Table of Contents

Class RequestProof

Namespace
VpnHood.Core.Tunneling.ProbeResistance
Assembly
VpnHood.Core.Tunneling.dll

Provides the proof that a request's client holds the server farm's secret, which the server asks for before it takes an HTTP body or a WebSocket upgrade: a JSON Web Token, signed with HS256 by a key derived from the secret.

public sealed class RequestProof
Inheritance
RequestProof
Inherited Members

Remarks

TCP and QUIC share it, and it runs only when a stream opens, never for the stream's packets.

Constructors

RequestProof(byte[])

Provides the proof that a request's client holds the server farm's secret, which the server asks for before it takes an HTTP body or a WebSocket upgrade: a JSON Web Token, signed with HS256 by a key derived from the secret.

public RequestProof(byte[] farmSecret)

Parameters

farmSecret byte[]

The server farm's secret, which the access key carries; at least 16 bytes.

Remarks

TCP and QUIC share it, and it runs only when a stream opens, never for the stream's packets.

Exceptions

ArgumentNullException

farmSecret is null.

ArgumentException

farmSecret is shorter than 16 bytes.

Fields

ClockTolerance

How far the client's clock may be from the server's: 30 seconds either way.

public static readonly TimeSpan ClockTolerance

Field Value

TimeSpan

Exceptions

ArgumentNullException

farmSecret is null.

ArgumentException

farmSecret is shorter than 16 bytes.

Lifetime

How long a proof holds from its issue: 5 minutes.

public static readonly TimeSpan Lifetime

Field Value

TimeSpan

Exceptions

ArgumentNullException

farmSecret is null.

ArgumentException

farmSecret is shorter than 16 bytes.

ProtocolVersion

The HTTP protocol version a proof is for: 15.

public const int ProtocolVersion = 15

Field Value

int

Exceptions

ArgumentNullException

farmSecret is null.

ArgumentException

farmSecret is shorter than 16 bytes.

Methods

Create(int, DateTimeOffset)

Creates a proof, issued now.

public string Create(int protocolVersion, DateTimeOffset now)

Parameters

protocolVersion int

The protocol version, which must be ProtocolVersion.

now DateTimeOffset

The time, by the client's clock as the server's would read it.

Returns

string

The proof, as a JSON Web Token.

Exceptions

ArgumentOutOfRangeException

protocolVersion is not ProtocolVersion.

Verify(string, int, DateTimeOffset)

Verifies a proof: its signature, its header and fields, and that it was issued within Lifetime before now, give or take ClockTolerance.

public bool Verify(string token, int protocolVersion, DateTimeOffset now)

Parameters

token string

The proof.

protocolVersion int

The protocol version, which must be ProtocolVersion.

now DateTimeOffset

The time.

Returns

bool

true if the proof holds; otherwise, false.

Exceptions

ArgumentNullException

farmSecret is null.

ArgumentException

farmSecret is shorter than 16 bytes.