MeshPeerAuth
How gateways and workers prove to each other that they belong to the mesh: HelloMsg.Token on an infrastructure link carries unixSeconds.base64url(HMAC-SHA256(key, role|id|incarnation|unixSeconds)) with a key derived from the mesh token (...
Nebula · Packages/com.1by3.nebula/Runtime/Gateway/Sessions.cspublic static class MeshPeerAuthHow gateways and workers prove to each other that they belong to the mesh: HelloMsg.Token on an infrastructure link carries unixSeconds.base64url(HMAC-SHA256(key, role|id|incarnation|unixSeconds)) with a key derived from the mesh token (NebulaConfig.MeshToken). A peer without the mesh token cannot mint one, and a captured token is only good for the same role, id and incarnation for MaxAgeSeconds. With no mesh token configured (a local mesh) every peer is accepted, as before. Players are authenticated separately (OidcTokenValidator, AnonymousIdentityIssuer).
Fields
MaxAgeSeconds
public const long MaxAgeSeconds = 300;Methods
DeriveKey
public static byte[] DeriveKey(string meshToken);Issue
public static string Issue(string meshToken, PeerRole role, string id, uint incarnation);
public static string Issue(byte[] key, PeerRole role, string id, uint incarnation, long unixSeconds);Verify
public static bool Verify(string meshToken, PeerRole role, string id, uint incarnation, string token, out string error);
public static bool Verify(byte[] key, PeerRole role, string id, uint incarnation, string token, long now, out string error);True when token proves the peer holds the mesh token, or when the mesh has none.