909 lines
31 KiB
C
909 lines
31 KiB
C
/*
|
|
* C-Relay Request Validator - Integrated Authentication System
|
|
*
|
|
* Provides complete request validation including:
|
|
* - Protocol validation via nostr_core_lib (signatures, pubkey extraction,
|
|
* NIP-42)
|
|
* - Database-driven authorization rules (whitelist, blacklist, size limits)
|
|
* - Memory caching for performance
|
|
* - SQLite integration for C-relay needs
|
|
*/
|
|
|
|
#define _GNU_SOURCE
|
|
#include "../nostr_core_lib/cjson/cJSON.h"
|
|
#include "../nostr_core_lib/nostr_core/nip001.h"
|
|
#include "../nostr_core_lib/nostr_core/nip013.h" // NIP-13: Proof of Work
|
|
#include "../nostr_core_lib/nostr_core/nostr_common.h"
|
|
#include "../nostr_core_lib/nostr_core/utils.h"
|
|
#include "debug.h" // C-relay debug system
|
|
#include "config.h" // C-relay configuration system
|
|
#include <sqlite3.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <strings.h>
|
|
#include <time.h>
|
|
|
|
// External references to C-relay global state
|
|
extern sqlite3* g_db;
|
|
extern char g_database_path[512];
|
|
|
|
// Forward declaration for C-relay event storage function
|
|
extern int store_event(cJSON* event);
|
|
|
|
// External references to C-relay global PoW configuration (matching main.c)
|
|
extern struct pow_config {
|
|
int enabled; // 0 = disabled, 1 = enabled
|
|
int min_pow_difficulty; // Minimum required difficulty (0 = no requirement)
|
|
int validation_flags; // Bitflags for validation options
|
|
int require_nonce_tag; // 1 = require nonce tag presence
|
|
int reject_lower_targets; // 1 = reject if committed < actual difficulty
|
|
int strict_format; // 1 = enforce strict nonce tag format
|
|
int anti_spam_mode; // 1 = full anti-spam validation
|
|
} g_pow_config;
|
|
|
|
// External references to C-relay expiration configuration (matching main.c)
|
|
extern struct expiration_config {
|
|
int enabled; // 0 = disabled, 1 = enabled
|
|
int strict_mode; // 1 = reject expired events on submission
|
|
int filter_responses; // 1 = filter expired events from responses
|
|
int delete_expired; // 1 = delete expired events from DB (future feature)
|
|
long grace_period; // Grace period in seconds for clock skew
|
|
} g_expiration_config;
|
|
|
|
// Configuration functions from C-relay
|
|
extern int get_config_bool(const char* key, int default_value);
|
|
extern int get_config_int(const char* key, int default_value);
|
|
|
|
// NIP-42 constants (from nostr_core_lib)
|
|
#define NOSTR_NIP42_AUTH_EVENT_KIND 22242
|
|
|
|
// NIP-42 error codes (from nostr_core_lib - already defined in nostr_common.h)
|
|
|
|
// Forward declarations for NIP-42 functions (simple implementations for C-relay)
|
|
int nostr_nip42_generate_challenge(char *challenge_buffer, size_t buffer_size);
|
|
int nostr_nip42_verify_auth_event(cJSON *event, const char *challenge_id,
|
|
const char *relay_url, int time_tolerance_seconds);
|
|
|
|
// Type definitions for unified request validation
|
|
typedef struct {
|
|
const char *operation; // HTTP method or operation type
|
|
const char *auth_header; // Authorization header value
|
|
const char *client_ip; // Client IP address
|
|
const char *request_url; // Full request URL
|
|
const char *resource_hash; // Resource hash for validation
|
|
const char *challenge_id; // NIP-42 challenge ID
|
|
long file_size; // File size for upload validation
|
|
int nip42_enabled; // Whether NIP-42 is enabled
|
|
} nostr_unified_request_t;
|
|
|
|
typedef struct {
|
|
int valid; // Whether request is valid
|
|
int error_code; // Error code if invalid
|
|
char reason[512]; // Reason for validation result
|
|
char pubkey[65]; // Extracted pubkey from event
|
|
unsigned char *file_data; // File data for uploads
|
|
size_t file_size; // Size of file data
|
|
int owns_file_data; // Whether we own the file data memory
|
|
char expected_hash[65]; // Expected file hash
|
|
} nostr_request_result_t;
|
|
|
|
// Additional error codes for ginxsom-specific functionality
|
|
#define NOSTR_ERROR_CRYPTO_INIT -100
|
|
#define NOSTR_ERROR_AUTH_REQUIRED -101
|
|
#define NOSTR_ERROR_NIP42_DISABLED -102
|
|
#define NOSTR_ERROR_EVENT_EXPIRED -103
|
|
// Note: NOSTR_ERROR_NIP42_CHALLENGE_NOT_FOUND and
|
|
// NOSTR_ERROR_NIP42_CHALLENGE_EXPIRED are already defined in
|
|
// nostr_core_lib/nostr_core/nostr_common.h
|
|
|
|
// Note: Using g_database_path from C-relay global state instead of hardcoded path
|
|
|
|
// NIP-42 challenge management constants
|
|
#define MAX_CHALLENGES 1000
|
|
#define CHALLENGE_CLEANUP_INTERVAL 300 // 5 minutes
|
|
|
|
//=============================================================================
|
|
// DATA STRUCTURES
|
|
//=============================================================================
|
|
|
|
// NIP-42 challenge storage
|
|
typedef struct {
|
|
char challenge_id[65];
|
|
char client_ip[64];
|
|
time_t created_at;
|
|
time_t expires_at;
|
|
int active;
|
|
} nip42_challenge_entry_t;
|
|
|
|
// NIP-42 challenge management
|
|
typedef struct {
|
|
nip42_challenge_entry_t challenges[MAX_CHALLENGES];
|
|
int challenge_count;
|
|
time_t last_cleanup;
|
|
int timeout_seconds;
|
|
int time_tolerance_seconds;
|
|
} nip42_challenge_manager_t;
|
|
|
|
//=============================================================================
|
|
// GLOBAL STATE
|
|
//=============================================================================
|
|
|
|
// No longer using local auth cache - using unified cache from config.c
|
|
static nip42_challenge_manager_t g_challenge_manager = {0};
|
|
static int g_validator_initialized = 0;
|
|
|
|
// Last rule violation details for status code mapping
|
|
struct {
|
|
char violation_type[100]; // "pubkey_blacklist", "hash_blacklist",
|
|
// "whitelist_violation", etc.
|
|
char reason[500]; // specific reason string
|
|
} g_last_rule_violation = {0};
|
|
|
|
|
|
//=============================================================================
|
|
// FORWARD DECLARATIONS
|
|
//=============================================================================
|
|
|
|
static int reload_auth_config(void);
|
|
// Removed unused forward declarations for functions that are no longer called
|
|
int check_database_auth_rules(const char *pubkey, const char *operation,
|
|
const char *resource_hash);
|
|
void nostr_request_validator_clear_violation(void);
|
|
|
|
// NIP-42 challenge management functions
|
|
static void cleanup_expired_challenges(void);
|
|
static int store_challenge(const char *challenge_id, const char *client_ip);
|
|
static int generate_challenge_id(char *challenge_buffer, size_t buffer_size);
|
|
|
|
//=============================================================================
|
|
// MAIN API FUNCTIONS
|
|
//=============================================================================
|
|
|
|
/**
|
|
* Initialize the ginxsom request validator system
|
|
*/
|
|
int ginxsom_request_validator_init(const char *db_path, const char *app_name) {
|
|
// Mark db_path as unused to suppress warning - it's for future use
|
|
(void)db_path;
|
|
(void)app_name;
|
|
|
|
if (g_validator_initialized) {
|
|
return NOSTR_SUCCESS; // Already initialized
|
|
}
|
|
|
|
// Initialize nostr_core_lib if not already done
|
|
if (nostr_crypto_init() != NOSTR_SUCCESS) {
|
|
return NOSTR_ERROR_CRYPTO_INIT;
|
|
}
|
|
|
|
// Load initial configuration from database
|
|
int result = reload_auth_config();
|
|
if (result != NOSTR_SUCCESS) {
|
|
return result;
|
|
}
|
|
|
|
// Initialize NIP-42 challenge manager using unified config
|
|
memset(&g_challenge_manager, 0, sizeof(g_challenge_manager));
|
|
|
|
const char* nip42_timeout = get_config_value("nip42_challenge_timeout");
|
|
g_challenge_manager.timeout_seconds = nip42_timeout ? atoi(nip42_timeout) : 600;
|
|
if (nip42_timeout) free((char*)nip42_timeout);
|
|
|
|
const char* nip42_tolerance = get_config_value("nip42_time_tolerance");
|
|
g_challenge_manager.time_tolerance_seconds = nip42_tolerance ? atoi(nip42_tolerance) : 300;
|
|
if (nip42_tolerance) free((char*)nip42_tolerance);
|
|
|
|
g_challenge_manager.last_cleanup = time(NULL);
|
|
|
|
g_validator_initialized = 1;
|
|
return NOSTR_SUCCESS;
|
|
}
|
|
|
|
/**
|
|
* Check if authentication rules are enabled
|
|
*/
|
|
int nostr_auth_rules_enabled(void) {
|
|
// Use unified cache from config.c
|
|
const char* auth_enabled = get_config_value("auth_enabled");
|
|
int result = 0;
|
|
if (auth_enabled && strcmp(auth_enabled, "true") == 0) {
|
|
result = 1;
|
|
}
|
|
if (auth_enabled) free((char*)auth_enabled);
|
|
|
|
// Also check legacy key
|
|
const char* auth_rules_enabled = get_config_value("auth_rules_enabled");
|
|
if (auth_rules_enabled && strcmp(auth_rules_enabled, "true") == 0) {
|
|
result = 1;
|
|
}
|
|
if (auth_rules_enabled) free((char*)auth_rules_enabled);
|
|
|
|
return result;
|
|
}
|
|
|
|
///////////////////////////////////////////////////////////////////////////////////////
|
|
///////////////////////////////////////////////////////////////////////////////////////
|
|
// MAIN VALIDATION OF REQUEST
|
|
///////////////////////////////////////////////////////////////////////////////////////
|
|
///////////////////////////////////////////////////////////////////////////////////////
|
|
int nostr_validate_unified_request(const char* json_string, size_t json_length) {
|
|
// Clear previous violation details
|
|
nostr_request_validator_clear_violation();
|
|
|
|
/////////////////////////////////////////////////////////////////////
|
|
// PHASE 1: INPUT VALIDATION (Immediate Rejection ~1μs)
|
|
/////////////////////////////////////////////////////////////////////
|
|
|
|
// 1. Null Pointer Checks - Reject malformed requests instantly
|
|
if (!json_string || json_length == 0) {
|
|
return NOSTR_ERROR_INVALID_INPUT;
|
|
}
|
|
|
|
// 2. Initialization Check - Verify system is properly initialized
|
|
if (!g_validator_initialized) {
|
|
return NOSTR_ERROR_INVALID_INPUT;
|
|
}
|
|
|
|
// 3. Parse JSON string to cJSON event object
|
|
cJSON *event = cJSON_ParseWithLength(json_string, json_length);
|
|
if (!event) {
|
|
return NOSTR_ERROR_INVALID_INPUT;
|
|
}
|
|
|
|
// 4. Validate basic event structure
|
|
cJSON *id = cJSON_GetObjectItem(event, "id");
|
|
cJSON *pubkey = cJSON_GetObjectItem(event, "pubkey");
|
|
cJSON *created_at = cJSON_GetObjectItem(event, "created_at");
|
|
cJSON *kind = cJSON_GetObjectItem(event, "kind");
|
|
cJSON *tags = cJSON_GetObjectItem(event, "tags");
|
|
cJSON *content = cJSON_GetObjectItem(event, "content");
|
|
cJSON *sig = cJSON_GetObjectItem(event, "sig");
|
|
|
|
if (!id || !cJSON_IsString(id) ||
|
|
!pubkey || !cJSON_IsString(pubkey) ||
|
|
!created_at || !cJSON_IsNumber(created_at) ||
|
|
!kind || !cJSON_IsNumber(kind) ||
|
|
!tags || !cJSON_IsArray(tags) ||
|
|
!content || !cJSON_IsString(content) ||
|
|
!sig || !cJSON_IsString(sig)) {
|
|
cJSON_Delete(event);
|
|
return NOSTR_ERROR_INVALID_INPUT;
|
|
}
|
|
|
|
int event_kind = (int)cJSON_GetNumberValue(kind);
|
|
|
|
// 5. Check configuration using unified cache
|
|
int auth_required = nostr_auth_rules_enabled();
|
|
|
|
/////////////////////////////////////////////////////////////////////
|
|
// PHASE 2: NOSTR EVENT VALIDATION
|
|
/////////////////////////////////////////////////////////////////////
|
|
|
|
// 6. Nostr Event Structure Validation using nostr_core_lib
|
|
int validation_result = nostr_validate_event(event);
|
|
if (validation_result != NOSTR_SUCCESS) {
|
|
cJSON_Delete(event);
|
|
return validation_result;
|
|
}
|
|
|
|
// 7. Extract pubkey for rule evaluation
|
|
const char *event_pubkey = cJSON_GetStringValue(pubkey);
|
|
if (!event_pubkey || strlen(event_pubkey) != 64) {
|
|
cJSON_Delete(event);
|
|
return NOSTR_ERROR_EVENT_INVALID_PUBKEY;
|
|
}
|
|
|
|
/////////////////////////////////////////////////////////////////////
|
|
// PHASE 3: ADMIN EVENT BYPASS CHECK
|
|
/////////////////////////////////////////////////////////////////////
|
|
|
|
// 8. Check if this is a kind 23456 admin event from authorized admin
|
|
// This must happen AFTER signature validation but BEFORE auth rules
|
|
if (event_kind == 23456) {
|
|
const char* admin_pubkey = get_config_value("admin_pubkey");
|
|
if (admin_pubkey && strcmp(event_pubkey, admin_pubkey) == 0) {
|
|
// Valid admin event - bypass remaining validation
|
|
cJSON_Delete(event);
|
|
return NOSTR_SUCCESS;
|
|
}
|
|
// Not from admin - continue with normal validation
|
|
}
|
|
|
|
/////////////////////////////////////////////////////////////////////
|
|
// PHASE 4: EVENT KIND SPECIFIC VALIDATION
|
|
/////////////////////////////////////////////////////////////////////
|
|
|
|
// 9. Handle NIP-42 authentication challenge events (kind 22242)
|
|
if (event_kind == 22242) {
|
|
// Check NIP-42 mode using unified cache
|
|
const char* nip42_enabled = get_config_value("nip42_auth_enabled");
|
|
if (nip42_enabled && strcmp(nip42_enabled, "false") == 0) {
|
|
free((char*)nip42_enabled);
|
|
cJSON_Delete(event);
|
|
return NOSTR_ERROR_NIP42_DISABLED;
|
|
}
|
|
if (nip42_enabled) free((char*)nip42_enabled);
|
|
|
|
// TODO: Implement full NIP-42 challenge validation
|
|
// For now, accept all valid NIP-42 events
|
|
cJSON_Delete(event);
|
|
return NOSTR_SUCCESS;
|
|
}
|
|
|
|
/////////////////////////////////////////////////////////////////////
|
|
// PHASE 5: AUTHENTICATION RULES (Database Queries)
|
|
/////////////////////////////////////////////////////////////////////
|
|
|
|
// 10. Check if authentication rules are enabled
|
|
if (!auth_required) {
|
|
} else {
|
|
// 11. Check database authentication rules (only if auth enabled)
|
|
|
|
// Create operation string with event kind for more specific rule matching
|
|
char operation_str[64];
|
|
snprintf(operation_str, sizeof(operation_str), "event_kind_%d", event_kind);
|
|
|
|
// Also check generic "event" operation for backward compatibility
|
|
int rules_result = check_database_auth_rules(event_pubkey, "event", NULL);
|
|
if (rules_result != NOSTR_SUCCESS) {
|
|
// If generic event check fails, try specific event kind check
|
|
rules_result = check_database_auth_rules(event_pubkey, operation_str, NULL);
|
|
if (rules_result != NOSTR_SUCCESS) {
|
|
cJSON_Delete(event);
|
|
return rules_result;
|
|
}
|
|
}
|
|
}
|
|
|
|
/////////////////////////////////////////////////////////////////////
|
|
// PHASE 6: ADDITIONAL VALIDATIONS (C-relay specific)
|
|
/////////////////////////////////////////////////////////////////////
|
|
|
|
// 12. NIP-13 Proof of Work validation
|
|
int pow_enabled = get_config_bool("pow_enabled", 0);
|
|
int pow_min_difficulty = get_config_int("pow_min_difficulty", 0);
|
|
int pow_validation_flags = get_config_int("pow_validation_flags", 1);
|
|
|
|
if (pow_enabled && pow_min_difficulty > 0) {
|
|
nostr_pow_result_t pow_result;
|
|
int pow_validation_result = nostr_validate_pow(event, pow_min_difficulty,
|
|
pow_validation_flags, &pow_result);
|
|
|
|
if (pow_validation_result != NOSTR_SUCCESS) {
|
|
cJSON_Delete(event);
|
|
return pow_validation_result;
|
|
}
|
|
}
|
|
|
|
// 13. NIP-40 Expiration validation
|
|
// Always check expiration tags if present (following NIP-40 specification)
|
|
|
|
cJSON *expiration_tag = NULL;
|
|
cJSON *tags_array = cJSON_GetObjectItem(event, "tags");
|
|
|
|
if (tags_array && cJSON_IsArray(tags_array)) {
|
|
cJSON *tag = NULL;
|
|
cJSON_ArrayForEach(tag, tags_array) {
|
|
if (!cJSON_IsArray(tag)) continue;
|
|
|
|
cJSON *tag_name = cJSON_GetArrayItem(tag, 0);
|
|
if (!tag_name || !cJSON_IsString(tag_name)) continue;
|
|
|
|
const char *tag_name_str = cJSON_GetStringValue(tag_name);
|
|
if (strcmp(tag_name_str, "expiration") == 0) {
|
|
cJSON *tag_value = cJSON_GetArrayItem(tag, 1);
|
|
if (tag_value && cJSON_IsString(tag_value)) {
|
|
expiration_tag = tag_value;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if (expiration_tag) {
|
|
const char *expiration_str = cJSON_GetStringValue(expiration_tag);
|
|
|
|
// Validate that the expiration string contains only digits (and optional leading whitespace)
|
|
const char* p = expiration_str;
|
|
|
|
// Skip leading whitespace
|
|
while (*p == ' ' || *p == '\t') p++;
|
|
|
|
// Check if we have at least one digit
|
|
if (*p == '\0') {
|
|
} else {
|
|
// Validate that all remaining characters are digits
|
|
const char* digit_start = p;
|
|
while (*p >= '0' && *p <= '9') p++;
|
|
|
|
// If we didn't consume the entire string or found no digits, it's malformed
|
|
if (*p != '\0' || p == digit_start) {
|
|
} else {
|
|
// Valid numeric string, parse and check expiration
|
|
time_t expiration_time = (time_t)atol(expiration_str);
|
|
time_t now = time(NULL);
|
|
int grace_period = get_config_int("nip40_expiration_grace_period", 60);
|
|
|
|
if (expiration_time > 0 && now > expiration_time + grace_period) {
|
|
cJSON_Delete(event);
|
|
return NOSTR_ERROR_EVENT_EXPIRED;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// All validations passed
|
|
cJSON_Delete(event);
|
|
return NOSTR_SUCCESS;
|
|
}
|
|
|
|
/**
|
|
* Generate NIP-42 challenge for clients
|
|
*/
|
|
int nostr_request_validator_generate_nip42_challenge(void *challenge_struct,
|
|
const char *client_ip) {
|
|
// Mark client_ip as unused to suppress warning - it's for future enhancement
|
|
(void)client_ip;
|
|
|
|
// Use nostr_core_lib NIP-42 functionality
|
|
char challenge_id[65];
|
|
int result = nostr_nip42_generate_challenge(challenge_id, 32);
|
|
if (result != NOSTR_SUCCESS) {
|
|
return result;
|
|
}
|
|
|
|
// Fill challenge structure (assuming it's a compatible structure)
|
|
// This is a simplified implementation - adjust based on actual structure
|
|
// needs
|
|
if (challenge_struct) {
|
|
// Cast to appropriate structure and fill fields
|
|
// For now, just return success
|
|
}
|
|
|
|
return NOSTR_SUCCESS;
|
|
}
|
|
|
|
/**
|
|
* Get the last rule violation type for status code mapping
|
|
*/
|
|
const char *nostr_request_validator_get_last_violation_type(void) {
|
|
return g_last_rule_violation.violation_type;
|
|
}
|
|
|
|
/**
|
|
* Clear the last rule violation details
|
|
*/
|
|
void nostr_request_validator_clear_violation(void) {
|
|
memset(&g_last_rule_violation, 0, sizeof(g_last_rule_violation));
|
|
}
|
|
|
|
/**
|
|
* Cleanup request validator resources
|
|
*/
|
|
void ginxsom_request_validator_cleanup(void) {
|
|
g_validator_initialized = 0;
|
|
nostr_request_validator_clear_violation();
|
|
}
|
|
|
|
/**
|
|
* Free file data allocated by validator
|
|
*/
|
|
void nostr_request_result_free_file_data(nostr_request_result_t *result) {
|
|
if (result && result->file_data && result->owns_file_data) {
|
|
free(result->file_data);
|
|
result->file_data = NULL;
|
|
result->file_size = 0;
|
|
result->owns_file_data = 0;
|
|
}
|
|
}
|
|
|
|
//=============================================================================
|
|
// HELPER FUNCTIONS
|
|
//=============================================================================
|
|
|
|
|
|
/**
|
|
* Force cache refresh - cache no longer exists, function kept for compatibility
|
|
*/
|
|
void nostr_request_validator_force_cache_refresh(void) {
|
|
// Cache no longer exists - direct database queries are used
|
|
}
|
|
|
|
/**
|
|
* This function is no longer needed - configuration is handled by unified cache
|
|
*/
|
|
static int reload_auth_config(void) {
|
|
// Configuration is now handled by the unified cache in config.c
|
|
return NOSTR_SUCCESS;
|
|
}
|
|
|
|
// Removed unused functions: parse_authorization_header, extract_pubkey_from_event
|
|
|
|
// Note: Blossom protocol validation removed - C-relay uses standard Nostr events only
|
|
|
|
/**
|
|
* Check database authentication rules for the request
|
|
* Implements the 6-step rule evaluation engine from AUTH_API.md
|
|
*/
|
|
int check_database_auth_rules(const char *pubkey, const char *operation __attribute__((unused)),
|
|
const char *resource_hash) {
|
|
sqlite3 *db = NULL;
|
|
sqlite3_stmt *stmt = NULL;
|
|
int rc;
|
|
|
|
DEBUG_TRACE("Checking auth rules for pubkey: %s", pubkey);
|
|
|
|
if (!pubkey) {
|
|
return NOSTR_ERROR_INVALID_INPUT;
|
|
}
|
|
|
|
// Open database using global database path
|
|
if (strlen(g_database_path) == 0) {
|
|
return NOSTR_SUCCESS; // Default allow on DB error
|
|
}
|
|
|
|
rc = sqlite3_open_v2(g_database_path, &db, SQLITE_OPEN_READONLY, NULL);
|
|
if (rc != SQLITE_OK) {
|
|
return NOSTR_SUCCESS; // Default allow on DB error
|
|
}
|
|
|
|
// Step 1: Check pubkey blacklist (highest priority)
|
|
const char *blacklist_sql =
|
|
"SELECT rule_type FROM auth_rules WHERE rule_type = "
|
|
"'blacklist' AND pattern_type = 'pubkey' AND pattern_value = ? AND active = 1 LIMIT 1";
|
|
DEBUG_TRACE("Blacklist SQL: %s", blacklist_sql);
|
|
rc = sqlite3_prepare_v2(db, blacklist_sql, -1, &stmt, NULL);
|
|
if (rc == SQLITE_OK) {
|
|
sqlite3_bind_text(stmt, 1, pubkey, -1, SQLITE_STATIC);
|
|
|
|
int step_result = sqlite3_step(stmt);
|
|
DEBUG_TRACE("Blacklist query result: %s", step_result == SQLITE_ROW ? "FOUND" : "NOT_FOUND");
|
|
|
|
if (step_result == SQLITE_ROW) {
|
|
DEBUG_TRACE("BLACKLIST HIT: Denying access for pubkey: %s", pubkey);
|
|
// Set specific violation details for status code mapping
|
|
strcpy(g_last_rule_violation.violation_type, "pubkey_blacklist");
|
|
sprintf(g_last_rule_violation.reason, "Public key blacklisted");
|
|
|
|
sqlite3_finalize(stmt);
|
|
sqlite3_close(db);
|
|
return NOSTR_ERROR_AUTH_REQUIRED;
|
|
}
|
|
sqlite3_finalize(stmt);
|
|
}
|
|
|
|
// Step 2: Check hash blacklist
|
|
if (resource_hash) {
|
|
const char *hash_blacklist_sql =
|
|
"SELECT rule_type FROM auth_rules WHERE rule_type = "
|
|
"'blacklist' AND pattern_type = 'hash' AND pattern_value = ? AND active = 1 LIMIT 1";
|
|
rc = sqlite3_prepare_v2(db, hash_blacklist_sql, -1, &stmt, NULL);
|
|
if (rc == SQLITE_OK) {
|
|
sqlite3_bind_text(stmt, 1, resource_hash, -1, SQLITE_STATIC);
|
|
|
|
if (sqlite3_step(stmt) == SQLITE_ROW) {
|
|
// Set specific violation details for status code mapping
|
|
strcpy(g_last_rule_violation.violation_type, "hash_blacklist");
|
|
sprintf(g_last_rule_violation.reason, "File hash blacklisted");
|
|
|
|
sqlite3_finalize(stmt);
|
|
sqlite3_close(db);
|
|
return NOSTR_ERROR_AUTH_REQUIRED;
|
|
}
|
|
sqlite3_finalize(stmt);
|
|
}
|
|
}
|
|
|
|
// Step 3: Check pubkey whitelist
|
|
const char *whitelist_sql =
|
|
"SELECT rule_type FROM auth_rules WHERE rule_type = "
|
|
"'whitelist' AND pattern_type = 'pubkey' AND pattern_value = ? AND active = 1 LIMIT 1";
|
|
rc = sqlite3_prepare_v2(db, whitelist_sql, -1, &stmt, NULL);
|
|
if (rc == SQLITE_OK) {
|
|
sqlite3_bind_text(stmt, 1, pubkey, -1, SQLITE_STATIC);
|
|
|
|
if (sqlite3_step(stmt) == SQLITE_ROW) {
|
|
sqlite3_finalize(stmt);
|
|
sqlite3_close(db);
|
|
return NOSTR_SUCCESS; // Allow whitelisted pubkey
|
|
}
|
|
sqlite3_finalize(stmt);
|
|
}
|
|
|
|
// Step 4: Check if any whitelist rules exist - if yes, deny by default
|
|
const char *whitelist_exists_sql =
|
|
"SELECT COUNT(*) FROM auth_rules WHERE rule_type = 'whitelist' "
|
|
"AND pattern_type = 'pubkey' AND active = 1 LIMIT 1";
|
|
rc = sqlite3_prepare_v2(db, whitelist_exists_sql, -1, &stmt, NULL);
|
|
if (rc == SQLITE_OK) {
|
|
if (sqlite3_step(stmt) == SQLITE_ROW) {
|
|
int whitelist_count = sqlite3_column_int(stmt, 0);
|
|
if (whitelist_count > 0) {
|
|
// Set specific violation details for status code mapping
|
|
strcpy(g_last_rule_violation.violation_type, "whitelist_violation");
|
|
strcpy(g_last_rule_violation.reason,
|
|
"Public key not whitelisted for this operation");
|
|
|
|
sqlite3_finalize(stmt);
|
|
sqlite3_close(db);
|
|
return NOSTR_ERROR_AUTH_REQUIRED;
|
|
}
|
|
}
|
|
sqlite3_finalize(stmt);
|
|
}
|
|
|
|
sqlite3_close(db);
|
|
return NOSTR_SUCCESS; // Default allow if no restrictive rules matched
|
|
}
|
|
|
|
// Removed unused functions: validate_nip42_event, validate_admin_event
|
|
|
|
//=============================================================================
|
|
// NIP-42 CHALLENGE MANAGEMENT FUNCTIONS
|
|
//=============================================================================
|
|
|
|
/**
|
|
* Generate a challenge ID using nostr_core_lib
|
|
*/
|
|
static int generate_challenge_id(char *challenge_buffer, size_t buffer_size) {
|
|
if (!challenge_buffer || buffer_size < 65) {
|
|
return NOSTR_ERROR_INVALID_INPUT;
|
|
}
|
|
|
|
// Use nostr_core_lib to generate a random challenge
|
|
return nostr_nip42_generate_challenge(challenge_buffer, 32);
|
|
}
|
|
|
|
/**
|
|
* Clean up expired challenges from memory
|
|
*/
|
|
static void cleanup_expired_challenges(void) {
|
|
time_t now = time(NULL);
|
|
|
|
// Only cleanup if enough time has passed
|
|
if (now - g_challenge_manager.last_cleanup < CHALLENGE_CLEANUP_INTERVAL) {
|
|
return;
|
|
}
|
|
|
|
int active_count = 0;
|
|
for (int i = 0; i < g_challenge_manager.challenge_count; i++) {
|
|
if (g_challenge_manager.challenges[i].active) {
|
|
if (now > g_challenge_manager.challenges[i].expires_at) {
|
|
// Mark expired challenge as inactive
|
|
g_challenge_manager.challenges[i].active = 0;
|
|
memset(g_challenge_manager.challenges[i].challenge_id, 0,
|
|
sizeof(g_challenge_manager.challenges[i].challenge_id));
|
|
} else {
|
|
active_count++;
|
|
}
|
|
}
|
|
}
|
|
|
|
// Compact the array if we have many inactive entries
|
|
if (active_count < g_challenge_manager.challenge_count / 2 &&
|
|
active_count < MAX_CHALLENGES - 100) {
|
|
int write_idx = 0;
|
|
for (int read_idx = 0; read_idx < g_challenge_manager.challenge_count;
|
|
read_idx++) {
|
|
if (g_challenge_manager.challenges[read_idx].active) {
|
|
if (write_idx != read_idx) {
|
|
memcpy(&g_challenge_manager.challenges[write_idx],
|
|
&g_challenge_manager.challenges[read_idx],
|
|
sizeof(nip42_challenge_entry_t));
|
|
}
|
|
write_idx++;
|
|
}
|
|
}
|
|
g_challenge_manager.challenge_count = write_idx;
|
|
}
|
|
|
|
g_challenge_manager.last_cleanup = now;
|
|
}
|
|
|
|
/**
|
|
* Store a new challenge in memory
|
|
*/
|
|
static int store_challenge(const char *challenge_id, const char *client_ip) {
|
|
if (!challenge_id || strlen(challenge_id) == 0) {
|
|
return NOSTR_ERROR_INVALID_INPUT;
|
|
}
|
|
|
|
cleanup_expired_challenges();
|
|
|
|
// Find an available slot
|
|
int slot_idx = -1;
|
|
|
|
// First, try to find an inactive slot
|
|
for (int i = 0; i < g_challenge_manager.challenge_count; i++) {
|
|
if (!g_challenge_manager.challenges[i].active) {
|
|
slot_idx = i;
|
|
break;
|
|
}
|
|
}
|
|
|
|
// If no inactive slot found, use next available if we haven't hit max
|
|
if (slot_idx == -1 && g_challenge_manager.challenge_count < MAX_CHALLENGES) {
|
|
slot_idx = g_challenge_manager.challenge_count++;
|
|
}
|
|
|
|
// If still no slot, we're full - remove oldest entry
|
|
if (slot_idx == -1) {
|
|
slot_idx = 0; // Overwrite first entry (oldest)
|
|
}
|
|
|
|
// Store the new challenge
|
|
nip42_challenge_entry_t *entry = &g_challenge_manager.challenges[slot_idx];
|
|
memset(entry, 0, sizeof(nip42_challenge_entry_t));
|
|
|
|
// Store challenge with proper length handling (up to buffer size - 1)
|
|
strncpy(entry->challenge_id, challenge_id, sizeof(entry->challenge_id) - 1);
|
|
entry->challenge_id[sizeof(entry->challenge_id) - 1] = '\0';
|
|
|
|
if (client_ip) {
|
|
strncpy(entry->client_ip, client_ip, sizeof(entry->client_ip) - 1);
|
|
entry->client_ip[sizeof(entry->client_ip) - 1] = '\0';
|
|
}
|
|
|
|
time_t now = time(NULL);
|
|
entry->created_at = now;
|
|
entry->expires_at = now + g_challenge_manager.timeout_seconds;
|
|
entry->active = 1;
|
|
|
|
return NOSTR_SUCCESS;
|
|
}
|
|
|
|
|
|
/**
|
|
* Generate and store a new NIP-42 challenge for /auth endpoint
|
|
*/
|
|
int nostr_generate_nip42_challenge(char *challenge_out, size_t challenge_size,
|
|
const char *client_ip) {
|
|
if (!challenge_out || challenge_size < 65) {
|
|
return NOSTR_ERROR_INVALID_INPUT;
|
|
}
|
|
|
|
// Generate challenge ID
|
|
int result = generate_challenge_id(challenge_out, challenge_size);
|
|
if (result != NOSTR_SUCCESS) {
|
|
return result;
|
|
}
|
|
|
|
// Store in challenge manager
|
|
result = store_challenge(challenge_out, client_ip);
|
|
if (result != NOSTR_SUCCESS) {
|
|
return result;
|
|
}
|
|
|
|
return NOSTR_SUCCESS;
|
|
}
|
|
|
|
//=============================================================================
|
|
// SIMPLE NIP-42 FUNCTION IMPLEMENTATIONS FOR C-RELAY
|
|
//=============================================================================
|
|
|
|
/**
|
|
* Simple NIP-42 challenge generation (generates random hex string)
|
|
*/
|
|
int nostr_nip42_generate_challenge(char *challenge_buffer, size_t buffer_size) {
|
|
if (!challenge_buffer || buffer_size < 65) {
|
|
return NOSTR_ERROR_INVALID_INPUT;
|
|
}
|
|
|
|
// Generate 32 random bytes and convert to hex string
|
|
unsigned char random_bytes[32];
|
|
|
|
// Simple random number generation using time and rand()
|
|
srand((unsigned int)time(NULL));
|
|
for (int i = 0; i < 32; i++) {
|
|
random_bytes[i] = (unsigned char)(rand() % 256);
|
|
}
|
|
|
|
// Convert to hex string
|
|
for (int i = 0; i < 32; i++) {
|
|
sprintf(&challenge_buffer[i * 2], "%02x", random_bytes[i]);
|
|
}
|
|
challenge_buffer[64] = '\0';
|
|
|
|
return NOSTR_SUCCESS;
|
|
}
|
|
|
|
/**
|
|
* Simple NIP-42 auth event verification (validates basic structure and expiration)
|
|
*/
|
|
int nostr_nip42_verify_auth_event(cJSON *event, const char *challenge_id,
|
|
const char *relay_url, int time_tolerance_seconds) {
|
|
if (!event || !challenge_id || !relay_url) {
|
|
return NOSTR_ERROR_INVALID_INPUT;
|
|
}
|
|
|
|
// Check if event has the required tags for NIP-42
|
|
cJSON *tags = cJSON_GetObjectItem(event, "tags");
|
|
if (!tags || !cJSON_IsArray(tags)) {
|
|
return NOSTR_ERROR_NIP42_AUTH_EVENT_INVALID;
|
|
}
|
|
|
|
int has_relay_tag = 0;
|
|
int has_challenge_tag = 0;
|
|
time_t expiration = 0;
|
|
|
|
// Look for required tags
|
|
cJSON *tag = NULL;
|
|
cJSON_ArrayForEach(tag, tags) {
|
|
if (!cJSON_IsArray(tag)) continue;
|
|
|
|
cJSON *tag_name = cJSON_GetArrayItem(tag, 0);
|
|
if (!tag_name || !cJSON_IsString(tag_name)) continue;
|
|
|
|
const char *tag_name_str = cJSON_GetStringValue(tag_name);
|
|
|
|
if (strcmp(tag_name_str, "relay") == 0) {
|
|
has_relay_tag = 1;
|
|
cJSON *relay_value = cJSON_GetArrayItem(tag, 1);
|
|
if (relay_value && cJSON_IsString(relay_value)) {
|
|
const char *event_relay = cJSON_GetStringValue(relay_value);
|
|
// For C-relay, accept the relay URL as valid (basic check)
|
|
if (event_relay && strlen(event_relay) > 0) {
|
|
// Relay URL validation passed
|
|
}
|
|
}
|
|
} else if (strcmp(tag_name_str, "challenge") == 0) {
|
|
has_challenge_tag = 1;
|
|
cJSON *challenge_value = cJSON_GetArrayItem(tag, 1);
|
|
if (challenge_value && cJSON_IsString(challenge_value)) {
|
|
const char *event_challenge = cJSON_GetStringValue(challenge_value);
|
|
if (!event_challenge || strcmp(event_challenge, challenge_id) != 0) {
|
|
return NOSTR_ERROR_NIP42_INVALID_CHALLENGE;
|
|
}
|
|
}
|
|
} else if (strcmp(tag_name_str, "expiration") == 0) {
|
|
cJSON *exp_value = cJSON_GetArrayItem(tag, 1);
|
|
if (exp_value && cJSON_IsString(exp_value)) {
|
|
const char *exp_str = cJSON_GetStringValue(exp_value);
|
|
|
|
// Validate that the expiration string contains only digits (and optional leading whitespace)
|
|
const char* p = exp_str;
|
|
|
|
// Skip leading whitespace
|
|
while (*p == ' ' || *p == '\t') p++;
|
|
|
|
// Check if we have at least one digit and all remaining characters are digits
|
|
if (*p != '\0') {
|
|
const char* digit_start = p;
|
|
while (*p >= '0' && *p <= '9') p++;
|
|
|
|
// If we consumed the entire string and found at least one digit, it's valid
|
|
if (*p == '\0' && p > digit_start) {
|
|
expiration = (time_t)atol(exp_str);
|
|
}
|
|
// If malformed, expiration remains 0 (no expiration), effectively ignoring the tag
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// Check required tags are present
|
|
if (!has_relay_tag || !has_challenge_tag) {
|
|
return NOSTR_ERROR_NIP42_AUTH_EVENT_INVALID;
|
|
}
|
|
|
|
// Check expiration with time tolerance
|
|
time_t now = time(NULL);
|
|
if (expiration > 0) {
|
|
if (now > expiration + time_tolerance_seconds) {
|
|
return NOSTR_ERROR_NIP42_CHALLENGE_EXPIRED;
|
|
}
|
|
}
|
|
|
|
// Check created_at timestamp for reasonable bounds
|
|
cJSON *created_at_json = cJSON_GetObjectItem(event, "created_at");
|
|
if (created_at_json && cJSON_IsNumber(created_at_json)) {
|
|
time_t created_at = (time_t)cJSON_GetNumberValue(created_at_json);
|
|
if (abs((int)(now - created_at)) > time_tolerance_seconds) {
|
|
return NOSTR_ERROR_NIP42_TIME_TOLERANCE;
|
|
}
|
|
}
|
|
|
|
return NOSTR_SUCCESS;
|
|
}
|