Skip to content

Fixes the error code for blocked UV #755

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 20, 2025
Merged

Fixes the error code for blocked UV #755

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1362a4a
Fixes the error code for blocked UV
kaczmarczyck Oct 20, 2025
2c24bf9
Code style suggestion fix
kaczmarczyck Oct 20, 2025
3099294
Fixes documentation with private repo links
kaczmarczyck Oct 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions libraries/opensk/src/ctap/fingerprint.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ pub fn perform_built_in_uv<E: Env>(
internal_retry: bool,
) -> CtapResult<()> {
if storage::uv_retries(env)? == 0 {
return Err(Ctap2StatusCode::CTAP2_ERR_PIN_BLOCKED);
return Err(Ctap2StatusCode::CTAP2_ERR_UV_BLOCKED);
}
env.fingerprint().check_fingerprint_init()?;
let result = check_fingerprint_loop(env, channel, internal_retry);
Expand Down Expand Up @@ -180,7 +180,7 @@ fn check_fingerprint_loop<E: Env>(
FingerprintCheckError::NoMatch | FingerprintCheckError::Other => {
storage::decr_uv_retries(env)?;
if storage::uv_retries(env)? == 0 {
return Err(Ctap2StatusCode::CTAP2_ERR_PIN_BLOCKED);
return Err(Ctap2StatusCode::CTAP2_ERR_UV_BLOCKED);
}
retries -= 1;
if retries == 0 {
Expand Down Expand Up @@ -345,7 +345,7 @@ pub fn process_bio_enrollment<E: Env>(
enrollment_status: &mut EnrollmentStatus,
) -> CtapResult<ResponseData> {
// Enforcing modaility is not explicitly mentioned in the specification.
// https://github.com/fido-alliance/fido-2-specs/issues/1673
// https://github.com/fido-alliance/fido-2-specs/issues/1673 (private)
// Let's be strict until we know which is correct.
if params.sub_command.is_some() {
let modality = ok_or_missing(params.modality)?;
Expand Down Expand Up @@ -446,7 +446,7 @@ mod test {
{
assert_eq!(
perform_built_in_uv(&mut env, DUMMY_CHANNEL, true),
Err(Ctap2StatusCode::CTAP2_ERR_PIN_BLOCKED)
Err(Ctap2StatusCode::CTAP2_ERR_UV_BLOCKED)
);
} else {
assert_eq!(
Expand Down
21 changes: 13 additions & 8 deletions libraries/opensk/src/ctap/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,6 +263,17 @@ fn truncate_to_char_boundary(s: &str, mut max: usize) -> &str {
}
}

// For MakeCredential and GetAssertion, the specification says:
// If the uvRetries counter is 0, return CTAP2_ERR_PIN_BLOCKED. See:
// https://github.com/fido-alliance/fido-2-specs/issues/1672 (private)
#[cfg(feature = "fingerprint")]
fn map_uv_block_error(result: CtapResult<()>) -> CtapResult<()> {
result.map_err(|e| match e {
Ctap2StatusCode::CTAP2_ERR_UV_BLOCKED => Ctap2StatusCode::CTAP2_ERR_PIN_BLOCKED,
other => other,
})
}

/// Send non-critical packets using fire-and-forget.
pub fn send_packets<E: Env>(
env: &mut E,
Expand Down Expand Up @@ -845,12 +856,8 @@ impl<E: Env> CtapState<E> {
if options.uv {
#[cfg(not(feature = "fingerprint"))]
return Err(Ctap2StatusCode::CTAP2_ERR_INVALID_OPTION);
// The specification says:
// If the uvRetries counter is 0, return CTAP2_ERR_PIN_BLOCKED.
// But I assume this is a typo and should be UV_BLOCKED instead.
// https://github.com/fido-alliance/fido-2-specs/issues/1672
#[cfg(feature = "fingerprint")]
perform_built_in_uv(env, channel, true)?;
map_uv_block_error(perform_built_in_uv(env, channel, true))?;
#[cfg(feature = "fingerprint")]
UV_FLAG
} else {
Expand Down Expand Up @@ -1226,10 +1233,8 @@ impl<E: Env> CtapState<E> {
if options.uv {
#[cfg(not(feature = "fingerprint"))]
return Err(Ctap2StatusCode::CTAP2_ERR_INVALID_OPTION);
// Same error code ambiguity as in MakeCredential.
// https://github.com/fido-alliance/fido-2-specs/issues/1672
#[cfg(feature = "fingerprint")]
perform_built_in_uv(env, channel, true)?;
map_uv_block_error(perform_built_in_uv(env, channel, true))?;
#[cfg(feature = "fingerprint")]
UV_FLAG
} else {
Expand Down
Loading