libp2phttp: HTTP Peer ID Authentication #2854
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
MarcoPolo
force-pushed
the
marco/http-peer-id-auth
branch
from
c2d12e7
to
2a55ceb
Compare
|
I've completely refactored this. The handshake logic is now neatly in
when you get a chance, could I get a review here and in the spec libp2p/specs#564 @sukunrt . |
Because otherwise the body is not copied.
MarcoPolo
force-pushed
the
marco/http-peer-id-auth
branch
from
fccc2d5
to
fbcede2
Compare
p2p/http/auth/client.go
Outdated
| } | ||
| resp.Body.Close() | ||
|
|
||
| err = handshake.ParseHeader(resp.Header) |
There was a problem hiding this comment.
Do we need to set the status code first?
There was a problem hiding this comment.
On the client? Or do you mean assert the status code is 401?
p2p/http/auth/client.go
Outdated
| originalBody := req.Body | ||
|
|
||
| handshake.Run() | ||
| handshake.SetHeader(req.Header) | ||
|
|
||
| // Don't send the body before we've authenticated the server | ||
| req.Body = nil | ||
| resp, err := client.Do(req) | ||
| if err != nil { | ||
| return "", nil, err | ||
| } | ||
| resp.Body.Close() | ||
|
|
||
| err = handshake.ParseHeader(resp.Header) | ||
| if err != nil { | ||
| return "", nil, fmt.Errorf("failed to parse auth header: %w", err) | ||
| } | ||
| err = handshake.Run() | ||
| if err != nil { | ||
| return "", nil, fmt.Errorf("failed to run handshake: %w", err) | ||
| } | ||
|
|
||
| serverWasAuthenticated := false | ||
| _, err = handshake.PeerID() | ||
| if err == nil { | ||
| serverWasAuthenticated = true | ||
| } | ||
|
|
||
| req = req.Clone(req.Context()) | ||
| if serverWasAuthenticated { | ||
| req.Body = originalBody | ||
| } else { | ||
| // Don't send the body before we've authenticated the server | ||
| req.Body = nil | ||
| } | ||
| handshake.SetHeader(req.Header) | ||
| resp, err = client.Do(req) | ||
| if err != nil { | ||
| return "", nil, fmt.Errorf("failed to do authenticated request: %w", err) | ||
| } | ||
|
|
||
| err = handshake.ParseHeader(resp.Header) | ||
| if err != nil { | ||
| resp.Body.Close() | ||
| return "", nil, fmt.Errorf("failed to parse auth info header: %w", err) | ||
| } | ||
| err = handshake.Run() | ||
| if err != nil { | ||
| resp.Body.Close() | ||
| return "", nil, fmt.Errorf("failed to run auth info handshake: %w", err) | ||
| } | ||
|
|
||
| serverPeerID, err := handshake.PeerID() | ||
| if err != nil { | ||
| resp.Body.Close() | ||
| return "", nil, fmt.Errorf("failed to get server's peer ID: %w", err) | ||
| } | ||
| a.tokenMapMu.Lock() | ||
| a.tokenMap[hostname] = tokenInfo{ | ||
| token: handshake.BearerToken(), | ||
| insertedAt: time.Now(), | ||
| peerID: serverPeerID, | ||
| } | ||
| a.tokenMapMu.Unlock() | ||
|
|
||
| if serverWasAuthenticated { | ||
| return serverPeerID, resp, nil | ||
| } | ||
|
|
||
| // Server wasn't authenticated earlier. | ||
| // We need to make one final request with the body now that we authenticated | ||
| // the server. | ||
| req = req.Clone(req.Context()) | ||
| req.Body = originalBody | ||
| handshake.SetHeader(req.Header) | ||
| resp, err = client.Do(req) | ||
| if err != nil { | ||
| return "", nil, fmt.Errorf("failed to do authenticated request: %w", err) | ||
| } | ||
| return serverPeerID, resp, nil |
There was a problem hiding this comment.
Can you add a comment before each of the steps? This runs both Server initiated and client initiated handshake making things a bit complicated, comments would aid readability here.
There was a problem hiding this comment.
I've changed this to be a for loop instead since it's all the same thing.
|
The new spec is much nicer! Thanks @MarcoPolo |
This enables HTTP peers to authenticate each other's peer ID. This would allow users to use an http transport that has a peer id component (e.g.
/dns/example.com/http/p2p/12Foo). I think it's nice to have this for completeness so that an http transport has the same semantics as a libp2p stream transport when doing HTTP with regard to Peer IDs.There's more testing I want to do here, but I think this is more or less ready for a review.
For a high level overview of the authentication protocol refer to the overview in the spec: https://github.com/libp2p/specs/blob/45006f17d2fa0cede50b2db2311a55061011a3fc/http/peer-id-auth.md#mutual-client-and-server-peer-id-authentication-overview