Skip to content
This repository was archived by the owner on May 28, 2022. It is now read-only.

Commit 0899d6a

Browse files
author
emmanuel
committed
CC-796: Remove dependency on unsupported version of go-oidc
1 parent f44e496 commit 0899d6a

37 files changed

Lines changed: 1147 additions & 906 deletions

‎go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ require (
77
github.com/cloudflare/brotli-go v0.0.0-20191101163834-d34379f7ff93
88
github.com/cloudflare/golibs v0.0.0-20170913112048-333127dbecfc
99
github.com/coredns/coredns v1.8.7
10-
github.com/coreos/go-oidc v0.0.0-20171002155002-a93f71fdfe73
1110
github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
1211
github.com/cpuguy83/go-md2man/v2 v2.0.0 // indirect
1312
github.com/facebookgo/ensure v0.0.0-20160127193407-b4ab57deab51 // indirect
@@ -51,14 +50,15 @@ require (
5150
golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b
5251
google.golang.org/genproto v0.0.0-20211223182754-3ac035c7e7cb // indirect
5352
google.golang.org/grpc v1.43.0 // indirect
54-
gopkg.in/coreos/go-oidc.v2 v2.1.0
5553
gopkg.in/natefinch/lumberjack.v2 v2.0.0
56-
gopkg.in/square/go-jose.v2 v2.4.0 // indirect
54+
gopkg.in/square/go-jose.v2 v2.6.0
5755
gopkg.in/yaml.v2 v2.4.0
5856
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
5957
zombiezen.com/go/capnproto2 v2.18.0+incompatible
6058
)
6159

60+
require gopkg.in/coreos/go-oidc.v2 v2.2.1
61+
6262
require (
6363
github.com/BurntSushi/toml v0.3.1 // indirect
6464
github.com/apparentlymart/go-cidr v1.1.0 // indirect

‎go.sum‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -131,8 +131,6 @@ github.com/coredns/caddy v1.1.1 h1:2eYKZT7i6yxIfGP3qLJoJ7HAsDJqYB+X68g4NYjSrE0=
131131
github.com/coredns/caddy v1.1.1/go.mod h1:A6ntJQlAWuQfFlsd9hvigKbo2WS0VUs2l1e2F+BawD4=
132132
github.com/coredns/coredns v1.8.7 h1:wVMjAnyFnY7Mc18AFO+9qbGD6ODPtdVUIlzoWrHr3hk=
133133
github.com/coredns/coredns v1.8.7/go.mod h1:bFmbgEfeRz5aizL2VsQ5LRlsvJuXWkgG/MWG9zxqjVM=
134-
github.com/coreos/go-oidc v0.0.0-20171002155002-a93f71fdfe73 h1:7CNPV0LWRCa1FNmqg700pbXhzvmoaXKyfxWRkjRym7Q=
135-
github.com/coreos/go-oidc v0.0.0-20171002155002-a93f71fdfe73/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
136134
github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
137135
github.com/coreos/go-systemd v0.0.0-20181012123002-c6f51f82210d/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
138136
github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
@@ -1052,15 +1050,15 @@ gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8
10521050
gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
10531051
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
10541052
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
1055-
gopkg.in/coreos/go-oidc.v2 v2.1.0 h1:E8PjVFdj/SLDKB0hvb70KTbMbYVHjqztiQdSkIg8E+I=
1056-
gopkg.in/coreos/go-oidc.v2 v2.1.0/go.mod h1:fYaTe2FS96wZZwR17YTDHwG+Mw6fmyqJNxN2eNCGPCI=
1053+
gopkg.in/coreos/go-oidc.v2 v2.2.1 h1:MY5SZClJ7vhjKfr64a4nHAOV/c3WH2gB9BMrR64J1Mc=
1054+
gopkg.in/coreos/go-oidc.v2 v2.2.1/go.mod h1:fYaTe2FS96wZZwR17YTDHwG+Mw6fmyqJNxN2eNCGPCI=
10571055
gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
10581056
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
10591057
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
10601058
gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
10611059
gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
1062-
gopkg.in/square/go-jose.v2 v2.4.0 h1:0kXPskUMGAXXWJlP05ktEMOV0vmzFQUWw6d+aZJQU8A=
1063-
gopkg.in/square/go-jose.v2 v2.4.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
1060+
gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
1061+
gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
10641062
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
10651063
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
10661064
gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

‎sshgen/sshgen.go‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,10 @@ import (
1515
"net/url"
1616
"time"
1717

18-
"github.com/coreos/go-oidc/jose"
1918
homedir "github.com/mitchellh/go-homedir"
2019
"github.com/pkg/errors"
2120
gossh "golang.org/x/crypto/ssh"
21+
"gopkg.in/square/go-jose.v2/jwt"
2222

2323
"github.com/cloudflare/cloudflared/config"
2424
cfpath "github.com/cloudflare/cloudflared/token"
@@ -87,37 +87,33 @@ func SignCert(token, pubKey string) (string, error) {
8787
return "", errors.New("invalid token")
8888
}
8989

90-
jwt, err := jose.ParseJWT(token)
90+
parsedToken, err := jwt.ParseSigned(token)
9191
if err != nil {
9292
return "", errors.Wrap(err, "failed to parse JWT")
9393
}
9494

95-
claims, err := jwt.Claims()
95+
claims := jwt.Claims{}
96+
err = parsedToken.UnsafeClaimsWithoutVerification(&claims)
9697
if err != nil {
9798
return "", errors.Wrap(err, "failed to retrieve JWT claims")
9899
}
99100

100-
issuer, _, err := claims.StringClaim("iss")
101-
if err != nil {
102-
return "", errors.Wrap(err, "failed to retrieve JWT iss")
103-
}
104-
105101
buf, err := json.Marshal(&signPayload{
106102
PublicKey: pubKey,
107103
JWT: token,
108-
Issuer: issuer,
104+
Issuer: claims.Issuer,
109105
})
110106
if err != nil {
111107
return "", errors.Wrap(err, "failed to marshal signPayload")
112108
}
113109
var res *http.Response
114110
if mockRequest != nil {
115-
res, err = mockRequest(issuer+signEndpoint, "application/json", bytes.NewBuffer(buf))
111+
res, err = mockRequest(claims.Issuer+signEndpoint, "application/json", bytes.NewBuffer(buf))
116112
} else {
117113
client := http.Client{
118114
Timeout: 10 * time.Second,
119115
}
120-
res, err = client.Post(issuer+signEndpoint, "application/json", bytes.NewBuffer(buf))
116+
res, err = client.Post(claims.Issuer+signEndpoint, "application/json", bytes.NewBuffer(buf))
121117
}
122118

123119
if err != nil {

‎sshgen/sshgen_test.go‎

Lines changed: 20 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@
44
package sshgen
55

66
import (
7-
"crypto/rand"
8-
"crypto/rsa"
97
"encoding/json"
108
"fmt"
119
"io"
@@ -18,8 +16,9 @@ import (
1816
"testing"
1917
"time"
2018

21-
"github.com/coreos/go-oidc/jose"
2219
"github.com/stretchr/testify/assert"
20+
"gopkg.in/square/go-jose.v2"
21+
"gopkg.in/square/go-jose.v2/jwt"
2322

2423
"github.com/cloudflare/cloudflared/config"
2524
cfpath "github.com/cloudflare/cloudflared/token"
@@ -97,22 +96,25 @@ func TestCertGenSuccess(t *testing.T) {
9796
}
9897

9998
func tokenGenerator() string {
100-
iat := time.Now().Unix()
101-
exp := time.Now().Add(time.Minute * 5).Unix()
102-
claims := jose.Claims{}
103-
claims.Add("aud", audTest)
104-
claims.Add("iat", iat)
105-
claims.Add("nonce", nonceTest)
106-
claims.Add("exp", exp)
107-
108-
k, err := rsa.GenerateKey(rand.Reader, 512)
99+
iat := time.Now()
100+
exp := time.Now().Add(time.Minute * 5)
101+
102+
claims := jwt.Claims{
103+
Audience: jwt.Audience{audTest},
104+
IssuedAt: jwt.NewNumericDate(iat),
105+
Expiry: jwt.NewNumericDate(exp),
106+
}
107+
108+
key := []byte("secret")
109+
signer, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.HS256, Key: key}, (&jose.SignerOptions{}).WithType("JWT"))
109110
if err != nil {
110-
return ""
111+
panic(err)
111112
}
112-
signer := jose.NewSignerRSA("asdf", *k)
113-
token, terr := jose.NewSignedJWT(claims, signer)
114-
if terr != nil {
115-
return ""
113+
114+
signedToken, err := jwt.Signed(signer).Claims(claims).CompactSerialize()
115+
if err != nil {
116+
panic(err)
116117
}
117-
return token.Encode()
118+
119+
return signedToken
118120
}

‎token/token.go‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ import (
1313
"syscall"
1414
"time"
1515

16-
"github.com/coreos/go-oidc/jose"
1716
"github.com/pkg/errors"
1817
"github.com/rs/zerolog"
18+
"gopkg.in/square/go-jose.v2"
1919

2020
"github.com/cloudflare/cloudflared/config"
2121
"github.com/cloudflare/cloudflared/retry"
@@ -342,7 +342,7 @@ func GetOrgTokenIfExists(authDomain string) (string, error) {
342342
return "", err
343343
}
344344
var payload jwtPayload
345-
err = json.Unmarshal(token.Payload, &payload)
345+
err = json.Unmarshal(token.UnsafePayloadWithoutVerification(), &payload)
346346
if err != nil {
347347
return "", err
348348
}
@@ -351,7 +351,7 @@ func GetOrgTokenIfExists(authDomain string) (string, error) {
351351
err := os.Remove(path)
352352
return "", err
353353
}
354-
return token.Encode(), nil
354+
return token.CompactSerialize()
355355
}
356356

357357
func GetAppTokenIfExists(appInfo *AppInfo) (string, error) {
@@ -364,7 +364,7 @@ func GetAppTokenIfExists(appInfo *AppInfo) (string, error) {
364364
return "", err
365365
}
366366
var payload jwtPayload
367-
err = json.Unmarshal(token.Payload, &payload)
367+
err = json.Unmarshal(token.UnsafePayloadWithoutVerification(), &payload)
368368
if err != nil {
369369
return "", err
370370
}
@@ -373,22 +373,21 @@ func GetAppTokenIfExists(appInfo *AppInfo) (string, error) {
373373
err := os.Remove(path)
374374
return "", err
375375
}
376-
return token.Encode(), nil
376+
return token.CompactSerialize()
377377

378378
}
379379

380380
// GetTokenIfExists will return the token from local storage if it exists and not expired
381-
func getTokenIfExists(path string) (*jose.JWT, error) {
381+
func getTokenIfExists(path string) (*jose.JSONWebSignature, error) {
382382
content, err := ioutil.ReadFile(path)
383383
if err != nil {
384384
return nil, err
385385
}
386-
token, err := jose.ParseJWT(string(content))
386+
token, err := jose.ParseSigned(string(content))
387387
if err != nil {
388388
return nil, err
389389
}
390-
391-
return &token, nil
390+
return token, nil
392391
}
393392

394393
// RemoveTokenIfExists removes the a token from local storage if it exists

0 commit comments

Comments
 (0)