6 Commits

7 changed files with 49 additions and 27 deletions

View File

@@ -1,12 +1,13 @@
[package] [package]
name = "ctap_hmac" name = "ctap_hmac"
description = "A Rust implementation of the FIDO2 CTAP protocol, including the HMAC extension" description = "A Rust implementation of the FIDO2 CTAP protocol, including the HMAC extension"
version = "0.3.0" version = "0.4.0"
license = "Apache-2.0/MIT" license = "Apache-2.0/MIT"
homepage = "https://github.com/ArdaXi/ctap/pull/2" homepage = "https://github.com/shimunn/ctap"
repository = "https://github.com/shimunn/ctap" repository = "https://github.com/shimunn/ctap"
authors = ["Arda Xi <arda@ardaxi.com>", "shimun <shimun@shimun.net>"] authors = ["Arda Xi <arda@ardaxi.com>", "shimun <shimun@shimun.net>"]
edition = "2018" edition = "2018"
readme = "README.md"
[dependencies] [dependencies]
rand = "0.6" rand = "0.6"

View File

@@ -4,7 +4,6 @@ use crypto::digest::Digest;
use crypto::sha2::Sha256; use crypto::sha2::Sha256;
use ctap::extensions::hmac::HmacExtension; use ctap::extensions::hmac::HmacExtension;
use ctap::{FidoAssertionRequestBuilder, FidoCredential, FidoCredentialRequestBuilder}; use ctap::{FidoAssertionRequestBuilder, FidoCredential, FidoCredentialRequestBuilder};
use hex; use hex;
use std::env::args; use std::env::args;
use std::io::prelude::*; use std::io::prelude::*;

View File

@@ -1,5 +1,4 @@
extern crate ctap_hmac as ctap; extern crate ctap_hmac as ctap;
use ctap::{ use ctap::{
FidoAssertionRequestBuilder, FidoCredential, FidoCredentialRequestBuilder, FidoDevice, FidoAssertionRequestBuilder, FidoCredential, FidoCredentialRequestBuilder, FidoDevice,
FidoResult, FidoResult,
@@ -7,6 +6,7 @@ use ctap::{
use hex; use hex;
use std::env::args; use std::env::args;
use std::time::Duration;
const RP_ID: &str = "ctap_demo"; const RP_ID: &str = "ctap_demo";
@@ -41,7 +41,8 @@ fn main() -> ctap::FidoResult<()> {
.map(|handle| FidoDevice::new(&handle)) .map(|handle| FidoDevice::new(&handle))
.collect::<FidoResult<Vec<_>>>()?; .collect::<FidoResult<Vec<_>>>()?;
// run with --features request_multiple // run with --features request_multiple
let (cred, _) = ctap::get_assertion_devices(&req, devices.iter_mut())?; let (cred, _) =
ctap::get_assertion_devices(&req, devices.iter_mut(), Some(Duration::from_secs(10)))?;
println!("Success, got assertion for: {}", hex::encode(&cred.id)); println!("Success, got assertion for: {}", hex::encode(&cred.id));
Ok(()) Ok(())
} }

View File

@@ -23,6 +23,8 @@ pub struct CborErrorCode(u8);
pub enum FidoErrorKind { pub enum FidoErrorKind {
#[fail(display = "Read/write error with device.")] #[fail(display = "Read/write error with device.")]
Io, Io,
#[fail(display = "Operation timed out")]
Timeout,
#[fail(display = "Error while reading packet from device.")] #[fail(display = "Error while reading packet from device.")]
ReadPacket, ReadPacket,
#[fail(display = "Error while writing packet to device.")] #[fail(display = "Error while writing packet to device.")]
@@ -47,7 +49,7 @@ pub enum FidoErrorKind {
DecryptPin, DecryptPin,
#[fail(display = "Failed to verify response signature.")] #[fail(display = "Failed to verify response signature.")]
VerifySignature, VerifySignature,
#[fail(display = "Supplied key has incorrect type.")] #[fail(display = "Failed to verify response signature.")]
KeyType, KeyType,
#[fail(display = "Device returned error: {}", _0)] #[fail(display = "Device returned error: {}", _0)]
CborError(CborErrorCode), CborError(CborErrorCode),

View File

@@ -1,6 +1,4 @@
use crate::{ use crate::{FidoAssertionRequest, FidoAssertionRequestBuilder, FidoCredentialRequest};
FidoAssertionRequest, FidoAssertionRequestBuilder, FidoCredentialRequest,
};
use crate::{FidoCredential, FidoDevice, FidoErrorKind, FidoResult}; use crate::{FidoCredential, FidoDevice, FidoErrorKind, FidoResult};
use cbor_codec::value::{Bytes, Int, Key, Text, Value}; use cbor_codec::value::{Bytes, Int, Key, Text, Value};
use cbor_codec::Encoder; use cbor_codec::Encoder;
@@ -13,7 +11,6 @@ use rust_crypto::sha2::Sha256;
use std::collections::BTreeMap; use std::collections::BTreeMap;
use std::io::Cursor; use std::io::Cursor;
pub trait HmacExtension { pub trait HmacExtension {
fn extension_name() -> &'static str { fn extension_name() -> &'static str {
"hmac-secret" "hmac-secret"

View File

@@ -457,7 +457,6 @@ impl FidoDevice {
/// ///
/// This method will fail if a PIN is required but the device is not /// This method will fail if a PIN is required but the device is not
/// unlocked or if the device returns malformed data. /// unlocked or if the device returns malformed data.
pub fn get_assertion<'a, 'b>( pub fn get_assertion<'a, 'b>(
&mut self, &mut self,
assertion: &FidoAssertionRequest<'a, 'b>, assertion: &FidoAssertionRequest<'a, 'b>,

View File

@@ -7,7 +7,8 @@ use crate::{
use crossbeam::thread; use crossbeam::thread;
#[cfg(feature = "request_multiple")] #[cfg(feature = "request_multiple")]
use std::sync::mpsc::channel; use std::sync::mpsc::channel;
#[cfg(feature = "request_multiple")]
use std::time::Duration;
#[cfg(feature = "request_multiple")] #[cfg(feature = "request_multiple")]
pub fn request_multiple_devices< pub fn request_multiple_devices<
'a, 'a,
@@ -15,6 +16,7 @@ pub fn request_multiple_devices<
F: Fn(&mut FidoDevice) -> FidoResult<T> + 'a + Sync, F: Fn(&mut FidoDevice) -> FidoResult<T> + 'a + Sync,
>( >(
devices: impl Iterator<Item = (&'a mut FidoDevice, &'a F)>, devices: impl Iterator<Item = (&'a mut FidoDevice, &'a F)>,
timeout: Option<Duration>,
) -> FidoResult<T> { ) -> FidoResult<T> {
thread::scope(|scope| -> FidoResult<T> { thread::scope(|scope| -> FidoResult<T> {
let (tx, rx) = channel(); let (tx, rx) = channel();
@@ -26,22 +28,41 @@ pub fn request_multiple_devices<
Ok((cancel, thread_handle)) Ok((cancel, thread_handle))
}) })
.collect::<FidoResult<Vec<_>>>()?; .collect::<FidoResult<Vec<_>>>()?;
let mut err = None; let mut err = None;
for res in rx.iter().take(handles.len()) { let mut slept = Duration::from_millis(0);
match res { let interval = Duration::from_millis(10);
Ok(_) => { let mut received = 0usize;
let res = loop {
if timeout.map(|t| t < slept).unwrap_or(true) {
break if let Some(cause) = err {
cause
} else {
Err(FidoErrorKind::Timeout.into())
};
}
if received == handles.len() {
break err.unwrap();
}
if let Ok(msg) = rx.recv_timeout(interval) {
received += 1;
match msg {
e @ Err(_) => {
err = Some(e);
}
res @ Ok(_) => {
break res;
}
}
} else {
slept += interval;
}
};
for (mut cancel, join) in handles { for (mut cancel, join) in handles {
// Canceling out of courtesy don't care if it fails // Canceling out of courtesy don't care if it fails
let _ = cancel.cancel(); let _ = cancel.cancel();
let _ = join.join(); let _ = join.join();
} }
return res; res
}
e => err = Some(e),
}
}
err.unwrap_or(Err(FidoErrorKind::DeviceUnsupported.into()))
}) })
.unwrap() .unwrap()
} }
@@ -51,9 +72,10 @@ pub fn request_multiple_devices<
pub fn get_assertion_devices<'a>( pub fn get_assertion_devices<'a>(
assertion_request: &'a FidoAssertionRequest, assertion_request: &'a FidoAssertionRequest,
devices: impl Iterator<Item = &'a mut FidoDevice>, devices: impl Iterator<Item = &'a mut FidoDevice>,
timeout: Option<Duration>,
) -> FidoResult<(&'a FidoCredential, AuthenticatorData)> { ) -> FidoResult<(&'a FidoCredential, AuthenticatorData)> {
let get_assertion = |device: &mut FidoDevice| device.get_assertion(assertion_request); let get_assertion = |device: &mut FidoDevice| device.get_assertion(assertion_request);
request_multiple_devices(devices.map(|device| (device, &get_assertion))) request_multiple_devices(devices.map(|device| (device, &get_assertion)), timeout)
} }
/// Will send the `credential_request` to all supplied `devices` and return either the first credential or the last error /// Will send the `credential_request` to all supplied `devices` and return either the first credential or the last error
@@ -61,7 +83,8 @@ pub fn get_assertion_devices<'a>(
pub fn make_credential_devices<'a>( pub fn make_credential_devices<'a>(
credential_request: &'a FidoCredentialRequest, credential_request: &'a FidoCredentialRequest,
devices: impl Iterator<Item = &'a mut FidoDevice>, devices: impl Iterator<Item = &'a mut FidoDevice>,
timeout: Option<Duration>,
) -> FidoResult<FidoCredential> { ) -> FidoResult<FidoCredential> {
let make_credential = |device: &mut FidoDevice| device.make_credential(credential_request); let make_credential = |device: &mut FidoDevice| device.make_credential(credential_request);
request_multiple_devices(devices.map(|device| (device, &make_credential))) request_multiple_devices(devices.map(|device| (device, &make_credential)), timeout)
} }