commit e8692579c1e2cb12484b850753eabb3c6e7f0909 · foxwitch.net/core

+15 -31

appview/db/db.go

···

       1
       1
        
       package db

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       4
        
       	"database/sql"

     

       6
       6
       -
       	"encoding/hex"

     

       7
       5
        
       	"fmt"

     

       8
       6
        
       	"log"

     

       9
       7
        
       

     

       10
       8
        
       	"github.com/google/uuid"

     

       11
       9
        
       	_ "github.com/mattn/go-sqlite3"

     

       12
       12
       -
       	"golang.org/x/crypto/bcrypt"

     

       13
       10
        
       )

     

       14
       11
        
       

     

       15
       12
        
       type DB struct {

     
···

       88
       85
        
       	}

     

       89
       86
        
       

     

       90
       87
        
       	secret := uuid.New().String()

     

       91
       91
       -
       	hashedSecret, err := bcrypt.GenerateFromPassword([]byte(secret), 3)

     

       92
       88
        
       

     

       93
       89
        
       	if err != nil {

     

       94
       90
        
       		return "", err

     
···

       98
       94
        
       		insert into registrations (domain, did, secret)

     

       99
       95
        
       		values (?, ?, ?)

     

       100
       96
        
       		on conflict(domain) do update set did = excluded.did, secret = excluded.secret

     

       101
       101
       -
       		`, domain, did, fmt.Sprintf("%x", hashedSecret))

     

       97
       97
       +
       		`, domain, did, secret)

     

       102
       98
        
       

     

       103
       99
        
       	if err != nil {

     

       104
       100
        
       		return "", err

     
···

       107
       103
        
       	return secret, nil

     

       108
       104
        
       }

     

       109
       105
        
       

     

       110
       110
       -
       func (d *DB) Register(domain, secret string) error {

     

       111
       111
       -
       	ctx := context.TODO()

     

       106
       106
       +
       func (d *DB) GetRegistrationKey(domain string) (string, error) {

     

       107
       107
       +
       	res := d.db.QueryRow(`select secret from registrations where domain = ?`, domain)

     

       112
       108
        
       

     

       113
       113
       -
       	tx, err := d.db.BeginTx(ctx, nil)

     

       109
       109
       +
       	var secret string

     

       110
       110
       +
       	err := res.Scan(&secret)

     

       114
       111
        
       	if err != nil {

     

       115
       115
       -
       		return err

     

       112
       112
       +
       		return "", nil

     

       116
       113
        
       	}

     

       117
       114
        
       

     

       118
       118
       -
       	res := tx.QueryRow(`select secret from registrations where domain = ?`, domain)

     

       115
       115
       +
       	return secret, nil

     

       116
       116
       +
       }

     

       119
       117
        
       

     

       120
       120
       -
       	var hexSecret string

     

       121
       121
       -
       	err = res.Scan(&hexSecret)

     

       122
       122
       -
       	if err != nil {

     

       123
       123
       -
       		return err

     

       124
       124
       -
       	}

     

       125
       125
       -
       

     

       126
       126
       -
       	decoded, err := hex.DecodeString(hexSecret)

     

       127
       127
       -
       	if err != nil {

     

       128
       128
       -
       		return err

     

       129
       129
       -
       	}

     

       130
       130
       -
       

     

       131
       131
       -
       	err = bcrypt.CompareHashAndPassword(decoded, []byte(secret))

     

       132
       132
       -
       	if err != nil {

     

       133
       133
       -
       		return err

     

       134
       134
       -
       	}

     

       135
       135
       -
       

     

       136
       136
       -
       	_, err = tx.Exec(`

     

       118
       118
       +
       func (d *DB) Register(domain string) error {

     

       119
       119
       +
       	_, err := d.db.Exec(`

     

       137
       120
        
       		update registrations

     

       138
       121
        
       		set registered = strftime('%s', 'now')

     

       139
       122
        
       		where domain = ?;

     

       140
       123
        
       		`, domain)

     

       141
       141
       -
       	if err != nil {

     

       142
       142
       -
       		return err

     

       143
       143
       -
       	}

     

       144
       124
        
       

     

       145
       145
       -
       	err = tx.Commit()

     

       146
       125
        
       	if err != nil {

     

       147
       126
        
       		return err

     

       148
       127
        
       	}

     

       149
       128
        
       

     

       150
       129
        
       	return nil

     

       151
       130
        
       }

     

       131
       131
       +
       

     

       132
       132
       +
       // type Registration struct {

     

       133
       133
       +
       // 	status RegStatus

     

       134
       134
       +
       // }

     

       135
       135
       +
       // func (d *DB) RegistrationsForDid(did string) ()

+81 -41

appview/state/state.go

···

       1
       1
        
       package state

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"encoding/json"

     

       4
       4
       +
       	"crypto/hmac"

     

       5
       5
       +
       	"crypto/sha256"

     

       6
       6
       +
       	"encoding/hex"

     

       5
       7
        
       	"log"

     

       6
       8
        
       	"net/http"

     

       9
       9
       +
       	"net/url"

     

       10
       10
       +
       	"time"

     

       7
       11
        
       

     

       8
       12
        
       	"github.com/go-chi/chi/v5"

     

       9
       13
        
       	"github.com/icyphox/bild/appview"

     
···

       61
       65
        
       }

     

       62
       66
        
       

     

       63
       67
        
       // requires auth

     

       64
       64
       -
       func (s *State) GenerateRegistrationKey(w http.ResponseWriter, r *http.Request) {

     

       65
       65
       -
       	session, err := s.Auth.Store.Get(r, appview.SESSION_NAME)

     

       66
       66
       -
       	if err != nil || session.IsNew {

     

       67
       67
       -
       		log.Println("unauthorized attempt to generate registration key")

     

       68
       68
       -
       		http.Error(w, "Forbidden", http.StatusUnauthorized)

     

       68
       68
       +
       func (s *State) Key(w http.ResponseWriter, r *http.Request) {

     

       69
       69
       +
       	switch r.Method {

     

       70
       70
       +
       	case http.MethodGet:

     

       71
       71
       +
       		// list open registrations under this did

     

       72
       72
       +
       

     

       73
       73
       +
       		return

     

       74
       74
       +
       	case http.MethodPost:

     

       75
       75
       +
       		session, err := s.Auth.Store.Get(r, appview.SESSION_NAME)

     

       76
       76
       +
       		if err != nil || session.IsNew {

     

       77
       77
       +
       			log.Println("unauthorized attempt to generate registration key")

     

       78
       78
       +
       			http.Error(w, "Forbidden", http.StatusUnauthorized)

     

       79
       79
       +
       			return

     

       80
       80
       +
       		}

     

       81
       81
       +
       

     

       82
       82
       +
       		did := session.Values[appview.SESSION_DID].(string)

     

       83
       83
       +
       

     

       84
       84
       +
       		// check if domain is valid url, and strip extra bits down to just host

     

       85
       85
       +
       		domain := r.FormValue("domain")

     

       86
       86
       +
       		url, err := url.Parse(domain)

     

       87
       87
       +
       		if domain == "" || err != nil {

     

       88
       88
       +
       			http.Error(w, "Invalid form", http.StatusBadRequest)

     

       89
       89
       +
       			return

     

       90
       90
       +
       		}

     

       91
       91
       +
       

     

       92
       92
       +
       		key, err := s.Db.GenerateRegistrationKey(url.Host, did)

     

       93
       93
       +
       

     

       94
       94
       +
       		if err != nil {

     

       95
       95
       +
       			log.Println(err)

     

       96
       96
       +
       			http.Error(w, "unable to register this domain", http.StatusNotAcceptable)

     

       97
       97
       +
       			return

     

       98
       98
       +
       		}

     

       99
       99
       +
       

     

       100
       100
       +
       		w.Write([]byte(key))

     

       69
       101
        
       		return

     

       70
       102
        
       	}

     

       103
       103
       +
       }

     

       71
       104
        
       

     

       72
       72
       -
       	did := session.Values[appview.SESSION_DID].(string)

     

       105
       105
       +
       // create a signed request and check if a node responds to that

     

       106
       106
       +
       //

     

       107
       107
       +
       // we should also rate limit these checks to avoid ddosing knotservers

     

       108
       108
       +
       func (s *State) Check(w http.ResponseWriter, r *http.Request) {

     

       73
       109
        
       	domain := r.FormValue("domain")

     

       74
       110
        
       	if domain == "" {

     

       75
       111
        
       		http.Error(w, "Invalid form", http.StatusBadRequest)

     

       76
       112
        
       		return

     

       77
       113
        
       	}

     

       78
       114
        
       

     

       79
       79
       -
       	key, err := s.Db.GenerateRegistrationKey(domain, did)

     

       80
       80
       -
       

     

       115
       115
       +
       	secret, err := s.Db.GetRegistrationKey(domain)

     

       81
       116
        
       	if err != nil {

     

       82
       82
       -
       		log.Println(err)

     

       83
       83
       -
       		http.Error(w, "unable to register this domain", http.StatusNotAcceptable)

     

       117
       117
       +
       		log.Printf("no key found for domain %s: %s\n", domain, err)

     

       84
       118
        
       		return

     

       85
       119
        
       	}

     

       86
       120
        
       

     

       87
       87
       -
       	w.Write([]byte(key))

     

       88
       88
       -
       	return

     

       89
       89
       -
       }

     

       121
       121
       +
       	hmac := hmac.New(sha256.New, []byte(secret))

     

       122
       122
       +
       	signature := hex.EncodeToString(hmac.Sum(nil))

     

       90
       123
        
       

     

       91
       91
       -
       type RegisterRequest struct {

     

       92
       92
       -
       	Domain string `json:"domain"`

     

       93
       93
       -
       	Secret string `json:"secret"`

     

       94
       94
       -
       }

     

       124
       124
       +
       	// make a request do the knotserver with an empty body and above signature

     

       125
       125
       +
       	url, _ := url.Parse(domain)

     

       126
       126
       +
       	url = url.JoinPath("check")

     

       127
       127
       +
       	pingRequest, err := http.NewRequest("GET", url.String(), nil)

     

       128
       128
       +
       	if err != nil {

     

       129
       129
       +
       		log.Println("failed to create ping request for ", url.String())

     

       130
       130
       +
       		return

     

       131
       131
       +
       	}

     

       132
       132
       +
       	pingRequest.Header.Set("X-Signature", signature)

     

       95
       133
        
       

     

       96
       96
       -
       func (s *State) Register(w http.ResponseWriter, r *http.Request) {

     

       97
       97
       -
       	switch r.Method {

     

       98
       98
       -
       	case http.MethodGet:

     

       99
       99
       -
       		log.Println("unimplemented")

     

       134
       134
       +
       	client := &http.Client{

     

       135
       135
       +
       		Timeout: 5 * time.Second,

     

       136
       136
       +
       	}

     

       137
       137
       +
       	resp, err := client.Do(pingRequest)

     

       138
       138
       +
       	if err != nil {

     

       139
       139
       +
       		w.Write([]byte("no dice"))

     

       140
       140
       +
       		log.Println("domain was unreachable after 5 seconds")

     

       100
       141
        
       		return

     

       101
       101
       -
       	case http.MethodPost:

     

       102
       102
       -
       		var req RegisterRequest

     

       103
       103
       -
       		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {

     

       104
       104
       -
       			http.Error(w, "invalid request body", http.StatusBadRequest)

     

       105
       105
       -
       			return

     

       106
       106
       -
       		}

     

       142
       142
       +
       	}

     

       107
       143
        
       

     

       108
       108
       -
       		domain := req.Domain

     

       109
       109
       -
       		secret := req.Secret

     

       144
       144
       +
       	if resp.StatusCode != http.StatusOK {

     

       145
       145
       +
       		log.Println("status nok")

     

       146
       146
       +
       		w.Write([]byte("no dice"))

     

       147
       147
       +
       		return

     

       148
       148
       +
       	}

     

       149
       149
       +
       	w.Write([]byte("check success"))

     

       110
       150
        
       

     

       111
       111
       -
       		err := s.Db.Register(domain, secret)

     

       112
       112
       -
       		if err != nil {

     

       113
       113
       -
       			log.Println("failed to register domain", err)

     

       114
       114
       -
       			return

     

       115
       115
       -
       		}

     

       151
       151
       +
       	// mark as registered

     

       152
       152
       +
       	s.Db.Register(domain)

     

       116
       153
        
       

     

       117
       117
       -
       		log.Printf("Registered domain: %s with secret: %s", domain, secret)

     

       118
       118
       -
       	}

     

       154
       154
       +
       	return

     

       119
       155
        
       }

     

       120
       156
        
       

     

       121
       157
        
       func (s *State) Router() http.Handler {

     

       122
       158
        
       	r := chi.NewRouter()

     

       123
       159
        
       

     

       124
       160
        
       	r.Post("/login", s.Login)

     

       125
       125
       -
       	r.Post("/node/register", s.Register)

     

       126
       126
       -
       	r.Group(func(r chi.Router) {

     

       127
       127
       -
       		r.Use(AuthMiddleware(s))

     

       128
       128
       -
       		r.Post("/node/generate-key", s.GenerateRegistrationKey)

     

       161
       161
       +
       

     

       162
       162
       +
       	r.Route("/node", func(r chi.Router) {

     

       163
       163
       +
       		r.Post("/check", s.Check)

     

       164
       164
       +
       

     

       165
       165
       +
       		r.Group(func(r chi.Router) {

     

       166
       166
       +
       			r.Use(AuthMiddleware(s))

     

       167
       167
       +
       			r.Post("/key", s.Key)

     

       168
       168
       +
       		})

     

       129
       169
        
       	})

     

       130
       170
        
       

     

       131
       171
        
       	return r