Skip to content

Commit 906a699

Browse files
DaneEverittDaneEveritt
committed
Begin implementation of new daemon authentication scheme
1 parent 8722571 commit 906a699

23 files changed

+796
-145
lines changed

‎app/Contracts/Repository/DaemonKeyRepositoryInterface.php‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<?php
2+
/*
3+
* Pterodactyl - Panel
4+
* Copyright (c) 2015 - 2017 Dane Everitt <dane@daneeveritt.com>.
5+
*
6+
* Permission is hereby granted, free of charge, to any person obtaining a copy
7+
* of this software and associated documentation files (the "Software"), to deal
8+
* in the Software without restriction, including without limitation the rights
9+
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
* copies of the Software, and to permit persons to whom the Software is
11+
* furnished to do so, subject to the following conditions:
12+
*
13+
* The above copyright notice and this permission notice shall be included in all
14+
* copies or substantial portions of the Software.
15+
*
16+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22+
* SOFTWARE.
23+
*/
24+
25+
namespace Pterodactyl\Contracts\Repository;
26+
27+
interface DaemonKeyRepositoryInterface extends RepositoryInterface
28+
{
29+
/**
30+
* Gets the daemon keys associated with a specific server.
31+
*
32+
* @param int $server
33+
* @return \Illuminate\Support\Collection
34+
*/
35+
public function getServerKeys($server);
36+
37+
/**
38+
* Return a daemon key with the associated server relation attached.
39+
*
40+
* @param string $key
41+
* @return \Pterodactyl\Models\DaemonKey
42+
*
43+
* @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
44+
*/
45+
public function getKeyWithServer($key);
46+
}

‎app/Contracts/Repository/SubuserRepositoryInterface.php‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,17 @@ public function getWithServer($id);
4646
*/
4747
public function getWithPermissions($id);
4848

49+
/**
50+
* Return a subuser and associated permissions given a user_id and server_id.
51+
*
52+
* @param int $user
53+
* @param int $server
54+
* @return \Pterodactyl\Models\Subuser
55+
*
56+
* @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
57+
*/
58+
public function getWithPermissionsUsingUserAndServer($user, $server);
59+
4960
/**
5061
* Find a subuser and return with server and permissions relationships.
5162
*
@@ -55,4 +66,15 @@ public function getWithPermissions($id);
5566
* @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
5667
*/
5768
public function getWithServerAndPermissions($id);
69+
70+
/**
71+
* Return a subuser and their associated connection key for a server.
72+
*
73+
* @param int $user
74+
* @param int $server
75+
* @return \Pterodactyl\Models\Subuser
76+
*
77+
* @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
78+
*/
79+
public function getWithKey($user, $server);
5880
}

‎app/Exceptions/Handler.php‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,16 @@ public function render($request, Exception $exception)
6666
$displayError = 'An unhandled exception was encountered with this request.';
6767
}
6868

69-
$response = response()->json([
70-
'error' => $displayError,
71-
'http_code' => (! $this->isHttpException($exception)) ?: $exception->getStatusCode(),
72-
'trace' => (! config('app.debug')) ? null : class_basename($exception) . ' in ' . $exception->getFile() . ' on line ' . $exception->getLine(),
73-
], ($this->isHttpException($exception)) ? $exception->getStatusCode() : 500, [], JSON_UNESCAPED_SLASHES);
69+
$response = response()->json(
70+
[
71+
'error' => $displayError,
72+
'http_code' => (! $this->isHttpException($exception)) ?: $exception->getStatusCode(),
73+
'trace' => (! config('app.debug')) ? null : $exception->getTrace(),
74+
],
75+
$this->isHttpException($exception) ? $exception->getStatusCode() : 500,
76+
$this->isHttpException($exception) ? $exception->getHeaders() : [],
77+
JSON_UNESCAPED_SLASHES
78+
);
7479

7580
parent::report($exception);
7681
} elseif ($exception instanceof DisplayException) {

‎app/Http/Controllers/API/Remote/ValidateKeyController.php‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
<?php
2+
/*
3+
* Pterodactyl - Panel
4+
* Copyright (c) 2015 - 2017 Dane Everitt <dane@daneeveritt.com>.
5+
*
6+
* Permission is hereby granted, free of charge, to any person obtaining a copy
7+
* of this software and associated documentation files (the "Software"), to deal
8+
* in the Software without restriction, including without limitation the rights
9+
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
* copies of the Software, and to permit persons to whom the Software is
11+
* furnished to do so, subject to the following conditions:
12+
*
13+
* The above copyright notice and this permission notice shall be included in all
14+
* copies or substantial portions of the Software.
15+
*
16+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22+
* SOFTWARE.
23+
*/
24+
25+
namespace Pterodactyl\Http\Controllers\API\Remote;
26+
27+
use Spatie\Fractal\Fractal;
28+
use Pterodactyl\Http\Controllers\Controller;
29+
use Illuminate\Contracts\Foundation\Application;
30+
use Illuminate\Foundation\Testing\HttpException;
31+
use League\Fractal\Serializer\JsonApiSerializer;
32+
use Pterodactyl\Transformers\Daemon\ApiKeyTransformer;
33+
use Pterodactyl\Contracts\Repository\DaemonKeyRepositoryInterface;
34+
35+
class ValidateKeyController extends Controller
36+
{
37+
/**
38+
* @var \Illuminate\Contracts\Foundation\Application
39+
*/
40+
protected $app;
41+
42+
/**
43+
* @var \Pterodactyl\Contracts\Repository\DaemonKeyRepositoryInterface
44+
*/
45+
protected $daemonKeyRepository;
46+
47+
/**
48+
* @var \Spatie\Fractal\Fractal
49+
*/
50+
protected $fractal;
51+
52+
/**
53+
* ValidateKeyController constructor.
54+
*
55+
* @param \Illuminate\Contracts\Foundation\Application $app
56+
* @param \Pterodactyl\Contracts\Repository\DaemonKeyRepositoryInterface $daemonKeyRepository
57+
* @param \Spatie\Fractal\Fractal $fractal
58+
*/
59+
public function __construct(
60+
Application $app,
61+
DaemonKeyRepositoryInterface $daemonKeyRepository,
62+
Fractal $fractal
63+
) {
64+
$this->app = $app;
65+
$this->daemonKeyRepository = $daemonKeyRepository;
66+
$this->fractal = $fractal;
67+
}
68+
69+
/**
70+
* Return the server(s) and permissions associated with an API key.
71+
*
72+
* @param string $token
73+
* @return array
74+
*
75+
* @throws \Illuminate\Foundation\Testing\HttpException
76+
* @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
77+
*/
78+
public function index($token)
79+
{
80+
if (! starts_with($token, 'i_')) {
81+
throw new HttpException(501);
82+
}
83+
84+
$key = $this->daemonKeyRepository->getKeyWithServer($token);
85+
86+
return $this->fractal->item($key, $this->app->make(ApiKeyTransformer::class), 'server')
87+
->serializeWith(JsonApiSerializer::class)
88+
->toArray();
89+
}
90+
}

‎app/Http/Kernel.php‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,9 @@
22

33
namespace Pterodactyl\Http;
44

5+
use Pterodactyl\Http\Middleware\DaemonAuthenticate;
56
use Illuminate\Foundation\Http\Kernel as HttpKernel;
7+
use Illuminate\Routing\Middleware\SubstituteBindings;
68

79
class Kernel extends HttpKernel
810
{
@@ -43,6 +45,10 @@ class Kernel extends HttpKernel
4345
'throttle:60,1',
4446
'bindings',
4547
],
48+
'daemon' => [
49+
\Pterodactyl\Http\Middleware\Daemon\DaemonAuthenticate::class,
50+
SubstituteBindings::class,
51+
],
4652
];
4753

4854
/**
@@ -57,7 +63,7 @@ class Kernel extends HttpKernel
5763
'server' => \Pterodactyl\Http\Middleware\ServerAuthenticate::class,
5864
'subuser' => \Pterodactyl\Http\Middleware\SubuserAccessAuthenticate::class,
5965
'admin' => \Pterodactyl\Http\Middleware\AdminAuthenticate::class,
60-
'daemon' => \Pterodactyl\Http\Middleware\DaemonAuthenticate::class,
66+
'daemon-old' => DaemonAuthenticate::class,
6167
'csrf' => \Pterodactyl\Http\Middleware\VerifyCsrfToken::class,
6268
'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
6369
'can' => \Illuminate\Auth\Middleware\Authorize::class,

‎app/Http/Middleware/Daemon/DaemonAuthenticate.php‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
<?php
2+
/*
3+
* Pterodactyl - Panel
4+
* Copyright (c) 2015 - 2017 Dane Everitt <dane@daneeveritt.com>.
5+
*
6+
* Permission is hereby granted, free of charge, to any person obtaining a copy
7+
* of this software and associated documentation files (the "Software"), to deal
8+
* in the Software without restriction, including without limitation the rights
9+
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
* copies of the Software, and to permit persons to whom the Software is
11+
* furnished to do so, subject to the following conditions:
12+
*
13+
* The above copyright notice and this permission notice shall be included in all
14+
* copies or substantial portions of the Software.
15+
*
16+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22+
* SOFTWARE.
23+
*/
24+
25+
namespace Pterodactyl\Http\Middleware\Daemon;
26+
27+
use Closure;
28+
use Illuminate\Http\Request;
29+
use Symfony\Component\HttpKernel\Exception\HttpException;
30+
use Pterodactyl\Contracts\Repository\NodeRepositoryInterface;
31+
use Pterodactyl\Exceptions\Repository\RecordNotFoundException;
32+
33+
class DaemonAuthenticate
34+
{
35+
/**
36+
* @var array
37+
*/
38+
protected $except = ['daemon.configuration'];
39+
40+
/**
41+
* @var \Pterodactyl\Contracts\Repository\NodeRepositoryInterface
42+
*/
43+
protected $repository;
44+
45+
/**
46+
* DaemonAuthenticate constructor.
47+
*
48+
* @param \Pterodactyl\Contracts\Repository\NodeRepositoryInterface $repository
49+
*/
50+
public function __construct(NodeRepositoryInterface $repository)
51+
{
52+
$this->repository = $repository;
53+
}
54+
55+
/**
56+
* Check if a request from the daemon can be properly attributed back to a single node instance.
57+
*
58+
* @param \Illuminate\Http\Request $request
59+
* @param \Closure $next
60+
* @return mixed
61+
*
62+
* @throws \Symfony\Component\HttpKernel\Exception\HttpException
63+
*/
64+
public function handle(Request $request, Closure $next)
65+
{
66+
$token = $request->bearerToken();
67+
68+
if (is_null($token)) {
69+
throw new HttpException(401, null, null, ['WWW-Authenticate' => 'Bearer']);
70+
}
71+
72+
try {
73+
$node = $this->repository->findFirstWhere([['daemonSecret', '=', $token]]);
74+
} catch (RecordNotFoundException $exception) {
75+
throw new HttpException(403);
76+
}
77+
78+
$request->attributes->set('node.model', $node);
79+
80+
return $next($request);
81+
}
82+
}

‎app/Http/Middleware/Server/ScheduleAccess.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,8 @@ public function __construct(
7070
* @param \Closure $next
7171
* @return mixed
7272
*
73-
* @throws \Pterodactyl\Exceptions\DisplayException
74-
* @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
73+
* @throws \Symfony\Component\HttpKernel\Exception\HttpException
74+
* @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException
7575
*/
7676
public function handle($request, Closure $next)
7777
{

‎app/Http/Middleware/Server/SubuserAccess.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ public function __construct(Session $session, SubuserRepositoryInterface $reposi
6363
*
6464
* @throws \Pterodactyl\Exceptions\DisplayException
6565
* @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
66+
* @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException
6667
*/
6768
public function handle($request, Closure $next)
6869
{

‎app/Http/Middleware/ServerAuthenticate.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@ public function __construct(
8282
*
8383
* @throws \Illuminate\Auth\AuthenticationException
8484
* @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
85+
* @throws \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException
86+
* @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException
8587
*/
8688
public function handle(Request $request, Closure $next)
8789
{

0 commit comments

Comments
 (0)