get_assertion_request_handler.h 7.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187
  1. // Copyright 2018 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #ifndef DEVICE_FIDO_GET_ASSERTION_REQUEST_HANDLER_H_
  5. #define DEVICE_FIDO_GET_ASSERTION_REQUEST_HANDLER_H_
  6. #include <memory>
  7. #include <set>
  8. #include <string>
  9. #include <vector>
  10. #include "base/callback.h"
  11. #include "base/memory/raw_ptr.h"
  12. #include "base/memory/weak_ptr.h"
  13. #include "device/fido/auth_token_requester.h"
  14. #include "device/fido/authenticator_get_assertion_response.h"
  15. #include "device/fido/ctap_get_assertion_request.h"
  16. #include "device/fido/fido_constants.h"
  17. #include "device/fido/fido_request_handler_base.h"
  18. #include "device/fido/fido_transport_protocol.h"
  19. #include "third_party/abseil-cpp/absl/types/optional.h"
  20. namespace base {
  21. class ElapsedTimer;
  22. }
  23. namespace device {
  24. class FidoAuthenticator;
  25. class FidoDiscoveryFactory;
  26. namespace pin {
  27. class TokenResponse;
  28. } // namespace pin
  29. enum class GetAssertionStatus {
  30. kSuccess,
  31. kAuthenticatorResponseInvalid,
  32. kUserConsentButCredentialNotRecognized,
  33. kUserConsentDenied,
  34. kAuthenticatorRemovedDuringPINEntry,
  35. kSoftPINBlock,
  36. kHardPINBlock,
  37. kAuthenticatorMissingResidentKeys,
  38. // TODO(agl): kAuthenticatorMissingUserVerification can
  39. // also be returned when the authenticator supports UV, but
  40. // there's no UI support for collecting a PIN. This could
  41. // be clearer.
  42. kAuthenticatorMissingUserVerification,
  43. kWinNotAllowedError,
  44. };
  45. class COMPONENT_EXPORT(DEVICE_FIDO) GetAssertionRequestHandler
  46. : public FidoRequestHandlerBase,
  47. public AuthTokenRequester::Delegate {
  48. public:
  49. using CompletionCallback = base::OnceCallback<void(
  50. GetAssertionStatus,
  51. absl::optional<std::vector<AuthenticatorGetAssertionResponse>>,
  52. const FidoAuthenticator*)>;
  53. GetAssertionRequestHandler(
  54. FidoDiscoveryFactory* fido_discovery_factory,
  55. const base::flat_set<FidoTransportProtocol>& supported_transports,
  56. CtapGetAssertionRequest request_parameter,
  57. CtapGetAssertionOptions request_options,
  58. bool allow_skipping_pin_touch,
  59. CompletionCallback completion_callback);
  60. GetAssertionRequestHandler(const GetAssertionRequestHandler&) = delete;
  61. GetAssertionRequestHandler& operator=(const GetAssertionRequestHandler&) =
  62. delete;
  63. ~GetAssertionRequestHandler() override;
  64. // Filters the allow list of the get assertion request to the given
  65. // |credential_id|. This is only valid to call for empty allow list requests.
  66. void PreselectAccount(std::vector<uint8_t> credential_id);
  67. base::WeakPtr<GetAssertionRequestHandler> GetWeakPtr();
  68. private:
  69. enum class State {
  70. kWaitingForTouch,
  71. kWaitingForToken,
  72. kWaitingForResponseWithToken,
  73. kReadingMultipleResponses,
  74. kFinished,
  75. };
  76. // FidoRequestHandlerBase:
  77. void OnBluetoothAdapterEnumerated(bool is_present,
  78. bool is_powered_on,
  79. bool can_power_on,
  80. bool is_peripheral_role_supported) override;
  81. void DispatchRequest(FidoAuthenticator* authenticator) override;
  82. void AuthenticatorRemoved(FidoDiscoveryBase* discovery,
  83. FidoAuthenticator* authenticator) override;
  84. void GetPlatformCredentialStatus(
  85. FidoAuthenticator* platform_authenticator) override;
  86. // AuthTokenRequester::Delegate:
  87. bool AuthenticatorSelectedForPINUVAuthToken(
  88. FidoAuthenticator* authenticator) override;
  89. void CollectPIN(pin::PINEntryReason reason,
  90. pin::PINEntryError error,
  91. uint32_t min_pin_length,
  92. int attempts,
  93. ProvidePINCallback provide_pin_cb) override;
  94. void PromptForInternalUVRetry(int attempts) override;
  95. void HavePINUVAuthTokenResultForAuthenticator(
  96. FidoAuthenticator* authenticator,
  97. AuthTokenRequester::Result result,
  98. absl::optional<pin::TokenResponse> response) override;
  99. void ObtainPINUVAuthToken(FidoAuthenticator* authenticator,
  100. std::set<pin::Permissions> permissions,
  101. bool skip_pin_touch,
  102. bool internal_uv_locked);
  103. void HandleResponse(
  104. FidoAuthenticator* authenticator,
  105. CtapGetAssertionRequest request,
  106. base::ElapsedTimer request_timer,
  107. CtapDeviceResponseCode response_code,
  108. absl::optional<AuthenticatorGetAssertionResponse> response);
  109. void HandleNextResponse(
  110. FidoAuthenticator* authenticator,
  111. CtapGetAssertionRequest request,
  112. CtapDeviceResponseCode response_code,
  113. absl::optional<AuthenticatorGetAssertionResponse> response);
  114. void TerminateUnsatisfiableRequestPostTouch(FidoAuthenticator* authenticator);
  115. void DispatchRequestWithToken(pin::TokenResponse token);
  116. void OnGetAssertionSuccess(FidoAuthenticator* authenticator,
  117. CtapGetAssertionRequest request);
  118. void OnReadLargeBlobs(
  119. FidoAuthenticator* authenticator,
  120. CtapDeviceResponseCode status,
  121. absl::optional<std::vector<std::pair<LargeBlobKey, LargeBlob>>> blobs);
  122. void OnWriteLargeBlob(FidoAuthenticator* authenticator,
  123. CtapDeviceResponseCode status);
  124. CompletionCallback completion_callback_;
  125. State state_ = State::kWaitingForTouch;
  126. CtapGetAssertionRequest request_;
  127. CtapGetAssertionOptions options_;
  128. absl::optional<pin::TokenResponse> pin_token_;
  129. // If true, and if at the time the request is dispatched to the first
  130. // authenticator no other authenticators are available, the request handler
  131. // will skip the initial touch that is usually required to select a PIN
  132. // protected authenticator.
  133. bool allow_skipping_pin_touch_;
  134. // selected_authenticator_for_pin_uv_auth_token_ points to the authenticator
  135. // that was tapped by the user while requesting a pinUvAuthToken from
  136. // connected authenticators. The object is owned by the underlying discovery
  137. // object and this pointer is cleared if it's removed during processing.
  138. raw_ptr<FidoAuthenticator> selected_authenticator_for_pin_uv_auth_token_ =
  139. nullptr;
  140. // responses_ holds the set of responses while they are incrementally read
  141. // from the device. Only used when more than one response is returned.
  142. std::vector<AuthenticatorGetAssertionResponse> responses_;
  143. // remaining_responses_ contains the number of responses that remain to be
  144. // read when multiple responses are returned.
  145. size_t remaining_responses_ = 0;
  146. // auth_token_requester_map_ holds active AuthTokenRequesters for
  147. // authenticators that need a pinUvAuthToken to service the request.
  148. std::map<FidoAuthenticator*, std::unique_ptr<AuthTokenRequester>>
  149. auth_token_requester_map_;
  150. // preselected_credential_ is set when the UI invokes `PreselectAccount()`. It
  151. // contains the ID of a platform authenticator credential chosen by the user
  152. // during a resident key request prior to dispatching to that platform
  153. // authenticator.
  154. absl::optional<std::vector<uint8_t>> preselected_credential_;
  155. SEQUENCE_CHECKER(my_sequence_checker_);
  156. base::WeakPtrFactory<GetAssertionRequestHandler> weak_factory_{this};
  157. };
  158. } // namespace device
  159. #endif // DEVICE_FIDO_GET_ASSERTION_REQUEST_HANDLER_H_