summaryrefslogtreecommitdiffstats
path: root/dom/webauthn
diff options
context:
space:
mode:
Diffstat (limited to 'dom/webauthn')
-rw-r--r--dom/webauthn/AndroidWebAuthnTokenManager.cpp438
-rw-r--r--dom/webauthn/AndroidWebAuthnTokenManager.h143
-rw-r--r--dom/webauthn/AuthenticatorAssertionResponse.cpp122
-rw-r--r--dom/webauthn/AuthenticatorAssertionResponse.h61
-rw-r--r--dom/webauthn/AuthenticatorAttestationResponse.cpp73
-rw-r--r--dom/webauthn/AuthenticatorAttestationResponse.h47
-rw-r--r--dom/webauthn/AuthenticatorResponse.cpp55
-rw-r--r--dom/webauthn/AuthenticatorResponse.h50
-rw-r--r--dom/webauthn/AuthrsTransport.cpp29
-rw-r--r--dom/webauthn/AuthrsTransport.h17
-rw-r--r--dom/webauthn/CtapArgs.cpp256
-rw-r--r--dom/webauthn/CtapArgs.h58
-rw-r--r--dom/webauthn/CtapResults.cpp82
-rw-r--r--dom/webauthn/CtapResults.h65
-rw-r--r--dom/webauthn/PWebAuthnTransaction.ipdl140
-rw-r--r--dom/webauthn/PublicKeyCredential.cpp168
-rw-r--r--dom/webauthn/PublicKeyCredential.h67
-rw-r--r--dom/webauthn/U2FSoftTokenTransport.cpp1031
-rw-r--r--dom/webauthn/U2FSoftTokenTransport.h53
-rw-r--r--dom/webauthn/U2FTokenManager.cpp542
-rw-r--r--dom/webauthn/U2FTokenManager.h117
-rw-r--r--dom/webauthn/U2FTokenTransport.h53
-rw-r--r--dom/webauthn/WebAuthnCBORUtil.cpp128
-rw-r--r--dom/webauthn/WebAuthnCBORUtil.h30
-rw-r--r--dom/webauthn/WebAuthnController.cpp739
-rw-r--r--dom/webauthn/WebAuthnController.h130
-rw-r--r--dom/webauthn/WebAuthnCoseIdentifiers.h22
-rw-r--r--dom/webauthn/WebAuthnEnumStrings.h49
-rw-r--r--dom/webauthn/WebAuthnManager.cpp864
-rw-r--r--dom/webauthn/WebAuthnManager.h146
-rw-r--r--dom/webauthn/WebAuthnManagerBase.cpp151
-rw-r--r--dom/webauthn/WebAuthnManagerBase.h73
-rw-r--r--dom/webauthn/WebAuthnTransactionChild.cpp87
-rw-r--r--dom/webauthn/WebAuthnTransactionChild.h60
-rw-r--r--dom/webauthn/WebAuthnTransactionParent.cpp148
-rw-r--r--dom/webauthn/WebAuthnTransactionParent.h46
-rw-r--r--dom/webauthn/WebAuthnTransportIdentifiers.h15
-rw-r--r--dom/webauthn/WebAuthnUtil.cpp460
-rw-r--r--dom/webauthn/WebAuthnUtil.h65
-rw-r--r--dom/webauthn/WinWebAuthnManager.cpp706
-rw-r--r--dom/webauthn/WinWebAuthnManager.h53
-rw-r--r--dom/webauthn/authrs_bridge/Cargo.toml16
-rw-r--r--dom/webauthn/authrs_bridge/src/lib.rs749
-rw-r--r--dom/webauthn/cbor-cpp/README.md35
-rw-r--r--dom/webauthn/cbor-cpp/src/LICENSE201
-rw-r--r--dom/webauthn/cbor-cpp/src/README-MOZILLA5
-rw-r--r--dom/webauthn/cbor-cpp/src/cbor.h23
-rw-r--r--dom/webauthn/cbor-cpp/src/encoder.cpp154
-rw-r--r--dom/webauthn/cbor-cpp/src/encoder.h70
-rw-r--r--dom/webauthn/cbor-cpp/src/output.h34
-rw-r--r--dom/webauthn/cbor-cpp/src/output_dynamic.cpp69
-rw-r--r--dom/webauthn/cbor-cpp/src/output_dynamic.h51
-rw-r--r--dom/webauthn/libudev-sys/Cargo.toml38
-rw-r--r--dom/webauthn/libudev-sys/src/lib.rs182
-rw-r--r--dom/webauthn/moz.build94
-rw-r--r--dom/webauthn/nsIU2FTokenManager.idl40
-rw-r--r--dom/webauthn/nsIWebAuthnController.idl205
-rw-r--r--dom/webauthn/tests/browser/browser.ini32
-rw-r--r--dom/webauthn/tests/browser/browser_abort_visibility.js276
-rw-r--r--dom/webauthn/tests/browser/browser_fido_appid_extension.js67
-rw-r--r--dom/webauthn/tests/browser/browser_webauthn_ipaddress.js28
-rw-r--r--dom/webauthn/tests/browser/browser_webauthn_prompts.js316
-rw-r--r--dom/webauthn/tests/browser/browser_webauthn_telemetry.js134
-rw-r--r--dom/webauthn/tests/browser/head.js155
-rw-r--r--dom/webauthn/tests/browser/tab_webauthn_result.html14
-rw-r--r--dom/webauthn/tests/cbor.js406
-rw-r--r--dom/webauthn/tests/get_assertion_dead_object.html21
-rw-r--r--dom/webauthn/tests/mochitest.ini88
-rw-r--r--dom/webauthn/tests/pkijs/LICENSE30
-rw-r--r--dom/webauthn/tests/pkijs/README1
-rw-r--r--dom/webauthn/tests/pkijs/asn1.js5466
-rw-r--r--dom/webauthn/tests/pkijs/common.js1542
-rw-r--r--dom/webauthn/tests/pkijs/x509_schema.js1889
-rw-r--r--dom/webauthn/tests/pkijs/x509_simpl.js7239
-rw-r--r--dom/webauthn/tests/test_webauthn_abort_signal.html146
-rw-r--r--dom/webauthn/tests/test_webauthn_attestation_conveyance.html123
-rw-r--r--dom/webauthn/tests/test_webauthn_authenticator_selection.html146
-rw-r--r--dom/webauthn/tests/test_webauthn_authenticator_transports.html150
-rw-r--r--dom/webauthn/tests/test_webauthn_get_assertion.html253
-rw-r--r--dom/webauthn/tests/test_webauthn_get_assertion_dead_object.html29
-rw-r--r--dom/webauthn/tests/test_webauthn_isexternalctap2securitykeysupported.html33
-rw-r--r--dom/webauthn/tests/test_webauthn_isplatformauthenticatoravailable.html40
-rw-r--r--dom/webauthn/tests/test_webauthn_loopback.html213
-rw-r--r--dom/webauthn/tests/test_webauthn_make_credential.html413
-rw-r--r--dom/webauthn/tests/test_webauthn_no_token.html87
-rw-r--r--dom/webauthn/tests/test_webauthn_override_request.html96
-rw-r--r--dom/webauthn/tests/test_webauthn_sameorigin.html316
-rw-r--r--dom/webauthn/tests/test_webauthn_sameoriginwithancestors.html107
-rw-r--r--dom/webauthn/tests/test_webauthn_store_credential.html53
-rw-r--r--dom/webauthn/tests/u2futil.js397
-rw-r--r--dom/webauthn/winwebauthn/.gitignore330
-rw-r--r--dom/webauthn/winwebauthn/LICENSE21
-rw-r--r--dom/webauthn/winwebauthn/README.md26
-rw-r--r--dom/webauthn/winwebauthn/webauthn.h998
94 files changed, 31286 insertions, 0 deletions
diff --git a/dom/webauthn/AndroidWebAuthnTokenManager.cpp b/dom/webauthn/AndroidWebAuthnTokenManager.cpp
new file mode 100644
index 0000000000..bdf21b723b
--- /dev/null
+++ b/dom/webauthn/AndroidWebAuthnTokenManager.cpp
@@ -0,0 +1,438 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/ipc/BackgroundParent.h"
+#include "mozilla/jni/GeckoBundleUtils.h"
+#include "mozilla/StaticPtr.h"
+
+#include "AndroidWebAuthnTokenManager.h"
+#include "JavaBuiltins.h"
+#include "JavaExceptions.h"
+#include "mozilla/java/WebAuthnTokenManagerWrappers.h"
+#include "mozilla/jni/Conversions.h"
+#include "mozilla/StaticPrefs_security.h"
+#include "WebAuthnEnumStrings.h"
+
+namespace mozilla {
+namespace jni {
+
+template <>
+dom::AndroidWebAuthnResult Java2Native(mozilla::jni::Object::Param aData,
+ JNIEnv* aEnv) {
+ // TODO:
+ // AndroidWebAuthnResult stores successful both result and failure result.
+ // We should split it into success and failure (Bug 1754157)
+ if (aData.IsInstanceOf<jni::Throwable>()) {
+ java::sdk::Throwable::LocalRef throwable(aData);
+ return dom::AndroidWebAuthnResult(throwable->GetMessage()->ToString());
+ }
+
+ if (aData
+ .IsInstanceOf<java::WebAuthnTokenManager::MakeCredentialResponse>()) {
+ java::WebAuthnTokenManager::MakeCredentialResponse::LocalRef response(
+ aData);
+ return dom::AndroidWebAuthnResult(response);
+ }
+
+ MOZ_ASSERT(
+ aData.IsInstanceOf<java::WebAuthnTokenManager::GetAssertionResponse>());
+ java::WebAuthnTokenManager::GetAssertionResponse::LocalRef response(aData);
+ return dom::AndroidWebAuthnResult(response);
+}
+} // namespace jni
+
+namespace dom {
+
+static nsIThread* gAndroidPBackgroundThread;
+
+StaticRefPtr<AndroidWebAuthnTokenManager> gAndroidWebAuthnManager;
+
+/* static */ AndroidWebAuthnTokenManager*
+AndroidWebAuthnTokenManager::GetInstance() {
+ if (!gAndroidWebAuthnManager) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ gAndroidWebAuthnManager = new AndroidWebAuthnTokenManager();
+ }
+ return gAndroidWebAuthnManager;
+}
+
+AndroidWebAuthnTokenManager::AndroidWebAuthnTokenManager() {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ MOZ_ASSERT(XRE_IsParentProcess());
+ MOZ_ASSERT(!gAndroidWebAuthnManager);
+
+ gAndroidPBackgroundThread = NS_GetCurrentThread();
+ MOZ_ASSERT(gAndroidPBackgroundThread, "This should never be null!");
+ gAndroidWebAuthnManager = this;
+}
+
+void AndroidWebAuthnTokenManager::AssertIsOnOwningThread() const {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ MOZ_ASSERT(gAndroidPBackgroundThread);
+#ifdef DEBUG
+ bool current;
+ MOZ_ASSERT(
+ NS_SUCCEEDED(gAndroidPBackgroundThread->IsOnCurrentThread(&current)));
+ MOZ_ASSERT(current);
+#endif
+}
+
+void AndroidWebAuthnTokenManager::Drop() {
+ AssertIsOnOwningThread();
+
+ ClearPromises();
+ gAndroidWebAuthnManager = nullptr;
+ gAndroidPBackgroundThread = nullptr;
+}
+
+RefPtr<U2FRegisterPromise> AndroidWebAuthnTokenManager::Register(
+ const WebAuthnMakeCredentialInfo& aInfo, bool aForceNoneAttestation) {
+ AssertIsOnOwningThread();
+
+ ClearPromises();
+
+ GetMainThreadSerialEventTarget()->Dispatch(NS_NewRunnableFunction(
+ "java::WebAuthnTokenManager::WebAuthnMakeCredential",
+ [self = RefPtr{this}, aInfo, aForceNoneAttestation]() {
+ AssertIsOnMainThread();
+
+ // Produce the credential exclusion list
+ jni::ObjectArray::LocalRef idList =
+ jni::ObjectArray::New(aInfo.ExcludeList().Length());
+
+ nsTArray<uint8_t> transportBuf;
+ int ix = 0;
+
+ for (const WebAuthnScopedCredential& cred : aInfo.ExcludeList()) {
+ jni::ByteBuffer::LocalRef id = jni::ByteBuffer::New(
+ const_cast<void*>(static_cast<const void*>(cred.id().Elements())),
+ cred.id().Length());
+
+ idList->SetElement(ix, id);
+ transportBuf.AppendElement(cred.transports());
+
+ ix += 1;
+ }
+
+ jni::ByteBuffer::LocalRef transportList = jni::ByteBuffer::New(
+ const_cast<void*>(
+ static_cast<const void*>(transportBuf.Elements())),
+ transportBuf.Length());
+
+ const nsTArray<uint8_t>& challBuf = aInfo.Challenge();
+ jni::ByteBuffer::LocalRef challenge = jni::ByteBuffer::New(
+ const_cast<void*>(static_cast<const void*>(challBuf.Elements())),
+ challBuf.Length());
+
+ nsTArray<uint8_t> uidBuf;
+
+ // Get authenticator selection criteria
+ GECKOBUNDLE_START(authSelBundle);
+ GECKOBUNDLE_START(extensionsBundle);
+ GECKOBUNDLE_START(credentialBundle);
+
+ const auto& rp = aInfo.Rp();
+ const auto& user = aInfo.User();
+
+ GECKOBUNDLE_PUT(credentialBundle, "isWebAuthn",
+ java::sdk::Integer::ValueOf(1));
+
+ // Get the attestation preference and override if the user asked
+ if (aForceNoneAttestation) {
+ // Add UI support to trigger this, bug 1550164
+ GECKOBUNDLE_PUT(authSelBundle, "attestationPreference",
+ jni::StringParam(u"none"_ns));
+ } else {
+ const nsString& attestation = aInfo.attestationConveyancePreference();
+ GECKOBUNDLE_PUT(authSelBundle, "attestationPreference",
+ jni::StringParam(attestation));
+ }
+
+ const WebAuthnAuthenticatorSelection& sel =
+ aInfo.AuthenticatorSelection();
+ // Unfortunately, GMS's FIDO2 API has no option for Passkey. If using
+ // residentKey, credential will be synced with Passkey via Google
+ // account or credential provider service. So this is experimental.
+ if (StaticPrefs::
+ security_webauthn_webauthn_enable_android_fido2_residentkey()) {
+ GECKOBUNDLE_PUT(authSelBundle, "residentKey",
+ jni::StringParam(sel.residentKey()));
+ }
+
+ if (sel.userVerificationRequirement().EqualsLiteral(
+ MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED)) {
+ GECKOBUNDLE_PUT(authSelBundle, "requireUserVerification",
+ java::sdk::Integer::ValueOf(1));
+ }
+
+ if (sel.authenticatorAttachment().isSome()) {
+ const nsString& authenticatorAttachment =
+ sel.authenticatorAttachment().value();
+ if (authenticatorAttachment.EqualsLiteral(
+ MOZ_WEBAUTHN_AUTHENTICATOR_ATTACHMENT_PLATFORM)) {
+ GECKOBUNDLE_PUT(authSelBundle, "requirePlatformAttachment",
+ java::sdk::Integer::ValueOf(1));
+ } else if (
+ authenticatorAttachment.EqualsLiteral(
+ MOZ_WEBAUTHN_AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM)) {
+ GECKOBUNDLE_PUT(authSelBundle, "requireCrossPlatformAttachment",
+ java::sdk::Integer::ValueOf(1));
+ }
+ }
+
+ // Get extensions
+ for (const WebAuthnExtension& ext : aInfo.Extensions()) {
+ if (ext.type() == WebAuthnExtension::TWebAuthnExtensionAppId) {
+ GECKOBUNDLE_PUT(
+ extensionsBundle, "fidoAppId",
+ jni::StringParam(
+ ext.get_WebAuthnExtensionAppId().appIdentifier()));
+ }
+ }
+
+ uidBuf.Assign(user.Id());
+
+ GECKOBUNDLE_PUT(credentialBundle, "rpName",
+ jni::StringParam(rp.Name()));
+ GECKOBUNDLE_PUT(credentialBundle, "rpIcon",
+ jni::StringParam(rp.Icon()));
+ GECKOBUNDLE_PUT(credentialBundle, "userName",
+ jni::StringParam(user.Name()));
+ GECKOBUNDLE_PUT(credentialBundle, "userIcon",
+ jni::StringParam(user.Icon()));
+ GECKOBUNDLE_PUT(credentialBundle, "userDisplayName",
+ jni::StringParam(user.DisplayName()));
+
+ GECKOBUNDLE_PUT(credentialBundle, "rpId",
+ jni::StringParam(aInfo.RpId()));
+ GECKOBUNDLE_PUT(credentialBundle, "origin",
+ jni::StringParam(aInfo.Origin()));
+ GECKOBUNDLE_PUT(credentialBundle, "timeoutMS",
+ java::sdk::Double::New(aInfo.TimeoutMS()));
+
+ GECKOBUNDLE_FINISH(authSelBundle);
+ GECKOBUNDLE_FINISH(extensionsBundle);
+ GECKOBUNDLE_FINISH(credentialBundle);
+
+ // For non-WebAuthn cases, uidBuf is empty (and unused)
+ jni::ByteBuffer::LocalRef uid = jni::ByteBuffer::New(
+ const_cast<void*>(static_cast<const void*>(uidBuf.Elements())),
+ uidBuf.Length());
+
+ auto result = java::WebAuthnTokenManager::WebAuthnMakeCredential(
+ credentialBundle, uid, challenge, idList, transportList,
+ authSelBundle, extensionsBundle);
+ auto geckoResult = java::GeckoResult::LocalRef(std::move(result));
+ // This is likely running on the main thread, so we'll always dispatch
+ // to the background for state updates.
+ MozPromise<AndroidWebAuthnResult, AndroidWebAuthnResult,
+ true>::FromGeckoResult(geckoResult)
+ ->Then(
+ GetMainThreadSerialEventTarget(), __func__,
+ [self = std::move(self)](AndroidWebAuthnResult&& aValue) {
+ self->HandleRegisterResult(std::move(aValue));
+ },
+ [self = std::move(self)](AndroidWebAuthnResult&& aValue) {
+ self->HandleRegisterResult(std::move(aValue));
+ });
+ }));
+
+ return mRegisterPromise.Ensure(__func__);
+}
+
+void AndroidWebAuthnTokenManager::HandleRegisterResult(
+ AndroidWebAuthnResult&& aResult) {
+ if (!gAndroidPBackgroundThread) {
+ // Promise is already rejected when shutting down background thread
+ return;
+ }
+ // This is likely running on the main thread, so we'll always dispatch to the
+ // background for state updates.
+ if (aResult.IsError()) {
+ nsresult aError = aResult.GetError();
+
+ gAndroidPBackgroundThread->Dispatch(NS_NewRunnableFunction(
+ "AndroidWebAuthnTokenManager::RegisterAbort",
+ [self = RefPtr<AndroidWebAuthnTokenManager>(this), aError]() {
+ self->mRegisterPromise.RejectIfExists(aError, __func__);
+ }));
+ } else {
+ gAndroidPBackgroundThread->Dispatch(NS_NewRunnableFunction(
+ "AndroidWebAuthnTokenManager::RegisterComplete",
+ [self = RefPtr<AndroidWebAuthnTokenManager>(this),
+ aResult = std::move(aResult)]() {
+ nsTArray<WebAuthnExtensionResult> extensions;
+ WebAuthnMakeCredentialResult result(aResult.mClientDataJSON,
+ aResult.mAttObj,
+ aResult.mKeyHandle, extensions);
+ self->mRegisterPromise.Resolve(std::move(result), __func__);
+ }));
+ }
+}
+
+RefPtr<U2FSignPromise> AndroidWebAuthnTokenManager::Sign(
+ const WebAuthnGetAssertionInfo& aInfo) {
+ AssertIsOnOwningThread();
+
+ ClearPromises();
+
+ GetMainThreadSerialEventTarget()->Dispatch(NS_NewRunnableFunction(
+ "java::WebAuthnTokenManager::WebAuthnGetAssertion",
+ [self = RefPtr{this}, aInfo]() {
+ AssertIsOnMainThread();
+
+ jni::ObjectArray::LocalRef idList =
+ jni::ObjectArray::New(aInfo.AllowList().Length());
+
+ nsTArray<uint8_t> transportBuf;
+
+ int ix = 0;
+ for (const WebAuthnScopedCredential& cred : aInfo.AllowList()) {
+ jni::ByteBuffer::LocalRef id = jni::ByteBuffer::New(
+ const_cast<void*>(static_cast<const void*>(cred.id().Elements())),
+ cred.id().Length());
+
+ idList->SetElement(ix, id);
+ transportBuf.AppendElement(cred.transports());
+
+ ix += 1;
+ }
+
+ jni::ByteBuffer::LocalRef transportList = jni::ByteBuffer::New(
+ const_cast<void*>(
+ static_cast<const void*>(transportBuf.Elements())),
+ transportBuf.Length());
+
+ const nsTArray<uint8_t>& challBuf = aInfo.Challenge();
+ jni::ByteBuffer::LocalRef challenge = jni::ByteBuffer::New(
+ const_cast<void*>(static_cast<const void*>(challBuf.Elements())),
+ challBuf.Length());
+
+ // Get extensions
+ GECKOBUNDLE_START(assertionBundle);
+ GECKOBUNDLE_START(extensionsBundle);
+
+ GECKOBUNDLE_PUT(assertionBundle, "isWebAuthn",
+ java::sdk::Integer::ValueOf(1));
+
+ // User Verification Requirement is not currently used in the
+ // Android FIDO API. Adding it should look like
+ // AttestationConveyancePreference
+
+ for (const WebAuthnExtension& ext : aInfo.Extensions()) {
+ if (ext.type() == WebAuthnExtension::TWebAuthnExtensionAppId) {
+ GECKOBUNDLE_PUT(
+ extensionsBundle, "fidoAppId",
+ jni::StringParam(
+ ext.get_WebAuthnExtensionAppId().appIdentifier()));
+ }
+ }
+
+ GECKOBUNDLE_PUT(assertionBundle, "rpId",
+ jni::StringParam(aInfo.RpId()));
+ GECKOBUNDLE_PUT(assertionBundle, "origin",
+ jni::StringParam(aInfo.Origin()));
+ GECKOBUNDLE_PUT(assertionBundle, "timeoutMS",
+ java::sdk::Double::New(aInfo.TimeoutMS()));
+
+ GECKOBUNDLE_FINISH(assertionBundle);
+ GECKOBUNDLE_FINISH(extensionsBundle);
+
+ auto result = java::WebAuthnTokenManager::WebAuthnGetAssertion(
+ challenge, idList, transportList, assertionBundle,
+ extensionsBundle);
+ auto geckoResult = java::GeckoResult::LocalRef(std::move(result));
+ MozPromise<AndroidWebAuthnResult, AndroidWebAuthnResult,
+ true>::FromGeckoResult(geckoResult)
+ ->Then(
+ GetMainThreadSerialEventTarget(), __func__,
+ [self = std::move(self)](AndroidWebAuthnResult&& aValue) {
+ self->HandleSignResult(std::move(aValue));
+ },
+ [self = std::move(self)](AndroidWebAuthnResult&& aValue) {
+ self->HandleSignResult(std::move(aValue));
+ });
+ }));
+
+ return mSignPromise.Ensure(__func__);
+}
+
+void AndroidWebAuthnTokenManager::HandleSignResult(
+ AndroidWebAuthnResult&& aResult) {
+ if (!gAndroidPBackgroundThread) {
+ // Promise is already rejected when shutting down background thread
+ return;
+ }
+ // This is likely running on the main thread, so we'll always dispatch to the
+ // background for state updates.
+ if (aResult.IsError()) {
+ nsresult aError = aResult.GetError();
+
+ gAndroidPBackgroundThread->Dispatch(NS_NewRunnableFunction(
+ "AndroidWebAuthnTokenManager::SignAbort",
+ [self = RefPtr<AndroidWebAuthnTokenManager>(this), aError]() {
+ self->mSignPromise.RejectIfExists(aError, __func__);
+ }));
+ } else {
+ gAndroidPBackgroundThread->Dispatch(NS_NewRunnableFunction(
+ "AndroidWebAuthnTokenManager::SignComplete",
+ [self = RefPtr<AndroidWebAuthnTokenManager>(this),
+ aResult = std::move(aResult)]() {
+ nsTArray<WebAuthnExtensionResult> emptyExtensions;
+ WebAuthnGetAssertionResult result(
+ aResult.mClientDataJSON, aResult.mKeyHandle, aResult.mSignature,
+ aResult.mAuthData, emptyExtensions, aResult.mUserHandle);
+ nsTArray<WebAuthnGetAssertionResultWrapper> results = {
+ {result, mozilla::Nothing()}};
+ self->mSignPromise.Resolve(std::move(results), __func__);
+ }));
+ }
+}
+
+void AndroidWebAuthnTokenManager::Cancel() {
+ AssertIsOnOwningThread();
+
+ ClearPromises();
+}
+
+AndroidWebAuthnResult::AndroidWebAuthnResult(
+ const java::WebAuthnTokenManager::MakeCredentialResponse::LocalRef&
+ aResponse) {
+ mClientDataJSON.Assign(
+ reinterpret_cast<const char*>(
+ aResponse->ClientDataJson()->GetElements().Elements()),
+ aResponse->ClientDataJson()->Length());
+ mKeyHandle.Assign(reinterpret_cast<uint8_t*>(
+ aResponse->KeyHandle()->GetElements().Elements()),
+ aResponse->KeyHandle()->Length());
+ mAttObj.Assign(reinterpret_cast<uint8_t*>(
+ aResponse->AttestationObject()->GetElements().Elements()),
+ aResponse->AttestationObject()->Length());
+}
+
+AndroidWebAuthnResult::AndroidWebAuthnResult(
+ const java::WebAuthnTokenManager::GetAssertionResponse::LocalRef&
+ aResponse) {
+ mClientDataJSON.Assign(
+ reinterpret_cast<const char*>(
+ aResponse->ClientDataJson()->GetElements().Elements()),
+ aResponse->ClientDataJson()->Length());
+ mKeyHandle.Assign(reinterpret_cast<uint8_t*>(
+ aResponse->KeyHandle()->GetElements().Elements()),
+ aResponse->KeyHandle()->Length());
+ mAuthData.Assign(reinterpret_cast<uint8_t*>(
+ aResponse->AuthData()->GetElements().Elements()),
+ aResponse->AuthData()->Length());
+ mSignature.Assign(reinterpret_cast<uint8_t*>(
+ aResponse->Signature()->GetElements().Elements()),
+ aResponse->Signature()->Length());
+ mUserHandle.Assign(reinterpret_cast<uint8_t*>(
+ aResponse->UserHandle()->GetElements().Elements()),
+ aResponse->UserHandle()->Length());
+}
+
+} // namespace dom
+} // namespace mozilla
diff --git a/dom/webauthn/AndroidWebAuthnTokenManager.h b/dom/webauthn/AndroidWebAuthnTokenManager.h
new file mode 100644
index 0000000000..10620b1353
--- /dev/null
+++ b/dom/webauthn/AndroidWebAuthnTokenManager.h
@@ -0,0 +1,143 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_AndroidWebAuthnTokenManager_h
+#define mozilla_dom_AndroidWebAuthnTokenManager_h
+
+#include "mozilla/dom/CryptoBuffer.h"
+#include "mozilla/dom/U2FTokenTransport.h"
+#include "mozilla/java/WebAuthnTokenManagerNatives.h"
+
+namespace mozilla {
+namespace dom {
+
+// Collected from
+// https://developers.google.com/android/reference/com/google/android/gms/fido/fido2/api/common/ErrorCode
+constexpr auto kSecurityError = u"SECURITY_ERR"_ns;
+constexpr auto kConstraintError = u"CONSTRAINT_ERR"_ns;
+constexpr auto kNotSupportedError = u"NOT_SUPPORTED_ERR"_ns;
+constexpr auto kInvalidStateError = u"INVALID_STATE_ERR"_ns;
+constexpr auto kNotAllowedError = u"NOT_ALLOWED_ERR"_ns;
+constexpr auto kAbortError = u"ABORT_ERR"_ns;
+constexpr auto kEncodingError = u"ENCODING_ERR"_ns;
+constexpr auto kDataError = u"DATA_ERR"_ns;
+constexpr auto kTimeoutError = u"TIMEOUT_ERR"_ns;
+constexpr auto kNetworkError = u"NETWORK_ERR"_ns;
+constexpr auto kUnknownError = u"UNKNOWN_ERR"_ns;
+
+class AndroidWebAuthnResult {
+ public:
+ explicit AndroidWebAuthnResult(const nsAString& aErrorCode)
+ : mErrorCode(aErrorCode) {}
+
+ explicit AndroidWebAuthnResult(
+ const java::WebAuthnTokenManager::MakeCredentialResponse::LocalRef&
+ aResponse);
+
+ explicit AndroidWebAuthnResult(
+ const java::WebAuthnTokenManager::GetAssertionResponse::LocalRef&
+ aResponse);
+
+ AndroidWebAuthnResult() = delete;
+
+ bool IsError() const { return NS_FAILED(GetError()); }
+
+ nsresult GetError() const {
+ if (mErrorCode.IsEmpty()) {
+ return NS_OK;
+ } else if (mErrorCode.Equals(kSecurityError)) {
+ return NS_ERROR_DOM_SECURITY_ERR;
+ } else if (mErrorCode.Equals(kConstraintError)) {
+ // TODO: The message is right, but it's not about indexeddb.
+ // See https://heycam.github.io/webidl/#constrainterror
+ return NS_ERROR_DOM_INDEXEDDB_CONSTRAINT_ERR;
+ } else if (mErrorCode.Equals(kNotSupportedError)) {
+ return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+ } else if (mErrorCode.Equals(kInvalidStateError)) {
+ return NS_ERROR_DOM_INVALID_STATE_ERR;
+ } else if (mErrorCode.Equals(kNotAllowedError)) {
+ return NS_ERROR_DOM_NOT_ALLOWED_ERR;
+ } else if (mErrorCode.Equals(kEncodingError)) {
+ return NS_ERROR_DOM_ENCODING_NOT_SUPPORTED_ERR;
+ } else if (mErrorCode.Equals(kDataError)) {
+ return NS_ERROR_DOM_DATA_ERR;
+ } else if (mErrorCode.Equals(kTimeoutError)) {
+ return NS_ERROR_DOM_TIMEOUT_ERR;
+ } else if (mErrorCode.Equals(kNetworkError)) {
+ return NS_ERROR_DOM_NETWORK_ERR;
+ } else if (mErrorCode.Equals(kAbortError)) {
+ return NS_ERROR_DOM_ABORT_ERR;
+ } else if (mErrorCode.Equals(kUnknownError)) {
+ return NS_ERROR_DOM_UNKNOWN_ERR;
+ } else {
+ __android_log_print(ANDROID_LOG_ERROR, "Gecko",
+ "RegisterAbort unknown code: %s",
+ NS_ConvertUTF16toUTF8(mErrorCode).get());
+ return NS_ERROR_DOM_UNKNOWN_ERR;
+ }
+ }
+
+ AndroidWebAuthnResult(const AndroidWebAuthnResult&) = delete;
+ AndroidWebAuthnResult(AndroidWebAuthnResult&&) = default;
+
+ // Attestation-only
+ CryptoBuffer mAttObj;
+
+ // Attestations and assertions
+ CryptoBuffer mKeyHandle;
+ nsCString mClientDataJSON;
+
+ // Assertions-only
+ CryptoBuffer mAuthData;
+ CryptoBuffer mSignature;
+ CryptoBuffer mUserHandle;
+
+ private:
+ const nsString mErrorCode;
+};
+
+/*
+ * WebAuthnAndroidTokenManager is a token implementation communicating with
+ * Android Fido2 APIs.
+ */
+class AndroidWebAuthnTokenManager final : public U2FTokenTransport {
+ public:
+ explicit AndroidWebAuthnTokenManager();
+ ~AndroidWebAuthnTokenManager() {}
+
+ virtual RefPtr<U2FRegisterPromise> Register(
+ const WebAuthnMakeCredentialInfo& aInfo,
+ bool aForceNoneAttestation) override;
+
+ virtual RefPtr<U2FSignPromise> Sign(
+ const WebAuthnGetAssertionInfo& aInfo) override;
+
+ void Cancel() override;
+
+ void Drop() override;
+
+ static AndroidWebAuthnTokenManager* GetInstance();
+
+ private:
+ void HandleRegisterResult(AndroidWebAuthnResult&& aResult);
+
+ void HandleSignResult(AndroidWebAuthnResult&& aResult);
+
+ void ClearPromises() {
+ mRegisterPromise.RejectIfExists(NS_ERROR_DOM_UNKNOWN_ERR, __func__);
+ mSignPromise.RejectIfExists(NS_ERROR_DOM_UNKNOWN_ERR, __func__);
+ }
+
+ void AssertIsOnOwningThread() const;
+
+ MozPromiseHolder<U2FRegisterPromise> mRegisterPromise;
+ MozPromiseHolder<U2FSignPromise> mSignPromise;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_AndroidWebAuthnTokenManager_h
diff --git a/dom/webauthn/AuthenticatorAssertionResponse.cpp b/dom/webauthn/AuthenticatorAssertionResponse.cpp
new file mode 100644
index 0000000000..424aa51948
--- /dev/null
+++ b/dom/webauthn/AuthenticatorAssertionResponse.cpp
@@ -0,0 +1,122 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/WebAuthenticationBinding.h"
+#include "mozilla/dom/AuthenticatorAssertionResponse.h"
+#include "mozilla/HoldDropJSObjects.h"
+
+namespace mozilla::dom {
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(AuthenticatorAssertionResponse)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(AuthenticatorAssertionResponse,
+ AuthenticatorResponse)
+ tmp->mAuthenticatorDataCachedObj = nullptr;
+ tmp->mSignatureCachedObj = nullptr;
+ tmp->mUserHandleCachedObj = nullptr;
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN_INHERITED(AuthenticatorAssertionResponse,
+ AuthenticatorResponse)
+ NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
+ NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mAuthenticatorDataCachedObj)
+ NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mSignatureCachedObj)
+ NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mUserHandleCachedObj)
+NS_IMPL_CYCLE_COLLECTION_TRACE_END
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(
+ AuthenticatorAssertionResponse, AuthenticatorResponse)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_ADDREF_INHERITED(AuthenticatorAssertionResponse, AuthenticatorResponse)
+NS_IMPL_RELEASE_INHERITED(AuthenticatorAssertionResponse, AuthenticatorResponse)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(AuthenticatorAssertionResponse)
+NS_INTERFACE_MAP_END_INHERITING(AuthenticatorResponse)
+
+AuthenticatorAssertionResponse::AuthenticatorAssertionResponse(
+ nsPIDOMWindowInner* aParent)
+ : AuthenticatorResponse(aParent),
+ mAuthenticatorDataCachedObj(nullptr),
+ mSignatureCachedObj(nullptr),
+ mUserHandleCachedObj(nullptr) {
+ mozilla::HoldJSObjects(this);
+}
+
+AuthenticatorAssertionResponse::~AuthenticatorAssertionResponse() {
+ mozilla::DropJSObjects(this);
+}
+
+JSObject* AuthenticatorAssertionResponse::WrapObject(
+ JSContext* aCx, JS::Handle<JSObject*> aGivenProto) {
+ return AuthenticatorAssertionResponse_Binding::Wrap(aCx, this, aGivenProto);
+}
+
+void AuthenticatorAssertionResponse::GetAuthenticatorData(
+ JSContext* aCx, JS::MutableHandle<JSObject*> aValue, ErrorResult& aRv) {
+ if (!mAuthenticatorDataCachedObj) {
+ mAuthenticatorDataCachedObj = mAuthenticatorData.ToArrayBuffer(aCx);
+ if (!mAuthenticatorDataCachedObj) {
+ aRv.NoteJSContextException(aCx);
+ return;
+ }
+ }
+ aValue.set(mAuthenticatorDataCachedObj);
+}
+
+nsresult AuthenticatorAssertionResponse::SetAuthenticatorData(
+ CryptoBuffer& aBuffer) {
+ if (NS_WARN_IF(!mAuthenticatorData.Assign(aBuffer))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ return NS_OK;
+}
+
+void AuthenticatorAssertionResponse::GetSignature(
+ JSContext* aCx, JS::MutableHandle<JSObject*> aValue, ErrorResult& aRv) {
+ if (!mSignatureCachedObj) {
+ mSignatureCachedObj = mSignature.ToArrayBuffer(aCx);
+ if (!mSignatureCachedObj) {
+ aRv.NoteJSContextException(aCx);
+ return;
+ }
+ }
+ aValue.set(mSignatureCachedObj);
+}
+
+nsresult AuthenticatorAssertionResponse::SetSignature(CryptoBuffer& aBuffer) {
+ if (NS_WARN_IF(!mSignature.Assign(aBuffer))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ return NS_OK;
+}
+
+void AuthenticatorAssertionResponse::GetUserHandle(
+ JSContext* aCx, JS::MutableHandle<JSObject*> aValue, ErrorResult& aRv) {
+ // Per
+ // https://w3c.github.io/webauthn/#ref-for-dom-authenticatorassertionresponse-userhandle%E2%91%A0
+ // this should return null if the handle is unset.
+ if (mUserHandle.IsEmpty()) {
+ aValue.set(nullptr);
+ } else {
+ if (!mUserHandleCachedObj) {
+ mUserHandleCachedObj = mUserHandle.ToArrayBuffer(aCx);
+ if (!mUserHandleCachedObj) {
+ aRv.NoteJSContextException(aCx);
+ return;
+ }
+ }
+ aValue.set(mUserHandleCachedObj);
+ }
+}
+
+nsresult AuthenticatorAssertionResponse::SetUserHandle(CryptoBuffer& aBuffer) {
+ if (NS_WARN_IF(!mUserHandle.Assign(aBuffer))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ return NS_OK;
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/AuthenticatorAssertionResponse.h b/dom/webauthn/AuthenticatorAssertionResponse.h
new file mode 100644
index 0000000000..f3ffa80929
--- /dev/null
+++ b/dom/webauthn/AuthenticatorAssertionResponse.h
@@ -0,0 +1,61 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_AuthenticatorAssertionResponse_h
+#define mozilla_dom_AuthenticatorAssertionResponse_h
+
+#include "js/TypeDecls.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/dom/AuthenticatorResponse.h"
+#include "mozilla/dom/BindingDeclarations.h"
+#include "mozilla/dom/CryptoBuffer.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsWrapperCache.h"
+
+namespace mozilla::dom {
+
+class AuthenticatorAssertionResponse final : public AuthenticatorResponse {
+ public:
+ NS_DECL_ISUPPORTS_INHERITED
+ NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_INHERITED(
+ AuthenticatorAssertionResponse, AuthenticatorResponse)
+
+ explicit AuthenticatorAssertionResponse(nsPIDOMWindowInner* aParent);
+
+ protected:
+ ~AuthenticatorAssertionResponse() override;
+
+ public:
+ virtual JSObject* WrapObject(JSContext* aCx,
+ JS::Handle<JSObject*> aGivenProto) override;
+
+ void GetAuthenticatorData(JSContext* aCx, JS::MutableHandle<JSObject*> aValue,
+ ErrorResult& aRv);
+
+ nsresult SetAuthenticatorData(CryptoBuffer& aBuffer);
+
+ void GetSignature(JSContext* aCx, JS::MutableHandle<JSObject*> aValue,
+ ErrorResult& aRv);
+
+ nsresult SetSignature(CryptoBuffer& aBuffer);
+
+ void GetUserHandle(JSContext* aCx, JS::MutableHandle<JSObject*> aValue,
+ ErrorResult& aRv);
+
+ nsresult SetUserHandle(CryptoBuffer& aUserHandle);
+
+ private:
+ CryptoBuffer mAuthenticatorData;
+ JS::Heap<JSObject*> mAuthenticatorDataCachedObj;
+ CryptoBuffer mSignature;
+ JS::Heap<JSObject*> mSignatureCachedObj;
+ CryptoBuffer mUserHandle;
+ JS::Heap<JSObject*> mUserHandleCachedObj;
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_AuthenticatorAssertionResponse_h
diff --git a/dom/webauthn/AuthenticatorAttestationResponse.cpp b/dom/webauthn/AuthenticatorAttestationResponse.cpp
new file mode 100644
index 0000000000..f2398df4cb
--- /dev/null
+++ b/dom/webauthn/AuthenticatorAttestationResponse.cpp
@@ -0,0 +1,73 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/WebAuthenticationBinding.h"
+#include "mozilla/dom/AuthenticatorAttestationResponse.h"
+
+#include "mozilla/HoldDropJSObjects.h"
+
+namespace mozilla::dom {
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(AuthenticatorAttestationResponse)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(
+ AuthenticatorAttestationResponse, AuthenticatorResponse)
+ tmp->mAttestationObjectCachedObj = nullptr;
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN_INHERITED(AuthenticatorAttestationResponse,
+ AuthenticatorResponse)
+ NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
+ NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mAttestationObjectCachedObj)
+NS_IMPL_CYCLE_COLLECTION_TRACE_END
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(
+ AuthenticatorAttestationResponse, AuthenticatorResponse)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_ADDREF_INHERITED(AuthenticatorAttestationResponse,
+ AuthenticatorResponse)
+NS_IMPL_RELEASE_INHERITED(AuthenticatorAttestationResponse,
+ AuthenticatorResponse)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(AuthenticatorAttestationResponse)
+NS_INTERFACE_MAP_END_INHERITING(AuthenticatorResponse)
+
+AuthenticatorAttestationResponse::AuthenticatorAttestationResponse(
+ nsPIDOMWindowInner* aParent)
+ : AuthenticatorResponse(aParent), mAttestationObjectCachedObj(nullptr) {
+ mozilla::HoldJSObjects(this);
+}
+
+AuthenticatorAttestationResponse::~AuthenticatorAttestationResponse() {
+ mozilla::DropJSObjects(this);
+}
+
+JSObject* AuthenticatorAttestationResponse::WrapObject(
+ JSContext* aCx, JS::Handle<JSObject*> aGivenProto) {
+ return AuthenticatorAttestationResponse_Binding::Wrap(aCx, this, aGivenProto);
+}
+
+void AuthenticatorAttestationResponse::GetAttestationObject(
+ JSContext* aCx, JS::MutableHandle<JSObject*> aValue, ErrorResult& aRv) {
+ if (!mAttestationObjectCachedObj) {
+ mAttestationObjectCachedObj = mAttestationObject.ToArrayBuffer(aCx);
+ if (!mAttestationObjectCachedObj) {
+ aRv.NoteJSContextException(aCx);
+ return;
+ }
+ }
+ aValue.set(mAttestationObjectCachedObj);
+}
+
+nsresult AuthenticatorAttestationResponse::SetAttestationObject(
+ CryptoBuffer& aBuffer) {
+ if (NS_WARN_IF(!mAttestationObject.Assign(aBuffer))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ return NS_OK;
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/AuthenticatorAttestationResponse.h b/dom/webauthn/AuthenticatorAttestationResponse.h
new file mode 100644
index 0000000000..1e46ab76dd
--- /dev/null
+++ b/dom/webauthn/AuthenticatorAttestationResponse.h
@@ -0,0 +1,47 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_AuthenticatorAttestationResponse_h
+#define mozilla_dom_AuthenticatorAttestationResponse_h
+
+#include "js/TypeDecls.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/dom/AuthenticatorResponse.h"
+#include "mozilla/dom/BindingDeclarations.h"
+#include "mozilla/dom/CryptoBuffer.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsWrapperCache.h"
+
+namespace mozilla::dom {
+
+class AuthenticatorAttestationResponse final : public AuthenticatorResponse {
+ public:
+ NS_DECL_ISUPPORTS_INHERITED
+ NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_INHERITED(
+ AuthenticatorAttestationResponse, AuthenticatorResponse)
+
+ explicit AuthenticatorAttestationResponse(nsPIDOMWindowInner* aParent);
+
+ protected:
+ ~AuthenticatorAttestationResponse() override;
+
+ public:
+ virtual JSObject* WrapObject(JSContext* aCx,
+ JS::Handle<JSObject*> aGivenProto) override;
+
+ void GetAttestationObject(JSContext* aCx, JS::MutableHandle<JSObject*> aValue,
+ ErrorResult& aRv);
+
+ nsresult SetAttestationObject(CryptoBuffer& aBuffer);
+
+ private:
+ CryptoBuffer mAttestationObject;
+ JS::Heap<JSObject*> mAttestationObjectCachedObj;
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_AuthenticatorAttestationResponse_h
diff --git a/dom/webauthn/AuthenticatorResponse.cpp b/dom/webauthn/AuthenticatorResponse.cpp
new file mode 100644
index 0000000000..01d4519694
--- /dev/null
+++ b/dom/webauthn/AuthenticatorResponse.cpp
@@ -0,0 +1,55 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/AuthenticatorResponse.h"
+
+#include "nsPIDOMWindow.h"
+#include "nsWrapperCache.h"
+
+namespace mozilla::dom {
+
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE_WITH_JS_MEMBERS(
+ AuthenticatorResponse, (mParent), (mClientDataJSONCachedObj))
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(AuthenticatorResponse)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(AuthenticatorResponse)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(AuthenticatorResponse)
+ NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+ NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+AuthenticatorResponse::AuthenticatorResponse(nsPIDOMWindowInner* aParent)
+ : mParent(aParent), mClientDataJSONCachedObj(nullptr) {
+ // Call HoldJSObjects() in subclasses.
+}
+
+AuthenticatorResponse::~AuthenticatorResponse() {
+ // Call DropJSObjects() in subclasses.
+}
+
+nsISupports* AuthenticatorResponse::GetParentObject() const { return mParent; }
+
+void AuthenticatorResponse::GetClientDataJSON(
+ JSContext* aCx, JS::MutableHandle<JSObject*> aValue, ErrorResult& aRv) {
+ if (!mClientDataJSONCachedObj) {
+ mClientDataJSONCachedObj = mClientDataJSON.ToArrayBuffer(aCx);
+ if (!mClientDataJSONCachedObj) {
+ aRv.NoteJSContextException(aCx);
+ return;
+ }
+ }
+ aValue.set(mClientDataJSONCachedObj);
+}
+
+nsresult AuthenticatorResponse::SetClientDataJSON(CryptoBuffer& aBuffer) {
+ if (NS_WARN_IF(!mClientDataJSON.Assign(aBuffer))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ return NS_OK;
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/AuthenticatorResponse.h b/dom/webauthn/AuthenticatorResponse.h
new file mode 100644
index 0000000000..51714beec0
--- /dev/null
+++ b/dom/webauthn/AuthenticatorResponse.h
@@ -0,0 +1,50 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_AuthenticatorResponse_h
+#define mozilla_dom_AuthenticatorResponse_h
+
+#include "js/TypeDecls.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/ErrorResult.h"
+#include "mozilla/dom/BindingDeclarations.h"
+#include "mozilla/dom/CryptoBuffer.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsWrapperCache.h"
+#include "nsCOMPtr.h"
+#include "nsPIDOMWindow.h"
+
+namespace mozilla::dom {
+
+class AuthenticatorResponse : public nsISupports, public nsWrapperCache {
+ public:
+ NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+ NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(AuthenticatorResponse)
+
+ explicit AuthenticatorResponse(nsPIDOMWindowInner* aParent);
+
+ protected:
+ virtual ~AuthenticatorResponse();
+
+ public:
+ nsISupports* GetParentObject() const;
+
+ void GetFormat(nsString& aRetVal) const;
+
+ void GetClientDataJSON(JSContext* aCx, JS::MutableHandle<JSObject*> aValue,
+ ErrorResult& aRv);
+
+ nsresult SetClientDataJSON(CryptoBuffer& aBuffer);
+
+ private:
+ nsCOMPtr<nsPIDOMWindowInner> mParent;
+ CryptoBuffer mClientDataJSON;
+ JS::Heap<JSObject*> mClientDataJSONCachedObj;
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_AuthenticatorResponse_h
diff --git a/dom/webauthn/AuthrsTransport.cpp b/dom/webauthn/AuthrsTransport.cpp
new file mode 100644
index 0000000000..699cd600eb
--- /dev/null
+++ b/dom/webauthn/AuthrsTransport.cpp
@@ -0,0 +1,29 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "AuthrsTransport.h"
+#include "nsIWebAuthnController.h"
+#include "nsCOMPtr.h"
+
+namespace {
+extern "C" {
+
+// Implemented in Rust
+nsresult authrs_transport_constructor(nsIWebAuthnTransport** result);
+
+} // extern "C"
+} // namespace
+
+namespace mozilla::dom {
+
+already_AddRefed<nsIWebAuthnTransport> NewAuthrsTransport() {
+ nsCOMPtr<nsIWebAuthnTransport> transport;
+ nsresult rv = authrs_transport_constructor(getter_AddRefs(transport));
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return nullptr;
+ }
+ return transport.forget();
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/AuthrsTransport.h b/dom/webauthn/AuthrsTransport.h
new file mode 100644
index 0000000000..234fa2294c
--- /dev/null
+++ b/dom/webauthn/AuthrsTransport.h
@@ -0,0 +1,17 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef DOM_WEBAUTHN_AUTHRS_BRIDGE_H_
+#define DOM_WEBAUTHN_AUTHRS_BRIDGE_H_
+
+#include "mozilla/AlreadyAddRefed.h"
+#include "nsIWebAuthnController.h"
+
+namespace mozilla::dom {
+
+already_AddRefed<nsIWebAuthnTransport> NewAuthrsTransport();
+
+} // namespace mozilla::dom
+
+#endif // DOM_WEBAUTHN_AUTHRS_BRIDGE_H_
diff --git a/dom/webauthn/CtapArgs.cpp b/dom/webauthn/CtapArgs.cpp
new file mode 100644
index 0000000000..af3873b527
--- /dev/null
+++ b/dom/webauthn/CtapArgs.cpp
@@ -0,0 +1,256 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "CtapArgs.h"
+#include "WebAuthnEnumStrings.h"
+#include "WebAuthnUtil.h"
+#include "mozilla/dom/PWebAuthnTransactionParent.h"
+
+namespace mozilla::dom {
+
+NS_IMPL_ISUPPORTS(CtapRegisterArgs, nsICtapRegisterArgs)
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetOrigin(nsAString& aOrigin) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aOrigin = mInfo.Origin();
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetClientDataHash(nsTArray<uint8_t>& aClientDataHash) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ CryptoBuffer clientDataHash;
+ nsresult rv = HashCString(mInfo.ClientDataJSON(), clientDataHash);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return NS_ERROR_FAILURE;
+ }
+ aClientDataHash.Clear();
+ aClientDataHash.AppendElements(clientDataHash);
+
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetRpId(nsAString& aRpId) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aRpId = mInfo.RpId();
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetRpName(nsAString& aRpName) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aRpName = mInfo.Rp().Name();
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetUserId(nsTArray<uint8_t>& aUserId) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aUserId.Clear();
+ aUserId.AppendElements(mInfo.User().Id());
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetUserName(nsAString& aUserName) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aUserName = mInfo.User().Name();
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetUserDisplayName(nsAString& aUserDisplayName) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aUserDisplayName = mInfo.User().DisplayName();
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetCoseAlgs(nsTArray<int32_t>& aCoseAlgs) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aCoseAlgs.Clear();
+ for (const CoseAlg& coseAlg : mInfo.coseAlgs()) {
+ aCoseAlgs.AppendElement(coseAlg.alg());
+ }
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetExcludeList(nsTArray<nsTArray<uint8_t> >& aExcludeList) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aExcludeList.Clear();
+ for (const WebAuthnScopedCredential& cred : mInfo.ExcludeList()) {
+ aExcludeList.AppendElement(cred.id().Clone());
+ }
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetHmacCreateSecret(bool* aHmacCreateSecret) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ for (const WebAuthnExtension& ext : mInfo.Extensions()) {
+ if (ext.type() == WebAuthnExtension::TWebAuthnExtensionHmacSecret) {
+ *aHmacCreateSecret =
+ ext.get_WebAuthnExtensionHmacSecret().hmacCreateSecret();
+ return NS_OK;
+ }
+ }
+
+ return NS_ERROR_NOT_AVAILABLE;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetResidentKey(nsAString& aResidentKey) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aResidentKey = mInfo.AuthenticatorSelection().residentKey();
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetUserVerification(nsAString& aUserVerificationRequirement) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aUserVerificationRequirement =
+ mInfo.AuthenticatorSelection().userVerificationRequirement();
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetAuthenticatorAttachment(
+ nsAString& aAuthenticatorAttachment) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ if (mInfo.AuthenticatorSelection().authenticatorAttachment().isNothing()) {
+ return NS_ERROR_NOT_AVAILABLE;
+ }
+ aAuthenticatorAttachment =
+ *mInfo.AuthenticatorSelection().authenticatorAttachment();
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetTimeoutMS(uint32_t* aTimeoutMS) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ *aTimeoutMS = mInfo.TimeoutMS();
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterArgs::GetAttestationConveyancePreference(
+ nsAString& aAttestationConveyancePreference) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ if (mForceNoneAttestation) {
+ aAttestationConveyancePreference = NS_ConvertUTF8toUTF16(
+ MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_NONE);
+ } else {
+ aAttestationConveyancePreference = mInfo.attestationConveyancePreference();
+ }
+ return NS_OK;
+}
+
+NS_IMPL_ISUPPORTS(CtapSignArgs, nsICtapSignArgs)
+
+NS_IMETHODIMP
+CtapSignArgs::GetOrigin(nsAString& aOrigin) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aOrigin = mInfo.Origin();
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapSignArgs::GetRpId(nsAString& aRpId) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aRpId = mInfo.RpId();
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapSignArgs::GetClientDataHash(nsTArray<uint8_t>& aClientDataHash) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ CryptoBuffer clientDataHash;
+ nsresult rv = HashCString(mInfo.ClientDataJSON(), clientDataHash);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return NS_ERROR_FAILURE;
+ }
+ aClientDataHash.Clear();
+ aClientDataHash.AppendElements(clientDataHash);
+
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapSignArgs::GetAllowList(nsTArray<nsTArray<uint8_t> >& aAllowList) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aAllowList.Clear();
+ for (const WebAuthnScopedCredential& cred : mInfo.AllowList()) {
+ aAllowList.AppendElement(cred.id().Clone());
+ }
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapSignArgs::GetHmacCreateSecret(bool* aHmacCreateSecret) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ for (const WebAuthnExtension& ext : mInfo.Extensions()) {
+ if (ext.type() == WebAuthnExtension::TWebAuthnExtensionHmacSecret) {
+ *aHmacCreateSecret =
+ ext.get_WebAuthnExtensionHmacSecret().hmacCreateSecret();
+ return NS_OK;
+ }
+ }
+
+ return NS_ERROR_NOT_AVAILABLE;
+}
+
+NS_IMETHODIMP
+CtapSignArgs::GetAppId(nsAString& aAppId) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ for (const WebAuthnExtension& ext : mInfo.Extensions()) {
+ if (ext.type() == WebAuthnExtension::TWebAuthnExtensionAppId) {
+ aAppId = ext.get_WebAuthnExtensionAppId().appIdentifier();
+ return NS_OK;
+ }
+ }
+
+ return NS_ERROR_NOT_AVAILABLE;
+}
+
+NS_IMETHODIMP
+CtapSignArgs::GetAppIdHash(nsTArray<uint8_t>& aAppIdHash) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ for (const WebAuthnExtension& ext : mInfo.Extensions()) {
+ if (ext.type() == WebAuthnExtension::TWebAuthnExtensionAppId) {
+ aAppIdHash.Clear();
+ aAppIdHash.AppendElements(ext.get_WebAuthnExtensionAppId().AppId());
+ return NS_OK;
+ }
+ }
+
+ return NS_ERROR_NOT_AVAILABLE;
+}
+
+NS_IMETHODIMP
+CtapSignArgs::GetUserVerification(nsAString& aUserVerificationRequirement) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ aUserVerificationRequirement = mInfo.userVerificationRequirement();
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapSignArgs::GetTimeoutMS(uint32_t* aTimeoutMS) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ *aTimeoutMS = mInfo.TimeoutMS();
+ return NS_OK;
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/CtapArgs.h b/dom/webauthn/CtapArgs.h
new file mode 100644
index 0000000000..406c24f4ba
--- /dev/null
+++ b/dom/webauthn/CtapArgs.h
@@ -0,0 +1,58 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CtapArgs_h
+#define CtapArgs_h
+
+#include "mozilla/dom/WebAuthnTransactionChild.h"
+#include "mozilla/ipc/BackgroundParent.h"
+#include "nsIWebAuthnController.h"
+
+namespace mozilla::dom {
+
+// These classes provide an FFI between C++ and Rust for the getters of IPC
+// objects (WebAuthnMakeCredentialInfo and WebAuthnGetAssertionInfo). They hold
+// non-owning references to IPC objects, and must only be used within the
+// lifetime of the IPC transaction that created them. There are runtime
+// assertions to ensure that these types are created and used on the IPC
+// background thread, but that alone does not guarantee safety.
+
+class CtapRegisterArgs final : public nsICtapRegisterArgs {
+ public:
+ NS_DECL_ISUPPORTS
+ NS_DECL_NSICTAPREGISTERARGS
+
+ explicit CtapRegisterArgs(const WebAuthnMakeCredentialInfo& aInfo,
+ bool aForceNoneAttestation)
+ : mInfo(aInfo), mForceNoneAttestation(aForceNoneAttestation) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ }
+
+ private:
+ ~CtapRegisterArgs() = default;
+
+ const WebAuthnMakeCredentialInfo& mInfo;
+ const bool mForceNoneAttestation;
+};
+
+class CtapSignArgs final : public nsICtapSignArgs {
+ public:
+ NS_DECL_ISUPPORTS
+ NS_DECL_NSICTAPSIGNARGS
+
+ explicit CtapSignArgs(const WebAuthnGetAssertionInfo& aInfo) : mInfo(aInfo) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ }
+
+ private:
+ ~CtapSignArgs() = default;
+
+ const WebAuthnGetAssertionInfo& mInfo;
+};
+
+} // namespace mozilla::dom
+
+#endif // CtapArgs_h
diff --git a/dom/webauthn/CtapResults.cpp b/dom/webauthn/CtapResults.cpp
new file mode 100644
index 0000000000..e6d6bf0e24
--- /dev/null
+++ b/dom/webauthn/CtapResults.cpp
@@ -0,0 +1,82 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "CtapResults.h"
+
+namespace mozilla::dom {
+
+NS_IMPL_ISUPPORTS(CtapRegisterResult, nsICtapRegisterResult)
+
+NS_IMETHODIMP
+CtapRegisterResult::GetStatus(nsresult* aStatus) {
+ *aStatus = mStatus;
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterResult::GetAttestationObject(
+ nsTArray<uint8_t>& aAttestationObject) {
+ aAttestationObject.Clear();
+ aAttestationObject.AppendElements(mAttestationObject);
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapRegisterResult::GetCredentialId(nsTArray<uint8_t>& aCredentialId) {
+ aCredentialId.Clear();
+ aCredentialId.AppendElements(mCredentialId);
+ return NS_OK;
+}
+
+NS_IMPL_ISUPPORTS(CtapSignResult, nsICtapSignResult)
+
+NS_IMETHODIMP
+CtapSignResult::GetStatus(nsresult* aStatus) {
+ *aStatus = mStatus;
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapSignResult::GetCredentialId(nsTArray<uint8_t>& aCredentialId) {
+ aCredentialId.Clear();
+ aCredentialId.AppendElements(mCredentialId);
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapSignResult::GetAuthenticatorData(nsTArray<uint8_t>& aAuthenticatorData) {
+ aAuthenticatorData.Clear();
+ aAuthenticatorData.AppendElements(mAuthenticatorData);
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapSignResult::GetSignature(nsTArray<uint8_t>& aSignature) {
+ aSignature.Clear();
+ aSignature.AppendElements(mSignature);
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapSignResult::GetUserHandle(nsTArray<uint8_t>& aUserHandle) {
+ aUserHandle.Clear();
+ aUserHandle.AppendElements(mUserHandle);
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+CtapSignResult::GetUserName(nsACString& aUserName) {
+ return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+NS_IMETHODIMP
+CtapSignResult::GetRpIdHash(nsTArray<uint8_t>& aRpIdHash) {
+ aRpIdHash.Clear();
+ aRpIdHash.AppendElements(mRpIdHash);
+ return NS_OK;
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/CtapResults.h b/dom/webauthn/CtapResults.h
new file mode 100644
index 0000000000..86ff788907
--- /dev/null
+++ b/dom/webauthn/CtapResults.h
@@ -0,0 +1,65 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CtapResults_h
+#define CtapResults_h
+
+#include "mozilla/dom/WebAuthnTransactionChild.h"
+#include "nsIWebAuthnController.h"
+
+namespace mozilla::dom {
+
+class CtapRegisterResult final : public nsICtapRegisterResult {
+ public:
+ NS_DECL_ISUPPORTS
+ NS_DECL_NSICTAPREGISTERRESULT
+
+ explicit CtapRegisterResult(nsresult aStatus,
+ nsTArray<uint8_t>&& aAttestationObject,
+ nsTArray<uint8_t>&& aCredentialId)
+ : mStatus(aStatus),
+ mAttestationObject(std::move(aAttestationObject)),
+ mCredentialId(std::move(aCredentialId)) {}
+
+ private:
+ ~CtapRegisterResult() = default;
+
+ nsresult mStatus;
+ nsTArray<uint8_t> mAttestationObject;
+ nsTArray<uint8_t> mCredentialId;
+};
+
+class CtapSignResult final : public nsICtapSignResult {
+ public:
+ NS_DECL_ISUPPORTS
+ NS_DECL_NSICTAPSIGNRESULT
+
+ explicit CtapSignResult(nsresult aStatus, nsTArray<uint8_t>&& aCredentialId,
+ nsTArray<uint8_t>&& aSignature,
+ nsTArray<uint8_t>&& aAuthenticatorData,
+ nsTArray<uint8_t>&& aUserHandle,
+ nsTArray<uint8_t>&& aRpIdHash)
+ : mStatus(aStatus),
+ mCredentialId(std::move(aCredentialId)),
+ mSignature(std::move(aSignature)),
+ mAuthenticatorData(std::move(aAuthenticatorData)),
+ mUserHandle(std::move(aUserHandle)),
+ mRpIdHash(std::move(aRpIdHash)) {}
+
+ private:
+ ~CtapSignResult() = default;
+
+ nsresult mStatus;
+ nsTArray<uint8_t> mCredentialId;
+ nsTArray<uint8_t> mSignature;
+ nsTArray<uint8_t> mAuthenticatorData;
+ nsTArray<uint8_t> mUserHandle;
+ nsTArray<uint8_t> mRpIdHash;
+};
+
+} // namespace mozilla::dom
+
+#endif // CtapResult_h
diff --git a/dom/webauthn/PWebAuthnTransaction.ipdl b/dom/webauthn/PWebAuthnTransaction.ipdl
new file mode 100644
index 0000000000..c262beb853
--- /dev/null
+++ b/dom/webauthn/PWebAuthnTransaction.ipdl
@@ -0,0 +1,140 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * IPC Transaction protocol for the WebAuthn DOM API. This IPC protocol allows
+ * the content process to call to the parent to access hardware for
+ * authentication registration and challenges. All transactions start in the
+ * child process, and the parent replies with a "Confirm*" message, or a
+ * "Cancel" message if there was an error (no hardware available, no registered
+ * keys, etc) or interruption (another transaction was started in another
+ * content process). Similarly, the content process can also request a cancel,
+ * either triggered explicitly by the user/script or due to UI events like
+ * selecting a different tab.
+ */
+
+include protocol PBackground;
+
+using mozilla::dom::MaybeDiscardedBrowsingContext from "mozilla/dom/BrowsingContext.h";
+
+namespace mozilla {
+namespace dom {
+
+struct WebAuthnAuthenticatorSelection {
+ nsString residentKey;
+ nsString userVerificationRequirement;
+ nsString? authenticatorAttachment;
+};
+
+struct WebAuthnScopedCredential {
+ uint8_t[] id;
+ uint8_t transports;
+};
+
+struct WebAuthnExtensionAppId {
+ uint8_t[] AppId;
+ nsString appIdentifier;
+};
+
+struct WebAuthnExtensionHmacSecret {
+ bool hmacCreateSecret;
+};
+
+union WebAuthnExtension {
+ WebAuthnExtensionAppId;
+ WebAuthnExtensionHmacSecret;
+};
+
+struct WebAuthnExtensionResultAppId {
+ bool AppId;
+};
+
+struct WebAuthnExtensionResultHmacSecret {
+ bool hmacCreateSecret;
+};
+
+union WebAuthnExtensionResult {
+ WebAuthnExtensionResultAppId;
+ WebAuthnExtensionResultHmacSecret;
+};
+
+struct WebAuthnMakeCredentialRpInfo {
+ nsString Name;
+ nsString Icon;
+};
+
+struct WebAuthnMakeCredentialUserInfo {
+ uint8_t[] Id;
+ nsString Name;
+ nsString Icon;
+ nsString DisplayName;
+};
+
+struct CoseAlg {
+ long alg;
+};
+
+struct WebAuthnMakeCredentialInfo {
+ nsString Origin;
+ nsString RpId;
+ uint8_t[] Challenge;
+ nsCString ClientDataJSON;
+ uint32_t TimeoutMS;
+ WebAuthnScopedCredential[] ExcludeList;
+ WebAuthnMakeCredentialRpInfo Rp;
+ WebAuthnMakeCredentialUserInfo User;
+ CoseAlg[] coseAlgs;
+ WebAuthnExtension[] Extensions;
+ WebAuthnAuthenticatorSelection AuthenticatorSelection;
+ nsString attestationConveyancePreference;
+ uint64_t BrowsingContextId;
+};
+
+struct WebAuthnMakeCredentialResult {
+ nsCString ClientDataJSON;
+ uint8_t[] AttestationObject;
+ uint8_t[] KeyHandle;
+ WebAuthnExtensionResult[] Extensions;
+};
+
+struct WebAuthnGetAssertionInfo {
+ nsString Origin;
+ nsString RpId;
+ uint8_t[] Challenge;
+ nsCString ClientDataJSON;
+ uint32_t TimeoutMS;
+ WebAuthnScopedCredential[] AllowList;
+ WebAuthnExtension[] Extensions;
+ nsString userVerificationRequirement;
+ uint64_t BrowsingContextId;
+};
+
+struct WebAuthnGetAssertionResult {
+ nsCString ClientDataJSON;
+ uint8_t[] KeyHandle;
+ uint8_t[] Signature;
+ uint8_t[] AuthenticatorData;
+ WebAuthnExtensionResult[] Extensions;
+ uint8_t[] UserHandle;
+};
+
+[ManualDealloc]
+async protocol PWebAuthnTransaction {
+ manager PBackground;
+
+ parent:
+ async RequestRegister(uint64_t aTransactionId, WebAuthnMakeCredentialInfo aTransactionInfo);
+ async RequestSign(uint64_t aTransactionId, WebAuthnGetAssertionInfo aTransactionInfo);
+ [Tainted] async RequestCancel(uint64_t aTransactionId);
+ async DestroyMe();
+
+ child:
+ async __delete__();
+ async ConfirmRegister(uint64_t aTransactionId, WebAuthnMakeCredentialResult aResult);
+ async ConfirmSign(uint64_t aTransactionId, WebAuthnGetAssertionResult aResult);
+ async Abort(uint64_t aTransactionId, nsresult Error);
+};
+
+}
+}
diff --git a/dom/webauthn/PublicKeyCredential.cpp b/dom/webauthn/PublicKeyCredential.cpp
new file mode 100644
index 0000000000..a9f40c436b
--- /dev/null
+++ b/dom/webauthn/PublicKeyCredential.cpp
@@ -0,0 +1,168 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/Promise.h"
+#include "mozilla/dom/PublicKeyCredential.h"
+#include "mozilla/dom/WebAuthenticationBinding.h"
+#include "nsCycleCollectionParticipant.h"
+#include "mozilla/dom/AuthenticatorResponse.h"
+#include "mozilla/HoldDropJSObjects.h"
+#include "mozilla/Preferences.h"
+
+#ifdef OS_WIN
+# include "WinWebAuthnManager.h"
+#endif
+
+#ifdef MOZ_WIDGET_ANDROID
+# include "mozilla/java/WebAuthnTokenManagerWrappers.h"
+#endif
+
+namespace mozilla::dom {
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(PublicKeyCredential)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(PublicKeyCredential, Credential)
+ tmp->mRawIdCachedObj = nullptr;
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN_INHERITED(PublicKeyCredential, Credential)
+ NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
+ NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mRawIdCachedObj)
+NS_IMPL_CYCLE_COLLECTION_TRACE_END
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(PublicKeyCredential,
+ Credential)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mResponse)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_ADDREF_INHERITED(PublicKeyCredential, Credential)
+NS_IMPL_RELEASE_INHERITED(PublicKeyCredential, Credential)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(PublicKeyCredential)
+NS_INTERFACE_MAP_END_INHERITING(Credential)
+
+PublicKeyCredential::PublicKeyCredential(nsPIDOMWindowInner* aParent)
+ : Credential(aParent), mRawIdCachedObj(nullptr) {
+ mozilla::HoldJSObjects(this);
+}
+
+PublicKeyCredential::~PublicKeyCredential() { mozilla::DropJSObjects(this); }
+
+JSObject* PublicKeyCredential::WrapObject(JSContext* aCx,
+ JS::Handle<JSObject*> aGivenProto) {
+ return PublicKeyCredential_Binding::Wrap(aCx, this, aGivenProto);
+}
+
+void PublicKeyCredential::GetRawId(JSContext* aCx,
+ JS::MutableHandle<JSObject*> aValue,
+ ErrorResult& aRv) {
+ if (!mRawIdCachedObj) {
+ mRawIdCachedObj = mRawId.ToArrayBuffer(aCx);
+ if (!mRawIdCachedObj) {
+ aRv.NoteJSContextException(aCx);
+ return;
+ }
+ }
+ aValue.set(mRawIdCachedObj);
+}
+
+already_AddRefed<AuthenticatorResponse> PublicKeyCredential::Response() const {
+ RefPtr<AuthenticatorResponse> temp(mResponse);
+ return temp.forget();
+}
+
+nsresult PublicKeyCredential::SetRawId(CryptoBuffer& aBuffer) {
+ if (NS_WARN_IF(!mRawId.Assign(aBuffer))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ return NS_OK;
+}
+
+void PublicKeyCredential::SetResponse(RefPtr<AuthenticatorResponse> aResponse) {
+ mResponse = aResponse;
+}
+
+/* static */
+already_AddRefed<Promise>
+PublicKeyCredential::IsUserVerifyingPlatformAuthenticatorAvailable(
+ GlobalObject& aGlobal, ErrorResult& aError) {
+ RefPtr<Promise> promise =
+ Promise::Create(xpc::CurrentNativeGlobal(aGlobal.Context()), aError);
+ if (aError.Failed()) {
+ return nullptr;
+ }
+
+// https://w3c.github.io/webauthn/#isUserVerifyingPlatformAuthenticatorAvailable
+//
+// If on latest windows, call system APIs, otherwise return false, as we don't
+// have other UVPAAs available at this time.
+#ifdef OS_WIN
+
+ if (WinWebAuthnManager::IsUserVerifyingPlatformAuthenticatorAvailable()) {
+ promise->MaybeResolve(true);
+ return promise.forget();
+ }
+
+ promise->MaybeResolve(false);
+#elif defined(MOZ_WIDGET_ANDROID)
+ auto result = java::WebAuthnTokenManager::
+ WebAuthnIsUserVerifyingPlatformAuthenticatorAvailable();
+ auto geckoResult = java::GeckoResult::LocalRef(std::move(result));
+ MozPromise<bool, bool, false>::FromGeckoResult(geckoResult)
+ ->Then(GetMainThreadSerialEventTarget(), __func__,
+ [promise](const MozPromise<bool, bool,
+ false>::ResolveOrRejectValue& aValue) {
+ if (aValue.IsResolve()) {
+ promise->MaybeResolve(aValue.ResolveValue());
+ }
+ });
+#else
+ promise->MaybeResolve(false);
+#endif
+ return promise.forget();
+}
+
+/* static */
+already_AddRefed<Promise>
+PublicKeyCredential::IsExternalCTAP2SecurityKeySupported(GlobalObject& aGlobal,
+ ErrorResult& aError) {
+ RefPtr<Promise> promise =
+ Promise::Create(xpc::CurrentNativeGlobal(aGlobal.Context()), aError);
+ if (aError.Failed()) {
+ return nullptr;
+ }
+
+#ifdef OS_WIN
+ if (WinWebAuthnManager::AreWebAuthNApisAvailable()) {
+ promise->MaybeResolve(true);
+ } else {
+ promise->MaybeResolve(Preferences::GetBool("security.webauthn.ctap2"));
+ }
+#elif defined(MOZ_WIDGET_ANDROID)
+ promise->MaybeResolve(false);
+#else
+ promise->MaybeResolve(Preferences::GetBool("security.webauthn.ctap2"));
+#endif
+
+ return promise.forget();
+}
+
+void PublicKeyCredential::GetClientExtensionResults(
+ AuthenticationExtensionsClientOutputs& aResult) {
+ aResult = mClientExtensionOutputs;
+}
+
+void PublicKeyCredential::SetClientExtensionResultAppId(bool aResult) {
+ mClientExtensionOutputs.mAppid.Construct();
+ mClientExtensionOutputs.mAppid.Value() = aResult;
+}
+
+void PublicKeyCredential::SetClientExtensionResultHmacSecret(
+ bool aHmacCreateSecret) {
+ mClientExtensionOutputs.mHmacCreateSecret.Construct();
+ mClientExtensionOutputs.mHmacCreateSecret.Value() = aHmacCreateSecret;
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/PublicKeyCredential.h b/dom/webauthn/PublicKeyCredential.h
new file mode 100644
index 0000000000..86bc84e40b
--- /dev/null
+++ b/dom/webauthn/PublicKeyCredential.h
@@ -0,0 +1,67 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_PublicKeyCredential_h
+#define mozilla_dom_PublicKeyCredential_h
+
+#include "js/TypeDecls.h"
+#include "mozilla/Attributes.h"
+#include "mozilla/dom/BindingDeclarations.h"
+#include "mozilla/dom/Credential.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsWrapperCache.h"
+#include "mozilla/dom/CryptoBuffer.h"
+
+namespace mozilla::dom {
+
+class PublicKeyCredential final : public Credential {
+ public:
+ NS_DECL_ISUPPORTS_INHERITED
+ NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_INHERITED(PublicKeyCredential,
+ Credential)
+
+ explicit PublicKeyCredential(nsPIDOMWindowInner* aParent);
+
+ protected:
+ ~PublicKeyCredential() override;
+
+ public:
+ virtual JSObject* WrapObject(JSContext* aCx,
+ JS::Handle<JSObject*> aGivenProto) override;
+
+ void GetRawId(JSContext* aCx, JS::MutableHandle<JSObject*> aValue,
+ ErrorResult& aRv);
+
+ already_AddRefed<AuthenticatorResponse> Response() const;
+
+ nsresult SetRawId(CryptoBuffer& aBuffer);
+
+ void SetResponse(RefPtr<AuthenticatorResponse>);
+
+ static already_AddRefed<Promise>
+ IsUserVerifyingPlatformAuthenticatorAvailable(GlobalObject& aGlobal,
+ ErrorResult& aError);
+
+ static already_AddRefed<Promise> IsExternalCTAP2SecurityKeySupported(
+ GlobalObject& aGlobal, ErrorResult& aError);
+
+ void GetClientExtensionResults(
+ AuthenticationExtensionsClientOutputs& aResult);
+
+ void SetClientExtensionResultAppId(bool aResult);
+
+ void SetClientExtensionResultHmacSecret(bool aHmacCreateSecret);
+
+ private:
+ CryptoBuffer mRawId;
+ JS::Heap<JSObject*> mRawIdCachedObj;
+ RefPtr<AuthenticatorResponse> mResponse;
+ AuthenticationExtensionsClientOutputs mClientExtensionOutputs;
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_PublicKeyCredential_h
diff --git a/dom/webauthn/U2FSoftTokenTransport.cpp b/dom/webauthn/U2FSoftTokenTransport.cpp
new file mode 100644
index 0000000000..3b2f2a6231
--- /dev/null
+++ b/dom/webauthn/U2FSoftTokenTransport.cpp
@@ -0,0 +1,1031 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "CtapResults.h"
+#include "WebAuthnCoseIdentifiers.h"
+#include "WebAuthnEnumStrings.h"
+#include "U2FSoftTokenTransport.h"
+#include "mozilla/dom/WebAuthnUtil.h"
+#include "CryptoBuffer.h"
+#include "mozilla/Base64.h"
+#include "mozilla/Casting.h"
+#include "mozilla/Preferences.h"
+#include "nsNSSComponent.h"
+#include "nsThreadUtils.h"
+#include "pk11pub.h"
+#include "prerror.h"
+#include "secerr.h"
+#include "WebCryptoCommon.h"
+
+#define PREF_U2F_NSSTOKEN_COUNTER "security.webauth.softtoken_counter"
+
+namespace mozilla::dom {
+
+using namespace mozilla;
+using mozilla::dom::CreateECParamsForCurve;
+
+const nsCString U2FSoftTokenTransport::mSecretNickname = "U2F_NSSTOKEN"_ns;
+
+namespace {
+constexpr auto kAttestCertSubjectName = "CN=Firefox U2F Soft Token"_ns;
+
+// This U2F-compatible soft token uses FIDO U2F-compatible ECDSA keypairs
+// on the SEC_OID_SECG_EC_SECP256R1 curve. When asked to Register, it will
+// generate and return a new keypair KP, where the private component is wrapped
+// using AES-KW with the 128-bit mWrappingKey to make an opaque "key handle".
+// In other words, Register yields { KP_pub, AES-KW(KP_priv, key=mWrappingKey) }
+//
+// The value mWrappingKey is long-lived; it is persisted as part of the NSS DB
+// for the current profile. The attestation certificates that are produced are
+// ephemeral to counteract profiling. They have little use for a soft-token
+// at any rate, but are required by the specification.
+
+const uint32_t kParamLen = 32;
+const uint32_t kPublicKeyLen = 65;
+const uint32_t kWrappedKeyBufLen = 256;
+const uint32_t kWrappingKeyByteLen = 128 / 8;
+const uint32_t kSaltByteLen = 64 / 8;
+const uint32_t kVersion1KeyHandleLen = 162;
+constexpr auto kEcAlgorithm =
+ NS_LITERAL_STRING_FROM_CSTRING(WEBCRYPTO_NAMED_CURVE_P256);
+
+const PRTime kOneDay = PRTime(PR_USEC_PER_SEC) * PRTime(60) // sec
+ * PRTime(60) // min
+ * PRTime(24); // hours
+const PRTime kExpirationSlack = kOneDay; // Pre-date for clock skew
+const PRTime kExpirationLife = kOneDay;
+
+static mozilla::LazyLogModule gNSSTokenLog("webauthn_softtoken");
+
+enum SoftTokenHandle {
+ Version1 = 0,
+};
+
+} // namespace
+
+NS_IMPL_ISUPPORTS(U2FSoftTokenTransport, nsIWebAuthnTransport)
+
+U2FSoftTokenTransport::U2FSoftTokenTransport(uint32_t aCounter)
+ : mInitialized(false), mCounter(aCounter), mController(nullptr) {}
+
+NS_IMETHODIMP
+U2FSoftTokenTransport::GetController(nsIWebAuthnController** aController) {
+ return NS_ERROR_NOT_IMPLEMENTED;
+}
+
+NS_IMETHODIMP
+U2FSoftTokenTransport::SetController(nsIWebAuthnController* aController) {
+ mController = aController;
+ return NS_OK;
+}
+
+/**
+ * Gets the first key with the given nickname from the given slot. Any other
+ * keys found are not returned.
+ * PK11_GetNextSymKey() should not be called on the returned key.
+ *
+ * @param aSlot Slot to search.
+ * @param aNickname Nickname the key should have.
+ * @return The first key found. nullptr if no key could be found.
+ */
+static UniquePK11SymKey GetSymKeyByNickname(const UniquePK11SlotInfo& aSlot,
+ const nsCString& aNickname) {
+ MOZ_ASSERT(aSlot);
+ if (NS_WARN_IF(!aSlot)) {
+ return nullptr;
+ }
+
+ MOZ_LOG(gNSSTokenLog, LogLevel::Debug,
+ ("Searching for a symmetric key named %s", aNickname.get()));
+
+ UniquePK11SymKey keyListHead(
+ PK11_ListFixedKeysInSlot(aSlot.get(), const_cast<char*>(aNickname.get()),
+ /* wincx */ nullptr));
+ if (NS_WARN_IF(!keyListHead)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Debug, ("Symmetric key not found."));
+ return nullptr;
+ }
+
+ // Sanity check PK11_ListFixedKeysInSlot() only returns keys with the correct
+ // nickname.
+ MOZ_ASSERT(aNickname ==
+ UniquePORTString(PK11_GetSymKeyNickname(keyListHead.get())).get());
+ MOZ_LOG(gNSSTokenLog, LogLevel::Debug, ("Symmetric key found!"));
+
+ // Free any remaining keys in the key list.
+ UniquePK11SymKey freeKey(PK11_GetNextSymKey(keyListHead.get()));
+ while (freeKey) {
+ freeKey = UniquePK11SymKey(PK11_GetNextSymKey(freeKey.get()));
+ }
+
+ return keyListHead;
+}
+
+static nsresult GenEcKeypair(const UniquePK11SlotInfo& aSlot,
+ /*out*/ UniqueSECKEYPrivateKey& aPrivKey,
+ /*out*/ UniqueSECKEYPublicKey& aPubKey) {
+ MOZ_ASSERT(aSlot);
+ if (NS_WARN_IF(!aSlot)) {
+ return NS_ERROR_INVALID_ARG;
+ }
+
+ UniquePLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
+ if (NS_WARN_IF(!arena)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ // Set the curve parameters; keyParams belongs to the arena memory space
+ SECItem* keyParams = CreateECParamsForCurve(kEcAlgorithm, arena.get());
+ if (NS_WARN_IF(!keyParams)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ // Generate a key pair
+ CK_MECHANISM_TYPE mechanism = CKM_EC_KEY_PAIR_GEN;
+
+ SECKEYPublicKey* pubKeyRaw;
+ aPrivKey = UniqueSECKEYPrivateKey(
+ PK11_GenerateKeyPair(aSlot.get(), mechanism, keyParams, &pubKeyRaw,
+ /* ephemeral */ false, false,
+ /* wincx */ nullptr));
+ aPubKey = UniqueSECKEYPublicKey(pubKeyRaw);
+ pubKeyRaw = nullptr;
+ if (NS_WARN_IF(!aPrivKey.get() || !aPubKey.get())) {
+ return NS_ERROR_FAILURE;
+ }
+
+ // Check that the public key has the correct length
+ if (NS_WARN_IF(aPubKey->u.ec.publicValue.len != kPublicKeyLen)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ return NS_OK;
+}
+
+nsresult U2FSoftTokenTransport::GetOrCreateWrappingKey(
+ const UniquePK11SlotInfo& aSlot) {
+ MOZ_ASSERT(aSlot);
+ if (NS_WARN_IF(!aSlot)) {
+ return NS_ERROR_INVALID_ARG;
+ }
+
+ // Search for an existing wrapping key. If we find it,
+ // store it for later and mark ourselves initialized.
+ mWrappingKey = GetSymKeyByNickname(aSlot, mSecretNickname);
+ if (mWrappingKey) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Debug, ("U2F Soft Token Key found."));
+ mInitialized = true;
+ return NS_OK;
+ }
+
+ MOZ_LOG(gNSSTokenLog, LogLevel::Info,
+ ("No keys found. Generating new U2F Soft Token wrapping key."));
+
+ // We did not find an existing wrapping key, so we generate one in the
+ // persistent database (e.g, Token).
+ mWrappingKey = UniquePK11SymKey(PK11_TokenKeyGenWithFlags(
+ aSlot.get(), CKM_AES_KEY_GEN,
+ /* default params */ nullptr, kWrappingKeyByteLen,
+ /* empty keyid */ nullptr,
+ /* flags */ CKF_WRAP | CKF_UNWRAP,
+ /* attributes */ PK11_ATTR_TOKEN | PK11_ATTR_PRIVATE,
+ /* wincx */ nullptr));
+
+ if (NS_WARN_IF(!mWrappingKey)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Failed to store wrapping key, NSS error #%d", PORT_GetError()));
+ return NS_ERROR_FAILURE;
+ }
+
+ SECStatus srv =
+ PK11_SetSymKeyNickname(mWrappingKey.get(), mSecretNickname.get());
+ if (NS_WARN_IF(srv != SECSuccess)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Failed to set nickname, NSS error #%d", PORT_GetError()));
+ return NS_ERROR_FAILURE;
+ }
+
+ MOZ_LOG(gNSSTokenLog, LogLevel::Debug,
+ ("Key stored, nickname set to %s.", mSecretNickname.get()));
+
+ GetMainThreadSerialEventTarget()->Dispatch(NS_NewRunnableFunction(
+ "dom::U2FSoftTokenTransport::GetOrCreateWrappingKey", []() {
+ MOZ_ASSERT(NS_IsMainThread());
+ Preferences::SetUint(PREF_U2F_NSSTOKEN_COUNTER, 0);
+ }));
+
+ return NS_OK;
+}
+
+static nsresult GetAttestationCertificate(
+ const UniquePK11SlotInfo& aSlot,
+ /*out*/ UniqueSECKEYPrivateKey& aAttestPrivKey,
+ /*out*/ UniqueCERTCertificate& aAttestCert) {
+ MOZ_ASSERT(aSlot);
+ if (NS_WARN_IF(!aSlot)) {
+ return NS_ERROR_INVALID_ARG;
+ }
+
+ UniqueSECKEYPublicKey pubKey;
+
+ // Construct an ephemeral keypair for this Attestation Certificate
+ nsresult rv = GenEcKeypair(aSlot, aAttestPrivKey, pubKey);
+ if (NS_WARN_IF(NS_FAILED(rv) || !aAttestPrivKey || !pubKey)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Failed to gen keypair, NSS error #%d", PORT_GetError()));
+ return NS_ERROR_FAILURE;
+ }
+
+ // Construct the Attestation Certificate itself
+ UniqueCERTName subjectName(CERT_AsciiToName(kAttestCertSubjectName.get()));
+ if (NS_WARN_IF(!subjectName)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Failed to set subject name, NSS error #%d", PORT_GetError()));
+ return NS_ERROR_FAILURE;
+ }
+
+ UniqueCERTSubjectPublicKeyInfo spki(
+ SECKEY_CreateSubjectPublicKeyInfo(pubKey.get()));
+ if (NS_WARN_IF(!spki)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Failed to set SPKI, NSS error #%d", PORT_GetError()));
+ return NS_ERROR_FAILURE;
+ }
+
+ UniqueCERTCertificateRequest certreq(
+ CERT_CreateCertificateRequest(subjectName.get(), spki.get(), nullptr));
+ if (NS_WARN_IF(!certreq)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Failed to gen CSR, NSS error #%d", PORT_GetError()));
+ return NS_ERROR_FAILURE;
+ }
+
+ PRTime now = PR_Now();
+ PRTime notBefore = now - kExpirationSlack;
+ PRTime notAfter = now + kExpirationLife;
+
+ UniqueCERTValidity validity(CERT_CreateValidity(notBefore, notAfter));
+ if (NS_WARN_IF(!validity)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Failed to gen validity, NSS error #%d", PORT_GetError()));
+ return NS_ERROR_FAILURE;
+ }
+
+ unsigned long serial;
+ unsigned char* serialBytes =
+ mozilla::BitwiseCast<unsigned char*, unsigned long*>(&serial);
+ SECStatus srv =
+ PK11_GenerateRandomOnSlot(aSlot.get(), serialBytes, sizeof(serial));
+ if (NS_WARN_IF(srv != SECSuccess)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Failed to gen serial, NSS error #%d", PORT_GetError()));
+ return NS_ERROR_FAILURE;
+ }
+ // Ensure that the most significant bit isn't set (which would
+ // indicate a negative number, which isn't valid for serial
+ // numbers).
+ serialBytes[0] &= 0x7f;
+ // Also ensure that the least significant bit on the most
+ // significant byte is set (to prevent a leading zero byte,
+ // which also wouldn't be valid).
+ serialBytes[0] |= 0x01;
+
+ // NB: CERTCertificates created with CERT_CreateCertificate are not safe to
+ // use with other NSS functions like CERT_DupCertificate.
+ // The strategy here is to create a tbsCertificate ("to-be-signed
+ // certificate"), encode it, and sign it, resulting in a signed DER
+ // certificate that can be decoded into a CERTCertificate.
+ UniqueCERTCertificate tbsCertificate(CERT_CreateCertificate(
+ serial, subjectName.get(), validity.get(), certreq.get()));
+ if (NS_WARN_IF(!tbsCertificate)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Failed to gen certificate, NSS error #%d", PORT_GetError()));
+ return NS_ERROR_FAILURE;
+ }
+
+ PLArenaPool* arena = tbsCertificate->arena;
+
+ srv = SECOID_SetAlgorithmID(arena, &tbsCertificate->signature,
+ SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE,
+ /* wincx */ nullptr);
+ if (NS_WARN_IF(srv != SECSuccess)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ // Set version to X509v3.
+ *(tbsCertificate->version.data) = SEC_CERTIFICATE_VERSION_3;
+ tbsCertificate->version.len = 1;
+
+ SECItem innerDER = {siBuffer, nullptr, 0};
+ if (NS_WARN_IF(!SEC_ASN1EncodeItem(arena, &innerDER, tbsCertificate.get(),
+ SEC_ASN1_GET(CERT_CertificateTemplate)))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ SECItem* certDer = PORT_ArenaZNew(arena, SECItem);
+ if (NS_WARN_IF(!certDer)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ srv = SEC_DerSignData(arena, certDer, innerDER.data, innerDER.len,
+ aAttestPrivKey.get(),
+ SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE);
+ if (NS_WARN_IF(srv != SECSuccess)) {
+ return NS_ERROR_FAILURE;
+ }
+ aAttestCert = UniqueCERTCertificate(CERT_NewTempCertificate(
+ CERT_GetDefaultCertDB(), certDer, nullptr, false, true));
+ if (NS_WARN_IF(!aAttestCert)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ MOZ_LOG(gNSSTokenLog, LogLevel::Debug,
+ ("U2F Soft Token attestation certificate generated."));
+ return NS_OK;
+}
+
+// Set up the context for the soft U2F Token. This is called by NSS
+// initialization.
+nsresult U2FSoftTokenTransport::Init() {
+ // If we've already initialized, just return.
+ if (mInitialized) {
+ return NS_OK;
+ }
+
+ UniquePK11SlotInfo slot(PK11_GetInternalKeySlot());
+ MOZ_ASSERT(slot.get());
+
+ // Search for an existing wrapping key, or create one.
+ nsresult rv = GetOrCreateWrappingKey(slot);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return rv;
+ }
+
+ mInitialized = true;
+ MOZ_LOG(gNSSTokenLog, LogLevel::Debug, ("U2F Soft Token initialized."));
+ return NS_OK;
+}
+
+// Convert a Private Key object into an opaque key handle, using AES Key Wrap
+// with the long-lived aPersistentKey mixed with aAppParam to convert aPrivKey.
+// The key handle's format is version || saltLen || salt || wrappedPrivateKey
+static UniqueSECItem KeyHandleFromPrivateKey(
+ const UniquePK11SlotInfo& aSlot, const UniquePK11SymKey& aPersistentKey,
+ uint8_t* aAppParam, uint32_t aAppParamLen,
+ const UniqueSECKEYPrivateKey& aPrivKey) {
+ MOZ_ASSERT(aSlot);
+ MOZ_ASSERT(aPersistentKey);
+ MOZ_ASSERT(aAppParam);
+ MOZ_ASSERT(aPrivKey);
+ if (NS_WARN_IF(!aSlot || !aPersistentKey || !aPrivKey || !aAppParam)) {
+ return nullptr;
+ }
+
+ // Generate a random salt
+ uint8_t saltParam[kSaltByteLen];
+ SECStatus srv =
+ PK11_GenerateRandomOnSlot(aSlot.get(), saltParam, sizeof(saltParam));
+ if (NS_WARN_IF(srv != SECSuccess)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Failed to generate a salt, NSS error #%d", PORT_GetError()));
+ return nullptr;
+ }
+
+ // Prepare the HKDF (https://tools.ietf.org/html/rfc5869)
+ CK_NSS_HKDFParams hkdfParams = {true, saltParam, sizeof(saltParam),
+ true, aAppParam, aAppParamLen};
+ SECItem kdfParams = {siBuffer, (unsigned char*)&hkdfParams,
+ sizeof(hkdfParams)};
+
+ // Derive a wrapping key from aPersistentKey, the salt, and the aAppParam.
+ // CKM_AES_KEY_GEN and CKA_WRAP are key type and usage attributes of the
+ // derived symmetric key and don't matter because we ignore them anyway.
+ UniquePK11SymKey wrapKey(
+ PK11_Derive(aPersistentKey.get(), CKM_NSS_HKDF_SHA256, &kdfParams,
+ CKM_AES_KEY_GEN, CKA_WRAP, kWrappingKeyByteLen));
+ if (NS_WARN_IF(!wrapKey.get())) {
+ MOZ_LOG(
+ gNSSTokenLog, LogLevel::Warning,
+ ("Failed to derive a wrapping key, NSS error #%d", PORT_GetError()));
+ return nullptr;
+ }
+
+ UniqueSECItem wrappedKey(::SECITEM_AllocItem(/* default arena */ nullptr,
+ /* no buffer */ nullptr,
+ kWrappedKeyBufLen));
+ if (NS_WARN_IF(!wrappedKey)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning, ("Failed to allocate memory"));
+ return nullptr;
+ }
+
+ UniqueSECItem param(PK11_ParamFromIV(CKM_NSS_AES_KEY_WRAP_PAD,
+ /* default IV */ nullptr));
+
+ srv =
+ PK11_WrapPrivKey(aSlot.get(), wrapKey.get(), aPrivKey.get(),
+ CKM_NSS_AES_KEY_WRAP_PAD, param.get(), wrappedKey.get(),
+ /* wincx */ nullptr);
+ if (NS_WARN_IF(srv != SECSuccess)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Failed to wrap U2F key, NSS error #%d", PORT_GetError()));
+ return nullptr;
+ }
+
+ // Concatenate the salt and the wrapped Private Key together
+ mozilla::dom::CryptoBuffer keyHandleBuf;
+ if (NS_WARN_IF(!keyHandleBuf.SetCapacity(
+ wrappedKey.get()->len + sizeof(saltParam) + 2, mozilla::fallible))) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning, ("Failed to allocate memory"));
+ return nullptr;
+ }
+
+ // It's OK to ignore the return values here because we're writing into
+ // pre-allocated space
+ (void)keyHandleBuf.AppendElement(SoftTokenHandle::Version1,
+ mozilla::fallible);
+ (void)keyHandleBuf.AppendElement(sizeof(saltParam), mozilla::fallible);
+ (void)keyHandleBuf.AppendElements(saltParam, sizeof(saltParam),
+ mozilla::fallible);
+ keyHandleBuf.AppendSECItem(wrappedKey.get());
+
+ UniqueSECItem keyHandle(::SECITEM_AllocItem(nullptr, nullptr, 0));
+ if (NS_WARN_IF(!keyHandle)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning, ("Failed to allocate memory"));
+ return nullptr;
+ }
+
+ if (NS_WARN_IF(!keyHandleBuf.ToSECItem(/* default arena */ nullptr,
+ keyHandle.get()))) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning, ("Failed to allocate memory"));
+ return nullptr;
+ }
+ return keyHandle;
+}
+
+// Convert an opaque key handle aKeyHandle back into a Private Key object, using
+// the long-lived aPersistentKey mixed with aAppParam and the AES Key Wrap
+// algorithm.
+static UniqueSECKEYPrivateKey PrivateKeyFromKeyHandle(
+ const UniquePK11SlotInfo& aSlot, const UniquePK11SymKey& aPersistentKey,
+ uint8_t* aKeyHandle, uint32_t aKeyHandleLen, uint8_t* aAppParam,
+ uint32_t aAppParamLen) {
+ MOZ_ASSERT(aSlot);
+ MOZ_ASSERT(aPersistentKey);
+ MOZ_ASSERT(aKeyHandle);
+ MOZ_ASSERT(aAppParam);
+ MOZ_ASSERT(aAppParamLen == SHA256_LENGTH);
+ if (NS_WARN_IF(!aSlot || !aPersistentKey || !aKeyHandle || !aAppParam ||
+ aAppParamLen != SHA256_LENGTH)) {
+ return nullptr;
+ }
+
+ // As we only support one key format ourselves (right now), fail early if
+ // we aren't that length
+ if (NS_WARN_IF(aKeyHandleLen != kVersion1KeyHandleLen)) {
+ return nullptr;
+ }
+
+ if (NS_WARN_IF(aKeyHandle[0] != SoftTokenHandle::Version1)) {
+ // Unrecognized version
+ return nullptr;
+ }
+
+ uint8_t saltLen = aKeyHandle[1];
+ uint8_t* saltPtr = aKeyHandle + 2;
+ if (NS_WARN_IF(saltLen != kSaltByteLen)) {
+ return nullptr;
+ }
+
+ // Prepare the HKDF (https://tools.ietf.org/html/rfc5869)
+ CK_NSS_HKDFParams hkdfParams = {true, saltPtr, saltLen,
+ true, aAppParam, aAppParamLen};
+ SECItem kdfParams = {siBuffer, (unsigned char*)&hkdfParams,
+ sizeof(hkdfParams)};
+
+ // Derive a wrapping key from aPersistentKey, the salt, and the aAppParam.
+ // CKM_AES_KEY_GEN and CKA_WRAP are key type and usage attributes of the
+ // derived symmetric key and don't matter because we ignore them anyway.
+ UniquePK11SymKey wrapKey(
+ PK11_Derive(aPersistentKey.get(), CKM_NSS_HKDF_SHA256, &kdfParams,
+ CKM_AES_KEY_GEN, CKA_WRAP, kWrappingKeyByteLen));
+ if (NS_WARN_IF(!wrapKey.get())) {
+ MOZ_LOG(
+ gNSSTokenLog, LogLevel::Warning,
+ ("Failed to derive a wrapping key, NSS error #%d", PORT_GetError()));
+ return nullptr;
+ }
+
+ uint8_t wrappedLen = aKeyHandleLen - saltLen - 2;
+ uint8_t* wrappedPtr = aKeyHandle + saltLen + 2;
+
+ ScopedAutoSECItem wrappedKeyItem(wrappedLen);
+ memcpy(wrappedKeyItem.data, wrappedPtr, wrappedKeyItem.len);
+
+ ScopedAutoSECItem pubKey(kPublicKeyLen);
+
+ UniqueSECItem param(PK11_ParamFromIV(CKM_NSS_AES_KEY_WRAP_PAD,
+ /* default IV */ nullptr));
+
+ CK_ATTRIBUTE_TYPE usages[] = {CKA_SIGN};
+ int usageCount = 1;
+
+ UniqueSECKEYPrivateKey unwrappedKey(
+ PK11_UnwrapPrivKey(aSlot.get(), wrapKey.get(), CKM_NSS_AES_KEY_WRAP_PAD,
+ param.get(), &wrappedKeyItem,
+ /* no nickname */ nullptr,
+ /* discard pubkey */ &pubKey,
+ /* not permanent */ false,
+ /* non-exportable */ true, CKK_EC, usages, usageCount,
+ /* wincx */ nullptr));
+ if (NS_WARN_IF(!unwrappedKey)) {
+ // Not our key.
+ MOZ_LOG(gNSSTokenLog, LogLevel::Debug,
+ ("Could not unwrap key handle, NSS Error #%d", PORT_GetError()));
+ return nullptr;
+ }
+
+ return unwrappedKey;
+}
+
+// IsRegistered determines if the provided key handle is usable by this token.
+nsresult U2FSoftTokenTransport::IsRegistered(
+ const nsTArray<uint8_t>& aKeyHandle, const nsTArray<uint8_t>& aAppParam,
+ bool& aResult) {
+ if (!mInitialized) {
+ nsresult rv = Init();
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return rv;
+ }
+ }
+
+ UniquePK11SlotInfo slot(PK11_GetInternalSlot());
+ MOZ_ASSERT(slot.get());
+
+ // Decode the key handle
+ UniqueSECKEYPrivateKey privKey = PrivateKeyFromKeyHandle(
+ slot, mWrappingKey, const_cast<uint8_t*>(aKeyHandle.Elements()),
+ aKeyHandle.Length(), const_cast<uint8_t*>(aAppParam.Elements()),
+ aAppParam.Length());
+ aResult = privKey.get() != nullptr;
+ return NS_OK;
+}
+
+// A U2F Register operation causes a new key pair to be generated by the token.
+// The token then returns the public key of the key pair, and a handle to the
+// private key, which is a fancy way of saying "key wrapped private key", as
+// well as the generated attestation certificate and a signature using that
+// certificate's private key.
+//
+// The KeyHandleFromPrivateKey and PrivateKeyFromKeyHandle methods perform
+// the actual key wrap/unwrap operations.
+//
+// The format of the return registration data is as follows:
+//
+// Bytes Value
+// 1 0x05
+// 65 public key
+// 1 key handle length
+// * key handle
+// ASN.1 attestation certificate
+// * attestation signature
+//
+NS_IMETHODIMP
+U2FSoftTokenTransport::MakeCredential(uint64_t aTransactionId,
+ uint64_t _aBrowsingContextId,
+ nsICtapRegisterArgs* args) {
+ nsresult rv;
+
+ if (!mInitialized) {
+ rv = Init();
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return rv;
+ }
+ }
+
+ if (NS_WARN_IF(!args)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ bool requireResidentKey = false;
+ nsString residentKey;
+ rv = args->GetResidentKey(residentKey);
+ if (NS_SUCCEEDED(rv) && residentKey.EqualsLiteral(
+ MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_REQUIRED)) {
+ requireResidentKey = true;
+ }
+
+ bool requireUserVerification = false;
+ nsString userVerification;
+ // Bug 1737205 will make this infallible
+ rv = args->GetUserVerification(userVerification);
+ if (NS_SUCCEEDED(rv)) {
+ requireUserVerification = userVerification.EqualsLiteral(
+ MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED);
+ }
+
+ bool requirePlatformAttachment = false;
+ nsString authenticatorAttachment;
+ // Bug 1737205 will make this infallible
+ rv = args->GetAuthenticatorAttachment(authenticatorAttachment);
+ if (NS_SUCCEEDED(rv) && authenticatorAttachment.EqualsLiteral(
+ MOZ_WEBAUTHN_AUTHENTICATOR_ATTACHMENT_PLATFORM)) {
+ requirePlatformAttachment = true;
+ }
+
+ // The U2F softtoken neither supports resident keys or
+ // user verification, nor is it a platform authenticator.
+ if (requireResidentKey || requireUserVerification ||
+ requirePlatformAttachment) {
+ return NS_ERROR_DOM_NOT_ALLOWED_ERR;
+ }
+
+ bool noneAttestationRequested = false;
+ nsString attestationConveyancePreference;
+ rv =
+ args->GetAttestationConveyancePreference(attestationConveyancePreference);
+ if (NS_SUCCEEDED(rv) &&
+ attestationConveyancePreference.EqualsLiteral(
+ MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_NONE)) {
+ noneAttestationRequested = true;
+ }
+
+ nsTArray<int32_t> coseAlgs;
+ // Bug 1737205 will make this infallible
+ rv = args->GetCoseAlgs(coseAlgs);
+ // If the request does not list algs, assume ES256.
+ if (NS_FAILED(rv) || coseAlgs.IsEmpty()) {
+ coseAlgs.AppendElement(
+ static_cast<int32_t>(CoseAlgorithmIdentifier::ES256));
+ }
+ // This token only supports ES256.
+ coseAlgs.RemoveElementsBy([](auto& alg) {
+ return alg != static_cast<int32_t>(CoseAlgorithmIdentifier::ES256);
+ });
+ // If there are no acceptable/supported algorithms, exit
+ if (coseAlgs.IsEmpty()) {
+ return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
+ }
+
+ nsString rpId;
+ args->GetRpId(rpId);
+
+ nsTArray<uint8_t> clientDataHash;
+ rv = args->GetClientDataHash(clientDataHash);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return NS_ERROR_DOM_UNKNOWN_ERR;
+ }
+
+ CryptoBuffer rpIdHash;
+ rv = HashCString(NS_ConvertUTF16toUTF8(rpId), rpIdHash);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ // Optional exclusion list.
+ nsTArray<nsTArray<uint8_t>> excludeList;
+ args->GetExcludeList(excludeList);
+ for (const auto& credId : excludeList) {
+ bool isRegistered = false;
+ nsresult rv = IsRegistered(credId, rpIdHash, isRegistered);
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+ if (isRegistered) {
+ return NS_ERROR_DOM_INVALID_STATE_ERR;
+ }
+ }
+
+ // We should already have a wrapping key
+ MOZ_ASSERT(mWrappingKey);
+
+ UniquePK11SlotInfo slot(PK11_GetInternalSlot());
+ MOZ_ASSERT(slot.get());
+
+ // Construct a one-time-use Attestation Certificate
+ UniqueSECKEYPrivateKey attestPrivKey;
+ UniqueCERTCertificate attestCert;
+ rv = GetAttestationCertificate(slot, attestPrivKey, attestCert);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return NS_ERROR_FAILURE;
+ }
+ MOZ_ASSERT(attestCert);
+ MOZ_ASSERT(attestPrivKey);
+
+ // Generate a new keypair; the private will be wrapped into a Key Handle
+ UniqueSECKEYPrivateKey privKey;
+ UniqueSECKEYPublicKey pubKey;
+ rv = GenEcKeypair(slot, privKey, pubKey);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ // The key handle will be the result of keywrap(privKey, key=mWrappingKey)
+ UniqueSECItem keyHandleItem = KeyHandleFromPrivateKey(
+ slot, mWrappingKey, const_cast<uint8_t*>(rpIdHash.Elements()),
+ rpIdHash.Length(), privKey);
+ if (NS_WARN_IF(!keyHandleItem.get())) {
+ return NS_ERROR_FAILURE;
+ }
+
+ // Sign the challenge using the Attestation privkey (from attestCert)
+ mozilla::dom::CryptoBuffer signedDataBuf;
+ if (NS_WARN_IF(!signedDataBuf.SetCapacity(
+ 1 + rpIdHash.Length() + clientDataHash.Length() + keyHandleItem->len +
+ kPublicKeyLen,
+ mozilla::fallible))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ // // It's OK to ignore the return values here because we're writing into
+ // // pre-allocated space
+ (void)signedDataBuf.AppendElement(0x00, mozilla::fallible);
+ (void)signedDataBuf.AppendElements(rpIdHash, mozilla::fallible);
+ (void)signedDataBuf.AppendElements(clientDataHash, mozilla::fallible);
+ signedDataBuf.AppendSECItem(keyHandleItem.get());
+ signedDataBuf.AppendSECItem(pubKey->u.ec.publicValue);
+
+ ScopedAutoSECItem signatureItem;
+ SECStatus srv = SEC_SignData(&signatureItem, signedDataBuf.Elements(),
+ signedDataBuf.Length(), attestPrivKey.get(),
+ SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE);
+ if (NS_WARN_IF(srv != SECSuccess)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Signature failure: %d", PORT_GetError()));
+ return NS_ERROR_FAILURE;
+ }
+
+ CryptoBuffer keyHandleBuf;
+ if (!keyHandleBuf.AppendSECItem(keyHandleItem.get())) {
+ return NS_ERROR_FAILURE;
+ }
+
+ CryptoBuffer attestCertBuf;
+ if (!attestCertBuf.AppendSECItem(attestCert.get()->derCert)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ CryptoBuffer signatureBuf;
+ if (!signatureBuf.AppendSECItem(signatureItem)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ CryptoBuffer pubKeyBuf;
+ if (!pubKeyBuf.AppendSECItem(pubKey->u.ec.publicValue)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ CryptoBuffer attObj;
+ rv = AssembleAttestationObject(rpIdHash, pubKeyBuf, keyHandleBuf,
+ attestCertBuf, signatureBuf,
+ noneAttestationRequested, attObj);
+ if (NS_FAILED(rv)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ nsTArray<uint8_t> outAttObj(std::move(attObj));
+ nsTArray<uint8_t> outKeyHandleBuf(std::move(keyHandleBuf));
+ mController->FinishRegister(
+ aTransactionId, new CtapRegisterResult(NS_OK, std::move(outAttObj),
+ std::move(outKeyHandleBuf)));
+ return NS_OK;
+}
+
+bool U2FSoftTokenTransport::FindRegisteredKeyHandle(
+ const nsTArray<nsTArray<uint8_t>>& aAppIds,
+ const nsTArray<nsTArray<uint8_t>>& aCredentialIds,
+ /*out*/ nsTArray<uint8_t>& aKeyHandle,
+ /*out*/ nsTArray<uint8_t>& aAppId) {
+ for (const nsTArray<uint8_t>& app_id : aAppIds) {
+ for (const nsTArray<uint8_t>& credId : aCredentialIds) {
+ bool isRegistered = false;
+ nsresult rv = IsRegistered(credId, app_id, isRegistered);
+ if (NS_SUCCEEDED(rv) && isRegistered) {
+ aKeyHandle.Clear();
+ aKeyHandle.AppendElements(credId);
+ aAppId.Assign(app_id);
+ return true;
+ }
+ }
+ }
+
+ return false;
+}
+
+// A U2F Sign operation creates a signature over the "param" arguments (plus
+// some other stuff) using the private key indicated in the key handle argument.
+//
+// The format of the signed data is as follows:
+//
+// 32 Application parameter
+// 1 User presence (0x01)
+// 4 Counter
+// 32 Challenge parameter
+//
+// The format of the signature data is as follows:
+//
+// 1 User presence
+// 4 Counter
+// * Signature
+//
+NS_IMETHODIMP
+U2FSoftTokenTransport::GetAssertion(uint64_t aTransactionId,
+ uint64_t _aBrowsingContextId,
+ nsICtapSignArgs* args) {
+ nsresult rv;
+ if (!mInitialized) {
+ rv = Init();
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return rv;
+ }
+ }
+
+ if (NS_WARN_IF(!args)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ bool requireUserVerification = false;
+ nsString userVerification;
+ // Bug 1737205 will make this infallible
+ rv = args->GetUserVerification(userVerification);
+ if (NS_SUCCEEDED(rv)) {
+ requireUserVerification = userVerification.EqualsLiteral(
+ MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED);
+ }
+ if (requireUserVerification) {
+ return NS_ERROR_DOM_NOT_ALLOWED_ERR;
+ }
+
+ nsString rpId;
+ args->GetRpId(rpId);
+
+ nsTArray<uint8_t> clientDataHash;
+ rv = args->GetClientDataHash(clientDataHash);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return NS_ERROR_DOM_UNKNOWN_ERR;
+ }
+
+ CryptoBuffer rpIdHash;
+ rv = HashCString(NS_ConvertUTF16toUTF8(rpId), rpIdHash);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ nsTArray<nsTArray<uint8_t>> appIdHashes;
+ appIdHashes.AppendElement(std::move(rpIdHash));
+
+ nsTArray<uint8_t> appIdHash;
+ rv = args->GetAppIdHash(appIdHash);
+ if (NS_SUCCEEDED(rv)) {
+ appIdHashes.AppendElement(std::move(appIdHash));
+ }
+
+ nsTArray<nsTArray<uint8_t>> allowList;
+ args->GetAllowList(allowList);
+
+ nsTArray<uint8_t> chosenAppId;
+ nsTArray<uint8_t> keyHandle;
+
+ // Fail if we can't find a valid key handle.
+ if (!FindRegisteredKeyHandle(appIdHashes, allowList, keyHandle,
+ chosenAppId)) {
+ return NS_ERROR_DOM_INVALID_STATE_ERR;
+ }
+
+ MOZ_ASSERT(mWrappingKey);
+
+ UniquePK11SlotInfo slot(PK11_GetInternalSlot());
+ MOZ_ASSERT(slot.get());
+
+ if (NS_WARN_IF((clientDataHash.Length() != kParamLen) ||
+ (chosenAppId.Length() != kParamLen))) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Parameter lengths are wrong! challenge=%d app=%d expected=%d",
+ (uint32_t)clientDataHash.Length(), (uint32_t)chosenAppId.Length(),
+ kParamLen));
+
+ return NS_ERROR_ILLEGAL_VALUE;
+ }
+
+ // Decode the key handle
+ UniqueSECKEYPrivateKey privKey = PrivateKeyFromKeyHandle(
+ slot, mWrappingKey, const_cast<uint8_t*>(keyHandle.Elements()),
+ keyHandle.Length(), const_cast<uint8_t*>(chosenAppId.Elements()),
+ chosenAppId.Length());
+ if (NS_WARN_IF(!privKey.get())) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning, ("Couldn't get the priv key!"));
+ return NS_ERROR_FAILURE;
+ }
+
+ // Increment the counter and turn it into a SECItem
+ mCounter += 1;
+ ScopedAutoSECItem counterItem(4);
+ counterItem.data[0] = (mCounter >> 24) & 0xFF;
+ counterItem.data[1] = (mCounter >> 16) & 0xFF;
+ counterItem.data[2] = (mCounter >> 8) & 0xFF;
+ counterItem.data[3] = (mCounter >> 0) & 0xFF;
+ uint32_t counter = mCounter;
+ GetMainThreadSerialEventTarget()->Dispatch(NS_NewRunnableFunction(
+ "dom::U2FSoftTokenTransport::GetAssertion", [counter]() {
+ MOZ_ASSERT(NS_IsMainThread());
+ Preferences::SetUint(PREF_U2F_NSSTOKEN_COUNTER, counter);
+ }));
+
+ // Compute the signature
+ mozilla::dom::CryptoBuffer signedDataBuf;
+ if (NS_WARN_IF(!signedDataBuf.SetCapacity(1 + 4 + (2 * kParamLen),
+ mozilla::fallible))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ // It's OK to ignore the return values here because we're writing into
+ // pre-allocated space
+ (void)signedDataBuf.AppendElements(chosenAppId.Elements(),
+ chosenAppId.Length(), mozilla::fallible);
+ (void)signedDataBuf.AppendElement(0x01, mozilla::fallible);
+ signedDataBuf.AppendSECItem(counterItem);
+ (void)signedDataBuf.AppendElements(
+ clientDataHash.Elements(), clientDataHash.Length(), mozilla::fallible);
+
+ if (MOZ_LOG_TEST(gNSSTokenLog, LogLevel::Debug)) {
+ nsAutoCString base64;
+ rv = Base64URLEncode(signedDataBuf.Length(), signedDataBuf.Elements(),
+ Base64URLEncodePaddingPolicy::Omit, base64);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ MOZ_LOG(gNSSTokenLog, LogLevel::Debug,
+ ("U2F Token signing bytes (base64): %s", base64.get()));
+ }
+
+ ScopedAutoSECItem signatureItem;
+ SECStatus srv = SEC_SignData(&signatureItem, signedDataBuf.Elements(),
+ signedDataBuf.Length(), privKey.get(),
+ SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE);
+ if (NS_WARN_IF(srv != SECSuccess)) {
+ MOZ_LOG(gNSSTokenLog, LogLevel::Warning,
+ ("Signature failure: %d", PORT_GetError()));
+ return NS_ERROR_FAILURE;
+ }
+
+ nsTArray<WebAuthnExtensionResult> extensions;
+
+ if (appIdHashes.Length() == 2) {
+ bool usedAppId = (chosenAppId == appIdHashes[1]);
+ extensions.AppendElement(WebAuthnExtensionResultAppId(usedAppId));
+ }
+
+ CryptoBuffer counterBuf;
+ if (!counterBuf.AppendSECItem(counterItem)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ CryptoBuffer signatureBuf;
+ if (!signatureBuf.AppendSECItem(signatureItem)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ CryptoBuffer chosenAppIdBuf;
+ if (!chosenAppIdBuf.Assign(chosenAppId)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ CryptoBuffer authenticatorData;
+ CryptoBuffer emptyAttestationData;
+ rv = AssembleAuthenticatorData(chosenAppIdBuf, 0x01, counterBuf,
+ emptyAttestationData, authenticatorData);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ nsTArray<uint8_t> outSignatureBuf(std::move(signatureBuf));
+ nsTArray<uint8_t> outAuthenticatorData(std::move(authenticatorData));
+ nsTArray<uint8_t> userHandle; // unused because this is a CTAP1 token
+
+ nsTArray<RefPtr<nsICtapSignResult>> results;
+ results.AppendElement(new CtapSignResult(
+ NS_OK, std::move(keyHandle), std::move(outSignatureBuf),
+ std::move(outAuthenticatorData), std::move(userHandle),
+ std::move(chosenAppId)));
+
+ mController->FinishSign(aTransactionId, results);
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+U2FSoftTokenTransport::Cancel(void) {
+ // This implementation is sync, requests can't be aborted.
+ return NS_OK;
+}
+
+NS_IMETHODIMP
+U2FSoftTokenTransport::PinCallback(uint64_t aTransactionId,
+ const nsACString& aPin) {
+ // This is a U2F/CTAP1 token. It doesn't support pins.
+ return NS_ERROR_FAILURE;
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/U2FSoftTokenTransport.h b/dom/webauthn/U2FSoftTokenTransport.h
new file mode 100644
index 0000000000..9cf4dfda71
--- /dev/null
+++ b/dom/webauthn/U2FSoftTokenTransport.h
@@ -0,0 +1,53 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_U2FSoftTokenTransport_h
+#define mozilla_dom_U2FSoftTokenTransport_h
+
+#include "nsIWebAuthnController.h"
+#include "ScopedNSSTypes.h"
+
+/*
+ * U2FSoftTokenManager is a software implementation of a secure token manager
+ * for the U2F and WebAuthn APIs.
+ */
+
+namespace mozilla::dom {
+
+class U2FSoftTokenTransport final : public nsIWebAuthnTransport {
+ public:
+ NS_DECL_ISUPPORTS
+ NS_DECL_NSIWEBAUTHNTRANSPORT
+
+ explicit U2FSoftTokenTransport(uint32_t aCounter);
+
+ private:
+ ~U2FSoftTokenTransport() = default;
+ nsresult Init();
+
+ nsresult IsRegistered(const nsTArray<uint8_t>& aKeyHandle,
+ const nsTArray<uint8_t>& aAppParam, bool& aResult);
+
+ bool FindRegisteredKeyHandle(
+ const nsTArray<nsTArray<uint8_t>>& aAppIds,
+ const nsTArray<nsTArray<uint8_t>>& aCredentialIds,
+ /*out*/ nsTArray<uint8_t>& aKeyHandle,
+ /*out*/ nsTArray<uint8_t>& aAppId);
+
+ bool mInitialized;
+ mozilla::UniquePK11SymKey mWrappingKey;
+
+ static const nsCString mSecretNickname;
+
+ nsresult GetOrCreateWrappingKey(const mozilla::UniquePK11SlotInfo& aSlot);
+ uint32_t mCounter;
+
+ nsCOMPtr<nsIWebAuthnController> mController;
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_U2FSoftTokenTransport_h
diff --git a/dom/webauthn/U2FTokenManager.cpp b/dom/webauthn/U2FTokenManager.cpp
new file mode 100644
index 0000000000..21704d2764
--- /dev/null
+++ b/dom/webauthn/U2FTokenManager.cpp
@@ -0,0 +1,542 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+#include "json/json.h"
+#include "mozilla/dom/U2FTokenManager.h"
+#include "mozilla/dom/U2FTokenTransport.h"
+#include "mozilla/dom/PWebAuthnTransactionParent.h"
+#include "mozilla/MozPromise.h"
+#include "mozilla/dom/WebAuthnUtil.h"
+#include "mozilla/ipc/BackgroundParent.h"
+#include "mozilla/ClearOnShutdown.h"
+#include "mozilla/Preferences.h"
+#include "mozilla/Services.h"
+#include "mozilla/Unused.h"
+#include "nsEscape.h"
+#include "nsIObserver.h"
+#include "nsIObserverService.h"
+#include "nsIThread.h"
+#include "nsTextFormatter.h"
+#include "mozilla/Telemetry.h"
+#include "WebAuthnEnumStrings.h"
+
+#ifdef MOZ_WIDGET_ANDROID
+# include "mozilla/dom/AndroidWebAuthnTokenManager.h"
+#endif
+
+#define PREF_WEBAUTHN_USBTOKEN_ENABLED \
+ "security.webauth.webauthn_enable_usbtoken"
+#define PREF_WEBAUTHN_ALLOW_DIRECT_ATTESTATION \
+ "security.webauth.webauthn_testing_allow_direct_attestation"
+#define PREF_WEBAUTHN_ANDROID_FIDO2_ENABLED \
+ "security.webauth.webauthn_enable_android_fido2"
+namespace mozilla::dom {
+
+/***********************************************************************
+ * Statics
+ **********************************************************************/
+
+class U2FPrefManager;
+
+namespace {
+static mozilla::LazyLogModule gU2FTokenManagerLog("u2fkeymanager");
+StaticRefPtr<U2FTokenManager> gU2FTokenManager;
+StaticRefPtr<U2FPrefManager> gPrefManager;
+static nsIThread* gBackgroundThread;
+} // namespace
+
+// Data for WebAuthn UI prompt notifications.
+static const char16_t kPresencePromptNotificationU2F[] =
+ u"{\"is_ctap2\":false,\"action\":\"presence\",\"tid\":%llu,"
+ u"\"origin\":\"%s\",\"browsingContextId\":%llu}";
+static const char16_t kRegisterDirectPromptNotificationU2F[] =
+ u"{\"is_ctap2\":false,\"action\":\"register-direct\",\"tid\":%llu,"
+ u"\"origin\":\"%s\",\"browsingContextId\":%llu}";
+static const char16_t kCancelPromptNotificationU2F[] =
+ u"{\"is_ctap2\":false,\"action\":\"cancel\",\"tid\":%llu}";
+
+class U2FPrefManager final : public nsIObserver {
+ private:
+ U2FPrefManager() : mPrefMutex("U2FPrefManager Mutex") { UpdateValues(); }
+ ~U2FPrefManager() = default;
+
+ public:
+ NS_DECL_ISUPPORTS
+
+ static U2FPrefManager* GetOrCreate() {
+ MOZ_ASSERT(NS_IsMainThread());
+ if (!gPrefManager) {
+ gPrefManager = new U2FPrefManager();
+ Preferences::AddStrongObserver(gPrefManager,
+ PREF_WEBAUTHN_USBTOKEN_ENABLED);
+ Preferences::AddStrongObserver(gPrefManager,
+ PREF_WEBAUTHN_ANDROID_FIDO2_ENABLED);
+ Preferences::AddStrongObserver(gPrefManager,
+ PREF_WEBAUTHN_ALLOW_DIRECT_ATTESTATION);
+ ClearOnShutdown(&gPrefManager, ShutdownPhase::XPCOMShutdownThreads);
+ }
+ return gPrefManager;
+ }
+
+ static U2FPrefManager* Get() { return gPrefManager; }
+
+ bool GetAndroidFido2Enabled() {
+ MutexAutoLock lock(mPrefMutex);
+ return mAndroidFido2Enabled;
+ }
+
+ bool GetAllowDirectAttestationForTesting() {
+ MutexAutoLock lock(mPrefMutex);
+ return mAllowDirectAttestation;
+ }
+
+ NS_IMETHODIMP
+ Observe(nsISupports* aSubject, const char* aTopic,
+ const char16_t* aData) override {
+ UpdateValues();
+ return NS_OK;
+ }
+
+ private:
+ void UpdateValues() {
+ MOZ_ASSERT(NS_IsMainThread());
+ MutexAutoLock lock(mPrefMutex);
+ mUsbTokenEnabled = Preferences::GetBool(PREF_WEBAUTHN_USBTOKEN_ENABLED);
+ mAndroidFido2Enabled =
+ Preferences::GetBool(PREF_WEBAUTHN_ANDROID_FIDO2_ENABLED);
+ mAllowDirectAttestation =
+ Preferences::GetBool(PREF_WEBAUTHN_ALLOW_DIRECT_ATTESTATION);
+ }
+
+ Mutex mPrefMutex MOZ_UNANNOTATED;
+ bool mUsbTokenEnabled;
+ bool mAndroidFido2Enabled;
+ bool mAllowDirectAttestation;
+};
+
+NS_IMPL_ISUPPORTS(U2FPrefManager, nsIObserver);
+
+/***********************************************************************
+ * U2FManager Implementation
+ **********************************************************************/
+
+NS_IMPL_ISUPPORTS(U2FTokenManager, nsIU2FTokenManager);
+
+U2FTokenManager::U2FTokenManager()
+ : mTransactionParent(nullptr), mLastTransactionId(0) {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ // Create on the main thread to make sure ClearOnShutdown() works.
+ MOZ_ASSERT(NS_IsMainThread());
+ // Create the preference manager while we're initializing.
+ U2FPrefManager::GetOrCreate();
+}
+
+// static
+void U2FTokenManager::Initialize() {
+ if (!XRE_IsParentProcess()) {
+ return;
+ }
+ MOZ_ASSERT(NS_IsMainThread());
+ MOZ_ASSERT(!gU2FTokenManager);
+ gU2FTokenManager = new U2FTokenManager();
+ ClearOnShutdown(&gU2FTokenManager);
+}
+
+// static
+U2FTokenManager* U2FTokenManager::Get() {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ // We should only be accessing this on the background thread
+ MOZ_ASSERT(!NS_IsMainThread());
+ return gU2FTokenManager;
+}
+
+void U2FTokenManager::AbortTransaction(const uint64_t& aTransactionId,
+ const nsresult& aError,
+ bool shouldCancelActiveDialog) {
+ Unused << mTransactionParent->SendAbort(aTransactionId, aError);
+ ClearTransaction(shouldCancelActiveDialog);
+}
+
+void U2FTokenManager::AbortOngoingTransaction() {
+ if (mLastTransactionId > 0 && mTransactionParent) {
+ // Send an abort to any other ongoing transaction
+ Unused << mTransactionParent->SendAbort(mLastTransactionId,
+ NS_ERROR_DOM_ABORT_ERR);
+ }
+ ClearTransaction(true);
+}
+
+void U2FTokenManager::MaybeClearTransaction(
+ PWebAuthnTransactionParent* aParent) {
+ // Only clear if we've been requested to do so by our current transaction
+ // parent.
+ if (mTransactionParent == aParent) {
+ ClearTransaction(true);
+ }
+}
+
+void U2FTokenManager::ClearTransaction(bool send_cancel) {
+ if (mLastTransactionId && send_cancel) {
+ // Remove any prompts we might be showing for the current transaction.
+ SendPromptNotification(kCancelPromptNotificationU2F, mLastTransactionId);
+ }
+ mTransactionParent = nullptr;
+
+ // Drop managers at the end of all transactions
+ if (mTokenManagerImpl) {
+ mTokenManagerImpl->Drop();
+ mTokenManagerImpl = nullptr;
+ }
+
+ // Forget promises, if necessary.
+ mRegisterPromise.DisconnectIfExists();
+ mSignPromise.DisconnectIfExists();
+
+ // Clear transaction id.
+ mLastTransactionId = 0;
+
+ // Forget any pending registration.
+ mPendingRegisterInfo.reset();
+ mPendingSignInfo.reset();
+ mPendingSignResults.Clear();
+}
+
+template <typename... T>
+void U2FTokenManager::SendPromptNotification(const char16_t* aFormat,
+ T... aArgs) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ nsAutoString json;
+ nsTextFormatter::ssprintf(json, aFormat, aArgs...);
+
+ nsCOMPtr<nsIRunnable> r(NewRunnableMethod<nsString>(
+ "U2FTokenManager::RunSendPromptNotification", this,
+ &U2FTokenManager::RunSendPromptNotification, json));
+
+ MOZ_ALWAYS_SUCCEEDS(GetMainThreadSerialEventTarget()->Dispatch(
+ r.forget(), NS_DISPATCH_NORMAL));
+}
+
+void U2FTokenManager::RunSendPromptNotification(const nsString& aJSON) {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ nsCOMPtr<nsIObserverService> os = services::GetObserverService();
+ if (NS_WARN_IF(!os)) {
+ return;
+ }
+
+ nsCOMPtr<nsIU2FTokenManager> self = this;
+ MOZ_ALWAYS_SUCCEEDS(
+ os->NotifyObservers(self, "webauthn-prompt", aJSON.get()));
+}
+
+RefPtr<U2FTokenTransport> U2FTokenManager::GetTokenManagerImpl() {
+ MOZ_ASSERT(U2FPrefManager::Get());
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ if (mTokenManagerImpl) {
+ return mTokenManagerImpl;
+ }
+
+ if (!gBackgroundThread) {
+ gBackgroundThread = NS_GetCurrentThread();
+ MOZ_ASSERT(gBackgroundThread, "This should never be null!");
+ }
+
+#ifdef MOZ_WIDGET_ANDROID
+ // On Android, prefer the platform support if enabled.
+ if (U2FPrefManager::Get()->GetAndroidFido2Enabled()) {
+ return AndroidWebAuthnTokenManager::GetInstance();
+ }
+#endif
+
+ return nullptr;
+}
+
+void U2FTokenManager::Register(
+ PWebAuthnTransactionParent* aTransactionParent,
+ const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialInfo& aTransactionInfo) {
+ MOZ_LOG(gU2FTokenManagerLog, LogLevel::Debug, ("U2FAuthRegister"));
+
+ AbortOngoingTransaction();
+ mTransactionParent = aTransactionParent;
+ mTokenManagerImpl = GetTokenManagerImpl();
+
+ if (!mTokenManagerImpl) {
+ AbortTransaction(aTransactionId, NS_ERROR_DOM_NOT_ALLOWED_ERR, true);
+ return;
+ }
+
+ mLastTransactionId = aTransactionId;
+
+ // Determine whether direct attestation was requested.
+ bool noneAttestationRequested = true;
+
+// On Android, let's always reject direct attestations until we have a
+// mechanism to solicit user consent, from Bug 1550164
+#ifndef MOZ_WIDGET_ANDROID
+ // The default attestation type is "none", so set
+ // noneAttestationRequested=false only if the RP's preference matches one of
+ // the other known types. This needs to be reviewed if values are added to
+ // the AttestationConveyancePreference enum.
+ const nsString& attestation =
+ aTransactionInfo.attestationConveyancePreference();
+ static_assert(MOZ_WEBAUTHN_ENUM_STRINGS_VERSION == 2);
+ if (attestation.EqualsLiteral(
+ MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT) ||
+ attestation.EqualsLiteral(
+ MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_INDIRECT) ||
+ attestation.EqualsLiteral(
+ MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_ENTERPRISE)) {
+ noneAttestationRequested = false;
+ }
+#endif // not MOZ_WIDGET_ANDROID
+
+ // Start a register request immediately if direct attestation
+ // wasn't requested or the test pref is set.
+ if (noneAttestationRequested ||
+ U2FPrefManager::Get()->GetAllowDirectAttestationForTesting()) {
+ MOZ_ASSERT(mPendingRegisterInfo.isNothing());
+ mPendingRegisterInfo = Some(aTransactionInfo);
+ DoRegister(aTransactionInfo, noneAttestationRequested);
+ return;
+ }
+
+ // If the RP request direct attestation, ask the user for permission and
+ // store the transaction info until the user proceeds or cancels.
+ NS_ConvertUTF16toUTF8 origin(aTransactionInfo.Origin());
+ SendPromptNotification(kRegisterDirectPromptNotificationU2F, aTransactionId,
+ origin.get(), aTransactionInfo.BrowsingContextId());
+
+ MOZ_ASSERT(mPendingRegisterInfo.isNothing());
+ mPendingRegisterInfo = Some(aTransactionInfo);
+}
+
+void U2FTokenManager::DoRegister(const WebAuthnMakeCredentialInfo& aInfo,
+ bool aForceNoneAttestation) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ MOZ_ASSERT(mLastTransactionId > 0);
+
+ // Show a prompt that lets the user cancel the ongoing transaction.
+ NS_ConvertUTF16toUTF8 origin(aInfo.Origin());
+ SendPromptNotification(kPresencePromptNotificationU2F, mLastTransactionId,
+ origin.get(), aInfo.BrowsingContextId(), "false");
+
+ uint64_t tid = mLastTransactionId;
+
+ mTokenManagerImpl->Register(aInfo, aForceNoneAttestation)
+ ->Then(
+ GetCurrentSerialEventTarget(), __func__,
+ [tid](WebAuthnMakeCredentialResult&& aResult) {
+ Telemetry::ScalarAdd(Telemetry::ScalarID::SECURITY_WEBAUTHN_USED,
+ u"U2FRegisterFinish"_ns, 1);
+ U2FTokenManager* mgr = U2FTokenManager::Get();
+ mgr->MaybeConfirmRegister(tid, aResult);
+ },
+ [tid](nsresult rv) {
+ MOZ_ASSERT(NS_FAILED(rv));
+ U2FTokenManager* mgr = U2FTokenManager::Get();
+ bool shouldCancelActiveDialog = true;
+ if (rv == NS_ERROR_DOM_OPERATION_ERR) {
+ // PIN-related errors. Let the dialog show to inform the user
+ shouldCancelActiveDialog = false;
+ }
+ Telemetry::ScalarAdd(Telemetry::ScalarID::SECURITY_WEBAUTHN_USED,
+ u"U2FRegisterAbort"_ns, 1);
+ mgr->MaybeAbortRegister(tid, rv, shouldCancelActiveDialog);
+ })
+ ->Track(mRegisterPromise);
+}
+
+void U2FTokenManager::MaybeConfirmRegister(
+ const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialResult& aResult) {
+ MOZ_ASSERT(mLastTransactionId == aTransactionId);
+ mRegisterPromise.Complete();
+
+ Unused << mTransactionParent->SendConfirmRegister(aTransactionId, aResult);
+ ClearTransaction(true);
+}
+
+void U2FTokenManager::MaybeAbortRegister(const uint64_t& aTransactionId,
+ const nsresult& aError,
+ bool shouldCancelActiveDialog) {
+ MOZ_ASSERT(mLastTransactionId == aTransactionId);
+ mRegisterPromise.Complete();
+ AbortTransaction(aTransactionId, aError, shouldCancelActiveDialog);
+}
+
+void U2FTokenManager::Sign(PWebAuthnTransactionParent* aTransactionParent,
+ const uint64_t& aTransactionId,
+ const WebAuthnGetAssertionInfo& aTransactionInfo) {
+ MOZ_LOG(gU2FTokenManagerLog, LogLevel::Debug, ("U2FAuthSign"));
+
+ AbortOngoingTransaction();
+ mTransactionParent = aTransactionParent;
+ mTokenManagerImpl = GetTokenManagerImpl();
+
+ if (!mTokenManagerImpl) {
+ AbortTransaction(aTransactionId, NS_ERROR_DOM_NOT_ALLOWED_ERR, true);
+ return;
+ }
+
+ mLastTransactionId = aTransactionId;
+ mPendingSignInfo = Some(aTransactionInfo);
+ DoSign(aTransactionInfo);
+}
+
+void U2FTokenManager::DoSign(const WebAuthnGetAssertionInfo& aTransactionInfo) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ MOZ_ASSERT(mLastTransactionId > 0);
+ uint64_t tid = mLastTransactionId;
+
+ NS_ConvertUTF16toUTF8 origin(aTransactionInfo.Origin());
+ uint64_t browserCtxId = aTransactionInfo.BrowsingContextId();
+
+ // Show a prompt that lets the user cancel the ongoing transaction.
+ SendPromptNotification(kPresencePromptNotificationU2F, tid, origin.get(),
+ browserCtxId, "false");
+
+ mTokenManagerImpl->Sign(aTransactionInfo)
+ ->Then(
+ GetCurrentSerialEventTarget(), __func__,
+ [tid, origin](nsTArray<WebAuthnGetAssertionResultWrapper>&& aResult) {
+ U2FTokenManager* mgr = U2FTokenManager::Get();
+ Telemetry::ScalarAdd(Telemetry::ScalarID::SECURITY_WEBAUTHN_USED,
+ u"U2FSignFinish"_ns, 1);
+ if (aResult.Length() == 1) {
+ WebAuthnGetAssertionResult result = aResult[0].assertion;
+ mgr->MaybeConfirmSign(tid, result);
+ }
+ },
+ [tid](nsresult rv) {
+ MOZ_ASSERT(NS_FAILED(rv));
+ U2FTokenManager* mgr = U2FTokenManager::Get();
+ bool shouldCancelActiveDialog = true;
+ if (rv == NS_ERROR_DOM_OPERATION_ERR) {
+ // PIN-related errors. Let the dialog show to inform the user
+ shouldCancelActiveDialog = false;
+ }
+ Telemetry::ScalarAdd(Telemetry::ScalarID::SECURITY_WEBAUTHN_USED,
+ u"U2FSignAbort"_ns, 1);
+ mgr->MaybeAbortSign(tid, rv, shouldCancelActiveDialog);
+ })
+ ->Track(mSignPromise);
+}
+
+void U2FTokenManager::MaybeConfirmSign(
+ const uint64_t& aTransactionId, const WebAuthnGetAssertionResult& aResult) {
+ MOZ_ASSERT(mLastTransactionId == aTransactionId);
+ mSignPromise.Complete();
+
+ Unused << mTransactionParent->SendConfirmSign(aTransactionId, aResult);
+ ClearTransaction(true);
+}
+
+void U2FTokenManager::MaybeAbortSign(const uint64_t& aTransactionId,
+ const nsresult& aError,
+ bool shouldCancelActiveDialog) {
+ MOZ_ASSERT(mLastTransactionId == aTransactionId);
+ mSignPromise.Complete();
+ AbortTransaction(aTransactionId, aError, shouldCancelActiveDialog);
+}
+
+void U2FTokenManager::Cancel(PWebAuthnTransactionParent* aParent,
+ const Tainted<uint64_t>& aTransactionId) {
+ // The last transaction ID also suffers from the issue described in Bug
+ // 1696159. A content process could cancel another content processes
+ // transaction by guessing the last transaction ID.
+ if (mTransactionParent != aParent ||
+ !MOZ_IS_VALID(aTransactionId, mLastTransactionId == aTransactionId)) {
+ return;
+ }
+
+ mTokenManagerImpl->Cancel();
+ ClearTransaction(true);
+}
+
+// nsIU2FTokenManager
+
+NS_IMETHODIMP
+U2FTokenManager::ResumeRegister(uint64_t aTransactionId,
+ bool aForceNoneAttestation) {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ MOZ_ASSERT(NS_IsMainThread());
+
+ if (!gBackgroundThread) {
+ return NS_ERROR_FAILURE;
+ }
+
+ nsCOMPtr<nsIRunnable> r(NewRunnableMethod<uint64_t, bool>(
+ "U2FTokenManager::RunResumeRegister", this,
+ &U2FTokenManager::RunResumeRegister, aTransactionId,
+ aForceNoneAttestation));
+
+ return gBackgroundThread->Dispatch(r.forget(), NS_DISPATCH_NORMAL);
+}
+
+void U2FTokenManager::RunResumeRegister(uint64_t aTransactionId,
+ bool aForceNoneAttestation) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ if (NS_WARN_IF(mPendingRegisterInfo.isNothing())) {
+ return;
+ }
+
+ if (mLastTransactionId != aTransactionId) {
+ return;
+ }
+
+ // Resume registration and cleanup.
+ DoRegister(mPendingRegisterInfo.ref(), aForceNoneAttestation);
+}
+
+void U2FTokenManager::RunResumeSign(uint64_t aTransactionId) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ if (NS_WARN_IF(mPendingSignInfo.isNothing())) {
+ return;
+ }
+
+ if (mLastTransactionId != aTransactionId) {
+ return;
+ }
+
+ // Resume sign and cleanup.
+ DoSign(mPendingSignInfo.ref());
+}
+
+NS_IMETHODIMP
+U2FTokenManager::Cancel(uint64_t aTransactionId) {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ MOZ_ASSERT(NS_IsMainThread());
+
+ if (!gBackgroundThread) {
+ return NS_ERROR_FAILURE;
+ }
+
+ nsCOMPtr<nsIRunnable> r(
+ NewRunnableMethod<uint64_t>("U2FTokenManager::RunCancel", this,
+ &U2FTokenManager::RunCancel, aTransactionId));
+
+ return gBackgroundThread->Dispatch(r.forget(), NS_DISPATCH_NORMAL);
+}
+
+void U2FTokenManager::RunCancel(uint64_t aTransactionId) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ if (mLastTransactionId != aTransactionId) {
+ return;
+ }
+
+ // Cancel the request.
+ mTokenManagerImpl->Cancel();
+
+ // Reject the promise.
+ AbortTransaction(aTransactionId, NS_ERROR_DOM_NOT_ALLOWED_ERR, true);
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/U2FTokenManager.h b/dom/webauthn/U2FTokenManager.h
new file mode 100644
index 0000000000..83c9b14b11
--- /dev/null
+++ b/dom/webauthn/U2FTokenManager.h
@@ -0,0 +1,117 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_U2FTokenManager_h
+#define mozilla_dom_U2FTokenManager_h
+
+#include "nsIU2FTokenManager.h"
+#include "mozilla/dom/U2FTokenTransport.h"
+#include "mozilla/dom/PWebAuthnTransaction.h"
+#include "mozilla/Tainting.h"
+
+/*
+ * Parent process manager for U2F and WebAuthn API transactions. Handles process
+ * transactions from all content processes, make sure only one transaction is
+ * live at any time. Manages access to hardware and software based key systems.
+ *
+ * U2FTokenManager is created on the first access to functions of either the U2F
+ * or WebAuthn APIs that require key registration or signing. It lives until the
+ * end of the browser process.
+ */
+
+namespace mozilla::dom {
+
+class U2FSoftTokenManager;
+class WebAuthnTransactionParent;
+
+class U2FTokenManager final : public nsIU2FTokenManager {
+ public:
+ NS_DECL_THREADSAFE_ISUPPORTS
+ NS_DECL_NSIU2FTOKENMANAGER
+
+ static U2FTokenManager* Get();
+ void Register(PWebAuthnTransactionParent* aTransactionParent,
+ const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialInfo& aTransactionInfo);
+ void Sign(PWebAuthnTransactionParent* aTransactionParent,
+ const uint64_t& aTransactionId,
+ const WebAuthnGetAssertionInfo& aTransactionInfo);
+ void Cancel(PWebAuthnTransactionParent* aTransactionParent,
+ const Tainted<uint64_t>& aTransactionId);
+ void MaybeClearTransaction(PWebAuthnTransactionParent* aParent);
+ static void Initialize();
+
+ Maybe<nsString> GetCurrentOrigin() {
+ if (mPendingRegisterInfo.isSome()) {
+ return Some(mPendingRegisterInfo.value().Origin());
+ }
+
+ if (mPendingSignInfo.isSome()) {
+ return Some(mPendingSignInfo.value().Origin());
+ }
+ return Nothing();
+ }
+
+ uint64_t GetCurrentTransactionId() { return mLastTransactionId; }
+
+ bool CurrentTransactionIsRegister() { return mPendingRegisterInfo.isSome(); }
+
+ bool CurrentTransactionIsSign() { return mPendingSignInfo.isSome(); }
+
+ // Sends a "webauthn-prompt" observer notification with the given data.
+ template <typename... T>
+ void SendPromptNotification(const char16_t* aFormat, T... aArgs);
+ // The main thread runnable function for "SendPromptNotification".
+ void RunSendPromptNotification(const nsString& aJSON);
+
+ private:
+ U2FTokenManager();
+ ~U2FTokenManager() = default;
+ RefPtr<U2FTokenTransport> GetTokenManagerImpl();
+ void AbortTransaction(const uint64_t& aTransactionId, const nsresult& aError,
+ bool shouldCancelActiveDialog);
+ void AbortOngoingTransaction();
+ void ClearTransaction(bool send_cancel);
+ // Step two of "Register", kicking off the actual transaction.
+ void DoRegister(const WebAuthnMakeCredentialInfo& aInfo,
+ bool aForceNoneAttestation);
+ void DoSign(const WebAuthnGetAssertionInfo& aTransactionInfo);
+ void MaybeConfirmRegister(const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialResult& aResult);
+ void MaybeAbortRegister(const uint64_t& aTransactionId,
+ const nsresult& aError,
+ bool shouldCancelActiveDialog);
+ void MaybeConfirmSign(const uint64_t& aTransactionId,
+ const WebAuthnGetAssertionResult& aResult);
+ void MaybeAbortSign(const uint64_t& aTransactionId, const nsresult& aError,
+ bool shouldCancelActiveDialog);
+ // The main thread runnable function for "nsIU2FTokenManager.ResumeRegister".
+ void RunResumeRegister(uint64_t aTransactionId, bool aForceNoneAttestation);
+ void RunResumeSign(uint64_t aTransactionId);
+ void RunResumeWithSelectedSignResult(uint64_t aTransactionId, uint64_t idx);
+ // The main thread runnable function for "nsIU2FTokenManager.Cancel".
+ void RunCancel(uint64_t aTransactionId);
+ // Using a raw pointer here, as the lifetime of the IPC object is managed by
+ // the PBackground protocol code. This means we cannot be left holding an
+ // invalid IPC protocol object after the transaction is finished.
+ PWebAuthnTransactionParent* mTransactionParent;
+ RefPtr<U2FTokenTransport> mTokenManagerImpl;
+ MozPromiseRequestHolder<U2FRegisterPromise> mRegisterPromise;
+ MozPromiseRequestHolder<U2FSignPromise> mSignPromise;
+ // The last transaction id, non-zero if there's an active transaction. This
+ // guards any cancel messages to ensure we don't cancel newer transactions
+ // due to a stale message.
+ uint64_t mLastTransactionId;
+ // Pending registration info while we wait for user input.
+ Maybe<WebAuthnMakeCredentialInfo> mPendingRegisterInfo;
+ // Pending registration info while we wait for user input.
+ Maybe<WebAuthnGetAssertionInfo> mPendingSignInfo;
+ nsTArray<WebAuthnGetAssertionResultWrapper> mPendingSignResults;
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_U2FTokenManager_h
diff --git a/dom/webauthn/U2FTokenTransport.h b/dom/webauthn/U2FTokenTransport.h
new file mode 100644
index 0000000000..0c6d80bdf3
--- /dev/null
+++ b/dom/webauthn/U2FTokenTransport.h
@@ -0,0 +1,53 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_U2FTokenTransport_h
+#define mozilla_dom_U2FTokenTransport_h
+
+#include "mozilla/dom/PWebAuthnTransaction.h"
+#include "mozilla/MozPromise.h"
+
+/*
+ * Abstract class representing a transport manager for U2F Keys (software,
+ * bluetooth, usb, etc.). Hides the implementation details for specific key
+ * transport types.
+ */
+
+namespace mozilla::dom {
+
+class WebAuthnGetAssertionResultWrapper {
+ public:
+ WebAuthnGetAssertionResult assertion;
+ mozilla::Maybe<nsCString> username;
+};
+
+typedef MozPromise<WebAuthnMakeCredentialResult, nsresult, true>
+ U2FRegisterPromise;
+typedef MozPromise<nsTArray<WebAuthnGetAssertionResultWrapper>, nsresult, true>
+ U2FSignPromise;
+
+class U2FTokenTransport {
+ public:
+ NS_INLINE_DECL_THREADSAFE_REFCOUNTING(U2FTokenTransport);
+ U2FTokenTransport() = default;
+
+ virtual RefPtr<U2FRegisterPromise> Register(
+ const WebAuthnMakeCredentialInfo& aInfo, bool aForceNoneAttestation) = 0;
+
+ virtual RefPtr<U2FSignPromise> Sign(
+ const WebAuthnGetAssertionInfo& aInfo) = 0;
+
+ virtual void Cancel() = 0;
+
+ virtual void Drop() {}
+
+ protected:
+ virtual ~U2FTokenTransport() = default;
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_U2FTokenTransport_h
diff --git a/dom/webauthn/WebAuthnCBORUtil.cpp b/dom/webauthn/WebAuthnCBORUtil.cpp
new file mode 100644
index 0000000000..51255e80d8
--- /dev/null
+++ b/dom/webauthn/WebAuthnCBORUtil.cpp
@@ -0,0 +1,128 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "cbor-cpp/src/cbor.h"
+#include "mozilla/dom/WebAuthnCBORUtil.h"
+#include "mozilla/dom/WebAuthnUtil.h"
+
+namespace mozilla::dom {
+
+nsresult CBOREncodePublicKeyObj(const CryptoBuffer& aPubKeyBuf,
+ /* out */ CryptoBuffer& aPubKeyObj) {
+ mozilla::dom::CryptoBuffer xBuf, yBuf;
+ nsresult rv = U2FDecomposeECKey(aPubKeyBuf, xBuf, yBuf);
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+
+ // COSE_Key object. See https://tools.ietf.org/html/rfc8152#section-7
+ cbor::output_dynamic cborPubKeyOut;
+ cbor::encoder encoder(cborPubKeyOut);
+ encoder.write_map(5);
+ {
+ encoder.write_int(1); // kty
+ encoder.write_int(2); // EC2
+ encoder.write_int(3); // alg
+ encoder.write_int(-7); // ES256
+
+ // See https://tools.ietf.org/html/rfc8152#section-13.1
+ encoder.write_int(-1); // crv
+ encoder.write_int(1); // P-256
+ encoder.write_int(-2); // x
+ encoder.write_bytes(xBuf.Elements(), xBuf.Length());
+ encoder.write_int(-3); // y
+ encoder.write_bytes(yBuf.Elements(), yBuf.Length());
+ }
+
+ if (!aPubKeyObj.Assign(cborPubKeyOut.data(), cborPubKeyOut.size())) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ return NS_OK;
+}
+
+nsresult CBOREncodeFidoU2FAttestationObj(
+ const CryptoBuffer& aAuthDataBuf, const CryptoBuffer& aAttestationCertBuf,
+ const CryptoBuffer& aSignatureBuf,
+ /* out */ CryptoBuffer& aAttestationObj) {
+ /*
+ Attestation Object, encoded in CBOR (description is CDDL)
+
+ attObj = {
+ authData: bytes,
+ $$attStmtType
+ }
+ $$attStmtType //= (
+ fmt: "fido-u2f",
+ attStmt: u2fStmtFormat
+ )
+ u2fStmtFormat = {
+ x5c: [ attestnCert: bytes, * (caCert: bytes) ],
+ sig: bytes
+ }
+ */
+ cbor::output_dynamic cborAttOut;
+ cbor::encoder encoder(cborAttOut);
+ encoder.write_map(3);
+ {
+ encoder.write_string("fmt");
+ encoder.write_string("fido-u2f");
+
+ encoder.write_string("attStmt");
+ encoder.write_map(2);
+ {
+ encoder.write_string("sig");
+ encoder.write_bytes(aSignatureBuf.Elements(), aSignatureBuf.Length());
+
+ encoder.write_string("x5c");
+ // U2F wire protocol can only deliver 1 certificate, so it's never a chain
+ encoder.write_array(1);
+ encoder.write_bytes(aAttestationCertBuf.Elements(),
+ aAttestationCertBuf.Length());
+ }
+
+ encoder.write_string("authData");
+ encoder.write_bytes(aAuthDataBuf.Elements(), aAuthDataBuf.Length());
+ }
+
+ if (!aAttestationObj.Assign(cborAttOut.data(), cborAttOut.size())) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ return NS_OK;
+}
+
+nsresult CBOREncodeNoneAttestationObj(const CryptoBuffer& aAuthDataBuf,
+ /* out */ CryptoBuffer& aAttestationObj) {
+ /*
+ Attestation Object, encoded in CBOR (description is CDDL)
+
+ $$attStmtType //= (
+ fmt: "none",
+ attStmt: emptyMap
+ )
+
+ emptyMap = {}
+ */
+ cbor::output_dynamic cborAttOut;
+ cbor::encoder encoder(cborAttOut);
+ encoder.write_map(3);
+ {
+ encoder.write_string("fmt");
+ encoder.write_string("none");
+
+ encoder.write_string("attStmt");
+ encoder.write_map(0);
+
+ encoder.write_string("authData");
+ encoder.write_bytes(aAuthDataBuf.Elements(), aAuthDataBuf.Length());
+ }
+
+ if (!aAttestationObj.Assign(cborAttOut.data(), cborAttOut.size())) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ return NS_OK;
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/WebAuthnCBORUtil.h b/dom/webauthn/WebAuthnCBORUtil.h
new file mode 100644
index 0000000000..8816716989
--- /dev/null
+++ b/dom/webauthn/WebAuthnCBORUtil.h
@@ -0,0 +1,30 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WebAuthnCBORUtil_h
+#define mozilla_dom_WebAuthnCBORUtil_h
+
+/*
+ * Serialize and deserialize CBOR data formats for WebAuthn
+ */
+
+#include "mozilla/dom/CryptoBuffer.h"
+
+namespace mozilla::dom {
+
+nsresult CBOREncodePublicKeyObj(const CryptoBuffer& aPubKeyBuf,
+ /* out */ CryptoBuffer& aPubKeyObj);
+
+nsresult CBOREncodeFidoU2FAttestationObj(
+ const CryptoBuffer& aAuthDataBuf, const CryptoBuffer& aAttestationCertBuf,
+ const CryptoBuffer& aSignatureBuf,
+ /* out */ CryptoBuffer& aAttestationObj);
+
+nsresult CBOREncodeNoneAttestationObj(const CryptoBuffer& aAuthDataBuf,
+ /* out */ CryptoBuffer& aAttestationObj);
+
+} // namespace mozilla::dom
+#endif // mozilla_dom_WebAuthnCBORUtil_h
diff --git a/dom/webauthn/WebAuthnController.cpp b/dom/webauthn/WebAuthnController.cpp
new file mode 100644
index 0000000000..c089baaca3
--- /dev/null
+++ b/dom/webauthn/WebAuthnController.cpp
@@ -0,0 +1,739 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "json/json.h"
+#include "mozilla/dom/WebAuthnController.h"
+#include "mozilla/dom/PWebAuthnTransactionParent.h"
+#include "mozilla/dom/WebAuthnUtil.h"
+#include "mozilla/ipc/BackgroundParent.h"
+#include "mozilla/ClearOnShutdown.h"
+#include "mozilla/Preferences.h"
+#include "mozilla/Services.h"
+#include "mozilla/StaticPrefs_security.h"
+#include "mozilla/Unused.h"
+#include "nsEscape.h"
+#include "nsIObserver.h"
+#include "nsIObserverService.h"
+#include "nsIThread.h"
+#include "nsTextFormatter.h"
+#include "mozilla/Telemetry.h"
+
+#include "AuthrsTransport.h"
+#include "CtapArgs.h"
+#include "CtapResults.h"
+#include "U2FSoftTokenTransport.h"
+#include "WebAuthnEnumStrings.h"
+
+#ifdef MOZ_WIDGET_ANDROID
+# include "mozilla/dom/AndroidWebAuthnTokenManager.h"
+#endif
+
+namespace mozilla::dom {
+
+/***********************************************************************
+ * Statics
+ **********************************************************************/
+
+namespace {
+static mozilla::LazyLogModule gWebAuthnControllerLog("webauthncontroller");
+StaticRefPtr<WebAuthnController> gWebAuthnController;
+static nsIThread* gWebAuthnBackgroundThread;
+} // namespace
+
+// Data for WebAuthn UI prompt notifications.
+static const char16_t kPresencePromptNotification[] =
+ u"{\"is_ctap2\":true,\"action\":\"presence\",\"tid\":%llu,"
+ u"\"origin\":\"%s\",\"browsingContextId\":%llu}";
+static const char16_t kRegisterDirectPromptNotification[] =
+ u"{\"is_ctap2\":true,\"action\":\"register-direct\",\"tid\":%llu,"
+ u"\"origin\":\"%s\",\"browsingContextId\":%llu}";
+static const char16_t kCancelPromptNotification[] =
+ u"{\"is_ctap2\":true,\"action\":\"cancel\",\"tid\":%llu}";
+static const char16_t kSelectSignResultNotification[] =
+ u"{\"is_ctap2\":true,\"action\":\"select-sign-result\",\"tid\":%llu,"
+ u"\"origin\":\"%s\",\"browsingContextId\":%llu,\"usernames\":[%s]}";
+
+/***********************************************************************
+ * U2FManager Implementation
+ **********************************************************************/
+
+NS_IMPL_ISUPPORTS(WebAuthnController, nsIWebAuthnController,
+ nsIU2FTokenManager);
+
+WebAuthnController::WebAuthnController() : mTransactionParent(nullptr) {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ // Create on the main thread to make sure ClearOnShutdown() works.
+ MOZ_ASSERT(NS_IsMainThread());
+}
+
+// static
+void WebAuthnController::Initialize() {
+ if (!XRE_IsParentProcess()) {
+ return;
+ }
+ MOZ_ASSERT(NS_IsMainThread());
+ MOZ_ASSERT(!gWebAuthnController);
+ gWebAuthnController = new WebAuthnController();
+ ClearOnShutdown(&gWebAuthnController);
+}
+
+// static
+WebAuthnController* WebAuthnController::Get() {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ return gWebAuthnController;
+}
+
+void WebAuthnController::AbortTransaction(const uint64_t& aTransactionId,
+ const nsresult& aError,
+ bool shouldCancelActiveDialog) {
+ if (mTransactionParent && mTransaction.isSome() && aTransactionId > 0 &&
+ aTransactionId == mTransaction.ref().mTransactionId) {
+ Unused << mTransactionParent->SendAbort(aTransactionId, aError);
+ ClearTransaction(shouldCancelActiveDialog);
+ }
+}
+
+void WebAuthnController::AbortOngoingTransaction() {
+ if (mTransaction.isSome()) {
+ AbortTransaction(mTransaction.ref().mTransactionId, NS_ERROR_DOM_ABORT_ERR,
+ true);
+ }
+}
+
+void WebAuthnController::MaybeClearTransaction(
+ PWebAuthnTransactionParent* aParent) {
+ // Only clear if we've been requested to do so by our current transaction
+ // parent.
+ if (mTransactionParent == aParent) {
+ ClearTransaction(true);
+ }
+}
+
+void WebAuthnController::ClearTransaction(bool cancel_prompt) {
+ if (cancel_prompt && mTransaction.isSome() &&
+ mTransaction.ref().mTransactionId > 0) {
+ // Remove any prompts we might be showing for the current transaction.
+ SendPromptNotification(kCancelPromptNotification,
+ mTransaction.ref().mTransactionId);
+ }
+ mTransactionParent = nullptr;
+ mTransportImpl = nullptr;
+
+ // Forget any pending registration.
+ mPendingRegisterInfo.reset();
+ mPendingSignInfo.reset();
+ mPendingSignResults.Clear();
+ mTransaction.reset();
+}
+
+template <typename... T>
+void WebAuthnController::SendPromptNotification(const char16_t* aFormat,
+ T... aArgs) {
+ MOZ_ASSERT(!NS_IsMainThread());
+ nsAutoString json;
+ nsTextFormatter::ssprintf(json, aFormat, aArgs...);
+
+ nsCOMPtr<nsIRunnable> r(NewRunnableMethod<nsString>(
+ "WebAuthnController::RunSendPromptNotification", this,
+ &WebAuthnController::RunSendPromptNotification, json));
+
+ MOZ_ALWAYS_SUCCEEDS(GetMainThreadSerialEventTarget()->Dispatch(
+ r.forget(), NS_DISPATCH_NORMAL));
+}
+
+NS_IMETHODIMP
+WebAuthnController::SendPromptNotificationPreformatted(
+ uint64_t aTransactionId, const nsACString& aJson) {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ MOZ_ASSERT(!NS_IsMainThread());
+
+ nsCOMPtr<nsIRunnable> r(NewRunnableMethod<nsString>(
+ "WebAuthnController::RunSendPromptNotification", this,
+ &WebAuthnController::RunSendPromptNotification,
+ NS_ConvertUTF8toUTF16(aJson)));
+ MOZ_ALWAYS_SUCCEEDS(GetMainThreadSerialEventTarget()->Dispatch(
+ r.forget(), NS_DISPATCH_NORMAL));
+ return NS_OK;
+}
+
+void WebAuthnController::RunSendPromptNotification(const nsString& aJSON) {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ nsCOMPtr<nsIObserverService> os = services::GetObserverService();
+ if (NS_WARN_IF(!os)) {
+ return;
+ }
+
+ nsCOMPtr<nsIWebAuthnController> self = this;
+ MOZ_ALWAYS_SUCCEEDS(
+ os->NotifyObservers(self, "webauthn-prompt", aJSON.get()));
+}
+
+nsCOMPtr<nsIWebAuthnTransport> WebAuthnController::GetTransportImpl() {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ if (mTransportImpl) {
+ return mTransportImpl;
+ }
+
+/* Enable in Bug 1819414 */
+#if 0
+# ifdef MOZ_WIDGET_ANDROID
+ // On Android, prefer the platform support if enabled.
+ if (StaticPrefs::security_webauth_webauthn_enable_android_fido2()) {
+ nsCOMPtr<nsIWebAuthnTransport> transport = AndroidWebAuthnTokenManager::GetInstance();
+ transport->SetController(this);
+ return transport;
+ }
+# endif
+#endif
+
+ // Prefer the HW token, even if the softtoken is enabled too.
+ // We currently don't support soft and USB tokens enabled at the
+ // same time as the softtoken would always win the race to register.
+ // We could support it for signing though...
+ if (StaticPrefs::security_webauth_webauthn_enable_usbtoken()) {
+ nsCOMPtr<nsIWebAuthnTransport> transport = NewAuthrsTransport();
+ transport->SetController(this);
+ return transport;
+ }
+
+ if (StaticPrefs::security_webauth_webauthn_enable_softtoken()) {
+ nsCOMPtr<nsIWebAuthnTransport> transport = new U2FSoftTokenTransport(
+ StaticPrefs::security_webauth_softtoken_counter());
+ transport->SetController(this);
+ return transport;
+ }
+
+ // TODO Use WebAuthnRequest to aggregate results from all transports,
+ // once we have multiple HW transport types.
+
+ return nullptr;
+}
+
+void WebAuthnController::Cancel(PWebAuthnTransactionParent* aTransactionParent,
+ const Tainted<uint64_t>& aTransactionId) {
+ // The last transaction ID also suffers from the issue described in Bug
+ // 1696159. A content process could cancel another content processes
+ // transaction by guessing the last transaction ID.
+ if (mTransactionParent != aTransactionParent || mTransaction.isNothing() ||
+ !MOZ_IS_VALID(aTransactionId,
+ mTransaction.ref().mTransactionId == aTransactionId)) {
+ return;
+ }
+
+ if (mTransportImpl) {
+ mTransportImpl->Cancel();
+ }
+
+ ClearTransaction(true);
+}
+
+void WebAuthnController::Register(
+ PWebAuthnTransactionParent* aTransactionParent,
+ const uint64_t& aTransactionId, const WebAuthnMakeCredentialInfo& aInfo) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ MOZ_LOG(gWebAuthnControllerLog, LogLevel::Debug,
+ ("WebAuthnController::Register"));
+ MOZ_ASSERT(aTransactionId > 0);
+
+ if (!gWebAuthnBackgroundThread) {
+ gWebAuthnBackgroundThread = NS_GetCurrentThread();
+ MOZ_ASSERT(gWebAuthnBackgroundThread, "This should never be null!");
+ }
+
+ AbortOngoingTransaction();
+ mTransactionParent = aTransactionParent;
+
+ /* We could refactor to defer the hashing here */
+ CryptoBuffer rpIdHash, clientDataHash;
+ NS_ConvertUTF16toUTF8 rpId(aInfo.RpId());
+ nsresult rv = BuildTransactionHashes(rpId, aInfo.ClientDataJSON(), rpIdHash,
+ clientDataHash);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ // We haven't set mTransaction yet, so we can't use AbortTransaction
+ Unused << mTransactionParent->SendAbort(aTransactionId,
+ NS_ERROR_DOM_UNKNOWN_ERR);
+ return;
+ }
+
+ // Hold on to any state that we need to finish the transaction.
+ mTransaction = Some(
+ Transaction(aTransactionId, rpIdHash, Nothing(), aInfo.ClientDataJSON()));
+
+ MOZ_ASSERT(mPendingRegisterInfo.isNothing());
+ mPendingRegisterInfo = Some(aInfo);
+
+ // Determine whether direct attestation was requested.
+ bool noneAttestationRequested = true;
+
+// On Android, let's always reject direct attestations until we have a
+// mechanism to solicit user consent, from Bug 1550164
+#ifndef MOZ_WIDGET_ANDROID
+ // The default attestation type is "none", so set
+ // noneAttestationRequested=false only if the RP's preference matches one of
+ // the other known types. This needs to be reviewed if values are added to
+ // the AttestationConveyancePreference enum.
+ const nsString& attestation = aInfo.attestationConveyancePreference();
+ static_assert(MOZ_WEBAUTHN_ENUM_STRINGS_VERSION == 2);
+ if (attestation.EqualsLiteral(
+ MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT) ||
+ attestation.EqualsLiteral(
+ MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_INDIRECT) ||
+ attestation.EqualsLiteral(
+ MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_ENTERPRISE)) {
+ noneAttestationRequested = false;
+ }
+#endif // not MOZ_WIDGET_ANDROID
+
+ // Start a register request immediately if direct attestation
+ // wasn't requested or the test pref is set.
+ if (noneAttestationRequested ||
+ StaticPrefs::
+ security_webauth_webauthn_testing_allow_direct_attestation()) {
+ DoRegister(aInfo, noneAttestationRequested);
+ return;
+ }
+
+ // If the RP request direct attestation, ask the user for permission and
+ // store the transaction info until the user proceeds or cancels.
+ NS_ConvertUTF16toUTF8 origin(aInfo.Origin());
+ SendPromptNotification(kRegisterDirectPromptNotification, aTransactionId,
+ origin.get(), aInfo.BrowsingContextId());
+}
+
+void WebAuthnController::DoRegister(const WebAuthnMakeCredentialInfo& aInfo,
+ bool aForceNoneAttestation) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ MOZ_ASSERT(mTransaction.isSome());
+ if (NS_WARN_IF(mTransaction.isNothing())) {
+ // Clear prompt?
+ return;
+ }
+
+ // Show a prompt that lets the user cancel the ongoing transaction.
+ NS_ConvertUTF16toUTF8 origin(aInfo.Origin());
+ SendPromptNotification(kPresencePromptNotification,
+ mTransaction.ref().mTransactionId, origin.get(),
+ aInfo.BrowsingContextId(), "false");
+
+ RefPtr<CtapRegisterArgs> args(
+ new CtapRegisterArgs(aInfo, aForceNoneAttestation));
+
+ mTransportImpl = GetTransportImpl();
+ if (!mTransportImpl) {
+ AbortTransaction(mTransaction.ref().mTransactionId,
+ NS_ERROR_DOM_NOT_ALLOWED_ERR, true);
+ return;
+ }
+ nsresult rv = mTransportImpl->MakeCredential(
+ mTransaction.ref().mTransactionId, aInfo.BrowsingContextId(), args);
+ if (NS_FAILED(rv)) {
+ AbortTransaction(mTransaction.ref().mTransactionId, rv, true);
+ return;
+ }
+}
+
+NS_IMETHODIMP
+WebAuthnController::ResumeRegister(uint64_t aTransactionId,
+ bool aForceNoneAttestation) {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ MOZ_ASSERT(NS_IsMainThread());
+
+ if (!gWebAuthnBackgroundThread) {
+ return NS_ERROR_FAILURE;
+ }
+
+ nsCOMPtr<nsIRunnable> r(NewRunnableMethod<uint64_t, bool>(
+ "WebAuthnController::RunResumeRegister", this,
+ &WebAuthnController::RunResumeRegister, aTransactionId,
+ aForceNoneAttestation));
+
+ return gWebAuthnBackgroundThread->Dispatch(r.forget(), NS_DISPATCH_NORMAL);
+}
+
+void WebAuthnController::RunResumeRegister(uint64_t aTransactionId,
+ bool aForceNoneAttestation) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ if (NS_WARN_IF(mPendingRegisterInfo.isNothing())) {
+ return;
+ }
+
+ if (mTransaction.isNothing() ||
+ mTransaction.ref().mTransactionId != aTransactionId) {
+ return;
+ }
+
+ // Resume registration and cleanup.
+ DoRegister(mPendingRegisterInfo.ref(), aForceNoneAttestation);
+}
+
+NS_IMETHODIMP
+WebAuthnController::FinishRegister(uint64_t aTransactionId,
+ nsICtapRegisterResult* aResult) {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ nsCOMPtr<nsIRunnable> r(
+ NewRunnableMethod<uint64_t, RefPtr<nsICtapRegisterResult>>(
+ "WebAuthnController::RunFinishRegister", this,
+ &WebAuthnController::RunFinishRegister, aTransactionId, aResult));
+
+ if (!gWebAuthnBackgroundThread) {
+ return NS_ERROR_FAILURE;
+ }
+ return gWebAuthnBackgroundThread->Dispatch(r.forget(), NS_DISPATCH_NORMAL);
+}
+
+void WebAuthnController::RunFinishRegister(
+ uint64_t aTransactionId, const RefPtr<nsICtapRegisterResult>& aResult) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ if (mTransaction.isNothing() ||
+ aTransactionId != mTransaction.ref().mTransactionId) {
+ // The previous transaction was likely cancelled from the prompt.
+ return;
+ }
+
+ nsresult status;
+ nsresult rv = aResult->GetStatus(&status);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ AbortTransaction(aTransactionId, NS_ERROR_FAILURE, true);
+ return;
+ }
+ if (NS_FAILED(status)) {
+ bool shouldCancelActiveDialog = true;
+ if (status == NS_ERROR_DOM_OPERATION_ERR) {
+ // PIN-related errors. Let the dialog show to inform the user
+ shouldCancelActiveDialog = false;
+ }
+ Telemetry::ScalarAdd(Telemetry::ScalarID::SECURITY_WEBAUTHN_USED,
+ u"CTAPRegisterAbort"_ns, 1);
+ AbortTransaction(aTransactionId, status, shouldCancelActiveDialog);
+ return;
+ }
+
+ nsCString clientDataJson = mPendingRegisterInfo.ref().ClientDataJSON();
+
+ nsTArray<uint8_t> attObj;
+ rv = aResult->GetAttestationObject(attObj);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ AbortTransaction(aTransactionId, NS_ERROR_FAILURE, true);
+ return;
+ }
+
+ nsTArray<uint8_t> credentialId;
+ rv = aResult->GetCredentialId(credentialId);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ AbortTransaction(aTransactionId, NS_ERROR_FAILURE, true);
+ return;
+ }
+
+ nsTArray<WebAuthnExtensionResult> extensions;
+ WebAuthnMakeCredentialResult result(clientDataJson, attObj, credentialId,
+ extensions);
+
+ Telemetry::ScalarAdd(Telemetry::ScalarID::SECURITY_WEBAUTHN_USED,
+ u"CTAPRegisterFinish"_ns, 1);
+ Unused << mTransactionParent->SendConfirmRegister(aTransactionId, result);
+ ClearTransaction(true);
+}
+
+void WebAuthnController::Sign(PWebAuthnTransactionParent* aTransactionParent,
+ const uint64_t& aTransactionId,
+ const WebAuthnGetAssertionInfo& aInfo) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ MOZ_LOG(gWebAuthnControllerLog, LogLevel::Debug, ("WebAuthnSign"));
+ MOZ_ASSERT(aTransactionId > 0);
+
+ if (!gWebAuthnBackgroundThread) {
+ gWebAuthnBackgroundThread = NS_GetCurrentThread();
+ MOZ_ASSERT(gWebAuthnBackgroundThread, "This should never be null!");
+ }
+
+ AbortOngoingTransaction();
+ mTransactionParent = aTransactionParent;
+
+ /* We could refactor to defer the hashing here */
+ CryptoBuffer rpIdHash, clientDataHash;
+ NS_ConvertUTF16toUTF8 rpId(aInfo.RpId());
+ nsresult rv = BuildTransactionHashes(rpId, aInfo.ClientDataJSON(), rpIdHash,
+ clientDataHash);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ // We haven't set mTransaction yet, so we can't use AbortTransaction
+ Unused << mTransactionParent->SendAbort(aTransactionId,
+ NS_ERROR_DOM_UNKNOWN_ERR);
+ return;
+ }
+
+ Maybe<nsTArray<uint8_t>> appIdHash = Nothing();
+ for (const WebAuthnExtension& ext : aInfo.Extensions()) {
+ if (ext.type() == WebAuthnExtension::TWebAuthnExtensionAppId) {
+ appIdHash = Some(ext.get_WebAuthnExtensionAppId().AppId().Clone());
+ }
+ }
+
+ // Hold on to any state that we need to finish the transaction.
+ mTransaction = Some(
+ Transaction(aTransactionId, rpIdHash, appIdHash, aInfo.ClientDataJSON()));
+
+ mPendingSignInfo = Some(aInfo);
+
+ // Show a prompt that lets the user cancel the ongoing transaction.
+ NS_ConvertUTF16toUTF8 origin(aInfo.Origin());
+ SendPromptNotification(kPresencePromptNotification,
+ mTransaction.ref().mTransactionId, origin.get(),
+ aInfo.BrowsingContextId(), "false");
+
+ RefPtr<CtapSignArgs> args(new CtapSignArgs(aInfo));
+
+ mTransportImpl = GetTransportImpl();
+ if (!mTransportImpl) {
+ AbortTransaction(mTransaction.ref().mTransactionId,
+ NS_ERROR_DOM_NOT_ALLOWED_ERR, true);
+ return;
+ }
+
+ rv = mTransportImpl->GetAssertion(mTransaction.ref().mTransactionId,
+ aInfo.BrowsingContextId(), args.get());
+ if (NS_FAILED(rv)) {
+ AbortTransaction(mTransaction.ref().mTransactionId, rv, true);
+ return;
+ }
+}
+
+NS_IMETHODIMP
+WebAuthnController::FinishSign(
+ uint64_t aTransactionId,
+ const nsTArray<RefPtr<nsICtapSignResult>>& aResult) {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ nsTArray<RefPtr<nsICtapSignResult>> ownedResult = aResult.Clone();
+
+ nsCOMPtr<nsIRunnable> r(
+ NewRunnableMethod<uint64_t, nsTArray<RefPtr<nsICtapSignResult>>>(
+ "WebAuthnController::RunFinishSign", this,
+ &WebAuthnController::RunFinishSign, aTransactionId,
+ std::move(ownedResult)));
+
+ if (!gWebAuthnBackgroundThread) {
+ return NS_ERROR_FAILURE;
+ }
+ return gWebAuthnBackgroundThread->Dispatch(r.forget(), NS_DISPATCH_NORMAL);
+}
+
+void WebAuthnController::RunFinishSign(
+ uint64_t aTransactionId,
+ const nsTArray<RefPtr<nsICtapSignResult>>& aResult) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ if (mTransaction.isNothing() ||
+ aTransactionId != mTransaction.ref().mTransactionId) {
+ return;
+ }
+
+ if (aResult.Length() == 0) {
+ Telemetry::ScalarAdd(Telemetry::ScalarID::SECURITY_WEBAUTHN_USED,
+ u"CTAPSignAbort"_ns, 1);
+ AbortTransaction(aTransactionId, NS_ERROR_DOM_UNKNOWN_ERR, true);
+ return;
+ }
+
+ if (aResult.Length() == 1) {
+ nsresult status;
+ nsresult rv = aResult[0]->GetStatus(&status);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ AbortTransaction(aTransactionId, NS_ERROR_FAILURE, true);
+ return;
+ }
+ if (NS_FAILED(status)) {
+ bool shouldCancelActiveDialog = true;
+ if (status == NS_ERROR_DOM_OPERATION_ERR) {
+ // PIN-related errors, e.g. blocked token. Let the dialog show to inform
+ // the user
+ shouldCancelActiveDialog = false;
+ }
+ Telemetry::ScalarAdd(Telemetry::ScalarID::SECURITY_WEBAUTHN_USED,
+ u"CTAPSignAbort"_ns, 1);
+ AbortTransaction(aTransactionId, status, shouldCancelActiveDialog);
+ return;
+ }
+ mPendingSignResults = aResult.Clone();
+ RunResumeWithSelectedSignResult(aTransactionId, 0);
+ return;
+ }
+
+ // If we more than one assertion, all of them should have OK status.
+ for (const auto& assertion : aResult) {
+ nsresult status;
+ nsresult rv = assertion->GetStatus(&status);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ AbortTransaction(aTransactionId, NS_ERROR_FAILURE, true);
+ return;
+ }
+ if (NS_WARN_IF(NS_FAILED(status))) {
+ Telemetry::ScalarAdd(Telemetry::ScalarID::SECURITY_WEBAUTHN_USED,
+ u"CTAPSignAbort"_ns, 1);
+ AbortTransaction(aTransactionId, status, true);
+ return;
+ }
+ }
+
+ nsCString usernames;
+ StringJoinAppend(
+ usernames, ","_ns, aResult,
+ [](nsACString& dst, const RefPtr<nsICtapSignResult>& assertion) {
+ nsCString username;
+ nsresult rv = assertion->GetUserName(username);
+ if (NS_FAILED(rv)) {
+ username.Assign("<Unknown username>");
+ }
+ nsCString escaped_username;
+ NS_Escape(username, escaped_username, url_XAlphas);
+ dst.Append("\""_ns + escaped_username + "\""_ns);
+ });
+
+ mPendingSignResults = aResult.Clone();
+ NS_ConvertUTF16toUTF8 origin(mPendingSignInfo.ref().Origin());
+ SendPromptNotification(kSelectSignResultNotification,
+ mTransaction.ref().mTransactionId, origin.get(),
+ mPendingSignInfo.ref().BrowsingContextId(),
+ usernames.get());
+}
+
+NS_IMETHODIMP
+WebAuthnController::SignatureSelectionCallback(uint64_t aTransactionId,
+ uint64_t idx) {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ MOZ_ASSERT(NS_IsMainThread());
+
+ nsCOMPtr<nsIRunnable> r(NewRunnableMethod<uint64_t, uint64_t>(
+ "WebAuthnController::RunResumeWithSelectedSignResult", this,
+ &WebAuthnController::RunResumeWithSelectedSignResult, aTransactionId,
+ idx));
+
+ if (!gWebAuthnBackgroundThread) {
+ return NS_ERROR_FAILURE;
+ }
+ return gWebAuthnBackgroundThread->Dispatch(r.forget(), NS_DISPATCH_NORMAL);
+}
+
+void WebAuthnController::RunResumeWithSelectedSignResult(
+ uint64_t aTransactionId, uint64_t idx) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+ if (mTransaction.isNothing() ||
+ mTransaction.ref().mTransactionId != aTransactionId) {
+ return;
+ }
+
+ if (NS_WARN_IF(mPendingSignResults.Length() <= idx)) {
+ return;
+ }
+
+ RefPtr<nsICtapSignResult>& selected = mPendingSignResults[idx];
+
+ nsTArray<uint8_t> credentialId;
+ nsresult rv = selected->GetCredentialId(credentialId);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ AbortTransaction(aTransactionId, NS_ERROR_FAILURE, true);
+ return;
+ }
+
+ nsTArray<uint8_t> signature;
+ rv = selected->GetSignature(signature);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ AbortTransaction(aTransactionId, NS_ERROR_FAILURE, true);
+ return;
+ }
+
+ nsTArray<uint8_t> authenticatorData;
+ rv = selected->GetAuthenticatorData(authenticatorData);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ AbortTransaction(aTransactionId, NS_ERROR_FAILURE, true);
+ return;
+ }
+
+ nsTArray<uint8_t> rpIdHash;
+ rv = selected->GetRpIdHash(rpIdHash);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ AbortTransaction(aTransactionId, NS_ERROR_FAILURE, true);
+ return;
+ }
+
+ nsTArray<uint8_t> userHandle;
+ Unused << selected->GetUserHandle(userHandle); // optional
+
+ nsTArray<WebAuthnExtensionResult> extensions;
+ if (mTransaction.ref().mAppIdHash.isSome()) {
+ bool usedAppId = (rpIdHash == mTransaction.ref().mAppIdHash.ref());
+ extensions.AppendElement(WebAuthnExtensionResultAppId(usedAppId));
+ }
+
+ WebAuthnGetAssertionResult result(mTransaction.ref().mClientDataJSON,
+ credentialId, signature, authenticatorData,
+ extensions, userHandle);
+
+ Telemetry::ScalarAdd(Telemetry::ScalarID::SECURITY_WEBAUTHN_USED,
+ u"CTAPSignFinish"_ns, 1);
+ Unused << mTransactionParent->SendConfirmSign(aTransactionId, result);
+ ClearTransaction(true);
+}
+
+NS_IMETHODIMP
+WebAuthnController::PinCallback(uint64_t aTransactionId,
+ const nsACString& aPin) {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ MOZ_ASSERT(NS_IsMainThread());
+
+ nsCOMPtr<nsIRunnable> r(NewRunnableMethod<uint64_t, nsCString>(
+ "WebAuthnController::RunPinCallback", this,
+ &WebAuthnController::RunPinCallback, aTransactionId, aPin));
+
+ if (!gWebAuthnBackgroundThread) {
+ return NS_ERROR_FAILURE;
+ }
+ return gWebAuthnBackgroundThread->Dispatch(r.forget(), NS_DISPATCH_NORMAL);
+}
+
+void WebAuthnController::RunPinCallback(uint64_t aTransactionId,
+ const nsCString& aPin) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ if (mTransportImpl) {
+ mTransportImpl->PinCallback(aTransactionId, aPin);
+ }
+}
+
+NS_IMETHODIMP
+WebAuthnController::Cancel(uint64_t aTransactionId) {
+ MOZ_ASSERT(XRE_IsParentProcess());
+ MOZ_ASSERT(NS_IsMainThread());
+
+ nsCOMPtr<nsIRunnable> r(NewRunnableMethod<uint64_t>(
+ "WebAuthnController::RunCancel", this, &WebAuthnController::RunCancel,
+ aTransactionId));
+
+ if (!gWebAuthnBackgroundThread) {
+ return NS_ERROR_FAILURE;
+ }
+ return gWebAuthnBackgroundThread->Dispatch(r.forget(), NS_DISPATCH_NORMAL);
+}
+
+void WebAuthnController::RunCancel(uint64_t aTransactionId) {
+ mozilla::ipc::AssertIsOnBackgroundThread();
+
+ if (mTransaction.isNothing() ||
+ mTransaction.ref().mTransactionId != aTransactionId) {
+ return;
+ }
+
+ // Cancel the request.
+ if (mTransportImpl) {
+ mTransportImpl->Cancel();
+ }
+
+ // Reject the promise.
+ AbortTransaction(aTransactionId, NS_ERROR_DOM_NOT_ALLOWED_ERR, true);
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/WebAuthnController.h b/dom/webauthn/WebAuthnController.h
new file mode 100644
index 0000000000..9497b146f6
--- /dev/null
+++ b/dom/webauthn/WebAuthnController.h
@@ -0,0 +1,130 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WebAuthnController_h
+#define mozilla_dom_WebAuthnController_h
+
+#include "nsIWebAuthnController.h"
+#include "mozilla/dom/PWebAuthnTransaction.h"
+#include "mozilla/Tainting.h"
+
+/*
+ * Parent process manager for WebAuthn API transactions. Handles process
+ * transactions from all content processes, make sure only one transaction is
+ * live at any time. Manages access to hardware and software based key systems.
+ *
+ */
+
+namespace mozilla::dom {
+
+class WebAuthnController final : public nsIWebAuthnController {
+ public:
+ NS_DECL_THREADSAFE_ISUPPORTS
+ NS_DECL_NSIU2FTOKENMANAGER
+ NS_DECL_NSIWEBAUTHNCONTROLLER
+
+ static void Initialize();
+ static WebAuthnController* Get();
+ void Register(PWebAuthnTransactionParent* aTransactionParent,
+ const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialInfo& aInfo);
+
+ void Sign(PWebAuthnTransactionParent* aTransactionParent,
+ const uint64_t& aTransactionId,
+ const WebAuthnGetAssertionInfo& aInfo);
+
+ void Cancel(PWebAuthnTransactionParent* aTransactionParent,
+ const Tainted<uint64_t>& aTransactionId);
+
+ void MaybeClearTransaction(PWebAuthnTransactionParent* aParent);
+
+ uint64_t GetCurrentTransactionId() {
+ return mTransaction.isNothing() ? 0 : mTransaction.ref().mTransactionId;
+ }
+
+ bool CurrentTransactionIsRegister() { return mPendingRegisterInfo.isSome(); }
+
+ bool CurrentTransactionIsSign() { return mPendingSignInfo.isSome(); }
+
+ // Sends a "webauthn-prompt" observer notification with the given data.
+ template <typename... T>
+ void SendPromptNotification(const char16_t* aFormat, T... aArgs);
+
+ // Same as SendPromptNotification, but with the already formatted string
+ // void SendPromptNotificationPreformatted(const nsACString& aJSON);
+ // The main thread runnable function for "SendPromptNotification".
+ void RunSendPromptNotification(const nsString& aJSON);
+
+ private:
+ WebAuthnController();
+ ~WebAuthnController() = default;
+ nsCOMPtr<nsIWebAuthnTransport> GetTransportImpl();
+
+ void AbortTransaction(const uint64_t& aTransactionId, const nsresult& aError,
+ bool shouldCancelActiveDialog);
+ void AbortOngoingTransaction();
+ void ClearTransaction(bool cancel_prompt);
+
+ void DoRegister(const WebAuthnMakeCredentialInfo& aInfo,
+ bool aForceNoneAttestation);
+ void DoSign(const WebAuthnGetAssertionInfo& aTransactionInfo);
+
+ void RunFinishRegister(uint64_t aTransactionId,
+ const RefPtr<nsICtapRegisterResult>& aResult);
+ void RunFinishSign(uint64_t aTransactionId,
+ const nsTArray<RefPtr<nsICtapSignResult>>& aResult);
+
+ // The main thread runnable function for "nsIU2FTokenManager.ResumeRegister".
+ void RunResumeRegister(uint64_t aTransactionId, bool aForceNoneAttestation);
+ void RunResumeSign(uint64_t aTransactionId);
+ void RunResumeWithSelectedSignResult(uint64_t aTransactionId, uint64_t idx);
+ void RunPinCallback(uint64_t aTransactionId, const nsCString& aPin);
+
+ // The main thread runnable function for "nsIU2FTokenManager.Cancel".
+ void RunCancel(uint64_t aTransactionId);
+
+ // Using a raw pointer here, as the lifetime of the IPC object is managed by
+ // the PBackground protocol code. This means we cannot be left holding an
+ // invalid IPC protocol object after the transaction is finished.
+ PWebAuthnTransactionParent* mTransactionParent;
+
+ nsCOMPtr<nsIWebAuthnTransport> mTransportImpl;
+
+ // Pending registration info while we wait for user input.
+ Maybe<WebAuthnMakeCredentialInfo> mPendingRegisterInfo;
+
+ // Pending registration info while we wait for user input.
+ Maybe<WebAuthnGetAssertionInfo> mPendingSignInfo;
+
+ nsTArray<RefPtr<nsICtapSignResult>> mPendingSignResults;
+
+ class Transaction {
+ public:
+ Transaction(uint64_t aTransactionId, const nsTArray<uint8_t>& aRpIdHash,
+ const Maybe<nsTArray<uint8_t>>& aAppIdHash,
+ const nsCString& aClientDataJSON,
+ bool aForceNoneAttestation = false)
+ : mTransactionId(aTransactionId),
+ mRpIdHash(aRpIdHash.Clone()),
+ mClientDataJSON(aClientDataJSON) {
+ if (aAppIdHash.isSome()) {
+ mAppIdHash = Some(aAppIdHash.ref().Clone());
+ } else {
+ mAppIdHash = Nothing();
+ }
+ }
+ uint64_t mTransactionId;
+ nsTArray<uint8_t> mRpIdHash;
+ Maybe<nsTArray<uint8_t>> mAppIdHash;
+ nsCString mClientDataJSON;
+ };
+
+ Maybe<Transaction> mTransaction;
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_U2FTokenManager_h
diff --git a/dom/webauthn/WebAuthnCoseIdentifiers.h b/dom/webauthn/WebAuthnCoseIdentifiers.h
new file mode 100644
index 0000000000..9e98b5623d
--- /dev/null
+++ b/dom/webauthn/WebAuthnCoseIdentifiers.h
@@ -0,0 +1,22 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WebAuthnCoseIdentifiers_h
+#define mozilla_dom_WebAuthnCoseIdentifiers_h
+
+#include "mozilla/dom/WebCryptoCommon.h"
+
+namespace mozilla::dom {
+
+// From https://www.iana.org/assignments/cose/cose.xhtml#algorithms
+enum class CoseAlgorithmIdentifier : int32_t {
+ ES256 = -7,
+ RS256 = -257,
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_WebAuthnCoseIdentifiers_h
diff --git a/dom/webauthn/WebAuthnEnumStrings.h b/dom/webauthn/WebAuthnEnumStrings.h
new file mode 100644
index 0000000000..a572dfb0d5
--- /dev/null
+++ b/dom/webauthn/WebAuthnEnumStrings.h
@@ -0,0 +1,49 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WebAuthnEnumStrings_h
+#define mozilla_dom_WebAuthnEnumStrings_h
+
+// WARNING: This version number must match the WebAuthn level where the strings
+// below are defined.
+#define MOZ_WEBAUTHN_ENUM_STRINGS_VERSION 2
+
+// https://www.w3.org/TR/webauthn-2/#enum-attestation-convey
+#define MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_NONE "none"
+#define MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_INDIRECT "indirect"
+#define MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT "direct"
+#define MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_ENTERPRISE "enterprise"
+// WARNING: Change version number when adding new values!
+
+// https://www.w3.org/TR/webauthn-2/#enum-attachment
+#define MOZ_WEBAUTHN_AUTHENTICATOR_ATTACHMENT_PLATFORM "platform"
+#define MOZ_WEBAUTHN_AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM "cross-platform"
+// WARNING: Change version number when adding new values!
+
+// https://www.w3.org/TR/webauthn-2/#enum-credentialType
+#define MOZ_WEBAUTHN_PUBLIC_KEY_CREDENTIAL_TYPE_PUBLIC_KEY "public-key"
+// WARNING: Change version number when adding new values!
+
+// https://www.w3.org/TR/webauthn-2/#enum-residentKeyRequirement
+#define MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_REQUIRED "required"
+#define MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_PREFERRED "preferred"
+#define MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_DISCOURAGED "discouraged"
+// WARNING: Change version number when adding new values!
+
+// https://www.w3.org/TR/webauthn-2/#enum-userVerificationRequirement
+#define MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED "required"
+#define MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_PREFERRED "preferred"
+#define MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_DISCOURAGED "discouraged"
+// WARNING: Change version number when adding new values!
+
+// https://www.w3.org/TR/webauthn-2/#enum-transport
+#define MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_USB "usb"
+#define MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_NFC "nfc"
+#define MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_BLE "ble"
+#define MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_INTERNAL "internal"
+// WARNING: Change version number when adding new values!
+
+#endif // mozilla_dom_WebAuthnEnumStrings_h
diff --git a/dom/webauthn/WebAuthnManager.cpp b/dom/webauthn/WebAuthnManager.cpp
new file mode 100644
index 0000000000..9a15f62bb4
--- /dev/null
+++ b/dom/webauthn/WebAuthnManager.cpp
@@ -0,0 +1,864 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "hasht.h"
+#include "nsHTMLDocument.h"
+#include "nsIURIMutator.h"
+#include "nsThreadUtils.h"
+#include "WebAuthnCoseIdentifiers.h"
+#include "WebAuthnEnumStrings.h"
+#include "WebAuthnTransportIdentifiers.h"
+#include "mozilla/BasePrincipal.h"
+#include "mozilla/dom/AuthenticatorAssertionResponse.h"
+#include "mozilla/dom/AuthenticatorAttestationResponse.h"
+#include "mozilla/dom/PublicKeyCredential.h"
+#include "mozilla/dom/Promise.h"
+#include "mozilla/dom/PWebAuthnTransaction.h"
+#include "mozilla/dom/WebAuthnManager.h"
+#include "mozilla/dom/WebAuthnTransactionChild.h"
+#include "mozilla/dom/WebAuthnUtil.h"
+#include "mozilla/ipc/BackgroundChild.h"
+#include "mozilla/ipc/PBackgroundChild.h"
+
+#ifdef OS_WIN
+# include "WinWebAuthnManager.h"
+#endif
+
+using namespace mozilla::ipc;
+
+namespace mozilla::dom {
+
+/***********************************************************************
+ * Statics
+ **********************************************************************/
+
+namespace {
+static mozilla::LazyLogModule gWebAuthnManagerLog("webauthnmanager");
+}
+
+NS_IMPL_ISUPPORTS_CYCLE_COLLECTION_INHERITED_0(WebAuthnManager,
+ WebAuthnManagerBase)
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(WebAuthnManager)
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(WebAuthnManager,
+ WebAuthnManagerBase)
+ NS_IMPL_CYCLE_COLLECTION_UNLINK(mTransaction)
+ tmp->mTransaction.reset();
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(WebAuthnManager,
+ WebAuthnManagerBase)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mTransaction)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+/***********************************************************************
+ * Utility Functions
+ **********************************************************************/
+
+static nsresult AssembleClientData(
+ const nsAString& aOrigin, const CryptoBuffer& aChallenge,
+ const nsAString& aType,
+ const AuthenticationExtensionsClientInputs& aExtensions,
+ /* out */ nsACString& aJsonOut) {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ nsString challengeBase64;
+ nsresult rv = aChallenge.ToJwkBase64(challengeBase64);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ CollectedClientData clientDataObject;
+ clientDataObject.mType.Assign(aType);
+ clientDataObject.mChallenge.Assign(challengeBase64);
+ clientDataObject.mOrigin.Assign(aOrigin);
+
+ nsAutoString temp;
+ if (NS_WARN_IF(!clientDataObject.ToJSON(temp))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ aJsonOut.Assign(NS_ConvertUTF16toUTF8(temp));
+ return NS_OK;
+}
+
+nsresult GetOrigin(nsPIDOMWindowInner* aParent,
+ /*out*/ nsAString& aOrigin, /*out*/ nsACString& aHost) {
+ MOZ_ASSERT(aParent);
+ nsCOMPtr<Document> doc = aParent->GetDoc();
+ MOZ_ASSERT(doc);
+
+ nsCOMPtr<nsIPrincipal> principal = doc->NodePrincipal();
+ nsresult rv = nsContentUtils::GetUTFOrigin(principal, aOrigin);
+ if (NS_WARN_IF(NS_FAILED(rv)) || NS_WARN_IF(aOrigin.IsEmpty())) {
+ return NS_ERROR_FAILURE;
+ }
+
+ if (principal->GetIsIpAddress()) {
+ return NS_ERROR_DOM_SECURITY_ERR;
+ }
+
+ if (aOrigin.EqualsLiteral("null")) {
+ // 4.1.1.3 If callerOrigin is an opaque origin, reject promise with a
+ // DOMException whose name is "NotAllowedError", and terminate this
+ // algorithm
+ MOZ_LOG(gWebAuthnManagerLog, LogLevel::Debug,
+ ("Rejecting due to opaque origin"));
+ return NS_ERROR_DOM_NOT_ALLOWED_ERR;
+ }
+
+ nsCOMPtr<nsIURI> originUri;
+ auto* basePrin = BasePrincipal::Cast(principal);
+ if (NS_FAILED(basePrin->GetURI(getter_AddRefs(originUri)))) {
+ return NS_ERROR_FAILURE;
+ }
+ if (NS_FAILED(originUri->GetAsciiHost(aHost))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ return NS_OK;
+}
+
+nsresult RelaxSameOrigin(nsPIDOMWindowInner* aParent,
+ const nsAString& aInputRpId,
+ /* out */ nsACString& aRelaxedRpId) {
+ MOZ_ASSERT(aParent);
+ nsCOMPtr<Document> doc = aParent->GetDoc();
+ MOZ_ASSERT(doc);
+
+ nsCOMPtr<nsIPrincipal> principal = doc->NodePrincipal();
+ auto* basePrin = BasePrincipal::Cast(principal);
+ nsCOMPtr<nsIURI> uri;
+
+ if (NS_FAILED(basePrin->GetURI(getter_AddRefs(uri)))) {
+ return NS_ERROR_FAILURE;
+ }
+ nsAutoCString originHost;
+ if (NS_FAILED(uri->GetAsciiHost(originHost))) {
+ return NS_ERROR_FAILURE;
+ }
+ nsCOMPtr<Document> document = aParent->GetDoc();
+ if (!document || !document->IsHTMLDocument()) {
+ return NS_ERROR_FAILURE;
+ }
+ nsHTMLDocument* html = document->AsHTMLDocument();
+ // See if the given RP ID is a valid domain string.
+ // (We use the document's URI here as a template so we don't have to come up
+ // with our own scheme, etc. If we can successfully set the host as the given
+ // RP ID, then it should be a valid domain string.)
+ nsCOMPtr<nsIURI> inputRpIdURI;
+ nsresult rv = NS_MutateURI(uri)
+ .SetHost(NS_ConvertUTF16toUTF8(aInputRpId))
+ .Finalize(inputRpIdURI);
+ if (NS_FAILED(rv)) {
+ return NS_ERROR_DOM_SECURITY_ERR;
+ }
+ nsAutoCString inputRpId;
+ if (NS_FAILED(inputRpIdURI->GetAsciiHost(inputRpId))) {
+ return NS_ERROR_FAILURE;
+ }
+ if (!html->IsRegistrableDomainSuffixOfOrEqualTo(
+ NS_ConvertUTF8toUTF16(inputRpId), originHost)) {
+ return NS_ERROR_DOM_SECURITY_ERR;
+ }
+
+ aRelaxedRpId.Assign(inputRpId);
+ return NS_OK;
+}
+
+/***********************************************************************
+ * WebAuthnManager Implementation
+ **********************************************************************/
+
+void WebAuthnManager::ClearTransaction() {
+ if (!mTransaction.isNothing()) {
+ StopListeningForVisibilityEvents();
+ }
+
+ mTransaction.reset();
+ Unfollow();
+}
+
+void WebAuthnManager::RejectTransaction(const nsresult& aError) {
+ if (!NS_WARN_IF(mTransaction.isNothing())) {
+ mTransaction.ref().mPromise->MaybeReject(aError);
+ }
+
+ ClearTransaction();
+}
+
+void WebAuthnManager::CancelTransaction(const nsresult& aError) {
+ if (!NS_WARN_IF(!mChild || mTransaction.isNothing())) {
+ mChild->SendRequestCancel(mTransaction.ref().mId);
+ }
+
+ RejectTransaction(aError);
+}
+
+void WebAuthnManager::HandleVisibilityChange() {
+ if (mTransaction.isSome()) {
+ mTransaction.ref().mVisibilityChanged = true;
+ }
+}
+
+WebAuthnManager::~WebAuthnManager() {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ if (mTransaction.isSome()) {
+ ClearTransaction();
+ }
+
+ if (mChild) {
+ RefPtr<WebAuthnTransactionChild> c;
+ mChild.swap(c);
+ c->Disconnect();
+ }
+}
+
+already_AddRefed<Promise> WebAuthnManager::MakeCredential(
+ const PublicKeyCredentialCreationOptions& aOptions,
+ const Optional<OwningNonNull<AbortSignal>>& aSignal, ErrorResult& aError) {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(mParent);
+
+ RefPtr<Promise> promise = Promise::Create(global, aError);
+ if (aError.Failed()) {
+ return nullptr;
+ }
+
+ if (mTransaction.isSome()) {
+ // If there hasn't been a visibility change during the current
+ // transaction, then let's let that one complete rather than
+ // cancelling it on a subsequent call.
+ if (!mTransaction.ref().mVisibilityChanged) {
+ promise->MaybeReject(NS_ERROR_DOM_ABORT_ERR);
+ return promise.forget();
+ }
+
+ // Otherwise, the user may well have clicked away, so let's
+ // abort the old transaction and take over control from here.
+ CancelTransaction(NS_ERROR_ABORT);
+ }
+
+ // Abort the request if aborted flag is already set.
+ if (aSignal.WasPassed() && aSignal.Value().Aborted()) {
+ promise->MaybeReject(NS_ERROR_DOM_ABORT_ERR);
+ return promise.forget();
+ }
+
+ nsString origin;
+ nsCString rpId;
+ nsresult rv = GetOrigin(mParent, origin, rpId);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ promise->MaybeReject(rv);
+ return promise.forget();
+ }
+
+ // Enforce 5.4.3 User Account Parameters for Credential Generation
+ // When we add UX, we'll want to do more with this value, but for now
+ // we just have to verify its correctness.
+
+ CryptoBuffer userId;
+ userId.Assign(aOptions.mUser.mId);
+ if (userId.Length() > 64) {
+ promise->MaybeRejectWithTypeError("user.id is too long");
+ return promise.forget();
+ }
+
+ // If timeoutSeconds was specified, check if its value lies within a
+ // reasonable range as defined by the platform and if not, correct it to the
+ // closest value lying within that range.
+
+ uint32_t adjustedTimeout = 30000;
+ if (aOptions.mTimeout.WasPassed()) {
+ adjustedTimeout = aOptions.mTimeout.Value();
+ adjustedTimeout = std::max(15000u, adjustedTimeout);
+ adjustedTimeout = std::min(120000u, adjustedTimeout);
+ }
+
+ if (aOptions.mRp.mId.WasPassed()) {
+ // If rpId is specified, then invoke the procedure used for relaxing the
+ // same-origin restriction by setting the document.domain attribute, using
+ // rpId as the given value but without changing the current document’s
+ // domain. If no errors are thrown, set rpId to the value of host as
+ // computed by this procedure, and rpIdHash to the SHA-256 hash of rpId.
+ // Otherwise, reject promise with a DOMException whose name is
+ // "SecurityError", and terminate this algorithm.
+
+ if (NS_FAILED(RelaxSameOrigin(mParent, aOptions.mRp.mId.Value(), rpId))) {
+ promise->MaybeReject(NS_ERROR_DOM_SECURITY_ERR);
+ return promise.forget();
+ }
+ }
+
+ // <https://w3c.github.io/webauthn/#sctn-appid-extension>
+ if (aOptions.mExtensions.mAppid.WasPassed()) {
+ promise->MaybeReject(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+ return promise.forget();
+ }
+
+ // Process each element of mPubKeyCredParams using the following steps, to
+ // produce a new sequence of coseAlgos.
+ nsTArray<CoseAlg> coseAlgos;
+ // If pubKeyCredParams is empty, append ES256 and RS256
+ if (aOptions.mPubKeyCredParams.IsEmpty()) {
+ coseAlgos.AppendElement(static_cast<long>(CoseAlgorithmIdentifier::ES256));
+ coseAlgos.AppendElement(static_cast<long>(CoseAlgorithmIdentifier::RS256));
+ } else {
+ for (size_t a = 0; a < aOptions.mPubKeyCredParams.Length(); ++a) {
+ // If current.type does not contain a PublicKeyCredentialType
+ // supported by this implementation, then stop processing current and move
+ // on to the next element in mPubKeyCredParams.
+ if (!aOptions.mPubKeyCredParams[a].mType.EqualsLiteral(
+ MOZ_WEBAUTHN_PUBLIC_KEY_CREDENTIAL_TYPE_PUBLIC_KEY)) {
+ continue;
+ }
+
+ coseAlgos.AppendElement(aOptions.mPubKeyCredParams[a].mAlg);
+ }
+ }
+
+ // If there are algorithms specified, but none are Public_key algorithms,
+ // reject the promise.
+ if (coseAlgos.IsEmpty() && !aOptions.mPubKeyCredParams.IsEmpty()) {
+ promise->MaybeReject(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+ return promise.forget();
+ }
+
+ // If excludeList is undefined, set it to the empty list.
+ //
+ // If extensions was specified, process any extensions supported by this
+ // client platform, to produce the extension data that needs to be sent to the
+ // authenticator. If an error is encountered while processing an extension,
+ // skip that extension and do not produce any extension data for it. Call the
+ // result of this processing clientExtensions.
+ //
+ // Currently no extensions are supported
+ //
+ // Use attestationChallenge, callerOrigin and rpId, along with the token
+ // binding key associated with callerOrigin (if any), to create a ClientData
+ // structure representing this request. Choose a hash algorithm for hashAlg
+ // and compute the clientDataJSON and clientDataHash.
+
+ CryptoBuffer challenge;
+ if (!challenge.Assign(aOptions.mChallenge)) {
+ promise->MaybeReject(NS_ERROR_DOM_SECURITY_ERR);
+ return promise.forget();
+ }
+
+ nsAutoCString clientDataJSON;
+ nsresult srv = AssembleClientData(origin, challenge, u"webauthn.create"_ns,
+ aOptions.mExtensions, clientDataJSON);
+ if (NS_WARN_IF(NS_FAILED(srv))) {
+ promise->MaybeReject(NS_ERROR_DOM_SECURITY_ERR);
+ return promise.forget();
+ }
+
+ nsTArray<WebAuthnScopedCredential> excludeList;
+ for (const auto& s : aOptions.mExcludeCredentials) {
+ WebAuthnScopedCredential c;
+ CryptoBuffer cb;
+ cb.Assign(s.mId);
+ c.id() = cb;
+ excludeList.AppendElement(c);
+ }
+
+ if (!MaybeCreateBackgroundActor()) {
+ promise->MaybeReject(NS_ERROR_DOM_OPERATION_ERR);
+ return promise.forget();
+ }
+
+ // TODO: Add extension list building
+ nsTArray<WebAuthnExtension> extensions;
+
+ // <https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#sctn-hmac-secret-extension>
+ if (aOptions.mExtensions.mHmacCreateSecret.WasPassed()) {
+ bool hmacCreateSecret = aOptions.mExtensions.mHmacCreateSecret.Value();
+ if (hmacCreateSecret) {
+ extensions.AppendElement(WebAuthnExtensionHmacSecret(hmacCreateSecret));
+ }
+ }
+
+ const auto& selection = aOptions.mAuthenticatorSelection;
+ const auto& attachment = selection.mAuthenticatorAttachment;
+ const nsString& attestation = aOptions.mAttestation;
+
+ // Attachment
+ Maybe<nsString> authenticatorAttachment;
+ if (attachment.WasPassed()) {
+ authenticatorAttachment.emplace(attachment.Value());
+ }
+
+ // The residentKey field was added in WebAuthn level 2. It takes precedent
+ // over the requireResidentKey field if and only if it is present and it is a
+ // member of the ResidentKeyRequirement enum.
+ static_assert(MOZ_WEBAUTHN_ENUM_STRINGS_VERSION == 2);
+ bool useResidentKeyValue =
+ selection.mResidentKey.WasPassed() &&
+ (selection.mResidentKey.Value().EqualsLiteral(
+ MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_REQUIRED) ||
+ selection.mResidentKey.Value().EqualsLiteral(
+ MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_PREFERRED) ||
+ selection.mResidentKey.Value().EqualsLiteral(
+ MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_DISCOURAGED));
+
+ nsString residentKey;
+ if (useResidentKeyValue) {
+ residentKey = selection.mResidentKey.Value();
+ } else {
+ // "If no value is given then the effective value is required if
+ // requireResidentKey is true or discouraged if it is false or absent."
+ if (selection.mRequireResidentKey) {
+ residentKey.AssignLiteral(MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_REQUIRED);
+ } else {
+ residentKey.AssignLiteral(
+ MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_DISCOURAGED);
+ }
+ }
+
+ // Create and forward authenticator selection criteria.
+ WebAuthnAuthenticatorSelection authSelection(
+ residentKey, selection.mUserVerification, authenticatorAttachment);
+
+ nsString rpIcon;
+ if (aOptions.mRp.mIcon.WasPassed()) {
+ rpIcon = aOptions.mRp.mIcon.Value();
+ }
+
+ nsString userIcon;
+ if (aOptions.mUser.mIcon.WasPassed()) {
+ userIcon = aOptions.mUser.mIcon.Value();
+ }
+
+ WebAuthnMakeCredentialRpInfo rpInfo(aOptions.mRp.mName, rpIcon);
+
+ WebAuthnMakeCredentialUserInfo userInfo(
+ userId, aOptions.mUser.mName, userIcon, aOptions.mUser.mDisplayName);
+
+ BrowsingContext* context = mParent->GetBrowsingContext();
+ if (!context) {
+ promise->MaybeReject(NS_ERROR_DOM_OPERATION_ERR);
+ return promise.forget();
+ }
+
+ WebAuthnMakeCredentialInfo info(
+ origin, NS_ConvertUTF8toUTF16(rpId), challenge, clientDataJSON,
+ adjustedTimeout, excludeList, rpInfo, userInfo, coseAlgos, extensions,
+ authSelection, attestation, context->Top()->Id());
+
+#ifdef OS_WIN
+ if (!WinWebAuthnManager::AreWebAuthNApisAvailable()) {
+ ListenForVisibilityEvents();
+ }
+#else
+ ListenForVisibilityEvents();
+#endif
+
+ AbortSignal* signal = nullptr;
+ if (aSignal.WasPassed()) {
+ signal = &aSignal.Value();
+ Follow(signal);
+ }
+
+ MOZ_ASSERT(mTransaction.isNothing());
+ mTransaction = Some(WebAuthnTransaction(promise));
+ mChild->SendRequestRegister(mTransaction.ref().mId, info);
+
+ return promise.forget();
+}
+
+const size_t MAX_ALLOWED_CREDENTIALS = 20;
+
+already_AddRefed<Promise> WebAuthnManager::GetAssertion(
+ const PublicKeyCredentialRequestOptions& aOptions,
+ const Optional<OwningNonNull<AbortSignal>>& aSignal, ErrorResult& aError) {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(mParent);
+
+ RefPtr<Promise> promise = Promise::Create(global, aError);
+ if (aError.Failed()) {
+ return nullptr;
+ }
+
+ if (mTransaction.isSome()) {
+ // If there hasn't been a visibility change during the current
+ // transaction, then let's let that one complete rather than
+ // cancelling it on a subsequent call.
+ if (!mTransaction.ref().mVisibilityChanged) {
+ promise->MaybeReject(NS_ERROR_DOM_ABORT_ERR);
+ return promise.forget();
+ }
+
+ // Otherwise, the user may well have clicked away, so let's
+ // abort the old transaction and take over control from here.
+ CancelTransaction(NS_ERROR_ABORT);
+ }
+
+ // Abort the request if aborted flag is already set.
+ if (aSignal.WasPassed() && aSignal.Value().Aborted()) {
+ promise->MaybeReject(NS_ERROR_DOM_ABORT_ERR);
+ return promise.forget();
+ }
+
+ nsString origin;
+ nsCString rpId;
+ nsresult rv = GetOrigin(mParent, origin, rpId);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ promise->MaybeReject(rv);
+ return promise.forget();
+ }
+
+ // If timeoutSeconds was specified, check if its value lies within a
+ // reasonable range as defined by the platform and if not, correct it to the
+ // closest value lying within that range.
+
+ uint32_t adjustedTimeout = 30000;
+ if (aOptions.mTimeout.WasPassed()) {
+ adjustedTimeout = aOptions.mTimeout.Value();
+ adjustedTimeout = std::max(15000u, adjustedTimeout);
+ adjustedTimeout = std::min(120000u, adjustedTimeout);
+ }
+
+ if (aOptions.mRpId.WasPassed()) {
+ // If rpId is specified, then invoke the procedure used for relaxing the
+ // same-origin restriction by setting the document.domain attribute, using
+ // rpId as the given value but without changing the current document’s
+ // domain. If no errors are thrown, set rpId to the value of host as
+ // computed by this procedure, and rpIdHash to the SHA-256 hash of rpId.
+ // Otherwise, reject promise with a DOMException whose name is
+ // "SecurityError", and terminate this algorithm.
+
+ if (NS_FAILED(RelaxSameOrigin(mParent, aOptions.mRpId.Value(), rpId))) {
+ promise->MaybeReject(NS_ERROR_DOM_SECURITY_ERR);
+ return promise.forget();
+ }
+ }
+
+ CryptoBuffer rpIdHash;
+ if (!rpIdHash.SetLength(SHA256_LENGTH, fallible)) {
+ promise->MaybeReject(NS_ERROR_OUT_OF_MEMORY);
+ return promise.forget();
+ }
+
+ // Abort the request if the allowCredentials set is too large
+ if (aOptions.mAllowCredentials.Length() > MAX_ALLOWED_CREDENTIALS) {
+ promise->MaybeReject(NS_ERROR_DOM_SECURITY_ERR);
+ return promise.forget();
+ }
+
+ // Use assertionChallenge, callerOrigin and rpId, along with the token binding
+ // key associated with callerOrigin (if any), to create a ClientData structure
+ // representing this request. Choose a hash algorithm for hashAlg and compute
+ // the clientDataJSON and clientDataHash.
+ CryptoBuffer challenge;
+ if (!challenge.Assign(aOptions.mChallenge)) {
+ promise->MaybeReject(NS_ERROR_DOM_SECURITY_ERR);
+ return promise.forget();
+ }
+
+ nsAutoCString clientDataJSON;
+ rv = AssembleClientData(origin, challenge, u"webauthn.get"_ns,
+ aOptions.mExtensions, clientDataJSON);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ promise->MaybeReject(NS_ERROR_DOM_SECURITY_ERR);
+ return promise.forget();
+ }
+
+ nsTArray<WebAuthnScopedCredential> allowList;
+ for (const auto& s : aOptions.mAllowCredentials) {
+ if (s.mType.EqualsLiteral(
+ MOZ_WEBAUTHN_PUBLIC_KEY_CREDENTIAL_TYPE_PUBLIC_KEY)) {
+ WebAuthnScopedCredential c;
+ CryptoBuffer cb;
+ cb.Assign(s.mId);
+ c.id() = cb;
+
+ // Serialize transports.
+ if (s.mTransports.WasPassed()) {
+ uint8_t transports = 0;
+
+ // We ignore unknown transports for forward-compatibility, but this
+ // needs to be reviewed if values are added to the
+ // AuthenticatorTransport enum.
+ static_assert(MOZ_WEBAUTHN_ENUM_STRINGS_VERSION == 2);
+ for (const nsAString& str : s.mTransports.Value()) {
+ if (str.EqualsLiteral(MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_USB)) {
+ transports |= MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_USB;
+ } else if (str.EqualsLiteral(
+ MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_NFC)) {
+ transports |= MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_NFC;
+ } else if (str.EqualsLiteral(
+ MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_BLE)) {
+ transports |= MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_BLE;
+ } else if (str.EqualsLiteral(
+ MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_INTERNAL)) {
+ transports |= MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_INTERNAL;
+ }
+ }
+ c.transports() = transports;
+ }
+
+ allowList.AppendElement(c);
+ }
+ }
+
+ if (!MaybeCreateBackgroundActor()) {
+ promise->MaybeReject(NS_ERROR_DOM_OPERATION_ERR);
+ return promise.forget();
+ }
+
+ // If extensions were specified, process any extensions supported by this
+ // client platform, to produce the extension data that needs to be sent to the
+ // authenticator. If an error is encountered while processing an extension,
+ // skip that extension and do not produce any extension data for it. Call the
+ // result of this processing clientExtensions.
+ nsTArray<WebAuthnExtension> extensions;
+
+ // <https://w3c.github.io/webauthn/#sctn-appid-extension>
+ if (aOptions.mExtensions.mAppid.WasPassed()) {
+ nsString appId(aOptions.mExtensions.mAppid.Value());
+
+ // Check that the appId value is allowed.
+ if (!EvaluateAppID(mParent, origin, appId)) {
+ promise->MaybeReject(NS_ERROR_DOM_SECURITY_ERR);
+ return promise.forget();
+ }
+
+ CryptoBuffer appIdHash;
+ if (!appIdHash.SetLength(SHA256_LENGTH, fallible)) {
+ promise->MaybeReject(NS_ERROR_OUT_OF_MEMORY);
+ return promise.forget();
+ }
+
+ // We need the SHA-256 hash of the appId.
+ rv = HashCString(NS_ConvertUTF16toUTF8(appId), appIdHash);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ promise->MaybeReject(NS_ERROR_DOM_SECURITY_ERR);
+ return promise.forget();
+ }
+
+ // Append the hash and send it to the backend.
+ extensions.AppendElement(WebAuthnExtensionAppId(appIdHash, appId));
+ }
+
+ BrowsingContext* context = mParent->GetBrowsingContext();
+ if (!context) {
+ promise->MaybeReject(NS_ERROR_DOM_OPERATION_ERR);
+ return promise.forget();
+ }
+
+ WebAuthnGetAssertionInfo info(origin, NS_ConvertUTF8toUTF16(rpId), challenge,
+ clientDataJSON, adjustedTimeout, allowList,
+ extensions, aOptions.mUserVerification,
+ context->Top()->Id());
+
+#ifdef OS_WIN
+ if (!WinWebAuthnManager::AreWebAuthNApisAvailable()) {
+ ListenForVisibilityEvents();
+ }
+#else
+ ListenForVisibilityEvents();
+#endif
+
+ AbortSignal* signal = nullptr;
+ if (aSignal.WasPassed()) {
+ signal = &aSignal.Value();
+ Follow(signal);
+ }
+
+ MOZ_ASSERT(mTransaction.isNothing());
+ mTransaction = Some(WebAuthnTransaction(promise));
+ mChild->SendRequestSign(mTransaction.ref().mId, info);
+
+ return promise.forget();
+}
+
+already_AddRefed<Promise> WebAuthnManager::Store(const Credential& aCredential,
+ ErrorResult& aError) {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(mParent);
+
+ RefPtr<Promise> promise = Promise::Create(global, aError);
+ if (aError.Failed()) {
+ return nullptr;
+ }
+
+ if (mTransaction.isSome()) {
+ // If there hasn't been a visibility change during the current
+ // transaction, then let's let that one complete rather than
+ // cancelling it on a subsequent call.
+ if (!mTransaction.ref().mVisibilityChanged) {
+ promise->MaybeReject(NS_ERROR_DOM_ABORT_ERR);
+ return promise.forget();
+ }
+
+ // Otherwise, the user may well have clicked away, so let's
+ // abort the old transaction and take over control from here.
+ CancelTransaction(NS_ERROR_ABORT);
+ }
+
+ promise->MaybeReject(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
+ return promise.forget();
+}
+
+void WebAuthnManager::FinishMakeCredential(
+ const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialResult& aResult) {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ // Check for a valid transaction.
+ if (mTransaction.isNothing() || mTransaction.ref().mId != aTransactionId) {
+ return;
+ }
+
+ CryptoBuffer clientDataBuf;
+ if (NS_WARN_IF(!clientDataBuf.Assign(aResult.ClientDataJSON()))) {
+ RejectTransaction(NS_ERROR_OUT_OF_MEMORY);
+ return;
+ }
+
+ CryptoBuffer attObjBuf;
+ if (NS_WARN_IF(!attObjBuf.Assign(aResult.AttestationObject()))) {
+ RejectTransaction(NS_ERROR_OUT_OF_MEMORY);
+ return;
+ }
+
+ CryptoBuffer keyHandleBuf;
+ if (NS_WARN_IF(!keyHandleBuf.Assign(aResult.KeyHandle()))) {
+ RejectTransaction(NS_ERROR_OUT_OF_MEMORY);
+ return;
+ }
+
+ nsAutoString keyHandleBase64Url;
+ nsresult rv = keyHandleBuf.ToJwkBase64(keyHandleBase64Url);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ RejectTransaction(rv);
+ return;
+ }
+
+ // Create a new PublicKeyCredential object and populate its fields with the
+ // values returned from the authenticator as well as the clientDataJSON
+ // computed earlier.
+ RefPtr<AuthenticatorAttestationResponse> attestation =
+ new AuthenticatorAttestationResponse(mParent);
+ attestation->SetClientDataJSON(clientDataBuf);
+ attestation->SetAttestationObject(attObjBuf);
+
+ RefPtr<PublicKeyCredential> credential = new PublicKeyCredential(mParent);
+ credential->SetId(keyHandleBase64Url);
+ credential->SetType(u"public-key"_ns);
+ credential->SetRawId(keyHandleBuf);
+ credential->SetResponse(attestation);
+
+ // Forward client extension results.
+ for (const auto& ext : aResult.Extensions()) {
+ if (ext.type() ==
+ WebAuthnExtensionResult::TWebAuthnExtensionResultHmacSecret) {
+ bool hmacCreateSecret =
+ ext.get_WebAuthnExtensionResultHmacSecret().hmacCreateSecret();
+ credential->SetClientExtensionResultHmacSecret(hmacCreateSecret);
+ }
+ }
+
+ mTransaction.ref().mPromise->MaybeResolve(credential);
+ ClearTransaction();
+}
+
+void WebAuthnManager::FinishGetAssertion(
+ const uint64_t& aTransactionId, const WebAuthnGetAssertionResult& aResult) {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ // Check for a valid transaction.
+ if (mTransaction.isNothing() || mTransaction.ref().mId != aTransactionId) {
+ return;
+ }
+
+ CryptoBuffer clientDataBuf;
+ if (!clientDataBuf.Assign(aResult.ClientDataJSON())) {
+ RejectTransaction(NS_ERROR_OUT_OF_MEMORY);
+ return;
+ }
+
+ CryptoBuffer credentialBuf;
+ if (!credentialBuf.Assign(aResult.KeyHandle())) {
+ RejectTransaction(NS_ERROR_OUT_OF_MEMORY);
+ return;
+ }
+
+ CryptoBuffer signatureBuf;
+ if (!signatureBuf.Assign(aResult.Signature())) {
+ RejectTransaction(NS_ERROR_OUT_OF_MEMORY);
+ return;
+ }
+
+ CryptoBuffer authenticatorDataBuf;
+ if (!authenticatorDataBuf.Assign(aResult.AuthenticatorData())) {
+ RejectTransaction(NS_ERROR_OUT_OF_MEMORY);
+ return;
+ }
+
+ nsAutoString credentialBase64Url;
+ nsresult rv = credentialBuf.ToJwkBase64(credentialBase64Url);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ RejectTransaction(rv);
+ return;
+ }
+
+ CryptoBuffer userHandleBuf;
+ // U2FTokenManager don't return user handle.
+ // Best effort.
+ userHandleBuf.Assign(aResult.UserHandle());
+
+ // If any authenticator returns success:
+
+ // Create a new PublicKeyCredential object named value and populate its fields
+ // with the values returned from the authenticator as well as the
+ // clientDataJSON computed earlier.
+ RefPtr<AuthenticatorAssertionResponse> assertion =
+ new AuthenticatorAssertionResponse(mParent);
+ assertion->SetClientDataJSON(clientDataBuf);
+ assertion->SetAuthenticatorData(authenticatorDataBuf);
+ assertion->SetSignature(signatureBuf);
+ if (!userHandleBuf.IsEmpty()) {
+ assertion->SetUserHandle(userHandleBuf);
+ }
+
+ RefPtr<PublicKeyCredential> credential = new PublicKeyCredential(mParent);
+ credential->SetId(credentialBase64Url);
+ credential->SetType(u"public-key"_ns);
+ credential->SetRawId(credentialBuf);
+ credential->SetResponse(assertion);
+
+ // Forward client extension results.
+ for (const auto& ext : aResult.Extensions()) {
+ if (ext.type() == WebAuthnExtensionResult::TWebAuthnExtensionResultAppId) {
+ bool appid = ext.get_WebAuthnExtensionResultAppId().AppId();
+ credential->SetClientExtensionResultAppId(appid);
+ }
+ }
+
+ mTransaction.ref().mPromise->MaybeResolve(credential);
+ ClearTransaction();
+}
+
+void WebAuthnManager::RequestAborted(const uint64_t& aTransactionId,
+ const nsresult& aError) {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ if (mTransaction.isSome() && mTransaction.ref().mId == aTransactionId) {
+ RejectTransaction(aError);
+ }
+}
+
+void WebAuthnManager::RunAbortAlgorithm() {
+ CancelTransaction(NS_ERROR_DOM_ABORT_ERR);
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/WebAuthnManager.h b/dom/webauthn/WebAuthnManager.h
new file mode 100644
index 0000000000..8271512a69
--- /dev/null
+++ b/dom/webauthn/WebAuthnManager.h
@@ -0,0 +1,146 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WebAuthnManager_h
+#define mozilla_dom_WebAuthnManager_h
+
+#include "mozilla/Maybe.h"
+#include "mozilla/MozPromise.h"
+#include "mozilla/RandomNum.h"
+#include "mozilla/dom/AbortSignal.h"
+#include "mozilla/dom/PWebAuthnTransaction.h"
+#include "mozilla/dom/WebAuthnManagerBase.h"
+
+/*
+ * Content process manager for the WebAuthn protocol. Created on calls to the
+ * WebAuthentication DOM object, this manager handles establishing IPC channels
+ * for WebAuthn transactions, as well as keeping track of JS Promise objects
+ * representing transactions in flight.
+ *
+ * The WebAuthn spec (https://www.w3.org/TR/webauthn/) allows for two different
+ * types of transactions: registration and signing. When either of these is
+ * requested via the DOM API, the following steps are executed in the
+ * WebAuthnManager:
+ *
+ * - Validation of the request. Return a failed promise to js if request does
+ * not have correct parameters.
+ *
+ * - If request is valid, open a new IPC channel for running the transaction. If
+ * another transaction is already running in this content process, cancel it.
+ * Return a pending promise to js.
+ *
+ * - Send transaction information to parent process (by running the Start*
+ * functions of WebAuthnManager). Assuming another transaction is currently in
+ * flight in another content process, parent will handle canceling it.
+ *
+ * - On return of successful transaction information from parent process, turn
+ * information into DOM object format required by spec, and resolve promise
+ * (by running the Finish* functions of WebAuthnManager). On cancellation
+ * request from parent, reject promise with corresponding error code. Either
+ * outcome will also close the IPC channel.
+ *
+ */
+
+namespace mozilla::dom {
+
+class Credential;
+
+class WebAuthnTransaction {
+ public:
+ explicit WebAuthnTransaction(const RefPtr<Promise>& aPromise)
+ : mPromise(aPromise), mId(NextId()), mVisibilityChanged(false) {
+ MOZ_ASSERT(mId > 0);
+ }
+
+ // JS Promise representing the transaction status.
+ RefPtr<Promise> mPromise;
+
+ // Unique transaction id.
+ uint64_t mId;
+
+ // Whether or not visibility has changed for the window during this
+ // transaction
+ bool mVisibilityChanged;
+
+ private:
+ // Generates a probabilistically unique ID for the new transaction. IDs are 53
+ // bits, as they are used in javascript. We use a random value if possible,
+ // otherwise a counter.
+ static uint64_t NextId() {
+ static uint64_t id = 0;
+ Maybe<uint64_t> rand = mozilla::RandomUint64();
+ return rand.valueOr(++id) & UINT64_C(0x1fffffffffffff); // 2^53 - 1
+ }
+};
+
+class WebAuthnManager final : public WebAuthnManagerBase, public AbortFollower {
+ public:
+ NS_DECL_ISUPPORTS_INHERITED
+ NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(WebAuthnManager, WebAuthnManagerBase)
+
+ explicit WebAuthnManager(nsPIDOMWindowInner* aParent)
+ : WebAuthnManagerBase(aParent) {}
+
+ already_AddRefed<Promise> MakeCredential(
+ const PublicKeyCredentialCreationOptions& aOptions,
+ const Optional<OwningNonNull<AbortSignal>>& aSignal, ErrorResult& aError);
+
+ already_AddRefed<Promise> GetAssertion(
+ const PublicKeyCredentialRequestOptions& aOptions,
+ const Optional<OwningNonNull<AbortSignal>>& aSignal, ErrorResult& aError);
+
+ already_AddRefed<Promise> Store(const Credential& aCredential,
+ ErrorResult& aError);
+
+ // WebAuthnManagerBase
+
+ void FinishMakeCredential(
+ const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialResult& aResult) override;
+
+ void FinishGetAssertion(const uint64_t& aTransactionId,
+ const WebAuthnGetAssertionResult& aResult) override;
+
+ void RequestAborted(const uint64_t& aTransactionId,
+ const nsresult& aError) override;
+
+ // AbortFollower
+
+ void RunAbortAlgorithm() override;
+
+ protected:
+ // Cancels the current transaction (by sending a Cancel message to the
+ // parent) and rejects it by calling RejectTransaction().
+ void CancelTransaction(const nsresult& aError);
+ // Upon a visibility change, makes note of it in the current transaction.
+ void HandleVisibilityChange() override;
+
+ private:
+ virtual ~WebAuthnManager();
+
+ // Rejects the current transaction and calls ClearTransaction().
+ void RejectTransaction(const nsresult& aError);
+
+ // Clears all information we have about the current transaction.
+ void ClearTransaction();
+
+ // The current transaction, if any.
+ Maybe<WebAuthnTransaction> mTransaction;
+};
+
+inline void ImplCycleCollectionTraverse(
+ nsCycleCollectionTraversalCallback& aCallback,
+ WebAuthnTransaction& aTransaction, const char* aName, uint32_t aFlags = 0) {
+ ImplCycleCollectionTraverse(aCallback, aTransaction.mPromise, aName, aFlags);
+}
+
+inline void ImplCycleCollectionUnlink(WebAuthnTransaction& aTransaction) {
+ ImplCycleCollectionUnlink(aTransaction.mPromise);
+}
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_WebAuthnManager_h
diff --git a/dom/webauthn/WebAuthnManagerBase.cpp b/dom/webauthn/WebAuthnManagerBase.cpp
new file mode 100644
index 0000000000..ee46d7b1b2
--- /dev/null
+++ b/dom/webauthn/WebAuthnManagerBase.cpp
@@ -0,0 +1,151 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/WebAuthnManagerBase.h"
+#include "mozilla/dom/Document.h"
+#include "mozilla/dom/WebAuthnTransactionChild.h"
+#include "mozilla/ipc/BackgroundChild.h"
+#include "mozilla/ipc/PBackgroundChild.h"
+#include "mozilla/dom/Event.h"
+#include "nsGlobalWindowInner.h"
+#include "nsPIWindowRoot.h"
+
+namespace mozilla::dom {
+
+constexpr auto kDeactivateEvent = u"deactivate"_ns;
+constexpr auto kVisibilityChange = u"visibilitychange"_ns;
+
+WebAuthnManagerBase::WebAuthnManagerBase(nsPIDOMWindowInner* aParent)
+ : mParent(aParent) {
+ MOZ_ASSERT(NS_IsMainThread());
+ MOZ_ASSERT(aParent);
+}
+
+WebAuthnManagerBase::~WebAuthnManagerBase() { MOZ_ASSERT(NS_IsMainThread()); }
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(WebAuthnManagerBase)
+ NS_INTERFACE_MAP_ENTRY(nsISupports)
+ NS_INTERFACE_MAP_ENTRY(nsIDOMEventListener)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_CYCLE_COLLECTION(WebAuthnManagerBase, mParent)
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(WebAuthnManagerBase)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(WebAuthnManagerBase)
+
+/***********************************************************************
+ * IPC Protocol Implementation
+ **********************************************************************/
+
+bool WebAuthnManagerBase::MaybeCreateBackgroundActor() {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ if (mChild) {
+ return true;
+ }
+
+ ::mozilla::ipc::PBackgroundChild* actorChild =
+ ::mozilla::ipc::BackgroundChild::GetOrCreateForCurrentThread();
+ if (NS_WARN_IF(!actorChild)) {
+ return false;
+ }
+
+ RefPtr<WebAuthnTransactionChild> mgr(new WebAuthnTransactionChild(this));
+ PWebAuthnTransactionChild* constructedMgr =
+ actorChild->SendPWebAuthnTransactionConstructor(mgr);
+
+ if (NS_WARN_IF(!constructedMgr)) {
+ return false;
+ }
+
+ MOZ_ASSERT(constructedMgr == mgr);
+ mChild = std::move(mgr);
+
+ return true;
+}
+
+void WebAuthnManagerBase::ActorDestroyed() {
+ MOZ_ASSERT(NS_IsMainThread());
+ mChild = nullptr;
+}
+
+/***********************************************************************
+ * Event Handling
+ **********************************************************************/
+
+void WebAuthnManagerBase::ListenForVisibilityEvents() {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ nsCOMPtr<nsPIDOMWindowOuter> outer = mParent->GetOuterWindow();
+ if (NS_WARN_IF(!outer)) {
+ return;
+ }
+
+ nsCOMPtr<EventTarget> windowRoot = outer->GetTopWindowRoot();
+ if (NS_WARN_IF(!windowRoot)) {
+ return;
+ }
+
+ nsresult rv = windowRoot->AddEventListener(kDeactivateEvent, this,
+ /* use capture */ true,
+ /* wants untrusted */ false);
+ Unused << NS_WARN_IF(NS_FAILED(rv));
+
+ rv = windowRoot->AddEventListener(kVisibilityChange, this,
+ /* use capture */ true,
+ /* wants untrusted */ false);
+ Unused << NS_WARN_IF(NS_FAILED(rv));
+}
+
+void WebAuthnManagerBase::StopListeningForVisibilityEvents() {
+ MOZ_ASSERT(NS_IsMainThread());
+
+ nsCOMPtr<nsPIDOMWindowOuter> outer = mParent->GetOuterWindow();
+ if (NS_WARN_IF(!outer)) {
+ return;
+ }
+
+ nsCOMPtr<EventTarget> windowRoot = outer->GetTopWindowRoot();
+ if (NS_WARN_IF(!windowRoot)) {
+ return;
+ }
+
+ windowRoot->RemoveEventListener(kDeactivateEvent, this,
+ /* use capture */ true);
+ windowRoot->RemoveEventListener(kVisibilityChange, this,
+ /* use capture */ true);
+}
+
+NS_IMETHODIMP
+WebAuthnManagerBase::HandleEvent(Event* aEvent) {
+ MOZ_ASSERT(NS_IsMainThread());
+ MOZ_ASSERT(aEvent);
+
+ nsAutoString type;
+ aEvent->GetType(type);
+ if (!type.Equals(kDeactivateEvent) && !type.Equals(kVisibilityChange)) {
+ return NS_ERROR_FAILURE;
+ }
+
+ // The "deactivate" event on the root window has no
+ // "current inner window" and thus GetTarget() is always null.
+ if (type.Equals(kVisibilityChange)) {
+ nsCOMPtr<Document> doc = do_QueryInterface(aEvent->GetTarget());
+ if (NS_WARN_IF(!doc) || !doc->Hidden()) {
+ return NS_OK;
+ }
+
+ nsGlobalWindowInner* win = nsGlobalWindowInner::Cast(doc->GetInnerWindow());
+ if (NS_WARN_IF(!win) || !win->IsTopInnerWindow()) {
+ return NS_OK;
+ }
+ }
+
+ HandleVisibilityChange();
+ return NS_OK;
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/WebAuthnManagerBase.h b/dom/webauthn/WebAuthnManagerBase.h
new file mode 100644
index 0000000000..18806c5d35
--- /dev/null
+++ b/dom/webauthn/WebAuthnManagerBase.h
@@ -0,0 +1,73 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WebAuthnManagerBase_h
+#define mozilla_dom_WebAuthnManagerBase_h
+
+#include "nsIDOMEventListener.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsCOMPtr.h"
+
+/*
+ * A base class used by WebAuthn and U2F implementations, providing shared
+ * functionality and requiring an interface used by the IPC child actors.
+ */
+
+class nsPIDOMWindowInner;
+
+namespace mozilla::dom {
+
+class WebAuthnTransactionChild;
+class WebAuthnMakeCredentialResult;
+class WebAuthnGetAssertionResult;
+
+class WebAuthnManagerBase : public nsIDOMEventListener {
+ public:
+ NS_DECL_NSIDOMEVENTLISTENER
+
+ NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+ NS_DECL_CYCLE_COLLECTION_CLASS(WebAuthnManagerBase)
+
+ explicit WebAuthnManagerBase(nsPIDOMWindowInner* aParent);
+
+ MOZ_CAN_RUN_SCRIPT
+ virtual void FinishMakeCredential(
+ const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialResult& aResult) = 0;
+
+ MOZ_CAN_RUN_SCRIPT
+ virtual void FinishGetAssertion(
+ const uint64_t& aTransactionId,
+ const WebAuthnGetAssertionResult& aResult) = 0;
+
+ MOZ_CAN_RUN_SCRIPT
+ virtual void RequestAborted(const uint64_t& aTransactionId,
+ const nsresult& aError) = 0;
+
+ void ActorDestroyed();
+
+ protected:
+ MOZ_CAN_RUN_SCRIPT virtual ~WebAuthnManagerBase();
+
+ // Needed by HandleEvent() to track visibilty changes.
+ MOZ_CAN_RUN_SCRIPT virtual void HandleVisibilityChange() = 0;
+
+ // Visibility event handling.
+ void ListenForVisibilityEvents();
+ void StopListeningForVisibilityEvents();
+
+ bool MaybeCreateBackgroundActor();
+
+ // The parent window.
+ nsCOMPtr<nsPIDOMWindowInner> mParent;
+
+ // IPC Channel to the parent process.
+ RefPtr<WebAuthnTransactionChild> mChild;
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_WebAuthnManagerBase_h
diff --git a/dom/webauthn/WebAuthnTransactionChild.cpp b/dom/webauthn/WebAuthnTransactionChild.cpp
new file mode 100644
index 0000000000..15022ff981
--- /dev/null
+++ b/dom/webauthn/WebAuthnTransactionChild.cpp
@@ -0,0 +1,87 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/WebAuthnTransactionChild.h"
+
+namespace mozilla::dom {
+
+WebAuthnTransactionChild::WebAuthnTransactionChild(
+ WebAuthnManagerBase* aManager)
+ : mManager(aManager) {
+ MOZ_ASSERT(aManager);
+
+ // Retain a reference so the task object isn't deleted without IPDL's
+ // knowledge. The reference will be released by
+ // mozilla::ipc::BackgroundChildImpl::DeallocPWebAuthnTransactionChild.
+ NS_ADDREF_THIS();
+}
+
+mozilla::ipc::IPCResult WebAuthnTransactionChild::RecvConfirmRegister(
+ const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialResult& aResult) {
+ if (NS_WARN_IF(!mManager)) {
+ return IPC_FAIL_NO_REASON(this);
+ }
+
+ // We don't own the reference to mManager. We need to prevent its refcount
+ // going to 0 while we call anything that can reach the call to
+ // StopListeningForVisibilityEvents in WebAuthnManager::ClearTransaction
+ // (often via WebAuthnManager::RejectTransaction).
+ RefPtr<WebAuthnManagerBase> kungFuDeathGrip(mManager);
+ kungFuDeathGrip->FinishMakeCredential(aTransactionId, aResult);
+ return IPC_OK();
+}
+
+mozilla::ipc::IPCResult WebAuthnTransactionChild::RecvConfirmSign(
+ const uint64_t& aTransactionId, const WebAuthnGetAssertionResult& aResult) {
+ if (NS_WARN_IF(!mManager)) {
+ return IPC_FAIL_NO_REASON(this);
+ }
+
+ // We don't own the reference to mManager. We need to prevent its refcount
+ // going to 0 while we call anything that can reach the call to
+ // StopListeningForVisibilityEvents in WebAuthnManager::ClearTransaction
+ // (often via WebAuthnManager::RejectTransaction).
+ RefPtr<WebAuthnManagerBase> kungFuDeathGrip(mManager);
+ kungFuDeathGrip->FinishGetAssertion(aTransactionId, aResult);
+ return IPC_OK();
+}
+
+mozilla::ipc::IPCResult WebAuthnTransactionChild::RecvAbort(
+ const uint64_t& aTransactionId, const nsresult& aError) {
+ if (NS_WARN_IF(!mManager)) {
+ return IPC_FAIL_NO_REASON(this);
+ }
+
+ // We don't own the reference to mManager. We need to prevent its refcount
+ // going to 0 while we call anything that can reach the call to
+ // StopListeningForVisibilityEvents in WebAuthnManager::ClearTransaction
+ // (often via WebAuthnManager::RejectTransaction).
+ RefPtr<WebAuthnManagerBase> kungFuDeathGrip(mManager);
+ kungFuDeathGrip->RequestAborted(aTransactionId, aError);
+ return IPC_OK();
+}
+
+void WebAuthnTransactionChild::ActorDestroy(ActorDestroyReason why) {
+ // Called by either a __delete__ message from the parent, or when the
+ // channel disconnects. Clear out the child actor reference to be sure.
+ if (mManager) {
+ mManager->ActorDestroyed();
+ mManager = nullptr;
+ }
+}
+
+void WebAuthnTransactionChild::Disconnect() {
+ mManager = nullptr;
+
+ // The WebAuthnManager released us, but we're going to be held alive by the
+ // IPC layer. The parent will explicitly destroy us via Send__delete__(),
+ // after receiving the DestroyMe message.
+
+ SendDestroyMe();
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/WebAuthnTransactionChild.h b/dom/webauthn/WebAuthnTransactionChild.h
new file mode 100644
index 0000000000..fd2d4db90b
--- /dev/null
+++ b/dom/webauthn/WebAuthnTransactionChild.h
@@ -0,0 +1,60 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WebAuthnTransactionChild_h
+#define mozilla_dom_WebAuthnTransactionChild_h
+
+#include "mozilla/dom/PWebAuthnTransactionChild.h"
+#include "mozilla/dom/WebAuthnManagerBase.h"
+
+/*
+ * Child process IPC implementation for WebAuthn API. Receives results of
+ * WebAuthn transactions from the parent process, and sends them to the
+ * WebAuthnManager either cancel the transaction, or be formatted and relayed to
+ * content.
+ */
+
+namespace mozilla::dom {
+
+class WebAuthnTransactionChild final : public PWebAuthnTransactionChild {
+ public:
+ NS_INLINE_DECL_REFCOUNTING(WebAuthnTransactionChild);
+ explicit WebAuthnTransactionChild(WebAuthnManagerBase* aManager);
+
+ // MOZ_CAN_RUN_SCRIPT_BOUNDARY until we can do MOZ_CAN_RUN_SCRIPT in
+ // IPDL-generated things.
+ MOZ_CAN_RUN_SCRIPT_BOUNDARY
+ mozilla::ipc::IPCResult RecvConfirmRegister(
+ const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialResult& aResult);
+
+ // MOZ_CAN_RUN_SCRIPT_BOUNDARY until we can do MOZ_CAN_RUN_SCRIPT in
+ // IPDL-generated things.
+ MOZ_CAN_RUN_SCRIPT_BOUNDARY
+ mozilla::ipc::IPCResult RecvConfirmSign(
+ const uint64_t& aTransactionId,
+ const WebAuthnGetAssertionResult& aResult);
+
+ // MOZ_CAN_RUN_SCRIPT_BOUNDARY until we can do MOZ_CAN_RUN_SCRIPT in
+ // IPDL-generated things.
+ MOZ_CAN_RUN_SCRIPT_BOUNDARY
+ mozilla::ipc::IPCResult RecvAbort(const uint64_t& aTransactionId,
+ const nsresult& aError);
+
+ void ActorDestroy(ActorDestroyReason why) override;
+
+ void Disconnect();
+
+ private:
+ ~WebAuthnTransactionChild() = default;
+
+ // Nulled by ~WebAuthnManager() when disconnecting.
+ WebAuthnManagerBase* mManager;
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_WebAuthnTransactionChild_h
diff --git a/dom/webauthn/WebAuthnTransactionParent.cpp b/dom/webauthn/WebAuthnTransactionParent.cpp
new file mode 100644
index 0000000000..d73542d478
--- /dev/null
+++ b/dom/webauthn/WebAuthnTransactionParent.cpp
@@ -0,0 +1,148 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/WebAuthnTransactionParent.h"
+#include "mozilla/dom/WebAuthnController.h"
+#include "mozilla/dom/U2FTokenManager.h"
+#include "mozilla/ipc/PBackgroundParent.h"
+#include "mozilla/ipc/BackgroundParent.h"
+#include "mozilla/StaticPrefs_security.h"
+
+#include "nsThreadUtils.h"
+
+#ifdef OS_WIN
+# include "WinWebAuthnManager.h"
+#endif
+
+namespace mozilla::dom {
+
+mozilla::ipc::IPCResult WebAuthnTransactionParent::RecvRequestRegister(
+ const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialInfo& aTransactionInfo) {
+ ::mozilla::ipc::AssertIsOnBackgroundThread();
+
+#ifdef OS_WIN
+ if (WinWebAuthnManager::AreWebAuthNApisAvailable()) {
+ WinWebAuthnManager* mgr = WinWebAuthnManager::Get();
+ mgr->Register(this, aTransactionId, aTransactionInfo);
+ return IPC_OK();
+ }
+#endif
+
+ bool androidFido2 =
+ StaticPrefs::security_webauth_webauthn_enable_android_fido2();
+
+ if (!androidFido2) {
+ WebAuthnController* ctrl = WebAuthnController::Get();
+ ctrl->Register(this, aTransactionId, aTransactionInfo);
+ } else {
+ U2FTokenManager* mgr = U2FTokenManager::Get();
+ mgr->Register(this, aTransactionId, aTransactionInfo);
+ }
+
+ return IPC_OK();
+}
+
+mozilla::ipc::IPCResult WebAuthnTransactionParent::RecvRequestSign(
+ const uint64_t& aTransactionId,
+ const WebAuthnGetAssertionInfo& aTransactionInfo) {
+ ::mozilla::ipc::AssertIsOnBackgroundThread();
+
+#ifdef OS_WIN
+ if (WinWebAuthnManager::AreWebAuthNApisAvailable()) {
+ WinWebAuthnManager* mgr = WinWebAuthnManager::Get();
+ mgr->Sign(this, aTransactionId, aTransactionInfo);
+ return IPC_OK();
+ }
+#endif
+
+ bool androidFido2 =
+ StaticPrefs::security_webauth_webauthn_enable_android_fido2();
+
+ if (!androidFido2) {
+ WebAuthnController* ctrl = WebAuthnController::Get();
+ ctrl->Sign(this, aTransactionId, aTransactionInfo);
+ } else {
+ U2FTokenManager* mgr = U2FTokenManager::Get();
+ mgr->Sign(this, aTransactionId, aTransactionInfo);
+ }
+
+ return IPC_OK();
+}
+
+mozilla::ipc::IPCResult WebAuthnTransactionParent::RecvRequestCancel(
+ const Tainted<uint64_t>& aTransactionId) {
+ ::mozilla::ipc::AssertIsOnBackgroundThread();
+
+#ifdef OS_WIN
+ if (WinWebAuthnManager::AreWebAuthNApisAvailable()) {
+ WinWebAuthnManager* mgr = WinWebAuthnManager::Get();
+ mgr->Cancel(this, aTransactionId);
+ return IPC_OK();
+ }
+#endif
+
+ // We don't know whether WebAuthnController or U2FTokenManager was used, so
+ // try cancelling both.
+ WebAuthnController* ctrl = WebAuthnController::Get();
+ if (ctrl) {
+ ctrl->Cancel(this, aTransactionId);
+ }
+
+ U2FTokenManager* mgr = U2FTokenManager::Get();
+ if (mgr) {
+ mgr->Cancel(this, aTransactionId);
+ }
+
+ return IPC_OK();
+}
+
+mozilla::ipc::IPCResult WebAuthnTransactionParent::RecvDestroyMe() {
+ ::mozilla::ipc::AssertIsOnBackgroundThread();
+
+ // The child was disconnected from the WebAuthnManager instance and will send
+ // no further messages. It is kept alive until we delete it explicitly.
+
+ // The child should have cancelled any active transaction. This means
+ // we expect no more messages to the child. We'll crash otherwise.
+
+ // The IPC roundtrip is complete. No more messages, hopefully.
+ IProtocol* mgr = Manager();
+ if (!Send__delete__(this)) {
+ return IPC_FAIL_NO_REASON(mgr);
+ }
+
+ return IPC_OK();
+}
+
+void WebAuthnTransactionParent::ActorDestroy(ActorDestroyReason aWhy) {
+ ::mozilla::ipc::AssertIsOnBackgroundThread();
+
+ // Called either by Send__delete__() in RecvDestroyMe() above, or when
+ // the channel disconnects. Ensure the token manager forgets about us.
+
+#ifdef OS_WIN
+ if (WinWebAuthnManager::AreWebAuthNApisAvailable()) {
+ WinWebAuthnManager* mgr = WinWebAuthnManager::Get();
+ if (mgr) {
+ mgr->MaybeClearTransaction(this);
+ }
+ return;
+ }
+#endif
+
+ WebAuthnController* ctrl = WebAuthnController::Get();
+ if (ctrl) {
+ ctrl->MaybeClearTransaction(this);
+ }
+
+ U2FTokenManager* mgr = U2FTokenManager::Get();
+ if (mgr) {
+ mgr->MaybeClearTransaction(this);
+ }
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/WebAuthnTransactionParent.h b/dom/webauthn/WebAuthnTransactionParent.h
new file mode 100644
index 0000000000..45b466551b
--- /dev/null
+++ b/dom/webauthn/WebAuthnTransactionParent.h
@@ -0,0 +1,46 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WebAuthnTransactionParent_h
+#define mozilla_dom_WebAuthnTransactionParent_h
+
+#include "mozilla/dom/PWebAuthnTransactionParent.h"
+
+/*
+ * Parent process IPC implementation for WebAuthn and U2F API. Receives
+ * authentication data to be either registered or signed by a key, passes
+ * information to U2FTokenManager.
+ */
+
+namespace mozilla::dom {
+
+class WebAuthnTransactionParent final : public PWebAuthnTransactionParent {
+ public:
+ NS_INLINE_DECL_REFCOUNTING(WebAuthnTransactionParent);
+ WebAuthnTransactionParent() = default;
+
+ mozilla::ipc::IPCResult RecvRequestRegister(
+ const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialInfo& aTransactionInfo);
+
+ mozilla::ipc::IPCResult RecvRequestSign(
+ const uint64_t& aTransactionId,
+ const WebAuthnGetAssertionInfo& aTransactionInfo);
+
+ mozilla::ipc::IPCResult RecvRequestCancel(
+ const Tainted<uint64_t>& aTransactionId);
+
+ mozilla::ipc::IPCResult RecvDestroyMe();
+
+ virtual void ActorDestroy(ActorDestroyReason aWhy) override;
+
+ private:
+ ~WebAuthnTransactionParent() = default;
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_WebAuthnTransactionParent_h
diff --git a/dom/webauthn/WebAuthnTransportIdentifiers.h b/dom/webauthn/WebAuthnTransportIdentifiers.h
new file mode 100644
index 0000000000..f884648162
--- /dev/null
+++ b/dom/webauthn/WebAuthnTransportIdentifiers.h
@@ -0,0 +1,15 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WebAuthnTransportIdentifiers_h
+#define mozilla_dom_WebAuthnTransportIdentifiers_h
+
+#define MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_USB 1
+#define MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_NFC 2
+#define MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_BLE 4
+#define MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_INTERNAL 8
+
+#endif // mozilla_dom_WebAuthnTransportIdentifiers_h
diff --git a/dom/webauthn/WebAuthnUtil.cpp b/dom/webauthn/WebAuthnUtil.cpp
new file mode 100644
index 0000000000..f437e5d361
--- /dev/null
+++ b/dom/webauthn/WebAuthnUtil.cpp
@@ -0,0 +1,460 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/WebAuthnUtil.h"
+#include "mozilla/dom/WebAuthnCBORUtil.h"
+#include "nsComponentManagerUtils.h"
+#include "nsICryptoHash.h"
+#include "nsIEffectiveTLDService.h"
+#include "nsNetUtil.h"
+#include "mozpkix/pkixutil.h"
+#include "nsHTMLDocument.h"
+#include "hasht.h"
+
+namespace mozilla::dom {
+
+// Bug #1436078 - Permit Google Accounts. Remove in Bug #1436085 in Jan 2023.
+constexpr auto kGoogleAccountsAppId1 =
+ u"https://www.gstatic.com/securitykey/origins.json"_ns;
+constexpr auto kGoogleAccountsAppId2 =
+ u"https://www.gstatic.com/securitykey/a/google.com/origins.json"_ns;
+
+const uint8_t FLAG_TUP = 0x01; // Test of User Presence required
+const uint8_t FLAG_AT = 0x40; // Authenticator Data is provided
+
+bool EvaluateAppID(nsPIDOMWindowInner* aParent, const nsString& aOrigin,
+ /* in/out */ nsString& aAppId) {
+ // Facet is the specification's way of referring to the web origin.
+ nsAutoCString facetString = NS_ConvertUTF16toUTF8(aOrigin);
+ nsCOMPtr<nsIURI> facetUri;
+ if (NS_FAILED(NS_NewURI(getter_AddRefs(facetUri), facetString))) {
+ return false;
+ }
+
+ // If the facetId (origin) is not HTTPS, reject
+ if (!facetUri->SchemeIs("https")) {
+ return false;
+ }
+
+ // If the appId is empty or null, overwrite it with the facetId and accept
+ if (aAppId.IsEmpty() || aAppId.EqualsLiteral("null")) {
+ aAppId.Assign(aOrigin);
+ return true;
+ }
+
+ // AppID is user-supplied. It's quite possible for this parse to fail.
+ nsAutoCString appIdString = NS_ConvertUTF16toUTF8(aAppId);
+ nsCOMPtr<nsIURI> appIdUri;
+ if (NS_FAILED(NS_NewURI(getter_AddRefs(appIdUri), appIdString))) {
+ return false;
+ }
+
+ // if the appId URL is not HTTPS, reject.
+ if (!appIdUri->SchemeIs("https")) {
+ return false;
+ }
+
+ nsAutoCString appIdHost;
+ if (NS_FAILED(appIdUri->GetAsciiHost(appIdHost))) {
+ return false;
+ }
+
+ // Allow localhost.
+ if (appIdHost.EqualsLiteral("localhost")) {
+ nsAutoCString facetHost;
+ if (NS_FAILED(facetUri->GetAsciiHost(facetHost))) {
+ return false;
+ }
+
+ if (facetHost.EqualsLiteral("localhost")) {
+ return true;
+ }
+ }
+
+ // Run the HTML5 algorithm to relax the same-origin policy, copied from W3C
+ // Web Authentication. See Bug 1244959 comment #8 for context on why we are
+ // doing this instead of implementing the external-fetch FacetID logic.
+ nsCOMPtr<Document> document = aParent->GetDoc();
+ if (!document || !document->IsHTMLDocument()) {
+ return false;
+ }
+
+ nsHTMLDocument* html = document->AsHTMLDocument();
+ // Use the base domain as the facet for evaluation. This lets this algorithm
+ // relax the whole eTLD+1.
+ nsCOMPtr<nsIEffectiveTLDService> tldService =
+ do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
+ if (!tldService) {
+ return false;
+ }
+
+ nsAutoCString lowestFacetHost;
+ if (NS_FAILED(tldService->GetBaseDomain(facetUri, 0, lowestFacetHost))) {
+ return false;
+ }
+
+ if (html->IsRegistrableDomainSuffixOfOrEqualTo(
+ NS_ConvertUTF8toUTF16(lowestFacetHost), appIdHost)) {
+ return true;
+ }
+
+ // Bug #1436078 - Permit Google Accounts. Remove in Bug #1436085 in Jan 2023.
+ if (lowestFacetHost.EqualsLiteral("google.com") &&
+ (aAppId.Equals(kGoogleAccountsAppId1) ||
+ aAppId.Equals(kGoogleAccountsAppId2))) {
+ return true;
+ }
+
+ return false;
+}
+
+nsresult ReadToCryptoBuffer(pkix::Reader& aSrc, /* out */ CryptoBuffer& aDest,
+ uint32_t aLen) {
+ if (aSrc.EnsureLength(aLen) != pkix::Success) {
+ return NS_ERROR_DOM_UNKNOWN_ERR;
+ }
+
+ if (!aDest.SetCapacity(aLen, mozilla::fallible)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ for (uint32_t offset = 0; offset < aLen; ++offset) {
+ uint8_t b;
+ if (aSrc.Read(b) != pkix::Success) {
+ return NS_ERROR_DOM_UNKNOWN_ERR;
+ }
+ if (!aDest.AppendElement(b, mozilla::fallible)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ }
+
+ return NS_OK;
+}
+
+// Format:
+// 32 bytes: SHA256 of the RP ID
+// 1 byte: flags (TUP & AT)
+// 4 bytes: sign counter
+// variable: attestation data struct
+// variable: CBOR-format extension auth data (optional, not flagged)
+nsresult AssembleAuthenticatorData(const CryptoBuffer& rpIdHashBuf,
+ const uint8_t flags,
+ const CryptoBuffer& counterBuf,
+ const CryptoBuffer& attestationDataBuf,
+ /* out */ CryptoBuffer& authDataBuf) {
+ if (NS_WARN_IF(!authDataBuf.SetCapacity(
+ 32 + 1 + 4 + attestationDataBuf.Length(), mozilla::fallible))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ if (rpIdHashBuf.Length() != 32 || counterBuf.Length() != 4) {
+ return NS_ERROR_INVALID_ARG;
+ }
+
+ (void)authDataBuf.AppendElements(rpIdHashBuf, mozilla::fallible);
+ (void)authDataBuf.AppendElement(flags, mozilla::fallible);
+ (void)authDataBuf.AppendElements(counterBuf, mozilla::fallible);
+ (void)authDataBuf.AppendElements(attestationDataBuf, mozilla::fallible);
+ return NS_OK;
+}
+
+// attestation data struct format:
+// - 16 bytes: AAGUID
+// - 2 bytes: Length of Credential ID
+// - L bytes: Credential ID
+// - variable: CBOR-format public key
+nsresult AssembleAttestationData(const CryptoBuffer& aaguidBuf,
+ const CryptoBuffer& keyHandleBuf,
+ const CryptoBuffer& pubKeyObj,
+ /* out */ CryptoBuffer& attestationDataBuf) {
+ if (NS_WARN_IF(!attestationDataBuf.SetCapacity(
+ aaguidBuf.Length() + 2 + keyHandleBuf.Length() + pubKeyObj.Length(),
+ mozilla::fallible))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ if (keyHandleBuf.Length() > 0xFFFF) {
+ return NS_ERROR_INVALID_ARG;
+ }
+
+ (void)attestationDataBuf.AppendElements(aaguidBuf, mozilla::fallible);
+ (void)attestationDataBuf.AppendElement((keyHandleBuf.Length() >> 8) & 0xFF,
+ mozilla::fallible);
+ (void)attestationDataBuf.AppendElement((keyHandleBuf.Length() >> 0) & 0xFF,
+ mozilla::fallible);
+ (void)attestationDataBuf.AppendElements(keyHandleBuf, mozilla::fallible);
+ (void)attestationDataBuf.AppendElements(pubKeyObj, mozilla::fallible);
+ return NS_OK;
+}
+
+nsresult AssembleAttestationObject(const CryptoBuffer& aRpIdHash,
+ const CryptoBuffer& aPubKeyBuf,
+ const CryptoBuffer& aKeyHandleBuf,
+ const CryptoBuffer& aAttestationCertBuf,
+ const CryptoBuffer& aSignatureBuf,
+ bool aForceNoneAttestation,
+ /* out */ CryptoBuffer& aAttestationObjBuf) {
+ // Construct the public key object
+ CryptoBuffer pubKeyObj;
+ nsresult rv = CBOREncodePublicKeyObj(aPubKeyBuf, pubKeyObj);
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+
+ mozilla::dom::CryptoBuffer aaguidBuf;
+ if (NS_WARN_IF(!aaguidBuf.SetCapacity(16, mozilla::fallible))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ // FIDO U2F devices have no AAGUIDs, so they'll be all zeros until we add
+ // support for CTAP2 devices.
+ for (int i = 0; i < 16; i++) {
+ // SetCapacity was just called, these cannot fail.
+ (void)aaguidBuf.AppendElement(0x00, mozilla::fallible);
+ }
+
+ // During create credential, counter is always 0 for U2F
+ // See https://github.com/w3c/webauthn/issues/507
+ mozilla::dom::CryptoBuffer counterBuf;
+ if (NS_WARN_IF(!counterBuf.SetCapacity(4, mozilla::fallible))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ // SetCapacity was just called, these cannot fail.
+ (void)counterBuf.AppendElement(0x00, mozilla::fallible);
+ (void)counterBuf.AppendElement(0x00, mozilla::fallible);
+ (void)counterBuf.AppendElement(0x00, mozilla::fallible);
+ (void)counterBuf.AppendElement(0x00, mozilla::fallible);
+
+ // Construct the Attestation Data, which slots into the end of the
+ // Authentication Data buffer.
+ CryptoBuffer attDataBuf;
+ rv = AssembleAttestationData(aaguidBuf, aKeyHandleBuf, pubKeyObj, attDataBuf);
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+
+ CryptoBuffer authDataBuf;
+ // attDataBuf always contains data, so per [1] we have to set the AT flag.
+ // [1] https://w3c.github.io/webauthn/#sec-authenticator-data
+ const uint8_t flags = FLAG_TUP | FLAG_AT;
+ rv = AssembleAuthenticatorData(aRpIdHash, flags, counterBuf, attDataBuf,
+ authDataBuf);
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+
+ // Direct attestation might have been requested by the RP.
+ // The user might override this and request anonymization anyway.
+ if (aForceNoneAttestation) {
+ rv = CBOREncodeNoneAttestationObj(authDataBuf, aAttestationObjBuf);
+ } else {
+ rv = CBOREncodeFidoU2FAttestationObj(authDataBuf, aAttestationCertBuf,
+ aSignatureBuf, aAttestationObjBuf);
+ }
+
+ return rv;
+}
+
+nsresult U2FDecomposeSignResponse(const CryptoBuffer& aResponse,
+ /* out */ uint8_t& aFlags,
+ /* out */ CryptoBuffer& aCounterBuf,
+ /* out */ CryptoBuffer& aSignatureBuf) {
+ if (aResponse.Length() < 5) {
+ return NS_ERROR_INVALID_ARG;
+ }
+
+ Span<const uint8_t> rspView = Span(aResponse);
+ aFlags = rspView[0];
+
+ if (NS_WARN_IF(!aCounterBuf.AppendElements(rspView.FromTo(1, 5),
+ mozilla::fallible))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ if (NS_WARN_IF(
+ !aSignatureBuf.AppendElements(rspView.From(5), mozilla::fallible))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ return NS_OK;
+}
+
+nsresult U2FDecomposeRegistrationResponse(
+ const CryptoBuffer& aResponse,
+ /* out */ CryptoBuffer& aPubKeyBuf,
+ /* out */ CryptoBuffer& aKeyHandleBuf,
+ /* out */ CryptoBuffer& aAttestationCertBuf,
+ /* out */ CryptoBuffer& aSignatureBuf) {
+ // U2F v1.1 Format via
+ // http://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html
+ //
+ // Bytes Value
+ // 1 0x05
+ // 65 public key
+ // 1 key handle length
+ // * key handle
+ // ASN.1 attestation certificate
+ // * attestation signature
+
+ pkix::Input u2fResponse;
+ u2fResponse.Init(aResponse.Elements(), aResponse.Length());
+
+ pkix::Reader input(u2fResponse);
+
+ uint8_t b;
+ if (input.Read(b) != pkix::Success) {
+ return NS_ERROR_DOM_UNKNOWN_ERR;
+ }
+ if (b != 0x05) {
+ return NS_ERROR_DOM_UNKNOWN_ERR;
+ }
+
+ nsresult rv = ReadToCryptoBuffer(input, aPubKeyBuf, 65);
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+
+ uint8_t handleLen;
+ if (input.Read(handleLen) != pkix::Success) {
+ return NS_ERROR_DOM_UNKNOWN_ERR;
+ }
+
+ rv = ReadToCryptoBuffer(input, aKeyHandleBuf, handleLen);
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+
+ // We have to parse the ASN.1 SEQUENCE on the outside to determine the cert's
+ // length.
+ pkix::Input cert;
+ if (pkix::der::ExpectTagAndGetTLV(input, pkix::der::SEQUENCE, cert) !=
+ pkix::Success) {
+ return NS_ERROR_DOM_UNKNOWN_ERR;
+ }
+
+ pkix::Reader certInput(cert);
+ rv = ReadToCryptoBuffer(certInput, aAttestationCertBuf, cert.GetLength());
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+
+ // The remainder of u2fResponse is the signature
+ pkix::Input u2fSig;
+ input.SkipToEnd(u2fSig);
+ pkix::Reader sigInput(u2fSig);
+ rv = ReadToCryptoBuffer(sigInput, aSignatureBuf, u2fSig.GetLength());
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+
+ MOZ_ASSERT(input.AtEnd());
+ return NS_OK;
+}
+
+nsresult U2FDecomposeECKey(const CryptoBuffer& aPubKeyBuf,
+ /* out */ CryptoBuffer& aXcoord,
+ /* out */ CryptoBuffer& aYcoord) {
+ pkix::Input pubKey;
+ pubKey.Init(aPubKeyBuf.Elements(), aPubKeyBuf.Length());
+
+ pkix::Reader input(pubKey);
+ uint8_t b;
+ if (input.Read(b) != pkix::Success) {
+ return NS_ERROR_DOM_UNKNOWN_ERR;
+ }
+ if (b != 0x04) {
+ return NS_ERROR_DOM_UNKNOWN_ERR;
+ }
+
+ nsresult rv = ReadToCryptoBuffer(input, aXcoord, 32);
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+
+ rv = ReadToCryptoBuffer(input, aYcoord, 32);
+ if (NS_FAILED(rv)) {
+ return rv;
+ }
+
+ MOZ_ASSERT(input.AtEnd());
+ return NS_OK;
+}
+
+static nsresult HashCString(nsICryptoHash* aHashService, const nsACString& aIn,
+ /* out */ CryptoBuffer& aOut) {
+ MOZ_ASSERT(aHashService);
+
+ nsresult rv = aHashService->Init(nsICryptoHash::SHA256);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return rv;
+ }
+
+ rv = aHashService->Update(
+ reinterpret_cast<const uint8_t*>(aIn.BeginReading()), aIn.Length());
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return rv;
+ }
+
+ nsAutoCString fullHash;
+ // Passing false below means we will get a binary result rather than a
+ // base64-encoded string.
+ rv = aHashService->Finish(false, fullHash);
+ if (NS_WARN_IF(NS_FAILED(rv))) {
+ return rv;
+ }
+
+ if (NS_WARN_IF(!aOut.Assign(fullHash))) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+
+ return NS_OK;
+}
+
+nsresult HashCString(const nsACString& aIn, /* out */ CryptoBuffer& aOut) {
+ nsresult srv;
+ nsCOMPtr<nsICryptoHash> hashService =
+ do_CreateInstance(NS_CRYPTO_HASH_CONTRACTID, &srv);
+ if (NS_FAILED(srv)) {
+ return srv;
+ }
+
+ srv = HashCString(hashService, aIn, aOut);
+ if (NS_WARN_IF(NS_FAILED(srv))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ return NS_OK;
+}
+
+nsresult BuildTransactionHashes(const nsCString& aRpId,
+ const nsCString& aClientDataJSON,
+ /* out */ CryptoBuffer& aRpIdHash,
+ /* out */ CryptoBuffer& aClientDataHash) {
+ nsresult srv;
+ nsCOMPtr<nsICryptoHash> hashService =
+ do_CreateInstance(NS_CRYPTO_HASH_CONTRACTID, &srv);
+ if (NS_FAILED(srv)) {
+ return srv;
+ }
+
+ if (!aRpIdHash.SetLength(SHA256_LENGTH, fallible)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ srv = HashCString(hashService, aRpId, aRpIdHash);
+ if (NS_WARN_IF(NS_FAILED(srv))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ if (!aClientDataHash.SetLength(SHA256_LENGTH, fallible)) {
+ return NS_ERROR_OUT_OF_MEMORY;
+ }
+ srv = HashCString(hashService, aClientDataJSON, aClientDataHash);
+ if (NS_WARN_IF(NS_FAILED(srv))) {
+ return NS_ERROR_FAILURE;
+ }
+
+ return NS_OK;
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/WebAuthnUtil.h b/dom/webauthn/WebAuthnUtil.h
new file mode 100644
index 0000000000..175ed8517e
--- /dev/null
+++ b/dom/webauthn/WebAuthnUtil.h
@@ -0,0 +1,65 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WebAuthnUtil_h
+#define mozilla_dom_WebAuthnUtil_h
+
+/*
+ * Utility functions used by both WebAuthnManager and U2FTokenManager.
+ */
+
+#include "ipc/EnumSerializer.h"
+#include "mozilla/dom/CryptoBuffer.h"
+#include "mozilla/dom/WebAuthenticationBinding.h"
+#include "ipc/IPCMessageUtils.h"
+
+namespace mozilla::dom {
+
+enum class U2FOperation { Register, Sign };
+
+bool EvaluateAppID(nsPIDOMWindowInner* aParent, const nsString& aOrigin,
+ /* in/out */ nsString& aAppId);
+
+nsresult AssembleAuthenticatorData(const CryptoBuffer& rpIdHashBuf,
+ const uint8_t flags,
+ const CryptoBuffer& counterBuf,
+ const CryptoBuffer& attestationDataBuf,
+ /* out */ CryptoBuffer& authDataBuf);
+
+nsresult AssembleAttestationObject(const CryptoBuffer& aRpIdHash,
+ const CryptoBuffer& aPubKeyBuf,
+ const CryptoBuffer& aKeyHandleBuf,
+ const CryptoBuffer& aAttestationCertBuf,
+ const CryptoBuffer& aSignatureBuf,
+ bool aForceNoneAttestation,
+ /* out */ CryptoBuffer& aAttestationObjBuf);
+
+nsresult U2FDecomposeSignResponse(const CryptoBuffer& aResponse,
+ /* out */ uint8_t& aFlags,
+ /* out */ CryptoBuffer& aCounterBuf,
+ /* out */ CryptoBuffer& aSignatureBuf);
+
+nsresult U2FDecomposeRegistrationResponse(
+ const CryptoBuffer& aResponse,
+ /* out */ CryptoBuffer& aPubKeyBuf,
+ /* out */ CryptoBuffer& aKeyHandleBuf,
+ /* out */ CryptoBuffer& aAttestationCertBuf,
+ /* out */ CryptoBuffer& aSignatureBuf);
+
+nsresult U2FDecomposeECKey(const CryptoBuffer& aPubKeyBuf,
+ /* out */ CryptoBuffer& aXcoord,
+ /* out */ CryptoBuffer& aYcoord);
+
+nsresult HashCString(const nsACString& aIn, /* out */ CryptoBuffer& aOut);
+
+nsresult BuildTransactionHashes(const nsCString& aRpId,
+ const nsCString& aClientDataJSON,
+ /* out */ CryptoBuffer& aRpIdHash,
+ /* out */ CryptoBuffer& aClientDataHash);
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_WebAuthnUtil_h
diff --git a/dom/webauthn/WinWebAuthnManager.cpp b/dom/webauthn/WinWebAuthnManager.cpp
new file mode 100644
index 0000000000..aa330212bf
--- /dev/null
+++ b/dom/webauthn/WinWebAuthnManager.cpp
@@ -0,0 +1,706 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/Assertions.h"
+#include "mozilla/dom/PWebAuthnTransactionParent.h"
+#include "mozilla/dom/WebAuthnCBORUtil.h"
+#include "mozilla/MozPromise.h"
+#include "mozilla/ipc/BackgroundParent.h"
+#include "mozilla/ClearOnShutdown.h"
+#include "mozilla/dom/CryptoBuffer.h"
+#include "mozilla/Unused.h"
+#include "nsTextFormatter.h"
+#include "nsWindowsHelpers.h"
+#include "WebAuthnEnumStrings.h"
+#include "WebAuthnTransportIdentifiers.h"
+#include "winwebauthn/webauthn.h"
+#include "WinWebAuthnManager.h"
+
+namespace mozilla::dom {
+
+namespace {
+static mozilla::LazyLogModule gWinWebAuthnManagerLog("winwebauthnkeymanager");
+StaticAutoPtr<WinWebAuthnManager> gWinWebAuthnManager;
+static HMODULE gWinWebAuthnModule = 0;
+
+static decltype(WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable)*
+ gWinWebauthnIsUVPAA = nullptr;
+static decltype(WebAuthNAuthenticatorMakeCredential)*
+ gWinWebauthnMakeCredential = nullptr;
+static decltype(WebAuthNFreeCredentialAttestation)*
+ gWinWebauthnFreeCredentialAttestation = nullptr;
+static decltype(WebAuthNAuthenticatorGetAssertion)* gWinWebauthnGetAssertion =
+ nullptr;
+static decltype(WebAuthNFreeAssertion)* gWinWebauthnFreeAssertion = nullptr;
+static decltype(WebAuthNGetCancellationId)* gWinWebauthnGetCancellationId =
+ nullptr;
+static decltype(WebAuthNCancelCurrentOperation)*
+ gWinWebauthnCancelCurrentOperation = nullptr;
+static decltype(WebAuthNGetErrorName)* gWinWebauthnGetErrorName = nullptr;
+static decltype(WebAuthNGetApiVersionNumber)* gWinWebauthnGetApiVersionNumber =
+ nullptr;
+
+} // namespace
+
+/***********************************************************************
+ * WinWebAuthnManager Implementation
+ **********************************************************************/
+
+constexpr uint32_t kMinWinWebAuthNApiVersion = WEBAUTHN_API_VERSION_1;
+
+WinWebAuthnManager::WinWebAuthnManager() {
+ // Create on the main thread to make sure ClearOnShutdown() works.
+ MOZ_ASSERT(NS_IsMainThread());
+ MOZ_ASSERT(!gWinWebAuthnModule);
+
+ gWinWebAuthnModule = LoadLibrarySystem32(L"webauthn.dll");
+
+ if (gWinWebAuthnModule) {
+ gWinWebauthnIsUVPAA = reinterpret_cast<
+ decltype(WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable)*>(
+ GetProcAddress(
+ gWinWebAuthnModule,
+ "WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable"));
+ gWinWebauthnMakeCredential =
+ reinterpret_cast<decltype(WebAuthNAuthenticatorMakeCredential)*>(
+ GetProcAddress(gWinWebAuthnModule,
+ "WebAuthNAuthenticatorMakeCredential"));
+ gWinWebauthnFreeCredentialAttestation =
+ reinterpret_cast<decltype(WebAuthNFreeCredentialAttestation)*>(
+ GetProcAddress(gWinWebAuthnModule,
+ "WebAuthNFreeCredentialAttestation"));
+ gWinWebauthnGetAssertion =
+ reinterpret_cast<decltype(WebAuthNAuthenticatorGetAssertion)*>(
+ GetProcAddress(gWinWebAuthnModule,
+ "WebAuthNAuthenticatorGetAssertion"));
+ gWinWebauthnFreeAssertion =
+ reinterpret_cast<decltype(WebAuthNFreeAssertion)*>(
+ GetProcAddress(gWinWebAuthnModule, "WebAuthNFreeAssertion"));
+ gWinWebauthnGetCancellationId =
+ reinterpret_cast<decltype(WebAuthNGetCancellationId)*>(
+ GetProcAddress(gWinWebAuthnModule, "WebAuthNGetCancellationId"));
+ gWinWebauthnCancelCurrentOperation =
+ reinterpret_cast<decltype(WebAuthNCancelCurrentOperation)*>(
+ GetProcAddress(gWinWebAuthnModule,
+ "WebAuthNCancelCurrentOperation"));
+ gWinWebauthnGetErrorName =
+ reinterpret_cast<decltype(WebAuthNGetErrorName)*>(
+ GetProcAddress(gWinWebAuthnModule, "WebAuthNGetErrorName"));
+ gWinWebauthnGetApiVersionNumber =
+ reinterpret_cast<decltype(WebAuthNGetApiVersionNumber)*>(
+ GetProcAddress(gWinWebAuthnModule, "WebAuthNGetApiVersionNumber"));
+
+ if (gWinWebauthnIsUVPAA && gWinWebauthnMakeCredential &&
+ gWinWebauthnFreeCredentialAttestation && gWinWebauthnGetAssertion &&
+ gWinWebauthnFreeAssertion && gWinWebauthnGetCancellationId &&
+ gWinWebauthnCancelCurrentOperation && gWinWebauthnGetErrorName &&
+ gWinWebauthnGetApiVersionNumber) {
+ mWinWebAuthNApiVersion = gWinWebauthnGetApiVersionNumber();
+ }
+ }
+}
+
+WinWebAuthnManager::~WinWebAuthnManager() {
+ if (gWinWebAuthnModule) {
+ FreeLibrary(gWinWebAuthnModule);
+ }
+ gWinWebAuthnModule = 0;
+}
+
+// static
+void WinWebAuthnManager::Initialize() {
+ if (!gWinWebAuthnManager) {
+ gWinWebAuthnManager = new WinWebAuthnManager();
+ ClearOnShutdown(&gWinWebAuthnManager);
+ }
+}
+
+// static
+WinWebAuthnManager* WinWebAuthnManager::Get() {
+ MOZ_ASSERT(gWinWebAuthnManager);
+ return gWinWebAuthnManager;
+}
+
+uint32_t WinWebAuthnManager::GetWebAuthNApiVersion() {
+ return mWinWebAuthNApiVersion;
+}
+
+// static
+bool WinWebAuthnManager::AreWebAuthNApisAvailable() {
+ WinWebAuthnManager* mgr = WinWebAuthnManager::Get();
+ return mgr->GetWebAuthNApiVersion() >= kMinWinWebAuthNApiVersion;
+}
+
+bool WinWebAuthnManager::
+ IsUserVerifyingPlatformAuthenticatorAvailableInternal() {
+ BOOL isUVPAA = FALSE;
+ return (gWinWebauthnIsUVPAA(&isUVPAA) == S_OK && isUVPAA == TRUE);
+}
+
+// static
+bool WinWebAuthnManager::IsUserVerifyingPlatformAuthenticatorAvailable() {
+ if (WinWebAuthnManager::AreWebAuthNApisAvailable()) {
+ return WinWebAuthnManager::Get()
+ ->IsUserVerifyingPlatformAuthenticatorAvailableInternal();
+ }
+ return false;
+}
+
+void WinWebAuthnManager::AbortTransaction(const uint64_t& aTransactionId,
+ const nsresult& aError) {
+ Unused << mTransactionParent->SendAbort(aTransactionId, aError);
+ ClearTransaction();
+}
+
+void WinWebAuthnManager::MaybeClearTransaction(
+ PWebAuthnTransactionParent* aParent) {
+ // Only clear if we've been requested to do so by our current transaction
+ // parent.
+ if (mTransactionParent == aParent) {
+ ClearTransaction();
+ }
+}
+
+void WinWebAuthnManager::ClearTransaction() { mTransactionParent = nullptr; }
+
+void WinWebAuthnManager::Register(
+ PWebAuthnTransactionParent* aTransactionParent,
+ const uint64_t& aTransactionId, const WebAuthnMakeCredentialInfo& aInfo) {
+ MOZ_LOG(gWinWebAuthnManagerLog, LogLevel::Debug, ("WinWebAuthNRegister"));
+
+ ClearTransaction();
+ mTransactionParent = aTransactionParent;
+
+ WEBAUTHN_EXTENSION rgExtension[1] = {};
+ DWORD cExtensions = 0;
+ BOOL HmacCreateSecret = FALSE;
+
+ // RP Information
+ WEBAUTHN_RP_ENTITY_INFORMATION rpInfo = {
+ WEBAUTHN_RP_ENTITY_INFORMATION_CURRENT_VERSION, aInfo.RpId().get(),
+ nullptr, nullptr};
+
+ // User Information
+ WEBAUTHN_USER_ENTITY_INFORMATION userInfo = {
+ WEBAUTHN_USER_ENTITY_INFORMATION_CURRENT_VERSION,
+ 0,
+ nullptr,
+ nullptr,
+ nullptr,
+ nullptr};
+
+ // Client Data
+ WEBAUTHN_CLIENT_DATA WebAuthNClientData = {
+ WEBAUTHN_CLIENT_DATA_CURRENT_VERSION,
+ (DWORD)aInfo.ClientDataJSON().Length(),
+ (BYTE*)(aInfo.ClientDataJSON().get()), WEBAUTHN_HASH_ALGORITHM_SHA_256};
+
+ // Algorithms
+ nsTArray<WEBAUTHN_COSE_CREDENTIAL_PARAMETER> coseParams;
+
+ // User Verification Requirement
+ DWORD winUserVerificationReq = WEBAUTHN_USER_VERIFICATION_REQUIREMENT_ANY;
+
+ // Attachment
+ DWORD winAttachment = WEBAUTHN_AUTHENTICATOR_ATTACHMENT_ANY;
+
+ // Resident Key
+ BOOL winRequireResidentKey = FALSE;
+ BOOL winPreferResidentKey = FALSE;
+
+ // AttestationConveyance
+ DWORD winAttestation = WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_ANY;
+
+ rpInfo.pwszName = aInfo.Rp().Name().get();
+ rpInfo.pwszIcon = aInfo.Rp().Icon().get();
+
+ userInfo.cbId = static_cast<DWORD>(aInfo.User().Id().Length());
+ userInfo.pbId = const_cast<unsigned char*>(aInfo.User().Id().Elements());
+ userInfo.pwszName = aInfo.User().Name().get();
+ userInfo.pwszIcon = aInfo.User().Icon().get();
+ userInfo.pwszDisplayName = aInfo.User().DisplayName().get();
+
+ for (const auto& coseAlg : aInfo.coseAlgs()) {
+ WEBAUTHN_COSE_CREDENTIAL_PARAMETER coseAlgorithm = {
+ WEBAUTHN_COSE_CREDENTIAL_PARAMETER_CURRENT_VERSION,
+ WEBAUTHN_CREDENTIAL_TYPE_PUBLIC_KEY, coseAlg.alg()};
+ coseParams.AppendElement(coseAlgorithm);
+ }
+
+ const auto& sel = aInfo.AuthenticatorSelection();
+
+ const nsString& userVerificationRequirement =
+ sel.userVerificationRequirement();
+ // This mapping needs to be reviewed if values are added to the
+ // UserVerificationRequirement enum.
+ static_assert(MOZ_WEBAUTHN_ENUM_STRINGS_VERSION == 2);
+ if (userVerificationRequirement.EqualsLiteral(
+ MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED)) {
+ winUserVerificationReq = WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED;
+ } else if (userVerificationRequirement.EqualsLiteral(
+ MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_PREFERRED)) {
+ winUserVerificationReq = WEBAUTHN_USER_VERIFICATION_REQUIREMENT_PREFERRED;
+ } else if (userVerificationRequirement.EqualsLiteral(
+ MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_DISCOURAGED)) {
+ winUserVerificationReq = WEBAUTHN_USER_VERIFICATION_REQUIREMENT_DISCOURAGED;
+ } else {
+ winUserVerificationReq = WEBAUTHN_USER_VERIFICATION_REQUIREMENT_ANY;
+ }
+
+ if (sel.authenticatorAttachment().isSome()) {
+ const nsString& authenticatorAttachment =
+ sel.authenticatorAttachment().value();
+ // This mapping needs to be reviewed if values are added to the
+ // AuthenticatorAttachement enum.
+ static_assert(MOZ_WEBAUTHN_ENUM_STRINGS_VERSION == 2);
+ if (authenticatorAttachment.EqualsLiteral(
+ MOZ_WEBAUTHN_AUTHENTICATOR_ATTACHMENT_PLATFORM)) {
+ winAttachment = WEBAUTHN_AUTHENTICATOR_ATTACHMENT_PLATFORM;
+ } else if (authenticatorAttachment.EqualsLiteral(
+ MOZ_WEBAUTHN_AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM)) {
+ winAttachment = WEBAUTHN_AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM;
+ } else {
+ winAttachment = WEBAUTHN_AUTHENTICATOR_ATTACHMENT_ANY;
+ }
+ }
+
+ const nsString& residentKey = sel.residentKey();
+ // This mapping needs to be reviewed if values are added to the
+ // ResidentKeyRequirement enum.
+ static_assert(MOZ_WEBAUTHN_ENUM_STRINGS_VERSION == 2);
+ if (residentKey.EqualsLiteral(
+ MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_REQUIRED)) {
+ winRequireResidentKey = TRUE;
+ winPreferResidentKey = TRUE;
+ } else if (residentKey.EqualsLiteral(
+ MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_PREFERRED)) {
+ winRequireResidentKey = FALSE;
+ winPreferResidentKey = TRUE;
+ } else if (residentKey.EqualsLiteral(
+ MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_DISCOURAGED)) {
+ winRequireResidentKey = FALSE;
+ winPreferResidentKey = FALSE;
+ } else {
+ // WebAuthnManager::MakeCredential is supposed to assign one of the above
+ // values, so this shouldn't happen.
+ MOZ_ASSERT_UNREACHABLE();
+ MaybeAbortRegister(aTransactionId, NS_ERROR_DOM_UNKNOWN_ERR);
+ return;
+ }
+
+ // AttestationConveyance
+ const nsString& attestation = aInfo.attestationConveyancePreference();
+ // This mapping needs to be reviewed if values are added to the
+ // AttestationConveyancePreference enum.
+ static_assert(MOZ_WEBAUTHN_ENUM_STRINGS_VERSION == 2);
+ if (attestation.EqualsLiteral(
+ MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_NONE)) {
+ winAttestation = WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_NONE;
+ } else if (attestation.EqualsLiteral(
+ MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_INDIRECT)) {
+ winAttestation = WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_INDIRECT;
+ } else if (attestation.EqualsLiteral(
+ MOZ_WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT)) {
+ winAttestation = WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT;
+ } else {
+ winAttestation = WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_ANY;
+ }
+
+ if (aInfo.Extensions().Length() >
+ (int)(sizeof(rgExtension) / sizeof(rgExtension[0]))) {
+ nsresult aError = NS_ERROR_DOM_INVALID_STATE_ERR;
+ MaybeAbortRegister(aTransactionId, aError);
+ return;
+ }
+ for (const WebAuthnExtension& ext : aInfo.Extensions()) {
+ if (ext.type() == WebAuthnExtension::TWebAuthnExtensionHmacSecret) {
+ HmacCreateSecret =
+ ext.get_WebAuthnExtensionHmacSecret().hmacCreateSecret() == true;
+ if (HmacCreateSecret) {
+ rgExtension[cExtensions].pwszExtensionIdentifier =
+ WEBAUTHN_EXTENSIONS_IDENTIFIER_HMAC_SECRET;
+ rgExtension[cExtensions].cbExtension = sizeof(BOOL);
+ rgExtension[cExtensions].pvExtension = &HmacCreateSecret;
+ cExtensions++;
+ }
+ }
+ }
+
+ WEBAUTHN_COSE_CREDENTIAL_PARAMETERS WebAuthNCredentialParameters = {
+ static_cast<DWORD>(coseParams.Length()), coseParams.Elements()};
+
+ // Exclude Credentials
+ nsTArray<WEBAUTHN_CREDENTIAL_EX> excludeCredentials;
+ WEBAUTHN_CREDENTIAL_EX* pExcludeCredentials = nullptr;
+ nsTArray<WEBAUTHN_CREDENTIAL_EX*> excludeCredentialsPtrs;
+ WEBAUTHN_CREDENTIAL_LIST excludeCredentialList = {0};
+ WEBAUTHN_CREDENTIAL_LIST* pExcludeCredentialList = nullptr;
+
+ for (auto& cred : aInfo.ExcludeList()) {
+ uint8_t transports = cred.transports();
+ DWORD winTransports = 0;
+ if (transports & MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_USB) {
+ winTransports |= WEBAUTHN_CTAP_TRANSPORT_USB;
+ }
+ if (transports & MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_NFC) {
+ winTransports |= WEBAUTHN_CTAP_TRANSPORT_NFC;
+ }
+ if (transports & MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_BLE) {
+ winTransports |= WEBAUTHN_CTAP_TRANSPORT_BLE;
+ }
+ if (transports & MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_INTERNAL) {
+ winTransports |= WEBAUTHN_CTAP_TRANSPORT_INTERNAL;
+ }
+
+ WEBAUTHN_CREDENTIAL_EX credential = {
+ WEBAUTHN_CREDENTIAL_EX_CURRENT_VERSION,
+ static_cast<DWORD>(cred.id().Length()), (PBYTE)(cred.id().Elements()),
+ WEBAUTHN_CREDENTIAL_TYPE_PUBLIC_KEY, winTransports};
+ excludeCredentials.AppendElement(credential);
+ }
+
+ if (!excludeCredentials.IsEmpty()) {
+ pExcludeCredentials = excludeCredentials.Elements();
+ for (DWORD i = 0; i < excludeCredentials.Length(); i++) {
+ excludeCredentialsPtrs.AppendElement(&pExcludeCredentials[i]);
+ }
+ excludeCredentialList.cCredentials = excludeCredentials.Length();
+ excludeCredentialList.ppCredentials = excludeCredentialsPtrs.Elements();
+ pExcludeCredentialList = &excludeCredentialList;
+ }
+
+ // MakeCredentialOptions
+ WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS WebAuthNCredentialOptions = {
+ WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_4,
+ aInfo.TimeoutMS(),
+ {0, NULL},
+ {0, NULL},
+ winAttachment,
+ winRequireResidentKey,
+ winUserVerificationReq,
+ winAttestation,
+ 0, // Flags
+ NULL, // CancellationId
+ pExcludeCredentialList,
+ WEBAUTHN_ENTERPRISE_ATTESTATION_NONE,
+ WEBAUTHN_LARGE_BLOB_SUPPORT_NONE,
+ winPreferResidentKey, // PreferResidentKey
+ };
+
+ GUID cancellationId = {0};
+ if (gWinWebauthnGetCancellationId(&cancellationId) == S_OK) {
+ WebAuthNCredentialOptions.pCancellationId = &cancellationId;
+ mCancellationIds.emplace(aTransactionId, &cancellationId);
+ }
+
+ if (cExtensions != 0) {
+ WebAuthNCredentialOptions.Extensions.cExtensions = cExtensions;
+ WebAuthNCredentialOptions.Extensions.pExtensions = rgExtension;
+ }
+
+ WEBAUTHN_CREDENTIAL_ATTESTATION* pWebAuthNCredentialAttestation = nullptr;
+
+ // Bug 1518876: Get Window Handle from Content process for Windows WebAuthN
+ // APIs
+ HWND hWnd = GetForegroundWindow();
+
+ HRESULT hr = gWinWebauthnMakeCredential(
+ hWnd, &rpInfo, &userInfo, &WebAuthNCredentialParameters,
+ &WebAuthNClientData, &WebAuthNCredentialOptions,
+ &pWebAuthNCredentialAttestation);
+
+ mCancellationIds.erase(aTransactionId);
+
+ if (hr == S_OK) {
+ nsTArray<uint8_t> credentialId;
+ credentialId.AppendElements(pWebAuthNCredentialAttestation->pbCredentialId,
+ pWebAuthNCredentialAttestation->cbCredentialId);
+
+ nsTArray<uint8_t> authenticatorData;
+
+ authenticatorData.AppendElements(
+ pWebAuthNCredentialAttestation->pbAuthenticatorData,
+ pWebAuthNCredentialAttestation->cbAuthenticatorData);
+
+ nsTArray<uint8_t> attObject;
+ if (winAttestation == WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_NONE) {
+ // Zero AAGuid
+ const uint8_t zeroGuid[16] = {0};
+ authenticatorData.ReplaceElementsAt(32 + 1 + 4 /*AAGuid offset*/, 16,
+ zeroGuid, 16);
+
+ CryptoBuffer authData;
+ authData.Assign(authenticatorData);
+ CryptoBuffer noneAttObj;
+ CBOREncodeNoneAttestationObj(authData, noneAttObj);
+ attObject.AppendElements(noneAttObj);
+ } else {
+ attObject.AppendElements(
+ pWebAuthNCredentialAttestation->pbAttestationObject,
+ pWebAuthNCredentialAttestation->cbAttestationObject);
+ }
+
+ nsTArray<WebAuthnExtensionResult> extensions;
+
+ if (pWebAuthNCredentialAttestation->dwVersion >=
+ WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_2) {
+ PCWEBAUTHN_EXTENSIONS pExtensionList =
+ &pWebAuthNCredentialAttestation->Extensions;
+ if (pExtensionList->cExtensions != 0 &&
+ pExtensionList->pExtensions != NULL) {
+ for (DWORD dwIndex = 0; dwIndex < pExtensionList->cExtensions;
+ dwIndex++) {
+ PWEBAUTHN_EXTENSION pExtension =
+ &pExtensionList->pExtensions[dwIndex];
+ if (pExtension->pwszExtensionIdentifier &&
+ (0 == _wcsicmp(pExtension->pwszExtensionIdentifier,
+ WEBAUTHN_EXTENSIONS_IDENTIFIER_HMAC_SECRET)) &&
+ pExtension->cbExtension == sizeof(BOOL)) {
+ BOOL* pCredentialCreatedWithHmacSecret =
+ (BOOL*)pExtension->pvExtension;
+ if (*pCredentialCreatedWithHmacSecret) {
+ extensions.AppendElement(WebAuthnExtensionResultHmacSecret(true));
+ }
+ }
+ }
+ }
+ }
+
+ WebAuthnMakeCredentialResult result(aInfo.ClientDataJSON(), attObject,
+ credentialId, extensions);
+
+ Unused << mTransactionParent->SendConfirmRegister(aTransactionId, result);
+ ClearTransaction();
+ gWinWebauthnFreeCredentialAttestation(pWebAuthNCredentialAttestation);
+
+ } else {
+ PCWSTR errorName = gWinWebauthnGetErrorName(hr);
+ nsresult aError = NS_ERROR_DOM_ABORT_ERR;
+
+ if (_wcsicmp(errorName, L"InvalidStateError") == 0) {
+ aError = NS_ERROR_DOM_INVALID_STATE_ERR;
+ } else if (_wcsicmp(errorName, L"ConstraintError") == 0 ||
+ _wcsicmp(errorName, L"UnknownError") == 0) {
+ aError = NS_ERROR_DOM_UNKNOWN_ERR;
+ } else if (_wcsicmp(errorName, L"NotSupportedError") == 0) {
+ aError = NS_ERROR_DOM_INVALID_STATE_ERR;
+ } else if (_wcsicmp(errorName, L"NotAllowedError") == 0) {
+ aError = NS_ERROR_DOM_NOT_ALLOWED_ERR;
+ }
+
+ MaybeAbortRegister(aTransactionId, aError);
+ }
+}
+
+void WinWebAuthnManager::MaybeAbortRegister(const uint64_t& aTransactionId,
+ const nsresult& aError) {
+ AbortTransaction(aTransactionId, aError);
+}
+
+void WinWebAuthnManager::Sign(PWebAuthnTransactionParent* aTransactionParent,
+ const uint64_t& aTransactionId,
+ const WebAuthnGetAssertionInfo& aInfo) {
+ MOZ_LOG(gWinWebAuthnManagerLog, LogLevel::Debug, ("WinWebAuthNSign"));
+
+ ClearTransaction();
+ mTransactionParent = aTransactionParent;
+
+ // User Verification Requirement
+ DWORD winUserVerificationReq = WEBAUTHN_USER_VERIFICATION_REQUIREMENT_ANY;
+
+ // RPID
+ PCWSTR rpID = nullptr;
+
+ // Attachment
+ DWORD winAttachment = WEBAUTHN_AUTHENTICATOR_ATTACHMENT_ANY;
+
+ // AppId
+ BOOL bU2fAppIdUsed = FALSE;
+ BOOL* pbU2fAppIdUsed = nullptr;
+ PCWSTR winAppIdentifier = nullptr;
+
+ // Client Data
+ WEBAUTHN_CLIENT_DATA WebAuthNClientData = {
+ WEBAUTHN_CLIENT_DATA_CURRENT_VERSION,
+ (DWORD)aInfo.ClientDataJSON().Length(),
+ (BYTE*)(aInfo.ClientDataJSON().get()), WEBAUTHN_HASH_ALGORITHM_SHA_256};
+
+ for (const WebAuthnExtension& ext : aInfo.Extensions()) {
+ if (ext.type() == WebAuthnExtension::TWebAuthnExtensionAppId) {
+ winAppIdentifier = ext.get_WebAuthnExtensionAppId().appIdentifier().get();
+ pbU2fAppIdUsed = &bU2fAppIdUsed;
+ break;
+ }
+ }
+
+ // RPID
+ rpID = aInfo.RpId().get();
+
+ // User Verification Requirement
+ const nsString& userVerificationReq = aInfo.userVerificationRequirement();
+ // This mapping needs to be reviewed if values are added to the
+ // UserVerificationRequirement enum.
+ static_assert(MOZ_WEBAUTHN_ENUM_STRINGS_VERSION == 2);
+ if (userVerificationReq.EqualsLiteral(
+ MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED)) {
+ winUserVerificationReq = WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED;
+ } else if (userVerificationReq.EqualsLiteral(
+ MOZ_WEBAUTHN_USER_VERIFICATION_REQUIREMENT_PREFERRED)) {
+ winUserVerificationReq = WEBAUTHN_USER_VERIFICATION_REQUIREMENT_PREFERRED;
+ } else if (userVerificationReq.EqualsLiteral(
+ MOZ_WEBAUTHN_RESIDENT_KEY_REQUIREMENT_DISCOURAGED)) {
+ winUserVerificationReq = WEBAUTHN_USER_VERIFICATION_REQUIREMENT_DISCOURAGED;
+ } else {
+ winUserVerificationReq = WEBAUTHN_USER_VERIFICATION_REQUIREMENT_ANY;
+ }
+
+ // allow Credentials
+ nsTArray<WEBAUTHN_CREDENTIAL_EX> allowCredentials;
+ WEBAUTHN_CREDENTIAL_EX* pAllowCredentials = nullptr;
+ nsTArray<WEBAUTHN_CREDENTIAL_EX*> allowCredentialsPtrs;
+ WEBAUTHN_CREDENTIAL_LIST allowCredentialList = {0};
+ WEBAUTHN_CREDENTIAL_LIST* pAllowCredentialList = nullptr;
+
+ for (auto& cred : aInfo.AllowList()) {
+ uint8_t transports = cred.transports();
+ DWORD winTransports = 0;
+ if (transports & MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_USB) {
+ winTransports |= WEBAUTHN_CTAP_TRANSPORT_USB;
+ }
+ if (transports & MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_NFC) {
+ winTransports |= WEBAUTHN_CTAP_TRANSPORT_NFC;
+ }
+ if (transports & MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_BLE) {
+ winTransports |= WEBAUTHN_CTAP_TRANSPORT_BLE;
+ }
+ if (transports & MOZ_WEBAUTHN_AUTHENTICATOR_TRANSPORT_ID_INTERNAL) {
+ winTransports |= WEBAUTHN_CTAP_TRANSPORT_INTERNAL;
+ }
+
+ WEBAUTHN_CREDENTIAL_EX credential = {
+ WEBAUTHN_CREDENTIAL_EX_CURRENT_VERSION,
+ static_cast<DWORD>(cred.id().Length()), (PBYTE)(cred.id().Elements()),
+ WEBAUTHN_CREDENTIAL_TYPE_PUBLIC_KEY, winTransports};
+ allowCredentials.AppendElement(credential);
+ }
+
+ if (allowCredentials.Length()) {
+ pAllowCredentials = allowCredentials.Elements();
+ for (DWORD i = 0; i < allowCredentials.Length(); i++) {
+ allowCredentialsPtrs.AppendElement(&pAllowCredentials[i]);
+ }
+ allowCredentialList.cCredentials = allowCredentials.Length();
+ allowCredentialList.ppCredentials = allowCredentialsPtrs.Elements();
+ pAllowCredentialList = &allowCredentialList;
+ }
+
+ WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS WebAuthNAssertionOptions = {
+ WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_CURRENT_VERSION,
+ aInfo.TimeoutMS(),
+ {0, NULL},
+ {0, NULL},
+ winAttachment,
+ winUserVerificationReq,
+ 0, // dwFlags
+ winAppIdentifier,
+ pbU2fAppIdUsed,
+ nullptr, // pCancellationId
+ pAllowCredentialList,
+ };
+
+ GUID cancellationId = {0};
+ if (gWinWebauthnGetCancellationId(&cancellationId) == S_OK) {
+ WebAuthNAssertionOptions.pCancellationId = &cancellationId;
+ mCancellationIds.emplace(aTransactionId, &cancellationId);
+ }
+
+ PWEBAUTHN_ASSERTION pWebAuthNAssertion = nullptr;
+
+ // Bug 1518876: Get Window Handle from Content process for Windows WebAuthN
+ // APIs
+ HWND hWnd = GetForegroundWindow();
+
+ HRESULT hr =
+ gWinWebauthnGetAssertion(hWnd, rpID, &WebAuthNClientData,
+ &WebAuthNAssertionOptions, &pWebAuthNAssertion);
+
+ mCancellationIds.erase(aTransactionId);
+
+ if (hr == S_OK) {
+ nsTArray<uint8_t> signature;
+ signature.AppendElements(pWebAuthNAssertion->pbSignature,
+ pWebAuthNAssertion->cbSignature);
+
+ nsTArray<uint8_t> keyHandle;
+ keyHandle.AppendElements(pWebAuthNAssertion->Credential.pbId,
+ pWebAuthNAssertion->Credential.cbId);
+
+ nsTArray<uint8_t> userHandle;
+ userHandle.AppendElements(pWebAuthNAssertion->pbUserId,
+ pWebAuthNAssertion->cbUserId);
+
+ nsTArray<uint8_t> authenticatorData;
+ authenticatorData.AppendElements(pWebAuthNAssertion->pbAuthenticatorData,
+ pWebAuthNAssertion->cbAuthenticatorData);
+
+ nsTArray<WebAuthnExtensionResult> extensions;
+
+ if (pbU2fAppIdUsed && *pbU2fAppIdUsed) {
+ extensions.AppendElement(WebAuthnExtensionResultAppId(true));
+ }
+
+ WebAuthnGetAssertionResult result(aInfo.ClientDataJSON(), keyHandle,
+ signature, authenticatorData, extensions,
+ userHandle);
+
+ Unused << mTransactionParent->SendConfirmSign(aTransactionId, result);
+ ClearTransaction();
+
+ gWinWebauthnFreeAssertion(pWebAuthNAssertion);
+
+ } else {
+ PCWSTR errorName = gWinWebauthnGetErrorName(hr);
+ nsresult aError = NS_ERROR_DOM_ABORT_ERR;
+
+ if (_wcsicmp(errorName, L"InvalidStateError") == 0) {
+ aError = NS_ERROR_DOM_INVALID_STATE_ERR;
+ } else if (_wcsicmp(errorName, L"ConstraintError") == 0 ||
+ _wcsicmp(errorName, L"UnknownError") == 0) {
+ aError = NS_ERROR_DOM_UNKNOWN_ERR;
+ } else if (_wcsicmp(errorName, L"NotSupportedError") == 0) {
+ aError = NS_ERROR_DOM_INVALID_STATE_ERR;
+ } else if (_wcsicmp(errorName, L"NotAllowedError") == 0) {
+ aError = NS_ERROR_DOM_NOT_ALLOWED_ERR;
+ }
+
+ MaybeAbortSign(aTransactionId, aError);
+ }
+}
+
+void WinWebAuthnManager::MaybeAbortSign(const uint64_t& aTransactionId,
+ const nsresult& aError) {
+ AbortTransaction(aTransactionId, aError);
+}
+
+void WinWebAuthnManager::Cancel(PWebAuthnTransactionParent* aParent,
+ const Tainted<uint64_t>& aTransactionId) {
+ if (mTransactionParent != aParent) {
+ return;
+ }
+
+ ClearTransaction();
+
+ auto iter = mCancellationIds.find(
+ MOZ_NO_VALIDATE(aTransactionId,
+ "Transaction ID is checked against a global container, "
+ "so an invalid entry can affect another origin's "
+ "request. This issue is filed as Bug 1696159."));
+ if (iter != mCancellationIds.end()) {
+ gWinWebauthnCancelCurrentOperation(iter->second);
+ }
+}
+
+} // namespace mozilla::dom
diff --git a/dom/webauthn/WinWebAuthnManager.h b/dom/webauthn/WinWebAuthnManager.h
new file mode 100644
index 0000000000..bee143ddd0
--- /dev/null
+++ b/dom/webauthn/WinWebAuthnManager.h
@@ -0,0 +1,53 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WinWebAuthnManager_h
+#define mozilla_dom_WinWebAuthnManager_h
+
+#include "mozilla/dom/U2FTokenTransport.h"
+#include "mozilla/dom/PWebAuthnTransaction.h"
+#include "mozilla/Tainting.h"
+
+namespace mozilla::dom {
+
+class WebAuthnTransactionParent;
+
+class WinWebAuthnManager final {
+ public:
+ static WinWebAuthnManager* Get();
+ void Register(PWebAuthnTransactionParent* aTransactionParent,
+ const uint64_t& aTransactionId,
+ const WebAuthnMakeCredentialInfo& aTransactionInfo);
+ void Sign(PWebAuthnTransactionParent* aTransactionParent,
+ const uint64_t& aTransactionId,
+ const WebAuthnGetAssertionInfo& aTransactionInfo);
+ void Cancel(PWebAuthnTransactionParent* aTransactionParent,
+ const Tainted<uint64_t>& aTransactionId);
+ void MaybeClearTransaction(PWebAuthnTransactionParent* aParent);
+ static void Initialize();
+ static bool IsUserVerifyingPlatformAuthenticatorAvailable();
+ static bool AreWebAuthNApisAvailable();
+
+ WinWebAuthnManager();
+ ~WinWebAuthnManager();
+
+ private:
+ void AbortTransaction(const uint64_t& aTransactionId, const nsresult& aError);
+ void ClearTransaction();
+ void MaybeAbortRegister(const uint64_t& aTransactionId,
+ const nsresult& aError);
+ void MaybeAbortSign(const uint64_t& aTransactionId, const nsresult& aError);
+ bool IsUserVerifyingPlatformAuthenticatorAvailableInternal();
+ uint32_t GetWebAuthNApiVersion();
+
+ PWebAuthnTransactionParent* mTransactionParent;
+ uint32_t mWinWebAuthNApiVersion = 0;
+ std::map<uint64_t, GUID*> mCancellationIds;
+};
+
+} // namespace mozilla::dom
+
+#endif // mozilla_dom_WinWebAuthnManager_h
diff --git a/dom/webauthn/authrs_bridge/Cargo.toml b/dom/webauthn/authrs_bridge/Cargo.toml
new file mode 100644
index 0000000000..ea549d3521
--- /dev/null
+++ b/dom/webauthn/authrs_bridge/Cargo.toml
@@ -0,0 +1,16 @@
+[package]
+name = "authrs_bridge"
+version = "0.1.0"
+edition = "2021"
+authors = ["Martin Sirringhaus", "John Schanck"]
+
+[dependencies]
+authenticator = { version = "0.4.0-alpha.15", features = ["gecko"] }
+log = "0.4"
+moz_task = { path = "../../../xpcom/rust/moz_task" }
+nserror = { path = "../../../xpcom/rust/nserror" }
+nsstring = { path = "../../../xpcom/rust/nsstring" }
+serde_cbor = "0.11"
+thin-vec = { version = "0.2.1", features = ["gecko-ffi"] }
+static_prefs = { path = "../../../modules/libpref/init/static_prefs" }
+xpcom = { path = "../../../xpcom/rust/xpcom" }
diff --git a/dom/webauthn/authrs_bridge/src/lib.rs b/dom/webauthn/authrs_bridge/src/lib.rs
new file mode 100644
index 0000000000..30ee54beb9
--- /dev/null
+++ b/dom/webauthn/authrs_bridge/src/lib.rs
@@ -0,0 +1,749 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#[macro_use]
+extern crate log;
+
+#[macro_use]
+extern crate xpcom;
+
+use authenticator::{
+ authenticatorservice::{AuthenticatorService, RegisterArgs, SignArgs},
+ ctap2::attestation::AttestationStatement,
+ ctap2::server::{
+ PublicKeyCredentialDescriptor, PublicKeyCredentialParameters, RelyingParty,
+ ResidentKeyRequirement, User, UserVerificationRequirement,
+ },
+ errors::{AuthenticatorError, PinError, U2FTokenError},
+ statecallback::StateCallback,
+ Assertion, Pin, RegisterResult, SignResult, StatusPinUv, StatusUpdate,
+};
+use moz_task::RunnableBuilder;
+use nserror::{
+ nsresult, NS_ERROR_DOM_INVALID_STATE_ERR, NS_ERROR_DOM_NOT_ALLOWED_ERR,
+ NS_ERROR_DOM_NOT_SUPPORTED_ERR, NS_ERROR_DOM_OPERATION_ERR, NS_ERROR_DOM_UNKNOWN_ERR,
+ NS_ERROR_FAILURE, NS_ERROR_NOT_AVAILABLE, NS_ERROR_NOT_IMPLEMENTED, NS_ERROR_NULL_POINTER,
+ NS_OK,
+};
+use nsstring::{nsACString, nsCString, nsString};
+use serde_cbor;
+use std::cell::RefCell;
+use std::sync::mpsc::{channel, Receiver, RecvError, Sender};
+use std::sync::{Arc, Mutex};
+use thin_vec::ThinVec;
+use xpcom::interfaces::{
+ nsICtapRegisterArgs, nsICtapRegisterResult, nsICtapSignArgs, nsICtapSignResult,
+ nsIWebAuthnController, nsIWebAuthnTransport,
+};
+use xpcom::{xpcom_method, RefPtr};
+
+fn make_prompt(action: &str, tid: u64, origin: &str, browsing_context_id: u64) -> String {
+ format!(
+ r#"{{"is_ctap2":true,"action":"{action}","tid":{tid},"origin":"{origin}","browsingContextId":{browsing_context_id}}}"#,
+ )
+}
+
+fn make_pin_required_prompt(
+ tid: u64,
+ origin: &str,
+ browsing_context_id: u64,
+ was_invalid: bool,
+ retries: i64,
+) -> String {
+ format!(
+ r#"{{"is_ctap2":true,"action":"pin-required","tid":{tid},"origin":"{origin}","browsingContextId":{browsing_context_id},"wasInvalid":{was_invalid},"retriesLeft":{retries}}}"#,
+ )
+}
+
+fn authrs_to_nserror(e: &AuthenticatorError) -> nsresult {
+ match e {
+ AuthenticatorError::U2FToken(U2FTokenError::NotSupported) => NS_ERROR_DOM_NOT_SUPPORTED_ERR,
+ AuthenticatorError::U2FToken(U2FTokenError::InvalidState) => NS_ERROR_DOM_INVALID_STATE_ERR,
+ AuthenticatorError::U2FToken(U2FTokenError::NotAllowed) => NS_ERROR_DOM_NOT_ALLOWED_ERR,
+ AuthenticatorError::PinError(PinError::PinRequired) => NS_ERROR_DOM_OPERATION_ERR,
+ AuthenticatorError::PinError(PinError::InvalidPin(_)) => NS_ERROR_DOM_OPERATION_ERR,
+ AuthenticatorError::PinError(PinError::PinAuthBlocked) => NS_ERROR_DOM_OPERATION_ERR,
+ AuthenticatorError::PinError(PinError::PinBlocked) => NS_ERROR_DOM_OPERATION_ERR,
+ AuthenticatorError::PinError(PinError::PinNotSet) => NS_ERROR_DOM_OPERATION_ERR,
+ AuthenticatorError::CredentialExcluded => NS_ERROR_DOM_OPERATION_ERR,
+ _ => NS_ERROR_DOM_UNKNOWN_ERR,
+ }
+}
+
+#[xpcom(implement(nsICtapRegisterResult), atomic)]
+pub struct CtapRegisterResult {
+ result: Result<RegisterResult, AuthenticatorError>,
+}
+
+impl CtapRegisterResult {
+ xpcom_method!(get_attestation_object => GetAttestationObject() -> ThinVec<u8>);
+ fn get_attestation_object(&self) -> Result<ThinVec<u8>, nsresult> {
+ let mut out = ThinVec::new();
+ if let Ok(RegisterResult::CTAP2(attestation)) = &self.result {
+ if let Ok(encoded_att_obj) = serde_cbor::to_vec(&attestation) {
+ out.extend_from_slice(&encoded_att_obj);
+ return Ok(out);
+ }
+ }
+ Err(NS_ERROR_FAILURE)
+ }
+
+ xpcom_method!(get_credential_id => GetCredentialId() -> ThinVec<u8>);
+ fn get_credential_id(&self) -> Result<ThinVec<u8>, nsresult> {
+ let mut out = ThinVec::new();
+ if let Ok(RegisterResult::CTAP2(attestation)) = &self.result {
+ if let Some(credential_data) = &attestation.auth_data.credential_data {
+ out.extend(credential_data.credential_id.clone());
+ return Ok(out);
+ }
+ }
+ Err(NS_ERROR_FAILURE)
+ }
+
+ xpcom_method!(get_status => GetStatus() -> nsresult);
+ fn get_status(&self) -> Result<nsresult, nsresult> {
+ match &self.result {
+ Ok(_) => Ok(NS_OK),
+ Err(e) => Ok(authrs_to_nserror(e)),
+ }
+ }
+}
+
+#[xpcom(implement(nsICtapSignResult), atomic)]
+pub struct CtapSignResult {
+ result: Result<Assertion, AuthenticatorError>,
+}
+
+impl CtapSignResult {
+ xpcom_method!(get_credential_id => GetCredentialId() -> ThinVec<u8>);
+ fn get_credential_id(&self) -> Result<ThinVec<u8>, nsresult> {
+ let mut out = ThinVec::new();
+ if let Ok(assertion) = &self.result {
+ if let Some(cred) = &assertion.credentials {
+ out.extend_from_slice(&cred.id);
+ return Ok(out);
+ }
+ }
+ Err(NS_ERROR_FAILURE)
+ }
+
+ xpcom_method!(get_signature => GetSignature() -> ThinVec<u8>);
+ fn get_signature(&self) -> Result<ThinVec<u8>, nsresult> {
+ let mut out = ThinVec::new();
+ if let Ok(assertion) = &self.result {
+ out.extend_from_slice(&assertion.signature);
+ return Ok(out);
+ }
+ Err(NS_ERROR_FAILURE)
+ }
+
+ xpcom_method!(get_authenticator_data => GetAuthenticatorData() -> ThinVec<u8>);
+ fn get_authenticator_data(&self) -> Result<ThinVec<u8>, nsresult> {
+ let mut out = ThinVec::new();
+ if let Ok(assertion) = &self.result {
+ if let Ok(encoded_auth_data) = assertion.auth_data.to_vec() {
+ out.extend_from_slice(&encoded_auth_data);
+ return Ok(out);
+ }
+ }
+ Err(NS_ERROR_FAILURE)
+ }
+
+ xpcom_method!(get_user_handle => GetUserHandle() -> ThinVec<u8>);
+ fn get_user_handle(&self) -> Result<ThinVec<u8>, nsresult> {
+ let mut out = ThinVec::new();
+ if let Ok(assertion) = &self.result {
+ if let Some(user) = &assertion.user {
+ out.extend_from_slice(&user.id);
+ return Ok(out);
+ }
+ }
+ Err(NS_ERROR_FAILURE)
+ }
+
+ xpcom_method!(get_user_name => GetUserName() -> nsACString);
+ fn get_user_name(&self) -> Result<nsCString, nsresult> {
+ if let Ok(assertion) = &self.result {
+ if let Some(user) = &assertion.user {
+ if let Some(name) = &user.name {
+ return Ok(nsCString::from(name));
+ }
+ }
+ }
+ Err(NS_ERROR_NOT_AVAILABLE)
+ }
+
+ xpcom_method!(get_rp_id_hash => GetRpIdHash() -> ThinVec<u8>);
+ fn get_rp_id_hash(&self) -> Result<ThinVec<u8>, nsresult> {
+ // assertion.auth_data.rp_id_hash
+ let mut out = ThinVec::new();
+ if let Ok(assertion) = &self.result {
+ out.extend(assertion.auth_data.rp_id_hash.0.clone());
+ return Ok(out);
+ }
+ Err(NS_ERROR_FAILURE)
+ }
+
+ xpcom_method!(get_status => GetStatus() -> nsresult);
+ fn get_status(&self) -> Result<nsresult, nsresult> {
+ match &self.result {
+ Ok(_) => Ok(NS_OK),
+ Err(e) => Ok(authrs_to_nserror(e)),
+ }
+ }
+}
+
+/// Controller wraps a raw pointer to an nsIWebAuthnController. The AuthrsTransport struct holds a
+/// Controller which we need to initialize from the SetController XPCOM method. Since XPCOM
+/// methods take &self, Controller must have interior mutability.
+#[derive(Clone)]
+struct Controller(RefCell<*const nsIWebAuthnController>);
+
+/// Our implementation of nsIWebAuthnController in WebAuthnController.cpp has the property that its
+/// XPCOM methods are safe to call from any thread, hence a raw pointer to an nsIWebAuthnController
+/// is Send.
+unsafe impl Send for Controller {}
+
+impl Controller {
+ fn init(&self, ptr: *const nsIWebAuthnController) -> Result<(), nsresult> {
+ self.0.replace(ptr);
+ Ok(())
+ }
+
+ fn send_prompt(&self, tid: u64, msg: &str) {
+ if (*self.0.borrow()).is_null() {
+ warn!("Controller not initialized");
+ return;
+ }
+ let notification_str = nsCString::from(msg);
+ unsafe {
+ (**(self.0.borrow())).SendPromptNotificationPreformatted(tid, &*notification_str);
+ }
+ }
+
+ fn finish_register(
+ &self,
+ tid: u64,
+ result: Result<RegisterResult, AuthenticatorError>,
+ ) -> Result<(), nsresult> {
+ if (*self.0.borrow()).is_null() {
+ return Err(NS_ERROR_FAILURE);
+ }
+ let wrapped_result = CtapRegisterResult::allocate(InitCtapRegisterResult { result })
+ .query_interface::<nsICtapRegisterResult>()
+ .ok_or(NS_ERROR_FAILURE)?;
+ unsafe {
+ (**(self.0.borrow())).FinishRegister(tid, wrapped_result.coerce());
+ }
+ Ok(())
+ }
+
+ fn finish_sign(
+ &self,
+ tid: u64,
+ result: Result<SignResult, AuthenticatorError>,
+ ) -> Result<(), nsresult> {
+ if (*self.0.borrow()).is_null() {
+ return Err(NS_ERROR_FAILURE);
+ }
+
+ // If result is an error, we return a single CtapSignResult that has its status field set
+ // to an error. Otherwise we convert the entries of SignResult (= Vec<Assertion>) into
+ // CtapSignResults with OK statuses.
+ let mut assertions: ThinVec<Option<RefPtr<nsICtapSignResult>>> = ThinVec::new();
+ match result {
+ Err(e) => assertions.push(
+ CtapSignResult::allocate(InitCtapSignResult { result: Err(e) })
+ .query_interface::<nsICtapSignResult>(),
+ ),
+ Ok(SignResult::CTAP2(assertion_vec)) => {
+ for assertion in assertion_vec.0 {
+ assertions.push(
+ CtapSignResult::allocate(InitCtapSignResult {
+ result: Ok(assertion),
+ })
+ .query_interface::<nsICtapSignResult>(),
+ );
+ }
+ }
+ _ => return Err(NS_ERROR_NOT_IMPLEMENTED), // SignResult::CTAP1 shouldn't happen.
+ }
+
+ unsafe {
+ (**(self.0.borrow())).FinishSign(tid, &mut assertions);
+ }
+ Ok(())
+ }
+}
+
+// The state machine creates a Sender<Pin>/Receiver<Pin> channel in ask_user_for_pin. It passes the
+// Sender through status_callback, which stores the Sender in the pin_receiver field of an
+// AuthrsTransport. The u64 in PinReceiver is a transaction ID, which the AuthrsTransport uses the
+// transaction ID as a consistency check.
+type PinReceiver = Option<(u64, Sender<Pin>)>;
+
+fn status_callback(
+ status_rx: Receiver<StatusUpdate>,
+ tid: u64,
+ origin: &String,
+ browsing_context_id: u64,
+ controller: Controller,
+ pin_receiver: Arc<Mutex<PinReceiver>>, /* Shared with an AuthrsTransport */
+) {
+ loop {
+ match status_rx.recv() {
+ Ok(StatusUpdate::DeviceAvailable { dev_info }) => {
+ debug!("STATUS: device available: {}", dev_info)
+ }
+ Ok(StatusUpdate::DeviceUnavailable { dev_info }) => {
+ debug!("STATUS: device unavailable: {}", dev_info)
+ }
+ Ok(StatusUpdate::Success { dev_info }) => {
+ debug!("STATUS: success using device: {}", dev_info);
+ }
+ Ok(StatusUpdate::SelectDeviceNotice) => {
+ debug!("STATUS: Please select a device by touching one of them.");
+ let notification_str =
+ make_prompt("select-device", tid, origin, browsing_context_id);
+ controller.send_prompt(tid, &notification_str);
+ }
+ Ok(StatusUpdate::DeviceSelected(dev_info)) => {
+ debug!("STATUS: Continuing with device: {}", dev_info);
+ }
+ Ok(StatusUpdate::PresenceRequired) => {
+ debug!("STATUS: Waiting for user presence");
+ let notification_str = make_prompt("presence", tid, origin, browsing_context_id);
+ controller.send_prompt(tid, &notification_str);
+ }
+ Ok(StatusUpdate::PinUvError(StatusPinUv::PinRequired(sender))) => {
+ let guard = pin_receiver.lock();
+ if let Ok(mut entry) = guard {
+ entry.replace((tid, sender));
+ } else {
+ return;
+ }
+ let notification_str =
+ make_pin_required_prompt(tid, origin, browsing_context_id, false, -1);
+ controller.send_prompt(tid, &notification_str);
+ }
+ Ok(StatusUpdate::PinUvError(StatusPinUv::InvalidPin(sender, attempts))) => {
+ let guard = pin_receiver.lock();
+ if let Ok(mut entry) = guard {
+ entry.replace((tid, sender));
+ } else {
+ return;
+ }
+ let notification_str = make_pin_required_prompt(
+ tid,
+ origin,
+ browsing_context_id,
+ true,
+ attempts.map_or(-1, |x| x as i64),
+ );
+ controller.send_prompt(tid, &notification_str);
+ }
+ Ok(StatusUpdate::PinUvError(StatusPinUv::PinAuthBlocked)) => {
+ let notification_str =
+ make_prompt("pin-auth-blocked", tid, origin, browsing_context_id);
+ controller.send_prompt(tid, &notification_str);
+ }
+ Ok(StatusUpdate::PinUvError(StatusPinUv::PinBlocked)) => {
+ let notification_str =
+ make_prompt("device-blocked", tid, origin, browsing_context_id);
+ controller.send_prompt(tid, &notification_str);
+ }
+ Ok(StatusUpdate::PinUvError(StatusPinUv::PinNotSet)) => {
+ let notification_str = make_prompt("pin-not-set", tid, origin, browsing_context_id);
+ controller.send_prompt(tid, &notification_str);
+ }
+ Ok(StatusUpdate::PinUvError(e)) => {
+ warn!("Unexpected error: {:?}", e)
+ }
+ Ok(StatusUpdate::InteractiveManagement((_, dev_info, auth_info))) => {
+ debug!(
+ "STATUS: interactive management: {}, {:?}",
+ dev_info, auth_info
+ );
+ }
+ Err(RecvError) => {
+ debug!("STATUS: end");
+ return;
+ }
+ }
+ }
+}
+
+// AuthrsTransport provides an nsIWebAuthnTransport interface to an AuthenticatorService. This
+// allows an nsIWebAuthnController to dispatch MakeCredential and GetAssertion requests to USB HID
+// tokens. The AuthrsTransport struct also keeps 1) a pointer to the active nsIWebAuthnController,
+// which is used to prompt the user for input and to return results to the controller; and
+// 2) a channel through which to receive a pin callback.
+#[xpcom(implement(nsIWebAuthnTransport), atomic)]
+pub struct AuthrsTransport {
+ auth_service: RefCell<AuthenticatorService>, // interior mutable for use in XPCOM methods
+ controller: Controller,
+ pin_receiver: Arc<Mutex<PinReceiver>>,
+}
+
+impl AuthrsTransport {
+ xpcom_method!(get_controller => GetController() -> *const nsIWebAuthnController);
+ fn get_controller(&self) -> Result<RefPtr<nsIWebAuthnController>, nsresult> {
+ Err(NS_ERROR_NOT_IMPLEMENTED)
+ }
+
+ xpcom_method!(set_controller => SetController(aController: *const nsIWebAuthnController));
+ fn set_controller(&self, controller: *const nsIWebAuthnController) -> Result<(), nsresult> {
+ self.controller.init(controller)
+ }
+
+ xpcom_method!(pin_callback => PinCallback(aTransactionId: u64, aPin: *const nsACString));
+ fn pin_callback(&self, transaction_id: u64, pin: &nsACString) -> Result<(), nsresult> {
+ let mut guard = self.pin_receiver.lock().or(Err(NS_ERROR_FAILURE))?;
+ match guard.take() {
+ // The pin_receiver is single-use.
+ Some((tid, channel)) if tid == transaction_id => channel
+ .send(Pin::new(&pin.to_string()))
+ .or(Err(NS_ERROR_FAILURE)),
+ // Either we weren't expecting a pin, or the controller is confused
+ // about which transaction is active. Neither is recoverable, so it's
+ // OK to drop the PinReceiver here.
+ _ => Err(NS_ERROR_FAILURE),
+ }
+ }
+
+ xpcom_method!(make_credential => MakeCredential(aTid: u64, aBrowsingContextId: u64, aArgs: *const nsICtapRegisterArgs));
+ fn make_credential(
+ &self,
+ tid: u64,
+ browsing_context_id: u64,
+ args: *const nsICtapRegisterArgs,
+ ) -> Result<(), nsresult> {
+ if args.is_null() {
+ return Err(NS_ERROR_NULL_POINTER);
+ }
+ let args = unsafe { &*args };
+
+ let mut origin = nsString::new();
+ unsafe { args.GetOrigin(&mut *origin) }.to_result()?;
+
+ let mut relying_party_id = nsString::new();
+ unsafe { args.GetRpId(&mut *relying_party_id) }.to_result()?;
+
+ let mut client_data_hash = ThinVec::new();
+ unsafe { args.GetClientDataHash(&mut client_data_hash) }.to_result()?;
+ let mut client_data_hash_arr = [0u8; 32];
+ client_data_hash_arr.copy_from_slice(&client_data_hash);
+
+ let mut timeout_ms = 0u32;
+ unsafe { args.GetTimeoutMS(&mut timeout_ms) }.to_result()?;
+
+ let mut exclude_list = ThinVec::new();
+ unsafe { args.GetExcludeList(&mut exclude_list) }.to_result()?;
+ let exclude_list = exclude_list
+ .iter_mut()
+ .map(|id| PublicKeyCredentialDescriptor {
+ id: id.to_vec(),
+ transports: vec![],
+ })
+ .collect();
+
+ let mut relying_party_name = nsString::new();
+ unsafe { args.GetRpName(&mut *relying_party_name) }.to_result()?;
+
+ let mut user_id = ThinVec::new();
+ unsafe { args.GetUserId(&mut user_id) }.to_result()?;
+
+ let mut user_name = nsString::new();
+ unsafe { args.GetUserName(&mut *user_name) }.to_result()?;
+
+ let mut user_display_name = nsString::new();
+ unsafe { args.GetUserDisplayName(&mut *user_display_name) }.to_result()?;
+
+ let mut cose_algs = ThinVec::new();
+ unsafe { args.GetCoseAlgs(&mut cose_algs) }.to_result()?;
+ let pub_cred_params = cose_algs
+ .iter()
+ .map(|alg| PublicKeyCredentialParameters::try_from(*alg).unwrap())
+ .collect();
+
+ let mut resident_key = nsString::new();
+ unsafe { args.GetResidentKey(&mut *resident_key) }.to_result()?;
+ let resident_key_req = if resident_key.eq("required") {
+ ResidentKeyRequirement::Required
+ } else if resident_key.eq("preferred") {
+ ResidentKeyRequirement::Preferred
+ } else if resident_key.eq("discouraged") {
+ ResidentKeyRequirement::Discouraged
+ } else {
+ return Err(NS_ERROR_FAILURE);
+ };
+
+ let mut user_verification = nsString::new();
+ unsafe { args.GetUserVerification(&mut *user_verification) }.to_result()?;
+ let user_verification_req = if user_verification.eq("required") {
+ UserVerificationRequirement::Required
+ } else if user_verification.eq("preferred") {
+ UserVerificationRequirement::Preferred
+ } else if user_verification.eq("discouraged") {
+ UserVerificationRequirement::Discouraged
+ } else {
+ return Err(NS_ERROR_FAILURE);
+ };
+
+ let mut attestation_conveyance_preference = nsString::new();
+ unsafe { args.GetAttestationConveyancePreference(&mut *attestation_conveyance_preference) }
+ .to_result()?;
+ let none_attestation = attestation_conveyance_preference.eq("none");
+
+ // TODO(Bug 1593571) - Add this to the extensions
+ // let mut hmac_create_secret = None;
+ // let mut maybe_hmac_create_secret = false;
+ // match unsafe { args.GetHmacCreateSecret(&mut maybe_hmac_create_secret) }.to_result() {
+ // Ok(_) => hmac_create_secret = Some(maybe_hmac_create_secret),
+ // _ => (),
+ // }
+
+ let info = RegisterArgs {
+ client_data_hash: client_data_hash_arr,
+ relying_party: RelyingParty {
+ id: relying_party_id.to_string(),
+ name: None,
+ icon: None,
+ },
+ origin: origin.to_string(),
+ user: User {
+ id: user_id.to_vec(),
+ icon: None,
+ name: Some(user_name.to_string()),
+ display_name: None,
+ },
+ pub_cred_params,
+ exclude_list,
+ user_verification_req,
+ resident_key_req,
+ extensions: Default::default(),
+ pin: None,
+ use_ctap1_fallback: static_prefs::pref!("security.webauthn.ctap2") == false,
+ };
+
+ let (status_tx, status_rx) = channel::<StatusUpdate>();
+ let pin_receiver = self.pin_receiver.clone();
+ let controller = self.controller.clone();
+ let status_origin = origin.to_string();
+ RunnableBuilder::new(
+ "AuthrsTransport::MakeCredential::StatusReceiver",
+ move || {
+ status_callback(
+ status_rx,
+ tid,
+ &status_origin,
+ browsing_context_id,
+ controller,
+ pin_receiver,
+ )
+ },
+ )
+ .may_block(true)
+ .dispatch_background_task()?;
+
+ let controller = self.controller.clone();
+ let callback_origin = origin.to_string();
+ let state_callback = StateCallback::<Result<RegisterResult, AuthenticatorError>>::new(
+ Box::new(move |result| {
+ let result = match result {
+ Ok(RegisterResult::CTAP1(..)) => Err(AuthenticatorError::VersionMismatch(
+ "AuthrsTransport::MakeCredential",
+ 2,
+ )),
+ Ok(RegisterResult::CTAP2(mut attestation_object)) => {
+ // Tokens always provide attestation, but the user may have asked we not
+ // include the attestation statement in the response.
+ if none_attestation {
+ attestation_object.att_statement = AttestationStatement::None;
+ }
+ Ok(RegisterResult::CTAP2(attestation_object))
+ }
+ Err(e @ AuthenticatorError::CredentialExcluded) => {
+ let notification_str = make_prompt(
+ "already-registered",
+ tid,
+ &callback_origin,
+ browsing_context_id,
+ );
+ controller.send_prompt(tid, &notification_str);
+ Err(e)
+ }
+ Err(e) => Err(e),
+ };
+ let _ = controller.finish_register(tid, result);
+ }),
+ );
+
+ self.auth_service
+ .borrow_mut()
+ .register(timeout_ms as u64, info.into(), status_tx, state_callback)
+ .or(Err(NS_ERROR_FAILURE))
+ }
+
+ xpcom_method!(get_assertion => GetAssertion(aTid: u64, aBrowsingContextId: u64, aArgs: *const nsICtapSignArgs));
+ fn get_assertion(
+ &self,
+ tid: u64,
+ browsing_context_id: u64,
+ args: *const nsICtapSignArgs,
+ ) -> Result<(), nsresult> {
+ if args.is_null() {
+ return Err(NS_ERROR_NULL_POINTER);
+ }
+ let args = unsafe { &*args };
+
+ let mut origin = nsString::new();
+ unsafe { args.GetOrigin(&mut *origin) }.to_result()?;
+
+ let mut relying_party_id = nsString::new();
+ unsafe { args.GetRpId(&mut *relying_party_id) }.to_result()?;
+
+ let mut client_data_hash = ThinVec::new();
+ unsafe { args.GetClientDataHash(&mut client_data_hash) }.to_result()?;
+ let mut client_data_hash_arr = [0u8; 32];
+ client_data_hash_arr.copy_from_slice(&client_data_hash);
+
+ let mut timeout_ms = 0u32;
+ unsafe { args.GetTimeoutMS(&mut timeout_ms) }.to_result()?;
+
+ let mut allow_list = ThinVec::new();
+ unsafe { args.GetAllowList(&mut allow_list) }.to_result()?;
+ let allow_list: Vec<_> = allow_list
+ .iter_mut()
+ .map(|id| PublicKeyCredentialDescriptor {
+ id: id.to_vec(),
+ transports: vec![],
+ })
+ .collect();
+
+ let mut user_verification = nsString::new();
+ unsafe { args.GetUserVerification(&mut *user_verification) }.to_result()?;
+ let user_verification_req = if user_verification.eq("required") {
+ UserVerificationRequirement::Required
+ } else if user_verification.eq("preferred") {
+ UserVerificationRequirement::Preferred
+ } else if user_verification.eq("discouraged") {
+ UserVerificationRequirement::Discouraged
+ } else {
+ return Err(NS_ERROR_FAILURE);
+ };
+
+ let mut alternate_rp_id = None;
+ let mut maybe_alternate_rp_id = nsString::new();
+ match unsafe { args.GetAppId(&mut *maybe_alternate_rp_id) }.to_result() {
+ Ok(_) => alternate_rp_id = Some(maybe_alternate_rp_id.to_string()),
+ _ => (),
+ }
+
+ let (status_tx, status_rx) = channel::<StatusUpdate>();
+ let pin_receiver = self.pin_receiver.clone();
+ let controller = self.controller.clone();
+ let status_origin = origin.to_string();
+ RunnableBuilder::new("AuthrsTransport::GetAssertion::StatusReceiver", move || {
+ status_callback(
+ status_rx,
+ tid,
+ &status_origin,
+ browsing_context_id,
+ controller,
+ pin_receiver,
+ )
+ })
+ .may_block(true)
+ .dispatch_background_task()?;
+
+ let uniq_allowed_cred = if allow_list.len() == 1 {
+ allow_list.first().cloned()
+ } else {
+ None
+ };
+
+ let controller = self.controller.clone();
+ let state_callback =
+ StateCallback::<Result<SignResult, AuthenticatorError>>::new(Box::new(move |result| {
+ let result = match result {
+ Ok(SignResult::CTAP1(..)) => Err(AuthenticatorError::VersionMismatch(
+ "AuthrsTransport::GetAssertion",
+ 2,
+ )),
+ Ok(SignResult::CTAP2(mut assertion_object)) => {
+ // In CTAP 2.0, but not CTAP 2.1, the assertion object's credential field
+ // "May be omitted if the allowList has exactly one Credential." If we had
+ // a unique allowed credential, then copy its descriptor to the output.
+ if uniq_allowed_cred.is_some() {
+ if let Some(assertion) = assertion_object.0.first_mut() {
+ if assertion.credentials.is_none() {
+ assertion.credentials = uniq_allowed_cred.clone();
+ }
+ }
+ }
+ Ok(SignResult::CTAP2(assertion_object))
+ }
+ Err(e) => Err(e),
+ };
+ let _ = controller.finish_sign(tid, result);
+ }));
+
+ // Bug 1834771 - Pre-filtering allowlists broke AppID support. As a temporary
+ // workaround, we will fallback to CTAP1 when the request includes the AppID
+ // extension and the allowlist is non-empty.
+ let use_ctap1_fallback = static_prefs::pref!("security.webauthn.ctap2") == false
+ || (alternate_rp_id.is_some() && !allow_list.is_empty());
+
+ let info = SignArgs {
+ client_data_hash: client_data_hash_arr,
+ relying_party_id: relying_party_id.to_string(),
+ origin: origin.to_string(),
+ allow_list,
+ user_verification_req,
+ user_presence_req: true,
+ extensions: Default::default(),
+ pin: None,
+ alternate_rp_id,
+ use_ctap1_fallback,
+ };
+
+ self.auth_service
+ .borrow_mut()
+ .sign(timeout_ms as u64, info.into(), status_tx, state_callback)
+ .or(Err(NS_ERROR_FAILURE))
+ }
+
+ xpcom_method!(cancel => Cancel());
+ fn cancel(&self) -> Result<nsresult, nsresult> {
+ // We may be waiting for a pin. Drop the channel to release the
+ // state machine from `ask_user_for_pin`.
+ drop(self.pin_receiver.lock().or(Err(NS_ERROR_FAILURE))?.take());
+
+ match &self.auth_service.borrow_mut().cancel() {
+ Ok(_) => Ok(NS_OK),
+ Err(e) => Err(authrs_to_nserror(e)),
+ }
+ }
+}
+
+#[no_mangle]
+pub extern "C" fn authrs_transport_constructor(
+ result: *mut *const nsIWebAuthnTransport,
+) -> nsresult {
+ let mut auth_service = match AuthenticatorService::new() {
+ Ok(auth_service) => auth_service,
+ _ => return NS_ERROR_FAILURE,
+ };
+ auth_service.add_detected_transports();
+ let wrapper = AuthrsTransport::allocate(InitAuthrsTransport {
+ auth_service: RefCell::new(auth_service),
+ controller: Controller(RefCell::new(std::ptr::null())),
+ pin_receiver: Arc::new(Mutex::new(None)),
+ });
+ unsafe {
+ RefPtr::new(wrapper.coerce::<nsIWebAuthnTransport>()).forget(&mut *result);
+ }
+ NS_OK
+}
diff --git a/dom/webauthn/cbor-cpp/README.md b/dom/webauthn/cbor-cpp/README.md
new file mode 100644
index 0000000000..015cad3325
--- /dev/null
+++ b/dom/webauthn/cbor-cpp/README.md
@@ -0,0 +1,35 @@
+cbor-cpp
+========
+
+[![Gitter](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/naphaso/cbor-cpp?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+
+CBOR C++ serialization library
+
+Just a simple SAX-like Concise Binary Object Representation (CBOR).
+
+[http://tools.ietf.org/html/rfc7049](http://tools.ietf.org/html/rfc7049)
+
+#### Examples
+
+```C++
+ cbor::output_dynamic output;
+
+ { //encoding
+ cbor::encoder encoder(output);
+ encoder.write_array(5);
+ {
+ encoder.write_int(123);
+ encoder.write_string("bar");
+ encoder.write_int(321);
+ encoder.write_int(321);
+ encoder.write_string("foo");
+ }
+ }
+
+ { // decoding
+ cbor::input input(output.data(), output.size());
+ cbor::listener_debug listener;
+ cbor::decoder decoder(input, listener);
+ decoder.run();
+ }
+```
diff --git a/dom/webauthn/cbor-cpp/src/LICENSE b/dom/webauthn/cbor-cpp/src/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/dom/webauthn/cbor-cpp/src/LICENSE
@@ -0,0 +1,201 @@
+ Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
+ APPENDIX: How to apply the Apache License to your work.
+
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "[]"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+ Copyright [yyyy] [name of copyright owner]
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
diff --git a/dom/webauthn/cbor-cpp/src/README-MOZILLA b/dom/webauthn/cbor-cpp/src/README-MOZILLA
new file mode 100644
index 0000000000..7552af4db9
--- /dev/null
+++ b/dom/webauthn/cbor-cpp/src/README-MOZILLA
@@ -0,0 +1,5 @@
+This library [1] has been stripped down to only the CBOR encoding parts, as there are outstanding issues [2]
+related to memory safety for the decoder.
+
+[1] https://github.com/naphaso/cbor-cpp/
+[2] https://github.com/naphaso/cbor-cpp/issues/8
diff --git a/dom/webauthn/cbor-cpp/src/cbor.h b/dom/webauthn/cbor-cpp/src/cbor.h
new file mode 100644
index 0000000000..d0725d166d
--- /dev/null
+++ b/dom/webauthn/cbor-cpp/src/cbor.h
@@ -0,0 +1,23 @@
+/*
+ Copyright 2014-2015 Stanislav Ovsyannikov
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
+
+#ifndef CBOR_CPP_CBOR_H
+#define CBOR_CPP_CBOR_H
+
+#include "encoder.h"
+#include "output_dynamic.h"
+
+#endif //CBOR_CPP_CBOR_H
diff --git a/dom/webauthn/cbor-cpp/src/encoder.cpp b/dom/webauthn/cbor-cpp/src/encoder.cpp
new file mode 100644
index 0000000000..d88c3f4fa2
--- /dev/null
+++ b/dom/webauthn/cbor-cpp/src/encoder.cpp
@@ -0,0 +1,154 @@
+/*
+ Copyright 2014-2015 Stanislav Ovsyannikov
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
+
+#include "encoder.h"
+
+using namespace cbor;
+
+
+encoder::encoder(output &out) {
+ _out = &out;
+}
+
+encoder::~encoder() {
+
+}
+
+void encoder::write_type_value(int major_type, unsigned int value) {
+ major_type <<= 5;
+ if(value < 24) {
+ _out->put_byte((unsigned char) (major_type | value));
+ } else if(value < 256) {
+ _out->put_byte((unsigned char) (major_type | 24));
+ _out->put_byte((unsigned char) value);
+ } else if(value < 65536) {
+ _out->put_byte((unsigned char) (major_type | 25));
+ _out->put_byte((unsigned char) (value >> 8));
+ _out->put_byte((unsigned char) value);
+ } else {
+ _out->put_byte((unsigned char) (major_type | 26));
+ _out->put_byte((unsigned char) (value >> 24));
+ _out->put_byte((unsigned char) (value >> 16));
+ _out->put_byte((unsigned char) (value >> 8));
+ _out->put_byte((unsigned char) value);
+ }
+}
+
+void encoder::write_type_value(int major_type, unsigned long long value) {
+ major_type <<= 5;
+ if(value < 24ULL) {
+ _out->put_byte((unsigned char) (major_type | value));
+ } else if(value < 256ULL) {
+ _out->put_byte((unsigned char) (major_type | 24));
+ _out->put_byte((unsigned char) value);
+ } else if(value < 65536ULL) {
+ _out->put_byte((unsigned char) (major_type | 25));
+ _out->put_byte((unsigned char) (value >> 8));
+ _out->put_byte((unsigned char) value);
+ } else if(value < 4294967296ULL) {
+ _out->put_byte((unsigned char) (major_type | 26));
+ _out->put_byte((unsigned char) (value >> 24));
+ _out->put_byte((unsigned char) (value >> 16));
+ _out->put_byte((unsigned char) (value >> 8));
+ _out->put_byte((unsigned char) value);
+ } else {
+ _out->put_byte((unsigned char) (major_type | 27));
+ _out->put_byte((unsigned char) (value >> 56));
+ _out->put_byte((unsigned char) (value >> 48));
+ _out->put_byte((unsigned char) (value >> 40));
+ _out->put_byte((unsigned char) (value >> 32));
+ _out->put_byte((unsigned char) (value >> 24));
+ _out->put_byte((unsigned char) (value >> 16));
+ _out->put_byte((unsigned char) (value >> 8));
+ _out->put_byte((unsigned char) value);
+ }
+}
+
+void encoder::write_int(unsigned int value) {
+ write_type_value(0, value);
+}
+
+void encoder::write_int(unsigned long long value) {
+ write_type_value(0, value);
+}
+
+void encoder::write_int(long long value) {
+ if(value < 0) {
+ write_type_value(1, (unsigned long long) -(value+1));
+ } else {
+ write_type_value(0, (unsigned long long) value);
+ }
+}
+
+void encoder::write_int(int value) {
+ if(value < 0) {
+ write_type_value(1, (unsigned int) -(value+1));
+ } else {
+ write_type_value(0, (unsigned int) value);
+ }
+}
+
+void encoder::write_bytes(const unsigned char *data, unsigned int size) {
+ write_type_value(2, size);
+ _out->put_bytes(data, size);
+}
+
+void encoder::write_raw(const unsigned char *data, unsigned int size) {
+ _out->put_bytes(data, size);
+}
+
+void encoder::write_string(const char *data, unsigned int size) {
+ write_type_value(3, size);
+ _out->put_bytes((const unsigned char *) data, size);
+}
+
+void encoder::write_string(const std::string str) {
+ write_type_value(3, (unsigned int) str.size());
+ _out->put_bytes((const unsigned char *) str.c_str(), (int) str.size());
+}
+
+
+void encoder::write_array(int size) {
+ write_type_value(4, (unsigned int) size);
+}
+
+void encoder::write_map(int size) {
+ write_type_value(5, (unsigned int) size);
+}
+
+void encoder::write_tag(const unsigned int tag) {
+ write_type_value(6, tag);
+}
+
+void encoder::write_special(int special) {
+ write_type_value(7, (unsigned int) special);
+}
+
+void encoder::write_bool(bool value) {
+ if (value == true) {
+ _out->put_byte((unsigned char) 0xf5);
+ } else {
+ _out->put_byte((unsigned char) 0xf4);
+ }
+}
+
+void encoder::write_null() {
+ _out->put_byte((unsigned char) 0xf6);
+}
+
+void encoder::write_undefined() {
+ _out->put_byte((unsigned char) 0xf7);
+}
diff --git a/dom/webauthn/cbor-cpp/src/encoder.h b/dom/webauthn/cbor-cpp/src/encoder.h
new file mode 100644
index 0000000000..4f7038e3f2
--- /dev/null
+++ b/dom/webauthn/cbor-cpp/src/encoder.h
@@ -0,0 +1,70 @@
+/*
+ Copyright 2014-2015 Stanislav Ovsyannikov
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
+
+
+#ifndef __CborEncoder_H_
+#define __CborEncoder_H_
+
+#include "output.h"
+#include <string>
+
+namespace cbor {
+ class encoder {
+ private:
+ output *_out;
+ public:
+ explicit encoder(output &out);
+
+ ~encoder();
+
+ void write_bool(bool value);
+
+ void write_int(int value);
+
+ void write_int(long long value);
+
+ void write_int(unsigned int value);
+
+ void write_int(unsigned long long value);
+
+ void write_bytes(const unsigned char *data, unsigned int size);
+
+ void write_raw(const unsigned char *data, unsigned int size);
+
+ void write_string(const char *data, unsigned int size);
+
+ void write_string(const std::string str);
+
+ void write_array(int size);
+
+ void write_map(int size);
+
+ void write_tag(const unsigned int tag);
+
+ void write_special(int special);
+
+ void write_null();
+
+ void write_undefined();
+
+ private:
+ void write_type_value(int major_type, unsigned int value);
+
+ void write_type_value(int major_type, unsigned long long value);
+ };
+}
+
+#endif //__CborEncoder_H_
diff --git a/dom/webauthn/cbor-cpp/src/output.h b/dom/webauthn/cbor-cpp/src/output.h
new file mode 100644
index 0000000000..0901d956eb
--- /dev/null
+++ b/dom/webauthn/cbor-cpp/src/output.h
@@ -0,0 +1,34 @@
+/*
+ Copyright 2014-2015 Stanislav Ovsyannikov
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
+
+
+#ifndef __CborOutput_H_
+#define __CborOutput_H_
+
+namespace cbor {
+ class output {
+ public:
+ virtual unsigned char *data() = 0;
+
+ virtual unsigned int size() = 0;
+
+ virtual void put_byte(unsigned char value) = 0;
+
+ virtual void put_bytes(const unsigned char *data, int size) = 0;
+ };
+}
+
+#endif //__CborOutput_H_
diff --git a/dom/webauthn/cbor-cpp/src/output_dynamic.cpp b/dom/webauthn/cbor-cpp/src/output_dynamic.cpp
new file mode 100644
index 0000000000..a9cf468112
--- /dev/null
+++ b/dom/webauthn/cbor-cpp/src/output_dynamic.cpp
@@ -0,0 +1,69 @@
+/*
+ Copyright 2014-2015 Stanislav Ovsyannikov
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
+
+#include "output_dynamic.h"
+
+#include <string.h>
+#include <stdlib.h>
+
+using namespace cbor;
+
+
+void output_dynamic::init(unsigned int initalCapacity) {
+ this->_capacity = initalCapacity;
+ this->_buffer = new unsigned char[initalCapacity];
+ this->_offset = 0;
+}
+
+output_dynamic::output_dynamic() {
+ init(256);
+}
+
+output_dynamic::output_dynamic(unsigned int inital_capacity) {
+ init(inital_capacity);
+}
+
+output_dynamic::~output_dynamic() {
+ delete _buffer;
+}
+
+unsigned char *output_dynamic::data() {
+ return _buffer;
+}
+
+unsigned int output_dynamic::size() {
+ return _offset;
+}
+
+void output_dynamic::put_byte(unsigned char value) {
+ if(_offset < _capacity) {
+ _buffer[_offset++] = value;
+ } else {
+ _capacity *= 2;
+ _buffer = (unsigned char *) realloc(_buffer, _capacity);
+ _buffer[_offset++] = value;
+ }
+}
+
+void output_dynamic::put_bytes(const unsigned char *data, int size) {
+ while(_offset + size > _capacity) {
+ _capacity *= 2;
+ _buffer = (unsigned char *) realloc(_buffer, _capacity);
+ }
+
+ memcpy(_buffer + _offset, data, size);
+ _offset += size;
+}
diff --git a/dom/webauthn/cbor-cpp/src/output_dynamic.h b/dom/webauthn/cbor-cpp/src/output_dynamic.h
new file mode 100644
index 0000000000..d6c7e460ce
--- /dev/null
+++ b/dom/webauthn/cbor-cpp/src/output_dynamic.h
@@ -0,0 +1,51 @@
+/*
+ Copyright 2014-2015 Stanislav Ovsyannikov
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+*/
+
+#ifndef __CborDynamicOutput_H_
+#define __CborDynamicOutput_H_
+
+
+#include "output.h"
+
+namespace cbor {
+ class output_dynamic : public output {
+ private:
+ unsigned char *_buffer;
+ unsigned int _capacity;
+ unsigned int _offset;
+ public:
+ output_dynamic();
+
+ explicit output_dynamic(unsigned int inital_capacity);
+
+ ~output_dynamic();
+
+ virtual unsigned char *data();
+
+ virtual unsigned int size();
+
+ virtual void put_byte(unsigned char value);
+
+ virtual void put_bytes(const unsigned char *data, int size);
+
+ private:
+ void init(unsigned int initalCapacity);
+ };
+}
+
+
+
+#endif //__CborDynamicOutput_H_
diff --git a/dom/webauthn/libudev-sys/Cargo.toml b/dom/webauthn/libudev-sys/Cargo.toml
new file mode 100644
index 0000000000..b438a56927
--- /dev/null
+++ b/dom/webauthn/libudev-sys/Cargo.toml
@@ -0,0 +1,38 @@
+# This is a fork of libudev-sys that dynamically loads its symbols with
+# dlopen when they are first used. This continues a precedent established
+# by Firefox's gamepad APIs to minimize the footprint of features when they
+# aren't being used. Specifically, this avoids the cost of dynamically linking
+# in libudev at process startup.
+#
+# "-sys" crates are a convention in the rust ecosystem for "a simple header
+# for a C library that Rust code can use to build a richer and safer API on
+# top of". In this case, libudev-sys is used by the [libudev crate].
+#
+# As of this writing, this hack is being used by the [authenticator-rs] crate,
+# which uses the libudev crate.
+#
+# The libudev crate assumes libudev is being dynamically linked in, and
+# checks if its symbols are null before intializing anything else, so that
+# you can use it to detect if libudev is installed and gracefully
+# disable gamepads or whatever else if it's not.
+#
+# If we're missing any symbols the libudev crate needs, then rust will give
+# us a compilation error. It's not a problem if we export additional symbols.
+#
+# So while this is a bit of a weird hack, it works pretty robustly, and this
+# crate is basically just a header for libudev so it's not a particularly
+# significant maintenance burden.
+#
+# authenticator-rs: https://github.com/mozilla/authenticator-rs
+# libudev crate: https://crates.io/crates/libudev
+
+[package]
+name = "libudev-sys"
+version = "0.1.3"
+authors = ["Tim Taubert <ttaubert@mozilla.com>"]
+description = "FFI bindings to libudev"
+license = "MPL-2.0"
+
+[dependencies]
+lazy_static = "1.0"
+libc = "0.2"
diff --git a/dom/webauthn/libudev-sys/src/lib.rs b/dom/webauthn/libudev-sys/src/lib.rs
new file mode 100644
index 0000000000..a08234a4c6
--- /dev/null
+++ b/dom/webauthn/libudev-sys/src/lib.rs
@@ -0,0 +1,182 @@
+/* -*- Mode: rust; rust-indent-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#![allow(non_camel_case_types)]
+#![allow(non_upper_case_globals)]
+
+#[macro_use]
+extern crate lazy_static;
+extern crate libc;
+
+use libc::{c_void,c_int,c_char,c_ulonglong,dev_t};
+use libc::{RTLD_GLOBAL,RTLD_LAZY,RTLD_NOLOAD};
+use libc::{dlopen,dlclose,dlsym};
+use std::ffi::CString;
+use std::{marker,mem,ops,ptr};
+
+#[repr(C)]
+pub struct udev {
+ __private: c_void
+}
+
+#[repr(C)]
+pub struct udev_list_entry {
+ __private: c_void
+}
+
+#[repr(C)]
+pub struct udev_device {
+ __private: c_void
+}
+
+#[repr(C)]
+pub struct udev_monitor {
+ __private: c_void
+}
+
+#[repr(C)]
+pub struct udev_enumerate {
+ __private: c_void
+}
+
+macro_rules! ifnull {
+ ($a:expr, $b:expr) => {
+ if $a.is_null() { $b } else { $a }
+ }
+}
+
+struct Library(*mut c_void);
+
+impl Library {
+ fn open(name: &'static str) -> Library {
+ let flags = RTLD_LAZY | RTLD_GLOBAL;
+ let flags_noload = flags | RTLD_NOLOAD;
+ let name = CString::new(name).unwrap();
+ let name = name.as_ptr();
+
+ Library(unsafe {
+ ifnull!(dlopen(name, flags_noload), dlopen(name, flags))
+ })
+ }
+
+ fn get(&self, name: &'static str) -> *mut c_void {
+ let name = CString::new(name).unwrap();
+ unsafe { dlsym(self.0, name.as_ptr()) }
+ }
+}
+
+impl Drop for Library {
+ fn drop(&mut self) {
+ unsafe { dlclose(self.0); }
+ }
+}
+
+unsafe impl Sync for Library {}
+unsafe impl Send for Library {}
+
+lazy_static! {
+ static ref LIBRARY: Library = {
+ Library::open("libudev.so.1")
+ };
+}
+
+pub struct Symbol<T> {
+ ptr: *mut c_void,
+ pd: marker::PhantomData<T>
+}
+
+impl<T> Symbol<T> {
+ fn new(ptr: *mut c_void) -> Self {
+ let default = Self::default as *mut c_void;
+ Self { ptr: ifnull!(ptr, default), pd: marker::PhantomData }
+ }
+
+ // This is the default symbol, used whenever dlopen() fails.
+ // Users of this library are expected to check whether udev_new() returns
+ // a nullptr, and if so they MUST NOT call any other exported functions.
+ extern "C" fn default() -> *mut c_void {
+ ptr::null_mut()
+ }
+}
+
+impl<T> ops::Deref for Symbol<T> {
+ type Target = T;
+
+ fn deref(&self) -> &T {
+ unsafe { mem::transmute(&self.ptr) }
+ }
+}
+
+unsafe impl<T: Sync + Send> Sync for Symbol<T> {}
+unsafe impl<T: Sync + Send> Send for Symbol<T> {}
+
+macro_rules! define {
+ ($name:ident, $type:ty) => {
+ lazy_static! {
+ pub static ref $name : Symbol<$type> = {
+ Symbol::new(LIBRARY.get(stringify!($name)))
+ };
+ }
+ };
+}
+
+// udev
+define!(udev_new, extern "C" fn () -> *mut udev);
+define!(udev_unref, extern "C" fn (*mut udev) -> *mut udev);
+
+// udev_list
+define!(udev_list_entry_get_next, extern "C" fn (*mut udev_list_entry) -> *mut udev_list_entry);
+define!(udev_list_entry_get_name, extern "C" fn (*mut udev_list_entry) -> *const c_char);
+define!(udev_list_entry_get_value, extern "C" fn (*mut udev_list_entry) -> *const c_char);
+
+// udev_device
+define!(udev_device_ref, extern "C" fn (*mut udev_device) -> *mut udev_device);
+define!(udev_device_unref, extern "C" fn (*mut udev_device) -> *mut udev_device);
+define!(udev_device_new_from_syspath, extern "C" fn (*mut udev, *const c_char) -> *mut udev_device);
+define!(udev_device_get_parent, extern "C" fn (*mut udev_device) -> *mut udev_device);
+define!(udev_device_get_devpath, extern "C" fn (*mut udev_device) -> *const c_char);
+define!(udev_device_get_subsystem, extern "C" fn (*mut udev_device) -> *const c_char);
+define!(udev_device_get_devtype, extern "C" fn (*mut udev_device) -> *const c_char);
+define!(udev_device_get_syspath, extern "C" fn (*mut udev_device) -> *const c_char);
+define!(udev_device_get_sysname, extern "C" fn (*mut udev_device) -> *const c_char);
+define!(udev_device_get_sysnum, extern "C" fn (*mut udev_device) -> *const c_char);
+define!(udev_device_get_devnode, extern "C" fn (*mut udev_device) -> *const c_char);
+define!(udev_device_get_is_initialized, extern "C" fn (*mut udev_device) -> c_int);
+define!(udev_device_get_properties_list_entry, extern "C" fn (*mut udev_device) -> *mut udev_list_entry);
+define!(udev_device_get_property_value, extern "C" fn (*mut udev_device, *const c_char) -> *const c_char);
+define!(udev_device_get_driver, extern "C" fn (*mut udev_device) -> *const c_char);
+define!(udev_device_get_devnum, extern "C" fn (*mut udev_device) -> dev_t);
+define!(udev_device_get_action, extern "C" fn (*mut udev_device) -> *const c_char);
+define!(udev_device_get_sysattr_value, extern "C" fn (*mut udev_device, *const c_char) -> *const c_char);
+define!(udev_device_set_sysattr_value, extern "C" fn (*mut udev_device, *const c_char, *mut c_char) -> c_int);
+define!(udev_device_get_sysattr_list_entry, extern "C" fn (*mut udev_device) -> *mut udev_list_entry);
+define!(udev_device_get_seqnum, extern "C" fn (*mut udev_device) -> c_ulonglong);
+
+// udev_monitor
+define!(udev_monitor_ref, extern "C" fn (*mut udev_monitor) -> *mut udev_monitor);
+define!(udev_monitor_unref, extern "C" fn (*mut udev_monitor) -> *mut udev_monitor);
+define!(udev_monitor_new_from_netlink, extern "C" fn (*mut udev, *const c_char) -> *mut udev_monitor);
+define!(udev_monitor_enable_receiving, extern "C" fn (*mut udev_monitor) -> c_int);
+define!(udev_monitor_get_fd, extern "C" fn (*mut udev_monitor) -> c_int);
+define!(udev_monitor_receive_device, extern "C" fn (*mut udev_monitor) -> *mut udev_device);
+define!(udev_monitor_filter_add_match_subsystem_devtype, extern "C" fn (*mut udev_monitor, *const c_char, *const c_char) -> c_int);
+define!(udev_monitor_filter_add_match_tag, extern "C" fn (*mut udev_monitor, *const c_char) -> c_int);
+define!(udev_monitor_filter_remove, extern "C" fn (*mut udev_monitor) -> c_int);
+
+// udev_enumerate
+define!(udev_enumerate_unref, extern "C" fn (*mut udev_enumerate) -> *mut udev_enumerate);
+define!(udev_enumerate_new, extern "C" fn (*mut udev) -> *mut udev_enumerate);
+define!(udev_enumerate_add_match_subsystem, extern "C" fn (*mut udev_enumerate, *const c_char) -> c_int);
+define!(udev_enumerate_add_nomatch_subsystem, extern "C" fn (*mut udev_enumerate, *const c_char) -> c_int);
+define!(udev_enumerate_add_match_sysattr, extern "C" fn (*mut udev_enumerate, *const c_char, *const c_char) -> c_int);
+define!(udev_enumerate_add_nomatch_sysattr, extern "C" fn (*mut udev_enumerate, *const c_char, *const c_char) -> c_int);
+define!(udev_enumerate_add_match_property, extern "C" fn (*mut udev_enumerate, *const c_char, *const c_char) -> c_int);
+define!(udev_enumerate_add_match_tag, extern "C" fn (*mut udev_enumerate, *const c_char) -> c_int);
+define!(udev_enumerate_add_match_parent, extern "C" fn (*mut udev_enumerate, *mut udev_device) -> c_int);
+define!(udev_enumerate_add_match_is_initialized, extern "C" fn (*mut udev_enumerate) -> c_int);
+define!(udev_enumerate_add_match_sysname, extern "C" fn (*mut udev_enumerate, *const c_char) -> c_int);
+define!(udev_enumerate_add_syspath, extern "C" fn (*mut udev_enumerate, *const c_char) -> c_int);
+define!(udev_enumerate_scan_devices, extern "C" fn (*mut udev_enumerate) -> c_int);
+define!(udev_enumerate_get_list_entry, extern "C" fn (*mut udev_enumerate) -> *mut udev_list_entry);
diff --git a/dom/webauthn/moz.build b/dom/webauthn/moz.build
new file mode 100644
index 0000000000..310f345bd9
--- /dev/null
+++ b/dom/webauthn/moz.build
@@ -0,0 +1,94 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+with Files("**"):
+ BUG_COMPONENT = ("Core", "DOM: Web Authentication")
+
+IPDL_SOURCES += ["PWebAuthnTransaction.ipdl"]
+
+XPIDL_SOURCES += ["nsIU2FTokenManager.idl", "nsIWebAuthnController.idl"]
+
+XPIDL_MODULE = "dom_webauthn"
+
+EXPORTS.mozilla.dom += [
+ "AuthenticatorAssertionResponse.h",
+ "AuthenticatorAttestationResponse.h",
+ "AuthenticatorResponse.h",
+ "PublicKeyCredential.h",
+ "U2FTokenManager.h",
+ "U2FTokenTransport.h",
+ "WebAuthnCBORUtil.h",
+ "WebAuthnController.h",
+ "WebAuthnManager.h",
+ "WebAuthnManagerBase.h",
+ "WebAuthnTransactionChild.h",
+ "WebAuthnTransactionParent.h",
+ "WebAuthnUtil.h",
+ "winwebauthn/webauthn.h",
+]
+
+UNIFIED_SOURCES += [
+ "AuthenticatorAssertionResponse.cpp",
+ "AuthenticatorAttestationResponse.cpp",
+ "AuthenticatorResponse.cpp",
+ "AuthrsTransport.cpp",
+ "cbor-cpp/src/encoder.cpp",
+ "cbor-cpp/src/output_dynamic.cpp",
+ "CtapArgs.cpp",
+ "CtapResults.cpp",
+ "PublicKeyCredential.cpp",
+ "U2FSoftTokenTransport.cpp",
+ "U2FTokenManager.cpp",
+ "WebAuthnCBORUtil.cpp",
+ "WebAuthnController.cpp",
+ "WebAuthnManager.cpp",
+ "WebAuthnManagerBase.cpp",
+ "WebAuthnTransactionChild.cpp",
+ "WebAuthnTransactionParent.cpp",
+ "WebAuthnUtil.cpp",
+]
+
+include("/ipc/chromium/chromium-config.mozbuild")
+
+FINAL_LIBRARY = "xul"
+
+LOCAL_INCLUDES += [
+ "/dom/base",
+ "/dom/crypto",
+ "/security/manager/ssl",
+ "/third_party/rust",
+ "/toolkit/components/jsoncpp/include",
+]
+
+USE_LIBS += [
+ "jsoncpp",
+]
+
+if CONFIG["MOZ_WIDGET_TOOLKIT"] == "android":
+ EXPORTS.mozilla.dom += [
+ "AndroidWebAuthnTokenManager.h",
+ ]
+ UNIFIED_SOURCES += [
+ "AndroidWebAuthnTokenManager.cpp",
+ ]
+
+if CONFIG["OS_ARCH"] == "WINNT":
+ OS_LIBS += [
+ "hid",
+ ]
+
+if CONFIG["OS_TARGET"] == "WINNT":
+ EXPORTS.mozilla.dom += [
+ "WinWebAuthnManager.h",
+ ]
+ UNIFIED_SOURCES += [
+ "WinWebAuthnManager.cpp",
+ ]
+
+MOCHITEST_MANIFESTS += ["tests/mochitest.ini"]
+BROWSER_CHROME_MANIFESTS += [
+ "tests/browser/browser.ini",
+]
diff --git a/dom/webauthn/nsIU2FTokenManager.idl b/dom/webauthn/nsIU2FTokenManager.idl
new file mode 100644
index 0000000000..4f835dc853
--- /dev/null
+++ b/dom/webauthn/nsIU2FTokenManager.idl
@@ -0,0 +1,40 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+/**
+ * TODO(1737205,1819414) Fold this interface into nsIWebAuthnController when we
+ * remove the legacy U2F DOM API.
+ *
+ * nsIU2FTokenManager
+ *
+ * An interface to the U2FTokenManager singleton.
+ *
+ * This should be used only by the WebAuthn browser UI prompts.
+ */
+
+[scriptable, uuid(745e1eac-e449-4342-bca1-ee0e6ead09fc)]
+interface nsIU2FTokenManager : nsISupports
+{
+ /**
+ * Resumes the current WebAuthn/U2F transaction if that matches the given
+ * transaction ID. This is used only when direct attestation was requested
+ * and we have to wait for user input to proceed.
+ *
+ * @param aTransactionID : The ID of the transaction to resume.
+ * @param aForceNoneAttestation : The user might enforce none attestation.
+ */
+ void resumeRegister(in uint64_t aTransactionID,
+ in bool aForceNoneAttestation);
+
+ /**
+ * Cancels the current WebAuthn/U2F transaction if that matches the given
+ * transaction ID.
+ *
+ * @param aTransactionID : The ID of the transaction to cancel.
+ */
+ void cancel(in uint64_t aTransactionID);
+};
diff --git a/dom/webauthn/nsIWebAuthnController.idl b/dom/webauthn/nsIWebAuthnController.idl
new file mode 100644
index 0000000000..b5a2e949ba
--- /dev/null
+++ b/dom/webauthn/nsIWebAuthnController.idl
@@ -0,0 +1,205 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+#include "nsIU2FTokenManager.idl"
+
+typedef long COSEAlgorithmIdentifier;
+
+// The nsICtapRegisterArgs interface encapsulates the arguments to the CTAP
+// authenticatorMakeCredential command as defined in
+// https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorMakeCredential
+// It is essentially a shim that allows data to be copied from an IPDL-defined
+// WebAuthnMakeCredentialInfo C++ struct to an authenticator-rs defined
+// RegisterArgsCtap2 Rust struct.
+//
+[uuid(2fc8febe-a277-11ed-bda2-8f6495a5e75c)]
+interface nsICtapRegisterArgs : nsISupports {
+ // TODO(Bug 1820035) The origin is only used for prompt callbacks. Refactor and remove.
+ readonly attribute AString origin;
+
+ readonly attribute Array<octet> clientDataHash;
+
+ // A PublicKeyCredentialRpEntity
+ readonly attribute AString rpId;
+ [must_use] readonly attribute AString rpName;
+
+ // A PublicKeyCredentialUserEntity
+ [must_use] readonly attribute Array<octet> userId;
+ [must_use] readonly attribute AString userName;
+ [must_use] readonly attribute AString userDisplayName;
+
+ // The spec defines this as a sequence<PublicKeyCredentialParameters>.
+ // We require type = "public-key" and only serialize the alg fields.
+ [must_use] readonly attribute Array<COSEAlgorithmIdentifier> coseAlgs;
+
+ // The spec defines this as a sequence<PublicKeyCredentialDescriptor>.
+ // We only include the ID field, as the transport field is optional and we
+ // can assume that the type is "public-key".
+ readonly attribute Array<Array<octet> > excludeList;
+
+ // CTAP2 passes extensions in a CBOR map of extension identifier ->
+ // WebAuthn AuthenticationExtensionsClientInputs. That's not feasible here.
+ // So we define a getter for each supported extension input and use the
+ // return code to signal presence.
+ [must_use] readonly attribute bool hmacCreateSecret;
+
+ // Options.
+ [must_use] readonly attribute AString residentKey;
+ [must_use] readonly attribute AString userVerification;
+ [must_use] readonly attribute AString authenticatorAttachment;
+
+ // This is the WebAuthn PublicKeyCredentialCreationOptions timeout.
+ // Arguably we don't need to pass it through since WebAuthnController can
+ // cancel transactions.
+ readonly attribute uint32_t timeoutMS;
+
+ // This is the WebAuthn PublicKeyCredentialCreationOptions attestation.
+ // We might overwrite the provided value with "none" if the user declines the
+ // consent popup.
+ [must_use] readonly attribute AString attestationConveyancePreference;
+};
+
+// The nsICtapSignArgs interface encapsulates the arguments to the CTAP
+// authenticatorGetAssertion command as defined in
+// https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#authenticatorGetAssertion
+// It is essentially a shim that allows data to be copied from an IPDL-defined
+// WebAuthnGetAssertionInfo C++ struct to an authenticator-rs defined
+// SignArgsCtap2 Rust struct.
+//
+[uuid(2e621cf4-a277-11ed-ae00-bf41a54ef553)]
+interface nsICtapSignArgs : nsISupports {
+ // TODO(Bug 1820035) The origin is only used for prompt callbacks. Refactor and remove.
+ readonly attribute AString origin;
+
+ // The spec only asks for the ID field of a PublicKeyCredentialRpEntity here
+ readonly attribute AString rpId;
+
+ readonly attribute Array<octet> clientDataHash;
+
+ // The spec defines this as a sequence<PublicKeyCredentialDescriptor>.
+ // We only include the ID field, as the transport field is optional and we
+ // can assume that the type is "public-key".
+ readonly attribute Array<Array<octet> > allowList;
+
+ // CTAP2 passes extensions in a CBOR map of extension identifier ->
+ // WebAuthn AuthenticationExtensionsClientInputs. That's not feasible here.
+ // So we define a getter for each supported extension input and use the
+ // return code to signal presence.
+ [must_use] readonly attribute bool hmacCreateSecret;
+ [must_use] readonly attribute AString appId;
+ [must_use] readonly attribute Array<octet> appIdHash;
+
+ // Options
+ [must_use] readonly attribute AString userVerification;
+
+ // This is the WebAuthn PublicKeyCredentialCreationOptions timeout.
+ // Arguably we don't need to pass it through since WebAuthnController can
+ // cancel transactions.
+ readonly attribute unsigned long timeoutMS;
+};
+
+// The nsICtapRegisterResult interface is used to construct IPDL-defined
+// WebAuthnMakeCredentialResult from either Rust or C++.
+//
+[uuid(0567c384-a728-11ed-85f7-030324a370f0)]
+interface nsICtapRegisterResult : nsISupports {
+ readonly attribute nsresult status;
+
+ // The serialied attestation object as defined in
+ // https://www.w3.org/TR/webauthn-2/#sctn-attestation
+ // Includes the format, the attestation statement, and
+ // the authenticator data.
+ readonly attribute Array<octet> attestationObject;
+
+ // The Credential ID field of the Attestation Object's Attested
+ // Credential Data. This is used to construct the rawID field of a
+ // WebAuthn PublicKeyCredential without having to parse the
+ // attestationObject.
+ readonly attribute Array<octet> credentialId;
+
+ // Bug 1536155
+ // readonly attribute Array<AString> transports;
+
+ // Bug 1816519
+ // readonly attribute Array<octet> authenticatorData;
+
+ // Bug 1816520
+ // readonly attribute Array<octet> publicKey
+ // readonly attribute COSEAlgorithmIdentifier publicKeyAlgorithm;
+
+ // bug 1593571
+ // readonly attribute bool hmacCreateSecret;
+};
+
+
+// The nsICtapSignResult interface is used to construct IPDL-defined
+// WebAuthnGetAssertionResult from either Rust or C++.
+//
+[uuid(05fff816-a728-11ed-b9ac-ff38cc2c8c28)]
+interface nsICtapSignResult : nsISupports {
+ readonly attribute nsresult status;
+
+ // The ID field of the PublicKeyCredentialDescriptor returned
+ // from authenticatorGetAssertion.
+ readonly attribute Array<octet> credentialId;
+
+ // The authData field of the authenticatorGetAssertion response
+ readonly attribute Array<octet> authenticatorData;
+
+ // The signature field of the authenticatorGetAssertion response
+ readonly attribute Array<octet> signature;
+
+ // The ID field of the PublicKeyCredentialUserEntity returned from
+ // authenticatorGetAssertion. (Optional)
+ [must_use] readonly attribute Array<octet> userHandle;
+
+ // The displayName field of the PublicKeyCredentialUserEntity
+ // returned from authenticatorGetAssertion. (Optional)
+ [must_use] readonly attribute ACString userName;
+
+ // The SHA-256 hash of the RP ID of the requester. Used to
+ // implement the FIDO AppID extension.
+ readonly attribute Array<octet> rpIdHash;
+
+ // bug 1593571
+ // readonly attribute bool hmacCreateSecret;
+};
+
+// The nsIWebAuthnController interface coordinates interactions between the user
+// and the authenticator to drive a WebAuthn transaction forward.
+// It allows an nsIWebAuthnTransport to
+// 1) prompt the user for input,
+// 2) receive a callback from a prompt, and
+// 3) return results to the content process.
+//
+[scriptable, uuid(c0744f48-ad64-11ed-b515-cf5149f4d6a6)]
+interface nsIWebAuthnController : nsIU2FTokenManager
+{
+ // Prompt callbacks
+ void pinCallback(in uint64_t aTransactionId, in ACString aPin);
+ void signatureSelectionCallback(in uint64_t aTransactionId, in uint64_t aIndex);
+
+ // Authenticator callbacks
+ [noscript] void sendPromptNotificationPreformatted(in uint64_t aTransactionId, in ACString aJSON);
+ [noscript] void finishRegister(in uint64_t aTransactionId, in nsICtapRegisterResult aResult);
+ [noscript] void finishSign(in uint64_t aTransactionId, in Array<nsICtapSignResult> aResult);
+};
+
+// The nsIWebAuthnTransport interface allows a C++ implemented nsIWebAuthnController to interact
+// with authenticators written in both Rust and C++
+[uuid(e236a9b4-a26f-11ed-b6cc-07a9834e19b1)]
+interface nsIWebAuthnTransport : nsISupports
+{
+ attribute nsIWebAuthnController controller;
+
+ void makeCredential(in uint64_t aTransactionId, in uint64_t browsingContextId, in nsICtapRegisterArgs args);
+ void getAssertion(in uint64_t aTransactionId, in uint64_t browsingContextId, in nsICtapSignArgs args);
+
+ // These are prompt callbacks but they're not intended to be called directly from
+ // JavaScript---they are proxied through the nsIWebAuthnController first.
+ [noscript] void pinCallback(in uint64_t aTransactionId, in ACString aPin);
+ [noscript] void cancel();
+};
diff --git a/dom/webauthn/tests/browser/browser.ini b/dom/webauthn/tests/browser/browser.ini
new file mode 100644
index 0000000000..0c95bc1921
--- /dev/null
+++ b/dom/webauthn/tests/browser/browser.ini
@@ -0,0 +1,32 @@
+[DEFAULT]
+support-files =
+ head.js
+ tab_webauthn_result.html
+ ../pkijs/*
+ ../cbor.js
+ ../u2futil.js
+prefs =
+ security.webauth.webauthn=true
+ security.webauth.webauthn_enable_softtoken=true
+ security.webauth.webauthn_enable_android_fido2=false
+ security.webauth.webauthn_enable_usbtoken=false
+ security.webauthn.ctap2=true
+
+[browser_abort_visibility.js]
+skip-if =
+ win10_2004 # Test not relevant on 1903+
+ win11_2009 # Test not relevant on 1903+
+[browser_fido_appid_extension.js]
+skip-if =
+ win10_2004 # Test not relevant on 1903+
+ win11_2009 # Test not relevant on 1903+
+[browser_webauthn_prompts.js]
+skip-if =
+ win10_2004 # Test not relevant on 1903+
+ win11_2009 # Test not relevant on 1903+
+[browser_webauthn_telemetry.js]
+skip-if =
+ win10_2004 # Test not relevant on 1903+
+ win11_2009 # Test not relevant on 1903+
+ fission && os == "linux" && asan # Bug 1713907 - new Fission platform triage
+[browser_webauthn_ipaddress.js]
diff --git a/dom/webauthn/tests/browser/browser_abort_visibility.js b/dom/webauthn/tests/browser/browser_abort_visibility.js
new file mode 100644
index 0000000000..e462c5f1ad
--- /dev/null
+++ b/dom/webauthn/tests/browser/browser_abort_visibility.js
@@ -0,0 +1,276 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+const TEST_URL =
+ "https://example.com/browser/dom/webauthn/tests/browser/tab_webauthn_result.html";
+
+add_task(async function test_setup() {
+ return SpecialPowers.pushPrefEnv({
+ set: [
+ ["security.webauth.webauthn_enable_softtoken", false],
+ ["security.webauth.webauthn_enable_usbtoken", true],
+ ],
+ });
+});
+add_task(test_switch_tab);
+add_task(test_new_window_make);
+add_task(test_new_window_get);
+add_task(test_minimize_make);
+add_task(test_minimize_get);
+
+async function assertStatus(tab, expected) {
+ let actual = await SpecialPowers.spawn(
+ tab.linkedBrowser,
+ [],
+ async function () {
+ info("visbility state: " + content.document.visibilityState);
+ info("active: " + content.browsingContext.isActive);
+ return content.document.getElementById("status").value;
+ }
+ );
+ is(actual, expected, "webauthn request " + expected);
+}
+
+async function waitForStatus(tab, expected) {
+ /* eslint-disable no-shadow */
+ await SpecialPowers.spawn(
+ tab.linkedBrowser,
+ [[expected]],
+ async function (expected) {
+ return ContentTaskUtils.waitForCondition(() => {
+ info(
+ "expecting " +
+ expected +
+ ", visbility state: " +
+ content.document.visibilityState
+ );
+ info(
+ "expecting " +
+ expected +
+ ", active: " +
+ content.browsingContext.isActive
+ );
+ return content.document.getElementById("status").value == expected;
+ });
+ }
+ );
+ /* eslint-enable no-shadow */
+
+ await assertStatus(tab, expected);
+}
+
+function startMakeCredentialRequest(tab) {
+ return SpecialPowers.spawn(tab.linkedBrowser, [], async function () {
+ const cose_alg_ECDSA_w_SHA256 = -7;
+
+ let publicKey = {
+ rp: { id: content.document.domain, name: "none", icon: "none" },
+ user: {
+ id: new Uint8Array(),
+ name: "none",
+ icon: "none",
+ displayName: "none",
+ },
+ challenge: content.crypto.getRandomValues(new Uint8Array(16)),
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ pubKeyCredParams: [{ type: "public-key", alg: cose_alg_ECDSA_w_SHA256 }],
+ };
+
+ let status = content.document.getElementById("status");
+
+ info(
+ "Attempting to create credential for origin: " +
+ content.document.nodePrincipal.origin
+ );
+ content.navigator.credentials
+ .create({ publicKey })
+ .then(() => {
+ status.value = "completed";
+ })
+ .catch(() => {
+ status.value = "aborted";
+ });
+
+ status.value = "pending";
+ });
+}
+
+function startGetAssertionRequest(tab) {
+ return SpecialPowers.spawn(tab.linkedBrowser, [], async function () {
+ let newCredential = {
+ type: "public-key",
+ id: content.crypto.getRandomValues(new Uint8Array(16)),
+ transports: ["usb"],
+ };
+
+ let publicKey = {
+ challenge: content.crypto.getRandomValues(new Uint8Array(16)),
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ rpId: content.document.domain,
+ allowCredentials: [newCredential],
+ };
+
+ let status = content.document.getElementById("status");
+
+ info(
+ "Attempting to get credential for origin: " +
+ content.document.nodePrincipal.origin
+ );
+ content.navigator.credentials
+ .get({ publicKey })
+ .then(() => {
+ status.value = "completed";
+ })
+ .catch(ex => {
+ info("aborted: " + ex);
+ status.value = "aborted";
+ });
+
+ status.value = "pending";
+ });
+}
+
+// Test that MakeCredential() and GetAssertion() requests
+// are aborted when the current tab loses its focus.
+async function test_switch_tab() {
+ // Create a new tab for the MakeCredential() request.
+ let tab_create = await BrowserTestUtils.openNewForegroundTab(
+ gBrowser,
+ TEST_URL
+ );
+
+ // Start the request.
+ await startMakeCredentialRequest(tab_create);
+ await assertStatus(tab_create, "pending");
+
+ // Open another tab and switch to it. The first will lose focus.
+ let tab_get = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+ await assertStatus(tab_create, "pending");
+
+ // Start a GetAssertion() request in the second tab, the first is aborted
+ await startGetAssertionRequest(tab_get);
+ await waitForStatus(tab_create, "aborted");
+ await assertStatus(tab_get, "pending");
+
+ // Start a second request in the second tab. It should abort.
+ await startGetAssertionRequest(tab_get);
+ await waitForStatus(tab_get, "aborted");
+
+ // Close tabs.
+ BrowserTestUtils.removeTab(tab_create);
+ BrowserTestUtils.removeTab(tab_get);
+}
+
+function waitForWindowActive(win, active) {
+ return Promise.all([
+ BrowserTestUtils.waitForEvent(win, active ? "focus" : "blur"),
+ BrowserTestUtils.waitForEvent(win, active ? "activate" : "deactivate"),
+ ]);
+}
+
+async function test_new_window_make() {
+ // Create a new tab for the MakeCredential() request.
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ // Start a MakeCredential request.
+ await startMakeCredentialRequest(tab);
+ await assertStatus(tab, "pending");
+
+ let windowGonePromise = waitForWindowActive(window, false);
+ // Open a new window. The tab will lose focus.
+ let win = await BrowserTestUtils.openNewBrowserWindow();
+ await windowGonePromise;
+ await assertStatus(tab, "pending");
+
+ let windowBackPromise = waitForWindowActive(window, true);
+ await BrowserTestUtils.closeWindow(win);
+ await windowBackPromise;
+
+ // Close tab.
+ await BrowserTestUtils.removeTab(tab);
+}
+
+async function test_new_window_get() {
+ // Create a new tab for the GetAssertion() request.
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ // Start a GetAssertion request.
+ await startGetAssertionRequest(tab);
+ await assertStatus(tab, "pending");
+
+ let windowGonePromise = waitForWindowActive(window, false);
+ // Open a new window. The tab will lose focus.
+ let win = await BrowserTestUtils.openNewBrowserWindow();
+ await windowGonePromise;
+ await assertStatus(tab, "pending");
+
+ let windowBackPromise = waitForWindowActive(window, true);
+ await BrowserTestUtils.closeWindow(win);
+ await windowBackPromise;
+
+ // Close tab.
+ BrowserTestUtils.removeTab(tab);
+}
+
+async function test_minimize_make() {
+ // Minimizing windows doesn't supported in headless mode.
+ if (Services.env.get("MOZ_HEADLESS")) {
+ return;
+ }
+
+ // Create a new window for the MakeCredential() request.
+ let win = await BrowserTestUtils.openNewBrowserWindow();
+ let tab = await BrowserTestUtils.openNewForegroundTab(win.gBrowser, TEST_URL);
+
+ // Start a MakeCredential request.
+ await startMakeCredentialRequest(tab);
+ await assertStatus(tab, "pending");
+
+ // Minimize the window.
+ let windowGonePromise = waitForWindowActive(win, false);
+ win.minimize();
+ await assertStatus(tab, "pending");
+ await windowGonePromise;
+
+ // Restore the window.
+ await new Promise(resolve => SimpleTest.waitForFocus(resolve, win));
+ await assertStatus(tab, "pending");
+
+ // Close window and wait for main window to be focused again.
+ let windowBackPromise = waitForWindowActive(window, true);
+ await BrowserTestUtils.closeWindow(win);
+ await windowBackPromise;
+}
+
+async function test_minimize_get() {
+ // Minimizing windows doesn't supported in headless mode.
+ if (Services.env.get("MOZ_HEADLESS")) {
+ return;
+ }
+
+ // Create a new window for the GetAssertion() request.
+ let win = await BrowserTestUtils.openNewBrowserWindow();
+ let tab = await BrowserTestUtils.openNewForegroundTab(win.gBrowser, TEST_URL);
+
+ // Start a GetAssertion request.
+ await startGetAssertionRequest(tab);
+ await assertStatus(tab, "pending");
+
+ // Minimize the window.
+ let windowGonePromise = waitForWindowActive(win, false);
+ win.minimize();
+ await assertStatus(tab, "pending");
+ await windowGonePromise;
+
+ // Restore the window.
+ await new Promise(resolve => SimpleTest.waitForFocus(resolve, win));
+ await assertStatus(tab, "pending");
+
+ // Close window and wait for main window to be focused again.
+ let windowBackPromise = waitForWindowActive(window, true);
+ await BrowserTestUtils.closeWindow(win);
+ await windowBackPromise;
+}
diff --git a/dom/webauthn/tests/browser/browser_fido_appid_extension.js b/dom/webauthn/tests/browser/browser_fido_appid_extension.js
new file mode 100644
index 0000000000..0d45bda434
--- /dev/null
+++ b/dom/webauthn/tests/browser/browser_fido_appid_extension.js
@@ -0,0 +1,67 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+const TEST_URL = "https://example.com/";
+
+let expectNotSupportedError = expectError("NotSupported");
+let expectInvalidStateError = expectError("InvalidState");
+let expectSecurityError = expectError("Security");
+
+add_task(async function test_appid_unused() {
+ // Open a new tab.
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ let appid = "https://example.com/appId";
+
+ let { attObj, rawId } = await promiseWebAuthnMakeCredential(tab);
+ let { authDataObj } = await webAuthnDecodeCBORAttestation(attObj);
+
+ // Make sure the RP ID hash matches what we calculate.
+ await checkRpIdHash(authDataObj.rpIdHash, "example.com");
+
+ // Get a new assertion.
+ let { clientDataJSON, authenticatorData, signature, extensions } =
+ await promiseWebAuthnGetAssertion(tab, rawId, { appid });
+
+ ok(
+ "appid" in extensions,
+ `appid should be populated in the extensions data, but saw: ` +
+ `${JSON.stringify(extensions)}`
+ );
+ is(extensions.appid, false, "appid extension should indicate it was unused");
+
+ // Check auth data.
+ let attestation = await webAuthnDecodeAuthDataArray(
+ new Uint8Array(authenticatorData)
+ );
+ is(
+ "" + attestation.flags,
+ "" + flag_TUP,
+ "Assertion's user presence byte set correctly"
+ );
+
+ // Verify the signature.
+ let params = await deriveAppAndChallengeParam(
+ "example.com",
+ clientDataJSON,
+ attestation
+ );
+ let signedData = await assembleSignedData(
+ params.appParam,
+ params.attestation.flags,
+ params.attestation.counter,
+ params.challengeParam
+ );
+ let valid = await verifySignature(
+ authDataObj.publicKeyHandle,
+ signedData,
+ signature
+ );
+ ok(valid, "signature is valid");
+
+ // Close tab.
+ BrowserTestUtils.removeTab(tab);
+});
diff --git a/dom/webauthn/tests/browser/browser_webauthn_ipaddress.js b/dom/webauthn/tests/browser/browser_webauthn_ipaddress.js
new file mode 100644
index 0000000000..2c3f8ea025
--- /dev/null
+++ b/dom/webauthn/tests/browser/browser_webauthn_ipaddress.js
@@ -0,0 +1,28 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+let expectSecurityError = expectError("Security");
+
+add_task(async function test_setup() {
+ return SpecialPowers.pushPrefEnv({
+ set: [["network.proxy.allow_hijacking_localhost", true]],
+ });
+});
+
+add_task(async function test_appid() {
+ // 127.0.0.1 triggers special cases in ssltunnel, so let's use .2!
+ const TEST_URL = "https://127.0.0.2/";
+
+ // Open a new tab.
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ await promiseWebAuthnMakeCredential(tab, "none", {})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+
+ // Close tab.
+ BrowserTestUtils.removeTab(tab);
+});
diff --git a/dom/webauthn/tests/browser/browser_webauthn_prompts.js b/dom/webauthn/tests/browser/browser_webauthn_prompts.js
new file mode 100644
index 0000000000..10835f73b6
--- /dev/null
+++ b/dom/webauthn/tests/browser/browser_webauthn_prompts.js
@@ -0,0 +1,316 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+const TEST_URL = "https://example.com/";
+
+add_task(async function test_setup_usbtoken() {
+ return SpecialPowers.pushPrefEnv({
+ set: [
+ ["security.webauth.webauthn_enable_softtoken", false],
+ ["security.webauth.webauthn_enable_usbtoken", true],
+ ],
+ });
+});
+add_task(test_register);
+add_task(test_register_escape);
+add_task(test_sign);
+add_task(test_sign_escape);
+add_task(test_register_direct_cancel);
+add_task(test_tab_switching);
+add_task(test_window_switching);
+add_task(async function test_setup_softtoken() {
+ return SpecialPowers.pushPrefEnv({
+ set: [
+ ["security.webauth.webauthn_enable_softtoken", true],
+ ["security.webauth.webauthn_enable_usbtoken", false],
+ ],
+ });
+});
+add_task(test_register_direct_proceed);
+add_task(test_register_direct_proceed_anon);
+
+function promiseNotification(id) {
+ return new Promise(resolve => {
+ PopupNotifications.panel.addEventListener("popupshown", function shown() {
+ let notification = PopupNotifications.getNotification(id);
+ if (notification) {
+ ok(true, `${id} prompt visible`);
+ PopupNotifications.panel.removeEventListener("popupshown", shown);
+ resolve();
+ }
+ });
+ });
+}
+
+function triggerMainPopupCommand(popup) {
+ info("triggering main command");
+ let notifications = popup.childNodes;
+ ok(notifications.length, "at least one notification displayed");
+ let notification = notifications[0];
+ info("triggering command: " + notification.getAttribute("buttonlabel"));
+
+ return EventUtils.synthesizeMouseAtCenter(notification.button, {});
+}
+
+let expectNotAllowedError = expectError("NotAllowed");
+
+function verifyAnonymizedCertificate(result) {
+ let { attObj, rawId } = result;
+ return webAuthnDecodeCBORAttestation(attObj).then(({ fmt, attStmt }) => {
+ is("none", fmt, "Is a None Attestation");
+ is("object", typeof attStmt, "attStmt is a map");
+ is(0, Object.keys(attStmt).length, "attStmt is empty");
+ });
+}
+
+function verifyDirectCertificate(result) {
+ let { attObj, rawId } = result;
+ return webAuthnDecodeCBORAttestation(attObj).then(({ fmt, attStmt }) => {
+ is("fido-u2f", fmt, "Is a FIDO U2F Attestation");
+ is("object", typeof attStmt, "attStmt is a map");
+ ok(attStmt.hasOwnProperty("x5c"), "attStmt.x5c exists");
+ ok(attStmt.hasOwnProperty("sig"), "attStmt.sig exists");
+ });
+}
+
+async function test_register() {
+ // Open a new tab.
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ // Request a new credential and wait for the prompt.
+ let active = true;
+ let request = promiseWebAuthnMakeCredential(tab, "none", {})
+ .then(arrivingHereIsBad)
+ .catch(expectNotAllowedError)
+ .then(() => (active = false));
+ await promiseNotification("webauthn-prompt-presence");
+
+ // Cancel the request with the button.
+ ok(active, "request should still be active");
+ PopupNotifications.panel.firstElementChild.button.click();
+ await request;
+
+ // Close tab.
+ await BrowserTestUtils.removeTab(tab);
+}
+
+async function test_register_escape() {
+ // Open a new tab.
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ // Request a new credential and wait for the prompt.
+ let active = true;
+ let request = promiseWebAuthnMakeCredential(tab, "none", {})
+ .then(arrivingHereIsBad)
+ .catch(expectNotAllowedError)
+ .then(() => (active = false));
+ await promiseNotification("webauthn-prompt-presence");
+
+ // Cancel the request by hitting escape.
+ ok(active, "request should still be active");
+ EventUtils.synthesizeKey("KEY_Escape");
+ await request;
+
+ // Close tab.
+ await BrowserTestUtils.removeTab(tab);
+}
+
+async function test_sign() {
+ // Open a new tab.
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ // Request a new assertion and wait for the prompt.
+ let active = true;
+ let request = promiseWebAuthnGetAssertion(tab)
+ .then(arrivingHereIsBad)
+ .catch(expectNotAllowedError)
+ .then(() => (active = false));
+ await promiseNotification("webauthn-prompt-presence");
+
+ // Cancel the request with the button.
+ ok(active, "request should still be active");
+ PopupNotifications.panel.firstElementChild.button.click();
+ await request;
+
+ // Close tab.
+ await BrowserTestUtils.removeTab(tab);
+}
+
+async function test_sign_escape() {
+ // Open a new tab.
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ // Request a new assertion and wait for the prompt.
+ let active = true;
+ let request = promiseWebAuthnGetAssertion(tab)
+ .then(arrivingHereIsBad)
+ .catch(expectNotAllowedError)
+ .then(() => (active = false));
+ await promiseNotification("webauthn-prompt-presence");
+
+ // Cancel the request by hitting escape.
+ ok(active, "request should still be active");
+ EventUtils.synthesizeKey("KEY_Escape");
+ await request;
+
+ // Close tab.
+ await BrowserTestUtils.removeTab(tab);
+}
+
+async function test_register_direct_cancel() {
+ // Open a new tab.
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ // Request a new credential with direct attestation and wait for the prompt.
+ let active = true;
+ let promise = promiseWebAuthnMakeCredential(tab, "direct", {})
+ .then(arrivingHereIsBad)
+ .catch(expectNotAllowedError)
+ .then(() => (active = false));
+ await promiseNotification("webauthn-prompt-register-direct");
+
+ // Cancel the request.
+ ok(active, "request should still be active");
+ PopupNotifications.panel.firstElementChild.secondaryButton.click();
+ await promise;
+
+ // Close tab.
+ await BrowserTestUtils.removeTab(tab);
+}
+
+// Add two tabs, open WebAuthn in the first, switch, assert the prompt is
+// not visible, switch back, assert the prompt is there and cancel it.
+async function test_tab_switching() {
+ // Open a new tab.
+ let tab_one = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ // Request a new credential and wait for the prompt.
+ let active = true;
+ let request = promiseWebAuthnMakeCredential(tab_one, "none", {})
+ .then(arrivingHereIsBad)
+ .catch(expectNotAllowedError)
+ .then(() => (active = false));
+ await promiseNotification("webauthn-prompt-presence");
+ is(PopupNotifications.panel.state, "open", "Doorhanger is visible");
+
+ // Open and switch to a second tab.
+ let tab_two = await BrowserTestUtils.openNewForegroundTab(
+ gBrowser,
+ "https://example.org/"
+ );
+
+ await TestUtils.waitForCondition(
+ () => PopupNotifications.panel.state == "closed"
+ );
+ is(PopupNotifications.panel.state, "closed", "Doorhanger is hidden");
+
+ // Go back to the first tab
+ await BrowserTestUtils.removeTab(tab_two);
+
+ await promiseNotification("webauthn-prompt-presence");
+
+ await TestUtils.waitForCondition(
+ () => PopupNotifications.panel.state == "open"
+ );
+ is(PopupNotifications.panel.state, "open", "Doorhanger is visible");
+
+ // Cancel the request.
+ ok(active, "request should still be active");
+ await triggerMainPopupCommand(PopupNotifications.panel);
+ await request;
+ ok(!active, "request should be stopped");
+
+ // Close tab.
+ await BrowserTestUtils.removeTab(tab_one);
+}
+
+// Add two tabs, open WebAuthn in the first, switch, assert the prompt is
+// not visible, switch back, assert the prompt is there and cancel it.
+async function test_window_switching() {
+ // Open a new tab.
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ // Request a new credential and wait for the prompt.
+ let active = true;
+ let request = promiseWebAuthnMakeCredential(tab, "none", {})
+ .then(arrivingHereIsBad)
+ .catch(expectNotAllowedError)
+ .then(() => (active = false));
+ await promiseNotification("webauthn-prompt-presence");
+
+ await TestUtils.waitForCondition(
+ () => PopupNotifications.panel.state == "open"
+ );
+ is(PopupNotifications.panel.state, "open", "Doorhanger is visible");
+
+ // Open and switch to a second window
+ let new_window = await BrowserTestUtils.openNewBrowserWindow();
+ await SimpleTest.promiseFocus(new_window);
+
+ await TestUtils.waitForCondition(
+ () => new_window.PopupNotifications.panel.state == "closed"
+ );
+ is(
+ new_window.PopupNotifications.panel.state,
+ "closed",
+ "Doorhanger is hidden"
+ );
+
+ // Go back to the first tab
+ await BrowserTestUtils.closeWindow(new_window);
+ await SimpleTest.promiseFocus(window);
+
+ await TestUtils.waitForCondition(
+ () => PopupNotifications.panel.state == "open"
+ );
+ is(PopupNotifications.panel.state, "open", "Doorhanger is still visible");
+
+ // Cancel the request.
+ ok(active, "request should still be active");
+ await triggerMainPopupCommand(PopupNotifications.panel);
+ await request;
+ ok(!active, "request should be stopped");
+
+ // Close tab.
+ await BrowserTestUtils.removeTab(tab);
+}
+
+async function test_register_direct_proceed() {
+ // Open a new tab.
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ // Request a new credential with direct attestation and wait for the prompt.
+ let request = promiseWebAuthnMakeCredential(tab, "direct", {});
+ await promiseNotification("webauthn-prompt-register-direct");
+
+ // Proceed.
+ PopupNotifications.panel.firstElementChild.button.click();
+
+ // Ensure we got "direct" attestation.
+ await request.then(verifyDirectCertificate);
+
+ // Close tab.
+ await BrowserTestUtils.removeTab(tab);
+}
+
+async function test_register_direct_proceed_anon() {
+ // Open a new tab.
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ // Request a new credential with direct attestation and wait for the prompt.
+ let request = promiseWebAuthnMakeCredential(tab, "direct", {});
+ await promiseNotification("webauthn-prompt-register-direct");
+
+ // Check "anonymize anyway" and proceed.
+ PopupNotifications.panel.firstElementChild.checkbox.checked = true;
+ PopupNotifications.panel.firstElementChild.button.click();
+
+ // Ensure we got "none" attestation.
+ await request.then(verifyAnonymizedCertificate);
+
+ // Close tab.
+ await BrowserTestUtils.removeTab(tab);
+}
diff --git a/dom/webauthn/tests/browser/browser_webauthn_telemetry.js b/dom/webauthn/tests/browser/browser_webauthn_telemetry.js
new file mode 100644
index 0000000000..bb96432a02
--- /dev/null
+++ b/dom/webauthn/tests/browser/browser_webauthn_telemetry.js
@@ -0,0 +1,134 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+ChromeUtils.defineESModuleGetters(this, {
+ TelemetryTestUtils: "resource://testing-common/TelemetryTestUtils.sys.mjs",
+});
+
+const TEST_URL = "https://example.com/";
+
+function getTelemetryForScalar(aName) {
+ let scalars = TelemetryTestUtils.getProcessScalars("parent", true);
+ return scalars[aName] || 0;
+}
+
+function cleanupTelemetry() {
+ Services.telemetry.clearScalars();
+ Services.telemetry.clearEvents();
+}
+
+function validateHistogramEntryCount(aHistogramName, aExpectedCount) {
+ let hist = Services.telemetry.getHistogramById(aHistogramName);
+ let resultIndexes = hist.snapshot();
+
+ let entriesSeen = Object.values(resultIndexes.values).reduce(
+ (a, b) => a + b,
+ 0
+ );
+
+ is(
+ entriesSeen,
+ aExpectedCount,
+ "Expecting " + aExpectedCount + " histogram entries in " + aHistogramName
+ );
+}
+
+add_task(async function test_setup() {
+ cleanupTelemetry();
+
+ await SpecialPowers.pushPrefEnv({
+ set: [
+ ["security.webauth.webauthn", true],
+ ["security.webauth.webauthn_enable_softtoken", true],
+ ["security.webauth.webauthn_enable_usbtoken", false],
+ ["security.webauth.webauthn_enable_android_fido2", false],
+ ["security.webauth.webauthn_testing_allow_direct_attestation", true],
+ ],
+ });
+});
+
+add_task(async function test() {
+ // These tests can't run simultaneously as the preference changes will race.
+ // So let's run them sequentially here, but in an async function so we can
+ // use await.
+
+ let tab = await BrowserTestUtils.openNewForegroundTab(gBrowser, TEST_URL);
+
+ // Create a new credential.
+ let { attObj, rawId } = await promiseWebAuthnMakeCredential(tab);
+ let { authDataObj } = await webAuthnDecodeCBORAttestation(attObj);
+
+ // Make sure the RP ID hash matches what we calculate.
+ await checkRpIdHash(authDataObj.rpIdHash, "example.com");
+
+ // Get a new assertion.
+ let { clientDataJSON, authenticatorData, signature } =
+ await promiseWebAuthnGetAssertion(tab, rawId);
+
+ // Check the we can parse clientDataJSON.
+ JSON.parse(buffer2string(clientDataJSON));
+
+ // Check auth data.
+ let attestation = await webAuthnDecodeAuthDataArray(
+ new Uint8Array(authenticatorData)
+ );
+ is(
+ "" + attestation.flags,
+ "" + flag_TUP,
+ "Assertion's user presence byte set correctly"
+ );
+
+ // Verify the signature.
+ let params = await deriveAppAndChallengeParam(
+ "example.com",
+ clientDataJSON,
+ attestation
+ );
+ let signedData = await assembleSignedData(
+ params.appParam,
+ params.attestation.flags,
+ params.attestation.counter,
+ params.challengeParam
+ );
+ let valid = await verifySignature(
+ authDataObj.publicKeyHandle,
+ signedData,
+ signature
+ );
+ ok(valid, "signature is valid");
+
+ // Check telemetry data.
+ let webauthn_used = getTelemetryForScalar("security.webauthn_used");
+ ok(
+ webauthn_used,
+ "Scalar keys are set: " + Object.keys(webauthn_used).join(", ")
+ );
+ is(
+ webauthn_used.CTAPRegisterFinish,
+ 1,
+ "webauthn_used CTAPRegisterFinish scalar should be 1"
+ );
+ is(
+ webauthn_used.CTAPSignFinish,
+ 1,
+ "webauthn_used CTAPSignFinish scalar should be 1"
+ );
+ is(
+ webauthn_used.CTAPSignAbort,
+ undefined,
+ "webauthn_used CTAPSignAbort scalar must be unset"
+ );
+ is(
+ webauthn_used.CTAPRegisterAbort,
+ undefined,
+ "webauthn_used CTAPRegisterAbort scalar must be unset"
+ );
+
+ BrowserTestUtils.removeTab(tab);
+
+ // There aren't tests for register succeeding and sign failing, as I don't see an easy way to prompt
+ // the soft token to fail that way _and_ trigger the Abort telemetry.
+});
diff --git a/dom/webauthn/tests/browser/head.js b/dom/webauthn/tests/browser/head.js
new file mode 100644
index 0000000000..d2c364cecd
--- /dev/null
+++ b/dom/webauthn/tests/browser/head.js
@@ -0,0 +1,155 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+let exports = this;
+
+const scripts = [
+ "pkijs/common.js",
+ "pkijs/asn1.js",
+ "pkijs/x509_schema.js",
+ "pkijs/x509_simpl.js",
+ "browser/cbor.js",
+ "browser/u2futil.js",
+];
+
+for (let script of scripts) {
+ Services.scriptloader.loadSubScript(
+ `chrome://mochitests/content/browser/dom/webauthn/tests/${script}`,
+ this
+ );
+}
+
+function memcmp(x, y) {
+ let xb = new Uint8Array(x);
+ let yb = new Uint8Array(y);
+
+ if (x.byteLength != y.byteLength) {
+ return false;
+ }
+
+ for (let i = 0; i < xb.byteLength; ++i) {
+ if (xb[i] != yb[i]) {
+ return false;
+ }
+ }
+
+ return true;
+}
+
+function arrivingHereIsBad(aResult) {
+ ok(false, "Bad result! Received a: " + aResult);
+}
+
+function expectError(aType) {
+ let expected = `${aType}Error`;
+ return function (aResult) {
+ is(
+ aResult.slice(0, expected.length),
+ expected,
+ `Expecting a ${aType}Error`
+ );
+ };
+}
+
+/* eslint-disable no-shadow */
+function promiseWebAuthnMakeCredential(
+ tab,
+ attestation = "none",
+ extensions = {}
+) {
+ return ContentTask.spawn(
+ tab.linkedBrowser,
+ [attestation, extensions],
+ ([attestation, extensions]) => {
+ const cose_alg_ECDSA_w_SHA256 = -7;
+
+ let challenge = content.crypto.getRandomValues(new Uint8Array(16));
+
+ let pubKeyCredParams = [
+ {
+ type: "public-key",
+ alg: cose_alg_ECDSA_w_SHA256,
+ },
+ ];
+
+ let publicKey = {
+ rp: { id: content.document.domain, name: "none", icon: "none" },
+ user: {
+ id: new Uint8Array(),
+ name: "none",
+ icon: "none",
+ displayName: "none",
+ },
+ pubKeyCredParams,
+ extensions,
+ attestation,
+ challenge,
+ };
+
+ return content.navigator.credentials
+ .create({ publicKey })
+ .then(credential => {
+ return {
+ attObj: credential.response.attestationObject,
+ rawId: credential.rawId,
+ };
+ });
+ }
+ );
+}
+
+function promiseWebAuthnGetAssertion(tab, key_handle = null, extensions = {}) {
+ return ContentTask.spawn(
+ tab.linkedBrowser,
+ [key_handle, extensions],
+ ([key_handle, extensions]) => {
+ let challenge = content.crypto.getRandomValues(new Uint8Array(16));
+ if (key_handle == null) {
+ key_handle = content.crypto.getRandomValues(new Uint8Array(16));
+ }
+
+ let credential = {
+ id: key_handle,
+ type: "public-key",
+ transports: ["usb"],
+ };
+
+ let publicKey = {
+ challenge,
+ extensions,
+ rpId: content.document.domain,
+ allowCredentials: [credential],
+ };
+
+ return content.navigator.credentials
+ .get({ publicKey })
+ .then(assertion => {
+ return {
+ authenticatorData: assertion.response.authenticatorData,
+ clientDataJSON: assertion.response.clientDataJSON,
+ extensions: assertion.getClientExtensionResults(),
+ signature: assertion.response.signature,
+ };
+ });
+ }
+ );
+}
+
+function checkRpIdHash(rpIdHash, hostname) {
+ return crypto.subtle
+ .digest("SHA-256", string2buffer(hostname))
+ .then(calculatedRpIdHash => {
+ let calcHashStr = bytesToBase64UrlSafe(
+ new Uint8Array(calculatedRpIdHash)
+ );
+ let providedHashStr = bytesToBase64UrlSafe(new Uint8Array(rpIdHash));
+
+ if (calcHashStr != providedHashStr) {
+ throw new Error("Calculated RP ID hash doesn't match.");
+ }
+ });
+}
+/* eslint-enable no-shadow */
diff --git a/dom/webauthn/tests/browser/tab_webauthn_result.html b/dom/webauthn/tests/browser/tab_webauthn_result.html
new file mode 100644
index 0000000000..8e8b9f82cd
--- /dev/null
+++ b/dom/webauthn/tests/browser/tab_webauthn_result.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Generic W3C Web Authentication Test Result Page</title>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+<h1>Generic W3C Web Authentication Test Result Page</h1>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1415675">Mozilla Bug 1415675</a>
+<input type="text" id="status" value="init" />
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/cbor.js b/dom/webauthn/tests/cbor.js
new file mode 100644
index 0000000000..3e1f300df3
--- /dev/null
+++ b/dom/webauthn/tests/cbor.js
@@ -0,0 +1,406 @@
+/*
+ * The MIT License (MIT)
+ *
+ * Copyright (c) 2014-2016 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+(function(global, undefined) { "use strict";
+var POW_2_24 = 5.960464477539063e-8,
+ POW_2_32 = 4294967296,
+ POW_2_53 = 9007199254740992;
+
+function encode(value) {
+ var data = new ArrayBuffer(256);
+ var dataView = new DataView(data);
+ var lastLength;
+ var offset = 0;
+
+ function prepareWrite(length) {
+ var newByteLength = data.byteLength;
+ var requiredLength = offset + length;
+ while (newByteLength < requiredLength)
+ newByteLength <<= 1;
+ if (newByteLength !== data.byteLength) {
+ var oldDataView = dataView;
+ data = new ArrayBuffer(newByteLength);
+ dataView = new DataView(data);
+ var uint32count = (offset + 3) >> 2;
+ for (var i = 0; i < uint32count; ++i)
+ dataView.setUint32(i << 2, oldDataView.getUint32(i << 2));
+ }
+
+ lastLength = length;
+ return dataView;
+ }
+ function commitWrite() {
+ offset += lastLength;
+ }
+ function writeFloat64(value) {
+ commitWrite(prepareWrite(8).setFloat64(offset, value));
+ }
+ function writeUint8(value) {
+ commitWrite(prepareWrite(1).setUint8(offset, value));
+ }
+ function writeUint8Array(value) {
+ var dataView = prepareWrite(value.length);
+ for (var i = 0; i < value.length; ++i)
+ dataView.setUint8(offset + i, value[i]);
+ commitWrite();
+ }
+ function writeUint16(value) {
+ commitWrite(prepareWrite(2).setUint16(offset, value));
+ }
+ function writeUint32(value) {
+ commitWrite(prepareWrite(4).setUint32(offset, value));
+ }
+ function writeUint64(value) {
+ var low = value % POW_2_32;
+ var high = (value - low) / POW_2_32;
+ var dataView = prepareWrite(8);
+ dataView.setUint32(offset, high);
+ dataView.setUint32(offset + 4, low);
+ commitWrite();
+ }
+ function writeTypeAndLength(type, length) {
+ if (length < 24) {
+ writeUint8(type << 5 | length);
+ } else if (length < 0x100) {
+ writeUint8(type << 5 | 24);
+ writeUint8(length);
+ } else if (length < 0x10000) {
+ writeUint8(type << 5 | 25);
+ writeUint16(length);
+ } else if (length < 0x100000000) {
+ writeUint8(type << 5 | 26);
+ writeUint32(length);
+ } else {
+ writeUint8(type << 5 | 27);
+ writeUint64(length);
+ }
+ }
+
+ function encodeItem(value) {
+ var i;
+
+ if (value === false)
+ return writeUint8(0xf4);
+ if (value === true)
+ return writeUint8(0xf5);
+ if (value === null)
+ return writeUint8(0xf6);
+ if (value === undefined)
+ return writeUint8(0xf7);
+
+ switch (typeof value) {
+ case "number":
+ if (Math.floor(value) === value) {
+ if (0 <= value && value <= POW_2_53)
+ return writeTypeAndLength(0, value);
+ if (-POW_2_53 <= value && value < 0)
+ return writeTypeAndLength(1, -(value + 1));
+ }
+ writeUint8(0xfb);
+ return writeFloat64(value);
+
+ case "string":
+ var utf8data = [];
+ for (i = 0; i < value.length; ++i) {
+ var charCode = value.charCodeAt(i);
+ if (charCode < 0x80) {
+ utf8data.push(charCode);
+ } else if (charCode < 0x800) {
+ utf8data.push(0xc0 | charCode >> 6);
+ utf8data.push(0x80 | charCode & 0x3f);
+ } else if (charCode < 0xd800) {
+ utf8data.push(0xe0 | charCode >> 12);
+ utf8data.push(0x80 | (charCode >> 6) & 0x3f);
+ utf8data.push(0x80 | charCode & 0x3f);
+ } else {
+ charCode = (charCode & 0x3ff) << 10;
+ charCode |= value.charCodeAt(++i) & 0x3ff;
+ charCode += 0x10000;
+
+ utf8data.push(0xf0 | charCode >> 18);
+ utf8data.push(0x80 | (charCode >> 12) & 0x3f);
+ utf8data.push(0x80 | (charCode >> 6) & 0x3f);
+ utf8data.push(0x80 | charCode & 0x3f);
+ }
+ }
+
+ writeTypeAndLength(3, utf8data.length);
+ return writeUint8Array(utf8data);
+
+ default:
+ var length;
+ if (Array.isArray(value)) {
+ length = value.length;
+ writeTypeAndLength(4, length);
+ for (i = 0; i < length; ++i)
+ encodeItem(value[i]);
+ } else if (value instanceof Uint8Array) {
+ writeTypeAndLength(2, value.length);
+ writeUint8Array(value);
+ } else {
+ var keys = Object.keys(value);
+ length = keys.length;
+ writeTypeAndLength(5, length);
+ for (i = 0; i < length; ++i) {
+ var key = keys[i];
+ encodeItem(key);
+ encodeItem(value[key]);
+ }
+ }
+ }
+ }
+
+ encodeItem(value);
+
+ if ("slice" in data)
+ return data.slice(0, offset);
+
+ var ret = new ArrayBuffer(offset);
+ var retView = new DataView(ret);
+ for (var i = 0; i < offset; ++i)
+ retView.setUint8(i, dataView.getUint8(i));
+ return ret;
+}
+
+function decode(data, tagger, simpleValue) {
+ var dataView = new DataView(data);
+ var offset = 0;
+
+ if (typeof tagger !== "function")
+ tagger = function(value) { return value; };
+ if (typeof simpleValue !== "function")
+ simpleValue = function() { return undefined; };
+
+ function commitRead(length, value) {
+ offset += length;
+ return value;
+ }
+ function readArrayBuffer(length) {
+ return commitRead(length, new Uint8Array(data, offset, length));
+ }
+ function readFloat16() {
+ var tempArrayBuffer = new ArrayBuffer(4);
+ var tempDataView = new DataView(tempArrayBuffer);
+ var value = readUint16();
+
+ var sign = value & 0x8000;
+ var exponent = value & 0x7c00;
+ var fraction = value & 0x03ff;
+
+ if (exponent === 0x7c00)
+ exponent = 0xff << 10;
+ else if (exponent !== 0)
+ exponent += (127 - 15) << 10;
+ else if (fraction !== 0)
+ return (sign ? -1 : 1) * fraction * POW_2_24;
+
+ tempDataView.setUint32(0, sign << 16 | exponent << 13 | fraction << 13);
+ return tempDataView.getFloat32(0);
+ }
+ function readFloat32() {
+ return commitRead(4, dataView.getFloat32(offset));
+ }
+ function readFloat64() {
+ return commitRead(8, dataView.getFloat64(offset));
+ }
+ function readUint8() {
+ return commitRead(1, dataView.getUint8(offset));
+ }
+ function readUint16() {
+ return commitRead(2, dataView.getUint16(offset));
+ }
+ function readUint32() {
+ return commitRead(4, dataView.getUint32(offset));
+ }
+ function readUint64() {
+ return readUint32() * POW_2_32 + readUint32();
+ }
+ function readBreak() {
+ if (dataView.getUint8(offset) !== 0xff)
+ return false;
+ offset += 1;
+ return true;
+ }
+ function readLength(additionalInformation) {
+ if (additionalInformation < 24)
+ return additionalInformation;
+ if (additionalInformation === 24)
+ return readUint8();
+ if (additionalInformation === 25)
+ return readUint16();
+ if (additionalInformation === 26)
+ return readUint32();
+ if (additionalInformation === 27)
+ return readUint64();
+ if (additionalInformation === 31)
+ return -1;
+ throw "Invalid length encoding";
+ }
+ function readIndefiniteStringLength(majorType) {
+ var initialByte = readUint8();
+ if (initialByte === 0xff)
+ return -1;
+ var length = readLength(initialByte & 0x1f);
+ if (length < 0 || (initialByte >> 5) !== majorType)
+ throw "Invalid indefinite length element";
+ return length;
+ }
+
+ function appendUtf16Data(utf16data, length) {
+ for (var i = 0; i < length; ++i) {
+ var value = readUint8();
+ if (value & 0x80) {
+ if (value < 0xe0) {
+ value = (value & 0x1f) << 6
+ | (readUint8() & 0x3f);
+ length -= 1;
+ } else if (value < 0xf0) {
+ value = (value & 0x0f) << 12
+ | (readUint8() & 0x3f) << 6
+ | (readUint8() & 0x3f);
+ length -= 2;
+ } else {
+ value = (value & 0x0f) << 18
+ | (readUint8() & 0x3f) << 12
+ | (readUint8() & 0x3f) << 6
+ | (readUint8() & 0x3f);
+ length -= 3;
+ }
+ }
+
+ if (value < 0x10000) {
+ utf16data.push(value);
+ } else {
+ value -= 0x10000;
+ utf16data.push(0xd800 | (value >> 10));
+ utf16data.push(0xdc00 | (value & 0x3ff));
+ }
+ }
+ }
+
+ function decodeItem() {
+ var initialByte = readUint8();
+ var majorType = initialByte >> 5;
+ var additionalInformation = initialByte & 0x1f;
+ var i;
+ var length;
+
+ if (majorType === 7) {
+ switch (additionalInformation) {
+ case 25:
+ return readFloat16();
+ case 26:
+ return readFloat32();
+ case 27:
+ return readFloat64();
+ }
+ }
+
+ length = readLength(additionalInformation);
+ if (length < 0 && (majorType < 2 || 6 < majorType))
+ throw "Invalid length";
+
+ switch (majorType) {
+ case 0:
+ return length;
+ case 1:
+ return -1 - length;
+ case 2:
+ if (length < 0) {
+ var elements = [];
+ var fullArrayLength = 0;
+ while ((length = readIndefiniteStringLength(majorType)) >= 0) {
+ fullArrayLength += length;
+ elements.push(readArrayBuffer(length));
+ }
+ var fullArray = new Uint8Array(fullArrayLength);
+ var fullArrayOffset = 0;
+ for (i = 0; i < elements.length; ++i) {
+ fullArray.set(elements[i], fullArrayOffset);
+ fullArrayOffset += elements[i].length;
+ }
+ return fullArray;
+ }
+ return readArrayBuffer(length);
+ case 3:
+ var utf16data = [];
+ if (length < 0) {
+ while ((length = readIndefiniteStringLength(majorType)) >= 0)
+ appendUtf16Data(utf16data, length);
+ } else
+ appendUtf16Data(utf16data, length);
+ return String.fromCharCode.apply(null, utf16data);
+ case 4:
+ var retArray;
+ if (length < 0) {
+ retArray = [];
+ while (!readBreak())
+ retArray.push(decodeItem());
+ } else {
+ retArray = new Array(length);
+ for (i = 0; i < length; ++i)
+ retArray[i] = decodeItem();
+ }
+ return retArray;
+ case 5:
+ var retObject = {};
+ for (i = 0; i < length || length < 0 && !readBreak(); ++i) {
+ var key = decodeItem();
+ retObject[key] = decodeItem();
+ }
+ return retObject;
+ case 6:
+ return tagger(decodeItem(), length);
+ case 7:
+ switch (length) {
+ case 20:
+ return false;
+ case 21:
+ return true;
+ case 22:
+ return null;
+ case 23:
+ return undefined;
+ default:
+ return simpleValue(length);
+ }
+ }
+ }
+
+ var ret = decodeItem();
+ if (offset !== data.byteLength)
+ throw "Remaining bytes";
+ return ret;
+}
+
+var obj = { encode: encode, decode: decode };
+
+if (typeof define === "function" && define.amd)
+ define("cbor/cbor", obj);
+else if (typeof module !== "undefined" && module.exports)
+ module.exports = obj;
+else if (!global.CBOR)
+ global.CBOR = obj;
+
+})(this);
diff --git a/dom/webauthn/tests/get_assertion_dead_object.html b/dom/webauthn/tests/get_assertion_dead_object.html
new file mode 100644
index 0000000000..e7de9d3deb
--- /dev/null
+++ b/dom/webauthn/tests/get_assertion_dead_object.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset=utf-8>
+</head>
+<body>
+<script type="text/javascript">
+ window.addEventListener('load', function() {
+ let o = [];
+ o[0] = window.navigator;
+ document.writeln('');
+ // Since the USB token is enabled by default, this will pop up a notification that the
+ // user can insert/interact with it. Since this is just a test, this won't happen. The
+ // request will eventually time out.
+ // Unfortunately the minimum timeout is 15 seconds.
+ o[0].credentials.get({ publicKey: { challenge: new Uint8Array(128), timeout: 15000 } });
+ o.forEach((n, i) => o[i] = null);
+ });
+</script>
+</body>
+</html>
diff --git a/dom/webauthn/tests/mochitest.ini b/dom/webauthn/tests/mochitest.ini
new file mode 100644
index 0000000000..343864747f
--- /dev/null
+++ b/dom/webauthn/tests/mochitest.ini
@@ -0,0 +1,88 @@
+[DEFAULT]
+support-files =
+ cbor.js
+ u2futil.js
+ pkijs/*
+ get_assertion_dead_object.html
+scheme = https
+prefs =
+ security.webauth.webauthn=true
+ security.webauth.webauthn_enable_softtoken=true
+ security.webauth.webauthn_enable_android_fido2=false
+ security.webauth.webauthn_enable_usbtoken=false
+ security.webauthn.ctap2=true
+
+[test_webauthn_abort_signal.html]
+fail-if = xorigin
+skip-if =
+ win10_2004 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win10_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win11_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+[test_webauthn_attestation_conveyance.html]
+fail-if = xorigin # NotAllowedError
+skip-if =
+ win10_2004 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win10_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win11_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+[test_webauthn_authenticator_selection.html]
+fail-if = xorigin # NotAllowedError
+skip-if =
+ win10_2004 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win10_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win11_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+[test_webauthn_authenticator_transports.html]
+fail-if = xorigin # NotAllowedError
+skip-if =
+ win10_2004 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win10_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win11_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+[test_webauthn_loopback.html]
+skip-if =
+ xorigin # Hangs, JavaScript error: https://example.org/tests/SimpleTest/SimpleTest.js, line 76: DataCloneError: The object could not be cloned.
+ win10_2004 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win10_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win11_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+[test_webauthn_no_token.html]
+skip-if =
+ xorigin # JavaScript error: https://example.org/tests/SimpleTest/SimpleTest.js, line 76: DataCloneError: The object could not be cloned.
+ win10_2004 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win10_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win11_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+[test_webauthn_make_credential.html]
+fail-if = xorigin # NotAllowedError
+skip-if =
+ win10_2004 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win10_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win11_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+[test_webauthn_get_assertion.html]
+fail-if = xorigin # NotAllowedError
+skip-if =
+ win10_2004 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win10_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win11_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+[test_webauthn_get_assertion_dead_object.html]
+skip-if =
+ win10_2004 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win10_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win11_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+[test_webauthn_override_request.html]
+[test_webauthn_store_credential.html]
+fail-if = xorigin # NotAllowedError
+skip-if =
+ win10_2004 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win10_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win11_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+[test_webauthn_sameorigin.html]
+fail-if = xorigin # NotAllowedError
+skip-if =
+ win10_2004 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win10_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win11_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+[test_webauthn_sameoriginwithancestors.html]
+skip-if =
+ xorigin # this test has its own cross-origin setup
+ win10_2004 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win10_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+ win11_2009 # Bug 1718296 (Windows 10 1903+ has its own window and U2F that we cannot control with tests.)
+[test_webauthn_isplatformauthenticatoravailable.html]
+[test_webauthn_isexternalctap2securitykeysupported.html]
diff --git a/dom/webauthn/tests/pkijs/LICENSE b/dom/webauthn/tests/pkijs/LICENSE
new file mode 100644
index 0000000000..4f71696a7d
--- /dev/null
+++ b/dom/webauthn/tests/pkijs/LICENSE
@@ -0,0 +1,30 @@
+Copyright (c) 2014, GMO GlobalSign
+Copyright (c) 2015, Peculiar Ventures
+All rights reserved.
+
+Author 2014-2015, Yury Strozhevsky
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+ list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this
+ list of conditions and the following disclaimer in the documentation and/or
+ other materials provided with the distribution.
+
+* Neither the name of the copyright holder nor the names of its
+ contributors may be used to endorse or promote products derived from
+ this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/dom/webauthn/tests/pkijs/README b/dom/webauthn/tests/pkijs/README
new file mode 100644
index 0000000000..9213c9d438
--- /dev/null
+++ b/dom/webauthn/tests/pkijs/README
@@ -0,0 +1 @@
+PKIjs and ASN1js are from https://pkijs.org/ and https://asn1js.org/. \ No newline at end of file
diff --git a/dom/webauthn/tests/pkijs/asn1.js b/dom/webauthn/tests/pkijs/asn1.js
new file mode 100644
index 0000000000..ddee052407
--- /dev/null
+++ b/dom/webauthn/tests/pkijs/asn1.js
@@ -0,0 +1,5466 @@
+/*
+ * Copyright (c) 2014, GMO GlobalSign
+ * Copyright (c) 2015, Peculiar Ventures
+ * All rights reserved.
+ *
+ * Author 2014-2015, Yury Strozhevsky <www.strozhevsky.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ * may be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ */
+(
+function(in_window)
+{
+ //**************************************************************************************
+ // #region Declaration of global variables
+ //**************************************************************************************
+ // #region "org" namespace
+ if(typeof in_window.org === "undefined")
+ in_window.org = {};
+ else
+ {
+ if(typeof in_window.org !== "object")
+ throw new Error("Name org already exists and it's not an object");
+ }
+ // #endregion
+
+ // #region "org.pkijs" namespace
+ if(typeof in_window.org.pkijs === "undefined")
+ in_window.org.pkijs = {};
+ else
+ {
+ if(typeof in_window.org.pkijs !== "object")
+ throw new Error("Name org.pkijs already exists and it's not an object" + " but " + (typeof in_window.org.pkijs));
+ }
+ // #endregion
+
+ // #region "org.pkijs.asn1" namespace
+ if(typeof in_window.org.pkijs.asn1 === "undefined")
+ in_window.org.pkijs.asn1 = {};
+ else
+ {
+ if(typeof in_window.org.pkijs.asn1 !== "object")
+ throw new Error("Name org.pkijs.asn1 already exists and it's not an object" + " but " + (typeof in_window.org.pkijs.asn1));
+ }
+ // #endregion
+
+ // #region "local" namespace
+ var local = {};
+ // #endregion
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Aux-functions
+ //**************************************************************************************
+ function util_frombase(input_buffer, input_base)
+ {
+ /// <summary>Convert number from 2^base to 2^10</summary>
+ /// <param name="input_buffer" type="Uint8Array">Array of bytes representing the number to convert</param>
+ /// <param name="input_base" type="Number">The base of initial number</param>
+
+ var result = 0;
+
+ for(var i = (input_buffer.length - 1); i >= 0; i-- )
+ result += input_buffer[(input_buffer.length - 1) - i] * Math.pow(2, input_base * i);
+
+ return result;
+ }
+ //**************************************************************************************
+ function util_tobase(value, base, reserved)
+ {
+ /// <summary>Convert number from 2^10 to 2^base</summary>
+ /// <param name="value" type="Number">The number to convert</param>
+ /// <param name="base" type="Number">The base for 2^base</param>
+ /// <param name="reserved" type="Number">Pre-defined number of bytes in output array (-1 = limited by function itself)</param>
+
+ reserved = reserved || (-1);
+
+ var result = 0;
+ var biggest = Math.pow(2, base);
+
+ for(var i = 1; i < 8; i++)
+ {
+ if(value < biggest)
+ {
+ var ret_buf;
+
+ if( reserved < 0 )
+ {
+ ret_buf = new ArrayBuffer(i);
+ result = i;
+ }
+ else
+ {
+ if(reserved < i)
+ return (new ArrayBuffer(0));
+
+ ret_buf = new ArrayBuffer(reserved);
+
+ result = reserved;
+ }
+
+ var ret_view = new Uint8Array(ret_buf);
+
+ for(var j = ( i - 1 ); j >= 0; j-- )
+ {
+ var basis = Math.pow(2, j * base);
+
+ ret_view[ result - j - 1 ] = Math.floor( value / basis );
+ value -= ( ret_view[ result - j - 1 ] ) * basis;
+ }
+
+ return ret_buf;
+ }
+
+ biggest *= Math.pow(2, base);
+ }
+ }
+ //**************************************************************************************
+ function util_encode_tc(value)
+ {
+ /// <summary>Encode integer value to "two complement" format</summary>
+ /// <param name="value" type="Number">Value to encode</param>
+
+ var mod_value = (value < 0) ? (value * (-1)) : value;
+ var big_int = 128;
+
+ for(var i = 1; i < 8; i++)
+ {
+ if( mod_value <= big_int )
+ {
+ if( value < 0 )
+ {
+ var small_int = big_int - mod_value;
+
+ var ret_buf = util_tobase( small_int, 8, i );
+ var ret_view = new Uint8Array(ret_buf);
+
+ ret_view[ 0 ] |= 0x80;
+
+ return ret_buf;
+ }
+ else
+ {
+ var ret_buf = util_tobase( mod_value, 8, i );
+ var ret_view = new Uint8Array(ret_buf);
+
+ if( ret_view[ 0 ] & 0x80 )
+ {
+ var temp_buf = util_copybuf(ret_buf);
+ var temp_view = new Uint8Array(temp_buf);
+
+ ret_buf = new ArrayBuffer( ret_buf.byteLength + 1 );
+ ret_view = new Uint8Array(ret_buf);
+
+ for(var k = 0; k < temp_buf.byteLength; k++)
+ ret_view[k + 1] = temp_view[k];
+
+ ret_view[0] = 0x00;
+ }
+
+ return ret_buf;
+ }
+ }
+
+ big_int *= Math.pow(2, 8);
+ }
+
+ return (new ArrayBuffer(0));
+ }
+ //**************************************************************************************
+ function util_decode_tc()
+ {
+ /// <summary>Decoding of "two complement" values</summary>
+ /// <remarks>The function must be called in scope of instance of "hex_block" class ("value_hex" and "warnings" properties must be present)</remarks>
+
+ var buf = new Uint8Array(this.value_hex);
+
+ if(this.value_hex.byteLength >= 2)
+ {
+ var condition_1 = (buf[0] == 0xFF) && (buf[1] & 0x80);
+ var condition_2 = (buf[0] == 0x00) && ((buf[1] & 0x80) == 0x00);
+
+ if(condition_1 || condition_2)
+ this.warnings.push("Needlessly long format");
+ }
+
+ // #region Create big part of the integer
+ var big_int_buffer = new ArrayBuffer(this.value_hex.byteLength);
+ var big_int_view = new Uint8Array(big_int_buffer);
+ for(var i = 0; i < this.value_hex.byteLength; i++)
+ big_int_view[i] = 0;
+
+ big_int_view[0] = (buf[0] & 0x80); // mask only the biggest bit
+
+ var big_int = util_frombase(big_int_view, 8);
+ // #endregion
+
+ // #region Create small part of the integer
+ var small_int_buffer = new ArrayBuffer(this.value_hex.byteLength);
+ var small_int_view = new Uint8Array(small_int_buffer);
+ for(var j = 0; j < this.value_hex.byteLength; j++)
+ small_int_view[j] = buf[j];
+
+ small_int_view[0] &= 0x7F; // mask biggest bit
+
+ var small_int = util_frombase(small_int_view, 8);
+ // #endregion
+
+ return (small_int - big_int);
+ }
+ //**************************************************************************************
+ function util_copybuf(input_buffer)
+ {
+ /// <summary>Creating a copy of input ArrayBuffer</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ArrayBuffer for coping</param>
+
+ if(check_buffer_params(input_buffer, 0, input_buffer.byteLength) === false)
+ return (new ArrayBuffer(0));
+
+ var input_view = new Uint8Array(input_buffer);
+
+ var ret_buf = new ArrayBuffer(input_buffer.byteLength);
+ var ret_view = new Uint8Array(ret_buf);
+
+ for(var i = 0; i < input_buffer.byteLength; i++)
+ ret_view[i] = input_view[i];
+
+ return ret_buf;
+ }
+ //**************************************************************************************
+ function util_copybuf_offset(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Creating a copy of input ArrayBuffer</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ArrayBuffer for coping</param>
+
+ if(check_buffer_params(input_buffer, input_offset, input_length) === false)
+ return (new ArrayBuffer(0));
+
+ var input_view = new Uint8Array(input_buffer, input_offset, input_length);
+
+ var ret_buf = new ArrayBuffer(input_length);
+ var ret_view = new Uint8Array(ret_buf);
+
+ for(var i = 0; i < input_length; i++)
+ ret_view[i] = input_view[i];
+
+ return ret_buf;
+ }
+ //**************************************************************************************
+ function util_concatbuf(input_buf1, input_buf2)
+ {
+ /// <summary>Concatenate two ArrayBuffers</summary>
+ /// <param name="input_buf1" type="ArrayBuffer">First ArrayBuffer (first part of concatenated array)</param>
+ /// <param name="input_buf2" type="ArrayBuffer">Second ArrayBuffer (second part of concatenated array)</param>
+
+ var input_view1 = new Uint8Array(input_buf1);
+ var input_view2 = new Uint8Array(input_buf2);
+
+ var ret_buf = new ArrayBuffer(input_buf1.byteLength + input_buf2.byteLength);
+ var ret_view = new Uint8Array(ret_buf);
+
+ for(var i = 0; i < input_buf1.byteLength; i++)
+ ret_view[i] = input_view1[i];
+
+ for(var j = 0; j < input_buf2.byteLength; j++)
+ ret_view[input_buf1.byteLength + j] = input_view2[j];
+
+ return ret_buf;
+ }
+ //**************************************************************************************
+ function check_buffer_params(input_buffer, input_offset, input_length)
+ {
+ if((input_buffer instanceof ArrayBuffer) === false)
+ {
+ this.error = "Wrong parameter: input_buffer must be \"ArrayBuffer\"";
+ return false;
+ }
+
+ if(input_buffer.byteLength === 0)
+ {
+ this.error = "Wrong parameter: input_buffer has zero length";
+ return false;
+ }
+
+ if(input_offset < 0)
+ {
+ this.error = "Wrong parameter: input_offset less than zero";
+ return false;
+ }
+
+ if(input_length < 0)
+ {
+ this.error = "Wrong parameter: input_length less than zero";
+ return false;
+ }
+
+ if((input_buffer.byteLength - input_offset - input_length) < 0)
+ {
+ this.error = "End of input reached before message was fully decoded (inconsistent offset and length values)";
+ return false;
+ }
+
+ return true;
+ }
+ //**************************************************************************************
+ function to_hex_codes(input_buffer, input_offset, input_lenght)
+ {
+ if(check_buffer_params(input_buffer, input_offset, input_lenght) === false)
+ return "";
+
+ var result = "";
+
+ var int_buffer = new Uint8Array(input_buffer, input_offset, input_lenght);
+
+ for(var i = 0; i < int_buffer.length; i++)
+ {
+ var str = int_buffer[i].toString(16).toUpperCase();
+ result = result + ((str.length === 1) ? " 0" : " ") + str;
+ }
+
+ return result;
+ }
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of base block class
+ //**************************************************************************************
+ local.base_block =
+ function()
+ {
+ /// <summary>General class of all ASN.1 blocks</summary>
+
+ if(arguments[0] instanceof Object)
+ {
+ this.block_length = in_window.org.pkijs.getValue(arguments[0], "block_length", 0);
+ this.error = in_window.org.pkijs.getValue(arguments[0], "error", new String());
+ this.warnings = in_window.org.pkijs.getValue(arguments[0], "warnings", new Array());
+ if("value_before_decode" in arguments[0])
+ this.value_before_decode = util_copybuf(arguments[0].value_before_decode);
+ else
+ this.value_before_decode = new ArrayBuffer(0);
+ }
+ else
+ {
+ this.block_length = 0;
+ this.error = new String();
+ this.warnings = new Array();
+ /// <field>Copy of the value of incoming ArrayBuffer done before decoding</field>
+ this.value_before_decode = new ArrayBuffer(0);
+ }
+ };
+ //**************************************************************************************
+ local.base_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "base_block";
+ };
+ //**************************************************************************************
+ local.base_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ return {
+ block_name: local.base_block.prototype.block_name.call(this),
+ block_length: this.block_length,
+ error: this.error,
+ warnings: this.warnings,
+ value_before_decode: in_window.org.pkijs.bufferToHexCodes(this.value_before_decode, 0, this.value_before_decode.byteLength)
+ };
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of hex block class
+ //**************************************************************************************
+ local.hex_block =
+ function()
+ {
+ /// <summary>Descendant of "base_block" with internal ArrayBuffer. Need to have it in case it is not possible to store ASN.1 value in native formats</summary>
+
+ local.base_block.call(this, arguments[0]);
+
+ if(arguments[0] instanceof Object)
+ {
+ this.is_hex_only = in_window.org.pkijs.getValue(arguments[0], "is_hex_only", false);
+ if("value_hex" in arguments[0])
+ this.value_hex = util_copybuf(arguments[0].value_hex);
+ else
+ this.value_hex = new ArrayBuffer(0);
+ }
+ else
+ {
+ this.is_hex_only = false;
+ this.value_hex = new ArrayBuffer(0);
+ }
+ };
+ //**************************************************************************************
+ local.hex_block.prototype = new local.base_block();
+ local.hex_block.constructor = local.hex_block;
+ //**************************************************************************************
+ local.hex_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "hex_block";
+ };
+ //**************************************************************************************
+ local.hex_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ // #region Basic check for parameters
+ if(check_buffer_params.call(this, input_buffer, input_offset, input_length) === false)
+ return (-1);
+ // #endregion
+
+ // #region Getting Uint8Array from ArrayBuffer
+ var int_buffer = new Uint8Array(input_buffer, input_offset, input_length);
+ // #endregion
+
+ // #region Initial checks
+ if(int_buffer.length == 0)
+ {
+ this.warnings.push("Zero buffer length");
+ return input_offset;
+ }
+ // #endregion
+
+ // #region Copy input buffer to internal buffer
+ this.value_hex = new ArrayBuffer(input_length);
+ var view = new Uint8Array(this.value_hex);
+
+ for(var i = 0; i < int_buffer.length; i++)
+ view[i] = int_buffer[i];
+ // #endregion
+
+ this.block_length = input_length;
+
+ return (input_offset + input_length);
+ };
+ //**************************************************************************************
+ local.hex_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ if(typeof size_only === "undefined")
+ size_only = false;
+
+ if(this.is_hex_only !== true)
+ {
+ this.error = "Flag \"is_hex_only\" is not set, abort";
+ return (new ArrayBuffer(0));
+ }
+
+ var ret_buf = new ArrayBuffer(this.value_hex.byteLength);
+
+ if(size_only === true)
+ return ret_buf;
+
+ var ret_view = new Uint8Array(ret_buf);
+ var cur_view = new Uint8Array(this.value_hex);
+
+ for(var i = 0; i < cur_view.length; i++)
+ ret_view[i] = cur_view[i];
+
+ return ret_buf;
+ };
+ //**************************************************************************************
+ local.hex_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.base_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.hex_block.prototype.block_name.call(this);
+ _object.is_hex_only = this.is_hex_only;
+ _object.value_hex = in_window.org.pkijs.bufferToHexCodes(this.value_hex, 0, this.value_hex.byteLength);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of identification block class
+ //**************************************************************************************
+ local.identification_block =
+ function()
+ {
+ /// <summary>Base class of ASN.1 "identification block"</summary>
+
+ local.hex_block.call(this, arguments[0]);
+
+ this.tag_class = (-1);
+ this.tag_number = (-1);
+ this.is_constructed = false;
+
+ if(arguments[0] instanceof Object)
+ {
+ if("id_block" in arguments[0])
+ {
+ // #region Properties from hex_block class
+ this.is_hex_only = in_window.org.pkijs.getValue(arguments[0].id_block, "is_hex_only", false);
+ this.value_hex = in_window.org.pkijs.getValue(arguments[0].id_block, "value_hex", new ArrayBuffer(0));
+ // #endregion
+
+ this.tag_class = in_window.org.pkijs.getValue(arguments[0].id_block, "tag_class", (-1));
+ this.tag_number = in_window.org.pkijs.getValue(arguments[0].id_block, "tag_number", (-1));
+ this.is_constructed = in_window.org.pkijs.getValue(arguments[0].id_block, "is_constructed", false);
+ }
+ }
+ };
+ //**************************************************************************************
+ local.identification_block.prototype = new local.hex_block();
+ local.identification_block.constructor = local.identification_block;
+ //**************************************************************************************
+ local.identification_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "identification_block";
+ };
+ //**************************************************************************************
+ local.identification_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ if(typeof size_only === "undefined")
+ size_only = false;
+
+ var first_octet = 0;
+
+ switch(this.tag_class)
+ {
+ case 1:
+ first_octet |= 0x00; // UNIVERSAL
+ break;
+ case 2:
+ first_octet |= 0x40; // APPLICATION
+ break;
+ case 3:
+ first_octet |= 0x80; // CONTEXT-SPECIFIC
+ break;
+ case 4:
+ first_octet |= 0xC0; // PRIVATE
+ break;
+ default:
+ this.error = "Unknown tag class";
+ return (new ArrayBuffer(0));
+ }
+
+ if(this.is_constructed)
+ first_octet |= 0x20;
+
+ if((this.tag_number < 31) && (!this.is_hex_only))
+ {
+ var ret_buf = new ArrayBuffer(1);
+ var ret_view = new Uint8Array(ret_buf);
+
+ if(!size_only)
+ {
+ var number = this.tag_number;
+ number &= 0x1F;
+ first_octet |= number;
+
+ ret_view[0] = first_octet;
+ }
+
+ return ret_buf;
+ }
+ else
+ {
+ if(this.is_hex_only === false)
+ {
+ var encoded_buf = util_tobase(this.tag_number, 7);
+ var encoded_view = new Uint8Array(encoded_buf);
+ var size = encoded_buf.byteLength;
+
+ var ret_buf = new ArrayBuffer(size + 1);
+ var ret_view = new Uint8Array(ret_buf);
+
+ ret_view[0] = (first_octet | 0x1F);
+
+ if(!size_only)
+ {
+ for(var i = 0; i < (size - 1) ; i++)
+ ret_view[i + 1] = encoded_view[i] | 0x80;
+
+ ret_view[size] = encoded_view[size - 1];
+ }
+
+ return ret_buf;
+ }
+ else
+ {
+ var ret_buf = new ArrayBuffer(this.value_hex.byteLength + 1);
+ var ret_view = new Uint8Array(ret_buf);
+
+ ret_view[0] = (first_octet | 0x1F);
+
+ if(size_only === false)
+ {
+ var cur_view = new Uint8Array(this.value_hex);
+
+ for(var i = 0; i < (cur_view.length - 1); i++)
+ ret_view[i + 1] = cur_view[i] | 0x80;
+
+ ret_view[this.value_hex.byteLength] = cur_view[cur_view.length - 1];
+ }
+
+ return ret_buf;
+ }
+ }
+ };
+ //**************************************************************************************
+ local.identification_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ // #region Basic check for parameters
+ if(check_buffer_params.call(this, input_buffer, input_offset, input_length) === false)
+ return (-1);
+ // #endregion
+
+ // #region Getting Uint8Array from ArrayBuffer
+ var int_buffer = new Uint8Array(input_buffer, input_offset, input_length);
+ // #endregion
+
+ // #region Initial checks
+ if(int_buffer.length == 0)
+ {
+ this.error = "Zero buffer length";
+ return (-1);
+ }
+ // #endregion
+
+ // #region Find tag class
+ var tag_class_mask = int_buffer[0] & 0xC0;
+
+ switch(tag_class_mask)
+ {
+ case 0x00:
+ this.tag_class = (1); // UNIVERSAL
+ break;
+ case 0x40:
+ this.tag_class = (2); // APPLICATION
+ break;
+ case 0x80:
+ this.tag_class = (3); // CONTEXT-SPECIFIC
+ break;
+ case 0xC0:
+ this.tag_class = (4); // PRIVATE
+ break;
+ default:
+ this.error = "Unknown tag class";
+ return ( -1 );
+ }
+ // #endregion
+
+ // #region Find it's constructed or not
+ this.is_constructed = (int_buffer[0] & 0x20) == 0x20;
+ // #endregion
+
+ // #region Find tag number
+ this.is_hex_only = false;
+
+ var tag_number_mask = int_buffer[0] & 0x1F;
+
+ // #region Simple case (tag number < 31)
+ if(tag_number_mask != 0x1F)
+ {
+ this.tag_number = (tag_number_mask);
+ this.block_length = 1;
+ }
+ // #endregion
+ // #region Tag number bigger or equal to 31
+ else
+ {
+ var count = 1;
+
+ this.value_hex = new ArrayBuffer(255);
+ var tag_number_buffer_max_length = 255;
+ var int_tag_number_buffer = new Uint8Array(this.value_hex);
+
+ while(int_buffer[count] & 0x80)
+ {
+ int_tag_number_buffer[count - 1] = int_buffer[count] & 0x7F;
+ count++;
+
+ if(count >= int_buffer.length)
+ {
+ this.error = "End of input reached before message was fully decoded";
+ return (-1);
+ }
+
+ // #region In case if tag number length is greater than 255 bytes (rare but possible case)
+ if(count == tag_number_buffer_max_length)
+ {
+ tag_number_buffer_max_length += 255;
+
+ var temp_buffer = new ArrayBuffer(tag_number_buffer_max_length);
+ var temp_buffer_view = new Uint8Array(temp_buffer);
+
+ for(var i = 0; i < int_tag_number_buffer.length; i++)
+ temp_buffer_view[i] = int_tag_number_buffer[i];
+
+ this.value_hex = new ArrayBuffer(tag_number_buffer_max_length);
+ int_tag_number_buffer = new Uint8Array(this.value_hex);
+ }
+ // #endregion
+ }
+
+ this.block_length = (count + 1);
+ int_tag_number_buffer[count - 1] = int_buffer[count] & 0x7F; // Write last byte to buffer
+
+ // #region Cut buffer
+ var temp_buffer = new ArrayBuffer(count);
+ var temp_buffer_view = new Uint8Array(temp_buffer);
+ for(var i = 0; i < count; i++)
+ temp_buffer_view[i] = int_tag_number_buffer[i];
+
+ this.value_hex = new ArrayBuffer(count);
+ int_tag_number_buffer = new Uint8Array(this.value_hex);
+ int_tag_number_buffer.set(temp_buffer_view);
+ // #endregion
+
+ // #region Try to convert long tag number to short form
+ if(this.block_length <= 9)
+ this.tag_number = util_frombase(int_tag_number_buffer, 7);
+ else
+ {
+ this.is_hex_only = true;
+ this.warnings.push("Tag too long, represented as hex-coded");
+ }
+ // #endregion
+ }
+ // #endregion
+ // #endregion
+
+ // #region Check if constructed encoding was using for primitive type
+ if(((this.tag_class == 1)) &&
+ (this.is_constructed))
+ {
+ switch(this.tag_number)
+ {
+ case 1: // BOOLEAN
+ case 2: // REAL
+ case 5: // NULL
+ case 6: // OBJECT IDENTIFIER
+ case 9: // REAL
+ case 14: // TIME
+ case 23:
+ case 24:
+ case 31:
+ case 32:
+ case 33:
+ case 34:
+ this.error = "Constructed encoding used for primitive type";
+ return (-1);
+ default:
+ ;
+ }
+ }
+ // #endregion
+
+ return ( input_offset + this.block_length ); // Return current offset in input buffer
+ };
+ //**************************************************************************************
+ local.identification_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.hex_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.identification_block.prototype.block_name.call(this);
+ _object.tag_class = this.tag_class;
+ _object.tag_number = this.tag_number;
+ _object.is_constructed = this.is_constructed;
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of length block class
+ //**************************************************************************************
+ local.length_block =
+ function()
+ {
+ /// <summary>Base class of ASN.1 "length block"</summary>
+
+ local.base_block.call(this, arguments[0]);
+
+ this.is_indefinite_form = false;
+ this.long_form_used = false;
+ this.length = (0);
+
+ if(arguments[0] instanceof Object)
+ {
+ if("len_block" in arguments[0])
+ {
+ this.is_indefinite_form = in_window.org.pkijs.getValue(arguments[0].len_block, "is_indefinite_form", false);
+ this.long_form_used = in_window.org.pkijs.getValue(arguments[0].len_block, "long_form_used", false);
+ this.length = in_window.org.pkijs.getValue(arguments[0].len_block, "length", 0);
+ }
+ }
+ };
+ //**************************************************************************************
+ local.length_block.prototype = new local.base_block();
+ local.length_block.constructor = local.length_block;
+ //**************************************************************************************
+ local.length_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "length_block";
+ };
+ //**************************************************************************************
+ local.length_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ // #region Basic check for parameters
+ if(check_buffer_params.call(this, input_buffer, input_offset, input_length) === false)
+ return (-1);
+ // #endregion
+
+ // #region Getting Uint8Array from ArrayBuffer
+ var int_buffer = new Uint8Array(input_buffer, input_offset, input_length);
+ // #endregion
+
+ // #region Initial checks
+ if(int_buffer.length == 0)
+ {
+ this.error = "Zero buffer length";
+ return (-1);
+ }
+
+ if(int_buffer[0] == 0xFF)
+ {
+ this.error = "Length block 0xFF is reserved by standard";
+ return (-1);
+ }
+ // #endregion
+
+ // #region Check for length form type
+ this.is_indefinite_form = int_buffer[0] == 0x80;
+ // #endregion
+
+ // #region Stop working in case of indefinite length form
+ if(this.is_indefinite_form == true)
+ {
+ this.block_length = 1;
+ return (input_offset + this.block_length);
+ }
+ // #endregion
+
+ // #region Check is long form of length encoding using
+ this.long_form_used = !!(int_buffer[0] & 0x80);
+ // #endregion
+
+ // #region Stop working in case of short form of length value
+ if(this.long_form_used == false)
+ {
+ this.length = (int_buffer[0]);
+ this.block_length = 1;
+ return (input_offset + this.block_length);
+ }
+ // #endregion
+
+ // #region Calculate length value in case of long form
+ var count = int_buffer[0] & 0x7F;
+
+ if(count > 8) // Too big length value
+ {
+ this.error = "Too big integer";
+ return (-1);
+ }
+
+ if((count + 1) > int_buffer.length)
+ {
+ this.error = "End of input reached before message was fully decoded";
+ return (-1);
+ }
+
+ var length_buffer_view = new Uint8Array(count);
+
+ for(var i = 0; i < count; i++)
+ length_buffer_view[i] = int_buffer[i + 1];
+
+ if(length_buffer_view[count - 1] == 0x00)
+ this.warnings.push("Needlessly long encoded length");
+
+ this.length = util_frombase(length_buffer_view, 8);
+
+ if(this.long_form_used && (this.length <= 127))
+ this.warnings.push("Unneccesary usage of long length form");
+
+ this.block_length = count + 1;
+ // #endregion
+
+ return (input_offset + this.block_length); // Return current offset in input buffer
+ };
+ //**************************************************************************************
+ local.length_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ if(typeof size_only === "undefined")
+ size_only = false;
+
+ if(this.length > 127)
+ this.long_form_used = true;
+
+ if(this.is_indefinite_form)
+ {
+ var ret_buf = new ArrayBuffer(1);
+
+ if(size_only === false)
+ {
+ var ret_view = new Uint8Array(ret_buf);
+ ret_view[0] = 0x80;
+ }
+
+ return ret_buf;
+ }
+
+ if(this.long_form_used === true)
+ {
+ var encoded_buf = util_tobase(this.length, 8);
+
+ if(encoded_buf.byteLength > 127)
+ {
+ this.error = "Too big length";
+ return (new ArrayBuffer(0));
+ }
+
+ var ret_buf = new ArrayBuffer(encoded_buf.byteLength + 1);
+
+ if(size_only === true)
+ return ret_buf;
+
+ var encoded_view = new Uint8Array(encoded_buf);
+ var ret_view = new Uint8Array(ret_buf);
+
+ ret_view[0] = encoded_buf.byteLength | 0x80;
+
+ for(var i = 0; i < encoded_buf.byteLength; i++)
+ ret_view[i + 1] = encoded_view[i];
+
+ return ret_buf;
+ }
+ else
+ {
+ var ret_buf = new ArrayBuffer(1);
+
+ if(size_only === false)
+ {
+ var ret_view = new Uint8Array(ret_buf);
+
+ ret_view[0] = this.length;
+ }
+
+ return ret_buf;
+ }
+
+ return (new ArrayBuffer(0));
+ };
+ //**************************************************************************************
+ local.length_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.base_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.length_block.prototype.block_name.call(this);
+ _object.is_indefinite_form = this.is_indefinite_form;
+ _object.long_form_used = this.long_form_used;
+ _object.length = this.length;
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of value block class
+ //**************************************************************************************
+ local.value_block =
+ function()
+ {
+ /// <summary>Generic class of ASN.1 "value block"</summary>
+ local.base_block.call(this, arguments[0]);
+ };
+ //**************************************************************************************
+ local.value_block.prototype = new local.base_block();
+ local.value_block.constructor = local.value_block;
+ //**************************************************************************************
+ local.value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "value_block";
+ };
+ //**************************************************************************************
+ local.value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.base_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.value_block.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of basic ASN.1 block class
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_block =
+ function()
+ {
+ /// <summary>Base class of ASN.1 block (identification block + length block + value block)</summary>
+
+ local.base_block.call(this, arguments[0]);
+
+ if(arguments[0] instanceof Object)
+ {
+ this.name = in_window.org.pkijs.getValue(arguments[0], "name", "");
+ this.optional = in_window.org.pkijs.getValue(arguments[0], "optional", false);
+
+ if("primitive_schema" in arguments[0])
+ this.primitive_schema = arguments[0].primitive_schema;
+ }
+
+ this.id_block = new local.identification_block(arguments[0]);
+ this.len_block = new local.length_block(arguments[0]);
+ this.value_block = new local.value_block(arguments[0]);
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_block.prototype = new local.base_block();
+ in_window.org.pkijs.asn1.ASN1_block.constructor = in_window.org.pkijs.asn1.ASN1_block;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "ASN1_block";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ var result_offset = this.value_block.fromBER(input_buffer, input_offset, (this.len_block.is_indefinite_form == true) ? input_length : this.len_block.length);
+ if(result_offset == (-1))
+ {
+ this.error = this.value_block.error;
+ return result_offset;
+ }
+
+ if(this.id_block.error.length == 0)
+ this.block_length += this.id_block.block_length;
+
+ if(this.len_block.error.length == 0)
+ this.block_length += this.len_block.block_length;
+
+ if(this.value_block.error.length == 0)
+ this.block_length += this.value_block.block_length;
+
+ return result_offset;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ if(typeof size_only === "undefined")
+ size_only = false;
+
+ var ret_buf;
+
+ var id_block_buf = this.id_block.toBER(size_only);
+ var value_block_size_buf = this.value_block.toBER(true);
+
+ this.len_block.length = value_block_size_buf.byteLength;
+ var len_block_buf = this.len_block.toBER(size_only);
+
+ ret_buf = util_concatbuf(id_block_buf, len_block_buf);
+
+ var value_block_buf;
+
+ if(size_only === false)
+ value_block_buf = this.value_block.toBER(size_only);
+ else
+ value_block_buf = new ArrayBuffer(this.len_block.length);
+
+ ret_buf = util_concatbuf(ret_buf, value_block_buf);
+
+ if(this.len_block.is_indefinite_form === true)
+ {
+ var indef_buf = new ArrayBuffer(2);
+
+ if(size_only === false)
+ {
+ var indef_view = new Uint8Array(indef_buf);
+
+ indef_view[0] = 0x00;
+ indef_view[1] = 0x00;
+ }
+
+ ret_buf = util_concatbuf(ret_buf, indef_buf);
+ }
+
+ return ret_buf;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.base_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.ASN1_block.prototype.block_name.call(this);
+ _object.id_block = this.id_block.toJSON();
+ _object.len_block = this.len_block.toJSON();
+ _object.value_block = this.value_block.toJSON();
+
+ if("name" in this)
+ _object.name = this.name;
+ if("optional" in this)
+ _object.optional = this.optional;
+ if("primitive_schema" in this)
+ _object.primitive_schema = this.primitive_schema.toJSON();
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of basic block for all PRIMITIVE types
+ //**************************************************************************************
+ local.ASN1_PRIMITIVE_value_block =
+ function()
+ {
+ /// <summary>Base class of ASN.1 value block for primitive values (non-constructive encoding)</summary>
+
+ local.value_block.call(this, arguments[0]);
+
+ if(arguments[0] instanceof Object)
+ {
+ // #region Variables from "hex_block" class
+ if("value_hex" in arguments[0])
+ this.value_hex = util_copybuf(arguments[0].value_hex);
+ else
+ this.value_hex = new ArrayBuffer(0);
+
+ this.is_hex_only = in_window.org.pkijs.getValue(arguments[0], "is_hex_only", true);
+ // #endregion
+ }
+ else
+ {
+ // #region Variables from "hex_block" class
+ this.value_hex = new ArrayBuffer(0);
+ this.is_hex_only = true;
+ // #endregion
+ }
+ };
+ //**************************************************************************************
+ local.ASN1_PRIMITIVE_value_block.prototype = new local.value_block();
+ local.ASN1_PRIMITIVE_value_block.constructor = local.ASN1_PRIMITIVE_value_block;
+ //**************************************************************************************
+ local.ASN1_PRIMITIVE_value_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ // #region Basic check for parameters
+ if(check_buffer_params.call(this, input_buffer, input_offset, input_length) === false)
+ return (-1);
+ // #endregion
+
+ // #region Getting Uint8Array from ArrayBuffer
+ var int_buffer = new Uint8Array(input_buffer, input_offset, input_length);
+ // #endregion
+
+ // #region Initial checks
+ if(int_buffer.length == 0)
+ {
+ this.warnings.push("Zero buffer length");
+ return input_offset;
+ }
+ // #endregion
+
+ // #region Copy input buffer into internal buffer
+ this.value_hex = new ArrayBuffer(int_buffer.length);
+ var value_hex_view = new Uint8Array(this.value_hex);
+
+ for(var i = 0; i < int_buffer.length; i++)
+ value_hex_view[i] = int_buffer[i];
+ // #endregion
+
+ this.block_length = input_length;
+
+ return (input_offset + input_length);
+ };
+ //**************************************************************************************
+ local.ASN1_PRIMITIVE_value_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ return util_copybuf(this.value_hex);
+ };
+ //**************************************************************************************
+ local.ASN1_PRIMITIVE_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "ASN1_PRIMITIVE_value_block";
+ };
+ //**************************************************************************************
+ local.ASN1_PRIMITIVE_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.value_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.ASN1_PRIMITIVE_value_block.prototype.block_name.call(this);
+ _object.value_hex = in_window.org.pkijs.bufferToHexCodes(this.value_hex, 0, this.value_hex.byteLength);
+ _object.is_hex_only = this.is_hex_only;
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_PRIMITIVE =
+ function()
+ {
+ /// <summary>Base class of ASN.1 block for primitive values (non-constructive encoding)</summary>
+
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.id_block.is_constructed = false;
+ this.value_block = new local.ASN1_PRIMITIVE_value_block(arguments[0]);
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_PRIMITIVE.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ in_window.org.pkijs.asn1.ASN1_PRIMITIVE.constructor = in_window.org.pkijs.asn1.ASN1_PRIMITIVE;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_PRIMITIVE.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "PRIMITIVE";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_PRIMITIVE.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.ASN1_PRIMITIVE.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of basic block for all CONSTRUCTED types
+ //**************************************************************************************
+ local.ASN1_CONSTRUCTED_value_block =
+ function()
+ {
+ /// <summary>Base class of ASN.1 value block for constructive values (constructive encoding)</summary>
+
+ local.value_block.call(this, arguments[0]);
+
+ if(arguments[0] instanceof Object)
+ {
+ this.value = in_window.org.pkijs.getValue(arguments[0], "value", new Array());
+ this.is_indefinite_form = in_window.org.pkijs.getValue(arguments[0], "is_indefinite_form", false);
+ }
+ else
+ {
+ this.value = new Array();
+ this.is_indefinite_form = false;
+ }
+ };
+ //**************************************************************************************
+ local.ASN1_CONSTRUCTED_value_block.prototype = new local.value_block();
+ local.ASN1_CONSTRUCTED_value_block.constructor = local.ASN1_CONSTRUCTED_value_block;
+ //**************************************************************************************
+ local.ASN1_CONSTRUCTED_value_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ // #region Store initial offset and length
+ var initial_offset = input_offset;
+ var initial_length = input_length;
+ // #endregion
+
+ // #region Basic check for parameters
+ if(check_buffer_params.call(this, input_buffer, input_offset, input_length) === false)
+ return (-1);
+ // #endregion
+
+ // #region Getting Uint8Array from ArrayBuffer
+ var int_buffer = new Uint8Array(input_buffer, input_offset, input_length);
+ // #endregion
+
+ // #region Initial checks
+ if(int_buffer.length == 0)
+ {
+ this.warnings.push("Zero buffer length");
+ return input_offset;
+ }
+ // #endregion
+
+ // #region Aux function
+ function check_len(_indefinite_length, _length)
+ {
+ if(_indefinite_length == true)
+ return 1;
+
+ return _length;
+ }
+ // #endregion
+
+ var current_offset = input_offset;
+
+ while(check_len(this.is_indefinite_form, input_length) > 0)
+ {
+ var return_object = fromBER_raw(input_buffer, current_offset, input_length);
+ if(return_object.offset == (-1))
+ {
+ this.error = return_object.result.error;
+ this.warnings.concat(return_object.result.warnings);
+ return (-1);
+ }
+
+ current_offset = return_object.offset;
+
+ this.block_length += return_object.result.block_length;
+ input_length -= return_object.result.block_length;
+
+ this.value.push(return_object.result);
+
+ if((this.is_indefinite_form == true) && (return_object.result.block_name() == in_window.org.pkijs.asn1.EOC.prototype.block_name()))
+ break;
+ }
+
+ if(this.is_indefinite_form == true)
+ {
+ if(this.value[this.value.length - 1].block_name() == in_window.org.pkijs.asn1.EOC.prototype.block_name())
+ this.value.pop();
+ else
+ this.warnings.push("No EOC block encoded");
+ }
+
+ // #region Copy "input_buffer" to "value_before_decode"
+ this.value_before_decode = util_copybuf_offset(input_buffer, initial_offset, initial_length);
+ // #endregion
+
+ return current_offset;
+ };
+ //**************************************************************************************
+ local.ASN1_CONSTRUCTED_value_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ if(typeof size_only === "undefined")
+ size_only = false;
+
+ var ret_buf = new ArrayBuffer(0);
+
+ for(var i = 0; i < this.value.length; i++)
+ {
+ var value_buf = this.value[i].toBER(size_only);
+ ret_buf = util_concatbuf(ret_buf, value_buf);
+ }
+
+ return ret_buf;
+ };
+ //**************************************************************************************
+ local.ASN1_CONSTRUCTED_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "ASN1_CONSTRUCTED_value_block";
+ };
+ //**************************************************************************************
+ local.ASN1_CONSTRUCTED_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.value_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.ASN1_CONSTRUCTED_value_block.prototype.block_name.call(this);
+ _object.is_indefinite_form = this.is_indefinite_form;
+ _object.value = new Array();
+ for(var i = 0; i < this.value.length; i++)
+ _object.value.push(this.value[i].toJSON());
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_CONSTRUCTED =
+ function()
+ {
+ /// <summary>Base class of ASN.1 block for constructive values (constructive encoding)</summary>
+
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.id_block.is_constructed = true;
+ this.value_block = new local.ASN1_CONSTRUCTED_value_block(arguments[0]);
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_CONSTRUCTED.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ in_window.org.pkijs.asn1.ASN1_CONSTRUCTED.constructor = in_window.org.pkijs.asn1.ASN1_CONSTRUCTED;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_CONSTRUCTED.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "CONSTRUCTED";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_CONSTRUCTED.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ this.value_block.is_indefinite_form = this.len_block.is_indefinite_form;
+
+ var result_offset = this.value_block.fromBER(input_buffer, input_offset, (this.len_block.is_indefinite_form == true) ? input_length : this.len_block.length);
+ if(result_offset == (-1))
+ {
+ this.error = this.value_block.error;
+ return result_offset;
+ }
+
+ if(this.id_block.error.length == 0)
+ this.block_length += this.id_block.block_length;
+
+ if(this.len_block.error.length == 0)
+ this.block_length += this.len_block.block_length;
+
+ if(this.value_block.error.length == 0)
+ this.block_length += this.value_block.block_length;
+
+ return result_offset;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ASN1_CONSTRUCTED.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.ASN1_CONSTRUCTED.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of ASN.1 EOC type class
+ //**************************************************************************************
+ local.EOC_value_block =
+ function()
+ {
+ local.value_block.call(this, arguments[0]);
+ };
+ //**************************************************************************************
+ local.EOC_value_block.prototype = new local.value_block();
+ local.EOC_value_block.constructor = local.EOC_value_block;
+ //**************************************************************************************
+ local.EOC_value_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ // #region There is no "value block" for EOC type and we need to return the same offset
+ return input_offset;
+ // #endregion
+ };
+ //**************************************************************************************
+ local.EOC_value_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ return (new ArrayBuffer(0));
+ };
+ //**************************************************************************************
+ local.EOC_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "EOC_value_block";
+ };
+ //**************************************************************************************
+ local.EOC_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.value_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.EOC_value_block.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.EOC =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.value_block = new local.EOC_value_block();
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 0; // EOC
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.EOC.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ in_window.org.pkijs.asn1.EOC.constructor = local.EOC_value_block;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.EOC.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "END_OF_CONTENT";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.EOC.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.EOC.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of ASN.1 BOOLEAN type class
+ //**************************************************************************************
+ local.BOOLEAN_value_block =
+ function()
+ {
+ local.value_block.call(this, arguments[0]);
+
+ if(arguments[0] instanceof Object)
+ {
+ this.value = in_window.org.pkijs.getValue(arguments[0], "value", false);
+
+ // #region Variables from hex_block class
+ this.is_hex_only = in_window.org.pkijs.getValue(arguments[0], "is_hex_only", false);
+ if("value_hex" in arguments[0])
+ this.value_hex = util_copybuf(arguments[0].value_hex);
+ else
+ {
+ this.value_hex = new ArrayBuffer(1);
+ if(this.value === true)
+ {
+ var view = new Uint8Array(this.value_hex);
+ view[0] = 0xFF;
+ }
+ }
+ // #endregion
+ }
+ else
+ {
+ this.value = false;
+
+ // #region Variables from hex_block class
+ this.is_hex_only = false;
+ this.value_hex = new ArrayBuffer(1);
+ // #endregion
+ }
+ };
+ //**************************************************************************************
+ local.BOOLEAN_value_block.prototype = new local.value_block();
+ local.BOOLEAN_value_block.constructor = local.BOOLEAN_value_block;
+ //**************************************************************************************
+ local.BOOLEAN_value_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ // #region Basic check for parameters
+ if(check_buffer_params.call(this, input_buffer, input_offset, input_length) === false)
+ return (-1);
+ // #endregion
+
+ // #region Getting Uint8Array from ArrayBuffer
+ var int_buffer = new Uint8Array(input_buffer, input_offset, input_length);
+ // #endregion
+
+ if(input_length > 1)
+ this.warnings.push("BOOLEAN value encoded in more then 1 octet");
+
+ this.value = int_buffer[0] != 0x00;
+
+ this.is_hex_only = true;
+
+ // #region Copy input buffer to internal array
+ this.value_hex = new ArrayBuffer(int_buffer.length);
+ var view = new Uint8Array(this.value_hex);
+
+ for(var i = 0; i < int_buffer.length; i++)
+ view[i] = int_buffer[i];
+ // #endregion
+
+ this.block_length = input_length;
+
+ return (input_offset + input_length);
+ };
+ //**************************************************************************************
+ local.BOOLEAN_value_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ if(typeof size_only === "undefined")
+ size_only = false;
+
+ return this.value_hex;
+ };
+ //**************************************************************************************
+ local.BOOLEAN_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "BOOLEAN_value_block";
+ };
+ //**************************************************************************************
+ local.BOOLEAN_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.value_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.BOOLEAN_value_block.prototype.block_name.call(this);
+ _object.value = this.value;
+ _object.is_hex_only = this.is_hex_only;
+ _object.value_hex = in_window.org.pkijs.bufferToHexCodes(this.value_hex, 0, this.value_hex.byteLength);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BOOLEAN =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.value_block = new local.BOOLEAN_value_block(arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 1; // BOOLEAN
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BOOLEAN.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ in_window.org.pkijs.asn1.BOOLEAN.constructor = local.BOOLEAN_value_block;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BOOLEAN.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "BOOLEAN";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BOOLEAN.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.BOOLEAN.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of ASN.1 SEQUENCE and SET type classes
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.SEQUENCE =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_CONSTRUCTED.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 16; // SEQUENCE
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.SEQUENCE.prototype = new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED();
+ in_window.org.pkijs.asn1.SEQUENCE.constructor = in_window.org.pkijs.asn1.SEQUENCE;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.SEQUENCE.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "SEQUENCE";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.SEQUENCE.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_CONSTRUCTED.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.SEQUENCE.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.SET =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_CONSTRUCTED.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 17; // SET
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.SET.prototype = new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED();
+ in_window.org.pkijs.asn1.SET.constructor = in_window.org.pkijs.asn1.SET;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.SET.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "SET";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.SET.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_CONSTRUCTED.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.SET.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of ASN.1 NULL type class
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.NULL =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 5; // NULL
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.NULL.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ in_window.org.pkijs.asn1.NULL.constructor = in_window.org.pkijs.asn1.NULL;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.NULL.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "NULL";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.NULL.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ if(this.len_block.length > 0)
+ this.warnings.push("Non-zero length of value block for NULL type");
+
+ if(this.id_block.error.length === 0)
+ this.block_length += this.id_block.block_length;
+
+ if(this.len_block.error.length === 0)
+ this.block_length += this.len_block.block_length;
+
+ this.block_length += input_length;
+
+ return (input_offset + input_length);
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.NULL.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ if(typeof size_only === "undefined")
+ size_only = false;
+
+ var ret_buf = new ArrayBuffer(2);
+
+ if(size_only === true)
+ return ret_buf;
+
+ var ret_view = new Uint8Array(ret_buf);
+ ret_view[0] = 0x05;
+ ret_view[1] = 0x00;
+
+ return ret_buf;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.NULL.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.NULL.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of ASN.1 OCTETSTRING type class
+ //**************************************************************************************
+ local.OCTETSTRING_value_block =
+ function()
+ {
+ /// <param name="input_value_hex" type="ArrayBuffer"></param>
+ /// <param name="input_value" type="Array"></param>
+ /// <param name="input_constructed" type="Boolean"></param>
+ /// <remarks>Value for the OCTETSTRING may be as hex, as well as a constructed value.</remarks>
+ /// <remarks>Constructed values consists of other OCTETSTRINGs</remarks>
+
+ local.ASN1_CONSTRUCTED_value_block.call(this, arguments[0]);
+
+ if(arguments[0] instanceof Object)
+ {
+ this.is_constructed = in_window.org.pkijs.getValue(arguments[0], "is_constructed", false);
+
+ // #region Variables from hex_block type
+ this.is_hex_only = in_window.org.pkijs.getValue(arguments[0], "is_hex_only", false);
+ if("value_hex" in arguments[0])
+ this.value_hex = util_copybuf(arguments[0].value_hex);
+ else
+ this.value_hex = new ArrayBuffer(0);
+ // #endregion
+ }
+ else
+ {
+ this.is_constructed = false;
+
+ // #region Variables from hex_block type
+ this.is_hex_only = false;
+ this.value_hex = new ArrayBuffer(0);
+ // #endregion
+ }
+ };
+ //**************************************************************************************
+ local.OCTETSTRING_value_block.prototype = new local.ASN1_CONSTRUCTED_value_block();
+ local.OCTETSTRING_value_block.constructor = local.OCTETSTRING_value_block;
+ //**************************************************************************************
+ local.OCTETSTRING_value_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ var result_offset = 0;
+
+ if(this.is_constructed == true)
+ {
+ this.is_hex_only = false;
+
+ result_offset = local.ASN1_CONSTRUCTED_value_block.prototype.fromBER.call(this, input_buffer, input_offset, input_length);
+ if(result_offset == (-1))
+ return result_offset;
+
+ for(var i = 0; i < this.value.length; i++)
+ {
+ var current_block_name = this.value[i].block_name();
+
+ if(current_block_name == in_window.org.pkijs.asn1.EOC.prototype.block_name())
+ {
+ if(this.is_indefinite_form == true)
+ break;
+ else
+ {
+ this.error = "EOC is unexpected, OCTET STRING may consists of OCTET STRINGs only";
+ return (-1);
+ }
+ }
+
+ if(current_block_name != in_window.org.pkijs.asn1.OCTETSTRING.prototype.block_name())
+ {
+ this.error = "OCTET STRING may consists of OCTET STRINGs only";
+ return (-1);
+ }
+ }
+ }
+ else
+ {
+ this.is_hex_only = true;
+
+ result_offset = local.hex_block.prototype.fromBER.call(this, input_buffer, input_offset, input_length);
+ this.block_length = input_length;
+ }
+
+ return result_offset;
+ };
+ //**************************************************************************************
+ local.OCTETSTRING_value_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ if(typeof size_only === "undefined")
+ size_only = false;
+
+ if(this.is_constructed === true)
+ return local.ASN1_CONSTRUCTED_value_block.prototype.toBER.call(this, size_only);
+ else
+ {
+ var ret_buf = new ArrayBuffer(this.value_hex.byteLength);
+
+ if(size_only === true)
+ return ret_buf;
+
+ if(this.value_hex.byteLength == 0)
+ return ret_buf;
+
+ ret_buf = util_copybuf(this.value_hex);
+
+ return ret_buf;
+ }
+
+ return (new ArrayBuffer(0));
+ };
+ //**************************************************************************************
+ local.OCTETSTRING_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "OCTETSTRING_value_block";
+ };
+ //**************************************************************************************
+ local.OCTETSTRING_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.ASN1_CONSTRUCTED_value_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.OCTETSTRING_value_block.prototype.block_name.call(this);
+ _object.is_constructed = this.is_constructed;
+ _object.is_hex_only = this.is_hex_only;
+ _object.value_hex = in_window.org.pkijs.bufferToHexCodes(this.value_hex, 0, this.value_hex.byteLength);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.OCTETSTRING =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.value_block = new local.OCTETSTRING_value_block(arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 4; // OCTETSTRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.OCTETSTRING.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ in_window.org.pkijs.asn1.OCTETSTRING.constructor = in_window.org.pkijs.asn1.OCTETSTRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.OCTETSTRING.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ this.value_block.is_constructed = this.id_block.is_constructed;
+ this.value_block.is_indefinite_form = this.len_block.is_indefinite_form;
+
+ // #region Ability to encode empty OCTET STRING
+ if(input_length == 0)
+ {
+ if(this.id_block.error.length == 0)
+ this.block_length += this.id_block.block_length;
+
+ if(this.len_block.error.length == 0)
+ this.block_length += this.len_block.block_length;
+
+ return input_offset;
+ }
+ // #endregion
+
+ return in_window.org.pkijs.asn1.ASN1_block.prototype.fromBER.call(this, input_buffer, input_offset, input_length);
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.OCTETSTRING.prototype.block_name =
+ function()
+ {
+ return "OCTETSTRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.OCTETSTRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.OCTETSTRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.OCTETSTRING.prototype.isEqual =
+ function(octetString)
+ {
+ /// <summaryChecking that two OCTETSTRINGs are equal></summary>
+ /// <param name="octetString" type="in_window.org.pkijs.asn1.OCTETSTRING">The OCTETSTRING to compare with</param>
+
+ // #region Check input type
+ if((octetString instanceof in_window.org.pkijs.asn1.OCTETSTRING) == false)
+ return false;
+ // #endregion
+
+ // #region Compare two JSON strings
+ if(JSON.stringify(this) != JSON.stringify(octetString))
+ return false;
+ // #endregion
+
+ return true;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of ASN.1 BITSTRING type class
+ //**************************************************************************************
+ local.BITSTRING_value_block =
+ function()
+ {
+ local.ASN1_CONSTRUCTED_value_block.call(this, arguments[0]);
+
+ if(arguments[0] instanceof Object)
+ {
+ this.unused_bits = in_window.org.pkijs.getValue(arguments[0], "unused_bits", 0);
+ this.is_constructed = in_window.org.pkijs.getValue(arguments[0], "is_constructed", false);
+
+ // #region Variables from hex_block type
+ this.is_hex_only = in_window.org.pkijs.getValue(arguments[0], "is_hex_only", false);
+
+ if("value_hex" in arguments[0])
+ this.value_hex = util_copybuf(arguments[0].value_hex);
+ else
+ this.value_hex = new ArrayBuffer(0);
+
+ this.block_length = this.value_hex.byteLength;
+ // #endregion
+ }
+ else
+ {
+ this.unused_bits = 0;
+ this.is_constructed = false;
+
+ // #region Variables from hex_block type
+ this.is_hex_only = false;
+ this.value_hex = new ArrayBuffer(0);
+ // #endregion
+ }
+ };
+ //**************************************************************************************
+ local.BITSTRING_value_block.prototype = new local.ASN1_CONSTRUCTED_value_block();
+ local.BITSTRING_value_block.constructor = local.BITSTRING_value_block;
+ //**************************************************************************************
+ local.BITSTRING_value_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ // #region Ability to decode zero-length BITSTRING value
+ if(input_length == 0)
+ return input_offset;
+ // #endregion
+
+ var result_offset = (-1);
+
+ // #region If the BISTRING supposed to be a constructed value
+ if(this.is_constructed == true)
+ {
+ result_offset = local.ASN1_CONSTRUCTED_value_block.prototype.fromBER.call(this, input_buffer, input_offset, input_length);
+ if(result_offset == (-1))
+ return result_offset;
+
+ for(var i = 0; i < this.value.length; i++)
+ {
+ var current_block_name = this.value[i].block_name();
+
+ if(current_block_name == in_window.org.pkijs.asn1.EOC.prototype.block_name())
+ {
+ if(this.is_indefinite_form == true)
+ break;
+ else
+ {
+ this.error = "EOC is unexpected, BIT STRING may consists of BIT STRINGs only";
+ return (-1);
+ }
+ }
+
+ if(current_block_name != in_window.org.pkijs.asn1.BITSTRING.prototype.block_name())
+ {
+ this.error = "BIT STRING may consists of BIT STRINGs only";
+ return (-1);
+ }
+
+ if((this.unused_bits > 0) && (this.value[i].unused_bits > 0))
+ {
+ this.error = "Usign of \"unused bits\" inside constructive BIT STRING allowed for least one only";
+ return (-1);
+ }
+ else
+ {
+ this.unused_bits = this.value[i].unused_bits;
+ if(this.unused_bits > 7)
+ {
+ this.error = "Unused bits for BITSTRING must be in range 0-7";
+ return (-1);
+ }
+ }
+ }
+
+ return result_offset;
+ }
+ // #endregion
+ // #region If the BITSTRING supposed to be a primitive value
+ else
+ {
+ // #region Basic check for parameters
+ if(check_buffer_params.call(this, input_buffer, input_offset, input_length) === false)
+ return (-1);
+ // #endregion
+
+ var int_buffer = new Uint8Array(input_buffer, input_offset, input_length);
+
+ this.unused_bits = int_buffer[0];
+ if(this.unused_bits > 7)
+ {
+ this.error = "Unused bits for BITSTRING must be in range 0-7";
+ return (-1);
+ }
+
+ // #region Copy input buffer to internal buffer
+ this.value_hex = new ArrayBuffer(int_buffer.length - 1);
+ var view = new Uint8Array(this.value_hex);
+ for(var i = 0; i < (input_length - 1) ; i++)
+ view[i] = int_buffer[i + 1];
+ // #endregion
+
+ this.block_length = int_buffer.length;
+
+ return (input_offset + input_length);
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ local.BITSTRING_value_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ if(typeof size_only === "undefined")
+ size_only = false;
+
+ if(this.is_constructed === true)
+ return local.ASN1_CONSTRUCTED_value_block.prototype.toBER.call(this, size_only);
+ else
+ {
+ if(size_only === true)
+ return (new ArrayBuffer(this.value_hex.byteLength + 1));
+
+ if(this.value_hex.byteLength == 0)
+ return (new ArrayBuffer(0));
+
+ var cur_view = new Uint8Array(this.value_hex);
+
+ var ret_buf = new ArrayBuffer(this.value_hex.byteLength + 1);
+ var ret_view = new Uint8Array(ret_buf);
+
+ ret_view[0] = this.unused_bits;
+
+ for(var i = 0; i < this.value_hex.byteLength; i++)
+ ret_view[i + 1] = cur_view[i];
+
+ return ret_buf;
+ }
+
+ return (new ArrayBuffer(0));
+ };
+ //**************************************************************************************
+ local.BITSTRING_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "BITSTRING_value_block";
+ };
+ //**************************************************************************************
+ local.BITSTRING_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.ASN1_CONSTRUCTED_value_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.BITSTRING_value_block.prototype.block_name.call(this);
+ _object.unused_bits = this.unused_bits;
+ _object.is_constructed = this.is_constructed;
+ _object.is_hex_only = this.is_hex_only;
+ _object.value_hex = in_window.org.pkijs.bufferToHexCodes(this.value_hex, 0, this.value_hex.byteLength);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BITSTRING =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.value_block = new local.BITSTRING_value_block(arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 3; // BITSTRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BITSTRING.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ in_window.org.pkijs.asn1.BITSTRING.constructor = in_window.org.pkijs.asn1.BITSTRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BITSTRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "BITSTRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BITSTRING.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ // #region Ability to encode empty BITSTRING
+ if(input_length == 0)
+ return input_offset;
+ // #endregion
+
+ this.value_block.is_constructed = this.id_block.is_constructed;
+ this.value_block.is_indefinite_form = this.len_block.is_indefinite_form;
+
+ return in_window.org.pkijs.asn1.ASN1_block.prototype.fromBER.call(this, input_buffer, input_offset, input_length);
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BITSTRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.BITSTRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of ASN.1 INTEGER type class
+ //**************************************************************************************
+ local.INTEGER_value_block =
+ function()
+ {
+ local.value_block.call(this, arguments[0]);
+
+ if(arguments[0] instanceof Object)
+ {
+ this.value_dec = in_window.org.pkijs.getValue(arguments[0], "value", 0);
+
+ // #region Variables from hex_block type
+ this.is_hex_only = in_window.org.pkijs.getValue(arguments[0], "is_hex_only", false);
+ if("value_hex" in arguments[0])
+ {
+ this.value_hex = util_copybuf(arguments[0].value_hex);
+
+ if(this.value_hex.byteLength >= 4) // Dummy's protection
+ this.is_hex_only = true;
+ else
+ this.value_dec = util_decode_tc.call(this);
+ }
+ else
+ this.value_hex = util_encode_tc(this.value_dec);
+ // #endregion
+ }
+ else
+ {
+ this.value_dec = 0;
+
+ // #region Variables from hex_block type
+ this.is_hex_only = false;
+ this.value_hex = new ArrayBuffer(0);
+ // #endregion
+ }
+ };
+ //**************************************************************************************
+ local.INTEGER_value_block.prototype = new local.value_block();
+ local.INTEGER_value_block.constructor = local.INTEGER_value_block;
+ //**************************************************************************************
+ local.INTEGER_value_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ var result_offset = local.hex_block.prototype.fromBER.call(this, input_buffer, input_offset, input_length);
+ if(result_offset == (-1))
+ return result_offset;
+
+ if(this.value_hex.byteLength > 4) // In JavaScript we can effectively work with 32-bit integers only
+ {
+ this.warnings.push("Too big INTEGER for decoding, hex only");
+ this.is_hex_only = true;
+ }
+ else
+ this.value_dec = util_decode_tc.call(this);
+
+ this.block_length = input_length;
+
+ return (input_offset + input_length);
+ };
+ //**************************************************************************************
+ local.INTEGER_value_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ if(typeof size_only === "undefined")
+ size_only = false;
+
+ if(this.is_hex_only === false)
+ {
+ var encoded_buf = util_encode_tc(this.value_dec);
+ if(encoded_buf.byteLength == 0)
+ {
+ this.error = "Error during encoding INTEGER value";
+ return (new ArrayBuffer(0));
+ }
+
+ return util_copybuf(encoded_buf);
+ }
+ else
+ return util_copybuf(this.value_hex);
+
+ return (new ArrayBuffer(0));
+ };
+ //**************************************************************************************
+ local.INTEGER_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "INTEGER_value_block";
+ };
+ //**************************************************************************************
+ local.INTEGER_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.value_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.INTEGER_value_block.prototype.block_name.call(this);
+ _object.value_dec = this.value_dec;
+ _object.is_hex_only = this.is_hex_only;
+ _object.value_hex = in_window.org.pkijs.bufferToHexCodes(this.value_hex, 0, this.value_hex.byteLength);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.INTEGER =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.value_block = new local.INTEGER_value_block(arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 2; // INTEGER
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.INTEGER.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ in_window.org.pkijs.asn1.INTEGER.constructor = in_window.org.pkijs.asn1.INTEGER;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.INTEGER.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "INTEGER";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.INTEGER.prototype.isEqual =
+ function()
+ {
+ /// <summary>Compare two INTEGER object, or INTEGER and ArrayBuffer objects</summary>
+ /// <returns type="Boolean"></returns>
+
+ if(arguments[0] instanceof in_window.org.pkijs.asn1.INTEGER)
+ {
+ if(this.value_block.is_hex_only && arguments[0].value_block.is_hex_only) // Compare two ArrayBuffers
+ return in_window.org.pkijs.isEqual_buffer(this.value_block.value_hex, arguments[0].value_block.value_hex);
+ else
+ {
+ if(this.value_block.is_hex_only === arguments[0].value_block.is_hex_only)
+ return (this.value_block.value_dec == arguments[0].value_block.value_dec);
+ else
+ return false;
+ }
+ }
+ else
+ {
+ if(arguments[0] instanceof ArrayBuffer)
+ return in_window.org.pkijs.isEqual_buffer(this.value_block.value_hex, arguments[0]);
+ else
+ return false;
+ }
+
+ return false;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.INTEGER.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.INTEGER.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of ASN.1 ENUMERATED type class
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ENUMERATED =
+ function()
+ {
+ in_window.org.pkijs.asn1.INTEGER.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 10; // ENUMERATED
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ENUMERATED.prototype = new in_window.org.pkijs.asn1.INTEGER();
+ in_window.org.pkijs.asn1.ENUMERATED.constructor = in_window.org.pkijs.asn1.ENUMERATED;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ENUMERATED.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "ENUMERATED";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ENUMERATED.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.INTEGER.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.ENUMERATED.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of ASN.1 OBJECT IDENTIFIER type class
+ //**************************************************************************************
+ local.SID_value_block =
+ function()
+ {
+ local.hex_block.call(this, arguments[0]);
+
+ if(arguments[0] instanceof Object)
+ {
+ this.value_dec = in_window.org.pkijs.getValue(arguments[0], "value_dec", -1);
+ this.is_first_sid = in_window.org.pkijs.getValue(arguments[0], "is_first_sid", false);
+ }
+ else
+ {
+ this.value_dec = (-1);
+ this.is_first_sid = false;
+ }
+ };
+ //**************************************************************************************
+ local.SID_value_block.prototype = new local.hex_block();
+ local.SID_value_block.constructor = local.SID_value_block;
+ //**************************************************************************************
+ local.SID_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "sid_block";
+ };
+ //**************************************************************************************
+ local.SID_value_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ if(input_length == 0)
+ return input_offset;
+
+ // #region Basic check for parameters
+ if(check_buffer_params.call(this, input_buffer, input_offset, input_length) === false)
+ return (-1);
+ // #endregion
+
+ var int_buffer = new Uint8Array(input_buffer, input_offset, input_length);
+
+ this.value_hex = new ArrayBuffer(input_length);
+ var view = new Uint8Array(this.value_hex);
+
+ for(var i = 0; i < input_length; i++)
+ {
+ view[i] = int_buffer[i] & 0x7F;
+
+ this.block_length++;
+
+ if((int_buffer[i] & 0x80) == 0x00)
+ break;
+ }
+
+ // #region Ajust size of value_hex buffer
+ var temp_value_hex = new ArrayBuffer(this.block_length);
+ var temp_view = new Uint8Array(temp_value_hex);
+
+ for(var i = 0; i < this.block_length; i++)
+ temp_view[i] = view[i];
+
+ this.value_hex = util_copybuf(temp_value_hex);
+ view = new Uint8Array(this.value_hex);
+ // #endregion
+
+ if((int_buffer[this.block_length - 1] & 0x80) != 0x00)
+ {
+ this.error = "End of input reached before message was fully decoded";
+ return (-1);
+ }
+
+ if(view[0] == 0x00)
+ this.warnings.push("Needlessly long format of SID encoding");
+
+ if(this.block_length <= 8)
+ this.value_dec = util_frombase(view, 7);
+ else
+ {
+ this.is_hex_only = true;
+ this.warnings.push("Too big SID for decoding, hex only");
+ }
+
+ return (input_offset + this.block_length);
+ };
+ //**************************************************************************************
+ local.SID_value_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ if(typeof size_only === "undefined")
+ size_only = false;
+
+ if(this.is_hex_only)
+ {
+ if(size_only === true)
+ return (new ArrayBuffer(this.value_hex.byteLength));
+
+ var cur_view = new Uint8Array(this.value_hex);
+
+ var ret_buf = new ArrayBuffer(this.block_length);
+ var ret_view = new Uint8Array(ret_buf);
+
+ for(var i = 0; i < (this.block_length - 1) ; i++)
+ ret_view[i] = cur_view[i] | 0x80;
+
+ ret_view[this.block_length - 1] = cur_view[this.block_length - 1];
+
+ return ret_buf;
+ }
+ else
+ {
+ var encoded_buf = util_tobase(this.value_dec, 7);
+ if(encoded_buf.byteLength === 0)
+ {
+ this.error = "Error during encoding SID value";
+ return (new ArrayBuffer(0));
+ }
+
+ var ret_buf = new ArrayBuffer(encoded_buf.byteLength);
+
+ if(size_only === false)
+ {
+ var encoded_view = new Uint8Array(encoded_buf);
+ var ret_view = new Uint8Array(ret_buf);
+
+ for(var i = 0; i < (encoded_buf.byteLength - 1) ; i++)
+ ret_view[i] = encoded_view[i] | 0x80;
+
+ ret_view[encoded_buf.byteLength - 1] = encoded_view[encoded_buf.byteLength - 1];
+ }
+
+ return ret_buf;
+ }
+ };
+ //**************************************************************************************
+ local.SID_value_block.prototype.toString =
+ function()
+ {
+ var result = "";
+
+ if(this.is_hex_only === true)
+ result = to_hex_codes(this.value_hex);
+ else
+ {
+ if(this.is_first_sid)
+ {
+ var sid_value = this.value_dec;
+
+ if(this.value_dec <= 39)
+ result = "0.";
+ else
+ {
+ if(this.value_dec <= 79)
+ {
+ result = "1.";
+ sid_value -= 40;
+ }
+ else
+ {
+ result = "2.";
+ sid_value -= 80;
+ }
+ }
+
+ result = result + sid_value.toString();
+ }
+ else
+ result = this.value_dec.toString();
+ }
+
+ return result;
+ };
+ //**************************************************************************************
+ local.SID_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.hex_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.SID_value_block.prototype.block_name.call(this);
+ _object.value_dec = this.value_dec;
+ _object.is_first_sid = this.is_first_sid;
+
+ return _object;
+ };
+ //**************************************************************************************
+ local.OID_value_block =
+ function()
+ {
+ local.value_block.call(this, arguments[0]);
+
+ this.value = new Array();
+
+ if(arguments[0] instanceof Object)
+ this.fromString(in_window.org.pkijs.getValue(arguments[0], "value", ""));
+ };
+ //**************************************************************************************
+ local.OID_value_block.prototype = new local.value_block();
+ local.OID_value_block.constructor = local.OID_value_block;
+ //**************************************************************************************
+ local.OID_value_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ var result_offset = input_offset;
+
+ while(input_length > 0)
+ {
+ var sid_block = new local.SID_value_block();
+ result_offset = sid_block.fromBER(input_buffer, result_offset, input_length);
+ if(result_offset == (-1))
+ {
+ this.block_length = 0;
+ this.error = sid_block.error;
+ return result_offset;
+ }
+
+ if(this.value.length == 0)
+ sid_block.is_first_sid = true;
+
+ this.block_length += sid_block.block_length;
+ input_length -= sid_block.block_length;
+
+ this.value.push(sid_block);
+ }
+
+ return result_offset;
+ };
+ //**************************************************************************************
+ local.OID_value_block.prototype.toBER =
+ function(size_only)
+ {
+ /// <summary>Encoding of current ASN.1 block into ASN.1 encoded array (BER rules)</summary>
+ /// <param name="size_only" type="Boolean">Flag that we need only a size of encoding, not a real array of bytes</param>
+
+ if(typeof size_only === "undefined")
+ size_only = false;
+
+ var ret_buf = new ArrayBuffer(0);
+
+ for(var i = 0; i < this.value.length; i++)
+ {
+ var value_buf = this.value[i].toBER(size_only);
+ if(value_buf.byteLength === 0)
+ {
+ this.error = this.value[i].error;
+ return (new ArrayBuffer(0));
+ }
+
+ ret_buf = util_concatbuf(ret_buf, value_buf);
+ }
+
+ return ret_buf;
+ };
+ //**************************************************************************************
+ local.OID_value_block.prototype.fromString =
+ function(str)
+ {
+ this.value = new Array(); // Clear existing SID values
+
+ var pos1 = 0;
+ var pos2 = 0;
+
+ var sid = "";
+
+ var flag = false;
+
+ do
+ {
+ pos2 = str.indexOf('.', pos1);
+ if(pos2 === (-1))
+ sid = str.substr(pos1);
+ else
+ sid = str.substr(pos1, pos2 - pos1);
+
+ pos1 = pos2 + 1;
+
+ if(flag)
+ {
+ var sid_block = this.value[0];
+
+ var plus = 0;
+
+ switch(sid_block.value_dec)
+ {
+ case 0:
+ break;
+ case 1:
+ plus = 40;
+ break;
+ case 2:
+ plus = 80;
+ break;
+ default:
+ this.value = new Array(); // clear SID array
+ return false; // ???
+ }
+
+ var parsedSID = parseInt(sid, 10);
+ if(isNaN(parsedSID))
+ return true;
+
+ sid_block.value_dec = parsedSID + plus;
+
+ flag = false;
+ }
+ else
+ {
+ var sid_block = new local.SID_value_block();
+ sid_block.value_dec = parseInt(sid, 10);
+ if(isNaN(sid_block.value_dec))
+ return true;
+
+ if(this.value.length === 0)
+ {
+ sid_block.is_first_sid = true;
+ flag = true;
+ }
+
+ this.value.push(sid_block);
+ }
+
+ } while(pos2 !== (-1));
+
+ return true;
+ };
+ //**************************************************************************************
+ local.OID_value_block.prototype.toString =
+ function()
+ {
+ var result = "";
+ var is_hex_only = false;
+
+ for(var i = 0; i < this.value.length; i++)
+ {
+ is_hex_only = this.value[i].is_hex_only;
+
+ var sid_str = this.value[i].toString();
+
+ if(i !== 0)
+ result = result + ".";
+
+ if(is_hex_only)
+ {
+ sid_str = "{" + sid_str + "}";
+
+ if(this.value[i].is_first_sid)
+ result = "2.{" + sid_str + " - 80}";
+ else
+ result = result + sid_str;
+ }
+ else
+ result = result + sid_str;
+ }
+
+ return result;
+ };
+ //**************************************************************************************
+ local.OID_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "OID_value_block";
+ };
+ //**************************************************************************************
+ local.OID_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.value_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.OID_value_block.prototype.block_name.call(this);
+ _object.value = local.OID_value_block.prototype.toString.call(this);
+ _object.sid_array = new Array();
+ for(var i = 0; i < this.value.length; i++)
+ _object.sid_array.push(this.value[i].toJSON());
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.OID =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.value_block = new local.OID_value_block(arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 6; // OBJECT IDENTIFIER
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.OID.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ in_window.org.pkijs.asn1.OID.constructor = in_window.org.pkijs.asn1.OID;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.OID.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "OID";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.OID.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.OID.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of all string's classes
+ //**************************************************************************************
+ local.UTF8STRING_value_block =
+ function()
+ {
+ local.hex_block.call(this, arguments[0]);
+
+ this.is_hex_only = true;
+ this.value = ""; // String representation of decoded ArrayBuffer
+ };
+ //**************************************************************************************
+ local.UTF8STRING_value_block.prototype = new local.hex_block();
+ local.UTF8STRING_value_block.constructor = local.UTF8STRING_value_block;
+ //**************************************************************************************
+ local.UTF8STRING_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "UTF8STRING_value_block";
+ };
+ //**************************************************************************************
+ local.UTF8STRING_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.hex_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.UTF8STRING_value_block.prototype.block_name.call(this);
+ _object.value = this.value;
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTF8STRING =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.value_block = new local.UTF8STRING_value_block();
+
+ if(arguments[0] instanceof Object)
+ {
+ if("value" in arguments[0])
+ in_window.org.pkijs.asn1.UTF8STRING.prototype.fromString.call(this,arguments[0].value);
+ }
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 12; // UTF8STRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTF8STRING.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ in_window.org.pkijs.asn1.UTF8STRING.constructor = in_window.org.pkijs.asn1.UTF8STRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTF8STRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "UTF8STRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTF8STRING.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ var result_offset = this.value_block.fromBER(input_buffer, input_offset, (this.len_block.is_indefinite_form == true) ? input_length : this.len_block.length);
+ if(result_offset == (-1))
+ {
+ this.error = this.value_block.error;
+ return result_offset;
+ }
+
+ in_window.org.pkijs.asn1.UTF8STRING.prototype.fromBuffer.call(this, this.value_block.value_hex);
+
+ if(this.id_block.error.length == 0)
+ this.block_length += this.id_block.block_length;
+
+ if(this.len_block.error.length == 0)
+ this.block_length += this.len_block.block_length;
+
+ if(this.value_block.error.length == 0)
+ this.block_length += this.value_block.block_length;
+
+ return result_offset;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTF8STRING.prototype.fromBuffer =
+ function(input_buffer)
+ {
+ /// <param name="input_buffer" type="ArrayBuffer">Array with encoded string</param>
+ this.value_block.value = String.fromCharCode.apply(null, new Uint8Array(input_buffer));
+
+ try
+ {
+ this.value_block.value = decodeURIComponent(escape(this.value_block.value));
+ }
+ catch(ex)
+ {
+ this.warnings.push("Error during \"decodeURIComponent\": " + ex + ", using raw string");
+ }
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTF8STRING.prototype.fromString =
+ function(input_string)
+ {
+ /// <param name="input_string" type="String">String with UNIVERSALSTRING value</param>
+
+ var str = unescape(encodeURIComponent(input_string));
+ var str_len = str.length;
+
+ this.value_block.value_hex = new ArrayBuffer(str_len);
+ var view = new Uint8Array(this.value_block.value_hex);
+
+ for(var i = 0; i < str_len; i++)
+ view[i] = str.charCodeAt(i);
+
+ this.value_block.value = input_string;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTF8STRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.UTF8STRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ local.BMPSTRING_value_block =
+ function()
+ {
+ local.hex_block.call(this, arguments[0]);
+
+ this.is_hex_only = true;
+ this.value = "";
+ };
+ //**************************************************************************************
+ local.BMPSTRING_value_block.prototype = new local.hex_block();
+ local.BMPSTRING_value_block.constructor = local.BMPSTRING_value_block;
+ //**************************************************************************************
+ local.BMPSTRING_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "BMPSTRING_value_block";
+ };
+ //**************************************************************************************
+ local.BMPSTRING_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.hex_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.BMPSTRING_value_block.prototype.block_name.call(this);
+ _object.value = this.value;
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BMPSTRING =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.value_block = new local.BMPSTRING_value_block();
+
+ if(arguments[0] instanceof Object)
+ {
+ if("value" in arguments[0])
+ in_window.org.pkijs.asn1.BMPSTRING.prototype.fromString.call(this, arguments[0].value);
+ }
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 30; // BMPSTRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BMPSTRING.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ in_window.org.pkijs.asn1.BMPSTRING.constructor = in_window.org.pkijs.asn1.BMPSTRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BMPSTRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "BMPSTRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BMPSTRING.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ var result_offset = this.value_block.fromBER(input_buffer, input_offset, (this.len_block.is_indefinite_form == true) ? input_length : this.len_block.length);
+ if(result_offset == (-1))
+ {
+ this.error = this.value_block.error;
+ return result_offset;
+ }
+
+ in_window.org.pkijs.asn1.BMPSTRING.prototype.fromBuffer.call(this, this.value_block.value_hex);
+
+ if(this.id_block.error.length == 0)
+ this.block_length += this.id_block.block_length;
+
+ if(this.len_block.error.length == 0)
+ this.block_length += this.len_block.block_length;
+
+ if(this.value_block.error.length == 0)
+ this.block_length += this.value_block.block_length;
+
+ return result_offset;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BMPSTRING.prototype.fromBuffer =
+ function(input_buffer)
+ {
+ /// <param name="input_buffer" type="ArrayBuffer">Array with encoded string</param>
+
+ var copy_buffer = in_window.org.pkijs.copyBuffer(input_buffer);
+
+ var value_view = new Uint8Array(copy_buffer);
+
+ for(var i = 0; i < value_view.length; i = i + 2)
+ {
+ var temp = value_view[i];
+
+ value_view[i] = value_view[i + 1];
+ value_view[i + 1] = temp;
+ }
+
+ this.value_block.value = String.fromCharCode.apply(null, new Uint16Array(copy_buffer));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BMPSTRING.prototype.fromString =
+ function(input_string)
+ {
+ /// <param name="input_string" type="String">String with UNIVERSALSTRING value</param>
+
+ var str_length = input_string.length;
+
+ this.value_block.value_hex = new ArrayBuffer(str_length * 2);
+ var value_hex_view = new Uint8Array(this.value_block.value_hex);
+
+ for(var i = 0; i < str_length; i++)
+ {
+ var code_buf = util_tobase(input_string.charCodeAt(i), 8);
+ var code_view = new Uint8Array(code_buf);
+ if(code_view.length > 2)
+ continue;
+
+ var dif = 2 - code_view.length;
+
+ for(var j = (code_view.length - 1) ; j >= 0; j--)
+ value_hex_view[i * 2 + j + dif] = code_view[j];
+ }
+
+ this.value_block.value = input_string;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.BMPSTRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.BMPSTRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ local.UNIVERSALSTRING_value_block =
+ function()
+ {
+ local.hex_block.call(this, arguments[0]);
+
+ this.is_hex_only = true;
+ this.value = "";
+ };
+ //**************************************************************************************
+ local.UNIVERSALSTRING_value_block.prototype = new local.hex_block();
+ local.UNIVERSALSTRING_value_block.constructor = local.UNIVERSALSTRING_value_block;
+ //**************************************************************************************
+ local.UNIVERSALSTRING_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "UNIVERSALSTRING_value_block";
+ };
+ //**************************************************************************************
+ local.UNIVERSALSTRING_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.hex_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.UNIVERSALSTRING_value_block.prototype.block_name.call(this);
+ _object.value = this.value;
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UNIVERSALSTRING =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.value_block = new local.UNIVERSALSTRING_value_block();
+
+ if(arguments[0] instanceof Object)
+ {
+ if("value" in arguments[0])
+ in_window.org.pkijs.asn1.UNIVERSALSTRING.prototype.fromString.call(this, arguments[0].value);
+ }
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 28; // UNIVERSALSTRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UNIVERSALSTRING.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ in_window.org.pkijs.asn1.UNIVERSALSTRING.constructor = in_window.org.pkijs.asn1.UNIVERSALSTRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UNIVERSALSTRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "UNIVERSALSTRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UNIVERSALSTRING.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ var result_offset = this.value_block.fromBER(input_buffer, input_offset, (this.len_block.is_indefinite_form == true) ? input_length : this.len_block.length);
+ if(result_offset == (-1))
+ {
+ this.error = this.value_block.error;
+ return result_offset;
+ }
+
+ in_window.org.pkijs.asn1.UNIVERSALSTRING.prototype.fromBuffer.call(this, this.value_block.value_hex);
+
+ if(this.id_block.error.length == 0)
+ this.block_length += this.id_block.block_length;
+
+ if(this.len_block.error.length == 0)
+ this.block_length += this.len_block.block_length;
+
+ if(this.value_block.error.length == 0)
+ this.block_length += this.value_block.block_length;
+
+ return result_offset;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UNIVERSALSTRING.prototype.fromBuffer =
+ function(input_buffer)
+ {
+ /// <param name="input_buffer" type="ArrayBuffer">Array with encoded string</param>
+
+ var copy_buffer = in_window.org.pkijs.copyBuffer(input_buffer);
+
+ var value_view = new Uint8Array(copy_buffer);
+
+ for(var i = 0; i < value_view.length; i = i + 4)
+ {
+ value_view[i] = value_view[i + 3];
+ value_view[i + 1] = value_view[i + 2];
+ value_view[i + 2] = 0x00;
+ value_view[i + 3] = 0x00;
+ }
+
+ this.value_block.value = String.fromCharCode.apply(null, new Uint32Array(copy_buffer));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UNIVERSALSTRING.prototype.fromString =
+ function(input_string)
+ {
+ /// <param name="input_string" type="String">String with UNIVERSALSTRING value</param>
+
+ var str_length = input_string.length;
+
+ this.value_block.value_hex = new ArrayBuffer(str_length * 4);
+ var value_hex_view = new Uint8Array(this.value_block.value_hex);
+
+ for(var i = 0; i < str_length; i++)
+ {
+ var code_buf = util_tobase(input_string.charCodeAt(i), 8);
+ var code_view = new Uint8Array(code_buf);
+ if(code_view.length > 4)
+ continue;
+
+ var dif = 4 - code_view.length;
+
+ for(var j = (code_view.length - 1) ; j >= 0; j--)
+ value_hex_view[i*4 + j + dif] = code_view[j];
+ }
+
+ this.value_block.value = input_string;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UNIVERSALSTRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.UNIVERSALSTRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ local.SIMPLESTRING_value_block =
+ function()
+ {
+ local.hex_block.call(this, arguments[0]);
+
+ /// <field type="String">Native string representation</field>
+ this.value = "";
+ this.is_hex_only = true;
+ };
+ //**************************************************************************************
+ local.SIMPLESTRING_value_block.prototype = new local.hex_block();
+ local.SIMPLESTRING_value_block.constructor = local.SIMPLESTRING_value_block;
+ //**************************************************************************************
+ local.SIMPLESTRING_value_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "SIMPLESTRING_value_block";
+ };
+ //**************************************************************************************
+ local.SIMPLESTRING_value_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.hex_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.SIMPLESTRING_value_block.prototype.block_name.call(this);
+ _object.value = this.value;
+
+ return _object;
+ };
+ //**************************************************************************************
+ local.SIMPLESTRING_block =
+ function()
+ {
+ in_window.org.pkijs.asn1.ASN1_block.call(this, arguments[0]);
+
+ this.value_block = new local.SIMPLESTRING_value_block();
+
+ if(arguments[0] instanceof Object)
+ {
+ if("value" in arguments[0])
+ local.SIMPLESTRING_block.prototype.fromString.call(this, arguments[0].value);
+ }
+ };
+ //**************************************************************************************
+ local.SIMPLESTRING_block.prototype = new in_window.org.pkijs.asn1.ASN1_block();
+ local.SIMPLESTRING_block.constructor = local.SIMPLESTRING_block;
+ //**************************************************************************************
+ local.SIMPLESTRING_block.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "SIMPLESTRING";
+ };
+ //**************************************************************************************
+ local.SIMPLESTRING_block.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ var result_offset = this.value_block.fromBER(input_buffer, input_offset, (this.len_block.is_indefinite_form == true) ? input_length : this.len_block.length);
+ if(result_offset == (-1))
+ {
+ this.error = this.value_block.error;
+ return result_offset;
+ }
+
+ local.SIMPLESTRING_block.prototype.fromBuffer.call(this, this.value_block.value_hex);
+
+ if(this.id_block.error.length == 0)
+ this.block_length += this.id_block.block_length;
+
+ if(this.len_block.error.length == 0)
+ this.block_length += this.len_block.block_length;
+
+ if(this.value_block.error.length == 0)
+ this.block_length += this.value_block.block_length;
+
+ return result_offset;
+ };
+ //**************************************************************************************
+ local.SIMPLESTRING_block.prototype.fromBuffer =
+ function(input_buffer)
+ {
+ /// <param name="input_buffer" type="ArrayBuffer">Array with encoded string</param>
+
+ this.value_block.value = String.fromCharCode.apply(null, new Uint8Array(input_buffer));
+ };
+ //**************************************************************************************
+ local.SIMPLESTRING_block.prototype.fromString =
+ function(input_string)
+ {
+ /// <param name="input_string" type="String">String with UNIVERSALSTRING value</param>
+ var str_len = input_string.length;
+
+ this.value_block.value_hex = new ArrayBuffer(str_len);
+ var view = new Uint8Array(this.value_block.value_hex);
+
+ for(var i = 0; i < str_len; i++)
+ view[i] = input_string.charCodeAt(i);
+
+ this.value_block.value = input_string;
+ };
+ //**************************************************************************************
+ local.SIMPLESTRING_block.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.ASN1_block.prototype.toJSON.call(this);
+
+ _object.block_name = local.SIMPLESTRING_block.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.NUMERICSTRING =
+ function()
+ {
+ local.SIMPLESTRING_block.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 18; // NUMERICSTRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.NUMERICSTRING.prototype = new local.SIMPLESTRING_block();
+ in_window.org.pkijs.asn1.NUMERICSTRING.constructor = in_window.org.pkijs.asn1.NUMERICSTRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.NUMERICSTRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "NUMERICSTRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.NUMERICSTRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.SIMPLESTRING_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.NUMERICSTRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.PRINTABLESTRING =
+ function()
+ {
+ local.SIMPLESTRING_block.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 19; // PRINTABLESTRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.PRINTABLESTRING.prototype = new local.SIMPLESTRING_block();
+ in_window.org.pkijs.asn1.PRINTABLESTRING.constructor = in_window.org.pkijs.asn1.PRINTABLESTRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.PRINTABLESTRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "PRINTABLESTRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.PRINTABLESTRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.SIMPLESTRING_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.PRINTABLESTRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.TELETEXSTRING =
+ function()
+ {
+ local.SIMPLESTRING_block.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 20; // TELETEXSTRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.TELETEXSTRING.prototype = new local.SIMPLESTRING_block();
+ in_window.org.pkijs.asn1.TELETEXSTRING.constructor = in_window.org.pkijs.asn1.TELETEXSTRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.TELETEXSTRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "TELETEXSTRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.TELETEXSTRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.SIMPLESTRING_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.TELETEXSTRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.VIDEOTEXSTRING =
+ function()
+ {
+ local.SIMPLESTRING_block.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 21; // VIDEOTEXSTRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.VIDEOTEXSTRING.prototype = new local.SIMPLESTRING_block();
+ in_window.org.pkijs.asn1.VIDEOTEXSTRING.constructor = in_window.org.pkijs.asn1.VIDEOTEXSTRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.VIDEOTEXSTRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "VIDEOTEXSTRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.VIDEOTEXSTRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.SIMPLESTRING_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.VIDEOTEXSTRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.IA5STRING =
+ function()
+ {
+ local.SIMPLESTRING_block.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 22; // IA5STRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.IA5STRING.prototype = new local.SIMPLESTRING_block();
+ in_window.org.pkijs.asn1.IA5STRING.constructor = in_window.org.pkijs.asn1.IA5STRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.IA5STRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "IA5STRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.IA5STRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.SIMPLESTRING_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.IA5STRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GRAPHICSTRING =
+ function()
+ {
+ local.SIMPLESTRING_block.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 25; // GRAPHICSTRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GRAPHICSTRING.prototype = new local.SIMPLESTRING_block();
+ in_window.org.pkijs.asn1.GRAPHICSTRING.constructor = in_window.org.pkijs.asn1.GRAPHICSTRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GRAPHICSTRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "GRAPHICSTRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GRAPHICSTRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.SIMPLESTRING_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.GRAPHICSTRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.VISIBLESTRING =
+ function()
+ {
+ local.SIMPLESTRING_block.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 26; // VISIBLESTRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.VISIBLESTRING.prototype = new local.SIMPLESTRING_block();
+ in_window.org.pkijs.asn1.VISIBLESTRING.constructor = in_window.org.pkijs.asn1.VISIBLESTRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.VISIBLESTRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "VISIBLESTRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.VISIBLESTRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.SIMPLESTRING_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.VISIBLESTRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALSTRING =
+ function()
+ {
+ local.SIMPLESTRING_block.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 27; // GENERALSTRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALSTRING.prototype = new local.SIMPLESTRING_block();
+ in_window.org.pkijs.asn1.GENERALSTRING.constructor = in_window.org.pkijs.asn1.GENERALSTRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALSTRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "GENERALSTRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALSTRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.SIMPLESTRING_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.GENERALSTRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.CHARACTERSTRING =
+ function()
+ {
+ local.SIMPLESTRING_block.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 29; // CHARACTERSTRING
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.CHARACTERSTRING.prototype = new local.SIMPLESTRING_block();
+ in_window.org.pkijs.asn1.CHARACTERSTRING.constructor = in_window.org.pkijs.asn1.CHARACTERSTRING;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.CHARACTERSTRING.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "CHARACTERSTRING";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.CHARACTERSTRING.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = local.SIMPLESTRING_block.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.CHARACTERSTRING.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of all date and time classes
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTCTIME =
+ function()
+ {
+ in_window.org.pkijs.asn1.VISIBLESTRING.call(this, arguments[0]);
+
+ this.year = 0;
+ this.month = 0;
+ this.day = 0;
+ this.hour = 0;
+ this.minute = 0;
+ this.second = 0;
+
+ // #region Create UTCTIME from ASN.1 UTC string value
+ if((arguments[0] instanceof Object) && ("value" in arguments[0]))
+ {
+ in_window.org.pkijs.asn1.UTCTIME.prototype.fromString.call(this, arguments[0].value);
+
+ this.value_block.value_hex = new ArrayBuffer(arguments[0].value.length);
+ var view = new Uint8Array(this.value_block.value_hex);
+
+ for(var i = 0; i < arguments[0].value.length; i++)
+ view[i] = arguments[0].value.charCodeAt(i);
+ }
+ // #endregion
+ // #region Create UTCTIME from JavaScript Date type
+ if((arguments[0] instanceof Object) && ("value_date" in arguments[0]))
+ {
+ in_window.org.pkijs.asn1.UTCTIME.prototype.fromDate.call(this, arguments[0].value_date);
+ this.value_block.value_hex = in_window.org.pkijs.asn1.UTCTIME.prototype.toBuffer.call(this);
+ }
+ // #endregion
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 23; // UTCTIME
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTCTIME.prototype = new in_window.org.pkijs.asn1.VISIBLESTRING();
+ in_window.org.pkijs.asn1.UTCTIME.constructor = in_window.org.pkijs.asn1.UTCTIME;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTCTIME.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ var result_offset = this.value_block.fromBER(input_buffer, input_offset, (this.len_block.is_indefinite_form == true) ? input_length : this.len_block.length);
+ if(result_offset == (-1))
+ {
+ this.error = this.value_block.error;
+ return result_offset;
+ }
+
+ in_window.org.pkijs.asn1.UTCTIME.prototype.fromBuffer.call(this, this.value_block.value_hex);
+
+ if(this.id_block.error.length == 0)
+ this.block_length += this.id_block.block_length;
+
+ if(this.len_block.error.length == 0)
+ this.block_length += this.len_block.block_length;
+
+ if(this.value_block.error.length == 0)
+ this.block_length += this.value_block.block_length;
+
+ return result_offset;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTCTIME.prototype.fromBuffer =
+ function(input_buffer)
+ {
+ in_window.org.pkijs.asn1.UTCTIME.prototype.fromString.call(this, String.fromCharCode.apply(null, new Uint8Array(input_buffer)));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTCTIME.prototype.toBuffer =
+ function()
+ {
+ var str = in_window.org.pkijs.asn1.UTCTIME.prototype.toString.call(this);
+
+ var buffer = new ArrayBuffer(str.length);
+ var view = new Uint8Array(buffer);
+
+ for(var i = 0; i < str.length; i++)
+ view[i] = str.charCodeAt(i);
+
+ return buffer;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTCTIME.prototype.fromDate =
+ function(input_date)
+ {
+ /// <summary>Create "UTCTime" ASN.1 type from JavaScript "Date" type</summary>
+
+ this.year = input_date.getUTCFullYear();
+ this.month = input_date.getUTCMonth() + 1;
+ this.day = input_date.getUTCDate();
+ this.hour = input_date.getUTCHours();
+ this.minute = input_date.getUTCMinutes();
+ this.second = input_date.getUTCSeconds();
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTCTIME.prototype.toDate =
+ function()
+ {
+ return (new Date(Date.UTC(this.year, this.month - 1, this.day, this.hour, this.minute, this.second)));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTCTIME.prototype.fromString =
+ function(input_string)
+ {
+ /// <summary>Create "UTCTime" ASN.1 type from JavaScript "String" type</summary>
+
+ // #region Parse input string
+ var parser = /(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z/ig;
+ var parser_array = parser.exec(input_string);
+ if(parser_array === null)
+ {
+ this.error = "Wrong input string for convertion";
+ return;
+ }
+ // #endregion
+
+ // #region Store parsed values
+ var year = parseInt(parser_array[1], 10);
+ if(year >= 50)
+ this.year = 1900 + year;
+ else
+ this.year = 2000 + year;
+
+ this.month = parseInt(parser_array[2], 10);
+ this.day = parseInt(parser_array[3], 10);
+ this.hour = parseInt(parser_array[4], 10);
+ this.minute = parseInt(parser_array[5], 10);
+ this.second = parseInt(parser_array[6], 10);
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTCTIME.prototype.toString =
+ function()
+ {
+ var output_array = new Array(7);
+
+ output_array[0] = in_window.org.pkijs.padNumber(((this.year < 2000) ? (this.year - 1900) : (this.year - 2000)), 2);
+ output_array[1] = in_window.org.pkijs.padNumber(this.month, 2);
+ output_array[2] = in_window.org.pkijs.padNumber(this.day, 2);
+ output_array[3] = in_window.org.pkijs.padNumber(this.hour, 2);
+ output_array[4] = in_window.org.pkijs.padNumber(this.minute, 2);
+ output_array[5] = in_window.org.pkijs.padNumber(this.second, 2);
+ output_array[6] = "Z";
+
+ return output_array.join('');
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTCTIME.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "UTCTIME";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.UTCTIME.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.VISIBLESTRING.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.UTCTIME.prototype.block_name.call(this);
+ _object.year = this.year;
+ _object.month = this.month;
+ _object.day = this.day;
+ _object.hour = this.hour;
+ _object.minute = this.minute;
+ _object.second = this.second;
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALIZEDTIME =
+ function()
+ {
+ in_window.org.pkijs.asn1.VISIBLESTRING.call(this, arguments[0]);
+
+ this.year = 0;
+ this.month = 0;
+ this.day = 0;
+ this.hour = 0;
+ this.minute = 0;
+ this.second = 0;
+ this.millisecond = 0;
+
+ // #region Create GeneralizedTime from ASN.1 string value
+ if((arguments[0] instanceof Object) && ("value" in arguments[0]))
+ {
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.fromString.call(this, arguments[0].value);
+
+ this.value_block.value_hex = new ArrayBuffer(arguments[0].value.length);
+ var view = new Uint8Array(this.value_block.value_hex);
+
+ for(var i = 0; i < arguments[0].value.length; i++)
+ view[i] = arguments[0].value.charCodeAt(i);
+ }
+ // #endregion
+ // #region Create GeneralizedTime from JavaScript Date type
+ if((arguments[0] instanceof Object) && ("value_date" in arguments[0]))
+ {
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.fromDate.call(this, arguments[0].value_date);
+ this.value_block.value_hex = in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.toBuffer.call(this);
+ }
+ // #endregion
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 24; // GENERALIZEDTIME
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype = new in_window.org.pkijs.asn1.VISIBLESTRING();
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.constructor = in_window.org.pkijs.asn1.GENERALIZEDTIME;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.fromBER =
+ function(input_buffer, input_offset, input_length)
+ {
+ /// <summary>Base function for converting block from BER encoded array of bytes</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array</param>
+ /// <param name="input_offset" type="Number">Offset in ASN.1 BER encoded array where decoding should be started</param>
+ /// <param name="input_length" type="Number">Maximum length of array of bytes which can be using in this function</param>
+
+ var result_offset = this.value_block.fromBER(input_buffer, input_offset, (this.len_block.is_indefinite_form == true) ? input_length : this.len_block.length);
+ if(result_offset == (-1))
+ {
+ this.error = this.value_block.error;
+ return result_offset;
+ }
+
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.fromBuffer.call(this, this.value_block.value_hex);
+
+ if(this.id_block.error.length == 0)
+ this.block_length += this.id_block.block_length;
+
+ if(this.len_block.error.length == 0)
+ this.block_length += this.len_block.block_length;
+
+ if(this.value_block.error.length == 0)
+ this.block_length += this.value_block.block_length;
+
+ return result_offset;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.fromBuffer =
+ function(input_buffer)
+ {
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.fromString.call(this, String.fromCharCode.apply(null, new Uint8Array(input_buffer)));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.toBuffer =
+ function()
+ {
+ var str = in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.toString.call(this);
+
+ var buffer = new ArrayBuffer(str.length);
+ var view = new Uint8Array(buffer);
+
+ for(var i = 0; i < str.length; i++)
+ view[i] = str.charCodeAt(i);
+
+ return buffer;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.fromDate =
+ function(input_date)
+ {
+ /// <summary>Create "GeneralizedTime" ASN.1 type from JavaScript "Date" type</summary>
+
+ this.year = input_date.getUTCFullYear();
+ this.month = input_date.getUTCMonth();
+ this.day = input_date.getUTCDate();
+ this.hour = input_date.getUTCHours();
+ this.minute = input_date.getUTCMinutes();
+ this.second = input_date.getUTCSeconds();
+ this.millisecond = input_date.getUTCMilliseconds();
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.toDate =
+ function()
+ {
+ return (new Date(Date.UTC(this.year, this.month - 1, this.day, this.hour, this.minute, this.second, this.millisecond)));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.fromString =
+ function(input_string)
+ {
+ /// <summary>Create "GeneralizedTime" ASN.1 type from JavaScript "String" type</summary>
+
+ // #region Initial variables
+ var isUTC = false;
+
+ var timeString = "";
+ var dateTimeString = "";
+ var fractionPart = 0;
+
+ var parser;
+
+ var hourDifference = 0;
+ var minuteDifference = 0;
+ // #endregion
+
+ // #region Convert as UTC time
+ if(input_string[input_string.length - 1] == "Z")
+ {
+ timeString = input_string.substr(0, input_string.length - 1);
+
+ isUTC = true;
+ }
+ // #endregion
+ // #region Convert as local time
+ else
+ {
+ var number = new Number(input_string[input_string.length - 1]);
+
+ if(isNaN(number.valueOf()))
+ throw new Error("Wrong input string for convertion");
+
+ timeString = input_string;
+ }
+ // #endregion
+
+ // #region Check that we do not have a "+" and "-" symbols inside UTC time
+ if(isUTC)
+ {
+ if(timeString.indexOf("+") != (-1))
+ throw new Error("Wrong input string for convertion");
+
+ if(timeString.indexOf("-") != (-1))
+ throw new Error("Wrong input string for convertion");
+ }
+ // #endregion
+ // #region Get "UTC time difference" in case of local time
+ else
+ {
+ var multiplier = 1;
+ var differencePosition = timeString.indexOf("+");
+ var differenceString = "";
+
+ if(differencePosition == (-1))
+ {
+ differencePosition = timeString.indexOf("-");
+ multiplier = (-1);
+ }
+
+ if(differencePosition != (-1))
+ {
+ differenceString = timeString.substr(differencePosition + 1);
+ timeString = timeString.substr(0, differencePosition);
+
+ if((differenceString.length != 2) && (differenceString.length != 4))
+ throw new Error("Wrong input string for convertion");
+
+ var number = new Number(differenceString.substr(0, 2));
+
+ if(isNaN(number.valueOf()))
+ throw new Error("Wrong input string for convertion");
+
+ hourDifference = multiplier * number;
+
+ if(differenceString.length == 4)
+ {
+ number = new Number(differenceString.substr(2, 2));
+
+ if(isNaN(number.valueOf()))
+ throw new Error("Wrong input string for convertion");
+
+ minuteDifference = multiplier * number;
+ }
+ }
+ }
+ // #endregion
+
+ // #region Get position of fraction point
+ var fractionPointPosition = timeString.indexOf("."); // Check for "full stop" symbol
+ if(fractionPointPosition == (-1))
+ fractionPointPosition = timeString.indexOf(","); // Check for "comma" symbol
+ // #endregion
+
+ // #region Get fraction part
+ if(fractionPointPosition != (-1))
+ {
+ var fractionPartCheck = new Number("0" + timeString.substr(fractionPointPosition));
+
+ if(isNaN(fractionPartCheck.valueOf()))
+ throw new Error("Wrong input string for convertion");
+
+ fractionPart = fractionPartCheck.valueOf();
+
+ dateTimeString = timeString.substr(0, fractionPointPosition);
+ }
+ else
+ dateTimeString = timeString;
+ // #endregion
+
+ // #region Parse internal date
+ switch(true)
+ {
+ case (dateTimeString.length == 8): // "YYYYMMDD"
+ parser = /(\d{4})(\d{2})(\d{2})/ig;
+ if(fractionPointPosition !== (-1))
+ throw new Error("Wrong input string for convertion"); // Here we should not have a "fraction point"
+ break;
+ case (dateTimeString.length == 10): // "YYYYMMDDHH"
+ parser = /(\d{4})(\d{2})(\d{2})(\d{2})/ig;
+
+ if(fractionPointPosition !== (-1))
+ {
+ var fractionResult = 60 * fractionPart;
+ this.minute = Math.floor(fractionResult);
+
+ fractionResult = 60 * (fractionResult - this.minute);
+ this.second = Math.floor(fractionResult);
+
+ fractionResult = 1000 * (fractionResult - this.second);
+ this.millisecond = Math.floor(fractionResult);
+ }
+ break;
+ case (dateTimeString.length == 12): // "YYYYMMDDHHMM"
+ parser = /(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})/ig;
+
+ if(fractionPointPosition !== (-1))
+ {
+ var fractionResult = 60 * fractionPart;
+ this.second = Math.floor(fractionResult);
+
+ fractionResult = 1000 * (fractionResult - this.second);
+ this.millisecond = Math.floor(fractionResult);
+ }
+ break;
+ case (dateTimeString.length == 14): // "YYYYMMDDHHMMSS"
+ parser = /(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})/ig;
+
+ if(fractionPointPosition !== (-1))
+ {
+ var fractionResult = 1000 * fractionPart;
+ this.millisecond = Math.floor(fractionResult);
+ }
+ break;
+ default:
+ throw new Error("Wrong input string for convertion");
+ }
+ // #endregion
+
+ // #region Put parsed values at right places
+ var parser_array = parser.exec(dateTimeString);
+ if(parser_array == null)
+ throw new Error("Wrong input string for convertion");
+
+ for(var j = 1; j < parser_array.length; j++)
+ {
+ switch(j)
+ {
+ case 1:
+ this.year = parseInt(parser_array[j], 10);
+ break;
+ case 2:
+ this.month = parseInt(parser_array[j], 10) - 1; // In JavaScript we have month range as "0 - 11"
+ break;
+ case 3:
+ this.day = parseInt(parser_array[j], 10);
+ break;
+ case 4:
+ this.hour = parseInt(parser_array[j], 10) + hourDifference;
+ break;
+ case 5:
+ this.minute = parseInt(parser_array[j], 10) + minuteDifference;
+ break;
+ case 6:
+ this.second = parseInt(parser_array[j], 10);
+ break;
+ default:
+ throw new Error("Wrong input string for convertion");
+ }
+ }
+ // #endregion
+
+ // #region Get final date
+ if(isUTC == false)
+ {
+ var tempDate = new Date(this.year, this.month, this.day, this.hour, this.minute, this.second, this.millisecond);
+
+ this.year = tempDate.getUTCFullYear();
+ this.month = tempDate.getUTCMonth();
+ this.day = tempDate.getUTCDay();
+ this.hour = tempDate.getUTCHours();
+ this.minute = tempDate.getUTCMinutes();
+ this.second = tempDate.getUTCSeconds();
+ this.millisecond = tempDate.getUTCMilliseconds();
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.toString =
+ function()
+ {
+ var output_array = new Array();
+
+ output_array.push(in_window.org.pkijs.padNumber(this.year, 4));
+ output_array.push(in_window.org.pkijs.padNumber(this.month, 2));
+ output_array.push(in_window.org.pkijs.padNumber(this.day, 2));
+ output_array.push(in_window.org.pkijs.padNumber(this.hour, 2));
+ output_array.push(in_window.org.pkijs.padNumber(this.minute, 2));
+ output_array.push(in_window.org.pkijs.padNumber(this.second, 2));
+ if(this.millisecond != 0)
+ {
+ output_array.push(".");
+ output_array.push(in_window.org.pkijs.padNumber(this.millisecond, 3));
+ }
+ output_array.push("Z");
+
+ return output_array.join('');
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "GENERALIZEDTIME";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.VISIBLESTRING.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.GENERALIZEDTIME.prototype.block_name.call(this);
+ _object.year = this.year;
+ _object.month = this.month;
+ _object.day = this.day;
+ _object.hour = this.hour;
+ _object.minute = this.minute;
+ _object.second = this.second;
+ _object.millisecond = this.millisecond;
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.DATE =
+ function()
+ {
+ in_window.org.pkijs.asn1.UTF8STRING.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 31; // DATE
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.DATE.prototype = new in_window.org.pkijs.asn1.UTF8STRING();
+ in_window.org.pkijs.asn1.DATE.constructor = in_window.org.pkijs.asn1.DATE;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.DATE.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "DATE";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.DATE.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.UTF8STRING.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.DATE.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.TIMEOFDAY =
+ function()
+ {
+ in_window.org.pkijs.asn1.UTF8STRING.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 32; // TIMEOFDAY
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.TIMEOFDAY.prototype = new in_window.org.pkijs.asn1.UTF8STRING();
+ in_window.org.pkijs.asn1.TIMEOFDAY.constructor = in_window.org.pkijs.asn1.TIMEOFDAY;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.TIMEOFDAY.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "TIMEOFDAY";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.TIMEOFDAY.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.UTF8STRING.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.TIMEOFDAY.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.DATETIME =
+ function()
+ {
+ in_window.org.pkijs.asn1.UTF8STRING.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 33; // DATETIME
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.DATETIME.prototype = new in_window.org.pkijs.asn1.UTF8STRING();
+ in_window.org.pkijs.asn1.DATETIME.constructor = in_window.org.pkijs.asn1.DATETIME;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.DATETIME.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "DATETIME";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.DATETIME.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.UTF8STRING.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.DATETIME.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.DURATION =
+ function()
+ {
+ in_window.org.pkijs.asn1.UTF8STRING.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 34; // DURATION
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.DURATION.prototype = new in_window.org.pkijs.asn1.UTF8STRING();
+ in_window.org.pkijs.asn1.DURATION.constructor = in_window.org.pkijs.asn1.DURATION;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.DURATION.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "DURATION";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.DURATION.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.UTF8STRING.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.DURATION.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.TIME =
+ function()
+ {
+ in_window.org.pkijs.asn1.UTF8STRING.call(this, arguments[0]);
+
+ this.id_block.tag_class = 1; // UNIVERSAL
+ this.id_block.tag_number = 14; // TIME
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.TIME.prototype = new in_window.org.pkijs.asn1.UTF8STRING();
+ in_window.org.pkijs.asn1.TIME.constructor = in_window.org.pkijs.asn1.TIME;
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.TIME.prototype.block_name =
+ function()
+ {
+ /// <summary>Aux function, need to get a block name. Need to have it here for inhiritence</summary>
+
+ return "TIME";
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.TIME.prototype.toJSON =
+ function()
+ {
+ /// <summary>Convertion for the block to JSON object</summary>
+
+ var _object = in_window.org.pkijs.asn1.UTF8STRING.prototype.toJSON.call(this);
+
+ _object.block_name = in_window.org.pkijs.asn1.TIME.prototype.block_name.call(this);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of special ASN.1 schema type CHOICE
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.CHOICE =
+ function()
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.value = in_window.org.pkijs.getValue(arguments[0], "value", new Array()); // Array of ASN.1 types for make a choice from
+ this.optional = in_window.org.pkijs.getValue(arguments[0], "optional", false);
+ }
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of special ASN.1 schema type ANY
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.ANY =
+ function()
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.name = in_window.org.pkijs.getValue(arguments[0], "name", "");
+ this.optional = in_window.org.pkijs.getValue(arguments[0], "optional", false);
+ }
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of special ASN.1 schema type REPEATED
+ //**************************************************************************************
+ in_window.org.pkijs.asn1.REPEATED =
+ function()
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.name = in_window.org.pkijs.getValue(arguments[0], "name", "");
+ this.optional = in_window.org.pkijs.getValue(arguments[0], "optional", false);
+ this.value = in_window.org.pkijs.getValue(arguments[0], "value", new in_window.org.pkijs.asn1.ANY());
+ this.local = in_window.org.pkijs.getValue(arguments[0], "local", false); // Could local or global array to store elements
+ }
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Major ASN.1 BER decoding function
+ //**************************************************************************************
+ function fromBER_raw(input_buffer, input_offset, input_length)
+ {
+ var incoming_offset = input_offset; // Need to store initial offset since "input_offset" is changing in the function
+
+ // #region Local function changing a type for ASN.1 classes
+ function local_change_type(input_object, new_type)
+ {
+ if(input_object instanceof new_type)
+ return input_object;
+
+ var new_object = new new_type();
+ new_object.id_block = input_object.id_block;
+ new_object.len_block = input_object.len_block;
+ new_object.warnings = input_object.warnings;
+ new_object.value_before_decode = util_copybuf(input_object.value_before_decode);
+
+ return new_object;
+ }
+ // #endregion
+
+ // #region Create a basic ASN.1 type since we need to return errors and warnings from the function
+ var return_object = new in_window.org.pkijs.asn1.ASN1_block();
+ // #endregion
+
+ // #region Basic check for parameters
+ if(check_buffer_params(input_buffer, input_offset, input_length) === false)
+ {
+ return_object.error = "Wrong input parameters";
+ return {
+ offset: (-1),
+ result: return_object
+ };
+ }
+ // #endregion
+
+ // #region Getting Uint8Array from ArrayBuffer
+ var int_buffer = new Uint8Array(input_buffer, input_offset, input_length);
+ // #endregion
+
+ // #region Initial checks
+ if(int_buffer.length == 0)
+ {
+ this.error = "Zero buffer length";
+ return {
+ offset: (-1),
+ result: return_object
+ };
+ }
+ // #endregion
+
+ // #region Decode indentifcation block of ASN.1 BER structure
+ var result_offset = return_object.id_block.fromBER(input_buffer, input_offset, input_length);
+ return_object.warnings.concat(return_object.id_block.warnings);
+ if(result_offset == (-1))
+ {
+ return_object.error = return_object.id_block.error;
+ return {
+ offset: (-1),
+ result: return_object
+ };
+ }
+
+ input_offset = result_offset;
+ input_length -= return_object.id_block.block_length;
+ // #endregion
+
+ // #region Decode length block of ASN.1 BER structure
+ result_offset = return_object.len_block.fromBER(input_buffer, input_offset, input_length);
+ return_object.warnings.concat(return_object.len_block.warnings);
+ if(result_offset == (-1))
+ {
+ return_object.error = return_object.len_block.error;
+ return {
+ offset: (-1),
+ result: return_object
+ };
+ }
+
+ input_offset = result_offset;
+ input_length -= return_object.len_block.block_length;
+ // #endregion
+
+ // #region Check for usign indefinite length form in encoding for primitive types
+ if((return_object.id_block.is_constructed == false) &&
+ (return_object.len_block.is_indefinite_form == true))
+ {
+ return_object.error = new String("Indefinite length form used for primitive encoding form");
+ return {
+ offset: (-1),
+ result: return_object
+ };
+ }
+ // #endregion
+
+ // #region Switch ASN.1 block type
+ var new_asn1_type = in_window.org.pkijs.asn1.ASN1_block;
+
+ switch(return_object.id_block.tag_class)
+ {
+ // #region UNIVERSAL
+ case 1:
+ // #region Check for reserved tag numbers
+ if((return_object.id_block.tag_number >= 37) &&
+ (return_object.id_block.is_hex_only == false))
+ {
+ return_object.error = "UNIVERSAL 37 and upper tags are reserved by ASN.1 standard";
+ return {
+ offset: (-1),
+ result: return_object
+ };
+ }
+ // #endregion
+
+ switch(return_object.id_block.tag_number)
+ {
+ // #region EOC type
+ case 0:
+ // #region Check for EOC type
+ if((return_object.id_block.is_constructed == true) &&
+ (return_object.len_block.length > 0))
+ {
+ return_object.error = "Type [UNIVERSAL 0] is reserved";
+ return {
+ offset: (-1),
+ result: return_object
+ };
+ }
+ // #endregion
+
+ new_asn1_type = in_window.org.pkijs.asn1.EOC;
+
+ break;
+ // #endregion
+ // #region BOOLEAN type
+ case 1:
+ new_asn1_type = in_window.org.pkijs.asn1.BOOLEAN;
+ break;
+ // #endregion
+ // #region INTEGER type
+ case 2:
+ new_asn1_type = in_window.org.pkijs.asn1.INTEGER;
+ break;
+ // #endregion
+ // #region BITSTRING type
+ case 3:
+ new_asn1_type = in_window.org.pkijs.asn1.BITSTRING;
+ break;
+ // #endregion
+ // #region OCTETSTRING type
+ case 4:
+ new_asn1_type = in_window.org.pkijs.asn1.OCTETSTRING;
+ break;
+ // #endregion
+ // #region NULL type
+ case 5:
+ new_asn1_type = in_window.org.pkijs.asn1.NULL;
+ break;
+ // #endregion
+ // #region OBJECT IDENTIFIER type
+ case 6:
+ new_asn1_type = in_window.org.pkijs.asn1.OID;
+ break;
+ // #endregion
+ // #region ENUMERATED type
+ case 10:
+ new_asn1_type = in_window.org.pkijs.asn1.ENUMERATED;
+ break;
+ // #endregion
+ // #region UTF8STRING type
+ case 12:
+ new_asn1_type = in_window.org.pkijs.asn1.UTF8STRING;
+ break;
+ // #endregion
+ // #region TIME type
+ case 14:
+ new_asn1_type = in_window.org.pkijs.asn1.TIME;
+ break;
+ // #endregion
+ // #region ASN.1 reserved type
+ case 15:
+ return_object.error = "[UNIVERSAL 15] is reserved by ASN.1 standard";
+ return {
+ offset: (-1),
+ result: return_object
+ };
+ break;
+ // #endregion
+ // #region SEQUENCE type
+ case 16:
+ new_asn1_type = in_window.org.pkijs.asn1.SEQUENCE;
+ break;
+ // #endregion
+ // #region SET type
+ case 17:
+ new_asn1_type = in_window.org.pkijs.asn1.SET;
+ break;
+ // #endregion
+ // #region NUMERICSTRING type
+ case 18:
+ new_asn1_type = in_window.org.pkijs.asn1.NUMERICSTRING;
+ break;
+ // #endregion
+ // #region PRINTABLESTRING type
+ case 19:
+ new_asn1_type = in_window.org.pkijs.asn1.PRINTABLESTRING;
+ break;
+ // #endregion
+ // #region TELETEXSTRING type
+ case 20:
+ new_asn1_type = in_window.org.pkijs.asn1.TELETEXSTRING;
+ break;
+ // #endregion
+ // #region VIDEOTEXSTRING type
+ case 21:
+ new_asn1_type = in_window.org.pkijs.asn1.VIDEOTEXSTRING;
+ break;
+ // #endregion
+ // #region IA5STRING type
+ case 22:
+ new_asn1_type = in_window.org.pkijs.asn1.IA5STRING;
+ break;
+ // #endregion
+ // #region UTCTIME type
+ case 23:
+ new_asn1_type = in_window.org.pkijs.asn1.UTCTIME;
+ break;
+ // #endregion
+ // #region GENERALIZEDTIME type
+ case 24:
+ new_asn1_type = in_window.org.pkijs.asn1.GENERALIZEDTIME;
+ break;
+ // #endregion
+ // #region GRAPHICSTRING type
+ case 25:
+ new_asn1_type = in_window.org.pkijs.asn1.GRAPHICSTRING;
+ break;
+ // #endregion
+ // #region VISIBLESTRING type
+ case 26:
+ new_asn1_type = in_window.org.pkijs.asn1.VISIBLESTRING;
+ break;
+ // #endregion
+ // #region GENERALSTRING type
+ case 27:
+ new_asn1_type = in_window.org.pkijs.asn1.GENERALSTRING;
+ break;
+ // #endregion
+ // #region UNIVERSALSTRING type
+ case 28:
+ new_asn1_type = in_window.org.pkijs.asn1.UNIVERSALSTRING;
+ break;
+ // #endregion
+ // #region CHARACTERSTRING type
+ case 29:
+ new_asn1_type = in_window.org.pkijs.asn1.CHARACTERSTRING;
+ break;
+ // #endregion
+ // #region BMPSTRING type
+ case 30:
+ new_asn1_type = in_window.org.pkijs.asn1.BMPSTRING;
+ break;
+ // #endregion
+ // #region DATE type
+ case 31:
+ new_asn1_type = in_window.org.pkijs.asn1.DATE;
+ break;
+ // #endregion
+ // #region TIMEOFDAY type
+ case 32:
+ new_asn1_type = in_window.org.pkijs.asn1.TIMEOFDAY;
+ break;
+ // #endregion
+ // #region DATE-TIME type
+ case 33:
+ new_asn1_type = in_window.org.pkijs.asn1.DATETIME;
+ break;
+ // #endregion
+ // #region DURATION type
+ case 34:
+ new_asn1_type = in_window.org.pkijs.asn1.DURATION;
+ break;
+ // #endregion
+ // #region default
+ default:
+ {
+ var new_object;
+
+ if(return_object.id_block.is_constructed == true)
+ new_object = new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED();
+ else
+ new_object = new in_window.org.pkijs.asn1.ASN1_PRIMITIVE();
+
+ new_object.id_block = return_object.id_block;
+ new_object.len_block = return_object.len_block;
+ new_object.warnings = return_object.warnings;
+
+ return_object = new_object;
+
+ result_offset = return_object.fromBER(input_buffer, input_offset, input_length);
+ }
+ // #endregion
+ }
+ break;
+ // #endregion
+ // #region All other tag classes
+ case 2: // APPLICATION
+ case 3: // CONTEXT-SPECIFIC
+ case 4: // PRIVATE
+ default:
+ {
+ if(return_object.id_block.is_constructed == true)
+ new_asn1_type = in_window.org.pkijs.asn1.ASN1_CONSTRUCTED;
+ else
+ new_asn1_type = in_window.org.pkijs.asn1.ASN1_PRIMITIVE;
+ }
+ // #endregion
+ }
+ // #endregion
+
+ // #region Change type and perform BER decoding
+ return_object = local_change_type(return_object, new_asn1_type);
+ result_offset = return_object.fromBER(input_buffer, input_offset, (return_object.len_block.is_indefinite_form == true) ? input_length : return_object.len_block.length);
+ // #endregion
+
+ // #region Coping incoming buffer for entire ASN.1 block
+ return_object.value_before_decode = util_copybuf_offset(input_buffer, incoming_offset, return_object.block_length);
+ // #endregion
+
+ return {
+ offset: result_offset,
+ result: return_object
+ };
+ }
+ //**************************************************************************************
+ in_window.org.pkijs.fromBER =
+ function(input_buffer)
+ {
+ /// <summary>Major function for decoding ASN.1 BER array into internal library structuries</summary>
+ /// <param name="input_buffer" type="ArrayBuffer">ASN.1 BER encoded array of bytes</param>
+
+ if(input_buffer.byteLength == 0)
+ {
+ var result = new in_window.org.pkijs.asn1.ASN1_block();
+ result.error = "Input buffer has zero length";
+
+ return {
+ offset: (-1),
+ result: result
+ };
+ }
+
+ return fromBER_raw(input_buffer, 0, input_buffer.byteLength);
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Major scheme verification function
+ //**************************************************************************************
+ in_window.org.pkijs.compareSchema =
+ function(root, input_asn1_data, input_asn1_schema)
+ {
+ // #region Special case for CHOICE schema element type
+ if(input_asn1_schema instanceof in_window.org.pkijs.asn1.CHOICE)
+ {
+ var choice_result = false;
+
+ for(var j = 0; j < input_asn1_schema.value.length; j++)
+ {
+ var result = in_window.org.pkijs.compareSchema(root, input_asn1_data, input_asn1_schema.value[j]);
+ if(result.verified === true)
+ return {
+ verified: true,
+ result: root
+ };
+ }
+
+ if(choice_result === false)
+ {
+ var _result = {
+ verified: false,
+ result: {
+ error: "Wrong values for CHOICE type"
+ }
+ };
+
+ if(input_asn1_schema.hasOwnProperty('name'))
+ _result.name = input_asn1_schema.name;
+
+ return _result;
+ }
+ }
+ // #endregion
+
+ // #region Special case for ANY schema element type
+ if(input_asn1_schema instanceof in_window.org.pkijs.asn1.ANY)
+ {
+ // #region Add named component of ASN.1 schema
+ if(input_asn1_schema.hasOwnProperty('name'))
+ root[input_asn1_schema.name] = input_asn1_data;
+ // #endregion
+
+ return {
+ verified: true,
+ result: root
+ };
+ }
+ // #endregion
+
+ // #region Initial check
+ if((root instanceof Object) === false)
+ return {
+ verified: false,
+ result: { error: "Wrong root object" }
+ };
+
+ if((input_asn1_data instanceof Object) === false)
+ return {
+ verified: false,
+ result: { error: "Wrong ASN.1 data" }
+ };
+
+ if((input_asn1_schema instanceof Object) === false)
+ return {
+ verified: false,
+ result: { error: "Wrong ASN.1 schema" }
+ };
+
+ if(('id_block' in input_asn1_schema) === false)
+ return {
+ verified: false,
+ result: { error: "Wrong ASN.1 schema" }
+ };
+ // #endregion
+
+ // #region Comparing id_block properties in ASN.1 data and ASN.1 schema
+ // #region Encode and decode ASN.1 schema id_block
+ /// <remarks>This encoding/decoding is neccessary because could be an errors in schema definition</remarks>
+ if(('fromBER' in input_asn1_schema.id_block) === false)
+ return {
+ verified: false,
+ result: { error: "Wrong ASN.1 schema" }
+ };
+
+ if(('toBER' in input_asn1_schema.id_block) === false)
+ return {
+ verified: false,
+ result: { error: "Wrong ASN.1 schema" }
+ };
+
+ var encoded_id = input_asn1_schema.id_block.toBER(false);
+ if(encoded_id.byteLength === 0)
+ return {
+ verified: false,
+ result: { error: "Error encoding id_block for ASN.1 schema" }
+ };
+
+ var decoded_offset = input_asn1_schema.id_block.fromBER(encoded_id, 0, encoded_id.byteLength);
+ if(decoded_offset === (-1))
+ return {
+ verified: false,
+ result: { error: "Error decoding id_block for ASN.1 schema" }
+ };
+ // #endregion
+
+ // #region tag_class
+ if(input_asn1_schema.id_block.hasOwnProperty('tag_class') === false)
+ return {
+ verified: false,
+ result: { error: "Wrong ASN.1 schema" }
+ };
+
+ if(input_asn1_schema.id_block.tag_class !== input_asn1_data.id_block.tag_class)
+ return {
+ verified: false,
+ result: root
+ };
+ // #endregion
+ // #region tag_number
+ if(input_asn1_schema.id_block.hasOwnProperty('tag_number') === false)
+ return {
+ verified: false,
+ result: { error: "Wrong ASN.1 schema" }
+ };
+
+ if(input_asn1_schema.id_block.tag_number !== input_asn1_data.id_block.tag_number)
+ return {
+ verified: false,
+ result: root
+ };
+ // #endregion
+ // #region is_constructed
+ if(input_asn1_schema.id_block.hasOwnProperty('is_constructed') === false)
+ return {
+ verified: false,
+ result: { error: "Wrong ASN.1 schema" }
+ };
+
+ if(input_asn1_schema.id_block.is_constructed !== input_asn1_data.id_block.is_constructed)
+ return {
+ verified: false,
+ result: root
+ };
+ // #endregion
+ // #region is_hex_only
+ if(('is_hex_only' in input_asn1_schema.id_block) === false) // Since 'is_hex_only' is an inhirited property
+ return {
+ verified: false,
+ result: { error: "Wrong ASN.1 schema" }
+ };
+
+ if(input_asn1_schema.id_block.is_hex_only !== input_asn1_data.id_block.is_hex_only)
+ return {
+ verified: false,
+ result: root
+ };
+ // #endregion
+ // #region value_hex
+ if(input_asn1_schema.id_block.is_hex_only === true)
+ {
+ if(('value_hex' in input_asn1_schema.id_block) === false) // Since 'value_hex' is an inhirited property
+ return {
+ verified: false,
+ result: { error: "Wrong ASN.1 schema" }
+ };
+
+ var schema_view = new Uint8Array(input_asn1_schema.id_block.value_hex);
+ var asn1_view = new Uint8Array(input_asn1_data.id_block.value_hex);
+
+ if(schema_view.length !== asn1_view.length)
+ return {
+ verified: false,
+ result: root
+ };
+
+ for(var i = 0; i < schema_view.length; i++)
+ {
+ if(schema_view[i] !== asn1_view[1])
+ return {
+ verified: false,
+ result: root
+ };
+ }
+ }
+ // #endregion
+ // #endregion
+
+ // #region Add named component of ASN.1 schema
+ if(input_asn1_schema.hasOwnProperty('name'))
+ {
+ input_asn1_schema.name = input_asn1_schema.name.replace(/^\s+|\s+$/g, '');
+ if(input_asn1_schema.name !== "")
+ root[input_asn1_schema.name] = input_asn1_data;
+ }
+ // #endregion
+
+ // #region Getting next ASN.1 block for comparition
+ if(input_asn1_schema.id_block.is_constructed === true)
+ {
+ var admission = 0;
+ var result = { verified: false };
+
+ var max_length = input_asn1_schema.value_block.value.length;
+
+ if(max_length > 0)
+ {
+ if(input_asn1_schema.value_block.value[0] instanceof in_window.org.pkijs.asn1.REPEATED)
+ max_length = input_asn1_data.value_block.value.length;
+ }
+
+ // #region Special case when constructive value has no elements
+ if(max_length === 0)
+ return {
+ verified: true,
+ result: root
+ };
+ // #endregion
+
+ // #region Special case when "input_asn1_data" has no values and "input_asn1_schema" has all optional values
+ if((input_asn1_data.value_block.value.length === 0) &&
+ (input_asn1_schema.value_block.value.length !== 0))
+ {
+ var _optional = true;
+
+ for(var i = 0; i < input_asn1_schema.value_block.value.length; i++)
+ _optional = _optional && (input_asn1_schema.value_block.value[i].optional || false);
+
+ if(_optional === true)
+ {
+ return {
+ verified: true,
+ result: root
+ };
+ }
+ else
+ {
+ // #region Delete early added name of block
+ if(input_asn1_schema.hasOwnProperty('name'))
+ {
+ input_asn1_schema.name = input_asn1_schema.name.replace(/^\s+|\s+$/g, '');
+ if(input_asn1_schema.name !== "")
+ delete root[input_asn1_schema.name];
+ }
+ // #endregion
+
+ root.error = "Inconsistent object length";
+
+ return {
+ verified: false,
+ result: root
+ };
+ }
+ }
+ // #endregion
+
+ for(var i = 0; i < max_length; i++)
+ {
+ // #region Special case when there is an "optional" element of ASN.1 schema at the end
+ if((i - admission) >= input_asn1_data.value_block.value.length)
+ {
+ if(input_asn1_schema.value_block.value[i].optional === false)
+ {
+ var _result = {
+ verified: false,
+ result: root
+ };
+
+ root.error = "Inconsistent length between ASN.1 data and schema";
+
+ // #region Delete early added name of block
+ if(input_asn1_schema.hasOwnProperty('name'))
+ {
+ input_asn1_schema.name = input_asn1_schema.name.replace(/^\s+|\s+$/g, '');
+ if(input_asn1_schema.name !== "")
+ {
+ delete root[input_asn1_schema.name];
+ _result.name = input_asn1_schema.name;
+ }
+ }
+ // #endregion
+
+ return _result;
+ }
+ }
+ // #endregion
+ else
+ {
+ // #region Special case for REPEATED type of ASN.1 schema element
+ if(input_asn1_schema.value_block.value[0] instanceof in_window.org.pkijs.asn1.REPEATED)
+ {
+ result = in_window.org.pkijs.compareSchema(root, input_asn1_data.value_block.value[i], input_asn1_schema.value_block.value[0].value);
+ if(result.verified === false)
+ {
+ if(input_asn1_schema.value_block.value[0].optional === true)
+ admission++;
+ else
+ {
+ // #region Delete early added name of block
+ if(input_asn1_schema.hasOwnProperty('name'))
+ {
+ input_asn1_schema.name = input_asn1_schema.name.replace(/^\s+|\s+$/g, '');
+ if(input_asn1_schema.name !== "")
+ delete root[input_asn1_schema.name];
+ }
+ // #endregion
+
+ return result;
+ }
+ }
+
+ if(("name" in input_asn1_schema.value_block.value[0]) && (input_asn1_schema.value_block.value[0].name.length > 0))
+ {
+ var array_root = {};
+
+ if(("local" in input_asn1_schema.value_block.value[0]) && (input_asn1_schema.value_block.value[0].local === true))
+ array_root = input_asn1_data;
+ else
+ array_root = root;
+
+ if(typeof array_root[input_asn1_schema.value_block.value[0].name] === "undefined")
+ array_root[input_asn1_schema.value_block.value[0].name] = new Array();
+
+ array_root[input_asn1_schema.value_block.value[0].name].push(input_asn1_data.value_block.value[i]);
+ }
+ }
+ // #endregion
+ else
+ {
+ result = in_window.org.pkijs.compareSchema(root, input_asn1_data.value_block.value[i - admission], input_asn1_schema.value_block.value[i]);
+ if(result.verified === false)
+ {
+ if(input_asn1_schema.value_block.value[i].optional === true)
+ admission++;
+ else
+ {
+ // #region Delete early added name of block
+ if(input_asn1_schema.hasOwnProperty('name'))
+ {
+ input_asn1_schema.name = input_asn1_schema.name.replace(/^\s+|\s+$/g, '');
+ if(input_asn1_schema.name !== "")
+ delete root[input_asn1_schema.name];
+ }
+ // #endregion
+
+ return result;
+ }
+ }
+ }
+ }
+ }
+
+ if(result.verified === false) // The situation may take place if last element is "optional" and verification failed
+ {
+ var _result = {
+ verified: false,
+ result: root
+ };
+
+ // #region Delete early added name of block
+ if(input_asn1_schema.hasOwnProperty('name'))
+ {
+ input_asn1_schema.name = input_asn1_schema.name.replace(/^\s+|\s+$/g, '');
+ if(input_asn1_schema.name !== "")
+ {
+ delete root[input_asn1_schema.name];
+ _result.name = input_asn1_schema.name;
+ }
+ }
+ // #endregion
+
+ return _result;
+ }
+
+ return {
+ verified: true,
+ result: root
+ };
+ }
+ // #endregion
+ // #region Ability to parse internal value for primitive-encoded value (value of OCTETSTRING, for example)
+ else
+ {
+ if( ("primitive_schema" in input_asn1_schema) &&
+ ("value_hex" in input_asn1_data.value_block) )
+ {
+ // #region Decoding of raw ASN.1 data
+ var asn1 = in_window.org.pkijs.fromBER(input_asn1_data.value_block.value_hex);
+ if(asn1.offset === (-1))
+ {
+ var _result = {
+ verified: false,
+ result: asn1.result
+ };
+
+ // #region Delete early added name of block
+ if(input_asn1_schema.hasOwnProperty('name'))
+ {
+ input_asn1_schema.name = input_asn1_schema.name.replace(/^\s+|\s+$/g, '');
+ if(input_asn1_schema.name !== "")
+ {
+ delete root[input_asn1_schema.name];
+ _result.name = input_asn1_schema.name;
+ }
+ }
+ // #endregion
+
+ return _result;
+ }
+ // #endregion
+
+ return in_window.org.pkijs.compareSchema(root, asn1.result, input_asn1_schema.primitive_schema);
+ }
+ else
+ return {
+ verified: true,
+ result: root
+ };
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.verifySchema =
+ function(input_buffer, input_schema)
+ {
+ // #region Initial check
+ if((input_schema instanceof Object) === false)
+ return {
+ verified: false,
+ result: { error: "Wrong ASN.1 schema type" }
+ };
+ // #endregion
+
+ // #region Decoding of raw ASN.1 data
+ var asn1 = in_window.org.pkijs.fromBER(input_buffer);
+ if(asn1.offset === (-1))
+ return {
+ verified: false,
+ result: asn1.result
+ };
+ // #endregion
+
+ // #region Compare ASN.1 struct with input schema
+ return in_window.org.pkijs.compareSchema(asn1.result, asn1.result, input_schema);
+ // #endregion
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Major function converting JSON to ASN.1 objects
+ //**************************************************************************************
+ in_window.org.pkijs.fromJSON =
+ function(json)
+ {
+ /// <summary>Converting from JSON to ASN.1 objects</summary>
+ /// <param name="json" type="String|Object">JSON string or object to convert to ASN.1 objects</param>
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+}
+)(typeof exports !== "undefined" ? exports : window); \ No newline at end of file
diff --git a/dom/webauthn/tests/pkijs/common.js b/dom/webauthn/tests/pkijs/common.js
new file mode 100644
index 0000000000..1bc9eda7f8
--- /dev/null
+++ b/dom/webauthn/tests/pkijs/common.js
@@ -0,0 +1,1542 @@
+/*
+ * Copyright (c) 2014, GMO GlobalSign
+ * Copyright (c) 2015, Peculiar Ventures
+ * All rights reserved.
+ *
+ * Author 2014-2015, Yury Strozhevsky <www.strozhevsky.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ * may be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ */
+(
+function(in_window)
+{
+ //**************************************************************************************
+ // #region Declaration of global variables
+ //**************************************************************************************
+ // #region "org" namespace
+ if(typeof in_window.org === "undefined")
+ in_window.org = {};
+ else
+ {
+ if(typeof in_window.org !== "object")
+ throw new Error("Name org already exists and it's not an object");
+ }
+ // #endregion
+
+ // #region "org.pkijs" namespace
+ if(typeof in_window.org.pkijs === "undefined")
+ in_window.org.pkijs = {};
+ else
+ {
+ if(typeof in_window.org.pkijs !== "object")
+ throw new Error("Name org.pkijs already exists and it's not an object" + " but " + (typeof in_window.org.pkijs));
+ }
+ // #endregion
+
+ // #region "local" namespace
+ var local = {};
+ // #endregion
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Settings for "crypto engine"
+ //**************************************************************************************
+ local.engine = {
+ name: "none",
+ crypto: null,
+ subtle: null
+ };
+
+ if(typeof window != "undefined")
+ {
+ if("crypto" in window)
+ {
+ var engineName = "webcrypto";
+ var cryptoObject = window.crypto;
+ var subtleObject = null;
+
+ // Apple Safari support
+ if("webkitSubtle" in window.crypto)
+ subtleObject = window.crypto.webkitSubtle;
+
+ if("subtle" in window.crypto)
+ subtleObject = window.crypto.subtle;
+
+ local.engine = {
+ name: engineName,
+ crypto: cryptoObject,
+ subtle: subtleObject
+ };
+ }
+ }
+ //**************************************************************************************
+ in_window.org.pkijs.setEngine =
+ function(name, crypto, subtle)
+ {
+ /// <summary>Setting the global "crypto engine" parameters</summary>
+ /// <param name="name" type="String">Auxiliary name for "crypto engine"</param>
+ /// <param name="crypto" type="Object">Object handling all root cryptographic requests (in fact currently it must handle only "getRandomValues")</param>
+ /// <param name="subtle" type="Object">Object handling all main cryptographic requests</param>
+
+ local.engine = {
+ name: name,
+ crypto: crypto,
+ subtle: subtle
+ };
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.getEngine =
+ function()
+ {
+ return local.engine;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Declaration of common functions
+ //**************************************************************************************
+ in_window.org.pkijs.emptyObject =
+ function()
+ {
+ this.toJSON = function()
+ {
+ return {};
+ };
+ this.toSchema = function()
+ {
+ return {};
+ };
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.getNames =
+ function(arg)
+ {
+ /// <summary>Get correct "names" array for all "schema" objects</summary>
+
+ var names = {};
+
+ if(arg instanceof Object)
+ names = (arg.names || {});
+
+ return names;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.inheriteObjectFields =
+ function(from)
+ {
+ for(var i in from.prototype)
+ {
+ if(typeof from.prototype[i] === "function")
+ continue;
+
+ this[i] = from.prototype[i];
+ }
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.getUTCDate =
+ function(date)
+ {
+ /// <summary>Making UTC date from local date</summary>
+ /// <param name="date" type="Date">Date to convert from</param>
+
+ var current_date = date;
+ return new Date(current_date.getTime() + (current_date.getTimezoneOffset() * 60000));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.padNumber =
+ function(input_number, full_length)
+ {
+ var str = input_number.toString(10);
+ var dif = full_length - str.length;
+
+ var padding = new Array(dif);
+ for(var i = 0; i < dif; i++)
+ padding[i] = '0';
+
+ var padding_string = padding.join('');
+
+ return padding_string.concat(str);
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.getValue =
+ function(args, item, default_value)
+ {
+ if(item in args)
+ return args[item];
+ else
+ return default_value;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.isEqual_view =
+ function(input_view1, input_view2)
+ {
+ /// <summary>Compare two Uint8Arrays</summary>
+ /// <param name="input_view1" type="Uint8Array">First Uint8Array for comparision</param>
+ /// <param name="input_view2" type="Uint8Array">Second Uint8Array for comparision</param>
+
+ if(input_view1.length !== input_view2.length)
+ return false;
+
+ for(var i = 0; i < input_view1.length; i++)
+ {
+ if(input_view1[i] != input_view2[i])
+ return false;
+ }
+
+ return true;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.isEqual_buffer =
+ function(input_buffer1, input_buffer2)
+ {
+ /// <summary>Compare two array buffers</summary>
+ /// <param name="input_buffer1" type="ArrayBuffer">First ArrayBuffer for comparision</param>
+ /// <param name="input_buffer2" type="ArrayBuffer">Second ArrayBuffer for comparision</param>
+
+ if(input_buffer1.byteLength != input_buffer2.byteLength)
+ return false;
+
+ var view1 = new Uint8Array(input_buffer1);
+ var view2 = new Uint8Array(input_buffer2);
+
+ return in_window.org.pkijs.isEqual_view(view1, view2);
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.concat_buffers =
+ function(input_buf1, input_buf2)
+ {
+ /// <summary>Concatenate two ArrayBuffers</summary>
+ /// <param name="input_buf1" type="ArrayBuffer">First ArrayBuffer (first part of concatenated array)</param>
+ /// <param name="input_buf2" type="ArrayBuffer">Second ArrayBuffer (second part of concatenated array)</param>
+
+ var input_view1 = new Uint8Array(input_buf1);
+ var input_view2 = new Uint8Array(input_buf2);
+
+ var ret_buf = new ArrayBuffer(input_buf1.byteLength + input_buf2.byteLength);
+ var ret_view = new Uint8Array(ret_buf);
+
+ for(var i = 0; i < input_buf1.byteLength; i++)
+ ret_view[i] = input_view1[i];
+
+ for(var j = 0; j < input_buf2.byteLength; j++)
+ ret_view[input_buf1.byteLength + j] = input_view2[j];
+
+ return ret_buf;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.copyBuffer =
+ function(input_buffer)
+ {
+ var result = new ArrayBuffer(input_buffer.byteLength);
+
+ var resultView = new Uint8Array(result);
+ var inputView = new Uint8Array(input_buffer);
+
+ for(var i = 0; i < inputView.length; i++)
+ resultView[i] = inputView[i];
+
+ return result;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.getCrypto =
+ function()
+ {
+ var crypto_temp;
+
+ if(local.engine.subtle !== null)
+ crypto_temp = local.engine.subtle;
+
+ return crypto_temp;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.stringPrep =
+ function(input_string)
+ {
+ /// <summary>String preparation function. In a future here will be realization of algorithm from RFC4518.</summary>
+ /// <param name="input_string" type="String">JavaScript string. As soon as for each ASN.1 string type we have a specific transformation function here we will work with pure JavaScript string</param>
+ /// <returns type="String">Formated string</returns>
+
+ var result = input_string.replace(/^\s+|\s+$/g, ""); // Trim input string
+ result = result.replace(/\s+/g, " "); // Change all sequence of SPACE down to SPACE char
+ result = result.toLowerCase();
+
+ return result;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.bufferToHexCodes =
+ function(input_buffer, input_offset, input_lenght)
+ {
+ var result = "";
+
+ var int_buffer = new Uint8Array(input_buffer, input_offset, input_lenght);
+
+ for(var i = 0; i < int_buffer.length; i++)
+ {
+ var str = int_buffer[i].toString(16).toUpperCase();
+ result = result + ((str.length === 1) ? "0" : "") + str;
+ }
+
+ return result;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.bufferFromHexCodes =
+ function(hexString)
+ {
+ /// <summary>Create an ArrayBuffer from string having hexdecimal codes</summary>
+ /// <param name="hexString" type="String">String to create ArrayBuffer from</param>
+
+ // #region Initial variables
+ var stringLength = hexString.length;
+
+ var resultBuffer = new ArrayBuffer(stringLength >> 1);
+ var resultView = new Uint8Array(resultBuffer);
+
+ var hex_map = {};
+
+ hex_map['0'] = 0x00;
+ hex_map['1'] = 0x01;
+ hex_map['2'] = 0x02;
+ hex_map['3'] = 0x03;
+ hex_map['4'] = 0x04;
+ hex_map['5'] = 0x05;
+ hex_map['6'] = 0x06;
+ hex_map['7'] = 0x07;
+ hex_map['8'] = 0x08;
+ hex_map['9'] = 0x09;
+ hex_map['A'] = 0x0A;
+ hex_map['a'] = 0x0A;
+ hex_map['B'] = 0x0B;
+ hex_map['b'] = 0x0B;
+ hex_map['C'] = 0x0C;
+ hex_map['c'] = 0x0C;
+ hex_map['D'] = 0x0D;
+ hex_map['d'] = 0x0D;
+ hex_map['E'] = 0x0E;
+ hex_map['e'] = 0x0E;
+ hex_map['F'] = 0x0F;
+ hex_map['f'] = 0x0F;
+
+ var j = 0;
+ var temp = 0x00;
+ // #endregion
+
+ // #region Convert char-by-char
+ for(var i = 0; i < stringLength; i++)
+ {
+ if(!(i % 2))
+ temp = hex_map[hexString.charAt(i)] << 4;
+ else
+ {
+ temp |= hex_map[hexString.charAt(i)];
+
+ resultView[j] = temp;
+ j++;
+ }
+ }
+ // #endregion
+
+ return resultBuffer;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.getRandomValues =
+ function(view)
+ {
+ /// <param name="view" type="Uint8Array">New array which gives a length for random value</param>
+
+ if(local.engine.crypto !== null)
+ return local.engine.crypto.getRandomValues(view);
+ else
+ throw new Error("No support for Web Cryptography API");
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.getAlgorithmParameters =
+ function(algorithmName, operation)
+ {
+ /// <param name="algorithmName" type="String">Algorithm name to get common parameters for</param>
+ /// <param name="operation" type="String">Kind of operation: "sign", "encrypt", "generatekey", "importkey", "exportkey", "verify"</param>
+
+ var result = {
+ algorithm: {},
+ usages: []
+ };
+
+ switch(algorithmName.toUpperCase())
+ {
+ case "RSASSA-PKCS1-V1_5":
+ switch(operation.toLowerCase())
+ {
+ case "generatekey":
+ result = {
+ algorithm: {
+ name: "RSASSA-PKCS1-v1_5",
+ modulusLength: 2048,
+ publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+ hash: {
+ name: "SHA-256"
+ }
+ },
+ usages: ["sign", "verify"]
+ };
+ break;
+ case "verify":
+ case "sign":
+ case "importkey":
+ result = {
+ algorithm: {
+ name: "RSASSA-PKCS1-v1_5",
+ hash: {
+ name: "SHA-256"
+ }
+ },
+ usages: ["verify"] // For importKey("pkcs8") usage must be "sign" only
+ };
+ break;
+ case "exportkey":
+ default:
+ return {
+ algorithm: {
+ name: "RSASSA-PKCS1-v1_5"
+ },
+ usages: []
+ };
+ }
+ break;
+ case "RSA-PSS":
+ switch(operation.toLowerCase())
+ {
+ case "sign":
+ case "verify":
+ result = {
+ algorithm: {
+ name: "RSA-PSS",
+ hash: {
+ name: "SHA-1"
+ },
+ saltLength: 20
+ },
+ usages: ["sign", "verify"]
+ };
+ break;
+ case "generatekey":
+ result = {
+ algorithm: {
+ name: "RSA-PSS",
+ modulusLength: 2048,
+ publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+ hash: {
+ name: "SHA-1"
+ }
+ },
+ usages: ["sign", "verify"]
+ };
+ break;
+ case "importkey":
+ result = {
+ algorithm: {
+ name: "RSA-PSS",
+ hash: {
+ name: "SHA-1"
+ }
+ },
+ usages: ["verify"] // For importKey("pkcs8") usage must be "sign" only
+ };
+ break;
+ case "exportkey":
+ default:
+ return {
+ algorithm: {
+ name: "RSA-PSS"
+ },
+ usages: []
+ };
+ }
+ break;
+ case "RSA-OAEP":
+ switch(operation.toLowerCase())
+ {
+ case "encrypt":
+ case "decrypt":
+ result = {
+ algorithm: {
+ name: "RSA-OAEP"
+ },
+ usages: ["encrypt", "decrypt"]
+ };
+ break;
+ break;
+ case "generatekey":
+ result = {
+ algorithm: {
+ name: "RSA-OAEP",
+ modulusLength: 2048,
+ publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+ hash: {
+ name: "SHA-256"
+ }
+ },
+ usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
+ };
+ break;
+ case "importkey":
+ result = {
+ algorithm: {
+ name: "RSA-OAEP",
+ hash: {
+ name: "SHA-256"
+ }
+ },
+ usages: ["encrypt"] // encrypt for "spki" and decrypt for "pkcs8"
+ };
+ break;
+ case "exportkey":
+ default:
+ return {
+ algorithm: {
+ name: "RSA-OAEP"
+ },
+ usages: []
+ };
+ }
+ break;
+ case "ECDSA":
+ switch(operation.toLowerCase())
+ {
+ case "generatekey":
+ result = {
+ algorithm: {
+ name: "ECDSA",
+ namedCurve: "P-256"
+ },
+ usages: ["sign", "verify"]
+ };
+ break;
+ case "importkey":
+ result = {
+ algorithm: {
+ name: "ECDSA",
+ namedCurve: "P-256"
+ },
+ usages: ["verify"] // "sign" for "pkcs8"
+ };
+ break;
+ case "verify":
+ case "sign":
+ result = {
+ algorithm: {
+ name: "ECDSA",
+ hash: {
+ name: "SHA-256"
+ }
+ },
+ usages: ["sign"]
+ };
+ break;
+ default:
+ return {
+ algorithm: {
+ name: "ECDSA"
+ },
+ usages: []
+ };
+ }
+ break;
+ case "ECDH":
+ switch(operation.toLowerCase())
+ {
+ case "exportkey":
+ case "importkey":
+ case "generatekey":
+ result = {
+ algorithm: {
+ name: "ECDH",
+ namedCurve: "P-256"
+ },
+ usages: ["deriveKey", "deriveBits"]
+ };
+ break;
+ case "derivekey":
+ case "derivebits":
+ result = {
+ algorithm: {
+ name: "ECDH",
+ namedCurve: "P-256",
+ public: [] // Must be a "publicKey"
+ },
+ usages: ["encrypt", "decrypt"]
+ };
+ break;
+ default:
+ return {
+ algorithm: {
+ name: "ECDH"
+ },
+ usages: []
+ };
+ }
+ break;
+ case "AES-CTR":
+ switch(operation.toLowerCase())
+ {
+ case "importkey":
+ case "exportkey":
+ case "generatekey":
+ result = {
+ algorithm: {
+ name: "AES-CTR",
+ length: 256
+ },
+ usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
+ };
+ break;
+ case "decrypt":
+ case "encrypt":
+ result = {
+ algorithm: {
+ name: "AES-CTR",
+ counter: new Uint8Array(16),
+ length: 10
+ },
+ usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
+ };
+ break;
+ default:
+ return {
+ algorithm: {
+ name: "AES-CTR"
+ },
+ usages: []
+ };
+ }
+ break;
+ case "AES-CBC":
+ switch(operation.toLowerCase())
+ {
+ case "importkey":
+ case "exportkey":
+ case "generatekey":
+ result = {
+ algorithm: {
+ name: "AES-CBC",
+ length: 256
+ },
+ usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
+ };
+ break;
+ case "decrypt":
+ case "encrypt":
+ result = {
+ algorithm: {
+ name: "AES-CBC",
+ iv: in_window.org.pkijs.getRandomValues(new Uint8Array(16)) // For "decrypt" the value should be replaced with value got on "encrypt" step
+ },
+ usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
+ };
+ break;
+ default:
+ return {
+ algorithm: {
+ name: "AES-CBC"
+ },
+ usages: []
+ };
+ }
+ break;
+ case "AES-GCM":
+ switch(operation.toLowerCase())
+ {
+ case "importkey":
+ case "exportkey":
+ case "generatekey":
+ result = {
+ algorithm: {
+ name: "AES-GCM",
+ length: 256
+ },
+ usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
+ };
+ break;
+ case "decrypt":
+ case "encrypt":
+ result = {
+ algorithm: {
+ name: "AES-GCM",
+ iv: in_window.org.pkijs.getRandomValues(new Uint8Array(16)) // For "decrypt" the value should be replaced with value got on "encrypt" step
+ },
+ usages: ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
+ };
+ break;
+ default:
+ return {
+ algorithm: {
+ name: "AES-GCM"
+ },
+ usages: []
+ };
+ }
+ break;
+ case "AES-KW":
+ switch(operation.toLowerCase())
+ {
+ case "importkey":
+ case "exportkey":
+ case "generatekey":
+ case "wrapkey":
+ case "unwrapkey":
+ result = {
+ algorithm: {
+ name: "AES-KW",
+ length: 256
+ },
+ usages: ["wrapKey", "unwrapKey"]
+ };
+ break;
+ default:
+ return {
+ algorithm: {
+ name: "AES-KW"
+ },
+ usages: []
+ };
+ }
+ break;
+ case "HMAC":
+ switch(operation.toLowerCase())
+ {
+ case "sign":
+ case "verify":
+ result = {
+ algorithm: {
+ name: "HMAC"
+ },
+ usages: ["sign", "verify"]
+ };
+ break;
+ case "importkey":
+ case "exportkey":
+ case "generatekey":
+ result = {
+ algorithm: {
+ name: "HMAC",
+ length: 32,
+ hash: {
+ name: "SHA-256"
+ }
+ },
+ usages: ["sign", "verify"]
+ };
+ break;
+ default:
+ return {
+ algorithm: {
+ name: "HMAC"
+ },
+ usages: []
+ };
+ }
+ break;
+ case "HKDF":
+ switch(operation.toLowerCase())
+ {
+ case "derivekey":
+ result = {
+ algorithm: {
+ name: "HKDF",
+ hash: "SHA-256",
+ salt: new Uint8Array(),
+ info: new Uint8Array()
+ },
+ usages: ["encrypt", "decrypt"]
+ };
+ break;
+ default:
+ return {
+ algorithm: {
+ name: "HKDF"
+ },
+ usages: []
+ };
+ }
+ break;
+ case "PBKDF2":
+ switch(operation.toLowerCase())
+ {
+ case "derivekey":
+ result = {
+ algorithm: {
+ name: "PBKDF2",
+ hash: { name: "SHA-256" },
+ salt: new Uint8Array(),
+ iterations: 1000
+ },
+ usages: ["encrypt", "decrypt"]
+ };
+ break;
+ default:
+ return {
+ algorithm: {
+ name: "PBKDF2"
+ },
+ usages: []
+ };
+ }
+ break;
+ default:
+ }
+
+ return result;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.getOIDByAlgorithm =
+ function(algorithm)
+ {
+ /// <summary>Get OID for each specific WebCrypto algorithm</summary>
+ /// <param name="algorithm" type="Object">WebCrypto algorithm</param>
+
+ var result = "";
+
+ switch(algorithm.name.toUpperCase())
+ {
+ case "RSASSA-PKCS1-V1_5":
+ switch(algorithm.hash.name.toUpperCase())
+ {
+ case "SHA-1":
+ result = "1.2.840.113549.1.1.5";
+ break;
+ case "SHA-256":
+ result = "1.2.840.113549.1.1.11";
+ break;
+ case "SHA-384":
+ result = "1.2.840.113549.1.1.12";
+ break;
+ case "SHA-512":
+ result = "1.2.840.113549.1.1.13";
+ break;
+ default:
+ }
+ break;
+ case "RSA-PSS":
+ result = "1.2.840.113549.1.1.10";
+ break;
+ case "RSA-OAEP":
+ result = "1.2.840.113549.1.1.7";
+ break;
+ case "ECDSA":
+ switch(algorithm.hash.name.toUpperCase())
+ {
+ case "SHA-1":
+ result = "1.2.840.10045.4.1";
+ break;
+ case "SHA-256":
+ result = "1.2.840.10045.4.3.2";
+ break;
+ case "SHA-384":
+ result = "1.2.840.10045.4.3.3";
+ break;
+ case "SHA-512":
+ result = "1.2.840.10045.4.3.4";
+ break;
+ default:
+ }
+ break;
+ case "ECDH":
+ switch(algorithm.kdf.toUpperCase()) // Non-standard addition - hash algorithm of KDF function
+ {
+ case "SHA-1":
+ result = "1.3.133.16.840.63.0.2"; // dhSinglePass-stdDH-sha1kdf-scheme
+ break;
+ case "SHA-256":
+ result = "1.3.132.1.11.1"; // dhSinglePass-stdDH-sha256kdf-scheme
+ break;
+ case "SHA-384":
+ result = "1.3.132.1.11.2"; // dhSinglePass-stdDH-sha384kdf-scheme
+ break;
+ case "SHA-512":
+ result = "1.3.132.1.11.3"; // dhSinglePass-stdDH-sha512kdf-scheme
+ break;
+ default:
+ }
+ break;
+ case "AES-CTR":
+ break;
+ case "AES-CBC":
+ switch(algorithm.length)
+ {
+ case 128:
+ result = "2.16.840.1.101.3.4.1.2";
+ break;
+ case 192:
+ result = "2.16.840.1.101.3.4.1.22";
+ break;
+ case 256:
+ result = "2.16.840.1.101.3.4.1.42";
+ break;
+ default:
+ }
+ break;
+ case "AES-CMAC":
+ break;
+ case "AES-GCM":
+ switch(algorithm.length)
+ {
+ case 128:
+ result = "2.16.840.1.101.3.4.1.6";
+ break;
+ case 192:
+ result = "2.16.840.1.101.3.4.1.26";
+ break;
+ case 256:
+ result = "2.16.840.1.101.3.4.1.46";
+ break;
+ default:
+ }
+ break;
+ case "AES-CFB":
+ switch(algorithm.length)
+ {
+ case 128:
+ result = "2.16.840.1.101.3.4.1.4";
+ break;
+ case 192:
+ result = "2.16.840.1.101.3.4.1.24";
+ break;
+ case 256:
+ result = "2.16.840.1.101.3.4.1.44";
+ break;
+ default:
+ }
+ break;
+ case "AES-KW":
+ switch(algorithm.length)
+ {
+ case 128:
+ result = "2.16.840.1.101.3.4.1.5";
+ break;
+ case 192:
+ result = "2.16.840.1.101.3.4.1.25";
+ break;
+ case 256:
+ result = "2.16.840.1.101.3.4.1.45";
+ break;
+ default:
+ }
+ break;
+ case "HMAC":
+ switch(algorithm.hash.name.toUpperCase())
+ {
+ case "SHA-1":
+ result = "1.2.840.113549.2.7";
+ break;
+ case "SHA-256":
+ result = "1.2.840.113549.2.9";
+ break;
+ case "SHA-384":
+ result = "1.2.840.113549.2.10";
+ break;
+ case "SHA-512":
+ result = "1.2.840.113549.2.11";
+ break;
+ default:
+ }
+ break;
+ case "DH":
+ result = "1.2.840.113549.1.9.16.3.5";
+ break;
+ case "SHA-1":
+ result = "1.3.14.3.2.26";
+ break;
+ case "SHA-256":
+ result = "2.16.840.1.101.3.4.2.1";
+ break;
+ case "SHA-384":
+ result = "2.16.840.1.101.3.4.2.2";
+ break;
+ case "SHA-512":
+ result = "2.16.840.1.101.3.4.2.3";
+ break;
+ case "CONCAT":
+ break;
+ case "HKDF":
+ break;
+ case "PBKDF2":
+ result = "1.2.840.113549.1.5.12";
+ break;
+ // #region Special case - OIDs for ECC curves
+ case "P-256":
+ result = "1.2.840.10045.3.1.7";
+ break;
+ case "P-384":
+ result = "1.3.132.0.34";
+ break;
+ case "P-521":
+ result = "1.3.132.0.35";
+ break;
+ // #endregion
+
+ default:
+ }
+
+ return result;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.getAlgorithmByOID =
+ function(oid)
+ {
+ /// <summary>Get WebCrypto algorithm by wel-known OID</summary>
+ /// <param name="oid" type="String">Wel-known OID to search for</param>
+
+ var result = {};
+
+ switch(oid)
+ {
+ case "1.2.840.113549.1.1.5":
+ result = {
+ name: "RSASSA-PKCS1-v1_5",
+ hash: {
+ name: "SHA-1"
+ }
+ };
+ break;
+ case "1.2.840.113549.1.1.11":
+ result = {
+ name: "RSASSA-PKCS1-v1_5",
+ hash: {
+ name: "SHA-256"
+ }
+ };
+ break;
+ case "1.2.840.113549.1.1.12":
+ result = {
+ name: "RSASSA-PKCS1-v1_5",
+ hash: {
+ name: "SHA-384"
+ }
+ };
+ break;
+ case "1.2.840.113549.1.1.13":
+ result = {
+ name: "RSASSA-PKCS1-v1_5",
+ hash: {
+ name: "SHA-512"
+ }
+ };
+ break;
+ case "1.2.840.113549.1.1.10":
+ result = {
+ name: "RSA-PSS"
+ };
+ break;
+ case "1.2.840.113549.1.1.7":
+ result = {
+ name: "RSA-OAEP"
+ };
+ break;
+ case "1.2.840.10045.4.1":
+ result = {
+ name: "ECDSA",
+ hash: {
+ name: "SHA-1"
+ }
+ };
+ break;
+ case "1.2.840.10045.4.3.2":
+ result = {
+ name: "ECDSA",
+ hash: {
+ name: "SHA-256"
+ }
+ };
+ break;
+ case "1.2.840.10045.4.3.3":
+ result = {
+ name: "ECDSA",
+ hash: {
+ name: "SHA-384"
+ }
+ };
+ break;
+ case "1.2.840.10045.4.3.4":
+ result = {
+ name: "ECDSA",
+ hash: {
+ name: "SHA-512"
+ }
+ };
+ break;
+ case "1.3.133.16.840.63.0.2":
+ result = {
+ name: "ECDH",
+ kdf: "SHA-1"
+ };
+ break;
+ case "1.3.132.1.11.1":
+ result = {
+ name: "ECDH",
+ kdf: "SHA-256"
+ };
+ break;
+ case "1.3.132.1.11.2":
+ result = {
+ name: "ECDH",
+ kdf: "SHA-384"
+ };
+ break;
+ case "1.3.132.1.11.3":
+ result = {
+ name: "ECDH",
+ kdf: "SHA-512"
+ };
+ break;
+ case "2.16.840.1.101.3.4.1.2":
+ result = {
+ name: "AES-CBC",
+ length: 128
+ };
+ break;
+ case "2.16.840.1.101.3.4.1.22":
+ result = {
+ name: "AES-CBC",
+ length: 192
+ };
+ break;
+ case "2.16.840.1.101.3.4.1.42":
+ result = {
+ name: "AES-CBC",
+ length: 256
+ };
+ break;
+ case "2.16.840.1.101.3.4.1.6":
+ result = {
+ name: "AES-GCM",
+ length: 128
+ };
+ break;
+ case "2.16.840.1.101.3.4.1.26":
+ result = {
+ name: "AES-GCM",
+ length: 192
+ };
+ break;
+ case "2.16.840.1.101.3.4.1.46":
+ result = {
+ name: "AES-GCM",
+ length: 256
+ };
+ break;
+ case "2.16.840.1.101.3.4.1.4":
+ result = {
+ name: "AES-CFB",
+ length: 128
+ };
+ break;
+ case "2.16.840.1.101.3.4.1.24":
+ result = {
+ name: "AES-CFB",
+ length: 192
+ };
+ break;
+ case "2.16.840.1.101.3.4.1.44":
+ result = {
+ name: "AES-CFB",
+ length: 256
+ };
+ break;
+ case "2.16.840.1.101.3.4.1.5":
+ result = {
+ name: "AES-KW",
+ length: 128
+ };
+ break;
+ case "2.16.840.1.101.3.4.1.25":
+ result = {
+ name: "AES-KW",
+ length: 192
+ };
+ break;
+ case "2.16.840.1.101.3.4.1.45":
+ result = {
+ name: "AES-KW",
+ length: 256
+ };
+ break;
+ case "1.2.840.113549.2.7":
+ result = {
+ name: "HMAC",
+ hash: {
+ name: "SHA-1"
+ }
+ };
+ break;
+ case "1.2.840.113549.2.9":
+ result = {
+ name: "HMAC",
+ hash: {
+ name: "SHA-256"
+ }
+ };
+ break;
+ case "1.2.840.113549.2.10":
+ result = {
+ name: "HMAC",
+ hash: {
+ name: "SHA-384"
+ }
+ };
+ break;
+ case "1.2.840.113549.2.11":
+ result = {
+ name: "HMAC",
+ hash: {
+ name: "SHA-512"
+ }
+ };
+ break;
+ case "1.2.840.113549.1.9.16.3.5":
+ result = {
+ name: "DH"
+ };
+ break;
+ case "1.3.14.3.2.26":
+ result = {
+ name: "SHA-1"
+ };
+ break;
+ case "2.16.840.1.101.3.4.2.1":
+ result = {
+ name: "SHA-256"
+ };
+ break;
+ case "2.16.840.1.101.3.4.2.2":
+ result = {
+ name: "SHA-384"
+ };
+ break;
+ case "2.16.840.1.101.3.4.2.3":
+ result = {
+ name: "SHA-512"
+ };
+ break;
+ case "1.2.840.113549.1.5.12":
+ result = {
+ name: "PBKDF2"
+ };
+ break;
+ // #region Special case - OIDs for ECC curves
+ case "1.2.840.10045.3.1.7":
+ result = {
+ name: "P-256"
+ };
+ break;
+ case "1.3.132.0.34":
+ result = {
+ name: "P-384"
+ };
+ break;
+ case "1.3.132.0.35":
+ result = {
+ name: "P-521"
+ };
+ break;
+ // #endregion
+
+ default:
+ }
+
+ return result;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.getHashAlgorithm =
+ function(signatureAlgorithm)
+ {
+ /// <summary>Getting hash algorithm by signature algorithm</summary>
+ /// <param name="signatureAlgorithm" type="in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER">Signature algorithm</param>
+
+ var result = "";
+
+ switch(signatureAlgorithm.algorithm_id)
+ {
+ case "1.2.840.10045.4.1": // ecdsa-with-SHA1
+ case "1.2.840.113549.1.1.5":
+ result = "SHA-1";
+ break;
+ case "1.2.840.10045.4.3.2": // ecdsa-with-SHA256
+ case "1.2.840.113549.1.1.11":
+ result = "SHA-256";
+ break;
+ case "1.2.840.10045.4.3.3": // ecdsa-with-SHA384
+ case "1.2.840.113549.1.1.12":
+ result = "SHA-384";
+ break;
+ case "1.2.840.10045.4.3.4": // ecdsa-with-SHA512
+ case "1.2.840.113549.1.1.13":
+ result = "SHA-512";
+ break;
+ case "1.2.840.113549.1.1.10": // RSA-PSS
+ {
+ var params;
+
+ try
+ {
+ params = new in_window.org.pkijs.simpl.x509.RSASSA_PSS_params({ schema: signatureAlgorithm.algorithm_params });
+ if("hashAlgorithm" in params)
+ {
+ var algorithm = in_window.org.pkijs.getAlgorithmByOID(params.hashAlgorithm.algorithm_id);
+ if(("name" in algorithm) === false)
+ return "";
+
+ result = algorithm.name;
+ }
+ else
+ result = "SHA-1";
+ }
+ catch(ex)
+ {
+ }
+ }
+ break;
+ default:
+ }
+
+ return result;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.createCMSECDSASignature =
+ function(signatureBuffer)
+ {
+ /// <summary>Create CMS ECDSA signature from WebCrypto ECDSA signature</summary>
+ /// <param name="signatureBuffer" type="ArrayBuffer">WebCrypto result of "sign" function</param>
+
+ // #region Initial check for correct length
+ if((signatureBuffer.byteLength % 2) != 0)
+ return new ArrayBuffer(0);
+ // #endregion
+
+ // #region Initial variables
+ var i = 0;
+ var length = signatureBuffer.byteLength / 2; // There are two equal parts inside incoming ArrayBuffer
+
+ var signatureView = new Uint8Array(signatureBuffer);
+
+ var r_buffer = new ArrayBuffer(length);
+ var r_view = new Uint8Array(r_buffer);
+ var r_corrected_buffer;
+ var r_corrected_view;
+
+ var s_buffer = new ArrayBuffer(length);
+ var s_view = new Uint8Array(s_buffer);
+ var s_corrected_buffer;
+ var s_corrected_view;
+ // #endregion
+
+ // #region Get "r" part of ECDSA signature
+ for(; i < length; i++)
+ r_view[i] = signatureView[i];
+
+ if(r_view[0] & 0x80)
+ {
+ r_corrected_buffer = new ArrayBuffer(length + 1);
+ r_corrected_view = new Uint8Array(r_corrected_buffer);
+
+ r_corrected_view[0] = 0x00;
+
+ for(var j = 0; j < length; j++)
+ r_corrected_view[j + 1] = r_view[j];
+ }
+ else
+ {
+ r_corrected_buffer = r_buffer;
+ r_corrected_view = r_view;
+ }
+ // #endregion
+
+ // #region Get "s" part of ECDSA signature
+ for(; i < signatureBuffer.byteLength; i++)
+ s_view[i - length] = signatureView[i];
+
+
+ if(s_view[0] & 0x80)
+ {
+ s_corrected_buffer = new ArrayBuffer(length + 1);
+ s_corrected_view = new Uint8Array(s_corrected_buffer);
+
+ s_corrected_view[0] = 0x00;
+
+ for(var j = 0; j < length; j++)
+ s_corrected_view[j + 1] = s_view[j];
+ }
+ else
+ {
+ s_corrected_buffer = s_buffer;
+ s_corrected_view = s_view;
+ }
+ // #endregion
+
+ // #region Create ASN.1 structure of CMS ECDSA signature
+ var r_integer = new in_window.org.pkijs.asn1.INTEGER();
+ r_integer.value_block.is_hex_only = true;
+ r_integer.value_block.value_hex = in_window.org.pkijs.copyBuffer(r_corrected_buffer);
+
+ var s_integer = new in_window.org.pkijs.asn1.INTEGER();
+ s_integer.value_block.is_hex_only = true;
+ s_integer.value_block.value_hex = in_window.org.pkijs.copyBuffer(s_corrected_buffer);
+
+ var asn1 = new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ r_integer,
+ s_integer
+ ]
+ });
+ // #endregion
+
+ return asn1.toBER(false);
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.createECDSASignatureFromCMS =
+ function(cmsSignature)
+ {
+ /// <summary>Create a single ArrayBuffer from CMS ECDSA signature</summary>
+ /// <param name="cmsSignature" type="in_window.org.pkijs.asn1.SEQUENCE">ASN.1 SEQUENCE contains CMS ECDSA signature</param>
+
+ // #region Initial variables
+ var length = 0;
+
+ var r_start = 0;
+ var s_start = 0;
+
+ var r_length = cmsSignature.value_block.value[0].value_block.value_hex.byteLength;
+ var s_length = cmsSignature.value_block.value[1].value_block.value_hex.byteLength;
+ // #endregion
+
+ // #region Get length of final "ArrayBuffer"
+ var r_view = new Uint8Array(cmsSignature.value_block.value[0].value_block.value_hex);
+ if((r_view[0] === 0x00) && (r_view[1] & 0x80))
+ {
+ length = r_length - 1;
+ r_start = 1;
+ }
+ else
+ length = r_length;
+
+ var s_view = new Uint8Array(cmsSignature.value_block.value[1].value_block.value_hex);
+ if((s_view[0] === 0x00) && (s_view[1] & 0x80))
+ {
+ length += s_length - 1;
+ s_start = 1;
+ }
+ else
+ length += s_length;
+ // #endregion
+
+ // #region Copy values from CMS ECDSA signature
+ var result = new ArrayBuffer(length);
+ var result_view = new Uint8Array(result);
+
+ for(var i = r_start; i < r_length; i++)
+ result_view[i - r_start] = r_view[i];
+
+ for(var i = s_start; i < s_length; i++)
+ result_view[i - s_start + r_length - r_start] = s_view[i];
+ // #endregion
+
+ return result;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.getEncryptionAlgorithm =
+ function(algorithm)
+ {
+ /// <summary>Get encryption algorithm OID by WebCrypto algorithm's object</summary>
+ /// <param name="algorithm" type="WebCryptoAlgorithm">WebCrypto algorithm object</param>
+
+ var result = "";
+
+ switch(algorithm.name.toUpperCase())
+ {
+ case "AES-CBC":
+ switch(algorithm.length)
+ {
+ case 128:
+ result = "2.16.840.1.101.3.4.1.2";
+ break;
+ case 192:
+ result = "2.16.840.1.101.3.4.1.22";
+ break;
+ case 256:
+ result = "2.16.840.1.101.3.4.1.42";
+ break;
+ default:
+ }
+ break;
+ case "AES-GCM":
+ switch(algorithm.length)
+ {
+ case 128:
+ result = "2.16.840.1.101.3.4.1.6";
+ break;
+ case 192:
+ result = "2.16.840.1.101.3.4.1.26";
+ break;
+ case 256:
+ result = "2.16.840.1.101.3.4.1.46";
+ break;
+ default:
+ }
+ break;
+ default:
+ }
+
+ return result;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.getAlgorithmByEncryptionOID =
+ function(oid)
+ {
+ /// <summary>Get encryption algorithm name by OID</summary>
+ /// <param name="oid" type="String">OID of encryption algorithm</param>
+
+ var result = "";
+
+ switch(oid)
+ {
+ case "2.16.840.1.101.3.4.1.2":
+ case "2.16.840.1.101.3.4.1.22":
+ case "2.16.840.1.101.3.4.1.42":
+ result = "AES-CBC";
+ break;
+ case "2.16.840.1.101.3.4.1.6":
+ case "2.16.840.1.101.3.4.1.26":
+ case "2.16.840.1.101.3.4.1.46":
+ result = "AES-GCM";
+ break;
+ default:
+ }
+
+ return result;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+}
+)(typeof exports !== "undefined" ? exports : window); \ No newline at end of file
diff --git a/dom/webauthn/tests/pkijs/x509_schema.js b/dom/webauthn/tests/pkijs/x509_schema.js
new file mode 100644
index 0000000000..15b0929bb5
--- /dev/null
+++ b/dom/webauthn/tests/pkijs/x509_schema.js
@@ -0,0 +1,1889 @@
+/*
+ * Copyright (c) 2014, GMO GlobalSign
+ * Copyright (c) 2015, Peculiar Ventures
+ * All rights reserved.
+ *
+ * Author 2014-2015, Yury Strozhevsky <www.strozhevsky.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ * may be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ */
+(
+function(in_window)
+{
+ //**************************************************************************************
+ // #region Declaration of global variables
+ //**************************************************************************************
+ // #region "org" namespace
+ if(typeof in_window.org === "undefined")
+ in_window.org = {};
+ else
+ {
+ if(typeof in_window.org !== "object")
+ throw new Error("Name org already exists and it's not an object");
+ }
+ // #endregion
+
+ // #region "org.pkijs" namespace
+ if(typeof in_window.org.pkijs === "undefined")
+ in_window.org.pkijs = {};
+ else
+ {
+ if(typeof in_window.org.pkijs !== "object")
+ throw new Error("Name org.pkijs already exists and it's not an object" + " but " + (typeof in_window.org.pkijs));
+ }
+ // #endregion
+
+ // #region "org.pkijs.schema" namespace
+ if(typeof in_window.org.pkijs.schema === "undefined")
+ in_window.org.pkijs.schema = {};
+ else
+ {
+ if(typeof in_window.org.pkijs.schema !== "object")
+ throw new Error("Name org.pkijs.schema already exists and it's not an object" + " but " + (typeof in_window.org.pkijs.schema));
+ }
+ // #endregion
+
+ // #region "org.pkijs.schema.x509" namespace
+ if(typeof in_window.org.pkijs.schema.x509 === "undefined")
+ in_window.org.pkijs.schema.x509 = {};
+ else
+ {
+ if(typeof in_window.org.pkijs.schema.x509 !== "object")
+ throw new Error("Name org.pkijs.schema.x509 already exists and it's not an object" + " but " + (typeof in_window.org.pkijs.schema.x509));
+ }
+ // #endregion
+
+ // #region "local" namespace
+ var local = {};
+ // #endregion
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "Time" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.TIME =
+ function(input_names, input_optional)
+ {
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+ var optional = (input_optional || false);
+
+ return (new in_window.org.pkijs.asn1.CHOICE({
+ optional: optional,
+ value: [
+ new in_window.org.pkijs.asn1.UTCTIME({ name: (names.utcTimeName || "") }),
+ new in_window.org.pkijs.asn1.GENERALIZEDTIME({ name: (names.generalTimeName || "") })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for X.509 v3 certificate (RFC5280)
+ //**************************************************************************************
+ local.tbsCertificate =
+ function()
+ {
+ //TBSCertificate ::= SEQUENCE {
+ // version [0] EXPLICIT Version DEFAULT v1,
+ // serialNumber CertificateSerialNumber,
+ // signature AlgorithmIdentifier,
+ // issuer Name,
+ // validity Validity,
+ // subject Name,
+ // subjectPublicKeyInfo SubjectPublicKeyInfo,
+ // issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
+ // -- If present, version MUST be v2 or v3
+ // subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
+ // -- If present, version MUST be v2 or v3
+ // extensions [3] EXPLICIT Extensions OPTIONAL
+ // -- If present, version MUST be v3
+ //}
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || "tbsCertificate"),
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.tbsCertificate_version || "tbsCertificate.version") }) // EXPLICIT integer value
+ ]
+ }),
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.tbsCertificate_serialNumber || "tbsCertificate.serialNumber") }),
+ in_window.org.pkijs.schema.ALGORITHM_IDENTIFIER(names.signature || {
+ names: {
+ block_name: "tbsCertificate.signature"
+ }
+ }),
+ in_window.org.pkijs.schema.RDN(names.issuer || {
+ names: {
+ block_name: "tbsCertificate.issuer"
+ }
+ }),
+ new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.tbsCertificate_validity || "tbsCertificate.validity"),
+ value: [
+ in_window.org.pkijs.schema.TIME(names.not_before || {
+ names: {
+ utcTimeName: "tbsCertificate.notBefore",
+ generalTimeName: "tbsCertificate.notBefore"
+ }
+ }),
+ in_window.org.pkijs.schema.TIME(names.not_after || {
+ names: {
+ utcTimeName: "tbsCertificate.notAfter",
+ generalTimeName: "tbsCertificate.notAfter"
+ }
+ })
+ ]
+ }),
+ in_window.org.pkijs.schema.RDN(names.subject || {
+ names: {
+ block_name: "tbsCertificate.subject"
+ }
+ }),
+ in_window.org.pkijs.schema.PUBLIC_KEY_INFO(names.subjectPublicKeyInfo || {
+ names: {
+ block_name: "tbsCertificate.subjectPublicKeyInfo"
+ }
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.tbsCertificate_issuerUniqueID ||"tbsCertificate.issuerUniqueID"),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ }
+ }), // IMPLICIT bistring value
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.tbsCertificate_subjectUniqueID ||"tbsCertificate.subjectUniqueID"),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 2 // [2]
+ }
+ }), // IMPLICIT bistring value
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 3 // [3]
+ },
+ value: [in_window.org.pkijs.schema.EXTENSIONS(names.extensions || {
+ names: {
+ block_name: "tbsCertificate.extensions"
+ }
+ })]
+ }) // EXPLICIT SEQUENCE value
+ ]
+ }));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.schema.CERT =
+ function()
+ {
+ //Certificate ::= SEQUENCE {
+ // tbsCertificate TBSCertificate,
+ // signatureAlgorithm AlgorithmIdentifier,
+ // signatureValue BIT STRING }
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ local.tbsCertificate(names.tbsCertificate),
+ in_window.org.pkijs.schema.ALGORITHM_IDENTIFIER(names.signatureAlgorithm || {
+ names: {
+ block_name: "signatureAlgorithm"
+ }
+ }),
+ new in_window.org.pkijs.asn1.BITSTRING({ name: (names.signatureValue || "signatureValue") })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for X.509 CRL (Certificate Revocation List)(RFC5280)
+ //**************************************************************************************
+ local.tbsCertList =
+ function()
+ {
+ //TBSCertList ::= SEQUENCE {
+ // version Version OPTIONAL,
+ // -- if present, MUST be v2
+ // signature AlgorithmIdentifier,
+ // issuer Name,
+ // thisUpdate Time,
+ // nextUpdate Time OPTIONAL,
+ // revokedCertificates SEQUENCE OF SEQUENCE {
+ // userCertificate CertificateSerialNumber,
+ // revocationDate Time,
+ // crlEntryExtensions Extensions OPTIONAL
+ // -- if present, version MUST be v2
+ // } OPTIONAL,
+ // crlExtensions [0] EXPLICIT Extensions OPTIONAL
+ // -- if present, version MUST be v2
+ //}
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || "tbsCertList"),
+ value: [
+ new in_window.org.pkijs.asn1.INTEGER({
+ optional: true,
+ name: (names.tbsCertList_version || "tbsCertList.version"),
+ value: 2
+ }), // EXPLICIT integer value (v2)
+ in_window.org.pkijs.schema.ALGORITHM_IDENTIFIER(names.signature || {
+ names: {
+ block_name: "tbsCertList.signature"
+ }
+ }),
+ in_window.org.pkijs.schema.RDN(names.issuer || {
+ names: {
+ block_name: "tbsCertList.issuer"
+ }
+ }),
+ in_window.org.pkijs.schema.TIME(names.tbsCertList_thisUpdate || {
+ names: {
+ utcTimeName: "tbsCertList.thisUpdate",
+ generalTimeName: "tbsCertList.thisUpdate"
+ }
+ }),
+ in_window.org.pkijs.schema.TIME(names.tbsCertList_thisUpdate || {
+ names: {
+ utcTimeName: "tbsCertList.nextUpdate",
+ generalTimeName: "tbsCertList.nextUpdate"
+ }
+ }, true),
+ new in_window.org.pkijs.asn1.SEQUENCE({
+ optional: true,
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.tbsCertList_revokedCertificates || "tbsCertList.revokedCertificates"),
+ value: new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ new in_window.org.pkijs.asn1.INTEGER(),
+ in_window.org.pkijs.schema.TIME(),
+ in_window.org.pkijs.schema.EXTENSIONS({}, true)
+ ]
+ })
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [in_window.org.pkijs.schema.EXTENSIONS(names.crlExtensions || {
+ names: {
+ block_name: "tbsCertList.extensions"
+ }
+ })]
+ }) // EXPLICIT SEQUENCE value
+ ]
+ }));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.schema.CRL =
+ function()
+ {
+ //CertificateList ::= SEQUENCE {
+ // tbsCertList TBSCertList,
+ // signatureAlgorithm AlgorithmIdentifier,
+ // signatureValue BIT STRING }
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || "CertificateList"),
+ value: [
+ local.tbsCertList(arguments[0]),
+ in_window.org.pkijs.schema.ALGORITHM_IDENTIFIER(names.signatureAlgorithm || {
+ names: {
+ block_name: "signatureAlgorithm"
+ }
+ }),
+ new in_window.org.pkijs.asn1.BITSTRING({ name: (names.signatureValue || "signatureValue") })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for PKCS#10 certificate request
+ //**************************************************************************************
+ local.CertificationRequestInfo =
+ function()
+ {
+ //CertificationRequestInfo ::= SEQUENCE {
+ // version INTEGER { v1(0) } (v1,...),
+ // subject Name,
+ // subjectPKInfo SubjectPublicKeyInfo{{ PKInfoAlgorithms }},
+ // attributes [0] Attributes{{ CRIAttributes }}
+ //}
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.CertificationRequestInfo || "CertificationRequestInfo"),
+ value: [
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.CertificationRequestInfo_version || "CertificationRequestInfo.version") }),
+ new in_window.org.pkijs.schema.RDN(names.subject || {
+ names: {
+ block_name: "CertificationRequestInfo.subject"
+ }
+ }),
+ new in_window.org.pkijs.schema.PUBLIC_KEY_INFO({
+ names: {
+ block_name: "CertificationRequestInfo.subjectPublicKeyInfo"
+ }
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ optional: true, // Because OpenSSL makes wrong "attributes" field
+ name: (names.CertificationRequestInfo_attributes || "CertificationRequestInfo.attributes"),
+ value: in_window.org.pkijs.schema.ATTRIBUTE(names.attributes || {})
+ })
+ ]
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.schema.PKCS10 =
+ function()
+ {
+ //CertificationRequest ::= SEQUENCE {
+ // certificationRequestInfo CertificationRequestInfo,
+ // signatureAlgorithm AlgorithmIdentifier{{ SignatureAlgorithms }},
+ // signature BIT STRING
+ //}
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ local.CertificationRequestInfo(names.certificationRequestInfo || {}),
+ new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.signatureAlgorithm || "signatureAlgorithm"),
+ value: [
+ new in_window.org.pkijs.asn1.OID(),
+ new in_window.org.pkijs.asn1.ANY({ optional: true })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.BITSTRING({ name: (names.signatureValue || "signatureValue") })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for PKCS#8 private key bag
+ //**************************************************************************************
+ in_window.org.pkijs.schema.PKCS8 =
+ function()
+ {
+ //PrivateKeyInfo ::= SEQUENCE {
+ // version Version,
+ // privateKeyAlgorithm AlgorithmIdentifier {{PrivateKeyAlgorithms}},
+ // privateKey PrivateKey,
+ // attributes [0] Attributes OPTIONAL }
+ //
+ //Version ::= INTEGER {v1(0)} (v1,...)
+ //
+ //PrivateKey ::= OCTET STRING
+ //
+ //Attributes ::= SET OF Attribute
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.version || "") }),
+ in_window.org.pkijs.schema.ALGORITHM_IDENTIFIER(names.privateKeyAlgorithm || ""),
+ new in_window.org.pkijs.asn1.OCTETSTRING({ name: (names.privateKey || "") }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.attributes || ""),
+ value: in_window.org.pkijs.schema.ATTRIBUTE()
+ })
+ ]
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "GeneralName" type
+ //**************************************************************************************
+ local.BuiltInStandardAttributes =
+ function(optional_flag)
+ {
+ //BuiltInStandardAttributes ::= SEQUENCE {
+ // country-name CountryName OPTIONAL,
+ // administration-domain-name AdministrationDomainName OPTIONAL,
+ // network-address [0] IMPLICIT NetworkAddress OPTIONAL,
+ // terminal-identifier [1] IMPLICIT TerminalIdentifier OPTIONAL,
+ // private-domain-name [2] PrivateDomainName OPTIONAL,
+ // organization-name [3] IMPLICIT OrganizationName OPTIONAL,
+ // numeric-user-identifier [4] IMPLICIT NumericUserIdentifier OPTIONAL,
+ // personal-name [5] IMPLICIT PersonalName OPTIONAL,
+ // organizational-unit-names [6] IMPLICIT OrganizationalUnitNames OPTIONAL }
+
+ if(typeof optional_flag === "undefined")
+ optional_flag = false;
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ optional: optional_flag,
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 2, // APPLICATION-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ name: (names.country_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.CHOICE({
+ value: [
+ new in_window.org.pkijs.asn1.NUMERICSTRING(),
+ new in_window.org.pkijs.asn1.PRINTABLESTRING()
+ ]
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 2, // APPLICATION-SPECIFIC
+ tag_number: 2 // [2]
+ },
+ name: (names.administration_domain_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.CHOICE({
+ value: [
+ new in_window.org.pkijs.asn1.NUMERICSTRING(),
+ new in_window.org.pkijs.asn1.PRINTABLESTRING()
+ ]
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ name: (names.network_address || ""),
+ is_hex_only: true
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ name: (names.terminal_identifier || ""),
+ is_hex_only: true
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 2 // [2]
+ },
+ name: (names.private_domain_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.CHOICE({
+ value: [
+ new in_window.org.pkijs.asn1.NUMERICSTRING(),
+ new in_window.org.pkijs.asn1.PRINTABLESTRING()
+ ]
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 3 // [3]
+ },
+ name: (names.organization_name || ""),
+ is_hex_only: true
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ optional: true,
+ name: (names.numeric_user_identifier || ""),
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 4 // [4]
+ },
+ is_hex_only: true
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ name: (names.personal_name || ""),
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 5 // [5]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ is_hex_only: true
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ is_hex_only: true
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 2 // [2]
+ },
+ is_hex_only: true
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 3 // [3]
+ },
+ is_hex_only: true
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ name: (names.organizational_unit_names || ""),
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 6 // [6]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ value: new in_window.org.pkijs.asn1.PRINTABLESTRING()
+ })
+ ]
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ local.BuiltInDomainDefinedAttributes =
+ function(optional_flag)
+ {
+ if(typeof optional_flag === "undefined")
+ optional_flag = false;
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ optional: optional_flag,
+ value: [
+ new in_window.org.pkijs.asn1.PRINTABLESTRING(),
+ new in_window.org.pkijs.asn1.PRINTABLESTRING()
+ ]
+ }));
+ };
+ //**************************************************************************************
+ local.ExtensionAttributes =
+ function(optional_flag)
+ {
+ if(typeof optional_flag === "undefined")
+ optional_flag = false;
+
+ return (new in_window.org.pkijs.asn1.SET({
+ optional: optional_flag,
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ is_hex_only: true
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value: [new in_window.org.pkijs.asn1.ANY()]
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.schema.GENERAL_NAME =
+ function()
+ {
+ /// <remarks>By passing "names" array as an argument you can name each element of "GENERAL NAME" choice</remarks>
+
+ //GeneralName ::= CHOICE {
+ // otherName [0] OtherName,
+ // rfc822Name [1] IA5String,
+ // dNSName [2] IA5String,
+ // x400Address [3] ORAddress,
+ // directoryName [4] Name,
+ // ediPartyName [5] EDIPartyName,
+ // uniformResourceIdentifier [6] IA5String,
+ // iPAddress [7] OCTET STRING,
+ // registeredID [8] OBJECT IDENTIFIER }
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.CHOICE({
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.OID(),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [new in_window.org.pkijs.asn1.ANY()]
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.block_name || ""),
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ }
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.block_name || ""),
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 2 // [2]
+ }
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 3 // [3]
+ },
+ name: (names.block_name || ""),
+ value: [
+ local.BuiltInStandardAttributes(false),
+ local.BuiltInDomainDefinedAttributes(true),
+ local.ExtensionAttributes(true)
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 4 // [4]
+ },
+ name: (names.block_name || ""),
+ value: [in_window.org.pkijs.schema.RDN(names.directoryName || {})]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 5 // [5]
+ },
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.CHOICE({
+ value: [
+ new in_window.org.pkijs.asn1.TELETEXSTRING(),
+ new in_window.org.pkijs.asn1.PRINTABLESTRING(),
+ new in_window.org.pkijs.asn1.UNIVERSALSTRING(),
+ new in_window.org.pkijs.asn1.UTF8STRING(),
+ new in_window.org.pkijs.asn1.BMPSTRING()
+ ]
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.CHOICE({
+ value: [
+ new in_window.org.pkijs.asn1.TELETEXSTRING(),
+ new in_window.org.pkijs.asn1.PRINTABLESTRING(),
+ new in_window.org.pkijs.asn1.UNIVERSALSTRING(),
+ new in_window.org.pkijs.asn1.UTF8STRING(),
+ new in_window.org.pkijs.asn1.BMPSTRING()
+ ]
+ })
+ ]
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.block_name || ""),
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 6 // [6]
+ }
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.block_name || ""),
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 7 // [7]
+ }
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.block_name || ""),
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 8 // [8]
+ }
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "AlgorithmIdentifier" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.ALGORITHM_IDENTIFIER =
+ function()
+ {
+ //AlgorithmIdentifier ::= SEQUENCE {
+ // algorithm OBJECT IDENTIFIER,
+ // parameters ANY DEFINED BY algorithm OPTIONAL }
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ optional: (names.optional || false),
+ value: [
+ new in_window.org.pkijs.asn1.OID({ name: (names.algorithmIdentifier || "") }),
+ new in_window.org.pkijs.asn1.ANY({ name: (names.algorithmParams || ""), optional: true })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "RSAPublicKey" type (RFC3447)
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.RSAPublicKey =
+ function()
+ {
+ //RSAPublicKey ::= SEQUENCE {
+ // modulus INTEGER, -- n
+ // publicExponent INTEGER -- e
+ //}
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.modulus || "") }),
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.publicExponent || "") })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "OtherPrimeInfo" type (RFC3447)
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.OtherPrimeInfo =
+ function()
+ {
+ //OtherPrimeInfo ::= SEQUENCE {
+ // prime INTEGER, -- ri
+ // exponent INTEGER, -- di
+ // coefficient INTEGER -- ti
+ //}
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.prime || "") }),
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.exponent || "") }),
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.coefficient || "") })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "RSAPrivateKey" type (RFC3447)
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.RSAPrivateKey =
+ function()
+ {
+ //RSAPrivateKey ::= SEQUENCE {
+ // version Version,
+ // modulus INTEGER, -- n
+ // publicExponent INTEGER, -- e
+ // privateExponent INTEGER, -- d
+ // prime1 INTEGER, -- p
+ // prime2 INTEGER, -- q
+ // exponent1 INTEGER, -- d mod (p-1)
+ // exponent2 INTEGER, -- d mod (q-1)
+ // coefficient INTEGER, -- (inverse of q) mod p
+ // otherPrimeInfos OtherPrimeInfos OPTIONAL
+ //}
+ //
+ //OtherPrimeInfos ::= SEQUENCE SIZE(1..MAX) OF OtherPrimeInfo
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.version || "") }),
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.modulus || "") }),
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.publicExponent || "") }),
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.privateExponent || "") }),
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.prime1 || "") }),
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.prime2 || "") }),
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.exponent1 || "") }),
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.exponent2 || "") }),
+ new in_window.org.pkijs.asn1.INTEGER({ name: (names.coefficient || "") }),
+ new in_window.org.pkijs.asn1.SEQUENCE({
+ optional: true,
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.otherPrimeInfos || ""),
+ value: in_window.org.pkijs.schema.x509.OtherPrimeInfo(names.otherPrimeInfo || {})
+ })
+ ]
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "RSASSA-PSS-params" type (RFC3447)
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.RSASSA_PSS_params =
+ function()
+ {
+ //RSASSA-PSS-params ::= SEQUENCE {
+ // hashAlgorithm [0] HashAlgorithm DEFAULT sha1Identifier,
+ // maskGenAlgorithm [1] MaskGenAlgorithm DEFAULT mgf1SHA1Identifier,
+ // saltLength [2] INTEGER DEFAULT 20,
+ // trailerField [3] INTEGER DEFAULT 1 }
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ optional: true,
+ value: [in_window.org.pkijs.schema.ALGORITHM_IDENTIFIER(names.hashAlgorithm || {})]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ optional: true,
+ value: [in_window.org.pkijs.schema.ALGORITHM_IDENTIFIER(names.maskGenAlgorithm || {})]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 2 // [2]
+ },
+ optional: true,
+ value: [new in_window.org.pkijs.asn1.INTEGER({ name: (names.saltLength || "") })]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 3 // [3]
+ },
+ optional: true,
+ value: [new in_window.org.pkijs.asn1.INTEGER({ name: (names.trailerField || "") })]
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "SubjectPublicKeyInfo" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.PUBLIC_KEY_INFO =
+ function()
+ {
+ //SubjectPublicKeyInfo ::= SEQUENCE {
+ // algorithm AlgorithmIdentifier,
+ // subjectPublicKey BIT STRING }
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ in_window.org.pkijs.schema.ALGORITHM_IDENTIFIER(names.algorithm || {}),
+ new in_window.org.pkijs.asn1.BITSTRING({ name: (names.subjectPublicKey || "") })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "Attribute" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.ATTRIBUTE =
+ function()
+ {
+ // Attribute { ATTRIBUTE:IOSet } ::= SEQUENCE {
+ // type ATTRIBUTE.&id({IOSet}),
+ // values SET SIZE(1..MAX) OF ATTRIBUTE.&Type({IOSet}{@type})
+ //}
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.OID({ name: (names.type || "") }),
+ new in_window.org.pkijs.asn1.SET({
+ name: (names.set_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.values || ""),
+ value: new in_window.org.pkijs.asn1.ANY()
+ })
+ ]
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "AttributeTypeAndValue" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.ATTR_TYPE_AND_VALUE =
+ function()
+ {
+ //AttributeTypeAndValue ::= SEQUENCE {
+ // type AttributeType,
+ // value AttributeValue }
+ //
+ //AttributeType ::= OBJECT IDENTIFIER
+ //
+ //AttributeValue ::= ANY -- DEFINED BY AttributeType
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.OID({ name: (names.type || "") }),
+ new in_window.org.pkijs.asn1.ANY({ name: (names.value || "") })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "RelativeDistinguishedName" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.RDN =
+ function()
+ {
+ //RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
+ //
+ //RelativeDistinguishedName ::=
+ //SET SIZE (1..MAX) OF AttributeTypeAndValue
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.repeated_sequence || ""),
+ value: new in_window.org.pkijs.asn1.SET({
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.repeated_set || ""),
+ value: in_window.org.pkijs.schema.ATTR_TYPE_AND_VALUE(names.attr_type_and_value || {})
+ })
+ ]
+ })
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "Extension" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.EXTENSION =
+ function()
+ {
+ //Extension ::= SEQUENCE {
+ // extnID OBJECT IDENTIFIER,
+ // critical BOOLEAN DEFAULT FALSE,
+ // extnValue OCTET STRING
+ //}
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.OID({ name: (names.extnID || "") }),
+ new in_window.org.pkijs.asn1.BOOLEAN({
+ name: (names.critical || ""),
+ optional: true
+ }),
+ new in_window.org.pkijs.asn1.OCTETSTRING({ name: (names.extnValue || "") })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "Extensions" type (sequence of many Extension)
+ //**************************************************************************************
+ in_window.org.pkijs.schema.EXTENSIONS =
+ function(input_names, input_optional)
+ {
+ //Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+ var optional = input_optional || false;
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ optional: optional,
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.extensions || ""),
+ value: in_window.org.pkijs.schema.EXTENSION(names.extension || {})
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "AuthorityKeyIdentifier" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.AuthorityKeyIdentifier =
+ function()
+ {
+ // AuthorityKeyIdentifier OID ::= 2.5.29.35
+ //
+ //AuthorityKeyIdentifier ::= SEQUENCE {
+ // keyIdentifier [0] KeyIdentifier OPTIONAL,
+ // authorityCertIssuer [1] GeneralNames OPTIONAL,
+ // authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
+ //
+ //KeyIdentifier ::= OCTET STRING
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.keyIdentifier || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ }
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.authorityCertIssuer || ""),
+ value: in_window.org.pkijs.schema.GENERAL_NAME()
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.authorityCertSerialNumber || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 2 // [2]
+ }
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "PrivateKeyUsagePeriod" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.PrivateKeyUsagePeriod =
+ function()
+ {
+ // PrivateKeyUsagePeriod OID ::= 2.5.29.16
+ //
+ //PrivateKeyUsagePeriod ::= SEQUENCE {
+ // notBefore [0] GeneralizedTime OPTIONAL,
+ // notAfter [1] GeneralizedTime OPTIONAL }
+ //-- either notBefore or notAfter MUST be present
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.notBefore || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ }
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.notAfter || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ }
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "IssuerAltName" and "SubjectAltName" types of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.AltName =
+ function()
+ {
+ // SubjectAltName OID ::= 2.5.29.17
+ // IssuerAltName OID ::= 2.5.29.18
+ //
+ // AltName ::= GeneralNames
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.altNames || ""),
+ value: in_window.org.pkijs.schema.GENERAL_NAME()
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "SubjectDirectoryAttributes" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.SubjectDirectoryAttributes =
+ function()
+ {
+ // SubjectDirectoryAttributes OID ::= 2.5.29.9
+ //
+ //SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.attributes || ""),
+ value: in_window.org.pkijs.schema.ATTRIBUTE()
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "GeneralSubtree" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.GeneralSubtree =
+ function()
+ {
+ //GeneralSubtree ::= SEQUENCE {
+ // base GeneralName,
+ // minimum [0] BaseDistance DEFAULT 0,
+ // maximum [1] BaseDistance OPTIONAL }
+ //
+ //BaseDistance ::= INTEGER (0..MAX)
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ in_window.org.pkijs.schema.GENERAL_NAME(names.base || ""),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [new in_window.org.pkijs.asn1.INTEGER({ name: (names.minimum || "") })]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value: [new in_window.org.pkijs.asn1.INTEGER({ name: (names.maximum || "") })]
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "NameConstraints" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.NameConstraints =
+ function()
+ {
+ // NameConstraints OID ::= 2.5.29.30
+ //
+ //NameConstraints ::= SEQUENCE {
+ // permittedSubtrees [0] GeneralSubtrees OPTIONAL,
+ // excludedSubtrees [1] GeneralSubtrees OPTIONAL }
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.permittedSubtrees || ""),
+ value: in_window.org.pkijs.schema.x509.GeneralSubtree()
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.excludedSubtrees || ""),
+ value: in_window.org.pkijs.schema.x509.GeneralSubtree()
+ })
+ ]
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "BasicConstraints" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.BasicConstraints =
+ function()
+ {
+ // BasicConstraints OID ::= 2.5.29.19
+ //
+ //BasicConstraints ::= SEQUENCE {
+ // cA BOOLEAN DEFAULT FALSE,
+ // pathLenConstraint INTEGER (0..MAX) OPTIONAL }
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.BOOLEAN({
+ optional: true,
+ name: (names.cA || "")
+ }),
+ new in_window.org.pkijs.asn1.INTEGER({
+ optional: true,
+ name: (names.pathLenConstraint || "")
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "PolicyQualifierInfo" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.PolicyQualifierInfo =
+ function()
+ {
+ //PolicyQualifierInfo ::= SEQUENCE {
+ // policyQualifierId PolicyQualifierId,
+ // qualifier ANY DEFINED BY policyQualifierId }
+ //
+ //id-qt OBJECT IDENTIFIER ::= { id-pkix 2 }
+ //id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 }
+ //id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 }
+ //
+ //PolicyQualifierId ::= OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.OID({ name: (names.policyQualifierId || "") }),
+ new in_window.org.pkijs.asn1.ANY({ name: (names.qualifier || "") })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "PolicyInformation" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.PolicyInformation =
+ function()
+ {
+ //PolicyInformation ::= SEQUENCE {
+ // policyIdentifier CertPolicyId,
+ // policyQualifiers SEQUENCE SIZE (1..MAX) OF
+ // PolicyQualifierInfo OPTIONAL }
+ //
+ //CertPolicyId ::= OBJECT IDENTIFIER
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.OID({ name: (names.policyIdentifier || "") }),
+ new in_window.org.pkijs.asn1.SEQUENCE({
+ optional: true,
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.policyQualifiers || ""),
+ value: in_window.org.pkijs.schema.x509.PolicyQualifierInfo()
+ })
+ ]
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "CertificatePolicies" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.CertificatePolicies =
+ function()
+ {
+ // CertificatePolicies OID ::= 2.5.29.32
+ //
+ //certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.certificatePolicies || ""),
+ value: in_window.org.pkijs.schema.x509.PolicyInformation()
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "PolicyMapping" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.PolicyMapping =
+ function()
+ {
+ //PolicyMapping ::= SEQUENCE {
+ // issuerDomainPolicy CertPolicyId,
+ // subjectDomainPolicy CertPolicyId }
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.OID({ name: (names.issuerDomainPolicy || "") }),
+ new in_window.org.pkijs.asn1.OID({ name: (names.subjectDomainPolicy || "") })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "PolicyMappings" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.PolicyMappings =
+ function()
+ {
+ // PolicyMappings OID ::= 2.5.29.33
+ //
+ //PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF PolicyMapping
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.mappings || ""),
+ value: in_window.org.pkijs.schema.x509.PolicyMapping()
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "PolicyConstraints" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.PolicyConstraints =
+ function()
+ {
+ // PolicyMappings OID ::= 2.5.29.36
+ //
+ //PolicyConstraints ::= SEQUENCE {
+ // requireExplicitPolicy [0] SkipCerts OPTIONAL,
+ // inhibitPolicyMapping [1] SkipCerts OPTIONAL }
+ //
+ //SkipCerts ::= INTEGER (0..MAX)
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.requireExplicitPolicy || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ }
+ }), // IMPLICIT integer value
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.inhibitPolicyMapping || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ }
+ }) // IMPLICIT integer value
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "ExtKeyUsage" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.ExtKeyUsage =
+ function()
+ {
+ // ExtKeyUsage OID ::= 2.5.29.37
+ //
+ // ExtKeyUsage ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
+
+ // KeyPurposeId ::= OBJECT IDENTIFIER
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.keyPurposes || ""),
+ value: new in_window.org.pkijs.asn1.OID()
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "DistributionPoint" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.DistributionPoint =
+ function()
+ {
+ //DistributionPoint ::= SEQUENCE {
+ // distributionPoint [0] DistributionPointName OPTIONAL,
+ // reasons [1] ReasonFlags OPTIONAL,
+ // cRLIssuer [2] GeneralNames OPTIONAL }
+ //
+ //DistributionPointName ::= CHOICE {
+ // fullName [0] GeneralNames,
+ // nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
+ //
+ //ReasonFlags ::= BIT STRING {
+ // unused (0),
+ // keyCompromise (1),
+ // cACompromise (2),
+ // affiliationChanged (3),
+ // superseded (4),
+ // cessationOfOperation (5),
+ // certificateHold (6),
+ // privilegeWithdrawn (7),
+ // aACompromise (8) }
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.CHOICE({
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ name: (names.distributionPoint || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.distributionPoint_names || ""),
+ value: in_window.org.pkijs.schema.GENERAL_NAME()
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ name: (names.distributionPoint || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value: in_window.org.pkijs.schema.RDN().value_block.value
+ })
+ ]
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.reasons || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ }
+ }), // IMPLICIT bitstring value
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ name: (names.cRLIssuer || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 2 // [2]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.cRLIssuer_names || ""),
+ value: in_window.org.pkijs.schema.GENERAL_NAME()
+ })
+ ]
+ }) // IMPLICIT bitstring value
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "CRLDistributionPoints" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.CRLDistributionPoints =
+ function()
+ {
+ // CRLDistributionPoints OID ::= 2.5.29.31
+ //
+ //CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.distributionPoints || ""),
+ value: in_window.org.pkijs.schema.x509.DistributionPoint()
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "AccessDescription" type
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.AccessDescription =
+ function()
+ {
+ //AccessDescription ::= SEQUENCE {
+ // accessMethod OBJECT IDENTIFIER,
+ // accessLocation GeneralName }
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.OID({ name: (names.accessMethod || "") }),
+ in_window.org.pkijs.schema.GENERAL_NAME(names.accessLocation || "")
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "AuthorityInfoAccess" and "SubjectInfoAccess" types of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.InfoAccess =
+ function()
+ {
+ // AuthorityInfoAccess OID ::= 1.3.6.1.5.5.7.1.1
+ // SubjectInfoAccess OID ::= 1.3.6.1.5.5.7.1.11
+ //
+ //AuthorityInfoAccessSyntax ::=
+ //SEQUENCE SIZE (1..MAX) OF AccessDescription
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.accessDescriptions || ""),
+ value: in_window.org.pkijs.schema.x509.AccessDescription()
+ })
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region ASN.1 schema definition for "IssuingDistributionPoint" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.schema.x509.IssuingDistributionPoint =
+ function()
+ {
+ // IssuingDistributionPoint OID ::= 2.5.29.28
+ //
+ //IssuingDistributionPoint ::= SEQUENCE {
+ // distributionPoint [0] DistributionPointName OPTIONAL,
+ // onlyContainsUserCerts [1] BOOLEAN DEFAULT FALSE,
+ // onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE,
+ // onlySomeReasons [3] ReasonFlags OPTIONAL,
+ // indirectCRL [4] BOOLEAN DEFAULT FALSE,
+ // onlyContainsAttributeCerts [5] BOOLEAN DEFAULT FALSE }
+ //
+ //ReasonFlags ::= BIT STRING {
+ // unused (0),
+ // keyCompromise (1),
+ // cACompromise (2),
+ // affiliationChanged (3),
+ // superseded (4),
+ // cessationOfOperation (5),
+ // certificateHold (6),
+ // privilegeWithdrawn (7),
+ // aACompromise (8) }
+
+ var names = in_window.org.pkijs.getNames(arguments[0]);
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ name: (names.block_name || ""),
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.CHOICE({
+ value: [
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ name: (names.distributionPoint || ""),
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: (names.distributionPoint_names || ""),
+ value: in_window.org.pkijs.schema.GENERAL_NAME()
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ name: (names.distributionPoint || ""),
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value: in_window.org.pkijs.schema.RDN().value_block.value
+ })
+ ]
+ })
+ ]
+ }),
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.onlyContainsUserCerts || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ }
+ }), // IMPLICIT boolean value
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.onlyContainsCACerts || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 2 // [2]
+ }
+ }), // IMPLICIT boolean value
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.onlySomeReasons || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 3 // [3]
+ }
+ }), // IMPLICIT bitstring value
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.indirectCRL || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 4 // [4]
+ }
+ }), // IMPLICIT boolean value
+ new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ name: (names.onlyContainsAttributeCerts || ""),
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 5 // [5]
+ }
+ }) // IMPLICIT boolean value
+ ]
+ }));
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+}
+)(typeof exports !== "undefined" ? exports : window); \ No newline at end of file
diff --git a/dom/webauthn/tests/pkijs/x509_simpl.js b/dom/webauthn/tests/pkijs/x509_simpl.js
new file mode 100644
index 0000000000..c00e79d55b
--- /dev/null
+++ b/dom/webauthn/tests/pkijs/x509_simpl.js
@@ -0,0 +1,7239 @@
+/*
+ * Copyright (c) 2014, GMO GlobalSign
+ * Copyright (c) 2015, Peculiar Ventures
+ * All rights reserved.
+ *
+ * Author 2014-2015, Yury Strozhevsky <www.strozhevsky.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without modification,
+ * are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the copyright holder nor the names of its contributors
+ * may be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
+ * OF SUCH DAMAGE.
+ *
+ */
+(
+function(in_window)
+{
+ //**************************************************************************************
+ // #region Declaration of global variables
+ //**************************************************************************************
+ // #region "org" namespace
+ if(typeof in_window.org === "undefined")
+ in_window.org = {};
+ else
+ {
+ if(typeof in_window.org !== "object")
+ throw new Error("Name org already exists and it's not an object");
+ }
+ // #endregion
+
+ // #region "org.pkijs" namespace
+ if(typeof in_window.org.pkijs === "undefined")
+ in_window.org.pkijs = {};
+ else
+ {
+ if(typeof in_window.org.pkijs !== "object")
+ throw new Error("Name org.pkijs already exists and it's not an object" + " but " + (typeof in_window.org.pkijs));
+ }
+ // #endregion
+
+ // #region "org.pkijs.simpl" namespace
+ if(typeof in_window.org.pkijs.simpl === "undefined")
+ in_window.org.pkijs.simpl = {};
+ else
+ {
+ if(typeof in_window.org.pkijs.simpl !== "object")
+ throw new Error("Name org.pkijs.simpl already exists and it's not an object" + " but " + (typeof in_window.org.pkijs.simpl));
+ }
+ // #endregion
+
+ // #region "org.pkijs.simpl.x509" namespace
+ if(typeof in_window.org.pkijs.simpl.x509 === "undefined")
+ in_window.org.pkijs.simpl.x509 = {};
+ else
+ {
+ if(typeof in_window.org.pkijs.simpl.x509 !== "object")
+ throw new Error("Name org.pkijs.simpl.x509 already exists and it's not an object" + " but " + (typeof in_window.org.pkijs.simpl.x509));
+ }
+ // #endregion
+
+ // #region "local" namespace
+ var local = {};
+ // #endregion
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "Time" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.TIME =
+ function()
+ {
+ // #region Internal properties of the object
+ this.type = 0; // 0 - UTCTime; 1 - GeneralizedTime; 2 - empty value
+ this.value = new Date(0, 0, 0);
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.TIME.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.type = (arguments[0].type || 0);
+ this.value = (arguments[0].value || (new Date(0, 0, 0)));
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.TIME.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.TIME({
+ names: {
+ utcTimeName: "utcTimeName",
+ generalTimeName: "generalTimeName"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for TIME");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ if("utcTimeName" in asn1.result)
+ {
+ this.type = 0;
+ this.value = asn1.result.utcTimeName.toDate();
+ }
+ if("generalTimeName" in asn1.result)
+ {
+ this.type = 1;
+ this.value = asn1.result.generalTimeName.toDate();
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.TIME.prototype.toSchema =
+ function()
+ {
+ // #region Construct and return new ASN.1 schema for this object
+ var result = {};
+
+ if(this.type === 0)
+ result = new in_window.org.pkijs.asn1.UTCTIME({ value_date: this.value });
+ if(this.type === 1)
+ result = new in_window.org.pkijs.asn1.GENERALIZEDTIME({ value_date: this.value });
+
+ return result;
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.TIME.prototype.toJSON =
+ function()
+ {
+ return {
+ type: this.type,
+ value: this.value
+ };
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "GeneralName" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.GENERAL_NAME =
+ function()
+ {
+ // #region Internal properties of the object
+ this.NameType = 9; // Name type - from a tagged value (0 for "otherName", 1 for "rfc822Name" etc.)
+ this.Name = {};
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.GENERAL_NAME.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.NameType = arguments[0].NameType || 9;
+ this.Name = arguments[0].Name || {};
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.GENERAL_NAME.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.GENERAL_NAME({
+ names: {
+ block_name: "block_name",
+ otherName: "otherName",
+ rfc822Name: "rfc822Name",
+ dNSName: "dNSName",
+ x400Address: "x400Address",
+ directoryName: {
+ names: {
+ block_name: "directoryName"
+ }
+ },
+ ediPartyName: "ediPartyName",
+ uniformResourceIdentifier: "uniformResourceIdentifier",
+ iPAddress: "iPAddress",
+ registeredID: "registeredID"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for GENERAL_NAME");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.NameType = asn1.result["block_name"].id_block.tag_number;
+
+ switch(this.NameType)
+ {
+ case 0: // otherName
+ this.Name = asn1.result["block_name"];
+ break;
+ case 1: // rfc822Name + dNSName + uniformResourceIdentifier
+ case 2:
+ case 6:
+ {
+ var value = asn1.result["block_name"];
+
+ value.id_block.tag_class = 1; // UNIVERSAL
+ value.id_block.tag_number = 22; // IA5STRING
+
+ var value_ber = value.toBER(false);
+
+ this.Name = in_window.org.pkijs.fromBER(value_ber).result.value_block.value;
+ }
+ break;
+ case 3: // x400Address
+ this.Name = asn1.result["block_name"];
+ break;
+ case 4: // directoryName
+ this.Name = new in_window.org.pkijs.simpl.RDN({ schema: asn1.result["directoryName"] });
+ break;
+ case 5: // ediPartyName
+ this.Name = asn1.result["ediPartyName"];
+ break;
+ case 7: // iPAddress
+ this.Name = new in_window.org.pkijs.asn1.OCTETSTRING({ value_hex: asn1.result["block_name"].value_block.value_hex });
+ break;
+ case 8: // registeredID
+ {
+ var value = asn1.result["block_name"];
+
+ value.id_block.tag_class = 1; // UNIVERSAL
+ value.id_block.tag_number = 6; // OID
+
+ var value_ber = value.toBER(false);
+
+ this.Name = in_window.org.pkijs.fromBER(value_ber).result.value_block.toString(); // Getting a string representation of the OID
+ }
+ break;
+ default:
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.GENERAL_NAME.prototype.toSchema =
+ function(schema)
+ {
+ // #region Construct and return new ASN.1 schema for this object
+ switch(this.NameType)
+ {
+ case 0:
+ case 3:
+ case 5:
+ return new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: this.NameType
+ },
+ value: [
+ this.Name
+ ]
+ });
+
+ break;
+ case 1:
+ case 2:
+ case 6:
+ {
+ var value = new in_window.org.pkijs.asn1.IA5STRING({ value: this.Name });
+
+ value.id_block.tag_class = 3;
+ value.id_block.tag_number = this.NameType;
+
+ return value;
+ }
+ break;
+ case 4:
+ return new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 4
+ },
+ value: [this.Name.toSchema()]
+ });
+ break;
+ case 7:
+ {
+ var value = this.Name;
+
+ value.id_block.tag_class = 3;
+ value.id_block.tag_number = this.NameType;
+
+ return value;
+ }
+ break;
+ case 8:
+ {
+ var value = new in_window.org.pkijs.asn1.OID({ value: this.Name });
+
+ value.id_block.tag_class = 3;
+ value.id_block.tag_number = this.NameType;
+
+ return value;
+ }
+ break;
+ default:
+ return in_window.org.pkijs.schema.GENERAL_NAME();
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.GENERAL_NAME.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ NameType: this.NameType
+ };
+
+ if((typeof this.Name) === "string")
+ _object.Name = this.Name;
+ else
+ _object.Name = this.Name.toJSON();
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "GeneralNames" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.GENERAL_NAMES =
+ function()
+ {
+ // #region Internal properties of the object
+ this.names = new Array(); // Array of "org.pkijs.simpl.GENERAL_NAME"
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.GENERAL_NAMES.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.names = arguments[0].names || new Array(); // Array of "org.pkijs.simpl.GENERAL_NAME"
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.GENERAL_NAMES.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ new in_window.org.pkijs.asn1.REPEATED({
+ name: "names",
+ value: in_window.org.pkijs.schema.GENERAL_NAME()
+ })
+ ]
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for GENERAL_NAMES");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ var n = asn1.result["names"];
+
+ for(var i = 0; i < n.length; i++)
+ this.names.push(new in_window.org.pkijs.simpl.GENERAL_NAME({ schema: n[i] }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.GENERAL_NAMES.prototype.toSchema =
+ function(schema)
+ {
+ // #region Construct and return new ASN.1 schema for this object
+ var output_array = new Array();
+
+ for(var i = 0; i < this.names.length; i++)
+ output_array.push(this.names[i].toSchema());
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.GENERAL_NAMES.prototype.toJSON =
+ function()
+ {
+ var _names = new Array();
+
+ for(var i = 0; i < this.names.length; i++)
+ _names.push(this.names[i].toJSON());
+
+ return {
+ names: _names
+ };
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "AlgorithmIdentifier" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER =
+ function()
+ {
+ // #region Internal properties of the object
+ this.algorithm_id = "";
+ // OPTIONAL this.algorithm_params = new in_window.org.pkijs.asn1.NULL();
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.algorithm_id = arguments[0].algorithm_id || "";
+ if("algorithm_params" in arguments[0])
+ this.algorithm_params = arguments[0].algorithm_params;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.ALGORITHM_IDENTIFIER({
+ names: {
+ algorithmIdentifier: "algorithm",
+ algorithmParams: "params"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for ALGORITHM_IDENTIFIER");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.algorithm_id = asn1.result.algorithm.value_block.toString();
+ if("params" in asn1.result)
+ this.algorithm_params = asn1.result.params;
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ output_array.push(new in_window.org.pkijs.asn1.OID({ value: this.algorithm_id }));
+ if("algorithm_params" in this)
+ output_array.push(this.algorithm_params);
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER.prototype.getCommonName =
+ function()
+ {
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ algorithm_id: this.algorithm_id
+ };
+
+ if("algorithm_params" in this)
+ _object.algorithm_params = this.algorithm_params.toJSON();
+
+ return _object;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER.prototype.isEqual =
+ function(algorithmIdentifier)
+ {
+ /// <summary>Check that two "ALGORITHM_IDENTIFIERs" are equal</summary>
+ /// <param name="algorithmIdentifier" type="in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER">The algorithm identifier to compare with</param>
+
+ // #region Check input type
+ if((algorithmIdentifier instanceof in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER) == false)
+ return false;
+ // #endregion
+
+ // #region Check "algorithm_id"
+ if(this.algorithm_id != algorithmIdentifier.algorithm_id)
+ return false;
+ // #endregion
+
+ // #region Check "algorithm_params"
+ if("algorithm_params" in this)
+ {
+ if("algorithm_params" in algorithmIdentifier)
+ {
+ return JSON.stringify(this.algorithm_params) == JSON.stringify(algorithmIdentifier.algorithm_params);
+ }
+ else
+ return false;
+ }
+ else
+ {
+ if("algorithm_params" in algorithmIdentifier)
+ return false;
+ }
+ // #endregion
+
+ return true;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "RSAPublicKey" type (RFC3447)
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.RSAPublicKey =
+ function()
+ {
+ // #region Internal properties of the object
+ this.modulus = new in_window.org.pkijs.asn1.INTEGER();
+ this.publicExponent = new in_window.org.pkijs.asn1.INTEGER();
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.RSAPublicKey.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.modulus = arguments[0].modulus || new in_window.org.pkijs.asn1.INTEGER();
+ this.publicExponent = arguments[0].publicExponent || new in_window.org.pkijs.asn1.INTEGER();
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.RSAPublicKey.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.RSAPublicKey({
+ names: {
+ modulus: "modulus",
+ publicExponent: "publicExponent"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for RSAPublicKey");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.modulus = asn1.result["modulus"];
+ this.publicExponent = asn1.result["publicExponent"];
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.RSAPublicKey.prototype.toSchema =
+ function()
+ {
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ this.modulus,
+ this.publicExponent
+ ]
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.RSAPublicKey.prototype.toJSON =
+ function()
+ {
+ return {
+ modulus: this.modulus.toJSON(),
+ publicExponent: this.publicExponent.toJSON()
+ };
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "OtherPrimeInfo" type (RFC3447)
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.OtherPrimeInfo =
+ function()
+ {
+ // #region Internal properties of the object
+ this.prime = new in_window.org.pkijs.asn1.INTEGER();
+ this.exponent = new in_window.org.pkijs.asn1.INTEGER();
+ this.coefficient = new in_window.org.pkijs.asn1.INTEGER();
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.OtherPrimeInfo.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.prime = arguments[0].prime || new in_window.org.pkijs.asn1.INTEGER();
+ this.exponent = arguments[0].exponent || new in_window.org.pkijs.asn1.INTEGER();
+ this.coefficient = arguments[0].coefficient || new in_window.org.pkijs.asn1.INTEGER();
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.OtherPrimeInfo.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.OtherPrimeInfo({
+ names: {
+ prime: "prime",
+ exponent: "exponent",
+ coefficient: "coefficient"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for OtherPrimeInfo");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.prime = asn1.result["prime"];
+ this.exponent = asn1.result["exponent"];
+ this.coefficient = asn1.result["coefficient"];
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.OtherPrimeInfo.prototype.toSchema =
+ function()
+ {
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ this.prime,
+ this.exponent,
+ this.coefficient
+ ]
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.OtherPrimeInfo.prototype.toJSON =
+ function()
+ {
+ return {
+ prime: this.prime.toJSON(),
+ exponent: this.exponent.toJSON(),
+ coefficient: this.coefficient.toJSON()
+ };
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "RSAPrivateKey" type (RFC3447)
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.RSAPrivateKey =
+ function()
+ {
+ // #region Internal properties of the object
+ this.version = 0;
+ this.modulus = new in_window.org.pkijs.asn1.INTEGER();
+ this.publicExponent = new in_window.org.pkijs.asn1.INTEGER();
+ this.privateExponent = new in_window.org.pkijs.asn1.INTEGER();
+ this.prime1 = new in_window.org.pkijs.asn1.INTEGER();
+ this.prime2 = new in_window.org.pkijs.asn1.INTEGER();
+ this.exponent1 = new in_window.org.pkijs.asn1.INTEGER();
+ this.exponent2 = new in_window.org.pkijs.asn1.INTEGER();
+ this.coefficient = new in_window.org.pkijs.asn1.INTEGER();
+ // OPTIONAL this.otherPrimeInfos = new Array(); // Array of "OtherPrimeInfo"
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.RSAPrivateKey.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.version = arguments[0].version || 0;
+ this.modulus = arguments[0].modulus || new in_window.org.pkijs.asn1.INTEGER();
+ this.publicExponent = arguments[0].publicExponent || new in_window.org.pkijs.asn1.INTEGER();
+ this.privateExponent = arguments[0].privateExponent || new in_window.org.pkijs.asn1.INTEGER();
+ this.prime1 = arguments[0].prime1 || new in_window.org.pkijs.asn1.INTEGER();
+ this.prime2 = arguments[0].prime2 || new in_window.org.pkijs.asn1.INTEGER();
+ this.exponent1 = arguments[0].exponent1 || new in_window.org.pkijs.asn1.INTEGER();
+ this.exponent2 = arguments[0].exponent2 || new in_window.org.pkijs.asn1.INTEGER();
+ this.coefficient = arguments[0].coefficient || new in_window.org.pkijs.asn1.INTEGER();
+ if("otherPrimeInfos" in arguments[0])
+ this.otherPrimeInfos = arguments[0].otherPrimeInfos || new Array();
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.RSAPrivateKey.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.RSAPrivateKey({
+ names: {
+ version: "version",
+ modulus: "modulus",
+ publicExponent: "publicExponent",
+ privateExponent: "privateExponent",
+ prime1: "prime1",
+ prime2: "prime2",
+ exponent1: "exponent1",
+ exponent2: "exponent2",
+ coefficient: "coefficient",
+ otherPrimeInfos: "otherPrimeInfos"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for RSAPrivateKey");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.version = asn1.result["version"].value_block.value_dec;
+ this.modulus = asn1.result["modulus"];
+ this.publicExponent = asn1.result["publicExponent"];
+ this.privateExponent = asn1.result["privateExponent"];
+ this.prime1 = asn1.result["prime1"];
+ this.prime2 = asn1.result["prime2"];
+ this.exponent1 = asn1.result["exponent1"];
+ this.exponent2 = asn1.result["exponent2"];
+ this.coefficient = asn1.result["coefficient"];
+
+ if("otherPrimeInfos" in asn1.result)
+ {
+ var otherPrimeInfos_array = asn1.result["otherPrimeInfos"];
+
+ for(var i = 0; i < otherPrimeInfos_array.length; i++)
+ this.otherPrimeInfos.push(new in_window.org.pkijs.simpl.x509.OtherPrimeInfo({ schema: otherPrimeInfos_array[i] }));
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.RSAPrivateKey.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ output_array.push(new in_window.org.pkijs.asn1.INTEGER({ value: this.version }));
+ output_array.push(this.modulus);
+ output_array.push(this.publicExponent);
+ output_array.push(this.privateExponent);
+ output_array.push(this.prime1);
+ output_array.push(this.prime2);
+ output_array.push(this.exponent1);
+ output_array.push(this.exponent2);
+ output_array.push(this.coefficient);
+
+ if("otherPrimeInfos" in this)
+ {
+ var otherPrimeInfos_array = new Array();
+
+ for(var i = 0; i < this.otherPrimeInfos.length; i++)
+ otherPrimeInfos_array.push(this.otherPrimeInfos[i].toSchema());
+
+ output_array.push(new in_window.org.pkijs.asn1.SEQUENCE({ value: otherPrimeInfos_array }));
+ }
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.RSAPrivateKey.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ version: this.version,
+ modulus: this.modulus.toJSON(),
+ publicExponent: this.publicExponent.toJSON(),
+ privateExponent: this.privateExponent.toJSON(),
+ prime1: this.prime1.toJSON(),
+ prime2: this.prime2.toJSON(),
+ exponent1: this.exponent1.toJSON(),
+ exponent2: this.exponent2.toJSON(),
+ coefficient: this.coefficient.toJSON()
+ };
+
+ if("otherPrimeInfos" in this)
+ {
+ _object.otherPrimeInfos = new Array();
+
+ for(var i = 0; i < this.otherPrimeInfos.length; i++)
+ _object.otherPrimeInfos.push(this.otherPrimeInfos[i].toJSON());
+ }
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "RSASSA_PSS_params" type (RFC3447)
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.RSASSA_PSS_params =
+ function()
+ {
+ // #region Internal properties of the object
+ // OPTIONAL this.hashAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER();
+ // OPTIONAL this.maskGenAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER();
+ // OPTIONAL this.saltLength = 20; // new in_window.org.pkijs.asn1.INTEGER();
+ // OPTIONAL this.trailerField = 1; // new in_window.org.pkijs.asn1.INTEGER();
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.RSASSA_PSS_params.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ if("hashAlgorithm" in arguments[0])
+ this.hashAlgorithm = arguments[0].hashAlgorithm;
+
+ if("maskGenAlgorithm" in arguments[0])
+ this.maskGenAlgorithm = arguments[0].maskGenAlgorithm;
+
+ if("saltLength" in arguments[0])
+ this.saltLength = arguments[0].saltLength;
+
+ if("trailerField" in arguments[0])
+ this.trailerField = arguments[0].trailerField;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.RSASSA_PSS_params.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.RSASSA_PSS_params({
+ names: {
+ hashAlgorithm: {
+ names: {
+ block_name: "hashAlgorithm"
+ }
+ },
+ maskGenAlgorithm: {
+ names: {
+ block_name: "maskGenAlgorithm"
+ }
+ },
+ saltLength: "saltLength",
+ trailerField: "trailerField"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for RSASSA_PSS_params");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ if("hashAlgorithm" in asn1.result)
+ this.hashAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({ schema: asn1.result["hashAlgorithm"] });
+
+ if("maskGenAlgorithm" in asn1.result)
+ this.maskGenAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({ schema: asn1.result["maskGenAlgorithm"] });
+
+ if("saltLength" in asn1.result)
+ this.saltLength = asn1.result["saltLength"].value_block.value_dec;
+
+ if("trailerField" in asn1.result)
+ this.trailerField = asn1.result["trailerField"].value_block.value_dec;
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.RSASSA_PSS_params.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ if("hashAlgorithm" in this)
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [this.hashAlgorithm.toSchema()]
+ }));
+
+ if("maskGenAlgorithm" in this)
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value: [this.maskGenAlgorithm.toSchema()]
+ }));
+
+ if("saltLength" in this)
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 2 // [2]
+ },
+ value: [new in_window.org.pkijs.asn1.INTEGER({ value: this.saltLength })]
+ }));
+
+ if("trailerField" in this)
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 3 // [3]
+ },
+ value: [new in_window.org.pkijs.asn1.INTEGER({ value: this.trailerField })]
+ }));
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.RSASSA_PSS_params.prototype.toJSON =
+ function()
+ {
+ var _object = {};
+
+ if("hashAlgorithm" in this)
+ _object.hashAlgorithm = this.hashAlgorithm.toJSON();
+
+ if("maskGenAlgorithm" in this)
+ _object.maskGenAlgorithm = this.maskGenAlgorithm.toJSON();
+
+ if("saltLength" in this)
+ _object.saltLength = this.saltLength.toJSON();
+
+ if("trailerField" in this)
+ _object.trailerField = this.trailerField.toJSON();
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "SubjectPublicKeyInfo" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PUBLIC_KEY_INFO =
+ function()
+ {
+ // #region Internal properties of the object
+ this.algorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER();
+ this.subjectPublicKey = new in_window.org.pkijs.asn1.BITSTRING();
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.PUBLIC_KEY_INFO.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.algorithm = (arguments[0].algorithm || (new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER()));
+ this.subjectPublicKey = (arguments[0].subjectPublicKey || (new in_window.org.pkijs.asn1.BITSTRING()));
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PUBLIC_KEY_INFO.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.PUBLIC_KEY_INFO({
+ names: {
+ algorithm: {
+ names: {
+ block_name: "algorithm"
+ }
+ },
+ subjectPublicKey: "subjectPublicKey"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for PUBLIC_KEY_INFO");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.algorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({ schema: asn1.result.algorithm });
+ this.subjectPublicKey = asn1.result.subjectPublicKey;
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PUBLIC_KEY_INFO.prototype.toSchema =
+ function()
+ {
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ this.algorithm.toSchema(),
+ this.subjectPublicKey
+ ]
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PUBLIC_KEY_INFO.prototype.importKey =
+ function(publicKey)
+ {
+ /// <param name="publicKey" type="Key">Public key to work with</param>
+
+ // #region Initial variables
+ var sequence = Promise.resolve();
+ var _this = this;
+ // #endregion
+
+ // #region Initial check
+ if(typeof publicKey === "undefined")
+ return new Promise(function(resolve, reject) { reject("Need to provide publicKey input parameter"); });
+ // #endregion
+
+ // #region Get a "crypto" extension
+ var crypto = in_window.org.pkijs.getCrypto();
+ if(typeof crypto == "undefined")
+ return new Promise(function(resolve, reject) { reject("Unable to create WebCrypto object"); });
+ // #endregion
+
+ // #region Export public key
+ sequence = sequence.then(
+ function()
+ {
+ return crypto.exportKey("spki", publicKey);
+ }
+ );
+ // #endregion
+
+ // #region Initialize internal variables by parsing exported value
+ sequence = sequence.then(
+ function(exportedKey)
+ {
+ var asn1 = in_window.org.pkijs.fromBER(exportedKey);
+ try
+ {
+ in_window.org.pkijs.simpl.PUBLIC_KEY_INFO.prototype.fromSchema.call(_this, asn1.result);
+ }
+ catch(exception)
+ {
+ return new Promise(function(resolve, reject) { reject("Error during initializing object from schema"); });
+ }
+ },
+ function(error)
+ {
+ return new Promise(function(resolve, reject) { reject("Error during exporting public key: " + error); });
+ }
+ );
+ // #endregion
+
+ return sequence;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PUBLIC_KEY_INFO.prototype.toJSON =
+ function()
+ {
+ return {
+ algorithm: this.algorithm.toJSON(),
+ subjectPublicKey: this.subjectPublicKey.toJSON()
+ };
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "AttributeTypeAndValue" type (part of RelativeDistinguishedName)
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ATTR_TYPE_AND_VALUE =
+ function()
+ {
+ // #region Internal properties of the object
+ this.type = "";
+ this.value = {}; // ANY -- DEFINED BY AttributeType
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.ATTR_TYPE_AND_VALUE.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.type = (arguments[0].type || "");
+ this.value = (arguments[0].value || {});
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ATTR_TYPE_AND_VALUE.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.ATTR_TYPE_AND_VALUE({
+ names: {
+ type: "type",
+ value: "typeValue"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for ATTR_TYPE_AND_VALUE");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.type = asn1.result.type.value_block.toString();
+ this.value = asn1.result.typeValue;
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ATTR_TYPE_AND_VALUE.prototype.toSchema =
+ function()
+ {
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ new in_window.org.pkijs.asn1.OID({ value: this.type }),
+ this.value
+ ]
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ATTR_TYPE_AND_VALUE.prototype.isEqual =
+ function()
+ {
+ if(arguments[0] instanceof in_window.org.pkijs.simpl.ATTR_TYPE_AND_VALUE)
+ {
+ if(this.type !== arguments[0].type)
+ return false;
+
+ if(((this.value instanceof in_window.org.pkijs.asn1.UTF8STRING) && (arguments[0].value instanceof in_window.org.pkijs.asn1.UTF8STRING)) ||
+ ((this.value instanceof in_window.org.pkijs.asn1.BMPSTRING) && (arguments[0].value instanceof in_window.org.pkijs.asn1.BMPSTRING)) ||
+ ((this.value instanceof in_window.org.pkijs.asn1.UNIVERSALSTRING) && (arguments[0].value instanceof in_window.org.pkijs.asn1.UNIVERSALSTRING)) ||
+ ((this.value instanceof in_window.org.pkijs.asn1.NUMERICSTRING) && (arguments[0].value instanceof in_window.org.pkijs.asn1.NUMERICSTRING)) ||
+ ((this.value instanceof in_window.org.pkijs.asn1.PRINTABLESTRING) && (arguments[0].value instanceof in_window.org.pkijs.asn1.PRINTABLESTRING)) ||
+ ((this.value instanceof in_window.org.pkijs.asn1.TELETEXSTRING) && (arguments[0].value instanceof in_window.org.pkijs.asn1.TELETEXSTRING)) ||
+ ((this.value instanceof in_window.org.pkijs.asn1.VIDEOTEXSTRING) && (arguments[0].value instanceof in_window.org.pkijs.asn1.VIDEOTEXSTRING)) ||
+ ((this.value instanceof in_window.org.pkijs.asn1.IA5STRING) && (arguments[0].value instanceof in_window.org.pkijs.asn1.IA5STRING)) ||
+ ((this.value instanceof in_window.org.pkijs.asn1.GRAPHICSTRING) && (arguments[0].value instanceof in_window.org.pkijs.asn1.GRAPHICSTRING)) ||
+ ((this.value instanceof in_window.org.pkijs.asn1.VISIBLESTRING) && (arguments[0].value instanceof in_window.org.pkijs.asn1.VISIBLESTRING)) ||
+ ((this.value instanceof in_window.org.pkijs.asn1.GENERALSTRING) && (arguments[0].value instanceof in_window.org.pkijs.asn1.GENERALSTRING)) ||
+ ((this.value instanceof in_window.org.pkijs.asn1.CHARACTERSTRING) && (arguments[0].value instanceof in_window.org.pkijs.asn1.CHARACTERSTRING)))
+ {
+ var value1 = in_window.org.pkijs.stringPrep(this.value.value_block.value);
+ var value2 = in_window.org.pkijs.stringPrep(arguments[0].value.value_block.value);
+
+ if(value1.localeCompare(value2) !== 0)
+ return false;
+ }
+ else // Comparing as two ArrayBuffers
+ {
+ if(in_window.org.pkijs.isEqual_buffer(this.value.value_before_decode, arguments[0].value.value_before_decode) === false)
+ return false;
+ }
+
+ return true;
+ }
+ else
+ return false;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ATTR_TYPE_AND_VALUE.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ type: this.type
+ };
+
+ if(Object.keys(this.value).length !== 0)
+ _object.value = this.value.toJSON();
+ else
+ _object.value = this.value;
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "RelativeDistinguishedName" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.RDN =
+ function()
+ {
+ // #region Internal properties of the object
+ /// <field name="types_and_values" type="Array" elementType="in_window.org.pkijs.simpl.ATTR_TYPE_AND_VALUE">Array of "type and value" objects</field>
+ this.types_and_values = new Array();
+ /// <field name="value_before_decode" type="ArrayBuffer">Value of the RDN before decoding from schema</field>
+ this.value_before_decode = new ArrayBuffer(0);
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.RDN.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.types_and_values = (arguments[0].types_and_values || (new Array()));
+ this.value_before_decode = arguments[0].value_before_decode || new ArrayBuffer(0);
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.RDN.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.RDN({
+ names: {
+ block_name: "RDN",
+ repeated_set: "types_and_values"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for RDN");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ if("types_and_values" in asn1.result) // Could be a case when there is no "types and values"
+ {
+ var types_and_values_array = asn1.result.types_and_values;
+ for(var i = 0; i < types_and_values_array.length; i++)
+ this.types_and_values.push(new in_window.org.pkijs.simpl.ATTR_TYPE_AND_VALUE({ schema: types_and_values_array[i] }));
+ }
+
+ this.value_before_decode = asn1.result.RDN.value_before_decode;
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.RDN.prototype.toSchema =
+ function()
+ {
+ // #region Decode stored TBS value
+ if(this.value_before_decode.byteLength === 0) // No stored encoded array, create "from scratch"
+ {
+ // #region Create array for output set
+ var output_array = new Array();
+
+ for(var i = 0; i < this.types_and_values.length; i++)
+ output_array.push(this.types_and_values[i].toSchema());
+ // #endregion
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [new in_window.org.pkijs.asn1.SET({ value: output_array })]
+ }));
+ }
+
+ var asn1 = in_window.org.pkijs.fromBER(this.value_before_decode);
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return asn1.result;
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.RDN.prototype.isEqual =
+ function()
+ {
+ if(arguments[0] instanceof in_window.org.pkijs.simpl.RDN)
+ {
+ if(this.types_and_values.length != arguments[0].types_and_values.length)
+ return false;
+
+ for(var i = 0; i < this.types_and_values.length; i++)
+ {
+ if(this.types_and_values[i].isEqual(arguments[0].types_and_values[i]) === false)
+ return false;
+ }
+
+ return true;
+ }
+ else
+ {
+ if(arguments[0] instanceof ArrayBuffer)
+ return in_window.org.pkijs.isEqual_buffer(this.value_before_decode, arguments[0]);
+ else
+ return false;
+ }
+
+ return false;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.RDN.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ types_and_values: new Array()
+ };
+
+ for(var i = 0; i < this.types_and_values.length; i++)
+ _object.types_and_values.push(this.types_and_values[i].toJSON());
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "AuthorityKeyIdentifier" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.AuthorityKeyIdentifier =
+ function()
+ {
+ // #region Internal properties of the object
+ // OPTIONAL this.keyIdentifier - OCTETSTRING
+ // OPTIONAL this.authorityCertIssuer - Array of GeneralName
+ // OPTIONAL this.authorityCertSerialNumber - INTEGER
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.AuthorityKeyIdentifier.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ if("keyIdentifier" in arguments[0])
+ this.keyIdentifier = arguments[0].keyIdentifier;
+
+ if("authorityCertIssuer" in arguments[0])
+ this.authorityCertIssuer = arguments[0].authorityCertIssuer;
+
+ if("authorityCertSerialNumber" in arguments[0])
+ this.authorityCertSerialNumber = arguments[0].authorityCertSerialNumber;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.AuthorityKeyIdentifier.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.AuthorityKeyIdentifier({
+ names: {
+ keyIdentifier: "keyIdentifier",
+ authorityCertIssuer: "authorityCertIssuer",
+ authorityCertSerialNumber: "authorityCertSerialNumber"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for AuthorityKeyIdentifier");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ if("keyIdentifier" in asn1.result)
+ {
+ asn1.result["keyIdentifier"].id_block.tag_class = 1; // UNIVERSAL
+ asn1.result["keyIdentifier"].id_block.tag_number = 4; // OCTETSTRING
+
+ this.keyIdentifier = asn1.result["keyIdentifier"];
+ }
+
+ if("authorityCertIssuer" in asn1.result)
+ {
+ this.authorityCertIssuer = new Array();
+ var issuer_array = asn1.result["authorityCertIssuer"];
+
+ for(var i = 0; i < issuer_array.length; i++)
+ this.authorityCertIssuer.push(new in_window.org.pkijs.simpl.GENERAL_NAME({ schema: issuer_array[i] }));
+ }
+
+ if("authorityCertSerialNumber" in asn1.result)
+ {
+ asn1.result["authorityCertSerialNumber"].id_block.tag_class = 1; // UNIVERSAL
+ asn1.result["authorityCertSerialNumber"].id_block.tag_number = 2; // INTEGER
+
+ this.authorityCertSerialNumber = asn1.result["authorityCertSerialNumber"];
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.AuthorityKeyIdentifier.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ if("keyIdentifier" in this)
+ {
+ var value = this.keyIdentifier;
+
+ value.id_block.tag_class = 3; // CONTEXT-SPECIFIC
+ value.id_block.tag_number = 0; // [0]
+
+ output_array.push(value);
+ }
+
+ if("authorityCertIssuer" in this)
+ {
+ var issuer_array = new Array();
+
+ for(var i = 0; i < this.authorityCertIssuer.length; i++)
+ issuer_array.push(this.authorityCertIssuer[i].toSchema());
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value: [new in_window.org.pkijs.asn1.SEQUENCE({
+ value: issuer_array
+ })]
+ }));
+ }
+
+ if("authorityCertSerialNumber" in this)
+ {
+ var value = this.authorityCertSerialNumber;
+
+ value.id_block.tag_class = 3; // CONTEXT-SPECIFIC
+ value.id_block.tag_number = 2; // [2]
+
+ output_array.push(value);
+ }
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.AuthorityKeyIdentifier.prototype.toJSON =
+ function()
+ {
+ var _object = {};
+
+ if("keyIdentifier" in this)
+ _object.keyIdentifier = this.keyIdentifier.toJSON();
+
+ if("authorityCertIssuer" in this)
+ {
+ _object.authorityCertIssuer = new Array();
+
+ for(var i = 0; i < this.authorityCertIssuer.length; i++)
+ _object.authorityCertIssuer.push(this.authorityCertIssuer[i].toJSON());
+ }
+
+ if("authorityCertSerialNumber" in this)
+ _object.authorityCertSerialNumber = this.authorityCertSerialNumber.toJSON();
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "PrivateKeyUsagePeriod" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PrivateKeyUsagePeriod =
+ function()
+ {
+ // #region Internal properties of the object
+ // OPTIONAL this.notBefore - new Date()
+ // OPTIONAL this.notAfter - new Date()
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.PrivateKeyUsagePeriod.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ if("notBefore" in arguments[0])
+ this.notBefore = arguments[0].notBefore;
+
+ if("notAfter" in arguments[0])
+ this.notAfter = arguments[0].notAfter;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PrivateKeyUsagePeriod.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.PrivateKeyUsagePeriod({
+ names: {
+ notBefore: "notBefore",
+ notAfter: "notAfter"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for PrivateKeyUsagePeriod");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ if("notBefore" in asn1.result)
+ {
+ var localNotBefore = new in_window.org.pkijs.asn1.GENERALIZEDTIME();
+ localNotBefore.fromBuffer(asn1.result["notBefore"].value_block.value_hex);
+ this.notBefore = localNotBefore.toDate();
+ }
+
+ if("notAfter" in asn1.result)
+ {
+ var localNotAfter = new in_window.org.pkijs.asn1.GENERALIZEDTIME({ value_hex: asn1.result["notAfter"].value_block.value_hex });
+ localNotAfter.fromBuffer(asn1.result["notAfter"].value_block.value_hex);
+ this.notAfter = localNotAfter.toDate();
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PrivateKeyUsagePeriod.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ if("notBefore" in this)
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value_hex: (new in_window.org.pkijs.asn1.GENERALIZEDTIME({ value_date: this.notBefore })).value_block.value_hex
+ }));
+
+ if("notAfter" in this)
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value_hex: (new in_window.org.pkijs.asn1.GENERALIZEDTIME({ value_date: this.notAfter })).value_block.value_hex
+ }));
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PrivateKeyUsagePeriod.prototype.toJSON =
+ function()
+ {
+ var _object = {};
+
+ if("notBefore" in this)
+ _object.notBefore = this.notBefore;
+
+ if("notAfter" in this)
+ _object.notAfter = this.notAfter;
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "IssuerAltName" and "SubjectAltName" types of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.AltName =
+ function()
+ {
+ // #region Internal properties of the object
+ this.altNames = new Array(); //Array of GeneralName
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.AltName.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.altNames = arguments[0].altNames || new Array();
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.AltName.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.AltName({
+ names: {
+ altNames: "altNames"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for AltName");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ if("altNames" in asn1.result)
+ {
+ var altNames_array = asn1.result["altNames"];
+
+ for(var i = 0; i < altNames_array.length; i++)
+ this.altNames.push(new in_window.org.pkijs.simpl.GENERAL_NAME({ schema: altNames_array[i] }));
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.AltName.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ for(var i = 0; i < this.altNames.length; i++)
+ output_array.push(this.altNames[i].toSchema());
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.AltName.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ altNames: new Array()
+ };
+
+ for(var i = 0; i < this.altNames.length; i++)
+ _object.altNames.push(this.altNames[i].toJSON());
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "SubjectDirectoryAttributes" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.SubjectDirectoryAttributes =
+ function()
+ {
+ // #region Internal properties of the object
+ this.attributes = new Array(); // Array of "simpl.ATTRIBUTE"
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.SubjectDirectoryAttributes.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.attributes = arguments[0].attributes || new Array(); // Array of "simpl.ATTRIBUTE"
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.SubjectDirectoryAttributes.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.SubjectDirectoryAttributes({
+ names: {
+ attributes: "attributes"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for SubjectDirectoryAttributes");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ var attrs = asn1.result["attributes"];
+
+ for(var i = 0; i < attrs.length; i++)
+ this.attributes.push(new in_window.org.pkijs.simpl.ATTRIBUTE({ schema: attrs[i] }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.SubjectDirectoryAttributes.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ for(var i = 0; i < this.attributes.length; i++)
+ output_array.push(this.attributes[i].toSchema());
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.SubjectDirectoryAttributes.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ attributes: new Array()
+ };
+
+ for(var i = 0; i < this.attributes.length; i++)
+ _object.attributes.push(this.attributes[i].toJSON());
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "PolicyMapping" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyMapping =
+ function()
+ {
+ // #region Internal properties of the object
+ this.issuerDomainPolicy = "";
+ this.subjectDomainPolicy = "";
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.PolicyMapping.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.issuerDomainPolicy = arguments[0].issuerDomainPolicy || "";
+ this.subjectDomainPolicy = arguments[0].subjectDomainPolicy || "";
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyMapping.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.PolicyMapping({
+ names: {
+ issuerDomainPolicy: "issuerDomainPolicy",
+ subjectDomainPolicy: "subjectDomainPolicy"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for PolicyMapping");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.issuerDomainPolicy = asn1.result["issuerDomainPolicy"].value_block.toString();
+ this.subjectDomainPolicy = asn1.result["subjectDomainPolicy"].value_block.toString();
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyMapping.prototype.toSchema =
+ function()
+ {
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ new in_window.org.pkijs.asn1.OID({ value: this.issuerDomainPolicy }),
+ new in_window.org.pkijs.asn1.OID({ value: this.subjectDomainPolicy })
+ ]
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyMapping.prototype.toJSON =
+ function()
+ {
+ return {
+ issuerDomainPolicy: this.issuerDomainPolicy,
+ subjectDomainPolicy: this.subjectDomainPolicy
+ };
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "PolicyMappings" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyMappings =
+ function()
+ {
+ // #region Internal properties of the object
+ this.mappings = new Array(); // Array of "simpl.x509.PolicyMapping"
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.PolicyMappings.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.mappings = arguments[0].mappings || new Array();
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyMappings.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.PolicyMappings({
+ names: {
+ mappings: "mappings"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for PolicyMappings");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ var maps = asn1.result["mappings"];
+
+ for(var i = 0; i < maps.length; i++)
+ this.mappings.push(new in_window.org.pkijs.simpl.x509.PolicyMapping({ schema: maps[i] }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyMappings.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ for(var i = 0; i < this.mappings.length; i++)
+ output_array.push(this.mappings.toSchema());
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyMappings.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ mappings: new Array()
+ };
+
+ for(var i = 0; i < this.mappings.length; i++)
+ _object.mappings.push(this.mappings[i].toJSON());
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "GeneralSubtree" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.GeneralSubtree =
+ function()
+ {
+ // #region Internal properties of the object
+ this.base = new in_window.org.pkijs.simpl.GENERAL_NAME();
+ // OPTIONAL this.minimum // in_window.org.pkijs.asn1.INTEGER
+ // OPTIONAL this.maximum // in_window.org.pkijs.asn1.INTEGER
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.GeneralSubtree.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.base = arguments[0].base || new in_window.org.pkijs.simpl.GENERAL_NAME();
+
+ if("minimum" in arguments[0])
+ this.minimum = arguments[0].minimum;
+
+ if("maximum" in arguments[0])
+ this.maximum = arguments[0].maximum;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.GeneralSubtree.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.GeneralSubtree({
+ names: {
+ base: {
+ names: {
+ block_name: "base"
+ }
+ },
+ minimum: "minimum",
+ maximum: "maximum"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for ");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.base = new in_window.org.pkijs.simpl.GENERAL_NAME({ schema: asn1.result["base"] });
+
+ if("minimum" in asn1.result)
+ {
+ if(asn1.result["minimum"].value_block.is_hex_only)
+ this.minimum = asn1.result["minimum"];
+ else
+ this.minimum = asn1.result["minimum"].value_block.value_dec;
+ }
+
+ if("maximum" in asn1.result)
+ {
+ if(asn1.result["maximum"].value_block.is_hex_only)
+ this.maximum = asn1.result["maximum"];
+ else
+ this.maximum = asn1.result["maximum"].value_block.value_dec;
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.GeneralSubtree.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ output_array.push(this.base.toSchema());
+
+ if("minimum" in this)
+ {
+ var value_minimum = 0;
+
+ if(this.minimum instanceof in_window.org.pkijs.asn1.INTEGER)
+ value_minimum = this.minimum;
+ else
+ value_minimum = new in_window.org.pkijs.asn1.INTEGER({ value: this.minimum });
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [value_minimum]
+ }));
+ }
+
+ if("maximum" in this)
+ {
+ var value_maximum = 0;
+
+ if(this.maximum instanceof in_window.org.pkijs.asn1.INTEGER)
+ value_maximum = this.maximum;
+ else
+ value_maximum = new in_window.org.pkijs.asn1.INTEGER({ value: this.maximum });
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value: [value_maximum]
+ }));
+ }
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.GeneralSubtree.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ base: this.base.toJSON()
+ };
+
+ if("minimum" in this)
+ {
+ if((typeof this.minimum) === "number")
+ _object.minimum = this.minimum;
+ else
+ _object.minimum = this.minimum.toJSON();
+ }
+
+ if("maximum" in this)
+ {
+ if((typeof this.maximum) === "number")
+ _object.maximum = this.maximum;
+ else
+ _object.maximum = this.maximum.toJSON();
+ }
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "NameConstraints" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.NameConstraints =
+ function()
+ {
+ // #region Internal properties of the object
+ // OPTIONAL this.permittedSubtrees - Array of "simpl.x509.GeneralSubtree"
+ // OPTIONAL this.excludedSubtrees - Array of "simpl.x509.GeneralSubtree"
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.NameConstraints.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ if("permittedSubtrees" in arguments[0])
+ this.permittedSubtrees = arguments[0].permittedSubtrees;
+
+ if("excludedSubtrees" in arguments[0])
+ this.excludedSubtrees = arguments[0].excludedSubtrees;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.NameConstraints.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.NameConstraints({
+ names: {
+ permittedSubtrees: "permittedSubtrees",
+ excludedSubtrees: "excludedSubtrees"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for NameConstraints");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ if("permittedSubtrees" in asn1.result)
+ {
+ this.permittedSubtrees = new Array();
+ var permited_array = asn1.result["permittedSubtrees"];
+
+ for(var i = 0; i < permited_array.length; i++)
+ this.permittedSubtrees.push(new in_window.org.pkijs.simpl.x509.GeneralSubtree({ schema: permited_array[i] }));
+ }
+
+ if("excludedSubtrees" in asn1.result)
+ {
+ this.excludedSubtrees = new Array();
+ var excluded_array = asn1.result["excludedSubtrees"];
+
+ for(var i = 0; i < excluded_array.length; i++)
+ this.excludedSubtrees.push(new in_window.org.pkijs.simpl.x509.GeneralSubtree({ schema: excluded_array[i] }));
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.NameConstraints.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ if("permittedSubtrees" in this)
+ {
+ var permited_array = new Array();
+
+ for(var i = 0; i < this.permittedSubtrees.length; i++)
+ permited_array.push(this.permittedSubtrees[i].toSchema());
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [new in_window.org.pkijs.asn1.SEQUENCE({
+ value: permited_array
+ })]
+ }));
+ }
+
+ if("excludedSubtrees" in this)
+ {
+ var excluded_array = new Array();
+
+ for(var i = 0; i < this.excludedSubtrees.length; i++)
+ excluded_array.push(this.excludedSubtrees[i].toSchema());
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value: [new in_window.org.pkijs.asn1.SEQUENCE({
+ value: excluded_array
+ })]
+ }));
+ }
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.NameConstraints.prototype.toJSON =
+ function()
+ {
+ var _object = {};
+
+ if("permittedSubtrees" in this)
+ {
+ _object.permittedSubtrees = new Array();
+
+ for(var i = 0; i < this.permittedSubtrees.length; i++)
+ _object.permittedSubtrees.push(this.permittedSubtrees[i].toJSON());
+ }
+
+ if("excludedSubtrees" in this)
+ {
+ _object.excludedSubtrees = new Array();
+
+ for(var i = 0; i < this.excludedSubtrees.length; i++)
+ _object.excludedSubtrees.push(this.excludedSubtrees[i].toJSON());
+ }
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "BasicConstraints" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.BasicConstraints =
+ function()
+ {
+ // #region Internal properties of the object
+ // OPTIONAL this.cA - boolean value
+ // OPTIONAL this.pathLenConstraint - integer value
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.BasicConstraints.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ if("cA" in arguments[0])
+ this.cA = arguments[0].cA;
+
+ if("pathLenConstraint" in arguments[0])
+ this.pathLenConstraint = arguments[0].pathLenConstraint;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.BasicConstraints.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.BasicConstraints({
+ names: {
+ cA: "cA",
+ pathLenConstraint: "pathLenConstraint"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for BasicConstraints");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ if("cA" in asn1.result)
+ this.cA = asn1.result["cA"].value_block.value;
+
+ if("pathLenConstraint" in asn1.result)
+ this.pathLenConstraint = asn1.result["pathLenConstraint"].value_block.value_dec;
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.BasicConstraints.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ if("cA" in this)
+ output_array.push(new in_window.org.pkijs.asn1.BOOLEAN({ value: this.cA }));
+
+ if("pathLenConstraint" in this)
+ output_array.push(new in_window.org.pkijs.asn1.INTEGER({ value: this.pathLenConstraint }));
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.BasicConstraints.prototype.toJSON =
+ function()
+ {
+ var _object = {};
+
+ if("cA" in this)
+ _object.cA = this.cA;
+
+ if("pathLenConstraint" in this)
+ _object.pathLenConstraint = this.pathLenConstraint;
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "PolicyQualifierInfo" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyQualifierInfo =
+ function()
+ {
+ // #region Internal properties of the object
+ this.policyQualifierId = "";
+ this.qualifier = new in_window.org.pkijs.asn1.ANY();
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.PolicyQualifierInfo.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.policyQualifierId = arguments[0].policyQualifierId || "";
+ this.qualifier = arguments[0].qualifier || new in_window.org.pkijs.asn1.ANY();
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyQualifierInfo.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.PolicyQualifierInfo({
+ names: {
+ policyQualifierId: "policyQualifierId",
+ qualifier: "qualifier"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for PolicyQualifierInfo");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.policyQualifierId = asn1.result["policyQualifierId"].value_block.toString();
+ this.qualifier = asn1.result["qualifier"];
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyQualifierInfo.prototype.toSchema =
+ function()
+ {
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ new in_window.org.pkijs.asn1.OID({ value: this.policyQualifierId }),
+ this.qualifier
+ ]
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyQualifierInfo.prototype.toJSON =
+ function()
+ {
+ return {
+ policyQualifierId: this.policyQualifierId,
+ qualifier: this.qualifier.toJSON()
+ };
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "PolicyInformation" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyInformation =
+ function()
+ {
+ // #region Internal properties of the object
+ this.policyIdentifier = "";
+ // OPTIONAL this.policyQualifiers = new Array(); // Array of "simpl.x509.PolicyQualifierInfo"
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.PolicyInformation.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.policyIdentifier = arguments[0].policyIdentifier || "";
+
+ if("policyQualifiers" in arguments[0])
+ this.policyQualifiers = arguments[0].policyQualifiers;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyInformation.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.PolicyInformation({
+ names: {
+ policyIdentifier: "policyIdentifier",
+ policyQualifiers: "policyQualifiers"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for PolicyInformation");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.policyIdentifier = asn1.result["policyIdentifier"].value_block.toString();
+
+ if("policyQualifiers" in asn1.result)
+ {
+ this.policyQualifiers = new Array();
+ var qualifiers = asn1.result["policyQualifiers"];
+
+ for(var i = 0; i < qualifiers.length; i++)
+ this.policyQualifiers.push(new in_window.org.pkijs.simpl.x509.PolicyQualifierInfo({ schema: qualifiers[i] }));
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyInformation.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ output_array.push(new in_window.org.pkijs.asn1.OID({ value: this.policyIdentifier }));
+
+ if("policyQualifiers" in this)
+ {
+ var qualifiers = new Array();
+
+ for(var i = 0; i < this.policyQualifiers.length; i++)
+ qualifiers.push(this.policyQualifiers[i].toSchema());
+
+ output_array.push(new in_window.org.pkijs.asn1.SEQUENCE({
+ value: qualifiers
+ }));
+ }
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyInformation.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ policyIdentifier: this.policyIdentifier
+ };
+
+ if("policyQualifiers" in this)
+ {
+ _object.policyQualifiers = new Array();
+
+ for(var i = 0; i < this.policyQualifiers.length; i++)
+ _object.policyQualifiers.push(this.policyQualifiers[i].toJSON());
+ }
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "CertificatePolicies" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.CertificatePolicies =
+ function()
+ {
+ // #region Internal properties of the object
+ this.certificatePolicies = new Array(); // Array of "simpl.x509.PolicyInformation"
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.CertificatePolicies.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.certificatePolicies = arguments[0].certificatePolicies || new Array(); // Array of "simpl.x509.PolicyInformation"
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.CertificatePolicies.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.CertificatePolicies({
+ names: {
+ certificatePolicies: "certificatePolicies"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for CertificatePolicies");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ var policies = asn1.result["certificatePolicies"];
+
+ for(var i = 0; i < policies.length; i++)
+ this.certificatePolicies.push(new in_window.org.pkijs.simpl.x509.PolicyInformation({ schema: policies[i] }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.CertificatePolicies.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ for(var i = 0; i < this.certificatePolicies.length; i++)
+ output_array.push(this.certificatePolicies[i].toSchema());
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.CertificatePolicies.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ certificatePolicies: new Array()
+ };
+
+ for(var i = 0; i < this.certificatePolicies.length; i++)
+ _object.certificatePolicies.push(this.certificatePolicies[i].toJSON());
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "PolicyConstraints" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyConstraints =
+ function()
+ {
+ // #region Internal properties of the object
+ // OPTIONAL this.requireExplicitPolicy = 0;
+ // OPTIONAL this.inhibitPolicyMapping = 0;
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.PolicyConstraints.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.requireExplicitPolicy = arguments[0].requireExplicitPolicy || 0;
+ this.inhibitPolicyMapping = arguments[0].inhibitPolicyMapping || 0;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyConstraints.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.PolicyConstraints({
+ names: {
+ requireExplicitPolicy: "requireExplicitPolicy",
+ inhibitPolicyMapping: "inhibitPolicyMapping"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for PolicyConstraints");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ if("requireExplicitPolicy" in asn1.result)
+ {
+ var field1 = asn1.result["requireExplicitPolicy"];
+
+ field1.id_block.tag_class = 1; // UNIVERSAL
+ field1.id_block.tag_number = 2; // INTEGER
+
+ var ber1 = field1.toBER(false);
+ var int1 = in_window.org.pkijs.fromBER(ber1);
+
+ this.requireExplicitPolicy = int1.result.value_block.value_dec;
+ }
+
+ if("inhibitPolicyMapping" in asn1.result)
+ {
+ var field2 = asn1.result["inhibitPolicyMapping"];
+
+ field2.id_block.tag_class = 1; // UNIVERSAL
+ field2.id_block.tag_number = 2; // INTEGER
+
+ var ber2 = field2.toBER(false);
+ var int2 = in_window.org.pkijs.fromBER(ber2);
+
+ this.inhibitPolicyMapping = int2.result.value_block.value_dec;
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyConstraints.prototype.toSchema =
+ function()
+ {
+ // #region Create correct values for output sequence
+ var output_array = new Array();
+
+ if("requireExplicitPolicy" in this)
+ {
+ var int1 = new in_window.org.pkijs.asn1.INTEGER({ value: this.requireExplicitPolicy });
+
+ int1.id_block.tag_class = 3; // CONTEXT-SPECIFIC
+ int1.id_block.tag_number = 0; // [0]
+
+ output_array.push(int1);
+ }
+
+ if("inhibitPolicyMapping" in this)
+ {
+ var int2 = new in_window.org.pkijs.asn1.INTEGER({ value: this.inhibitPolicyMapping });
+
+ int1.id_block.tag_class = 3; // CONTEXT-SPECIFIC
+ int1.id_block.tag_number = 1; // [1]
+
+ output_array.push(int2);
+ }
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.PolicyConstraints.prototype.toJSON =
+ function()
+ {
+ var _object = {};
+
+ if("requireExplicitPolicy" in this)
+ _object.requireExplicitPolicy = this.requireExplicitPolicy;
+
+ if("inhibitPolicyMapping" in this)
+ _object.inhibitPolicyMapping = this.inhibitPolicyMapping;
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "ExtKeyUsage" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.ExtKeyUsage =
+ function()
+ {
+ // #region Internal properties of the object
+ this.keyPurposes = new Array(); // Array of strings (OIDs value for key purposes)
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.ExtKeyUsage.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.keyPurposes = arguments[0].keyPurposes || new Array(); // Array of strings (OIDs value for key purposes)
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.ExtKeyUsage.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.ExtKeyUsage({
+ names: {
+ keyPurposes: "keyPurposes"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for ExtKeyUsage");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ var purposes = asn1.result["keyPurposes"];
+
+ for(var i = 0; i < purposes.length; i++)
+ this.keyPurposes.push(purposes[i].value_block.toString());
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.ExtKeyUsage.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ for(var i = 0; i < this.keyPurposes.length; i++)
+ output_array.push(new in_window.org.pkijs.asn1.OID({ value: this.keyPurposes[i] }));
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.ExtKeyUsage.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ keyPurposes: new Array()
+ };
+
+ for(var i = 0; i < this.keyPurposes.length; i++)
+ _object.keyPurposes.push(this.keyPurposes[i]);
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "DistributionPoint" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.DistributionPoint =
+ function()
+ {
+ // #region Internal properties of the object
+ // OPTIONAL this.distributionPoint // Array of "simpl.GENERAL_NAME" or a value of "simpl.RDN" type
+ // OPTIONAL this.reasons // BITSTRING value
+ // OPTIONAL this.cRLIssuer // Array of "simpl.GENERAL_NAME"
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.DistributionPoint.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ if("distributionPoint" in arguments[0])
+ this.distributionPoint = arguments[0].distributionPoint;
+
+ if("reasons" in arguments[0])
+ this.reasons = arguments[0].reasons;
+
+ if("cRLIssuer" in arguments[0])
+ this.cRLIssuer = arguments[0].cRLIssuer;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.DistributionPoint.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.DistributionPoint({
+ names: {
+ distributionPoint: "distributionPoint",
+ distributionPoint_names: "distributionPoint_names",
+ reasons: "reasons",
+ cRLIssuer: "cRLIssuer",
+ cRLIssuer_names: "cRLIssuer_names"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for DistributionPoint");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ if("distributionPoint" in asn1.result)
+ {
+ if(asn1.result["distributionPoint"].id_block.tag_number == 0) // GENERAL_NAMES variant
+ {
+ this.distributionPoint = new Array();
+ var names = asn1.result["distributionPoint_names"];
+
+ for(var i = 0; i < names.length; i++)
+ this.distributionPoint.push(new in_window.org.pkijs.simpl.GENERAL_NAME({ schema: names[i] }));
+ }
+
+ if(asn1.result["distributionPoint"].id_block.tag_number == 1) // RDN variant
+ {
+ asn1.result["distributionPoint"].id_block.tag_class = 1; // UNIVERSAL
+ asn1.result["distributionPoint"].id_block.tag_number = 16; // SEQUENCE
+
+ this.distributionPoint = new in_window.org.pkijs.simpl.RDN({ schema: asn1.result["distributionPoint"] });
+ }
+ }
+
+ if("reasons" in asn1.result)
+ this.reasons = new in_window.org.pkijs.asn1.BITSTRING({ value_hex: asn1.result["reasons"].value_block.value_hex });
+
+ if("cRLIssuer" in asn1.result)
+ {
+ this.cRLIssuer = new Array();
+ var crl_names = asn1.result["cRLIssuer_names"];
+
+ for(var i = 0; i < crl_names; i++)
+ this.cRLIssuer.push(new in_window.org.pkijs.simpl.GENERAL_NAME({ schema: crl_names[i] }));
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.DistributionPoint.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ if("distributionPoint" in this)
+ {
+ var internalValue;
+
+ if(this.distributionPoint instanceof Array)
+ {
+ var namesArray = new Array();
+
+ for(var i = 0; i < this.distributionPoint.length; i++)
+ namesArray.push(this.distributionPoint[i].toSchema());
+
+ internalValue = new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: namesArray
+ });
+ }
+ else
+ {
+ internalValue = new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value: [this.distributionPoint.toSchema()]
+ });
+ }
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [internalValue]
+ }));
+ }
+
+ if("reasons" in this)
+ {
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value_hex: this.reasons.value_block.value_hex
+ }));
+ }
+
+ if("cRLIssuer" in this)
+ {
+ var value = new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 2 // [2]
+ }
+ });
+
+ for(var i = 0; i < this.cRLIssuer.length; i++)
+ value.value_block.value.push(this.cRLIssuer[i].toSchema());
+
+ output_array.push(value);
+ }
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.DistributionPoint.prototype.toJSON =
+ function()
+ {
+ var _object = {};
+
+ if("distributionPoint" in this)
+ {
+ if(this.distributionPoint instanceof Array)
+ {
+ _object.distributionPoint = new Array();
+
+ for(var i = 0; i < this.distributionPoint.length; i++)
+ _object.distributionPoint.push(this.distributionPoint[i].toJSON());
+ }
+ else
+ _object.distributionPoint = this.distributionPoint.toJSON();
+ }
+
+ if("reasons" in this)
+ _object.reasons = this.reasons.toJSON();
+
+ if("cRLIssuer" in this)
+ {
+ _object.cRLIssuer = new Array();
+
+ for(var i = 0; i < this.cRLIssuer.length; i++)
+ _object.cRLIssuer.push(this.cRLIssuer[i].toJSON());
+ }
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "CRLDistributionPoints" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.CRLDistributionPoints =
+ function()
+ {
+ // #region Internal properties of the object
+ this.distributionPoints = new Array(); // Array of "simpl.x509.DistributionPoint"
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.CRLDistributionPoints.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.distributionPoints = arguments[0].distributionPoints || new Array(); // Array of "simpl.x509.DistributionPoint"
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.CRLDistributionPoints.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.CRLDistributionPoints({
+ names: {
+ distributionPoints: "distributionPoints"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for CRLDistributionPoints");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ var points = asn1.result["distributionPoints"];
+
+ for(var i = 0; i < points.length; i++)
+ this.distributionPoints.push(new in_window.org.pkijs.simpl.x509.DistributionPoint({ schema: points[i] }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.CRLDistributionPoints.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ for(var i = 0; i < this.distributionPoints.length; i++)
+ output_array.push(this.distributionPoints[i].toSchema());
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.CRLDistributionPoints.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ distributionPoints: new Array()
+ };
+
+ for(var i = 0; i < this.distributionPoints.length; i++)
+ _object.distributionPoints.push(this.distributionPoints[i].toJSON());
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "AccessDescription" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.AccessDescription =
+ function()
+ {
+ // #region Internal properties of the object
+ this.accessMethod = "";
+ this.accessLocation = new in_window.org.pkijs.simpl.GENERAL_NAME();
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.AccessDescription.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.accessMethod = arguments[0].accessMethod || "";
+ this.accessLocation = arguments[0].accessLocation || new in_window.org.pkijs.simpl.GENERAL_NAME();
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.AccessDescription.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.AccessDescription({
+ names: {
+ accessMethod: "accessMethod",
+ accessLocation: {
+ names: {
+ block_name: "accessLocation"
+ }
+ }
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for AccessDescription");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.accessMethod = asn1.result["accessMethod"].value_block.toString();
+ this.accessLocation = new in_window.org.pkijs.simpl.GENERAL_NAME({ schema: asn1.result["accessLocation"] });
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.AccessDescription.prototype.toSchema =
+ function()
+ {
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ new in_window.org.pkijs.asn1.OID({ value: this.accessMethod }),
+ this.accessLocation.toSchema()
+ ]
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.AccessDescription.prototype.toJSON =
+ function()
+ {
+ return {
+ accessMethod: this.accessMethod,
+ accessLocation: this.accessLocation.toJSON()
+ };
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "AuthorityInfoAccess" and "SubjectInfoAccess" types of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.InfoAccess =
+ function()
+ {
+ // #region Internal properties of the object
+ this.accessDescriptions = new Array(); // Array of "simpl.x509.AccessDescription"
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.InfoAccess.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.accessDescriptions = arguments[0].accessDescriptions || new Array(); // Array of "simpl.x509.DistributionPoint"
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.InfoAccess.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.InfoAccess({
+ names: {
+ accessDescriptions: "accessDescriptions"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for InfoAccess");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ var descriptions = asn1.result["accessDescriptions"];
+
+ for(var i = 0; i < descriptions.length; i++)
+ this.accessDescriptions.push(new in_window.org.pkijs.simpl.x509.AccessDescription({ schema: descriptions[i] }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.InfoAccess.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ for(var i = 0; i < this.accessDescriptions.length; i++)
+ output_array.push(this.accessDescriptions[i].toSchema());
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.InfoAccess.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ accessDescriptions: new Array()
+ };
+
+ for(var i = 0; i < this.accessDescriptions.length; i++)
+ _object.accessDescriptions.push(this.accessDescriptions[i].toJSON());
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "IssuingDistributionPoint" type of extension
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.IssuingDistributionPoint =
+ function()
+ {
+ // #region Internal properties of the object
+ // OPTIONAL this.distributionPoint // Array of "simpl.GENERAL_NAME" or a value of "simpl.RDN" type
+ // OPTIONAL this.onlyContainsUserCerts // BOOLEAN flag
+ // OPTIONAL this.onlyContainsCACerts // BOOLEAN flag
+ // OPTIONAL this.onlySomeReasons // BITSTRING
+ // OPTIONAL this.indirectCRL // BOOLEAN flag
+ // OPTIONAL this.onlyContainsAttributeCerts // BOOLEAN flag
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.x509.IssuingDistributionPoint.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ if("distributionPoint" in arguments[0])
+ this.distributionPoint = arguments[0].distributionPoint;
+
+ if("onlyContainsUserCerts" in arguments[0])
+ this.onlyContainsUserCerts = arguments[0].onlyContainsUserCerts;
+
+ if("onlyContainsCACerts" in arguments[0])
+ this.onlyContainsCACerts = arguments[0].onlyContainsCACerts;
+
+ if("onlySomeReasons" in arguments[0])
+ this.onlySomeReasons = arguments[0].onlySomeReasons;
+
+ if("indirectCRL" in arguments[0])
+ this.indirectCRL = arguments[0].indirectCRL;
+
+ if("onlyContainsAttributeCerts" in arguments[0])
+ this.onlyContainsAttributeCerts = arguments[0].onlyContainsAttributeCerts;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.IssuingDistributionPoint.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.x509.IssuingDistributionPoint({
+ names: {
+ distributionPoint: "distributionPoint",
+ distributionPoint_names: "distributionPoint_names",
+ onlyContainsUserCerts: "onlyContainsUserCerts",
+ onlyContainsCACerts: "onlyContainsCACerts",
+ onlySomeReasons: "onlySomeReasons",
+ indirectCRL: "indirectCRL",
+ onlyContainsAttributeCerts: "onlyContainsAttributeCerts"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for IssuingDistributionPoint");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ if("distributionPoint" in asn1.result)
+ {
+ if(asn1.result["distributionPoint"].id_block.tag_number == 0) // GENERAL_NAMES variant
+ {
+ this.distributionPoint = new Array();
+ var names = asn1.result["distributionPoint_names"];
+
+ for(var i = 0; i < names.length; i++)
+ this.distributionPoint.push(new in_window.org.pkijs.simpl.GENERAL_NAME({ schema: names[i] }));
+ }
+
+ if(asn1.result["distributionPoint"].id_block.tag_number == 1) // RDN variant
+ {
+ asn1.result["distributionPoint"].id_block.tag_class = 1; // UNIVERSAL
+ asn1.result["distributionPoint"].id_block.tag_number = 16; // SEQUENCE
+
+ this.distributionPoint = new in_window.org.pkijs.simpl.RDN({ schema: asn1.result["distributionPoint"] });
+ }
+ }
+
+ if("onlyContainsUserCerts" in asn1.result)
+ {
+ var view = new Uint8Array(asn1.result["onlyContainsUserCerts"].value_block.value_hex);
+ this.onlyContainsUserCerts = (view[0] !== 0x00);
+ }
+
+ if("onlyContainsCACerts" in asn1.result)
+ {
+ var view = new Uint8Array(asn1.result["onlyContainsCACerts"].value_block.value_hex);
+ this.onlyContainsCACerts = (view[0] !== 0x00);
+ }
+
+ if("onlySomeReasons" in asn1.result)
+ {
+ var view = new Uint8Array(asn1.result["onlySomeReasons"].value_block.value_hex);
+ this.onlySomeReasons = view[0];
+ }
+
+ if("indirectCRL" in asn1.result)
+ {
+ var view = new Uint8Array(asn1.result["indirectCRL"].value_block.value_hex);
+ this.indirectCRL = (view[0] !== 0x00);
+ }
+
+ if("onlyContainsAttributeCerts" in asn1.result)
+ {
+ var view = new Uint8Array(asn1.result["onlyContainsAttributeCerts"].value_block.value_hex);
+ this.onlyContainsAttributeCerts = (view[0] !== 0x00);
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.IssuingDistributionPoint.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ if("distributionPoint" in this)
+ {
+ var value;
+
+ if(this.distributionPoint instanceof Array)
+ {
+ value = new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ }
+ });
+
+ for(var i = 0; i < this.distributionPoint.length; i++)
+ value.value_block.value.push(this.distributionPoint[i].toSchema());
+ }
+ else
+ {
+ value = this.distributionPoint.toSchema();
+
+ value.id_block.tag_class = 3; // CONTEXT - SPECIFIC
+ value.id_block.tag_number = 1; // [1]
+ }
+
+ output_array.push(value);
+ }
+
+ if("onlyContainsUserCerts" in this)
+ {
+ var buffer = new ArrayBuffer(1);
+ var view = new Uint8Array(buffer);
+
+ view[0] = (this.onlyContainsUserCerts === false) ? 0x00 : 0xFF;
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value_hex: buffer
+ }));
+ }
+
+ if("onlyContainsCACerts" in this)
+ {
+ var buffer = new ArrayBuffer(1);
+ var view = new Uint8Array(buffer);
+
+ view[0] = (this.onlyContainsCACerts === false) ? 0x00 : 0xFF;
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 2 // [2]
+ },
+ value_hex: buffer
+ }));
+ }
+
+ if("onlySomeReasons" in this)
+ {
+ var buffer = new ArrayBuffer(1);
+ var view = new Uint8Array(buffer);
+
+ view[0] = this.onlySomeReasons;
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 3 // [3]
+ },
+ value_hex: buffer
+ }));
+ }
+
+ if("indirectCRL" in this)
+ {
+ var buffer = new ArrayBuffer(1);
+ var view = new Uint8Array(buffer);
+
+ view[0] = (this.indirectCRL === false) ? 0x00 : 0xFF;
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 4 // [4]
+ },
+ value_hex: buffer
+ }));
+ }
+
+ if("onlyContainsAttributeCerts" in this)
+ {
+ var buffer = new ArrayBuffer(1);
+ var view = new Uint8Array(buffer);
+
+ view[0] = (this.onlyContainsAttributeCerts === false) ? 0x00 : 0xFF;
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 5 // [5]
+ },
+ value_hex: buffer
+ }));
+ }
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.x509.IssuingDistributionPoint.prototype.toJSON =
+ function()
+ {
+ var _object = {};
+
+ if("distributionPoint" in this)
+ {
+ if(this.distributionPoint instanceof Array)
+ {
+ _object.distributionPoint = new Array();
+
+ for(var i = 0; i < this.distributionPoint.length; i++)
+ _object.distributionPoint.push(this.distributionPoint[i].toJSON());
+ }
+ else
+ _object.distributionPoint = this.distributionPoint.toJSON();
+ }
+
+ if("onlyContainsUserCerts" in this)
+ _object.onlyContainsUserCerts = this.onlyContainsUserCerts;
+
+ if("onlyContainsCACerts" in this)
+ _object.onlyContainsCACerts = this.onlyContainsCACerts;
+
+ if("onlySomeReasons" in this)
+ _object.onlySomeReasons = this.onlySomeReasons.toJSON();
+
+ if("indirectCRL" in this)
+ _object.indirectCRL = this.indirectCRL;
+
+ if("onlyContainsAttributeCerts" in this)
+ _object.onlyContainsAttributeCerts = this.onlyContainsAttributeCerts;
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "Extension" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.EXTENSION =
+ function()
+ {
+ // #region Internal properties of the object
+ this.extnID = "";
+ this.critical = false;
+ this.extnValue = new in_window.org.pkijs.asn1.OCTETSTRING();
+
+ // OPTIONAL this.parsedValue - Parsed "extnValue" in case of well-known "extnID"
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.EXTENSION.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.extnID = (arguments[0].extnID || "");
+ this.critical = (arguments[0].critical || false);
+ if("extnValue" in arguments[0])
+ this.extnValue = new in_window.org.pkijs.asn1.OCTETSTRING({ value_hex: arguments[0].extnValue });
+ else
+ this.extnValue = new in_window.org.pkijs.asn1.OCTETSTRING();
+
+ if("parsedValue" in arguments[0])
+ this.parsedValue = arguments[0].parsedValue;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.EXTENSION.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.EXTENSION({
+ names: {
+ extnID: "extnID",
+ critical: "critical",
+ extnValue: "extnValue"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for EXTENSION");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.extnID = asn1.result.extnID.value_block.toString();
+ if("critical" in asn1.result)
+ this.critical = asn1.result.critical.value_block.value;
+ this.extnValue = asn1.result.extnValue;
+
+ // #region Get "parsedValue" for well-known extensions
+ var asn1 = in_window.org.pkijs.fromBER(this.extnValue.value_block.value_hex);
+ if(asn1.offset === (-1))
+ return;
+
+ switch(this.extnID)
+ {
+ case "2.5.29.9": // SubjectDirectoryAttributes
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.SubjectDirectoryAttributes({ schema: asn1.result });
+ break;
+ case "2.5.29.14": // SubjectKeyIdentifier
+ this.parsedValue = asn1.result; // Should be just a simple OCTETSTRING
+ break;
+ case "2.5.29.15": // KeyUsage
+ this.parsedValue = asn1.result; // Should be just a simple BITSTRING
+ break;
+ case "2.5.29.16": // PrivateKeyUsagePeriod
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.PrivateKeyUsagePeriod({ schema: asn1.result });
+ break;
+ case "2.5.29.17": // SubjectAltName
+ case "2.5.29.18": // IssuerAltName
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.AltName({ schema: asn1.result });
+ break;
+ case "2.5.29.19": // BasicConstraints
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.BasicConstraints({ schema: asn1.result });
+ break;
+ case "2.5.29.20": // CRLNumber
+ case "2.5.29.27": // BaseCRLNumber (delta CRL indicator)
+ this.parsedValue = asn1.result; // Should be just a simple INTEGER
+ break;
+ case "2.5.29.21": // CRLReason
+ this.parsedValue = asn1.result; // Should be just a simple ENUMERATED
+ break;
+ case "2.5.29.24": // InvalidityDate
+ this.parsedValue = asn1.result; // Should be just a simple GeneralizedTime
+ break;
+ case "2.5.29.28": // IssuingDistributionPoint
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.IssuingDistributionPoint({ schema: asn1.result });
+ break;
+ case "2.5.29.29": // CertificateIssuer
+ this.parsedValue = new in_window.org.pkijs.simpl.GENERAL_NAMES({ schema: asn1.result }); // Should be just a simple
+ break;
+ case "2.5.29.30": // NameConstraints
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.NameConstraints({ schema: asn1.result });
+ break;
+ case "2.5.29.31": // CRLDistributionPoints
+ case "2.5.29.46": // FreshestCRL
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.CRLDistributionPoints({ schema: asn1.result });
+ break;
+ case "2.5.29.32": // CertificatePolicies
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.CertificatePolicies({ schema: asn1.result });
+ break;
+ case "2.5.29.33": // PolicyMappings
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.PolicyMappings({ schema: asn1.result });
+ break;
+ case "2.5.29.35": // AuthorityKeyIdentifier
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.AuthorityKeyIdentifier({ schema: asn1.result });
+ break;
+ case "2.5.29.36": // PolicyConstraints
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.PolicyConstraints({ schema: asn1.result });
+ break;
+ case "2.5.29.37": // ExtKeyUsage
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.ExtKeyUsage({ schema: asn1.result });
+ break;
+ case "2.5.29.54": // InhibitAnyPolicy
+ this.parsedValue = asn1.result; // Should be just a simple INTEGER
+ break;
+ case "1.3.6.1.5.5.7.1.1": // AuthorityInfoAccess
+ case "1.3.6.1.5.5.7.1.11": // SubjectInfoAccess
+ this.parsedValue = new in_window.org.pkijs.simpl.x509.InfoAccess({ schema: asn1.result });
+ break;
+ default:
+ }
+ // #endregion
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.EXTENSION.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ output_array.push(new in_window.org.pkijs.asn1.OID({ value: this.extnID }));
+
+ if(this.critical)
+ output_array.push(new in_window.org.pkijs.asn1.BOOLEAN({ value: this.critical }));
+
+ output_array.push(this.extnValue);
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.EXTENSION.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ extnID: this.extnID,
+ critical: this.critical,
+ extnValue: this.extnValue.toJSON()
+ };
+
+ if("parsedValue" in this)
+ _object.parsedValue = this.parsedValue.toJSON();
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "Extensions" type (sequence of many Extension)
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.EXTENSIONS =
+ function()
+ {
+ // #region Internal properties of the object
+ this.extensions_array = new Array();
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.EXTENSIONS.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ this.extensions_array = (arguments[0].extensions_array || (new Array()));
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.EXTENSIONS.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.EXTENSIONS({
+ names: {
+ extensions: "extensions"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for EXTENSIONS");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ for(var i = 0; i < asn1.result.extensions.length; i++)
+ this.extensions_array.push(new in_window.org.pkijs.simpl.EXTENSION({ schema: asn1.result.extensions[i] }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.EXTENSIONS.prototype.toSchema =
+ function()
+ {
+ // #region Construct and return new ASN.1 schema for this object
+ var extension_schemas = new Array();
+
+ for(var i = 0; i < this.extensions_array.length; i++)
+ extension_schemas.push(this.extensions_array[i].toSchema());
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: extension_schemas
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.EXTENSIONS.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ extensions_array: new Array()
+ };
+
+ for(var i = 0; i < this.extensions_array.length; i++)
+ _object.extensions_array.push(this.extensions_array[i].toJSON());
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for X.509 v3 certificate (RFC5280)
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CERT =
+ function()
+ {
+ // #region Internal properties of the object
+ // #region Properties from certificate TBS part
+ this.tbs = new ArrayBuffer(0); // Encoded value of certificate TBS (need to have it for certificate validation)
+
+ // OPTIONAL this.version = 0;
+ this.serialNumber = new in_window.org.pkijs.asn1.INTEGER(); // Might be a very long integer value
+ this.signature = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER(); // Signature algorithm from certificate TBS part
+ this.issuer = new in_window.org.pkijs.simpl.RDN();
+ this.notBefore = new in_window.org.pkijs.simpl.TIME();
+ this.notAfter = new in_window.org.pkijs.simpl.TIME();
+ this.subject = new in_window.org.pkijs.simpl.RDN();
+ this.subjectPublicKeyInfo = new in_window.org.pkijs.simpl.PUBLIC_KEY_INFO();
+ // OPTIONAL this.issuerUniqueID = new ArrayBuffer(0); // IMPLICIT bistring value
+ // OPTIONAL this.subjectUniqueID = new ArrayBuffer(0); // IMPLICIT bistring value
+ // OPTIONAL this.extensions = new Array(); // Array of "simpl.EXTENSION"
+ // #endregion
+
+ // #region Properties from certificate major part
+ this.signatureAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER(); // Signature algorithm from certificate major part
+ this.signatureValue = new in_window.org.pkijs.asn1.BITSTRING();
+ // #endregion
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.CERT.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ // #region Properties from certificate TBS part
+ this.tbs = arguments[0].tbs || new ArrayBuffer(0);
+
+ if("version" in arguments[0])
+ this.version = arguments[0].version;
+ this.serialNumber = arguments[0].serialNumber || new in_window.org.pkijs.asn1.INTEGER(); // Might be a very long integer value
+ this.signature = arguments[0].signature || new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER(); // Signature algorithm from certificate TBS part
+ this.issuer = arguments[0].issuer || new in_window.org.pkijs.simpl.RDN();
+ this.notBefore = arguments[0].not_before || new in_window.org.pkijs.simpl.TIME();
+ this.notAfter = arguments[0].not_after || new in_window.org.pkijs.simpl.TIME();
+ this.subject = arguments[0].subject || new in_window.org.pkijs.simpl.RDN();
+ this.subjectPublicKeyInfo = arguments[0].subjectPublicKeyInfo || new in_window.org.pkijs.simpl.PUBLIC_KEY_INFO();
+ if("issuerUniqueID" in arguments[0])
+ this.issuerUniqueID = arguments[0].issuerUniqueID;
+ if("subjectUniqueID" in arguments[0])
+ this.subjectUniqueID = arguments[0].subjectUniqueID;
+ if("extensions" in arguments[0])
+ this.extensions = arguments[0].extensions;
+ // #endregion
+
+ // #region Properties from certificate major part
+ this.signatureAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER(); // Signature algorithm from certificate major part
+ this.signatureValue = new in_window.org.pkijs.asn1.BITSTRING();
+ // #endregion
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CERT.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.CERT({
+ names: {
+ tbsCertificate: {
+ names: {
+ extensions: {
+ names: {
+ extensions: "tbsCertificate.extensions"
+ }
+ }
+ }
+ }
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for CERT");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.tbs = asn1.result["tbsCertificate"].value_before_decode;
+
+ if("tbsCertificate.version" in asn1.result)
+ this.version = asn1.result["tbsCertificate.version"].value_block.value_dec;
+ this.serialNumber = asn1.result["tbsCertificate.serialNumber"];
+ this.signature = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({ schema: asn1.result["tbsCertificate.signature"] });
+ this.issuer = new in_window.org.pkijs.simpl.RDN({ schema: asn1.result["tbsCertificate.issuer"] });
+ this.notBefore = new in_window.org.pkijs.simpl.TIME({ schema: asn1.result["tbsCertificate.notBefore"] });
+ this.notAfter = new in_window.org.pkijs.simpl.TIME({ schema: asn1.result["tbsCertificate.notAfter"] });
+ this.subject = new in_window.org.pkijs.simpl.RDN({ schema: asn1.result["tbsCertificate.subject"] });
+ this.subjectPublicKeyInfo = new in_window.org.pkijs.simpl.PUBLIC_KEY_INFO({ schema: asn1.result["tbsCertificate.subjectPublicKeyInfo"] });
+ if("tbsCertificate.issuerUniqueID" in asn1.result)
+ this.issuerUniqueID = asn1.result["tbsCertificate.issuerUniqueID"].value_block.value_hex;
+ if("tbsCertificate.subjectUniqueID" in asn1.result)
+ this.issuerUniqueID = asn1.result["tbsCertificate.subjectUniqueID"].value_block.value_hex;
+ if("tbsCertificate.extensions" in asn1.result)
+ {
+ this.extensions = new Array();
+
+ var extensions = asn1.result["tbsCertificate.extensions"];
+
+ for(var i = 0; i < extensions.length; i++)
+ this.extensions.push(new in_window.org.pkijs.simpl.EXTENSION({ schema: extensions[i] }));
+ }
+
+ this.signatureAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({ schema: asn1.result["signatureAlgorithm"] });
+ this.signatureValue = asn1.result["signatureValue"];
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CERT.prototype.encodeTBS =
+ function()
+ {
+ /// <summary>Create ASN.1 schema for existing values of TBS part for the certificate</summary>
+
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ if("version" in this)
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.INTEGER({ value: this.version }) // EXPLICIT integer value
+ ]
+ }));
+
+ output_array.push(this.serialNumber);
+ output_array.push(this.signature.toSchema());
+ output_array.push(this.issuer.toSchema());
+
+ output_array.push(new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ this.notBefore.toSchema(),
+ this.notAfter.toSchema()
+ ]
+ }));
+
+ output_array.push(this.subject.toSchema());
+ output_array.push(this.subjectPublicKeyInfo.toSchema());
+
+ if("issuerUniqueID" in this)
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 1 // [1]
+ },
+ value_hex: this.issuerUniqueID
+ }));
+ if("subjectUniqueID" in this)
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_PRIMITIVE({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 2 // [2]
+ },
+ value_hex: this.subjectUniqueID
+ }));
+
+ if("subjectUniqueID" in this)
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 3 // [3]
+ },
+ value: [this.extensions.toSchema()]
+ }));
+
+ if("extensions" in this)
+ {
+ var extensions = new Array();
+
+ for(var i = 0; i < this.extensions.length; i++)
+ extensions.push(this.extensions[i].toSchema());
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 3 // [3]
+ },
+ value: [new in_window.org.pkijs.asn1.SEQUENCE({
+ value: extensions
+ })]
+ }));
+ }
+ // #endregion
+
+ // #region Create and return output sequence
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CERT.prototype.toSchema =
+ function(encodeFlag)
+ {
+ /// <param name="encodeFlag" type="Boolean">If param equal to false then create TBS schema via decoding stored value. In othe case create TBS schema via assembling from TBS parts.</param>
+
+ if(typeof encodeFlag === "undefined")
+ encodeFlag = false;
+
+ var tbs_schema = {};
+
+ // #region Decode stored TBS value
+ if(encodeFlag === false)
+ {
+ if(this.tbs.length === 0) // No stored certificate TBS part
+ return in_window.org.pkijs.schema.CERT().value[0];
+
+ var tbs_asn1 = in_window.org.pkijs.fromBER(this.tbs);
+
+ tbs_schema = tbs_asn1.result;
+ }
+ // #endregion
+ // #region Create TBS schema via assembling from TBS parts
+ else
+ tbs_schema = in_window.org.pkijs.simpl.CERT.prototype.encodeTBS.call(this);
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ tbs_schema,
+ this.signatureAlgorithm.toSchema(),
+ this.signatureValue
+ ]
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CERT.prototype.verify =
+ function()
+ {
+ /// <summary>!!! Works well in Chrome dev versions only (April 2014th) !!!</summary>
+ /// <returns type="Promise">Returns a new Promise object (in case of error), or a result of "crypto.subtle.veryfy" function</returns>
+
+ // #region Global variables
+ var sequence = Promise.resolve();
+
+ var subjectPublicKeyInfo = {};
+
+ var signature = this.signatureValue;
+ var tbs = this.tbs;
+
+ var _this = this;
+ // #endregion
+
+ // #region Set correct "subjectPublicKeyInfo" value
+ if(arguments[0] instanceof Object)
+ {
+ if("issuerCertificate" in arguments[0]) // Must be of type "simpl.CERT"
+ subjectPublicKeyInfo = arguments[0].issuerCertificate.subjectPublicKeyInfo;
+ }
+ else
+ {
+ if(this.issuer.isEqual(this.subject)) // Self-signed certificate
+ subjectPublicKeyInfo = this.subjectPublicKeyInfo;
+ }
+
+ if((subjectPublicKeyInfo instanceof in_window.org.pkijs.simpl.PUBLIC_KEY_INFO) === false)
+ return new Promise(function(resolve, reject) { reject("Please provide issuer certificate as a parameter"); });
+ // #endregion
+
+ // #region Get a "crypto" extension
+ var crypto = in_window.org.pkijs.getCrypto();
+ if(typeof crypto == "undefined")
+ return new Promise(function(resolve, reject) { reject("Unable to create WebCrypto object"); });
+ // #endregion
+
+ // #region Find signer's hashing algorithm
+ var sha_algorithm = in_window.org.pkijs.getHashAlgorithm(this.signatureAlgorithm);
+ if(sha_algorithm === "")
+ return new Promise(function(resolve, reject) { reject("Unsupported signature algorithm: " + _this.signatureAlgorithm.algorithm_id); });
+ // #endregion
+
+ // #region Importing public key
+ sequence = sequence.then(
+ function()
+ {
+ // #region Get information about public key algorithm and default parameters for import
+ var algorithmObject = in_window.org.pkijs.getAlgorithmByOID(_this.signatureAlgorithm.algorithm_id);
+ if(("name" in algorithmObject) === false)
+ return new Promise(function(resolve, reject) { reject("Unsupported public key algorithm: " + _this.signatureAlgorithm.algorithm_id); });
+
+ var algorithm_name = algorithmObject.name;
+
+ var algorithm = in_window.org.pkijs.getAlgorithmParameters(algorithm_name, "importkey");
+ if("hash" in algorithm.algorithm)
+ algorithm.algorithm.hash.name = sha_algorithm;
+ // #endregion
+
+ var publicKeyInfo_schema = subjectPublicKeyInfo.toSchema();
+ var publicKeyInfo_buffer = publicKeyInfo_schema.toBER(false);
+ var publicKeyInfo_view = new Uint8Array(publicKeyInfo_buffer);
+
+ return crypto.importKey("spki", publicKeyInfo_view, algorithm.algorithm, true, algorithm.usages);
+ }
+ );
+ // #endregion
+
+ // #region Verify signature for the certificate
+ sequence = sequence.then(
+ function(publicKey)
+ {
+ // #region Get default algorithm parameters for verification
+ var algorithm = in_window.org.pkijs.getAlgorithmParameters(publicKey.algorithm.name, "verify");
+ if("hash" in algorithm.algorithm)
+ algorithm.algorithm.hash.name = sha_algorithm;
+ // #endregion
+
+ // #region Special case for ECDSA signatures
+ var signature_value = signature.value_block.value_hex;
+
+ if(publicKey.algorithm.name === "ECDSA")
+ {
+ var asn1 = in_window.org.pkijs.fromBER(signature_value);
+ signature_value = in_window.org.pkijs.createECDSASignatureFromCMS(asn1.result);
+ }
+ // #endregion
+
+ // #region Special case for RSA-PSS
+ if(publicKey.algorithm.name === "RSA-PSS")
+ {
+ var pssParameters;
+
+ try
+ {
+ pssParameters = new in_window.org.pkijs.simpl.x509.RSASSA_PSS_params({ schema: _this.signatureAlgorithm.algorithm_params });
+ }
+ catch(ex)
+ {
+ return new Promise(function(resolve, reject) { reject(ex); });
+ }
+
+ if("saltLength" in pssParameters)
+ algorithm.algorithm.saltLength = pssParameters.saltLength;
+ else
+ algorithm.algorithm.saltLength = 20;
+
+ var hash_algo = "SHA-1";
+
+ if("hashAlgorithm" in pssParameters)
+ {
+ var hashAlgorithm = in_window.org.pkijs.getAlgorithmByOID(pssParameters.hashAlgorithm.algorithm_id);
+ if(("name" in hashAlgorithm) === false)
+ return new Promise(function(resolve, reject) { reject("Unrecognized hash algorithm: " + pssParameters.hashAlgorithm.algorithm_id); });
+
+ hash_algo = hashAlgorithm.name;
+ }
+
+ algorithm.algorithm.hash.name = hash_algo;
+ }
+ // #endregion
+
+ return crypto.verify(algorithm.algorithm,
+ publicKey,
+ new Uint8Array(signature_value),
+ new Uint8Array(tbs));
+ }
+ );
+ // #endregion
+
+ return sequence;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CERT.prototype.sign =
+ function(privateKey, hashAlgorithm)
+ {
+ /// <param name="privateKey" type="CryptoKey">Private key for "subjectPublicKeyInfo" structure</param>
+ /// <param name="hashAlgorithm" type="String" optional="true">Hashing algorithm. Default SHA-1</param>
+
+ // #region Initial variables
+ var _this = this;
+ // #endregion
+
+ // #region Get a private key from function parameter
+ if(typeof privateKey === "undefined")
+ return new Promise(function(resolve, reject) { reject("Need to provide a private key for signing"); });
+ // #endregion
+
+ // #region Get hashing algorithm
+ if(typeof hashAlgorithm === "undefined")
+ hashAlgorithm = "SHA-1";
+ else
+ {
+ // #region Simple check for supported algorithm
+ var oid = in_window.org.pkijs.getOIDByAlgorithm({ name: hashAlgorithm });
+ if(oid === "")
+ return new Promise(function(resolve, reject) { reject("Unsupported hash algorithm: " + hashAlgorithm); });
+ // #endregion
+ }
+ // #endregion
+
+ // #region Get a "default parameters" for current algorithm
+ var defParams = in_window.org.pkijs.getAlgorithmParameters(privateKey.algorithm.name, "sign");
+ defParams.algorithm.hash.name = hashAlgorithm;
+ // #endregion
+
+ // #region Fill internal structures base on "privateKey" and "hashAlgorithm"
+ switch(privateKey.algorithm.name.toUpperCase())
+ {
+ case "RSASSA-PKCS1-V1_5":
+ case "ECDSA":
+ _this.signature.algorithm_id = in_window.org.pkijs.getOIDByAlgorithm(defParams.algorithm);
+ _this.signatureAlgorithm.algorithm_id = _this.signature.algorithm_id;
+ break;
+ case "RSA-PSS":
+ {
+ // #region Set "saltLength" as a length (in octets) of hash function result
+ switch(hashAlgorithm.toUpperCase())
+ {
+ case "SHA-256":
+ defParams.algorithm.saltLength = 32;
+ break;
+ case "SHA-384":
+ defParams.algorithm.saltLength = 48;
+ break;
+ case "SHA-512":
+ defParams.algorithm.saltLength = 64;
+ break;
+ default:
+ }
+ // #endregion
+
+ // #region Fill "RSASSA_PSS_params" object
+ var paramsObject = {};
+
+ if(hashAlgorithm.toUpperCase() !== "SHA-1")
+ {
+ var hashAlgorithmOID = in_window.org.pkijs.getOIDByAlgorithm({ name: hashAlgorithm });
+ if(hashAlgorithmOID === "")
+ return new Promise(function(resolve, reject) { reject("Unsupported hash algorithm: " + hashAlgorithm); });
+
+ paramsObject.hashAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({
+ algorithm_id: hashAlgorithmOID,
+ algorithm_params: new in_window.org.pkijs.asn1.NULL()
+ });
+
+ paramsObject.maskGenAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({
+ algorithm_id: "1.2.840.113549.1.1.8", // MGF1
+ algorithm_params: paramsObject.hashAlgorithm.toSchema()
+ })
+ }
+
+ if(defParams.algorithm.saltLength !== 20)
+ paramsObject.saltLength = defParams.algorithm.saltLength;
+
+ var pssParameters = new in_window.org.pkijs.simpl.x509.RSASSA_PSS_params(paramsObject);
+ // #endregion
+
+ // #region Automatically set signature algorithm
+ _this.signature = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({
+ algorithm_id: "1.2.840.113549.1.1.10",
+ algorithm_params: pssParameters.toSchema()
+ });
+ _this.signatureAlgorithm = _this.signature; // Must be the same
+ // #endregion
+ }
+ break;
+ default:
+ return new Promise(function(resolve, reject) { reject("Unsupported signature algorithm: " + privateKey.algorithm.name); });
+ }
+ // #endregion
+
+ // #region Create TBS data for signing
+ _this.tbs = in_window.org.pkijs.simpl.CERT.prototype.encodeTBS.call(this).toBER(false);
+ // #endregion
+
+ // #region Get a "crypto" extension
+ var crypto = in_window.org.pkijs.getCrypto();
+ if(typeof crypto == "undefined")
+ return new Promise(function(resolve, reject) { reject("Unable to create WebCrypto object"); });
+ // #endregion
+
+ // #region Signing TBS data on provided private key
+ return crypto.sign(defParams.algorithm,
+ privateKey,
+ new Uint8Array(_this.tbs)).then(
+ function(result)
+ {
+ // #region Special case for ECDSA algorithm
+ if(defParams.algorithm.name === "ECDSA")
+ result = in_window.org.pkijs.createCMSECDSASignature(result);
+ // #endregion
+
+ _this.signatureValue = new in_window.org.pkijs.asn1.BITSTRING({ value_hex: result });
+ },
+ function(error)
+ {
+ return new Promise(function(resolve, reject) { reject("Signing error: " + error); });
+ }
+ );
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CERT.prototype.getPublicKey =
+ function()
+ {
+ /// <summary>Importing public key for current certificate</summary>
+
+ // #region Initial variables
+ var algorithm;
+ // #endregion
+
+ // #region Get a "crypto" extension
+ var crypto = in_window.org.pkijs.getCrypto();
+ if(typeof crypto == "undefined")
+ return new Promise(function(resolve, reject) { reject("Unable to create WebCrypto object"); });
+ // #endregion
+
+ // #region Find correct algorithm for imported public key
+ if(arguments[0] instanceof Object)
+ {
+ if("algorithm" in arguments[0])
+ algorithm = arguments[0].algorithm;
+ else
+ return new Promise(function(resolve, reject) { reject("Absent mandatory parameter \"algorithm\""); });
+ }
+ else
+ {
+ // #region Find signer's hashing algorithm
+ var sha_algorithm = in_window.org.pkijs.getHashAlgorithm(this.signatureAlgorithm);
+ if(sha_algorithm === "")
+ return new Promise(function(resolve, reject) { reject("Unsupported signature algorithm: " + _this.signatureAlgorithm.algorithm_id); });
+ // #endregion
+
+ // #region Get information about public key algorithm and default parameters for import
+ var algorithmObject = in_window.org.pkijs.getAlgorithmByOID(this.signatureAlgorithm.algorithm_id);
+ if(("name" in algorithmObject) === false)
+ return new Promise(function(resolve, reject) { reject("Unsupported public key algorithm: " + _this.signatureAlgorithm.algorithm_id); });
+
+ var algorithm_name = algorithmObject.name;
+
+ algorithm = in_window.org.pkijs.getAlgorithmParameters(algorithm_name, "importkey");
+ if("hash" in algorithm.algorithm)
+ algorithm.algorithm.hash.name = sha_algorithm;
+ // #endregion
+ }
+ // #endregion
+
+ // #region Get neccessary values from internal fields for current certificate
+ var publicKeyInfo_schema = this.subjectPublicKeyInfo.toSchema();
+ var publicKeyInfo_buffer = publicKeyInfo_schema.toBER(false);
+ var publicKeyInfo_view = new Uint8Array(publicKeyInfo_buffer);
+ // #endregion
+
+ return crypto.importKey("spki", publicKeyInfo_view, algorithm.algorithm, true, algorithm.usages);
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CERT.prototype.getKeyHash =
+ function()
+ {
+ /// <summary>Get SHA-1 hash value for subject public key</summary>
+
+ // #region Get a "crypto" extension
+ var crypto = in_window.org.pkijs.getCrypto();
+ if(typeof crypto == "undefined")
+ return new Promise(function(resolve, reject) { reject("Unable to create WebCrypto object"); });
+ // #endregion
+
+ return crypto.digest({ name: "sha-1" }, new Uint8Array(this.subjectPublicKeyInfo.subjectPublicKey.value_block.value_hex));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CERT.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ tbs: in_window.org.pkijs.bufferToHexCodes(this.tbs, 0, this.tbs.byteLength),
+ serialNumber: this.serialNumber.toJSON(),
+ signature: this.signature.toJSON(),
+ issuer: this.issuer.toJSON(),
+ notBefore: this.notBefore.toJSON(),
+ notAfter: this.notAfter.toJSON(),
+ subject: this.subject.toJSON(),
+ subjectPublicKeyInfo: this.subjectPublicKeyInfo.toJSON(),
+ signatureAlgorithm: this.signatureAlgorithm.toJSON(),
+ signatureValue: this.signatureValue.toJSON()
+ };
+
+ if("version" in this)
+ _object.version = this.version;
+
+ if("issuerUniqueID" in this)
+ _object.issuerUniqueID = in_window.org.pkijs.bufferToHexCodes(this.issuerUniqueID, 0, this.issuerUniqueID.byteLength);
+
+ if("subjectUniqueID" in this)
+ _object.subjectUniqueID = in_window.org.pkijs.bufferToHexCodes(this.subjectUniqueID, 0, this.subjectUniqueID.byteLength);
+
+ if("extensions" in this)
+ {
+ _object.extensions = new Array();
+
+ for(var i = 0; i < this.extensions.length; i++)
+ _object.extensions.push(this.extensions[i].toJSON());
+ }
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "revoked certificate" type (to use in CRL)
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.REV_CERT =
+ function()
+ {
+ // #region Internal properties of the object
+ this.userCertificate = new in_window.org.pkijs.asn1.INTEGER();
+ this.revocationDate = new in_window.org.pkijs.simpl.TIME();
+ // OPTIONAL this.crlEntryExtensions = new Array(); // Array of "in_window.org.pkijs.simpl.EXTENSION");
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.REV_CERT.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.userCertificate = arguments[0].userCertificate || new in_window.org.pkijs.asn1.INTEGER();
+ this.revocationDate = arguments[0].revocationDate || new in_window.org.pkijs.simpl.TIME();
+ if("crlEntryExtensions" in arguments[0])
+ this.crlEntryExtensions = arguments[0].crlEntryExtensions;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.REV_CERT.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ new in_window.org.pkijs.asn1.INTEGER({ name: "userCertificate" }),
+ in_window.org.pkijs.schema.TIME({
+ names: {
+ utcTimeName: "revocationDate",
+ generalTimeName: "revocationDate"
+ }
+ }),
+ in_window.org.pkijs.schema.EXTENSIONS({
+ names: {
+ block_name: "crlEntryExtensions"
+ }
+ }, true)
+ ]
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for REV_CERT");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.userCertificate = asn1.result["userCertificate"];
+ this.revocationDate = new in_window.org.pkijs.simpl.TIME({ schema: asn1.result["revocationDate"] });
+
+ if("crlEntryExtensions" in asn1.result)
+ {
+ this.crlEntryExtensions = new Array();
+ var exts = asn1.result["crlEntryExtensions"].value_block.value;
+
+ for(var i = 0; i < exts.length; i++)
+ this.crlEntryExtensions.push(new in_window.org.pkijs.simpl.EXTENSION({ schema: exts[i] }));
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.REV_CERT.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var sequence_array = new Array();
+ sequence_array.push(this.userCertificate);
+ sequence_array.push(this.revocationDate.toSchema());
+
+ if("crlEntryExtensions" in this)
+ {
+ var exts = new Array();
+
+ for(var i = 0; i < this.crlEntryExtensions.length; i++)
+ exts.push(this.crlEntryExtensions[i].toSchema());
+
+ sequence_array.push(new in_window.org.pkijs.asn1.SEQUENCE({ value: exts }));
+ }
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: sequence_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.REV_CERT.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ userCertificate: this.userCertificate.toJSON(),
+ revocationDate: this.revocationDate.toJSON
+ };
+
+ if("crlEntryExtensions" in this)
+ {
+ _object.crlEntryExtensions = new Array();
+
+ for(var i = 0; i < this.crlEntryExtensions.length; i++)
+ _object.crlEntryExtensions.push(this.crlEntryExtensions[i].toJSON());
+ }
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for X.509 CRL (Certificate Revocation List)(RFC5280)
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CRL =
+ function()
+ {
+ // #region Internal properties of the object
+ // #region Properties from CRL TBS part
+ this.tbs = new ArrayBuffer(0);
+
+ // OPTIONAL this.version = 1;
+ this.signature = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER();
+ this.issuer = new in_window.org.pkijs.simpl.RDN();
+ this.thisUpdate = new in_window.org.pkijs.simpl.TIME();
+ // OPTIONAL this.nextUpdate = new in_window.org.pkijs.simpl.TIME();
+ // OPTIONAL this.revokedCertificates = new Array(); // Array of REV_CERT objects
+ // OPTIONAL this.crlExtensions = new Array(); // Array of in_window.org.pkijs.simpl.EXTENSION();
+ // #endregion
+
+ // #region Properties from CRL major part
+ this.signatureAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER();
+ this.signatureValue = new in_window.org.pkijs.asn1.BITSTRING();
+ // #endregion
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.CRL.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ // #region Properties from CRL TBS part
+ this.tbs = arguments[0].tbs || new ArrayBuffer(0);
+
+ if("version" in arguments[0])
+ this.version = arguments[0].version;
+ this.signature = arguments[0].signature || new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER();
+ this.issuer = arguments[0].issuer || new in_window.org.pkijs.simpl.RDN();
+ this.thisUpdate = arguments[0].thisUpdate || new in_window.org.pkijs.simpl.TIME();
+ if("nextUpdate" in arguments[0])
+ this.nextUpdate = arguments[0].nextUpdate;
+ if("revokedCertificates" in arguments[0])
+ this.revokedCertificates = arguments[0].revokedCertificates;
+ if("crlExtensions" in arguments[0])
+ this.crlExtensions = arguments[0].crlExtensions;
+ // #endregion
+
+ // #region Properties from CRL major part
+ this.signatureAlgorithm = arguments[0].signatureAlgorithm || new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER();
+ this.signatureValue = arguments[0].signatureValue || new in_window.org.pkijs.asn1.BITSTRING();
+ // #endregion
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CRL.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.CRL()
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for CRL");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.tbs = asn1.result["tbsCertList"].value_before_decode;
+
+ if("tbsCertList.version" in asn1.result)
+ this.version = asn1.result["tbsCertList.version"].value_block.value_dec;
+ this.signature = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({ schema: asn1.result["tbsCertList.signature"] });
+ this.issuer = new in_window.org.pkijs.simpl.RDN({ schema: asn1.result["tbsCertList.issuer"] });
+ this.thisUpdate = new in_window.org.pkijs.simpl.TIME({ schema: asn1.result["tbsCertList.thisUpdate"] });
+ if("tbsCertList.nextUpdate" in asn1.result)
+ this.nextUpdate = new in_window.org.pkijs.simpl.TIME({ schema: asn1.result["tbsCertList.nextUpdate"] });
+ if("tbsCertList.revokedCertificates" in asn1.result)
+ {
+ this.revokedCertificates = new Array();
+
+ var rev_certs = asn1.result["tbsCertList.revokedCertificates"];
+ for(var i = 0; i < rev_certs.length; i++)
+ this.revokedCertificates.push(new in_window.org.pkijs.simpl.REV_CERT({ schema: rev_certs[i] }));
+ }
+ if("tbsCertList.extensions" in asn1.result)
+ {
+ this.crlExtensions = new Array();
+ var exts = asn1.result["tbsCertList.extensions"].value_block.value;
+
+ for(var i = 0; i < exts.length; i++)
+ this.crlExtensions.push(new in_window.org.pkijs.simpl.EXTENSION({ schema: exts[i] }));
+ }
+
+ this.signatureAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({ schema: asn1.result["signatureAlgorithm"] });
+ this.signatureValue = asn1.result["signatureValue"];
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CRL.prototype.encodeTBS =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ if("version" in this)
+ output_array.push(new in_window.org.pkijs.asn1.INTEGER({ value: this.version }));
+
+ output_array.push(this.signature.toSchema());
+ output_array.push(this.issuer.toSchema());
+ output_array.push(this.thisUpdate.toSchema());
+
+ if("nextUpdate" in this)
+ output_array.push(this.nextUpdate.toSchema());
+
+ if("revokedCertificates" in this)
+ {
+ var rev_certificates = new Array();
+
+ for(var i = 0; i < this.revokedCertificates.length; i++)
+ rev_certificates.push(this.revokedCertificates[i].toSchema());
+
+ output_array.push(new in_window.org.pkijs.asn1.SEQUENCE({
+ value: rev_certificates
+ }));
+ }
+
+ if("crlExtensions" in this)
+ {
+ var extensions = new Array();
+
+ for(var j = 0; j < this.crlExtensions.length; j++)
+ extensions.push(this.crlExtensions[j].toSchema());
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: [
+ new in_window.org.pkijs.asn1.SEQUENCE({
+ value: extensions
+ })
+ ]
+ }));
+ }
+ // #endregion
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CRL.prototype.toSchema =
+ function(encodeFlag)
+ {
+ /// <param name="encodeFlag" type="Boolean">If param equal to false then create TBS schema via decoding stored value. In othe case create TBS schema via assembling from TBS parts.</param>
+
+ // #region Check "encodeFlag"
+ if(typeof encodeFlag === "undefined")
+ encodeFlag = false;
+ // #endregion
+
+ // #region Decode stored TBS value
+ var tbs_schema;
+
+ if(encodeFlag === false)
+ {
+ if(this.tbs.length === 0) // No stored TBS part
+ return in_window.org.pkijs.schema.CRL();
+
+ tbs_schema = in_window.org.pkijs.fromBER(this.tbs).result;
+ }
+ // #endregion
+ // #region Create TBS schema via assembling from TBS parts
+ else
+ tbs_schema = in_window.org.pkijs.simpl.CRL.prototype.encodeTBS.call(this);
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ tbs_schema,
+ this.signatureAlgorithm.toSchema(),
+ this.signatureValue
+ ]
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CRL.prototype.verify =
+ function()
+ {
+ // #region Global variables
+ var sequence = Promise.resolve();
+
+ var signature = this.signatureValue;
+ var tbs = this.tbs;
+
+ var subjectPublicKeyInfo = -1;
+
+ var _this = this;
+ // #endregion
+
+ // #region Get information about CRL issuer certificate
+ if(arguments[0] instanceof Object)
+ {
+ if("issuerCertificate" in arguments[0]) // "issuerCertificate" must be of type "simpl.CERT"
+ {
+ subjectPublicKeyInfo = arguments[0].issuerCertificate.subjectPublicKeyInfo;
+
+ // The CRL issuer name and "issuerCertificate" subject name are not equal
+ if(this.issuer.isEqual(arguments[0].issuerCertificate.subject) == false)
+ return new Promise(function(resolve, reject) { resolve(false); });
+ }
+
+ // #region In case if there is only public key during verification
+ if("publicKeyInfo" in arguments[0])
+ subjectPublicKeyInfo = arguments[0].publicKeyInfo; // Must be of type "org.pkijs.simpl.PUBLIC_KEY_INFO"
+ // #endregion
+ }
+
+ if((subjectPublicKeyInfo instanceof in_window.org.pkijs.simpl.PUBLIC_KEY_INFO) === false)
+ return new Promise(function(resolve, reject) { reject("Issuer's certificate must be provided as an input parameter"); });
+ // #endregion
+
+ // #region Check the CRL for unknown critical extensions
+ if("crlExtensions" in this)
+ {
+ for(var i = 0; i < this.crlExtensions.length; i++)
+ {
+ if(this.crlExtensions[i].critical)
+ {
+ // We can not be sure that unknown extension has no value for CRL signature
+ if(("parsedValue" in this.crlExtensions[i]) == false)
+ return new Promise(function(resolve, reject) { resolve(false); });
+ }
+ }
+ }
+ // #endregion
+
+ // #region Get a "crypto" extension
+ var crypto = in_window.org.pkijs.getCrypto();
+ if(typeof crypto == "undefined")
+ return new Promise(function(resolve, reject) { reject("Unable to create WebCrypto object"); });
+ // #endregion
+
+ // #region Find signer's hashing algorithm
+ var sha_algorithm = in_window.org.pkijs.getHashAlgorithm(this.signatureAlgorithm);
+ if(sha_algorithm === "")
+ return new Promise(function(resolve, reject) { reject("Unsupported signature algorithm: " + _this.signatureAlgorithm.algorithm_id); });
+ // #endregion
+
+ // #region Import public key
+ sequence = sequence.then(
+ function()
+ {
+ // #region Get information about public key algorithm and default parameters for import
+ var algorithmObject = in_window.org.pkijs.getAlgorithmByOID(_this.signature.algorithm_id);
+ if(("name" in algorithmObject) === "")
+ return new Promise(function(resolve, reject) { reject("Unsupported public key algorithm: " + _this.signature.algorithm_id); });
+
+ var algorithm_name = algorithmObject.name;
+
+ var algorithm = in_window.org.pkijs.getAlgorithmParameters(algorithm_name, "importkey");
+ if("hash" in algorithm.algorithm)
+ algorithm.algorithm.hash.name = sha_algorithm;
+ // #endregion
+
+ var publicKeyInfo_schema = subjectPublicKeyInfo.toSchema();
+ var publicKeyInfo_buffer = publicKeyInfo_schema.toBER(false);
+ var publicKeyInfo_view = new Uint8Array(publicKeyInfo_buffer);
+
+ return crypto.importKey("spki",
+ publicKeyInfo_view,
+ algorithm.algorithm,
+ true,
+ algorithm.usages);
+ }
+ );
+ // #endregion
+
+ // #region Verify signature for the certificate
+ sequence = sequence.then(
+ function(publicKey)
+ {
+ // #region Get default algorithm parameters for verification
+ var algorithm = in_window.org.pkijs.getAlgorithmParameters(publicKey.algorithm.name, "verify");
+ if("hash" in algorithm.algorithm)
+ algorithm.algorithm.hash.name = sha_algorithm;
+ // #endregion
+
+ // #region Special case for ECDSA signatures
+ var signature_value = signature.value_block.value_hex;
+
+ if(publicKey.algorithm.name === "ECDSA")
+ {
+ var asn1 = in_window.org.pkijs.fromBER(signature_value);
+ signature_value = in_window.org.pkijs.createECDSASignatureFromCMS(asn1.result);
+ }
+ // #endregion
+
+ // #region Special case for RSA-PSS
+ if(publicKey.algorithm.name === "RSA-PSS")
+ {
+ var pssParameters;
+
+ try
+ {
+ pssParameters = new in_window.org.pkijs.simpl.x509.RSASSA_PSS_params({ schema: _this.signatureAlgorithm.algorithm_params });
+ }
+ catch(ex)
+ {
+ return new Promise(function(resolve, reject) { reject(ex); });
+ }
+
+ if("saltLength" in pssParameters)
+ algorithm.algorithm.saltLength = pssParameters.saltLength;
+ else
+ algorithm.algorithm.saltLength = 20;
+
+ var hash_algo = "SHA-1";
+
+ if("hashAlgorithm" in pssParameters)
+ {
+ var hashAlgorithm = in_window.org.pkijs.getAlgorithmByOID(pssParameters.hashAlgorithm.algorithm_id);
+ if(("name" in hashAlgorithm) === false)
+ return new Promise(function(resolve, reject) { reject("Unrecognized hash algorithm: " + pssParameters.hashAlgorithm.algorithm_id); });
+
+ hash_algo = hashAlgorithm.name;
+ }
+
+ algorithm.algorithm.hash.name = hash_algo;
+ }
+ // #endregion
+
+ return crypto.verify(algorithm.algorithm,
+ publicKey,
+ new Uint8Array(signature_value),
+ new Uint8Array(tbs));
+ }
+ );
+ // #endregion
+
+ return sequence;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CRL.prototype.sign =
+ function(privateKey, hashAlgorithm)
+ {
+ /// <param name="privateKey" type="Key">Private key for "subjectPublicKeyInfo" structure</param>
+ /// <param name="hashAlgorithm" type="String" optional="true">Hashing algorithm. Default SHA-1</param>
+
+ // #region Initial variables
+ var _this = this;
+ // #endregion
+
+ // #region Get a private key from function parameter
+ if(typeof privateKey === "undefined")
+ return new Promise(function(resolve, reject) { reject("Need to provide a private key for signing"); });
+ // #endregion
+
+ // #region Get hashing algorithm
+ if(typeof hashAlgorithm === "undefined")
+ hashAlgorithm = "SHA-1";
+ else
+ {
+ // #region Simple check for supported algorithm
+ var oid = in_window.org.pkijs.getOIDByAlgorithm({ name: hashAlgorithm });
+ if(oid === "")
+ return new Promise(function(resolve, reject) { reject("Unsupported hash algorithm: " + hashAlgorithm); });
+ // #endregion
+ }
+ // #endregion
+
+ // #region Get a "default parameters" for current algorithm
+ var defParams = in_window.org.pkijs.getAlgorithmParameters(privateKey.algorithm.name, "sign");
+ defParams.algorithm.hash.name = hashAlgorithm;
+ // #endregion
+
+ // #region Fill internal structures base on "privateKey" and "hashAlgorithm"
+ switch(privateKey.algorithm.name.toUpperCase())
+ {
+ case "RSASSA-PKCS1-V1_5":
+ case "ECDSA":
+ _this.signature.algorithm_id = in_window.org.pkijs.getOIDByAlgorithm(defParams.algorithm);
+ _this.signatureAlgorithm.algorithm_id = _this.signature.algorithm_id;
+ break;
+ case "RSA-PSS":
+ {
+ // #region Set "saltLength" as a length (in octets) of hash function result
+ switch(hashAlgorithm.toUpperCase())
+ {
+ case "SHA-256":
+ defParams.algorithm.saltLength = 32;
+ break;
+ case "SHA-384":
+ defParams.algorithm.saltLength = 48;
+ break;
+ case "SHA-512":
+ defParams.algorithm.saltLength = 64;
+ break;
+ default:
+ }
+ // #endregion
+
+ // #region Fill "RSASSA_PSS_params" object
+ var paramsObject = {};
+
+ if(hashAlgorithm.toUpperCase() !== "SHA-1")
+ {
+ var hashAlgorithmOID = in_window.org.pkijs.getOIDByAlgorithm({ name: hashAlgorithm });
+ if(hashAlgorithmOID === "")
+ return new Promise(function(resolve, reject) { reject("Unsupported hash algorithm: " + hashAlgorithm); });
+
+ paramsObject.hashAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({
+ algorithm_id: hashAlgorithmOID,
+ algorithm_params: new in_window.org.pkijs.asn1.NULL()
+ });
+
+ paramsObject.maskGenAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({
+ algorithm_id: "1.2.840.113549.1.1.8", // MGF1
+ algorithm_params: paramsObject.hashAlgorithm.toSchema()
+ })
+ }
+
+ if(defParams.algorithm.saltLength !== 20)
+ paramsObject.saltLength = defParams.algorithm.saltLength;
+
+ var pssParameters = new in_window.org.pkijs.simpl.x509.RSASSA_PSS_params(paramsObject);
+ // #endregion
+
+ // #region Automatically set signature algorithm
+ _this.signature = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({
+ algorithm_id: "1.2.840.113549.1.1.10",
+ algorithm_params: pssParameters.toSchema()
+ });
+ _this.signatureAlgorithm = _this.signature; // Must be the same
+ // #endregion
+ }
+ break;
+ default:
+ return new Promise(function(resolve, reject) { reject("Unsupported signature algorithm: " + privateKey.algorithm.name); });
+ }
+ // #endregion
+
+ // #region Create TBS data for signing
+ _this.tbs = in_window.org.pkijs.simpl.CRL.prototype.encodeTBS.call(this).toBER(false);
+ // #endregion
+
+ // #region Get a "crypto" extension
+ var crypto = in_window.org.pkijs.getCrypto();
+ if(typeof crypto == "undefined")
+ return new Promise(function(resolve, reject) { reject("Unable to create WebCrypto object"); });
+ // #endregion
+
+ // #region Signing TBS data on provided private key
+ return crypto.sign(
+ defParams.algorithm,
+ privateKey,
+ new Uint8Array(_this.tbs)).
+ then(
+ function(result)
+ {
+ // #region Special case for ECDSA algorithm
+ if(defParams.algorithm.name === "ECDSA")
+ result = in_window.org.pkijs.createCMSECDSASignature(result);
+ // #endregion
+
+ _this.signatureValue = new in_window.org.pkijs.asn1.BITSTRING({ value_hex: result });
+ },
+ function(error)
+ {
+ return new Promise(function(resolve, reject) { reject("Signing error: " + error); });
+ }
+ );
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CRL.prototype.isCertificateRevoked =
+ function()
+ {
+ // #region Get input certificate
+ var certificate = {};
+
+ if(arguments[0] instanceof Object)
+ {
+ if("certificate" in arguments[0])
+ certificate = arguments[0].certificate;
+ }
+
+ if((certificate instanceof in_window.org.pkijs.simpl.CERT) === false)
+ return false;
+ // #endregion
+
+ // #region Check that issuer of the input certificate is the same with issuer of this CRL
+ if(this.issuer.isEqual(certificate.issuer) === false)
+ return false;
+ // #endregion
+
+ // #region Check that there are revoked certificates in this CRL
+ if(("revokedCertificates" in this) === false)
+ return false;
+ // #endregion
+
+ // #region Search for input certificate in revoked certificates array
+ for(var i = 0; i < this.revokedCertificates.length; i++)
+ {
+ if(this.revokedCertificates[i].userCertificate.isEqual(certificate.serialNumber))
+ return true;
+ }
+ // #endregion
+
+ return false;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CRL.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ tbs: in_window.org.pkijs.bufferToHexCodes(this.tbs, 0, this.tbs.byteLength),
+ signature: this.signature.toJSON(),
+ issuer: this.issuer.toJSON(),
+ thisUpdate: this.thisUpdate.toJSON(),
+ signatureAlgorithm: this.signatureAlgorithm.toJSON(),
+ signatureValue: this.signatureValue.toJSON()
+ };
+
+ if("version" in this)
+ _object.version = this.version;
+
+ if("nextUpdate" in this)
+ _object.nextUpdate = this.nextUpdate.toJSON();
+
+ if("revokedCertificates" in this)
+ {
+ _object.revokedCertificates = new Array();
+
+ for(var i = 0; i < this.revokedCertificates.length; i++)
+ _object.revokedCertificates.push(this.revokedCertificates[i].toJSON());
+ }
+
+ if("crlExtensions" in this)
+ {
+ _object.crlExtensions = new Array();
+
+ for(var i = 0; i < this.crlExtensions.length; i++)
+ _object.crlExtensions.push(this.crlExtensions[i].toJSON());
+ }
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for "Attribute" type
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ATTRIBUTE =
+ function()
+ {
+ // #region Internal properties of the object
+ this.type = "";
+ this.values = new Array();
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.ATTRIBUTE.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.type = arguments[0].type || "";
+ this.values = arguments[0].values || new Array();
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ATTRIBUTE.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.ATTRIBUTE({
+ names: {
+ type: "type",
+ values: "values"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for ATTRIBUTE");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.type = asn1.result["type"].value_block.toString();
+ this.values = asn1.result["values"];
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ATTRIBUTE.prototype.toSchema =
+ function()
+ {
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ new in_window.org.pkijs.asn1.OID({ value: this.type }),
+ new in_window.org.pkijs.asn1.SET({
+ value: this.values
+ })
+ ]
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.ATTRIBUTE.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ type: this.type,
+ values: new Array()
+ };
+
+ for(var i = 0; i < this.values.length; i++)
+ _object.values.push(this.values[i].toJSON());
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for PKCS#10 certificate request
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PKCS10 =
+ function()
+ {
+ // #region Internal properties of the object
+ this.tbs = new ArrayBuffer(0);
+
+ this.version = 0;
+ this.subject = new in_window.org.pkijs.simpl.RDN();
+ this.subjectPublicKeyInfo = new in_window.org.pkijs.simpl.PUBLIC_KEY_INFO();
+ // OPTIONAL this.attributes = new Array(); // Array of simpl.ATTRIBUTE objects
+
+ this.signatureAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER(); // Signature algorithm from certificate major part
+ this.signatureValue = new in_window.org.pkijs.asn1.BITSTRING();
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.PKCS10.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.tbs = arguments[0].tbs || new ArrayBuffer(0);
+
+ this.version = arguments[0].version || 0;
+ this.subject = arguments[0].subject || new in_window.org.pkijs.simpl.RDN();
+ this.subjectPublicKeyInfo = arguments[0].subjectPublicKeyInfo || new in_window.org.pkijs.simpl.PUBLIC_KEY_INFO();
+
+ if("attributes" in arguments[0])
+ this.attributes = arguments[0].attributes;
+
+ this.signatureAlgorithm = arguments[0].signatureAlgorithm || new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER(); // Signature algorithm from certificate major part
+ this.signatureValue = arguments[0].signatureValue || new in_window.org.pkijs.asn1.BITSTRING();
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PKCS10.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.PKCS10()
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for PKCS10");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.tbs = asn1.result["CertificationRequestInfo"].value_before_decode;
+
+ this.version = asn1.result["CertificationRequestInfo.version"].value_block.value_dec;
+ this.subject = new in_window.org.pkijs.simpl.RDN({ schema: asn1.result["CertificationRequestInfo.subject"] });
+ this.subjectPublicKeyInfo = new in_window.org.pkijs.simpl.PUBLIC_KEY_INFO({ schema: asn1.result["CertificationRequestInfo.subjectPublicKeyInfo"] });
+ if("CertificationRequestInfo.attributes" in asn1.result)
+ {
+ this.attributes = new Array();
+
+ var attrs = asn1.result["CertificationRequestInfo.attributes"];
+ for(var i = 0; i < attrs.length; i++)
+ this.attributes.push(new in_window.org.pkijs.simpl.ATTRIBUTE({ schema: attrs[i] }));
+ }
+
+ this.signatureAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({ schema: asn1.result["signatureAlgorithm"] });
+ this.signatureValue = asn1.result["signatureValue"];
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PKCS10.prototype.encodeTBS =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ output_array.push(new in_window.org.pkijs.asn1.INTEGER({ value: this.version }));
+ output_array.push(this.subject.toSchema());
+ output_array.push(this.subjectPublicKeyInfo.toSchema());
+
+ if("attributes" in this)
+ {
+ var attributes = new Array();
+
+ for(var i = 0; i < this.attributes.length; i++)
+ attributes.push(this.attributes[i].toSchema());
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: attributes
+ }));
+ }
+ // #endregion
+
+ return (new in_window.org.pkijs.asn1.SEQUENCE({ value: output_array }));
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PKCS10.prototype.toSchema =
+ function(encodeFlag)
+ {
+ /// <param name="encodeFlag" type="Boolean">If param equal to false then create TBS schema via decoding stored value. In othe case create TBS schema via assembling from TBS parts.</param>
+
+ // #region Check "encodeFlag"
+ if(typeof encodeFlag === "undefined")
+ encodeFlag = false;
+ // #endregion
+
+ // #region Decode stored TBS value
+ var tbs_schema;
+
+ if(encodeFlag === false)
+ {
+ if(this.tbs.length === 0) // No stored TBS part
+ return in_window.org.pkijs.schema.PKCS10();
+
+ tbs_schema = in_window.org.pkijs.fromBER(this.tbs).result;
+ }
+ // #endregion
+ // #region Create TBS schema via assembling from TBS parts
+ else
+ tbs_schema = in_window.org.pkijs.simpl.PKCS10.prototype.encodeTBS.call(this);
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: [
+ tbs_schema,
+ this.signatureAlgorithm.toSchema(),
+ this.signatureValue
+ ]
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PKCS10.prototype.verify =
+ function()
+ {
+ /// <summary>!!! Works well in Chrome dev versions only (April 2014th) !!!</summary>
+ /// <returns type="Promise">Returns a new Promise object (in case of error), or a result of "crypto.subtle.veryfy" function</returns>
+
+ // #region Global variables
+ var _this = this;
+ var sha_algorithm = "";
+
+ var sequence = Promise.resolve();
+
+ var subjectPublicKeyInfo = this.subjectPublicKeyInfo;
+ var signature = this.signatureValue;
+ var tbs = this.tbs;
+ // #endregion
+
+ // #region Get a "crypto" extension
+ var crypto = in_window.org.pkijs.getCrypto();
+ if(typeof crypto == "undefined")
+ return new Promise(function(resolve, reject) { reject("Unable to create WebCrypto object"); });
+ // #endregion
+
+ // #region Find a correct hashing algorithm
+ sha_algorithm = in_window.org.pkijs.getHashAlgorithm(this.signatureAlgorithm);
+ if(sha_algorithm === "")
+ return new Promise(function(resolve, reject) { reject("Unsupported signature algorithm: " + _this.signatureAlgorithm.algorithm_id); });
+ // #endregion
+
+ // #region Importing public key
+ sequence = sequence.then(
+ function()
+ {
+ // #region Get information about public key algorithm and default parameters for import
+ var algorithmObject = in_window.org.pkijs.getAlgorithmByOID(_this.signatureAlgorithm.algorithm_id);
+ if(("name" in algorithmObject) === false)
+ return new Promise(function(resolve, reject) { reject("Unsupported public key algorithm: " + _this.signatureAlgorithm.algorithm_id); });
+
+ var algorithm_name = algorithmObject.name;
+
+ var algorithm = in_window.org.pkijs.getAlgorithmParameters(algorithm_name, "importkey");
+ if("hash" in algorithm.algorithm)
+ algorithm.algorithm.hash.name = sha_algorithm;
+ // #endregion
+
+ var publicKeyInfo_schema = subjectPublicKeyInfo.toSchema();
+ var publicKeyInfo_buffer = publicKeyInfo_schema.toBER(false);
+ var publicKeyInfo_view = new Uint8Array(publicKeyInfo_buffer);
+
+ return crypto.importKey("spki", publicKeyInfo_view, algorithm.algorithm, true, algorithm.usages);
+ }
+ );
+ // #endregion
+
+ // #region Verify signature
+ sequence = sequence.then(
+ function(publicKey)
+ {
+ // #region Get default algorithm parameters for verification
+ var algorithm = in_window.org.pkijs.getAlgorithmParameters(publicKey.algorithm.name, "verify");
+ if("hash" in algorithm.algorithm)
+ algorithm.algorithm.hash.name = sha_algorithm;
+ // #endregion
+
+ // #region Special case for ECDSA signatures
+ var signature_value = signature.value_block.value_hex;
+
+ if(publicKey.algorithm.name === "ECDSA")
+ {
+ var asn1 = in_window.org.pkijs.fromBER(signature_value);
+ signature_value = in_window.org.pkijs.createECDSASignatureFromCMS(asn1.result);
+ }
+ // #endregion
+
+ // #region Special case for RSA-PSS
+ if(publicKey.algorithm.name === "RSA-PSS")
+ {
+ var pssParameters;
+
+ try
+ {
+ pssParameters = new in_window.org.pkijs.simpl.x509.RSASSA_PSS_params({ schema: _this.signatureAlgorithm.algorithm_params });
+ }
+ catch(ex)
+ {
+ return new Promise(function(resolve, reject) { reject(ex); });
+ }
+
+ if("saltLength" in pssParameters)
+ algorithm.algorithm.saltLength = pssParameters.saltLength;
+ else
+ algorithm.algorithm.saltLength = 20;
+
+ var hash_algo = "SHA-1";
+
+ if("hashAlgorithm" in pssParameters)
+ {
+ var hashAlgorithm = in_window.org.pkijs.getAlgorithmByOID(pssParameters.hashAlgorithm.algorithm_id);
+ if(("name" in hashAlgorithm) === false)
+ return new Promise(function(resolve, reject) { reject("Unrecognized hash algorithm: " + pssParameters.hashAlgorithm.algorithm_id); });
+
+ hash_algo = hashAlgorithm.name;
+ }
+
+ algorithm.algorithm.hash.name = hash_algo;
+ }
+ // #endregion
+
+ return crypto.verify(algorithm.algorithm,
+ publicKey,
+ new Uint8Array(signature_value),
+ new Uint8Array(tbs));
+ }
+ );
+ // #endregion
+
+ return sequence;
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PKCS10.prototype.sign =
+ function(privateKey, hashAlgorithm)
+ {
+ /// <param name="privateKey" type="Key">Private key for "subjectPublicKeyInfo" structure</param>
+ /// <param name="hashAlgorithm" type="String" optional="true">Hashing algorithm. Default SHA-1</param>
+
+ // #region Initial variables
+ var _this = this;
+ // #endregion
+
+ // #region Get a private key from function parameter
+ if(typeof privateKey === "undefined")
+ return new Promise(function(resolve, reject) { reject("Need to provide a private key for signing"); });
+ // #endregion
+
+ // #region Get hashing algorithm
+ if(typeof hashAlgorithm === "undefined")
+ hashAlgorithm = "SHA-1";
+ else
+ {
+ // #region Simple check for supported algorithm
+ var oid = in_window.org.pkijs.getOIDByAlgorithm({ name: hashAlgorithm });
+ if(oid === "")
+ return new Promise(function(resolve, reject) { reject("Unsupported hash algorithm: " + hashAlgorithm); });
+ // #endregion
+ }
+ // #endregion
+
+ // #region Get a "default parameters" for current algorithm
+ var defParams = in_window.org.pkijs.getAlgorithmParameters(privateKey.algorithm.name, "sign");
+ defParams.algorithm.hash.name = hashAlgorithm;
+ // #endregion
+
+ // #region Fill internal structures base on "privateKey" and "hashAlgorithm"
+ switch(privateKey.algorithm.name.toUpperCase())
+ {
+ case "RSASSA-PKCS1-V1_5":
+ case "ECDSA":
+ _this.signatureAlgorithm.algorithm_id = in_window.org.pkijs.getOIDByAlgorithm(defParams.algorithm);
+ break;
+ case "RSA-PSS":
+ {
+ // #region Set "saltLength" as a length (in octets) of hash function result
+ switch(hashAlgorithm.toUpperCase())
+ {
+ case "SHA-256":
+ defParams.algorithm.saltLength = 32;
+ break;
+ case "SHA-384":
+ defParams.algorithm.saltLength = 48;
+ break;
+ case "SHA-512":
+ defParams.algorithm.saltLength = 64;
+ break;
+ default:
+ }
+ // #endregion
+
+ // #region Fill "RSASSA_PSS_params" object
+ var paramsObject = {};
+
+ if(hashAlgorithm.toUpperCase() !== "SHA-1")
+ {
+ var hashAlgorithmOID = in_window.org.pkijs.getOIDByAlgorithm({ name: hashAlgorithm });
+ if(hashAlgorithmOID === "")
+ return new Promise(function(resolve, reject) { reject("Unsupported hash algorithm: " + hashAlgorithm); });
+
+ paramsObject.hashAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({
+ algorithm_id: hashAlgorithmOID,
+ algorithm_params: new in_window.org.pkijs.asn1.NULL()
+ });
+
+ paramsObject.maskGenAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({
+ algorithm_id: "1.2.840.113549.1.1.8", // MGF1
+ algorithm_params: paramsObject.hashAlgorithm.toSchema()
+ })
+ }
+
+ if(defParams.algorithm.saltLength !== 20)
+ paramsObject.saltLength = defParams.algorithm.saltLength;
+
+ var pssParameters = new in_window.org.pkijs.simpl.x509.RSASSA_PSS_params(paramsObject);
+ // #endregion
+
+ // #region Automatically set signature algorithm
+ _this.signatureAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({
+ algorithm_id: "1.2.840.113549.1.1.10",
+ algorithm_params: pssParameters.toSchema()
+ });
+ // #endregion
+ }
+ break;
+ default:
+ return new Promise(function(resolve, reject) { reject("Unsupported signature algorithm: " + privateKey.algorithm.name); });
+ }
+ // #endregion
+
+ // #region Create TBS data for signing
+ _this.tbs = in_window.org.pkijs.simpl.PKCS10.prototype.encodeTBS.call(this).toBER(false);
+ // #endregion
+
+ // #region Get a "crypto" extension
+ var crypto = in_window.org.pkijs.getCrypto();
+ if(typeof crypto == "undefined")
+ return new Promise(function(resolve, reject) { reject("Unable to create WebCrypto object"); });
+ // #endregion
+
+ // #region Signing TBS data on provided private key
+ return crypto.sign(defParams.algorithm,
+ privateKey,
+ new Uint8Array(_this.tbs)).then(
+ function(result)
+ {
+ // #region Special case for ECDSA algorithm
+ if(defParams.algorithm.name === "ECDSA")
+ result = in_window.org.pkijs.createCMSECDSASignature(result);
+ // #endregion
+
+ _this.signatureValue = new in_window.org.pkijs.asn1.BITSTRING({ value_hex: result });
+ },
+ function(error)
+ {
+ return new Promise(function(resolve, reject) { reject("Signing error: " + error); });
+ }
+ );
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PKCS10.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ tbs: in_window.org.pkijs.bufferToHexCodes(this.tbs, 0, this.tbs.byteLength),
+ version: this.version,
+ subject: this.subject.toJSON(),
+ subjectPublicKeyInfo: this.subjectPublicKeyInfo.toJSON(),
+ signatureAlgorithm: this.signatureAlgorithm.toJSON(),
+ signatureValue: this.signatureValue.toJSON()
+ };
+
+ if("attributes" in this)
+ {
+ _object.attributes = new Array();
+
+ for(var i = 0; i < this.attributes.length; i++)
+ _object.attributes.push(this.attributes[i].toJSON());
+ }
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for PKCS#8 private key bag
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PKCS8 =
+ function()
+ {
+ // #region Internal properties of the object
+ this.version = 0;
+ this.privateKeyAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER();
+ this.privateKey = new in_window.org.pkijs.asn1.OCTETSTRING();
+ // OPTIONAL this.attributes // Array of "in_window.org.pkijs.simpl.ATTRIBUTE"
+ // #endregion
+
+ // #region If input argument array contains "schema" for this object
+ if((arguments[0] instanceof Object) && ("schema" in arguments[0]))
+ in_window.org.pkijs.simpl.PKCS8.prototype.fromSchema.call(this, arguments[0].schema);
+ // #endregion
+ // #region If input argument array contains "native" values for internal properties
+ else
+ {
+ if(arguments[0] instanceof Object)
+ {
+ this.version = arguments[0].version || 0;
+ this.privateKeyAlgorithm = arguments[0].privateKeyAlgorithm || new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER();
+ this.privateKey = arguments[0].privateKey || new in_window.org.pkijs.asn1.OCTETSTRING();
+
+ if("attributes" in arguments[0])
+ this.attributes = arguments[0].attributes;
+ }
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PKCS8.prototype.fromSchema =
+ function(schema)
+ {
+ // #region Check the schema is valid
+ var asn1 = in_window.org.pkijs.compareSchema(schema,
+ schema,
+ in_window.org.pkijs.schema.PKCS8({
+ names: {
+ version: "version",
+ privateKeyAlgorithm: {
+ names: {
+ block_name: "privateKeyAlgorithm"
+ }
+ },
+ privateKey: "privateKey",
+ attributes: "attributes"
+ }
+ })
+ );
+
+ if(asn1.verified === false)
+ throw new Error("Object's schema was not verified against input data for PKCS8");
+ // #endregion
+
+ // #region Get internal properties from parsed schema
+ this.version = asn1.result["version"].value_block.value_dec;
+ this.privateKeyAlgorithm = new in_window.org.pkijs.simpl.ALGORITHM_IDENTIFIER({ schema: asn1.result["privateKeyAlgorithm"] });
+ this.privateKey = asn1.result["privateKey"];
+
+ if("attributes" in asn1.result)
+ {
+ this.attributes = new Array();
+ var attrs = asn1.result["attributes"];
+
+ for(var i = 0; i < attrs.length; i++)
+ this.attributes.push(new in_window.org.pkijs.simpl.ATTRIBUTE({ schema: attrs[i] }));
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PKCS8.prototype.toSchema =
+ function()
+ {
+ // #region Create array for output sequence
+ var output_array = new Array();
+
+ output_array.push(new in_window.org.pkijs.asn1.INTEGER({ value: this.version }));
+ output_array.push(this.privateKeyAlgorithm.toSchema());
+ output_array.push(this.privateKey);
+
+ if("attributes" in this)
+ {
+ var attrs = new Array();
+
+ for(var i = 0; i < this.attributes.length; i++)
+ attrs.push(this.attributes[i].toSchema());
+
+ output_array.push(new in_window.org.pkijs.asn1.ASN1_CONSTRUCTED({
+ optional: true,
+ id_block: {
+ tag_class: 3, // CONTEXT-SPECIFIC
+ tag_number: 0 // [0]
+ },
+ value: attrs
+ }));
+ }
+ // #endregion
+
+ // #region Construct and return new ASN.1 schema for this object
+ return (new in_window.org.pkijs.asn1.SEQUENCE({
+ value: output_array
+ }));
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.PKCS8.prototype.toJSON =
+ function()
+ {
+ var _object = {
+ version: this.version,
+ privateKeyAlgorithm: this.privateKeyAlgorithm.toJSON(),
+ privateKey: this.privateKey.toJSON()
+ };
+
+ if("attributes" in this)
+ {
+ _object.attributes = new Array();
+
+ for(var i = 0; i < this.attributes.length; i++)
+ _object.attributes.push(this.attributes[i].toJSON());
+ }
+
+ return _object;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+ // #region Simplified structure for working with X.509 certificate chains
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CERT_CHAIN =
+ function()
+ {
+ // #region Internal properties of the object
+ /// <field name="trusted_certs" type="Array" elementType="in_window.org.pkijs.simpl.CERT">Array of pre-defined trusted (by user) certificates</field>
+ this.trusted_certs = new Array();
+ /// <field name="certs" type="Array" elementType="in_window.org.pkijs.simpl.CERT">Array with certificate chain. Could be only one end-user certificate in there!</field>
+ this.certs = new Array();
+ /// <field name="crls" type="Array" elementType="in_window.org.pkijs.simpl.CRL">Array of all CRLs for all certificates from certificate chain</field>
+ this.crls = new Array();
+ // #endregion
+
+ // #region Initialize internal properties by input values
+ if(arguments[0] instanceof Object)
+ {
+ this.trusted_certs = arguments[0].trusted_certs || new Array();
+ this.certs = arguments[0].certs || new Array();
+ this.crls = arguments[0].crls || new Array();
+ }
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CERT_CHAIN.prototype.sort =
+ function()
+ {
+ // #region Initial variables
+ /// <var type="Array" elementType="in_window.org.pkijs.simpl.CERT">Array of sorted certificates</var>
+ var sorted_certs = new Array();
+
+ /// <var type="Array" elementType="in_window.org.pkijs.simpl.CERT">Initial array of certificates</var>
+ var certs = this.certs.slice(0); // Explicity copy "this.certs"
+
+ /// <var type="Date">Date for checking certificate validity period</var>
+ var check_date = new Date();
+
+ var _this = this;
+ // #endregion
+
+ // #region Initial checks
+ if(certs.length === 0)
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 2,
+ result_message: "Certificate's array can not be empty"
+ });
+ });
+ // #endregion
+
+ // #region Find end-user certificate
+ var end_user_index = -1;
+
+ for(var i = 0; i < certs.length; i++)
+ {
+ var isCA = false;
+
+ if("extensions" in certs[i])
+ {
+ var mustBeCA = false;
+ var keyUsagePresent = false;
+ var cRLSign = false;
+
+ for(var j = 0; j < certs[i].extensions.length; j++)
+ {
+ if((certs[i].extensions[j].critical === true) &&
+ (("parsedValue" in certs[i].extensions[j]) === false))
+ {
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 6,
+ result_message: "Unable to parse critical certificate extension: " + certs[i].extensions[j].extnID
+ });
+ });
+ }
+
+ if(certs[i].extensions[j].extnID === "2.5.29.15") // KeyUsage
+ {
+ keyUsagePresent = true;
+
+ var view = new Uint8Array(certs[i].extensions[j].parsedValue.value_block.value_hex);
+
+ if((view[0] & 0x04) === 0x04) // Set flag "keyCertSign"
+ mustBeCA = true;
+
+ if((view[0] & 0x02) === 0x02) // Set flag "cRLSign"
+ cRLSign = true;
+ }
+
+ if(certs[i].extensions[j].extnID === "2.5.29.19") // BasicConstraints
+ {
+ if("cA" in certs[i].extensions[j].parsedValue)
+ {
+ if(certs[i].extensions[j].parsedValue.cA === true)
+ isCA = true;
+ }
+ }
+ }
+
+ if((mustBeCA === true) && (isCA === false))
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 3,
+ result_message: "Unable to build certificate chain - using \"keyCertSign\" flag set without BasicConstaints"
+ });
+ });
+
+ if((keyUsagePresent === true) && (isCA === true) && (mustBeCA === false))
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 4,
+ result_message: "Unable to build certificate chain - \"keyCertSign\" flag was not set"
+ });
+ });
+
+ if((isCA === true) && (keyUsagePresent === true) && (cRLSign === false))
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 5,
+ result_message: "Unable to build certificate chain - intermediate certificate must have \"cRLSign\" key usage flag"
+ });
+ });
+ }
+
+ if(isCA === false)
+ {
+ if(sorted_certs.length !== 0)
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 7,
+ result_message: "Unable to build certificate chain - more than one possible end-user certificate"
+ });
+ });
+
+ sorted_certs.push(certs[i]);
+ end_user_index = i;
+ }
+ }
+
+ certs.splice(end_user_index, 1);
+ // #endregion
+
+ // #region Check that end-user certificate was found
+ if(sorted_certs.length === 0)
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 1,
+ result_message: "Can't find end-user certificate"
+ });
+ });
+ // #endregion
+
+ // #region Return if there is only one certificate in certificate's array
+ if(certs.length === 0)
+ {
+ if(sorted_certs[0].issuer.isEqual(sorted_certs[0].subject) === true)
+ return new Promise(function(resolve, reject) { resolve(sorted_certs); });
+ else
+ {
+ if(this.trusted_certs.length === 0)
+ {
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 70,
+ result_message: "Can't find root certificate"
+ });
+ });
+ }
+ else
+ {
+ certs = _this.trusted_certs.splice(0);
+ }
+ }
+
+ }
+ // #endregion
+
+ /// <var type="in_window.org.pkijs.simpl.CERT">Current certificate (to find issuer for)</var>
+ var current_certificate = sorted_certs[0];
+
+ // #region Auxiliary functions working with Promises
+ function basic(subject_certificate, issuer_certificate)
+ {
+ /// <summary>Basic certificate checks</summary>
+ /// <param name="subject_certificate" type="in_window.org.pkijs.simpl.CERT">Certificate for testing (subject)</param>
+ /// <param name="issuer_certificate" type="in_window.org.pkijs.simpl.CERT">Certificate for issuer of subject certificate</param>
+
+ // #region Initial variables
+ var sequence = Promise.resolve();
+ // #endregion
+
+ // #region Check validity period for subject certificate
+ sequence = sequence.then(
+ function()
+ {
+ if((subject_certificate.notBefore.value > check_date) ||
+ (subject_certificate.notAfter.value < check_date))
+ {
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 8,
+ result_message: "Certificate validity period is out of checking date"
+ });
+ });
+ }
+ }
+ );
+ // #endregion
+
+ // #region Give ability to not provide CRLs (all certificates assume to be valid)
+ if(_this.crls.length === 0)
+ return sequence.then(
+ function()
+ {
+ return new Promise(function(resolve, reject) { resolve(); });
+ }
+ );
+ // #endregion
+
+ // #region Find correct CRL for "issuer_certificate"
+ function find_crl(index)
+ {
+ return _this.crls[index].verify({ issuerCertificate: issuer_certificate }).then(
+ function(result)
+ {
+ if(result === true)
+ return new Promise(function(resolve, reject) { resolve(_this.crls[index]); });
+ else
+ {
+ index++;
+
+ if(index < _this.crls.length)
+ return find_crl(index);
+ else
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 9,
+ result_message: "Unable to find CRL for issuer's certificate"
+ });
+ });
+ }
+ },
+ function(error)
+ {
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 10,
+ result_message: "Unable to find CRL for issuer's certificate"
+ });
+ });
+ }
+ );
+ }
+
+ sequence = sequence.then(
+ function()
+ {
+ return find_crl(0);
+ }
+ );
+ // #endregion
+
+ // #region Check that subject certificate is not in the CRL
+ sequence = sequence.then(
+ function(crl)
+ {
+ /// <param name="crl" type="in_window.org.pkijs.simpl.CRL">CRL for issuer's certificate</param>
+
+ if(crl.isCertificateRevoked({ certificate: subject_certificate }) === true)
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 11,
+ result_message: "Subject certificate was revoked"
+ });
+ });
+ else
+ return new Promise(function(resolve, reject) { resolve(); });
+ },
+ function(error)
+ {
+ /// <summary>Not for all certificates we have a CRL. So, this "stub" is for handling such situation - assiming we have a valid, non-revoked certificate</summary>
+ return new Promise(function(resolve, reject) { resolve(); });
+ }
+ );
+ // #endregion
+
+ return sequence;
+ }
+
+ function outer()
+ {
+ return inner(current_certificate, 0).then(
+ function(index)
+ {
+ sorted_certs.push(certs[index]);
+ current_certificate = certs[index];
+
+ certs.splice(index, 1);
+
+ if(current_certificate.issuer.isEqual(current_certificate.subject) === true)
+ {
+ // #region Check that the "self-signed" certificate there is in "trusted_certs" array
+ var found = (_this.trusted_certs.length === 0); // If user did not set "trusted_certs" then we have an option to trust any self-signed certificate as root
+
+ for(var i = 0; i < _this.trusted_certs.length; i++)
+ {
+ if((current_certificate.issuer.isEqual(_this.trusted_certs[i].issuer) === true) &&
+ (current_certificate.subject.isEqual(_this.trusted_certs[i].subject) === true) &&
+ (current_certificate.serialNumber.isEqual(_this.trusted_certs[i].serialNumber) === true))
+ {
+ found = true;
+ break;
+ }
+ }
+
+ if(found === false)
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 22,
+ result_message: "Self-signed root certificate not in \"trusted certificates\" array"
+ });
+ });
+ // #endregion
+
+ return (current_certificate.verify()).then( // Verifing last, self-signed certificate
+ function(result)
+ {
+ if(result === true)
+ return basic(current_certificate, current_certificate).then(
+ function()
+ {
+ return new Promise(function(resolve, reject) { resolve(sorted_certs); });
+ },
+ function(error)
+ {
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 12,
+ result_message: error
+ });
+ });
+ }
+ );
+ else
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 13,
+ result_message: "Unable to build certificate chain - signature of root certificate is invalid"
+ });
+ });
+ },
+ function(error)
+ {
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 14,
+ result_message: error
+ });
+ });
+ }
+ );
+ }
+ else // In case if self-signed cert for the chain in the "trusted_certs" array
+ {
+ if(certs.length > 0)
+ return outer();
+ else
+ {
+ if(_this.trusted_certs.length !== 0)
+ {
+ certs = _this.trusted_certs.splice(0);
+ return outer();
+ }
+ else
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 23,
+ result_message: "Root certificate not found"
+ });
+ });
+ }
+ }
+ },
+ function(error)
+ {
+ return new Promise(function(resolve, reject)
+ {
+ reject(error);
+ });
+ }
+ );
+ }
+
+ function inner(current_certificate, index)
+ {
+ if(certs[index].subject.isEqual(current_certificate.issuer) === true)
+ {
+ return current_certificate.verify({ issuerCertificate: certs[index] }).then(
+ function(result)
+ {
+ if(result === true)
+ {
+ return basic(current_certificate, certs[index]).then(
+ function()
+ {
+ return new Promise(function(resolve, reject) { resolve(index); });
+ },
+ function(error)
+ {
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 16,
+ result_message: error
+ });
+ });
+ }
+ );
+ }
+ else
+ {
+ if(index < (certs.length - 1))
+ return inner(current_certificate, index + 1);
+ else
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 17,
+ result_message: "Unable to build certificate chain - incomplete certificate chain or signature of some certificate is invalid"
+ });
+ });
+ }
+ },
+ function(error)
+ {
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 18,
+ result_message: "Unable to build certificate chain - error during certificate signature verification"
+ });
+ });
+ }
+ );
+ }
+ else
+ {
+ if(index < (certs.length - 1))
+ return inner(current_certificate, index + 1);
+ else
+ return new Promise(function(resolve, reject)
+ {
+ reject({
+ result: false,
+ result_code: 19,
+ result_message: "Unable to build certificate chain - incomplete certificate chain"
+ });
+ });
+ }
+ }
+ // #endregion
+
+ // #region Find certificates for all issuers
+ return outer();
+ // #endregion
+ };
+ //**************************************************************************************
+ in_window.org.pkijs.simpl.CERT_CHAIN.prototype.verify =
+ function()
+ {
+ // #region Initial checks
+ if(this.certs.length === 0)
+ return new Promise(function(resolve, reject) { reject("Empty certificate array"); });
+ // #endregion
+
+ // #region Initial variables
+ var sequence = Promise.resolve();
+
+ var _this = this;
+ // #endregion
+
+ // #region Get input variables
+ var initial_policy_set = new Array();
+ initial_policy_set.push("2.5.29.32.0"); // "anyPolicy"
+
+ var initial_explicit_policy = false;
+ var initial_policy_mapping_inhibit = false;
+ var initial_inhibit_policy = false;
+
+ var initial_permitted_subtrees_set = new Array(); // Array of "simpl.x509.GeneralSubtree"
+ var initial_excluded_subtrees_set = new Array(); // Array of "simpl.x509.GeneralSubtree"
+ var initial_required_name_forms = new Array(); // Array of "simpl.x509.GeneralSubtree"
+
+ var verification_time = new Date();
+
+ if(arguments[0] instanceof Object)
+ {
+ if("initial_policy_set" in arguments[0])
+ initial_policy_set = arguments[0].initial_policy_set;
+
+ if("initial_explicit_policy" in arguments[0])
+ initial_explicit_policy = arguments[0].initial_explicit_policy;
+
+ if("initial_policy_mapping_inhibit" in arguments[0])
+ initial_policy_mapping_inhibit = arguments[0].initial_policy_mapping_inhibit;
+
+ if("initial_inhibit_policy" in arguments[0])
+ initial_inhibit_policy = arguments[0].initial_inhibit_policy;
+
+ if("initial_permitted_subtrees_set" in arguments[0])
+ initial_permitted_subtrees_set = arguments[0].initial_permitted_subtrees_set;
+
+ if("initial_excluded_subtrees_set" in arguments[0])
+ initial_excluded_subtrees_set = arguments[0].initial_excluded_subtrees_set;
+
+ if("initial_required_name_forms" in arguments[0])
+ initial_required_name_forms = arguments[0].initial_required_name_forms;
+ }
+
+ var explicit_policy_indicator = initial_explicit_policy;
+ var policy_mapping_inhibit_indicator = initial_policy_mapping_inhibit;
+ var inhibit_any_policy_indicator = initial_inhibit_policy;
+
+ var pending_constraints = new Array(3);
+ pending_constraints[0] = false; // For "explicit_policy_pending"
+ pending_constraints[1] = false; // For "policy_mapping_inhibit_pending"
+ pending_constraints[2] = false; // For "inhibit_any_policy_pending"
+
+ var explicit_policy_pending = 0;
+ var policy_mapping_inhibit_pending = 0;
+ var inhibit_any_policy_pending = 0;
+
+ var permitted_subtrees = initial_permitted_subtrees_set;
+ var excluded_subtrees = initial_excluded_subtrees_set;
+ var required_name_forms = initial_required_name_forms;
+
+ var path_depth = 1;
+ // #endregion
+
+ // #region Sorting certificates in the chain array
+ sequence = (in_window.org.pkijs.simpl.CERT_CHAIN.prototype.sort.call(this)).then(
+ function(sorted_certs)
+ {
+ _this.certs = sorted_certs;
+ }
+ );
+ // #endregion
+
+ // #region Work with policies
+ sequence = sequence.then(
+ function()
+ {
+ // #region Support variables
+ var all_policies = new Array(); // Array of all policies (string values)
+ all_policies.push("2.5.29.32.0"); // Put "anyPolicy" at first place
+
+ var policies_and_certs = new Array(); // In fact "array of array" where rows are for each specific policy, column for each certificate and value is "true/false"
+
+ var any_policy_array = new Array(_this.certs.length - 1); // Minus "trusted anchor"
+ for(var ii = 0; ii < (_this.certs.length - 1) ; ii++)
+ any_policy_array[ii] = true;
+
+ policies_and_certs.push(any_policy_array);
+
+ var policy_mappings = new Array(_this.certs.length - 1); // Array of "PolicyMappings" for each certificate
+ var cert_policies = new Array(_this.certs.length - 1); // Array of "CertificatePolicies" for each certificate
+ // #endregion
+
+ for(var i = (_this.certs.length - 2) ; i >= 0 ; i--, path_depth++)
+ {
+ if("extensions" in _this.certs[i])
+ {
+ for(var j = 0; j < _this.certs[i].extensions.length; j++)
+ {
+ // #region CertificatePolicies
+ if(_this.certs[i].extensions[j].extnID === "2.5.29.32")
+ {
+ cert_policies[i] = _this.certs[i].extensions[j].parsedValue;
+
+ for(var k = 0; k < _this.certs[i].extensions[j].parsedValue.certificatePolicies.length; k++)
+ {
+ var policy_index = (-1);
+
+ // #region Try to find extension in "all_policies" array
+ for(var s = 0; s < all_policies.length; s++)
+ {
+ if(_this.certs[i].extensions[j].parsedValue.certificatePolicies[k].policyIdentifier === all_policies[s])
+ {
+ policy_index = s;
+ break;
+ }
+ }
+ // #endregion
+
+ if(policy_index === (-1))
+ {
+ all_policies.push(_this.certs[i].extensions[j].parsedValue.certificatePolicies[k].policyIdentifier);
+
+ var cert_array = new Array(_this.certs.length - 1);
+ cert_array[i] = true;
+
+ policies_and_certs.push(cert_array);
+ }
+ else(policies_and_certs[policy_index])[i] = true;
+ }
+ }
+ // #endregion
+
+ // #region PolicyMappings
+ if(_this.certs[i].extensions[j].extnID === "2.5.29.33")
+ policy_mappings[i] = _this.certs[i].extensions[j].parsedValue;
+ // #endregion
+
+ // #region PolicyConstraints
+ if(_this.certs[i].extensions[j].extnID === "2.5.29.36")
+ {
+ if(explicit_policy_indicator == false)
+ {
+ // #region requireExplicitPolicy
+ if(_this.certs[i].extensions[j].parsedValue.requireExplicitPolicy === 0)
+ explicit_policy_indicator = true;
+ else
+ {
+ if(pending_constraints[0] === false)
+ {
+ pending_constraints[0] = true;
+ explicit_policy_pending = _this.certs[i].extensions[j].parsedValue.requireExplicitPolicy;
+ }
+ else
+ {
+ explicit_policy_pending = (explicit_policy_pending > _this.certs[i].extensions[j].parsedValue.requireExplicitPolicy) ? _this.certs[i].extensions[j].parsedValue.requireExplicitPolicy : explicit_policy_pending;
+ }
+ }
+ // #endregion
+
+ // #region inhibitPolicyMapping
+ if(_this.certs[i].extensions[j].parsedValue.inhibitPolicyMapping === 0)
+ policy_mapping_inhibit_indicator = true;
+ else
+ {
+ if(pending_constraints[1] === false)
+ {
+ pending_constraints[1] = true;
+ policy_mapping_inhibit_pending = _this.certs[i].extensions[j].parsedValue.requireExplicitPolicy;
+ }
+ else
+ {
+ policy_mapping_inhibit_pending = (policy_mapping_inhibit_pending > _this.certs[i].extensions[j].parsedValue.requireExplicitPolicy) ? _this.certs[i].extensions[j].parsedValue.requireExplicitPolicy : policy_mapping_inhibit_pending;
+ }
+ }
+ // #endregion
+ }
+ }
+ // #endregion
+
+ // #region InhibitAnyPolicy
+ if(_this.certs[i].extensions[j].extnID === "2.5.29.54")
+ {
+ if(inhibit_any_policy_indicator === false)
+ {
+ if(_this.certs[i].extensions[j].parsedValue.value_block.value_dec === 0)
+ inhibit_any_policy_indicator = true;
+ else
+ {
+ if(pending_constraints[2] === false)
+ {
+ pending_constraints[2] = true;
+ inhibit_any_policy_pending = _this.certs[i].extensions[j].parsedValue.value_block.value_dec;
+ }
+ else
+ {
+ inhibit_any_policy_pending = (inhibit_any_policy_pending > _this.certs[i].extensions[j].parsedValue.value_block.value_dec) ? _this.certs[i].extensions[j].parsedValue.value_block.value_dec : inhibit_any_policy_pending;
+ }
+ }
+ }
+ }
+ // #endregion
+ }
+
+ // #region Check "inhibit_any_policy_indicator"
+ if(inhibit_any_policy_indicator === true)
+ delete (policies_and_certs[0])[i]; // Unset value to "undefined" for "anyPolicies" value for current certificate
+ // #endregion
+
+ // #region Combine information from certificate policies and policy mappings
+ if((typeof cert_policies[i] !== "undefined") &&
+ (typeof policy_mappings[i] !== "undefined") &&
+ (policy_mapping_inhibit_indicator === false))
+ {
+ for(var m = 0; m < cert_policies[i].certificatePolicies.length; m++)
+ {
+ var domainPolicy = "";
+
+ // #region Find if current policy is in "mappings" array
+ for(var n = 0; n < policy_mappings[i].mappings.length; n++)
+ {
+ if(policy_mappings[i].mappings[n].subjectDomainPolicy === cert_policies[i].certificatePolicies[m].policyIdentifier)
+ {
+ domainPolicy = policy_mappings[i].mappings[n].issuerDomainPolicy;
+ break;
+ }
+
+ // #region Could be the case for some reasons
+ if(policy_mappings[i].mappings[n].issuerDomainPolicy === cert_policies[i].certificatePolicies[m].policyIdentifier)
+ {
+ domainPolicy = policy_mappings[i].mappings[n].subjectDomainPolicy;
+ break;
+ }
+ // #endregion
+ }
+
+ if(domainPolicy === "")
+ continue;
+ // #endregion
+
+ // #region Find the index of "domainPolicy"
+ var domainPolicy_index = (-1);
+
+ for(var p = 0; p < all_policies.length; p++)
+ {
+ if(all_policies[p] === domainPolicy)
+ {
+ domainPolicy_index = p;
+ break;
+ }
+ }
+ // #endregion
+
+ // #region Change array value for "domainPolicy"
+ if(domainPolicy_index !== (-1))
+ (policies_and_certs[domainPolicy_index])[i] = true; // Put "set" in "domainPolicy" cell for specific certificate
+ // #endregion
+ }
+ }
+ // #endregion
+
+ // #region Process with "pending constraints"
+ if(explicit_policy_indicator === false)
+ {
+ if(pending_constraints[0] === true)
+ {
+ explicit_policy_pending--;
+ if(explicit_policy_pending === 0)
+ {
+ explicit_policy_indicator = true;
+ pending_constraints[0] = false;
+ }
+ }
+ }
+
+ if(policy_mapping_inhibit_indicator === false)
+ {
+ if(pending_constraints[1] === true)
+ {
+ policy_mapping_inhibit_pending--;
+ if(policy_mapping_inhibit_pending === 0)
+ {
+ policy_mapping_inhibit_indicator = true;
+ pending_constraints[1] = false;
+ }
+ }
+ }
+
+ if(inhibit_any_policy_indicator === false)
+ {
+ if(pending_constraints[2] === true)
+ {
+ inhibit_any_policy_pending--;
+ if(inhibit_any_policy_pending === 0)
+ {
+ inhibit_any_policy_indicator = true;
+ pending_constraints[2] = false;
+ }
+ }
+ }
+ // #endregion
+ }
+ }
+
+ // #region Create "set of authorities-constrained policies"
+ var auth_constr_policies = new Array();
+
+ for(var i = 0; i < policies_and_certs.length; i++)
+ {
+ var found = true;
+
+ for(var j = 0; j < (_this.certs.length - 1) ; j++)
+ {
+ if(typeof (policies_and_certs[i])[j] === "undefined")
+ {
+ found = false;
+ break;
+ }
+ }
+
+ if(found === true)
+ auth_constr_policies.push(all_policies[i]);
+ }
+ // #endregion
+
+ // #region Create "set of user-constrained policies"
+ var user_constr_policies = new Array();
+
+ for(var i = 0; i < auth_constr_policies.length; i++)
+ {
+ for(var j = 0; j < initial_policy_set.length; j++)
+ {
+ if(initial_policy_set[j] === auth_constr_policies[i])
+ {
+ user_constr_policies.push(initial_policy_set[j]);
+ break;
+ }
+ }
+ }
+ // #endregion
+
+ // #region Combine output object
+ return {
+ result: (user_constr_policies.length > 0),
+ result_code: 0,
+ result_message: (user_constr_policies.length > 0) ? "" : "Zero \"user_constr_policies\" array, no intersections with \"auth_constr_policies\"",
+ auth_constr_policies: auth_constr_policies,
+ user_constr_policies: user_constr_policies,
+ explicit_policy_indicator: explicit_policy_indicator,
+ policy_mappings: policy_mappings
+ };
+ // #endregion
+ }
+ );
+ // #endregion
+
+ // #region Work with name constraints
+ sequence = sequence.then(
+ function(policy_result)
+ {
+ // #region Auxiliary functions for name constraints checking
+ function compare_dNSName(name, constraint)
+ {
+ /// <summary>Compare two dNSName values</summary>
+ /// <param name="name" type="String">DNS from name</param>
+ /// <param name="constraint" type="String">Constraint for DNS from name</param>
+ /// <returns type="Boolean">Boolean result - valid or invalid the "name" against the "constraint"</returns>
+
+ // #region Make a "string preparation" for both name and constrain
+ var name_prepared = in_window.org.pkijs.stringPrep(name);
+ var constraint_prepared = in_window.org.pkijs.stringPrep(constraint);
+ // #endregion
+
+ // #region Make a "splitted" versions of "constraint" and "name"
+ var name_splitted = name_prepared.split(".");
+ var constraint_splitted = constraint_prepared.split(".");
+ // #endregion
+
+ // #region Length calculation and additional check
+ var name_len = name_splitted.length;
+ var constr_len = constraint_splitted.length;
+
+ if((name_len === 0) || (constr_len === 0) || (name_len < constr_len))
+ return false;
+ // #endregion
+
+ // #region Check that no part of "name" has zero length
+ for(var i = 0; i < name_len; i++)
+ {
+ if(name_splitted[i].length === 0)
+ return false;
+ }
+ // #endregion
+
+ // #region Check that no part of "constraint" has zero length
+ for(var i = 0; i < constr_len; i++)
+ {
+ if(constraint_splitted[i].length === 0)
+ {
+ if(i === 0)
+ {
+ if(constr_len === 1)
+ return false;
+ else
+ continue;
+ }
+
+ return false;
+ }
+ }
+ // #endregion
+
+ // #region Check that "name" has a tail as "constraint"
+
+ for(var i = 0; i < constr_len; i++)
+ {
+ if(constraint_splitted[constr_len - 1 - i].length === 0)
+ continue;
+
+ if(name_splitted[name_len - 1 - i].localeCompare(constraint_splitted[constr_len - 1 - i]) !== 0)
+ return false;
+ }
+ // #endregion
+
+ return true;
+ }
+
+ function compare_rfc822Name(name, constraint)
+ {
+ /// <summary>Compare two rfc822Name values</summary>
+ /// <param name="name" type="String">E-mail address from name</param>
+ /// <param name="constraint" type="String">Constraint for e-mail address from name</param>
+ /// <returns type="Boolean">Boolean result - valid or invalid the "name" against the "constraint"</returns>
+
+ // #region Make a "string preparation" for both name and constrain
+ var name_prepared = in_window.org.pkijs.stringPrep(name);
+ var constraint_prepared = in_window.org.pkijs.stringPrep(constraint);
+ // #endregion
+
+ // #region Make a "splitted" versions of "constraint" and "name"
+ var name_splitted = name_prepared.split("@");
+ var constraint_splitted = constraint_prepared.split("@");
+ // #endregion
+
+ // #region Splitted array length checking
+ if((name_splitted.length === 0) || (constraint_splitted.length === 0) || (name_splitted.length < constraint_splitted.length))
+ return false;
+ // #endregion
+
+ if(constraint_splitted.length === 1)
+ {
+ var result = compare_dNSName(name_splitted[1], constraint_splitted[0]);
+
+ if(result)
+ {
+ // #region Make a "splitted" versions of domain name from "constraint" and "name"
+ var ns = name_splitted[1].split(".");
+ var cs = constraint_splitted[0].split(".");
+ // #endregion
+
+ if(cs[0].length === 0)
+ return true;
+
+ return ns.length === cs.length;
+ }
+ else
+ return false;
+ }
+ else
+ return (name_prepared.localeCompare(constraint_prepared) === 0);
+
+ return false;
+ }
+
+ function compare_uniformResourceIdentifier(name, constraint)
+ {
+ /// <summary>Compare two uniformResourceIdentifier values</summary>
+ /// <param name="name" type="String">uniformResourceIdentifier from name</param>
+ /// <param name="constraint" type="String">Constraint for uniformResourceIdentifier from name</param>
+ /// <returns type="Boolean">Boolean result - valid or invalid the "name" against the "constraint"</returns>
+
+ // #region Make a "string preparation" for both name and constrain
+ var name_prepared = in_window.org.pkijs.stringPrep(name);
+ var constraint_prepared = in_window.org.pkijs.stringPrep(constraint);
+ // #endregion
+
+ // #region Find out a major URI part to compare with
+ var ns = name_prepared.split("/");
+ var cs = constraint_prepared.split("/");
+
+ if(cs.length > 1) // Malformed constraint
+ return false;
+
+ if(ns.length > 1) // Full URI string
+ {
+ for(var i = 0; i < ns.length; i++)
+ {
+ if((ns[i].length > 0) && (ns[i].charAt(ns[i].length - 1) !== ':'))
+ {
+ var ns_port = ns[i].split(":");
+ name_prepared = ns_port[0];
+ break;
+ }
+ }
+ }
+ // #endregion
+
+ var result = compare_dNSName(name_prepared, constraint_prepared);
+
+ if(result)
+ {
+ // #region Make a "splitted" versions of "constraint" and "name"
+ var name_splitted = name_prepared.split(".");
+ var constraint_splitted = constraint_prepared.split(".");
+ // #endregion
+
+ if(constraint_splitted[0].length === 0)
+ return true;
+
+ return name_splitted.length === constraint_splitted.length;
+ }
+ else
+ return false;
+
+ return false;
+ }
+
+ function compare_iPAddress(name, constraint)
+ {
+ /// <summary>Compare two iPAddress values</summary>
+ /// <param name="name" type="in_window.org.pkijs.asn1.OCTETSTRING">iPAddress from name</param>
+ /// <param name="constraint" type="in_window.org.pkijs.asn1.OCTETSTRING">Constraint for iPAddress from name</param>
+ /// <returns type="Boolean">Boolean result - valid or invalid the "name" against the "constraint"</returns>
+
+ // #region Common variables
+ var name_view = new Uint8Array(name.value_block.value_hex);
+ var constraint_view = new Uint8Array(constraint.value_block.value_hex);
+ // #endregion
+
+ // #region Work with IPv4 addresses
+ if((name_view.length === 4) && (constraint_view.length === 8))
+ {
+ for(var i = 0; i < 4; i++)
+ {
+ if((name_view[i] ^ constraint_view[i]) & constraint_view[i + 4])
+ return false;
+ }
+
+ return true;
+ }
+ // #endregion
+
+ // #region Work with IPv6 addresses
+ if((name_view.length === 16) && (constraint_view.length === 32))
+ {
+ for(var i = 0; i < 16; i++)
+ {
+ if((name_view[i] ^ constraint_view[i]) & constraint_view[i + 16])
+ return false;
+ }
+
+ return true;
+ }
+ // #endregion
+
+ return false;
+ }
+
+ function compare_directoryName(name, constraint)
+ {
+ /// <summary>Compare two directoryName values</summary>
+ /// <param name="name" type="in_window.org.pkijs.simpl.RDN">directoryName from name</param>
+ /// <param name="constraint" type="in_window.org.pkijs.simpl.RDN">Constraint for directoryName from name</param>
+ /// <param name="any" type="Boolean">Boolean flag - should be comparision interrupted after first match or we need to match all "constraints" parts</param>
+ /// <returns type="Boolean">Boolean result - valid or invalid the "name" against the "constraint"</returns>
+
+ // #region Initial check
+ if((name.types_and_values.length === 0) || (constraint.types_and_values.length === 0))
+ return true;
+
+ if(name.types_and_values.length < constraint.types_and_values.length)
+ return false;
+ // #endregion
+
+ // #region Initial variables
+ var result = true;
+ var name_start = 0;
+ // #endregion
+
+ for(var i = 0; i < constraint.types_and_values.length; i++)
+ {
+ var local_result = false;
+
+ for(var j = name_start; j < name.types_and_values.length; j++)
+ {
+ local_result = name.types_and_values[j].isEqual(constraint.types_and_values[i]);
+
+ if(name.types_and_values[j].type === constraint.types_and_values[i].type)
+ result = result && local_result;
+
+ if(local_result === true)
+ {
+ if((name_start === 0) || (name_start === j))
+ {
+ name_start = j + 1;
+ break;
+ }
+ else // Structure of "name" must be the same with "constraint"
+ return false;
+ }
+ }
+
+ if(local_result === false)
+ return false;
+ }
+
+ return (name_start === 0) ? false : result;
+ }
+ // #endregion
+
+ // #region Check a result from "policy checking" part
+ if(policy_result.result === false)
+ return policy_result;
+ // #endregion
+
+ // #region Check all certificates, excluding "trust anchor"
+ path_depth = 1;
+
+ for(var i = (_this.certs.length - 2) ; i >= 0 ; i--, path_depth++)
+ {
+ // #region Support variables
+ var subject_alt_names = new Array();
+
+ var cert_permitted_subtrees = new Array();
+ var cert_excluded_subtrees = new Array();
+ // #endregion
+
+ if("extensions" in _this.certs[i])
+ {
+ for(var j = 0; j < _this.certs[i].extensions.length; j++)
+ {
+ // #region NameConstraints
+ if(_this.certs[i].extensions[j].extnID === "2.5.29.30")
+ {
+ if("permittedSubtrees" in _this.certs[i].extensions[j].parsedValue)
+ cert_permitted_subtrees = cert_permitted_subtrees.concat(_this.certs[i].extensions[j].parsedValue.permittedSubtrees);
+
+ if("excludedSubtrees" in _this.certs[i].extensions[j].parsedValue)
+ cert_excluded_subtrees = cert_excluded_subtrees.concat(_this.certs[i].extensions[j].parsedValue.excludedSubtrees);
+ }
+ // #endregion
+
+ // #region SubjectAltName
+ if(_this.certs[i].extensions[j].extnID === "2.5.29.17")
+ subject_alt_names = subject_alt_names.concat(_this.certs[i].extensions[j].parsedValue.altNames);
+ // #endregion
+ }
+ }
+
+ // #region Checking for "required name forms"
+ var form_found = (required_name_forms.length <= 0);
+
+ for(var j = 0; j < required_name_forms.length; j++)
+ {
+ switch(required_name_forms[j].base.NameType)
+ {
+ case 4: // directoryName
+ {
+ if(required_name_forms[j].base.Name.types_and_values.length !== _this.certs[i].subject.types_and_values.length)
+ continue;
+
+ form_found = true;
+
+ for(var k = 0; k < _this.certs[i].subject.types_and_values.length; k++)
+ {
+ if(_this.certs[i].subject.types_and_values[k].type !== required_name_forms[j].base.Name.types_and_values[k].type)
+ {
+ form_found = false;
+ break;
+ }
+ }
+
+ if(form_found === true)
+ break;
+ }
+ break;
+ default: // ??? Probably here we should reject the certificate ???
+ }
+ }
+
+ if(form_found === false)
+ {
+ policy_result.result = false;
+ policy_result.result_code = 21;
+ policy_result.result_message = "No neccessary name form found";
+
+ return new Promise(function(resolve, reject)
+ {
+ reject(policy_result);
+ });
+ }
+ // #endregion
+
+ // #region Checking for "permited sub-trees"
+ // #region Make groups for all types of constraints
+ var constr_groups = new Array(); // Array of array for groupped constraints
+ constr_groups[0] = new Array(); // rfc822Name
+ constr_groups[1] = new Array(); // dNSName
+ constr_groups[2] = new Array(); // directoryName
+ constr_groups[3] = new Array(); // uniformResourceIdentifier
+ constr_groups[4] = new Array(); // iPAddress
+
+ for(var j = 0; j < permitted_subtrees.length; j++)
+ {
+ switch(permitted_subtrees[j].base.NameType)
+ {
+ // #region rfc822Name
+ case 1:
+ constr_groups[0].push(permitted_subtrees[j]);
+ break;
+ // #endregion
+ // #region dNSName
+ case 2:
+ constr_groups[1].push(permitted_subtrees[j]);
+ break;
+ // #endregion
+ // #region directoryName
+ case 4:
+ constr_groups[2].push(permitted_subtrees[j]);
+ break;
+ // #endregion
+ // #region uniformResourceIdentifier
+ case 6:
+ constr_groups[3].push(permitted_subtrees[j]);
+ break;
+ // #endregion
+ // #region iPAddress
+ case 7:
+ constr_groups[4].push(permitted_subtrees[j]);
+ break;
+ // #endregion
+ // #region default
+
+ default:
+ // #endregion
+ }
+ }
+ // #endregion
+
+ // #region Check name constraints groupped by type, one-by-one
+ for(var p = 0; p < 5; p++)
+ {
+ var group_permitted = false;
+ var valueExists = false;
+ var group = constr_groups[p];
+
+ for(var j = 0; j < group.length; j++)
+ {
+ switch(p)
+ {
+ // #region rfc822Name
+ case 0:
+ if(subject_alt_names.length > 0)
+ {
+ for(var k = 0; k < subject_alt_names.length; k++)
+ {
+ if(subject_alt_names[k].NameType === 1) // rfc822Name
+ {
+ valueExists = true;
+ group_permitted = group_permitted || compare_rfc822Name(subject_alt_names[k].Name, group[j].base.Name);
+ }
+ }
+ }
+ else // Try to find out "emailAddress" inside "subject"
+ {
+ for(var k = 0; k < _this.certs[i].subject.types_and_values.length; k++)
+ {
+ if((_this.certs[i].subject.types_and_values[k].type === "1.2.840.113549.1.9.1") || // PKCS#9 e-mail address
+ (_this.certs[i].subject.types_and_values[k].type === "0.9.2342.19200300.100.1.3")) // RFC1274 "rfc822Mailbox" e-mail address
+ {
+ valueExists = true;
+ group_permitted = group_permitted || compare_rfc822Name(_this.certs[i].subject.types_and_values[k].value.value_block.value, group[j].base.Name);
+ }
+ }
+ }
+ break;
+ // #endregion
+ // #region dNSName
+ case 1:
+ if(subject_alt_names.length > 0)
+ {
+ for(var k = 0; k < subject_alt_names.length; k++)
+ {
+ if(subject_alt_names[k].NameType === 2) // dNSName
+ {
+ valueExists = true;
+ group_permitted = group_permitted || compare_dNSName(subject_alt_names[k].Name, group[j].base.Name);
+ }
+ }
+ }
+ break;
+ // #endregion
+ // #region directoryName
+ case 2:
+ valueExists = true;
+ group_permitted = compare_directoryName(_this.certs[i].subject, group[j].base.Name);
+ break;
+ // #endregion
+ // #region uniformResourceIdentifier
+ case 3:
+ if(subject_alt_names.length > 0)
+ {
+ for(var k = 0; k < subject_alt_names.length; k++)
+ {
+ if(subject_alt_names[k].NameType === 6) // uniformResourceIdentifier
+ {
+ valueExists = true;
+ group_permitted = group_permitted || compare_uniformResourceIdentifier(subject_alt_names[k].Name, group[j].base.Name);
+ }
+ }
+ }
+ break;
+ // #endregion
+ // #region iPAddress
+ case 4:
+ if(subject_alt_names.length > 0)
+ {
+ for(var k = 0; k < subject_alt_names.length; k++)
+ {
+ if(subject_alt_names[k].NameType === 7) // iPAddress
+ {
+ valueExists = true;
+ group_permitted = group_permitted || compare_iPAddress(subject_alt_names[k].Name, group[j].base.Name);
+ }
+ }
+ }
+ break;
+ // #endregion
+ // #region default
+
+ default:
+ // #endregion
+ }
+
+ if(group_permitted)
+ break;
+ }
+
+ if((group_permitted === false) && (group.length > 0) && valueExists)
+ {
+ policy_result.result = false;
+ policy_result.result_code = 41;
+ policy_result.result_message = "Failed to meet \"permitted sub-trees\" name constraint";
+
+ return new Promise(function(resolve, reject)
+ {
+ reject(policy_result);
+ });
+ }
+ }
+ // #endregion
+ // #endregion
+
+ // #region Checking for "excluded sub-trees"
+ var excluded = false;
+
+ for(var j = 0; j < excluded_subtrees.length; j++)
+ {
+ switch(excluded_subtrees[j].base.NameType)
+ {
+ // #region rfc822Name
+ case 1:
+ if(subject_alt_names.length >= 0)
+ {
+ for(var k = 0; k < subject_alt_names.length; k++)
+ {
+ if(subject_alt_names[k].NameType === 1) // rfc822Name
+ excluded = excluded || compare_rfc822Name(subject_alt_names[k].Name, excluded_subtrees[j].base.Name);
+ }
+ }
+ else // Try to find out "emailAddress" inside "subject"
+ {
+ for(var k = 0; k < _this.subject.types_and_values.length; k++)
+ {
+ if((_this.subject.types_and_values[k].type === "1.2.840.113549.1.9.1") || // PKCS#9 e-mail address
+ (_this.subject.types_and_values[k].type === "0.9.2342.19200300.100.1.3")) // RFC1274 "rfc822Mailbox" e-mail address
+ {
+ excluded = excluded || compare_rfc822Name(_this.subject.types_and_values[k].value.value_block.value, excluded_subtrees[j].base.Name);
+ }
+ }
+ }
+ break;
+ // #endregion
+ // #region dNSName
+ case 2:
+ if(subject_alt_names.length > 0)
+ {
+ for(var k = 0; k < subject_alt_names.length; k++)
+ {
+ if(subject_alt_names[k].NameType === 2) // dNSName
+ excluded = excluded || compare_dNSName(subject_alt_names[k].Name, excluded_subtrees[j].base.Name);
+ }
+ }
+ break;
+ // #endregion
+ // #region directoryName
+ case 4:
+ excluded = excluded || compare_directoryName(_this.certs[i].subject, excluded_subtrees[j].base.Name);
+ break;
+ // #endregion
+ // #region uniformResourceIdentifier
+ case 6:
+ if(subject_alt_names.length > 0)
+ {
+ for(var k = 0; k < subject_alt_names.length; k++)
+ {
+ if(subject_alt_names[k].NameType === 6) // uniformResourceIdentifier
+ excluded = excluded || compare_uniformResourceIdentifier(subject_alt_names[k].Name, excluded_subtrees[j].base.Name);
+ }
+ }
+ break;
+ // #endregion
+ // #region iPAddress
+ case 7:
+ if(subject_alt_names.length > 0)
+ {
+ for(var k = 0; k < subject_alt_names.length; k++)
+ {
+ if(subject_alt_names[k].NameType === 7) // iPAddress
+ excluded = excluded || compare_iPAddress(subject_alt_names[k].Name, excluded_subtrees[j].base.Name);
+ }
+ }
+ break;
+ // #endregion
+ // #region default
+
+ default: // No action, but probably here we need to create a warning for "malformed constraint"
+ // #endregion
+ }
+
+ if(excluded)
+ break;
+ }
+
+ if(excluded === true)
+ {
+ policy_result.result = false;
+ policy_result.result_code = 42;
+ policy_result.result_message = "Failed to meet \"excluded sub-trees\" name constraint";
+
+ return new Promise(function(resolve, reject)
+ {
+ reject(policy_result);
+ });
+ }
+ // #endregion
+
+ // #region Append "cert_..._subtrees" to "..._subtrees"
+ permitted_subtrees = permitted_subtrees.concat(cert_permitted_subtrees);
+ excluded_subtrees = excluded_subtrees.concat(cert_excluded_subtrees);
+ // #endregion
+ }
+ // #endregion
+
+ return policy_result;
+ }
+ );
+ // #endregion
+
+ return sequence;
+ };
+ //**************************************************************************************
+ // #endregion
+ //**************************************************************************************
+}
+)(typeof exports !== "undefined" ? exports : window);
diff --git a/dom/webauthn/tests/test_webauthn_abort_signal.html b/dom/webauthn/tests/test_webauthn_abort_signal.html
new file mode 100644
index 0000000000..e7e898812d
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_abort_signal.html
@@ -0,0 +1,146 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Test for aborting W3C Web Authentication request</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+ <h1>Test for aborting W3C Web Authentication request</h1>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1415675">Mozilla Bug 1415675</a>
+
+ <script class="testbody" type="text/javascript">
+ "use strict";
+
+ function arrivingHereIsBad(aResult) {
+ ok(false, "Bad result! Received a: " + aResult);
+ }
+
+ function expectAbortError(aResult) {
+ is(aResult.code, DOMException.ABORT_ERR, "Expecting an AbortError");
+ }
+
+ add_task(() => {
+ // Enable USB tokens.
+ return SpecialPowers.pushPrefEnv({"set": [
+ ["security.webauth.webauthn_enable_softtoken", false],
+ ["security.webauth.webauthn_enable_usbtoken", true],
+ ]});
+ });
+
+ // Start a new MakeCredential() request.
+ function requestMakeCredential(signal) {
+ let publicKey = {
+ rp: {id: document.domain, name: "none", icon: "none"},
+ user: {id: new Uint8Array(), name: "none", icon: "none", displayName: "none"},
+ challenge: crypto.getRandomValues(new Uint8Array(16)),
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ pubKeyCredParams: [{type: "public-key", alg: cose_alg_ECDSA_w_SHA256}],
+ };
+
+ return navigator.credentials.create({publicKey, signal});
+ }
+
+ // Start a new GetAssertion() request.
+ async function requestGetAssertion(signal) {
+ let newCredential = {
+ type: "public-key",
+ id: crypto.getRandomValues(new Uint8Array(16)),
+ transports: ["usb"],
+ };
+
+ let publicKey = {
+ challenge: crypto.getRandomValues(new Uint8Array(16)),
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ rpId: document.domain,
+ allowCredentials: [newCredential]
+ };
+
+ // Start the request, handle failures only.
+ return navigator.credentials.get({publicKey, signal});
+ }
+
+ // Create an AbortController and abort immediately.
+ add_task(async function test_create_abortcontroller_and_abort() {
+ let ctrl = new AbortController();
+ ctrl.abort();
+
+ // The event shouldn't fire.
+ ctrl.signal.onabort = arrivingHereIsBad;
+
+ // MakeCredential() should abort immediately.
+ await requestMakeCredential(ctrl.signal)
+ .then(arrivingHereIsBad)
+ .catch(expectAbortError);
+
+ // GetAssertion() should abort immediately.
+ await requestGetAssertion(ctrl.signal)
+ .then(arrivingHereIsBad)
+ .catch(expectAbortError);
+ });
+
+ // Request a new credential and abort the request.
+ add_task(async function test_request_credential_and_abort() {
+ let aborted = false;
+ let ctrl = new AbortController();
+
+ ctrl.signal.onabort = () => {
+ ok(!aborted, "abort event fired once");
+ aborted = true;
+ };
+
+ // Request a new credential.
+ let request = requestMakeCredential(ctrl.signal)
+ .then(arrivingHereIsBad)
+ .catch(err => {
+ ok(aborted, "abort event was fired");
+ expectAbortError(err);
+ });
+
+ // Wait a tick for the statemachine to start.
+ await Promise.resolve();
+
+ // Abort the request.
+ ok(!aborted, "request still pending");
+ ctrl.abort();
+ ok(aborted, "request aborted");
+
+ // Wait for the request to terminate.
+ await request;
+ });
+
+ // Request a new assertion and abort the request.
+ add_task(async function test_request_assertion_and_abort() {
+ let aborted = false;
+ let ctrl = new AbortController();
+
+ ctrl.signal.onabort = () => {
+ ok(!aborted, "abort event fired once");
+ aborted = true;
+ };
+
+ // Request a new assertion.
+ let request = requestGetAssertion(ctrl.signal)
+ .then(arrivingHereIsBad)
+ .catch(err => {
+ ok(aborted, "abort event was fired");
+ expectAbortError(err);
+ });
+
+ // Wait a tick for the statemachine to start.
+ await Promise.resolve();
+
+ // Abort the request.
+ ok(!aborted, "request still pending");
+ ctrl.abort();
+ ok(aborted, "request aborted");
+
+ // Wait for the request to terminate.
+ await request;
+ });
+ </script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_attestation_conveyance.html b/dom/webauthn/tests/test_webauthn_attestation_conveyance.html
new file mode 100644
index 0000000000..f4a3c39349
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_attestation_conveyance.html
@@ -0,0 +1,123 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>W3C Web Authentication - Attestation Conveyance</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <script type="text/javascript" src="pkijs/common.js"></script>
+ <script type="text/javascript" src="pkijs/asn1.js"></script>
+ <script type="text/javascript" src="pkijs/x509_schema.js"></script>
+ <script type="text/javascript" src="pkijs/x509_simpl.js"></script>
+ <script type="text/javascript" src="cbor.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+ <h1>W3C Web Authentication - Attestation Conveyance</h1>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1428916">Mozilla Bug 1428916</a>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1416056">Mozilla Bug 1416056</a>
+
+ <script class="testbody" type="text/javascript">
+ "use strict";
+
+ add_task(() => {
+ return SpecialPowers.pushPrefEnv({"set": [
+ ["security.webauth.webauthn_testing_allow_direct_attestation", true],
+ ]});
+ });
+
+ function getAttestationCertFromAttestationBuffer(aAttestationBuffer) {
+ return webAuthnDecodeCBORAttestation(aAttestationBuffer)
+ .then((aAttestationObj) => {
+ is(aAttestationObj.fmt, "fido-u2f", "Is a FIDO U2F Attestation");
+ let attestationCertDER = aAttestationObj.attStmt.x5c[0];
+ let certDERBuffer = attestationCertDER.slice(0, attestationCertDER.byteLength).buffer;
+ let certAsn1 = org.pkijs.fromBER(certDERBuffer);
+ return new org.pkijs.simpl.CERT({ schema: certAsn1.result });
+ });
+ }
+
+ function verifyAnonymizedCertificate(aResult) {
+ return webAuthnDecodeCBORAttestation(aResult.response.attestationObject)
+ .then(({fmt, attStmt}) => {
+ is(fmt, "none", "Is a None Attestation");
+ is(typeof(attStmt), "object", "attStmt is a map");
+ is(Object.keys(attStmt).length, 0, "attStmt is empty");
+ });
+ }
+
+ function verifyDirectCertificate(aResult) {
+ return getAttestationCertFromAttestationBuffer(aResult.response.attestationObject)
+ .then((attestationCert) => {
+ let subject = attestationCert.subject.types_and_values[0].value.value_block.value;
+ is(subject, "Firefox U2F Soft Token", "Subject name matches the direct Soft Token")
+ });
+ }
+
+ function arrivingHereIsBad(aResult) {
+ ok(false, "Bad result! Received a: " + aResult);
+ }
+
+ function expectTypeError(aResult) {
+ ok(aResult.toString().startsWith("TypeError"), "Expecting a TypeError, got " + aResult);
+ }
+
+ // Start a new MakeCredential() request.
+ function requestMakeCredential(attestation) {
+ let publicKey = {
+ rp: {id: document.domain, name: "none", icon: "none"},
+ user: {id: new Uint8Array(), name: "none", icon: "none", displayName: "none"},
+ challenge: crypto.getRandomValues(new Uint8Array(16)),
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ pubKeyCredParams: [{type: "public-key", alg: cose_alg_ECDSA_w_SHA256}],
+ attestation,
+ };
+
+ return navigator.credentials.create({publicKey});
+ }
+
+ // Test success cases for make credential.
+ add_task(async function test_make_credential_success () {
+ // No selection criteria should be equal to none, which means anonymized
+ await requestMakeCredential()
+ .then(verifyAnonymizedCertificate)
+ .catch(arrivingHereIsBad);
+
+ // Request an unknown attestation type. This should be treated as "none".
+ await requestMakeCredential("unknown")
+ .then(verifyAnonymizedCertificate)
+ .catch(arrivingHereIsBad);
+
+ // Request no attestation.
+ await requestMakeCredential("none")
+ .then(verifyAnonymizedCertificate)
+ .catch(arrivingHereIsBad);
+
+ // Request indirect attestation, which is the same as direct.
+ await requestMakeCredential("indirect")
+ .then((x) => {
+ if (AppConstants.platform === "android") {
+ // If this is Android, the result will be anonymized (Bug 1551229)
+ return verifyAnonymizedCertificate(x);
+ } else {
+ return verifyDirectCertificate(x);
+ }
+ })
+ .catch(arrivingHereIsBad);
+
+ // Request direct attestation, which will prompt for user intervention.
+ await requestMakeCredential("direct")
+ .then((x) => {
+ if (AppConstants.platform === "android") {
+ // If this is Android, the result will be anonymized (Bug 1551229)
+ return verifyAnonymizedCertificate(x);
+ } else {
+ return verifyDirectCertificate(x);
+ }
+ })
+ .catch(arrivingHereIsBad);
+ });
+ </script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_authenticator_selection.html b/dom/webauthn/tests/test_webauthn_authenticator_selection.html
new file mode 100644
index 0000000000..6ddde1e91f
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_authenticator_selection.html
@@ -0,0 +1,146 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>W3C Web Authentication - Authenticator Selection Criteria</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+ <h1>W3C Web Authentication - Authenticator Selection Criteria</h1>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1406462">Mozilla Bug 1406462</a>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1406467">Mozilla Bug 1406467</a>
+
+ <script class="testbody" type="text/javascript">
+ "use strict";
+
+ function arrivingHereIsGood(aResult) {
+ ok(true, "Good result! Received a: " + aResult);
+ }
+
+ function arrivingHereIsBad(aResult) {
+ ok(false, "Bad result! Received a: " + aResult);
+ }
+
+ function expectNotAllowedError(aResult) {
+ ok(aResult.toString().startsWith("NotAllowedError"), "Expecting a NotAllowedError, got " + aResult);
+ }
+
+ // We store the credential of the first successful make credential
+ // operation so we can use it for get assertion tests later.
+ let gCredential;
+
+ // Start a new MakeCredential() request.
+ function requestMakeCredential(authenticatorSelection) {
+ let publicKey = {
+ rp: {id: document.domain, name: "none", icon: "none"},
+ user: {id: new Uint8Array(), name: "none", icon: "none", displayName: "none"},
+ challenge: crypto.getRandomValues(new Uint8Array(16)),
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ pubKeyCredParams: [{type: "public-key", alg: cose_alg_ECDSA_w_SHA256}],
+ authenticatorSelection,
+ };
+
+ return navigator.credentials.create({publicKey});
+ }
+
+ // Start a new GetAssertion() request.
+ function requestGetAssertion(userVerification) {
+ let newCredential = {
+ type: "public-key",
+ id: gCredential,
+ transports: ["usb"],
+ };
+
+ let publicKey = {
+ challenge: crypto.getRandomValues(new Uint8Array(16)),
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ rpId: document.domain,
+ allowCredentials: [newCredential]
+ };
+
+ if (userVerification) {
+ publicKey.userVerification = userVerification;
+ }
+
+ return navigator.credentials.get({publicKey});
+ }
+
+ // Test success cases for make credential.
+ add_task(async function test_make_credential_successes() {
+ // No selection criteria.
+ await requestMakeCredential({})
+ // Save the credential so we can use it for sign success tests.
+ .then(res => gCredential = res.rawId)
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+
+ // Request a cross-platform authenticator.
+ await requestMakeCredential({authenticatorAttachment: "cross-platform"})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+
+ // Don't require a resident key.
+ await requestMakeCredential({requireResidentKey: false})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+
+ // Prefer user verification.
+ await requestMakeCredential({userVerification: "preferred"})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+
+ // Discourage user verification.
+ await requestMakeCredential({userVerification: "discouraged"})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ });
+
+ // Test success cases for get assertion.
+ add_task(async function test_get_assertion_successes() {
+ // No selection criteria.
+ await requestGetAssertion()
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+
+ // Prefer user verification.
+ await requestGetAssertion("preferred")
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+
+ // Discourage user verification.
+ await requestGetAssertion("discouraged")
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ });
+
+ // Test failure cases for make credential.
+ add_task(async function test_make_credential_failures() {
+ // Request a platform authenticator.
+ await requestMakeCredential({authenticatorAttachment: "platform"})
+ .then(arrivingHereIsBad)
+ .catch(expectNotAllowedError);
+
+ // Require a resident key.
+ await requestMakeCredential({requireResidentKey: true})
+ .then(arrivingHereIsBad)
+ .catch(expectNotAllowedError);
+
+ // Require user verification.
+ await requestMakeCredential({userVerification: "required"})
+ .then(arrivingHereIsBad)
+ .catch(expectNotAllowedError);
+ });
+
+ // Test failure cases for get assertion.
+ add_task(async function test_get_assertion_failures() {
+ // Require user verification.
+ await requestGetAssertion("required")
+ .then(arrivingHereIsBad)
+ .catch(expectNotAllowedError);
+ });
+ </script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_authenticator_transports.html b/dom/webauthn/tests/test_webauthn_authenticator_transports.html
new file mode 100644
index 0000000000..b1b855126e
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_authenticator_transports.html
@@ -0,0 +1,150 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>W3C Web Authentication - Authenticator Transports</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+ <h1>W3C Web Authentication - Authenticator Transports</h1>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1406467">Mozilla Bug 1406467</a>
+
+ <script class="testbody" type="text/javascript">
+ "use strict";
+
+ function arrivingHereIsGood(aResult) {
+ ok(true, "Good result! Received a: " + aResult);
+ }
+
+ function arrivingHereIsBad(aResult) {
+ ok(false, "Bad result! Received a: " + aResult);
+ }
+
+ function expectNotAllowedError(aResult) {
+ ok(aResult.toString().startsWith("NotAllowedError"), "Expecting a NotAllowedError, got " + aResult);
+ }
+
+ function expectInvalidStateError(aResult) {
+ ok(aResult.toString().startsWith("InvalidStateError"), "Expecting a InvalidStateError, got " + aResult);
+ }
+
+ // Store the credential of the first successful make credential
+ // operation so we can use it to get assertions later.
+ let gCredential;
+
+ // Start a new MakeCredential() request.
+ function requestMakeCredential(excludeCredentials) {
+ let publicKey = {
+ rp: {id: document.domain, name: "none", icon: "none"},
+ user: {id: new Uint8Array(), name: "none", icon: "none", displayName: "none"},
+ challenge: crypto.getRandomValues(new Uint8Array(16)),
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ pubKeyCredParams: [{type: "public-key", alg: cose_alg_ECDSA_w_SHA256}],
+ excludeCredentials
+ };
+
+ return navigator.credentials.create({publicKey});
+ }
+
+ // Start a new GetAssertion() request.
+ function requestGetAssertion(allowCredentials) {
+ let publicKey = {
+ challenge: crypto.getRandomValues(new Uint8Array(16)),
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ rpId: document.domain,
+ allowCredentials
+ };
+
+ return navigator.credentials.get({publicKey});
+ }
+
+ // Test make credential behavior.
+ add_task(async function test_make_credential() {
+ // Make a credential.
+ await requestMakeCredential([])
+ // Save the credential for later.
+ .then(res => gCredential = res.rawId)
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+
+ // Pass a random credential to exclude.
+ await requestMakeCredential([{
+ type: "public-key",
+ id: crypto.getRandomValues(new Uint8Array(16)),
+ transports: ["usb"],
+ }]).then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+
+ // Pass gCredential with transport=usb.
+ // The credential already exists, and the softoken consents to create,
+ // so the error is InvalidState and not NotAllowed.
+ await requestMakeCredential([{
+ type: "public-key",
+ id: gCredential,
+ transports: ["usb"],
+ }]).then(arrivingHereIsBad)
+ .catch(expectInvalidStateError);
+
+ // Pass gCredential with transport=nfc.
+ // The softoken pretends to support all transports.
+ // Also, as above, the credential exists and the token indicates consent.
+ await requestMakeCredential([{
+ type: "public-key",
+ id: gCredential,
+ transports: ["nfc"],
+ }]).then(arrivingHereIsBad)
+ .catch(expectInvalidStateError);
+
+ // Pass gCredential with an empty transports list.
+ // As above, the token indicates consent, so expect InvalidStateError.
+ await requestMakeCredential([{
+ type: "public-key",
+ id: gCredential,
+ transports: [],
+ }]).then(arrivingHereIsBad)
+ .catch(expectInvalidStateError);
+ });
+
+ // Test get assertion behavior.
+ add_task(async function test_get_assertion() {
+ // Request an assertion for gCredential.
+ await requestGetAssertion([{
+ type: "public-key",
+ id: gCredential,
+ transports: ["usb"],
+ }]).then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+
+ // Request an assertion for a random credential. The token indicates
+ // consent even though this credential doesn't exist, so expect an
+ // InvalidStateError.
+ await requestGetAssertion([{
+ type: "public-key",
+ id: crypto.getRandomValues(new Uint8Array(16)),
+ transports: ["usb"],
+ }]).then(arrivingHereIsBad)
+ .catch(expectInvalidStateError);
+
+ // Request an assertion for gCredential with transport=nfc.
+ // The softoken pretends to support all transports.
+ await requestGetAssertion([{
+ type: "public-key",
+ id: gCredential,
+ transports: ["nfc"],
+ }]).then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+
+ // Request an assertion for gCredential with an empty transports list.
+ await requestGetAssertion([{
+ type: "public-key",
+ id: gCredential,
+ transports: [],
+ }]).then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ });
+ </script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_get_assertion.html b/dom/webauthn/tests/test_webauthn_get_assertion.html
new file mode 100644
index 0000000000..7d51ce2c4b
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_get_assertion.html
@@ -0,0 +1,253 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Tests for GetAssertion for W3C Web Authentication</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <script type="text/javascript" src="pkijs/common.js"></script>
+ <script type="text/javascript" src="pkijs/asn1.js"></script>
+ <script type="text/javascript" src="pkijs/x509_schema.js"></script>
+ <script type="text/javascript" src="pkijs/x509_simpl.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+ <h1>Tests for GetAssertion for W3C Web Authentication</h1>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1309284">Mozilla Bug 1309284</a>
+
+ <script class="testbody" type="text/javascript">
+ "use strict";
+
+ is(navigator.authentication, undefined, "navigator.authentication does not exist any longer");
+ isnot(navigator.credentials, undefined, "Credential Management API endpoint must exist");
+ isnot(navigator.credentials.create, undefined, "CredentialManagement create API endpoint must exist");
+ isnot(navigator.credentials.get, undefined, "CredentialManagement get API endpoint must exist");
+
+ let gAssertionChallenge = new Uint8Array(16);
+ window.crypto.getRandomValues(gAssertionChallenge);
+
+ let unknownCredType = {type: "Magic", id: base64ToBytes("AAA=")};
+ let unknownCred = {type: "public-key", id: base64ToBytes("AAA=")};
+ let validCred = null;
+
+ add_task(test_setup_valid_credential);
+ add_task(test_without_credential);
+ add_task(test_with_credential);
+ add_task(test_unexpected_option);
+ add_task(test_unexpected_option_with_credential);
+ add_task(test_unexpected_transport);
+ add_task(test_unknown_credential_type);
+ add_task(test_unknown_credential);
+ add_task(test_too_many_credentials);
+ add_task(test_unexpected_option_unknown_credential_type);
+ add_task(test_empty_credential_list);
+ add_task(() => {
+ // Enable USB tokens.
+ return SpecialPowers.pushPrefEnv({"set": [
+ ["security.webauth.webauthn_enable_softtoken", false],
+ ["security.webauth.webauthn_enable_usbtoken", true],
+ ]});
+ });
+ add_task(test_usb_empty_credential_list);
+
+ function requestGetAssertion(params) {
+ return navigator.credentials.get(params);
+ }
+
+ function arrivingHereIsGood(aResult) {
+ ok(true, "Good result! Received a: " + aResult);
+ }
+
+ function arrivingHereIsBad(aResult) {
+ ok(false, "Bad result! Received a: " + aResult);
+ }
+
+ function expectNotAllowedError(aResult) {
+ ok(aResult.toString().startsWith("NotAllowedError"), "Expecting a NotAllowedError, got " + aResult);
+ }
+
+ function expectInvalidStateError(aResult) {
+ ok(aResult.toString().startsWith("InvalidStateError"), "Expecting a InvalidStateError, got " + aResult);
+ }
+
+ function expectTypeError(aResult) {
+ ok(aResult.toString().startsWith("TypeError"), "Expecting a TypeError, got " + aResult);
+ }
+
+ function expectSecurityError(aResult) {
+ ok(aResult.toString().startsWith("SecurityError"), "Expecting a SecurityError, got " + aResult);
+ }
+
+ function expectAbortError(aResult) {
+ is(aResult.code, DOMException.ABORT_ERR, "Expecting an AbortError");
+ }
+
+ // Set up a valid credential
+ async function test_setup_valid_credential() {
+ let publicKey = {
+ rp: {id: document.domain, name: "none", icon: "none"},
+ user: {id: new Uint8Array(), name: "none", icon: "none", displayName: "none"},
+ challenge: crypto.getRandomValues(new Uint8Array(16)),
+ pubKeyCredParams: [{type: "public-key", alg: cose_alg_ECDSA_w_SHA256}],
+ };
+
+ return navigator.credentials.create({publicKey})
+ .then(res => validCred = {type: "public-key", id: res.rawId} );
+ }
+
+ // Test basic good call, but without giving a credential so expect failures
+ // this is OK by the standard, but not supported by U2F-backed authenticators
+ // like the soft token in use here.
+ async function test_without_credential() {
+ let publicKey = {
+ challenge: gAssertionChallenge
+ };
+
+ await requestGetAssertion({publicKey})
+ .then(arrivingHereIsBad)
+ .catch(expectInvalidStateError);
+ }
+
+ // Test with a valid credential
+ async function test_with_credential() {
+ let publicKey = {
+ challenge: gAssertionChallenge,
+ allowCredentials: [validCred]
+ };
+
+ await requestGetAssertion({publicKey})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+
+ // Test with an unexpected option. That won't stop anything, and we'll
+ // fail with InvalidState just as if we had no valid credentials -- which
+ // we don't.
+ async function test_unexpected_option() {
+ let publicKey = {
+ challenge: gAssertionChallenge,
+ unknownValue: "hi"
+ };
+
+ await requestGetAssertion({publicKey})
+ .then(arrivingHereIsBad)
+ .catch(expectInvalidStateError);
+ }
+
+ // Test with an unexpected option but a valid credential
+ async function test_unexpected_option_with_credential() {
+ let publicKey = {
+ challenge: gAssertionChallenge,
+ unknownValue: "hi",
+ allowCredentials: [validCred]
+ };
+
+ await requestGetAssertion({publicKey})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+
+ // Test with an unexpected transport on a valid credential
+ async function test_unexpected_transport() {
+ let cred = validCred;
+ cred.transports = ["unknown", "usb"];
+
+ let publicKey = {
+ challenge: gAssertionChallenge,
+ unknownValue: "hi",
+ allowCredentials: [cred]
+ };
+
+ await requestGetAssertion({publicKey})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+
+ // Test with an unknown credential type
+ async function test_unknown_credential_type() {
+ let publicKey = {
+ challenge: gAssertionChallenge,
+ allowCredentials: [unknownCredType]
+ };
+
+ await requestGetAssertion({publicKey})
+ .then(arrivingHereIsBad)
+ .catch(expectInvalidStateError);
+ }
+
+ // Test with an unknown credential
+ async function test_unknown_credential() {
+ let publicKey = {
+ challenge: gAssertionChallenge,
+ allowCredentials: [unknownCred]
+ };
+
+ await requestGetAssertion({publicKey})
+ .then(arrivingHereIsBad)
+ .catch(expectInvalidStateError);
+ }
+
+ // Test with too many credentials
+ async function test_too_many_credentials() {
+ let tooManyCredentials = Array(21).fill(validCred);
+ let publicKey = {
+ challenge: gAssertionChallenge,
+ allowCredentials: tooManyCredentials,
+ };
+
+ await requestGetAssertion({publicKey})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+
+ // Test with an unexpected option and an unknown credential type
+ async function test_unexpected_option_unknown_credential_type() {
+ let publicKey = {
+ challenge: gAssertionChallenge,
+ unknownValue: "hi",
+ allowCredentials: [unknownCredType]
+ };
+
+ await requestGetAssertion({publicKey})
+ .then(arrivingHereIsBad)
+ .catch(expectInvalidStateError);
+ }
+
+ // Test with an empty credential list
+ // This will return InvalidStateError since the softotken consents, but
+ // there are no valid credentials.
+ async function test_empty_credential_list() {
+ let publicKey = {
+ challenge: gAssertionChallenge,
+ allowCredentials: []
+ };
+
+ await requestGetAssertion({publicKey})
+ .then(arrivingHereIsBad)
+ .catch(expectInvalidStateError);
+ }
+
+ // Test with an empty credential list
+ async function test_usb_empty_credential_list() {
+ let publicKey = {
+ challenge: gAssertionChallenge,
+ allowCredentials: []
+ };
+
+ let ctrl = new AbortController();
+ let request = requestGetAssertion({publicKey, signal: ctrl.signal})
+ .then(arrivingHereIsBad)
+ .catch(expectAbortError);
+
+ // Wait a tick for the statemachine to start.
+ await Promise.resolve();
+
+ // The request should time out. We'll abort it here and will fail or
+ // succeed upon resolution, when the error code is checked.
+ ctrl.abort();
+ await request;
+ }
+ </script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_get_assertion_dead_object.html b/dom/webauthn/tests/test_webauthn_get_assertion_dead_object.html
new file mode 100644
index 0000000000..3cd9ca1365
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_get_assertion_dead_object.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Test for GetAssertion on dead object</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+ <h1>Test for GetAssertion on dead object</h1>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1483905">Mozilla Bug 1483905</a>
+
+ <script class="testbody" type="text/javascript">
+ "use strict";
+ SimpleTest.waitForExplicitFinish();
+ SimpleTest.requestFlakyTimeout(
+ "Due to the nature of this test, there's no way for the window we're opening to signal " +
+ "that it's done (the `document.writeln('')` is essential and basically clears any state " +
+ "we could use). So, we have to wait at least 15 seconds for the webauthn call to time out.");
+ let win = window.open("https://example.com/tests/dom/webauthn/tests/get_assertion_dead_object.html");
+ setTimeout(() => {
+ win.close();
+ SimpleTest.finish();
+ }, 20000);
+ </script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_isexternalctap2securitykeysupported.html b/dom/webauthn/tests/test_webauthn_isexternalctap2securitykeysupported.html
new file mode 100644
index 0000000000..33f367dc19
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_isexternalctap2securitykeysupported.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Test for W3C Web Authentication isExternalCTAP2SecurityKeySupported</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <script type="text/javascript" src="pkijs/common.js"></script>
+ <script type="text/javascript" src="pkijs/asn1.js"></script>
+ <script type="text/javascript" src="pkijs/x509_schema.js"></script>
+ <script type="text/javascript" src="pkijs/x509_simpl.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+<h1>Test for W3C Web Authentication isExternalCTAP2SecurityKeySupported</h1>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1526023">Mozilla Bug 1526023</a>
+
+<script class="testbody" type="text/javascript">
+"use strict";
+
+// Execute the full-scope test
+SimpleTest.waitForExplicitFinish();
+
+add_task(async function test_external_key_support() {
+ PublicKeyCredential.isExternalCTAP2SecurityKeySupported()
+ .then(aResult => ok(true, `Should always return either true or false: ${aResult}`))
+ .catch(aProblem => ok(false, `We shouldn't get here: ${aProblem}`))
+});
+
+</script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_isplatformauthenticatoravailable.html b/dom/webauthn/tests/test_webauthn_isplatformauthenticatoravailable.html
new file mode 100644
index 0000000000..c3910cd96d
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_isplatformauthenticatoravailable.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Test for W3C Web Authentication isUserVerifyingPlatformAuthenticatorAvailable</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <script type="text/javascript" src="pkijs/common.js"></script>
+ <script type="text/javascript" src="pkijs/asn1.js"></script>
+ <script type="text/javascript" src="pkijs/x509_schema.js"></script>
+ <script type="text/javascript" src="pkijs/x509_simpl.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+<h1>Test for W3C Web Authentication isUserVerifyingPlatformAuthenticatorAvailable</h1>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1309284">Mozilla Bug 1309284</a>
+
+<script class="testbody" type="text/javascript">
+"use strict";
+
+// Execute the full-scope test
+SimpleTest.waitForExplicitFinish();
+
+add_task(async function test_is_platform_available() {
+ // This test ensures that isUserVerifyingPlatformAuthenticatorAvailable()
+ // is a callable method, but with the softtoken enabled, it's not useful to
+ // figure out what it actually returns, so we'll just make sure it runs.
+ await PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable()
+ .then(function(aResult) {
+ ok(true, "Resolved: " + aResult);
+ })
+ .catch(function(aProblem) {
+ ok(false, "Problem encountered: " + aProblem);
+ });
+});
+
+</script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_loopback.html b/dom/webauthn/tests/test_webauthn_loopback.html
new file mode 100644
index 0000000000..5eb5df5c8c
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_loopback.html
@@ -0,0 +1,213 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Full-run test for MakeCredential/GetAssertion for W3C Web Authentication</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <script type="text/javascript" src="pkijs/common.js"></script>
+ <script type="text/javascript" src="pkijs/asn1.js"></script>
+ <script type="text/javascript" src="pkijs/x509_schema.js"></script>
+ <script type="text/javascript" src="pkijs/x509_simpl.js"></script>
+ <script type="text/javascript" src="cbor.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+<h1>Full-run test for MakeCredential/GetAssertion for W3C Web Authentication</h1>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1309284">Mozilla Bug 1309284</a>
+
+<script class="testbody" type="text/javascript">
+"use strict";
+
+// Execute the full-scope test
+SimpleTest.waitForExplicitFinish();
+
+SpecialPowers.pushPrefEnv({"set": [["security.webauth.webauthn_testing_allow_direct_attestation", true]]},
+function() {
+is(navigator.authentication, undefined, "navigator.authentication does not exist any longer");
+isnot(navigator.credentials, undefined, "Credential Management API endpoint must exist");
+isnot(navigator.credentials.create, undefined, "CredentialManagement create API endpoint must exist");
+isnot(navigator.credentials.get, undefined, "CredentialManagement get API endpoint must exist");
+
+ let credm = navigator.credentials;
+
+ let gCredentialChallenge = new Uint8Array(16);
+ window.crypto.getRandomValues(gCredentialChallenge);
+ let gAssertionChallenge = new Uint8Array(16);
+ window.crypto.getRandomValues(gAssertionChallenge);
+
+ testMakeCredential();
+
+ function decodeCreatedCredential(aCredInfo) {
+ /* PublicKeyCredential : Credential
+ - rawId: Key Handle buffer pulled from U2F Register() Response
+ - id: Key Handle buffer in base64url form, should == rawId
+ - type: Literal 'public-key'
+ - response : AuthenticatorAttestationResponse : AuthenticatorResponse
+ - attestationObject: CBOR object
+ - clientDataJSON: serialized JSON
+ */
+
+ is(aCredInfo.type, "public-key", "Credential type must be public-key")
+
+ ok(aCredInfo.rawId.byteLength > 0, "Key ID exists");
+ is(aCredInfo.id, bytesToBase64UrlSafe(aCredInfo.rawId), "Encoded Key ID and Raw Key ID match");
+
+ ok(aCredInfo.rawId === aCredInfo.rawId, "PublicKeyCredential.RawID is SameObject");
+ ok(aCredInfo.response === aCredInfo.response, "PublicKeyCredential.Response is SameObject");
+ ok(aCredInfo.response.clientDataJSON === aCredInfo.response.clientDataJSON, "PublicKeyCredential.Response.ClientDataJSON is SameObject");
+ ok(aCredInfo.response.attestationObject === aCredInfo.response.attestationObject, "PublicKeyCredential.Response.AttestationObject is SameObject");
+
+ let clientData = JSON.parse(buffer2string(aCredInfo.response.clientDataJSON));
+ is(clientData.challenge, bytesToBase64UrlSafe(gCredentialChallenge), "Challenge is correct");
+ is(clientData.origin, window.location.origin, "Origin is correct");
+ is(clientData.type, "webauthn.create", "Type is correct");
+
+ return webAuthnDecodeCBORAttestation(aCredInfo.response.attestationObject)
+ .then(function(aAttestationObj) {
+ // Make sure the RP ID hash matches what we calculate.
+ return crypto.subtle.digest("SHA-256", string2buffer(document.domain))
+ .then(function(calculatedRpIdHash) {
+ let calcHashStr = bytesToBase64UrlSafe(new Uint8Array(calculatedRpIdHash));
+ let providedHashStr = bytesToBase64UrlSafe(new Uint8Array(aAttestationObj.authDataObj.rpIdHash));
+
+ is(calcHashStr, providedHashStr,
+ "Calculated RP ID hash must match what the browser derived.");
+ return Promise.resolve(aAttestationObj);
+ });
+ })
+ .then(function(aAttestationObj) {
+ ok(aAttestationObj.authDataObj.flags == (flag_TUP | flag_AT),
+ "User presence and Attestation Object must be the only flags set");
+
+ aCredInfo.clientDataObj = clientData;
+ aCredInfo.publicKeyHandle = aAttestationObj.authDataObj.publicKeyHandle;
+ aCredInfo.attestationObject = aAttestationObj.authDataObj.attestationAuthData;
+ return aCredInfo;
+ });
+}
+
+ function checkAssertionAndSigValid(aPublicKey, aAssertion) {
+ /* PublicKeyCredential : Credential
+ - rawId: ID of Credential from AllowList that succeeded
+ - id: Key Handle buffer in base64url form, should == rawId
+ - type: Literal 'public-key'
+ - response : AuthenticatorAssertionResponse : AuthenticatorResponse
+ - clientDataJSON: serialized JSON
+ - authenticatorData: RP ID Hash || U2F Sign() Response
+ - signature: U2F Sign() Response
+ */
+
+ is(aAssertion.type, "public-key", "Credential type must be public-key")
+
+ ok(aAssertion.rawId.byteLength > 0, "Key ID exists");
+ is(aAssertion.id, bytesToBase64UrlSafe(new Uint8Array(aAssertion.rawId)), "Encoded Key ID and Raw Key ID match");
+
+ ok(aAssertion.response.authenticatorData === aAssertion.response.authenticatorData, "AuthenticatorAssertionResponse.AuthenticatorData is SameObject");
+ ok(aAssertion.response.authenticatorData instanceof ArrayBuffer, "AuthenticatorAssertionResponse.AuthenticatorData is an ArrayBuffer");
+ ok(aAssertion.response.signature === aAssertion.response.signature, "AuthenticatorAssertionResponse.Signature is SameObject");
+ ok(aAssertion.response.signature instanceof ArrayBuffer, "AuthenticatorAssertionResponse.Signature is an ArrayBuffer");
+ ok(aAssertion.response.userHandle === null, "AuthenticatorAssertionResponse.UserHandle is null for u2f authenticators");
+
+ ok(aAssertion.response.authenticatorData.byteLength > 0, "Authenticator data exists");
+ let clientData = JSON.parse(buffer2string(aAssertion.response.clientDataJSON));
+ is(clientData.challenge, bytesToBase64UrlSafe(gAssertionChallenge), "Challenge is correct");
+ is(clientData.origin, window.location.origin, "Origin is correct");
+ is(clientData.type, "webauthn.get", "Type is correct");
+
+ return webAuthnDecodeAuthDataArray(aAssertion.response.authenticatorData)
+ .then(function(aAttestation) {
+ ok(new Uint8Array(aAttestation.flags) == flag_TUP, "User presence must be the only flag set");
+ is(aAttestation.counter.byteLength, 4, "Counter must be 4 bytes");
+ return deriveAppAndChallengeParam(window.location.host, aAssertion.response.clientDataJSON, aAttestation)
+ })
+ .then(function(aParams) {
+ console.log(aParams);
+ console.log("ClientData buffer: ", hexEncode(aAssertion.response.clientDataJSON));
+ console.log("ClientDataHash: ", hexEncode(aParams.challengeParam));
+ return assembleSignedData(aParams.appParam, aParams.attestation.flags,
+ aParams.attestation.counter, aParams.challengeParam);
+ })
+ .then(function(aSignedData) {
+ console.log(aPublicKey, aSignedData, aAssertion.response.signature);
+ return verifySignature(aPublicKey, aSignedData, aAssertion.response.signature);
+ })
+}
+
+ function testMakeCredential() {
+ let rp = {id: document.domain, name: "none", icon: "none"};
+ let user = {id: new Uint8Array(), name: "none", icon: "none", displayName: "none"};
+ let param = {type: "public-key", alg: cose_alg_ECDSA_w_SHA256};
+ let makeCredentialOptions = {
+ rp,
+ user,
+ challenge: gCredentialChallenge,
+ pubKeyCredParams: [param],
+ attestation: "direct"
+ };
+ credm.create({publicKey: makeCredentialOptions})
+ .then(decodeCreatedCredential)
+ .then(testMakeDuplicate)
+ .catch(function(aReason) {
+ ok(false, aReason);
+ SimpleTest.finish();
+ });
+}
+
+ function testMakeDuplicate(aCredInfo) {
+ let rp = {id: document.domain, name: "none", icon: "none"};
+ let user = {id: new Uint8Array(), name: "none", icon: "none", displayName: "none"};
+ let param = {type: "public-key", alg: cose_alg_ECDSA_w_SHA256};
+ let makeCredentialOptions = {
+ rp,
+ user,
+ challenge: gCredentialChallenge,
+ pubKeyCredParams: [param],
+ excludeCredentials: [{type: "public-key", id: new Uint8Array(aCredInfo.rawId),
+ transports: ["usb"]}]
+ };
+ credm.create({publicKey: makeCredentialOptions})
+ .then(function() {
+ // We should have errored here!
+ ok(false, "The excludeList didn't stop a duplicate being created!");
+ SimpleTest.finish();
+ })
+ .catch(function(aReason) {
+ ok(aReason.toString().startsWith("InvalidStateError"), "Expect InvalidStateError, got " + aReason);
+ testAssertion(aCredInfo);
+ });
+}
+
+ function testAssertion(aCredInfo) {
+ let newCredential = {
+ type: "public-key",
+ id: new Uint8Array(aCredInfo.rawId),
+ transports: ["usb"],
+ }
+
+ let publicKeyCredentialRequestOptions = {
+ challenge: gAssertionChallenge,
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ rpId: document.domain,
+ allowCredentials: [newCredential]
+ };
+ credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(function(aAssertion) {
+ /* Pass along the pubKey. */
+ return checkAssertionAndSigValid(aCredInfo.publicKeyHandle, aAssertion);
+ })
+ .then(function(aSigVerifyResult) {
+ ok(aSigVerifyResult, "Signing signature verified");
+ SimpleTest.finish();
+ })
+ .catch(function(reason) {
+ ok(false, "Signing signature invalid: " + reason);
+ SimpleTest.finish();
+ });
+}
+});
+
+</script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_make_credential.html b/dom/webauthn/tests/test_webauthn_make_credential.html
new file mode 100644
index 0000000000..b6819acaff
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_make_credential.html
@@ -0,0 +1,413 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Test for MakeCredential for W3C Web Authentication</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <script type="text/javascript" src="pkijs/common.js"></script>
+ <script type="text/javascript" src="pkijs/asn1.js"></script>
+ <script type="text/javascript" src="pkijs/x509_schema.js"></script>
+ <script type="text/javascript" src="pkijs/x509_simpl.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+ <h1>Test for MakeCredential for W3C Web Authentication</h1>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1309284">Mozilla Bug 1309284</a>
+
+ <script class="testbody" type="text/javascript">
+ "use strict";
+
+ is(navigator.authentication, undefined, "navigator.authentication does not exist any longer");
+ isnot(navigator.credentials, undefined, "Credential Management API endpoint must exist");
+ isnot(navigator.credentials.create, undefined, "CredentialManagement create API endpoint must exist");
+ isnot(navigator.credentials.get, undefined, "CredentialManagement get API endpoint must exist");
+
+ let credm;
+ let gCredentialChallenge;
+ let rp;
+ let user;
+ let param;
+ let unsupportedParam;
+ let unknownParam;
+
+ // Setup test env
+ add_task(() => {
+ gCredentialChallenge = new Uint8Array(16);
+ window.crypto.getRandomValues(gCredentialChallenge);
+
+ rp = {id: document.domain, name: "none", icon: "none"};
+ user = {id: new Uint8Array(64), name: "none", icon: "none", displayName: "none"};
+ param = {type: "public-key", alg: cose_alg_ECDSA_w_SHA256};
+ unsupportedParam = {type: "public-key", alg: cose_alg_ECDSA_w_SHA512};
+ unknownParam = {type: "SimplePassword", alg: "MaxLength=2"};
+ credm = navigator.credentials;
+ });
+ // Add tests
+ add_task(test_good_call);
+ add_task(test_empty_account);
+ add_task(test_without_rp_name);
+ add_task(test_without_user_id);
+ add_task(test_without_user_name);
+ add_task(test_without_user_displayname);
+ add_task(test_user_too_large);
+ add_task(test_empty_parameters);
+ add_task(test_without_parameters);
+ add_task(test_unsupported_parameter);
+ add_task(test_unsupported_but_one_param);
+ add_task(test_one_unknown_parameter);
+ add_task(test_one_unknown_one_unsupported_param);
+ add_task(test_one_of_each_parameters);
+ add_task(test_without_challenge);
+ add_task(test_invalid_challenge);
+ add_task(test_duplicate_pub_key);
+ add_task(test_invalid_rp_id);
+ add_task(test_invalid_rp_id_2);
+ add_task(test_missing_rp);
+ add_task(test_incorrect_user_id_type);
+ add_task(test_missing_user);
+ add_task(test_complete_account);
+ add_task(test_too_large_user_id);
+ add_task(test_excluding_unknown_transports);
+ add_task(test_unknown_attestation_type);
+ add_task(test_unknown_selection_criteria);
+
+ function arrivingHereIsGood(aResult) {
+ ok(true, "Good result! Received a: " + aResult);
+ return Promise.resolve();
+ }
+
+ function arrivingHereIsBad(aResult) {
+ ok(false, "Bad result! Received a: " + aResult);
+ return Promise.resolve();
+ }
+
+ function expectNotAllowedError(aResult) {
+ ok(aResult.toString().startsWith("NotAllowedError"), "Expecting a NotAllowedError");
+ return Promise.resolve();
+ }
+
+ function expectTypeError(aResult) {
+ ok(aResult.toString().startsWith("TypeError"), "Expecting a TypeError");
+ return Promise.resolve();
+ }
+
+ function expectNotSupportedError(aResult) {
+ ok(aResult.toString().startsWith("NotSupportedError"), "Expecting a NotSupportedError");
+ return Promise.resolve();
+ }
+
+ // Test basic good call
+ async function test_good_call() {
+ let makeCredentialOptions = {
+ rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+
+ // Test empty account
+ async function test_empty_account() {
+ let makeCredentialOptions = {
+ challenge: gCredentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test without rp.name
+ async function test_without_rp_name() {
+ let rp1 = {id: document.domain, icon: "none"};
+ let makeCredentialOptions = {
+ rp: rp1, user, challenge: gCredentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test without user.id
+ async function test_without_user_id() {
+ let user1 = {name: "none", icon: "none", displayName: "none"};
+ let makeCredentialOptions = {
+ rp, user: user1, challenge: gCredentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test without user.name
+ async function test_without_user_name() {
+ let user1 = {id: new Uint8Array(64), icon: "none", displayName: "none"};
+ let makeCredentialOptions = {
+ rp, user: user1, challenge: gCredentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test without user.displayName
+ async function test_without_user_displayname() {
+ let user1 = {id: new Uint8Array(64), name: "none", icon: "none"};
+ let makeCredentialOptions = {
+ rp, user: user1, challenge: gCredentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test with a user handle that exceeds the max length
+ async function test_user_too_large() {
+ let user1 = {id: new Uint8Array(65), name: "none", icon: "none", displayName: "none"};
+ let makeCredentialOptions = {
+ rp, user: user1, challenge: gCredentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test without any parameters; this is acceptable meaning the RP ID is
+ // happy to accept either ECDSA-SHA256 or RSA-SHA256
+ async function test_empty_parameters() {
+ let makeCredentialOptions = {
+ rp, user, challenge: gCredentialChallenge, pubKeyCredParams: []
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+
+ // Test without a parameter array at all
+ async function test_without_parameters() {
+ let makeCredentialOptions = {
+ rp, user, challenge: gCredentialChallenge
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test with an unsupported parameter
+ async function test_unsupported_parameter() {
+ let makeCredentialOptions = {
+ rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [unsupportedParam]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectNotSupportedError);
+ }
+
+ // Test with an unsupported parameter and a good one
+ async function test_unsupported_but_one_param() {
+ let makeCredentialOptions = {
+ rp, user, challenge: gCredentialChallenge,
+ pubKeyCredParams: [param, unsupportedParam]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+
+ // Test with one unknown parameter.
+ async function test_one_unknown_parameter() {
+ let makeCredentialOptions = {
+ rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [unknownParam]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectNotSupportedError);
+ }
+
+ // Test with an unsupported parameter, and an unknown one
+ async function test_one_unknown_one_unsupported_param() {
+ let makeCredentialOptions = {
+ rp, user, challenge: gCredentialChallenge,
+ pubKeyCredParams: [unsupportedParam, unknownParam]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectNotSupportedError);
+ }
+
+ // Test with an unsupported parameter, an unknown one, and a good one. This
+ // should succeed, as the unsupported and unknown should be ignored.
+ async function test_one_of_each_parameters() {
+ let makeCredentialOptions = {
+ rp, user, challenge: gCredentialChallenge,
+ pubKeyCredParams: [param, unsupportedParam, unknownParam]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+
+ // Test without a challenge
+ async function test_without_challenge() {
+ let makeCredentialOptions = {
+ rp, user, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test with an invalid challenge
+ async function test_invalid_challenge() {
+ let makeCredentialOptions = {
+ rp, user, challenge: "begone, thou ill-fitting moist glove!",
+ pubKeyCredParams: [unsupportedParam]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test with duplicate pubKeyCredParams
+ async function test_duplicate_pub_key() {
+ let makeCredentialOptions = {
+ rp, user, challenge: gCredentialChallenge,
+ pubKeyCredParams: [param, param, param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+
+ // Test with an RP ID that is not a valid domain string
+ async function test_invalid_rp_id() {
+ let rp1 = { id: document.domain + ":somejunk", name: "none", icon: "none" };
+ let makeCredentialOptions = {
+ rp: rp1, user, challenge: gCredentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(arrivingHereIsGood);
+ }
+
+ // Test with another RP ID that is not a valid domain string
+ async function test_invalid_rp_id_2() {
+ let rp1 = { id: document.domain + ":8888", name: "none", icon: "none" };
+ let makeCredentialOptions = {
+ rp: rp1, user, challenge: gCredentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(arrivingHereIsGood);
+ }
+
+ // Test with missing rp
+ async function test_missing_rp() {
+ let makeCredentialOptions = {
+ user, challenge: gCredentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test with incorrect user ID type
+ async function test_incorrect_user_id_type() {
+ let invalidType = {id: "a string, which is not a buffer", name: "none", icon: "none", displayName: "none"};
+ let makeCredentialOptions = {
+ user: invalidType, challenge: gCredentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test with missing user
+ async function test_missing_user() {
+ let makeCredentialOptions = {
+ rp, challenge: gCredentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test a complete account
+ async function test_complete_account() {
+ let completeRP = {id: document.domain, name: "Foxxy Name",
+ icon: "https://example.com/fox.svg"};
+ let completeUser = {id: string2buffer("foxes_are_the_best@example.com"),
+ name: "Fox F. Foxington",
+ icon: "https://example.com/fox.svg",
+ displayName: "Foxxy V"};
+ let makeCredentialOptions = {
+ rp: completeRP, user: completeUser, challenge: gCredentialChallenge,
+ pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+
+ // Test with too-large user ID buffer
+ async function test_too_large_user_id() {
+ let hugeUser = {id: new Uint8Array(65),
+ name: "Fox F. Foxington",
+ icon: "https://example.com/fox.svg",
+ displayName: "Foxxy V"};
+ let makeCredentialOptions = {
+ rp, user: hugeUser, challenge: gCredentialChallenge,
+ pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+
+ // Test with excluding unknown transports
+ async function test_excluding_unknown_transports() {
+ let completeRP = {id: document.domain, name: "Foxxy Name",
+ icon: "https://example.com/fox.svg"};
+ let completeUser = {id: string2buffer("foxes_are_the_best@example.com"),
+ name: "Fox F. Foxington",
+ icon: "https://example.com/fox.svg",
+ displayName: "Foxxy V"};
+ let excludedUnknownTransport = {type: "public-key",
+ id: string2buffer("123"),
+ transports: ["unknown", "usb"]};
+ let makeCredentialOptions = {
+ rp: completeRP, user: completeUser, challenge: gCredentialChallenge,
+ pubKeyCredParams: [param], excludeCredentials: [excludedUnknownTransport]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+
+ async function test_unknown_attestation_type() {
+ let makeCredentialOptions = {
+ rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [param],
+ attestation: "unknown"
+ };
+ return credm.create({publicKey: makeCredentialOptions })
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+
+ async function test_unknown_selection_criteria() {
+ let makeCredentialOptions = {
+ rp, user, challenge: gCredentialChallenge, pubKeyCredParams: [param],
+ authenticatorSelection: {
+ userVerificationRequirement: "unknown UV requirement",
+ authenticatorAttachment: "unknown authenticator attachment type"
+ },
+ };
+ return credm.create({publicKey: makeCredentialOptions })
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+
+ </script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_no_token.html b/dom/webauthn/tests/test_webauthn_no_token.html
new file mode 100644
index 0000000000..0d89fd94ad
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_no_token.html
@@ -0,0 +1,87 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Test for W3C Web Authentication with no token</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <script type="text/javascript" src="pkijs/common.js"></script>
+ <script type="text/javascript" src="pkijs/asn1.js"></script>
+ <script type="text/javascript" src="pkijs/x509_schema.js"></script>
+ <script type="text/javascript" src="pkijs/x509_simpl.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+<h1>Test for W3C Web Authentication with no token</h1>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1309284">Mozilla Bug 1309284</a>
+
+<script class="testbody" type="text/javascript">
+"use strict";
+
+is(navigator.authentication, undefined, "navigator.authentication does not exist any longer");
+isnot(navigator.credentials, undefined, "Credential Management API endpoint must exist");
+isnot(navigator.credentials.create, undefined, "CredentialManagement create API endpoint must exist");
+isnot(navigator.credentials.get, undefined, "CredentialManagement get API endpoint must exist");
+
+let credm;
+let credentialChallenge;
+let assertionChallenge;
+let credentialId;
+
+// Setup test env
+add_task(() => {
+ credentialChallenge = new Uint8Array(16);
+ window.crypto.getRandomValues(credentialChallenge);
+ assertionChallenge = new Uint8Array(16);
+ window.crypto.getRandomValues(assertionChallenge);
+ credentialId = new Uint8Array(128);
+ window.crypto.getRandomValues(credentialId);
+ credm = navigator.credentials;
+ // Turn off all tokens. This should result in "not allowed" failures
+ return SpecialPowers.pushPrefEnv({"set": [
+ ["security.webauth.webauthn_enable_softtoken", false],
+ ["security.webauth.webauthn_enable_usbtoken", false],
+ ]});
+});
+
+add_task(async function test_no_token_make_credential() {
+ let rp = {id: document.domain, name: "none", icon: "none"};
+ let user = {id: new Uint8Array(), name: "none", icon: "none", displayName: "none"};
+ let param = {type: "public-key", alg: cose_alg_ECDSA_w_SHA256};
+ let makeCredentialOptions = {
+ rp, user, challenge: credentialChallenge, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(function(aResult) {
+ ok(false, "Should have failed.");
+ })
+ .catch(function(aReason) {
+ ok(aReason.toString().startsWith("NotAllowedError"), aReason);
+ });
+});
+
+add_task(async function test_no_token_get_assertion() {
+ let newCredential = {
+ type: "public-key",
+ id: credentialId,
+ transports: ["usb"],
+ }
+ let publicKeyCredentialRequestOptions = {
+ challenge: assertionChallenge,
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ rpId: document.domain,
+ allowCredentials: [newCredential]
+ };
+ return credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(function(aResult) {
+ ok(false, "Should have failed.");
+ })
+ .catch(function(aReason) {
+ ok(aReason.toString().startsWith("NotAllowedError"), aReason);
+ })
+});
+
+</script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_override_request.html b/dom/webauthn/tests/test_webauthn_override_request.html
new file mode 100644
index 0000000000..e88ea5a95d
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_override_request.html
@@ -0,0 +1,96 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Test for overriding W3C Web Authentication request</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+ <h1>Test for overriding W3C Web Authentication request</h1>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1415675">Mozilla Bug 1415675</a>
+
+ <script class="testbody" type="text/javascript">
+ "use strict";
+
+ // Last request status.
+ let status = "";
+
+ add_task(() => {
+ return SpecialPowers.pushPrefEnv({"set": [
+ ["security.webauth.webauthn_enable_softtoken", false],
+ ["security.webauth.webauthn_enable_usbtoken", true],
+ ]});
+ });
+
+ // Start a new MakeCredential() request.
+ async function requestMakeCredential(status_value) {
+ let publicKey = {
+ rp: {id: document.domain, name: "none", icon: "none"},
+ user: {id: new Uint8Array(), name: "none", icon: "none", displayName: "none"},
+ challenge: crypto.getRandomValues(new Uint8Array(16)),
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ pubKeyCredParams: [{type: "public-key", alg: cose_alg_ECDSA_w_SHA256}],
+ };
+
+ // Start the request, handle failures only.
+ navigator.credentials.create({publicKey}).catch(() => {
+ status = status_value;
+ });
+
+ // Wait a tick to let the statemachine start.
+ await Promise.resolve();
+ }
+
+ // Start a new GetAssertion() request.
+ async function requestGetAssertion(status_value) {
+ let newCredential = {
+ type: "public-key",
+ id: crypto.getRandomValues(new Uint8Array(16)),
+ transports: ["usb"],
+ };
+
+ let publicKey = {
+ challenge: crypto.getRandomValues(new Uint8Array(16)),
+ timeout: 5000, // the minimum timeout is actually 15 seconds
+ rpId: document.domain,
+ allowCredentials: [newCredential]
+ };
+
+ // Start the request, handle failures only.
+ navigator.credentials.get({publicKey}).catch(() => {
+ status = status_value;
+ });
+
+ // Wait a tick to let the statemachine start.
+ await Promise.resolve();
+ }
+
+ // Test that .create() and .get() requests override any pending requests.
+ add_task(async function test_override_pending_requests() {
+ // Request a new credential.
+ await requestMakeCredential("aborted1");
+
+ // Request another credential, the new request will abort.
+ await requestMakeCredential("aborted2");
+ is(status, "aborted2", "second request aborted");
+
+ // Request an assertion, the new request will still abort.
+ await requestGetAssertion("aborted3");
+ is(status, "aborted3", "third request aborted");
+
+ // Request another assertion, this fourth request will abort.
+ await requestGetAssertion("aborted4");
+ is(status, "aborted4", "fourth request aborted");
+
+ // Request another credential, the fifth request will still abort. Why
+ // do we keep trying? Well, the test originally looked like this, and
+ // let's face it, it's kinda funny.
+ await requestMakeCredential("aborted5");
+ is(status, "aborted5", "fifth request aborted");
+ });
+ </script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_sameorigin.html b/dom/webauthn/tests/test_webauthn_sameorigin.html
new file mode 100644
index 0000000000..9da20e0c47
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_sameorigin.html
@@ -0,0 +1,316 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Test for MakeCredential for W3C Web Authentication</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <script type="text/javascript" src="pkijs/common.js"></script>
+ <script type="text/javascript" src="pkijs/asn1.js"></script>
+ <script type="text/javascript" src="pkijs/x509_schema.js"></script>
+ <script type="text/javascript" src="pkijs/x509_simpl.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+ <h1>Test Same Origin Policy for W3C Web Authentication</h1>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1309284">Mozilla Bug 1309284</a>
+
+ <script class="testbody" type="text/javascript">
+ "use strict";
+
+ // Execute the full-scope test
+ SimpleTest.waitForExplicitFinish();
+
+ is(navigator.authentication, undefined, "navigator.authentication does not exist any longer");
+ isnot(navigator.credentials, undefined, "Credential Management API endpoint must exist");
+ isnot(navigator.credentials.create, undefined, "CredentialManagement create API endpoint must exist");
+ isnot(navigator.credentials.get, undefined, "CredentialManagement get API endpoint must exist");
+
+ let credm;
+ let chall;
+ let user;
+ let param;
+ let gTrackedCredential;
+ add_task(() => {
+ credm = navigator.credentials;
+
+ chall = new Uint8Array(16);
+ window.crypto.getRandomValues(chall);
+
+ user = {id: new Uint8Array(16), name: "none", icon: "none", displayName: "none"};
+ param = {type: "public-key", alg: cose_alg_ECDSA_w_SHA256};
+ gTrackedCredential = {};
+ });
+
+ add_task(test_basic_good);
+ add_task(test_rp_id_unset);
+ add_task(test_rp_name_unset);
+ add_task(test_origin_with_optional_fields);
+ add_task(test_blank_rp_id);
+ add_task(test_subdomain);
+ add_task(test_same_origin);
+ add_task(test_etld);
+ add_task(test_different_domain_same_tld);
+ add_task(test_assertion_basic_good);
+ add_task(test_assertion_rp_id_unset);
+ add_task(test_assertion_origin_with_optional_fields);
+ add_task(test_assertion_blank_rp_id);
+ add_task(test_assertion_subdomain);
+ add_task(test_assertion_same_origin);
+ add_task(test_assertion_etld);
+ add_task(test_assertion_different_domain_same_tld);
+ add_task(test_basic_good_with_origin);
+ add_task(test_assertion_basic_good_with_origin);
+ add_task(test_assertion_invalid_rp_id);
+ add_task(test_assertion_another_invalid_rp_id);
+
+ function arrivingHereIsGood(aResult) {
+ ok(true, "Good result! Received a: " + aResult);
+ }
+
+ function arrivingHereIsBad(aResult) {
+ ok(false, "Bad result! Received a: " + aResult);
+ }
+
+ function expectSecurityError(aResult) {
+ ok(aResult.toString().startsWith("SecurityError"), "Expecting a SecurityError");
+ }
+
+ function expectTypeError(aResult) {
+ ok(aResult.toString().startsWith("TypeError"), "Expecting a TypeError");
+ }
+
+ function keepThisPublicKeyCredential(aIdentifier) {
+ return function(aPublicKeyCredential) {
+ gTrackedCredential[aIdentifier] = {
+ type: "public-key",
+ id: new Uint8Array(aPublicKeyCredential.rawId),
+ transports: [ "usb" ],
+ }
+ return Promise.resolve(aPublicKeyCredential);
+ }
+ }
+
+ function test_basic_good() {
+ // Test basic good call
+ let rp = {id: document.domain, name: "none"};
+ let makeCredentialOptions = {
+ rp, user, challenge: chall, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(keepThisPublicKeyCredential("basic"))
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+ function test_rp_id_unset() {
+ // Test rp.id being unset
+ let makeCredentialOptions = {
+ rp: {name: "none"}, user, challenge: chall, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+ function test_rp_name_unset() {
+ // Test rp.name being unset
+ let makeCredentialOptions = {
+ rp: {id: document.domain}, user, challenge: chall, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectTypeError);
+ }
+ function test_origin_with_optional_fields() {
+ // Test this origin with optional fields
+ let rp = {id: "user:pass@" + document.domain + ":8888", name: "none"};
+ let makeCredentialOptions = {
+ rp, user, challenge: chall, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+ function test_blank_rp_id() {
+ // Test blank rp.id
+ let rp = {id: "", name: "none"};
+ let makeCredentialOptions = {
+ rp, user, challenge: chall, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+ function test_subdomain() {
+ // Test subdomain of this origin
+ let rp = {id: "subdomain." + document.domain, name: "none"};
+ let makeCredentialOptions = {
+ rp, user, challenge: chall, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+ function test_same_origin() {
+ // Test the same origin
+ let rp = {id: "example.com", name: "none"};
+ let makeCredentialOptions = {
+ rp, user, challenge: chall, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+ function test_etld() {
+ // Test the eTLD
+ let rp = {id: "com", name: "none"};
+ let makeCredentialOptions = {
+ rp, user, challenge: chall, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+ function test_different_domain_same_tld() {
+ // Test a different domain within the same TLD
+ let rp = {id: "alt.test", name: "none"};
+ let makeCredentialOptions = {
+ rp, user, challenge: chall, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+ function test_assertion_basic_good() {
+ // Test basic good call
+ let publicKeyCredentialRequestOptions = {
+ challenge: chall,
+ rpId: document.domain,
+ allowCredentials: [gTrackedCredential.basic]
+ };
+ return credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+ function test_assertion_rp_id_unset() {
+ // Test rpId being unset
+ let publicKeyCredentialRequestOptions = {
+ challenge: chall,
+ allowCredentials: [gTrackedCredential.basic]
+ };
+ return credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+ function test_assertion_origin_with_optional_fields() {
+ // Test this origin with optional fields
+ let publicKeyCredentialRequestOptions = {
+ challenge: chall,
+ rpId: "user:pass@" + document.origin + ":8888",
+ allowCredentials: [gTrackedCredential.basic]
+ };
+ return credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+ function test_assertion_blank_rp_id() {
+ // Test blank rpId
+ let publicKeyCredentialRequestOptions = {
+ challenge: chall,
+ rpId: "",
+ allowCredentials: [gTrackedCredential.basic]
+ };
+ return credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+ function test_assertion_subdomain() {
+ // Test subdomain of this origin
+ let publicKeyCredentialRequestOptions = {
+ challenge: chall,
+ rpId: "subdomain." + document.domain,
+ allowCredentials: [gTrackedCredential.basic]
+ };
+ return credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+ function test_assertion_same_origin() {
+ // Test the same origin
+ let publicKeyCredentialRequestOptions = {
+ challenge: chall,
+ rpId: "example.com",
+ allowCredentials: [gTrackedCredential.basic]
+ };
+ return credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(arrivingHereIsGood)
+ .catch(arrivingHereIsBad);
+ }
+ function test_assertion_etld() {
+ // Test the eTLD
+ let publicKeyCredentialRequestOptions = {
+ challenge: chall,
+ rpId: "com",
+ allowCredentials: [gTrackedCredential.basic]
+ };
+ return credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+ function test_assertion_different_domain_same_tld() {
+ // Test a different domain within the same TLD
+ let publicKeyCredentialRequestOptions = {
+ challenge: chall,
+ rpId: "alt.test",
+ allowCredentials: [gTrackedCredential.basic]
+ };
+ return credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+ function test_basic_good_with_origin() {
+ // Test basic good Create call but using an origin (Bug 1380421)
+ let rp = {id: window.origin, name: "none"};
+ let makeCredentialOptions = {
+ rp, user, challenge: chall, pubKeyCredParams: [param]
+ };
+ return credm.create({publicKey: makeCredentialOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+ function test_assertion_basic_good_with_origin() {
+ // Test basic good Get call but using an origin (Bug 1380421)
+ let publicKeyCredentialRequestOptions = {
+ challenge: chall,
+ rpId: window.origin,
+ allowCredentials: [gTrackedCredential.basic]
+ };
+ return credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(arrivingHereIsBad)
+ .catch(expectSecurityError);
+ }
+ function test_assertion_invalid_rp_id() {
+ // Test with an rpId that is not a valid domain string
+ let publicKeyCredentialRequestOptions = {
+ challenge: chall,
+ rpId: document.domain + ":somejunk",
+ allowCredentials: [gTrackedCredential.basic]
+ };
+ return credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(arrivingHereIsBad)
+ .catch(arrivingHereIsGood);
+ }
+ function test_assertion_another_invalid_rp_id() {
+ // Test with another rpId that is not a valid domain string
+ let publicKeyCredentialRequestOptions = {
+ challenge: chall,
+ rpId: document.domain + ":8888",
+ allowCredentials: [gTrackedCredential.basic]
+ };
+ return credm.get({publicKey: publicKeyCredentialRequestOptions})
+ .then(arrivingHereIsBad)
+ .catch(arrivingHereIsGood);
+ }
+ </script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_sameoriginwithancestors.html b/dom/webauthn/tests/test_webauthn_sameoriginwithancestors.html
new file mode 100644
index 0000000000..7bb0ede1ec
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_sameoriginwithancestors.html
@@ -0,0 +1,107 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Test for MakeCredential for W3C Web Authentication (sameOriginWithAncestors = false)</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <script type="text/javascript" src="u2futil.js"></script>
+ <script type="text/javascript" src="pkijs/common.js"></script>
+ <script type="text/javascript" src="pkijs/asn1.js"></script>
+ <script type="text/javascript" src="pkijs/x509_schema.js"></script>
+ <script type="text/javascript" src="pkijs/x509_simpl.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+ <h1>Test Same Origin Policy for W3C Web Authentication (sameOriginWithAncestors = false)</h1>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1694639">Mozilla Bug 1694639</a>
+
+ <script class="testbody" type="text/javascript">
+ "use strict";
+
+ // Execute the full-scope test
+ SimpleTest.waitForExplicitFinish();
+
+ var gTrackedCredential = {};
+
+ function arrivingHereIsGood(aResult) {
+ ok(true, "Good result! Received a: " + aResult);
+ }
+
+ function arrivingHereIsBad(aResult) {
+ ok(false, "Bad result! Received a: " + aResult);
+ }
+
+ function expectNotAllowedError(aResult) {
+ ok(aResult == "NotAllowedError", "Expecting a NotAllowedError, got " + aResult);
+ }
+
+ function keepThisPublicKeyCredential(aIdentifier) {
+ return function(aPublicKeyCredential) {
+ gTrackedCredential[aIdentifier] = {
+ type: "public-key",
+ id: new Uint8Array(aPublicKeyCredential.rawId),
+ transports: [ "usb" ],
+ }
+ return Promise.resolve(aPublicKeyCredential);
+ }
+ }
+
+ add_task(async function runTests() {
+ let iframe = document.createElement("iframe");
+ iframe.src = "https://example.org";
+ document.body.appendChild(iframe);
+ await new Promise(resolve => iframe.addEventListener("load", resolve, {once: true}));
+
+ is(navigator.authentication, undefined, "navigator.authentication does not exist any longer");
+ isnot(navigator.credentials, undefined, "Credential Management API endpoint must exist");
+ isnot(navigator.credentials.create, undefined, "CredentialManagement create API endpoint must exist");
+ isnot(navigator.credentials.get, undefined, "CredentialManagement get API endpoint must exist");
+
+ let credm = navigator.credentials;
+
+ let chall = new Uint8Array(16);
+ window.crypto.getRandomValues(chall);
+
+ let user = {id: new Uint8Array(16), name: "none", icon: "none", displayName: "none"};
+ let param = {type: "public-key", alg: cose_alg_ECDSA_w_SHA256};
+
+ let rp = {id: document.domain, name: "none"};
+ let makeCredentialOptions = {
+ rp, user, challenge: chall, pubKeyCredParams: [param]
+ };
+ await credm.create({publicKey: makeCredentialOptions})
+ .then(keepThisPublicKeyCredential("basic"))
+ .catch(arrivingHereIsBad);
+
+ var testFuncs = [
+ function (args) {
+ // Test create when sameOriginWithAncestors = false
+ let credentialOptions = {
+ rp: args.rp, user: args.user, challenge: args.challenge, pubKeyCredParams: [args.param]
+ };
+ return this.content.window.navigator.credentials.create({publicKey: credentialOptions})
+ .catch(e => Promise.reject(e.name));
+ },
+ function (args) {
+ // Test get when sameOriginWithAncestors = false
+ let publicKeyCredentialRequestOptions = {
+ challenge: args.challenge,
+ rpId: args.rp.id,
+ allowCredentials: [args.trackedCredential.basic]
+ };
+ return this.content.window.navigator.credentials.get({publicKey: publicKeyCredentialRequestOptions})
+ .catch(e => Promise.reject(e.name));
+ },
+ ];
+
+ let args = { user, param, rp, challenge: chall, trackedCredential: gTrackedCredential }
+ for(let func of testFuncs) {
+ await SpecialPowers.spawn(iframe, [args], func)
+ .then(arrivingHereIsBad)
+ .catch(expectNotAllowedError);
+ }
+ });
+ </script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/test_webauthn_store_credential.html b/dom/webauthn/tests/test_webauthn_store_credential.html
new file mode 100644
index 0000000000..f19d1d7fa0
--- /dev/null
+++ b/dom/webauthn/tests/test_webauthn_store_credential.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<head>
+ <title>Tests for Store for W3C Web Authentication</title>
+ <script src="/tests/SimpleTest/SimpleTest.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+
+ <h1>Tests for Store for W3C Web Authentication</h1>
+ <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1309284">Mozilla Bug 1309284</a>
+
+ <script class="testbody" type="text/javascript">
+ "use strict";
+
+ isnot(navigator.credentials, undefined, "Credential Management API endpoint must exist");
+ isnot(navigator.credentials.create, undefined, "CredentialManagement create API endpoint must exist");
+ isnot(navigator.credentials.get, undefined, "CredentialManagement get API endpoint must exist");
+ isnot(navigator.credentials.store, undefined, "CredentialManagement store API endpoint must exist");
+
+ function arrivingHereIsBad(aResult) {
+ ok(false, "Bad result! Received a: " + aResult);
+ return Promise.resolve();
+ }
+
+ function expectNotSupportedError(aResult) {
+ ok(aResult.toString().startsWith("NotSupportedError"), "Expecting a NotSupportedError, received: " + aResult);
+ return Promise.resolve();
+ }
+
+ add_task(async function test_store_credential() {
+ let credentialChallenge = new Uint8Array(16);
+ window.crypto.getRandomValues(credentialChallenge);
+
+ let rp = {id: document.domain, name: "none", icon: "none"};
+ let user = {id: new Uint8Array(64), name: "none", icon: "none", displayName: "none"};
+ let params = [ {type: "public-key", alg: "es256"}, {type: "public-key", alg: -7} ]
+
+ let makeCredentialOptions = {
+ rp, user, challenge: credentialChallenge, pubKeyCredParams: params
+ };
+
+ let credential = await navigator.credentials.create({publicKey: makeCredentialOptions})
+ .catch(arrivingHereIsBad);
+
+ await navigator.credentials.store(credential)
+ .then(arrivingHereIsBad)
+ .catch(expectNotSupportedError);
+ });
+ </script>
+
+</body>
+</html>
diff --git a/dom/webauthn/tests/u2futil.js b/dom/webauthn/tests/u2futil.js
new file mode 100644
index 0000000000..8f68b2b67c
--- /dev/null
+++ b/dom/webauthn/tests/u2futil.js
@@ -0,0 +1,397 @@
+// Used by local_addTest() / local_completeTest()
+var _countCompletions = 0;
+var _expectedCompletions = 0;
+
+const flag_TUP = 0x01;
+const flag_UV = 0x04;
+const flag_AT = 0x40;
+
+const cose_kty = 1;
+const cose_kty_ec2 = 2;
+const cose_alg = 3;
+const cose_alg_ECDSA_w_SHA256 = -7;
+const cose_alg_ECDSA_w_SHA512 = -36;
+const cose_crv = -1;
+const cose_crv_P256 = 1;
+const cose_crv_x = -2;
+const cose_crv_y = -3;
+
+var { AppConstants } = SpecialPowers.ChromeUtils.importESModule(
+ "resource://gre/modules/AppConstants.sys.mjs"
+);
+
+function handleEventMessage(event) {
+ if ("test" in event.data) {
+ let summary = event.data.test + ": " + event.data.msg;
+ log(event.data.status + ": " + summary);
+ ok(event.data.status, summary);
+ } else if ("done" in event.data) {
+ SimpleTest.finish();
+ } else {
+ ok(false, "Unexpected message in the test harness: " + event.data);
+ }
+}
+
+function log(msg) {
+ console.log(msg);
+ let logBox = document.getElementById("log");
+ if (logBox) {
+ logBox.textContent += "\n" + msg;
+ }
+}
+
+function local_is(value, expected, message) {
+ if (value === expected) {
+ local_ok(true, message);
+ } else {
+ local_ok(false, message + " unexpectedly: " + value + " !== " + expected);
+ }
+}
+
+function local_isnot(value, expected, message) {
+ if (value !== expected) {
+ local_ok(true, message);
+ } else {
+ local_ok(false, message + " unexpectedly: " + value + " === " + expected);
+ }
+}
+
+function local_ok(expression, message) {
+ let body = { test: this.location.pathname, status: expression, msg: message };
+ parent.postMessage(body, "http://mochi.test:8888");
+}
+
+function local_doesThrow(fn, name) {
+ let gotException = false;
+ try {
+ fn();
+ } catch (ex) {
+ gotException = true;
+ }
+ local_ok(gotException, name);
+}
+
+function local_expectThisManyTests(count) {
+ if (_expectedCompletions > 0) {
+ local_ok(
+ false,
+ "Error: local_expectThisManyTests should only be called once."
+ );
+ }
+ _expectedCompletions = count;
+}
+
+function local_completeTest() {
+ _countCompletions += 1;
+ if (_countCompletions == _expectedCompletions) {
+ log("All tests completed.");
+ local_finished();
+ }
+ if (_countCompletions > _expectedCompletions) {
+ local_ok(
+ false,
+ "Error: local_completeTest called more than local_addTest."
+ );
+ }
+}
+
+function local_finished() {
+ parent.postMessage({ done: true }, "http://mochi.test:8888");
+}
+
+function string2buffer(str) {
+ return new Uint8Array(str.length).map((x, i) => str.charCodeAt(i));
+}
+
+function buffer2string(buf) {
+ let str = "";
+ if (!(buf.constructor === Uint8Array)) {
+ buf = new Uint8Array(buf);
+ }
+ buf.map(function (x) {
+ return (str += String.fromCharCode(x));
+ });
+ return str;
+}
+
+function bytesToBase64(u8a) {
+ let CHUNK_SZ = 0x8000;
+ let c = [];
+ let array = new Uint8Array(u8a);
+ for (let i = 0; i < array.length; i += CHUNK_SZ) {
+ c.push(String.fromCharCode.apply(null, array.subarray(i, i + CHUNK_SZ)));
+ }
+ return window.btoa(c.join(""));
+}
+
+function base64ToBytes(b64encoded) {
+ return new Uint8Array(
+ window
+ .atob(b64encoded)
+ .split("")
+ .map(function (c) {
+ return c.charCodeAt(0);
+ })
+ );
+}
+
+function bytesToBase64UrlSafe(buf) {
+ return bytesToBase64(buf)
+ .replace(/\+/g, "-")
+ .replace(/\//g, "_")
+ .replace(/=/g, "");
+}
+
+function base64ToBytesUrlSafe(str) {
+ if (str.length % 4 == 1) {
+ throw "Improper b64 string";
+ }
+
+ var b64 = str.replace(/\-/g, "+").replace(/\_/g, "/");
+ while (b64.length % 4 != 0) {
+ b64 += "=";
+ }
+ return base64ToBytes(b64);
+}
+
+function hexEncode(buf) {
+ return Array.from(buf)
+ .map(x => ("0" + x.toString(16)).substr(-2))
+ .join("");
+}
+
+function hexDecode(str) {
+ return new Uint8Array(str.match(/../g).map(x => parseInt(x, 16)));
+}
+
+function hasOnlyKeys(obj, ...keys) {
+ let okeys = new Set(Object.keys(obj));
+ return keys.length == okeys.size && keys.every(k => okeys.has(k));
+}
+
+function webAuthnDecodeCBORAttestation(aCborAttBuf) {
+ let attObj = CBOR.decode(aCborAttBuf);
+ console.log(":: Attestation CBOR Object ::");
+ if (!hasOnlyKeys(attObj, "authData", "fmt", "attStmt")) {
+ return Promise.reject("Invalid CBOR Attestation Object");
+ }
+ if (attObj.fmt == "fido-u2f" && !hasOnlyKeys(attObj.attStmt, "sig", "x5c")) {
+ return Promise.reject("Invalid CBOR Attestation Statement");
+ }
+ if (attObj.fmt == "none" && Object.keys(attObj.attStmt).length) {
+ return Promise.reject("Invalid CBOR Attestation Statement");
+ }
+
+ return webAuthnDecodeAuthDataArray(new Uint8Array(attObj.authData)).then(
+ function (aAuthDataObj) {
+ attObj.authDataObj = aAuthDataObj;
+ return Promise.resolve(attObj);
+ }
+ );
+}
+
+function webAuthnDecodeAuthDataArray(aAuthData) {
+ let rpIdHash = aAuthData.slice(0, 32);
+ let flags = aAuthData.slice(32, 33);
+ let counter = aAuthData.slice(33, 37);
+
+ console.log(":: Authenticator Data ::");
+ console.log("RP ID Hash: " + hexEncode(rpIdHash));
+ console.log("Counter: " + hexEncode(counter) + " Flags: " + flags);
+
+ if ((flags & flag_AT) == 0x00) {
+ // No Attestation Data, so we're done.
+ return Promise.resolve({
+ rpIdHash,
+ flags,
+ counter,
+ });
+ }
+
+ if (aAuthData.length < 38) {
+ return Promise.reject(
+ "Authenticator Data flag was set, but not enough data passed in!"
+ );
+ }
+
+ let attData = {};
+ attData.aaguid = aAuthData.slice(37, 53);
+ attData.credIdLen = (aAuthData[53] << 8) + aAuthData[54];
+ attData.credId = aAuthData.slice(55, 55 + attData.credIdLen);
+
+ console.log(":: Authenticator Data ::");
+ console.log("AAGUID: " + hexEncode(attData.aaguid));
+
+ let cborPubKey = aAuthData.slice(55 + attData.credIdLen);
+ var pubkeyObj = CBOR.decode(cborPubKey.buffer);
+ if (
+ !(
+ cose_kty in pubkeyObj &&
+ cose_alg in pubkeyObj &&
+ cose_crv in pubkeyObj &&
+ cose_crv_x in pubkeyObj &&
+ cose_crv_y in pubkeyObj
+ )
+ ) {
+ throw "Invalid CBOR Public Key Object";
+ }
+ if (pubkeyObj[cose_kty] != cose_kty_ec2) {
+ throw "Unexpected key type";
+ }
+ if (pubkeyObj[cose_alg] != cose_alg_ECDSA_w_SHA256) {
+ throw "Unexpected public key algorithm";
+ }
+ if (pubkeyObj[cose_crv] != cose_crv_P256) {
+ throw "Unexpected curve";
+ }
+
+ let pubKeyBytes = assemblePublicKeyBytesData(
+ pubkeyObj[cose_crv_x],
+ pubkeyObj[cose_crv_y]
+ );
+ console.log(":: CBOR Public Key Object Data ::");
+ console.log("kty: " + pubkeyObj[cose_kty] + " (EC2)");
+ console.log("alg: " + pubkeyObj[cose_alg] + " (ES256)");
+ console.log("crv: " + pubkeyObj[cose_crv] + " (P256)");
+ console.log("X: " + pubkeyObj[cose_crv_x]);
+ console.log("Y: " + pubkeyObj[cose_crv_y]);
+ console.log("Uncompressed (hex): " + hexEncode(pubKeyBytes));
+
+ return importPublicKey(pubKeyBytes).then(function (aKeyHandle) {
+ return Promise.resolve({
+ rpIdHash,
+ flags,
+ counter,
+ attestationAuthData: attData,
+ publicKeyBytes: pubKeyBytes,
+ publicKeyHandle: aKeyHandle,
+ });
+ });
+}
+
+function importPublicKey(keyBytes) {
+ if (keyBytes[0] != 0x04 || keyBytes.byteLength != 65) {
+ throw "Bad public key octet string";
+ }
+ var jwk = {
+ kty: "EC",
+ crv: "P-256",
+ x: bytesToBase64UrlSafe(keyBytes.slice(1, 33)),
+ y: bytesToBase64UrlSafe(keyBytes.slice(33)),
+ };
+ return crypto.subtle.importKey(
+ "jwk",
+ jwk,
+ { name: "ECDSA", namedCurve: "P-256" },
+ true,
+ ["verify"]
+ );
+}
+
+function deriveAppAndChallengeParam(appId, clientData, attestation) {
+ var appIdBuf = string2buffer(appId);
+ return Promise.all([
+ crypto.subtle.digest("SHA-256", appIdBuf),
+ crypto.subtle.digest("SHA-256", clientData),
+ ]).then(function (digests) {
+ return {
+ appParam: new Uint8Array(digests[0]),
+ challengeParam: new Uint8Array(digests[1]),
+ attestation,
+ };
+ });
+}
+
+function assemblePublicKeyBytesData(xCoord, yCoord) {
+ // Produce an uncompressed EC key point. These start with 0x04, and then
+ // two 32-byte numbers denoting X and Y.
+ if (xCoord.length != 32 || yCoord.length != 32) {
+ throw "Coordinates must be 32 bytes long";
+ }
+ let keyBytes = new Uint8Array(65);
+ keyBytes[0] = 0x04;
+ xCoord.map((x, i) => (keyBytes[1 + i] = x));
+ yCoord.map((x, i) => (keyBytes[33 + i] = x));
+ return keyBytes;
+}
+
+function assembleSignedData(appParam, flags, counter, challengeParam) {
+ let signedData = new Uint8Array(32 + 1 + 4 + 32);
+ new Uint8Array(appParam).map((x, i) => (signedData[0 + i] = x));
+ signedData[32] = new Uint8Array(flags)[0];
+ new Uint8Array(counter).map((x, i) => (signedData[33 + i] = x));
+ new Uint8Array(challengeParam).map((x, i) => (signedData[37 + i] = x));
+ return signedData;
+}
+
+function assembleRegistrationSignedData(
+ appParam,
+ challengeParam,
+ keyHandle,
+ pubKey
+) {
+ let signedData = new Uint8Array(1 + 32 + 32 + keyHandle.length + 65);
+ signedData[0] = 0x00;
+ new Uint8Array(appParam).map((x, i) => (signedData[1 + i] = x));
+ new Uint8Array(challengeParam).map((x, i) => (signedData[33 + i] = x));
+ new Uint8Array(keyHandle).map((x, i) => (signedData[65 + i] = x));
+ new Uint8Array(pubKey).map(
+ (x, i) => (signedData[65 + keyHandle.length + i] = x)
+ );
+ return signedData;
+}
+
+function sanitizeSigArray(arr) {
+ // ECDSA signature fields into WebCrypto must be exactly 32 bytes long, so
+ // this method strips leading padding bytes, if added, and also appends
+ // padding zeros, if needed.
+ if (arr.length > 32) {
+ arr = arr.slice(arr.length - 32);
+ }
+ let ret = new Uint8Array(32);
+ ret.set(arr, ret.length - arr.length);
+ return ret;
+}
+
+function verifySignature(key, data, derSig) {
+ if (derSig.byteLength < 68) {
+ return Promise.reject(
+ "Invalid signature (length=" +
+ derSig.byteLength +
+ "): " +
+ hexEncode(new Uint8Array(derSig))
+ );
+ }
+
+ // Copy signature data into the current context.
+ let derSigCopy = new ArrayBuffer(derSig.byteLength);
+ new Uint8Array(derSigCopy).set(new Uint8Array(derSig));
+
+ let sigAsn1 = org.pkijs.fromBER(derSigCopy);
+
+ // pkijs.asn1 seems to erroneously set an error code when calling some
+ // internal function. The test suite doesn't like dangling globals.
+ delete window.error;
+
+ let sigR = new Uint8Array(
+ sigAsn1.result.value_block.value[0].value_block.value_hex
+ );
+ let sigS = new Uint8Array(
+ sigAsn1.result.value_block.value[1].value_block.value_hex
+ );
+
+ // The resulting R and S values from the ASN.1 Sequence must be fit into 32
+ // bytes. Sometimes they have leading zeros, sometimes they're too short, it
+ // all depends on what lib generated the signature.
+ let R = sanitizeSigArray(sigR);
+ let S = sanitizeSigArray(sigS);
+
+ console.log("Verifying these bytes: " + bytesToBase64UrlSafe(data));
+
+ let sigData = new Uint8Array(R.length + S.length);
+ sigData.set(R);
+ sigData.set(S, R.length);
+
+ let alg = { name: "ECDSA", hash: "SHA-256" };
+ return crypto.subtle.verify(alg, key, sigData, data);
+}
diff --git a/dom/webauthn/winwebauthn/.gitignore b/dom/webauthn/winwebauthn/.gitignore
new file mode 100644
index 0000000000..3e759b75bf
--- /dev/null
+++ b/dom/webauthn/winwebauthn/.gitignore
@@ -0,0 +1,330 @@
+## Ignore Visual Studio temporary files, build results, and
+## files generated by popular Visual Studio add-ons.
+##
+## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
+
+# User-specific files
+*.suo
+*.user
+*.userosscache
+*.sln.docstates
+
+# User-specific files (MonoDevelop/Xamarin Studio)
+*.userprefs
+
+# Build results
+[Dd]ebug/
+[Dd]ebugPublic/
+[Rr]elease/
+[Rr]eleases/
+x64/
+x86/
+bld/
+[Bb]in/
+[Oo]bj/
+[Ll]og/
+
+# Visual Studio 2015/2017 cache/options directory
+.vs/
+# Uncomment if you have tasks that create the project's static files in wwwroot
+#wwwroot/
+
+# Visual Studio 2017 auto generated files
+Generated\ Files/
+
+# MSTest test Results
+[Tt]est[Rr]esult*/
+[Bb]uild[Ll]og.*
+
+# NUNIT
+*.VisualState.xml
+TestResult.xml
+
+# Build Results of an ATL Project
+[Dd]ebugPS/
+[Rr]eleasePS/
+dlldata.c
+
+# Benchmark Results
+BenchmarkDotNet.Artifacts/
+
+# .NET Core
+project.lock.json
+project.fragment.lock.json
+artifacts/
+**/Properties/launchSettings.json
+
+# StyleCop
+StyleCopReport.xml
+
+# Files built by Visual Studio
+*_i.c
+*_p.c
+*_i.h
+*.ilk
+*.meta
+*.obj
+*.iobj
+*.pch
+*.pdb
+*.ipdb
+*.pgc
+*.pgd
+*.rsp
+*.sbr
+*.tlb
+*.tli
+*.tlh
+*.tmp
+*.tmp_proj
+*.log
+*.vspscc
+*.vssscc
+.builds
+*.pidb
+*.svclog
+*.scc
+
+# Chutzpah Test files
+_Chutzpah*
+
+# Visual C++ cache files
+ipch/
+*.aps
+*.ncb
+*.opendb
+*.opensdf
+*.sdf
+*.cachefile
+*.VC.db
+*.VC.VC.opendb
+
+# Visual Studio profiler
+*.psess
+*.vsp
+*.vspx
+*.sap
+
+# Visual Studio Trace Files
+*.e2e
+
+# TFS 2012 Local Workspace
+$tf/
+
+# Guidance Automation Toolkit
+*.gpState
+
+# ReSharper is a .NET coding add-in
+_ReSharper*/
+*.[Rr]e[Ss]harper
+*.DotSettings.user
+
+# JustCode is a .NET coding add-in
+.JustCode
+
+# TeamCity is a build add-in
+_TeamCity*
+
+# DotCover is a Code Coverage Tool
+*.dotCover
+
+# AxoCover is a Code Coverage Tool
+.axoCover/*
+!.axoCover/settings.json
+
+# Visual Studio code coverage results
+*.coverage
+*.coveragexml
+
+# NCrunch
+_NCrunch_*
+.*crunch*.local.xml
+nCrunchTemp_*
+
+# MightyMoose
+*.mm.*
+AutoTest.Net/
+
+# Web workbench (sass)
+.sass-cache/
+
+# Installshield output folder
+[Ee]xpress/
+
+# DocProject is a documentation generator add-in
+DocProject/buildhelp/
+DocProject/Help/*.HxT
+DocProject/Help/*.HxC
+DocProject/Help/*.hhc
+DocProject/Help/*.hhk
+DocProject/Help/*.hhp
+DocProject/Help/Html2
+DocProject/Help/html
+
+# Click-Once directory
+publish/
+
+# Publish Web Output
+*.[Pp]ublish.xml
+*.azurePubxml
+# Note: Comment the next line if you want to checkin your web deploy settings,
+# but database connection strings (with potential passwords) will be unencrypted
+*.pubxml
+*.publishproj
+
+# Microsoft Azure Web App publish settings. Comment the next line if you want to
+# checkin your Azure Web App publish settings, but sensitive information contained
+# in these scripts will be unencrypted
+PublishScripts/
+
+# NuGet Packages
+*.nupkg
+# The packages folder can be ignored because of Package Restore
+**/[Pp]ackages/*
+# except build/, which is used as an MSBuild target.
+!**/[Pp]ackages/build/
+# Uncomment if necessary however generally it will be regenerated when needed
+#!**/[Pp]ackages/repositories.config
+# NuGet v3's project.json files produces more ignorable files
+*.nuget.props
+*.nuget.targets
+
+# Microsoft Azure Build Output
+csx/
+*.build.csdef
+
+# Microsoft Azure Emulator
+ecf/
+rcf/
+
+# Windows Store app package directories and files
+AppPackages/
+BundleArtifacts/
+Package.StoreAssociation.xml
+_pkginfo.txt
+*.appx
+
+# Visual Studio cache files
+# files ending in .cache can be ignored
+*.[Cc]ache
+# but keep track of directories ending in .cache
+!*.[Cc]ache/
+
+# Others
+ClientBin/
+~$*
+*~
+*.dbmdl
+*.dbproj.schemaview
+*.jfm
+*.pfx
+*.publishsettings
+orleans.codegen.cs
+
+# Including strong name files can present a security risk
+# (https://github.com/github/gitignore/pull/2483#issue-259490424)
+#*.snk
+
+# Since there are multiple workflows, uncomment next line to ignore bower_components
+# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
+#bower_components/
+
+# RIA/Silverlight projects
+Generated_Code/
+
+# Backup & report files from converting an old project file
+# to a newer Visual Studio version. Backup files are not needed,
+# because we have git ;-)
+_UpgradeReport_Files/
+Backup*/
+UpgradeLog*.XML
+UpgradeLog*.htm
+ServiceFabricBackup/
+*.rptproj.bak
+
+# SQL Server files
+*.mdf
+*.ldf
+*.ndf
+
+# Business Intelligence projects
+*.rdl.data
+*.bim.layout
+*.bim_*.settings
+*.rptproj.rsuser
+
+# Microsoft Fakes
+FakesAssemblies/
+
+# GhostDoc plugin setting file
+*.GhostDoc.xml
+
+# Node.js Tools for Visual Studio
+.ntvs_analysis.dat
+node_modules/
+
+# Visual Studio 6 build log
+*.plg
+
+# Visual Studio 6 workspace options file
+*.opt
+
+# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
+*.vbw
+
+# Visual Studio LightSwitch build output
+**/*.HTMLClient/GeneratedArtifacts
+**/*.DesktopClient/GeneratedArtifacts
+**/*.DesktopClient/ModelManifest.xml
+**/*.Server/GeneratedArtifacts
+**/*.Server/ModelManifest.xml
+_Pvt_Extensions
+
+# Paket dependency manager
+.paket/paket.exe
+paket-files/
+
+# FAKE - F# Make
+.fake/
+
+# JetBrains Rider
+.idea/
+*.sln.iml
+
+# CodeRush
+.cr/
+
+# Python Tools for Visual Studio (PTVS)
+__pycache__/
+*.pyc
+
+# Cake - Uncomment if you are using it
+# tools/**
+# !tools/packages.config
+
+# Tabs Studio
+*.tss
+
+# Telerik's JustMock configuration file
+*.jmconfig
+
+# BizTalk build output
+*.btp.cs
+*.btm.cs
+*.odx.cs
+*.xsd.cs
+
+# OpenCover UI analysis results
+OpenCover/
+
+# Azure Stream Analytics local run output
+ASALocalRun/
+
+# MSBuild Binary and Structured Log
+*.binlog
+
+# NVidia Nsight GPU debugger configuration file
+*.nvuser
+
+# MFractors (Xamarin productivity tool) working folder
+.mfractor/
diff --git a/dom/webauthn/winwebauthn/LICENSE b/dom/webauthn/winwebauthn/LICENSE
new file mode 100644
index 0000000000..21071075c2
--- /dev/null
+++ b/dom/webauthn/winwebauthn/LICENSE
@@ -0,0 +1,21 @@
+ MIT License
+
+ Copyright (c) Microsoft Corporation. All rights reserved.
+
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+
+ The above copyright notice and this permission notice shall be included in all
+ copies or substantial portions of the Software.
+
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE
diff --git a/dom/webauthn/winwebauthn/README.md b/dom/webauthn/winwebauthn/README.md
new file mode 100644
index 0000000000..7aaa69079b
--- /dev/null
+++ b/dom/webauthn/winwebauthn/README.md
@@ -0,0 +1,26 @@
+# Description
+
+This project includes Win32 headers for communicating to Windows Hello and external secruity keys as part of WebAuthn and CTAP specification.
+
+For more details about the standards, please follow these links:
+* WebAuthn: https://w3c.github.io/webauthn/
+* CTAP: https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html
+
+
+# Having Issues?
+If you have any issues in adopting these APIs or need some clarification, please contact fido-dev@microsoft.com.
+
+
+# Contributing
+
+This project welcomes contributions and suggestions. Most contributions require you to agree to a
+Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
+the rights to use your contribution. For details, visit https://cla.microsoft.com.
+
+When you submit a pull request, a CLA-bot will automatically determine whether you need to provide
+a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions
+provided by the bot. You will only need to do this once across all repos using our CLA.
+
+This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
+For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
+contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
diff --git a/dom/webauthn/winwebauthn/webauthn.h b/dom/webauthn/winwebauthn/webauthn.h
new file mode 100644
index 0000000000..703fccc633
--- /dev/null
+++ b/dom/webauthn/winwebauthn/webauthn.h
@@ -0,0 +1,998 @@
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License.
+
+#ifndef __WEBAUTHN_H_
+#define __WEBAUTHN_H_
+
+#pragma once
+
+#include <winapifamily.h>
+
+#pragma region Desktop Family or OneCore Family
+#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP | WINAPI_PARTITION_SYSTEM)
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef WINAPI
+#define WINAPI __stdcall
+#endif
+
+#ifndef INITGUID
+#define INITGUID
+#include <guiddef.h>
+#undef INITGUID
+#else
+#include <guiddef.h>
+#endif
+
+//+------------------------------------------------------------------------------------------
+// API Version Information.
+// Caller should check for WebAuthNGetApiVersionNumber to check the presence of relevant APIs
+// and features for their usage.
+//-------------------------------------------------------------------------------------------
+
+#define WEBAUTHN_API_VERSION_1 1
+// WEBAUTHN_API_VERSION_1 : Baseline Version
+// Data Structures and their sub versions:
+// - WEBAUTHN_RP_ENTITY_INFORMATION : 1
+// - WEBAUTHN_USER_ENTITY_INFORMATION : 1
+// - WEBAUTHN_CLIENT_DATA : 1
+// - WEBAUTHN_COSE_CREDENTIAL_PARAMETER : 1
+// - WEBAUTHN_COSE_CREDENTIAL_PARAMETERS : Not Applicable
+// - WEBAUTHN_CREDENTIAL : 1
+// - WEBAUTHN_CREDENTIALS : Not Applicable
+// - WEBAUTHN_CREDENTIAL_EX : 1
+// - WEBAUTHN_CREDENTIAL_LIST : Not Applicable
+// - WEBAUTHN_EXTENSION : Not Applicable
+// - WEBAUTHN_EXTENSIONS : Not Applicable
+// - WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS : 3
+// - WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS : 4
+// - WEBAUTHN_COMMON_ATTESTATION : 1
+// - WEBAUTHN_CREDENTIAL_ATTESTATION : 3
+// - WEBAUTHN_ASSERTION : 1
+// Extensions:
+// - WEBAUTHN_EXTENSIONS_IDENTIFIER_HMAC_SECRET
+// APIs:
+// - WebAuthNGetApiVersionNumber
+// - WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable
+// - WebAuthNAuthenticatorMakeCredential
+// - WebAuthNAuthenticatorGetAssertion
+// - WebAuthNFreeCredentialAttestation
+// - WebAuthNFreeAssertion
+// - WebAuthNGetCancellationId
+// - WebAuthNCancelCurrentOperation
+// - WebAuthNGetErrorName
+// - WebAuthNGetW3CExceptionDOMError
+
+#define WEBAUTHN_API_VERSION_2 2
+// WEBAUTHN_API_VERSION_2 : Delta From WEBAUTHN_API_VERSION_1
+// Added Extensions:
+// - WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_PROTECT
+//
+
+#define WEBAUTHN_API_VERSION_3 3
+// WEBAUTHN_API_VERSION_3 : Delta From WEBAUTHN_API_VERSION_2
+// Data Structures and their sub versions:
+// - WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS : 4
+// - WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS : 5
+// - WEBAUTHN_CREDENTIAL_ATTESTATION : 4
+// - WEBAUTHN_ASSERTION : 2
+// Added Extensions:
+// - WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_BLOB
+// - WEBAUTHN_EXTENSIONS_IDENTIFIER_MIN_PIN_LENGTH
+//
+
+#define WEBAUTHN_API_VERSION_4 4
+// WEBAUTHN_API_VERSION_4 : Delta From WEBAUTHN_API_VERSION_3
+// Data Structures and their sub versions:
+// - WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS : 5
+// - WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS : 6
+// - WEBAUTHN_ASSERTION : 3
+// APIs:
+// - WebAuthNGetPlatformCredentialList
+// - WebAuthNFreePlatformCredentialList
+// - WebAuthNDeletePlatformCredential
+//
+
+#define WEBAUTHN_API_CURRENT_VERSION WEBAUTHN_API_VERSION_4
+
+//+------------------------------------------------------------------------------------------
+// Information about an RP Entity
+//-------------------------------------------------------------------------------------------
+
+#define WEBAUTHN_RP_ENTITY_INFORMATION_CURRENT_VERSION 1
+
+typedef struct _WEBAUTHN_RP_ENTITY_INFORMATION {
+ // Version of this structure, to allow for modifications in the future.
+ // This field is required and should be set to CURRENT_VERSION above.
+ DWORD dwVersion;
+
+ // Identifier for the RP. This field is required.
+ PCWSTR pwszId;
+
+ // Contains the friendly name of the Relying Party, such as "Acme Corporation", "Widgets Inc" or "Awesome Site".
+ // This field is required.
+ PCWSTR pwszName;
+
+ // Optional URL pointing to RP's logo.
+ PCWSTR pwszIcon;
+} WEBAUTHN_RP_ENTITY_INFORMATION, *PWEBAUTHN_RP_ENTITY_INFORMATION;
+typedef const WEBAUTHN_RP_ENTITY_INFORMATION *PCWEBAUTHN_RP_ENTITY_INFORMATION;
+
+//+------------------------------------------------------------------------------------------
+// Information about an User Entity
+//-------------------------------------------------------------------------------------------
+#define WEBAUTHN_MAX_USER_ID_LENGTH 64
+
+#define WEBAUTHN_USER_ENTITY_INFORMATION_CURRENT_VERSION 1
+
+typedef struct _WEBAUTHN_USER_ENTITY_INFORMATION {
+ // Version of this structure, to allow for modifications in the future.
+ // This field is required and should be set to CURRENT_VERSION above.
+ DWORD dwVersion;
+
+ // Identifier for the User. This field is required.
+ DWORD cbId;
+ _Field_size_bytes_(cbId)
+ PBYTE pbId;
+
+ // Contains a detailed name for this account, such as "john.p.smith@example.com".
+ PCWSTR pwszName;
+
+ // Optional URL that can be used to retrieve an image containing the user's current avatar,
+ // or a data URI that contains the image data.
+ PCWSTR pwszIcon;
+
+ // For User: Contains the friendly name associated with the user account by the Relying Party, such as "John P. Smith".
+ PCWSTR pwszDisplayName;
+} WEBAUTHN_USER_ENTITY_INFORMATION, *PWEBAUTHN_USER_ENTITY_INFORMATION;
+typedef const WEBAUTHN_USER_ENTITY_INFORMATION *PCWEBAUTHN_USER_ENTITY_INFORMATION;
+
+//+------------------------------------------------------------------------------------------
+// Information about client data.
+//-------------------------------------------------------------------------------------------
+
+#define WEBAUTHN_HASH_ALGORITHM_SHA_256 L"SHA-256"
+#define WEBAUTHN_HASH_ALGORITHM_SHA_384 L"SHA-384"
+#define WEBAUTHN_HASH_ALGORITHM_SHA_512 L"SHA-512"
+
+#define WEBAUTHN_CLIENT_DATA_CURRENT_VERSION 1
+
+typedef struct _WEBAUTHN_CLIENT_DATA {
+ // Version of this structure, to allow for modifications in the future.
+ // This field is required and should be set to CURRENT_VERSION above.
+ DWORD dwVersion;
+
+ // Size of the pbClientDataJSON field.
+ DWORD cbClientDataJSON;
+ // UTF-8 encoded JSON serialization of the client data.
+ _Field_size_bytes_(cbClientDataJSON)
+ PBYTE pbClientDataJSON;
+
+ // Hash algorithm ID used to hash the pbClientDataJSON field.
+ LPCWSTR pwszHashAlgId;
+} WEBAUTHN_CLIENT_DATA, *PWEBAUTHN_CLIENT_DATA;
+typedef const WEBAUTHN_CLIENT_DATA *PCWEBAUTHN_CLIENT_DATA;
+
+//+------------------------------------------------------------------------------------------
+// Information about credential parameters.
+//-------------------------------------------------------------------------------------------
+
+#define WEBAUTHN_CREDENTIAL_TYPE_PUBLIC_KEY L"public-key"
+
+#define WEBAUTHN_COSE_ALGORITHM_ECDSA_P256_WITH_SHA256 -7
+#define WEBAUTHN_COSE_ALGORITHM_ECDSA_P384_WITH_SHA384 -35
+#define WEBAUTHN_COSE_ALGORITHM_ECDSA_P521_WITH_SHA512 -36
+
+#define WEBAUTHN_COSE_ALGORITHM_RSASSA_PKCS1_V1_5_WITH_SHA256 -257
+#define WEBAUTHN_COSE_ALGORITHM_RSASSA_PKCS1_V1_5_WITH_SHA384 -258
+#define WEBAUTHN_COSE_ALGORITHM_RSASSA_PKCS1_V1_5_WITH_SHA512 -259
+
+#define WEBAUTHN_COSE_ALGORITHM_RSA_PSS_WITH_SHA256 -37
+#define WEBAUTHN_COSE_ALGORITHM_RSA_PSS_WITH_SHA384 -38
+#define WEBAUTHN_COSE_ALGORITHM_RSA_PSS_WITH_SHA512 -39
+
+#define WEBAUTHN_COSE_CREDENTIAL_PARAMETER_CURRENT_VERSION 1
+
+typedef struct _WEBAUTHN_COSE_CREDENTIAL_PARAMETER {
+ // Version of this structure, to allow for modifications in the future.
+ DWORD dwVersion;
+
+ // Well-known credential type specifying a credential to create.
+ LPCWSTR pwszCredentialType;
+
+ // Well-known COSE algorithm specifying the algorithm to use for the credential.
+ LONG lAlg;
+} WEBAUTHN_COSE_CREDENTIAL_PARAMETER, *PWEBAUTHN_COSE_CREDENTIAL_PARAMETER;
+typedef const WEBAUTHN_COSE_CREDENTIAL_PARAMETER *PCWEBAUTHN_COSE_CREDENTIAL_PARAMETER;
+
+typedef struct _WEBAUTHN_COSE_CREDENTIAL_PARAMETERS {
+ DWORD cCredentialParameters;
+ _Field_size_(cCredentialParameters)
+ PWEBAUTHN_COSE_CREDENTIAL_PARAMETER pCredentialParameters;
+} WEBAUTHN_COSE_CREDENTIAL_PARAMETERS, *PWEBAUTHN_COSE_CREDENTIAL_PARAMETERS;
+typedef const WEBAUTHN_COSE_CREDENTIAL_PARAMETERS *PCWEBAUTHN_COSE_CREDENTIAL_PARAMETERS;
+
+//+------------------------------------------------------------------------------------------
+// Information about credential.
+//-------------------------------------------------------------------------------------------
+#define WEBAUTHN_CREDENTIAL_CURRENT_VERSION 1
+
+typedef struct _WEBAUTHN_CREDENTIAL {
+ // Version of this structure, to allow for modifications in the future.
+ DWORD dwVersion;
+
+ // Size of pbID.
+ DWORD cbId;
+ // Unique ID for this particular credential.
+ _Field_size_bytes_(cbId)
+ PBYTE pbId;
+
+ // Well-known credential type specifying what this particular credential is.
+ LPCWSTR pwszCredentialType;
+} WEBAUTHN_CREDENTIAL, *PWEBAUTHN_CREDENTIAL;
+typedef const WEBAUTHN_CREDENTIAL *PCWEBAUTHN_CREDENTIAL;
+
+typedef struct _WEBAUTHN_CREDENTIALS {
+ DWORD cCredentials;
+ _Field_size_(cCredentials)
+ PWEBAUTHN_CREDENTIAL pCredentials;
+} WEBAUTHN_CREDENTIALS, *PWEBAUTHN_CREDENTIALS;
+typedef const WEBAUTHN_CREDENTIALS *PCWEBAUTHN_CREDENTIALS;
+
+//+------------------------------------------------------------------------------------------
+// Information about credential with extra information, such as, dwTransports
+//-------------------------------------------------------------------------------------------
+
+#define WEBAUTHN_CTAP_TRANSPORT_USB 0x00000001
+#define WEBAUTHN_CTAP_TRANSPORT_NFC 0x00000002
+#define WEBAUTHN_CTAP_TRANSPORT_BLE 0x00000004
+#define WEBAUTHN_CTAP_TRANSPORT_TEST 0x00000008
+#define WEBAUTHN_CTAP_TRANSPORT_INTERNAL 0x00000010
+#define WEBAUTHN_CTAP_TRANSPORT_FLAGS_MASK 0x0000001F
+
+#define WEBAUTHN_CREDENTIAL_EX_CURRENT_VERSION 1
+
+typedef struct _WEBAUTHN_CREDENTIAL_EX {
+ // Version of this structure, to allow for modifications in the future.
+ DWORD dwVersion;
+
+ // Size of pbID.
+ DWORD cbId;
+ // Unique ID for this particular credential.
+ _Field_size_bytes_(cbId)
+ PBYTE pbId;
+
+ // Well-known credential type specifying what this particular credential is.
+ LPCWSTR pwszCredentialType;
+
+ // Transports. 0 implies no transport restrictions.
+ DWORD dwTransports;
+} WEBAUTHN_CREDENTIAL_EX, *PWEBAUTHN_CREDENTIAL_EX;
+typedef const WEBAUTHN_CREDENTIAL_EX *PCWEBAUTHN_CREDENTIAL_EX;
+
+//+------------------------------------------------------------------------------------------
+// Information about credential list with extra information
+//-------------------------------------------------------------------------------------------
+
+typedef struct _WEBAUTHN_CREDENTIAL_LIST {
+ DWORD cCredentials;
+ _Field_size_(cCredentials)
+ PWEBAUTHN_CREDENTIAL_EX *ppCredentials;
+} WEBAUTHN_CREDENTIAL_LIST, *PWEBAUTHN_CREDENTIAL_LIST;
+typedef const WEBAUTHN_CREDENTIAL_LIST *PCWEBAUTHN_CREDENTIAL_LIST;
+
+//+------------------------------------------------------------------------------------------
+// Credential Information for WebAuthNGetPlatformCredentialList API
+//-------------------------------------------------------------------------------------------
+
+#define WEBAUTHN_CREDENTIAL_DETAILS_VERSION_1 1
+#define WEBAUTHN_CREDENTIAL_DETAILS_CURRENT_VERSION WEBAUTHN_CREDENTIAL_DETAILS_VERSION_1
+
+typedef struct _WEBAUTHN_CREDENTIAL_DETAILS {
+ // Version of this structure, to allow for modifications in the future.
+ DWORD dwVersion;
+
+ // Size of pbCredentialID.
+ DWORD cbCredentialID;
+ _Field_size_bytes_(cbCredentialID)
+ PBYTE pbCredentialID;
+
+ // RP Info
+ PWEBAUTHN_RP_ENTITY_INFORMATION pRpInformation;
+
+ // User Info
+ PWEBAUTHN_USER_ENTITY_INFORMATION pUserInformation;
+
+ // Removable or not.
+ BOOL bRemovable;
+} WEBAUTHN_CREDENTIAL_DETAILS, *PWEBAUTHN_CREDENTIAL_DETAILS;
+typedef const WEBAUTHN_CREDENTIAL_DETAILS *PCWEBAUTHN_CREDENTIAL_DETAILS;
+
+typedef struct _WEBAUTHN_CREDENTIAL_DETAILS_LIST {
+ DWORD cCredentialDetails;
+ _Field_size_(cCredentialDetails)
+ PWEBAUTHN_CREDENTIAL_DETAILS *ppCredentialDetails;
+} WEBAUTHN_CREDENTIAL_DETAILS_LIST, *PWEBAUTHN_CREDENTIAL_DETAILS_LIST;
+typedef const WEBAUTHN_CREDENTIAL_DETAILS_LIST *PCWEBAUTHN_CREDENTIAL_DETAILS_LIST;
+
+#define WEBAUTHN_GET_CREDENTIALS_OPTIONS_VERSION_1 1
+#define WEBAUTHN_GET_CREDENTIALS_OPTIONS_CURRENT_VERSION WEBAUTHN_GET_CREDENTIALS_OPTIONS_VERSION_1
+
+typedef struct _WEBAUTHN_GET_CREDENTIALS_OPTIONS {
+ // Version of this structure, to allow for modifications in the future.
+ DWORD dwVersion;
+
+ // Optional.
+ LPCWSTR pwszRpId;
+
+ // Optional. BrowserInPrivate Mode. Defaulting to FALSE.
+ BOOL bBrowserInPrivateMode;
+} WEBAUTHN_GET_CREDENTIALS_OPTIONS, *PWEBAUTHN_GET_CREDENTIALS_OPTIONS;
+typedef const WEBAUTHN_GET_CREDENTIALS_OPTIONS *PCWEBAUTHN_GET_CREDENTIALS_OPTIONS;
+
+//+------------------------------------------------------------------------------------------
+// PRF values.
+//-------------------------------------------------------------------------------------------
+
+#define WEBAUTHN_CTAP_ONE_HMAC_SECRET_LENGTH 32
+
+// SALT values below by default are converted into RAW Hmac-Secret values as per PRF extension.
+// - SHA-256(UTF8Encode("WebAuthn PRF") || 0x00 || Value)
+//
+// Set WEBAUTHN_AUTHENTICATOR_HMAC_SECRET_VALUES_FLAG in dwFlags in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS,
+// if caller wants to provide RAW Hmac-Secret SALT values directly. In that case,
+// values if provided MUST be of WEBAUTHN_CTAP_ONE_HMAC_SECRET_LENGTH size.
+
+typedef struct _WEBAUTHN_HMAC_SECRET_SALT {
+ // Size of pbFirst.
+ DWORD cbFirst;
+ _Field_size_bytes_(cbFirst)
+ PBYTE pbFirst; // Required
+
+ // Size of pbSecond.
+ DWORD cbSecond;
+ _Field_size_bytes_(cbSecond)
+ PBYTE pbSecond;
+} WEBAUTHN_HMAC_SECRET_SALT, *PWEBAUTHN_HMAC_SECRET_SALT;
+typedef const WEBAUTHN_HMAC_SECRET_SALT *PCWEBAUTHN_HMAC_SECRET_SALT;
+
+typedef struct _WEBAUTHN_CRED_WITH_HMAC_SECRET_SALT {
+ // Size of pbCredID.
+ DWORD cbCredID;
+ _Field_size_bytes_(cbCredID)
+ PBYTE pbCredID; // Required
+
+ // PRF Values for above credential
+ PWEBAUTHN_HMAC_SECRET_SALT pHmacSecretSalt; // Required
+} WEBAUTHN_CRED_WITH_HMAC_SECRET_SALT, *PWEBAUTHN_CRED_WITH_HMAC_SECRET_SALT;
+typedef const WEBAUTHN_CRED_WITH_HMAC_SECRET_SALT *PCWEBAUTHN_CRED_WITH_HMAC_SECRET_SALT;
+
+typedef struct _WEBAUTHN_HMAC_SECRET_SALT_VALUES {
+ PWEBAUTHN_HMAC_SECRET_SALT pGlobalHmacSalt;
+
+ DWORD cCredWithHmacSecretSaltList;
+ _Field_size_(cCredWithHmacSecretSaltList)
+ PWEBAUTHN_CRED_WITH_HMAC_SECRET_SALT pCredWithHmacSecretSaltList;
+} WEBAUTHN_HMAC_SECRET_SALT_VALUES, *PWEBAUTHN_HMAC_SECRET_SALT_VALUES;
+typedef const WEBAUTHN_HMAC_SECRET_SALT_VALUES *PCWEBAUTHN_HMAC_SECRET_SALT_VALUES;
+
+//+------------------------------------------------------------------------------------------
+// Hmac-Secret extension
+//-------------------------------------------------------------------------------------------
+
+#define WEBAUTHN_EXTENSIONS_IDENTIFIER_HMAC_SECRET L"hmac-secret"
+// Below type definitions is for WEBAUTHN_EXTENSIONS_IDENTIFIER_HMAC_SECRET
+// MakeCredential Input Type: BOOL.
+// - pvExtension must point to a BOOL with the value TRUE.
+// - cbExtension must contain the sizeof(BOOL).
+// MakeCredential Output Type: BOOL.
+// - pvExtension will point to a BOOL with the value TRUE if credential
+// was successfully created with HMAC_SECRET.
+// - cbExtension will contain the sizeof(BOOL).
+// GetAssertion Input Type: Not Supported
+// GetAssertion Output Type: Not Supported
+
+//+------------------------------------------------------------------------------------------
+// credProtect extension
+//-------------------------------------------------------------------------------------------
+
+#define WEBAUTHN_USER_VERIFICATION_ANY 0
+#define WEBAUTHN_USER_VERIFICATION_OPTIONAL 1
+#define WEBAUTHN_USER_VERIFICATION_OPTIONAL_WITH_CREDENTIAL_ID_LIST 2
+#define WEBAUTHN_USER_VERIFICATION_REQUIRED 3
+
+typedef struct _WEBAUTHN_CRED_PROTECT_EXTENSION_IN {
+ // One of the above WEBAUTHN_USER_VERIFICATION_* values
+ DWORD dwCredProtect;
+ // Set the following to TRUE to require authenticator support for the credProtect extension
+ BOOL bRequireCredProtect;
+} WEBAUTHN_CRED_PROTECT_EXTENSION_IN, *PWEBAUTHN_CRED_PROTECT_EXTENSION_IN;
+typedef const WEBAUTHN_CRED_PROTECT_EXTENSION_IN *PCWEBAUTHN_CRED_PROTECT_EXTENSION_IN;
+
+
+#define WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_PROTECT L"credProtect"
+// Below type definitions is for WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_PROTECT
+// MakeCredential Input Type: WEBAUTHN_CRED_PROTECT_EXTENSION_IN.
+// - pvExtension must point to a WEBAUTHN_CRED_PROTECT_EXTENSION_IN struct
+// - cbExtension will contain the sizeof(WEBAUTHN_CRED_PROTECT_EXTENSION_IN).
+// MakeCredential Output Type: DWORD.
+// - pvExtension will point to a DWORD with one of the above WEBAUTHN_USER_VERIFICATION_* values
+// if credential was successfully created with CRED_PROTECT.
+// - cbExtension will contain the sizeof(DWORD).
+// GetAssertion Input Type: Not Supported
+// GetAssertion Output Type: Not Supported
+
+//+------------------------------------------------------------------------------------------
+// credBlob extension
+//-------------------------------------------------------------------------------------------
+
+typedef struct _WEBAUTHN_CRED_BLOB_EXTENSION {
+ // Size of pbCredBlob.
+ DWORD cbCredBlob;
+ _Field_size_bytes_(cbCredBlob)
+ PBYTE pbCredBlob;
+} WEBAUTHN_CRED_BLOB_EXTENSION, *PWEBAUTHN_CRED_BLOB_EXTENSION;
+typedef const WEBAUTHN_CRED_BLOB_EXTENSION *PCWEBAUTHN_CRED_BLOB_EXTENSION;
+
+
+#define WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_BLOB L"credBlob"
+// Below type definitions is for WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_BLOB
+// MakeCredential Input Type: WEBAUTHN_CRED_BLOB_EXTENSION.
+// - pvExtension must point to a WEBAUTHN_CRED_BLOB_EXTENSION struct
+// - cbExtension must contain the sizeof(WEBAUTHN_CRED_BLOB_EXTENSION).
+// MakeCredential Output Type: BOOL.
+// - pvExtension will point to a BOOL with the value TRUE if credBlob was successfully created
+// - cbExtension will contain the sizeof(BOOL).
+// GetAssertion Input Type: BOOL.
+// - pvExtension must point to a BOOL with the value TRUE to request the credBlob.
+// - cbExtension must contain the sizeof(BOOL).
+// GetAssertion Output Type: WEBAUTHN_CRED_BLOB_EXTENSION.
+// - pvExtension will point to a WEBAUTHN_CRED_BLOB_EXTENSION struct if the authenticator
+// returns the credBlob in the signed extensions
+// - cbExtension will contain the sizeof(WEBAUTHN_CRED_BLOB_EXTENSION).
+
+//+------------------------------------------------------------------------------------------
+// minPinLength extension
+//-------------------------------------------------------------------------------------------
+
+#define WEBAUTHN_EXTENSIONS_IDENTIFIER_MIN_PIN_LENGTH L"minPinLength"
+// Below type definitions is for WEBAUTHN_EXTENSIONS_IDENTIFIER_MIN_PIN_LENGTH
+// MakeCredential Input Type: BOOL.
+// - pvExtension must point to a BOOL with the value TRUE to request the minPinLength.
+// - cbExtension must contain the sizeof(BOOL).
+// MakeCredential Output Type: DWORD.
+// - pvExtension will point to a DWORD with the minimum pin length if returned by the authenticator
+// - cbExtension will contain the sizeof(DWORD).
+// GetAssertion Input Type: Not Supported
+// GetAssertion Output Type: Not Supported
+
+//+------------------------------------------------------------------------------------------
+// Information about Extensions.
+//-------------------------------------------------------------------------------------------
+typedef struct _WEBAUTHN_EXTENSION {
+ LPCWSTR pwszExtensionIdentifier;
+ DWORD cbExtension;
+ PVOID pvExtension;
+} WEBAUTHN_EXTENSION, *PWEBAUTHN_EXTENSION;
+typedef const WEBAUTHN_EXTENSION *PCWEBAUTHN_EXTENSION;
+
+typedef struct _WEBAUTHN_EXTENSIONS {
+ DWORD cExtensions;
+ _Field_size_(cExtensions)
+ PWEBAUTHN_EXTENSION pExtensions;
+} WEBAUTHN_EXTENSIONS, *PWEBAUTHN_EXTENSIONS;
+typedef const WEBAUTHN_EXTENSIONS *PCWEBAUTHN_EXTENSIONS;
+
+//+------------------------------------------------------------------------------------------
+// Options.
+//-------------------------------------------------------------------------------------------
+
+#define WEBAUTHN_AUTHENTICATOR_ATTACHMENT_ANY 0
+#define WEBAUTHN_AUTHENTICATOR_ATTACHMENT_PLATFORM 1
+#define WEBAUTHN_AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM 2
+#define WEBAUTHN_AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM_U2F_V2 3
+
+#define WEBAUTHN_USER_VERIFICATION_REQUIREMENT_ANY 0
+#define WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED 1
+#define WEBAUTHN_USER_VERIFICATION_REQUIREMENT_PREFERRED 2
+#define WEBAUTHN_USER_VERIFICATION_REQUIREMENT_DISCOURAGED 3
+
+#define WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_ANY 0
+#define WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_NONE 1
+#define WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_INDIRECT 2
+#define WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT 3
+
+#define WEBAUTHN_ENTERPRISE_ATTESTATION_NONE 0
+#define WEBAUTHN_ENTERPRISE_ATTESTATION_VENDOR_FACILITATED 1
+#define WEBAUTHN_ENTERPRISE_ATTESTATION_PLATFORM_MANAGED 2
+
+#define WEBAUTHN_LARGE_BLOB_SUPPORT_NONE 0
+#define WEBAUTHN_LARGE_BLOB_SUPPORT_REQUIRED 1
+#define WEBAUTHN_LARGE_BLOB_SUPPORT_PREFERRED 2
+
+#define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_1 1
+#define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_2 2
+#define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_3 3
+#define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_4 4
+#define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_5 5
+#define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_CURRENT_VERSION WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_5
+
+typedef struct _WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS {
+ // Version of this structure, to allow for modifications in the future.
+ DWORD dwVersion;
+
+ // Time that the operation is expected to complete within.
+ // This is used as guidance, and can be overridden by the platform.
+ DWORD dwTimeoutMilliseconds;
+
+ // Credentials used for exclusion.
+ WEBAUTHN_CREDENTIALS CredentialList;
+
+ // Optional extensions to parse when performing the operation.
+ WEBAUTHN_EXTENSIONS Extensions;
+
+ // Optional. Platform vs Cross-Platform Authenticators.
+ DWORD dwAuthenticatorAttachment;
+
+ // Optional. Require key to be resident or not. Defaulting to FALSE.
+ BOOL bRequireResidentKey;
+
+ // User Verification Requirement.
+ DWORD dwUserVerificationRequirement;
+
+ // Attestation Conveyance Preference.
+ DWORD dwAttestationConveyancePreference;
+
+ // Reserved for future Use
+ DWORD dwFlags;
+
+ //
+ // The following fields have been added in WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_2
+ //
+
+ // Cancellation Id - Optional - See WebAuthNGetCancellationId
+ GUID *pCancellationId;
+
+ //
+ // The following fields have been added in WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_3
+ //
+
+ // Exclude Credential List. If present, "CredentialList" will be ignored.
+ PWEBAUTHN_CREDENTIAL_LIST pExcludeCredentialList;
+
+ //
+ // The following fields have been added in WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_4
+ //
+
+ // Enterprise Attestation
+ DWORD dwEnterpriseAttestation;
+
+ // Large Blob Support: none, required or preferred
+ //
+ // NTE_INVALID_PARAMETER when large blob required or preferred and
+ // bRequireResidentKey isn't set to TRUE
+ DWORD dwLargeBlobSupport;
+
+ // Optional. Prefer key to be resident. Defaulting to FALSE. When TRUE,
+ // overrides the above bRequireResidentKey.
+ BOOL bPreferResidentKey;
+
+ //
+ // The following fields have been added in WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_5
+ //
+
+ // Optional. BrowserInPrivate Mode. Defaulting to FALSE.
+ BOOL bBrowserInPrivateMode;
+
+} WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS, *PWEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS;
+typedef const WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS *PCWEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS;
+
+#define WEBAUTHN_CRED_LARGE_BLOB_OPERATION_NONE 0
+#define WEBAUTHN_CRED_LARGE_BLOB_OPERATION_GET 1
+#define WEBAUTHN_CRED_LARGE_BLOB_OPERATION_SET 2
+#define WEBAUTHN_CRED_LARGE_BLOB_OPERATION_DELETE 3
+
+#define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_1 1
+#define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_2 2
+#define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_3 3
+#define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_4 4
+#define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_5 5
+#define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_6 6
+#define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_CURRENT_VERSION WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_6
+
+/*
+ Information about flags.
+*/
+
+#define WEBAUTHN_AUTHENTICATOR_HMAC_SECRET_VALUES_FLAG 0x00100000
+
+typedef struct _WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS {
+ // Version of this structure, to allow for modifications in the future.
+ DWORD dwVersion;
+
+ // Time that the operation is expected to complete within.
+ // This is used as guidance, and can be overridden by the platform.
+ DWORD dwTimeoutMilliseconds;
+
+ // Allowed Credentials List.
+ WEBAUTHN_CREDENTIALS CredentialList;
+
+ // Optional extensions to parse when performing the operation.
+ WEBAUTHN_EXTENSIONS Extensions;
+
+ // Optional. Platform vs Cross-Platform Authenticators.
+ DWORD dwAuthenticatorAttachment;
+
+ // User Verification Requirement.
+ DWORD dwUserVerificationRequirement;
+
+ // Flags
+ DWORD dwFlags;
+
+ //
+ // The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_2
+ //
+
+ // Optional identifier for the U2F AppId. Converted to UTF8 before being hashed. Not lower cased.
+ PCWSTR pwszU2fAppId;
+
+ // If the following is non-NULL, then, set to TRUE if the above pwszU2fAppid was used instead of
+ // PCWSTR pwszRpId;
+ BOOL *pbU2fAppId;
+
+ //
+ // The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_3
+ //
+
+ // Cancellation Id - Optional - See WebAuthNGetCancellationId
+ GUID *pCancellationId;
+
+ //
+ // The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_4
+ //
+
+ // Allow Credential List. If present, "CredentialList" will be ignored.
+ PWEBAUTHN_CREDENTIAL_LIST pAllowCredentialList;
+
+ //
+ // The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_5
+ //
+
+ DWORD dwCredLargeBlobOperation;
+
+ // Size of pbCredLargeBlob
+ DWORD cbCredLargeBlob;
+ _Field_size_bytes_(cbCredLargeBlob)
+ PBYTE pbCredLargeBlob;
+
+ //
+ // The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_6
+ //
+
+ // PRF values which will be converted into HMAC-SECRET values according to WebAuthn Spec.
+ PWEBAUTHN_HMAC_SECRET_SALT_VALUES pHmacSecretSaltValues;
+
+ // Optional. BrowserInPrivate Mode. Defaulting to FALSE.
+ BOOL bBrowserInPrivateMode;
+
+} WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS, *PWEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS;
+typedef const WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS *PCWEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS;
+
+
+//+------------------------------------------------------------------------------------------
+// Attestation Info.
+//
+//-------------------------------------------------------------------------------------------
+#define WEBAUTHN_ATTESTATION_DECODE_NONE 0
+#define WEBAUTHN_ATTESTATION_DECODE_COMMON 1
+// WEBAUTHN_ATTESTATION_DECODE_COMMON supports format types
+// L"packed"
+// L"fido-u2f"
+
+#define WEBAUTHN_ATTESTATION_VER_TPM_2_0 L"2.0"
+
+typedef struct _WEBAUTHN_X5C {
+ // Length of X.509 encoded certificate
+ DWORD cbData;
+ // X.509 encoded certificate bytes
+ _Field_size_bytes_(cbData)
+ PBYTE pbData;
+} WEBAUTHN_X5C, *PWEBAUTHN_X5C;
+
+// Supports either Self or Full Basic Attestation
+
+// Note, new fields will be added to the following data structure to
+// support additional attestation format types, such as, TPM.
+// When fields are added, the dwVersion will be incremented.
+//
+// Therefore, your code must make the following check:
+// "if (dwVersion >= WEBAUTHN_COMMON_ATTESTATION_CURRENT_VERSION)"
+
+#define WEBAUTHN_COMMON_ATTESTATION_CURRENT_VERSION 1
+
+typedef struct _WEBAUTHN_COMMON_ATTESTATION {
+ // Version of this structure, to allow for modifications in the future.
+ DWORD dwVersion;
+
+ // Hash and Padding Algorithm
+ //
+ // The following won't be set for "fido-u2f" which assumes "ES256".
+ PCWSTR pwszAlg;
+ LONG lAlg; // COSE algorithm
+
+ // Signature that was generated for this attestation.
+ DWORD cbSignature;
+ _Field_size_bytes_(cbSignature)
+ PBYTE pbSignature;
+
+ // Following is set for Full Basic Attestation. If not, set then, this is Self Attestation.
+ // Array of X.509 DER encoded certificates. The first certificate is the signer, leaf certificate.
+ DWORD cX5c;
+ _Field_size_(cX5c)
+ PWEBAUTHN_X5C pX5c;
+
+ // Following are also set for tpm
+ PCWSTR pwszVer; // L"2.0"
+ DWORD cbCertInfo;
+ _Field_size_bytes_(cbCertInfo)
+ PBYTE pbCertInfo;
+ DWORD cbPubArea;
+ _Field_size_bytes_(cbPubArea)
+ PBYTE pbPubArea;
+} WEBAUTHN_COMMON_ATTESTATION, *PWEBAUTHN_COMMON_ATTESTATION;
+typedef const WEBAUTHN_COMMON_ATTESTATION *PCWEBAUTHN_COMMON_ATTESTATION;
+
+#define WEBAUTHN_ATTESTATION_TYPE_PACKED L"packed"
+#define WEBAUTHN_ATTESTATION_TYPE_U2F L"fido-u2f"
+#define WEBAUTHN_ATTESTATION_TYPE_TPM L"tpm"
+#define WEBAUTHN_ATTESTATION_TYPE_NONE L"none"
+
+#define WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_1 1
+#define WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_2 2
+#define WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_3 3
+#define WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_4 4
+#define WEBAUTHN_CREDENTIAL_ATTESTATION_CURRENT_VERSION WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_4
+
+typedef struct _WEBAUTHN_CREDENTIAL_ATTESTATION {
+ // Version of this structure, to allow for modifications in the future.
+ DWORD dwVersion;
+
+ // Attestation format type
+ PCWSTR pwszFormatType;
+
+ // Size of cbAuthenticatorData.
+ DWORD cbAuthenticatorData;
+ // Authenticator data that was created for this credential.
+ _Field_size_bytes_(cbAuthenticatorData)
+ PBYTE pbAuthenticatorData;
+
+ // Size of CBOR encoded attestation information
+ //0 => encoded as CBOR null value.
+ DWORD cbAttestation;
+ //Encoded CBOR attestation information
+ _Field_size_bytes_(cbAttestation)
+ PBYTE pbAttestation;
+
+ DWORD dwAttestationDecodeType;
+ // Following depends on the dwAttestationDecodeType
+ // WEBAUTHN_ATTESTATION_DECODE_NONE
+ // NULL - not able to decode the CBOR attestation information
+ // WEBAUTHN_ATTESTATION_DECODE_COMMON
+ // PWEBAUTHN_COMMON_ATTESTATION;
+ PVOID pvAttestationDecode;
+
+ // The CBOR encoded Attestation Object to be returned to the RP.
+ DWORD cbAttestationObject;
+ _Field_size_bytes_(cbAttestationObject)
+ PBYTE pbAttestationObject;
+
+ // The CredentialId bytes extracted from the Authenticator Data.
+ // Used by Edge to return to the RP.
+ DWORD cbCredentialId;
+ _Field_size_bytes_(cbCredentialId)
+ PBYTE pbCredentialId;
+
+ //
+ // Following fields have been added in WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_2
+ //
+
+ WEBAUTHN_EXTENSIONS Extensions;
+
+ //
+ // Following fields have been added in WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_3
+ //
+
+ // One of the WEBAUTHN_CTAP_TRANSPORT_* bits will be set corresponding to
+ // the transport that was used.
+ DWORD dwUsedTransport;
+
+ //
+ // Following fields have been added in WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_4
+ //
+
+ BOOL bEpAtt;
+ BOOL bLargeBlobSupported;
+ BOOL bResidentKey;
+
+} WEBAUTHN_CREDENTIAL_ATTESTATION, *PWEBAUTHN_CREDENTIAL_ATTESTATION;
+typedef const WEBAUTHN_CREDENTIAL_ATTESTATION *PCWEBAUTHN_CREDENTIAL_ATTESTATION;
+
+
+//+------------------------------------------------------------------------------------------
+// authenticatorGetAssertion output.
+//-------------------------------------------------------------------------------------------
+
+#define WEBAUTHN_CRED_LARGE_BLOB_STATUS_NONE 0
+#define WEBAUTHN_CRED_LARGE_BLOB_STATUS_SUCCESS 1
+#define WEBAUTHN_CRED_LARGE_BLOB_STATUS_NOT_SUPPORTED 2
+#define WEBAUTHN_CRED_LARGE_BLOB_STATUS_INVALID_DATA 3
+#define WEBAUTHN_CRED_LARGE_BLOB_STATUS_INVALID_PARAMETER 4
+#define WEBAUTHN_CRED_LARGE_BLOB_STATUS_NOT_FOUND 5
+#define WEBAUTHN_CRED_LARGE_BLOB_STATUS_MULTIPLE_CREDENTIALS 6
+#define WEBAUTHN_CRED_LARGE_BLOB_STATUS_LACK_OF_SPACE 7
+#define WEBAUTHN_CRED_LARGE_BLOB_STATUS_PLATFORM_ERROR 8
+#define WEBAUTHN_CRED_LARGE_BLOB_STATUS_AUTHENTICATOR_ERROR 9
+
+#define WEBAUTHN_ASSERTION_VERSION_1 1
+#define WEBAUTHN_ASSERTION_VERSION_2 2
+#define WEBAUTHN_ASSERTION_VERSION_3 3
+#define WEBAUTHN_ASSERTION_CURRENT_VERSION WEBAUTHN_ASSERTION_VERSION_3
+
+typedef struct _WEBAUTHN_ASSERTION {
+ // Version of this structure, to allow for modifications in the future.
+ DWORD dwVersion;
+
+ // Size of cbAuthenticatorData.
+ DWORD cbAuthenticatorData;
+ // Authenticator data that was created for this assertion.
+ _Field_size_bytes_(cbAuthenticatorData)
+ PBYTE pbAuthenticatorData;
+
+ // Size of pbSignature.
+ DWORD cbSignature;
+ // Signature that was generated for this assertion.
+ _Field_size_bytes_(cbSignature)
+ PBYTE pbSignature;
+
+ // Credential that was used for this assertion.
+ WEBAUTHN_CREDENTIAL Credential;
+
+ // Size of User Id
+ DWORD cbUserId;
+ // UserId
+ _Field_size_bytes_(cbUserId)
+ PBYTE pbUserId;
+
+ //
+ // Following fields have been added in WEBAUTHN_ASSERTION_VERSION_2
+ //
+
+ WEBAUTHN_EXTENSIONS Extensions;
+
+ // Size of pbCredLargeBlob
+ DWORD cbCredLargeBlob;
+ _Field_size_bytes_(cbCredLargeBlob)
+ PBYTE pbCredLargeBlob;
+
+ DWORD dwCredLargeBlobStatus;
+
+ //
+ // Following fields have been added in WEBAUTHN_ASSERTION_VERSION_3
+ //
+
+ PWEBAUTHN_HMAC_SECRET_SALT pHmacSecret;
+
+} WEBAUTHN_ASSERTION, *PWEBAUTHN_ASSERTION;
+typedef const WEBAUTHN_ASSERTION *PCWEBAUTHN_ASSERTION;
+
+//+------------------------------------------------------------------------------------------
+// APIs.
+//-------------------------------------------------------------------------------------------
+
+DWORD
+WINAPI
+WebAuthNGetApiVersionNumber();
+
+HRESULT
+WINAPI
+WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable(
+ _Out_ BOOL *pbIsUserVerifyingPlatformAuthenticatorAvailable);
+
+
+HRESULT
+WINAPI
+WebAuthNAuthenticatorMakeCredential(
+ _In_ HWND hWnd,
+ _In_ PCWEBAUTHN_RP_ENTITY_INFORMATION pRpInformation,
+ _In_ PCWEBAUTHN_USER_ENTITY_INFORMATION pUserInformation,
+ _In_ PCWEBAUTHN_COSE_CREDENTIAL_PARAMETERS pPubKeyCredParams,
+ _In_ PCWEBAUTHN_CLIENT_DATA pWebAuthNClientData,
+ _In_opt_ PCWEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS pWebAuthNMakeCredentialOptions,
+ _Outptr_result_maybenull_ PWEBAUTHN_CREDENTIAL_ATTESTATION *ppWebAuthNCredentialAttestation);
+
+
+HRESULT
+WINAPI
+WebAuthNAuthenticatorGetAssertion(
+ _In_ HWND hWnd,
+ _In_ LPCWSTR pwszRpId,
+ _In_ PCWEBAUTHN_CLIENT_DATA pWebAuthNClientData,
+ _In_opt_ PCWEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS pWebAuthNGetAssertionOptions,
+ _Outptr_result_maybenull_ PWEBAUTHN_ASSERTION *ppWebAuthNAssertion);
+
+void
+WINAPI
+WebAuthNFreeCredentialAttestation(
+ _In_opt_ PWEBAUTHN_CREDENTIAL_ATTESTATION pWebAuthNCredentialAttestation);
+
+void
+WINAPI
+WebAuthNFreeAssertion(
+ _In_ PWEBAUTHN_ASSERTION pWebAuthNAssertion);
+
+HRESULT
+WINAPI
+WebAuthNGetCancellationId(
+ _Out_ GUID* pCancellationId);
+
+HRESULT
+WINAPI
+WebAuthNCancelCurrentOperation(
+ _In_ const GUID* pCancellationId);
+
+// Returns NTE_NOT_FOUND when credentials are not found.
+HRESULT
+WINAPI
+WebAuthNGetPlatformCredentialList(
+ _In_ PCWEBAUTHN_GET_CREDENTIALS_OPTIONS pGetCredentialsOptions,
+ _Outptr_result_maybenull_ PWEBAUTHN_CREDENTIAL_DETAILS_LIST *ppCredentialDetailsList);
+
+void
+WINAPI
+WebAuthNFreePlatformCredentialList(
+ _In_ PWEBAUTHN_CREDENTIAL_DETAILS_LIST pCredentialDetailsList);
+
+HRESULT
+WINAPI
+WebAuthNDeletePlatformCredential(
+ _In_ DWORD cbCredentialId,
+ _In_reads_bytes_(cbCredentialId) const BYTE *pbCredentialId
+ );
+
+//
+// Returns the following Error Names:
+// L"Success" - S_OK
+// L"InvalidStateError" - NTE_EXISTS
+// L"ConstraintError" - HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED),
+// NTE_NOT_SUPPORTED,
+// NTE_TOKEN_KEYSET_STORAGE_FULL
+// L"NotSupportedError" - NTE_INVALID_PARAMETER
+// L"NotAllowedError" - NTE_DEVICE_NOT_FOUND,
+// NTE_NOT_FOUND,
+// HRESULT_FROM_WIN32(ERROR_CANCELLED),
+// NTE_USER_CANCELLED,
+// HRESULT_FROM_WIN32(ERROR_TIMEOUT)
+// L"UnknownError" - All other hr values
+//
+PCWSTR
+WINAPI
+WebAuthNGetErrorName(
+ _In_ HRESULT hr);
+
+HRESULT
+WINAPI
+WebAuthNGetW3CExceptionDOMError(
+ _In_ HRESULT hr);
+
+
+#ifdef __cplusplus
+} // Balance extern "C" above
+#endif
+
+#endif // WINAPI_FAMILY_PARTITION
+#pragma endregion
+
+#endif // __WEBAUTHN_H_