@reegaviljoen/eldlock 0.1.0

package/eldlock-server/internal/libfido2/README.md

@@ -0,0 +1,127 @@
+# go-libfido2
+
+Go wrapper for libfido2.
+
+```go
+import (
+    "github.com/keys-pub/go-libfido2"
+)
+
+func ExampleDevice_Assertion() {
+    locs, err := libfido2.DeviceLocations()
+    if err != nil {
+        log.Fatal(err)
+    }
+    if len(locs) == 0 {
+        log.Println("No devices")
+        return
+    }
+
+    log.Printf("Using device: %+v\n", locs[0])
+    path := locs[0].Path
+    device, err := libfido2.NewDevice(path)
+    if err != nil {
+        log.Fatal(err)
+    }
+
+    cdh := libfido2.RandBytes(32)
+    userID := libfido2.RandBytes(32)
+    salt := libfido2.RandBytes(32)
+    pin := "12345"
+
+    attest, err := device.MakeCredential(
+        cdh,
+        libfido2.RelyingParty{
+            ID: "keys.pub",
+        },
+        libfido2.User{
+            ID:   userID,
+            Name: "gabriel",
+        },
+        libfido2.ES256, // Algorithm
+        pin,
+        &libfido2.MakeCredentialOpts{
+            Extensions: []libfido2.Extension{libfido2.HMACSecretExtension},
+        },
+    )
+    if err != nil {
+        log.Fatal(err)
+    }
+
+    log.Printf("Attestation:\n")
+    log.Printf("AuthData: %s\n", hex.EncodeToString(attest.AuthData))
+    log.Printf("ClientDataHash: %s\n", hex.EncodeToString(attest.ClientDataHash))
+    log.Printf("ID: %s\n", hex.EncodeToString(attest.CredentialID))
+    log.Printf("Type: %s\n", attest.CredentialType)
+    log.Printf("Sig: %s\n", hex.EncodeToString(attest.Sig))
+
+    assertion, err := device.Assertion(
+        "keys.pub",
+        cdh,
+        [][]byte{attest.CredentialID},
+        pin,
+        &libfido2.AssertionOpts{
+            Extensions: []libfido2.Extension{libfido2.HMACSecretExtension},
+            HMACSalt:   salt,
+        },
+    )
+    if err != nil {
+        log.Fatal(err)
+    }
+
+    log.Printf("Assertion:\n")
+    log.Printf("%s\n", hex.EncodeToString(assertion.AuthData))
+    log.Printf("%s\n", hex.EncodeToString(assertion.HMACSecret))
+    log.Printf("%s\n", hex.EncodeToString(assertion.Sig))
+
+    // Output:
+    //
+}
+```
+
+## Examples
+
+The examples require a device.
+
+To run an example, set FIDO2_EXAMPLES=1.
+
+```shell
+FIDO2_EXAMPLES=1 go test -v -run ExampleDeviceLocations
+FIDO2_EXAMPLES=1 go test -v -run ExampleDevice_Assertion
+FIDO2_EXAMPLES=1 go test -v -run ExampleDevice_Credentials
+```
+
+## Dependencies
+
+### Linux
+
+```shell
+sudo apt install software-properties-common
+sudo apt-add-repository ppa:yubico/stable
+sudo apt update
+sudo apt install libfido2-dev
+```
+
+### macOS
+
+```shell
+brew install keys-pub/tap/libfido2
+```
+
+### Windows
+
+```shell
+scoop bucket add keys.pub https://github.com/keys-pub/scoop-bucket
+scoop install libfido2
+```
+
+
+### Building libfido2
+
+#### macOS
+
+```shell
+export CFLAGS="-I/usr/local/include -I/usr/local/opt/openssl@1.1/include"
+export LDFLAGS="-L/usr/local/lib -L/usr/local/opt/openssl@1.1/lib/"
+(rm -rf build && mkdir build && cd build && cmake ..) && make -C build
+```

package/eldlock-server/internal/libfido2/examples_test.go

@@ -0,0 +1,614 @@
+package libfido2_test
+
+import (
+	"bytes"
+	"encoding/hex"
+	"log"
+	"os"
+
+	"github.com/keys-pub/go-libfido2"
+)
+
+func ExampleDeviceLocations() {
+	if os.Getenv("FIDO2_EXAMPLES") != "1" {
+		return
+	}
+	libfido2.SetLogger(libfido2.NewLogger(libfido2.DebugLevel))
+
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	for _, loc := range locs {
+		log.Printf("%+v\n", loc)
+		device, err := libfido2.NewDevice(loc.Path)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		hidInfo, err := device.CTAPHIDInfo()
+		if err != nil {
+			log.Fatal(err)
+		}
+		log.Printf("CTAPHIDInfo: %+v\n", hidInfo)
+
+		info, err := device.Info()
+		if err != nil {
+			log.Fatal(err)
+		}
+		log.Printf("Info: %+v\n", info)
+	}
+
+	// Output:
+	//
+}
+
+func ExampleDevice_MakeCredential() {
+	if os.Getenv("FIDO2_EXAMPLES") != "1" {
+		return
+	}
+	libfido2.SetLogger(libfido2.NewLogger(libfido2.DebugLevel))
+
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(locs) == 0 {
+		log.Println("No devices")
+		return
+	}
+
+	log.Printf("Using device: %+v\n", locs[0])
+	path := locs[0].Path
+	device, err := libfido2.NewDevice(path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	cdh := libfido2.RandBytes(32)
+	userID := libfido2.RandBytes(32)
+	pin := "12345"
+
+	attest, err := device.MakeCredential(
+		cdh,
+		libfido2.RelyingParty{
+			ID:   "keys.pub",
+			Name: "keys.pub",
+		},
+		libfido2.User{
+			ID:          userID,
+			Name:        "gabriel",
+			DisplayName: "Gabriel",
+		},
+		libfido2.ES256, // Algorithm
+		pin,
+		nil,
+	)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	log.Printf("Attestation:\n")
+	log.Printf("AuthData: %s\n", hex.EncodeToString(attest.AuthData))
+	log.Printf("ClientDataHash: %s\n", hex.EncodeToString(attest.ClientDataHash))
+	log.Printf("ID: %s\n", hex.EncodeToString(attest.CredentialID))
+	log.Printf("Type: %d\n", attest.CredentialType)
+	log.Printf("Sig: %s\n", hex.EncodeToString(attest.Sig))
+
+	// Output:
+	//
+}
+
+func ExampleDevice_Assertion() {
+	if os.Getenv("FIDO2_EXAMPLES") != "1" {
+		return
+	}
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(locs) == 0 {
+		log.Println("No devices")
+		return
+	}
+
+	log.Printf("Using device: %+v\n", locs[0])
+	path := locs[0].Path
+	device, err := libfido2.NewDevice(path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	cdh := libfido2.RandBytes(32)
+	userID := libfido2.RandBytes(32)
+	salt := libfido2.RandBytes(32)
+	pin := "12345"
+
+	attest, err := device.MakeCredential(
+		cdh,
+		libfido2.RelyingParty{
+			ID: "keys.pub",
+		},
+		libfido2.User{
+			ID:   userID,
+			Name: "gabriel",
+		},
+		libfido2.ES256, // Algorithm
+		pin,
+		&libfido2.MakeCredentialOpts{
+			Extensions: []libfido2.Extension{libfido2.HMACSecretExtension},
+			RK:         libfido2.True,
+		},
+	)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	log.Printf("Attestation:\n")
+	log.Printf("AuthData: %s\n", hex.EncodeToString(attest.AuthData))
+	log.Printf("ClientDataHash: %s\n", hex.EncodeToString(attest.ClientDataHash))
+	log.Printf("ID: %s\n", hex.EncodeToString(attest.CredentialID))
+	log.Printf("Type: %s\n", attest.CredentialType)
+	log.Printf("Sig: %s\n", hex.EncodeToString(attest.Sig))
+
+	assertion, err := device.Assertion(
+		"keys.pub",
+		cdh,
+		[][]byte{attest.CredentialID},
+		pin,
+		&libfido2.AssertionOpts{
+			Extensions: []libfido2.Extension{libfido2.HMACSecretExtension},
+			UP:         libfido2.True,
+			HMACSalt:   salt,
+		},
+	)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	log.Printf("Assertion:\n")
+	log.Printf("AuthDataCBOR: %s\n", hex.EncodeToString(assertion.AuthDataCBOR))
+	log.Printf("HMACSecret: %s\n", hex.EncodeToString(assertion.HMACSecret))
+	log.Printf("Sig: %s\n", hex.EncodeToString(assertion.Sig))
+	log.Printf("CredentialID: %s\n", hex.EncodeToString(assertion.CredentialID))
+	log.Printf("User.ID: %s\n", hex.EncodeToString(assertion.User.ID))
+
+	// Output:
+	//
+}
+
+func ExampleDevice_Credentials() {
+	if os.Getenv("FIDO2_EXAMPLES") != "1" {
+		return
+	}
+	libfido2.SetLogger(libfido2.NewLogger(libfido2.DebugLevel))
+
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(locs) == 0 {
+		log.Println("No devices")
+		return
+	}
+
+	log.Printf("Using device: %+v\n", locs[0])
+	path := locs[0].Path
+	device, err := libfido2.NewDevice(path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	pin := "12345"
+
+	info, err := device.CredentialsInfo(pin)
+	if err != nil {
+		log.Fatal(err)
+	}
+	log.Printf("Info: %+v\n", info)
+
+	rps, err := device.RelyingParties(pin)
+	if err != nil {
+		log.Fatal(err)
+	}
+	for _, rp := range rps {
+		log.Printf("RP{ID: %s, Name: %s}\n", rp.ID, rp.Name)
+		creds, err := device.Credentials(rp.ID, pin)
+		if err != nil {
+			log.Fatal(err)
+		}
+		for _, cred := range creds {
+			log.Printf("User{ID: %s, Name: %s}\n", hex.EncodeToString(cred.User.ID), cred.User.Name)
+			log.Printf("ID: %s\n", hex.EncodeToString(cred.ID))
+			log.Printf("Type: %s\n", cred.Type)
+			log.Printf("\n")
+		}
+	}
+
+	// Output:
+	//
+}
+
+func ExampleDevice_Reset() {
+	if os.Getenv("FIDO2_EXAMPLES") != "1" {
+		return
+	}
+	libfido2.SetLogger(libfido2.NewLogger(libfido2.DebugLevel))
+
+	if os.Getenv("FIDO2_EXAMPLES_RESET") != "1" {
+		log.Println("only runs if FIDO2_EXAMPLES_RESET=1")
+		return
+	}
+
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(locs) == 0 {
+		log.Println("No devices")
+		return
+	}
+
+	log.Printf("Using device: %+v\n", locs[0])
+	path := locs[0].Path
+	device, err := libfido2.NewDevice(path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	log.Printf("Resetting: %+v\n", locs[0])
+	if err := device.Reset(); err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	//
+
+}
+
+func ExampleDevice_SetPIN() {
+	if os.Getenv("FIDO2_EXAMPLES_SET_PIN") != "1" {
+		return
+	}
+	libfido2.SetLogger(libfido2.NewLogger(libfido2.DebugLevel))
+
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(locs) == 0 {
+		log.Println("No devices")
+		return
+	}
+
+	log.Printf("Using device: %+v\n", locs[0])
+	path := locs[0].Path
+	device, err := libfido2.NewDevice(path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	pin := "12345"
+	if err := device.SetPIN(pin, ""); err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	//
+}
+
+func ExampleDevice_MakeCredential_hmacSecret() {
+	if os.Getenv("FIDO2_EXAMPLES") != "1" {
+		return
+	}
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(locs) == 0 {
+		log.Fatal("No devices")
+		return
+	}
+
+	log.Printf("Using device: %+v\n", locs[0])
+	path := locs[0].Path
+	device, err := libfido2.NewDevice(path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	cdh := bytes.Repeat([]byte{0x01}, 32)
+	rpID := "keys.pub"
+	pin := "12345"
+
+	attest, err := device.MakeCredential(
+		cdh,
+		libfido2.RelyingParty{
+			ID:   rpID,
+			Name: "hmac-secret",
+		},
+		libfido2.User{
+			ID:   libfido2.RandBytes(16),
+			Name: "hmac-secret",
+		},
+		libfido2.ES256, // Algorithm
+		pin,
+		&libfido2.MakeCredentialOpts{
+			Extensions: []libfido2.Extension{libfido2.HMACSecretExtension},
+			RK:         libfido2.True,
+			// UV:          libfido2.True,
+			// CredProtect: libfido2.CredProtectUVRequired,
+		},
+	)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	log.Printf("Credential ID: %s\n", hex.EncodeToString(attest.CredentialID))
+}
+
+type testVector struct {
+	CredentialID string
+	Secret       string
+}
+
+func ExampleDevice_Assertion_hmacSecret() {
+	if os.Getenv("FIDO2_EXAMPLES") != "1" {
+		return
+	}
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(locs) == 0 {
+		log.Fatalf("No devices")
+		return
+	}
+	log.Printf("Using device: %+v\n", locs[0])
+	path := locs[0].Path
+	device, err := libfido2.NewDevice(path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	name := locs[0].Product + "/" + locs[0].Manufacturer
+
+	cdh := bytes.Repeat([]byte{0x01}, 32)
+	rpID := "keys.pub"
+	pin := "12345"
+
+	testVectors := map[string]testVector{
+		"SoloKey 4.0/SoloKeys": testVector{
+			CredentialID: "91874f4c3d580370bf5b5301130ecc034f5927d955f5399ebad267f5666c78598942d489f10d4f4780fad392eb2962d065bdd3574375e80c42218dadd199ed3ffe7deb010000",
+			Secret:       "dd67d3aa73b13b7bb71ad0fe13cf8a247632a3508d7c9906ef6dc823906c3103",
+		},
+		"Security Key by Yubico/Yubico": testVector{
+			CredentialID: "c4fe75012ed137a0afcaa59ab36f0722b9b05849b2203fc4ba4f304033015eaafdbee823ee42dce88b4ae4d943926de3cc93e797004d108ed2465c675ae568e6",
+			Secret:       "f3d37d52ca7a12cf05c34bd3c13ddc3288b723018697347e6ac5ea79b7d3cc83",
+		},
+	}
+
+	testVector, ok := testVectors[name]
+	if !ok {
+		log.Fatalf("No test vector found for %s", name)
+	}
+
+	credentialID, err := hex.DecodeString(testVector.CredentialID)
+	if err != nil {
+		log.Fatal(err)
+	}
+	salt := bytes.Repeat([]byte{0x02}, 32)
+
+	assertion, err := device.Assertion(
+		rpID,
+		cdh,
+		[][]byte{credentialID},
+		pin,
+		&libfido2.AssertionOpts{
+			Extensions: []libfido2.Extension{libfido2.HMACSecretExtension},
+			// UP:         libfido2.True, // Required for some devices
+			// UV:         libfido2.True, // Required for some devices
+			HMACSalt: salt,
+		},
+	)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	if testVector.Secret != hex.EncodeToString(assertion.HMACSecret) {
+		log.Fatalf("Expected %s", testVector.Secret)
+	}
+}
+
+func ExampleDevice_DeleteCredential() {
+	if os.Getenv("FIDO2_EXAMPLES") != "1" {
+		return
+	}
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(locs) == 0 {
+		log.Fatal("No devices")
+		return
+	}
+
+	log.Printf("Using device: %+v\n", locs[0])
+	path := locs[0].Path
+	device, err := libfido2.NewDevice(path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	pin := "12345"
+
+	info, err := device.CredentialsInfo(pin)
+	if err != nil {
+		log.Fatal(err)
+	}
+	log.Printf("Info: %+v\n", info)
+
+	rps, err := device.RelyingParties(pin)
+	if err != nil {
+		log.Fatal(err)
+	}
+	for _, rp := range rps {
+		creds, err := device.Credentials(rp.ID, pin)
+		if err != nil {
+			log.Fatal(err)
+		}
+		for _, cred := range creds {
+			log.Printf("Deleting: %s\n", hex.EncodeToString(cred.ID))
+			if err := device.DeleteCredential(cred.ID, pin); err != nil {
+				log.Fatal(err)
+			}
+		}
+	}
+
+	// Output:
+	//
+}
+
+func ExampleDevice_BioEnrollment() {
+	if os.Getenv("FIDO2_EXAMPLES") != "1" {
+		return
+	}
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(locs) == 0 {
+		log.Fatal("No devices")
+		return
+	}
+
+	log.Printf("Using device: %+v\n", locs[0])
+	path := locs[0].Path
+	device, err := libfido2.NewDevice(path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	pin := "12345"
+
+	err = device.BioEnroll(pin)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Output:
+	//
+}
+
+func ExampleDevice_BioList() {
+	if os.Getenv("FIDO2_EXAMPLES") != "1" {
+		return
+	}
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(locs) == 0 {
+		log.Fatal("No devices")
+		return
+	}
+
+	log.Printf("Using device: %+v\n", locs[0])
+	path := locs[0].Path
+	device, err := libfido2.NewDevice(path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	pin := "12345"
+
+	templates, err := device.BioList(pin)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	log.Println(templates)
+
+	// Output:
+	//
+}
+
+func ExampleDevice_BioDelete() {
+	if os.Getenv("FIDO2_EXAMPLES") != "1" {
+		return
+	}
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(locs) == 0 {
+		log.Fatal("No devices")
+		return
+	}
+
+	log.Printf("Using device: %+v\n", locs[0])
+	path := locs[0].Path
+	device, err := libfido2.NewDevice(path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	pin := "12345"
+
+	templates, err := device.BioList(pin)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	for _, template := range templates {
+		err := device.BioDelete(pin, template.ID)
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+
+	// Output:
+	//
+}
+
+func ExampleDevice_BioSetTemplateName() {
+	if os.Getenv("FIDO2_EXAMPLES") != "1" {
+		return
+	}
+	locs, err := libfido2.DeviceLocations()
+	if err != nil {
+		log.Fatal(err)
+	}
+	if len(locs) == 0 {
+		log.Fatal("No devices")
+		return
+	}
+
+	log.Printf("Using device: %+v\n", locs[0])
+	path := locs[0].Path
+	device, err := libfido2.NewDevice(path)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	pin := "12345"
+
+	templates, err := device.BioList(pin)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	if len(templates) == 0 {
+		log.Fatal("no bio template")
+		return
+	}
+
+	template := templates[0]
+	newName := "newName"
+
+	device.BioSetTemplateName(pin, template.ID, newName)
+
+	// Output:
+	//
+}