Merge pull request #237 from jzelinskie/v1jwtfix

jwt: verifying JWT are now client errors

Dockerfile

@@ -1,17 +1,18 @@
 # vim: ft=dockerfile
-FROM golang
+FROM golang:alpine
 MAINTAINER Jimmy Zelinskie <jimmyzelinskie@gmail.com>
 
-# Add files
+# Create source directory
 WORKDIR        /go/src/github.com/chihaya/chihaya/
 RUN mkdir -p   /go/src/github.com/chihaya/chihaya/
 
-# Dependencies
+# Install dependencies
+RUN apk update && apk add git
 RUN go get github.com/tools/godep
 ADD Godeps /go/src/github.com/chihaya/chihaya/Godeps
 RUN godep restore
 
-# Add source
+# Add source files
 ADD *.go       /go/src/github.com/chihaya/chihaya/
 ADD api        /go/src/github.com/chihaya/chihaya/api
 ADD cmd        /go/src/github.com/chihaya/chihaya/cmd
@@ -20,14 +21,13 @@ ADD http       /go/src/github.com/chihaya/chihaya/http
 ADD stats      /go/src/github.com/chihaya/chihaya/stats
 ADD tracker    /go/src/github.com/chihaya/chihaya/tracker
 ADD udp        /go/src/github.com/chihaya/chihaya/udp
+ADD example_config.json /config.json
 
-# Install
+# Install chihaya
 RUN go install github.com/chihaya/chihaya/cmd/chihaya
 
-# Configuration/environment
-VOLUME ["/config"]
+# Setup the entrypoint
+# docker run -p 6880-6882:6880-6882 -v $PATH_TO_CONFIG_FILE:/config.json:ro quay.io/jzelinskie/chihaya:latest -v=5
 EXPOSE 6880-6882
-
-# docker run -p 6880-6882:6880-6882 -v $PATH_TO_DIR_WITH_CONF_FILE:/config:ro -e quay.io/jzelinskie/chihaya:latest -v=5
-ENTRYPOINT ["chihaya", "-config=/config/config.json", "-logtostderr=true"]
+ENTRYPOINT ["chihaya", "-config=/config.json", "-logtostderr=true"]
 CMD ["-v=5"]

README.md

@@ -44,15 +44,18 @@ This is particularly useful behavior for private tracker use-cases.
 Copy [`example_config.json`] to your choice of location, and update the values as required.
 An explanation of the available keys can be found in [CONFIGURATION.md].
 
-[`example_config.json`]: https://github.com/chihaya/chihaya/blob/master/example_config.json
-[CONFIGURATION.md]: https://github.com/chihaya/chihaya/blob/master/CONFIGURATION.md
+[`example_config.json`]: ./example_config.json
+[CONFIGURATION.md]: ./CONFIGURATION.md
 
 ### Docker
 
 ```sh
-$ docker pull quay.io/jzelinskie/chihaya:latest
-$ export CHIHAYA_LOG_LEVEL=5 # most verbose, and the default
-$ docker run -p 6880-6882:6880-6882 -v $PATH_TO_DIR_WITH_CONF_FILE:/config:ro -e quay.io/jzelinskie/chihaya:latest -v=$CHIHAYA_LOG_LEVEL
+# Download and edit the example config
+curl -L https://raw.githubusercontent.com/chihaya/chihaya/release-v1.0/example_config.json -o config.json
+vi config.json
+
+# Run the container with the config file mounted
+docker run -p 6880-6882:6880-6882 -v $PWD/config.json:/config.json:ro quay.io/jzelinskie/chihaya:v1.0.1 -v=5
 ```
 
 ## Developing Chihaya

tracker/jwt.go

@@ -7,7 +7,6 @@ package tracker
 import (
 	"encoding/json"
 	"errors"
-	"fmt"
 	"net/http"
 	"net/url"
 	"time"
@@ -15,6 +14,8 @@ import (
 	oidchttp "github.com/coreos/go-oidc/http"
 	"github.com/coreos/go-oidc/jose"
 	"github.com/golang/glog"
+
+	"github.com/chihaya/chihaya/tracker/models"
 )
 
 const jwkTTLFallback = 5 * time.Minute
@@ -101,46 +102,46 @@ func validateJWTSignature(jwt *jose.JWT, jwkSet *jwkSet) (bool, error) {
 func (tkr *Tracker) validateJWT(jwtStr, infohash string) error {
 	jwkSet := tkr.jwkSet
 	if time.Now().After(jwkSet.validUntil) {
-		return fmt.Errorf("Failed verify JWT due to stale JWK Set")
+		return errors.New("Failed verify JWT due to stale JWK Set")
 	}
 
 	jwt, err := jose.ParseJWT(jwtStr)
 	if err != nil {
-		return err
+		return models.ClientError("Failed to parse JWT")
 	}
 
 	validated, err := validateJWTSignature(&jwt, &jwkSet)
 	if err != nil {
 		return err
 	} else if !validated {
-		return errors.New("Failed to verify JWT with all available verifiers")
+		return models.ClientError("Failed to verify JWT signature with available verifiers")
 	}
 
 	claims, err := jwt.Claims()
 	if err != nil {
-		return err
+		return models.ClientError("Failed to decode JWT claims")
 	}
 
 	if claimedIssuer, ok, err := claims.StringClaim("iss"); claimedIssuer != jwkSet.Issuer || err != nil || !ok {
-		return errors.New("Failed to validate JWT issuer claim")
+		return models.ClientError("Failed to validate JWT issuer claim")
 	}
 
 	if claimedAudience, ok, err := claims.StringClaim("aud"); claimedAudience != tkr.Config.JWTAudience || err != nil || !ok {
-		return errors.New("Failed to validate JWT audience claim")
+		return models.ClientError("Failed to validate JWT audience claim")
 	}
 
 	claimedInfohash, ok, err := claims.StringClaim("infohash")
 	if err != nil || !ok {
-		return errors.New("Failed to validate JWT infohash claim")
+		return models.ClientError("Failed to validate JWT infohash claim")
 	}
 
 	unescapedInfohash, err := url.QueryUnescape(claimedInfohash)
 	if err != nil {
-		return errors.New("Failed to unescape JWT infohash claim")
+		return models.ClientError("Failed to unescape JWT infohash claim")
 	}
 
 	if unescapedInfohash != infohash {
-		return errors.New("Failed to match infohash claim with requested infohash")
+		return models.ClientError("Failed to match infohash claim with requested infohash")
 	}
 
 	return nil