feat(BRIDGE-424): FIDO2 GUI support.
This commit is contained in:
Atanas Janeshliev
267
internal/fido/fido.go
Normal file
267
internal/fido/fido.go
Normal file
@ -0,0 +1,267 @@
|
||||
// Copyright (c) 2025 Proton AG
|
||||
//
|
||||
// This file is part of Proton Mail Bridge.
|
||||
//
|
||||
// Proton Mail Bridge is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// Proton Mail Bridge is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License
|
||||
// along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
//go:build darwin || linux
|
||||
|
||||
package fido
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/sha256"
|
||||
"errors"
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
"github.com/ProtonMail/go-proton-api"
|
||||
"github.com/fxamacker/cbor/v2"
|
||||
"github.com/keys-pub/go-libfido2"
|
||||
)
|
||||
|
||||
var ErrAssertionCancelled = errors.New("FIDO assertion cancelled")
|
||||
|
||||
const (
|
||||
clientPinOption = "clientPin"
|
||||
touchNotificationDelay = 500 * time.Millisecond
|
||||
)
|
||||
|
||||
func getFidoDevice() (fido2Device *libfido2.Device, err error) {
|
||||
locs, err := libfido2.DeviceLocations()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("could not find security key device location: %w", err)
|
||||
}
|
||||
|
||||
if len(locs) == 0 {
|
||||
return nil, errors.New("no device found")
|
||||
}
|
||||
|
||||
if len(locs) > 1 {
|
||||
return nil, errors.New("multiple security keys detected, please disconnect all but one device and try again")
|
||||
}
|
||||
|
||||
fido2Device, err = libfido2.NewDevice(locs[0].Path)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("cannot open security key: %w", err)
|
||||
}
|
||||
|
||||
return fido2Device, nil
|
||||
}
|
||||
|
||||
func deviceHasOption(dev *libfido2.Device, name string) (bool, error) {
|
||||
info, err := dev.Info()
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("cannot get device info: %w", err)
|
||||
}
|
||||
|
||||
for _, opt := range info.Options {
|
||||
if opt.Name == name && opt.Value == libfido2.True {
|
||||
return true, err
|
||||
}
|
||||
}
|
||||
|
||||
return false, err
|
||||
}
|
||||
|
||||
func IsPinSupported() (bool, error) {
|
||||
dev, err := getFidoDevice()
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
|
||||
return deviceHasOption(dev, clientPinOption)
|
||||
}
|
||||
|
||||
func constructCredentialIDs(allowCredentials []interface{}) ([][]byte, error) {
|
||||
var credentialIDs [][]byte //nolint:prealloc
|
||||
for _, cred := range allowCredentials {
|
||||
credMap, ok := cred.(map[string]interface{})
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
idArray, ok := credMap["id"].([]interface{})
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
credID := sliceAnyToByteArray(idArray)
|
||||
credentialIDs = append(credentialIDs, credID)
|
||||
}
|
||||
|
||||
if len(credentialIDs) == 0 {
|
||||
return nil, errors.New("no valid credential IDs found")
|
||||
}
|
||||
|
||||
return credentialIDs, nil
|
||||
}
|
||||
|
||||
func prepareFidoAuth(auth proton.Auth) (*libfido2.Device, authData, [][]byte, [32]byte, error) {
|
||||
dev, err := getFidoDevice()
|
||||
if err != nil {
|
||||
return nil, authData{}, nil, [32]byte{}, fmt.Errorf("could not obtain security key device: %w", err)
|
||||
}
|
||||
|
||||
data, err := extractFidoAuthData(auth)
|
||||
if err != nil {
|
||||
return nil, authData{}, nil, [32]byte{}, fmt.Errorf("could not extract security key authentication data: %w", err)
|
||||
}
|
||||
|
||||
credentialIDs, err := constructCredentialIDs(data.AllowCredentials)
|
||||
if err != nil {
|
||||
return nil, authData{}, nil, [32]byte{}, err
|
||||
}
|
||||
|
||||
clientDataHash := sha256.Sum256(data.ClientDataJSONBytes)
|
||||
|
||||
return dev, data, credentialIDs, clientDataHash, nil
|
||||
}
|
||||
|
||||
func processFidoAssertion(assertion *libfido2.Assertion) ([]byte, error) {
|
||||
var authData []byte
|
||||
if err := cbor.Unmarshal(assertion.AuthDataCBOR, &authData); err != nil {
|
||||
return nil, fmt.Errorf("failed to decode CBOR authenticator data: %w", err)
|
||||
}
|
||||
return authData, nil
|
||||
}
|
||||
|
||||
func performAssertion(dev *libfido2.Device, rpID string, clientDataHash []byte, credentialIDs [][]byte, pin string) (*libfido2.Assertion, error) {
|
||||
assertion, err := dev.Assertion(
|
||||
rpID,
|
||||
clientDataHash,
|
||||
credentialIDs,
|
||||
pin,
|
||||
&libfido2.AssertionOpts{UP: libfido2.True},
|
||||
)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("FIDO2 assertion failed: %w", err)
|
||||
}
|
||||
return assertion, nil
|
||||
}
|
||||
|
||||
// performAssertationWithTimeout - initializes the assertion and sends data to the touchEventCh (with some delay) in parallel.
|
||||
func performAssertionWithTimeout(ctx context.Context, dev *libfido2.Device, rpID string, clientDataHash []byte, credentialIDs [][]byte, pin string, touchEventCh chan struct{}) (*libfido2.Assertion, error) {
|
||||
type assertionResult struct {
|
||||
assertion *libfido2.Assertion
|
||||
err error
|
||||
}
|
||||
|
||||
resultCh := make(chan assertionResult, 1)
|
||||
go func() {
|
||||
assertion, err := performAssertion(dev, rpID, clientDataHash, credentialIDs, pin)
|
||||
resultCh <- assertionResult{assertion: assertion, err: err}
|
||||
}()
|
||||
|
||||
nearTimeout := time.NewTimer(touchNotificationDelay)
|
||||
defer nearTimeout.Stop()
|
||||
|
||||
select {
|
||||
case result := <-resultCh:
|
||||
if result.err != nil {
|
||||
return nil, result.err
|
||||
}
|
||||
return result.assertion, nil
|
||||
|
||||
case <-nearTimeout.C:
|
||||
// Notify that touch is required.
|
||||
select {
|
||||
case touchEventCh <- struct{}{}:
|
||||
default:
|
||||
}
|
||||
|
||||
// Wait for either completion or cancellation.
|
||||
select {
|
||||
case result := <-resultCh:
|
||||
if result.err != nil {
|
||||
return nil, result.err
|
||||
}
|
||||
return result.assertion, nil
|
||||
|
||||
case <-ctx.Done():
|
||||
if err := dev.Cancel(); err != nil {
|
||||
return nil, fmt.Errorf("%w: %v", ErrAssertionCancelled, err)
|
||||
}
|
||||
return nil, ErrAssertionCancelled
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func AuthWithHardwareKeyGUI(ctx context.Context, client *proton.Client, auth proton.Auth, touchEventCh chan struct{}, touchConfirmCh chan struct{}, pin string) error {
|
||||
dev, fidoAuthData, credentialIDs, clientDataHash, err := prepareFidoAuth(auth)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
assertion, err := performAssertionWithTimeout(ctx, dev, fidoAuthData.RpID, clientDataHash[:], credentialIDs, pin, touchEventCh)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// Notify that spinner should be displayed, as assertion has finished.
|
||||
touchConfirmCh <- struct{}{}
|
||||
|
||||
// Decode CBOR to get raw authenticator data.
|
||||
authData, err := processFidoAssertion(assertion)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return authWithFido(client,
|
||||
auth,
|
||||
assertion.CredentialID,
|
||||
fidoAuthData.ClientDataJSONBytes,
|
||||
authData,
|
||||
assertion.Sig)
|
||||
}
|
||||
|
||||
func AuthWithHardwareKeyCLI(cliProvider CLIProvider, client *proton.Client, auth proton.Auth) error {
|
||||
cliProvider.PromptAndWaitReturn("Please insert your security key")
|
||||
|
||||
dev, fidoAuthData, credentialIDs, clientDataHash, err := prepareFidoAuth(auth)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
pinSupported, err := IsPinSupported()
|
||||
if err != nil {
|
||||
return fmt.Errorf("could not determine security key PIN support: %w", err)
|
||||
}
|
||||
|
||||
var pin string
|
||||
if pinSupported {
|
||||
pin = cliProvider.ReadSecurityKeyPin()
|
||||
if pin == "" {
|
||||
return errors.New("a PIN is required for this security key")
|
||||
}
|
||||
}
|
||||
|
||||
fmt.Println("Please touch the button or sensor on your security key.")
|
||||
assertion, err := performAssertion(dev, fidoAuthData.RpID, clientDataHash[:], credentialIDs, pin)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
authData, err := processFidoAssertion(assertion)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
fmt.Println("Submitting FIDO2 authentication request.")
|
||||
return authWithFido(
|
||||
client,
|
||||
auth,
|
||||
assertion.CredentialID,
|
||||
fidoAuthData.ClientDataJSONBytes,
|
||||
authData,
|
||||
assertion.Sig)
|
||||
}
|
||||
94
internal/fido/fido_windows.go
Normal file
94
internal/fido/fido_windows.go
Normal file
@ -0,0 +1,94 @@
|
||||
// Copyright (c) 2025 Proton AG
|
||||
//
|
||||
// This file is part of Proton Mail Bridge.
|
||||
//
|
||||
// Proton Mail Bridge is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// Proton Mail Bridge is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License
|
||||
// along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
//go:build windows
|
||||
|
||||
package fido
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"time"
|
||||
|
||||
"github.com/ProtonMail/go-proton-api"
|
||||
"github.com/go-ctap/ctaphid/pkg/webauthntypes"
|
||||
"github.com/go-ctap/winhello"
|
||||
"github.com/go-ctap/winhello/window"
|
||||
)
|
||||
|
||||
func AuthWithHardwareKeyCLI(_ CLIProvider, client *proton.Client, auth proton.Auth) error {
|
||||
return AuthWithHardwareKeyGUI(client, auth, true)
|
||||
}
|
||||
|
||||
func AuthWithHardwareKeyGUI(client *proton.Client, auth proton.Auth, onCLI bool) error {
|
||||
fidoAuthData, err := extractFidoAuthData(auth)
|
||||
if err != nil {
|
||||
return fmt.Errorf("could not extract security key authentication data: %w", err)
|
||||
}
|
||||
|
||||
var credentialDescriptors []webauthntypes.PublicKeyCredentialDescriptor
|
||||
for _, cred := range fidoAuthData.AllowCredentials {
|
||||
credMap, ok := cred.(map[string]interface{})
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
idArray, ok := credMap["id"].([]interface{})
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
credID := sliceAnyToByteArray(idArray)
|
||||
credentialDescriptors = append(credentialDescriptors, webauthntypes.PublicKeyCredentialDescriptor{
|
||||
ID: credID,
|
||||
Type: webauthntypes.PublicKeyCredentialTypePublicKey,
|
||||
})
|
||||
}
|
||||
|
||||
if len(credentialDescriptors) == 0 {
|
||||
return fmt.Errorf("no valid credential descriptors found")
|
||||
}
|
||||
|
||||
windowHandler, err := window.GetForegroundWindow()
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to obtain window handle: %w", err)
|
||||
}
|
||||
|
||||
if onCLI {
|
||||
fmt.Println("Please use Windows Hello to authenticate.")
|
||||
}
|
||||
assertion, err := winhello.GetAssertion(windowHandler,
|
||||
fidoAuthData.RpID,
|
||||
fidoAuthData.ClientDataJSONBytes,
|
||||
credentialDescriptors,
|
||||
nil,
|
||||
&winhello.AuthenticatorGetAssertionOptions{
|
||||
Timeout: time.Second * 60,
|
||||
AuthenticatorAttachment: winhello.WinHelloAuthenticatorAttachmentCrossPlatform,
|
||||
UserVerificationRequirement: winhello.WinHelloUserVerificationRequirementPreferred,
|
||||
CredentialHints: []webauthntypes.PublicKeyCredentialHint{
|
||||
webauthntypes.PublicKeyCredentialHintSecurityKey,
|
||||
},
|
||||
},
|
||||
)
|
||||
if err != nil {
|
||||
return fmt.Errorf("windows Hello assertion failed: %w", err)
|
||||
}
|
||||
|
||||
if onCLI {
|
||||
fmt.Println("Submitting FIDO2 authentication request.")
|
||||
}
|
||||
|
||||
return authWithFido(client, auth, assertion.Credential.ID, fidoAuthData.ClientDataJSONBytes, assertion.AuthDataRaw, assertion.Signature)
|
||||
}
|
||||
23
internal/fido/types.go
Normal file
23
internal/fido/types.go
Normal file
@ -0,0 +1,23 @@
|
||||
// Copyright (c) 2025 Proton AG
|
||||
//
|
||||
// This file is part of Proton Mail Bridge.
|
||||
//
|
||||
// Proton Mail Bridge is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// Proton Mail Bridge is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License
|
||||
// along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
package fido
|
||||
|
||||
type CLIProvider interface {
|
||||
PromptAndWaitReturn(string)
|
||||
ReadSecurityKeyPin() string
|
||||
}
|
||||
111
internal/fido/utils.go
Normal file
111
internal/fido/utils.go
Normal file
@ -0,0 +1,111 @@
|
||||
// Copyright (c) 2025 Proton AG
|
||||
//
|
||||
// This file is part of Proton Mail Bridge.
|
||||
//
|
||||
// Proton Mail Bridge is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// Proton Mail Bridge is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License
|
||||
// along with Proton Mail Bridge. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
package fido
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
|
||||
"github.com/ProtonMail/go-proton-api"
|
||||
)
|
||||
|
||||
type authData struct {
|
||||
AllowCredentials []interface{}
|
||||
ClientDataJSONBytes []byte
|
||||
RpID string
|
||||
}
|
||||
|
||||
func extractFidoAuthData(auth proton.Auth) (authData, error) {
|
||||
authOptions, ok := auth.TwoFA.FIDO2.AuthenticationOptions.(map[string]interface{})
|
||||
if !ok {
|
||||
return authData{}, fmt.Errorf("invalid authentication options format")
|
||||
}
|
||||
|
||||
publicKey, ok := authOptions["publicKey"].(map[string]interface{})
|
||||
if !ok {
|
||||
return authData{}, fmt.Errorf("no publicKey found in authentication options")
|
||||
}
|
||||
|
||||
rpID, ok := publicKey["rpId"].(string)
|
||||
if !ok {
|
||||
return authData{}, fmt.Errorf("could not find rpId in authentication options")
|
||||
}
|
||||
|
||||
challengeArray, ok := publicKey["challenge"].([]interface{})
|
||||
if !ok {
|
||||
return authData{}, fmt.Errorf("no challenge found in authentication options")
|
||||
}
|
||||
challenge := sliceAnyToByteArray(challengeArray)
|
||||
|
||||
allowCredentials, ok := publicKey["allowCredentials"].([]interface{})
|
||||
if !ok || len(allowCredentials) == 0 {
|
||||
return authData{}, fmt.Errorf("no allowed credentials found in authentication options")
|
||||
}
|
||||
|
||||
clientDataJSON := map[string]interface{}{
|
||||
"type": "webauthn.get",
|
||||
"challenge": base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(challenge),
|
||||
"origin": "https://" + rpID,
|
||||
}
|
||||
|
||||
clientDataJSONBytes, err := json.Marshal(clientDataJSON)
|
||||
if err != nil {
|
||||
return authData{}, fmt.Errorf("failed to marshal client data JSON: %w", err)
|
||||
}
|
||||
|
||||
return authData{
|
||||
AllowCredentials: allowCredentials,
|
||||
ClientDataJSONBytes: clientDataJSONBytes,
|
||||
RpID: rpID,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func sliceAnyToByteArray(s []any) []byte {
|
||||
result := make([]byte, len(s))
|
||||
for i, val := range s {
|
||||
if intVal, ok := val.(float64); ok {
|
||||
result[i] = byte(intVal)
|
||||
} else {
|
||||
panic("boom")
|
||||
}
|
||||
}
|
||||
return result
|
||||
}
|
||||
|
||||
func authWithFido(client *proton.Client, auth proton.Auth, credentialIDs []byte, clientDataJSON []byte, authDataRaw []byte, signature []byte) error {
|
||||
credentialIDInts := make([]int, len(credentialIDs))
|
||||
for i, b := range credentialIDs {
|
||||
credentialIDInts[i] = int(b)
|
||||
}
|
||||
|
||||
fido2Req := proton.FIDO2Req{
|
||||
AuthenticationOptions: auth.TwoFA.FIDO2.AuthenticationOptions,
|
||||
ClientData: base64.StdEncoding.EncodeToString(clientDataJSON),
|
||||
AuthenticatorData: base64.StdEncoding.EncodeToString(authDataRaw),
|
||||
Signature: base64.StdEncoding.EncodeToString(signature),
|
||||
CredentialID: credentialIDInts,
|
||||
}
|
||||
|
||||
if err := client.Auth2FA(context.Background(), proton.Auth2FAReq{FIDO2: fido2Req}); err != nil {
|
||||
return fmt.Errorf("FIDO2 authentication failed: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
Reference in New Issue
Block a user