Skip to content

Commit 706c9c1

Browse files
lucacomelucacome
authored
Update JWT library to golang-jwt/jwt (#2074)
1 parent 208e138 commit 706c9c1

File tree

4 files changed

+120
-29
lines changed

4 files changed

+120
-29
lines changed

‎cmd/nginx-ingress/aws.go

Lines changed: 28 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// +build aws
1+
//go:build aws
22

33
package main
44

@@ -15,7 +15,7 @@ import (
1515
"github.com/aws/aws-sdk-go-v2/service/marketplacemetering"
1616
"github.com/aws/aws-sdk-go-v2/service/marketplacemetering/types"
1717

18-
"github.com/dgrijalva/jwt-go/v4"
18+
"github.com/golang-jwt/jwt/v4"
1919
)
2020

2121
var (
@@ -61,49 +61,52 @@ func checkAWSEntitlement() error {
6161
return err
6262
}
6363

64-
pk, err := base64.StdEncoding.DecodeString(pubKeyString)
65-
if err != nil {
66-
return fmt.Errorf("error decoding Public Key string: %w", err)
67-
}
68-
pubKey, err := jwt.ParseRSAPublicKeyFromPEM(pk)
69-
if err != nil {
70-
return fmt.Errorf("error parsing Public Key: %w", err)
71-
}
64+
token, err := jwt.ParseWithClaims(*out.Signature, &claims{}, func(token *jwt.Token) (interface{}, error) {
65+
if _, ok := token.Method.(*jwt.SigningMethodRSAPSS); !ok {
66+
return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
67+
}
7268

73-
token, err := jwt.ParseWithClaims(*out.Signature, &claims{}, jwt.KnownKeyfunc(jwt.SigningMethodPS256, pubKey))
74-
if err != nil {
75-
return fmt.Errorf("error parsing the JWT token: %w", err)
76-
}
69+
pk, err := base64.StdEncoding.DecodeString(pubKeyString)
70+
if err != nil {
71+
return nil, fmt.Errorf("error decoding Public Key string: %w", err)
72+
}
73+
pubKey, err := jwt.ParseRSAPublicKeyFromPEM(pk)
74+
if err != nil {
75+
return nil, fmt.Errorf("error parsing Public Key: %w", err)
76+
}
77+
78+
return pubKey, nil
79+
})
7780

7881
if claims, ok := token.Claims.(*claims); ok && token.Valid {
7982
if claims.ProductCode != productCode || claims.PublicKeyVersion != pubKeyVersion || claims.Nonce != nonce {
8083
return fmt.Errorf("the claims in the JWT token don't match the request")
8184
}
8285
} else {
83-
return fmt.Errorf("something is wrong with the JWT token")
86+
return fmt.Errorf("something is wrong with the JWT token: %w", err)
8487
}
85-
8688
return nil
8789
}
8890

8991
type claims struct {
90-
ProductCode string `json:"productCode,omitempty"`
91-
PublicKeyVersion int32 `json:"publicKeyVersion,omitempty"`
92-
IssuedAt *jwt.Time `json:"iat,omitempty"`
93-
Nonce string `json:"nonce,omitempty"`
92+
ProductCode string `json:"productCode,omitempty"`
93+
PublicKeyVersion int32 `json:"publicKeyVersion,omitempty"`
94+
Nonce string `json:"nonce,omitempty"`
95+
jwt.RegisteredClaims
9496
}
9597

96-
func (c claims) Valid(h *jwt.ValidationHelper) error {
98+
func (c claims) Valid() error {
9799
if c.Nonce == "" {
98-
return &jwt.InvalidClaimsError{Message: "the JWT token doesn't include the Nonce"}
100+
return jwt.NewValidationError("token doesn't include the Nonce", jwt.ValidationErrorClaimsInvalid)
99101
}
100102
if c.ProductCode == "" {
101-
return &jwt.InvalidClaimsError{Message: "the JWT token doesn't include the ProductCode"}
103+
return jwt.NewValidationError("token doesn't include the ProductCode", jwt.ValidationErrorClaimsInvalid)
102104
}
103105
if c.PublicKeyVersion == 0 {
104-
return &jwt.InvalidClaimsError{Message: "the JWT token doesn't include the PublicKeyVersion"}
106+
return jwt.NewValidationError("token doesn't include the PublicKeyVersion", jwt.ValidationErrorClaimsInvalid)
105107
}
106-
if err := h.ValidateNotBefore(c.IssuedAt); err != nil {
108+
109+
if err := c.RegisteredClaims.Valid(); err != nil {
107110
return err
108111
}
109112

‎cmd/nginx-ingress/aws_test.go

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
//go:build aws
2+
3+
package main
4+
5+
import (
6+
"errors"
7+
"testing"
8+
"time"
9+
10+
"github.com/golang-jwt/jwt/v4"
11+
)
12+
13+
func TestValidClaims(t *testing.T) {
14+
iat := *jwt.NewNumericDate(time.Now().Add(time.Hour * -1))
15+
16+
c := claims{
17+
"test",
18+
1,
19+
"nonce",
20+
jwt.RegisteredClaims{
21+
IssuedAt: &iat,
22+
},
23+
}
24+
if err := c.Valid(); err != nil {
25+
t.Fatalf("Failed to verify claims, wanted: %v got %v", nil, err)
26+
}
27+
}
28+
29+
func TestInvalidClaims(t *testing.T) {
30+
badClaims := []struct {
31+
c claims
32+
expectedError error
33+
}{
34+
{
35+
claims{
36+
"",
37+
1,
38+
"nonce",
39+
jwt.RegisteredClaims{
40+
IssuedAt: jwt.NewNumericDate(time.Now().Add(time.Hour * -1)),
41+
},
42+
},
43+
errors.New("token doesn't include the ProductCode"),
44+
},
45+
{
46+
claims{
47+
"productCode",
48+
1,
49+
"",
50+
jwt.RegisteredClaims{
51+
IssuedAt: jwt.NewNumericDate(time.Now().Add(time.Hour * -1)),
52+
},
53+
},
54+
errors.New("token doesn't include the Nonce"),
55+
},
56+
{
57+
claims{
58+
"productCode",
59+
0,
60+
"nonce",
61+
jwt.RegisteredClaims{
62+
IssuedAt: jwt.NewNumericDate(time.Now().Add(time.Hour * -1)),
63+
},
64+
},
65+
errors.New("token doesn't include the PublicKeyVersion"),
66+
},
67+
{
68+
claims{
69+
"test",
70+
1,
71+
"nonce",
72+
jwt.RegisteredClaims{
73+
IssuedAt: jwt.NewNumericDate(time.Now().Add(time.Hour * +2)),
74+
},
75+
},
76+
errors.New("token used before issued"),
77+
},
78+
}
79+
80+
for _, badC := range badClaims {
81+
82+
err := badC.c.Valid()
83+
if err == nil {
84+
t.Errorf("Valid() returned no error when it should have returned error %q", badC.expectedError)
85+
} else if err.Error() != badC.expectedError.Error() {
86+
t.Errorf("Valid() returned error %q when it should have returned error %q", err, badC.expectedError)
87+
}
88+
}
89+
}

‎go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ go 1.17
55
require (
66
github.com/aws/aws-sdk-go-v2/config v1.8.2
77
github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.5.1
8-
github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1
8+
github.com/golang-jwt/jwt/v4 v4.1.0
99
github.com/golang/glog v1.0.0
1010
github.com/google/go-cmp v0.5.6
1111
github.com/nginxinc/nginx-plus-go-client v0.8.0

‎go.sum

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,10 +145,7 @@ github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ
145145
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
146146
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
147147
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
148-
github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
149148
github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
150-
github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1 h1:CaO/zOnF8VvUfEbhRatPcwKVWamvbYd8tQGRWacE9kU=
151-
github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4=
152149
github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
153150
github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
154151
github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
@@ -220,6 +217,8 @@ github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zV
220217
github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
221218
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
222219
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
220+
github.com/golang-jwt/jwt/v4 v4.1.0 h1:XUgk2Ex5veyVFVeLm0xhusUTQybEbexJXrvPNOKkSY0=
221+
github.com/golang-jwt/jwt/v4 v4.1.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
223222
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
224223
github.com/golang/glog v1.0.0 h1:nfP3RFugxnNRyKgeWd4oI1nYvXpxrx8ck8ZrcizshdQ=
225224
github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=

0 commit comments

Comments
 (0)