upstream: support FIDO tokens that return no attestation data, e.g.

recent WinHello. From Michael Braun via GHPR542

OpenBSD-Commit-ID: a71b0542f2f7819ba0e33a88908e01b6fc49e4ce

diff --git a/sk-usbhid.c b/sk-usbhid.c
index 36f089a57197e4a8b0c16cefa1d831a2942719d7..427431b9a4575ba77e873a54cc6aa910b71fb485 100644 (file)
--- a/sk-usbhid.c
+++ b/sk-usbhid.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sk-usbhid.c,v 1.46 2023/03/28 06:12:38 dtucker Exp $ */
+/* $OpenBSD: sk-usbhid.c,v 1.47 2024/12/03 08:31:49 djm Exp $ */
 /*
  * Copyright (c) 2019 Markus Friedl
  * Copyright (c) 2020 Pedro Martelletto
@@ -961,13 +961,15 @@ sk_enroll(uint32_t alg, const uint8_t *challenge, size_t challenge_len,
                            fido_strerr(r));
                        goto out;
                }
-       } else {
+       } else if (strcmp(fido_cred_fmt(cred), "none") != 0) {
                skdebug(__func__, "self-attested credential");
                if ((r = fido_cred_verify_self(cred)) != FIDO_OK) {
                        skdebug(__func__, "fido_cred_verify_self: %s",
                            fido_strerr(r));
                        goto out;
                }
+       } else {
+               skdebug(__func__, "no attestation data");
        }
        if ((response = calloc(1, sizeof(*response))) == NULL) {
                skdebug(__func__, "calloc response failed");