Daniel García
4 years ago
18 changed files with 654 additions and 126 deletions
@ -0,0 +1,394 @@ |
|||||
|
use rocket::Route; |
||||
|
use rocket_contrib::json::Json; |
||||
|
use serde_json::Value; |
||||
|
use webauthn_rs::{base64_data::Base64UrlSafeData, proto::*, AuthenticationState, RegistrationState, Webauthn}; |
||||
|
|
||||
|
use crate::{ |
||||
|
api::{ |
||||
|
core::two_factor::_generate_recover_code, EmptyResult, JsonResult, JsonUpcase, NumberOrString, PasswordData, |
||||
|
}, |
||||
|
auth::Headers, |
||||
|
db::{ |
||||
|
models::{TwoFactor, TwoFactorType}, |
||||
|
DbConn, |
||||
|
}, |
||||
|
error::Error, |
||||
|
CONFIG, |
||||
|
}; |
||||
|
|
||||
|
pub fn routes() -> Vec<Route> { |
||||
|
routes![get_webauthn, generate_webauthn_challenge, activate_webauthn, activate_webauthn_put, delete_webauthn,] |
||||
|
} |
||||
|
|
||||
|
struct WebauthnConfig { |
||||
|
url: String, |
||||
|
rpid: String, |
||||
|
} |
||||
|
|
||||
|
impl WebauthnConfig { |
||||
|
fn load() -> Webauthn<Self> { |
||||
|
let domain = CONFIG.domain(); |
||||
|
Webauthn::new(Self { |
||||
|
rpid: reqwest::Url::parse(&domain) |
||||
|
.map(|u| u.domain().map(str::to_owned)) |
||||
|
.ok() |
||||
|
.flatten() |
||||
|
.unwrap_or_default(), |
||||
|
url: domain, |
||||
|
}) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
impl webauthn_rs::WebauthnConfig for WebauthnConfig { |
||||
|
fn get_relying_party_name(&self) -> &str { |
||||
|
&self.url |
||||
|
} |
||||
|
|
||||
|
fn get_origin(&self) -> &str { |
||||
|
&self.url |
||||
|
} |
||||
|
|
||||
|
fn get_relying_party_id(&self) -> &str { |
||||
|
&self.rpid |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
impl webauthn_rs::WebauthnConfig for &WebauthnConfig { |
||||
|
fn get_relying_party_name(&self) -> &str { |
||||
|
&self.url |
||||
|
} |
||||
|
|
||||
|
fn get_origin(&self) -> &str { |
||||
|
&self.url |
||||
|
} |
||||
|
|
||||
|
fn get_relying_party_id(&self) -> &str { |
||||
|
&self.rpid |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
#[derive(Debug, Serialize, Deserialize)] |
||||
|
pub struct WebauthnRegistration { |
||||
|
pub id: i32, |
||||
|
pub name: String, |
||||
|
pub migrated: bool, |
||||
|
|
||||
|
pub credential: Credential, |
||||
|
} |
||||
|
|
||||
|
impl WebauthnRegistration { |
||||
|
fn to_json(&self) -> Value { |
||||
|
json!({ |
||||
|
"Id": self.id, |
||||
|
"Name": self.name, |
||||
|
"migrated": self.migrated, |
||||
|
}) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
#[post("/two-factor/get-webauthn", data = "<data>")] |
||||
|
fn get_webauthn(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn) -> JsonResult { |
||||
|
if !CONFIG.domain_set() { |
||||
|
err!("`DOMAIN` environment variable is not set. Webauthn disabled") |
||||
|
} |
||||
|
|
||||
|
if !headers.user.check_valid_password(&data.data.MasterPasswordHash) { |
||||
|
err!("Invalid password"); |
||||
|
} |
||||
|
|
||||
|
let (enabled, registrations) = get_webauthn_registrations(&headers.user.uuid, &conn)?; |
||||
|
let registrations_json: Vec<Value> = registrations.iter().map(WebauthnRegistration::to_json).collect(); |
||||
|
|
||||
|
Ok(Json(json!({ |
||||
|
"Enabled": enabled, |
||||
|
"Keys": registrations_json, |
||||
|
"Object": "twoFactorWebAuthn" |
||||
|
}))) |
||||
|
} |
||||
|
|
||||
|
#[post("/two-factor/get-webauthn-challenge", data = "<data>")] |
||||
|
fn generate_webauthn_challenge(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn) -> JsonResult { |
||||
|
if !headers.user.check_valid_password(&data.data.MasterPasswordHash) { |
||||
|
err!("Invalid password"); |
||||
|
} |
||||
|
|
||||
|
let registrations = get_webauthn_registrations(&headers.user.uuid, &conn)? |
||||
|
.1 |
||||
|
.into_iter() |
||||
|
.map(|r| r.credential.cred_id) // We return the credentialIds to the clients to avoid double registering
|
||||
|
.collect(); |
||||
|
|
||||
|
let (challenge, state) = WebauthnConfig::load().generate_challenge_register_options( |
||||
|
headers.user.uuid.as_bytes().to_vec(), |
||||
|
headers.user.email, |
||||
|
headers.user.name, |
||||
|
Some(registrations), |
||||
|
None, |
||||
|
None, |
||||
|
)?; |
||||
|
|
||||
|
let type_ = TwoFactorType::WebauthnRegisterChallenge; |
||||
|
TwoFactor::new(headers.user.uuid.clone(), type_, serde_json::to_string(&state)?).save(&conn)?; |
||||
|
|
||||
|
let mut challenge_value = serde_json::to_value(challenge.public_key)?; |
||||
|
challenge_value["status"] = "ok".into(); |
||||
|
challenge_value["errorMessage"] = "".into(); |
||||
|
Ok(Json(challenge_value)) |
||||
|
} |
||||
|
|
||||
|
#[derive(Debug, Deserialize)] |
||||
|
#[allow(non_snake_case)] |
||||
|
struct EnableWebauthnData { |
||||
|
Id: NumberOrString, // 1..5
|
||||
|
Name: String, |
||||
|
MasterPasswordHash: String, |
||||
|
DeviceResponse: RegisterPublicKeyCredentialCopy, |
||||
|
} |
||||
|
|
||||
|
// This is copied from RegisterPublicKeyCredential to change the Response objects casing
|
||||
|
#[derive(Debug, Deserialize)] |
||||
|
#[allow(non_snake_case)] |
||||
|
struct RegisterPublicKeyCredentialCopy { |
||||
|
pub Id: String, |
||||
|
pub RawId: Base64UrlSafeData, |
||||
|
pub Response: AuthenticatorAttestationResponseRawCopy, |
||||
|
pub Type: String, |
||||
|
} |
||||
|
|
||||
|
// This is copied from AuthenticatorAttestationResponseRaw to change clientDataJSON to clientDataJson
|
||||
|
#[derive(Debug, Deserialize)] |
||||
|
#[allow(non_snake_case)] |
||||
|
pub struct AuthenticatorAttestationResponseRawCopy { |
||||
|
pub AttestationObject: Base64UrlSafeData, |
||||
|
pub ClientDataJson: Base64UrlSafeData, |
||||
|
} |
||||
|
|
||||
|
impl From<RegisterPublicKeyCredentialCopy> for RegisterPublicKeyCredential { |
||||
|
fn from(r: RegisterPublicKeyCredentialCopy) -> Self { |
||||
|
Self { |
||||
|
id: r.Id, |
||||
|
raw_id: r.RawId, |
||||
|
response: AuthenticatorAttestationResponseRaw { |
||||
|
attestation_object: r.Response.AttestationObject, |
||||
|
client_data_json: r.Response.ClientDataJson, |
||||
|
}, |
||||
|
type_: r.Type, |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// This is copied from PublicKeyCredential to change the Response objects casing
|
||||
|
#[derive(Debug, Deserialize)] |
||||
|
#[allow(non_snake_case)] |
||||
|
pub struct PublicKeyCredentialCopy { |
||||
|
pub Id: String, |
||||
|
pub RawId: Base64UrlSafeData, |
||||
|
pub Response: AuthenticatorAssertionResponseRawCopy, |
||||
|
pub Extensions: Option<AuthenticationExtensionsClientOutputsCopy>, |
||||
|
pub Type: String, |
||||
|
} |
||||
|
|
||||
|
// This is copied from AuthenticatorAssertionResponseRaw to change clientDataJSON to clientDataJson
|
||||
|
#[derive(Debug, Deserialize)] |
||||
|
#[allow(non_snake_case)] |
||||
|
pub struct AuthenticatorAssertionResponseRawCopy { |
||||
|
pub AuthenticatorData: Base64UrlSafeData, |
||||
|
pub ClientDataJson: Base64UrlSafeData, |
||||
|
pub Signature: Base64UrlSafeData, |
||||
|
pub UserHandle: Option<Base64UrlSafeData>, |
||||
|
} |
||||
|
|
||||
|
#[derive(Debug, Deserialize)] |
||||
|
#[allow(non_snake_case)] |
||||
|
pub struct AuthenticationExtensionsClientOutputsCopy { |
||||
|
#[serde(default)] |
||||
|
pub Appid: bool, |
||||
|
} |
||||
|
|
||||
|
impl From<PublicKeyCredentialCopy> for PublicKeyCredential { |
||||
|
fn from(r: PublicKeyCredentialCopy) -> Self { |
||||
|
Self { |
||||
|
id: r.Id, |
||||
|
raw_id: r.RawId, |
||||
|
response: AuthenticatorAssertionResponseRaw { |
||||
|
authenticator_data: r.Response.AuthenticatorData, |
||||
|
client_data_json: r.Response.ClientDataJson, |
||||
|
signature: r.Response.Signature, |
||||
|
user_handle: r.Response.UserHandle, |
||||
|
}, |
||||
|
extensions: r.Extensions.map(|e| AuthenticationExtensionsClientOutputs { |
||||
|
appid: e.Appid, |
||||
|
}), |
||||
|
type_: r.Type, |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
#[post("/two-factor/webauthn", data = "<data>")] |
||||
|
fn activate_webauthn(data: JsonUpcase<EnableWebauthnData>, headers: Headers, conn: DbConn) -> JsonResult { |
||||
|
let data: EnableWebauthnData = data.into_inner().data; |
||||
|
let mut user = headers.user; |
||||
|
|
||||
|
if !user.check_valid_password(&data.MasterPasswordHash) { |
||||
|
err!("Invalid password"); |
||||
|
} |
||||
|
|
||||
|
// Retrieve and delete the saved challenge state
|
||||
|
let type_ = TwoFactorType::WebauthnRegisterChallenge as i32; |
||||
|
let state = match TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn) { |
||||
|
Some(tf) => { |
||||
|
let state: RegistrationState = serde_json::from_str(&tf.data)?; |
||||
|
tf.delete(&conn)?; |
||||
|
state |
||||
|
} |
||||
|
None => err!("Can't recover challenge"), |
||||
|
}; |
||||
|
|
||||
|
// Verify the credentials with the saved state
|
||||
|
let (credential, _data) = |
||||
|
WebauthnConfig::load().register_credential(&data.DeviceResponse.into(), &state, |_| Ok(false))?; |
||||
|
|
||||
|
let mut registrations: Vec<_> = get_webauthn_registrations(&user.uuid, &conn)?.1; |
||||
|
// TODO: Check for repeated ID's
|
||||
|
registrations.push(WebauthnRegistration { |
||||
|
id: data.Id.into_i32()?, |
||||
|
name: data.Name, |
||||
|
migrated: false, |
||||
|
|
||||
|
credential, |
||||
|
}); |
||||
|
|
||||
|
// Save the registrations and return them
|
||||
|
TwoFactor::new(user.uuid.clone(), TwoFactorType::Webauthn, serde_json::to_string(®istrations)?).save(&conn)?; |
||||
|
_generate_recover_code(&mut user, &conn); |
||||
|
|
||||
|
let keys_json: Vec<Value> = registrations.iter().map(WebauthnRegistration::to_json).collect(); |
||||
|
Ok(Json(json!({ |
||||
|
"Enabled": true, |
||||
|
"Keys": keys_json, |
||||
|
"Object": "twoFactorU2f" |
||||
|
}))) |
||||
|
} |
||||
|
|
||||
|
#[put("/two-factor/webauthn", data = "<data>")] |
||||
|
fn activate_webauthn_put(data: JsonUpcase<EnableWebauthnData>, headers: Headers, conn: DbConn) -> JsonResult { |
||||
|
activate_webauthn(data, headers, conn) |
||||
|
} |
||||
|
|
||||
|
#[derive(Deserialize, Debug)] |
||||
|
#[allow(non_snake_case)] |
||||
|
struct DeleteU2FData { |
||||
|
Id: NumberOrString, |
||||
|
MasterPasswordHash: String, |
||||
|
} |
||||
|
|
||||
|
#[delete("/two-factor/webauthn", data = "<data>")] |
||||
|
fn delete_webauthn(data: JsonUpcase<DeleteU2FData>, headers: Headers, conn: DbConn) -> JsonResult { |
||||
|
let id = data.data.Id.into_i32()?; |
||||
|
if !headers.user.check_valid_password(&data.data.MasterPasswordHash) { |
||||
|
err!("Invalid password"); |
||||
|
} |
||||
|
|
||||
|
let type_ = TwoFactorType::Webauthn as i32; |
||||
|
let mut tf = match TwoFactor::find_by_user_and_type(&headers.user.uuid, type_, &conn) { |
||||
|
Some(tf) => tf, |
||||
|
None => err!("Webauthn data not found!"), |
||||
|
}; |
||||
|
|
||||
|
let mut data: Vec<WebauthnRegistration> = serde_json::from_str(&tf.data)?; |
||||
|
|
||||
|
let item_pos = match data.iter().position(|r| r.id != id) { |
||||
|
Some(p) => p, |
||||
|
None => err!("Webauthn entry not found"), |
||||
|
}; |
||||
|
|
||||
|
let removed_item = data.remove(item_pos); |
||||
|
tf.data = serde_json::to_string(&data)?; |
||||
|
tf.save(&conn)?; |
||||
|
drop(tf); |
||||
|
|
||||
|
// If entry is migrated from u2f, delete the u2f entry as well
|
||||
|
if let Some(mut u2f) = TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::U2f as i32, &conn) { |
||||
|
use crate::api::core::two_factor::u2f::U2FRegistration; |
||||
|
let mut data: Vec<U2FRegistration> = match serde_json::from_str(&u2f.data) { |
||||
|
Ok(d) => d, |
||||
|
Err(_) => err!("Error parsing U2F data"), |
||||
|
}; |
||||
|
|
||||
|
data.retain(|r| r.reg.key_handle != removed_item.credential.cred_id); |
||||
|
let new_data_str = serde_json::to_string(&data)?; |
||||
|
|
||||
|
u2f.data = new_data_str; |
||||
|
u2f.save(&conn)?; |
||||
|
} |
||||
|
|
||||
|
let keys_json: Vec<Value> = data.iter().map(WebauthnRegistration::to_json).collect(); |
||||
|
|
||||
|
Ok(Json(json!({ |
||||
|
"Enabled": true, |
||||
|
"Keys": keys_json, |
||||
|
"Object": "twoFactorU2f" |
||||
|
}))) |
||||
|
} |
||||
|
|
||||
|
pub fn get_webauthn_registrations(user_uuid: &str, conn: &DbConn) -> Result<(bool, Vec<WebauthnRegistration>), Error> { |
||||
|
let type_ = TwoFactorType::Webauthn as i32; |
||||
|
match TwoFactor::find_by_user_and_type(user_uuid, type_, conn) { |
||||
|
Some(tf) => Ok((tf.enabled, serde_json::from_str(&tf.data)?)), |
||||
|
None => Ok((false, Vec::new())), // If no data, return empty list
|
||||
|
} |
||||
|
} |
||||
|
|
||||
|
pub fn generate_webauthn_login(user_uuid: &str, conn: &DbConn) -> JsonResult { |
||||
|
// Load saved credentials
|
||||
|
let creds: Vec<Credential> = |
||||
|
get_webauthn_registrations(user_uuid, conn)?.1.into_iter().map(|r| r.credential).collect(); |
||||
|
|
||||
|
if creds.is_empty() { |
||||
|
err!("No Webauthn devices registered") |
||||
|
} |
||||
|
|
||||
|
// Generate a challenge based on the credentials
|
||||
|
let ext = RequestAuthenticationExtensions::builder().appid(format!("{}/app-id.json", &CONFIG.domain())).build(); |
||||
|
let (response, state) = WebauthnConfig::load().generate_challenge_authenticate_options(creds, Some(ext))?; |
||||
|
|
||||
|
// Save the challenge state for later validation
|
||||
|
TwoFactor::new(user_uuid.into(), TwoFactorType::WebauthnLoginChallenge, serde_json::to_string(&state)?) |
||||
|
.save(&conn)?; |
||||
|
|
||||
|
// Return challenge to the clients
|
||||
|
Ok(Json(serde_json::to_value(response.public_key)?)) |
||||
|
} |
||||
|
|
||||
|
pub fn validate_webauthn_login(user_uuid: &str, response: &str, conn: &DbConn) -> EmptyResult { |
||||
|
let type_ = TwoFactorType::WebauthnLoginChallenge as i32; |
||||
|
let state = match TwoFactor::find_by_user_and_type(user_uuid, type_, conn) { |
||||
|
Some(tf) => { |
||||
|
let state: AuthenticationState = serde_json::from_str(&tf.data)?; |
||||
|
tf.delete(&conn)?; |
||||
|
state |
||||
|
} |
||||
|
None => err!("Can't recover login challenge"), |
||||
|
}; |
||||
|
|
||||
|
let rsp: crate::util::UpCase<PublicKeyCredentialCopy> = serde_json::from_str(response)?; |
||||
|
let rsp: PublicKeyCredential = rsp.data.into(); |
||||
|
|
||||
|
let mut registrations = get_webauthn_registrations(user_uuid, conn)?.1; |
||||
|
|
||||
|
// If the credential we received is migrated from U2F, enable the U2F compatibility
|
||||
|
//let use_u2f = registrations.iter().any(|r| r.migrated && r.credential.cred_id == rsp.raw_id.0);
|
||||
|
let (cred_id, auth_data) = WebauthnConfig::load().authenticate_credential(&rsp, &state)?; |
||||
|
|
||||
|
for reg in &mut registrations { |
||||
|
if ®.credential.cred_id == cred_id { |
||||
|
reg.credential.counter = auth_data.counter; |
||||
|
|
||||
|
TwoFactor::new(user_uuid.to_string(), TwoFactorType::Webauthn, serde_json::to_string(®istrations)?) |
||||
|
.save(&conn)?; |
||||
|
return Ok(()); |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
err!("Credential not present") |
||||
|
} |
||||
Loading…
Reference in new issue