fido_dev_cancel for U2F failed with FIDO_ERR_INVALID_ARGUMENT

[kmenshikh]

https://github.com/Yubico/libfido2/blob/main/src/dev.c

Ln 354: if (fido_dev_is_fido2(dev) == false)
return (FIDO_ERR_INVALID_ARGUMENT);

How can i cancel operation for U2F devices?

I guess it is possible, since old u2f-host lib has this ability (u2fh_abort) and it works.

[LDVG]

Hi,

U2FHID has no equivalent command to CTAPHID_CANCEL. Instead, you would just stop sending U2FHID messages. I'm unfortunately not familiar with a u2fh_abort() function. What is your use-case?

[kmenshikh]

I was wrong with u2fh_abort().
This function is absent in the original libu2f-host source code.
It seems i have some "patched" version.

But main idea is:
User initiate auth process (fido_dev_get_assert).
User changed his mind (doesn't matter why) and want to stop auth process (without waiting timeout).

Instead, you would just stop sending U2FHID messages.
May be fido_dev_cancel() will set some "canceled" flag and this flag will be checked inside tx/rx code?

[LDVG]

User changed his mind (doesn't matter why) and want to stop auth process (without waiting timeout).

Unfortunately, libfido2 provides no such API.

However, you can achieve this on POSIX-compatible systems by sending a signal (e.g. SIGUSR1) to the worker thread and using signal masks to make sure it is only delivered during device I/O, see fido_dev_set_sigmask().

[kmenshikh]

Unfortunately, libfido2 provides no such API.

But it can provide ;-)
My idea to add small changes.

(1) src\fido\types.h
typedef struct fido_dev {

bool                  cancelled; // <<< ADD THIS

} fido_dev_t;

(2) src\dev.c
int
fido_dev_cancel(fido_dev_t *dev)

// THIS CODE ....
if (fido_dev_is_fido2(dev) == false)
    return (FIDO_ERR_INVALID_ARGUMENT);

// ... REPLACE WITH THIS
if (fido_dev_is_fido2(dev) == false) {
    dev->cancelled = true;
    return (FIDO_OK);
}

(3) src\u2f.c
static int
do_auth(...)

do {
    // ..........

    // ADD THIS BLOCK
    if (dev->cancelled == true) {
        r = FIDO_ERR_TX; // or some other code
        goto fail;
    }
} while (((reply[0] << 8) | reply[1]) == SW_CONDITIONS_NOT_SATISFIED);

THE SAME IN
int
u2f_register()

(4) On fido_dev_get_assert/fido_dev_make_cred reset dev->cancelled

[LDVG]

While libfido2 is generally threading-friendly, this is under the assumption that access to an object is serialized by the threads themselves. Passing the same fido_dev_t * to fido_dev_cancel() in one thread and e.g. fido_dev_make_cred() in another without protecting these calls by grabbing a write lock violates this assumption, and the race conditions therein make for unpredictable results.

As you can see from our examples: in libfido2, fido_dev_cancel() is typically called after a function that talks to an authenticator returns with an error code, to cancel any potentially outstanding request that the authenticator could still be processing.

[katbai]

Hi LDVG,
I have the same requirement to cancel make_cred for U2F devices in mac client. But seems fido_dev_set_sigmask is not implemented in Macos. Is there any alternative method? Thanks.

[LDVG]

Hi @katbai; there's currently no other libfido2 API to do that, no.