* Bump go-libfido2 to 399e6dce025f0fae1e47088e4912e113512240cb
bump
* Add the IsFIDO2 and Close functions to FIDODevice
* Rewrite FIDO2 device interactions as single-threaded
* test: Wait for device goroutines on tests
* test: Drop "metered" tests
* test: Adjust tests according to behavioral changes
* nit: Invert u2f flag to fido2
* Reintroduce Info retries
* nit: Update old comments
* Delete unused code
* test: Fix minor lint issues
* Set the libfido2 device timeout
* Appease linter
* Revert "test: Wait for device goroutines on tests"
This reverts commit 2f871273b5c508627f177a37f74660ab1cea1618.
* nit: Function declaration indent
* Document that openedDevices.devices doesn't change length after assigned
* Log the retry interval
* Bump go-libfido2 to v1.5.3-teleport.1
* Use SessionData with extensions in Webauthn flow.
* Pass MFAChallengeExtensions through webauthn flow.
* Opportunistically enforce Webauthn challenge scope.
* Don't delete webauthn session data when reuse is allowed.
* Return more login data from webauthn flow.
* Enforce reuse when provided by the caller.
* Address comments.
* Fix test.
* Add unit test for scope and reuse.
* use pointer for challenge extension parameters.
* Address comments.
* fix: Use random scopes on TestIdentityService_UpsertGlobalWebauthnSessionData_maxLimit
* Replace webauthn SessionData proto definition with an internal definition.
* Remove unused SessionData proto message.
* Address comments; Fix test.
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* restrictedsession/fuzz_test.go: Add basic IP and CIDR seeds
* proxyline_test.go: Add fuzzing for Proxy Line v1
Adds a fuzzing test case and seeds for proxy line v1.
This commit also enables both fuzzing tests in oss-fuzz.
* client/fuzz_test.go: Add fuzz coverage and seeds
This adds some fuzzing coverage to some previously missing functions.
In addition seeds (primarily from unit test cases) were added to all fuzz test cases, and all cases were enabled in oss-fuzz.
* Add fuzzing for lib/auth/webauthncli.parseU2FRegistrationResponse
This adds fuzzing coverage and seeds for the function `parseU2FRegistrationResponse`. This commit also enables this test in oss-fuzz.
* Alias `api/types/webauthn` imports to `wanpb`
* Use `webauthnpb` as the default package name
* Move messages.go to webauthntypes/
* Move extensions.go to webauthntypes/
* Move proto.go to webauthntypes/
* nit: Use consistent license style
* Use the `wantypes` alias for webauthntypes
* Use the `wanwin` alias for webauthnwin
* nit: Move winwebauthn.go to webauthnwin.go
* Document package webauthntypes
* Alias types required by e/
* Appease linter
* Add all main types/method to compat.go
* Reinstate spaces on proxy_test.go
* Alias newly-added usages
* Represent the entirety of protocol within lib/auth/webauthn
* Bump github.com/go-webauthn/webauthn to v0.6.2
* Fixes for v0.6.x: Challenge, RPOrigins
* Bump github.com/go-webauthn/webauthn to v0.7.2
* Document new v0.7.2 fields
* Bump github.com/go-webauthn/webauthn to v0.8.2
* Fixes for v0.8.x: UserEntity.ID
* Bump github.com/go-webauthn/webauthn to v0.8.6
* Let bots update go-webauthn
* Drop support for RP and User icon
* Update generated protos
* Add a brief godoc to cloned types
* Add the credential_rp_id field to WebauthnDevice
* Update generated protos
* Record credential RPID on registration and login
* React to unexpected RPIDs when issuing challenges
* Log number of allowed credentials
* Fix TestServer_CreateAuthenticateChallenge_authPreference
* Use slices.Delete
* Try to appease the flaky test detector
This commit adds a user message ("Detected security key tap") that is
printed at the earliest opportunity after `tsh` succesfully detects a
security key tap.
This solves a problem users have when there is significant latency in
their connection to their teleport proxy, where there may be zero
visible feedback to the user for upwards of 8 seconds after they tap
their security key.
This often causes users to think that the tap was not detected or
failed, and they attempt to tap again.
This can cause the user to accidentally paste a "yubisneeze" into their
terminal, which is not great from a security perspective.
As an API choice here I added a `TouchAcknowledger` returned by they
`PromptTouch` of the `LoginPrompt` interface.
It may seem like a bit of a weird API, but I did it this way so that all
callers of `PromptTouch` are forced to explicitly acknowledge the touch
or explicitly ignore that return value, they cannot simply forget to ack.
This applies to WebAuthn and Passwordless logins from `tsh`, no changes
are made to Connect.
Improves FIDO2 login/registration UX by letting users choose (almost) any
available key and then presenting a user-friendly error if the operation cannot
be done.
New devices are now polled for continuously, as we can't eagerly filter devices
anymore. All FIDO2 devices, regardless of their capabilities, are made to wait
for user interaction: once the user interacts with the device we either complete
the operation successfully or return a reason for failure.
U2F-only devices are still silently ignored, as before. They don't respond well
to FIDO2 APIs and proved to be unwieldy in practical tests. (Maybe we can tackle
those in a follow up.)
Examples of new UX:
```shell
# Attempting passwordless login on a non-capable device (lack of PIN)
$ tsh login --proxy=zarquon --user=ihaveitall --auth=passwordless
> Tap your security key
> ERROR: device not registered for passwordless
# Attempting passwordless registration on a non-capable device (lack of PIN)
$ tsh mfa add --type=WEBAUTHN --name=test --allow-passwordless
> Tap any *registered* security key
> Tap your *new* security key
> ERROR: device lacks PIN or user verification capabilities
```
Closes#15037.
U2F devices, like the Yubikey4, fail in a slightly unexpected way when
assertions set UP=false. Handle this edge case and also make sure that failures
when checking for excluded credentials won't break the entire ceremony.
Similar to #15975, but in the registration flow this time.
Repro steps:
1. Register a Yubikey 4
2. Attempt to register a different security key
3. Registration fails with a "user presence required" error
U2F devices, like Yubikey 4, don't seem to respect cancels, locking the program
if a different security key is chosen.
There isn't a clean way to cancel when Cancel() doesn't work, so I've added a
timeout to let the program complete. It's OK for the timeout to be short, it's
not tied to user interaction and by the time we get to it all cancels were
already issued.
Fixes an issue where libfido2 code wrongly interprets
`libfido2.ErrUserPresenceRequired` as `libfido2.ErrNoCredentials`.
Added some logging for good measure.
#14657
* Simulate Yubikey4 UP=false behavior
* Avoid wrongly filtering Yubikey4 devices
Improve the error message for libfido2 error 60 (UV blocked) and automatically
retry error 63 (UV invalid).
libfido2 error 63 happens with some frequency with Yubikey Bio. The biometric
sensor is a bit finicky, so if the finger is a bit off it tends to happen.
Fixes#13900.
* Simulate libfido2 errors 60 and 63
* Add better handling for common libfido2 errors
The `--allow-passwordless` flag was ignored when set, which makes tsh do
non-passwordless registrations. This causes all sorts of confusing behavior.
I'm taking the chance to also add some additional logging to webauthncli.
* Correctly use the value of --allow-passwordless
* Add additional logging to wancli
The FIDO1/2 device detection loop makes an incorrect [assumption about the
Info()][1] method, which breaks the loop for FIDO devices. That was in turn
compounded by a swallowed error, causing a rather confusing behavior.
We now correctly handle FIDO devices by assuming they have no FIDO2-like
capabilities and treat our errors more gracefully (or less silently).
Fixes#14657.
[1]: https://github.com/gravitational/go-libfido2/blob/45a8c53e4500d24b209a94b86dbc6cefeafaa649/fido2.go#L339
* Add a registration/login test for U2F devices
* Fix the device detection loop for U2F devices
Implement the Touch ID credential picker.
During passwordless authentication, when more than one login is present in
Enclave credentials, `tsh` now asks the end user to pick their desired login.
Credential picker terminal prompts are preceded by a system Touch ID prompt,
which is then reused for authentication, provided less than 10 seconds pass in
the meantime.
I've done a couple of refactors to make the `CredentialInfo` structs similar
between the `webauthncli` and `touchid` packages, so it's easier to trace
parallels between them.
#13901
* Refactor touchid.CredentialInfo
* Refactor wancli.CredentialInfo
* Move fido2_prompt*.go to prompt*.go
* Define the touchid credential picker API
* Add Touch ID credential picker tests
* Implement touchid credential picker
* configure golangci-lint misspell to check for anglicized spellings
* Americanize spellings
* fix aws constant value with british spelling 🇬🇧
* update api types with americanized spellings
* use american spellings .cloudbuild/scripts
Address the following FIDO2 issues:
1. Retry assertions without UV if UV=true if the PIN is set
2. Correctly handle single account responses from authenticators
1 happens in the wild and the fix is confirmed. The fix is based in the fact
that the authenticator will set the UV bit in the resulting assertion when the
PIN is present, regardless of us asking for it. We do need the UV bit to clear
server-side validation, that haven't changed.
2 was a misunderstanding on my part; the spec doesn't require authenticators to
return user names for single account responses, which they effectively don't. In
practical terms we are unable to guarantee the `--user` flag for single account
scenarios, but not failing seems better than failing. See the
[authenticatorGetAssertion response][1], user member.
[1]: https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorgetassertion-response-structure
* Add tests for UV failure and single account
* Correctly handle single account responses
* Retry without UV if a PIN is set
Add a credential picker to the tsh FIDO2/WebAuthn backend.
The PR pulls a recent patch in our go-libfido2 fork that makes it correctly
return multiple assertions from the authenticator. This allows us to implement
the credential picker for FIDO2, simplify our implementation and provide the
exact same UX that browsers use (always 1-touch for bio, touch->PIN->touch
otherwise).
I've dropped concepts like "optimistic assertions" and "eager PIN prompts" in
favor of a simple, uniform implementation.
Issue #13901.
* Prompt for credentials in LoginPrompt
* Update go-libfido2
* Implement FIDO2 credential picker
* Drop optimistic assertions, only set user if explicit
* Add license to fido2_prompt_test.go
Favor newer Touch ID credentials in the allowed set for MFA, or just the newer
credential for passwordless.
Fixes a capture-by-reference bug and adds coverage for it.
Issue #13340.
* Add tests for Touch ID credential-choosing logic
* Favor newer Touch ID credentials within the allowed set
* Warn about origin vs RPID mismatch
Avoid "input swallowing" bugs by disabling stdin hijacking by default.
Only `tsh login` is allowed to hijack stdin, as it is expected to exit right
after authentication. Any MFA authentication attempts resulting from
non-`tsh login` invocations default to the user's strongest auth method.
Defaulting to the strongest auth method can cause problems in constrained
environments for users that have both Webauthn and OTP registered. For example,
someone using `tsh` under WSL (Windows Subsystem for Linux) or a remote machine
could be locked into Webauthn MFA, which they can't use because their
environment lacks USB access or they don't have physical access to it. In order
to solve this problem I've slightly modified the meaning of the `--mfa-mode`
flag so `otp` can be specified.
The `TELEPORT_MFA_MODE` environment variable may be set to avoid constant flag
passing.
Fixes#12675 and #13021.
* Expand --mfa-mode and disable stdin hijack by default
* Use TELEPORT_ instead of TSH_ for FIDO2 env var
* Use t.Setenv in tests
U2F facets don't serve a purpose since Webauthn became the de-facto MFA
mechanism. This should make it easier for users to write v10-style
authentication configs.
The remaining U2F fields are still relevant for when we derive Webauthn settings
from U2F, so those are kept (and validated).
Note that we still keep the fileconf field, since we don't want configs to
needlessly break during version upgrades.
#10375
* Remove references to U2F.Facets
* Remove Facets from U2F proto
* Reinstate proto Facets field
U2F gets marshaled as JSON to storage, so we better keep the field to
avoid issue with resource configs.
* Add deprecation notice on comment
* Update generated protos
* Allow register passwordless on invite/reset
* Specify the type of device usage when registering new device
* Minor refactoring to reduce number of parameters to funcs
* Check if device register requested pwdless, response is pwdless capable
Add the --mfa-mode flag and wire touch ID into tsh authn/registration.
In the default MFA mode (auto), touch ID should be eager if there is a
credential present in the system. Users may change this behavior using other MFA
modes.
See https://github.com/gravitational/teleport/blob/master/rfd/0054-passwordless-macos.md.
#9160
* Add AuthenticatorAttachment/MFAMode to tsh
* Add support for touch ID in wancli.Login
* Warn users about passwordless in U2F mode
* Add support for touch ID in `tsh mfa add`
Fixes a rather exoteric race condition where a goroutine beats an
already-cancelled context in a select.
The select in question sits on selectDevice / fido2.go#L729. It is not an error
for the select to go either way, instead this is a failure of test setup. The
fix is simple: we use authenticators that do have resident credentials for the
test, so their Assertion operations block waiting for user interaction,
eliminating the race in the test in question.
Example flaky execution:
https://console.cloud.google.com/cloud-build/builds/ceaa0674-db49-444b-b059-a17e01b0328f?project=ci-account#9160
Document the different implementations, fallbacks, build tags, and provide some
install/use instructions.
#9160
* Document FIDO2 support in ./lib/auth/webauthncli
* Add license
Zac Bergquist