1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
|
/*
* Copyright (c) 2023 Vaughn Nugent
*
* Library: VNLib
* Package: VNLib.Data.Caching.Extensions
* File: ServiceEndpoints.cs
*
* ServiceEndpoints.cs is part of VNLib.Data.Caching.Extensions which is part of the larger
* VNLib collection of libraries and utilities.
*
* VNLib.Data.Caching.Extensions is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* VNLib.Data.Caching.Extensions is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see https://www.gnu.org/licenses/.
*/
using System;
using System.Security;
using System.Text.Json;
using RestSharp;
using VNLib.Net.Http;
using VNLib.Hashing;
using VNLib.Hashing.IdentityUtility;
using VNLib.Net.Rest.Client.Construction;
using ContentType = VNLib.Net.Http.ContentType;
using VNLib.Data.Caching.Extensions.Clustering;
namespace VNLib.Data.Caching.Extensions.ApiModel
{
/*
* Defines the cache endpoints, builds and routes request messages to the
* server enpoints. In effect defines the client api for cache services.
*
* This class also define methods for authentication and message verification
*/
internal static class ServiceEndpoints
{
private static readonly TimeSpan MaxTimeDisparity = TimeSpan.FromSeconds(10);
/// <summary>
/// Get the endpoint definition for cache services for the site adapter
/// </summary>
internal static IRestEndpointDefinition Definition { get; } = new EndpointBuilder();
private class EndpointBuilder : IRestEndpointDefinition
{
///<inheritdoc/>
public void BuildRequest(IRestSiteAdapter site, IRestEndpointBuilder builder)
{
//Define cache service endpoints/requests
builder.WithEndpoint<DiscoveryRequest>()
.WithUrl(e => e.DiscoveryUrl)
.WithMethod(Method.Get)
//Accept text response (it should be a jwt)
.WithHeader("Accept", HttpHelpers.GetContentTypeString(ContentType.Text))
.WithHeader("Authorization", BuildDiscoveryAuthToken)
//Verify jwt responses
.OnResponse(VerifyJwtResponse);
builder.WithEndpoint<NegotationRequest>()
.WithUrl(e => e.ConnectUrl)
.WithMethod(Method.Get)
//Accept text response (its should be a jwt)
.WithHeader("Accept", HttpHelpers.GetContentTypeString(ContentType.Text))
.WithHeader("Authorization", BuildDiscoveryAuthToken)
//Verify jwt responses
.OnResponse(VerifyJwtResponse);
//Well known endpoint does not require authentication
builder.WithEndpoint<GetConfigRequest>()
.WithUrl(gc => gc.WellKnownEp)
.WithMethod(Method.Get)
//Responses should be a signed jwt
.WithHeader("Accept", HttpHelpers.GetContentTypeString(ContentType.Text))
//Verify jwt responses
.OnResponse(VerifyJwtResponse);
}
}
/*
* These methods define consitend endpoint definitions that must match the server
* endpoints.
*
* Most requests will send an authorization header with a signed JWT that includes
* a random challenge that the server will return in the response.
*
* All responses will be signed JWTs that must be verified before continuing
*/
private static string BuildDiscoveryAuthToken(ICacheConnectionRequest request)
{
request.Challenge = RandomHash.GetRandomBase32(24);
//Build request jwt
using JsonWebToken jwt = new();
jwt.WriteHeader(request.Config.AuthManager.GetJwtHeader());
//See if the supplied config is for a cache node
CacheNodeConfiguration? cnc = request.Config as CacheNodeConfiguration;
//Init claim
JwtPayload claim = jwt.InitPayloadClaim();
claim.AddClaim("chl", request.Challenge)
.AddClaim("iat", DateTimeOffset.UtcNow.ToUnixTimeMilliseconds());
if (!string.IsNullOrWhiteSpace(cnc?.NodeId))
{
/*
* The unique node id so the other nodes know to load the
* proper event queue for the current server
*/
claim.AddClaim("sub", cnc.NodeId);
}
claim.CommitClaims();
//sign the jwt
request.Config.AuthManager.SignJwt(jwt);
//Compile the jwt
return jwt.Compile();
}
private static void VerifyJwtResponse(ICacheConnectionRequest req, RestResponse response)
{
byte[] data = response.RawBytes ?? throw new ArgumentException("Server response was empty, cannot continue");
//If node config then set the is-node flag
bool isNode = req.Config is CacheNodeConfiguration;
//Response is jwt
using JsonWebToken responseJwt = JsonWebToken.ParseRaw(data);
//Verify the jwt
if (!req.Config.AuthManager.VerifyJwt(responseJwt, isNode))
{
throw new SecurityException("Failed to verify the discovery server's challenge, cannot continue");
}
//get payload as a document
using JsonDocument doc = responseJwt.GetPayload();
//Verify iat times
long iatSec = doc.RootElement.GetProperty("iat").GetInt64();
//Get dto
DateTimeOffset iat = DateTimeOffset.FromUnixTimeSeconds(iatSec);
DateTimeOffset now = DateTimeOffset.UtcNow;
//Verify iat is not before or after the current time with the disparity
if (iat.Add(MaxTimeDisparity) < now || iat.Subtract(MaxTimeDisparity) > now)
{
throw new SecurityException("Server returned a request that has expired. Please check your system clock");
}
//If a challenge is set, verify it
if (req.Challenge != null)
{
//Verify challenge
string challenge = doc.RootElement.GetProperty("chl").GetString()
?? throw new SecurityException("Server did not return a challenge");
if (!challenge.Equals(req.Challenge, StringComparison.Ordinal))
{
throw new SecurityException("Server returned an invalid challenge");
}
}
}
}
}
|
