Small nits

p2p/http/auth/internal/handshake/client.go

@@ -33,7 +33,8 @@ type PeerIDAuthHandshakeClient struct {
 	state           peerIDAuthClientState
 	p               params
 	hb              headerBuilder
-	challengeServer [challengeLen]byte
+	challengeServer []byte
+	buf             [128]byte
 }
 
 var errMissingChallenge = errors.New("missing challenge")
@@ -155,12 +156,13 @@ func (h *PeerIDAuthHandshakeClient) Run() error {
 }
 
 func (h *PeerIDAuthHandshakeClient) addChallengeServerParam() error {
-	_, err := io.ReadFull(randReader, h.challengeServer[:])
+	_, err := io.ReadFull(randReader, h.buf[:challengeLen])
 	if err != nil {
 		return err
 	}
-	copy(h.challengeServer[:], base64.URLEncoding.AppendEncode(nil, h.challengeServer[:]))
-	h.hb.writeParam("challenge-server", h.challengeServer[:])
+	h.challengeServer = base64.URLEncoding.AppendEncode(nil, h.buf[:challengeLen])
+	clear(h.buf[:challengeLen])
+	h.hb.writeParam("challenge-server", h.challengeServer)
 	return nil
 }
 
@@ -173,7 +175,7 @@ func (h *PeerIDAuthHandshakeClient) verifySig(clientPubKeyBytes []byte) error {
 		return fmt.Errorf("failed to decode signature: %w", err)
 	}
 	err = verifySig(h.serverPubKey, PeerIDAuthScheme, []sigParam{
-		{"challenge-server", h.challengeServer[:]},
+		{"challenge-server", h.challengeServer},
 		{"client-public-key", clientPubKeyBytes},
 		{"hostname", []byte(h.Hostname)},
 	}, sig)
@@ -210,6 +212,9 @@ func (h *PeerIDAuthHandshakeClient) PeerID() (peer.ID, error) {
 		return "", errors.New("server not authenticated yet")
 	}
 
+	if h.serverPeerID == "" {
+		return "", errors.New("peer ID not set")
+	}
 	return h.serverPeerID, nil
 }
 

p2p/http/auth/internal/handshake/handshake.go

@@ -81,7 +81,7 @@ func (p *params) parsePeerIDAuthSchemeParams(headerVal []byte) error {
 			p.sigB64 = v
 		}
 	}
-	return nil
+	return err
 }
 
 func splitAuthHeaderParams(data []byte, atEOF bool) (advance int, token []byte, err error) {
@@ -91,13 +91,15 @@ func splitAuthHeaderParams(data []byte, atEOF bool) (advance int, token []byte,
 
 	start := 0
 	for start < len(data) && (data[start] == ' ' || data[start] == ',') {
+		// Ignore leading spaces and commas
 		start++
 	}
 	if start == len(data) {
 		return len(data), nil, nil
 	}
 	end := start + 1
 	for end < len(data) && data[end] != ' ' && data[end] != ',' {
+		// Consume until we hit a space or comma
 		end++
 	}
 	token = data[start:end]
@@ -132,8 +134,8 @@ func (h *headerBuilder) maybeAddComma() {
 	h.b.WriteString(", ")
 }
 
-// writeParam writes a key value pair to the header. It first b64 encodes the value.
-// It uses buf as a scratch space.
+// writeParam writes a key value pair to the header. It first b64 encodes the
+// value. It uses buf as scratch space.
 func (h *headerBuilder) writeParamB64(buf []byte, key string, val []byte) {
 	if buf == nil {
 		buf = make([]byte, base64.URLEncoding.EncodedLen(len(val)))

p2p/http/auth/internal/handshake/server.go

@@ -257,7 +257,7 @@ func (h *PeerIDAuthHandshakeServer) Run() error {
 		return nil
 	}
 
-	return nil
+	return errors.New("unhandled state")
 }
 
 func (h *PeerIDAuthHandshakeServer) addChallengeClientParam() error {
@@ -349,6 +349,9 @@ func (h *PeerIDAuthHandshakeServer) PeerID() (peer.ID, error) {
 	default:
 		return "", errors.New("not in proper state")
 	}
+	if h.opaque.PeerID == "" {
+		return "", errors.New("peer ID not set")
+	}
 	return h.opaque.PeerID, nil
 }