mirror of
https://github.com/Sagit-chu/flvx.git
synced 2026-11-13 00:14:22 +08:00
sagit
fadc2b6c12
* fix(relay): authenticate endpoints and fail closed on missing routes * fix(tunnel): retain chains until receiver replacement is acknowledged * docs: record final relay security review and validation
42 lines
1.3 KiB
Go
42 lines
1.3 KiB
Go
// Package relaysecurity defines the versioned, endpoint-scoped relay contract.
|
|
// It authenticates relay clients, not the confidentiality of their transport.
|
|
package relaysecurity
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/hex"
|
|
"errors"
|
|
"strings"
|
|
)
|
|
|
|
const Version = 1
|
|
const Required = "required"
|
|
const Legacy = "legacy"
|
|
|
|
type Credentials struct {
|
|
Version int `json:"version"`
|
|
Username string `json:"username"`
|
|
Password string `json:"password"`
|
|
}
|
|
|
|
func New() (*Credentials, error) {
|
|
b := make([]byte, 32)
|
|
if _, err := rand.Read(b); err != nil {
|
|
return nil, errors.New("relay credential randomness unavailable")
|
|
}
|
|
u := make([]byte, 12)
|
|
if _, err := rand.Read(u); err != nil {
|
|
return nil, errors.New("relay credential randomness unavailable")
|
|
}
|
|
return &Credentials{Version: Version, Username: "relay-" + hex.EncodeToString(u), Password: hex.EncodeToString(b)}, nil
|
|
}
|
|
func (c *Credentials) Validate() error {
|
|
if c == nil || c.Version != Version || strings.TrimSpace(c.Username) == "" || len(c.Username) > 255 || len(c.Password) < 32 || len(c.Password) > 255 {
|
|
return errors.New("invalid required relay authentication")
|
|
}
|
|
return nil
|
|
}
|
|
func (c *Credentials) Config() map[string]interface{} {
|
|
return map[string]interface{}{"username": c.Username, "password": c.Password}
|
|
}
|