rust/neon
1
0
Fork 0
mirror of https://github.com/neondatabase/neon.git synced 2026-10-16 08:42:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

strip down supported algorithms to just RS256 and ES256

Browse Source
This commit is contained in:
Conrad Ludgate
2024-08-12 09:01:04 +01:00
parent 103f34e954
commit 0d895ba002
3 changed files with 1 additions and 183 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cargo.lock
Generated
-101
View File
@@ -1548,33 +1548,6 @@ dependencies = [
"typenum",
]
[[package]]
name = "curve25519-dalek"
version = "4.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
dependencies = [
"cfg-if",
"cpufeatures",
"curve25519-dalek-derive",
"digest",
"fiat-crypto",
"rustc_version",
"subtle",
"zeroize",
]
[[package]]
name = "curve25519-dalek-derive"
version = "0.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
dependencies = [
"proc-macro2",
"quote",
"syn 2.0.52",
]
[[package]]
name = "darling"
version = "0.20.1"
@@ -1827,30 +1800,6 @@ dependencies = [
"spki 0.7.3",
]
[[package]]
name = "ed25519"
version = "2.2.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
dependencies = [
"pkcs8 0.10.2",
"signature 2.2.0",
]
[[package]]
name = "ed25519-dalek"
version = "2.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4a3daa8e81a3963a60642bcc1f90a670680bd4a77535faa384e9d1c79d620871"
dependencies = [
"curve25519-dalek",
"ed25519",
"serde",
"sha2",
"subtle",
"zeroize",
]
[[package]]
name = "either"
version = "1.8.1"
@@ -1889,7 +1838,6 @@ dependencies = [
"ff 0.13.0",
"generic-array",
"group 0.13.0",
"hkdf",
"pem-rfc7468",
"pkcs8 0.10.2",
"rand_core 0.6.4",
@@ -2057,12 +2005,6 @@ dependencies = [
"subtle",
]
[[package]]
name = "fiat-crypto"
version = "0.2.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
[[package]]
name = "filetime"
version = "0.2.22"
@@ -2479,15 +2421,6 @@ version = "0.4.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6fe2267d4ed49bc07b63801559be28c718ea06c4738b7a03c94df7386d2cde46"
[[package]]
name = "hkdf"
version = "0.12.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
dependencies = [
"hmac",
]
[[package]]
name = "hmac"
version = "0.12.1"
@@ -2969,20 +2902,6 @@ dependencies = [
"simple_asn1",
]
[[package]]
name = "k256"
version = "0.13.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3f01b677d82ef7a676aa37e099defd83a28e15687112cafdd112d60236b6115b"
dependencies = [
"cfg-if",
"ecdsa 0.16.9",
"elliptic-curve 0.13.8",
"once_cell",
"sha2",
"signature 2.2.0",
]
[[package]]
name = "kqueue"
version = "1.0.7"
@@ -3707,24 +3626,8 @@ version = "0.13.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "70786f51bcc69f6a4c0360e063a4cac5419ef7c5cd5b3c99ad70f3be5ba79209"
dependencies = [
"ecdsa 0.16.9",
"elliptic-curve 0.13.8",
"primeorder",
"sha2",
]
[[package]]
name = "p521"
version = "0.13.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2"
dependencies = [
"base16ct 0.2.0",
"ecdsa 0.16.9",
"elliptic-curve 0.13.8",
"primeorder",
"rand_core 0.6.4",
"sha2",
]
[[package]]
@@ -4532,7 +4435,6 @@ dependencies = [
"crossbeam-deque",
"dashmap",
"ecdsa 0.16.9",
"ed25519-dalek",
"env_logger",
"fallible-iterator",
"framed-websockets",
@@ -4555,7 +4457,6 @@ dependencies = [
"itertools 0.10.5",
"jose-jwa",
"jose-jwk",
"k256",
"lasso",
"md5",
"measured",
@@ -4563,8 +4464,6 @@ dependencies = [
"once_cell",
"opentelemetry",
"p256 0.13.2",
"p384",
"p521",
"parking_lot 0.12.1",
"parquet",
"parquet_derive",
proxy/Cargo.toml
-4
View File
@@ -110,10 +110,6 @@ jose-jwk = { version = "0.1.2", features = ["p256", "p384", "rsa"] }
signature = "2"
ecdsa = "0.16"
p256 = "0.13"
p384 = "0.13"
p521 = "0.13"
k256 = "0.13"
ed25519-dalek = "2"
rsa = "0.9"
workspace_hack.workspace = true
proxy/src/auth/backend/jwt.rs
+1 -78
View File
@@ -3,8 +3,6 @@ use std::{sync::Arc, time::Duration};
use anyhow::{bail, ensure, Context};
use arc_swap::ArcSwapOption;
use dashmap::DashMap;
use hmac::digest::generic_array::GenericArray;
// use jose_jwa::S;
use jose_jwk::crypto::KeyInfo;
use tokio::time::Instant;
@@ -235,9 +233,6 @@ impl JWKCache {
jose_jwk::Key::Rsa(key) => {
verify_rsa_signature(header_payload.as_bytes(), &sig, key, &jwk.prm.alg)?;
}
jose_jwk::Key::Okp(key) => {
verify_okp_signature(header_payload.as_bytes(), &sig, key)?;
}
key => bail!("unsupported key type {key:?}"),
};
@@ -259,59 +254,12 @@ fn verify_ec_signature(data: &[u8], sig: &[u8], key: &jose_jwk::Ec) -> anyhow::R
let sig = Signature::from_slice(sig)?;
key.verify(data, &sig)?;
}
jose_jwk::EcCurves::P384 => {
let pk =
p384::PublicKey::try_from(key).map_err(|_| anyhow::anyhow!("invalid P384 key"))?;
let key = p384::ecdsa::VerifyingKey::from(&pk);
let sig = Signature::from_slice(sig)?;
key.verify(data, &sig)?;
}
jose_jwk::EcCurves::P521 => {
ensure!(key.x.len() == 66 && key.y.len() == 66);
let x = GenericArray::from_slice(&key.x);
let y = GenericArray::from_slice(&key.y);
let encoded = p521::EncodedPoint::from_affine_coordinates(x, y, false);
let key = p521::ecdsa::VerifyingKey::from_encoded_point(&encoded)?;
let sig = Signature::from_slice(sig)?;
key.verify(data, &sig)?;
}
jose_jwk::EcCurves::P256K => {
ensure!(key.x.len() == 32 && key.y.len() == 32);
let x = GenericArray::from_slice(&key.x);
let y = GenericArray::from_slice(&key.y);
let encoded = k256::EncodedPoint::from_affine_coordinates(x, y, false);
let key = k256::ecdsa::VerifyingKey::from_encoded_point(&encoded)?;
let sig = Signature::from_slice(sig)?;
key.verify(data, &sig)?;
}
key => bail!("unsupported ec key type {key:?}"),
}
Ok(())
}
fn verify_okp_signature(data: &[u8], sig: &[u8], key: &jose_jwk::Okp) -> anyhow::Result<()> {
use ed25519_dalek::Signature;
use signature::Verifier;
match key.crv {
jose_jwk::OkpCurves::Ed25519 => {
let x = <&[u8; 32]>::try_from(&**key.x)?;
let key = ed25519_dalek::VerifyingKey::from_bytes(x)?;
let sig = Signature::from_slice(sig)?;
key.verify(data, &sig)?;
}
// jose_jwk::OkpCurves::Ed448 => todo!(),
// jose_jwk::OkpCurves::X25519 => todo!(),
// jose_jwk::OkpCurves::X448 => todo!(),
key => bail!("unsupported octet key pair curve type {key:?}"),
}
Ok(())
}
fn verify_rsa_signature(
data: &[u8],
sig: &[u8],
@@ -319,42 +267,17 @@ fn verify_rsa_signature(
alg: &Option<jose_jwa::Algorithm>,
) -> anyhow::Result<()> {
use jose_jwa::{Algorithm, Signing};
use rsa::{Pkcs1v15Sign, Pss, RsaPublicKey};
use rsa::{Pkcs1v15Sign, RsaPublicKey};
use sha2::Digest;
let key = RsaPublicKey::try_from(key).map_err(|_| anyhow::anyhow!("invalid RSA key"))?;
match alg {
Some(Algorithm::Signing(Signing::Ps256)) => {
let hashed = sha2::Sha256::digest(data);
let scheme = Pss::new::<sha2::Sha256>();
key.verify(scheme, &hashed, sig)?;
}
Some(Algorithm::Signing(Signing::Ps384)) => {
let hashed = sha2::Sha384::digest(data);
let scheme = Pss::new::<sha2::Sha384>();
key.verify(scheme, &hashed, sig)?;
}
Some(Algorithm::Signing(Signing::Ps512)) => {
let hashed = sha2::Sha512::digest(data);
let scheme = Pss::new::<sha2::Sha512>();
key.verify(scheme, &hashed, sig)?;
}
Some(Algorithm::Signing(Signing::Rs256)) => {
let hashed = sha2::Sha256::digest(data);
let scheme = Pkcs1v15Sign::new::<sha2::Sha256>();
key.verify(scheme, &hashed, sig)?;
}
Some(Algorithm::Signing(Signing::Rs384)) => {
let hashed = sha2::Sha384::digest(data);
let scheme = Pkcs1v15Sign::new::<sha2::Sha384>();
key.verify(scheme, &hashed, sig)?;
}
Some(Algorithm::Signing(Signing::Rs512)) => {
let hashed = sha2::Sha512::digest(data);
let scheme = Pkcs1v15Sign::new::<sha2::Sha512>();
key.verify(scheme, &hashed, sig)?;
}
_ => bail!("invalid RSA signing algorithm"),
};