Changes
10 changed files (+190/-251)
-
-
@@ -43,7 +43,7 @@ type WebAuthnCredential struct {Name string LowerName string `xorm:"unique(s)"` UserID int64 `xorm:"INDEX unique(s)"` CredentialID string `xorm:"INDEX"` CredentialID string `xorm:"INDEX VARCHAR(410)"` PublicKey []byte AttestationType string AAGUID []byte
-
-
models/migrations/fixtures/Test_increaseCredentialIDTo410/expected_webauthn_credential.yml > models/migrations/fixtures/Test_remigrateU2FCredentials/expected_webauthn_credential.yml
-
@@ -4,6 +4,9 @@- id: 2 credential_id: "TVHE44TOH7DF7V48SEAIT3EMMJ7TGBOQ289E5AQB34S98LFCUFJ7U2NAVI8RJG6K2F4TC8AQ8KBNO7AGEOQOL9NE43GR63HTEHJSLOG=" - id: 3 credential_id: "TVHE44TOH7DF7V48SEAIT3EMMJ7TGBOQ289E5AQB34S98LFCUFJ7U2NAVI8RJG6K2F4TC8AQ8KBNO7AGEOQOL9NE43GR63HTEHJSLOG=" - id: 4 credential_id: "THIS SHOULD NOT CHAGNGE" credential_id: "TVHE44TOH7DF7V48SEAIT3EMMJ7TGBOQ289E5AQB34S98LFCUFJ7U2NAVI8RJG6K2F4TC8AQ8KBNO7AGEOQOL9NE43GR63HTEHJSLOG="
-
-
models/migrations/fixtures/Test_increaseCredentialIDTo410/u2f_registration.yml > models/migrations/fixtures/Test_remigrateU2FCredentials/u2f_registration.yml
-
models/migrations/fixtures/Test_increaseCredentialIDTo410/webauthn_credential.yml > models/migrations/fixtures/Test_remigrateU2FCredentials/webauthn_credential.yml
-
@@ -23,7 +23,7 @@lower_name: "u2fkey-wrong-user-id" name: "u2fkey-wrong-user-id" user_id: 1 credential_id: "THIS SHOULD NOT CHAGNGE" credential_id: "THIS SHOULD CHANGE" public_key: 0x040d0967a2cad045011631187576492a0beb5b377954b4f694c5afc8bdf25270f87f09a9ab6ce9c282f447ba71b2f2bae2105b32b847e0704f310f48644e3eddf2 attestation_type: 'fido-u2f' sign_count: 1
-
-
-
@@ -367,11 +367,13 @@ var migrations = []Migration{// v206 -> v207 NewMigration("Add authorize column to team_unit table", addAuthorizeColForTeamUnit), // v207 -> v208 NewMigration("Add webauthn table and migrate u2f data to webauthn", addWebAuthnCred), NewMigration("Add webauthn table and migrate u2f data to webauthn - NO-OPED", addWebAuthnCred), // v208 -> v209 NewMigration("Use base32.HexEncoding instead of base64 encoding for cred ID as it is case insensitive", useBase32HexForCredIDInWebAuthnCredential), NewMigration("Use base32.HexEncoding instead of base64 encoding for cred ID as it is case insensitive - NO-OPED", useBase32HexForCredIDInWebAuthnCredential), // v209 -> v210 NewMigration("Increase WebAuthentication CredentialID size to 410", increaseCredentialIDTo410), NewMigration("Increase WebAuthentication CredentialID size to 410 - NO-OPED", increaseCredentialIDTo410), // v210 -> v211 NewMigration("v208 was completely broken - remigrate", remigrateU2FCredentials), } // GetCurrentDBVersion returns the current db version
-
-
-
@@ -5,86 +5,11 @@package migrations import ( "crypto/elliptic" "encoding/base64" "strings" "code.gitea.io/gitea/modules/timeutil" "github.com/tstranex/u2f" "xorm.io/xorm" ) func addWebAuthnCred(x *xorm.Engine) error { // Create webauthnCredential table type webauthnCredential struct { ID int64 `xorm:"pk autoincr"` Name string LowerName string `xorm:"unique(s)"` UserID int64 `xorm:"INDEX unique(s)"` CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety PublicKey []byte AttestationType string AAGUID []byte SignCount uint32 `xorm:"BIGINT"` CloneWarning bool CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"` UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"` } if err := x.Sync2(&webauthnCredential{}); err != nil { return err } // Now migrate the old u2f registrations to the new format type u2fRegistration struct { ID int64 `xorm:"pk autoincr"` Name string UserID int64 `xorm:"INDEX"` Raw []byte Counter uint32 `xorm:"BIGINT"` CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"` UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"` } var start int regs := make([]*u2fRegistration, 0, 50) for { err := x.OrderBy("id").Limit(50, start).Find(®s) if err != nil { return err } for _, reg := range regs { parsed := new(u2f.Registration) err = parsed.UnmarshalBinary(reg.Raw) if err != nil { continue } c := &webauthnCredential{ ID: reg.ID, Name: reg.Name, LowerName: strings.ToLower(reg.Name), UserID: reg.UserID, CredentialID: base64.RawStdEncoding.EncodeToString(parsed.KeyHandle), PublicKey: elliptic.Marshal(elliptic.P256(), parsed.PubKey.X, parsed.PubKey.Y), AttestationType: "fido-u2f", AAGUID: []byte{}, SignCount: reg.Counter, } _, err := x.Insert(c) if err != nil { return err } } if len(regs) < 50 { break } start += 50 regs = regs[:0] } // NO-OP Don't migrate here - let v210 do this. return nil }
-
-
-
@@ -5,46 +5,10 @@package migrations import ( "encoding/base32" "encoding/base64" "xorm.io/xorm" ) func useBase32HexForCredIDInWebAuthnCredential(x *xorm.Engine) error { // Create webauthnCredential table type webauthnCredential struct { ID int64 `xorm:"pk autoincr"` CredentialID string `xorm:"INDEX VARCHAR(410)"` } if err := x.Sync2(&webauthnCredential{}); err != nil { return err } var start int regs := make([]*webauthnCredential, 0, 50) for { err := x.OrderBy("id").Limit(50, start).Find(®s) if err != nil { return err } for _, reg := range regs { credID, _ := base64.RawStdEncoding.DecodeString(reg.CredentialID) reg.CredentialID = base32.HexEncoding.EncodeToString(credID) _, err := x.Update(reg) if err != nil { return err } } if len(regs) < 50 { break } start += 50 regs = regs[:0] } // noop return nil }
-
-
-
@@ -5,140 +5,13 @@package migrations import ( "encoding/base32" "fmt" "strings" "code.gitea.io/gitea/modules/timeutil" "github.com/tstranex/u2f" "xorm.io/xorm" "xorm.io/xorm/schemas" ) func increaseCredentialIDTo410(x *xorm.Engine) error { // Create webauthnCredential table type webauthnCredential struct { ID int64 `xorm:"pk autoincr"` Name string LowerName string `xorm:"unique(s)"` UserID int64 `xorm:"INDEX unique(s)"` CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety PublicKey []byte AttestationType string AAGUID []byte SignCount uint32 `xorm:"BIGINT"` CloneWarning bool CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"` UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"` } if err := x.Sync2(&webauthnCredential{}); err != nil { return err } switch x.Dialect().URI().DBType { case schemas.MYSQL: _, err := x.Exec("ALTER TABLE webauthn_credential MODIFY COLUMN credential_id VARCHAR(410)") if err != nil { return err } case schemas.ORACLE: _, err := x.Exec("ALTER TABLE webauthn_credential MODIFY credential_id VARCHAR(410)") if err != nil { return err } case schemas.MSSQL: // This column has an index on it. I could write all of the code to attempt to change the index OR // I could just use recreate table. sess := x.NewSession() if err := sess.Begin(); err != nil { _ = sess.Close() return err } if err := recreateTable(sess, new(webauthnCredential)); err != nil { _ = sess.Close() return err } if err := sess.Commit(); err != nil { _ = sess.Close() return err } if err := sess.Close(); err != nil { return err } case schemas.POSTGRES: _, err := x.Exec("ALTER TABLE webauthn_credential ALTER COLUMN credential_id TYPE VARCHAR(410)") if err != nil { return err } default: // SQLite doesn't support ALTER COLUMN, and it already makes String _TEXT_ by default so no migration needed // nor is there any need to re-migrate return nil } exist, err := x.IsTableExist("u2f_registration") if err != nil { return err } if !exist { return nil } // Now migrate the old u2f registrations to the new format type u2fRegistration struct { ID int64 `xorm:"pk autoincr"` Name string UserID int64 `xorm:"INDEX"` Raw []byte Counter uint32 `xorm:"BIGINT"` CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"` UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"` } var start int regs := make([]*u2fRegistration, 0, 50) for { err := x.OrderBy("id").Limit(50, start).Find(®s) if err != nil { return err } for _, reg := range regs { parsed := new(u2f.Registration) err = parsed.UnmarshalBinary(reg.Raw) if err != nil { continue } cred := &webauthnCredential{} has, err := x.ID(reg.ID).Where("id = ? AND user_id = ?", reg.ID, reg.UserID).Get(cred) if err != nil { return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %v", reg.ID, err) } if !has { continue } remigratedCredID := base32.HexEncoding.EncodeToString(parsed.KeyHandle) if cred.CredentialID == remigratedCredID || (!strings.HasPrefix(remigratedCredID, cred.CredentialID) && cred.CredentialID != "") { continue } cred.CredentialID = remigratedCredID _, err = x.ID(cred.ID).Update(cred) if err != nil { return err } } if len(regs) < 50 { break } start += 50 regs = regs[:0] } // no-op // v208 was completely wrong // So now we have to no-op again. return nil }
-
-
-
@@ -0,0 +1,172 @@// Copyright 2022 The Gitea Authors. All rights reserved. // Use of this source code is governed by a MIT-style // license that can be found in the LICENSE file. package migrations import ( "crypto/elliptic" "encoding/base32" "fmt" "strings" "code.gitea.io/gitea/modules/timeutil" "github.com/tstranex/u2f" "xorm.io/xorm" "xorm.io/xorm/schemas" ) // v208 migration was completely broken func remigrateU2FCredentials(x *xorm.Engine) error { // Create webauthnCredential table type webauthnCredential struct { ID int64 `xorm:"pk autoincr"` Name string LowerName string `xorm:"unique(s)"` UserID int64 `xorm:"INDEX unique(s)"` CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety PublicKey []byte AttestationType string AAGUID []byte SignCount uint32 `xorm:"BIGINT"` CloneWarning bool CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"` UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"` } if err := x.Sync2(&webauthnCredential{}); err != nil { return err } switch x.Dialect().URI().DBType { case schemas.MYSQL: _, err := x.Exec("ALTER TABLE webauthn_credential MODIFY COLUMN credential_id VARCHAR(410)") if err != nil { return err } case schemas.ORACLE: _, err := x.Exec("ALTER TABLE webauthn_credential MODIFY credential_id VARCHAR(410)") if err != nil { return err } case schemas.MSSQL: // This column has an index on it. I could write all of the code to attempt to change the index OR // I could just use recreate table. sess := x.NewSession() if err := sess.Begin(); err != nil { _ = sess.Close() return err } if err := recreateTable(sess, new(webauthnCredential)); err != nil { _ = sess.Close() return err } if err := sess.Commit(); err != nil { _ = sess.Close() return err } if err := sess.Close(); err != nil { return err } case schemas.POSTGRES: _, err := x.Exec("ALTER TABLE webauthn_credential ALTER COLUMN credential_id TYPE VARCHAR(410)") if err != nil { return err } default: // SQLite doesn't support ALTER COLUMN, and it already makes String _TEXT_ by default so no migration needed // nor is there any need to re-migrate } exist, err := x.IsTableExist("u2f_registration") if err != nil { return err } if !exist { return nil } // Now migrate the old u2f registrations to the new format type u2fRegistration struct { ID int64 `xorm:"pk autoincr"` Name string UserID int64 `xorm:"INDEX"` Raw []byte Counter uint32 `xorm:"BIGINT"` CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"` UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"` } var start int regs := make([]*u2fRegistration, 0, 50) for { err := x.OrderBy("id").Limit(50, start).Find(®s) if err != nil { return err } err = func() error { sess := x.NewSession() defer sess.Close() if err := sess.Begin(); err != nil { return fmt.Errorf("unable to allow start session. Error: %w", err) } if x.Dialect().URI().DBType == schemas.MSSQL { if _, err := sess.Exec("SET IDENTITY_INSERT `webauthn_credential` ON"); err != nil { return fmt.Errorf("unable to allow identity insert on webauthn_credential. Error: %w", err) } } for _, reg := range regs { parsed := new(u2f.Registration) err = parsed.UnmarshalBinary(reg.Raw) if err != nil { continue } remigrated := &webauthnCredential{ ID: reg.ID, Name: reg.Name, LowerName: strings.ToLower(reg.Name), UserID: reg.UserID, CredentialID: base32.HexEncoding.EncodeToString(parsed.KeyHandle), PublicKey: elliptic.Marshal(elliptic.P256(), parsed.PubKey.X, parsed.PubKey.Y), AttestationType: "fido-u2f", AAGUID: []byte{}, SignCount: reg.Counter, UpdatedUnix: reg.UpdatedUnix, CreatedUnix: reg.CreatedUnix, } has, err := sess.ID(reg.ID).Where("id = ?", reg.ID).Get(new(webauthnCredential)) if err != nil { return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %w", reg.ID, err) } if !has { _, err = sess.Insert(remigrated) if err != nil { return fmt.Errorf("unable to (re)insert webauthn_credential[%d]. Error: %w", reg.ID, err) } continue } _, err = sess.ID(remigrated.ID).AllCols().Update(remigrated) if err != nil { return fmt.Errorf("unable to update webauthn_credential[%d]. Error: %w", reg.ID, err) } } return sess.Commit() }() if err != nil { return err } if len(regs) < 50 { break } start += 50 regs = regs[:0] } return nil }
-
-
-
@@ -12,7 +12,7 @@ import ("xorm.io/xorm/schemas" ) func Test_increaseCredentialIDTo410(t *testing.T) { func Test_remigrateU2FCredentials(t *testing.T) { // Create webauthnCredential table type WebauthnCredential struct { ID int64 `xorm:"pk autoincr"`
-
@@ -55,7 +55,7 @@ func Test_increaseCredentialIDTo410(t *testing.T) {} // Run the migration if err := increaseCredentialIDTo410(x); err != nil { if err := remigrateU2FCredentials(x); err != nil { assert.NoError(t, err) return }
-