direktil/local-server
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Compare commits

base: direktil:f83b1eab2352cd4df2f19def07b8e3e04a0c3871
Branches Tags
direktil:main direktil:dev direktil:testing direktil:test
...
compare: direktil:2b27cc57e34f17ceded04a76f4af89e0e8c4f66c
Branches Tags
direktil:main direktil:dev direktil:testing direktil:test

2 Commits
f83b1eab23 ... 2b27cc57e3

Author SHA1 Message Date
Mikaël Cluseau
2b27cc57e3 render context: add asset_download_token 2025-07-27 12:40:01 +02:00
Mikaël Cluseau
7f1193cdda dlset: allow globs in name, short kind 2025-07-27 12:08:45 +02:00
3 changed files with 106 additions and 48 deletions
Expand all files Collapse all files

27
cmd/dkl-local-server/render-context.go
View File

@ -14,6 +14,7 @@ import (
"path"
"path/filepath"
"text/template"
"time"
cfsslconfig "github.com/cloudflare/cfssl/config"
restful "github.com/emicklei/go-restful"
@ -237,6 +238,32 @@ func (ctx *renderContext) TemplateFuncs() map[string]any {
}
}
return
},
"asset_download_token": func(asset string, params ...string) (token string, err error) {
now := time.Now()
exp := now.Add(24 * time.Hour) // expire in 24h by default
if len(params) != 0 {
exp, err = parseCertDuration(params[0], now)
if err != nil {
return
}
}
set := DownloadSet{
Expiry: exp,
Items: []DownloadSetItem{
{
Kind: "host",
Name: ctx.Host.Name,
Assets: []string{asset},
},
},
}
privKey, _ := dlsSigningKeys()
token = set.Signed(privKey)
return
},
} {

115
cmd/dkl-local-server/ws-download-set.go
View File

@ -6,6 +6,7 @@ import (
"encoding/base32"
"fmt"
"io"
"path/filepath"
"slices"
"strconv"
"strings"
@ -69,6 +70,28 @@ func (s *DownloadSet) Decode(encoded string) (err error) {
return
}
func (s DownloadSet) Signed(privKey ed25519.PrivateKey) string {
buf := new(bytes.Buffer)
{
setBytes := []byte(s.Encode())
w := lz4.NewWriter(buf)
w.Write(setBytes)
w.Close()
}
setBytes := buf.Bytes()
sig := ed25519.Sign(privKey, setBytes)
buf = bytes.NewBuffer(make([]byte, 0, 1+len(sig)+len(setBytes)))
buf.WriteByte(byte(len(sig)))
buf.Write(sig)
buf.Write(setBytes)
enc := base32.StdEncoding.WithPadding(base32.NoPadding)
return enc.EncodeToString(buf.Bytes())
}
type DownloadSetItem struct {
Kind string
Name string
@ -76,7 +99,15 @@ type DownloadSetItem struct {
}
func (i DownloadSetItem) EncodeTo(buf *strings.Builder) {
buf.WriteString(i.Kind)
kind := i.Kind
switch kind {
case "host":
kind = "h"
case "cluster":
kind = "c"
}
buf.WriteString(kind)
buf.WriteByte(':')
buf.WriteString(i.Name)
@ -89,6 +120,14 @@ func (i DownloadSetItem) EncodeTo(buf *strings.Builder) {
func (i *DownloadSetItem) Decode(encoded string) {
rem := encoded
i.Kind, rem, _ = strings.Cut(rem, ":")
switch i.Kind {
case "h":
i.Kind = "host"
case "c":
i.Kind = "cluster"
}
i.Name, rem, _ = strings.Cut(rem, ":")
if rem == "" {
@ -121,32 +160,8 @@ func wsSignDownloadSet(req *restful.Request, resp *restful.Response) {
Items: setReq.Items,
}
buf := new(bytes.Buffer)
{
setBytes := []byte(set.Encode())
w := lz4.NewWriter(buf)
w.Write(setBytes)
w.Close()
}
setBytes := buf.Bytes()
privkey, pubkey := dlsSigningKeys()
sig := ed25519.Sign(privkey, setBytes)
if !ed25519.Verify(pubkey, setBytes, sig) {
wsError(resp, fmt.Errorf("signature self-check failed"))
return
}
buf = bytes.NewBuffer(make([]byte, 0, 1+len(sig)+len(setBytes)))
buf.WriteByte(byte(len(sig)))
buf.Write(sig)
buf.Write(setBytes)
enc := base32.StdEncoding.WithPadding(base32.NoPadding)
resp.WriteEntity(enc.EncodeToString(buf.Bytes()))
privKey, _ := dlsSigningKeys()
resp.WriteEntity(set.Signed(privKey))
}
func getDlSet(req *restful.Request) (*DownloadSet, *httperr.Error) {
@ -230,10 +245,8 @@ func wsDownloadSet(req *restful.Request, resp *restful.Response) {
<html>
<head>
<title>` + err.Error() + `</title>
<style>
@import url('/ui/style.css');
@import url('/ui/app.css');
</style>
<style src="/ui/style.css"/>
<style src="/ui/app.css"/>
</head>
<body><h1>` + err.Error() + `</h1></body>
</html>`))
@ -245,21 +258,43 @@ func wsDownloadSet(req *restful.Request, resp *restful.Response) {
<html>
<head>
<title>Download set</title>
<style>
@import url('/ui/style.css');
@import url('/ui/app.css');
</style>
<style src="/ui/style.css"/>
<style src="/ui/app.css"/>
</head>
<body><h1>Download set</h1>
`)
cfg, err2 := readConfig()
if err2 != nil {
wsError(resp, err2)
return
}
for _, item := range set.Items {
fmt.Fprintf(buf, "<h2>%s %s</h2>", strings.Title(item.Kind), item.Name)
fmt.Fprintf(buf, "<p class=\"download-links\">\n")
for _, asset := range item.Assets {
fmt.Fprintf(buf, " <a href=\"/public/download-set/%s/%s/%s?set=%s\" download>%s</a>\n", item.Kind, item.Name, asset, setStr, asset)
names := make([]string, 0)
switch item.Kind {
case "cluster":
for _, c := range cfg.Clusters {
if ok, _ := filepath.Match(item.Name, c.Name); ok {
names = append(names, c.Name)
}
}
case "host":
for _, h := range cfg.Hosts {
if ok, _ := filepath.Match(item.Name, h.Name); ok {
names = append(names, h.Name)
}
}
}
for _, name := range names {
fmt.Fprintf(buf, "<h2>%s %s</h2>", strings.Title(item.Kind), name)
fmt.Fprintf(buf, "<p class=\"download-links\">\n")
for _, asset := range item.Assets {
fmt.Fprintf(buf, " <a href=\"/public/download-set/%s/%s/%s?set=%s\" download>%s</a>\n", item.Kind, name, asset, setStr, asset)
}
fmt.Fprintf(buf, `</p>`)
}
fmt.Fprintf(buf, `</p>`)
}
buf.WriteString("</body></html>")

12
cmd/dkl-local-server/ws-downloads.go
View File

@ -184,10 +184,8 @@ func wsDownloadPage(req *restful.Request, resp *restful.Response) {
<html>
<head>
<title>Token not found</title>
<style>
@import url('/ui/style.css');
@import url('/ui/app.css');
</style>
<style src="/ui/style.css"/>
<style src="/ui/app.css"/>
</head>
<body><h1>Token not found</h1></body>
</html>`))
@ -199,10 +197,8 @@ func wsDownloadPage(req *restful.Request, resp *restful.Response) {
<html>
<head>
<title>Token assets: %s %s</title>
<style>
@import url('/ui/style.css');
@import url('/ui/app.css');
</style>
<style src="/ui/style.css"/>
<style src="/ui/app.css"/>
</head>
<body><h1>Token assets: %s %s</h1>
<ul>