v2_authenticator.h 5.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167
  1. // Copyright 2020 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef DEVICE_FIDO_CABLE_V2_AUTHENTICATOR_H_
  5. #define DEVICE_FIDO_CABLE_V2_AUTHENTICATOR_H_
  6. #include <string>
  7. #include <vector>
  8. #include <stdint.h>
  9. #include "base/callback.h"
  10. #include "base/containers/span.h"
  11. #include "device/fido/cable/v2_constants.h"
  12. #include "device/fido/fido_constants.h"
  13. #include "services/network/public/mojom/network_context.mojom-forward.h"
  14. #include "third_party/abseil-cpp/absl/types/optional.h"
  15. #include "third_party/abseil-cpp/absl/types/variant.h"
  16. #include "third_party/blink/public/mojom/webauthn/authenticator.mojom-forward.h"
  17. namespace device {
  18. namespace cablev2 {
  19. namespace authenticator {
  20. // Platform abstracts the actions taken by the platform, i.e. the
  21. // credential-store operations themselves, plus an interface for BLE
  22. // advertising.
  23. class Platform {
  24. public:
  25. // BLEAdvert represents a currently-transmitting advert. Destroying the object
  26. // stops the transmission.
  27. class BLEAdvert {
  28. public:
  29. virtual ~BLEAdvert();
  30. };
  31. virtual ~Platform();
  32. enum class Status {
  33. // These values must match up with CableAuthenticatorUI.java.
  34. TUNNEL_SERVER_CONNECT = 1,
  35. HANDSHAKE_COMPLETE = 2,
  36. REQUEST_RECEIVED = 3,
  37. CTAP_ERROR = 4,
  38. FIRST_TRANSACTION_DONE = 5,
  39. };
  40. enum class Error {
  41. // These values must match up with CableAuthenticatorUI.java and zero
  42. // is considered to be not an error by the Java code.
  43. // NONE = 0,
  44. UNEXPECTED_EOF = 100,
  45. TUNNEL_SERVER_CONNECT_FAILED = 101,
  46. HANDSHAKE_FAILED = 102,
  47. DECRYPT_FAILURE = 103,
  48. INVALID_CBOR = 104,
  49. INVALID_CTAP = 105,
  50. UNKNOWN_COMMAND = 106,
  51. INTERNAL_ERROR = 107,
  52. SERVER_LINK_WRONG_LENGTH = 108,
  53. SERVER_LINK_NOT_ON_CURVE = 109,
  54. NO_SCREENLOCK = 110,
  55. NO_BLUETOOTH_PERMISSION = 111,
  56. QR_URI_ERROR = 112,
  57. EOF_WHILE_PROCESSING = 113,
  58. AUTHENTICATOR_SELECTION_RECEIVED = 114,
  59. DISCOVERABLE_CREDENTIALS_REQUEST = 115,
  60. };
  61. using MakeCredentialCallback =
  62. base::OnceCallback<void(uint32_t status,
  63. base::span<const uint8_t> attestation_obj)>;
  64. virtual void MakeCredential(
  65. blink::mojom::PublicKeyCredentialCreationOptionsPtr params,
  66. MakeCredentialCallback callback) = 0;
  67. using GetAssertionCallback = base::OnceCallback<void(
  68. uint32_t status,
  69. blink::mojom::GetAssertionAuthenticatorResponsePtr response)>;
  70. virtual void GetAssertion(
  71. blink::mojom::PublicKeyCredentialRequestOptionsPtr params,
  72. GetAssertionCallback callback) = 0;
  73. // OnStatus is called when a new informative status is available.
  74. virtual void OnStatus(Status) = 0;
  75. // OnCompleted is called when the transaction has completed. Note that calling
  76. // this may result in the |Transaction| that owns this |Platform| being
  77. // deleted.
  78. virtual void OnCompleted(absl::optional<Error>) = 0;
  79. virtual std::unique_ptr<BLEAdvert> SendBLEAdvert(
  80. base::span<const uint8_t, kAdvertSize> payload) = 0;
  81. };
  82. // Transport abstracts a way of transmitting to, and receiving from, the peer.
  83. // The framing of messages must be preserved.
  84. class Transport {
  85. public:
  86. // Disconnected is a fresh type in order to be distinguishable in |Update|.
  87. enum class Disconnected { kDisconnected = 200 };
  88. // Update is a sum type of all the possible signals that a transport can
  89. // report. The first element is a message from the peer. |Disconnected| is
  90. // handled separately because it's context dependent whether that is an error
  91. // or not.
  92. using Update = absl::variant<std::vector<uint8_t>,
  93. Platform::Error,
  94. Platform::Status,
  95. Disconnected>;
  96. virtual ~Transport();
  97. // StartReading requests that the given callback be called whenever a message
  98. // arrives from the peer, an error occurs, or the status of the link changes.
  99. virtual void StartReading(
  100. base::RepeatingCallback<void(Update)> update_callback) = 0;
  101. virtual void Write(std::vector<uint8_t> data) = 0;
  102. };
  103. // A Transaction is a handle to an ongoing caBLEv2 transaction with a peer.
  104. class Transaction {
  105. public:
  106. virtual ~Transaction();
  107. };
  108. // TransactWithPlaintextTransport allows an arbitrary transport to be used for a
  109. // caBLEv2 transaction.
  110. std::unique_ptr<Transaction> TransactWithPlaintextTransport(
  111. std::unique_ptr<Platform> platform,
  112. std::unique_ptr<Transport> transport);
  113. // TransactFromQRCode starts a network-based transaction based on the decoded
  114. // contents of a QR code.
  115. std::unique_ptr<Transaction> TransactFromQRCode(
  116. unsigned protocol_revision,
  117. std::unique_ptr<Platform> platform,
  118. network::mojom::NetworkContext* network_context,
  119. base::span<const uint8_t, kRootSecretSize> root_secret,
  120. const std::string& authenticator_name,
  121. // TODO: name this constant.
  122. base::span<const uint8_t, 16> qr_secret,
  123. base::span<const uint8_t, kP256X962Length> peer_identity,
  124. absl::optional<std::vector<uint8_t>> contact_id,
  125. bool use_new_crypter_construction);
  126. // TransactFromFCM starts a network-based transaction based on the decoded
  127. // contents of a cloud message.
  128. std::unique_ptr<Transaction> TransactFromFCM(
  129. unsigned protocol_revision,
  130. std::unique_ptr<Platform> platform,
  131. network::mojom::NetworkContext* network_context,
  132. base::span<const uint8_t, kRootSecretSize> root_secret,
  133. std::array<uint8_t, kRoutingIdSize> routing_id,
  134. base::span<const uint8_t, kTunnelIdSize> tunnel_id,
  135. base::span<const uint8_t, kPairingIDSize> pairing_id,
  136. base::span<const uint8_t, kClientNonceSize> client_nonce,
  137. absl::optional<base::span<const uint8_t>> contact_id);
  138. } // namespace authenticator
  139. } // namespace cablev2
  140. } // namespace device
  141. #endif // DEVICE_FIDO_CABLE_V2_AUTHENTICATOR_H_