Changeset 290539 in webkit

Timestamp:

Feb 25, 2022 5:47:04 PM (5 months ago)

Author:

J Pascoe

Message:

[WebAuthn] Fallback to attestation=none whenever attestation fails
​https://bugs.webkit.org/show_bug.cgi?id=237223
rdar://88767812

Reviewed by Brent Fulgham.

Source/WebKit:

Whenever attestation is requested by a RP and it fails to complete,
we previously errored out of the registration. The more correct platform
behavior in this case is to provide attestation=none.

Created API test for this behavior.

• UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:

(WebKit::LocalAuthenticator::continueMakeCredentialAfterAttested):

Tools:

Add test for local authenticator attestation fallback behavior.

• TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:

(TestWebKitAPI::TEST):

Location:

trunk

Files:

• Source/WebKit/ChangeLog (modified) (1 diff)
• Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm (modified) (1 diff)
• Tools/ChangeLog (modified) (1 diff)
• Tools/TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2022-02-25  J Pascoe  <j_pascoe@apple.com>
+
+        [WebAuthn] Fallback to attestation=none whenever attestation fails
+        https://bugs.webkit.org/show_bug.cgi?id=237223
+        rdar://88767812
+
+        Reviewed by Brent Fulgham.
+
+        Whenever attestation is requested by a RP and it fails to complete,
+        we previously errored out of the registration. The more correct platform
+        behavior in this case is to provide attestation=none.
+
+        Created API test for this behavior.
+
+        * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
+        (WebKit::LocalAuthenticator::continueMakeCredentialAfterAttested):
+
 2022-02-25  Per Arne Vollan  <pvollan@apple.com>
 

trunk/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm

@@ -466 +466 @@
 
     if (error) {
-        receiveException({ UnknownError, makeString("Couldn't attest: ", String(error.localizedDescription)) });
+        LOG_ERROR("Couldn't attest: %s", String(error.localizedDescription).utf8().data());
+        auto attestationObject = buildAttestationObject(WTFMove(authData), "", { }, AttestationConveyancePreference::None);
+        receiveRespond(AuthenticatorAttestationResponse::create(credentialId, attestationObject, AuthenticatorAttachment::Platform));
         return;
     }

trunk/Tools/ChangeLog

@@ +1 @@
+2022-02-25  J Pascoe  <j_pascoe@apple.com>
+
+        [WebAuthn] Fallback to attestation=none whenever attestation fails
+        https://bugs.webkit.org/show_bug.cgi?id=237223
+        rdar://88767812
+
+        Reviewed by Brent Fulgham.
+
+        Add test for local authenticator attestation fallback behavior.
+
+        * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
+        (TestWebKitAPI::TEST):
+
 2022-02-25  Brent Fulgham  <bfulgham@apple.com>
 

trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm

@@ -1929 +1929 @@
     Util::run(&webAuthenticationPanelRan);
 }
+
+TEST(WebAuthenticationPanel, MakeCredentialLAAttestationFalback)
+{
+    reset();
+
+    uint8_t identifier[] = { 0x01, 0x02, 0x03, 0x04 };
+    uint8_t hash[] = { 0x01, 0x02, 0x03, 0x04, 0x01, 0x02, 0x03, 0x04, 0x01, 0x02, 0x03, 0x04, 0x01, 0x02, 0x03, 0x04, 0x01, 0x02, 0x03, 0x04, 0x01, 0x02, 0x03, 0x04, 0x01, 0x02, 0x03, 0x04, 0x01, 0x02, 0x03, 0x04 };
+    NSData *nsIdentifier = [NSData dataWithBytes:identifier length:sizeof(identifier)];
+    auto nsHash = adoptNS([[NSData alloc] initWithBytes:hash length:sizeof(hash)]);
+    auto parameters = adoptNS([[_WKPublicKeyCredentialParameters alloc] initWithAlgorithm:@-7]);
+
+    auto rp = adoptNS([[_WKPublicKeyCredentialRelyingPartyEntity alloc] initWithName:@"example.com"]);
+    [rp setIdentifier:@"example.com"];
+    auto user = adoptNS([[_WKPublicKeyCredentialUserEntity alloc] initWithName:@"jappleseed@example.com" identifier:nsIdentifier displayName:@"J Appleseed"]);
+    NSArray<_WKPublicKeyCredentialParameters *> *publicKeyCredentialParamaters = @[ parameters.get() ];
+    auto options = adoptNS([[_WKPublicKeyCredentialCreationOptions alloc] initWithRelyingParty:rp.get() user:user.get() publicKeyCredentialParamaters:publicKeyCredentialParamaters]);
+    options.get().attestation = _WKAttestationConveyancePreferenceDirect;
+
+    auto panel = adoptNS([[_WKWebAuthenticationPanel alloc] init]);
+    [panel setMockConfiguration:@{ @"privateKeyBase64": testES256PrivateKeyBase64 }];
+    auto delegate = adoptNS([[TestWebAuthenticationPanelDelegate alloc] init]);
+    [panel setDelegate:delegate.get()];
+
+    [panel makeCredentialWithClientDataHash:nsHash.get() options:options.get() completionHandler:^(_WKAuthenticatorAttestationResponse *response, NSError *error) {
+        webAuthenticationPanelRan = true;
+        cleanUpKeychain("example.com");
+
+        EXPECT_NOT_NULL(response);
+        // {"fmt": "none", "attStmt": {}, "authData": ...}
+        EXPECT_WK_STREQ([response.attestationObject base64EncodedStringWithOptions:0], "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViYo3mm9u6vuaVeN4wRgDTidR5oL6ufLTCrE9ISVYbOGUdFAAAAAAAAAAAAAAAAAAAAAAAAAAAAFEjElx54Be4RDrBJQO9wt0WPvG0epQECAyYgASFYIDj/zxSkzKgaBuS3cdWDF558of8AaIpgFpsjF/Qm1749IlggVBJPgqUIwfhWHJ91nb7UPH76c0+WFOzZKslPyyFse4g=");
+    }];
+    Util::run(&webAuthenticationPanelRan);
+}
 #endif