Skip to content

Commit 4505696

Browse files
zandbeltzandbelt
committed
updates to TODO/ERR
Signed-off-by: Hans Zandbelt <[email protected]>
1 parent bdab52a commit 4505696

File tree

2 files changed

+77
-73
lines changed

2 files changed

+77
-73
lines changed

‎src/jose.c

Lines changed: 76 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -707,17 +707,15 @@ void oauth2_jose_jwk_list_free(oauth2_log_t *log, oauth2_jose_jwk_list_t *keys)
707707

708708
static oauth2_jose_jwk_list_t *
709709
oauth2_jose_jwks_list_resolve(oauth2_log_t *, oauth2_jose_jwks_provider_t *,
710-
bool *, const cjose_header_t *);
710+
bool *, cjose_header_t *);
711711
static oauth2_jose_jwk_list_t *
712712
oauth2_jose_jwks_uri_resolve(oauth2_log_t *, oauth2_jose_jwks_provider_t *,
713-
bool *, const cjose_header_t *);
714-
static oauth2_jose_jwk_list_t *
715-
oauth2_jose_jwks_eckey_url_resolve(oauth2_log_t *,
716-
oauth2_jose_jwks_provider_t *, bool *,
717-
const cjose_header_t *);
713+
bool *, cjose_header_t *);
714+
static oauth2_jose_jwk_list_t *oauth2_jose_jwks_eckey_url_resolve(
715+
oauth2_log_t *, oauth2_jose_jwks_provider_t *, bool *, cjose_header_t *);
718716
static oauth2_jose_jwk_list_t *
719717
oauth2_jose_jwks_aws_alb_resolve(oauth2_log_t *, oauth2_jose_jwks_provider_t *,
720-
bool *, const cjose_header_t *);
718+
bool *, cjose_header_t *);
721719

722720
static oauth2_jose_jwks_provider_t *
723721
_oauth2_jose_jwks_provider_init(oauth2_log_t *log,
@@ -1892,7 +1890,7 @@ _OAUTH_CFG_CTX_CALLBACK(oauth2_jose_verify_options_jwk_set_aws_alb)
18921890
static oauth2_jose_jwk_list_t *
18931891
oauth2_jose_jwks_list_resolve(oauth2_log_t *log,
18941892
oauth2_jose_jwks_provider_t *provider,
1895-
bool *refresh, const cjose_header_t *hdr)
1893+
bool *refresh, cjose_header_t *hdr)
18961894
{
18971895
*refresh = false;
18981896
return oauth2_jose_jwk_list_clone(log, provider->jwks);
@@ -2219,7 +2217,7 @@ static oauth2_jose_jwk_list_t *_oauth2_jose_jwks_resolve_from_uri(
22192217
static oauth2_jose_jwk_list_t *
22202218
oauth2_jose_jwks_uri_resolve(oauth2_log_t *log,
22212219
oauth2_jose_jwks_provider_t *provider,
2222-
bool *refresh, const cjose_header_t *hdr)
2220+
bool *refresh, cjose_header_t *hdr)
22232221
{
22242222
return _oauth2_jose_jwks_resolve_from_uri(
22252223
log, provider, refresh,
@@ -2229,85 +2227,91 @@ oauth2_jose_jwks_uri_resolve(oauth2_log_t *log,
22292227
static oauth2_jose_jwk_list_t *
22302228
oauth2_jose_jwks_eckey_url_resolve(oauth2_log_t *log,
22312229
oauth2_jose_jwks_provider_t *provider,
2232-
bool *refresh, const cjose_header_t *hdr)
2230+
bool *refresh, cjose_header_t *hdr)
22332231
{
22342232
return _oauth2_jose_jwks_resolve_from_uri(
22352233
log, provider, refresh,
22362234
_oauth2_jose_jwks_eckey_url_resolve_response_callback);
22372235
}
22382236

2239-
static const char *_oauth2_jose_jwks_aws_alb_region(const char *arn) {
2240-
if (!arn) return NULL;
2237+
static const char *_oauth2_jose_jwks_aws_alb_region(const char *arn)
2238+
{
2239+
if (!arn)
2240+
return NULL;
22412241

2242-
char *arn_copy = oauth2_strdup(arn);
2243-
if (!arn_copy) return NULL;
2242+
char *arn_copy = oauth2_strdup(arn);
2243+
if (!arn_copy)
2244+
return NULL;
22442245

2245-
char *token = strtok(arn_copy, ":");
2246-
int count = 0;
2247-
const char *region = NULL;
2246+
char *token = strtok(arn_copy, ":");
2247+
int count = 0;
2248+
const char *region = NULL;
22482249

2249-
while (token) {
2250-
if (count == 3) {
2251-
region = oauth2_strdup(token);
2252-
break;
2253-
}
2254-
token = strtok(NULL, ":");
2255-
count++;
2256-
}
2250+
while (token) {
2251+
if (count == 3) {
2252+
region = oauth2_strdup(token);
2253+
break;
2254+
}
2255+
token = strtok(NULL, ":");
2256+
count++;
2257+
}
22572258

2258-
oauth2_mem_free(arn_copy);
2259-
return region;
2259+
oauth2_mem_free(arn_copy);
2260+
return region;
22602261
}
22612262

22622263
static oauth2_jose_jwk_list_t *
22632264
oauth2_jose_jwks_aws_alb_resolve(oauth2_log_t *log,
22642265
oauth2_jose_jwks_provider_t *provider,
2265-
bool *refresh, const cjose_header_t *hdr)
2266+
bool *refresh, cjose_header_t *hdr)
22662267
{
2267-
cjose_err err;
2268-
2269-
// TODO - error here, issue with const cjose_header_t *hdr
2270-
const char *signer = cjose_header_get(hdr, "signer", &err);
2271-
const char *kid = cjose_header_get(hdr, "kid", &err);
2272-
2273-
if (!signer || !kid) {
2274-
oauth2_error(log, "missing 'signer' or 'kid' in JWT header: signer=%s, kid=%s", signer, kid);
2275-
return NULL;
2276-
}
2277-
2278-
// TODO - determine if theres a better place for this?
2279-
// TODO - maybe needed? timing safe compare?
2280-
if (strcmp(signer, provider->alb_arn) != 0) {
2281-
oauth2_error(log, "signer does not match configured ARN: signer=%s, arn=%s", signer, provider->alb_arn);
2282-
return NULL;
2283-
}
2284-
2285-
const char *region = _oauth2_jose_jwks_aws_alb_region(provider->alb_arn);
2286-
if (!region) {
2287-
oauth2_error(log, "failed to extract region from ARN: arn=%s", provider->alb_arn);
2288-
return NULL;
2289-
}
2290-
2291-
size_t url_len = strlen("https://public-keys.auth.elb.") + strlen(region) + strlen(".amazonaws.com/") + strlen(kid) + 1;
2292-
char *url = oauth2_mem_alloc(url_len);
2293-
if (!url) {
2294-
oauth2_error(log, "oauth2_mem_alloc failed for JWKS URL");
2295-
return NULL;
2296-
}
2297-
2298-
oauth2_snprintf(url, url_len, "https://public-keys.auth.elb.%s.amazonaws.com/%s", region, kid);
2299-
oauth2_debug(log, "constructed JWKS URL: %s", url);
2300-
2301-
// TODO - should probably be a copy of provider?
2302-
oauth2_cfg_endpoint_set_url(provider->jwks_uri->endpoint, url);
2303-
2304-
oauth2_jose_jwk_list_t *result = _oauth2_jose_jwks_resolve_from_uri(
2305-
log, provider, refresh, oauth2_jose_jwks_eckey_url_resolve_response_callback
2306-
);
2307-
2308-
oauth2_mem_free(url);
2309-
2310-
return result;
2268+
cjose_err err;
2269+
2270+
const char *signer = cjose_header_get(hdr, "signer", &err);
2271+
const char *kid = cjose_header_get(hdr, "kid", &err);
2272+
2273+
if (!signer || !kid) {
2274+
oauth2_error(log,
2275+
"missing 'signer' or 'kid' in JWT header: "
2276+
"signer=%s, kid=%s",
2277+
signer, kid);
2278+
return NULL;
2279+
}
2280+
2281+
// TODO - maybe needed? timing safe compare?
2282+
if (strcmp(signer, provider->alb_arn) != 0) {
2283+
oauth2_error(
2284+
log,
2285+
"signer does not match configured ARN: signer=%s, arn=%s",
2286+
signer, provider->alb_arn);
2287+
return NULL;
2288+
}
2289+
2290+
const char *region =
2291+
_oauth2_jose_jwks_aws_alb_region(provider->alb_arn);
2292+
if (!region) {
2293+
oauth2_error(log, "failed to extract region from ARN: arn=%s",
2294+
provider->alb_arn);
2295+
return NULL;
2296+
}
2297+
2298+
// TODO: make the base URL configurable
2299+
char *url = _oauth2_stradd4(NULL, "https://public-keys.auth.elb.",
2300+
region, ".amazonaws.com/", kid);
2301+
oauth2_debug(log, "constructed ALB JWKs URL: %s", url);
2302+
2303+
provider->jwks_uri = oauth2_uri_ctx_init(log);
2304+
oauth2_jose_options_uri_ctx(log, url, NULL, provider->jwks_uri, NULL);
2305+
2306+
oauth2_jose_jwk_list_t *result = _oauth2_jose_jwks_resolve_from_uri(
2307+
log, provider, refresh,
2308+
_oauth2_jose_jwks_eckey_url_resolve_response_callback);
2309+
2310+
oauth2_uri_ctx_free(log, provider->jwks_uri);
2311+
provider->jwks_uri = NULL;
2312+
oauth2_mem_free(url);
2313+
2314+
return result;
23112315
}
23122316

23132317
/*

‎src/jose_int.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ typedef struct oauth2_jose_jwks_provider_t oauth2_jose_jwks_provider_t;
5555
typedef oauth2_jose_jwk_list_t *(
5656
oauth2_jose_jwks_resolve_cb_t)(oauth2_log_t *,
5757
oauth2_jose_jwks_provider_t *, bool *,
58-
const cjose_header_t *hdr);
58+
cjose_header_t *hdr);
5959

6060
typedef struct oauth2_jose_jwks_provider_t {
6161
oauth2_jose_jwks_provider_type_t type;

0 commit comments

Comments
 (0)