Skip to content

Commit

Permalink
Merge pull request #2124 from smallstep/mariano/payloadformat
Browse files Browse the repository at this point in the history
Add attestation format to challenge
  • Loading branch information
maraino authored Dec 30, 2024
2 parents 143e484 + ba9e082 commit 3f9dc06
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 0 deletions.
2 changes: 2 additions & 0 deletions acme/challenge.go
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,7 @@ type Challenge struct {
Target string `json:"target,omitempty"`
Error *Error `json:"error,omitempty"`
Payload []byte `json:"-"`
PayloadFormat string `json:"-"`
}

// ToLog enables response logging.
Expand Down Expand Up @@ -944,6 +945,7 @@ func deviceAttest01Validate(ctx context.Context, ch *Challenge, db DB, jwk *jose
ch.Error = nil
ch.ValidatedAt = clock.Now().Format(time.RFC3339)
ch.Payload = payload
ch.PayloadFormat = format

// Store the fingerprint in the authorization.
//
Expand Down
19 changes: 19 additions & 0 deletions acme/challenge_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,8 @@ func mustAttestApple(t *testing.T, nonce string) ([]byte, *x509.Certificate, *x5
}

func mustAttestYubikey(t *testing.T, _, keyAuthorization string, serial int) ([]byte, *x509.Certificate, *x509.Certificate) {
t.Helper()

ca, err := minica.New()
fatalError(t, err)

Expand Down Expand Up @@ -821,6 +823,7 @@ MCowBQYDK2VwAyEA5c+4NKZSNQcR1T8qN6SjwgdPZQ0Ge12Ylx/YeGAJ35k=
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewError(ErrorRejectedIdentifierType, "payload contained error: an error")

Expand Down Expand Up @@ -873,6 +876,7 @@ MCowBQYDK2VwAyEA5c+4NKZSNQcR1T8qN6SjwgdPZQ0Ge12Ylx/YeGAJ35k=
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "1234", updch.Value)
assert.Equal(t, payload, updch.Payload)
assert.Equal(t, "step", updch.PayloadFormat)

return nil
},
Expand Down Expand Up @@ -4007,6 +4011,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewError(ErrorRejectedIdentifierType, "payload contained error: an error")

Expand Down Expand Up @@ -4046,6 +4051,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "failed base64 decoding attObj %q", "?!")

Expand Down Expand Up @@ -4085,6 +4091,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "attObj must not be empty")

Expand Down Expand Up @@ -4124,6 +4131,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "attObj must not be empty")

Expand Down Expand Up @@ -4163,6 +4171,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "attObj is not well formed CBOR: unexpected EOF")

Expand Down Expand Up @@ -4204,6 +4213,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "unsupported attestation object format %q", "unsupported-format")

Expand Down Expand Up @@ -4250,6 +4260,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewError(ErrorBadAttestationStatementType, "attestation format %q is not enabled", "step")

Expand Down Expand Up @@ -4306,6 +4317,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "x5c not present")

Expand Down Expand Up @@ -4354,6 +4366,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "serial-number", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "challenge token does not match")

Expand Down Expand Up @@ -4401,6 +4414,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "non-matching-value", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

subproblem := NewSubproblemWithIdentifier(
ErrorRejectedIdentifierType,
Expand Down Expand Up @@ -4480,6 +4494,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "x5c not present")

Expand Down Expand Up @@ -4535,6 +4550,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "permanent identifier does not match").
AddSubproblems(NewSubproblemWithIdentifier(
Expand Down Expand Up @@ -4631,6 +4647,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, `unsupported attestation object format "bogus-format"`)

Expand Down Expand Up @@ -4724,6 +4741,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Equal(t, payload, updch.Payload)
assert.Equal(t, "step", updch.PayloadFormat)

return errors.New("force")
},
Expand Down Expand Up @@ -4771,6 +4789,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Equal(t, payload, updch.Payload)
assert.Equal(t, "step", updch.PayloadFormat)

return nil
},
Expand Down

0 comments on commit 3f9dc06

Please sign in to comment.