Skip to content

Commit

Permalink
Add attestation format to challenge
Browse files Browse the repository at this point in the history 
This commit adds the format of the payload to the challenge object.
  • Loading branch information
@maraino
maraino committed Dec 30, 2024
1 parent 143e484 commit ba9e082
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 0 deletions.
2 changes: 2 additions & 0 deletions acme/challenge.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,7 @@ type Challenge struct {
Target string `json:"target,omitempty"`
Error *Error `json:"error,omitempty"`
Payload []byte `json:"-"`
PayloadFormat string `json:"-"`
}

// ToLog enables response logging.
Expand Down Expand Up @@ -944,6 +945,7 @@ func deviceAttest01Validate(ctx context.Context, ch *Challenge, db DB, jwk *jose
ch.Error = nil
ch.ValidatedAt = clock.Now().Format(time.RFC3339)
ch.Payload = payload
ch.PayloadFormat = format

// Store the fingerprint in the authorization.
//
Expand Down
19 changes: 19 additions & 0 deletions acme/challenge_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,8 @@ func mustAttestApple(t *testing.T, nonce string) ([]byte, *x509.Certificate, *x5
}

func mustAttestYubikey(t *testing.T, _, keyAuthorization string, serial int) ([]byte, *x509.Certificate, *x509.Certificate) {
t.Helper()

ca, err := minica.New()
fatalError(t, err)

Expand Down Expand Up @@ -821,6 +823,7 @@ MCowBQYDK2VwAyEA5c+4NKZSNQcR1T8qN6SjwgdPZQ0Ge12Ylx/YeGAJ35k=
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewError(ErrorRejectedIdentifierType, "payload contained error: an error")

Expand Down Expand Up @@ -873,6 +876,7 @@ MCowBQYDK2VwAyEA5c+4NKZSNQcR1T8qN6SjwgdPZQ0Ge12Ylx/YeGAJ35k=
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "1234", updch.Value)
assert.Equal(t, payload, updch.Payload)
assert.Equal(t, "step", updch.PayloadFormat)

return nil
},
Expand Down Expand Up @@ -4007,6 +4011,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewError(ErrorRejectedIdentifierType, "payload contained error: an error")

Expand Down Expand Up @@ -4046,6 +4051,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "failed base64 decoding attObj %q", "?!")

Expand Down Expand Up @@ -4085,6 +4091,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "attObj must not be empty")

Expand Down Expand Up @@ -4124,6 +4131,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "attObj must not be empty")

Expand Down Expand Up @@ -4163,6 +4171,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "attObj is not well formed CBOR: unexpected EOF")

Expand Down Expand Up @@ -4204,6 +4213,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "unsupported attestation object format %q", "unsupported-format")

Expand Down Expand Up @@ -4250,6 +4260,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewError(ErrorBadAttestationStatementType, "attestation format %q is not enabled", "step")

Expand Down Expand Up @@ -4306,6 +4317,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "x5c not present")

Expand Down Expand Up @@ -4354,6 +4366,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "serial-number", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "challenge token does not match")

Expand Down Expand Up @@ -4401,6 +4414,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "non-matching-value", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

subproblem := NewSubproblemWithIdentifier(
ErrorRejectedIdentifierType,
Expand Down Expand Up @@ -4480,6 +4494,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "x5c not present")

Expand Down Expand Up @@ -4535,6 +4550,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, "permanent identifier does not match").
AddSubproblems(NewSubproblemWithIdentifier(
Expand Down Expand Up @@ -4631,6 +4647,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Nil(t, updch.Payload)
assert.Empty(t, updch.PayloadFormat)

err := NewDetailedError(ErrorBadAttestationStatementType, `unsupported attestation object format "bogus-format"`)

Expand Down Expand Up @@ -4724,6 +4741,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Equal(t, payload, updch.Payload)
assert.Equal(t, "step", updch.PayloadFormat)

return errors.New("force")
},
Expand Down Expand Up @@ -4771,6 +4789,7 @@ func Test_deviceAttest01Validate(t *testing.T) {
assert.Equal(t, ChallengeType("device-attest-01"), updch.Type)
assert.Equal(t, "12345678", updch.Value)
assert.Equal(t, payload, updch.Payload)
assert.Equal(t, "step", updch.PayloadFormat)

return nil
},
Expand Down

0 comments on commit ba9e082

Please sign in to comment.