Skip to content

Commit e44e2d1

Browse files
tgauthtgauth
authored
Merge pull request #15 from tgauth/update-1.14.0
Update 1.14.0
2 parents db728a3 + 9736699 commit e44e2d1

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+678
-153
lines changed

‎.actions/build-linux-i686-w64-mingw32-gcc

+3-3
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ make -j"$(nproc)" -C build
3232
sudo make -C build install
3333
cd ..
3434

35-
# Build and install OpenSSL 1.1.1t.
36-
git clone --depth=1 https://github.com/openssl/openssl -b OpenSSL_1_1_1t
35+
# Build and install OpenSSL 1.1.1w.
36+
git clone --depth=1 https://github.com/openssl/openssl -b OpenSSL_1_1_1w
3737
cd openssl
3838
./Configure mingw --prefix=/fakeroot --openssldir=/fakeroot/openssl \
3939
--cross-compile-prefix=i686-w64-mingw32-
@@ -42,7 +42,7 @@ sudo make install_sw
4242
cd ..
4343

4444
# Build and install zlib.
45-
git clone --depth=1 https://github.com/madler/zlib -b v1.2.13
45+
git clone --depth=1 https://github.com/madler/zlib -b v1.3
4646
cd zlib
4747
make -fwin32/Makefile.gcc PREFIX=i686-w64-mingw32-
4848
sudo make -fwin32/Makefile.gcc PREFIX=i686-w64-mingw32- DESTDIR=/fakeroot \

‎.actions/build-linux-openssl3-clang

+2-2
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ FAKEROOT="$(mktemp -d)"
1212
# Check exports.
1313
(cd src && ./diff_exports.sh)
1414

15-
# Build and install OpenSSL 3.0.8.
16-
git clone --branch openssl-3.0.8 \
15+
# Build and install OpenSSL 3.0.12.
16+
git clone --branch openssl-3.0.12 \
1717
--depth=1 https://github.com/openssl/openssl
1818
cd openssl
1919
./Configure linux-x86_64-clang --prefix="${FAKEROOT}" \

‎.actions/build-linux-openssl3-gcc

+2-2
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@
88
${CC} --version
99
FAKEROOT="$(mktemp -d)"
1010

11-
# Build and install OpenSSL 3.0.8.
12-
git clone --branch openssl-3.0.8 \
11+
# Build and install OpenSSL 3.0.12.
12+
git clone --branch openssl-3.0.12 \
1313
--depth=1 https://github.com/openssl/openssl
1414
cd openssl
1515
./Configure linux-x86_64 --prefix="${FAKEROOT}" \

‎.actions/build-linux-openssl3-i686-w64-mingw32-gcc

+3-3
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ make -j"$(nproc)" -C build
3232
sudo make -C build install
3333
cd ..
3434

35-
# Build and install OpenSSL 3.0.8.
36-
git clone --branch openssl-3.0.8 \
35+
# Build and install OpenSSL 3.0.11.
36+
git clone --branch openssl-3.0.12 \
3737
--depth=1 https://github.com/openssl/openssl
3838
cd openssl
3939
./Configure mingw --prefix=/fakeroot --openssldir=/fakeroot/openssl \
@@ -43,7 +43,7 @@ sudo make install_sw
4343
cd ..
4444

4545
# Build and install zlib.
46-
git clone --depth=1 https://github.com/madler/zlib -b v1.2.13
46+
git clone --depth=1 https://github.com/madler/zlib -b v1.3
4747
cd zlib
4848
make -fwin32/Makefile.gcc PREFIX=i686-w64-mingw32-
4949
sudo make -fwin32/Makefile.gcc PREFIX=i686-w64-mingw32- DESTDIR=/fakeroot \

‎.actions/build-osx-clang

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
# license that can be found in the LICENSE file.
66
# SPDX-License-Identifier: BSD-2-Clause
77

8-
export PKG_CONFIG_PATH="$(brew --prefix openssl@1.1)/lib/pkgconfig"
8+
export PKG_CONFIG_PATH="$(brew --prefix openssl@3.0)/lib/pkgconfig"
99
SCAN="$(brew --prefix llvm)/bin/scan-build"
1010

1111
# Build, analyze, and install libfido2.

‎.actions/fuzz-linux

+4-4
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,13 @@
66
# SPDX-License-Identifier: BSD-2-Clause
77

88
LIBCBOR_URL="https://github.com/pjk/libcbor"
9-
LIBCBOR_TAG="v0.10.1"
9+
LIBCBOR_TAG="v0.10.2"
1010
LIBCBOR_ASAN="address alignment bounds"
1111
LIBCBOR_MSAN="memory"
1212
OPENSSL_URL="https://github.com/openssl/openssl"
13-
OPENSSL_TAG="OpenSSL_1_1_1t"
13+
OPENSSL_TAG="openssl-3.0.12"
1414
ZLIB_URL="https://github.com/madler/zlib"
15-
ZLIB_TAG="v1.2.13"
15+
ZLIB_TAG="v1.3"
1616
ZLIB_ASAN="address alignment bounds undefined"
1717
ZLIB_MSAN="memory"
1818
FIDO2_ASAN="address bounds fuzzer-no-link implicit-conversion leak"
@@ -62,7 +62,7 @@ cd -
6262
git clone --depth=1 "${OPENSSL_URL}" -b "${OPENSSL_TAG}"
6363
cd openssl
6464
./Configure linux-x86_64-clang "enable-$1" --prefix="${FAKEROOT}" \
65-
--openssldir="${FAKEROOT}/openssl"
65+
--openssldir="${FAKEROOT}/openssl" --libdir=lib
6666
make install_sw
6767
cd -
6868

‎.github/workflows/alpine_builds.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ jobs:
3232
- name: fix permissions on workdir
3333
run: chown root:wheel "${GITHUB_WORKSPACE}"
3434
- name: checkout libfido2
35-
uses: actions/checkout@v2
35+
uses: actions/checkout@v4
3636
- name: build libfido2
3737
env:
3838
CC: ${{ matrix.cc }}

‎.github/workflows/bsd_builds.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
matrix:
2121
image: [freebsd/13.x, openbsd/7.2]
2222
steps:
23-
- uses: actions/checkout@v2
23+
- uses: actions/checkout@v4
2424
- name: dependencies
2525
run: |
2626
sudo apt -q update

‎.github/workflows/cifuzz_oss.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
fuzz-seconds: 600
4040
dry-run: false
4141
- name: upload crash
42-
uses: actions/upload-artifact@v1
42+
uses: actions/upload-artifact@v3
4343
if: failure()
4444
with:
4545
name: ${{ matrix.sanitizer }}-artifacts

‎.github/workflows/codeql-analysis.yml

+4-1
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,16 @@ on:
1616
schedule:
1717
- cron: '0 0 * * 0'
1818

19+
permissions:
20+
security-events: write
21+
1922
jobs:
2023
codeql-build:
2124
if: github.repository == 'Yubico/libfido2'
2225
runs-on: ubuntu-22.04
2326
steps:
2427
- name: checkout
25-
uses: actions/checkout@v2
28+
uses: actions/checkout@v4
2629
with:
2730
fetch-depth: 2
2831
- name: init codeql

‎.github/workflows/cygwin_builds.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
arch: [ x64 ]
2525
config: [ "Debug", "Release" ]
2626
steps:
27-
- uses: actions/checkout@v2
27+
- uses: actions/checkout@v4
2828
- name: build
2929
run: |
3030
.\windows\cygwin.ps1 -Config ${{ matrix.config }}

‎.github/workflows/linux_builds.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,14 @@ jobs:
2626
- { os: ubuntu-22.04, cc: gcc-10 }
2727
- { os: ubuntu-22.04, cc: gcc-11 }
2828
- { os: ubuntu-22.04, cc: gcc-12 }
29-
- { os: ubuntu-20.04, cc: clang-12 }
3029
- { os: ubuntu-22.04, cc: clang-13 }
3130
- { os: ubuntu-22.04, cc: clang-14 }
3231
- { os: ubuntu-22.04, cc: clang-15 }
32+
- { os: ubuntu-22.04, cc: clang-16 }
3333
- { os: ubuntu-20.04, cc: i686-w64-mingw32-gcc-9 }
3434
- { os: ubuntu-22.04, cc: i686-w64-mingw32-gcc-10 }
3535
steps:
36-
- uses: actions/checkout@v2
36+
- uses: actions/checkout@v4
3737
- name: dependencies
3838
run: |
3939
sudo apt -q update

‎.github/workflows/linux_fuzz.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,10 @@ jobs:
2121
fail-fast: false
2222
matrix:
2323
os: [ ubuntu-22.04 ]
24-
cc: [ clang-15 ]
24+
cc: [ clang-16 ]
2525
sanitizer: [ asan, msan ]
2626
steps:
27-
- uses: actions/checkout@v2
27+
- uses: actions/checkout@v4
2828
- name: dependencies
2929
run: |
3030
sudo apt -q update

‎.github/workflows/macos_builds.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,12 @@ jobs:
2020
strategy:
2121
fail-fast: false
2222
matrix:
23-
os: [ macos-12, macos-11 ]
23+
os: [ macos-13, macos-12 ]
2424
cc: [ clang ]
2525
steps:
26-
- uses: actions/checkout@v2
26+
- uses: actions/checkout@v4
2727
- name: dependencies
28-
run: brew install libcbor llvm mandoc pkg-config zlib
28+
run: brew install libcbor llvm mandoc openssl@3.0 pkg-config zlib
2929
- name: build
3030
env:
3131
CC: ${{ matrix.cc }}

‎.github/workflows/openssl3.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ jobs:
2424
- os: ubuntu-22.04
2525
cc: gcc-11
2626
- os: ubuntu-22.04
27-
cc: clang-15
27+
cc: clang-16
2828
- os: ubuntu-22.04
2929
cc: i686-w64-mingw32-gcc-10
3030
steps:
31-
- uses: actions/checkout@v2
31+
- uses: actions/checkout@v4
3232
- name: dependencies
3333
env:
3434
CC: ${{ matrix.cc }}

‎.github/workflows/windows_builds.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
type: [ dynamic, static ]
2626
config: [ "Release" ]
2727
steps:
28-
- uses: actions/checkout@v2
28+
- uses: actions/checkout@v4
2929
- name: build
3030
run: |
3131
.\windows\build.ps1 -Fido2Flags '/analyze' -Arch ${{ matrix.arch }} `

‎CMakeLists.txt

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@
22
# Use of this source code is governed by a BSD-style
33
# license that can be found in the LICENSE file.
44
# SPDX-License-Identifier: BSD-2-Clause
5+
cmake_minimum_required(VERSION 3.7)
56

67
# detect AppleClang; needs to come before project()
78
cmake_policy(SET CMP0025 NEW)
89

910
project(libfido2 C)
10-
cmake_minimum_required(VERSION 3.0)
1111
# Set PIE flags for POSITION_INDEPENDENT_CODE targets, added in CMake 3.14.
1212
if(POLICY CMP0083)
1313
cmake_policy(SET CMP0083 NEW)
@@ -29,7 +29,7 @@ set(CMAKE_POSITION_INDEPENDENT_CODE ON)
2929
set(CMAKE_COLOR_MAKEFILE OFF)
3030
set(CMAKE_VERBOSE_MAKEFILE ON)
3131
set(FIDO_MAJOR "1")
32-
set(FIDO_MINOR "13")
32+
set(FIDO_MINOR "14")
3333
set(FIDO_PATCH "0")
3434
set(FIDO_VERSION ${FIDO_MAJOR}.${FIDO_MINOR}.${FIDO_PATCH})
3535

‎NEWS

+10
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
* Version 1.14.0 (2023-11-13)
2+
** fido2-cred -M, fido2-token -G: support raw client data via -w flag.
3+
** winhello: support U2F AppID extension for assertions.
4+
** winhello: fix restrictive parsing of the hmac-secret on assertions.
5+
** winhello: translate NTE_USER_CANCELLED to FIDO_ERR_OPERATION_DENIED; gh#685.
6+
** New API calls:
7+
** fido_assert_authdata_raw_len;
8+
** fido_assert_authdata_raw_ptr;
9+
** fido_assert_set_winhello_appid.
10+
111
* Version 1.13.0 (2023-02-20)
212
** Support for linking against OpenSSL on Windows; gh#668.
313
** New API calls:

‎README.adoc

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ is also available.
3838

3939
=== Releases
4040

41-
The current release of *libfido2* is 1.13.0. Signed release tarballs are
41+
The current release of *libfido2* is 1.14.0. Signed release tarballs are
4242
available at Yubico's
4343
https://developers.yubico.com/libfido2/Releases[release page].
4444

‎examples/README.adoc

+3-2
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ The following examples are provided:
4848
the device's PIN is changed from [oldpin] to <pin>.
4949

5050
- cred [-t es256|es384|rs256|eddsa] [-k pubkey] [-ei cred_id] [-P pin]
51-
[-T seconds] [-b blobkey] [-hruv] <device>
51+
[-T seconds] [-b blobkey] [-hruv] [-c cred_protect] <device>
5252

5353
Creates a new credential on <device> and verify that the credential
5454
was signed by the authenticator. The device's attestation certificate
@@ -63,7 +63,8 @@ The following examples are provided:
6363
is generated using U2F (CTAP1) instead of FIDO2 (CTAP2) commands.
6464
The -T option may be used to enforce a timeout of <seconds>. If the
6565
option -b is specified, the credential's "largeBlob" key is stored in
66-
<blobkey>.
66+
<blobkey>. If the option -c is specified the the generated credential
67+
will be bound by the specified protection policy.
6768

6869
- assert [-t es256|es384|rs256|eddsa] [-a cred_id] [-h hmac_secret] [-P pin]
6970
[-s hmac_salt] [-T seconds] [-b blobkey] [-puv] <pubkey> <device>

‎examples/cred.c

+25-5
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018-2022 Yubico AB. All rights reserved.
2+
* Copyright (c) 2018-2023 Yubico AB. All rights reserved.
33
* Use of this source code is governed by a BSD-style
44
* license that can be found in the LICENSE file.
55
* SPDX-License-Identifier: BSD-2-Clause
@@ -36,15 +36,16 @@ static void
3636
usage(void)
3737
{
3838
fprintf(stderr, "usage: cred [-t es256|es384|rs256|eddsa] [-k pubkey] "
39-
"[-ei cred_id] [-P pin] [-T seconds] [-b blobkey] [-hruv] "
39+
"[-ei cred_id] [-P pin] [-T seconds] [-b blobkey] [-c cred_protect] [-hruv] "
4040
"<device>\n");
4141
exit(EXIT_FAILURE);
4242
}
4343

4444
static void
4545
verify_cred(int type, const char *fmt, const unsigned char *authdata_ptr,
4646
size_t authdata_len, const unsigned char *attstmt_ptr, size_t attstmt_len,
47-
bool rk, bool uv, int ext, const char *key_out, const char *id_out)
47+
bool rk, bool uv, int ext, int cred_protect, const char *key_out,
48+
const char *id_out)
4849
{
4950
fido_cred_t *cred;
5051
int r;
@@ -85,6 +86,11 @@ verify_cred(int type, const char *fmt, const unsigned char *authdata_ptr,
8586
if (uv && (r = fido_cred_set_uv(cred, FIDO_OPT_TRUE)) != FIDO_OK)
8687
errx(1, "fido_cred_set_uv: %s (0x%x)", fido_strerr(r), r);
8788

89+
/* credProt */
90+
if (cred_protect != 0 && (r = fido_cred_set_prot(cred,
91+
cred_protect)) != FIDO_OK)
92+
errx(1, "fido_cred_set_prot: %s (0x%x)", fido_strerr(r), r);
93+
8894
/* fmt */
8995
r = fido_cred_set_fmt(cred, fmt);
9096
if (r != FIDO_OK)
@@ -159,11 +165,12 @@ main(int argc, char **argv)
159165
int ext = 0;
160166
int ch;
161167
int r;
168+
long long cred_protect = 0;
162169

163170
if ((cred = fido_cred_new()) == NULL)
164171
errx(1, "fido_cred_new");
165172

166-
while ((ch = getopt(argc, argv, "P:T:b:e:hi:k:rt:uv")) != -1) {
173+
while ((ch = getopt(argc, argv, "P:T:b:e:hi:k:rt:uvc:")) != -1) {
167174
switch (ch) {
168175
case 'P':
169176
pin = optarg;
@@ -192,6 +199,13 @@ main(int argc, char **argv)
192199
case 'h':
193200
ext |= FIDO_EXT_HMAC_SECRET;
194201
break;
202+
case 'c':
203+
if (base10(optarg, &cred_protect) < 0)
204+
errx(1, "base10: %s", optarg);
205+
if (cred_protect <= 0 || cred_protect > 3)
206+
errx(1, "-c: %s must be in (1,3)", optarg);
207+
ext |= FIDO_EXT_CRED_PROTECT;
208+
break;
195209
case 'i':
196210
id_out = optarg;
197211
break;
@@ -275,6 +289,11 @@ main(int argc, char **argv)
275289
if (uv && (r = fido_cred_set_uv(cred, FIDO_OPT_TRUE)) != FIDO_OK)
276290
errx(1, "fido_cred_set_uv: %s (0x%x)", fido_strerr(r), r);
277291

292+
/* credProt */
293+
if (cred_protect != 0 && (r = fido_cred_set_prot(cred,
294+
(int)cred_protect)) != FIDO_OK)
295+
errx(1, "fido_cred_set_prot: %s (0x%x)", fido_strerr(r), r);
296+
278297
/* timeout */
279298
if (ms != 0 && (r = fido_dev_set_timeout(dev, (int)ms)) != FIDO_OK)
280299
errx(1, "fido_dev_set_timeout: %s (0x%x)", fido_strerr(r), r);
@@ -296,7 +315,8 @@ main(int argc, char **argv)
296315

297316
verify_cred(type, fido_cred_fmt(cred), fido_cred_authdata_ptr(cred),
298317
fido_cred_authdata_len(cred), fido_cred_attstmt_ptr(cred),
299-
fido_cred_attstmt_len(cred), rk, uv, ext, key_out, id_out);
318+
fido_cred_attstmt_len(cred), rk, uv, ext, fido_cred_prot(cred),
319+
key_out, id_out);
300320

301321
if (blobkey_out != NULL) {
302322
/* extract the "largeBlob" key */

‎fuzz/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ RUN apk -q update
1010
RUN apk add build-base clang clang-analyzer cmake compiler-rt coreutils
1111
RUN apk add eudev-dev git linux-headers llvm openssl-dev pcsc-lite-dev
1212
RUN apk add sudo tar zlib-dev
13-
RUN git clone --branch v0.10.1 --depth=1 https://github.com/PJK/libcbor
13+
RUN git clone --branch v0.10.2 --depth=1 https://github.com/PJK/libcbor
1414
RUN git clone --depth=1 https://github.com/yubico/libfido2
1515
WORKDIR /libfido2
1616
RUN ./fuzz/build-coverage /libcbor /libfido2

‎fuzz/Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# license that can be found in the LICENSE file.
44
# SPDX-License-Identifier: BSD-2-Clause
55

6-
IMAGE := libfido2-coverage:1.13.1
6+
IMAGE := libfido2-coverage:1.14.0
77
RUNNER := libfido2-runner
88
PROFDATA := llvm-profdata
99
COV := llvm-cov

‎fuzz/export.gnu

+2
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@
2020
fido_assert_allow_cred;
2121
fido_assert_authdata_len;
2222
fido_assert_authdata_ptr;
23+
fido_assert_authdata_raw_len;
24+
fido_assert_authdata_raw_ptr;
2325
fido_assert_blob_len;
2426
fido_assert_blob_ptr;
2527
fido_assert_clientdata_hash_len;

0 commit comments

Comments
 (0)