ctap_make_credential_request.cc 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367
  1. // Copyright 2017 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "device/fido/ctap_make_credential_request.h"
  5. #include <algorithm>
  6. #include <limits>
  7. #include <utility>
  8. #include "base/numerics/safe_conversions.h"
  9. #include "components/cbor/values.h"
  10. #include "device/fido/device_response_converter.h"
  11. #include "device/fido/fido_constants.h"
  12. #include "device/fido/fido_parsing_utils.h"
  13. namespace device {
  14. namespace {
  15. bool IsMakeCredentialOptionMapFormatCorrect(
  16. const cbor::Value::MapValue& option_map) {
  17. return std::all_of(
  18. option_map.begin(), option_map.end(), [](const auto& param) {
  19. return param.first.is_string() &&
  20. (param.first.GetString() == kResidentKeyMapKey ||
  21. param.first.GetString() == kUserVerificationMapKey) &&
  22. param.second.is_bool();
  23. });
  24. }
  25. bool AreMakeCredentialRequestMapKeysCorrect(
  26. const cbor::Value::MapValue& request_map) {
  27. return std::all_of(
  28. request_map.begin(), request_map.end(), [](const auto& param) {
  29. return (param.first.is_integer() && 1u <= param.first.GetInteger() &&
  30. param.first.GetInteger() <= 10u);
  31. });
  32. }
  33. } // namespace
  34. // static
  35. absl::optional<CtapMakeCredentialRequest> CtapMakeCredentialRequest::Parse(
  36. const cbor::Value::MapValue& request_map,
  37. const ParseOpts& opts) {
  38. if (!AreMakeCredentialRequestMapKeysCorrect(request_map))
  39. return absl::nullopt;
  40. const auto client_data_hash_it = request_map.find(cbor::Value(1));
  41. if (client_data_hash_it == request_map.end() ||
  42. !client_data_hash_it->second.is_bytestring() ||
  43. client_data_hash_it->second.GetBytestring().size() !=
  44. kClientDataHashLength) {
  45. return absl::nullopt;
  46. }
  47. base::span<const uint8_t, kClientDataHashLength> client_data_hash(
  48. client_data_hash_it->second.GetBytestring().data(),
  49. kClientDataHashLength);
  50. const auto rp_entity_it = request_map.find(cbor::Value(2));
  51. if (rp_entity_it == request_map.end() || !rp_entity_it->second.is_map())
  52. return absl::nullopt;
  53. auto rp_entity =
  54. PublicKeyCredentialRpEntity::CreateFromCBORValue(rp_entity_it->second);
  55. if (!rp_entity)
  56. return absl::nullopt;
  57. const auto user_entity_it = request_map.find(cbor::Value(3));
  58. if (user_entity_it == request_map.end() || !user_entity_it->second.is_map())
  59. return absl::nullopt;
  60. auto user_entity = PublicKeyCredentialUserEntity::CreateFromCBORValue(
  61. user_entity_it->second);
  62. if (!user_entity)
  63. return absl::nullopt;
  64. const auto credential_params_it = request_map.find(cbor::Value(4));
  65. if (credential_params_it == request_map.end())
  66. return absl::nullopt;
  67. auto credential_params = PublicKeyCredentialParams::CreateFromCBORValue(
  68. credential_params_it->second);
  69. if (!credential_params)
  70. return absl::nullopt;
  71. CtapMakeCredentialRequest request(
  72. /*client_data_json=*/std::string(), std::move(*rp_entity),
  73. std::move(*user_entity), std::move(*credential_params));
  74. request.client_data_hash = fido_parsing_utils::Materialize(client_data_hash);
  75. const auto exclude_list_it = request_map.find(cbor::Value(5));
  76. if (exclude_list_it != request_map.end()) {
  77. if (!exclude_list_it->second.is_array())
  78. return absl::nullopt;
  79. const auto& credential_descriptors = exclude_list_it->second.GetArray();
  80. std::vector<PublicKeyCredentialDescriptor> exclude_list;
  81. for (const auto& credential_descriptor : credential_descriptors) {
  82. auto excluded_credential =
  83. PublicKeyCredentialDescriptor::CreateFromCBORValue(
  84. credential_descriptor);
  85. if (!excluded_credential)
  86. return absl::nullopt;
  87. exclude_list.push_back(std::move(*excluded_credential));
  88. }
  89. request.exclude_list = std::move(exclude_list);
  90. }
  91. const auto extensions_it = request_map.find(cbor::Value(6));
  92. if (extensions_it != request_map.end()) {
  93. if (!extensions_it->second.is_map()) {
  94. return absl::nullopt;
  95. }
  96. const cbor::Value::MapValue& extensions = extensions_it->second.GetMap();
  97. if (opts.reject_all_extensions && !extensions.empty()) {
  98. return absl::nullopt;
  99. }
  100. for (const auto& extension : extensions) {
  101. if (!extension.first.is_string()) {
  102. return absl::nullopt;
  103. }
  104. const std::string& extension_name = extension.first.GetString();
  105. if (extension_name == kExtensionCredProtect) {
  106. if (!extension.second.is_unsigned()) {
  107. return absl::nullopt;
  108. }
  109. switch (extension.second.GetUnsigned()) {
  110. case 1:
  111. request.cred_protect = device::CredProtect::kUVOptional;
  112. break;
  113. case 2:
  114. request.cred_protect = device::CredProtect::kUVOrCredIDRequired;
  115. break;
  116. case 3:
  117. request.cred_protect = device::CredProtect::kUVRequired;
  118. break;
  119. default:
  120. return absl::nullopt;
  121. }
  122. } else if (extension_name == kExtensionHmacSecret) {
  123. if (!extension.second.is_bool()) {
  124. return absl::nullopt;
  125. }
  126. request.hmac_secret = extension.second.GetBool();
  127. } else if (extension_name == kExtensionLargeBlobKey) {
  128. if (!extension.second.is_bool() || !extension.second.GetBool()) {
  129. return absl::nullopt;
  130. }
  131. request.large_blob_key = true;
  132. } else if (extension_name == kExtensionCredBlob) {
  133. if (!extension.second.is_bytestring()) {
  134. return absl::nullopt;
  135. }
  136. request.cred_blob = extension.second.GetBytestring();
  137. } else if (extension_name == kExtensionMinPINLength) {
  138. if (!extension.second.is_bool()) {
  139. return absl::nullopt;
  140. }
  141. request.min_pin_length_requested = extension.second.GetBool();
  142. }
  143. }
  144. }
  145. const auto option_it = request_map.find(cbor::Value(7));
  146. if (option_it != request_map.end()) {
  147. if (!option_it->second.is_map())
  148. return absl::nullopt;
  149. const auto& option_map = option_it->second.GetMap();
  150. if (!IsMakeCredentialOptionMapFormatCorrect(option_map))
  151. return absl::nullopt;
  152. const auto resident_key_option =
  153. option_map.find(cbor::Value(kResidentKeyMapKey));
  154. if (resident_key_option != option_map.end()) {
  155. request.resident_key_required = resident_key_option->second.GetBool();
  156. }
  157. const auto uv_option =
  158. option_map.find(cbor::Value(kUserVerificationMapKey));
  159. if (uv_option != option_map.end()) {
  160. request.user_verification =
  161. uv_option->second.GetBool()
  162. ? UserVerificationRequirement::kRequired
  163. : UserVerificationRequirement::kDiscouraged;
  164. }
  165. }
  166. const auto pin_auth_it = request_map.find(cbor::Value(8));
  167. if (pin_auth_it != request_map.end()) {
  168. if (!pin_auth_it->second.is_bytestring())
  169. return absl::nullopt;
  170. request.pin_auth = pin_auth_it->second.GetBytestring();
  171. }
  172. const auto pin_protocol_it = request_map.find(cbor::Value(9));
  173. if (pin_protocol_it != request_map.end()) {
  174. if (!pin_protocol_it->second.is_unsigned() ||
  175. pin_protocol_it->second.GetUnsigned() >
  176. std::numeric_limits<uint8_t>::max()) {
  177. return absl::nullopt;
  178. }
  179. absl::optional<PINUVAuthProtocol> pin_protocol =
  180. ToPINUVAuthProtocol(pin_protocol_it->second.GetUnsigned());
  181. if (!pin_protocol) {
  182. return absl::nullopt;
  183. }
  184. request.pin_protocol = *pin_protocol;
  185. }
  186. const auto enterprise_attestation_it = request_map.find(cbor::Value(10));
  187. if (enterprise_attestation_it != request_map.end()) {
  188. if (!enterprise_attestation_it->second.is_unsigned()) {
  189. return absl::nullopt;
  190. }
  191. switch (enterprise_attestation_it->second.GetUnsigned()) {
  192. case 1:
  193. request.attestation_preference = AttestationConveyancePreference::
  194. kEnterpriseIfRPListedOnAuthenticator;
  195. break;
  196. case 2:
  197. request.attestation_preference =
  198. AttestationConveyancePreference::kEnterpriseApprovedByBrowser;
  199. break;
  200. default:
  201. return absl::nullopt;
  202. }
  203. }
  204. return request;
  205. }
  206. CtapMakeCredentialRequest::CtapMakeCredentialRequest(
  207. std::string in_client_data_json,
  208. PublicKeyCredentialRpEntity in_rp,
  209. PublicKeyCredentialUserEntity in_user,
  210. PublicKeyCredentialParams in_public_key_credential_params)
  211. : client_data_json(std::move(in_client_data_json)),
  212. client_data_hash(fido_parsing_utils::CreateSHA256Hash(client_data_json)),
  213. rp(std::move(in_rp)),
  214. user(std::move(in_user)),
  215. public_key_credential_params(std::move(in_public_key_credential_params)) {
  216. }
  217. CtapMakeCredentialRequest::CtapMakeCredentialRequest(
  218. const CtapMakeCredentialRequest& that) = default;
  219. CtapMakeCredentialRequest::CtapMakeCredentialRequest(
  220. CtapMakeCredentialRequest&& that) = default;
  221. CtapMakeCredentialRequest& CtapMakeCredentialRequest::operator=(
  222. const CtapMakeCredentialRequest& that) = default;
  223. CtapMakeCredentialRequest& CtapMakeCredentialRequest::operator=(
  224. CtapMakeCredentialRequest&& that) = default;
  225. CtapMakeCredentialRequest::~CtapMakeCredentialRequest() = default;
  226. std::pair<CtapRequestCommand, absl::optional<cbor::Value>>
  227. AsCTAPRequestValuePair(const CtapMakeCredentialRequest& request) {
  228. cbor::Value::MapValue cbor_map;
  229. cbor_map[cbor::Value(1)] = cbor::Value(request.client_data_hash);
  230. cbor_map[cbor::Value(2)] = AsCBOR(request.rp);
  231. cbor_map[cbor::Value(3)] = AsCBOR(request.user);
  232. cbor_map[cbor::Value(4)] = AsCBOR(request.public_key_credential_params);
  233. if (!request.exclude_list.empty()) {
  234. cbor::Value::ArrayValue exclude_list_array;
  235. for (const auto& descriptor : request.exclude_list) {
  236. exclude_list_array.push_back(AsCBOR(descriptor));
  237. }
  238. cbor_map[cbor::Value(5)] = cbor::Value(std::move(exclude_list_array));
  239. }
  240. cbor::Value::MapValue extensions;
  241. if (request.hmac_secret) {
  242. extensions[cbor::Value(kExtensionHmacSecret)] = cbor::Value(true);
  243. }
  244. if (request.large_blob_key) {
  245. extensions[cbor::Value(kExtensionLargeBlobKey)] = cbor::Value(true);
  246. }
  247. if (request.cred_protect) {
  248. extensions.emplace(kExtensionCredProtect,
  249. static_cast<int64_t>(*request.cred_protect));
  250. }
  251. if (request.cred_blob) {
  252. extensions.emplace(kExtensionCredBlob, *request.cred_blob);
  253. }
  254. if (request.min_pin_length_requested) {
  255. extensions.emplace(kExtensionMinPINLength, true);
  256. }
  257. if (!extensions.empty()) {
  258. cbor_map[cbor::Value(6)] = cbor::Value(std::move(extensions));
  259. }
  260. if (request.pin_auth) {
  261. cbor_map[cbor::Value(8)] = cbor::Value(*request.pin_auth);
  262. }
  263. if (request.pin_protocol) {
  264. cbor_map[cbor::Value(9)] =
  265. cbor::Value(static_cast<uint8_t>(*request.pin_protocol));
  266. }
  267. cbor::Value::MapValue option_map;
  268. // Resident keys are not required by default.
  269. if (request.resident_key_required) {
  270. option_map[cbor::Value(kResidentKeyMapKey)] =
  271. cbor::Value(request.resident_key_required);
  272. }
  273. // User verification is not required by default.
  274. if (request.user_verification == UserVerificationRequirement::kRequired) {
  275. option_map[cbor::Value(kUserVerificationMapKey)] = cbor::Value(true);
  276. }
  277. if (!option_map.empty()) {
  278. cbor_map[cbor::Value(7)] = cbor::Value(std::move(option_map));
  279. }
  280. switch (request.attestation_preference) {
  281. case AttestationConveyancePreference::kEnterpriseIfRPListedOnAuthenticator:
  282. cbor_map.emplace(10, static_cast<int64_t>(1));
  283. break;
  284. case AttestationConveyancePreference::kEnterpriseApprovedByBrowser:
  285. cbor_map.emplace(10, static_cast<int64_t>(2));
  286. break;
  287. default:
  288. break;
  289. }
  290. return std::make_pair(CtapRequestCommand::kAuthenticatorMakeCredential,
  291. cbor::Value(std::move(cbor_map)));
  292. }
  293. MakeCredentialOptions::MakeCredentialOptions() = default;
  294. MakeCredentialOptions::~MakeCredentialOptions() = default;
  295. MakeCredentialOptions::MakeCredentialOptions(const MakeCredentialOptions&) =
  296. default;
  297. MakeCredentialOptions::MakeCredentialOptions(
  298. const AuthenticatorSelectionCriteria& authenticator_selection_criteria)
  299. : authenticator_attachment(
  300. authenticator_selection_criteria.authenticator_attachment),
  301. resident_key(authenticator_selection_criteria.resident_key),
  302. user_verification(
  303. authenticator_selection_criteria.user_verification_requirement) {}
  304. MakeCredentialOptions::MakeCredentialOptions(MakeCredentialOptions&&) = default;
  305. MakeCredentialOptions& MakeCredentialOptions::operator=(
  306. const MakeCredentialOptions&) = default;
  307. MakeCredentialOptions& MakeCredentialOptions::operator=(
  308. MakeCredentialOptions&&) = default;
  309. } // namespace device