nginx-hmac-secure-link

[nexusofdoom]

revers proxy nginx with nginx-hmac-secure-link
can this be done?
nexusofdoom/lancache-installer#20

[agile6v]

Hi @nexusofdoom

Sorry. I don't understand your question.
Please explain in detail.

Thanks.

[nexusofdoom]

caching nginx box setup like so.. online host uses Prerequisites for Token Authentication from akimia it addess this to the request acl=/*~hmac=6a10b3f602ffde88c02cd1b89665bfdfdc0fc84c3cf7049752931ad732654fab

the client points to my nginx caching box and ask to get the file but it never gets a hit on the key.

is there a way to rewrite the new token to the end of the request ? or something more I can do?

this is the url it requests "akamai-gamecdn.blackdesertonline.com/live001/game/download/131/BlackDesertOnline885.bcab?begin=1238753107&end=1247683342&hdnts=st=1537229206exp=1537230106acl=/live001/game/download/*!/live001/game/patch/*~hmac=c2d249db5aff5d6940e03447517ba12b41fdb9aa204cd3c762a9265f445beade"

and below is what the key shows
that it miss
/live001/game/download/131/BlackDesertOnline885.bcab

[agile6v]

Hello

What is the response code for this request?

"akamai-gamecdn.blackdesertonline.com/live001/game/download/131/BlackDesertOnline885.bcab?begin=1238753107&end=1247683342&hdnts=st=1537229206exp=1537230106acl=/live001/game/download/*!/live001/game/patch/*~hmac=c2d249db5aff5d6940e03447517ba12b41fdb9aa204cd3c762a9265f445beade"

[nexusofdoom]

where do you want me to get the response code ?
I have httpry installed along with I can look at the nginx log or do you want me to run wireshark on the client pc?

[nexusofdoom]

note in httpry its code 200

[agile6v]

You can get it using curl. I want to determine if the request is returned 200.

[nexusofdoom]

Ok will do when I get back from work tonight. thanks.

[agile6v]

Sorry, I can only judge by my experience.
I think you should request the origin website, check if the response is allowed caching. And also send me a copy.

[nexusofdoom]

direct test talking to there server
curl "akamai-gamecdn.blackdesertonline.com/live001/game/download/131/BlackDesertOnline885.bcab?begin=1238753107&end=1247683342&hdnts=st=1537229206exp=1537230106acl=/live001/game/download/*!/live001/game/patch/*~hmac=
c2d249db5aff5d6940e03447517ba12b41fdb9aa204cd3c762a9265f445beade"
curl : An error occurred while processing your request.
Reference #199.5ef00a17.1537399717.1bba468b
At line:1 char:1

• curl "akamai-gamecdn.blackdesertonline.com/live001/game/download/131/ ...

•   + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
  

[nexusofdoom]

if I use lancache I get this, note it saves files to the cache and the client gets the file but the next time it downloads the acl= changes and it comes back as a miss in nginx and it re-downloads the file all over again.

curl "akamai-gamecdn.blackdesertonline.com/live001/game/download/131/BlackDesertOnline885.bcab?begin=1238753107&end=1247683342&hdnts=st=1537229206exp=1537230106acl=/live001/game/download/*!/live001/game/patch/*~hmac=
c2d249db5aff5d6940e03447517ba12b41fdb9aa204cd3c762a9265f445beade"

StatusCode : 200
StatusDescription : OK
Content : ��À(Y Ð Ü·�0 � 4� À" �3 �òR� � ô7 x/� � ��aq� � lg� @ç� }y ´ÞLÏ� � ¬N
P� N� º@ÔÂ üO
P� N� ù�m6
LQ
pC 0� 3ë+© � ¼�
�= x� ¨A�ß  TÒ
�C ...
RawContent : HTTP/1.1 200 OK
Connection: keep-alive
X-Upstream-Cache-Status: HIT
Accept-Ranges: bytes
Content-Length: 8930236
Content-Type: text/plain
Date: Wed, 19 Sep 2018 23:25:32 GMT
ETag: "5518bf566eb7...
Forms : {}
Headers : {[Connection, keep-alive], [X-Upstream-Cache-Status, HIT], [Accept-Ranges, bytes], [Content-Length, 8930236]...}
Images : {}
InputFields : {}
Links : {}
ParsedHtml : mshtml.HTMLDocumentClass
RawContentLength : 8930236

[agile6v]

Hello

I noticed $request_url is used as key in your nginx conf.
$request_uri : full original request URI (with arguments)

[nexusofdoom]

this is the testing config I am playing with.
/etc/nginx/vhosts-enabled/lancache-pearlabyss.conf

server {
listen lancache-pearlabyss deferred default;
server_name pearlabyss _;
# DNS entries: lancache-
access_log /srv/lancache/logs/Access/pearlabyss.log main buffer=128k flush=1m;
access_log /srv/lancache/logs/Keys/pearlabyss.log keys_uri buffer=128k flush=1m;
error_log /srv/lancache/logs/Errors/pearlabyss.log;

# Default Node
include lancache/resolver;
#include lancache/cache-key-range;
    location / {
            set $no_cache 0;
            if ($request_uri ~* "(/live001/game/config/config.patch.version)") {
            set $no_cache 1;
            }
            proxy_no_cache $no_cache;
            proxy_cache_bypass $no_cache;
            proxy_bind 10.0.4.20;
            proxy_ignore_headers Expires Cache-Control;
            #proxy_set_header Range $http_range;
            #proxy_set_header If-Range $http_if_range;
            #proxy_cache_key "$server_name$uri";
            #proxy_cache_key "$scheme$request_method$host$uri$is_args$args";
            #proxy_cache_key "$uri$is_args$args$slice_range";
            #proxy_set_header X-Real-IP $remote_addr;
            #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            #proxy_cache_valid 200  206 320d;
            #proxy_cache_key $scheme$host$proxy_host$request_uri;
            #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            #proxy_set_header Host $host;
            #proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 150;
            # Use Origin cache
            proxy_cache pearlabyss;
            include lancache/proxy-cache;
            #include lancache/cache-range;
            include lancache/cache-key-default;
    }

}

[agile6v]

Your should use $uri instead of $request_uri as proxy_cache_key.

[nexusofdoom]

so change this
include lancache/cache-key-default;
}
}

to

        include lancache/cache-key-uri;
}

}

[nexusofdoom]

I did this

server {
listen lancache-pearlabyss deferred default;
server_name pearlabyss _;
# DNS entries: lancache-
access_log /srv/lancache/logs/Access/pearlabyss.log main buffer=128k flush=1m;
access_log /srv/lancache/logs/Keys/pearlabyss.log keys_uri buffer=128k flush=1m;
error_log /srv/lancache/logs/Errors/pearlabyss.log;

# Default Node
include lancache/resolver;
#include lancache/cache-key-range;
    location / {
            set $no_cache 0;
            if ($request_uri ~* "(/live001/game/config/config.patch.version)") {
            set $no_cache 1;
            }
            proxy_no_cache $no_cache;
            proxy_cache_bypass $no_cache;
            proxy_bind 10.0.4.20;
            proxy_ignore_headers Expires Cache-Control;
            #proxy_set_header Range $http_range;
            #proxy_set_header If-Range $http_if_range;
            proxy_cache_key "$uri";