jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-11 08:23:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): bind signed workload tokens to allocation_id only

Browse Source 
The just-landed signed workload token embedded (allocation_id, match_id,
server_id) as claims. That doesn't actually work for its intended delivery
channel: the token is meant to be requested as a GameServerAllocation
annotation in the SAME request that asks Agones to pick a server, so at mint
time the allocator knows allocation_id (it generates it) but not yet which
server_id Agones will return -- server_id only exists in Agones's response,
after the annotation request has already been sent. Embedding it was simply
not possible for the real caller this was built for; only the (allocator ->
signed_token) unit tests and hand-constructed integration tests happened to
supply it directly, masking the gap.

Fixes it by having the token bind only allocation_id (the one identifier
actually known at mint time) plus expiry. match_id/server_id are resolved at
verify time from the durable allocations table via the new
store.AllocationBindingByAllocationID, keyed by allocation_id -- which the
allocator already records immediately after Agones responds. This is
strictly stronger, not just a workaround: a caller can no longer claim any
match/server pairing at all, even one that happens to be internally
consistent -- the binding returned is entirely durable-record-derived.

Verified: server/workload's unit tests updated for the new two-field claim
shape; server/api's Postgres integration suite gains
TestWorkloadVerifierFromSignedTokenNeverTrustsCallerSuppliedBinding (two
distinct real allocations each resolve to their own, and only their own,
match/server pairing) replacing the now-inapplicable mismatched-triple test.
Full `go build ./... && go vet ./... && gofmt -l . && go test ./... -race`
and `go test -tags integration ./... -race` both clean; the api integration
suite re-run 3x clean against a live postgres:17-alpine container.
This commit is contained in:
Josh Creek
2026-09-01 14:54:38 +01:00
parent 939b7a9584
commit d588898f5d
5 changed files with 118 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/workload/signed_token.go
+28 -21
View File
@@ -18,22 +18,31 @@ import (
// cluster to validate against and so cannot be built or tested here.
//
// This sidesteps that requirement entirely: the control plane signs its own
// short-lived token over (allocation_id, match_id, server_id, expiry) with a
// secret only it holds, exactly the way domain.SessionStore already mints
// player session tokens elsewhere in this codebase. It needs no Kubernetes
// trust boundary to verify -- HMAC signature plus expiry is self-contained.
// short-lived token over (allocation_id, expiry) with a secret only it
// holds, exactly the way domain.SessionStore already mints player session
// tokens elsewhere in this codebase. It needs no Kubernetes trust boundary
// to verify -- HMAC signature plus expiry is self-contained.
//
// The token deliberately binds ONLY allocation_id, not match_id/server_id
// too: it is meant to be requested as a GameServerAllocation annotation
// (see agones/allocation.go) in the SAME request that asks Agones to pick a
// server for this allocation -- so at mint time, the allocator knows
// allocation_id (it generates it) but not yet which server_id Agones will
// return. match_id and server_id are instead resolved durably at verify
// time from the allocations table, which the allocator records immediately
// after Agones responds (see store.AllocationBindingByAllocationID) -- so a
// token can never claim a match/server pairing that isn't what was actually,
// durably allocated.
//
// The delivery channel is what makes this safe despite not proving pod
// identity the way a Kubernetes-issued token would: the token is meant to be
// handed to the allocated GameServer via the same Agones GameServerAllocation
// annotation channel allocation.go already uses for match-id/allocation-id
// (see agones/allocation.go), which only the actually-allocated pod's local
// SDK sidecar can read. A caller who can present this token has already
// proven, via that channel, that it is the pod Agones allocated.
// identity the way a Kubernetes-issued token would: the token reaches the
// allocated GameServer via the same annotation channel allocation.go
// already uses for match-id/allocation-id, which only the actually-
// allocated pod's local SDK sidecar can read. A caller who can present this
// token has already proven, via that channel, that it is the pod Agones
// allocated.
type SignedWorkloadToken struct {
AllocationID string `json:"a"`
MatchID string `json:"m"`
ServerID string `json:"s"`
ExpiresAt time.Time `json:"e"`
}
@@ -46,15 +55,15 @@ var (
)
// IssueSignedWorkloadToken produces a compact "payload.signature" token
// binding the three identifiers the API layer actually checks (see
// api.Service's WorkloadVerify call site: it only compares ServerID and
// MatchID on the returned domain.WorkloadBinding). now must be non-zero and
// ttl must be positive so a token is never silently issued already-expired.
func IssueSignedWorkloadToken(secret []byte, allocationID, matchID, serverID string, now time.Time, ttl time.Duration) (string, error) {
// binding allocation_id, the one identifier known at mint time (see the
// type doc above for why match_id/server_id aren't embedded). now must be
// non-zero and ttl must be positive so a token is never silently issued
// already-expired.
func IssueSignedWorkloadToken(secret []byte, allocationID string, now time.Time, ttl time.Duration) (string, error) {
if len(secret) == 0 {
return "", ErrEmptyWorkloadSecret
}
if allocationID == "" || matchID == "" || serverID == "" {
if allocationID == "" {
return "", ErrTokenClaims
}
if now.IsZero() || ttl <= 0 {
@@ -62,8 +71,6 @@ func IssueSignedWorkloadToken(secret []byte, allocationID, matchID, serverID str
}
claims := SignedWorkloadToken{
AllocationID: allocationID,
MatchID: matchID,
ServerID: serverID,
ExpiresAt: now.Add(ttl).UTC(),
}
payload, err := json.Marshal(claims)
@@ -113,7 +120,7 @@ func ParseSignedWorkloadToken(secret []byte, token string, now time.Time) (Signe
if err := json.Unmarshal(payload, &claims); err != nil {
return SignedWorkloadToken{}, ErrMalformedToken
}
if claims.AllocationID == "" || claims.MatchID == "" || claims.ServerID == "" || claims.ExpiresAt.IsZero() {
if claims.AllocationID == "" || claims.ExpiresAt.IsZero() {
return SignedWorkloadToken{}, ErrTokenClaims
}
if now.IsZero() {
server/workload/signed_token_test.go
+10 -14
View File
@@ -9,7 +9,7 @@ import (
func TestSignedWorkloadTokenRoundTrips(t *testing.T) {
secret := []byte("test-secret")
now := time.Unix(1_700_000_000, 0).UTC()
token, err := IssueSignedWorkloadToken(secret, "alloc-1", "match-1", "server-1", now, time.Minute)
token, err := IssueSignedWorkloadToken(secret, "alloc-1", now, time.Minute)
if err != nil {
t.Fatalf("issue: %v", err)
}
@@ -17,7 +17,7 @@ func TestSignedWorkloadTokenRoundTrips(t *testing.T) {
if err != nil {
t.Fatalf("parse: %v", err)
}
if claims.AllocationID != "alloc-1" || claims.MatchID != "match-1" || claims.ServerID != "server-1" {
if claims.AllocationID != "alloc-1" {
t.Fatalf("unexpected claims: %+v", claims)
}
}
@@ -25,7 +25,7 @@ func TestSignedWorkloadTokenRoundTrips(t *testing.T) {
func TestSignedWorkloadTokenRejectsExpiry(t *testing.T) {
secret := []byte("test-secret")
now := time.Unix(1_700_000_000, 0).UTC()
token, err := IssueSignedWorkloadToken(secret, "alloc-1", "match-1", "server-1", now, time.Minute)
token, err := IssueSignedWorkloadToken(secret, "alloc-1", now, time.Minute)
if err != nil {
t.Fatalf("issue: %v", err)
}
@@ -43,7 +43,7 @@ func TestSignedWorkloadTokenRejectsExpiry(t *testing.T) {
func TestSignedWorkloadTokenRejectsTamperedPayload(t *testing.T) {
secret := []byte("test-secret")
now := time.Unix(1_700_000_000, 0).UTC()
token, err := IssueSignedWorkloadToken(secret, "alloc-1", "match-1", "server-1", now, time.Minute)
token, err := IssueSignedWorkloadToken(secret, "alloc-1", now, time.Minute)
if err != nil {
t.Fatalf("issue: %v", err)
}
@@ -55,7 +55,7 @@ func TestSignedWorkloadTokenRejectsTamperedPayload(t *testing.T) {
func TestSignedWorkloadTokenRejectsWrongSecret(t *testing.T) {
now := time.Unix(1_700_000_000, 0).UTC()
token, err := IssueSignedWorkloadToken([]byte("secret-a"), "alloc-1", "match-1", "server-1", now, time.Minute)
token, err := IssueSignedWorkloadToken([]byte("secret-a"), "alloc-1", now, time.Minute)
if err != nil {
t.Fatalf("issue: %v", err)
}
@@ -80,20 +80,16 @@ func TestIssueSignedWorkloadTokenRejectsInvalidInput(t *testing.T) {
name string
secret []byte
allocationID string
matchID string
serverID string
now time.Time
ttl time.Duration
}{
{"empty secret", nil, "a", "m", "s", now, time.Minute},
{"empty allocation id", []byte("k"), "", "m", "s", now, time.Minute},
{"empty match id", []byte("k"), "a", "", "s", now, time.Minute},
{"empty server id", []byte("k"), "a", "m", "", now, time.Minute},
{"zero now", []byte("k"), "a", "m", "s", time.Time{}, time.Minute},
{"non-positive ttl", []byte("k"), "a", "m", "s", now, 0},
{"empty secret", nil, "a", now, time.Minute},
{"empty allocation id", []byte("k"), "", now, time.Minute},
{"zero now", []byte("k"), "a", time.Time{}, time.Minute},
{"non-positive ttl", []byte("k"), "a", now, 0},
}
for _, c := range cases {
if _, err := IssueSignedWorkloadToken(c.secret, c.allocationID, c.matchID, c.serverID, c.now, c.ttl); err == nil {
if _, err := IssueSignedWorkloadToken(c.secret, c.allocationID, c.now, c.ttl); err == nil {
t.Fatalf("%s: expected an error, got nil", c.name)
}
}