Attachment 413262 Details for Bug 217945 – Patch for landing

[patch] Patch for landing

bug-217945-20201104234514.patch (text/plain), 5.97 KB, created by Jiewen Tan on 2020-11-04 23:45:15 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Jiewen Tan

Created: 2020-11-04 23:45:15 PST

Size: 5.97 KB

patch

obsolete

>Subversion Revision: 269285
>diff --git a/Source/WebKit/ChangeLog b/Source/WebKit/ChangeLog
>index 02f8e62f5c7273c6ce50611af2a6745f1708950c..85bdbb5860167043034c5dd64a0691563a317af8 100644
>--- a/Source/WebKit/ChangeLog
>+++ b/Source/WebKit/ChangeLog
>@@ -1,3 +1,20 @@
>+2020-11-04  Jiewen Tan  <jiewen_tan@apple.com>
>+
>+        [WebAuthn] Determine an AAGUID for the platform authenticators
>+        https://bugs.webkit.org/show_bug.cgi?id=217945
>+        <rdar://problem/70811618>
>+
>+        Reviewed by Brent Fulgham.
>+
>+        Relying parties use the AAGUID to recognize supported authenticators. Using a NULL AAGUID blocks them from recognizing Apple products as valid WebAuthentication targets.
>+        We need to assign ourselves a GUID representing Apple authenticators, then publish with our attestation certificate and with the FIDO Alliance.
>+
>+        Covered by existing tests.
>+
>+        * UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm:
>+        (WebKit::LocalAuthenticatorInternal::aaguidVector):
>+        (WebKit::LocalAuthenticator::continueMakeCredentialAfterUserVerification):
>+
> 2020-11-02  Ryosuke Niwa  <rniwa@webkit.org>
> 
>         Remove some useless comments from .messages.in files
>diff --git a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm b/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm
>index 4dc97e89390e85aaa55ede4ef2801e1b678b3dde..75d7d8e57f8d7df5c16456ccf075bfc9828d5c9e 100644
>--- a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm
>+++ b/Source/WebKit/UIProcess/WebAuthentication/Cocoa/LocalAuthenticator.mm
>@@ -59,6 +59,7 @@ const uint8_t getAssertionFlags = 0b00000101; // UP and UV are set.
> // Credential ID is currently SHA-1 of the corresponding public key.
> const uint16_t credentialIdLength = 20;
> const uint64_t counter = 0;
>+const uint8_t aaguid[] = { 0xF2, 0x4A, 0x8E, 0x70, 0xD0, 0xD3, 0xF8, 0x2C, 0x29, 0x37, 0x32, 0x52, 0x3C, 0xC4, 0xDE, 0x5A }; // Randomly generated.
> 
> static inline bool emptyTransportsOrContain(const Vector<AuthenticatorTransport>& transports, AuthenticatorTransport target)
> {
>@@ -85,6 +86,13 @@ static inline Vector<uint8_t> toVector(NSData *data)
>     return result;
> }
> 
>+static inline Vector<uint8_t> aaguidVector()
>+{
>+    Vector<uint8_t> result;
>+    result.append(aaguid, aaguidLength);
>+    return result;
>+}
>+
> static inline RetainPtr<NSData> toNSData(const Vector<uint8_t>& data)
> {
>     return adoptNS([[NSData alloc] initWithBytes:data.data() length:data.size()]);
>@@ -356,22 +364,20 @@ void LocalAuthenticator::continueMakeCredentialAfterUserVerification(SecAccessCo
>         [nsPublicKeyData getBytes: y.data() range:NSMakeRange(1 + ES256FieldElementLength, ES256FieldElementLength)];
>         cosePublicKey = encodeES256PublicKeyAsCBOR(WTFMove(x), WTFMove(y));
>     }
>-    // FIXME(rdar://problem/38320512): Define Apple AAGUID.
>-    auto attestedCredentialData = buildAttestedCredentialData(Vector<uint8_t>(aaguidLength, 0), credentialId, cosePublicKey);
> 
>     // Step 12.
>-    auto authData = buildAuthData(creationOptions.rp.id, makeCredentialFlags, counter, attestedCredentialData);
>-
>     // Skip Apple Attestation for none attestation.
>     if (creationOptions.attestation == AttestationConveyancePreference::None) {
>         deleteDuplicateCredential();
> 
>+        auto authData = buildAuthData(creationOptions.rp.id, makeCredentialFlags, counter, buildAttestedCredentialData(Vector<uint8_t>(aaguidLength, 0), credentialId, cosePublicKey));
>         auto attestationObject = buildAttestationObject(WTFMove(authData), "", { }, AttestationConveyancePreference::None);
>         receiveRespond(AuthenticatorAttestationResponse::create(credentialId, attestationObject));
>         return;
>     }
> 
>     // Step 13. Apple Attestation
>+    auto authData = buildAuthData(creationOptions.rp.id, makeCredentialFlags, counter, buildAttestedCredentialData(aaguidVector(), credentialId, cosePublicKey));
>     auto nsAuthData = toNSData(authData);
>     auto callback = [credentialId = WTFMove(credentialId), authData = WTFMove(authData), weakThis = makeWeakPtr(*this)] (NSArray * _Nullable certificates, NSError * _Nullable error) mutable {
>         ASSERT(RunLoop::isMain());
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index cfb26da912582137321ba4369625ad73b37de2ee..110ebb7409362f0f2db7f640e12a20b3aeec2d45 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,13 @@
>+2020-11-04  Jiewen Tan  <jiewen_tan@apple.com>
>+
>+        [WebAuthn] Determine an AAGUID for the platform authenticators
>+        https://bugs.webkit.org/show_bug.cgi?id=217945
>+        <rdar://problem/70811618>
>+
>+        Reviewed by Brent Fulgham.
>+
>+        * http/wpt/webauthn/public-key-credential-create-success-local.https.html:
>+
> 2020-11-02  Diego Pino Garcia  <dpino@igalia.com>
> 
>         [WPE] Unreviewed test gardening. Update test expectations.
>diff --git a/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-local.https.html b/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-local.https.html
>index 5c79760e15f0fc15383b9ff61713bf54562e2e99..e2eae07713989aef5dfa4996b6f52d4e750ce7bb 100644
>--- a/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-local.https.html
>+++ b/LayoutTests/http/wpt/webauthn/public-key-credential-create-success-local.https.html
>@@ -31,7 +31,10 @@
>         assert_equals(bytesToHexString(authData.rpIdHash), "49960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d9763");
>         assert_equals(authData.flags, 69);
>         assert_equals(authData.counter, 0);
>-        assert_equals(bytesToHexString(authData.aaguid), "00000000000000000000000000000000");
>+        if (isNoneAttestation)
>+            assert_equals(bytesToHexString(authData.aaguid), "00000000000000000000000000000000");
>+        else
>+            assert_equals(bytesToHexString(authData.aaguid), "f24a8e70d0d3f82c293732523cc4de5a");
>         assert_array_equals(authData.credentialID, credentialID);
>         // Check self attestation
>         assert_true(checkPublicKey(authData.publicKey));

Actions: View | Formatted Diff | Diff

Attachments on bug 217945: 413150 | 413262