From fdc245f096d67bca2388c41cb40ade2cdf207447 Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Mon, 14 Feb 2022 23:22:34 +0000 Subject: [PATCH 01/14] Attempt to fix the webauthn migration again - part 3 MariaDB now asserts that 408 characters is too long for a VARCHAR(410) I have no words. See #18756 Signed-off-by: Andrew Thornton --- models/auth/webauthn.go | 2 +- .../expected_webauthn_credential.yml | 0 .../u2f_registration.yml | 0 .../webauthn_credential.yml | 0 models/migrations/migrations.go | 4 +- models/migrations/v207.go | 2 +- models/migrations/v208.go | 2 +- models/migrations/v209.go | 133 +--------------- models/migrations/v210.go | 144 ++++++++++++++++++ .../migrations/{v209_test.go => v210_test.go} | 8 +- 10 files changed, 157 insertions(+), 138 deletions(-) rename models/migrations/fixtures/{Test_increaseCredentialIDTo410 => Test_increaseCredentialIDTo500}/expected_webauthn_credential.yml (100%) rename models/migrations/fixtures/{Test_increaseCredentialIDTo410 => Test_increaseCredentialIDTo500}/u2f_registration.yml (100%) rename models/migrations/fixtures/{Test_increaseCredentialIDTo410 => Test_increaseCredentialIDTo500}/webauthn_credential.yml (100%) create mode 100644 models/migrations/v210.go rename models/migrations/{v209_test.go => v210_test.go} (89%) diff --git a/models/auth/webauthn.go b/models/auth/webauthn.go index 9e09134662660..bf14885a0cfb1 100644 --- a/models/auth/webauthn.go +++ b/models/auth/webauthn.go @@ -43,7 +43,7 @@ type WebAuthnCredential struct { Name string LowerName string `xorm:"unique(s)"` UserID int64 `xorm:"INDEX unique(s)"` - CredentialID string `xorm:"INDEX"` + CredentialID string `xorm:"INDEX VARCHAR(500)"` PublicKey []byte AttestationType string AAGUID []byte diff --git a/models/migrations/fixtures/Test_increaseCredentialIDTo410/expected_webauthn_credential.yml b/models/migrations/fixtures/Test_increaseCredentialIDTo500/expected_webauthn_credential.yml similarity index 100% rename from models/migrations/fixtures/Test_increaseCredentialIDTo410/expected_webauthn_credential.yml rename to models/migrations/fixtures/Test_increaseCredentialIDTo500/expected_webauthn_credential.yml diff --git a/models/migrations/fixtures/Test_increaseCredentialIDTo410/u2f_registration.yml b/models/migrations/fixtures/Test_increaseCredentialIDTo500/u2f_registration.yml similarity index 100% rename from models/migrations/fixtures/Test_increaseCredentialIDTo410/u2f_registration.yml rename to models/migrations/fixtures/Test_increaseCredentialIDTo500/u2f_registration.yml diff --git a/models/migrations/fixtures/Test_increaseCredentialIDTo410/webauthn_credential.yml b/models/migrations/fixtures/Test_increaseCredentialIDTo500/webauthn_credential.yml similarity index 100% rename from models/migrations/fixtures/Test_increaseCredentialIDTo410/webauthn_credential.yml rename to models/migrations/fixtures/Test_increaseCredentialIDTo500/webauthn_credential.yml diff --git a/models/migrations/migrations.go b/models/migrations/migrations.go index bf0008f8790d4..822a5a7392fef 100644 --- a/models/migrations/migrations.go +++ b/models/migrations/migrations.go @@ -371,7 +371,9 @@ var migrations = []Migration{ // v208 -> v209 NewMigration("Use base32.HexEncoding instead of base64 encoding for cred ID as it is case insensitive", useBase32HexForCredIDInWebAuthnCredential), // v209 -> v210 - NewMigration("Increase WebAuthentication CredentialID size to 410", increaseCredentialIDTo410), + NewMigration("Increase WebAuthentication CredentialID size to 410 - NOOPED", increaseCredentialIDTo410), + // v210 -> v211 + NewMigration("Increase WebAuthentication CredentialID size to 500", increaseCredentialIDTo500), } // GetCurrentDBVersion returns the current db version diff --git a/models/migrations/v207.go b/models/migrations/v207.go index 2165f279042a0..56b90907c28d2 100644 --- a/models/migrations/v207.go +++ b/models/migrations/v207.go @@ -23,7 +23,7 @@ func addWebAuthnCred(x *xorm.Engine) error { Name string LowerName string `xorm:"unique(s)"` UserID int64 `xorm:"INDEX unique(s)"` - CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety + CredentialID string `xorm:"INDEX VARCHAR(500)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety PublicKey []byte AttestationType string AAGUID []byte diff --git a/models/migrations/v208.go b/models/migrations/v208.go index e5796eb18fbf5..022423a59956e 100644 --- a/models/migrations/v208.go +++ b/models/migrations/v208.go @@ -16,7 +16,7 @@ func useBase32HexForCredIDInWebAuthnCredential(x *xorm.Engine) error { // Create webauthnCredential table type webauthnCredential struct { ID int64 `xorm:"pk autoincr"` - CredentialID string `xorm:"INDEX VARCHAR(410)"` + CredentialID string `xorm:"INDEX VARCHAR(500)"` } if err := x.Sync2(&webauthnCredential{}); err != nil { return err diff --git a/models/migrations/v209.go b/models/migrations/v209.go index b4295d62faa06..942143bda61c8 100644 --- a/models/migrations/v209.go +++ b/models/migrations/v209.go @@ -5,140 +5,13 @@ package migrations import ( - "encoding/base32" - "fmt" - "strings" - - "code.gitea.io/gitea/modules/timeutil" - - "github.com/tstranex/u2f" "xorm.io/xorm" - "xorm.io/xorm/schemas" ) func increaseCredentialIDTo410(x *xorm.Engine) error { - // Create webauthnCredential table - type webauthnCredential struct { - ID int64 `xorm:"pk autoincr"` - Name string - LowerName string `xorm:"unique(s)"` - UserID int64 `xorm:"INDEX unique(s)"` - CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety - PublicKey []byte - AttestationType string - AAGUID []byte - SignCount uint32 `xorm:"BIGINT"` - CloneWarning bool - CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"` - UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"` - } - if err := x.Sync2(&webauthnCredential{}); err != nil { - return err - } - - switch x.Dialect().URI().DBType { - case schemas.MYSQL: - _, err := x.Exec("ALTER TABLE webauthn_credential MODIFY COLUMN credential_id VARCHAR(410)") - if err != nil { - return err - } - case schemas.ORACLE: - _, err := x.Exec("ALTER TABLE webauthn_credential MODIFY credential_id VARCHAR(410)") - if err != nil { - return err - } - case schemas.MSSQL: - // This column has an index on it. I could write all of the code to attempt to change the index OR - // I could just use recreate table. - sess := x.NewSession() - if err := sess.Begin(); err != nil { - _ = sess.Close() - return err - } - - if err := recreateTable(sess, new(webauthnCredential)); err != nil { - _ = sess.Close() - return err - } - if err := sess.Commit(); err != nil { - _ = sess.Close() - return err - } - if err := sess.Close(); err != nil { - return err - } - case schemas.POSTGRES: - _, err := x.Exec("ALTER TABLE webauthn_credential ALTER COLUMN credential_id TYPE VARCHAR(410)") - if err != nil { - return err - } - default: - // SQLite doesn't support ALTER COLUMN, and it already makes String _TEXT_ by default so no migration needed - // nor is there any need to re-migrate - return nil - } - - exist, err := x.IsTableExist("u2f_registration") - if err != nil { - return err - } - if !exist { - return nil - } - - // Now migrate the old u2f registrations to the new format - type u2fRegistration struct { - ID int64 `xorm:"pk autoincr"` - Name string - UserID int64 `xorm:"INDEX"` - Raw []byte - Counter uint32 `xorm:"BIGINT"` - CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"` - UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"` - } - - var start int - regs := make([]*u2fRegistration, 0, 50) - for { - err := x.OrderBy("id").Limit(50, start).Find(®s) - if err != nil { - return err - } - - for _, reg := range regs { - parsed := new(u2f.Registration) - err = parsed.UnmarshalBinary(reg.Raw) - if err != nil { - continue - } - - cred := &webauthnCredential{} - has, err := x.ID(reg.ID).Where("id = ? AND user_id = ?", reg.ID, reg.UserID).Get(cred) - if err != nil { - return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %v", reg.ID, err) - } - if !has { - continue - } - remigratedCredID := base32.HexEncoding.EncodeToString(parsed.KeyHandle) - if cred.CredentialID == remigratedCredID || (!strings.HasPrefix(remigratedCredID, cred.CredentialID) && cred.CredentialID != "") { - continue - } - - cred.CredentialID = remigratedCredID - - _, err = x.ID(cred.ID).Update(cred) - if err != nil { - return err - } - } - - if len(regs) < 50 { - break - } - start += 50 - regs = regs[:0] - } + // no-op + // MariaDB asserts that 408 characters is too long for a VARCHAR(410) so this migration is clearly wrong. + // So now we have to no-op again. return nil } diff --git a/models/migrations/v210.go b/models/migrations/v210.go new file mode 100644 index 0000000000000..c7c42944ccf11 --- /dev/null +++ b/models/migrations/v210.go @@ -0,0 +1,144 @@ +// Copyright 2022 The Gitea Authors. All rights reserved. +// Use of this source code is governed by a MIT-style +// license that can be found in the LICENSE file. + +package migrations + +import ( + "encoding/base32" + "fmt" + "strings" + + "code.gitea.io/gitea/modules/timeutil" + "github.com/tstranex/u2f" + + "xorm.io/xorm" + "xorm.io/xorm/schemas" +) + +// MariaDB asserts that 408 is too long for a VARCHAR(410) so now we need 500 +func increaseCredentialIDTo500(x *xorm.Engine) error { + // Create webauthnCredential table + type webauthnCredential struct { + ID int64 `xorm:"pk autoincr"` + Name string + LowerName string `xorm:"unique(s)"` + UserID int64 `xorm:"INDEX unique(s)"` + CredentialID string `xorm:"INDEX VARCHAR(500)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety + PublicKey []byte + AttestationType string + AAGUID []byte + SignCount uint32 `xorm:"BIGINT"` + CloneWarning bool + CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"` + UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"` + } + if err := x.Sync2(&webauthnCredential{}); err != nil { + return err + } + + switch x.Dialect().URI().DBType { + case schemas.MYSQL: + _, err := x.Exec("ALTER TABLE webauthn_credential MODIFY COLUMN credential_id VARCHAR(500)") + if err != nil { + return err + } + case schemas.ORACLE: + _, err := x.Exec("ALTER TABLE webauthn_credential MODIFY credential_id VARCHAR(500)") + if err != nil { + return err + } + case schemas.MSSQL: + // This column has an index on it. I could write all of the code to attempt to change the index OR + // I could just use recreate table. + sess := x.NewSession() + if err := sess.Begin(); err != nil { + _ = sess.Close() + return err + } + + if err := recreateTable(sess, new(webauthnCredential)); err != nil { + _ = sess.Close() + return err + } + if err := sess.Commit(); err != nil { + _ = sess.Close() + return err + } + if err := sess.Close(); err != nil { + return err + } + case schemas.POSTGRES: + _, err := x.Exec("ALTER TABLE webauthn_credential ALTER COLUMN credential_id TYPE VARCHAR(500)") + if err != nil { + return err + } + default: + // SQLite doesn't support ALTER COLUMN, and it already makes String _TEXT_ by default so no migration needed + // nor is there any need to re-migrate + } + + exist, err := x.IsTableExist("u2f_registration") + if err != nil { + return err + } + if !exist { + return nil + } + + // Now migrate the old u2f registrations to the new format + type u2fRegistration struct { + ID int64 `xorm:"pk autoincr"` + Name string + UserID int64 `xorm:"INDEX"` + Raw []byte + Counter uint32 `xorm:"BIGINT"` + CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"` + UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"` + } + + var start int + regs := make([]*u2fRegistration, 0, 50) + for { + err := x.OrderBy("id").Limit(50, start).Find(®s) + if err != nil { + return err + } + + for _, reg := range regs { + parsed := new(u2f.Registration) + err = parsed.UnmarshalBinary(reg.Raw) + if err != nil { + continue + } + + cred := &webauthnCredential{} + has, err := x.ID(reg.ID).Where("id = ? AND user_id = ?", reg.ID, reg.UserID).Get(cred) + if err != nil { + return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %v", reg.ID, err) + } + if !has { + continue + } + remigratedCredID := base32.HexEncoding.EncodeToString(parsed.KeyHandle) + if cred.CredentialID == remigratedCredID || (!strings.HasPrefix(remigratedCredID, cred.CredentialID) && cred.CredentialID != "") { + continue + } + + cred.CredentialID = remigratedCredID + + _, err = x.ID(cred.ID).Update(cred) + if err != nil { + return err + } + } + + if len(regs) < 50 { + break + } + start += 50 + regs = regs[:0] + } + + return nil +} diff --git a/models/migrations/v209_test.go b/models/migrations/v210_test.go similarity index 89% rename from models/migrations/v209_test.go rename to models/migrations/v210_test.go index a929f95adc9c1..09c9116e04086 100644 --- a/models/migrations/v209_test.go +++ b/models/migrations/v210_test.go @@ -12,14 +12,14 @@ import ( "xorm.io/xorm/schemas" ) -func Test_increaseCredentialIDTo410(t *testing.T) { +func Test_increaseCredentialIDTo500(t *testing.T) { // Create webauthnCredential table type WebauthnCredential struct { ID int64 `xorm:"pk autoincr"` Name string LowerName string `xorm:"unique(s)"` UserID int64 `xorm:"INDEX unique(s)"` - CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety + CredentialID string `xorm:"INDEX VARCHAR(500)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety PublicKey []byte AttestationType string SignCount uint32 `xorm:"BIGINT"` @@ -39,7 +39,7 @@ func Test_increaseCredentialIDTo410(t *testing.T) { type ExpectedWebauthnCredential struct { ID int64 `xorm:"pk autoincr"` - CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety + CredentialID string `xorm:"INDEX VARCHAR(500)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety } // Prepare and load the testing database @@ -55,7 +55,7 @@ func Test_increaseCredentialIDTo410(t *testing.T) { } // Run the migration - if err := increaseCredentialIDTo410(x); err != nil { + if err := increaseCredentialIDTo500(x); err != nil { assert.NoError(t, err) return } From 4c37c8d7944d5f507e75f18231d8abc165dc646f Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Tue, 15 Feb 2022 00:26:13 +0000 Subject: [PATCH 02/14] 208 is totally broken Signed-off-by: Andrew Thornton --- models/migrations/v208.go | 39 +-------------------------------------- models/migrations/v210.go | 21 ++++++++++++++------- 2 files changed, 15 insertions(+), 45 deletions(-) diff --git a/models/migrations/v208.go b/models/migrations/v208.go index 022423a59956e..28754061214fd 100644 --- a/models/migrations/v208.go +++ b/models/migrations/v208.go @@ -5,47 +5,10 @@ package migrations import ( - "encoding/base32" - "encoding/base64" - "xorm.io/xorm" ) func useBase32HexForCredIDInWebAuthnCredential(x *xorm.Engine) error { - - // Create webauthnCredential table - type webauthnCredential struct { - ID int64 `xorm:"pk autoincr"` - CredentialID string `xorm:"INDEX VARCHAR(500)"` - } - if err := x.Sync2(&webauthnCredential{}); err != nil { - return err - } - - var start int - regs := make([]*webauthnCredential, 0, 50) - for { - err := x.OrderBy("id").Limit(50, start).Find(®s) - if err != nil { - return err - } - - for _, reg := range regs { - credID, _ := base64.RawStdEncoding.DecodeString(reg.CredentialID) - reg.CredentialID = base32.HexEncoding.EncodeToString(credID) - - _, err := x.Update(reg) - if err != nil { - return err - } - } - - if len(regs) < 50 { - break - } - start += 50 - regs = regs[:0] - } - + // noop return nil } diff --git a/models/migrations/v210.go b/models/migrations/v210.go index c7c42944ccf11..683b195e1e020 100644 --- a/models/migrations/v210.go +++ b/models/migrations/v210.go @@ -5,6 +5,7 @@ package migrations import ( + "crypto/elliptic" "encoding/base32" "fmt" "strings" @@ -113,21 +114,27 @@ func increaseCredentialIDTo500(x *xorm.Engine) error { } cred := &webauthnCredential{} - has, err := x.ID(reg.ID).Where("id = ? AND user_id = ?", reg.ID, reg.UserID).Get(cred) + has, err := x.ID(reg.ID).Where("id = ?", reg.ID).Get(cred) if err != nil { return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %v", reg.ID, err) } if !has { continue } - remigratedCredID := base32.HexEncoding.EncodeToString(parsed.KeyHandle) - if cred.CredentialID == remigratedCredID || (!strings.HasPrefix(remigratedCredID, cred.CredentialID) && cred.CredentialID != "") { - continue - } - cred.CredentialID = remigratedCredID + c := &webauthnCredential{ + ID: reg.ID, + Name: reg.Name, + LowerName: strings.ToLower(reg.Name), + UserID: reg.UserID, + CredentialID: base32.HexEncoding.EncodeToString(parsed.KeyHandle), + PublicKey: elliptic.Marshal(elliptic.P256(), parsed.PubKey.X, parsed.PubKey.Y), + AttestationType: "fido-u2f", + AAGUID: []byte{}, + SignCount: reg.Counter, + } - _, err = x.ID(cred.ID).Update(cred) + _, err = x.ID(c.ID).Update(c) if err != nil { return err } From 995aef7c56b76a993df41d03326616f74b0a1424 Mon Sep 17 00:00:00 2001 From: zeripath Date: Tue, 15 Feb 2022 00:53:32 +0000 Subject: [PATCH 03/14] Update expected_webauthn_credential.yml --- .../expected_webauthn_credential.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/models/migrations/fixtures/Test_increaseCredentialIDTo500/expected_webauthn_credential.yml b/models/migrations/fixtures/Test_increaseCredentialIDTo500/expected_webauthn_credential.yml index 36b011a9d3da5..6a60e0df07c83 100644 --- a/models/migrations/fixtures/Test_increaseCredentialIDTo500/expected_webauthn_credential.yml +++ b/models/migrations/fixtures/Test_increaseCredentialIDTo500/expected_webauthn_credential.yml @@ -6,4 +6,4 @@ credential_id: "TVHE44TOH7DF7V48SEAIT3EMMJ7TGBOQ289E5AQB34S98LFCUFJ7U2NAVI8RJG6K2F4TC8AQ8KBNO7AGEOQOL9NE43GR63HTEHJSLOG=" - id: 4 - credential_id: "THIS SHOULD NOT CHAGNGE" + credential_id: "TVHE44TOH7DF7V48SEAIT3EMMJ7TGBOQ289E5AQB34S98LFCUFJ7U2NAVI8RJG6K2F4TC8AQ8KBNO7AGEOQOL9NE43GR63HTEHJSLOG=" From b83fe3220bd59d5ac80021baed4ece96461fe659 Mon Sep 17 00:00:00 2001 From: zeripath Date: Tue, 15 Feb 2022 00:54:49 +0000 Subject: [PATCH 04/14] Update models/migrations/v209.go --- models/migrations/v209.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/models/migrations/v209.go b/models/migrations/v209.go index 942143bda61c8..ac03f11cc17dd 100644 --- a/models/migrations/v209.go +++ b/models/migrations/v209.go @@ -10,7 +10,7 @@ import ( func increaseCredentialIDTo410(x *xorm.Engine) error { // no-op - // MariaDB asserts that 408 characters is too long for a VARCHAR(410) so this migration is clearly wrong. + // V208 is badly broken // So now we have to no-op again. return nil From 076866c3ce2d8971bc1c2c6aa2fae21013ed0032 Mon Sep 17 00:00:00 2001 From: zeripath Date: Tue, 15 Feb 2022 00:56:01 +0000 Subject: [PATCH 05/14] Update webauthn_credential.yml --- .../Test_increaseCredentialIDTo500/webauthn_credential.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/models/migrations/fixtures/Test_increaseCredentialIDTo500/webauthn_credential.yml b/models/migrations/fixtures/Test_increaseCredentialIDTo500/webauthn_credential.yml index 0adf1bc8e2aa2..7f9f10f89a631 100644 --- a/models/migrations/fixtures/Test_increaseCredentialIDTo500/webauthn_credential.yml +++ b/models/migrations/fixtures/Test_increaseCredentialIDTo500/webauthn_credential.yml @@ -23,7 +23,7 @@ lower_name: "u2fkey-wrong-user-id" name: "u2fkey-wrong-user-id" user_id: 1 - credential_id: "THIS SHOULD NOT CHAGNGE" + credential_id: "THIS SHOULD CHANGE" public_key: 0x040d0967a2cad045011631187576492a0beb5b377954b4f694c5afc8bdf25270f87f09a9ab6ce9c282f447ba71b2f2bae2105b32b847e0704f310f48644e3eddf2 attestation_type: 'fido-u2f' sign_count: 1 From 743e35d301d115f8c9d116a0fba1a481e30d3cd6 Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Tue, 15 Feb 2022 10:22:08 +0000 Subject: [PATCH 06/14] Restructure - back to 410 but always reinsert Signed-off-by: Andrew Thornton --- models/auth/webauthn.go | 2 +- .../expected_webauthn_credential.yml | 0 .../u2f_registration.yml | 0 .../webauthn_credential.yml | 0 models/migrations/v207.go | 2 +- models/migrations/v210.go | 36 ++++++++++--------- models/migrations/v210_test.go | 6 ++-- 7 files changed, 25 insertions(+), 21 deletions(-) rename models/migrations/fixtures/{Test_increaseCredentialIDTo500 => Test_increaseCredentialIDTo410}/expected_webauthn_credential.yml (100%) rename models/migrations/fixtures/{Test_increaseCredentialIDTo500 => Test_increaseCredentialIDTo410}/u2f_registration.yml (100%) rename models/migrations/fixtures/{Test_increaseCredentialIDTo500 => Test_increaseCredentialIDTo410}/webauthn_credential.yml (100%) diff --git a/models/auth/webauthn.go b/models/auth/webauthn.go index bf14885a0cfb1..1813a68193b74 100644 --- a/models/auth/webauthn.go +++ b/models/auth/webauthn.go @@ -43,7 +43,7 @@ type WebAuthnCredential struct { Name string LowerName string `xorm:"unique(s)"` UserID int64 `xorm:"INDEX unique(s)"` - CredentialID string `xorm:"INDEX VARCHAR(500)"` + CredentialID string `xorm:"INDEX VARCHAR(410)"` PublicKey []byte AttestationType string AAGUID []byte diff --git a/models/migrations/fixtures/Test_increaseCredentialIDTo500/expected_webauthn_credential.yml b/models/migrations/fixtures/Test_increaseCredentialIDTo410/expected_webauthn_credential.yml similarity index 100% rename from models/migrations/fixtures/Test_increaseCredentialIDTo500/expected_webauthn_credential.yml rename to models/migrations/fixtures/Test_increaseCredentialIDTo410/expected_webauthn_credential.yml diff --git a/models/migrations/fixtures/Test_increaseCredentialIDTo500/u2f_registration.yml b/models/migrations/fixtures/Test_increaseCredentialIDTo410/u2f_registration.yml similarity index 100% rename from models/migrations/fixtures/Test_increaseCredentialIDTo500/u2f_registration.yml rename to models/migrations/fixtures/Test_increaseCredentialIDTo410/u2f_registration.yml diff --git a/models/migrations/fixtures/Test_increaseCredentialIDTo500/webauthn_credential.yml b/models/migrations/fixtures/Test_increaseCredentialIDTo410/webauthn_credential.yml similarity index 100% rename from models/migrations/fixtures/Test_increaseCredentialIDTo500/webauthn_credential.yml rename to models/migrations/fixtures/Test_increaseCredentialIDTo410/webauthn_credential.yml diff --git a/models/migrations/v207.go b/models/migrations/v207.go index 56b90907c28d2..2165f279042a0 100644 --- a/models/migrations/v207.go +++ b/models/migrations/v207.go @@ -23,7 +23,7 @@ func addWebAuthnCred(x *xorm.Engine) error { Name string LowerName string `xorm:"unique(s)"` UserID int64 `xorm:"INDEX unique(s)"` - CredentialID string `xorm:"INDEX VARCHAR(500)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety + CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety PublicKey []byte AttestationType string AAGUID []byte diff --git a/models/migrations/v210.go b/models/migrations/v210.go index 683b195e1e020..487d3ecaee0ef 100644 --- a/models/migrations/v210.go +++ b/models/migrations/v210.go @@ -25,7 +25,7 @@ func increaseCredentialIDTo500(x *xorm.Engine) error { Name string LowerName string `xorm:"unique(s)"` UserID int64 `xorm:"INDEX unique(s)"` - CredentialID string `xorm:"INDEX VARCHAR(500)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety + CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety PublicKey []byte AttestationType string AAGUID []byte @@ -40,12 +40,12 @@ func increaseCredentialIDTo500(x *xorm.Engine) error { switch x.Dialect().URI().DBType { case schemas.MYSQL: - _, err := x.Exec("ALTER TABLE webauthn_credential MODIFY COLUMN credential_id VARCHAR(500)") + _, err := x.Exec("ALTER TABLE webauthn_credential MODIFY COLUMN credential_id VARCHAR(410)") if err != nil { return err } case schemas.ORACLE: - _, err := x.Exec("ALTER TABLE webauthn_credential MODIFY credential_id VARCHAR(500)") + _, err := x.Exec("ALTER TABLE webauthn_credential MODIFY credential_id VARCHAR(410)") if err != nil { return err } @@ -70,7 +70,7 @@ func increaseCredentialIDTo500(x *xorm.Engine) error { return err } case schemas.POSTGRES: - _, err := x.Exec("ALTER TABLE webauthn_credential ALTER COLUMN credential_id TYPE VARCHAR(500)") + _, err := x.Exec("ALTER TABLE webauthn_credential ALTER COLUMN credential_id TYPE VARCHAR(410)") if err != nil { return err } @@ -112,17 +112,7 @@ func increaseCredentialIDTo500(x *xorm.Engine) error { if err != nil { continue } - - cred := &webauthnCredential{} - has, err := x.ID(reg.ID).Where("id = ?", reg.ID).Get(cred) - if err != nil { - return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %v", reg.ID, err) - } - if !has { - continue - } - - c := &webauthnCredential{ + remigrated := &webauthnCredential{ ID: reg.ID, Name: reg.Name, LowerName: strings.ToLower(reg.Name), @@ -132,9 +122,23 @@ func increaseCredentialIDTo500(x *xorm.Engine) error { AttestationType: "fido-u2f", AAGUID: []byte{}, SignCount: reg.Counter, + UpdatedUnix: reg.UpdatedUnix, + CreatedUnix: reg.CreatedUnix, + } + + has, err := x.ID(reg.ID).Where("id = ?", reg.ID).Get(new(webauthnCredential)) + if err != nil { + return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %v", reg.ID, err) + } + if has { + _, err = x.ID(remigrated.ID).AllCols().Insert(remigrated) + if err != nil { + return err + } + continue } - _, err = x.ID(c.ID).Update(c) + _, err = x.ID(remigrated.ID).AllCols().Update(remigrated) if err != nil { return err } diff --git a/models/migrations/v210_test.go b/models/migrations/v210_test.go index 09c9116e04086..d5c9f5851492e 100644 --- a/models/migrations/v210_test.go +++ b/models/migrations/v210_test.go @@ -12,14 +12,14 @@ import ( "xorm.io/xorm/schemas" ) -func Test_increaseCredentialIDTo500(t *testing.T) { +func Test_increaseCredentialIDTo410(t *testing.T) { // Create webauthnCredential table type WebauthnCredential struct { ID int64 `xorm:"pk autoincr"` Name string LowerName string `xorm:"unique(s)"` UserID int64 `xorm:"INDEX unique(s)"` - CredentialID string `xorm:"INDEX VARCHAR(500)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety + CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety PublicKey []byte AttestationType string SignCount uint32 `xorm:"BIGINT"` @@ -39,7 +39,7 @@ func Test_increaseCredentialIDTo500(t *testing.T) { type ExpectedWebauthnCredential struct { ID int64 `xorm:"pk autoincr"` - CredentialID string `xorm:"INDEX VARCHAR(500)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety + CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety } // Prepare and load the testing database From 046158428c8c223d29e04bb595d3579a25454fd0 Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Tue, 15 Feb 2022 10:27:08 +0000 Subject: [PATCH 07/14] renames Signed-off-by: Andrew Thornton --- .../expected_webauthn_credential.yml | 0 .../u2f_registration.yml | 0 .../webauthn_credential.yml | 0 models/migrations/migrations.go | 4 ++-- models/migrations/v210.go | 4 ++-- models/migrations/v210_test.go | 4 ++-- 6 files changed, 6 insertions(+), 6 deletions(-) rename models/migrations/fixtures/{Test_increaseCredentialIDTo410 => Test_remigrateU2FCredentials}/expected_webauthn_credential.yml (100%) rename models/migrations/fixtures/{Test_increaseCredentialIDTo410 => Test_remigrateU2FCredentials}/u2f_registration.yml (100%) rename models/migrations/fixtures/{Test_increaseCredentialIDTo410 => Test_remigrateU2FCredentials}/webauthn_credential.yml (100%) diff --git a/models/migrations/fixtures/Test_increaseCredentialIDTo410/expected_webauthn_credential.yml b/models/migrations/fixtures/Test_remigrateU2FCredentials/expected_webauthn_credential.yml similarity index 100% rename from models/migrations/fixtures/Test_increaseCredentialIDTo410/expected_webauthn_credential.yml rename to models/migrations/fixtures/Test_remigrateU2FCredentials/expected_webauthn_credential.yml diff --git a/models/migrations/fixtures/Test_increaseCredentialIDTo410/u2f_registration.yml b/models/migrations/fixtures/Test_remigrateU2FCredentials/u2f_registration.yml similarity index 100% rename from models/migrations/fixtures/Test_increaseCredentialIDTo410/u2f_registration.yml rename to models/migrations/fixtures/Test_remigrateU2FCredentials/u2f_registration.yml diff --git a/models/migrations/fixtures/Test_increaseCredentialIDTo410/webauthn_credential.yml b/models/migrations/fixtures/Test_remigrateU2FCredentials/webauthn_credential.yml similarity index 100% rename from models/migrations/fixtures/Test_increaseCredentialIDTo410/webauthn_credential.yml rename to models/migrations/fixtures/Test_remigrateU2FCredentials/webauthn_credential.yml diff --git a/models/migrations/migrations.go b/models/migrations/migrations.go index 822a5a7392fef..22d06eac27f71 100644 --- a/models/migrations/migrations.go +++ b/models/migrations/migrations.go @@ -369,11 +369,11 @@ var migrations = []Migration{ // v207 -> v208 NewMigration("Add webauthn table and migrate u2f data to webauthn", addWebAuthnCred), // v208 -> v209 - NewMigration("Use base32.HexEncoding instead of base64 encoding for cred ID as it is case insensitive", useBase32HexForCredIDInWebAuthnCredential), + NewMigration("Use base32.HexEncoding instead of base64 encoding for cred ID as it is case insensitive - NOOPED", useBase32HexForCredIDInWebAuthnCredential), // v209 -> v210 NewMigration("Increase WebAuthentication CredentialID size to 410 - NOOPED", increaseCredentialIDTo410), // v210 -> v211 - NewMigration("Increase WebAuthentication CredentialID size to 500", increaseCredentialIDTo500), + NewMigration("v208 was completely broken - remigrate", remigrateU2FCredentials), } // GetCurrentDBVersion returns the current db version diff --git a/models/migrations/v210.go b/models/migrations/v210.go index 487d3ecaee0ef..55db5cb9ed568 100644 --- a/models/migrations/v210.go +++ b/models/migrations/v210.go @@ -17,8 +17,8 @@ import ( "xorm.io/xorm/schemas" ) -// MariaDB asserts that 408 is too long for a VARCHAR(410) so now we need 500 -func increaseCredentialIDTo500(x *xorm.Engine) error { +// v208 migration was completely broken +func remigrateU2FCredentials(x *xorm.Engine) error { // Create webauthnCredential table type webauthnCredential struct { ID int64 `xorm:"pk autoincr"` diff --git a/models/migrations/v210_test.go b/models/migrations/v210_test.go index d5c9f5851492e..3e10b3ce80a25 100644 --- a/models/migrations/v210_test.go +++ b/models/migrations/v210_test.go @@ -12,7 +12,7 @@ import ( "xorm.io/xorm/schemas" ) -func Test_increaseCredentialIDTo410(t *testing.T) { +func Test_remigrateU2FCredentials(t *testing.T) { // Create webauthnCredential table type WebauthnCredential struct { ID int64 `xorm:"pk autoincr"` @@ -55,7 +55,7 @@ func Test_increaseCredentialIDTo410(t *testing.T) { } // Run the migration - if err := increaseCredentialIDTo500(x); err != nil { + if err := remigrateU2FCredentials(x); err != nil { assert.NoError(t, err) return } From e50dd62a018626515857a3acfecdb6b4c877c02a Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Tue, 15 Feb 2022 10:37:55 +0000 Subject: [PATCH 08/14] Gah! Signed-off-by: Andrew Thornton --- models/migrations/v210.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/models/migrations/v210.go b/models/migrations/v210.go index 55db5cb9ed568..af68476e79fbe 100644 --- a/models/migrations/v210.go +++ b/models/migrations/v210.go @@ -130,7 +130,7 @@ func remigrateU2FCredentials(x *xorm.Engine) error { if err != nil { return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %v", reg.ID, err) } - if has { + if !has { _, err = x.ID(remigrated.ID).AllCols().Insert(remigrated) if err != nil { return err From 3b1e85cafad6abe7d797345b9ce39cf9cfa94519 Mon Sep 17 00:00:00 2001 From: zeripath Date: Tue, 15 Feb 2022 11:49:57 +0000 Subject: [PATCH 09/14] Update models/migrations/v210.go --- models/migrations/v210.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/models/migrations/v210.go b/models/migrations/v210.go index af68476e79fbe..087e26ce2fc1f 100644 --- a/models/migrations/v210.go +++ b/models/migrations/v210.go @@ -131,7 +131,7 @@ func remigrateU2FCredentials(x *xorm.Engine) error { return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %v", reg.ID, err) } if !has { - _, err = x.ID(remigrated.ID).AllCols().Insert(remigrated) + _, err = x.Insert(remigrated) if err != nil { return err } From 84d9f60e168519eff07af42c7c79b90abd502ef4 Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Tue, 15 Feb 2022 12:57:58 +0000 Subject: [PATCH 10/14] fix test Signed-off-by: Andrew Thornton --- .../expected_webauthn_credential.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/models/migrations/fixtures/Test_remigrateU2FCredentials/expected_webauthn_credential.yml b/models/migrations/fixtures/Test_remigrateU2FCredentials/expected_webauthn_credential.yml index 6a60e0df07c83..0e68a5d012478 100644 --- a/models/migrations/fixtures/Test_remigrateU2FCredentials/expected_webauthn_credential.yml +++ b/models/migrations/fixtures/Test_remigrateU2FCredentials/expected_webauthn_credential.yml @@ -4,6 +4,9 @@ - id: 2 credential_id: "TVHE44TOH7DF7V48SEAIT3EMMJ7TGBOQ289E5AQB34S98LFCUFJ7U2NAVI8RJG6K2F4TC8AQ8KBNO7AGEOQOL9NE43GR63HTEHJSLOG=" +- + id: 3 + credential_id: "TVHE44TOH7DF7V48SEAIT3EMMJ7TGBOQ289E5AQB34S98LFCUFJ7U2NAVI8RJG6K2F4TC8AQ8KBNO7AGEOQOL9NE43GR63HTEHJSLOG=" - id: 4 credential_id: "TVHE44TOH7DF7V48SEAIT3EMMJ7TGBOQ289E5AQB34S98LFCUFJ7U2NAVI8RJG6K2F4TC8AQ8KBNO7AGEOQOL9NE43GR63HTEHJSLOG=" From 8cd27a3f1b64559a80c21a31fdc6b7bdbeaea88d Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Tue, 15 Feb 2022 16:07:07 +0000 Subject: [PATCH 11/14] no-op v207 Signed-off-by: Andrew Thornton --- models/migrations/migrations.go | 6 +-- models/migrations/v207.go | 78 +-------------------------------- 2 files changed, 4 insertions(+), 80 deletions(-) diff --git a/models/migrations/migrations.go b/models/migrations/migrations.go index 22d06eac27f71..63d1c32259964 100644 --- a/models/migrations/migrations.go +++ b/models/migrations/migrations.go @@ -367,11 +367,11 @@ var migrations = []Migration{ // v206 -> v207 NewMigration("Add authorize column to team_unit table", addAuthorizeColForTeamUnit), // v207 -> v208 - NewMigration("Add webauthn table and migrate u2f data to webauthn", addWebAuthnCred), + NewMigration("Add webauthn table and migrate u2f data to webauthn - NO-OPED", addWebAuthnCred), // v208 -> v209 - NewMigration("Use base32.HexEncoding instead of base64 encoding for cred ID as it is case insensitive - NOOPED", useBase32HexForCredIDInWebAuthnCredential), + NewMigration("Use base32.HexEncoding instead of base64 encoding for cred ID as it is case insensitive - NO-OPED", useBase32HexForCredIDInWebAuthnCredential), // v209 -> v210 - NewMigration("Increase WebAuthentication CredentialID size to 410 - NOOPED", increaseCredentialIDTo410), + NewMigration("Increase WebAuthentication CredentialID size to 410 - NO-OPED", increaseCredentialIDTo410), // v210 -> v211 NewMigration("v208 was completely broken - remigrate", remigrateU2FCredentials), } diff --git a/models/migrations/v207.go b/models/migrations/v207.go index 2165f279042a0..f60dfc3dc359f 100644 --- a/models/migrations/v207.go +++ b/models/migrations/v207.go @@ -5,87 +5,11 @@ package migrations import ( - "crypto/elliptic" - "encoding/base64" - "strings" - - "code.gitea.io/gitea/modules/timeutil" - - "github.com/tstranex/u2f" "xorm.io/xorm" ) func addWebAuthnCred(x *xorm.Engine) error { - - // Create webauthnCredential table - type webauthnCredential struct { - ID int64 `xorm:"pk autoincr"` - Name string - LowerName string `xorm:"unique(s)"` - UserID int64 `xorm:"INDEX unique(s)"` - CredentialID string `xorm:"INDEX VARCHAR(410)"` // CredentalID in U2F is at most 255bytes / 5 * 8 = 408 - add a few extra characters for safety - PublicKey []byte - AttestationType string - AAGUID []byte - SignCount uint32 `xorm:"BIGINT"` - CloneWarning bool - CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"` - UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"` - } - if err := x.Sync2(&webauthnCredential{}); err != nil { - return err - } - - // Now migrate the old u2f registrations to the new format - type u2fRegistration struct { - ID int64 `xorm:"pk autoincr"` - Name string - UserID int64 `xorm:"INDEX"` - Raw []byte - Counter uint32 `xorm:"BIGINT"` - CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"` - UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"` - } - - var start int - regs := make([]*u2fRegistration, 0, 50) - for { - err := x.OrderBy("id").Limit(50, start).Find(®s) - if err != nil { - return err - } - - for _, reg := range regs { - parsed := new(u2f.Registration) - err = parsed.UnmarshalBinary(reg.Raw) - if err != nil { - continue - } - - c := &webauthnCredential{ - ID: reg.ID, - Name: reg.Name, - LowerName: strings.ToLower(reg.Name), - UserID: reg.UserID, - CredentialID: base64.RawStdEncoding.EncodeToString(parsed.KeyHandle), - PublicKey: elliptic.Marshal(elliptic.P256(), parsed.PubKey.X, parsed.PubKey.Y), - AttestationType: "fido-u2f", - AAGUID: []byte{}, - SignCount: reg.Counter, - } - - _, err := x.Insert(c) - if err != nil { - return err - } - } - - if len(regs) < 50 { - break - } - start += 50 - regs = regs[:0] - } + // NO-OP Don't migrate here - let v210 do this. return nil } From a1c5cbfb64940e17c241924807c0d958953afa8e Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Wed, 16 Feb 2022 17:48:05 +0000 Subject: [PATCH 12/14] Set IDENTITY_INSERT for MSSQL Signed-off-by: Andrew Thornton --- models/migrations/v210.go | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/models/migrations/v210.go b/models/migrations/v210.go index 087e26ce2fc1f..2ed9e5a0cdca4 100644 --- a/models/migrations/v210.go +++ b/models/migrations/v210.go @@ -128,19 +128,29 @@ func remigrateU2FCredentials(x *xorm.Engine) error { has, err := x.ID(reg.ID).Where("id = ?", reg.ID).Get(new(webauthnCredential)) if err != nil { - return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %v", reg.ID, err) + return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %w", reg.ID, err) } if !has { + if x.Dialect().URI().DBType == schemas.MSSQL { + if _, err := x.Exec("SET IDENTITY_INSERT `%s` ON", "webauthn_credential"); err != nil { + return fmt.Errorf("unable to allow identity insert on webauthn_credential[%d]. Error: %w", reg.ID, err) + } + } _, err = x.Insert(remigrated) if err != nil { - return err + return fmt.Errorf("unable to (re)insert webauthn_credential[%d]. Error: %w", reg.ID, err) + } + if x.Dialect().URI().DBType == schemas.MSSQL { + if _, err := x.Exec("SET IDENTITY_INSERT `%s` OFF", "webauthn_credential"); err != nil { + return fmt.Errorf("unable to turn off identity insert on webauthn_credential[%d]. Error: %w", reg.ID, err) + } } continue } _, err = x.ID(remigrated.ID).AllCols().Update(remigrated) if err != nil { - return err + return fmt.Errorf("unable to update webauthn_credential[%d]. Error: %w", reg.ID, err) } } From 8b802b8ff67fc87504d0aa9256b40f1dcf627dbe Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Wed, 16 Feb 2022 18:07:04 +0000 Subject: [PATCH 13/14] try again Signed-off-by: Andrew Thornton --- models/migrations/v210.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/models/migrations/v210.go b/models/migrations/v210.go index 2ed9e5a0cdca4..b806363619c26 100644 --- a/models/migrations/v210.go +++ b/models/migrations/v210.go @@ -132,7 +132,7 @@ func remigrateU2FCredentials(x *xorm.Engine) error { } if !has { if x.Dialect().URI().DBType == schemas.MSSQL { - if _, err := x.Exec("SET IDENTITY_INSERT `%s` ON", "webauthn_credential"); err != nil { + if _, err := x.Exec("SET IDENTITY_INSERT `webauthn_credential` ON"); err != nil { return fmt.Errorf("unable to allow identity insert on webauthn_credential[%d]. Error: %w", reg.ID, err) } } @@ -141,7 +141,7 @@ func remigrateU2FCredentials(x *xorm.Engine) error { return fmt.Errorf("unable to (re)insert webauthn_credential[%d]. Error: %w", reg.ID, err) } if x.Dialect().URI().DBType == schemas.MSSQL { - if _, err := x.Exec("SET IDENTITY_INSERT `%s` OFF", "webauthn_credential"); err != nil { + if _, err := x.Exec("SET IDENTITY_INSERT `webauthn_credential` OFF"); err != nil { return fmt.Errorf("unable to turn off identity insert on webauthn_credential[%d]. Error: %w", reg.ID, err) } } From 3442eed9990573c07314ba1f092398223019ce06 Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Wed, 16 Feb 2022 19:35:52 +0000 Subject: [PATCH 14/14] use session Signed-off-by: Andrew Thornton --- models/migrations/v210.go | 81 +++++++++++++++++++++------------------ 1 file changed, 44 insertions(+), 37 deletions(-) diff --git a/models/migrations/v210.go b/models/migrations/v210.go index b806363619c26..cf50760b92c33 100644 --- a/models/migrations/v210.go +++ b/models/migrations/v210.go @@ -106,52 +106,59 @@ func remigrateU2FCredentials(x *xorm.Engine) error { return err } - for _, reg := range regs { - parsed := new(u2f.Registration) - err = parsed.UnmarshalBinary(reg.Raw) - if err != nil { - continue + err = func() error { + sess := x.NewSession() + defer sess.Close() + if err := sess.Begin(); err != nil { + return fmt.Errorf("unable to allow start session. Error: %w", err) } - remigrated := &webauthnCredential{ - ID: reg.ID, - Name: reg.Name, - LowerName: strings.ToLower(reg.Name), - UserID: reg.UserID, - CredentialID: base32.HexEncoding.EncodeToString(parsed.KeyHandle), - PublicKey: elliptic.Marshal(elliptic.P256(), parsed.PubKey.X, parsed.PubKey.Y), - AttestationType: "fido-u2f", - AAGUID: []byte{}, - SignCount: reg.Counter, - UpdatedUnix: reg.UpdatedUnix, - CreatedUnix: reg.CreatedUnix, - } - - has, err := x.ID(reg.ID).Where("id = ?", reg.ID).Get(new(webauthnCredential)) - if err != nil { - return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %w", reg.ID, err) + if x.Dialect().URI().DBType == schemas.MSSQL { + if _, err := sess.Exec("SET IDENTITY_INSERT `webauthn_credential` ON"); err != nil { + return fmt.Errorf("unable to allow identity insert on webauthn_credential. Error: %w", err) + } } - if !has { - if x.Dialect().URI().DBType == schemas.MSSQL { - if _, err := x.Exec("SET IDENTITY_INSERT `webauthn_credential` ON"); err != nil { - return fmt.Errorf("unable to allow identity insert on webauthn_credential[%d]. Error: %w", reg.ID, err) - } + for _, reg := range regs { + parsed := new(u2f.Registration) + err = parsed.UnmarshalBinary(reg.Raw) + if err != nil { + continue + } + remigrated := &webauthnCredential{ + ID: reg.ID, + Name: reg.Name, + LowerName: strings.ToLower(reg.Name), + UserID: reg.UserID, + CredentialID: base32.HexEncoding.EncodeToString(parsed.KeyHandle), + PublicKey: elliptic.Marshal(elliptic.P256(), parsed.PubKey.X, parsed.PubKey.Y), + AttestationType: "fido-u2f", + AAGUID: []byte{}, + SignCount: reg.Counter, + UpdatedUnix: reg.UpdatedUnix, + CreatedUnix: reg.CreatedUnix, } - _, err = x.Insert(remigrated) + + has, err := sess.ID(reg.ID).Where("id = ?", reg.ID).Get(new(webauthnCredential)) if err != nil { - return fmt.Errorf("unable to (re)insert webauthn_credential[%d]. Error: %w", reg.ID, err) + return fmt.Errorf("unable to get webauthn_credential[%d]. Error: %w", reg.ID, err) } - if x.Dialect().URI().DBType == schemas.MSSQL { - if _, err := x.Exec("SET IDENTITY_INSERT `webauthn_credential` OFF"); err != nil { - return fmt.Errorf("unable to turn off identity insert on webauthn_credential[%d]. Error: %w", reg.ID, err) + if !has { + _, err = sess.Insert(remigrated) + if err != nil { + return fmt.Errorf("unable to (re)insert webauthn_credential[%d]. Error: %w", reg.ID, err) } + + continue } - continue - } - _, err = x.ID(remigrated.ID).AllCols().Update(remigrated) - if err != nil { - return fmt.Errorf("unable to update webauthn_credential[%d]. Error: %w", reg.ID, err) + _, err = sess.ID(remigrated.ID).AllCols().Update(remigrated) + if err != nil { + return fmt.Errorf("unable to update webauthn_credential[%d]. Error: %w", reg.ID, err) + } } + return sess.Commit() + }() + if err != nil { + return err } if len(regs) < 50 {