Added certificate url for obtaining new certificates

Duplicati/Agent/Program.cs

@@ -127,6 +127,7 @@ public static class Program
                 KeepRemoteConnection.Start(
                     settings.ServerUrl,
                     settings.JWT,
+                    settings.CertificateUrl,
                     settings.ServerCertificates,
                     cts.Token,
                     ReKey,

Duplicati/Agent/Settings.cs

@@ -39,6 +39,7 @@ public sealed record Settings(
     string Filename,
     string JWT,
     string ServerUrl,
+    string CertificateUrl,
     string? SettingsEncryptionKey,
     IEnumerable<MiniServerCertificate> ServerCertificates
 )
@@ -66,7 +67,7 @@ public sealed record Settings(
     {
         path ??= DefaultSettingsFile;
         var tmp = JsonSerializer.Deserialize<Settings>(File.ReadAllText(path))
-            ?? new Settings(path, string.Empty, string.Empty, string.Empty, Array.Empty<MiniServerCertificate>());
+            ?? new Settings(path, string.Empty, string.Empty, string.Empty, string.Empty, Array.Empty<MiniServerCertificate>());
 
         return tmp with
         {

Duplicati/Library/RemoteControl/KeepRemoteConnection.cs

@@ -100,9 +100,9 @@ public class KeepRemoteConnection : IDisposable
     /// </summary>
     /// <param name="serverUrl">The url to use</param>
     /// <param name="JWT">The JWT token to use</param>
-    /// <param name="serverKey">The server key to use</param>
+    /// <param name="serverKeys">The server keys to use</param>
     /// <param name="cancellationToken">The token to cancel the connection</param>
-    private KeepRemoteConnection(string serverUrl, string JWT, IEnumerable<MiniServerCertificate> serverKeys, CancellationToken cancellationToken, Func<ClaimedClientData, Task> onReKey, Func<CommandMessage, Task> onMessage)
+    private KeepRemoteConnection(string serverUrl, string JWT, string certificateUrl, IEnumerable<MiniServerCertificate> serverKeys, CancellationToken cancellationToken, Func<ClaimedClientData, Task> onReKey, Func<CommandMessage, Task> onMessage)
     {
         _client = new Websocket.Client.WebsocketClient(new Uri(serverUrl));
         _client.ReconnectTimeout = TimeSpan.FromSeconds(30);
@@ -115,6 +115,7 @@ public class KeepRemoteConnection : IDisposable
 
         _client.DisconnectionHappened.Subscribe(info =>
         {
+            // TODO: If disconnected due to certifiate error, we should try to get fresh certificates
             _state = ConnectionState.NotConnected;
             Log.WriteMessage(LogMessageType.Warning, LogTag, "WebsocketDisconnect", "Disconnected from the server");
         });
@@ -159,7 +160,7 @@ public class KeepRemoteConnection : IDisposable
                         throw new EnvelopeJsonParsingException("Invalid Json message");
 
                     if ((authMessage.WillReplaceToken ?? false) && authMessage.NewToken != null)
-                        await onReKey(new ClaimedClientData(authMessage.NewToken, serverUrl, serverKeys, null));
+                        await onReKey(new ClaimedClientData(authMessage.NewToken, serverUrl, certificateUrl, serverKeys, null));
 
                     _state = ConnectionState.Authenticated;
                 }
@@ -209,15 +210,16 @@ public class KeepRemoteConnection : IDisposable
     /// </summary>
     /// <param name="serverUrl">The url to use</param>
     /// <param name="JWT">The JWT to use</param>
+    /// <param name="certificateUrl">The certificate url to use</param>
     /// <param name="serverKeys">The server keys to use</param>
     /// <param name="cancellationToken">The token to cancel the connection</param>
     /// <param name="onReKey">The callback to call when rekeying</param>
     /// <param name="onMessage">The callback to call when a message is received</param>
     /// <returns></returns>
-    public static Task Start(string serverUrl, string JWT, IEnumerable<MiniServerCertificate> serverKeys, CancellationToken cancellationToken, Func<ClaimedClientData, Task> onReKey, Func<CommandMessage, Task> onMessage)
+    public static Task Start(string serverUrl, string JWT, string certificateUrl, IEnumerable<MiniServerCertificate> serverKeys, CancellationToken cancellationToken, Func<ClaimedClientData, Task> onReKey, Func<CommandMessage, Task> onMessage)
         => Task.Run(async () =>
         {
-            using var connection = new KeepRemoteConnection(serverUrl, JWT, serverKeys, cancellationToken, onReKey, onMessage);
+            using var connection = new KeepRemoteConnection(serverUrl, JWT, certificateUrl, serverKeys, cancellationToken, onReKey, onMessage);
             await connection._runnerTask;
         });
 
@@ -285,13 +287,14 @@ public class KeepRemoteConnection : IDisposable
     /// </summary>
     /// <param name="serverUrl">The url to use</param>
     /// <param name="JWT">The JWT token to use</param>
-    /// <param name="serverKey">The server key to use</param>
+    /// 
+    /// <param name="serverKeys">The server keys to use</param>
     /// <param name="onReKey">The callback to call when rekeying</param>
     /// <param name="onMessage">The callback to call when a message is received</param>
     /// <param name="cancellationToken">The token to cancel the connection</param>
     /// <returns>The connection object</returns>
-    public static KeepRemoteConnection CreateRemoteListener(string serverUrl, string JWT, IEnumerable<MiniServerCertificate> serverKeys, CancellationToken cancellationToken, Func<ClaimedClientData, Task> onReKey, Func<CommandMessage, Task> onMessage)
-        => new KeepRemoteConnection(serverUrl, JWT, serverKeys, cancellationToken, onReKey, onMessage);
+    public static KeepRemoteConnection CreateRemoteListener(string serverUrl, string JWT, string certificateUrl, IEnumerable<MiniServerCertificate> serverKeys, CancellationToken cancellationToken, Func<ClaimedClientData, Task> onReKey, Func<CommandMessage, Task> onMessage)
+        => new KeepRemoteConnection(serverUrl, JWT, certificateUrl, serverKeys, cancellationToken, onReKey, onMessage);
 
     /// <summary>
     /// Sends a heartbeat message to the server

Duplicati/Library/RemoteControl/RegisterForRemote.cs

@@ -203,10 +203,10 @@ public class RegisterForRemote : IDisposable
             throw new InvalidOperationException("Resgistration process is not in the registered state");
 
         _state = States.WaitingForClaim;
-        _cancellationTokenSource.CancelAfter(TimeSpan.FromSeconds(_registerClientData!.MaxLifetimeSeconds));
+        _cancellationTokenSource.CancelAfter(TimeSpan.FromSeconds(Math.Min(3600, Math.Max(1, _registerClientData!.MaxLifetimeSeconds))));
         try
         {
-            _claimedClientData = await RetryHelper.Retry(() => CheckClientClaimed(), _registerClientData!.MaxRetries, TimeSpan.FromSeconds(_registerClientData!.RetrySeconds), _cancellationTokenSource.Token);
+            _claimedClientData = await RetryHelper.Retry(() => CheckClientClaimed(), Math.Min(100, Math.Max(1, _registerClientData!.MaxRetries)), TimeSpan.FromSeconds(_registerClientData!.RetrySeconds), _cancellationTokenSource.Token);
         }
         catch (Exception ex)
         {

Duplicati/Library/RemoteControl/SharedTypes.cs

@@ -42,11 +42,13 @@ public sealed record RegisterClientData(
 /// </summary>
 /// <param name="JWT">The JWT token for the machine</param>
 /// <param name="ServerUrl">The URL for the remote server</param>
-/// <param name="ServerCertificateKey">The certificate key for the remote server</param>
+/// <param name="CertificateUrl">The URL for getting new server certificates</param>
+/// <param name="ServerCertificates">The certificates for the remote server</param>
 /// <param name="LocalEncryptionKey">The encryption key for the local settings</param>
 public sealed record ClaimedClientData(
     string JWT,
     string ServerUrl,
+    string CertificateUrl,
     IEnumerable<MiniServerCertificate> ServerCertificates,
     string? LocalEncryptionKey
 );

Duplicati/WebserverCore/Services/RemoteControllerRegistrationService.cs

@@ -41,6 +41,10 @@ public sealed record RemoteControlConfig
     /// </summary>
     public required string ServerUrl { get; init; }
     /// <summary>
+    /// The URL for getting new server certificates.
+    /// </summary>
+    public required string CertificateUrl { get; init; }
+    /// <summary>
     /// The trusted server certificates.
     /// </summary>
     public required IEnumerable<MiniServerCertificate> ServerCertificates { get; init; }

Duplicati/WebserverCore/Services/RemoteControllerService.cs

@@ -101,7 +101,8 @@ public class RemoteControllerService(Connection connection, IHttpClientFactory h
         {
             Token = data.JWT,
             ServerCertificates = MiniServerCertificate.MergeCertificates(data.ServerCertificates, oldCerts),
-            ServerUrl = data.ServerUrl
+            ServerUrl = data.ServerUrl,
+            CertificateUrl = data.CertificateUrl
         });
 
         // TODO: Implement changing the encryption key