dark/zerotiertspu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix hash verification on refresh

Browse source
This commit is contained in:
Grant Limberg 2021-12-16 19:49:15 -08:00
parent 8fccf3136c
commit a69e91c541
No known key found for this signature in database
GPG key ID: 2BA62CCABBB4095A
1 changed files with 115 additions and 85 deletions
Download patch file Download diff file Expand all files Collapse all files

64
zeroidc/src/lib.rs
View file

@ -159,6 +159,10 @@ impl ZeroIDC {
(*inner_local.lock().unwrap()).running = true; (*inner_local.lock().unwrap()).running = true;
let mut running = true; let mut running = true;
// Keep a copy of the initial nonce used to get the tokens
// Will be needed later when verifying the responses from refresh tokens
let nonce = (*inner_local.lock().unwrap()).nonce.clone();
while running { while running {
let exp = UNIX_EPOCH + Duration::from_secs((*inner_local.lock().unwrap()).exp_time); let exp = UNIX_EPOCH + Duration::from_secs((*inner_local.lock().unwrap()).exp_time);
let now = SystemTime::now(); let now = SystemTime::now();
@ -169,38 +173,47 @@ impl ZeroIDC {
let refresh_token = (*inner_local.lock().unwrap()).refresh_token.clone(); let refresh_token = (*inner_local.lock().unwrap()).refresh_token.clone();
if let Some(refresh_token) = refresh_token { if let Some(refresh_token) = refresh_token {
if now >= (exp - Duration::from_secs(30)) { if now >= (exp - Duration::from_secs(30)) {
let nonce = (*inner_local.lock().unwrap()).nonce.clone();
let token_response = (*inner_local.lock().unwrap()).oidc_client.as_ref().map(|c| { let token_response = (*inner_local.lock().unwrap()).oidc_client.as_ref().map(|c| {
let res = c.exchange_refresh_token(&refresh_token) let res = c.exchange_refresh_token(&refresh_token)
.request(http_client); .request(http_client);
res
});
if let Some(res) = token_response {
match res { match res {
Ok(res) => { Ok(res) => {
let n = match nonce {
let n = match nonce.clone() {
Some(n) => n, Some(n) => n,
None => { None => {
return None; println!("err: no nonce");
continue;
} }
}; };
let id = match res.id_token() { let id = match res.id_token() {
Some(t) => t, Some(t) => t,
None => { None => {
return None; println!("err: no id_token");
continue;
} }
}; };
let verified = (*inner_local.lock().unwrap()).oidc_client.as_ref().map(|c| {
let claims = match id.claims(&c.id_token_verifier(), &n) { let claims = match id.claims(&c.id_token_verifier(), &n) {
Ok(c) => c, Ok(c) => c,
Err(_e) => { Err(e) => {
return None; println!("claims err: {}", e);
return false;
} }
}; };
let signing_algo = match id.signing_alg() { let signing_algo = match id.signing_alg() {
Ok(s) => s, Ok(s) => s,
Err(_) => { Err(e) => {
return None; println!("alg err: {}", e);
return false;
} }
}; };
@ -209,24 +222,34 @@ impl ZeroIDC {
Ok(h) => h, Ok(h) => h,
Err(e) => { Err(e) => {
println!("Error hashing access token: {}", e); println!("Error hashing access token: {}", e);
return None; return false;
} }
}; };
if actual_hash != *expected_hash { if actual_hash != *expected_hash {
println!("token hash error"); println!("token hash error");
return None; return false;
} }
} }
return Some(res); return true;
},
Err(_e) => {
return None;
}
};
}); });
if let Some(Some(res)) = token_response{ match verified {
Some(verified) => {
if !verified {
println!("not verified.");
(*inner_local.lock().unwrap()).running = false;
break;
}
},
None => {
println!("no verification performed?");
(*inner_local.lock().unwrap()).running = false;
break;
}
}
match res.id_token() { match res.id_token() {
Some(id_token) => { Some(id_token) => {
let params = [("id_token", id_token.to_string()),("state", "refresh".to_string())]; let params = [("id_token", id_token.to_string()),("state", "refresh".to_string())];
@ -284,6 +307,13 @@ impl ZeroIDC {
println!("no id token?!?"); println!("no id token?!?");
} }
} }
},
Err(e) => {
println!("token error: {}", e);
}
}
} else {
println!("token response??");
} }
} else { } else {
println!("waiting to refresh"); println!("waiting to refresh");