commit 495f292a0c542337cff6c44d7b5d26103cb849cc
parent 67690d4577f9f6c31f1350b27904d22682c77fcd
Author: Bohdan Potuzhnyi <potub1@bfh.ch>
Date: Sat, 14 Sep 2024 18:39:29 +0000
changed usage of the authorize_start_pkce to authorize_start
Diffstat:
8 files changed, 31 insertions(+), 259 deletions(-)
diff --git a/src/challenger/challenger-httpd_authorize.c b/src/challenger/challenger-httpd_authorize.c
@@ -158,32 +158,8 @@ CH_handler_authorize (struct CH_HandlerContext *hc,
code_challenge_method = "plain";
}
- /* Note: this is a somewhat arbitrary restriction, as the rest of
- this code would support other schemas just fine. However, #7838
- (RFC 7636) should be implemented before lifting this restriction,
- as otherwise the service might be accidentally used with public
- clients which would then be insecure. */
- /*
- if ( (NULL != redirect_uri) &&
- (0 != strncmp (redirect_uri,
- "http://",
- strlen ("http://"))) &&
- (0 != strncmp (redirect_uri,
- "https://",
- strlen ("https://"))) )
- {
- GNUNET_break_op (0);
- return reply_error (
- hc,
- "invalid-request",
- MHD_HTTP_BAD_REQUEST,
- TALER_EC_GENERIC_PARAMETER_MALFORMED,
- "redirect_uri (has to start with 'http://' or 'https://')");
- }
- */
-
/**
- * Replacement of previous safe check to not allow public without s256 code_challenge
+ * Safe check to not allow public clients without s256 code_challenge
*/
if ( (NULL != redirect_uri) &&
(0 != strncmp (redirect_uri,
@@ -226,7 +202,7 @@ CH_handler_authorize (struct CH_HandlerContext *hc,
/* authorize_start will return 0 if a 'redirect_uri' was
configured for the client and this one differs. */
- qs = CH_db->authorize_start_pkce (CH_db->cls,
+ qs = CH_db->authorize_start (CH_db->cls,
&nonce,
client_id,
scope,
@@ -249,7 +225,7 @@ CH_handler_authorize (struct CH_HandlerContext *hc,
"internal-error",
MHD_HTTP_INTERNAL_SERVER_ERROR,
TALER_EC_GENERIC_DB_STORE_FAILED,
- "authorize_start_pkce");
+ "authorize_start");
case GNUNET_DB_STATUS_SOFT_ERROR:
GNUNET_break (0);
return MHD_NO;
diff --git a/src/challengerdb/Makefile.am b/src/challengerdb/Makefile.am
@@ -81,7 +81,6 @@ libchallenger_plugin_db_postgres_la_SOURCES = \
pg_token_add_token.h pg_token_add_token.c \
pg_setup_nonce.h pg_setup_nonce.c \
pg_authorize_start.h pg_authorize_start.c \
- pg_authorize_start_pkce.h pg_authorize_start_pkce.c \
pg_challenge_set_address_and_pin.h pg_challenge_set_address_and_pin.c \
pg_validate_solve_pin.h pg_validate_solve_pin.c \
pg_validation_get.h pg_validation_get.c \
diff --git a/src/challengerdb/pg_authorize_start.c b/src/challengerdb/pg_authorize_start.c
@@ -16,7 +16,8 @@
/**
* @file challengerdb/pg_authorize_start.c
* @brief Implementation of the authorize_start function for Postgres
- * @author Christian Grothoff
+ * @author Bohdan Potuzhnyi
+ * @author Vlada Svirsh
*/
#include "platform.h"
#include <taler/taler_error_codes.h>
@@ -33,6 +34,8 @@ CH_PG_authorize_start (void *cls,
const char *client_scope,
const char *client_state,
const char *client_redirect_uri,
+ const char *code_challenge,
+ const char *code_challenge_method,
json_t **last_address,
uint32_t *address_attempts_left,
uint32_t *pin_transmissions_left,
@@ -51,6 +54,12 @@ CH_PG_authorize_start (void *cls,
NULL != client_redirect_uri
? GNUNET_PQ_query_param_string (client_redirect_uri)
: GNUNET_PQ_query_param_null (),
+ NULL != code_challenge
+ ? GNUNET_PQ_query_param_string (code_challenge)
+ : GNUNET_PQ_query_param_null (),
+ NULL != code_challenge_method
+ ? GNUNET_PQ_query_param_string (code_challenge_method)
+ : GNUNET_PQ_query_param_null (),
GNUNET_PQ_query_param_end
};
struct GNUNET_PQ_ResultSpec rs[] = {
@@ -78,6 +87,8 @@ CH_PG_authorize_start (void *cls,
" client_scope=$3"
" ,client_state=$4"
" ,client_redirect_uri=$5::VARCHAR"
+ " ,code_challenge=$6"
+ " ,code_challenge_method=$7"
" WHERE nonce=$1"
" AND client_serial_id=$2"
" AND ($5::VARCHAR=COALESCE(client_redirect_uri,$5::VARCHAR))"
diff --git a/src/challengerdb/pg_authorize_start.h b/src/challengerdb/pg_authorize_start.h
@@ -16,7 +16,8 @@
/**
* @file challengerdb/pg_authorize_start.h
* @brief implementation of the authorize_start function for Postgres
- * @author Christian Grothoff
+ * @author Bohdan Potuzhnyi
+ * @author Vlada Svirsh
*/
#ifndef PG_LOGIN_START_H
#define PG_LOGIN_START_H
@@ -38,6 +39,8 @@
* @param client_scope scope of the validation
* @param client_state state of the client
* @param client_redirect_uri where to redirect at the end, NULL to use a unique one registered for the client
+ * @param code_challenge PKCE code challenge
+ * @param code_challenge_method PKCE code challenge method
* @param[out] last_address set to the last address used
* @param[out] address_attempts_left set to number of address changing attempts left for this address
* @param[out] pin_transmissions_left set to number of times the PIN can still be re-requested
@@ -56,6 +59,8 @@ CH_PG_authorize_start (void *cls,
const char *client_scope,
const char *client_state,
const char *client_redirect_uri,
+ const char *code_challenge,
+ const char *code_challenge_method,
json_t **last_address,
uint32_t *address_attempts_left,
uint32_t *pin_transmissions_left,
diff --git a/src/challengerdb/pg_authorize_start_pkce.c b/src/challengerdb/pg_authorize_start_pkce.c
@@ -1,106 +0,0 @@
-/*
- This file is part of Challenger
- Copyright (C) 2023 Taler Systems SA
-
- Challenger is free software; you can redistribute it and/or modify it under the
- terms of the GNU General Public License as published by the Free Software
- Foundation; either version 3, or (at your option) any later version.
-
- Challenger is distributed in the hope that it will be useful, but WITHOUT ANY
- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
- A PARTICULAR PURPOSE. See the GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License along with
- Challenger; see the file COPYING. If not, see <http://www.gnu.org/licenses/>
- */
-/**
- * @file challengerdb/pg_authorize_start_pkce.c
- * @brief Implementation of the authorize_start_pkce function for Postgres
- * @author Bohdan Potuzhnyi
- * @author Vlada Svirsh
- */
-#include "platform.h"
-#include <taler/taler_error_codes.h>
-#include <taler/taler_dbevents.h>
-#include <taler/taler_pq_lib.h>
-#include "pg_authorize_start_pkce.h"
-#include "pg_helper.h"
-
-
-enum GNUNET_DB_QueryStatus
-CH_PG_authorize_start_pkce (void *cls,
- const struct CHALLENGER_ValidationNonceP *nonce,
- uint64_t client_id,
- const char *client_scope,
- const char *client_state,
- const char *client_redirect_uri,
- const char *code_challenge,
- const char *code_challenge_method,
- json_t **last_address,
- uint32_t *address_attempts_left,
- uint32_t *pin_transmissions_left,
- uint32_t *auth_attempts_left,
- bool *solved,
- struct GNUNET_TIME_Absolute *last_tx_time)
-{
- struct PostgresClosure *pg = cls;
- struct GNUNET_PQ_QueryParam params[] = {
- GNUNET_PQ_query_param_auto_from_type (nonce),
- GNUNET_PQ_query_param_uint64 (&client_id),
- NULL != client_scope
- ? GNUNET_PQ_query_param_string (client_scope)
- : GNUNET_PQ_query_param_null (),
- GNUNET_PQ_query_param_string (client_state),
- NULL != client_redirect_uri
- ? GNUNET_PQ_query_param_string (client_redirect_uri)
- : GNUNET_PQ_query_param_null (),
- NULL != code_challenge
- ? GNUNET_PQ_query_param_string (code_challenge)
- : GNUNET_PQ_query_param_null (),
- NULL != code_challenge_method
- ? GNUNET_PQ_query_param_string (code_challenge_method)
- : GNUNET_PQ_query_param_null (),
- GNUNET_PQ_query_param_end
- };
- struct GNUNET_PQ_ResultSpec rs[] = {
- GNUNET_PQ_result_spec_allow_null (
- TALER_PQ_result_spec_json ("address",
- last_address),
- NULL),
- GNUNET_PQ_result_spec_uint32 ("address_attempts_left",
- address_attempts_left),
- GNUNET_PQ_result_spec_uint32 ("pin_transmissions_left",
- pin_transmissions_left),
- GNUNET_PQ_result_spec_uint32 ("auth_attempts_left",
- auth_attempts_left),
- GNUNET_PQ_result_spec_bool ("solved",
- solved),
- GNUNET_PQ_result_spec_absolute_time ("last_tx_time",
- last_tx_time),
- GNUNET_PQ_result_spec_end
- };
-
- *last_address = NULL;
- PREPARE (pg,
- "authorize_start_validation_pkce",
- "UPDATE validations SET"
- " client_scope=$3"
- " ,client_state=$4"
- " ,client_redirect_uri=$5::VARCHAR"
- " ,code_challenge=$6"
- " ,code_challenge_method=$7"
- " WHERE nonce=$1"
- " AND client_serial_id=$2"
- " AND ($5::VARCHAR=COALESCE(client_redirect_uri,$5::VARCHAR))"
- " RETURNING"
- " address"
- " ,address_attempts_left"
- " ,pin_transmissions_left"
- " ,GREATEST(0, auth_attempts_left) AS auth_attempts_left"
- " ,auth_attempts_left = -1 AS solved"
- " ,last_tx_time;");
- return GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
- "authorize_start_validation_pkce",
- params,
- rs);
-}
diff --git a/src/challengerdb/pg_authorize_start_pkce.h b/src/challengerdb/pg_authorize_start_pkce.h
@@ -1,72 +0,0 @@
-/*
- This file is part of Challenger
- Copyright (C) 2023 Taler Systems SA
-
- Challenger is free software; you can redistribute it and/or modify it under the
- terms of the GNU General Public License as published by the Free Software
- Foundation; either version 3, or (at your option) any later version.
-
- Challenger is distributed in the hope that it will be useful, but WITHOUT ANY
- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
- A PARTICULAR PURPOSE. See the GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License along with
- Challenger; see the file COPYING. If not, see <http://www.gnu.org/licenses/>
- */
-/**
- * @file challengerdb/pg_authorize_start_pkce.h
- * @brief implementation of the authorize_start_pkce function for Postgres
- * @author Bohdan Potuzhnyi
- * @author Vlada Svirsh
- */
-#ifndef PG_LOGIN_START_PKCE_H
-#define PG_LOGIN_START_PKCE_H
-
-#include <taler/taler_util.h>
-#include <taler/taler_json_lib.h>
-#include "challenger_database_plugin.h"
-
-
-/**
- * Set the user-provided address in a validation process. Updates
- * the address and decrements the "addresses left" counter. If the
- * address did not change, the operation is successful even without
- * the counter change.
- *
- * @param cls
- * @param nonce unique nonce to use to identify the validation
- * @param client_id client that initiated the validation
- * @param client_scope scope of the validation
- * @param client_state state of the client
- * @param client_redirect_uri where to redirect at the end, NULL to use a unique one registered for the client
- * @param code_challenge PKCE code challenge
- * @param code_challenge_method PKCE code challenge method
- * @param[out] last_address set to the last address used
- * @param[out] address_attempts_left set to number of address changing attempts left for this address
- * @param[out] pin_transmissions_left set to number of times the PIN can still be re-requested
- * @param[out] auth_attempts_left set to number of authentication attempts remaining
- * @param[out] solved set to true if the challenge is already solved
- * @param[out] last_tx_time set to the last time when we (presumably) send a PIN to @a last_address; 0 if never sent
- * @return transaction status:
- * #GNUNET_DB_STATUS_SUCCESS_ONE_RESULT if the address was changed
- * #GNUNET_DB_STATUS_SUCCESS_NO_RESULTS if we do not permit further changes to the address (attempts exhausted)
- * #GNUNET_DB_STATUS_HARD_ERROR on failure
- */
-enum GNUNET_DB_QueryStatus
-CH_PG_authorize_start_pkce (void *cls,
- const struct CHALLENGER_ValidationNonceP *nonce,
- uint64_t client_id,
- const char *client_scope,
- const char *client_state,
- const char *client_redirect_uri,
- const char *code_challenge,
- const char *code_challenge_method,
- json_t **last_address,
- uint32_t *address_attempts_left,
- uint32_t *pin_transmissions_left,
- uint32_t *auth_attempts_left,
- bool *solved,
- struct GNUNET_TIME_Absolute *last_tx_time);
-
-
-#endif
diff --git a/src/challengerdb/plugin_challengerdb_postgres.c b/src/challengerdb/plugin_challengerdb_postgres.c
@@ -34,7 +34,6 @@
#include "pg_client_check.h"
#include "pg_setup_nonce.h"
#include "pg_authorize_start.h"
-#include "pg_authorize_start_pkce.h"
#include "pg_challenge_set_address_and_pin.h"
#include "pg_validate_solve_pin.h"
#include "pg_validation_get.h"
@@ -407,8 +406,6 @@ libchallenger_plugin_db_postgres_init (void *cls)
= &CH_PG_setup_nonce;
plugin->authorize_start
= &CH_PG_authorize_start;
- plugin->authorize_start_pkce
- = &CH_PG_authorize_start_pkce;
plugin->challenge_set_address_and_pin
= &CH_PG_challenge_set_address_and_pin;
plugin->validate_solve_pin
diff --git a/src/include/challenger_database_plugin.h b/src/include/challenger_database_plugin.h
@@ -234,8 +234,8 @@ struct CHALLENGER_DatabasePlugin
/**
- * Set the user-provided address in a validation process. Updates
- * the address and decrements the "addresses left" counter. If the
+ * Set the user-provided address and PKCE parameters in a validation process.
+ * Updates the address and decrements the "addresses left" counter. If the
* address did not change, the operation is successful even without
* the counter change.
*
@@ -245,8 +245,10 @@ struct CHALLENGER_DatabasePlugin
* @param client_scope scope of the validation
* @param client_state state of the client
* @param client_redirect_uri where to redirect at the end, NULL to use a unique one registered for the client
+ * @param code_challenge PKCE code challenge
+ * @param code_challenge_method PKCE code challenge method
* @param[out] last_address set to the last address used
- * @param[out] address_attempts_left set to number change address operations left for this @a nonce
+ * @param[out] address_attempts_left set to number of address changing attempts left for this address
* @param[out] pin_transmissions_left set to number of times the PIN can still be re-requested
* @param[out] auth_attempts_left set to number of authentication attempts remaining
* @param[out] solved set to true if the challenge is already solved
@@ -257,12 +259,14 @@ struct CHALLENGER_DatabasePlugin
* #GNUNET_DB_STATUS_HARD_ERROR on failure
*/
enum GNUNET_DB_QueryStatus
- (*authorize_start)(void *cls,
+ (*authorize_start)(void *cls,
const struct CHALLENGER_ValidationNonceP *nonce,
uint64_t client_id,
const char *client_scope,
const char *client_state,
const char *client_redirect_uri,
+ const char *code_challenge,
+ const char *code_challenge_method,
json_t **last_address,
uint32_t *address_attempts_left,
uint32_t *pin_transmissions_left,
@@ -270,48 +274,6 @@ struct CHALLENGER_DatabasePlugin
bool *solved,
struct GNUNET_TIME_Absolute *last_tx_time);
-
- /**
- * Set the user-provided address and PKCE parameters in a validation process.
- * Updates the address and decrements the "addresses left" counter. If the
- * address did not change, the operation is successful even without
- * the counter change.
- *
- * @param cls
- * @param nonce unique nonce to use to identify the validation
- * @param client_id client that initiated the validation
- * @param client_scope scope of the validation
- * @param client_state state of the client
- * @param client_redirect_uri where to redirect at the end, NULL to use a unique one registered for the client
- * @param code_challenge PKCE code challenge
- * @param code_challenge_method PKCE code challenge method
- * @param[out] last_address set to the last address used
- * @param[out] address_attempts_left set to number of address changing attempts left for this address
- * @param[out] pin_transmissions_left set to number of times the PIN can still be re-requested
- * @param[out] auth_attempts_left set to number of authentication attempts remaining
- * @param[out] solved set to true if the challenge is already solved
- * @param[out] last_tx_time set to the last time when we (presumably) send a PIN to @a last_address; 0 if never sent
- * @return transaction status:
- * #GNUNET_DB_STATUS_SUCCESS_ONE_RESULT if the address was changed
- * #GNUNET_DB_STATUS_SUCCESS_NO_RESULTS if we do not permit further changes to the address (attempts exhausted)
- * #GNUNET_DB_STATUS_HARD_ERROR on failure
- */
- enum GNUNET_DB_QueryStatus
- (*authorize_start_pkce)(void *cls,
- const struct CHALLENGER_ValidationNonceP *nonce,
- uint64_t client_id,
- const char *client_scope,
- const char *client_state,
- const char *client_redirect_uri,
- const char *code_challenge,
- const char *code_challenge_method,
- json_t **last_address,
- uint32_t *address_attempts_left,
- uint32_t *pin_transmissions_left,
- uint32_t *auth_attempts_left,
- bool *solved,
- struct GNUNET_TIME_Absolute *last_tx_time);
-
/**
* Set the user-provided address in a validation process. Updates
* the address and decrements the "addresses left" counter. If the
@@ -410,7 +372,7 @@ struct CHALLENGER_DatabasePlugin
char **client_state,
char **client_redirect_uri);
-
+
/**
* Return validation details including PKCE parameters. Used by `/solve`, `/auth`, and
* `/info` endpoints to authorize and return validated user address to the client.
@@ -430,7 +392,7 @@ struct CHALLENGER_DatabasePlugin
* #GNUNET_DB_STATUS_HARD_ERROR on failure
*/
enum GNUNET_DB_QueryStatus
- (*validation_get_pkce)(void *cls,
+ (*validation_get_pkce)(void *cls,
const struct CHALLENGER_ValidationNonceP *nonce,
char **client_secret,
json_t **address,
