[WebAuthN] Implement FIDO AppID extension
authorjiewen_tan@apple.com <jiewen_tan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 20 Mar 2019 06:11:57 +0000 (06:11 +0000)
committerjiewen_tan@apple.com <jiewen_tan@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 20 Mar 2019 06:11:57 +0000 (06:11 +0000)
https://bugs.webkit.org/show_bug.cgi?id=143491
<rdar://problem/48298273>

Reviewed by Brent Fulgham.

Source/WebCore:

This patch adds support for FIDO AppID extension: https://www.w3.org/TR/webauthn/#sctn-appid-extension.
To be noticed, this implementation follows what spec suggested in the 'Note' session and what Chrome/Firefox
do in practice to avoid some unnecessary steps of
https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid.

In fido::convertToU2fSignCommand, the checkOnly flag is deleted as it is never used.

Covered by new tests in existing files.

* CMakeLists.txt:
* DerivedSources-input.xcfilelist:
* DerivedSources-output.xcfilelist:
* DerivedSources.make:
* Modules/webauthn/AuthenticationExtensionsClientInputs.h: Copied from Source/WebCore/Modules/webauthn/PublicKeyCredential.idl.
(WebCore::AuthenticationExtensionsClientInputs::encode const):
(WebCore::AuthenticationExtensionsClientInputs::decode):
* Modules/webauthn/AuthenticationExtensionsClientInputs.idl: Copied from Source/WebCore/Modules/webauthn/PublicKeyCredentialRequestOptions.idl.
* Modules/webauthn/AuthenticatorCoordinator.cpp:
(WebCore::AuthenticatorCoordinatorInternal::processAppIdExtension):
(WebCore::AuthenticatorCoordinator::create const):
(WebCore::AuthenticatorCoordinator::discoverFromExternalSource const):
* Modules/webauthn/PublicKeyCredential.cpp:
(WebCore::PublicKeyCredential::tryCreate):
(WebCore::PublicKeyCredential::PublicKeyCredential):
(WebCore::PublicKeyCredential::getClientExtensionResults const):
(WebCore::PublicKeyCredential::create): Deleted.
* Modules/webauthn/PublicKeyCredential.h:
* Modules/webauthn/PublicKeyCredential.idl:
* Modules/webauthn/PublicKeyCredentialCreationOptions.h:
* Modules/webauthn/PublicKeyCredentialCreationOptions.idl:
* Modules/webauthn/PublicKeyCredentialData.h:
(WebCore::PublicKeyCredentialData::encode const):
(WebCore::PublicKeyCredentialData::decode):
* Modules/webauthn/PublicKeyCredentialRequestOptions.h:
(WebCore::PublicKeyCredentialRequestOptions::encode const):
(WebCore::PublicKeyCredentialRequestOptions::decode):
* Modules/webauthn/PublicKeyCredentialRequestOptions.idl:
* Modules/webauthn/fido/DeviceResponseConverter.cpp:
(fido::readCTAPMakeCredentialResponse):
(fido::readCTAPGetAssertionResponse):
* Modules/webauthn/fido/U2fCommandConstructor.cpp:
(fido::convertToU2fSignCommand):
* Modules/webauthn/fido/U2fCommandConstructor.h:
* Modules/webauthn/fido/U2fResponseConverter.cpp:
(fido::readU2fRegisterResponse):
(fido::readU2fSignResponse):
* Sources.txt:
* WebCore.xcodeproj/project.pbxproj:

Source/WebKit:

In U2fHidAuthenticator::continueSignCommandAfterResponseReceived, it will retry the current command
with the AppID if it exists when SW_WRONG_DATA is received from devices. Noted, it will not set
the AuthenticationExtensionsClientOutputs::appid to false in any circumstances. In other words, the
field will be empty if AppID is supplied in AuthenticationExtensionsClientInputs and not used.

* UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
(WebKit::LocalAuthenticator::continueMakeCredentialAfterAttested):
(WebKit::LocalAuthenticator::continueGetAssertionAfterUserConsented):
* UIProcess/WebAuthentication/fido/U2fHidAuthenticator.cpp:
(WebKit::U2fHidAuthenticator::issueSignCommand):
(WebKit::U2fHidAuthenticator::continueSignCommandAfterResponseReceived):
* UIProcess/WebAuthentication/fido/U2fHidAuthenticator.h:

Tools:

Add a test that covers the new flag of convertToU2fSignCommand.

* TestWebKitAPI/Tests/WebCore/CtapRequestTest.cpp:
(TestWebKitAPI::TEST):
* TestWebKitAPI/Tests/WebCore/FidoTestData.h:
* TestWebKitAPI/Tests/WebCore/U2fCommandConstructorTest.cpp:
(TestWebKitAPI::TEST):

LayoutTests:

* http/wpt/webauthn/public-key-credential-create-success-hid.https.html:
* http/wpt/webauthn/public-key-credential-create-success-local.https.html:
* http/wpt/webauthn/public-key-credential-create-success-u2f.https.html:
* http/wpt/webauthn/public-key-credential-get-failure-u2f.https-expected.txt:
* http/wpt/webauthn/public-key-credential-get-failure-u2f.https.html:
* http/wpt/webauthn/public-key-credential-get-failure.https-expected.txt:
* http/wpt/webauthn/public-key-credential-get-failure.https.html:
* http/wpt/webauthn/public-key-credential-get-success-hid.https.html:
* http/wpt/webauthn/public-key-credential-get-success-local.https.html:
* http/wpt/webauthn/public-key-credential-get-success-u2f.https-expected.txt:
* http/wpt/webauthn/public-key-credential-get-success-u2f.https.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243193 268f45cc-cd09-0410-ab3c-d52691b4dbfc

42 files changed:
LayoutTests/ChangeLog
LayoutTests/http/wpt/webauthn/public-key-credential-create-success-hid.https.html
LayoutTests/http/wpt/webauthn/public-key-credential-create-success-local.https.html
LayoutTests/http/wpt/webauthn/public-key-credential-create-success-u2f.https.html
LayoutTests/http/wpt/webauthn/public-key-credential-get-failure-u2f.https-expected.txt
LayoutTests/http/wpt/webauthn/public-key-credential-get-failure-u2f.https.html
LayoutTests/http/wpt/webauthn/public-key-credential-get-failure.https-expected.txt
LayoutTests/http/wpt/webauthn/public-key-credential-get-failure.https.html
LayoutTests/http/wpt/webauthn/public-key-credential-get-success-hid.https.html
LayoutTests/http/wpt/webauthn/public-key-credential-get-success-local.https.html
LayoutTests/http/wpt/webauthn/public-key-credential-get-success-u2f.https-expected.txt
LayoutTests/http/wpt/webauthn/public-key-credential-get-success-u2f.https.html
Source/WebCore/CMakeLists.txt
Source/WebCore/ChangeLog
Source/WebCore/DerivedSources-input.xcfilelist
Source/WebCore/DerivedSources-output.xcfilelist
Source/WebCore/DerivedSources.make
Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientInputs.h [new file with mode: 0644]
Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientInputs.idl [new file with mode: 0644]
Source/WebCore/Modules/webauthn/AuthenticatorCoordinator.cpp
Source/WebCore/Modules/webauthn/PublicKeyCredential.cpp
Source/WebCore/Modules/webauthn/PublicKeyCredential.h
Source/WebCore/Modules/webauthn/PublicKeyCredential.idl
Source/WebCore/Modules/webauthn/PublicKeyCredentialCreationOptions.h
Source/WebCore/Modules/webauthn/PublicKeyCredentialCreationOptions.idl
Source/WebCore/Modules/webauthn/PublicKeyCredentialData.h
Source/WebCore/Modules/webauthn/PublicKeyCredentialRequestOptions.h
Source/WebCore/Modules/webauthn/PublicKeyCredentialRequestOptions.idl
Source/WebCore/Modules/webauthn/fido/DeviceResponseConverter.cpp
Source/WebCore/Modules/webauthn/fido/U2fCommandConstructor.cpp
Source/WebCore/Modules/webauthn/fido/U2fCommandConstructor.h
Source/WebCore/Modules/webauthn/fido/U2fResponseConverter.cpp
Source/WebCore/Sources.txt
Source/WebCore/WebCore.xcodeproj/project.pbxproj
Source/WebKit/ChangeLog
Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm
Source/WebKit/UIProcess/WebAuthentication/fido/U2fHidAuthenticator.cpp
Source/WebKit/UIProcess/WebAuthentication/fido/U2fHidAuthenticator.h
Tools/ChangeLog
Tools/TestWebKitAPI/Tests/WebCore/CtapRequestTest.cpp
Tools/TestWebKitAPI/Tests/WebCore/FidoTestData.h
Tools/TestWebKitAPI/Tests/WebCore/U2fCommandConstructorTest.cpp

index bdd12c8..a8b54c2 100644 (file)
@@ -1,3 +1,23 @@
+2019-03-19  Jiewen Tan  <jiewen_tan@apple.com>
+
+        [WebAuthN] Implement FIDO AppID extension
+        https://bugs.webkit.org/show_bug.cgi?id=143491
+        <rdar://problem/48298273>
+
+        Reviewed by Brent Fulgham.
+
+        * http/wpt/webauthn/public-key-credential-create-success-hid.https.html:
+        * http/wpt/webauthn/public-key-credential-create-success-local.https.html:
+        * http/wpt/webauthn/public-key-credential-create-success-u2f.https.html:
+        * http/wpt/webauthn/public-key-credential-get-failure-u2f.https-expected.txt:
+        * http/wpt/webauthn/public-key-credential-get-failure-u2f.https.html:
+        * http/wpt/webauthn/public-key-credential-get-failure.https-expected.txt:
+        * http/wpt/webauthn/public-key-credential-get-failure.https.html:
+        * http/wpt/webauthn/public-key-credential-get-success-hid.https.html:
+        * http/wpt/webauthn/public-key-credential-get-success-local.https.html:
+        * http/wpt/webauthn/public-key-credential-get-success-u2f.https-expected.txt:
+        * http/wpt/webauthn/public-key-credential-get-success-u2f.https.html:
+
 2019-03-19  Ryosuke Niwa  <rniwa@webkit.org>
 
         Rebaseline the test after r243175. It got somehow landed with failing expectations.
index c971835..ecb954e 100644 (file)
@@ -16,7 +16,7 @@
         assert_equals(credential.type, 'public-key');
         assert_array_equals(new Uint8Array(credential.rawId), Base64URL.parse(testHidCredentialIdBase64));
         assert_equals(bytesToASCIIString(credential.response.clientDataJSON), '{"type":"webauthn.create","challenge":"MTIzNDU2","origin":"https://localhost:9443"}');
-        assert_throws("NotSupportedError", () => { credential.getClientExtensionResults() });
+        assert_not_exists(credential.getClientExtensionResults(), "appid");
 
         // Check attestation
         const attestationObject = CBOR.decode(credential.response.attestationObject);
index 6f877c4..69465b5 100644 (file)
@@ -30,7 +30,7 @@
         assert_equals(credential.type, 'public-key');
         assert_array_equals(new Uint8Array(credential.rawId), Base64URL.parse(testCredentialIdBase64));
         assert_equals(bytesToASCIIString(credential.response.clientDataJSON), '{"type":"webauthn.create","challenge":"MTIzNDU2","origin":"https://localhost:9443"}');
-        assert_throws("NotSupportedError", () => { credential.getClientExtensionResults() });
+        assert_not_exists(credential.getClientExtensionResults(), "appid");
 
         // Check attestation
         const attestationObject = CBOR.decode(credential.response.attestationObject);
index 9faef85..f50e5cb 100644 (file)
@@ -12,7 +12,7 @@
         assert_equals(credential.type, 'public-key');
         assert_array_equals(new Uint8Array(credential.rawId), Base64URL.parse(testU2fCredentialIdBase64));
         assert_equals(bytesToASCIIString(credential.response.clientDataJSON), '{"type":"webauthn.create","challenge":"MTIzNDU2","origin":"https://localhost:9443"}');
-        assert_throws("NotSupportedError", () => { credential.getClientExtensionResults() });
+        assert_not_exists(credential.getClientExtensionResults(), "appid");
 
         // Check attestation
         const attestationObject = CBOR.decode(credential.response.attestationObject);
index 5a06145..b57b784 100644 (file)
@@ -2,4 +2,6 @@
 PASS PublicKeyCredential's [[get]] with malformed sign response in a mock hid authenticator. 
 PASS PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. 
 PASS PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. 2 
+PASS PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. (AppID) 
+PASS PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. 2 (AppID) 
 
index b435b5f..6491378 100644 (file)
             testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "malicious-payload", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64] } });
         return promiseRejects(t, "NotAllowedError", navigator.credentials.get(options), "No credentials from the allowCredentials list is found in the authenticator.");
     }, "PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. 2");
+
+    // With AppID extension
+    promise_test(function(t) {
+        const options = {
+            publicKey: {
+                challenge: asciiToUint8Array("123456"),
+                allowCredentials: [{ type: "public-key", id: Base64URL.parse(testCredentialIdBase64) }],
+                extensions: { appid: "" }
+            }
+        };
+
+        if (window.testRunner)
+            testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "malicious-payload", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64] } });
+        return promiseRejects(t, "NotAllowedError", navigator.credentials.get(options), "No credentials from the allowCredentials list is found in the authenticator.");
+    }, "PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. (AppID)");
+
+    promise_test(function(t) {
+        const options = {
+            publicKey: {
+                challenge: asciiToUint8Array("123456"),
+                allowCredentials: [{ type: "public-key", id: Base64URL.parse(testCredentialIdBase64) }, { type: "public-key", id: Base64URL.parse(testCredentialIdBase64) }],
+                extensions: { appid: "" }
+            }
+        };
+
+        if (window.testRunner)
+            testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "malicious-payload", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64] } });
+        return promiseRejects(t, "NotAllowedError", navigator.credentials.get(options), "No credentials from the allowCredentials list is found in the authenticator.");
+    }, "PublicKeyCredential's [[get]] with no matched allow credentials in a mock hid authenticator. 2 (AppID)");
 </script>
index 1f71481..d0fa61f 100644 (file)
@@ -1,4 +1,8 @@
 
 PASS PublicKeyCredential's [[get]] with timeout 
 PASS PublicKeyCredential's [[get]] with a mismatched RP ID 
+PASS PublicKeyCredential's [[get]] with a mismatched APP ID (invalid URLs) 
+PASS PublicKeyCredential's [[get]] with a mismatched APP ID (different protocols) 
+PASS PublicKeyCredential's [[get]] with a mismatched APP ID (different sites 1) 
+PASS PublicKeyCredential's [[get]] with a mismatched APP ID (different sites 2) 
 
index b05eccb..a245690 100644 (file)
         return promiseRejects(t, "SecurityError",
             navigator.credentials.get(options), "The origin of the document is not a registrable domain suffix of the provided RP ID.");
     }, "PublicKeyCredential's [[get]] with a mismatched RP ID");
+
+    promise_test(t => {
+        const options = {
+            publicKey: {
+                challenge: asciiToUint8Array("123456"),
+                extensions: { appid: "abc" }
+            }
+        };
+
+        return promiseRejects(t, "SecurityError",
+            navigator.credentials.get(options), "The origin of the document is not authorized for the provided App ID.");
+    }, "PublicKeyCredential's [[get]] with a mismatched APP ID (invalid URLs)");
+
+    promise_test(t => {
+        const options = {
+            publicKey: {
+                challenge: asciiToUint8Array("123456"),
+                extensions: { appid: "ftp://localhost" }
+            }
+        };
+
+        return promiseRejects(t, "SecurityError",
+            navigator.credentials.get(options), "The origin of the document is not authorized for the provided App ID.");
+    }, "PublicKeyCredential's [[get]] with a mismatched APP ID (different protocols)");
+
+    promise_test(t => {
+        const options = {
+            publicKey: {
+                challenge: asciiToUint8Array("123456"),
+                extensions: { appid: "https://127.0.0.1" }
+            }
+        };
+
+        return promiseRejects(t, "SecurityError",
+            navigator.credentials.get(options), "The origin of the document is not authorized for the provided App ID.");
+    }, "PublicKeyCredential's [[get]] with a mismatched APP ID (different sites 1)");
+
+    promise_test(t => {
+        const options = {
+            publicKey: {
+                challenge: asciiToUint8Array("123456"),
+                extensions: { appid: "https://haha.localhost" }
+            }
+        };
+
+        return promiseRejects(t, "SecurityError",
+            navigator.credentials.get(options), "The origin of the document is not authorized for the provided App ID.");
+    }, "PublicKeyCredential's [[get]] with a mismatched APP ID (different sites 2)");
 </script>
index 9a4d4ca..29910e9 100644 (file)
@@ -16,6 +16,7 @@
         assert_array_equals(new Uint8Array(credential.rawId), Base64URL.parse(testHidCredentialIdBase64));
         assert_equals(bytesToASCIIString(credential.response.clientDataJSON), '{"type":"webauthn.get","challenge":"MTIzNDU2","origin":"https://localhost:9443"}');
         assert_equals(credential.response.userHandle, null);
+        assert_not_exists(credential.getClientExtensionResults(), "appid");
 
         // Check authData
         const authData = decodeAuthData(new Uint8Array(credential.response.authenticatorData));
index 7f2daaf..73aeccf 100644 (file)
@@ -19,6 +19,7 @@
         assert_array_equals(new Uint8Array(credential.rawId), Base64URL.parse(testCredentialIdBase64));
         assert_equals(bytesToASCIIString(credential.response.clientDataJSON), '{"type":"webauthn.get","challenge":"MTIzNDU2","origin":"https://localhost:9443"}');
         assert_equals(bytesToHexString(credential.response.userHandle), "00010203040506070809");
+        assert_not_exists(credential.getClientExtensionResults(), "appid");
 
         // Check authData
         const authData = decodeAuthData(new Uint8Array(credential.response.authenticatorData));
@@ -32,7 +33,7 @@
                 // credential.response.signature is in ASN.1 and WebCrypto expect signatures provides in r|s.
                 return crypto.subtle.verify({name: "ECDSA", hash: "SHA-256"}, publicKey, extractRawSignature(credential.response.signature), concatenateBuffers(credential.response.authenticatorData, hash)).then( verified => {
                     assert_true(verified);
-                    assert_throws("NotSupportedError", () => { credential.getClientExtensionResults() });
+                    assert_not_exists(credential.getClientExtensionResults(), "appid");
                 });
             });
         });
index 4c4a39e..ab8f071 100644 (file)
@@ -2,4 +2,10 @@
 PASS PublicKeyCredential's [[get]] with minimum options in a mock hid authenticator. 
 PASS PublicKeyCredential's [[get]] with more allow credentials in a mock hid authenticator. 
 PASS PublicKeyCredential's [[get]] with test of user presence in a mock hid authenticator. 
+PASS PublicKeyCredential's [[get]] with empty extensions in a mock hid authenticator. 
+PASS PublicKeyCredential's [[get]] with same site AppID but not used in a mock hid authenticator. 
+PASS PublicKeyCredential's [[get]] with empty AppID in a mock hid authenticator. 
+PASS PublicKeyCredential's [[get]] with an AppID in a mock hid authenticator. 
+PASS PublicKeyCredential's [[get]] with multiple credentials and AppID is not used in a mock hid authenticator. 
+PASS PublicKeyCredential's [[get]] with multiple credentials and AppID is used in a mock hid authenticator. 
 
index 4743b15..a0a0f0b 100644 (file)
@@ -4,7 +4,9 @@
 <script src="/resources/testharnessreport.js"></script>
 <script src="./resources/util.js"></script>
 <script>
-    function checkResult(credential)
+    const defaultAppIDHash = "c2671b6eb9233197d5f2b1288a55ba4f0860f96f7199bba32fe6da7c3f0f31e5";
+
+    function checkResult(credential, isAppID = false, appIDHash = defaultAppIDHash)
     {
         // Check respond
         assert_array_equals(Base64URL.parse(credential.id), Base64URL.parse(testU2fCredentialIdBase64));
         assert_array_equals(new Uint8Array(credential.rawId), Base64URL.parse(testU2fCredentialIdBase64));
         assert_equals(bytesToASCIIString(credential.response.clientDataJSON), '{"type":"webauthn.get","challenge":"MTIzNDU2","origin":"https://localhost:9443"}');
         assert_equals(credential.response.userHandle, null);
+        if (!isAppID)
+            assert_not_exists(credential.getClientExtensionResults(), "appid");
+        else
+            assert_true(credential.getClientExtensionResults().appid);
 
         // Check authData
         const authData = decodeAuthData(new Uint8Array(credential.response.authenticatorData));
-        assert_equals(bytesToHexString(authData.rpIdHash), "49960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d9763");
+        if (!isAppID)
+            assert_equals(bytesToHexString(authData.rpIdHash), "49960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d9763");
+        else
+            assert_equals(bytesToHexString(authData.rpIdHash), appIDHash);
         assert_equals(authData.flags, 1);
         assert_equals(authData.counter, 59);
     }
             return checkResult(credential);
         });
     }, "PublicKeyCredential's [[get]] with test of user presence in a mock hid authenticator.");
+
+    // With AppID extension
+    promise_test(t => {
+        const options = {
+            publicKey: {
+                challenge: Base64URL.parse("MTIzNDU2"),
+                allowCredentials: [{ type: "public-key", id: Base64URL.parse(testU2fCredentialIdBase64) }],
+                timeout: 100,
+                extensions: { }
+            }
+        };
+
+        if (window.testRunner)
+            testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "success", isU2f: true, payloadBase64: [testU2fSignResponse] } });
+        return navigator.credentials.get(options).then(credential => {
+            return checkResult(credential);
+        });
+    }, "PublicKeyCredential's [[get]] with empty extensions in a mock hid authenticator.");
+
+    promise_test(t => {
+        const options = {
+            publicKey: {
+                challenge: Base64URL.parse("MTIzNDU2"),
+                allowCredentials: [{ type: "public-key", id: Base64URL.parse(testU2fCredentialIdBase64) }],
+                timeout: 100,
+                extensions: { appid: "https://localhost:666/appid" }
+            }
+        };
+
+        if (window.testRunner)
+            testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "success", isU2f: true, payloadBase64: [testU2fSignResponse] } });
+        return navigator.credentials.get(options).then(credential => {
+            return checkResult(credential);
+        });
+    }, "PublicKeyCredential's [[get]] with same site AppID but not used in a mock hid authenticator.");
+
+    promise_test(t => {
+        const options = {
+            publicKey: {
+                challenge: Base64URL.parse("MTIzNDU2"),
+                allowCredentials: [{ type: "public-key", id: Base64URL.parse(testU2fCredentialIdBase64) }],
+                timeout: 100,
+                extensions: { appid: "" }
+            }
+        };
+
+        if (window.testRunner)
+            testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "success", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fSignResponse] } });
+        return navigator.credentials.get(options).then(credential => {
+            return checkResult(credential, true);
+        });
+    }, "PublicKeyCredential's [[get]] with empty AppID in a mock hid authenticator.");
+
+    // FIXME: Sub domains need to be tested as well. However, localhost has no sub domains.
+    promise_test(t => {
+        const options = {
+            publicKey: {
+                challenge: Base64URL.parse("MTIzNDU2"),
+                allowCredentials: [{ type: "public-key", id: Base64URL.parse(testU2fCredentialIdBase64) }],
+                timeout: 100,
+                extensions: { appid: "https://localhost:666/appid" }
+            }
+        };
+
+        if (window.testRunner)
+            testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "success", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fSignResponse] } });
+        return navigator.credentials.get(options).then(credential => {
+            return checkResult(credential, true, "7eabc5cc3251bdc59115ef87b5f7ee74cb03747e39ba8341748565cc129c0719");
+        });
+    }, "PublicKeyCredential's [[get]] with an AppID in a mock hid authenticator.");
+
+    promise_test(t => {
+        const options = {
+            publicKey: {
+                challenge: Base64URL.parse("MTIzNDU2"),
+                allowCredentials: [{ type: "public-key", id: Base64URL.parse(testCredentialIdBase64) }, { type: "public-key", id: Base64URL.parse(testU2fCredentialIdBase64) }],
+                timeout: 100,
+                extensions: { appid: "" }
+            }
+        };
+
+        if (window.testRunner)
+            testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "success", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64, testU2fSignResponse] } });
+        return navigator.credentials.get(options).then(credential => {
+            return checkResult(credential);
+        });
+    }, "PublicKeyCredential's [[get]] with multiple credentials and AppID is not used in a mock hid authenticator.");
+
+    promise_test(t => {
+        const options = {
+            publicKey: {
+                challenge: Base64URL.parse("MTIzNDU2"),
+                allowCredentials: [{ type: "public-key", id: Base64URL.parse(testCredentialIdBase64) }, { type: "public-key", id: Base64URL.parse(testU2fCredentialIdBase64) }],
+                timeout: 100,
+                extensions: { appid: "" }
+            }
+        };
+
+        if (window.testRunner)
+            testRunner.setWebAuthenticationMockConfiguration({ hid: { stage: "request", subStage: "msg", error: "success", isU2f: true, payloadBase64: [testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64, testU2fApduWrongDataOnlyResponseBase64, testU2fSignResponse] } });
+        return navigator.credentials.get(options).then(credential => {
+            return checkResult(credential, true);
+        });
+    }, "PublicKeyCredential's [[get]] with multiple credentials and AppID is used in a mock hid authenticator.");
+
 </script>
index 560834a..4a15c18 100644 (file)
@@ -438,6 +438,7 @@ set(WebCore_NON_SVG_IDL_FILES
     Modules/webaudio/ScriptProcessorNode.idl
     Modules/webaudio/WaveShaperNode.idl
 
+    Modules/webauthn/AuthenticationExtensionsClientInputs.idl
     Modules/webauthn/AuthenticatorAssertionResponse.idl
     Modules/webauthn/AuthenticatorAttestationResponse.idl
     Modules/webauthn/AuthenticatorResponse.idl
index 0eb30af..158e9f0 100644 (file)
@@ -1,3 +1,60 @@
+2019-03-19  Jiewen Tan  <jiewen_tan@apple.com>
+
+        [WebAuthN] Implement FIDO AppID extension
+        https://bugs.webkit.org/show_bug.cgi?id=143491
+        <rdar://problem/48298273>
+
+        Reviewed by Brent Fulgham.
+
+        This patch adds support for FIDO AppID extension: https://www.w3.org/TR/webauthn/#sctn-appid-extension.
+        To be noticed, this implementation follows what spec suggested in the 'Note' session and what Chrome/Firefox
+        do in practice to avoid some unnecessary steps of
+        https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid.
+
+        In fido::convertToU2fSignCommand, the checkOnly flag is deleted as it is never used.
+
+        Covered by new tests in existing files.
+
+        * CMakeLists.txt:
+        * DerivedSources-input.xcfilelist:
+        * DerivedSources-output.xcfilelist:
+        * DerivedSources.make:
+        * Modules/webauthn/AuthenticationExtensionsClientInputs.h: Copied from Source/WebCore/Modules/webauthn/PublicKeyCredential.idl.
+        (WebCore::AuthenticationExtensionsClientInputs::encode const):
+        (WebCore::AuthenticationExtensionsClientInputs::decode):
+        * Modules/webauthn/AuthenticationExtensionsClientInputs.idl: Copied from Source/WebCore/Modules/webauthn/PublicKeyCredentialRequestOptions.idl.
+        * Modules/webauthn/AuthenticatorCoordinator.cpp:
+        (WebCore::AuthenticatorCoordinatorInternal::processAppIdExtension):
+        (WebCore::AuthenticatorCoordinator::create const):
+        (WebCore::AuthenticatorCoordinator::discoverFromExternalSource const):
+        * Modules/webauthn/PublicKeyCredential.cpp:
+        (WebCore::PublicKeyCredential::tryCreate):
+        (WebCore::PublicKeyCredential::PublicKeyCredential):
+        (WebCore::PublicKeyCredential::getClientExtensionResults const):
+        (WebCore::PublicKeyCredential::create): Deleted.
+        * Modules/webauthn/PublicKeyCredential.h:
+        * Modules/webauthn/PublicKeyCredential.idl:
+        * Modules/webauthn/PublicKeyCredentialCreationOptions.h:
+        * Modules/webauthn/PublicKeyCredentialCreationOptions.idl:
+        * Modules/webauthn/PublicKeyCredentialData.h:
+        (WebCore::PublicKeyCredentialData::encode const):
+        (WebCore::PublicKeyCredentialData::decode):
+        * Modules/webauthn/PublicKeyCredentialRequestOptions.h:
+        (WebCore::PublicKeyCredentialRequestOptions::encode const):
+        (WebCore::PublicKeyCredentialRequestOptions::decode):
+        * Modules/webauthn/PublicKeyCredentialRequestOptions.idl:
+        * Modules/webauthn/fido/DeviceResponseConverter.cpp:
+        (fido::readCTAPMakeCredentialResponse):
+        (fido::readCTAPGetAssertionResponse):
+        * Modules/webauthn/fido/U2fCommandConstructor.cpp:
+        (fido::convertToU2fSignCommand):
+        * Modules/webauthn/fido/U2fCommandConstructor.h:
+        * Modules/webauthn/fido/U2fResponseConverter.cpp:
+        (fido::readU2fRegisterResponse):
+        (fido::readU2fSignResponse):
+        * Sources.txt:
+        * WebCore.xcodeproj/project.pbxproj:
+
 2019-03-19  Devin Rousso  <drousso@apple.com>
 
         Web Inspector: Debugger: lazily create the agent
index 5f52b41..c6b5bc1 100644 (file)
@@ -304,6 +304,7 @@ $(PROJECT_DIR)/Modules/webaudio/PannerNode.idl
 $(PROJECT_DIR)/Modules/webaudio/PeriodicWave.idl
 $(PROJECT_DIR)/Modules/webaudio/ScriptProcessorNode.idl
 $(PROJECT_DIR)/Modules/webaudio/WaveShaperNode.idl
+$(PROJECT_DIR)/Modules/webauthn/AuthenticationExtensionsClientInputs.idl
 $(PROJECT_DIR)/Modules/webauthn/AuthenticatorAssertionResponse.idl
 $(PROJECT_DIR)/Modules/webauthn/AuthenticatorAttestationResponse.idl
 $(PROJECT_DIR)/Modules/webauthn/AuthenticatorResponse.idl
index 083ea29..0b96b17 100644 (file)
@@ -154,6 +154,8 @@ $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAudioTrackList.cpp
 $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAudioTrackList.h
 $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAudioTrackMediaSource.cpp
 $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAudioTrackMediaSource.h
+$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAuthenticationExtensionsClientInputs.cpp
+$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAuthenticationExtensionsClientInputs.h
 $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAuthenticatorAssertionResponse.cpp
 $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAuthenticatorAssertionResponse.h
 $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/JSAuthenticatorAttestationResponse.cpp
index 89c3968..78cac39 100644 (file)
@@ -351,6 +351,7 @@ JS_BINDING_IDLS = \
     $(WebCore)/Modules/webaudio/PeriodicWave.idl \
     $(WebCore)/Modules/webaudio/ScriptProcessorNode.idl \
     $(WebCore)/Modules/webaudio/WaveShaperNode.idl \
+    $(WebCore)/Modules/webauthn/AuthenticationExtensionsClientInputs.idl \
     $(WebCore)/Modules/webauthn/AuthenticatorAssertionResponse.idl \
     $(WebCore)/Modules/webauthn/AuthenticatorAttestationResponse.idl \
     $(WebCore)/Modules/webauthn/AuthenticatorResponse.idl \
diff --git a/Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientInputs.h b/Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientInputs.h
new file mode 100644 (file)
index 0000000..8e2d847
--- /dev/null
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2019 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#if ENABLE(WEB_AUTHN)
+
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+struct AuthenticationExtensionsClientInputs {
+    String appid;
+
+    template<class Encoder> void encode(Encoder&) const;
+    template<class Decoder> static Optional<AuthenticationExtensionsClientInputs> decode(Decoder&);
+};
+
+template<class Encoder>
+void AuthenticationExtensionsClientInputs::encode(Encoder& encoder) const
+{
+    encoder << appid;
+}
+
+template<class Decoder>
+Optional<AuthenticationExtensionsClientInputs> AuthenticationExtensionsClientInputs::decode(Decoder& decoder)
+{
+    AuthenticationExtensionsClientInputs result;
+
+    Optional<String> appid;
+    decoder >> appid;
+    if (!appid)
+        return WTF::nullopt;
+    result.appid = WTFMove(*appid);
+
+    return result;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUTHN)
diff --git a/Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientInputs.idl b/Source/WebCore/Modules/webauthn/AuthenticationExtensionsClientInputs.idl
new file mode 100644 (file)
index 0000000..7e9e97b
--- /dev/null
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2019 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+[
+    Conditional=WEB_AUTHN,
+] dictionary AuthenticationExtensionsClientInputs {
+    USVString appid;
+};
index 7830799..d263c1b 100644 (file)
@@ -37,6 +37,8 @@
 #include "PublicKeyCredentialCreationOptions.h"
 #include "PublicKeyCredentialData.h"
 #include "PublicKeyCredentialRequestOptions.h"
+#include "RegistrableDomain.h"
+#include "SchemeRegistry.h"
 #include "SecurityOrigin.h"
 #include <pal/crypto/CryptoDigest.h>
 #include <wtf/JSONValues.h>
@@ -78,6 +80,27 @@ static Vector<uint8_t> produceClientDataJsonHash(const ArrayBuffer& clientDataJs
     return crypto->computeHash();
 }
 
+// The following roughly implements Step 1-3 of the spec to avoid the complexity of making unnecessary network requests:
+// https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid
+// It follows what Chrome and Firefox do, see:
+// https://bugzilla.mozilla.org/show_bug.cgi?id=1244959#c8
+// https://bugs.chromium.org/p/chromium/issues/detail?id=818303
+static String processAppIdExtension(const SecurityOrigin& facetId, const String& appId)
+{
+    // Step 1. Skipped since facetId should always be secure origins.
+    ASSERT(SchemeRegistry::shouldTreatURLSchemeAsSecure(facetId.protocol()));
+
+    // Step 2. Follow Chrome and Firefox to use the origin directly without adding a trailing slash.
+    if (appId.isEmpty())
+        return facetId.toString();
+
+    // Step 3. Relax the comparison to same site.
+    URL appIdURL(URL(), appId);
+    if (!appIdURL.isValid() || facetId.protocol() != appIdURL.protocol() || RegistrableDomain(appIdURL) != RegistrableDomain::uncheckedCreateFromHost(facetId.host()))
+        return String();
+    return appId;
+}
+
 } // namespace AuthenticatorCoordinatorInternal
 
 AuthenticatorCoordinator::AuthenticatorCoordinator(std::unique_ptr<AuthenticatorCoordinatorClient>&& client)
@@ -95,7 +118,7 @@ void AuthenticatorCoordinator::create(const SecurityOrigin& callerOrigin, const
     using namespace AuthenticatorCoordinatorInternal;
 
     // The following implements https://www.w3.org/TR/webauthn/#createCredential as of 5 December 2017.
-    // FIXME: Extensions are not supported yet. Skip Step 11-12.
+    // Extensions are not supported. Skip Step 11-12.
     // Step 1, 3, 16 are handled by the caller.
     // Step 2.
     if (!sameOriginWithAncestors) {
@@ -158,7 +181,6 @@ void AuthenticatorCoordinator::discoverFromExternalSource(const SecurityOrigin&
     using namespace AuthenticatorCoordinatorInternal;
 
     // The following implements https://www.w3.org/TR/webauthn/#createCredential as of 5 December 2017.
-    // FIXME: Extensions are not supported yet. Skip Step 8-9.
     // Step 1, 3, 13 are handled by the caller.
     // Step 2.
     if (!sameOriginWithAncestors) {
@@ -177,6 +199,18 @@ void AuthenticatorCoordinator::discoverFromExternalSource(const SecurityOrigin&
     if (options.rpId.isEmpty())
         options.rpId = callerOrigin.host();
 
+    // Step 8-9.
+    // Only FIDO AppID Extension is supported.
+    if (options.extensions && !options.extensions->appid.isNull()) {
+        // The following implements https://www.w3.org/TR/webauthn/#sctn-appid-extension as of 4 March 2019.
+        auto appid = processAppIdExtension(callerOrigin, options.extensions->appid);
+        if (!appid) {
+            promise.reject(Exception { SecurityError, "The origin of the document is not authorized for the provided App ID."_s });
+            return;
+        }
+        options.extensions->appid = appid;
+    }
+
     // Step 10-12.
     auto clientDataJson = produceClientDataJson(ClientDataType::Get, options.challenge, callerOrigin);
     auto clientDataJsonHash = produceClientDataJsonHash(clientDataJson);
index c6b6844..4750869 100644 (file)
 
 namespace WebCore {
 
-Ref<PublicKeyCredential> PublicKeyCredential::create(Ref<ArrayBuffer>&& id, Ref<AuthenticatorResponse>&& response)
-{
-    return adoptRef(*new PublicKeyCredential(WTFMove(id), WTFMove(response)));
-}
-
 RefPtr<PublicKeyCredential> PublicKeyCredential::tryCreate(const PublicKeyCredentialData& data)
 {
     if (!data.rawId || !data.clientDataJSON)
@@ -54,25 +49,26 @@ RefPtr<PublicKeyCredential> PublicKeyCredential::tryCreate(const PublicKeyCreden
         if (!data.attestationObject)
             return nullptr;
 
-        return adoptRef(*new PublicKeyCredential(data.rawId.releaseNonNull(), AuthenticatorAttestationResponse::create(data.clientDataJSON.releaseNonNull(), data.attestationObject.releaseNonNull())));
+        return adoptRef(*new PublicKeyCredential(data.rawId.releaseNonNull(), AuthenticatorAttestationResponse::create(data.clientDataJSON.releaseNonNull(), data.attestationObject.releaseNonNull()), { data.appid }));
     }
 
     if (!data.authenticatorData || !data.signature)
         return nullptr;
 
-    return adoptRef(*new PublicKeyCredential(data.rawId.releaseNonNull(), AuthenticatorAssertionResponse::create(data.clientDataJSON.releaseNonNull(), data.authenticatorData.releaseNonNull(), data.signature.releaseNonNull(), WTFMove(data.userHandle))));
+    return adoptRef(*new PublicKeyCredential(data.rawId.releaseNonNull(), AuthenticatorAssertionResponse::create(data.clientDataJSON.releaseNonNull(), data.authenticatorData.releaseNonNull(), data.signature.releaseNonNull(), WTFMove(data.userHandle)), { data.appid }));
 }
 
-PublicKeyCredential::PublicKeyCredential(Ref<ArrayBuffer>&& id, Ref<AuthenticatorResponse>&& response)
+PublicKeyCredential::PublicKeyCredential(Ref<ArrayBuffer>&& id, Ref<AuthenticatorResponse>&& response, AuthenticationExtensionsClientOutputs&& extensions)
     : BasicCredential(WTF::base64URLEncode(id->data(), id->byteLength()), Type::PublicKey, Discovery::Remote)
     , m_rawId(WTFMove(id))
     , m_response(WTFMove(response))
+    , m_extensions(WTFMove(extensions))
 {
 }
 
-ExceptionOr<bool> PublicKeyCredential::getClientExtensionResults() const
+PublicKeyCredential::AuthenticationExtensionsClientOutputs PublicKeyCredential::getClientExtensionResults() const
 {
-    return Exception { NotSupportedError };
+    return m_extensions;
 }
 
 void PublicKeyCredential::isUserVerifyingPlatformAuthenticatorAvailable(Document& document, DOMPromiseDeferred<IDLBoolean>&& promise)
index 30fce42..12df0c2 100644 (file)
@@ -42,23 +42,26 @@ struct PublicKeyCredentialData;
 
 class PublicKeyCredential final : public BasicCredential {
 public:
-    static Ref<PublicKeyCredential> create(Ref<ArrayBuffer>&& id, Ref<AuthenticatorResponse>&&);
+    struct AuthenticationExtensionsClientOutputs {
+        Optional<bool> appid;
+    };
+
     static RefPtr<PublicKeyCredential> tryCreate(const PublicKeyCredentialData&);
 
     ArrayBuffer* rawId() const { return m_rawId.ptr(); }
     AuthenticatorResponse* response() const { return m_response.ptr(); }
-    // Not support yet. Always throws.
-    ExceptionOr<bool> getClientExtensionResults() const;
+    AuthenticationExtensionsClientOutputs getClientExtensionResults() const;
 
     static void isUserVerifyingPlatformAuthenticatorAvailable(Document&, DOMPromiseDeferred<IDLBoolean>&&);
 
 private:
-    PublicKeyCredential(Ref<ArrayBuffer>&& id, Ref<AuthenticatorResponse>&&);
+    PublicKeyCredential(Ref<ArrayBuffer>&& id, Ref<AuthenticatorResponse>&&, AuthenticationExtensionsClientOutputs&&);
 
     Type credentialType() const final { return Type::PublicKey; }
 
     Ref<ArrayBuffer> m_rawId;
     Ref<AuthenticatorResponse> m_response;
+    AuthenticationExtensionsClientOutputs m_extensions;
 };
 
 } // namespace WebCore
index d51f06d..3072c1c 100644 (file)
@@ -23,8 +23,6 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-typedef boolean AuthenticationExtensions;
-
 [
     Conditional=WEB_AUTHN,
     EnabledAtRuntime=WebAuthentication,
@@ -33,7 +31,14 @@ typedef boolean AuthenticationExtensions;
 ] interface PublicKeyCredential : BasicCredential {
     [SameObject] readonly attribute ArrayBuffer rawId;
     [SameObject] readonly attribute AuthenticatorResponse response;
-    [MayThrowException] AuthenticationExtensions getClientExtensionResults();
+    AuthenticationExtensionsClientOutputs getClientExtensionResults();
 
     [CallWith=Document] static Promise<boolean> isUserVerifyingPlatformAuthenticatorAvailable();
 };
+
+[
+    Conditional=WEB_AUTHN,
+    JSGenerateToJSObject,
+] dictionary AuthenticationExtensionsClientOutputs {
+    boolean appid;
+};
index 6f9271a..4916458 100644 (file)
@@ -27,6 +27,7 @@
 
 #if ENABLE(WEB_AUTHN)
 
+#include "AuthenticationExtensionsClientInputs.h"
 #include "BufferSource.h"
 #include "PublicKeyCredentialDescriptor.h"
 #include "PublicKeyCredentialType.h"
@@ -83,6 +84,7 @@ struct PublicKeyCredentialCreationOptions {
     Optional<unsigned> timeout;
     Vector<PublicKeyCredentialDescriptor> excludeCredentials;
     Optional<AuthenticatorSelectionCriteria> authenticatorSelection;
+    Optional<AuthenticationExtensionsClientInputs> extensions; // A place holder, but never used.
 
     template<class Encoder> void encode(Encoder&) const;
     template<class Decoder> static Optional<PublicKeyCredentialCreationOptions> decode(Decoder&);
index 36e180b..033e0dc 100644 (file)
@@ -39,8 +39,7 @@ typedef long COSEAlgorithmIdentifier;
     AuthenticatorSelectionCriteria authenticatorSelection;
     // Always "direct" for us.
     // AttestationConveyancePreference attestation = "none";
-    // Not support yet.
-    // AuthenticationExtensions extensions;
+    AuthenticationExtensionsClientInputs extensions;
 };
 
 [
index 2126cac..7e63ba3 100644 (file)
@@ -49,6 +49,9 @@ struct PublicKeyCredentialData {
     mutable RefPtr<ArrayBuffer> signature;
     mutable RefPtr<ArrayBuffer> userHandle;
 
+    // Extensions
+    Optional<bool> appid;
+
     template<class Encoder> void encode(Encoder&) const;
     template<class Decoder> static Optional<PublicKeyCredentialData> decode(Decoder&);
 };
@@ -81,6 +84,9 @@ void PublicKeyCredentialData::encode(Encoder& encoder) const
     encoder << static_cast<uint64_t>(signature->byteLength());
     encoder.encodeFixedLengthData(reinterpret_cast<const uint8_t*>(signature->data()), signature->byteLength(), 1);
 
+    // Encode AppID before user handle to avoid the userHandle flag.
+    encoder << appid;
+
     if (!userHandle) {
         encoder << false;
         return;
@@ -148,6 +154,12 @@ Optional<PublicKeyCredentialData> PublicKeyCredentialData::decode(Decoder& decod
     if (!decoder.decodeFixedLengthData(reinterpret_cast<uint8_t*>(result.signature->data()), signatureLength.value(), 1))
         return WTF::nullopt;
 
+    Optional<Optional<bool>> appid;
+    decoder >> appid;
+    if (!appid)
+        return WTF::nullopt;
+    result.appid = WTFMove(*appid);
+
     Optional<bool> hasUserHandle;
     decoder >> hasUserHandle;
     if (!hasUserHandle)
index 6b9cab7..22da325 100644 (file)
@@ -27,6 +27,7 @@
 
 #if ENABLE(WEB_AUTHN)
 
+#include "AuthenticationExtensionsClientInputs.h"
 #include "BufferSource.h"
 #include "PublicKeyCredentialDescriptor.h"
 #include "UserVerificationRequirement.h"
@@ -40,6 +41,7 @@ struct PublicKeyCredentialRequestOptions {
     mutable String rpId;
     Vector<PublicKeyCredentialDescriptor> allowCredentials;
     UserVerificationRequirement userVerification { UserVerificationRequirement::Preferred };
+    mutable Optional<AuthenticationExtensionsClientInputs> extensions;
 
     template<class Encoder> void encode(Encoder&) const;
     template<class Decoder> static Optional<PublicKeyCredentialRequestOptions> decode(Decoder&);
@@ -49,7 +51,7 @@ struct PublicKeyCredentialRequestOptions {
 template<class Encoder>
 void PublicKeyCredentialRequestOptions::encode(Encoder& encoder) const
 {
-    encoder << timeout << rpId << allowCredentials << userVerification;
+    encoder << timeout << rpId << allowCredentials << userVerification << extensions;
 }
 
 template<class Decoder>
@@ -74,6 +76,12 @@ Optional<PublicKeyCredentialRequestOptions> PublicKeyCredentialRequestOptions::d
         return WTF::nullopt;
     result.userVerification = WTFMove(*userVerification);
 
+    Optional<Optional<AuthenticationExtensionsClientInputs>> extensions;
+    decoder >> extensions;
+    if (!extensions)
+        return WTF::nullopt;
+    result.extensions = WTFMove(*extensions);
+
     return result;
 }
 
index d651db2..3e392be 100644 (file)
@@ -31,6 +31,5 @@
     USVString rpId;
     sequence<PublicKeyCredentialDescriptor> allowCredentials = [];
     UserVerificationRequirement userVerification = "preferred";
-    // Not support yet.
-    // AuthenticationExtensions extensions;
+    AuthenticationExtensionsClientInputs extensions;
 };
index d036717..12442b1 100644 (file)
@@ -121,7 +121,7 @@ Optional<PublicKeyCredentialData> readCTAPMakeCredentialResponse(const Vector<ui
     attestationObjectMap[CBOR("attStmt")] = WTFMove(attStmt);
     auto attestationObject = cbor::CBORWriter::write(CBOR(WTFMove(attestationObjectMap)));
 
-    return PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), true, nullptr, ArrayBuffer::create(attestationObject.value().data(), attestationObject.value().size()), nullptr, nullptr, nullptr };
+    return PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), true, nullptr, ArrayBuffer::create(attestationObject.value().data(), attestationObject.value().size()), nullptr, nullptr, nullptr, WTF::nullopt };
 }
 
 Optional<PublicKeyCredentialData> readCTAPGetAssertionResponse(const Vector<uint8_t>& inBuffer)
@@ -170,7 +170,7 @@ Optional<PublicKeyCredentialData> readCTAPGetAssertionResponse(const Vector<uint
         userHandle = ArrayBuffer::create(id.data(), id.size());
     }
 
-    return PublicKeyCredentialData { WTFMove(credentialId), false, nullptr, nullptr, ArrayBuffer::create(authData.data(), authData.size()), ArrayBuffer::create(signature.data(), signature.size()), WTFMove(userHandle) };
+    return PublicKeyCredentialData { WTFMove(credentialId), false, nullptr, nullptr, ArrayBuffer::create(authData.data(), authData.size()), ArrayBuffer::create(signature.data(), signature.size()), WTFMove(userHandle), WTF::nullopt };
 }
 
 Optional<AuthenticatorGetInfoResponse> readCTAPGetInfoResponse(const Vector<uint8_t>& inBuffer)
index d9e7771..6165b88 100644 (file)
@@ -114,12 +114,15 @@ Optional<Vector<uint8_t>> convertToU2fCheckOnlySignCommand(const Vector<uint8_t>
     return constructU2fSignCommand(produceRpIdHash(request.rp.id), clientDataHash, keyHandle.idVector, true /* checkOnly */);
 }
 
-Optional<Vector<uint8_t>> convertToU2fSignCommand(const Vector<uint8_t>& clientDataHash, const PublicKeyCredentialRequestOptions& request, const Vector<uint8_t>& keyHandle, bool checkOnly)
+Optional<Vector<uint8_t>> convertToU2fSignCommand(const Vector<uint8_t>& clientDataHash, const PublicKeyCredentialRequestOptions& request, const Vector<uint8_t>& keyHandle, bool isAppId)
 {
     if (!isConvertibleToU2fSignCommand(request))
         return WTF::nullopt;
 
-    return constructU2fSignCommand(produceRpIdHash(request.rpId), clientDataHash, keyHandle, checkOnly);
+    if (!isAppId)
+        return constructU2fSignCommand(produceRpIdHash(request.rpId), clientDataHash, keyHandle, false);
+    ASSERT(request.extensions && !request.extensions->appid.isNull());
+    return constructU2fSignCommand(produceRpIdHash(request.extensions->appid), clientDataHash, keyHandle, false);
 }
 
 Vector<uint8_t> constructBogusU2fRegistrationCommand()
index 07e16e5..eebe292 100644 (file)
@@ -62,7 +62,7 @@ WEBCORE_EXPORT Optional<Vector<uint8_t>> convertToU2fRegisterCommand(const Vecto
 WEBCORE_EXPORT Optional<Vector<uint8_t>> convertToU2fCheckOnlySignCommand(const Vector<uint8_t>& clientDataHash, const WebCore::PublicKeyCredentialCreationOptions&, const WebCore::PublicKeyCredentialDescriptor&);
 
 // Extracts APDU encoded U2F sign command from PublicKeyCredentialRequestOptions.
-WEBCORE_EXPORT Optional<Vector<uint8_t>> convertToU2fSignCommand(const Vector<uint8_t>& clientDataHash, const WebCore::PublicKeyCredentialRequestOptions&, const Vector<uint8_t>& keyHandle, bool checkOnly = false);
+WEBCORE_EXPORT Optional<Vector<uint8_t>> convertToU2fSignCommand(const Vector<uint8_t>& clientDataHash, const WebCore::PublicKeyCredentialRequestOptions&, const Vector<uint8_t>& keyHandle, bool isAppId = false);
 
 WEBCORE_EXPORT Vector<uint8_t> constructBogusU2fRegistrationCommand();
 
index cb46781..32a1853 100644 (file)
@@ -170,7 +170,7 @@ Optional<PublicKeyCredentialData> readU2fRegisterResponse(const String& rpId, co
 
     auto attestationObject = buildAttestationObject(WTFMove(authData), "fido-u2f", WTFMove(fidoAttestationStatement));
 
-    return PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), true, nullptr, ArrayBuffer::create(attestationObject.data(), attestationObject.size()), nullptr, nullptr, nullptr };
+    return PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), true, nullptr, ArrayBuffer::create(attestationObject.data(), attestationObject.size()), nullptr, nullptr, nullptr, WTF::nullopt };
 }
 
 Optional<PublicKeyCredentialData> readU2fSignResponse(const String& rpId, const Vector<uint8_t>& keyHandle, const Vector<uint8_t>& u2fData)
@@ -186,7 +186,7 @@ Optional<PublicKeyCredentialData> readU2fSignResponse(const String& rpId, const
     counter += u2fData[counterIndex + 3];
     auto authData = buildAuthData(rpId, flags, counter, { });
 
-    return PublicKeyCredentialData { ArrayBuffer::create(keyHandle.data(), keyHandle.size()), false, nullptr, nullptr, ArrayBuffer::create(authData.data(), authData.size()), ArrayBuffer::create(u2fData.data() + signatureIndex, u2fData.size() - signatureIndex), nullptr };
+    return PublicKeyCredentialData { ArrayBuffer::create(keyHandle.data(), keyHandle.size()), false, nullptr, nullptr, ArrayBuffer::create(authData.data(), authData.size()), ArrayBuffer::create(u2fData.data() + signatureIndex, u2fData.size() - signatureIndex), nullptr, WTF::nullopt };
 }
 
 } // namespace fido
index 36aa511..f8a799f 100644 (file)
@@ -2567,6 +2567,7 @@ JSAudioListener.cpp
 JSAudioNode.cpp
 JSAudioParam.cpp
 JSAudioProcessingEvent.cpp
+JSAuthenticationExtensionsClientInputs.cpp
 JSAuthenticatorAssertionResponse.cpp
 JSAuthenticatorAttestationResponse.cpp
 JSAuthenticatorResponse.cpp
index dafc5bb..3a20c0f 100644 (file)
                57D0018D1DD5413200ED19D9 /* JSCryptoKeyUsage.h in Headers */ = {isa = PBXBuildFile; fileRef = 57D0018C1DD5413200ED19D9 /* JSCryptoKeyUsage.h */; };
                57D8462E1FEAF69900CA3682 /* PublicKeyCredential.h in Headers */ = {isa = PBXBuildFile; fileRef = 57D8462B1FEAF68F00CA3682 /* PublicKeyCredential.h */; settings = {ATTRIBUTES = (Private, ); }; };
                57D846351FEAFCD300CA3682 /* JSPublicKeyCredential.h in Headers */ = {isa = PBXBuildFile; fileRef = 57D846301FEAFC2F00CA3682 /* JSPublicKeyCredential.h */; };
+               57DA47B0224034E4002A4612 /* AuthenticationExtensionsClientInputs.h in Headers */ = {isa = PBXBuildFile; fileRef = 57DA47A522401E0F002A4612 /* AuthenticationExtensionsClientInputs.h */; settings = {ATTRIBUTES = (Private, ); }; };
                57DCED74214305F00016B847 /* PublicKeyCredentialData.h in Headers */ = {isa = PBXBuildFile; fileRef = 57DCED72214305F00016B847 /* PublicKeyCredentialData.h */; settings = {ATTRIBUTES = (Private, ); }; };
                57DCED9021487FF70016B847 /* AuthenticatorTransport.h in Headers */ = {isa = PBXBuildFile; fileRef = 57DCED8C21487EDB0016B847 /* AuthenticatorTransport.h */; settings = {ATTRIBUTES = (Private, ); }; };
                57DCED98214882160016B847 /* JSAuthenticatorTransport.h in Headers */ = {isa = PBXBuildFile; fileRef = 57DCED92214880C60016B847 /* JSAuthenticatorTransport.h */; };
                57D8462D1FEAF68F00CA3682 /* PublicKeyCredential.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = PublicKeyCredential.idl; sourceTree = "<group>"; };
                57D846301FEAFC2F00CA3682 /* JSPublicKeyCredential.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPublicKeyCredential.h; sourceTree = "<group>"; };
                57D846311FEAFC2F00CA3682 /* JSPublicKeyCredential.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPublicKeyCredential.cpp; sourceTree = "<group>"; };
+               57DA47A522401E0F002A4612 /* AuthenticationExtensionsClientInputs.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = AuthenticationExtensionsClientInputs.h; sourceTree = "<group>"; };
+               57DA47A722401E0F002A4612 /* AuthenticationExtensionsClientInputs.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = AuthenticationExtensionsClientInputs.idl; sourceTree = "<group>"; };
+               57DA47AC224032DC002A4612 /* JSAuthenticationExtensionsClientInputs.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JSAuthenticationExtensionsClientInputs.cpp; sourceTree = "<group>"; };
+               57DA47AD224032DD002A4612 /* JSAuthenticationExtensionsClientInputs.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSAuthenticationExtensionsClientInputs.h; sourceTree = "<group>"; };
                57DCED72214305F00016B847 /* PublicKeyCredentialData.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = PublicKeyCredentialData.h; sourceTree = "<group>"; };
                57DCED8C21487EDB0016B847 /* AuthenticatorTransport.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = AuthenticatorTransport.h; sourceTree = "<group>"; };
                57DCED8E21487EDB0016B847 /* AuthenticatorTransport.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = AuthenticatorTransport.idl; sourceTree = "<group>"; };
                                57152B5321CB2CE3000C37CA /* apdu */,
                                57303BB32006C6ED00355965 /* cbor */,
                                578A4BFA2166AE0000D08F34 /* fido */,
+                               57DA47A522401E0F002A4612 /* AuthenticationExtensionsClientInputs.h */,
+                               57DA47A722401E0F002A4612 /* AuthenticationExtensionsClientInputs.idl */,
                                57303C272009B2FC00355965 /* AuthenticatorAssertionResponse.h */,
                                57303C292009B2FC00355965 /* AuthenticatorAssertionResponse.idl */,
                                57303C1B2009A98600355965 /* AuthenticatorAttestationResponse.h */,
                57D8462F1FEAFB0500CA3682 /* WebAuthN */ = {
                        isa = PBXGroup;
                        children = (
+                               57DA47AC224032DC002A4612 /* JSAuthenticationExtensionsClientInputs.cpp */,
+                               57DA47AD224032DD002A4612 /* JSAuthenticationExtensionsClientInputs.h */,
                                57303C2E2009B7DA00355965 /* JSAuthenticatorAssertionResponse.cpp */,
                                57303C2D2009B7D900355965 /* JSAuthenticatorAssertionResponse.h */,
                                57303C202009AEF500355965 /* JSAuthenticatorAttestationResponse.cpp */,
                                7EE6846112D26E3800E79415 /* AuthenticationChallenge.h in Headers */,
                                934F713A0D5A6F1000018D69 /* AuthenticationChallengeBase.h in Headers */,
                                E124748410AA161D00B79493 /* AuthenticationClient.h in Headers */,
+                               57DA47B0224034E4002A4612 /* AuthenticationExtensionsClientInputs.h in Headers */,
                                514C764C0CE9234E007EF3CD /* AuthenticationMac.h in Headers */,
                                57303C2C2009B4A800355965 /* AuthenticatorAssertionResponse.h in Headers */,
                                57303C1F2009AB4200355965 /* AuthenticatorAttestationResponse.h in Headers */,
index 1a370ae..50d9256 100644 (file)
@@ -1,3 +1,24 @@
+2019-03-19  Jiewen Tan  <jiewen_tan@apple.com>
+
+        [WebAuthN] Implement FIDO AppID extension
+        https://bugs.webkit.org/show_bug.cgi?id=143491
+        <rdar://problem/48298273>
+
+        Reviewed by Brent Fulgham.
+
+        In U2fHidAuthenticator::continueSignCommandAfterResponseReceived, it will retry the current command
+        with the AppID if it exists when SW_WRONG_DATA is received from devices. Noted, it will not set
+        the AuthenticationExtensionsClientOutputs::appid to false in any circumstances. In other words, the
+        field will be empty if AppID is supplied in AuthenticationExtensionsClientInputs and not used.
+
+        * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
+        (WebKit::LocalAuthenticator::continueMakeCredentialAfterAttested):
+        (WebKit::LocalAuthenticator::continueGetAssertionAfterUserConsented):
+        * UIProcess/WebAuthentication/fido/U2fHidAuthenticator.cpp:
+        (WebKit::U2fHidAuthenticator::issueSignCommand):
+        (WebKit::U2fHidAuthenticator::continueSignCommandAfterResponseReceived):
+        * UIProcess/WebAuthentication/fido/U2fHidAuthenticator.h:
+
 2019-03-19  Ross Kirsling  <ross.kirsling@sony.com>
 
         Unreviewed adjustment to r242842 per Darin's request.
index 4e3d114..69ffedb 100644 (file)
@@ -326,7 +326,7 @@ void LocalAuthenticator::continueMakeCredentialAfterAttested(SecKeyRef privateKe
     }
     auto attestationObject = buildAttestationObject(WTFMove(authData), "Apple", WTFMove(attestationStatementMap));
 
-    receiveRespond(PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), true, nullptr, ArrayBuffer::create(attestationObject.data(), attestationObject.size()), nullptr, nullptr, nullptr });
+    receiveRespond(PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), true, nullptr, ArrayBuffer::create(attestationObject.data(), attestationObject.size()), nullptr, nullptr, nullptr, WTF::nullopt });
 #endif // !PLATFORM(IOS_FAMILY)
 }
 
@@ -463,7 +463,7 @@ void LocalAuthenticator::continueGetAssertionAfterUserConsented(LocalConnection:
     }
 
     // Step 13.
-    receiveRespond(PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), false, nullptr, nullptr, ArrayBuffer::create(authData.data(), authData.size()), ArrayBuffer::create(signature.data(), signature.size()), ArrayBuffer::create(userhandle.data(), userhandle.size()) });
+    receiveRespond(PublicKeyCredentialData { ArrayBuffer::create(credentialId.data(), credentialId.size()), false, nullptr, nullptr, ArrayBuffer::create(authData.data(), authData.size()), ArrayBuffer::create(signature.data(), signature.size()), ArrayBuffer::create(userhandle.data(), userhandle.size()), WTF::nullopt });
 #endif // !PLATFORM(IOS_FAMILY)
 }
 
index 8447f42..1cde829 100644 (file)
@@ -101,7 +101,7 @@ void U2fHidAuthenticator::issueSignCommand(size_t index)
         receiveRespond(ExceptionData { NotAllowedError, "No credentials from the allowCredentials list is found in the authenticator."_s });
         return;
     }
-    auto u2fCmd = convertToU2fSignCommand(requestData().hash, requestData().requestOptions, requestData().requestOptions.allowCredentials[index].idVector);
+    auto u2fCmd = convertToU2fSignCommand(requestData().hash, requestData().requestOptions, requestData().requestOptions.allowCredentials[index].idVector, m_isAppId);
     ASSERT(u2fCmd);
     issueNewCommand(WTFMove(*u2fCmd), CommandType::SignCommand);
 }
@@ -200,11 +200,19 @@ void U2fHidAuthenticator::continueSignCommandAfterResponseReceived(ApduResponse&
 {
     switch (apduResponse.status()) {
     case ApduResponse::Status::SW_NO_ERROR: {
-        auto response = readU2fSignResponse(requestData().requestOptions.rpId, requestData().requestOptions.allowCredentials[m_nextListIndex - 1].idVector, apduResponse.data());
+        Optional<PublicKeyCredentialData> response;
+        if (m_isAppId) {
+            ASSERT(requestData().requestOptions.extensions && !requestData().requestOptions.extensions->appid.isNull());
+            response = readU2fSignResponse(requestData().requestOptions.extensions->appid, requestData().requestOptions.allowCredentials[m_nextListIndex - 1].idVector, apduResponse.data());
+        } else
+            response = readU2fSignResponse(requestData().requestOptions.rpId, requestData().requestOptions.allowCredentials[m_nextListIndex - 1].idVector, apduResponse.data());
         if (!response) {
             receiveRespond(ExceptionData { UnknownError, "Couldn't parse the U2F sign response."_s });
             return;
         }
+        if (m_isAppId)
+            response->appid = m_isAppId;
+
         receiveRespond(WTFMove(*response));
         return;
     }
@@ -212,6 +220,17 @@ void U2fHidAuthenticator::continueSignCommandAfterResponseReceived(ApduResponse&
         // Polling is required during test of user presence.
         m_retryTimer.startOneShot(Seconds::fromMilliseconds(retryTimeOutValueMs));
         return;
+    case ApduResponse::Status::SW_WRONG_DATA:
+        if (requestData().requestOptions.extensions && !requestData().requestOptions.extensions->appid.isNull()) {
+            if (!m_isAppId) {
+                m_isAppId = true;
+                issueSignCommand(m_nextListIndex - 1);
+                return;
+            }
+            m_isAppId = false;
+        }
+        issueSignCommand(m_nextListIndex++);
+        return;
     default:
         issueSignCommand(m_nextListIndex++);
     }
index cff2947..aaab666 100644 (file)
@@ -74,6 +74,7 @@ private:
     Vector<uint8_t> m_lastCommand;
     CommandType m_lastCommandType;
     size_t m_nextListIndex { 0 };
+    bool m_isAppId { false };
 };
 
 } // namespace WebKit
index 51dc4cc..cfc86ca 100644 (file)
@@ -1,3 +1,19 @@
+2019-03-19  Jiewen Tan  <jiewen_tan@apple.com>
+
+        [WebAuthN] Implement FIDO AppID extension
+        https://bugs.webkit.org/show_bug.cgi?id=143491
+        <rdar://problem/48298273>
+
+        Reviewed by Brent Fulgham.
+
+        Add a test that covers the new flag of convertToU2fSignCommand.
+
+        * TestWebKitAPI/Tests/WebCore/CtapRequestTest.cpp:
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WebCore/FidoTestData.h:
+        * TestWebKitAPI/Tests/WebCore/U2fCommandConstructorTest.cpp:
+        (TestWebKitAPI::TEST):
+
 2019-03-19  Keith Rollin  <krollin@apple.com>
 
         Add support for more platforms to generate-xcfilelists
index 8cb4427..f5e4f14 100644 (file)
@@ -59,7 +59,7 @@ TEST(CTAPRequestTest, TestConstructMakeCredentialRequestParam)
     Vector<PublicKeyCredentialCreationOptions::Parameters> params { { PublicKeyCredentialType::PublicKey, 7 }, { PublicKeyCredentialType::PublicKey, 257 } };
     PublicKeyCredentialCreationOptions::AuthenticatorSelectionCriteria selection { PublicKeyCredentialCreationOptions::AuthenticatorAttachment::Platform, true, UserVerificationRequirement::Preferred };
 
-    PublicKeyCredentialCreationOptions options { rp, user, { }, params, WTF::nullopt, { }, selection };
+    PublicKeyCredentialCreationOptions options { rp, user, { }, params, WTF::nullopt, { }, selection, WTF::nullopt };
     Vector<uint8_t> hash;
     hash.append(TestData::kClientDataHash, sizeof(TestData::kClientDataHash));
     auto serializedData = encodeMakeCredenitalRequestAsCBOR(hash, options, AuthenticatorSupportedOptions::UserVerificationAvailability::kSupportedButNotConfigured);
index b682fb7..9279201 100644 (file)
@@ -113,6 +113,32 @@ constexpr uint8_t kU2fSignCommandApdu[] = {
     0x00, 0x00,
 };
 
+constexpr uint8_t kU2fAppIDSignCommandApdu[] = {
+    // CLA, INS, P1, P2 APDU instruction parameters
+    0x00, 0x02, 0x03, 0x00,
+    // Data Length (3 bytes in big endian order)
+    0x00, 0x00, 0x81,
+    // Challenge parameter -- see kClientDataHash
+    0x68, 0x71, 0x34, 0x96, 0x82, 0x22, 0xec, 0x17, 0x20, 0x2e, 0x42,
+    0x50, 0x5f, 0x8e, 0xd2, 0xb1, 0x6a, 0xe2, 0x2f, 0x16, 0xbb, 0x05,
+    0xb8, 0x8c, 0x25, 0xdb, 0x9e, 0x60, 0x26, 0x45, 0xf1, 0x41,
+    // Application parameter
+    0xc9, 0x34, 0x02, 0x87, 0x08, 0x3d, 0x64, 0xde, 0xed, 0x17, 0x1b, 0xbb,
+    0xd7, 0x60, 0x10, 0xae, 0xc5, 0x65, 0x3e, 0x78, 0xfc, 0xd0, 0x31, 0x88,
+    0xd0, 0xbf, 0x70, 0x16, 0x9a, 0x46, 0x91, 0xda,
+    // Key handle length
+    0x40,
+    // Key handle
+    0x3E, 0xBD, 0x89, 0xBF, 0x77, 0xEC, 0x50, 0x97, 0x55, 0xEE, 0x9C, 0x26,
+    0x35, 0xEF, 0xAA, 0xAC, 0x7B, 0x2B, 0x9C, 0x5C, 0xEF, 0x17, 0x36, 0xC3,
+    0x71, 0x7D, 0xA4, 0x85, 0x34, 0xC8, 0xC6, 0xB6, 0x54, 0xD7, 0xFF, 0x94,
+    0x5F, 0x50, 0xB5, 0xCC, 0x4E, 0x78, 0x05, 0x5B, 0xDD, 0x39, 0x6B, 0x64,
+    0xF7, 0x8D, 0xA2, 0xC5, 0xF9, 0x62, 0x00, 0xCC, 0xD4, 0x15, 0xCD, 0x08,
+    0xFE, 0x42, 0x00, 0x38,
+    // Max response length
+    0x00, 0x00,
+};
+
 constexpr uint8_t kU2fCheckOnlySignCommandApdu[] = {
     // CLA, INS, P1, P2 APDU instruction parameters
     0x00, 0x02, 0x07, 0x00,
index 7d745f9..6460446 100644 (file)
@@ -176,6 +176,27 @@ TEST(U2fCommandConstructorTest, TestConvertCtapGetAssertionToU2fSignRequest)
     EXPECT_EQ(*u2fSignCommand, convertBytesToVector(TestData::kU2fSignCommandApdu, sizeof(TestData::kU2fSignCommandApdu)));
 }
 
+TEST(U2fCommandConstructorTest, TestConvertCtapGetAssertionWithAppIDToU2fSignRequest)
+{
+    auto getAssertionReq = constructGetAssertionRequest();
+    PublicKeyCredentialDescriptor credentialDescriptor;
+    credentialDescriptor.type = PublicKeyCredentialType::PublicKey;
+    credentialDescriptor.idVector = convertBytesToVector(TestData::kU2fSignKeyHandle, sizeof(TestData::kU2fSignKeyHandle));
+    Vector<PublicKeyCredentialDescriptor> allowedList;
+    allowedList.append(WTFMove(credentialDescriptor));
+    getAssertionReq.allowCredentials = WTFMove(allowedList);
+    EXPECT_TRUE(isConvertibleToU2fSignCommand(getAssertionReq));
+
+    // AppID
+    WebCore::AuthenticationExtensionsClientInputs extensions;
+    extensions.appid = "https://www.example.com/appid";
+    getAssertionReq.extensions = WTFMove(extensions);
+
+    const auto u2fSignCommand = convertToU2fSignCommand(convertBytesToVector(TestData::kClientDataHash, sizeof(TestData::kClientDataHash)), getAssertionReq, convertBytesToVector(TestData::kU2fSignKeyHandle, sizeof(TestData::kU2fSignKeyHandle)), true);
+    ASSERT_TRUE(u2fSignCommand);
+    EXPECT_EQ(*u2fSignCommand, convertBytesToVector(TestData::kU2fAppIDSignCommandApdu, sizeof(TestData::kU2fAppIDSignCommandApdu)));
+}
+
 TEST(U2fCommandConstructorTest, TestU2fSignAllowListRequirement)
 {
     auto getAssertionReq = constructGetAssertionRequest();