Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-06-25 08:26
📄 __init__.py # Copyright 2016 Google Inc. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Library for Universal 2nd factor authentication."""	651 B	2025-02-24 20:22
📄 apdu.py # Copyright 2016 Google Inc. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Implement the U2F variant of ISO 7816 extended APDU. This module implements a subset ISO 7816 APDU encoding. In particular, it only supports extended length encoding, it only supports commands that expect a reply, and it does not support explicitly specifying the length of the expected reply. It also implements the U2F variant of ISO 7816 where the Lc field is always specified, even if there is no data. """ import struct from pyu2f import errors CMD_REGISTER = 0x01 CMD_AUTH = 0x02 CMD_VERSION = 0x03 class CommandApdu(object): """Represents a Command APDU. Represents a Command APDU sent to the security key. Encoding is specified in FIDO U2F standards. """ cla = None ins = None p1 = None p2 = None data = None def __init__(self, cla, ins, p1, p2, data=None): self.cla = cla self.ins = ins self.p1 = p1 self.p2 = p2 if data and len(data) > 65535: raise errors.InvalidCommandError() if data: self.data = data def ToByteArray(self): """Serialize the command. Encodes the command as per the U2F specs, using the standard ISO 7816-4 extended encoding. All Commands expect data, so Le is always present. Returns: Python bytearray of the encoded command. """ lc = self.InternalEncodeLc() out = bytearray(4) # will extend out[0] = self.cla out[1] = self.ins out[2] = self.p1 out[3] = self.p2 if self.data: out.extend(lc) out.extend(self.data) out.extend([0x00, 0x00]) # Le else: out.extend([0x00, 0x00, 0x00]) # Le return out def ToLegacyU2FByteArray(self): """Serialize the command in the legacy format. Encodes the command as per the U2F specs, using the legacy encoding in which LC is always present. Returns: Python bytearray of the encoded command. """ lc = self.InternalEncodeLc() out = bytearray(4) # will extend out[0] = self.cla out[1] = self.ins out[2] = self.p1 out[3] = self.p2 out.extend(lc) if self.data: out.extend(self.data) out.extend([0x00, 0x00]) # Le return out def InternalEncodeLc(self): dl = 0 if self.data: dl = len(self.data) # The top two bytes are guaranteed to be 0 by the assertion # in the constructor. fourbyte = struct.pack('>I', dl) return bytearray(fourbyte[1:]) class ResponseApdu(object): """Represents a Response APDU. Represents a Response APU sent by the security key. Encoding is specified in FIDO U2F standards. """ body = None sw1 = None sw2 = None def __init__(self, data): self.dbg_full_packet = data if not data or len(data) < 2: raise errors.InvalidResponseError() if len(data) > 2: self.body = data[:-2] self.sw1 = data[-2] self.sw2 = data[-1] def IsSuccess(self): return self.sw1 == 0x90 and self.sw2 == 0x00 def CheckSuccessOrRaise(self): if self.sw1 == 0x69 and self.sw2 == 0x85: # SW_CONDITIONS_NOT_SATISFIED raise errors.TUPRequiredError() elif self.sw1 == 0x6a and self.sw2 == 0x80: # SW_WRONG_DATA raise errors.InvalidKeyHandleError() elif self.sw1 == 0x67 and self.sw2 == 0x00: # SW_WRONG_LENGTH raise errors.InvalidKeyHandleError() elif not self.IsSuccess(): raise errors.ApduError(self.sw1, self.sw2)	3.85 KB	2025-02-24 20:22
📁 convenience	-	2025-06-25 08:26
📄 errors.py # Copyright 2016 Google Inc. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Exceptions that can be raised by the pyu2f library. All exceptions that can be raised by the pyu2f library. Most of these are internal coditions, but U2FError and NoDeviceFoundError are public errors that clients should expect to handle. """ class NoDeviceFoundError(Exception): pass class U2FError(Exception): OK = 0 OTHER_ERROR = 1 BAD_REQUEST = 2 CONFIGURATION_UNSUPPORTED = 3 DEVICE_INELIGIBLE = 4 TIMEOUT = 5 def __init__(self, code, cause=None): self.code = code if cause: self.cause = cause super(U2FError, self).__init__("U2F Error code: %d (cause: %s)" % (code, str(cause))) class HidError(Exception): """Errors in the hid usb transport protocol.""" pass class InvalidPacketError(HidError): pass class HardwareError(Exception): """Errors in the security key hardware that are transport independent.""" pass class InvalidRequestError(HardwareError): pass class ApduError(HardwareError): def __init__(self, sw1, sw2): self.sw1 = sw1 self.sw2 = sw2 super(ApduError, self).__init__("Device returned status: %d %d" % (sw1, sw2)) class TUPRequiredError(HardwareError): pass class InvalidKeyHandleError(HardwareError): pass class UnsupportedVersionException(Exception): pass class InvalidCommandError(Exception): pass class InvalidResponseError(Exception): pass class InvalidModelError(Exception): pass class OsHidError(Exception): pass class PluginError(Exception): pass	2.1 KB	2025-02-24 20:22
📄 hardware.py # Copyright 2016 Google Inc. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """This module implements the low level device API. This module exposes a low level SecurityKey class, representing the physical security key device. """ import logging from pyu2f import apdu from pyu2f import errors class SecurityKey(object): """Low level api for talking to a security key. This class implements the low level api specified in FIDO U2F for talking to a security key. """ def __init__(self, transport): self.transport = transport self.use_legacy_format = False self.logger = logging.getLogger('pyu2f.hardware') def CmdRegister(self, challenge_param, app_param): """Register security key. Ask the security key to register with a particular origin & client. Args: challenge_param: Arbitrary 32 byte challenge string. app_param: Arbitrary 32 byte applciation parameter. Returns: A binary structure containing the key handle, attestation, and a signature over that by the attestation key. The precise format is dictated by the FIDO U2F specs. Raises: TUPRequiredError: A Test of User Precense is required to proceed. ApduError: Something went wrong on the device. """ self.logger.debug('CmdRegister') if len(challenge_param) != 32 or len(app_param) != 32: raise errors.InvalidRequestError() body = bytearray(challenge_param + app_param) response = self.InternalSendApdu(apdu.CommandApdu( 0, apdu.CMD_REGISTER, 0x03, # Per the U2F reference code tests 0x00, body)) response.CheckSuccessOrRaise() return response.body def CmdAuthenticate(self, challenge_param, app_param, key_handle, check_only=False): """Attempt to obtain an authentication signature. Ask the security key to sign a challenge for a particular key handle in order to authenticate the user. Args: challenge_param: SHA-256 hash of client_data object as a bytes object. app_param: SHA-256 hash of the app id as a bytes object. key_handle: The key handle to use to issue the signature as a bytes object. check_only: If true, only check if key_handle is valid. Returns: A binary structure containing the key handle, attestation, and a signature over that by the attestation key. The precise format is dictated by the FIDO U2F specs. Raises: TUPRequiredError: If check_only is False, a Test of User Precense is required to proceed. If check_only is True, this means the key_handle is valid. InvalidKeyHandleError: The key_handle is not valid for this device. ApduError: Something else went wrong on the device. """ self.logger.debug('CmdAuthenticate') if len(challenge_param) != 32 or len(app_param) != 32: raise errors.InvalidRequestError() control = 0x07 if check_only else 0x03 body = bytearray(challenge_param + app_param + bytearray([len(key_handle)]) + key_handle) response = self.InternalSendApdu(apdu.CommandApdu( 0, apdu.CMD_AUTH, control, 0x00, body)) response.CheckSuccessOrRaise() return response.body def CmdVersion(self): """Obtain the version of the device and test transport format. Obtains the version of the device and determines whether to use ISO 7816-4 or the U2f variant. This function should be called at least once before CmdAuthenticate or CmdRegister to make sure the object is using the proper transport for the device. Returns: The version of the U2F protocol in use. """ self.logger.debug('CmdVersion') response = self.InternalSendApdu(apdu.CommandApdu( 0, apdu.CMD_VERSION, 0x00, 0x00)) if not response.IsSuccess(): raise errors.ApduError(response.sw1, response.sw2) return response.body def CmdBlink(self, time): self.logger.debug('CmdBlink') self.transport.SendBlink(time) def CmdWink(self): self.logger.debug('CmdWink') self.transport.SendWink() def CmdPing(self, data): self.logger.debug('CmdPing') return self.transport.SendPing(data) def InternalSendApdu(self, apdu_to_send): """Send an APDU to the device. Sends an APDU to the device, possibly falling back to the legacy encoding format that is not ISO7816-4 compatible. Args: apdu_to_send: The CommandApdu object to send Returns: The ResponseApdu object constructed out of the devices reply. """ response = None if not self.use_legacy_format: response = apdu.ResponseApdu(self.transport.SendMsgBytes( apdu_to_send.ToByteArray())) if response.sw1 == 0x67 and response.sw2 == 0x00: # If we failed using the standard format, retry with the # legacy format. self.use_legacy_format = True return self.InternalSendApdu(apdu_to_send) else: response = apdu.ResponseApdu(self.transport.SendMsgBytes( apdu_to_send.ToLegacyU2FByteArray())) return response	5.57 KB	2025-02-24 20:22
📁 hid	-	2025-06-25 08:26
📄 hidtransport.py # Copyright 2016 Google Inc. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """HID Transport for U2F. This module imports the U2F HID Transport protocol as well as methods for discovering devices implementing this protocol. """ import logging import os import struct import time from pyu2f import errors from pyu2f import hid def HidUsageSelector(device): if device['usage_page'] == 0xf1d0 and device['usage'] == 0x01: return True return False def DiscoverLocalHIDU2FDevices(selector=HidUsageSelector): for d in hid.Enumerate(): if selector(d): try: dev = hid.Open(d['path']) yield UsbHidTransport(dev) except OSError: # Insufficient permissions to access device pass class UsbHidTransport(object): """Implements the U2FHID transport protocol. This class implements the U2FHID transport protocol from the FIDO U2F specs. This protocol manages fragmenting longer messages over a short hid frame (usually 64 bytes). It exposes an APDU channel through the MSG command as well as a series of other commands for configuring and interacting with the device. """ U2FHID_PING = 0x81 U2FHID_MSG = 0x83 U2FHID_WINK = 0x88 U2FHID_PROMPT = 0x87 U2FHID_INIT = 0x86 U2FHID_LOCK = 0x84 U2FHID_ERROR = 0xbf U2FHID_SYNC = 0xbc U2FHID_BROADCAST_CID = bytearray([0xff, 0xff, 0xff, 0xff]) ERR_CHANNEL_BUSY = bytearray([0x06]) class InitPacket(object): """Represent an initial U2FHID packet. Represent an initial U2FHID packet. This packet contains metadata necessary to interpret the entire packet stream associated with a particular exchange (read or write). Attributes: packet_size: The size of the hid report (packet) used. Usually 64. cid: The channel id for the connection to the device. size: The size of the entire message to be sent (including all continuation packets) payload: The portion of the message to put into the init packet. This must be smaller than packet_size - 7 (the overhead for an init packet). """ def __init__(self, packet_size, cid, cmd, size, payload): self.packet_size = packet_size if len(cid) != 4 or cmd > 255 or size >= 2**16: raise errors.InvalidPacketError() if len(payload) > self.packet_size - 7: raise errors.InvalidPacketError() self.cid = cid # byte array self.cmd = cmd # number self.size = size # number (full size of message) self.payload = payload # byte array (for first packet) def ToWireFormat(self): """Serializes the packet.""" ret = bytearray(64) ret[0:4] = self.cid ret[4] = self.cmd struct.pack_into('>H', ret, 5, self.size) ret[7:7 + len(self.payload)] = self.payload return list(map(int, ret)) @staticmethod def FromWireFormat(packet_size, data): """Derializes the packet. Deserializes the packet from wire format. Args: packet_size: The size of all packets (usually 64) data: List of ints or bytearray containing the data from the wire. Returns: InitPacket object for specified data Raises: InvalidPacketError: if the data isn't a valid InitPacket """ ba = bytearray(data) if len(ba) != packet_size: raise errors.InvalidPacketError() cid = ba[0:4] cmd = ba[4] size = struct.unpack('>H', bytes(ba[5:7]))[0] payload = ba[7:7 + size] # might truncate at packet_size return UsbHidTransport.InitPacket(packet_size, cid, cmd, size, payload) class ContPacket(object): """Represents a continutation U2FHID packet. Represents a continutation U2FHID packet. These packets follow the intial packet and contains the remaining data in a particular message. Attributes: packet_size: The size of the hid report (packet) used. Usually 64. cid: The channel id for the connection to the device. seq: The sequence number for this continuation packet. The first continuation packet is 0 and it increases from there. payload: The payload to put into this continuation packet. This must be less than packet_size - 5 (the overhead of the continuation packet is 5). """ def __init__(self, packet_size, cid, seq, payload): self.packet_size = packet_size self.cid = cid self.seq = seq self.payload = payload if len(payload) > self.packet_size - 5: raise errors.InvalidPacketError() if seq > 127: raise errors.InvalidPacketError() def ToWireFormat(self): """Serializes the packet.""" ret = bytearray(self.packet_size) ret[0:4] = self.cid ret[4] = self.seq ret[5:5 + len(self.payload)] = self.payload return list(map(int, ret)) @staticmethod def FromWireFormat(packet_size, data): """Derializes the packet. Deserializes the packet from wire format. Args: packet_size: The size of all packets (usually 64) data: List of ints or bytearray containing the data from the wire. Returns: InitPacket object for specified data Raises: InvalidPacketError: if the data isn't a valid ContPacket """ ba = bytearray(data) if len(ba) != packet_size: raise errors.InvalidPacketError() cid = ba[0:4] seq = ba[4] # We don't know the size limit a priori here without seeing the init # packet, so truncation needs to be done in the higher level protocol # handling code, unlike the degenerate case of a 1 packet message in an # init packet, where the size is known. payload = ba[5:] return UsbHidTransport.ContPacket(packet_size, cid, seq, payload) def __init__(self, hid_device, read_timeout_secs=3.0): self.hid_device = hid_device in_size = hid_device.GetInReportDataLength() out_size = hid_device.GetOutReportDataLength() if in_size != out_size: raise errors.HardwareError( 'unsupported device with different in/out packet sizes.') if in_size == 0: raise errors.HardwareError('unable to determine packet size') self.packet_size = in_size self.read_timeout_secs = read_timeout_secs self.logger = logging.getLogger('pyu2f.hidtransport') self.InternalInit() def SendMsgBytes(self, msg): r = self.InternalExchange(UsbHidTransport.U2FHID_MSG, msg) return r def SendBlink(self, length): return self.InternalExchange(UsbHidTransport.U2FHID_PROMPT, bytearray([length])) def SendWink(self): return self.InternalExchange(UsbHidTransport.U2FHID_WINK, bytearray([])) def SendPing(self, data): return self.InternalExchange(UsbHidTransport.U2FHID_PING, data) def InternalInit(self): """Initializes the device and obtains channel id.""" self.cid = UsbHidTransport.U2FHID_BROADCAST_CID nonce = bytearray(os.urandom(8)) r = self.InternalExchange(UsbHidTransport.U2FHID_INIT, nonce) if len(r) < 17: raise errors.HidError('unexpected init reply len') if r[0:8] != nonce: raise errors.HidError('nonce mismatch') self.cid = bytearray(r[8:12]) self.u2fhid_version = r[12] def InternalExchange(self, cmd, payload_in): """Sends and receives a message from the device.""" # make a copy because we destroy it below self.logger.debug('payload: ' + str(list(payload_in))) payload = bytearray() payload[:] = payload_in for _ in range(2): self.InternalSend(cmd, payload) ret_cmd, ret_payload = self.InternalRecv() if ret_cmd == UsbHidTransport.U2FHID_ERROR: if ret_payload == UsbHidTransport.ERR_CHANNEL_BUSY: time.sleep(0.5) continue raise errors.HidError('Device error: %d' % int(ret_payload[0])) elif ret_cmd != cmd: raise errors.HidError('Command mismatch!') return ret_payload raise errors.HidError('Device Busy. Please retry') def InternalSend(self, cmd, payload): """Sends a message to the device, including fragmenting it.""" length_to_send = len(payload) max_payload = self.packet_size - 7 first_frame = payload[0:max_payload] first_packet = UsbHidTransport.InitPacket(self.packet_size, self.cid, cmd, len(payload), first_frame) del payload[0:max_payload] length_to_send -= len(first_frame) self.InternalSendPacket(first_packet) seq = 0 while length_to_send > 0: max_payload = self.packet_size - 5 next_frame = payload[0:max_payload] del payload[0:max_payload] length_to_send -= len(next_frame) next_packet = UsbHidTransport.ContPacket(self.packet_size, self.cid, seq, next_frame) self.InternalSendPacket(next_packet) seq += 1 def InternalSendPacket(self, packet): wire = packet.ToWireFormat() self.logger.debug('sending packet: ' + str(wire)) self.hid_device.Write(wire) def InternalReadFrame(self): # TODO(gdasher): Figure out timeouts. Today, this implementation # blocks forever at the HID level waiting for a response to a report. # This may not be reasonable behavior (though in practice in seems to be # OK on the set of devices and machines tested so far). frame = self.hid_device.Read() self.logger.debug('recv: ' + str(frame)) return frame def InternalRecv(self): """Receives a message from the device, including defragmenting it.""" first_read = self.InternalReadFrame() first_packet = UsbHidTransport.InitPacket.FromWireFormat(self.packet_size, first_read) data = first_packet.payload to_read = first_packet.size - len(first_packet.payload) seq = 0 while to_read > 0: next_read = self.InternalReadFrame() next_packet = UsbHidTransport.ContPacket.FromWireFormat(self.packet_size, next_read) if self.cid != next_packet.cid: # Skip over packets that are for communication with other clients. # HID is broadcast, so we see potentially all communication from the # device. For well-behaved devices, these should be BUSY messages # sent to other clients of the device because at this point we're # in mid-message transit. continue if seq != next_packet.seq: raise errors.HardwareError('Packets received out of order') # This packet for us at this point, so debit it against our # balance of bytes to read. to_read -= len(next_packet.payload) data.extend(next_packet.payload) seq += 1 # truncate incomplete frames data = data[0:first_packet.size] return (first_packet.cmd, data)	11.19 KB	2025-02-24 20:22
📄 model.py # Copyright 2016 Google Inc. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Implements data model for the library. This module implements basic data model objects that are necessary for interacting with the Security Key as well as for implementing the higher level components of the U2F protocol. """ import base64 import json from pyu2f import errors class ClientData(object): """FIDO U2F ClientData. Implements the ClientData object of the FIDO U2F protocol. """ TYP_AUTHENTICATION = 'navigator.id.getAssertion' TYP_REGISTRATION = 'navigator.id.finishEnrollment' def __init__(self, typ, raw_server_challenge, origin): if typ not in [ClientData.TYP_REGISTRATION, ClientData.TYP_AUTHENTICATION]: raise errors.InvalidModelError() self.typ = typ self.raw_server_challenge = raw_server_challenge self.origin = origin def GetJson(self): """Returns JSON version of ClientData compatible with FIDO spec.""" # The U2F Raw Messages specification specifies that the challenge is encoded # with URL safe Base64 without padding encoding specified in RFC 4648. # Python does not natively support a paddingless encoding, so we simply # remove the padding from the end of the string. server_challenge_b64 = base64.urlsafe_b64encode( self.raw_server_challenge).decode() server_challenge_b64 = server_challenge_b64.rstrip('=') return json.dumps({'typ': self.typ, 'challenge': server_challenge_b64, 'origin': self.origin}, sort_keys=True) def __repr__(self): return self.GetJson() class RegisteredKey(object): def __init__(self, key_handle, version=u'U2F_V2'): self.key_handle = key_handle self.version = version class RegisterResponse(object): def __init__(self, registration_data, client_data): self.registration_data = registration_data self.client_data = client_data class SignResponse(object): def __init__(self, key_handle, signature_data, client_data): self.key_handle = key_handle self.signature_data = signature_data self.client_data = client_data	2.58 KB	2025-02-24 20:22
📁 tests	-	2025-02-24 20:22
📄 u2f.py # Copyright 2016 Google Inc. All Rights Reserved. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. """Implement a high level U2F API analogous to the javascript API spec. This modules implements a high level U2F API that is analogous in spirit to the high level U2F javascript API. It supports both registration and authetication. For the purposes of this API, the "origin" is the hostname of the machine this library is running on. """ import hashlib import socket import time from pyu2f import errors from pyu2f import hardware from pyu2f import hidtransport from pyu2f import model def GetLocalU2FInterface(origin=socket.gethostname()): """Obtains a U2FInterface for the first valid local U2FHID device found.""" hid_transports = hidtransport.DiscoverLocalHIDU2FDevices() for t in hid_transports: try: return U2FInterface(security_key=hardware.SecurityKey(transport=t), origin=origin) except errors.UnsupportedVersionException: # Skip over devices that don't speak the proper version of the protocol. pass # Unable to find a device raise errors.NoDeviceFoundError() class U2FInterface(object): """High level U2F interface. Implements a high level interface in the spirit of the FIDO U2F javascript API high level interface. It supports registration and authentication (signing). IMPORTANT NOTE: This class does NOT validate the app id against the origin. In particular, any user can assert any app id all the way to the device. The security model of a python library is such that doing so would not provide significant benfit as it could be bypassed by the caller talking to a lower level of the API. In fact, so could the origin itself. The origin is still set to a plausible value (the hostname) by this library. TODO(gdasher): Figure out a plan on how to address this gap/document the consequences of this more clearly. """ def __init__(self, security_key, origin=socket.gethostname()): self.origin = origin self.security_key = security_key if self.security_key.CmdVersion() != b'U2F_V2': raise errors.UnsupportedVersionException() def Register(self, app_id, challenge, registered_keys): """Registers app_id with the security key. Executes the U2F registration flow with the security key. Args: app_id: The app_id to register the security key against. challenge: Server challenge passed to the security key. registered_keys: List of keys already registered for this app_id+user. Returns: RegisterResponse with key_handle and attestation information in it ( encoded in FIDO U2F binary format within registration_data field). Raises: U2FError: There was some kind of problem with registration (e.g. the device was already registered or there was a timeout waiting for the test of user presence). """ client_data = model.ClientData(model.ClientData.TYP_REGISTRATION, challenge, self.origin) challenge_param = self.InternalSHA256(client_data.GetJson()) app_param = self.InternalSHA256(app_id) for key in registered_keys: try: # skip non U2F_V2 keys if key.version != u'U2F_V2': continue resp = self.security_key.CmdAuthenticate(challenge_param, app_param, key.key_handle, True) # check_only mode CmdAuthenticate should always raise some # exception raise errors.HardwareError('Should Never Happen') except errors.TUPRequiredError: # This indicates key was valid. Thus, no need to register raise errors.U2FError(errors.U2FError.DEVICE_INELIGIBLE) except errors.InvalidKeyHandleError as e: # This is the case of a key for a different token, so we just ignore it. pass except errors.HardwareError as e: raise errors.U2FError(errors.U2FError.BAD_REQUEST, e) # Now register the new key for _ in range(30): try: resp = self.security_key.CmdRegister(challenge_param, app_param) return model.RegisterResponse(resp, client_data) except errors.TUPRequiredError as e: self.security_key.CmdWink() time.sleep(0.5) except errors.HardwareError as e: raise errors.U2FError(errors.U2FError.BAD_REQUEST, e) raise errors.U2FError(errors.U2FError.TIMEOUT) def Authenticate(self, app_id, challenge, registered_keys): """Authenticates app_id with the security key. Executes the U2F authentication/signature flow with the security key. Args: app_id: The app_id to register the security key against. challenge: Server challenge passed to the security key as a bytes object. registered_keys: List of keys already registered for this app_id+user. Returns: SignResponse with client_data, key_handle, and signature_data. The client data is an object, while the signature_data is encoded in FIDO U2F binary format. Raises: U2FError: There was some kind of problem with authentication (e.g. there was a timeout while waiting for the test of user presence.) """ client_data = model.ClientData(model.ClientData.TYP_AUTHENTICATION, challenge, self.origin) app_param = self.InternalSHA256(app_id) challenge_param = self.InternalSHA256(client_data.GetJson()) num_invalid_keys = 0 for key in registered_keys: try: if key.version != u'U2F_V2': continue for _ in range(30): try: resp = self.security_key.CmdAuthenticate(challenge_param, app_param, key.key_handle) return model.SignResponse(key.key_handle, resp, client_data) except errors.TUPRequiredError: self.security_key.CmdWink() time.sleep(0.5) except errors.InvalidKeyHandleError: num_invalid_keys += 1 continue except errors.HardwareError as e: raise errors.U2FError(errors.U2FError.BAD_REQUEST, e) if num_invalid_keys == len(registered_keys): # In this case, all provided keys were invalid. raise errors.U2FError(errors.U2FError.DEVICE_INELIGIBLE) # In this case, the TUP was not pressed. raise errors.U2FError(errors.U2FError.TIMEOUT) def InternalSHA256(self, string): md = hashlib.sha256() md.update(string.encode()) return md.digest()	6.87 KB	2025-02-24 20:22

Terminal