mirror of
https://github.com/status-im/nimbus-eth2.git
synced 2025-01-10 06:16:25 +00:00
8771e91d53
* Support for driving multiple EL nodes from a single Nimbus BN Full list of changes: * Eth1Monitor has been renamed to ELManager to match its current responsibilities better. * The ELManager is no longer optional in the code (it won't have a nil value under any circumstances). * The support for subscribing for headers was removed as it only worked with WebSockets and contributed significant complexity while bringing only a very minor advantage. * The `--web3-url` parameter has been deprecated in favor of a new `--el` parameter. The new parameter has a reasonable default value and supports specifying a different JWT for each connection. Each connection can also be configured with a different set of responsibilities (e.g. download deposits, validate blocks and/or produce blocks). On the command-line, these properties can be configured through URL properties stored in the #anchor part of the URL. In TOML files, they come with a very natural syntax (althrough the URL scheme is also supported). * The previously scattered EL-related state and logic is now moved to `eth1_monitor.nim` (this module will be renamed to `el_manager.nim` in a follow-up commit). State is assigned properly either to the `ELManager` or the to individual `ELConnection` objects where appropriate. The ELManager executes all Engine API requests against all attached EL nodes, in parallel. It compares their results and if there is a disagreement regarding the validity of a certain payload, this is detected and the beacon node is protected from publishing a block with a potential execution layer consensus bug in it. The BN provides metrics per EL node for the number of successful or failed requests for each type Engine API requests. If an EL node goes offline and connectivity is resoted later, we report the problem and the remedy in edge-triggered fashion. * More progress towards implementing Deneb block production in the VC and comparing the value of blocks produced by the EL and the builder API. * Adds a Makefile target for the zhejiang testnet
114 lines
4.5 KiB
Nim
114 lines
4.5 KiB
Nim
# beacon_chain
|
|
# Copyright (c) 2022-2023 Status Research & Development GmbH
|
|
# Licensed and distributed under either of
|
|
# * MIT license (license terms in the root directory or at https://opensource.org/licenses/MIT).
|
|
# * Apache v2 license (license terms in the root directory or at https://www.apache.org/licenses/LICENSE-2.0).
|
|
# at your option. This file may not be copied, modified, or distributed except according to those terms.
|
|
|
|
import
|
|
chronicles, confutils/defs,
|
|
bearssl/rand,
|
|
nimcrypto/[hmac, utils],
|
|
stew/[byteutils, results]
|
|
|
|
from std/base64 import encode
|
|
from std/json import JsonNode, `$`, `%*`
|
|
from std/options import Option, get, isNone
|
|
from std/os import `/`
|
|
from std/strutils import replace
|
|
|
|
export rand, results
|
|
|
|
{.push raises: [].}
|
|
|
|
const
|
|
JWT_SECRET_LEN = 32
|
|
|
|
proc base64urlEncode(x: auto): string =
|
|
# The only strings this gets are internally generated, and don't have
|
|
# encoding quirks.
|
|
base64.encode(x, safe = true).replace("=", "")
|
|
|
|
func getIatToken*(time: int64): JsonNode =
|
|
# https://github.com/ethereum/execution-apis/blob/v1.0.0-beta.2/src/engine/authentication.md#jwt-claims
|
|
# "Required: `iat` (issued-at) claim. The execution layer client **SHOULD**
|
|
# only accept `iat` timestamps which are within +-60 seconds from the current
|
|
# time."
|
|
#
|
|
# https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.6 describes iat
|
|
# claims.
|
|
#
|
|
# https://pyjwt.readthedocs.io/en/stable/usage.html#issued-at-claim-iat shows
|
|
# an example of an iat claim: {"iat": 1371720939}
|
|
%* {"iat": time}
|
|
|
|
proc getSignedToken*(key: openArray[byte], payload: string): string =
|
|
# https://github.com/ethereum/execution-apis/blob/v1.0.0-beta.2/src/engine/authentication.md#jwt-specifications
|
|
# "The execution layer client **MUST** support at least the following `alg`
|
|
# `HMAC + SHA256` (`HS256`)"
|
|
|
|
# https://datatracker.ietf.org/doc/html/rfc7515#appendix-A.1.1
|
|
const jwsProtectedHeader =
|
|
base64urlEncode($ %* {"typ": "JWT", "alg": "HS256"}) & "."
|
|
# In theory, std/json might change how it encodes, and it doesn't per-se
|
|
# matter but can also simply specify the base64-encoded form directly if
|
|
# useful, since it's never checked here on its own.
|
|
static: doAssert jwsProtectedHeader == "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9."
|
|
let signingInput = jwsProtectedHeader & base64urlEncode(payload)
|
|
|
|
signingInput & "." & base64urlEncode(sha256.hmac(key, signingInput).data)
|
|
|
|
proc getSignedIatToken*(key: openArray[byte], time: int64): string =
|
|
getSignedToken(key, $getIatToken(time))
|
|
|
|
proc parseJwtTokenValue*(input: string): Result[seq[byte], cstring] =
|
|
# Secret JWT key is parsed in constant time using nimcrypto:
|
|
# https://github.com/cheatfate/nimcrypto/pull/44
|
|
let secret = utils.fromHex(input)
|
|
if secret.len == JWT_SECRET_LEN:
|
|
ok(secret)
|
|
else:
|
|
err("The JWT secret should be 256 bits and hex-encoded")
|
|
|
|
proc loadJwtSecretFile*(jwtSecretFile: InputFile): Result[seq[byte], cstring] =
|
|
try:
|
|
let lines = readLines(string jwtSecretFile, 1)
|
|
if lines.len > 0:
|
|
parseJwtTokenValue(lines[0])
|
|
else:
|
|
err("The JWT token file should not be empty")
|
|
except IOError:
|
|
err("couldn't open specified JWT secret file")
|
|
except ValueError:
|
|
err("invalid JWT hex string")
|
|
|
|
proc checkJwtSecret*(
|
|
rng: var HmacDrbgContext, dataDir: string, jwtSecret: Option[InputFile]):
|
|
Result[seq[byte], cstring] =
|
|
# If such a parameter is given, but the file cannot be read, or does not
|
|
# contain a hex-encoded key of 256 bits, the client should treat this as an
|
|
# error: either abort the startup, or show error and continue without
|
|
# exposing the authenticated port.
|
|
if jwtSecret.isNone:
|
|
# If such a parameter is not given, the client SHOULD generate such a
|
|
# token, valid for the duration of the execution, and store the
|
|
# hex-encoded secret as a jwt.hex file on the filesystem. This file can
|
|
# then be used to provision the counterpart client.
|
|
#
|
|
# https://github.com/ethereum/execution-apis/blob/v1.0.0-beta.2/src/engine/authentication.md#key-distribution
|
|
const jwtSecretFilename = "jwt.hex"
|
|
let jwtSecretPath = dataDir / jwtSecretFilename
|
|
|
|
let newSecret = rng.generateBytes(JWT_SECRET_LEN)
|
|
try:
|
|
writeFile(jwtSecretPath, newSecret.to0xHex())
|
|
except IOError as exc:
|
|
# Allow continuing to run, though this is effectively fatal for a merge
|
|
# client using authentication. This keeps it lower-risk initially.
|
|
warn "Could not write JWT secret to data directory",
|
|
jwtSecretPath,
|
|
err = exc.msg
|
|
return ok(newSecret)
|
|
|
|
loadJwtSecretFile(jwtSecret.get)
|