fido_device_authenticator.h 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274
  1. // Copyright 2018 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef DEVICE_FIDO_FIDO_DEVICE_AUTHENTICATOR_H_
  5. #define DEVICE_FIDO_FIDO_DEVICE_AUTHENTICATOR_H_
  6. #include <memory>
  7. #include <string>
  8. #include <vector>
  9. #include "base/component_export.h"
  10. #include "base/memory/weak_ptr.h"
  11. #include "build/build_config.h"
  12. #include "build/chromeos_buildflags.h"
  13. #include "device/fido/ctap2_device_operation.h"
  14. #include "device/fido/fido_authenticator.h"
  15. #include "device/fido/fido_constants.h"
  16. #include "device/fido/fido_request_handler_base.h"
  17. #include "device/fido/large_blob.h"
  18. #include "device/fido/pin.h"
  19. #include "third_party/abseil-cpp/absl/types/optional.h"
  20. namespace device {
  21. struct CtapGetAssertionRequest;
  22. struct CtapGetAssertionOptions;
  23. struct CtapMakeCredentialRequest;
  24. struct EnumerateRPsResponse;
  25. class FidoDevice;
  26. class FidoTask;
  27. // Adaptor class from a |FidoDevice| to the |FidoAuthenticator| interface.
  28. // Responsible for translating WebAuthn-level requests into serializations that
  29. // can be passed to the device for transport.
  30. class COMPONENT_EXPORT(DEVICE_FIDO) FidoDeviceAuthenticator
  31. : public FidoAuthenticator {
  32. public:
  33. explicit FidoDeviceAuthenticator(std::unique_ptr<FidoDevice> device);
  34. FidoDeviceAuthenticator(const FidoDeviceAuthenticator&) = delete;
  35. FidoDeviceAuthenticator& operator=(const FidoDeviceAuthenticator&) = delete;
  36. ~FidoDeviceAuthenticator() override;
  37. // FidoAuthenticator:
  38. void InitializeAuthenticator(base::OnceClosure callback) override;
  39. void ExcludeAppIdCredentialsBeforeMakeCredential(
  40. CtapMakeCredentialRequest request,
  41. MakeCredentialOptions options,
  42. base::OnceCallback<void(CtapDeviceResponseCode, absl::optional<bool>)>)
  43. override;
  44. void MakeCredential(CtapMakeCredentialRequest request,
  45. MakeCredentialOptions options,
  46. MakeCredentialCallback callback) override;
  47. void GetAssertion(CtapGetAssertionRequest request,
  48. CtapGetAssertionOptions options,
  49. GetAssertionCallback callback) override;
  50. void GetNextAssertion(GetAssertionCallback callback) override;
  51. void GetTouch(base::OnceClosure callback) override;
  52. void GetPinRetries(GetRetriesCallback callback) override;
  53. void GetPINToken(std::string pin,
  54. std::vector<pin::Permissions> permissions,
  55. absl::optional<std::string> rp_id,
  56. GetTokenCallback callback) override;
  57. void GetUvRetries(GetRetriesCallback callback) override;
  58. bool CanGetUvToken() override;
  59. void GetUvToken(std::vector<pin::Permissions> permissions,
  60. absl::optional<std::string> rp_id,
  61. GetTokenCallback callback) override;
  62. uint32_t CurrentMinPINLength() override;
  63. uint32_t NewMinPINLength() override;
  64. bool ForcePINChange() override;
  65. void SetPIN(const std::string& pin, SetPINCallback callback) override;
  66. void ChangePIN(const std::string& old_pin,
  67. const std::string& new_pin,
  68. SetPINCallback callback) override;
  69. PINUVDisposition PINUVDispositionForMakeCredential(
  70. const CtapMakeCredentialRequest& request,
  71. const FidoRequestHandlerBase::Observer* observer) override;
  72. // WillNeedPINToGetAssertion returns whether a PIN prompt will be needed to
  73. // serve the given request on this authenticator.
  74. PINUVDisposition PINUVDispositionForGetAssertion(
  75. const CtapGetAssertionRequest& request,
  76. const FidoRequestHandlerBase::Observer* observer) override;
  77. void GetCredentialsMetadata(const pin::TokenResponse& pin_token,
  78. GetCredentialsMetadataCallback callback) override;
  79. void EnumerateCredentials(const pin::TokenResponse& pin_token,
  80. EnumerateCredentialsCallback callback) override;
  81. void DeleteCredential(const pin::TokenResponse& pin_token,
  82. const PublicKeyCredentialDescriptor& credential_id,
  83. DeleteCredentialCallback callback) override;
  84. bool SupportsUpdateUserInformation() const override;
  85. void UpdateUserInformation(const pin::TokenResponse& pin_token,
  86. const PublicKeyCredentialDescriptor& credential_id,
  87. const PublicKeyCredentialUserEntity& updated_user,
  88. UpdateUserInformationCallback callback) override;
  89. void GetModality(BioEnrollmentCallback callback) override;
  90. void GetSensorInfo(BioEnrollmentCallback callback) override;
  91. void BioEnrollFingerprint(const pin::TokenResponse&,
  92. absl::optional<std::vector<uint8_t>> template_id,
  93. BioEnrollmentCallback) override;
  94. void BioEnrollCancel(BioEnrollmentCallback) override;
  95. void BioEnrollEnumerate(const pin::TokenResponse&,
  96. BioEnrollmentCallback) override;
  97. void BioEnrollRename(const pin::TokenResponse&,
  98. std::vector<uint8_t> template_id,
  99. std::string name,
  100. BioEnrollmentCallback) override;
  101. void BioEnrollDelete(const pin::TokenResponse&,
  102. std::vector<uint8_t> template_id,
  103. BioEnrollmentCallback) override;
  104. void WriteLargeBlob(
  105. LargeBlob large_blob,
  106. const LargeBlobKey& large_blob_key,
  107. absl::optional<pin::TokenResponse> pin_uv_auth_token,
  108. base::OnceCallback<void(CtapDeviceResponseCode)> callback) override;
  109. void ReadLargeBlob(const std::vector<LargeBlobKey>& large_blob_keys,
  110. absl::optional<pin::TokenResponse> pin_uv_auth_token,
  111. LargeBlobReadCallback callback) override;
  112. absl::optional<base::span<const int32_t>> GetAlgorithms() override;
  113. bool DiscoverableCredentialStorageFull() const override;
  114. void Reset(ResetCallback callback) override;
  115. void Cancel() override;
  116. std::string GetId() const override;
  117. std::string GetDisplayName() const override;
  118. ProtocolVersion SupportedProtocol() const override;
  119. bool SupportsHMACSecretExtension() const override;
  120. bool SupportsEnterpriseAttestation() const override;
  121. bool SupportsCredBlobOfSize(size_t num_bytes) const override;
  122. const absl::optional<AuthenticatorSupportedOptions>& Options() const override;
  123. absl::optional<FidoTransportProtocol> AuthenticatorTransport() const override;
  124. bool IsInPairingMode() const override;
  125. bool IsPaired() const override;
  126. bool RequiresBlePairingPin() const override;
  127. base::WeakPtr<FidoAuthenticator> GetWeakPtr() override;
  128. FidoDevice* device() { return device_.get(); }
  129. void SetTaskForTesting(std::unique_ptr<FidoTask> task);
  130. protected:
  131. void OnCtapMakeCredentialResponseReceived(
  132. MakeCredentialCallback callback,
  133. absl::optional<std::vector<uint8_t>> response_data);
  134. void OnCtapGetAssertionResponseReceived(
  135. GetAssertionCallback callback,
  136. absl::optional<std::vector<uint8_t>> response_data);
  137. private:
  138. using GetEphemeralKeyCallback =
  139. base::OnceCallback<void(CtapDeviceResponseCode,
  140. absl::optional<pin::KeyAgreementResponse>)>;
  141. void InitializeAuthenticatorDone(base::OnceClosure callback);
  142. void GetEphemeralKey(GetEphemeralKeyCallback callback);
  143. void DoGetAssertion(CtapGetAssertionRequest request,
  144. CtapGetAssertionOptions options,
  145. GetAssertionCallback callback);
  146. void OnHaveEphemeralKeyForGetAssertion(
  147. CtapGetAssertionRequest request,
  148. CtapGetAssertionOptions options,
  149. GetAssertionCallback callback,
  150. CtapDeviceResponseCode status,
  151. absl::optional<pin::KeyAgreementResponse> key);
  152. void OnHaveEphemeralKeyForGetPINToken(
  153. std::string pin,
  154. std::vector<pin::Permissions> permissions,
  155. absl::optional<std::string> rp_id,
  156. GetTokenCallback callback,
  157. CtapDeviceResponseCode status,
  158. absl::optional<pin::KeyAgreementResponse> key);
  159. void OnHaveEphemeralKeyForSetPIN(
  160. std::string pin,
  161. SetPINCallback callback,
  162. CtapDeviceResponseCode status,
  163. absl::optional<pin::KeyAgreementResponse> key);
  164. void OnHaveEphemeralKeyForChangePIN(
  165. std::string old_pin,
  166. std::string new_pin,
  167. SetPINCallback callback,
  168. CtapDeviceResponseCode status,
  169. absl::optional<pin::KeyAgreementResponse> key);
  170. void OnHaveEphemeralKeyForUvToken(
  171. absl::optional<std::string> rp_id,
  172. std::vector<pin::Permissions> permissions,
  173. GetTokenCallback callback,
  174. CtapDeviceResponseCode status,
  175. absl::optional<pin::KeyAgreementResponse> key);
  176. void FetchLargeBlobArray(
  177. absl::optional<pin::TokenResponse> pin_uv_auth_token,
  178. LargeBlobArrayReader large_blob_array_reader,
  179. base::OnceCallback<void(CtapDeviceResponseCode,
  180. absl::optional<LargeBlobArrayReader>)> callback);
  181. void WriteLargeBlobArray(
  182. absl::optional<pin::TokenResponse> pin_uv_auth_token,
  183. LargeBlobArrayWriter large_blob_array_writer,
  184. base::OnceCallback<void(CtapDeviceResponseCode)> callback);
  185. void OnReadLargeBlobFragment(
  186. const size_t bytes_requested,
  187. LargeBlobArrayReader large_blob_array_reader,
  188. absl::optional<pin::TokenResponse> pin_uv_auth_token,
  189. base::OnceCallback<void(CtapDeviceResponseCode,
  190. absl::optional<LargeBlobArrayReader>)> callback,
  191. CtapDeviceResponseCode status,
  192. absl::optional<LargeBlobsResponse> response);
  193. void OnWriteLargeBlobFragment(
  194. LargeBlobArrayWriter large_blob_array_writer,
  195. absl::optional<pin::TokenResponse> pin_uv_auth_token,
  196. base::OnceCallback<void(CtapDeviceResponseCode)> callback,
  197. CtapDeviceResponseCode status,
  198. absl::optional<LargeBlobsResponse> response);
  199. void OnHaveLargeBlobArrayForWrite(
  200. LargeBlob large_blob,
  201. const LargeBlobKey& large_blob_key,
  202. absl::optional<pin::TokenResponse> pin_uv_auth_token,
  203. base::OnceCallback<void(CtapDeviceResponseCode)> callback,
  204. CtapDeviceResponseCode status,
  205. absl::optional<LargeBlobArrayReader> large_blob_array_reader);
  206. void OnHaveLargeBlobArrayForRead(
  207. const std::vector<LargeBlobKey>& large_blob_keys,
  208. LargeBlobReadCallback callback,
  209. CtapDeviceResponseCode status,
  210. absl::optional<LargeBlobArrayReader> large_blob_array_reader);
  211. template <typename... Args>
  212. void TaskClearProxy(base::OnceCallback<void(Args...)> callback, Args... args);
  213. template <typename... Args>
  214. void OperationClearProxy(base::OnceCallback<void(Args...)> callback,
  215. Args... args);
  216. template <typename Task, typename Response, typename... RequestArgs>
  217. void RunTask(RequestArgs&&... request_args,
  218. base::OnceCallback<void(CtapDeviceResponseCode,
  219. absl::optional<Response>)> callback);
  220. template <typename Request, typename Response>
  221. void RunOperation(Request request,
  222. base::OnceCallback<void(CtapDeviceResponseCode,
  223. absl::optional<Response>)> callback,
  224. base::OnceCallback<absl::optional<Response>(
  225. const absl::optional<cbor::Value>&)> parser,
  226. bool (*string_fixup_predicate)(
  227. const std::vector<const cbor::Value*>&) = nullptr);
  228. struct EnumerateCredentialsState;
  229. void OnEnumerateRPsDone(EnumerateCredentialsState state,
  230. CtapDeviceResponseCode status,
  231. absl::optional<EnumerateRPsResponse> response);
  232. void OnEnumerateCredentialsDone(
  233. EnumerateCredentialsState state,
  234. CtapDeviceResponseCode status,
  235. absl::optional<EnumerateCredentialsResponse> response);
  236. size_t max_large_blob_fragment_length();
  237. const std::unique_ptr<FidoDevice> device_;
  238. absl::optional<AuthenticatorSupportedOptions> options_;
  239. std::unique_ptr<FidoTask> task_;
  240. std::unique_ptr<GenericDeviceOperation> operation_;
  241. // The highest advertised PINUVAuthProtocol version that the authenticator
  242. // supports. This is guaranteed to be non-null after authenticator
  243. // initialization if |options_| indicates that PIN is supported.
  244. absl::optional<PINUVAuthProtocol> chosen_pin_uv_auth_protocol_;
  245. base::WeakPtrFactory<FidoDeviceAuthenticator> weak_factory_{this};
  246. };
  247. } // namespace device
  248. #endif // DEVICE_FIDO_FIDO_DEVICE_AUTHENTICATOR_H_