Skip to content

fix(hid): cancel propagation via Notify and CancelOnDrop #208

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
AlfioEmanueleFresta wants to merge 3 commits into
base: fix/hid-receive-hardening
Choose a base branch
from
Draft

fix(hid): cancel propagation via Notify and CancelOnDrop #208

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5c205ce
fix(hid): validate CID, SEQ, and init bit on continuation packets
AlfioEmanueleFresta May 10, 2026
fb6269e
fix(hid): enforce wall-clock timeout on HID receive and CTAP2 exchanges
AlfioEmanueleFresta May 10, 2026
a1de4e5
fix(hid): break Drop deadlock and propagate future-drop to in-flight …
AlfioEmanueleFresta May 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 27 additions & 19 deletions libwebauthn/src/proto/ctap2/protocol.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,12 @@
use std::time::Duration;

use async_trait::async_trait;
use tokio::time::timeout as tokio_timeout;
use tracing::{debug, instrument, trace, warn};

use crate::proto::ctap2::cbor::{self, CborRequest};
use crate::proto::ctap2::cbor::{self, CborRequest, CborResponse};
use crate::proto::ctap2::{Ctap2BioEnrollmentResponse, Ctap2CommandCode};
use crate::transport::error::TransportError;
use crate::transport::Channel;
use crate::unwrap_field;
use crate::webauthn::error::{CtapError, Error, PlatformError};
Expand All @@ -19,6 +21,21 @@ use super::{

const TIMEOUT_GET_INFO: Duration = Duration::from_millis(250);

/// CBOR send + recv with a wall-clock timeout over the pair. Mirrors
/// `send_apdu_request_wait_uv` in the CTAP1 module.
async fn cbor_send_recv<C: Channel + ?Sized>(
channel: &mut C,
request: &CborRequest,
timeout: Duration,
) -> Result<CborResponse, Error> {
tokio_timeout(timeout, async {
channel.cbor_send(request, timeout).await?;
channel.cbor_recv(timeout).await
})
.await
.map_err(|_| Error::Transport(TransportError::Timeout))?
}

macro_rules! parse_cbor {
($type:ty, $data:expr) => {{
match cbor::from_slice::<$type>($data) {
Expand Down Expand Up @@ -83,8 +100,7 @@ where
#[instrument(skip_all)]
async fn ctap2_get_info(&mut self) -> Result<Ctap2GetInfoResponse, Error> {
let cbor_request = CborRequest::new(Ctap2CommandCode::AuthenticatorGetInfo);
self.cbor_send(&cbor_request, TIMEOUT_GET_INFO).await?;
let cbor_response = self.cbor_recv(TIMEOUT_GET_INFO).await?;
let cbor_response = cbor_send_recv(self, &cbor_request, TIMEOUT_GET_INFO).await?;
match cbor_response.status_code {
CtapError::Ok => (),
error => return Err(Error::Ctap(error)),
Expand All @@ -103,8 +119,7 @@ where
timeout: Duration,
) -> Result<Ctap2MakeCredentialResponse, Error> {
trace!(?request);
self.cbor_send(&request.try_into()?, timeout).await?;
let cbor_response = self.cbor_recv(timeout).await?;
let cbor_response = cbor_send_recv(self, &request.try_into()?, timeout).await?;
match cbor_response.status_code {
CtapError::Ok => (),
error => return Err(Error::Ctap(error)),
Expand All @@ -124,8 +139,7 @@ where
timeout: Duration,
) -> Result<Ctap2GetAssertionResponse, Error> {
trace!(?request);
self.cbor_send(&request.try_into()?, timeout).await?;
let cbor_response = self.cbor_recv(timeout).await?;
let cbor_response = cbor_send_recv(self, &request.try_into()?, timeout).await?;
match cbor_response.status_code {
CtapError::Ok => (),
error => return Err(Error::Ctap(error)),
Expand All @@ -145,8 +159,7 @@ where
) -> Result<Ctap2GetAssertionResponse, Error> {
debug!("CTAP2 GetNextAssertion request");
let cbor_request = CborRequest::new(Ctap2CommandCode::AuthenticatorGetNextAssertion);
self.cbor_send(&cbor_request, timeout).await?;
let cbor_response = self.cbor_recv(timeout).await?;
let cbor_response = cbor_send_recv(self, &cbor_request, timeout).await?;
let data = unwrap_field!(cbor_response.data);
let ctap_response = parse_cbor!(Ctap2GetAssertionResponse, &data);
debug!("CTAP2 GetNextAssertion successful");
Expand All @@ -159,8 +172,7 @@ where
debug!("CTAP2 Authenticator Selection request");
let cbor_request = CborRequest::new(Ctap2CommandCode::AuthenticatorSelection);

self.cbor_send(&cbor_request, timeout).await?;
let cbor_response = self.cbor_recv(timeout).await?;
let cbor_response = cbor_send_recv(self, &cbor_request, timeout).await?;
match cbor_response.status_code {
CtapError::Ok => {
return Ok(());
Expand All @@ -179,8 +191,7 @@ where
timeout: Duration,
) -> Result<Ctap2ClientPinResponse, Error> {
trace!(?request);
self.cbor_send(&request.try_into()?, timeout).await?;
let cbor_response = self.cbor_recv(timeout).await?;
let cbor_response = cbor_send_recv(self, &request.try_into()?, timeout).await?;
match cbor_response.status_code {
CtapError::Ok => (),
error => return Err(Error::Ctap(error)),
Expand All @@ -205,8 +216,7 @@ where
timeout: Duration,
) -> Result<(), Error> {
trace!(?request);
self.cbor_send(&request.try_into()?, timeout).await?;
let cbor_response = self.cbor_recv(timeout).await?;
let cbor_response = cbor_send_recv(self, &request.try_into()?, timeout).await?;
match cbor_response.status_code {
CtapError::Ok => {
return Ok(());
Expand All @@ -228,8 +238,7 @@ where
timeout: Duration,
) -> Result<Ctap2BioEnrollmentResponse, Error> {
trace!(?request);
self.cbor_send(&request.try_into()?, timeout).await?;
let cbor_response = self.cbor_recv(timeout).await?;
let cbor_response = cbor_send_recv(self, &request.try_into()?, timeout).await?;
match cbor_response.status_code {
CtapError::Ok => (),
error => return Err(Error::Ctap(error)),
Expand All @@ -254,8 +263,7 @@ where
timeout: Duration,
) -> Result<Ctap2CredentialManagementResponse, Error> {
trace!(?request);
self.cbor_send(&request.try_into()?, timeout).await?;
let cbor_response = self.cbor_recv(timeout).await?;
let cbor_response = cbor_send_recv(self, &request.try_into()?, timeout).await?;
match cbor_response.status_code {
CtapError::Ok => (),
error => return Err(Error::Ctap(error)),
Expand Down
Loading
Loading