mirror of
https://github.com/go-gitea/gitea.git
synced 2024-09-05 23:34:19 -04:00
Attempt to fix the webauthn migration again - part 3 (#18770)
v208.go is seriously broken as it misses an ID() check. We need to no-op and remigrate all of the u2f keys. See #18756 Signed-off-by: Andrew Thornton <art27@cantab.net>
This commit is contained in:
parent
f48771ae78
commit
3a29a23cdc
@ -43,7 +43,7 @@ type WebAuthnCredential struct {
|
|||||||
Name string
|
Name string
|
||||||
LowerName string `xorm:"unique(s)"`
|
LowerName string `xorm:"unique(s)"`
|
||||||
UserID int64 `xorm:"INDEX unique(s)"`
|
UserID int64 `xorm:"INDEX unique(s)"`
|
||||||
CredentialID string `xorm:"INDEX"`
|
CredentialID string `xorm:"INDEX VARCHAR(410)"`
|
||||||
PublicKey []byte
|
PublicKey []byte
|
||||||
AttestationType string
|
AttestationType string
|
||||||
AAGUID []byte
|
AAGUID []byte
|
||||||
|
@ -4,6 +4,9 @@
|
|||||||
-
|
-
|
||||||
id: 2
|
id: 2
|
||||||
credential_id: "TVHE44TOH7DF7V48SEAIT3EMMJ7TGBOQ289E5AQB34S98LFCUFJ7U2NAVI8RJG6K2F4TC8AQ8KBNO7AGEOQOL9NE43GR63HTEHJSLOG="
|
credential_id: "TVHE44TOH7DF7V48SEAIT3EMMJ7TGBOQ289E5AQB34S98LFCUFJ7U2NAVI8RJG6K2F4TC8AQ8KBNO7AGEOQOL9NE43GR63HTEHJSLOG="
|
||||||
|
-
|
||||||
|
id: 3
|
||||||
|
credential_id: "TVHE44TOH7DF7V48SEAIT3EMMJ7TGBOQ289E5AQB34S98LFCUFJ7U2NAVI8RJG6K2F4TC8AQ8KBNO7AGEOQOL9NE43GR63HTEHJSLOG="
|
||||||
-
|
-
|
||||||
id: 4
|
id: 4
|
||||||
credential_id: "THIS SHOULD NOT CHAGNGE"
|
credential_id: "TVHE44TOH7DF7V48SEAIT3EMMJ7TGBOQ289E5AQB34S98LFCUFJ7U2NAVI8RJG6K2F4TC8AQ8KBNO7AGEOQOL9NE43GR63HTEHJSLOG="
|
@ -23,7 +23,7 @@
|
|||||||
lower_name: "u2fkey-wrong-user-id"
|
lower_name: "u2fkey-wrong-user-id"
|
||||||
name: "u2fkey-wrong-user-id"
|
name: "u2fkey-wrong-user-id"
|
||||||
user_id: 1
|
user_id: 1
|
||||||
credential_id: "THIS SHOULD NOT CHAGNGE"
|
credential_id: "THIS SHOULD CHANGE"
|
||||||
public_key: 0x040d0967a2cad045011631187576492a0beb5b377954b4f694c5afc8bdf25270f87f09a9ab6ce9c282f447ba71b2f2bae2105b32b847e0704f310f48644e3eddf2
|
public_key: 0x040d0967a2cad045011631187576492a0beb5b377954b4f694c5afc8bdf25270f87f09a9ab6ce9c282f447ba71b2f2bae2105b32b847e0704f310f48644e3eddf2
|
||||||
attestation_type: 'fido-u2f'
|
attestation_type: 'fido-u2f'
|
||||||
sign_count: 1
|
sign_count: 1
|
@ -367,11 +367,13 @@ var migrations = []Migration{
|
|||||||
// v206 -> v207
|
// v206 -> v207
|
||||||
NewMigration("Add authorize column to team_unit table", addAuthorizeColForTeamUnit),
|
NewMigration("Add authorize column to team_unit table", addAuthorizeColForTeamUnit),
|
||||||
// v207 -> v208
|
// v207 -> v208
|
||||||
NewMigration("Add webauthn table and migrate u2f data to webauthn", addWebAuthnCred),
|
NewMigration("Add webauthn table and migrate u2f data to webauthn - NO-OPED", addWebAuthnCred),
|
||||||
// v208 -> v209
|
// v208 -> v209
|
||||||
NewMigration("Use base32.HexEncoding instead of base64 encoding for cred ID as it is case insensitive", useBase32HexForCredIDInWebAuthnCredential),
|
NewMigration("Use base32.HexEncoding instead of base64 encoding for cred ID as it is case insensitive - NO-OPED", useBase32HexForCredIDInWebAuthnCredential),
|
||||||
// v209 -> v210
|
// v209 -> v210
|
||||||
NewMigration("Increase WebAuthentication CredentialID size to 410", increaseCredentialIDTo410),
|
NewMigration("Increase WebAuthentication CredentialID size to 410 - NO-OPED", increaseCredentialIDTo410),
|
||||||
|
// v210 -> v211
|
||||||
|
NewMigration("v208 was completely broken - remigrate", remigrateU2FCredentials),
|
||||||
}
|
}
|
||||||
|
|
||||||
// GetCurrentDBVersion returns the current db version
|
// GetCurrentDBVersion returns the current db version
|
||||||
|
@ -5,86 +5,11 @@
|
|||||||
package migrations
|
package migrations
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"crypto/elliptic"
|
|
||||||
"encoding/base64"
|
|
||||||
"strings"
|
|
||||||
|
|
||||||
"code.gitea.io/gitea/modules/timeutil"
|
|
||||||
|
|
||||||
"github.com/tstranex/u2f"
|
|
||||||
"xorm.io/xorm"
|
"xorm.io/xorm"
|
||||||
)
|
)
|
||||||
|
|
||||||
func addWebAuthnCred(x *xorm.Engine) error {
|
func addWebAuthnCred(x *xorm.Engine) error {
|
||||||
// Create webauthnCredential table
|
// NO-OP Don't migrate here - let v210 do this.
|
||||||
type webauthnCredential struct {
|
|
||||||
ID int64 `xorm:"pk autoincr"`
|
|
||||||
Name string
|
|
||||||
LowerName string `xorm:"unique(s)"`
|
|
||||||
UserID int64 `xorm:"INDEX unique(s)"`
|
|
||||||
CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety
|
|
||||||
PublicKey []byte
|
|
||||||
AttestationType string
|
|
||||||
AAGUID []byte
|
|
||||||
SignCount uint32 `xorm:"BIGINT"`
|
|
||||||
CloneWarning bool
|
|
||||||
CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
|
|
||||||
UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
|
|
||||||
}
|
|
||||||
if err := x.Sync2(&webauthnCredential{}); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
// Now migrate the old u2f registrations to the new format
|
|
||||||
type u2fRegistration struct {
|
|
||||||
ID int64 `xorm:"pk autoincr"`
|
|
||||||
Name string
|
|
||||||
UserID int64 `xorm:"INDEX"`
|
|
||||||
Raw []byte
|
|
||||||
Counter uint32 `xorm:"BIGINT"`
|
|
||||||
CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
|
|
||||||
UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
|
|
||||||
}
|
|
||||||
|
|
||||||
var start int
|
|
||||||
regs := make([]*u2fRegistration, 0, 50)
|
|
||||||
for {
|
|
||||||
err := x.OrderBy("id").Limit(50, start).Find(®s)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, reg := range regs {
|
|
||||||
parsed := new(u2f.Registration)
|
|
||||||
err = parsed.UnmarshalBinary(reg.Raw)
|
|
||||||
if err != nil {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
c := &webauthnCredential{
|
|
||||||
ID: reg.ID,
|
|
||||||
Name: reg.Name,
|
|
||||||
LowerName: strings.ToLower(reg.Name),
|
|
||||||
UserID: reg.UserID,
|
|
||||||
CredentialID: base64.RawStdEncoding.EncodeToString(parsed.KeyHandle),
|
|
||||||
PublicKey: elliptic.Marshal(elliptic.P256(), parsed.PubKey.X, parsed.PubKey.Y),
|
|
||||||
AttestationType: "fido-u2f",
|
|
||||||
AAGUID: []byte{},
|
|
||||||
SignCount: reg.Counter,
|
|
||||||
}
|
|
||||||
|
|
||||||
_, err := x.Insert(c)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if len(regs) < 50 {
|
|
||||||
break
|
|
||||||
}
|
|
||||||
start += 50
|
|
||||||
regs = regs[:0]
|
|
||||||
}
|
|
||||||
|
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
@ -5,46 +5,10 @@
|
|||||||
package migrations
|
package migrations
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"encoding/base32"
|
|
||||||
"encoding/base64"
|
|
||||||
|
|
||||||
"xorm.io/xorm"
|
"xorm.io/xorm"
|
||||||
)
|
)
|
||||||
|
|
||||||
func useBase32HexForCredIDInWebAuthnCredential(x *xorm.Engine) error {
|
func useBase32HexForCredIDInWebAuthnCredential(x *xorm.Engine) error {
|
||||||
// Create webauthnCredential table
|
// noop
|
||||||
type webauthnCredential struct {
|
|
||||||
ID int64 `xorm:"pk autoincr"`
|
|
||||||
CredentialID string `xorm:"INDEX VARCHAR(410)"`
|
|
||||||
}
|
|
||||||
if err := x.Sync2(&webauthnCredential{}); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
var start int
|
|
||||||
regs := make([]*webauthnCredential, 0, 50)
|
|
||||||
for {
|
|
||||||
err := x.OrderBy("id").Limit(50, start).Find(®s)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, reg := range regs {
|
|
||||||
credID, _ := base64.RawStdEncoding.DecodeString(reg.CredentialID)
|
|
||||||
reg.CredentialID = base32.HexEncoding.EncodeToString(credID)
|
|
||||||
|
|
||||||
_, err := x.Update(reg)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if len(regs) < 50 {
|
|
||||||
break
|
|
||||||
}
|
|
||||||
start += 50
|
|
||||||
regs = regs[:0]
|
|
||||||
}
|
|
||||||
|
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
@ -5,140 +5,13 @@
|
|||||||
package migrations
|
package migrations
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"encoding/base32"
|
|
||||||
"fmt"
|
|
||||||
"strings"
|
|
||||||
|
|
||||||
"code.gitea.io/gitea/modules/timeutil"
|
|
||||||
|
|
||||||
"github.com/tstranex/u2f"
|
|
||||||
"xorm.io/xorm"
|
"xorm.io/xorm"
|
||||||
"xorm.io/xorm/schemas"
|
|
||||||
)
|
)
|
||||||
|
|
||||||
func increaseCredentialIDTo410(x *xorm.Engine) error {
|
func increaseCredentialIDTo410(x *xorm.Engine) error {
|
||||||
// Create webauthnCredential table
|
// no-op
|
||||||
type webauthnCredential struct {
|
// v208 was completely wrong
|
||||||
ID int64 `xorm:"pk autoincr"`
|
// So now we have to no-op again.
|
||||||
Name string
|
|
||||||
LowerName string `xorm:"unique(s)"`
|
|
||||||
UserID int64 `xorm:"INDEX unique(s)"`
|
|
||||||
CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety
|
|
||||||
PublicKey []byte
|
|
||||||
AttestationType string
|
|
||||||
AAGUID []byte
|
|
||||||
SignCount uint32 `xorm:"BIGINT"`
|
|
||||||
CloneWarning bool
|
|
||||||
CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
|
|
||||||
UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
|
|
||||||
}
|
|
||||||
if err := x.Sync2(&webauthnCredential{}); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
switch x.Dialect().URI().DBType {
|
|
||||||
case schemas.MYSQL:
|
|
||||||
_, err := x.Exec("ALTER TABLE webauthn_credential MODIFY COLUMN credential_id VARCHAR(410)")
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
case schemas.ORACLE:
|
|
||||||
_, err := x.Exec("ALTER TABLE webauthn_credential MODIFY credential_id VARCHAR(410)")
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
case schemas.MSSQL:
|
|
||||||
// This column has an index on it. I could write all of the code to attempt to change the index OR
|
|
||||||
// I could just use recreate table.
|
|
||||||
sess := x.NewSession()
|
|
||||||
if err := sess.Begin(); err != nil {
|
|
||||||
_ = sess.Close()
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if err := recreateTable(sess, new(webauthnCredential)); err != nil {
|
|
||||||
_ = sess.Close()
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if err := sess.Commit(); err != nil {
|
|
||||||
_ = sess.Close()
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if err := sess.Close(); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
case schemas.POSTGRES:
|
|
||||||
_, err := x.Exec("ALTER TABLE webauthn_credential ALTER COLUMN credential_id TYPE VARCHAR(410)")
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
default:
|
|
||||||
// SQLite doesn't support ALTER COLUMN, and it already makes String _TEXT_ by default so no migration needed
|
|
||||||
// nor is there any need to re-migrate
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
exist, err := x.IsTableExist("u2f_registration")
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if !exist {
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
// Now migrate the old u2f registrations to the new format
|
|
||||||
type u2fRegistration struct {
|
|
||||||
ID int64 `xorm:"pk autoincr"`
|
|
||||||
Name string
|
|
||||||
UserID int64 `xorm:"INDEX"`
|
|
||||||
Raw []byte
|
|
||||||
Counter uint32 `xorm:"BIGINT"`
|
|
||||||
CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
|
|
||||||
UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
|
|
||||||
}
|
|
||||||
|
|
||||||
var start int
|
|
||||||
regs := make([]*u2fRegistration, 0, 50)
|
|
||||||
for {
|
|
||||||
err := x.OrderBy("id").Limit(50, start).Find(®s)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, reg := range regs {
|
|
||||||
parsed := new(u2f.Registration)
|
|
||||||
err = parsed.UnmarshalBinary(reg.Raw)
|
|
||||||
if err != nil {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
cred := &webauthnCredential{}
|
|
||||||
has, err := x.ID(reg.ID).Where("id = ? AND user_id = ?", reg.ID, reg.UserID).Get(cred)
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %v", reg.ID, err)
|
|
||||||
}
|
|
||||||
if !has {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
remigratedCredID := base32.HexEncoding.EncodeToString(parsed.KeyHandle)
|
|
||||||
if cred.CredentialID == remigratedCredID || (!strings.HasPrefix(remigratedCredID, cred.CredentialID) && cred.CredentialID != "") {
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
|
|
||||||
cred.CredentialID = remigratedCredID
|
|
||||||
|
|
||||||
_, err = x.ID(cred.ID).Update(cred)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if len(regs) < 50 {
|
|
||||||
break
|
|
||||||
}
|
|
||||||
start += 50
|
|
||||||
regs = regs[:0]
|
|
||||||
}
|
|
||||||
|
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
172
models/migrations/v210.go
Normal file
172
models/migrations/v210.go
Normal file
@ -0,0 +1,172 @@
|
|||||||
|
// Copyright 2022 The Gitea Authors. All rights reserved.
|
||||||
|
// Use of this source code is governed by a MIT-style
|
||||||
|
// license that can be found in the LICENSE file.
|
||||||
|
|
||||||
|
package migrations
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/elliptic"
|
||||||
|
"encoding/base32"
|
||||||
|
"fmt"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"code.gitea.io/gitea/modules/timeutil"
|
||||||
|
"github.com/tstranex/u2f"
|
||||||
|
|
||||||
|
"xorm.io/xorm"
|
||||||
|
"xorm.io/xorm/schemas"
|
||||||
|
)
|
||||||
|
|
||||||
|
// v208 migration was completely broken
|
||||||
|
func remigrateU2FCredentials(x *xorm.Engine) error {
|
||||||
|
// Create webauthnCredential table
|
||||||
|
type webauthnCredential struct {
|
||||||
|
ID int64 `xorm:"pk autoincr"`
|
||||||
|
Name string
|
||||||
|
LowerName string `xorm:"unique(s)"`
|
||||||
|
UserID int64 `xorm:"INDEX unique(s)"`
|
||||||
|
CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety
|
||||||
|
PublicKey []byte
|
||||||
|
AttestationType string
|
||||||
|
AAGUID []byte
|
||||||
|
SignCount uint32 `xorm:"BIGINT"`
|
||||||
|
CloneWarning bool
|
||||||
|
CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
|
||||||
|
UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
|
||||||
|
}
|
||||||
|
if err := x.Sync2(&webauthnCredential{}); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
switch x.Dialect().URI().DBType {
|
||||||
|
case schemas.MYSQL:
|
||||||
|
_, err := x.Exec("ALTER TABLE webauthn_credential MODIFY COLUMN credential_id VARCHAR(410)")
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
case schemas.ORACLE:
|
||||||
|
_, err := x.Exec("ALTER TABLE webauthn_credential MODIFY credential_id VARCHAR(410)")
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
case schemas.MSSQL:
|
||||||
|
// This column has an index on it. I could write all of the code to attempt to change the index OR
|
||||||
|
// I could just use recreate table.
|
||||||
|
sess := x.NewSession()
|
||||||
|
if err := sess.Begin(); err != nil {
|
||||||
|
_ = sess.Close()
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := recreateTable(sess, new(webauthnCredential)); err != nil {
|
||||||
|
_ = sess.Close()
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if err := sess.Commit(); err != nil {
|
||||||
|
_ = sess.Close()
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if err := sess.Close(); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
case schemas.POSTGRES:
|
||||||
|
_, err := x.Exec("ALTER TABLE webauthn_credential ALTER COLUMN credential_id TYPE VARCHAR(410)")
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
default:
|
||||||
|
// SQLite doesn't support ALTER COLUMN, and it already makes String _TEXT_ by default so no migration needed
|
||||||
|
// nor is there any need to re-migrate
|
||||||
|
}
|
||||||
|
|
||||||
|
exist, err := x.IsTableExist("u2f_registration")
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if !exist {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Now migrate the old u2f registrations to the new format
|
||||||
|
type u2fRegistration struct {
|
||||||
|
ID int64 `xorm:"pk autoincr"`
|
||||||
|
Name string
|
||||||
|
UserID int64 `xorm:"INDEX"`
|
||||||
|
Raw []byte
|
||||||
|
Counter uint32 `xorm:"BIGINT"`
|
||||||
|
CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
|
||||||
|
UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
|
||||||
|
}
|
||||||
|
|
||||||
|
var start int
|
||||||
|
regs := make([]*u2fRegistration, 0, 50)
|
||||||
|
for {
|
||||||
|
err := x.OrderBy("id").Limit(50, start).Find(®s)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
err = func() error {
|
||||||
|
sess := x.NewSession()
|
||||||
|
defer sess.Close()
|
||||||
|
if err := sess.Begin(); err != nil {
|
||||||
|
return fmt.Errorf("unable to allow start session. Error: %w", err)
|
||||||
|
}
|
||||||
|
if x.Dialect().URI().DBType == schemas.MSSQL {
|
||||||
|
if _, err := sess.Exec("SET IDENTITY_INSERT `webauthn_credential` ON"); err != nil {
|
||||||
|
return fmt.Errorf("unable to allow identity insert on webauthn_credential. Error: %w", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
for _, reg := range regs {
|
||||||
|
parsed := new(u2f.Registration)
|
||||||
|
err = parsed.UnmarshalBinary(reg.Raw)
|
||||||
|
if err != nil {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
remigrated := &webauthnCredential{
|
||||||
|
ID: reg.ID,
|
||||||
|
Name: reg.Name,
|
||||||
|
LowerName: strings.ToLower(reg.Name),
|
||||||
|
UserID: reg.UserID,
|
||||||
|
CredentialID: base32.HexEncoding.EncodeToString(parsed.KeyHandle),
|
||||||
|
PublicKey: elliptic.Marshal(elliptic.P256(), parsed.PubKey.X, parsed.PubKey.Y),
|
||||||
|
AttestationType: "fido-u2f",
|
||||||
|
AAGUID: []byte{},
|
||||||
|
SignCount: reg.Counter,
|
||||||
|
UpdatedUnix: reg.UpdatedUnix,
|
||||||
|
CreatedUnix: reg.CreatedUnix,
|
||||||
|
}
|
||||||
|
|
||||||
|
has, err := sess.ID(reg.ID).Where("id = ?", reg.ID).Get(new(webauthnCredential))
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %w", reg.ID, err)
|
||||||
|
}
|
||||||
|
if !has {
|
||||||
|
_, err = sess.Insert(remigrated)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("unable to (re)insert webauthn_credential[%d]. Error: %w", reg.ID, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
_, err = sess.ID(remigrated.ID).AllCols().Update(remigrated)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("unable to update webauthn_credential[%d]. Error: %w", reg.ID, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return sess.Commit()
|
||||||
|
}()
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(regs) < 50 {
|
||||||
|
break
|
||||||
|
}
|
||||||
|
start += 50
|
||||||
|
regs = regs[:0]
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
@ -12,7 +12,7 @@ import (
|
|||||||
"xorm.io/xorm/schemas"
|
"xorm.io/xorm/schemas"
|
||||||
)
|
)
|
||||||
|
|
||||||
func Test_increaseCredentialIDTo410(t *testing.T) {
|
func Test_remigrateU2FCredentials(t *testing.T) {
|
||||||
// Create webauthnCredential table
|
// Create webauthnCredential table
|
||||||
type WebauthnCredential struct {
|
type WebauthnCredential struct {
|
||||||
ID int64 `xorm:"pk autoincr"`
|
ID int64 `xorm:"pk autoincr"`
|
||||||
@ -55,7 +55,7 @@ func Test_increaseCredentialIDTo410(t *testing.T) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Run the migration
|
// Run the migration
|
||||||
if err := increaseCredentialIDTo410(x); err != nil {
|
if err := remigrateU2FCredentials(x); err != nil {
|
||||||
assert.NoError(t, err)
|
assert.NoError(t, err)
|
||||||
return
|
return
|
||||||
}
|
}
|
Loading…
Reference in New Issue
Block a user