123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274 |
- // Copyright 2018 The Chromium Authors. All rights reserved.
- // Use of this source code is governed by a BSD-style license that can be
- // found in the LICENSE file.
- #ifndef DEVICE_FIDO_FIDO_DEVICE_AUTHENTICATOR_H_
- #define DEVICE_FIDO_FIDO_DEVICE_AUTHENTICATOR_H_
- #include <memory>
- #include <string>
- #include <vector>
- #include "base/component_export.h"
- #include "base/memory/weak_ptr.h"
- #include "build/build_config.h"
- #include "build/chromeos_buildflags.h"
- #include "device/fido/ctap2_device_operation.h"
- #include "device/fido/fido_authenticator.h"
- #include "device/fido/fido_constants.h"
- #include "device/fido/fido_request_handler_base.h"
- #include "device/fido/large_blob.h"
- #include "device/fido/pin.h"
- #include "third_party/abseil-cpp/absl/types/optional.h"
- namespace device {
- struct CtapGetAssertionRequest;
- struct CtapGetAssertionOptions;
- struct CtapMakeCredentialRequest;
- struct EnumerateRPsResponse;
- class FidoDevice;
- class FidoTask;
- // Adaptor class from a |FidoDevice| to the |FidoAuthenticator| interface.
- // Responsible for translating WebAuthn-level requests into serializations that
- // can be passed to the device for transport.
- class COMPONENT_EXPORT(DEVICE_FIDO) FidoDeviceAuthenticator
- : public FidoAuthenticator {
- public:
- explicit FidoDeviceAuthenticator(std::unique_ptr<FidoDevice> device);
- FidoDeviceAuthenticator(const FidoDeviceAuthenticator&) = delete;
- FidoDeviceAuthenticator& operator=(const FidoDeviceAuthenticator&) = delete;
- ~FidoDeviceAuthenticator() override;
- // FidoAuthenticator:
- void InitializeAuthenticator(base::OnceClosure callback) override;
- void ExcludeAppIdCredentialsBeforeMakeCredential(
- CtapMakeCredentialRequest request,
- MakeCredentialOptions options,
- base::OnceCallback<void(CtapDeviceResponseCode, absl::optional<bool>)>)
- override;
- void MakeCredential(CtapMakeCredentialRequest request,
- MakeCredentialOptions options,
- MakeCredentialCallback callback) override;
- void GetAssertion(CtapGetAssertionRequest request,
- CtapGetAssertionOptions options,
- GetAssertionCallback callback) override;
- void GetNextAssertion(GetAssertionCallback callback) override;
- void GetTouch(base::OnceClosure callback) override;
- void GetPinRetries(GetRetriesCallback callback) override;
- void GetPINToken(std::string pin,
- std::vector<pin::Permissions> permissions,
- absl::optional<std::string> rp_id,
- GetTokenCallback callback) override;
- void GetUvRetries(GetRetriesCallback callback) override;
- bool CanGetUvToken() override;
- void GetUvToken(std::vector<pin::Permissions> permissions,
- absl::optional<std::string> rp_id,
- GetTokenCallback callback) override;
- uint32_t CurrentMinPINLength() override;
- uint32_t NewMinPINLength() override;
- bool ForcePINChange() override;
- void SetPIN(const std::string& pin, SetPINCallback callback) override;
- void ChangePIN(const std::string& old_pin,
- const std::string& new_pin,
- SetPINCallback callback) override;
- PINUVDisposition PINUVDispositionForMakeCredential(
- const CtapMakeCredentialRequest& request,
- const FidoRequestHandlerBase::Observer* observer) override;
- // WillNeedPINToGetAssertion returns whether a PIN prompt will be needed to
- // serve the given request on this authenticator.
- PINUVDisposition PINUVDispositionForGetAssertion(
- const CtapGetAssertionRequest& request,
- const FidoRequestHandlerBase::Observer* observer) override;
- void GetCredentialsMetadata(const pin::TokenResponse& pin_token,
- GetCredentialsMetadataCallback callback) override;
- void EnumerateCredentials(const pin::TokenResponse& pin_token,
- EnumerateCredentialsCallback callback) override;
- void DeleteCredential(const pin::TokenResponse& pin_token,
- const PublicKeyCredentialDescriptor& credential_id,
- DeleteCredentialCallback callback) override;
- bool SupportsUpdateUserInformation() const override;
- void UpdateUserInformation(const pin::TokenResponse& pin_token,
- const PublicKeyCredentialDescriptor& credential_id,
- const PublicKeyCredentialUserEntity& updated_user,
- UpdateUserInformationCallback callback) override;
- void GetModality(BioEnrollmentCallback callback) override;
- void GetSensorInfo(BioEnrollmentCallback callback) override;
- void BioEnrollFingerprint(const pin::TokenResponse&,
- absl::optional<std::vector<uint8_t>> template_id,
- BioEnrollmentCallback) override;
- void BioEnrollCancel(BioEnrollmentCallback) override;
- void BioEnrollEnumerate(const pin::TokenResponse&,
- BioEnrollmentCallback) override;
- void BioEnrollRename(const pin::TokenResponse&,
- std::vector<uint8_t> template_id,
- std::string name,
- BioEnrollmentCallback) override;
- void BioEnrollDelete(const pin::TokenResponse&,
- std::vector<uint8_t> template_id,
- BioEnrollmentCallback) override;
- void WriteLargeBlob(
- LargeBlob large_blob,
- const LargeBlobKey& large_blob_key,
- absl::optional<pin::TokenResponse> pin_uv_auth_token,
- base::OnceCallback<void(CtapDeviceResponseCode)> callback) override;
- void ReadLargeBlob(const std::vector<LargeBlobKey>& large_blob_keys,
- absl::optional<pin::TokenResponse> pin_uv_auth_token,
- LargeBlobReadCallback callback) override;
- absl::optional<base::span<const int32_t>> GetAlgorithms() override;
- bool DiscoverableCredentialStorageFull() const override;
- void Reset(ResetCallback callback) override;
- void Cancel() override;
- std::string GetId() const override;
- std::string GetDisplayName() const override;
- ProtocolVersion SupportedProtocol() const override;
- bool SupportsHMACSecretExtension() const override;
- bool SupportsEnterpriseAttestation() const override;
- bool SupportsCredBlobOfSize(size_t num_bytes) const override;
- const absl::optional<AuthenticatorSupportedOptions>& Options() const override;
- absl::optional<FidoTransportProtocol> AuthenticatorTransport() const override;
- bool IsInPairingMode() const override;
- bool IsPaired() const override;
- bool RequiresBlePairingPin() const override;
- base::WeakPtr<FidoAuthenticator> GetWeakPtr() override;
- FidoDevice* device() { return device_.get(); }
- void SetTaskForTesting(std::unique_ptr<FidoTask> task);
- protected:
- void OnCtapMakeCredentialResponseReceived(
- MakeCredentialCallback callback,
- absl::optional<std::vector<uint8_t>> response_data);
- void OnCtapGetAssertionResponseReceived(
- GetAssertionCallback callback,
- absl::optional<std::vector<uint8_t>> response_data);
- private:
- using GetEphemeralKeyCallback =
- base::OnceCallback<void(CtapDeviceResponseCode,
- absl::optional<pin::KeyAgreementResponse>)>;
- void InitializeAuthenticatorDone(base::OnceClosure callback);
- void GetEphemeralKey(GetEphemeralKeyCallback callback);
- void DoGetAssertion(CtapGetAssertionRequest request,
- CtapGetAssertionOptions options,
- GetAssertionCallback callback);
- void OnHaveEphemeralKeyForGetAssertion(
- CtapGetAssertionRequest request,
- CtapGetAssertionOptions options,
- GetAssertionCallback callback,
- CtapDeviceResponseCode status,
- absl::optional<pin::KeyAgreementResponse> key);
- void OnHaveEphemeralKeyForGetPINToken(
- std::string pin,
- std::vector<pin::Permissions> permissions,
- absl::optional<std::string> rp_id,
- GetTokenCallback callback,
- CtapDeviceResponseCode status,
- absl::optional<pin::KeyAgreementResponse> key);
- void OnHaveEphemeralKeyForSetPIN(
- std::string pin,
- SetPINCallback callback,
- CtapDeviceResponseCode status,
- absl::optional<pin::KeyAgreementResponse> key);
- void OnHaveEphemeralKeyForChangePIN(
- std::string old_pin,
- std::string new_pin,
- SetPINCallback callback,
- CtapDeviceResponseCode status,
- absl::optional<pin::KeyAgreementResponse> key);
- void OnHaveEphemeralKeyForUvToken(
- absl::optional<std::string> rp_id,
- std::vector<pin::Permissions> permissions,
- GetTokenCallback callback,
- CtapDeviceResponseCode status,
- absl::optional<pin::KeyAgreementResponse> key);
- void FetchLargeBlobArray(
- absl::optional<pin::TokenResponse> pin_uv_auth_token,
- LargeBlobArrayReader large_blob_array_reader,
- base::OnceCallback<void(CtapDeviceResponseCode,
- absl::optional<LargeBlobArrayReader>)> callback);
- void WriteLargeBlobArray(
- absl::optional<pin::TokenResponse> pin_uv_auth_token,
- LargeBlobArrayWriter large_blob_array_writer,
- base::OnceCallback<void(CtapDeviceResponseCode)> callback);
- void OnReadLargeBlobFragment(
- const size_t bytes_requested,
- LargeBlobArrayReader large_blob_array_reader,
- absl::optional<pin::TokenResponse> pin_uv_auth_token,
- base::OnceCallback<void(CtapDeviceResponseCode,
- absl::optional<LargeBlobArrayReader>)> callback,
- CtapDeviceResponseCode status,
- absl::optional<LargeBlobsResponse> response);
- void OnWriteLargeBlobFragment(
- LargeBlobArrayWriter large_blob_array_writer,
- absl::optional<pin::TokenResponse> pin_uv_auth_token,
- base::OnceCallback<void(CtapDeviceResponseCode)> callback,
- CtapDeviceResponseCode status,
- absl::optional<LargeBlobsResponse> response);
- void OnHaveLargeBlobArrayForWrite(
- LargeBlob large_blob,
- const LargeBlobKey& large_blob_key,
- absl::optional<pin::TokenResponse> pin_uv_auth_token,
- base::OnceCallback<void(CtapDeviceResponseCode)> callback,
- CtapDeviceResponseCode status,
- absl::optional<LargeBlobArrayReader> large_blob_array_reader);
- void OnHaveLargeBlobArrayForRead(
- const std::vector<LargeBlobKey>& large_blob_keys,
- LargeBlobReadCallback callback,
- CtapDeviceResponseCode status,
- absl::optional<LargeBlobArrayReader> large_blob_array_reader);
- template <typename... Args>
- void TaskClearProxy(base::OnceCallback<void(Args...)> callback, Args... args);
- template <typename... Args>
- void OperationClearProxy(base::OnceCallback<void(Args...)> callback,
- Args... args);
- template <typename Task, typename Response, typename... RequestArgs>
- void RunTask(RequestArgs&&... request_args,
- base::OnceCallback<void(CtapDeviceResponseCode,
- absl::optional<Response>)> callback);
- template <typename Request, typename Response>
- void RunOperation(Request request,
- base::OnceCallback<void(CtapDeviceResponseCode,
- absl::optional<Response>)> callback,
- base::OnceCallback<absl::optional<Response>(
- const absl::optional<cbor::Value>&)> parser,
- bool (*string_fixup_predicate)(
- const std::vector<const cbor::Value*>&) = nullptr);
- struct EnumerateCredentialsState;
- void OnEnumerateRPsDone(EnumerateCredentialsState state,
- CtapDeviceResponseCode status,
- absl::optional<EnumerateRPsResponse> response);
- void OnEnumerateCredentialsDone(
- EnumerateCredentialsState state,
- CtapDeviceResponseCode status,
- absl::optional<EnumerateCredentialsResponse> response);
- size_t max_large_blob_fragment_length();
- const std::unique_ptr<FidoDevice> device_;
- absl::optional<AuthenticatorSupportedOptions> options_;
- std::unique_ptr<FidoTask> task_;
- std::unique_ptr<GenericDeviceOperation> operation_;
- // The highest advertised PINUVAuthProtocol version that the authenticator
- // supports. This is guaranteed to be non-null after authenticator
- // initialization if |options_| indicates that PIN is supported.
- absl::optional<PINUVAuthProtocol> chosen_pin_uv_auth_protocol_;
- base::WeakPtrFactory<FidoDeviceAuthenticator> weak_factory_{this};
- };
- } // namespace device
- #endif // DEVICE_FIDO_FIDO_DEVICE_AUTHENTICATOR_H_
|