Skip to content

Commit 8e2b77d

Browse files
DaneEverittDaneEveritt
committed
Final touches to new key-rotation service
1 parent 0f0c319 commit 8e2b77d

6 files changed

Lines changed: 154 additions & 18 deletions

File tree

‎app/Http/Controllers/API/Remote/ValidateKeyController.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
use Illuminate\Foundation\Testing\HttpException;
3131
use League\Fractal\Serializer\JsonApiSerializer;
3232
use Pterodactyl\Transformers\Daemon\ApiKeyTransformer;
33+
use Pterodactyl\Services\DaemonKeys\DaemonKeyUpdateService;
3334
use Pterodactyl\Contracts\Repository\DaemonKeyRepositoryInterface;
3435

3536
class ValidateKeyController extends Controller
@@ -77,7 +78,7 @@ public function __construct(
7778
*/
7879
public function index($token)
7980
{
80-
if (! starts_with($token, 'i_')) {
81+
if (! starts_with($token, DaemonKeyUpdateService::INTERNAL_TOKEN_IDENTIFIER)) {
8182
throw new HttpException(501);
8283
}
8384

‎app/Http/Controllers/Base/IndexController.php‎

Lines changed: 16 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,9 @@
2626
namespace Pterodactyl\Http\Controllers\Base;
2727

2828
use Illuminate\Http\Request;
29+
use GuzzleHttp\Exception\RequestException;
2930
use Pterodactyl\Http\Controllers\Controller;
31+
use Symfony\Component\HttpKernel\Exception\HttpException;
3032
use Pterodactyl\Services\Servers\ServerAccessHelperService;
3133
use Pterodactyl\Contracts\Repository\ServerRepositoryInterface;
3234
use Pterodactyl\Contracts\Repository\Daemon\ServerRepositoryInterface as DaemonServerRepositoryInterface;
@@ -36,7 +38,7 @@ class IndexController extends Controller
3638
/**
3739
* @var \Pterodactyl\Services\Servers\ServerAccessHelperService
3840
*/
39-
protected $access;
41+
protected $serverAccessHelper;
4042

4143
/**
4244
* @var \Pterodactyl\Contracts\Repository\Daemon\ServerRepositoryInterface
@@ -52,15 +54,15 @@ class IndexController extends Controller
5254
* IndexController constructor.
5355
*
5456
* @param \Pterodactyl\Contracts\Repository\Daemon\ServerRepositoryInterface $daemonRepository
55-
* @param \Pterodactyl\Services\Servers\ServerAccessHelperService $access
57+
* @param \Pterodactyl\Services\Servers\ServerAccessHelperService $serverAccessHelper
5658
* @param \Pterodactyl\Contracts\Repository\ServerRepositoryInterface $repository
5759
*/
5860
public function __construct(
5961
DaemonServerRepositoryInterface $daemonRepository,
60-
ServerAccessHelperService $access,
62+
ServerAccessHelperService $serverAccessHelper,
6163
ServerRepositoryInterface $repository
6264
) {
63-
$this->access = $access;
65+
$this->serverAccessHelper = $serverAccessHelper;
6466
$this->daemonRepository = $daemonRepository;
6567
$this->repository = $repository;
6668
}
@@ -90,18 +92,23 @@ public function getIndex(Request $request)
9092
*/
9193
public function status(Request $request, $uuid)
9294
{
93-
$server = $this->access->handle($uuid, $request->user());
95+
$server = $this->repository->findFirstWhere([['uuidShort', '=', $uuid]]);
96+
$token = $this->serverAccessHelper->handle($server, $request->user());
9497

9598
if (! $server->installed) {
9699
return response()->json(['status' => 20]);
97100
} elseif ($server->suspended) {
98101
return response()->json(['status' => 30]);
99102
}
100103

101-
$response = $this->daemonRepository->setNode($server->node_id)
102-
->setAccessServer($server->uuid)
103-
->setAccessToken($server->daemonSecret)
104-
->details();
104+
try {
105+
$response = $this->daemonRepository->setNode($server->node_id)
106+
->setAccessServer($server->uuid)
107+
->setAccessToken($token)
108+
->details();
109+
} catch (RequestException $exception) {
110+
throw new HttpException(500, $exception->getMessage());
111+
}
105112

106113
return response()->json(json_decode($response->getBody()));
107114
}

‎app/Services/DaemonKeys/DaemonKeyUpdateService.php‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
<?php
2+
/*
3+
* Pterodactyl - Panel
4+
* Copyright (c) 2015 - 2017 Dane Everitt <dane@daneeveritt.com>.
5+
*
6+
* Permission is hereby granted, free of charge, to any person obtaining a copy
7+
* of this software and associated documentation files (the "Software"), to deal
8+
* in the Software without restriction, including without limitation the rights
9+
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
* copies of the Software, and to permit persons to whom the Software is
11+
* furnished to do so, subject to the following conditions:
12+
*
13+
* The above copyright notice and this permission notice shall be included in all
14+
* copies or substantial portions of the Software.
15+
*
16+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22+
* SOFTWARE.
23+
*/
24+
25+
namespace Pterodactyl\Services\DaemonKeys;
26+
27+
use Carbon\Carbon;
28+
use Pterodactyl\Models\DaemonKey;
29+
use Illuminate\Contracts\Config\Repository as ConfigRepository;
30+
use Pterodactyl\Contracts\Repository\DaemonKeyRepositoryInterface;
31+
32+
class DaemonKeyUpdateService
33+
{
34+
const INTERNAL_TOKEN_IDENTIFIER = 'i_';
35+
36+
/**
37+
* @var \Carbon\Carbon
38+
*/
39+
protected $carbon;
40+
41+
/**
42+
* @var
43+
*/
44+
protected $config;
45+
46+
/**
47+
* @var \Pterodactyl\Contracts\Repository\DaemonKeyRepositoryInterface
48+
*/
49+
protected $repository;
50+
51+
/**
52+
* DaemonKeyUpdateService constructor.
53+
*
54+
* @param \Carbon\Carbon $carbon
55+
* @param \Illuminate\Contracts\Config\Repository $config
56+
* @param \Pterodactyl\Contracts\Repository\DaemonKeyRepositoryInterface $repository
57+
*/
58+
public function __construct(
59+
Carbon $carbon,
60+
ConfigRepository $config,
61+
DaemonKeyRepositoryInterface $repository
62+
) {
63+
$this->carbon = $carbon;
64+
$this->config = $config;
65+
$this->repository = $repository;
66+
}
67+
68+
/**
69+
* Update a daemon key to expire the previous one.
70+
*
71+
* @param \Pterodactyl\Models\DaemonKey|int $key
72+
* @return string
73+
*
74+
* @throws \RuntimeException
75+
* @throws \Pterodactyl\Exceptions\Model\DataValidationException
76+
* @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
77+
*/
78+
public function handle($key)
79+
{
80+
if ($key instanceof DaemonKey) {
81+
$key = $key->id;
82+
}
83+
84+
$secret = self::INTERNAL_TOKEN_IDENTIFIER . str_random(40);
85+
86+
$this->repository->withoutFresh()->update($key, [
87+
'secret' => $secret,
88+
'expires_at' => $this->carbon->now()->addMinutes($this->config->get('pterodactyl.api.key_expire_time')),
89+
]);
90+
91+
return $secret;
92+
}
93+
}

‎app/Services/Servers/ServerAccessHelperService.php‎

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,12 @@
2424

2525
namespace Pterodactyl\Services\Servers;
2626

27+
use Carbon\Carbon;
2728
use Pterodactyl\Models\User;
2829
use Pterodactyl\Models\Server;
30+
use Pterodactyl\Models\DaemonKey;
2931
use Illuminate\Cache\Repository as CacheRepository;
32+
use Pterodactyl\Services\DaemonKeys\DaemonKeyUpdateService;
3033
use Pterodactyl\Contracts\Repository\UserRepositoryInterface;
3134
use Pterodactyl\Contracts\Repository\ServerRepositoryInterface;
3235
use Pterodactyl\Contracts\Repository\DaemonKeyRepositoryInterface;
@@ -39,11 +42,21 @@ class ServerAccessHelperService
3942
*/
4043
protected $cache;
4144

45+
/**
46+
* @var \Carbon\Carbon
47+
*/
48+
protected $carbon;
49+
4250
/**
4351
* @var \Pterodactyl\Contracts\Repository\DaemonKeyRepositoryInterface
4452
*/
4553
protected $daemonKeyRepository;
4654

55+
/**
56+
* @var \Pterodactyl\Services\DaemonKeys\DaemonKeyUpdateService
57+
*/
58+
protected $daemonKeyUpdateService;
59+
4760
/**
4861
* @var \Pterodactyl\Contracts\Repository\ServerRepositoryInterface
4962
*/
@@ -58,18 +71,24 @@ class ServerAccessHelperService
5871
* ServerAccessHelperService constructor.
5972
*
6073
* @param \Illuminate\Cache\Repository $cache
74+
* @param \Carbon\Carbon $carbon
6175
* @param \Pterodactyl\Contracts\Repository\DaemonKeyRepositoryInterface $daemonKeyRepository
76+
* @param \Pterodactyl\Services\DaemonKeys\DaemonKeyUpdateService $daemonKeyUpdateService
6277
* @param \Pterodactyl\Contracts\Repository\ServerRepositoryInterface $repository
6378
* @param \Pterodactyl\Contracts\Repository\UserRepositoryInterface $userRepository
6479
*/
6580
public function __construct(
6681
CacheRepository $cache,
82+
Carbon $carbon,
6783
DaemonKeyRepositoryInterface $daemonKeyRepository,
84+
DaemonKeyUpdateService $daemonKeyUpdateService,
6885
ServerRepositoryInterface $repository,
6986
UserRepositoryInterface $userRepository
7087
) {
7188
$this->cache = $cache;
89+
$this->carbon = $carbon;
7290
$this->daemonKeyRepository = $daemonKeyRepository;
91+
$this->daemonKeyUpdateService = $daemonKeyUpdateService;
7392
$this->repository = $repository;
7493
$this->userRepository = $userRepository;
7594
}
@@ -81,8 +100,10 @@ public function __construct(
81100
* @param int|\Pterodactyl\Models\User $user
82101
* @return string
83102
*
103+
* @throws \Pterodactyl\Exceptions\Model\DataValidationException
84104
* @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
85105
* @throws \Pterodactyl\Exceptions\Service\Server\UserNotLinkedToServerException
106+
* @throws \RuntimeException
86107
*/
87108
public function handle($server, $user)
88109
{
@@ -95,16 +116,16 @@ public function handle($server, $user)
95116
}
96117

97118
$keys = $server->relationLoaded('keys') ? $server->keys : $this->daemonKeyRepository->getServerKeys($server->id);
98-
99-
$key = array_get($keys->where('user_id', $user->id)->first(null, []), 'secret');
100-
if ($user->root_admin) {
101-
$key = array_get($keys->where('user_id', $server->owner_id)->first(null, []), 'secret');
102-
}
119+
$key = $keys->where('user_id', $user->root_admin ? $server->owner_id : $user->id)->first();
103120

104121
if (is_null($key)) {
105122
throw new UserNotLinkedToServerException;
106123
}
107124

108-
return $key;
125+
if (max($this->carbon->now()->diffInSeconds($key->expires_at, false), 0) === 0) {
126+
$key = $this->daemonKeyUpdateService->handle($key);
127+
}
128+
129+
return ($key instanceof DaemonKey) ? $key->secret : $key;
109130
}
110131
}

‎app/Transformers/Daemon/ApiKeyTransformer.php‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,19 @@
2424

2525
namespace Pterodactyl\Transformers\Daemon;
2626

27+
use Carbon\Carbon;
2728
use Pterodactyl\Models\DaemonKey;
2829
use Pterodactyl\Models\Permission;
2930
use League\Fractal\TransformerAbstract;
3031
use Pterodactyl\Contracts\Repository\SubuserRepositoryInterface;
3132

3233
class ApiKeyTransformer extends TransformerAbstract
3334
{
35+
/**
36+
* @var \Carbon\Carbon
37+
*/
38+
protected $carbon;
39+
3440
/**
3541
* @var \Pterodactyl\Contracts\Repository\SubuserRepositoryInterface
3642
*/
@@ -39,10 +45,12 @@ class ApiKeyTransformer extends TransformerAbstract
3945
/**
4046
* ApiKeyTransformer constructor.
4147
*
48+
* @param \Carbon\Carbon $carbon
4249
* @param \Pterodactyl\Contracts\Repository\SubuserRepositoryInterface $repository
4350
*/
44-
public function __construct(SubuserRepositoryInterface $repository)
51+
public function __construct(Carbon $carbon, SubuserRepositoryInterface $repository)
4552
{
53+
$this->carbon = $carbon;
4654
$this->repository = $repository;
4755
}
4856

@@ -59,6 +67,8 @@ public function transform(DaemonKey $key)
5967
if ($key->user_id === $key->server->owner_id) {
6068
return [
6169
'id' => $key->server->uuid,
70+
'is_temporary' => true,
71+
'expires_in' => max($this->carbon->now()->diffInSeconds($key->expires_at, false), 0),
6272
'permissions' => ['s:*'],
6373
];
6474
}
@@ -76,7 +86,10 @@ public function transform(DaemonKey $key)
7686
}
7787

7888
return [
79-
$key->server->uuid => $daemonPermissions,
89+
'id' => $key->server->uuid,
90+
'is_temporary' => true,
91+
'expires_in' => max($this->carbon->now()->diffInSeconds($key->expires_at, false), 0),
92+
'permissions' => $daemonPermissions,
8093
];
8194
}
8295
}

‎config/pterodactyl.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@
5959
*/
6060
'api' => [
6161
'include_on_list' => env('API_INCLUDE_ON_LIST', false),
62+
'key_expire_time' => env('API_KEY_EXPIRE_TIME', 60 * 12),
6263
],
6364

6465
/*

0 commit comments

Comments
 (0)