ULTRA [ www.resource.optimyar.com ]

Linux uranus.pws-dns.net 5.14.0-427.42.1.el9_4.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Nov 1 14:58:02 EDT 2024 x86_64

LiteSpeed

31.214.174.197 | Your IP: 216.73.216.157

Cant read [ /etc/named.conf ]

[ drwxr-xr-x ]

/ home / freeclou / optimyar / wp-content / plugins / ithemes-security-pro / pro / webauthn /

Home Upload Mass Deface Mass Delete Back Connect Notify

RegistrationCeremony.php

<?php

namespace iThemesSecurity\WebAuthn;

use iThemesSecurity\Strauss\Cose\Key\Key;
use iThemesSecurity\Lib\Result;
use iThemesSecurity\WebAuthn\DTO\AttestationObject;
use iThemesSecurity\WebAuthn\DTO\AttestationStatement;
use iThemesSecurity\WebAuthn\DTO\AuthenticatorAttestationResponse;
use iThemesSecurity\WebAuthn\DTO\BinaryString;
use iThemesSecurity\WebAuthn\DTO\CollectedClientData;
use iThemesSecurity\WebAuthn\DTO\PublicKeyCredential;
use iThemesSecurity\WebAuthn\DTO\PublicKey;
use iThemesSecurity\WebAuthn\DTO\PublicKeyCredentialCreationOptions;
use iThemesSecurity\WebAuthn\DTO\PublicKeyCredentialParameters;
use iThemesSecurity\WebAuthn\DTO\PublicKeyCredentialRpEntity;
use iThemesSecurity\WebAuthn\DTO\UserVerificationRequirement;

final class RegistrationCeremony {

/** @var PublicKeyCredentialRpEntity_Factory */
	protected $rp_factory;

/** @var AttestationObjectLoader */
	protected $attestation_loader;

/** @var PublicKeyCredential_Record_Repository */
	protected $repository;

public function __construct(
		PublicKeyCredentialRpEntity_Factory $rp_factory,
		AttestationObjectLoader $attestation_loader,
		PublicKeyCredential_Record_Repository $repository
	) {
		$this->rp_factory         = $rp_factory;
		$this->attestation_loader = $attestation_loader;
		$this->repository         = $repository;
	}

/**
	 * Performs a Registration Ceremony.
	 *
	 * See https://w3c.github.io/webauthn/#sctn-registering-a-new-credential.
	 * Steps 1-5 are performed by the JS client.
	 *
	 * @param PublicKeyCredentialCreationOptions                    $options    The options used to initialize the ceremony.
	 * @param PublicKeyCredential<AuthenticatorAttestationResponse> $credential The Attestation response from the Authenticator.
	 * @param string                                                $label      A label created by the user to identify this credential / device.
	 *
	 * @return Result<PublicKeyCredential_Record>
	 */
	public function perform(
		PublicKeyCredentialCreationOptions $options,
		PublicKeyCredential $credential,
		string $label
	): Result {
		try {
			$response = $credential->get_response();
			$rp       = $this->rp_factory->make();

if ( ! $rp->is_success() ) {
				return $rp;
			}

// Step 6.
			$client_data = $response->get_and_decode_client_data();

// Step 7
			if ( $client_data->get_type() !== CollectedClientData::TYPE_CREATE ) {
				return Result::error( new \WP_Error(
					'itsec.webauthn.registration-ceremony.invalid-type',
					__( 'The attestation type is incorrect.', 'it-l10n-ithemes-security-pro' )
				) );
			}

// Step 8
			if ( ! $options->get_challenge()->equals( $client_data->get_challenge() ) ) {
				return Result::error( new \WP_Error(
					'itsec.webauthn.registration-ceremony.invalid-challenge',
					__( 'The challenge is incorrect.', 'it-l10n-ithemes-security-pro' )
				) );
			}

// Step 9
			if ( ! $this->do_origins_match( $rp->get_data(), $client_data->get_origin() ) ) {
				return Result::error( new \WP_Error(
					'itsec.webauthn.registration-ceremony.invalid-origin',
					__( 'The origin is invalid.', 'it-l10n-ithemes-security-pro' )
				) );
			}

// Skip Step 10. We only use the None attestation.

// Step 11
			$attestation = $this->attestation_loader->load( $response->get_attestation_object() );

// Step 12
			$rp_id_hash = hash( 'sha256', $rp->get_data()->get_id(), true );

if ( ! hash_equals( $rp_id_hash, $attestation->get_authenticator_data()->get_rp_id_hash()->get_binary() ) ) {
				return Result::error( new \WP_Error(
					'itsec.webauthn.registration-ceremony.rp-id-hash-mismatch',
					__( 'The Relying Party id hash does not match.', 'it-l10n-ithemes-security-pro' )
				) );
			}

// Step 13
			if ( ! $attestation->get_authenticator_data()->is_user_present() ) {
				return Result::error( new \WP_Error(
					'itsec.webauthn.registration-ceremony.user-not-present',
					__( 'The user is not present.', 'it-l10n-ithemes-security-pro' )
				) );
			}

$authenticator_selection = $options->get_authenticator_selection();

// Step 14
			if (
				$authenticator_selection &&
				$authenticator_selection->get_user_verification() === UserVerificationRequirement::REQUIRED &&
				! $attestation->get_authenticator_data()->is_user_verified()
			) {
				return Result::error( new \WP_Error(
					'itsec.webauthn.registration-ceremony.user-not-verified',
					__( 'The user is not verified.', 'it-l10n-ithemes-security-pro' )
				) );
			}

// Skip Steps 15 and 16. We do not have backup requirements.

// Step 17
			$algorithm = $this->get_credential_algorithm( $attestation );

if ( ! $algorithm ) {
				return Result::error( new \WP_Error(
					'itsec.webauthn.registration-ceremony.no-alg',
					__( 'Cannot determine algorithm used.', 'it-l10n-ithemes-security-pro' )
				) );
			}

$allowed_algorithms = array_map(
				function ( PublicKeyCredentialParameters $p ) { return $p->get_alg(); },
				$options->get_pub_key_cred_params()
			);
			if ( ! in_array( $algorithm, $allowed_algorithms, true ) ) {
				return Result::error( new \WP_Error(
					'itsec.webauthn.registration-ceremony.invalid-alg',
					__( 'An unsupported algorithm is provided.', 'it-l10n-ithemes-security-pro' )
				) );
			}

// Skip Step 18, we do not query any client extensions.

// Step 19 - 22. We only use the None attestation.
			if ( $attestation->get_attestation_statement()->get_type() !== AttestationStatement::TYPE_NONE ) {
				return Result::error( new \WP_Error(
					'itsec.webauthn.registration-ceremony.invalid-attestation-stmt-type',
					__( 'Invalid attestation statement type.', 'it-l10n-ithemes-security-pro' )
				) );
			}

// Step 23.
			$credential_id = $this->get_credential_id( $attestation );

if ( ! $credential_id ) {
				return Result::error( new \WP_Error(
					'itsec.webauthn.registration-ceremony.missing-credential-id',
					__( 'No credential id given.', 'it-l10n-ithemes-security-pro' )
				) );
			}

if ( strlen( $credential_id->get_binary() ) > 1023 ) {
				return Result::error( new \WP_Error(
					'itsec.webauthn.registration-ceremony.credential-id-too-long',
					__( 'Credential id is too long.', 'it-l10n-ithemes-security-pro' )
				) );
			}

// Step 24.
			$is_available = $this->repository->is_id_available( $credential_id );

if ( ! $is_available->is_success() || ! $is_available->get_data() ) {
				return Result::error( new \WP_Error(
					'itsec.webauthn.registration-ceremony.duplicate-credential-id',
					__( 'Credential id is already registered.', 'it-l10n-ithemes-security-pro' )
				) );
			}

$public_key = Key::createFromData( $this->get_credential_public_key( $attestation ) );

$record = new PublicKeyCredential_Record(
				$credential_id,
				$credential->get_type(),
				$response->get_transports(),
				PublicKey::from_cose_key( $public_key ),
				$attestation->get_authenticator_data()->get_sign_count(),
				$attestation->get_authenticator_data()->is_eligible_for_backups(),
				$attestation->get_authenticator_data()->is_backed_up(),
				$options->get_user()->get_id(),
				new \DateTimeImmutable( 'now', new \DateTimeZone( 'UTC' ) ),
				$label,
				PublicKeyCredential_Record::S_ACTIVE
			);

$persisted = $this->repository->persist( $record );

if ( ! $persisted->is_success() ) {
				return $persisted;
			}

return Result::success( $record );
		} catch ( \Throwable $e ) {
			\ITSEC_Log::add_error( 'webauthn', 'registration-ceremony-failed', [
				'user'      => $options->get_user()->get_id()->as_ascii_fast(),
				'exception' => $e->getMessage(),
			] );

return Result::error( new \WP_Error(
				'itsec.webauthn.registration-ceremony.failed',
				__( 'Could not register a new WebAuthn credential.', 'it-l10n-ithemes-security-pro' )
			) );
		}
	}

/**
	 * Checks if the origin given by the Credential matches the
	 * Relying Party origin.
	 *
	 * @param PublicKeyCredentialRpEntity $rp
	 * @param string                      $given_origin
	 *
	 * @return bool
	 */
	private function do_origins_match( PublicKeyCredentialRpEntity $rp, string $given_origin ): bool {
		$parts = wp_parse_url( $given_origin );

if ( ! empty( $parts['port'] ) ) {
			$id = sprintf( '%s:%d', $parts['host'], $parts['port'] );
		} else {
			$id = $parts['host'];
		}

return $id === $rp->get_id();
	}

/**
	 * Extracts the Public Key data from the Attestation object.
	 *
	 * @param AttestationObject $attestation
	 *
	 * @return array|null
	 */
	private function get_credential_public_key( AttestationObject $attestation ): ?array {
		$credential_data = $attestation->get_authenticator_data()->get_attested_credential_data();

if ( ! $credential_data ) {
			return null;
		}

return $credential_data->get_credential_public_key();
	}

/**
	 * Finds the credential algorithm used by the Public Key.
	 *
	 * @param AttestationObject $attestation
	 *
	 * @return int|null
	 */
	private function get_credential_algorithm( AttestationObject $attestation ): ?int {
		$public_key = $this->get_credential_public_key( $attestation );

if ( ! $public_key ) {
			return null;
		}

if ( ! isset( $public_key[3] ) ) {
			return null;
		}

return (int) $public_key[3];
	}

/**
	 * Extracts the credential ID from the Attestation object.
	 *
	 * @param AttestationObject $attestation
	 *
	 * @return BinaryString|null
	 */
	private function get_credential_id( AttestationObject $attestation ): ?BinaryString {
		$credential_data = $attestation->get_authenticator_data()->get_attested_credential_data();

if ( ! $credential_data ) {
			return null;
		}

return $credential_data->get_credential_id();
	}
}

Name	Type	Size	Owner/Group	Permission	Last Modified	Actions
.	dir	-	freeclou/freeclou	drwxr-xr-x	2025-01-29 12:43:49
..	dir	-	freeclou/freeclou	drwxr-xr-x	2025-01-29 12:43:49
DTO	dir	-	freeclou/freeclou	drwxr-xr-x	2025-01-29 12:43:49
REST	dir	-	freeclou/freeclou	drwxr-xr-x	2025-01-29 12:43:49
entries	dir	-	freeclou/freeclou	drwxr-xr-x	2025-01-29 12:43:49
AttestationObjectLoader.php	text/x-php	1.89 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
AuthenticationCeremony.php	text/x-php	9.4 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
AuthenticatorDataLoader.php	text/x-php	1.96 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
Interstitial.php	text/x-php	3.33 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
Login.php	text/x-php	415 B	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
Module.php	text/x-php	2.06 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
PublicKeyCredentialCreationOptions_Factory.php	text/x-php	718 B	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
PublicKeyCredentialCreationOptions_Factory_Default.php	text/x-php	2.82 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
PublicKeyCredentialRequestOptions_Factory.php	text/x-php	473 B	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
PublicKeyCredentialRequestOptions_Factory_Default.php	text/x-php	2.49 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
PublicKeyCredentialRpEntity_Factory.php	text/x-php	340 B	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
PublicKeyCredentialRpEntity_Factory_Default.php	text/x-php	670 B	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
PublicKeyCredentialUserEntity_Factory.php	text/x-php	1.09 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
PublicKeyCredentialUserEntity_Factory_Database.php	text/x-php	4.03 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
PublicKeyCredential_Record.php	text/x-php	5.23 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
PublicKeyCredential_Record_Repository.php	text/x-php	1.88 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
PublicKeyCredential_Record_Repository_Database.php	text/x-php	7.49 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
RegistrationCeremony.php	text/x-php	9.42 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
Session_Storage.php	text/x-php	1.29 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
Session_Storage_Opaque_Tokens.php	text/x-php	1.93 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
Verified_Credential_Opaque_Tokens.php	text/x-php	1.55 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
Verified_Credential_Tokens.php	text/x-php	269 B	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
container.php	text/x-php	4.46 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
logs.php	text/x-php	2.78 KB	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49
module.json	application/json	875 B	freeclou/freeclou	-rw-r--r--	2025-01-29 12:43:49