TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-07-19 03:58:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

cmd/tsidp: use rands.HexString

Browse Source 
Change-Id: I4af086878f8f7fb7b579844125f9eae352ca4115
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
This commit is contained in:
Brad Fitzpatrick 2023-11-14 09:50:54 -08:00
parent 35d733be18
commit d72722b5b2
1 changed files with 4 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
cmd/tsidp/tsidp.go
View File

@ -8,7 +8,6 @@ import (
"crypto/x509" "crypto/x509"
"encoding/base64" "encoding/base64"
"encoding/binary" "encoding/binary"
"encoding/hex"
"encoding/json" "encoding/json"
"encoding/pem" "encoding/pem"
"flag" "flag"
@ -36,6 +35,7 @@ import (
"tailscale.com/types/views" "tailscale.com/types/views"
"tailscale.com/util/mak" "tailscale.com/util/mak"
"tailscale.com/util/must" "tailscale.com/util/must"
"tailscale.com/util/rands"
) )
var ( var (
@ -123,7 +123,7 @@ func (s *idpServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
} }
uq := r.URL.Query() uq := r.URL.Query()
code := must.Get(readHex()) code := rands.HexString(32)
ar := &authRequest{ ar := &authRequest{
nonce: uq.Get("nonce"), nonce: uq.Get("nonce"),
who: who, who: who,
@ -241,12 +241,7 @@ func (s *idpServer) serveToken(w http.ResponseWriter, r *http.Request) {
http.Error(w, err.Error(), http.StatusInternalServerError) http.Error(w, err.Error(), http.StatusInternalServerError)
return return
} }
jti, err := readHex() jti := rands.HexString(32)
if err != nil {
log.Printf("Error reading hex: %v", err)
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
who := ar.who who := ar.who
// TODO(maisem): not sure if this is the right thing to do // TODO(maisem): not sure if this is the right thing to do
@ -288,12 +283,7 @@ func (s *idpServer) serveToken(w http.ResponseWriter, r *http.Request) {
return return
} }
at, err := readHex() at := rands.HexString(32)
if err != nil {
log.Printf("Error reading hex: %v", err)
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
s.mu.Lock() s.mu.Lock()
ar.validTill = now.Add(5 * time.Minute) ar.validTill = now.Add(5 * time.Minute)
mak.Set(&s.accessToken, at, ar) mak.Set(&s.accessToken, at, ar)
@ -492,14 +482,6 @@ func mustGenRSAKey(bits int) (kid uint64, k *rsa.PrivateKey) {
return return
} }
func readHex() (string, error) {
var proxyCred [16]byte
if _, err := crand.Read(proxyCred[:]); err != nil {
return "", err
}
return hex.EncodeToString(proxyCred[:]), nil
}
// readUint64 reads from r until 8 bytes represent a non-zero uint64. // readUint64 reads from r until 8 bytes represent a non-zero uint64.
func readUint64(r io.Reader) (uint64, error) { func readUint64(r io.Reader) (uint64, error) {
for { for {