| | | 1 | | using System.Security.Cryptography; |
| | | 2 | | using Microsoft.Extensions.Logging; |
| | | 3 | | |
| | | 4 | | namespace NLightning.Daemon.Services.Ipc; |
| | | 5 | | |
| | | 6 | | using Daemon.Ipc.Interfaces; |
| | | 7 | | |
| | | 8 | | /// <summary> |
| | | 9 | | /// Cookie-file-based authenticator (Bitcoin Core style). Uses constant-time comparison. |
| | | 10 | | /// </summary> |
| | | 11 | | public sealed class CookieFileAuthenticator : IIpcAuthenticator |
| | | 12 | | { |
| | | 13 | | private readonly string _cookieFilePath; |
| | | 14 | | private readonly ILogger<CookieFileAuthenticator> _logger; |
| | | 15 | | |
| | 0 | 16 | | public CookieFileAuthenticator(string cookieFilePath, ILogger<CookieFileAuthenticator> logger) |
| | | 17 | | { |
| | 0 | 18 | | _cookieFilePath = cookieFilePath; |
| | 0 | 19 | | _logger = logger; |
| | 0 | 20 | | } |
| | | 21 | | |
| | | 22 | | public async Task<bool> ValidateAsync(string? token, CancellationToken ct = default) |
| | | 23 | | { |
| | | 24 | | try |
| | | 25 | | { |
| | 0 | 26 | | if (string.IsNullOrEmpty(token)) return false; |
| | 0 | 27 | | if (!File.Exists(_cookieFilePath)) return false; |
| | 0 | 28 | | var expected = (await File.ReadAllTextAsync(_cookieFilePath, ct)).Trim(); |
| | 0 | 29 | | return FixedTimeEquals(expected, token); |
| | | 30 | | } |
| | 0 | 31 | | catch (Exception ex) |
| | | 32 | | { |
| | 0 | 33 | | _logger.LogWarning(ex, "Auth validation failed"); |
| | 0 | 34 | | return false; |
| | | 35 | | } |
| | 0 | 36 | | } |
| | | 37 | | |
| | | 38 | | private static bool FixedTimeEquals(string a, string b) |
| | | 39 | | { |
| | 0 | 40 | | var aBytes = System.Text.Encoding.UTF8.GetBytes(a); |
| | 0 | 41 | | var bBytes = System.Text.Encoding.UTF8.GetBytes(b); |
| | 0 | 42 | | return CryptographicOperations.FixedTimeEquals(aBytes, bBytes); |
| | | 43 | | } |
| | | 44 | | } |