diff --git a/go.mod b/go.mod index 281be14247..a69e410bc0 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,7 @@ require ( github.com/distribution/reference v0.5.0 github.com/docker/go-events v0.1.0 github.com/docker/go-metrics v0.1.0 - github.com/fernet/fernet-go v0.0.0-20211208181803-9f70042a33ee + github.com/fernet/fernet-go v0.0.0-20240119011108-303da6aec611 github.com/gogo/protobuf v1.3.2 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 github.com/hashicorp/go-memdb v1.3.2 diff --git a/go.sum b/go.sum index 6d0b42e381..e3090e7395 100644 --- a/go.sum +++ b/go.sum @@ -39,8 +39,8 @@ github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+m github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98= github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= -github.com/fernet/fernet-go v0.0.0-20211208181803-9f70042a33ee h1:v6Eju/FhxsACGNipFEPBZZAzGr1F/jlRQr1qiBw2nEE= -github.com/fernet/fernet-go v0.0.0-20211208181803-9f70042a33ee/go.mod h1:2H9hjfbpSMHwY503FclkV/lZTBh2YlOmLLSda12uL8c= +github.com/fernet/fernet-go v0.0.0-20240119011108-303da6aec611 h1:JwYtKJ/DVEoIA5dH45OEU7uoryZY/gjd/BQiwwAOImM= +github.com/fernet/fernet-go v0.0.0-20240119011108-303da6aec611/go.mod h1:zHMNeYgqrTpKyjawjitDg0Osd1P/FmeA0SZLYK3RfLQ= github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= diff --git a/swarmd/go.mod b/swarmd/go.mod index ea7f6b26bd..8cd310cc93 100644 --- a/swarmd/go.mod +++ b/swarmd/go.mod @@ -48,10 +48,10 @@ require ( github.com/containerd/containerd v1.7.29 // indirect github.com/coreos/go-semver v0.3.1 // indirect github.com/distribution/reference v0.6.0 // indirect - github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect + github.com/docker/go-events v0.1.0 // indirect github.com/docker/go-metrics v0.1.0 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect - github.com/fernet/fernet-go v0.0.0-20211208181803-9f70042a33ee // indirect + github.com/fernet/fernet-go v0.0.0-20240119011108-303da6aec611 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/golang/protobuf v1.5.4 // indirect diff --git a/swarmd/go.sum b/swarmd/go.sum index b8bab79390..8dfea93931 100644 --- a/swarmd/go.sum +++ b/swarmd/go.sum @@ -33,8 +33,8 @@ github.com/docker/docker v24.0.0-rc.2.0.20230908212318-6ce5aa1cd5a4+incompatible github.com/docker/docker v24.0.0-rc.2.0.20230908212318-6ce5aa1cd5a4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/go-connections v0.4.1-0.20231110212414-fa09c952e3ea h1:+4n+kUVbPdu6qMI9SUnSKMC+D50gNW4L7Lhk9tI2lVo= github.com/docker/go-connections v0.4.1-0.20231110212414-fa09c952e3ea/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc= -github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8= -github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA= +github.com/docker/go-events v0.1.0 h1:J8VX4H7Ta8mmBhv/K/24x1kosKOrEEnYmGjcdFHTOW0= +github.com/docker/go-events v0.1.0/go.mod h1:jwVwMgySJX4PiukIIRrind1wPGU8QhPa8aTEPkreUj4= github.com/docker/go-metrics v0.1.0 h1:r76KPNpstz+IvQKSWpYegSkkyzex0V3A1ZGVx6bhGlY= github.com/docker/go-metrics v0.1.0/go.mod h1:PciI3sONtB051kXALN1JoIlpcu54E1FuPh+4DuqEzyw= github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= @@ -43,8 +43,8 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= -github.com/fernet/fernet-go v0.0.0-20211208181803-9f70042a33ee h1:v6Eju/FhxsACGNipFEPBZZAzGr1F/jlRQr1qiBw2nEE= -github.com/fernet/fernet-go v0.0.0-20211208181803-9f70042a33ee/go.mod h1:2H9hjfbpSMHwY503FclkV/lZTBh2YlOmLLSda12uL8c= +github.com/fernet/fernet-go v0.0.0-20240119011108-303da6aec611 h1:JwYtKJ/DVEoIA5dH45OEU7uoryZY/gjd/BQiwwAOImM= +github.com/fernet/fernet-go v0.0.0-20240119011108-303da6aec611/go.mod h1:zHMNeYgqrTpKyjawjitDg0Osd1P/FmeA0SZLYK3RfLQ= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= diff --git a/vendor/github.com/fernet/fernet-go/fernet.go b/vendor/github.com/fernet/fernet-go/fernet.go index b35fdbbe4f..4d6cf5ab6a 100644 --- a/vendor/github.com/fernet/fernet-go/fernet.go +++ b/vendor/github.com/fernet/fernet-go/fernet.go @@ -80,7 +80,7 @@ func verify(msg, tok []byte, ttl time.Duration, now time.Time, k *Key) []byte { if subtle.ConstantTimeCompare(tok[n:], hmac[:]) != 1 { return nil } - pay := tok[payOffset : len(tok)-sha256.Size] + pay := tok[payOffset:n] if len(pay)%aes.BlockSize != 0 { return nil } @@ -89,7 +89,7 @@ func verify(msg, tok []byte, ttl time.Duration, now time.Time, k *Key) []byte { pay = msg } bc, _ := aes.NewCipher(k.cryptBytes()) - iv := tok[9:][:aes.BlockSize] + iv := tok[ivOffset:][:aes.BlockSize] cipher.NewCBCDecrypter(bc, iv).CryptBlocks(pay, pay) return unpad(pay) } @@ -120,42 +120,34 @@ func unpad(p []byte) []byte { return p[:len(p)-int(c)] } -func b64enc(src []byte) []byte { - dst := make([]byte, encoding.EncodedLen(len(src))) - encoding.Encode(dst, src) - return dst -} - -func b64dec(src []byte) []byte { - dst := make([]byte, encoding.DecodedLen(len(src))) - n, err := encoding.Decode(dst, src) - if err != nil { - return nil - } - return dst[:n] -} - func genhmac(q, p, k []byte) { h := hmac.New(sha256.New, k) h.Write(p) h.Sum(q) } -// EncryptAndSign encrypts and signs msg with key k and returns the resulting -// fernet token. If msg contains text, the text should be encoded -// with UTF-8 to follow fernet convention. -func EncryptAndSign(msg []byte, k *Key) (tok []byte, err error) { +// EncryptAndSignAtTime encrypts and signs msg with key k at timestamp signedAt +// and returns the resulting fernet token. If msg contains text, the text +// should be encoded with UTF-8 to follow fernet convention. +func EncryptAndSignAtTime(msg []byte, k *Key, signedAt time.Time) (tok []byte, err error) { iv := make([]byte, aes.BlockSize) if _, err := io.ReadFull(rand.Reader, iv); err != nil { return nil, err } b := make([]byte, encodedLen(len(msg))) - n := gen(b, msg, iv, time.Now(), k) + n := gen(b, msg, iv, signedAt, k) tok = make([]byte, encoding.EncodedLen(n)) encoding.Encode(tok, b[:n]) return tok, nil } +// EncryptAndSign encrypts and signs msg with key k and returns the resulting +// fernet token. If msg contains text, the text should be encoded +// with UTF-8 to follow fernet convention. +func EncryptAndSign(msg []byte, k *Key) (tok []byte, err error) { + return EncryptAndSignAtTime(msg, k, time.Now()) +} + // VerifyAndDecrypt verifies that tok is a valid fernet token that was signed // with a key in k at most ttl time ago only if ttl is greater than zero. // Returns the message contained in tok if tok is valid, otherwise nil. diff --git a/vendor/modules.txt b/vendor/modules.txt index 67d07e57d2..9f8159e0b9 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -56,8 +56,8 @@ github.com/docker/go-metrics # github.com/dustin/go-humanize v1.0.1 ## explicit; go 1.16 github.com/dustin/go-humanize -# github.com/fernet/fernet-go v0.0.0-20211208181803-9f70042a33ee -## explicit +# github.com/fernet/fernet-go v0.0.0-20240119011108-303da6aec611 +## explicit; go 1.18 github.com/fernet/fernet-go # github.com/fsnotify/fsnotify v1.6.0 ## explicit; go 1.16