sk_sign: set FIDO2 uv attribute explicitely for WinHello

WinHello via libfido2 performs user verification by default.
However, if we stick to that, there's no way to differentiate
between keys created with or without "-O  verify-required".
Set FIDO2 uv attribute explicitely to FIDO_OPT_FALSE, then check
if user verification has been requested.

Signed-off-by: Corinna Vinschen <vinschen@redhat.com>

diff --git a/sk-usbhid.c b/sk-usbhid.c
index 06bf0e85c0873cb469c5993716d74826b3be6c4a..a82110efa652b7ca8174be04f25052a010f5075c 100644 (file)
--- a/sk-usbhid.c
+++ b/sk-usbhid.c
@@ -1216,6 +1216,14 @@ sk_sign(uint32_t alg, const uint8_t *data, size_t datalen,
                skdebug(__func__, "fido_assert_set_up: %s", fido_strerr(r));
                goto out;
        }
+       /*
+        * WinHello requests the PIN by default.  Make "uv" request explicit
+        * to allow keys with and without -O verify-required to make sense.
+        */
+       if (pin == NULL && fido_dev_is_winhello (sk->dev) &&
+           (r = fido_assert_set_uv(assert, FIDO_OPT_FALSE)) != FIDO_OK) {
+               skdebug(__func__, "fido_assert_set_uv: %s", fido_strerr(r));
+       }
        if (pin == NULL && (flags & SSH_SK_USER_VERIFICATION_REQD)) {
                if (check_sk_options(sk->dev, "uv", &internal_uv) < 0 ||
                    internal_uv != 1) {