Proxmox/proxmox-perl-rs
5
0
Fork 1
Code Pull Requests Releases Activity

pve-rs/tfa: ignore and discard incomplete u2f entries

Browse Source 
it can happen that we have leftover entries with non-completed challenges.
since a user cannot continue here in a sensible way, ignore and discard
them

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
This commit is contained in:
Dominik Csapak 2021-11-12 09:58:14 +01:00 committed by Wolfgang Bumiller
parent 515d6a81d8
commit dfbbed5d87
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
pve-rs/src/tfa/mod.rs
View File

@ -490,10 +490,13 @@ fn decode_old_entry(ty: &[u8], data: &[u8], user: &str) -> Result<TfaUserData, E
.map_err(|err| format_err!("failed to parse json data in tfa entry - {}", err))?; .map_err(|err| format_err!("failed to parse json data in tfa entry - {}", err))?;
match ty { match ty {
b"u2f" => user_data.u2f.push(proxmox_tfa_api::TfaEntry::from_parts( b"u2f" => {
info, if let Some(entry) = decode_old_u2f_entry(value)? {
decode_old_u2f_entry(value)?, user_data
)), .u2f
.push(proxmox_tfa_api::TfaEntry::from_parts(info, entry))
}
}
b"oath" => user_data.totp.extend( b"oath" => user_data.totp.extend(
decode_old_oath_entry(value, user)? decode_old_oath_entry(value, user)?
.into_iter() .into_iter()
@ -513,12 +516,17 @@ fn decode_old_entry(ty: &[u8], data: &[u8], user: &str) -> Result<TfaUserData, E
Ok(user_data) Ok(user_data)
} }
fn decode_old_u2f_entry(data: JsonValue) -> Result<proxmox_tfa::u2f::Registration, Error> { fn decode_old_u2f_entry(data: JsonValue) -> Result<Option<proxmox_tfa::u2f::Registration>, Error> {
let mut obj = match data { let mut obj = match data {
JsonValue::Object(obj) => obj, JsonValue::Object(obj) => obj,
_ => bail!("bad json type for u2f registration"), _ => bail!("bad json type for u2f registration"),
}; };
// discard old partial u2f registrations
if obj.get("challenge").is_some() {
return Ok(None);
}
let reg = proxmox_tfa::u2f::Registration { let reg = proxmox_tfa::u2f::Registration {
key: proxmox_tfa::u2f::RegisteredKey { key: proxmox_tfa::u2f::RegisteredKey {
key_handle: base64::decode_config( key_handle: base64::decode_config(
@ -538,7 +546,7 @@ fn decode_old_u2f_entry(data: JsonValue) -> Result<proxmox_tfa::u2f::Registratio
bail!("invalid extra data in u2f entry"); bail!("invalid extra data in u2f entry");
} }
Ok(reg) Ok(Some(reg))
} }
fn decode_old_oath_entry( fn decode_old_oath_entry(