jwt auth on websockets

ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/JsonRpcService.java

@@ -87,11 +87,13 @@
 import io.vertx.core.http.ServerWebSocket;
 import io.vertx.core.net.PfxOptions;
 import io.vertx.core.net.SocketAddress;
+import io.vertx.ext.auth.User;
 import io.vertx.ext.web.Route;
 import io.vertx.ext.web.Router;
 import io.vertx.ext.web.RoutingContext;
 import io.vertx.ext.web.handler.BodyHandler;
 import io.vertx.ext.web.handler.CorsHandler;
+import org.jetbrains.annotations.NotNull;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -331,26 +333,21 @@ private Handler<ServerWebSocket> webSocketHandler() {
                 user -> {
                   if (user.isEmpty()) {
                     websocket.reject(403);
+                  } else {
+                    final Handler<Buffer> socketHandler =
+                        handlerForUser(socketAddress, websocket, user);
+                    websocket.textMessageHandler(text -> socketHandler.handle(Buffer.buffer(text)));
+                    websocket.binaryMessageHandler(socketHandler);
                   }
                 });
+      } else {
+        final Handler<Buffer> socketHandler =
+            handlerForUser(socketAddress, websocket, Optional.empty());
+        websocket.textMessageHandler(text -> socketHandler.handle(Buffer.buffer(text)));
+        websocket.binaryMessageHandler(socketHandler);
       }
-      LOG.debug("Websocket Connected ({})", socketAddressAsString(socketAddress));
-
-      final Handler<Buffer> socketHandler =
-          buffer -> {
-            LOG.debug(
-                "Received Websocket request (binary frame) {} ({})",
-                buffer.toString(),
-                socketAddressAsString(socketAddress));
-
-            if (webSocketMessageHandler.isPresent()) {
-              webSocketMessageHandler.get().handle(websocket, buffer, Optional.empty());
-            } else {
-              LOG.error("No socket request handler configured");
-            }
-          };
-      websocket.textMessageHandler(text -> socketHandler.handle(Buffer.buffer(text)));
-      websocket.binaryMessageHandler(socketHandler);
+      String addr = socketAddressAsString(socketAddress);
+      LOG.debug("Websocket Connected ({})", addr);
 
       websocket.closeHandler(
           v -> {
@@ -371,6 +368,24 @@ private Handler<ServerWebSocket> webSocketHandler() {
     };
   }
 
+  @NotNull
+  private Handler<Buffer> handlerForUser(
+      final SocketAddress socketAddress,
+      final ServerWebSocket websocket,
+      final Optional<User> user) {
+    return buffer -> {
+      String addr = socketAddressAsString(socketAddress);
+      LOG.debug("Received Websocket request (binary frame) {} ({})", buffer, addr);
+
+      if (webSocketMessageHandler.isPresent()) {
+        // if auth enabled and user empty will always 401
+        webSocketMessageHandler.get().handle(websocket, buffer, user);
+      } else {
+        LOG.error("No socket request handler configured");
+      }
+    };
+  }
+
   private void validateConfig(final JsonRpcConfiguration config) {
     checkArgument(
         config.getPort() == 0 || NetworkUtility.isValidPort(config.getPort()),
@@ -588,20 +603,18 @@ private Optional<String> getAndValidateHostHeader(final RoutingContext event) {
             : event.request().host();
     final Iterable<String> splitHostHeader = Splitter.on(':').split(hostname);
     final long hostPieces = stream(splitHostHeader).count();
-    if (hostPieces > 1) {
-      // If the host contains a colon, verify the host is correctly formed - host [ ":" port ]
-      if (hostPieces > 2 || !Iterables.get(splitHostHeader, 1).matches("\\d{1,5}+")) {
-        return Optional.empty();
-      }
+    // If the host contains a colon, verify the host is correctly formed - host [ ":" port ]
+    if (hostPieces > 2 || !Iterables.get(splitHostHeader, 1).matches("\\d{1,5}+")) {
+      return Optional.empty();
     }
+
     return Optional.ofNullable(Iterables.get(splitHostHeader, 0));
   }
 
   private boolean hostIsInAllowlist(final String hostHeader) {
     if (config.getHostsAllowlist().contains("*")
         || config.getHostsAllowlist().stream()
-            .anyMatch(
-                allowlistEntry -> allowlistEntry.toLowerCase().equals(hostHeader.toLowerCase()))) {
+            .anyMatch(allowlistEntry -> allowlistEntry.equalsIgnoreCase(hostHeader))) {
       return true;
     } else {
       LOG.trace("Host not in allowlist: '{}'", hostHeader);

ethereum/api/src/main/java/org/hyperledger/besu/ethereum/api/jsonrpc/authentication/EngineAuthService.java

@@ -52,6 +52,12 @@ public EngineAuthService(final Vertx vertx, final Optional<File> signingKey, fin
     this.jwtAuthProvider = JWTAuth.create(vertx, jwtAuthOptions);
   }
 
+  public String createToken() {
+    JsonObject claims = new JsonObject();
+    claims.put("iat", System.currentTimeMillis() / 1000);
+    return this.jwtAuthProvider.generateToken(claims);
+  }
+
   private JWTAuthOptions engineApiJWTOptions(
       final JwtAlgorithm jwtAlgorithm, final Optional<File> keyFile, final Path datadir) {
     byte[] signingKey = null;

ethereum/api/src/test/java/org/hyperledger/besu/ethereum/api/jsonrpc/internal/response/MutableJsonRpcSuccessResponse.java

@@ -0,0 +1,97 @@
+/*
+ * Copyright Hyperledger Besu contributors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+ * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package org.hyperledger.besu.ethereum.api.jsonrpc.internal.response;
+
+import java.util.Objects;
+
+import com.fasterxml.jackson.annotation.JsonGetter;
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonPropertyOrder;
+import com.fasterxml.jackson.annotation.JsonSetter;
+
+@JsonPropertyOrder({"jsonrpc", "id", "result"})
+public class MutableJsonRpcSuccessResponse {
+
+  private Object id;
+  private Object result;
+  private Object version;
+
+  public MutableJsonRpcSuccessResponse() {
+    this.id = null;
+    this.result = null;
+  }
+
+  public MutableJsonRpcSuccessResponse(final Object id, final Object result) {
+    this.id = id;
+    this.result = result;
+  }
+
+  public MutableJsonRpcSuccessResponse(final Object id) {
+    this.id = id;
+    this.result = "Success";
+  }
+
+  @JsonGetter("id")
+  public Object getId() {
+    return id;
+  }
+
+  @JsonGetter("result")
+  public Object getResult() {
+    return result;
+  }
+
+  @JsonSetter("id")
+  public void setId(final Object id) {
+    this.id = id;
+  }
+
+  @JsonSetter("result")
+  public void setResult(final Object result) {
+    this.result = result;
+  }
+
+  @JsonGetter("jsonrpc")
+  public Object getVersion() {
+    return version;
+  }
+
+  @JsonSetter("jsonrpc")
+  public void setVersion(final Object version) {
+    this.version = version;
+  }
+
+  @JsonIgnore
+  public JsonRpcResponseType getType() {
+    return JsonRpcResponseType.SUCCESS;
+  }
+
+  @Override
+  public boolean equals(final Object o) {
+    if (this == o) {
+      return true;
+    }
+    if (o == null || getClass() != o.getClass()) {
+      return false;
+    }
+    final MutableJsonRpcSuccessResponse that = (MutableJsonRpcSuccessResponse) o;
+    return Objects.equals(id, that.id) && Objects.equals(result, that.result);
+  }
+
+  @Override
+  public int hashCode() {
+    return Objects.hash(id, result);
+  }
+}