run python black
This commit is contained in:
Conor Patrick
@@ -50,14 +50,14 @@ class Packet(object):
|
||||
|
||||
class Tester:
|
||||
def __init__(self,):
|
||||
self.origin = 'https://examplo.org'
|
||||
self.host = 'examplo.org'
|
||||
self.origin = "https://examplo.org"
|
||||
self.host = "examplo.org"
|
||||
|
||||
def find_device(self,):
|
||||
print(list(CtapHidDevice.list_devices()))
|
||||
dev = next(CtapHidDevice.list_devices(), None)
|
||||
if not dev:
|
||||
raise RuntimeError('No FIDO device found')
|
||||
raise RuntimeError("No FIDO device found")
|
||||
self.dev = dev
|
||||
self.client = Fido2Client(dev, self.origin)
|
||||
self.ctap = self.client.ctap2
|
||||
@@ -66,23 +66,23 @@ class Tester:
|
||||
# cmd,resp = self.recv_raw()
|
||||
|
||||
def send_data(self, cmd, data):
|
||||
if type(data) != type(b''):
|
||||
data = struct.pack('%dB' % len(data), *[ord(x) for x in data])
|
||||
if type(data) != type(b""):
|
||||
data = struct.pack("%dB" % len(data), *[ord(x) for x in data])
|
||||
with Timeout(1.0) as event:
|
||||
return self.dev.call(cmd, data, event)
|
||||
|
||||
def send_raw(self, data, cid=None):
|
||||
if cid is None:
|
||||
cid = self.dev._dev.cid
|
||||
elif type(cid) != type(b''):
|
||||
cid = struct.pack('%dB' % len(cid), *[ord(x) for x in cid])
|
||||
if type(data) != type(b''):
|
||||
data = struct.pack('%dB' % len(data), *[ord(x) for x in data])
|
||||
elif type(cid) != type(b""):
|
||||
cid = struct.pack("%dB" % len(cid), *[ord(x) for x in cid])
|
||||
if type(data) != type(b""):
|
||||
data = struct.pack("%dB" % len(data), *[ord(x) for x in data])
|
||||
data = cid + data
|
||||
l = len(data)
|
||||
if l != 64:
|
||||
pad = '\x00' * (64 - l)
|
||||
pad = struct.pack('%dB' % len(pad), *[ord(x) for x in pad])
|
||||
pad = "\x00" * (64 - l)
|
||||
pad = struct.pack("%dB" % len(pad), *[ord(x) for x in pad])
|
||||
data = data + pad
|
||||
data = list(data)
|
||||
assert len(data) == 64
|
||||
@@ -92,8 +92,8 @@ class Tester:
|
||||
return self.dev._dev.cid
|
||||
|
||||
def set_cid(self, cid):
|
||||
if type(cid) not in [type(b''), type(bytearray())]:
|
||||
cid = struct.pack('%dB' % len(cid), *[ord(x) for x in cid])
|
||||
if type(cid) not in [type(b""), type(bytearray())]:
|
||||
cid = struct.pack("%dB" % len(cid), *[ord(x) for x in cid])
|
||||
self.dev._dev.cid = cid
|
||||
|
||||
def recv_raw(self,):
|
||||
@@ -107,7 +107,7 @@ class Tester:
|
||||
if data[0] != 0:
|
||||
raise CtapError(data[0])
|
||||
elif data[0] != err:
|
||||
raise ValueError('Unexpected error: %02x' % data[0])
|
||||
raise ValueError("Unexpected error: %02x" % data[0])
|
||||
|
||||
def test_long_ping(self):
|
||||
amt = 1000
|
||||
@@ -120,48 +120,48 @@ class Tester:
|
||||
# if (delt < 140 ):
|
||||
# raise RuntimeError('Fob is too fast (%d ms)' % delt)
|
||||
if delt > 555 * (amt / 1000):
|
||||
raise RuntimeError('Fob is too slow (%d ms)' % delt)
|
||||
raise RuntimeError("Fob is too slow (%d ms)" % delt)
|
||||
if r != pingdata:
|
||||
raise ValueError('Ping data not echo\'d')
|
||||
print('1000 byte ping time: %s ms' % delt)
|
||||
raise ValueError("Ping data not echo'd")
|
||||
print("1000 byte ping time: %s ms" % delt)
|
||||
except CtapError as e:
|
||||
print('7609 byte Ping failed:', e)
|
||||
raise RuntimeError('ping failed')
|
||||
print('PASS: 7609 byte ping')
|
||||
print("7609 byte Ping failed:", e)
|
||||
raise RuntimeError("ping failed")
|
||||
print("PASS: 7609 byte ping")
|
||||
# sys.flush(sys.sto)
|
||||
sys.stdout.flush()
|
||||
|
||||
def test_hid(self, check_timeouts=False):
|
||||
if check_timeouts:
|
||||
print('Test idle')
|
||||
print("Test idle")
|
||||
try:
|
||||
cmd, resp = self.recv_raw()
|
||||
except socket.timeout:
|
||||
print('Pass: Idle')
|
||||
print("Pass: Idle")
|
||||
|
||||
print('Test init')
|
||||
r = self.send_data(CTAPHID.INIT, '\x11\x11\x11\x11\x11\x11\x11\x11')
|
||||
print("Test init")
|
||||
r = self.send_data(CTAPHID.INIT, "\x11\x11\x11\x11\x11\x11\x11\x11")
|
||||
|
||||
pingdata = os.urandom(100)
|
||||
try:
|
||||
r = self.send_data(CTAPHID.PING, pingdata)
|
||||
if r != pingdata:
|
||||
raise ValueError('Ping data not echo\'d')
|
||||
raise ValueError("Ping data not echo'd")
|
||||
except CtapError as e:
|
||||
print('100 byte Ping failed:', e)
|
||||
raise RuntimeError('ping failed')
|
||||
print('PASS: 100 byte ping')
|
||||
print("100 byte Ping failed:", e)
|
||||
raise RuntimeError("ping failed")
|
||||
print("PASS: 100 byte ping")
|
||||
|
||||
self.test_long_ping()
|
||||
|
||||
try:
|
||||
r = self.send_data(CTAPHID.WINK, '')
|
||||
r = self.send_data(CTAPHID.WINK, "")
|
||||
print(hexlify(r))
|
||||
# assert(len(r) == 0)
|
||||
except CtapError as e:
|
||||
print('wink failed:', e)
|
||||
raise RuntimeError('wink failed')
|
||||
print('PASS: wink')
|
||||
print("wink failed:", e)
|
||||
raise RuntimeError("wink failed")
|
||||
print("PASS: wink")
|
||||
|
||||
# try:
|
||||
# r = self.send_data(CTAPHID.WINK, 'we9gofrei8g')
|
||||
@@ -171,87 +171,87 @@ class Tester:
|
||||
# print('PASS: malformed wink')
|
||||
|
||||
try:
|
||||
r = self.send_data(CTAPHID.CBOR, '')
|
||||
r = self.send_data(CTAPHID.CBOR, "")
|
||||
if len(r) > 1 or r[0] == 0:
|
||||
raise RuntimeError('Cbor is supposed to have payload')
|
||||
raise RuntimeError("Cbor is supposed to have payload")
|
||||
except CtapError as e:
|
||||
assert e.code == CtapError.ERR.INVALID_LENGTH
|
||||
print('PASS: no data cbor')
|
||||
print("PASS: no data cbor")
|
||||
|
||||
try:
|
||||
r = self.send_data(CTAPHID.MSG, '')
|
||||
r = self.send_data(CTAPHID.MSG, "")
|
||||
print(hexlify(r))
|
||||
if len(r) > 2:
|
||||
raise RuntimeError('MSG is supposed to have payload')
|
||||
raise RuntimeError("MSG is supposed to have payload")
|
||||
except CtapError as e:
|
||||
assert e.code == CtapError.ERR.INVALID_LENGTH
|
||||
print('PASS: no data msg')
|
||||
print("PASS: no data msg")
|
||||
|
||||
try:
|
||||
r = self.send_data(CTAPHID.INIT, '\x11\x22\x33\x44\x55\x66\x77\x88')
|
||||
r = self.send_data(CTAPHID.INIT, "\x11\x22\x33\x44\x55\x66\x77\x88")
|
||||
except CtapError as e:
|
||||
raise RuntimeError('resync fail: ', e)
|
||||
print('PASS: resync')
|
||||
raise RuntimeError("resync fail: ", e)
|
||||
print("PASS: resync")
|
||||
|
||||
try:
|
||||
r = self.send_data(0x66, '')
|
||||
raise RuntimeError('Invalid command did not return error')
|
||||
r = self.send_data(0x66, "")
|
||||
raise RuntimeError("Invalid command did not return error")
|
||||
except CtapError as e:
|
||||
assert e.code == CtapError.ERR.INVALID_COMMAND
|
||||
print('PASS: invalid HID command')
|
||||
print("PASS: invalid HID command")
|
||||
|
||||
print('Sending packet with too large of a length.')
|
||||
self.send_raw('\x81\x1d\xba\x00')
|
||||
print("Sending packet with too large of a length.")
|
||||
self.send_raw("\x81\x1d\xba\x00")
|
||||
cmd, resp = self.recv_raw()
|
||||
self.check_error(resp, CtapError.ERR.INVALID_LENGTH)
|
||||
print('PASS: invalid length')
|
||||
print("PASS: invalid length")
|
||||
|
||||
r = self.send_data(CTAPHID.PING, '\x44' * 200)
|
||||
print('Sending packets that skip a sequence number.')
|
||||
self.send_raw('\x81\x04\x90')
|
||||
self.send_raw('\x00')
|
||||
self.send_raw('\x01')
|
||||
r = self.send_data(CTAPHID.PING, "\x44" * 200)
|
||||
print("Sending packets that skip a sequence number.")
|
||||
self.send_raw("\x81\x04\x90")
|
||||
self.send_raw("\x00")
|
||||
self.send_raw("\x01")
|
||||
# skip 2
|
||||
self.send_raw('\x03')
|
||||
self.send_raw("\x03")
|
||||
cmd, resp = self.recv_raw()
|
||||
self.check_error(resp, CtapError.ERR.INVALID_SEQ)
|
||||
if check_timeouts:
|
||||
cmd, resp = self.recv_raw()
|
||||
assert cmd == 0xBF # timeout
|
||||
print('PASS: invalid sequence')
|
||||
print("PASS: invalid sequence")
|
||||
|
||||
print('Resync and send ping')
|
||||
print("Resync and send ping")
|
||||
try:
|
||||
r = self.send_data(CTAPHID.INIT, '\x11\x22\x33\x44\x55\x66\x77\x88')
|
||||
r = self.send_data(CTAPHID.INIT, "\x11\x22\x33\x44\x55\x66\x77\x88")
|
||||
pingdata = os.urandom(100)
|
||||
r = self.send_data(CTAPHID.PING, pingdata)
|
||||
if r != pingdata:
|
||||
raise ValueError('Ping data not echo\'d')
|
||||
raise ValueError("Ping data not echo'd")
|
||||
except CtapError as e:
|
||||
raise RuntimeError('resync fail: ', e)
|
||||
print('PASS: resync and ping')
|
||||
raise RuntimeError("resync fail: ", e)
|
||||
print("PASS: resync and ping")
|
||||
|
||||
print('Send ping and abort it')
|
||||
self.send_raw('\x81\x04\x00')
|
||||
self.send_raw('\x00')
|
||||
self.send_raw('\x01')
|
||||
print("Send ping and abort it")
|
||||
self.send_raw("\x81\x04\x00")
|
||||
self.send_raw("\x00")
|
||||
self.send_raw("\x01")
|
||||
try:
|
||||
r = self.send_data(CTAPHID.INIT, '\x11\x22\x33\x44\x55\x66\x77\x88')
|
||||
r = self.send_data(CTAPHID.INIT, "\x11\x22\x33\x44\x55\x66\x77\x88")
|
||||
except CtapError as e:
|
||||
raise RuntimeError('resync fail: ', e)
|
||||
print('PASS: interrupt ping with resync')
|
||||
raise RuntimeError("resync fail: ", e)
|
||||
print("PASS: interrupt ping with resync")
|
||||
|
||||
print('Send ping and abort it with different cid, expect timeout')
|
||||
print("Send ping and abort it with different cid, expect timeout")
|
||||
oldcid = self.cid()
|
||||
newcid = '\x11\x22\x33\x44'
|
||||
self.send_raw('\x81\x10\x00')
|
||||
self.send_raw('\x00')
|
||||
self.send_raw('\x01')
|
||||
newcid = "\x11\x22\x33\x44"
|
||||
self.send_raw("\x81\x10\x00")
|
||||
self.send_raw("\x00")
|
||||
self.send_raw("\x01")
|
||||
self.set_cid(newcid)
|
||||
self.send_raw(
|
||||
'\x86\x00\x08\x11\x22\x33\x44\x55\x66\x77\x88'
|
||||
"\x86\x00\x08\x11\x22\x33\x44\x55\x66\x77\x88"
|
||||
) # init from different cid
|
||||
print('wait for init response')
|
||||
print("wait for init response")
|
||||
cmd, r = self.recv_raw() # init response
|
||||
assert cmd == 0x86
|
||||
self.set_cid(oldcid)
|
||||
@@ -260,51 +260,51 @@ class Tester:
|
||||
cmd, r = self.recv_raw() # timeout response
|
||||
assert cmd == 0xBF
|
||||
|
||||
print('PASS: resync and timeout')
|
||||
print("PASS: resync and timeout")
|
||||
|
||||
print('Test timeout')
|
||||
self.send_data(CTAPHID.INIT, '\x11\x22\x33\x44\x55\x66\x77\x88')
|
||||
print("Test timeout")
|
||||
self.send_data(CTAPHID.INIT, "\x11\x22\x33\x44\x55\x66\x77\x88")
|
||||
t1 = time.time() * 1000
|
||||
self.send_raw('\x81\x04\x00')
|
||||
self.send_raw('\x00')
|
||||
self.send_raw('\x01')
|
||||
self.send_raw("\x81\x04\x00")
|
||||
self.send_raw("\x00")
|
||||
self.send_raw("\x01")
|
||||
cmd, r = self.recv_raw() # timeout response
|
||||
t2 = time.time() * 1000
|
||||
delt = t2 - t1
|
||||
assert cmd == 0xBF
|
||||
assert r[0] == CtapError.ERR.TIMEOUT
|
||||
assert delt < 1000 and delt > 400
|
||||
print('Pass timeout')
|
||||
print("Pass timeout")
|
||||
|
||||
print('Test not cont')
|
||||
self.send_data(CTAPHID.INIT, '\x11\x22\x33\x44\x55\x66\x77\x88')
|
||||
self.send_raw('\x81\x04\x00')
|
||||
self.send_raw('\x00')
|
||||
self.send_raw('\x01')
|
||||
self.send_raw('\x81\x10\x00') # init packet
|
||||
print("Test not cont")
|
||||
self.send_data(CTAPHID.INIT, "\x11\x22\x33\x44\x55\x66\x77\x88")
|
||||
self.send_raw("\x81\x04\x00")
|
||||
self.send_raw("\x00")
|
||||
self.send_raw("\x01")
|
||||
self.send_raw("\x81\x10\x00") # init packet
|
||||
cmd, r = self.recv_raw() # timeout response
|
||||
assert cmd == 0xBF
|
||||
assert r[0] == CtapError.ERR.INVALID_SEQ
|
||||
print('PASS: Test not cont')
|
||||
print("PASS: Test not cont")
|
||||
|
||||
if check_timeouts:
|
||||
print('Check random cont ignored')
|
||||
self.send_data(CTAPHID.INIT, '\x11\x22\x33\x44\x55\x66\x77\x88')
|
||||
self.send_raw('\x01\x10\x00')
|
||||
print("Check random cont ignored")
|
||||
self.send_data(CTAPHID.INIT, "\x11\x22\x33\x44\x55\x66\x77\x88")
|
||||
self.send_raw("\x01\x10\x00")
|
||||
try:
|
||||
cmd, r = self.recv_raw() # timeout response
|
||||
except socket.timeout:
|
||||
pass
|
||||
print('PASS: random cont')
|
||||
print("PASS: random cont")
|
||||
|
||||
print('Check busy')
|
||||
print("Check busy")
|
||||
t1 = time.time() * 1000
|
||||
self.send_data(CTAPHID.INIT, '\x11\x22\x33\x44\x55\x66\x77\x88')
|
||||
self.send_data(CTAPHID.INIT, "\x11\x22\x33\x44\x55\x66\x77\x88")
|
||||
oldcid = self.cid()
|
||||
newcid = '\x11\x22\x33\x44'
|
||||
self.send_raw('\x81\x04\x00')
|
||||
newcid = "\x11\x22\x33\x44"
|
||||
self.send_raw("\x81\x04\x00")
|
||||
self.set_cid(newcid)
|
||||
self.send_raw('\x81\x04\x00')
|
||||
self.send_raw("\x81\x04\x00")
|
||||
cmd, r = self.recv_raw() # busy response
|
||||
t2 = time.time() * 1000
|
||||
assert t2 - t1 < 100
|
||||
@@ -315,25 +315,25 @@ class Tester:
|
||||
cmd, r = self.recv_raw() # timeout response
|
||||
assert cmd == 0xBF
|
||||
assert r[0] == CtapError.ERR.TIMEOUT
|
||||
print('PASS: busy')
|
||||
print("PASS: busy")
|
||||
|
||||
print('Check busy interleaved')
|
||||
cid1 = '\x11\x22\x33\x44'
|
||||
cid2 = '\x01\x22\x33\x44'
|
||||
print("Check busy interleaved")
|
||||
cid1 = "\x11\x22\x33\x44"
|
||||
cid2 = "\x01\x22\x33\x44"
|
||||
self.set_cid(cid2)
|
||||
self.send_data(CTAPHID.INIT, '\x11\x22\x33\x44\x55\x66\x77\x88')
|
||||
self.send_data(CTAPHID.INIT, "\x11\x22\x33\x44\x55\x66\x77\x88")
|
||||
self.set_cid(cid1)
|
||||
self.send_data(CTAPHID.INIT, '\x11\x22\x33\x44\x55\x66\x77\x88')
|
||||
self.send_raw('\x81\x00\x63') # echo 99 bytes first channel
|
||||
self.send_data(CTAPHID.INIT, "\x11\x22\x33\x44\x55\x66\x77\x88")
|
||||
self.send_raw("\x81\x00\x63") # echo 99 bytes first channel
|
||||
|
||||
self.set_cid(cid2) # send ping on 2nd channel
|
||||
self.send_raw('\x81\x00\x63')
|
||||
self.send_raw('\x00')
|
||||
self.send_raw("\x81\x00\x63")
|
||||
self.send_raw("\x00")
|
||||
|
||||
cmd, r = self.recv_raw() # busy response
|
||||
|
||||
self.set_cid(cid1) # finish 1st channel ping
|
||||
self.send_raw('\x00')
|
||||
self.send_raw("\x00")
|
||||
|
||||
self.set_cid(cid2)
|
||||
|
||||
@@ -349,35 +349,35 @@ class Tester:
|
||||
cmd, r = self.recv_raw() # timeout
|
||||
assert cmd == 0xBF
|
||||
assert r[0] == CtapError.ERR.TIMEOUT
|
||||
print('PASS: busy interleaved')
|
||||
print("PASS: busy interleaved")
|
||||
|
||||
if check_timeouts:
|
||||
print('Test idle, wait for timeout')
|
||||
print("Test idle, wait for timeout")
|
||||
sys.stdout.flush()
|
||||
try:
|
||||
cmd, resp = self.recv_raw()
|
||||
except socket.timeout:
|
||||
print('Pass: Idle')
|
||||
print("Pass: Idle")
|
||||
|
||||
print('Test cid 0 is invalid')
|
||||
self.set_cid('\x00\x00\x00\x00')
|
||||
print("Test cid 0 is invalid")
|
||||
self.set_cid("\x00\x00\x00\x00")
|
||||
self.send_raw(
|
||||
'\x86\x00\x08\x11\x22\x33\x44\x55\x66\x77\x88', cid='\x00\x00\x00\x00'
|
||||
"\x86\x00\x08\x11\x22\x33\x44\x55\x66\x77\x88", cid="\x00\x00\x00\x00"
|
||||
)
|
||||
cmd, r = self.recv_raw() # timeout
|
||||
assert cmd == 0xBF
|
||||
assert r[0] == CtapError.ERR.INVALID_CHANNEL
|
||||
print('Pass: cid 0')
|
||||
print("Pass: cid 0")
|
||||
|
||||
print('Test invalid broadcast cid use')
|
||||
self.set_cid('\xff\xff\xff\xff')
|
||||
print("Test invalid broadcast cid use")
|
||||
self.set_cid("\xff\xff\xff\xff")
|
||||
self.send_raw(
|
||||
'\x81\x00\x08\x11\x22\x33\x44\x55\x66\x77\x88', cid='\xff\xff\xff\xff'
|
||||
"\x81\x00\x08\x11\x22\x33\x44\x55\x66\x77\x88", cid="\xff\xff\xff\xff"
|
||||
)
|
||||
cmd, r = self.recv_raw() # timeout
|
||||
assert cmd == 0xBF
|
||||
assert r[0] == CtapError.ERR.INVALID_CHANNEL
|
||||
print('Pass: cid broadcast')
|
||||
print("Pass: cid broadcast")
|
||||
|
||||
def test_u2f(self,):
|
||||
pass
|
||||
@@ -385,46 +385,46 @@ class Tester:
|
||||
def test_fido2_simple(self, pin_token=None):
|
||||
creds = []
|
||||
exclude_list = []
|
||||
rp = {'id': self.host, 'name': 'ExaRP'}
|
||||
user = {'id': b'usee_od', 'name': 'AB User'}
|
||||
challenge = 'Y2hhbGxlbmdl'
|
||||
rp = {"id": self.host, "name": "ExaRP"}
|
||||
user = {"id": b"usee_od", "name": "AB User"}
|
||||
challenge = "Y2hhbGxlbmdl"
|
||||
PIN = pin_token
|
||||
|
||||
fake_id1 = array.array('B', [randint(0, 255) for i in range(0, 150)]).tobytes()
|
||||
fake_id2 = array.array('B', [randint(0, 255) for i in range(0, 73)]).tobytes()
|
||||
fake_id1 = array.array("B", [randint(0, 255) for i in range(0, 150)]).tobytes()
|
||||
fake_id2 = array.array("B", [randint(0, 255) for i in range(0, 73)]).tobytes()
|
||||
|
||||
exclude_list.append({'id': fake_id1, 'type': 'public-key'})
|
||||
exclude_list.append({'id': fake_id2, 'type': 'public-key'})
|
||||
exclude_list.append({"id": fake_id1, "type": "public-key"})
|
||||
exclude_list.append({"id": fake_id2, "type": "public-key"})
|
||||
|
||||
print('MC')
|
||||
print("MC")
|
||||
t1 = time.time() * 1000
|
||||
attest, data = self.client.make_credential(
|
||||
rp, user, challenge, pin=PIN, exclude_list=[]
|
||||
)
|
||||
t2 = time.time() * 1000
|
||||
attest.verify(data.hash)
|
||||
print('Register valid (%d ms)' % (t2 - t1))
|
||||
print("Register valid (%d ms)" % (t2 - t1))
|
||||
|
||||
cred = attest.auth_data.credential_data
|
||||
creds.append(cred)
|
||||
|
||||
allow_list = [{'id': creds[0].credential_id, 'type': 'public-key'}]
|
||||
allow_list = [{"id": creds[0].credential_id, "type": "public-key"}]
|
||||
t1 = time.time() * 1000
|
||||
assertions, client_data = self.client.get_assertion(
|
||||
rp['id'], challenge, allow_list, pin=PIN
|
||||
rp["id"], challenge, allow_list, pin=PIN
|
||||
)
|
||||
t2 = time.time() * 1000
|
||||
assertions[0].verify(client_data.hash, creds[0].public_key)
|
||||
|
||||
print('Assertion valid (%d ms)' % (t2 - t1))
|
||||
print("Assertion valid (%d ms)" % (t2 - t1))
|
||||
|
||||
def test_fido2_brute_force(self):
|
||||
creds = []
|
||||
exclude_list = []
|
||||
rp = {'id': self.host, 'name': 'ExaRP'}
|
||||
user = {'id': b'usee_od', 'name': 'AB User'}
|
||||
rp = {"id": self.host, "name": "ExaRP"}
|
||||
user = {"id": b"usee_od", "name": "AB User"}
|
||||
PIN = None
|
||||
abc = 'abcdefghijklnmopqrstuvwxyz'
|
||||
abc = "abcdefghijklnmopqrstuvwxyz"
|
||||
abc += abc.upper()
|
||||
|
||||
self.ctap.reset()
|
||||
@@ -432,17 +432,17 @@ class Tester:
|
||||
for i in range(0, 2048 ** 2):
|
||||
creds = []
|
||||
|
||||
challenge = ''.join([abc[randint(0, len(abc) - 1)] for x in range(0, 32)])
|
||||
challenge = "".join([abc[randint(0, len(abc) - 1)] for x in range(0, 32)])
|
||||
|
||||
fake_id1 = array.array(
|
||||
'B', [randint(0, 255) for i in range(0, 150)]
|
||||
"B", [randint(0, 255) for i in range(0, 150)]
|
||||
).tostring()
|
||||
fake_id2 = array.array(
|
||||
'B', [randint(0, 255) for i in range(0, 73)]
|
||||
"B", [randint(0, 255) for i in range(0, 73)]
|
||||
).tostring()
|
||||
|
||||
exclude_list.append({'id': fake_id1, 'type': 'public-key'})
|
||||
exclude_list.append({'id': fake_id2, 'type': 'public-key'})
|
||||
exclude_list.append({"id": fake_id1, "type": "public-key"})
|
||||
exclude_list.append({"id": fake_id2, "type": "public-key"})
|
||||
|
||||
# for i in range(0,2048**2):
|
||||
for i in range(0, 1):
|
||||
@@ -453,7 +453,7 @@ class Tester:
|
||||
print(attest.auth_data.counter)
|
||||
t2 = time.time() * 1000
|
||||
attest.verify(data.hash)
|
||||
print('Register valid (%d ms)' % (t2 - t1))
|
||||
print("Register valid (%d ms)" % (t2 - t1))
|
||||
sys.stdout.flush()
|
||||
|
||||
cred = attest.auth_data.credential_data
|
||||
@@ -461,39 +461,39 @@ class Tester:
|
||||
|
||||
# for i in range(0,2048**2):
|
||||
for i in range(0, 1):
|
||||
allow_list = [{'id': creds[0].credential_id, 'type': 'public-key'}]
|
||||
allow_list = [{"id": creds[0].credential_id, "type": "public-key"}]
|
||||
t1 = time.time() * 1000
|
||||
assertions, client_data = self.client.get_assertion(
|
||||
rp['id'], challenge, allow_list, pin=PIN
|
||||
rp["id"], challenge, allow_list, pin=PIN
|
||||
)
|
||||
t2 = time.time() * 1000
|
||||
assertions[0].verify(client_data.hash, creds[0].public_key)
|
||||
print(assertions[0].auth_data.counter)
|
||||
|
||||
print('Assertion valid (%d ms)' % (t2 - t1))
|
||||
print("Assertion valid (%d ms)" % (t2 - t1))
|
||||
sys.stdout.flush()
|
||||
|
||||
def test_fido2(self):
|
||||
def test(self, pincode=None):
|
||||
creds = []
|
||||
exclude_list = []
|
||||
rp = {'id': self.host, 'name': 'ExaRP'}
|
||||
user = {'id': b'usee_od', 'name': 'AB User'}
|
||||
challenge = 'Y2hhbGxlbmdl'
|
||||
rp = {"id": self.host, "name": "ExaRP"}
|
||||
user = {"id": b"usee_od", "name": "AB User"}
|
||||
challenge = "Y2hhbGxlbmdl"
|
||||
PIN = pincode
|
||||
|
||||
fake_id1 = array.array(
|
||||
'B', [randint(0, 255) for i in range(0, 150)]
|
||||
"B", [randint(0, 255) for i in range(0, 150)]
|
||||
).tostring()
|
||||
fake_id2 = array.array(
|
||||
'B', [randint(0, 255) for i in range(0, 73)]
|
||||
"B", [randint(0, 255) for i in range(0, 73)]
|
||||
).tostring()
|
||||
|
||||
exclude_list.append({'id': fake_id1, 'type': 'public-key'})
|
||||
exclude_list.append({'id': fake_id2, 'type': 'public-key'})
|
||||
exclude_list.append({"id": fake_id1, "type": "public-key"})
|
||||
exclude_list.append({"id": fake_id2, "type": "public-key"})
|
||||
|
||||
# test make credential
|
||||
print('make 3 credentials')
|
||||
print("make 3 credentials")
|
||||
for i in range(0, 3):
|
||||
attest, data = self.client.make_credential(
|
||||
rp, user, challenge, pin=PIN, exclude_list=[]
|
||||
@@ -502,149 +502,149 @@ class Tester:
|
||||
cred = attest.auth_data.credential_data
|
||||
creds.append(cred)
|
||||
print(cred)
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
if PIN is not None:
|
||||
print('make credential with wrong pin code')
|
||||
print("make credential with wrong pin code")
|
||||
try:
|
||||
attest, data = self.client.make_credential(
|
||||
rp, user, challenge, pin=PIN + ' ', exclude_list=[]
|
||||
rp, user, challenge, pin=PIN + " ", exclude_list=[]
|
||||
)
|
||||
except CtapError as e:
|
||||
assert e.code == CtapError.ERR.PIN_INVALID
|
||||
except ClientError as e:
|
||||
assert e.cause.code == CtapError.ERR.PIN_INVALID
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
print('make credential with exclude list')
|
||||
print("make credential with exclude list")
|
||||
attest, data = self.client.make_credential(
|
||||
rp, user, challenge, pin=PIN, exclude_list=exclude_list
|
||||
)
|
||||
attest.verify(data.hash)
|
||||
cred = attest.auth_data.credential_data
|
||||
creds.append(cred)
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
print('make credential with exclude list including real credential')
|
||||
real_excl = [{'id': cred.credential_id, 'type': 'public-key'}]
|
||||
print("make credential with exclude list including real credential")
|
||||
real_excl = [{"id": cred.credential_id, "type": "public-key"}]
|
||||
try:
|
||||
attest, data = self.client.make_credential(
|
||||
rp, user, challenge, pin=PIN, exclude_list=exclude_list + real_excl
|
||||
)
|
||||
raise RuntimeError('Exclude list did not return expected error')
|
||||
raise RuntimeError("Exclude list did not return expected error")
|
||||
except CtapError as e:
|
||||
assert e.code == CtapError.ERR.CREDENTIAL_EXCLUDED
|
||||
except ClientError as e:
|
||||
assert e.cause.code == CtapError.ERR.CREDENTIAL_EXCLUDED
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
for i, x in enumerate(creds):
|
||||
print('get assertion %d' % i)
|
||||
allow_list = [{'id': x.credential_id, 'type': 'public-key'}]
|
||||
print("get assertion %d" % i)
|
||||
allow_list = [{"id": x.credential_id, "type": "public-key"}]
|
||||
assertions, client_data = self.client.get_assertion(
|
||||
rp['id'], challenge, allow_list, pin=PIN
|
||||
rp["id"], challenge, allow_list, pin=PIN
|
||||
)
|
||||
assertions[0].verify(client_data.hash, x.public_key)
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
if PIN is not None:
|
||||
print('get assertion with wrong pin code')
|
||||
print("get assertion with wrong pin code")
|
||||
try:
|
||||
assertions, client_data = self.client.get_assertion(
|
||||
rp['id'], challenge, allow_list, pin=PIN + ' '
|
||||
rp["id"], challenge, allow_list, pin=PIN + " "
|
||||
)
|
||||
except CtapError as e:
|
||||
assert e.code == CtapError.ERR.PIN_INVALID
|
||||
except ClientError as e:
|
||||
assert e.cause.code == CtapError.ERR.PIN_INVALID
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
print('get multiple assertions')
|
||||
allow_list = [{'id': x.credential_id, 'type': 'public-key'} for x in creds]
|
||||
print("get multiple assertions")
|
||||
allow_list = [{"id": x.credential_id, "type": "public-key"} for x in creds]
|
||||
assertions, client_data = self.client.get_assertion(
|
||||
rp['id'], challenge, allow_list, pin=PIN
|
||||
rp["id"], challenge, allow_list, pin=PIN
|
||||
)
|
||||
|
||||
for ass, cred in zip(assertions, creds):
|
||||
i += 1
|
||||
|
||||
ass.verify(client_data.hash, cred.public_key)
|
||||
print('%d verified' % i)
|
||||
print('PASS')
|
||||
print("%d verified" % i)
|
||||
print("PASS")
|
||||
|
||||
print('Reset device')
|
||||
print("Reset device")
|
||||
try:
|
||||
self.ctap.reset()
|
||||
except CtapError as e:
|
||||
print('Warning, reset failed: ', e)
|
||||
print("Warning, reset failed: ", e)
|
||||
pass
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
test(self, None)
|
||||
|
||||
print('Set a pin code')
|
||||
PIN = '1122aabbwfg0h9g !@#=='
|
||||
print("Set a pin code")
|
||||
PIN = "1122aabbwfg0h9g !@#=="
|
||||
self.client.pin_protocol.set_pin(PIN)
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
print('Illegally set pin code again')
|
||||
print("Illegally set pin code again")
|
||||
try:
|
||||
self.client.pin_protocol.set_pin(PIN)
|
||||
except CtapError as e:
|
||||
assert e.code == CtapError.ERR.NOT_ALLOWED
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
print('Change pin code')
|
||||
PIN2 = PIN + '_pin2'
|
||||
print("Change pin code")
|
||||
PIN2 = PIN + "_pin2"
|
||||
self.client.pin_protocol.change_pin(PIN, PIN2)
|
||||
PIN = PIN2
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
print('Change pin code using wrong pin')
|
||||
print("Change pin code using wrong pin")
|
||||
try:
|
||||
self.client.pin_protocol.change_pin(PIN.replace('a', 'b'), '1234')
|
||||
self.client.pin_protocol.change_pin(PIN.replace("a", "b"), "1234")
|
||||
except CtapError as e:
|
||||
assert e.code == CtapError.ERR.PIN_INVALID
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
print('MC using wrong pin')
|
||||
print("MC using wrong pin")
|
||||
try:
|
||||
self.test_fido2_simple('abcd3')
|
||||
self.test_fido2_simple("abcd3")
|
||||
except ClientError as e:
|
||||
assert e.cause.code == CtapError.ERR.PIN_INVALID
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
print('get info')
|
||||
print("get info")
|
||||
inf = self.ctap.get_info()
|
||||
print('PASS')
|
||||
print("PASS")
|
||||
|
||||
self.test_fido2_simple(PIN)
|
||||
|
||||
print('Re-run make_credential and get_assertion tests with pin code')
|
||||
print("Re-run make_credential and get_assertion tests with pin code")
|
||||
test(self, PIN)
|
||||
|
||||
print('Reset device')
|
||||
print("Reset device")
|
||||
try:
|
||||
self.ctap.reset()
|
||||
except CtapError as e:
|
||||
print('Warning, reset failed: ', e)
|
||||
print('PASS')
|
||||
print("Warning, reset failed: ", e)
|
||||
print("PASS")
|
||||
|
||||
def test_rk(self,):
|
||||
creds = []
|
||||
rp = {'id': self.host, 'name': 'ExaRP'}
|
||||
user0 = {'id': b'first one', 'name': 'single User'}
|
||||
rp = {"id": self.host, "name": "ExaRP"}
|
||||
user0 = {"id": b"first one", "name": "single User"}
|
||||
|
||||
users = [
|
||||
{'id': b'user' + os.urandom(16), 'name': 'AB User'} for i in range(0, 2)
|
||||
{"id": b"user" + os.urandom(16), "name": "AB User"} for i in range(0, 2)
|
||||
]
|
||||
challenge = 'Y2hhbGxlbmdl'
|
||||
challenge = "Y2hhbGxlbmdl"
|
||||
PIN = None
|
||||
print('reset')
|
||||
print("reset")
|
||||
self.ctap.reset()
|
||||
# if PIN: self.client.pin_protocol.set_pin(PIN)
|
||||
|
||||
print('registering 1 user with RK')
|
||||
print("registering 1 user with RK")
|
||||
t1 = time.time() * 1000
|
||||
attest, data = self.client.make_credential(
|
||||
rp, user0, challenge, pin=PIN, exclude_list=[], rk=True
|
||||
@@ -652,20 +652,20 @@ class Tester:
|
||||
t2 = time.time() * 1000
|
||||
attest.verify(data.hash)
|
||||
creds.append(attest.auth_data.credential_data)
|
||||
print('Register valid (%d ms)' % (t2 - t1))
|
||||
print("Register valid (%d ms)" % (t2 - t1))
|
||||
|
||||
print('1 assertion')
|
||||
print("1 assertion")
|
||||
t1 = time.time() * 1000
|
||||
assertions, client_data = self.client.get_assertion(
|
||||
rp['id'], challenge, pin=PIN
|
||||
rp["id"], challenge, pin=PIN
|
||||
)
|
||||
t2 = time.time() * 1000
|
||||
assertions[0].verify(client_data.hash, creds[0].public_key)
|
||||
print('Assertion valid (%d ms)' % (t2 - t1))
|
||||
print("Assertion valid (%d ms)" % (t2 - t1))
|
||||
|
||||
print(assertions[0], client_data)
|
||||
|
||||
print('registering %d users with RK' % len(users))
|
||||
print("registering %d users with RK" % len(users))
|
||||
for i in range(0, len(users)):
|
||||
t1 = time.time() * 1000
|
||||
attest, data = self.client.make_credential(
|
||||
@@ -673,22 +673,22 @@ class Tester:
|
||||
)
|
||||
t2 = time.time() * 1000
|
||||
attest.verify(data.hash)
|
||||
print('Register valid (%d ms)' % (t2 - t1))
|
||||
print("Register valid (%d ms)" % (t2 - t1))
|
||||
|
||||
creds.append(attest.auth_data.credential_data)
|
||||
|
||||
t1 = time.time() * 1000
|
||||
assertions, client_data = self.client.get_assertion(
|
||||
rp['id'], challenge, pin=PIN
|
||||
rp["id"], challenge, pin=PIN
|
||||
)
|
||||
t2 = time.time() * 1000
|
||||
|
||||
for x, y in zip(assertions, creds):
|
||||
x.verify(client_data.hash, y.public_key)
|
||||
|
||||
print('Assertion(s) valid (%d ms)' % (t2 - t1))
|
||||
print("Assertion(s) valid (%d ms)" % (t2 - t1))
|
||||
|
||||
print('registering a duplicate user ')
|
||||
print("registering a duplicate user ")
|
||||
|
||||
t1 = time.time() * 1000
|
||||
attest, data = self.client.make_credential(
|
||||
@@ -697,24 +697,24 @@ class Tester:
|
||||
t2 = time.time() * 1000
|
||||
attest.verify(data.hash)
|
||||
creds = creds[:2] + creds[3:] + [attest.auth_data.credential_data]
|
||||
print('Register valid (%d ms)' % (t2 - t1))
|
||||
print("Register valid (%d ms)" % (t2 - t1))
|
||||
|
||||
t1 = time.time() * 1000
|
||||
assertions, client_data = self.client.get_assertion(
|
||||
rp['id'], challenge, pin=PIN
|
||||
rp["id"], challenge, pin=PIN
|
||||
)
|
||||
t2 = time.time() * 1000
|
||||
assert len(assertions) == len(users) + 1
|
||||
for x, y in zip(assertions, creds):
|
||||
x.verify(client_data.hash, y.public_key)
|
||||
|
||||
print('Assertion(s) valid (%d ms)' % (t2 - t1))
|
||||
print("Assertion(s) valid (%d ms)" % (t2 - t1))
|
||||
|
||||
def test_responses(self,):
|
||||
PIN = '1234'
|
||||
PIN = "1234"
|
||||
RPID = self.host
|
||||
for dev in CtapHidDevice.list_devices():
|
||||
print('dev', dev)
|
||||
print("dev", dev)
|
||||
client = Fido2Client(dev, RPID)
|
||||
ctap = client.ctap2
|
||||
# ctap.reset()
|
||||
@@ -726,17 +726,17 @@ class Tester:
|
||||
|
||||
inf = ctap.get_info()
|
||||
# print (inf)
|
||||
print('versions: ', inf.versions)
|
||||
print('aaguid: ', inf.aaguid)
|
||||
print('rk: ', inf.options['rk'])
|
||||
print('clientPin: ', inf.options['clientPin'])
|
||||
print('max_message_size: ', inf.max_msg_size)
|
||||
print("versions: ", inf.versions)
|
||||
print("aaguid: ", inf.aaguid)
|
||||
print("rk: ", inf.options["rk"])
|
||||
print("clientPin: ", inf.options["clientPin"])
|
||||
print("max_message_size: ", inf.max_msg_size)
|
||||
|
||||
# rp = {'id': 'SelectDevice', 'name': 'SelectDevice'}
|
||||
rp = {'id': RPID, 'name': 'ExaRP'}
|
||||
user = {'id': os.urandom(10), 'name': 'SelectDevice'}
|
||||
user = {'id': b'21first one', 'name': 'single User'}
|
||||
challenge = 'Y2hhbGxlbmdl'
|
||||
rp = {"id": RPID, "name": "ExaRP"}
|
||||
user = {"id": os.urandom(10), "name": "SelectDevice"}
|
||||
user = {"id": b"21first one", "name": "single User"}
|
||||
challenge = "Y2hhbGxlbmdl"
|
||||
|
||||
if 1:
|
||||
attest, data = client.make_credential(
|
||||
@@ -746,15 +746,15 @@ class Tester:
|
||||
cred = attest.auth_data.credential_data
|
||||
creds = [cred]
|
||||
|
||||
allow_list = [{'id': creds[0].credential_id, 'type': 'public-key'}]
|
||||
allow_list = [{"id": creds[0].credential_id, "type": "public-key"}]
|
||||
allow_list = []
|
||||
assertions, client_data = client.get_assertion(
|
||||
rp['id'], challenge, pin=PIN
|
||||
rp["id"], challenge, pin=PIN
|
||||
)
|
||||
assertions[0].verify(client_data.hash, creds[0].public_key)
|
||||
|
||||
if 0:
|
||||
print('registering 1 user with RK')
|
||||
print("registering 1 user with RK")
|
||||
t1 = time.time() * 1000
|
||||
attest, data = client.make_credential(
|
||||
rp, user, challenge, pin=PIN, exclude_list=[], rk=True
|
||||
@@ -762,23 +762,23 @@ class Tester:
|
||||
t2 = time.time() * 1000
|
||||
attest.verify(data.hash)
|
||||
creds = [attest.auth_data.credential_data]
|
||||
print('Register valid (%d ms)' % (t2 - t1))
|
||||
print("Register valid (%d ms)" % (t2 - t1))
|
||||
|
||||
print('1 assertion')
|
||||
print("1 assertion")
|
||||
t1 = time.time() * 1000
|
||||
assertions, client_data = client.get_assertion(
|
||||
rp['id'], challenge, pin=PIN
|
||||
rp["id"], challenge, pin=PIN
|
||||
)
|
||||
t2 = time.time() * 1000
|
||||
assertions[0].verify(client_data.hash, creds[0].public_key)
|
||||
print('Assertion valid (%d ms)' % (t2 - t1))
|
||||
print("Assertion valid (%d ms)" % (t2 - t1))
|
||||
|
||||
# print('fmt:',attest.fmt)
|
||||
# print('rp_id_hash',attest.auth_data.rp_id_hash)
|
||||
# print('flags:', hex(attest.auth_data.flags))
|
||||
# print('count:', hex(attest.auth_data.counter))
|
||||
print('flags MC:', attest.auth_data)
|
||||
print('flags GA:', assertions[0].auth_data)
|
||||
print("flags MC:", attest.auth_data)
|
||||
print("flags GA:", assertions[0].auth_data)
|
||||
# print('cred_id:',attest.auth_data.credential_data.credential_id)
|
||||
# print('pubkey:',attest.auth_data.credential_data.public_key)
|
||||
# print('aaguid:',attest.auth_data.credential_data.aaguid)
|
||||
@@ -790,8 +790,8 @@ class Tester:
|
||||
# print('x5c:',attest.att_statement['x5c'])
|
||||
# print('data:',data)
|
||||
|
||||
print('assertion:', assertions[0])
|
||||
print('clientData:', client_data)
|
||||
print("assertion:", assertions[0])
|
||||
print("clientData:", client_data)
|
||||
|
||||
print()
|
||||
# break
|
||||
@@ -804,12 +804,12 @@ def test_find_brute_force():
|
||||
t = Tester()
|
||||
t.find_device()
|
||||
t2 = time.time() * 1000
|
||||
print('connected %d (%d ms)' % (i, t2 - t1))
|
||||
print("connected %d (%d ms)" % (i, t2 - t1))
|
||||
i += 1
|
||||
time.sleep(0.01)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
if __name__ == "__main__":
|
||||
t = Tester()
|
||||
t.find_device()
|
||||
# t.test_hid()
|
||||
|
||||
Reference in New Issue
Block a user