===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/ssh-ecdsa-sk.c,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -r1.6 -r1.7
--- src/usr.bin/ssh/ssh-ecdsa-sk.c	2020/06/22 05:56:23	1.6
+++ src/usr.bin/ssh/ssh-ecdsa-sk.c	2020/06/22 05:58:35	1.7
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-ecdsa-sk.c,v 1.6 2020/06/22 05:56:23 djm Exp $ */
+/* $OpenBSD: ssh-ecdsa-sk.c,v 1.7 2020/06/22 05:58:35 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
@@ -43,6 +43,75 @@
 #define SSHKEY_INTERNAL
 #include "sshkey.h"
 
+/*
+ * Check FIDO/W3C webauthn signatures clientData field against the expected
+ * format and prepare a hash of it for use in signature verification.
+ *
+ * webauthn signatures do not sign the hash of the message directly, but
+ * instead sign a JSON-like "clientData" wrapper structure that contains the
+ * message hash along with a other information.
+ *
+ * Fortunately this structure has a fixed format so it is possible to verify
+ * that the hash of the signed message is present within the clientData
+ * structure without needing to implement any JSON parsing.
+ */
+static int
+webauthn_check_prepare_hash(const u_char *data, size_t datalen,
+    const char *origin, const struct sshbuf *wrapper,
+    uint8_t flags, const struct sshbuf *extensions,
+    u_char *msghash, size_t msghashlen)
+{
+	int r = SSH_ERR_INTERNAL_ERROR;
+	struct sshbuf *chall = NULL, *m = NULL;
+
+	if ((m = sshbuf_new()) == NULL ||
+	    (chall = sshbuf_from(data, datalen)) == NULL) {
+		r = SSH_ERR_ALLOC_FAIL;
+		goto out;
+	}
+	/*
+	 * Ensure origin contains no quote character and that the flags are
+	 * consistent with what we received
+	 */
+	if (strchr(origin, '\"') != NULL ||
+	    (flags & 0x40) != 0 /* AD */ ||
+	    ((flags & 0x80) == 0 /* ED */) != (sshbuf_len(extensions) == 0)) {
+		r = SSH_ERR_INVALID_FORMAT;
+		goto out;
+	}
+#define WEBAUTHN_0	"{\"type\":\"webauthn.get\",\"challenge\":\""
+#define WEBAUTHN_1	"\",\"origin\":\""
+#define WEBAUTHN_2	"\""
+	if ((r = sshbuf_put(m, WEBAUTHN_0, sizeof(WEBAUTHN_0) - 1)) != 0 ||
+	    (r = sshbuf_dtourlb64(chall, m, 0)) != 0 ||
+	    (r = sshbuf_put(m, WEBAUTHN_1, sizeof(WEBAUTHN_1) - 1)) != 0 ||
+	    (r = sshbuf_put(m, origin, strlen(origin))) != 0 ||
+	    (r = sshbuf_put(m, WEBAUTHN_2, sizeof(WEBAUTHN_2) - 1)) != 0)
+		goto out;
+#ifdef DEBUG_SK
+	fprintf(stderr, "%s: received origin: %s\n", __func__, origin);
+	fprintf(stderr, "%s: received clientData:\n", __func__);
+	sshbuf_dump(wrapper, stderr);
+	fprintf(stderr, "%s: expected clientData premable:\n", __func__);
+	sshbuf_dump(m, stderr);
+#endif
+	/* Check that the supplied clientData matches what we expect */
+	if ((r = sshbuf_cmp(wrapper, 0, sshbuf_ptr(m), sshbuf_len(m))) != 0)
+		goto out;
+
+	/* Prepare hash of clientData */
+	if ((r = ssh_digest_buffer(SSH_DIGEST_SHA256, wrapper,
+	    msghash, msghashlen)) != 0)
+		goto out;
+
+	/* success */
+	r = 0;
+ out:
+	sshbuf_free(chall);
+	sshbuf_free(m);
+	return r;
+}
+
 /* ARGSUSED */
 int
 ssh_ecdsa_sk_verify(const struct sshkey *key,
@@ -55,9 +124,10 @@
 	u_char sig_flags;
 	u_char msghash[32], apphash[32], sighash[32];
 	u_int sig_counter;
-	int ret = SSH_ERR_INTERNAL_ERROR;
+	int is_webauthn = 0, ret = SSH_ERR_INTERNAL_ERROR;
 	struct sshbuf *b = NULL, *sigbuf = NULL, *original_signed = NULL;
-	char *ktype = NULL;
+	struct sshbuf *webauthn_wrapper = NULL, *webauthn_exts = NULL;
+	char *ktype = NULL, *webauthn_origin = NULL;
 	struct sshkey_sig_details *details = NULL;
 #ifdef DEBUG_SK
 	char *tmp = NULL;
@@ -84,7 +154,9 @@
 		ret = SSH_ERR_INVALID_FORMAT;
 		goto out;
 	}
-	if (strcmp(ktype, "sk-ecdsa-sha2-nistp256@openssh.com") != 0) {
+	if (strcmp(ktype, "webauthn-sk-ecdsa-sha2-nistp256@openssh.com") == 0)
+		is_webauthn = 1;
+	else if (strcmp(ktype, "sk-ecdsa-sha2-nistp256@openssh.com") != 0) {
 		ret = SSH_ERR_INVALID_FORMAT;
 		goto out;
 	}
@@ -94,6 +166,14 @@
 		ret = SSH_ERR_INVALID_FORMAT;
 		goto out;
 	}
+	if (is_webauthn) {
+		if (sshbuf_get_cstring(b, &webauthn_origin, NULL) != 0 ||
+		    sshbuf_froms(b, &webauthn_wrapper) != 0 ||
+		    sshbuf_froms(b, &webauthn_exts) != 0) {
+			ret = SSH_ERR_INVALID_FORMAT;
+			goto out;
+		}
+	}
 	if (sshbuf_len(b) != 0) {
 		ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
 		goto out;
@@ -109,6 +189,7 @@
 		ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
 		goto out;
 	}
+
 #ifdef DEBUG_SK
 	fprintf(stderr, "%s: data: (len %zu)\n", __func__, datalen);
 	/* sshbuf_dump_data(data, datalen, stderr); */
@@ -118,6 +199,12 @@
 	free(tmp);
 	fprintf(stderr, "%s: sig_flags = 0x%02x, sig_counter = %u\n",
 	    __func__, sig_flags, sig_counter);
+	if (is_webauthn) {
+		fprintf(stderr, "%s: webauthn origin: %s\n", __func__,
+		    webauthn_origin);
+		fprintf(stderr, "%s: webauthn_wrapper:\n", __func__);
+		sshbuf_dump(webauthn_wrapper, stderr);
+	}
 #endif
 	if ((sig = ECDSA_SIG_new()) == NULL) {
 		ret = SSH_ERR_ALLOC_FAIL;
@@ -134,7 +221,12 @@
 		ret = SSH_ERR_ALLOC_FAIL;
 		goto out;
 	}
-	if ((ret = ssh_digest_memory(SSH_DIGEST_SHA256, data, datalen,
+	if (is_webauthn) {
+		if ((ret = webauthn_check_prepare_hash(data, datalen,
+		    webauthn_origin, webauthn_wrapper, sig_flags, webauthn_exts,
+		    msghash, sizeof(msghash))) != 0)
+			goto out;
+	} else if ((ret = ssh_digest_memory(SSH_DIGEST_SHA256, data, datalen,
 	    msghash, sizeof(msghash))) != 0)
 		goto out;
 	/* Application value is hashed before signature */
@@ -151,6 +243,7 @@
 	    apphash, sizeof(apphash))) != 0 ||
 	    (ret = sshbuf_put_u8(original_signed, sig_flags)) != 0 ||
 	    (ret = sshbuf_put_u32(original_signed, sig_counter)) != 0 ||
+	    (ret = sshbuf_putb(original_signed, webauthn_exts)) != 0 ||
 	    (ret = sshbuf_put(original_signed, msghash, sizeof(msghash))) != 0)
 		goto out;
 	/* Signature is over H(original_signed) */
@@ -190,6 +283,9 @@
 	explicit_bzero(sighash, sizeof(msghash));
 	explicit_bzero(apphash, sizeof(apphash));
 	sshkey_sig_details_free(details);
+	sshbuf_free(webauthn_wrapper);
+	sshbuf_free(webauthn_exts);
+	free(webauthn_origin);
 	sshbuf_free(original_signed);
 	sshbuf_free(sigbuf);
 	sshbuf_free(b);