25a32d9 · skrepka · git.iko.soy

git.iko.soy/skrepka

on master help sign in

Simplify server.knot: extract verifySignature, flatten refreshPeers, drop redundant ::

25a32d9iko5 months ago

server.knot+16−16

compare with master

unifiedsplit

@@ -376,8 +376,7 @@ isBadServerName = \sn -> sn == "" || sn == "localhost" || not all (\c -> contain

376 "10.",

377 "192.168.",

378 "169.254.",

379− "0.",

379+ "0."

380− "::"

381] || any (\s -> containsSuffix s sn) [".localhost", ".local", ".internal", ".arpa", ".onion"]

380] || any (\s -> containsSuffix s sn) [".localhost", ".local", ".internal", ".arpa", ".onion"]

382

381

383-- ============================================

382-- ============================================

@@ -420,6 +419,15 @@ withSessionAuth = \authorization t clientIp onUnauth onAuth -> do

420 Just {value: s} -> onAuth s.pubkey

419 Just {value: s} -> onAuth s.pubkey

421 _ -> onUnauth

420 _ -> onUnauth

422

421

422+-- True when `signature` is a valid Ed25519 signature by `pubkey` over `challenge`.

423+-- False on any hex-decoding failure.

424+verifySignature : PubkeyHex -> SignatureHex -> Text -> Bool

425+verifySignature = \pubkey signature challenge -> case bytesFromHex pubkey of

426+ Just {value: pk} -> case bytesFromHex signature of

427+ Just {value: sigBytes} -> verify pk (textToBytes challenge) sigBytes

428+ _ -> False {}

429+ _ -> False {}

430+

423-- ============================================

431-- ============================================

424-- Federation failure tracking (simple, no circuit breaker)

432-- Federation failure tracking (simple, no circuit breaker)

425-- ============================================

433-- ============================================

@@ -637,14 +645,10 @@ handleVerifyAuth = \pubkey challenge signature revokeOthers clientIp -> do

637 t <- now

645 t <- now

638 let expiry = t + sessionExpiry

646 let expiry = t + sessionExpiry

639 token <- genToken

647 token <- genToken

648+ let sigValid = verifySignature pubkey signature challenge

640 result <- atomic (do

649 result <- atomic (do

641 ch <- *challenges

650 ch <- *challenges

642 let same = \c -> c.pubkey == pubkey && c.challenge == challenge

651 let same = \c -> c.pubkey == pubkey && c.challenge == challenge

643− let sigValid = case bytesFromHex pubkey of

644− Just {value: pk} -> case bytesFromHex signature of

645− Just {value: sigBytes} -> verify pk (textToBytes challenge) sigBytes

646− _ -> False {}

647− _ -> False {}

648 let valid = any (\c -> same c && c.expiresAt > t && matchIp clientIp c.ip) ch && sigValid

652 let valid = any (\c -> same c && c.expiresAt > t && matchIp clientIp c.ip) ch && sigValid

649 if not valid

653 if not valid

650 then yield (Nothing {})

654 then yield (Nothing {})

@@ -687,19 +691,15 @@ handlePoll = \cursor authorization clientIp -> do

687 let mine = \p -> p.pubkey == pubkey && isLocalServer p.server

691 let mine = \p -> p.pubkey == pubkey && isLocalServer p.server

688 let stale = not any (\p -> mine p && p.expiresAt - t >= sessionExpiry / 2) pres

692 let stale = not any (\p -> mine p && p.expiresAt - t >= sessionExpiry / 2) pres

689 refreshPeers <- if stale

693 refreshPeers <- if stale

690− then do

691− peers <- refreshLocalPresence pubkey (t + sessionExpiry)

694+ then refreshLocalPresence pubkey (t + sessionExpiry)

692− yield (Just {value: peers})

693− else yield (Nothing {})

695+ else yield []

694 yield (Just {value: {pubkey, clampedCursor, startWakeup, refreshPeers}}))

696 yield (Just {value: {pubkey, clampedCursor, startWakeup, refreshPeers}}))

695 case setup of

697 case setup of

696 Nothing {} -> yield (Err {error: {status: 401, message: "unauthorized"}})

698 Nothing {} -> yield (Err {error: {status: 401, message: "unauthorized"}})

697 Just {value: s} -> do

699 Just {value: s} -> do

698− case s.refreshPeers of

699− Just {value: peers} -> when federationEnabled (fork (sendBatchedGossip peers [

700+ when (federationEnabled && count s.refreshPeers > 0) (fork (sendBatchedGossip s.refreshPeers [

700− GossipOnline {s.pubkey}

701+ GossipOnline {s.pubkey}

701− ]))

702+ ]))

702− Nothing {} -> yield {}

703 pollResult <- doPoll s t

704 yield (Ok {value: {pollResult.events, pollResult.cursor}})

705