||
cert.version = 2 | ||
cert.sign(private_key, OpenSSL::Digest.new(signing_algorithm)) | ||
|
||
pkcs12 = OpenSSL::PKCS12.create(password, pkcs12_name, private_key, cert) | ||
pkcs12_base64 = Base64.strict_encode64(pkcs12.to_der) | ||
pkcs12_base64 | ||
} | ||
end | ||
end |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,116 @@ | ||
RSpec.describe Metasploit::Credential::Pkcs12, type: :model do | ||
it_should_behave_like 'Metasploit::Concern.run' | ||
|
||
context 'factories' do | ||
context 'metasploit_credential_pkcs12' do | ||
subject(:metasploit_credential_pkcs12) do | ||
FactoryBot.build(:metasploit_credential_pkcs12) | ||
end | ||
|
||
it { is_expected.to be_valid } | ||
end | ||
end | ||
|
||
context 'validations' do | ||
it { is_expected.to validate_presence_of :data } | ||
|
||
context 'on #data' do | ||
subject(:data_errors) do | ||
pkcs12.errors[:data] | ||
end | ||
|
||
let(:pkcs12) do | ||
FactoryBot.build(:metasploit_credential_pkcs12) | ||
end | ||
|
||
context '#readable' do | ||
context 'with #data' do | ||
context 'with error' do | ||
# | ||
# Shared Examples | ||
# | ||
|
||
shared_examples_for 'exception' do | ||
it 'includes error class' do | ||
exception_class_name = exception.class.to_s | ||
expect( | ||
data_errors.any? { |error| | ||
error.include? exception_class_name | ||
} | ||
).to be true | ||
end | ||
|
||
it 'includes error message' do | ||
exception_message = exception.to_s | ||
|
||
expect( | ||
data_errors.any? { |error| | ||
error.include? exception_message | ||
} | ||
).to be true | ||
end | ||
end | ||
|
||
# | ||
# Callbacks | ||
# | ||
|
||
before(:example) do | ||
expect(pkcs12).to receive(:openssl_pkcs12).and_raise(exception) | ||
|
||
pkcs12.valid? | ||
end | ||
|
||
context 'with ArgumentError' do | ||
let(:exception) do | ||
ArgumentError.new("Bad Argument") | ||
end | ||
|
||
it_should_behave_like 'exception' | ||
end | ||
|
||
context 'with OpenSSL::PKCS12::PKCS12Error' do | ||
let(:exception) do | ||
OpenSSL::PKCS12::PKCS12Error.new('mac verify failure') | ||
end | ||
|
||
it_should_behave_like 'exception' | ||
end | ||
end | ||
|
||
context 'without error' do | ||
before(:example) do | ||
pkcs12.valid? | ||
end | ||
|
||
it { is_expected.to be_empty } | ||
end | ||
end | ||
|
||
context 'without #data' do | ||
let(:error) do | ||
I18n.translate!('errors.messages.blank') | ||
end | ||
|
||
# | ||
# Callbacks | ||
# | ||
|
||
before(:example) do | ||
pkcs12.data = nil | ||
|
||
pkcs12.valid? | ||
end | ||
|
||
it { is_expected.to include(error) } | ||
end | ||
end | ||
end | ||
end | ||
|
||
describe 'human name' do | ||
it 'properly determines the model\'s human name' do | ||
expect(described_class.model_name.human).to eq('Pkcs12 (pfx)') | ||
end | ||
end | ||
end |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters