diff --git a/combined/cmd/root.go b/combined/cmd/root.go index 7eac84ce5..d63a58a5b 100644 --- a/combined/cmd/root.go +++ b/combined/cmd/root.go @@ -29,13 +29,13 @@ import ( mgmtServer "github.com/netbirdio/netbird/management/internals/server" nbconfig "github.com/netbirdio/netbird/management/internals/server/config" "github.com/netbirdio/netbird/management/server/telemetry" + "github.com/netbirdio/netbird/relay/auth" "github.com/netbirdio/netbird/relay/healthcheck" relayServer "github.com/netbirdio/netbird/relay/server" "github.com/netbirdio/netbird/relay/server/listener" "github.com/netbirdio/netbird/relay/server/listener/ws" syncgrpc "github.com/netbirdio/netbird/shared/management/grpc" sharedMetrics "github.com/netbirdio/netbird/shared/metrics" - "github.com/netbirdio/netbird/shared/relay/auth" "github.com/netbirdio/netbird/shared/signal/proto" signalServer "github.com/netbirdio/netbird/signal/server" "github.com/netbirdio/netbird/stun" diff --git a/shared/relay/auth/allow/allow_all.go b/relay/auth/allow/allow_all.go similarity index 100% rename from shared/relay/auth/allow/allow_all.go rename to relay/auth/allow/allow_all.go diff --git a/shared/relay/auth/doc.go b/relay/auth/doc.go similarity index 76% rename from shared/relay/auth/doc.go rename to relay/auth/doc.go index b3e8dbb08..010894f44 100644 --- a/shared/relay/auth/doc.go +++ b/relay/auth/doc.go @@ -8,7 +8,7 @@ Validator. Methods: -Validate(func() hash.Hash, any): This method is defined in the Validator interface and is used to validate the authentication. +Validate(any) error: This method is defined in the Validator interface and is used to validate the authentication. Usage: @@ -18,7 +18,7 @@ To create a new AllowAllAuth validator, simply instantiate it: To validate the authentication, use the Validate method: - err := validator.Validate(sha256.New, any) + err := validator.Validate(credentials) This package provides a simple and effective way to manage authentication with the relay server, ensuring that the peers are authenticated properly. diff --git a/shared/relay/auth/validator.go b/relay/auth/validator.go similarity index 100% rename from shared/relay/auth/validator.go rename to relay/auth/validator.go diff --git a/relay/cmd/root.go b/relay/cmd/root.go index a64812d4d..d7f4defcd 100644 --- a/relay/cmd/root.go +++ b/relay/cmd/root.go @@ -19,10 +19,10 @@ import ( "github.com/spf13/cobra" "github.com/netbirdio/netbird/encryption" + "github.com/netbirdio/netbird/relay/auth" "github.com/netbirdio/netbird/relay/healthcheck" "github.com/netbirdio/netbird/relay/server" "github.com/netbirdio/netbird/shared/metrics" - "github.com/netbirdio/netbird/shared/relay/auth" "github.com/netbirdio/netbird/stun" "github.com/netbirdio/netbird/trustedproxy" "github.com/netbirdio/netbird/util" diff --git a/relay/test/benchmark_test.go b/relay/test/benchmark_test.go index 6b1131f1e..657d3a2f6 100644 --- a/relay/test/benchmark_test.go +++ b/relay/test/benchmark_test.go @@ -14,8 +14,8 @@ import ( "github.com/pion/turn/v3" "github.com/netbirdio/netbird/client/iface" + "github.com/netbirdio/netbird/relay/auth/allow" "github.com/netbirdio/netbird/relay/server" - "github.com/netbirdio/netbird/shared/relay/auth/allow" "github.com/netbirdio/netbird/shared/relay/auth/hmac" "github.com/netbirdio/netbird/shared/relay/client" "github.com/netbirdio/netbird/util" diff --git a/shared/relay/auth/go.sum b/shared/relay/auth/go.sum deleted file mode 100644 index 938ef5547..000000000 --- a/shared/relay/auth/go.sum +++ /dev/null @@ -1 +0,0 @@ -golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc= diff --git a/shared/relay/auth/hmac/token.go b/shared/relay/auth/hmac/token.go index c908efbff..1ce61d3c2 100644 --- a/shared/relay/auth/hmac/token.go +++ b/shared/relay/auth/hmac/token.go @@ -47,31 +47,6 @@ func (m *TimedHMAC) GenerateToken(algo func() hash.Hash) (*Token, error) { }, nil } -// Validate checks if the token is valid -func (m *TimedHMAC) Validate(algo func() hash.Hash, token Token) error { - expectedMAC, err := m.generate(algo, token.Payload) - if err != nil { - return err - } - - expectedSignature := base64.StdEncoding.EncodeToString(expectedMAC) - - if !hmac.Equal([]byte(expectedSignature), []byte(token.Signature)) { - return fmt.Errorf("signature mismatch") - } - - timeAuthInt, err := strconv.ParseInt(token.Payload, 10, 64) - if err != nil { - return fmt.Errorf("invalid payload: %w", err) - } - - if time.Now().Unix() > timeAuthInt { - return fmt.Errorf("expired token") - } - - return nil -} - func (m *TimedHMAC) generate(algo func() hash.Hash, payload string) ([]byte, error) { mac := hmac.New(algo, []byte(m.secret)) _, err := mac.Write([]byte(payload)) diff --git a/shared/relay/auth/hmac/token_test.go b/shared/relay/auth/hmac/token_test.go index e629eab97..adeb2c8ea 100644 --- a/shared/relay/auth/hmac/token_test.go +++ b/shared/relay/auth/hmac/token_test.go @@ -2,7 +2,6 @@ package hmac import ( "crypto/sha1" - "crypto/sha256" "encoding/base64" "strconv" "testing" @@ -33,73 +32,3 @@ func TestGenerateCredentials(t *testing.T) { t.Fatalf("expected signature to be base64 encoded, got %v", err) } } - -func TestValidateCredentials(t *testing.T) { - secret := "supersecret" - timeToLive := 1 * time.Hour - manager := NewTimedHMAC(secret, timeToLive) - - // Test valid token - creds, err := manager.GenerateToken(sha1.New) - if err != nil { - t.Fatalf("expected no error, got %v", err) - } - - if err := manager.Validate(sha1.New, *creds); err != nil { - t.Fatalf("expected valid token: %s", err) - } -} - -func TestInvalidSignature(t *testing.T) { - secret := "supersecret" - timeToLive := 1 * time.Hour - manager := NewTimedHMAC(secret, timeToLive) - - creds, err := manager.GenerateToken(sha256.New) - if err != nil { - t.Fatalf("expected no error, got %v", err) - } - - invalidCreds := &Token{ - Payload: creds.Payload, - Signature: "invalidsignature", - } - - if err = manager.Validate(sha1.New, *invalidCreds); err == nil { - t.Fatalf("expected invalid token due to signature mismatch") - } -} - -func TestExpired(t *testing.T) { - secret := "supersecret" - v := NewTimedHMAC(secret, -1*time.Hour) - expiredCreds, err := v.GenerateToken(sha256.New) - if err != nil { - t.Fatalf("expected no error, got %v", err) - } - - if err = v.Validate(sha1.New, *expiredCreds); err == nil { - t.Fatalf("expected invalid token due to expiration") - } -} - -func TestInvalidPayload(t *testing.T) { - secret := "supersecret" - timeToLive := 1 * time.Hour - v := NewTimedHMAC(secret, timeToLive) - - creds, err := v.GenerateToken(sha256.New) - if err != nil { - t.Fatalf("expected no error, got %v", err) - } - - // Test invalid payload - invalidPayloadCreds := &Token{ - Payload: "invalidtimestamp", - Signature: creds.Signature, - } - - if err = v.Validate(sha1.New, *invalidPayloadCreds); err == nil { - t.Fatalf("expected invalid token due to invalid payload") - } -} diff --git a/shared/relay/client/client_serverip_test.go b/shared/relay/client/client_serverip_test.go index 7e699e37d..15d73d7d5 100644 --- a/shared/relay/client/client_serverip_test.go +++ b/shared/relay/client/client_serverip_test.go @@ -11,8 +11,8 @@ import ( "go.opentelemetry.io/otel" "github.com/netbirdio/netbird/client/iface" + "github.com/netbirdio/netbird/relay/auth/allow" "github.com/netbirdio/netbird/relay/server" - "github.com/netbirdio/netbird/shared/relay/auth/allow" ) // TestClient_ServerIPRecoversFromUnresolvableFQDN verifies that when the diff --git a/shared/relay/client/client_test.go b/shared/relay/client/client_test.go index 9820d642f..6ae6b1b86 100644 --- a/shared/relay/client/client_test.go +++ b/shared/relay/client/client_test.go @@ -11,11 +11,10 @@ import ( "go.opentelemetry.io/otel" "github.com/netbirdio/netbird/client/iface" - "github.com/netbirdio/netbird/shared/relay/auth/allow" + "github.com/netbirdio/netbird/relay/auth/allow" + "github.com/netbirdio/netbird/relay/server" "github.com/netbirdio/netbird/shared/relay/auth/hmac" "github.com/netbirdio/netbird/util" - - "github.com/netbirdio/netbird/relay/server" ) var ( diff --git a/shared/relay/client/manager_test.go b/shared/relay/client/manager_test.go index 9e964f688..0df2bb008 100644 --- a/shared/relay/client/manager_test.go +++ b/shared/relay/client/manager_test.go @@ -11,8 +11,8 @@ import ( "go.opentelemetry.io/otel" "github.com/netbirdio/netbird/client/iface" + "github.com/netbirdio/netbird/relay/auth/allow" "github.com/netbirdio/netbird/relay/server" - "github.com/netbirdio/netbird/shared/relay/auth/allow" ) // newManagerTestServerConfig creates a new server config for manager testing with the given address