Skip to content

feat: debug feature to write client identies/credentials to disk #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cococry merged 1 commit into from
Jul 29, 2026
Merged

feat: debug feature to write client identies/credentials to disk #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 22 additions & 20 deletions faithd/src/auth/device_link.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@
#include "../logging/logging.h"
#include "handshake.h"

#define _MODULE_NAME "auth/device_link"

static faith_status_code_t send_device_auth_response_failed(server_state_t *s,
client_conn_t *cl) {
if (!s || !cl || cl->closing)
Expand Down Expand Up @@ -47,19 +49,19 @@ device_link_handle_device_response(server_state_t *s, client_conn_t *cl,

if (!req || !req_cl) {
nob_log(ERROR,
"[client=%" PRIu64 " fd=%i] Server got %s but there is no "
"[%s: client=%" PRIu64 " fd=%i] Server got %s but there is no "
"device link request pending. Rejecting envelope.",
cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type));
_MODULE_NAME, cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type));
return FAITH_ERR_INVALID;
}

if (response_envl->type != FAITH_ENVELOPE_DEVICE_AUTH_APPROVE &&
response_envl->type != FAITH_ENVELOPE_DEVICE_AUTH_DENY) {
nob_log(ERROR,
"[client=%" PRIu64 " fd=%i] Invalid envelope type. Expected "
"[%s: client=%" PRIu64 " fd=%i] Invalid envelope type. Expected "
"FAITH_ENVELOPE_DEVICE_AUTH_APPROVE or "
"FAITH_ENVELOPE_DEVICE_AUTH_DENY, got %s",
cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type));
_MODULE_NAME, cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type));

return FAITH_ERR_INVALID;
}
Expand All @@ -68,9 +70,9 @@ device_link_handle_device_response(server_state_t *s, client_conn_t *cl,
response_envl->body_size !=
FAITH_ENVL_CTS_DEVICE_LINK_RESPONSE_BODY_SIZE) {
nob_log(ERROR,
"[client=%" PRIu64
"[%s: client=%" PRIu64
" fd=%i] Server got invalid %s envelope contents.",
cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type));
_MODULE_NAME, cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type));

_FH_CHECK_RETURN(send_device_auth_response_failed(s, cl));

Expand All @@ -85,9 +87,9 @@ device_link_handle_device_response(server_state_t *s, client_conn_t *cl,
faith_id128_to_hex(cl->ident.device_id.bytes, device_id_hex));

nob_log(ERROR,
"[client=%" PRIu64 " fd=%i] Server got unauthorized %s"
"[%s: client=%" PRIu64 " fd=%i] Server got unauthorized %s"
"from client. Client (auth_id=%s, device_id=%s) is not authorized.",
cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type),
_MODULE_NAME, cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type),
auth_id_hex, device_id_hex);

/* Return UNAUTHORIZED without rejecting/closing the client connection that
Expand All @@ -104,10 +106,10 @@ device_link_handle_device_response(server_state_t *s, client_conn_t *cl,
faith_id128_to_hex(req->device_id_new.bytes, req_device_id_hex));

nob_log(INFO,
"[client=%" PRIu64 " fd=%i] Client that requested"
"[%s: client=%" PRIu64 " fd=%i] Client that requested"
"their device (device_id=%s) to be linked to auth_id=%s has "
"already been closed.",
cl->conn.id, cl->conn.fd, req_auth_id_hex, req_device_id_hex);
_MODULE_NAME, cl->conn.id, cl->conn.fd, req_auth_id_hex, req_device_id_hex);

_FH_CHECK_RETURN(send_device_auth_response_failed(s, cl));

Expand All @@ -121,9 +123,9 @@ device_link_handle_device_response(server_state_t *s, client_conn_t *cl,
if (!faith_device_id_equal(response.device_id_new, req->device_id_new)) {
nob_log(
ERROR,
"[client=%" PRIu64 " fd=%i] Server got %s but the sent"
"[%s: client=%" PRIu64 " fd=%i] Server got %s but the sent"
"device_id does not match the device_id that requested the approval.",
cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type));
_MODULE_NAME, cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type));

_FH_CHECK_RETURN(send_device_auth_response_failed(s, cl));

Expand All @@ -134,9 +136,9 @@ device_link_handle_device_response(server_state_t *s, client_conn_t *cl,

if (faith_now_ms() > cl->pending_device_link_req->expires_at_ms) {
nob_log(ERROR,
"[client=%" PRIu64 " fd=%i] Server got %s but the "
"[%s: client=%" PRIu64 " fd=%i] Server got %s but the "
"link request has already expired.",
cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type));
_MODULE_NAME, cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type));

/* Reject the requesting client conection if the request has expired but
* keep the responding one open. */
Expand Down Expand Up @@ -211,12 +213,12 @@ device_link_handle_device_response(server_state_t *s, client_conn_t *cl,
* correct behaviour.*/
if (!sess) {
nob_log(ERROR,
"[client=%" PRIu64
"[%s: client=%" PRIu64
" fd=%i] Server got %s but client connection that "
"sent the envelope does not have registered session data. "
"However, the client connection IS authorized, so there is "
"probably a deeper issue.",
cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type));
_MODULE_NAME, cl->conn.id, cl->conn.fd, faith_envelope_name(response_envl->type));

_FH_CHECK_RETURN(send_device_auth_response_failed(s, cl));

Expand Down Expand Up @@ -303,12 +305,12 @@ defer: {
_FH_CHECK_RETURN(faith_id128_to_hex(device_id_new.bytes, device_id_hex));

nob_log(ERROR,
"[client=%" PRIu64 " fd=%i] Client connection"
"[%s: client=%" PRIu64 " fd=%i] Client connection"
"(auth_id=%s, device_id=%s) failed authorization for device link "
"request; Error %s. Device with device_id=%s will not be linked to "
"auth_id=%s. "
"Closing connection. ",
req_cl->conn.id, req_cl->conn.fd, auth_id_hex, device_id_hex,
_MODULE_NAME, req_cl->conn.id, req_cl->conn.fd, auth_id_hex, device_id_hex,
faith_status_code_name(_fh_result), device_id_hex, auth_id_hex);

/* Don't propagate status code */
Expand Down Expand Up @@ -339,9 +341,9 @@ device_link_new_device(server_state_t *s, client_conn_t *cl,

nob_log(
INFO,
"[client=%" PRIu64
"[%s: client=%" PRIu64
" fd=%i] Handling newly joined device (device_id=%s) for auth_id=%s.",
cl->conn.id, cl->conn.fd, new_device_id_hex, cl_auth_id_hex);
_MODULE_NAME, cl->conn.id, cl->conn.fd, new_device_id_hex, cl_auth_id_hex);
}

if (!sess_registry_auth_id_registered(&s->rt, &params->sender_auth_id)) {
Expand Down
52 changes: 30 additions & 22 deletions faithd/src/auth/handshake.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@

#include "../delivery/events.h"

#define _MODULE_NAME "auth/handshake"

faith_status_code_t auth_handle_hello(server_state_t *s, client_conn_t *cl,
const faith_envelope_t *hello_envl) {
// HELLO {
Expand All @@ -30,8 +32,9 @@ faith_status_code_t auth_handle_hello(server_state_t *s, client_conn_t *cl,

if (cl->state != CLIENT_WAIT_FOR_HELLO) {
nob_log(ERROR,
"[client=%" PRIu64 " fd=%i] Server got invalid HELLO from client.",
cl->conn.id, cl->conn.fd);
"[%s: client=%" PRIu64
" fd=%i] Server got invalid HELLO from client.",
_MODULE_NAME, cl->conn.id, cl->conn.fd);
return FAITH_ERR_BAD_ENVELOPE;
}

Expand Down Expand Up @@ -89,18 +92,18 @@ faith_status_code_t auth_handle_challenge_response(

if (challenge_response_envl->type != FAITH_ENVELOPE_CHALLENGE_RESPONSE) {
nob_log(ERROR,
"[client=%" PRIu64 " fd=%i] Invalid envelope type. Expected "
"[%s: client=%" PRIu64 " fd=%i] Invalid envelope type. Expected "
"FAITH_ENVELOPE_CHALLENGE_RESPONSE, got %s",
cl->conn.id, cl->conn.fd,
_MODULE_NAME, cl->conn.id, cl->conn.fd,
faith_envelope_name(challenge_response_envl->type));
return FAITH_ERR_INVALID;
}

if (cl->state != CLIENT_WAIT_FOR_CHALLENGE_RESPONSE) {
nob_log(ERROR,
"[client=%" PRIu64
"[%s: client=%" PRIu64
" fd=%i] Server got invalid CHALLENGE_RESPONSE from client.",
cl->conn.id, cl->conn.fd);
_MODULE_NAME, cl->conn.id, cl->conn.fd);
return FAITH_ERR_BAD_ENVELOPE;
}

Expand All @@ -109,18 +112,18 @@ faith_status_code_t auth_handle_challenge_response(
if (!faith_client_id_equal(challenge_response_envl->sender_id,
params->sender_auth_id)) {
nob_log(ERROR,
"[client=%" PRIu64
"[%s: client=%" PRIu64
" fd=%i] Server got CHALLENGE_RESPONSE from invalid client.",
cl->conn.id, cl->conn.fd);
_MODULE_NAME, cl->conn.id, cl->conn.fd);
return FAITH_ERR_INVALID;
}

if (!challenge_response_envl->body ||
challenge_response_envl->body_size != FAITH_ED25519_SIGNATURE_SIZE) {
nob_log(ERROR,
"[client=%" PRIu64
"[%s: client=%" PRIu64
" fd=%i] Server got invalid CHALLENGE_RESPONSE envelope contents.",
cl->conn.id, cl->conn.fd);
_MODULE_NAME, cl->conn.id, cl->conn.fd);
return FAITH_ERR_INVALID;
}

Expand All @@ -140,9 +143,10 @@ faith_status_code_t auth_handle_challenge_response(
_FH_CHECK_RETURN(
faith_id128_to_hex(params->device_id.bytes, device_id_hex));
nob_log(ERROR,
"[client=%" PRIu64
"[%s: client=%" PRIu64
" fd=%i] Failed to get routing session (auth_id=%s, device_id=%s).",
cl->conn.id, cl->conn.fd, sender_auth_id_hex, device_id_hex);
_MODULE_NAME, cl->conn.id, cl->conn.fd, sender_auth_id_hex,
device_id_hex);
return sess_rc;
}

Expand Down Expand Up @@ -171,10 +175,12 @@ faith_status_code_t auth_handle_challenge_response(
_FH_CHECK_RETURN(
faith_id128_to_hex(params->device_id.bytes, device_id_hex));
nob_log(ERROR,
"[client=%" PRIu64 " fd=%i] Rejected requested routing session "
"[%s: client=%" PRIu64
" fd=%i] Rejected requested routing session "
"(auth_id=%s, device_id=%s). "
"Invalid public key sent.",
cl->conn.id, cl->conn.fd, sender_auth_id_hex, device_id_hex);
_MODULE_NAME, cl->conn.id, cl->conn.fd, sender_auth_id_hex,
device_id_hex);
return FAITH_ERR_UNAUTHORIZED;
}

Expand Down Expand Up @@ -222,9 +228,9 @@ faith_status_code_t auth_handle_challenge_response(
sizeof(msg_buf), &sign_msg));
if (_fh_rc != FAITH_OK) {
nob_log(ERROR,
"[client=%" PRIu64
"[%s: client=%" PRIu64
" fd=%i] Failed to generate signing message buffer",
cl->conn.id, cl->conn.fd);
_MODULE_NAME, cl->conn.id, cl->conn.fd);

return _fh_rc;
}
Expand Down Expand Up @@ -273,10 +279,11 @@ reject: {
faith_id128_to_hex(params->sender_auth_id.bytes, sender_auth_id_hex));
_FH_CHECK_RETURN(faith_id128_to_hex(params->device_id.bytes, device_id_hex));
nob_log(ERROR,
"[client=%" PRIu64
"[%s: client=%" PRIu64
" fd=%i] Client failed authorization for requested routing session "
"(auth_id=%s, device_id=%s). ",
cl->conn.id, cl->conn.fd, sender_auth_id_hex, device_id_hex);
_MODULE_NAME, cl->conn.id, cl->conn.fd, sender_auth_id_hex,
device_id_hex);
return FAITH_ERR_UNAUTHORIZED;
}
}
Expand Down Expand Up @@ -306,9 +313,10 @@ faith_status_code_t auth_authorize_client(
faith_id128_to_hex(cl->ident.device_id.bytes, cl_device_id_hex));

nob_log(INFO,
"[client=%" PRIu64 " fd=%i] Client passed authorization for "
"[%s: client=%" PRIu64 " fd=%i] Client passed authorization for "
"requested routing session. (auth_id=%s, device_id=%s)",
cl->conn.id, cl->conn.fd, cl_auth_id_hex, cl_device_id_hex);
_MODULE_NAME, cl->conn.id, cl->conn.fd, cl_auth_id_hex,
cl_device_id_hex);

return FAITH_OK;
}
Expand Down Expand Up @@ -345,9 +353,9 @@ auth_handshake_complete(server_state_t *s, client_conn_t *cl,
faith_id128_to_hex(cl->ident.device_id.bytes, device_id_hex));

nob_log(INFO,
"[client=%" PRIu64
"[%s: client=%" PRIu64
" fd=%i] Server accepted HELLO (auth id: %s, device id: %s)",
cl->conn.id, cl->conn.fd, auth_id_hex, device_id_hex);
_MODULE_NAME, cl->conn.id, cl->conn.fd, auth_id_hex, device_id_hex);

return _fh_result;
}
Expand Down
Loading
Loading