Add U2F support

src/function/sync/apply-actions/cache.ts

@@ -45,6 +45,7 @@ export class Cache {
 
   invalidiateUserList = false
   invalidiateDeviceList = false
+  invalidateU2fList = false
   areChangesImportant = false
 
   constructor ({ familyId, deviceId, hasFullVersion, database, transaction, connectedDevicesManager }: {
@@ -271,6 +272,19 @@ export class Cache {
       this.invalidiateDeviceList = false
     }
 
+    if (this.invalidateU2fList) {
+      await database.family.update({
+        u2fKeysVersion: generateVersionId()
+      }, {
+        where: {
+          familyId: this.familyId
+        },
+        transaction
+      })
+
+      this.invalidateU2fList = false
+    }
+
     this.devicesWithModifiedShowDeviceConnected.forEach((showDeviceConnected, deviceId) => {
       this.connectedDevicesManager.notifyShareConnectedChanged({
         familyId: this.familyId,

src/function/sync/apply-actions/dispatch-helper/parent-action.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2020 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -24,14 +24,18 @@ import { Cache } from '../cache'
 import { dispatchParentAction as dispatchParentActionInternal } from '../dispatch-parent-action'
 import { SourceDeviceNotFoundException } from '../exception/illegal-state'
 import { SelfLimitNotPossibleException } from '../exception/self-limit'
+import { AuthenticationMethod } from '../types'
 import { dispatch } from './helper'
 
-export async function dispatchParentAction ({ action, eventHandler, cache, isChildLimitAdding, deviceId }: {
+export async function dispatchParentAction ({
+  action, eventHandler, cache, isChildLimitAdding, deviceId, authentication
+}: {
   action: ClientPushChangesRequestAction
   cache: Cache
   eventHandler: EventHandler
   isChildLimitAdding: boolean
   deviceId: string
+  authentication: AuthenticationMethod
 }) {
   return dispatch({
     action,
@@ -90,7 +94,8 @@ export async function dispatchParentAction ({ action, eventHandler, cache, isChi
           cache,
           parentUserId: action.userId,
           sourceDeviceId: deviceId,
-          fromChildSelfLimitAddChildUserId: deviceUserId
+          fromChildSelfLimitAddChildUserId: deviceUserId,
+          authentication
         })
       } else {
         await dispatchParentActionInternal({
@@ -98,7 +103,8 @@ export async function dispatchParentAction ({ action, eventHandler, cache, isChi
           cache,
           parentUserId: action.userId,
           sourceDeviceId: deviceId,
-          fromChildSelfLimitAddChildUserId: null
+          fromChildSelfLimitAddChildUserId: null,
+          authentication
         })
       }
     }

src/function/sync/apply-actions/dispatch-parent-action/addu2fkey.ts

@@ -0,0 +1,56 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { AddParentU2fKeyAction } from '../../../../action'
+import { getU2fKeyId } from '../../../../database/u2fkey'
+import { Cache } from '../cache'
+import { ApplyActionUnacceptableAuthMethodException } from '../exception/auth'
+import { LimitReachedException } from '../exception/limit'
+import { AuthenticationMethod } from '../types'
+
+export async function dispatchAddU2f ({ action, cache, parentUserId, authentication }: {
+  action: AddParentU2fKeyAction
+  cache: Cache
+  parentUserId: string
+  authentication: AuthenticationMethod
+}) {
+  if (authentication === 'u2f') {
+    throw new ApplyActionUnacceptableAuthMethodException()
+  }
+
+  const counter = await cache.database.u2fKey.count({
+    where: {
+      familyId: cache.familyId
+    },
+    transaction: cache.transaction
+  })
+
+  if (counter >= 16) throw new LimitReachedException({ type: 'u2f keys' })
+
+  await cache.database.u2fKey.create({
+    familyId: cache.familyId,
+    keyId: getU2fKeyId({ keyHandle: action.keyHandle, publicKey: action.publicKey }),
+    userId: parentUserId,
+    addedAt: Date.now().toString(10),
+    keyHandle: action.keyHandle,
+    publicKey: action.publicKey,
+    nextCounter: '0'
+  }, { transaction: cache.transaction })
+
+  cache.invalidateU2fList = true
+  cache.areChangesImportant = true
+}

src/function/sync/apply-actions/dispatch-parent-action/index.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2020 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -18,6 +18,7 @@
 import {
   AddCategoryAppsAction,
   AddCategoryNetworkIdAction,
+  AddParentU2fKeyAction,
   AddUserAction,
   ChangeParentPasswordAction,
   CreateCategoryAction,
@@ -29,7 +30,9 @@ import {
   IncrementCategoryExtraTimeAction,
   ParentAction,
   RemoveCategoryAppsAction,
+  RemoveParentU2fKeyAction,
   RemoveUserAction,
+  ReportU2fLoginAction,
   RenameChildAction,
   ResetCategoryNetworkIdsAction,
   ReviewChildTaskAction,
@@ -68,8 +71,10 @@ import {
 import { Cache } from '../cache'
 import { ActionObjectTypeNotHandledException } from '../exception/illegal-state'
 import { ActionNotSupportedBySelfLimitationException } from '../exception/self-limit'
+import { AuthenticationMethod } from '../types'
 import { dispatchAddCategoryApps } from './addcategoryapps'
 import { dispatchAddCategoryNetworkId } from './addcategorynetworkid'
+import { dispatchAddU2f } from './addu2fkey'
 import { dispatchAddUser } from './adduser'
 import { dispatchChangeParentPassword } from './changeparentpassword'
 import { dispatchCreateCategory } from './createcategory'
@@ -80,7 +85,9 @@ import { dispatchDeleteTimeLimitRule } from './deletetimelimitrule'
 import { dispatchIgnoreManipulation } from './ignoremanipulation'
 import { dispatchIncrementCategoryExtraTime } from './incrementcategoryextratime'
 import { dispatchRemoveCategoryApps } from './removecategoryapps'
+import { dispatchRemoveU2f } from './removeu2fkey'
 import { dispatchRemoveUser } from './removeuser'
+import { dispatchReportU2fLogin } from './reportu2flogin'
 import { dispatchRenameChild } from './renamechild'
 import { dispatchResetCategoryNetworkIds } from './resetcategorynetworkids'
 import { dispatchReviewChildTaskAction } from './reviewchildtaskaction'
@@ -116,12 +123,16 @@ import { dispatchUpdateUserFlagsAction } from './updateuserflags'
 import { dispatchUpdateUserLimitLoginCategoryAction } from './updateuserlimitlogincategory'
 import { dispatchUpdateUserLimitPreBlockDuration } from './updateuserlimitloginpreblockduration'
 
-export const dispatchParentAction = async ({ action, cache, parentUserId, sourceDeviceId, fromChildSelfLimitAddChildUserId }: {
+export const dispatchParentAction = async ({
+  action, cache, parentUserId, sourceDeviceId,
+  fromChildSelfLimitAddChildUserId, authentication
+}: {
   action: ParentAction
   cache: Cache
   parentUserId: string
   sourceDeviceId: string | null
   fromChildSelfLimitAddChildUserId: string | null
+  authentication: AuthenticationMethod
 }) => {
   if (action instanceof AddCategoryAppsAction) {
     return dispatchAddCategoryApps({ action, cache, fromChildSelfLimitAddChildUserId })
@@ -146,10 +157,14 @@ export const dispatchParentAction = async ({ action, cache, parentUserId, source
   } else {
     if (action instanceof AddCategoryNetworkIdAction) {
       return dispatchAddCategoryNetworkId({ action, cache })
+    } else if (action instanceof AddParentU2fKeyAction) {
+      return dispatchAddU2f({ action, cache, parentUserId, authentication })
     } else if (action instanceof AddUserAction) {
       return dispatchAddUser({ action, cache })
     } else if (action instanceof RemoveCategoryAppsAction) {
       return dispatchRemoveCategoryApps({ action, cache })
+    } else if (action instanceof RemoveParentU2fKeyAction) {
+      return dispatchRemoveU2f({ action, cache, parentUserId, authentication })
     } else if (action instanceof DeleteCategoryAction) {
       return dispatchDeleteCategory({ action, cache })
     } else if (action instanceof UpdateCategoryTitleAction) {
@@ -200,6 +215,8 @@ export const dispatchParentAction = async ({ action, cache, parentUserId, source
       return dispatchUpdateTimelimitRule({ action, cache })
     } else if (action instanceof RemoveUserAction) {
       return dispatchRemoveUser({ action, cache, parentUserId })
+    } else if (action instanceof ReportU2fLoginAction) {
+      return dispatchReportU2fLogin({ action, cache, authentication })
     } else if (action instanceof ResetCategoryNetworkIdsAction) {
       return dispatchResetCategoryNetworkIds({ action, cache })
     } else if (action instanceof RenameChildAction) {

src/function/sync/apply-actions/dispatch-parent-action/removeu2fkey.ts

@@ -0,0 +1,47 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { RemoveParentU2fKeyAction } from '../../../../action'
+import { getU2fKeyId } from '../../../../database/u2fkey'
+import { Cache } from '../cache'
+import { ApplyActionUnacceptableAuthMethodException } from '../exception/auth'
+import { AuthenticationMethod } from '../types'
+
+export async function dispatchRemoveU2f ({ action, cache, parentUserId, authentication }: {
+  action: RemoveParentU2fKeyAction
+  cache: Cache
+  parentUserId: string
+  authentication: AuthenticationMethod
+}) {
+  if (authentication === 'u2f') {
+    throw new ApplyActionUnacceptableAuthMethodException()
+  }
+
+  await cache.database.u2fKey.destroy({
+    where: {
+      familyId: cache.familyId,
+      keyId: getU2fKeyId({ keyHandle: action.keyHandle, publicKey: action.publicKey }),
+      userId: parentUserId,
+      keyHandle: action.keyHandle,
+      publicKey: action.publicKey
+    },
+    transaction: cache.transaction
+  })
+
+  cache.invalidateU2fList = true
+  cache.areChangesImportant = true
+}

src/function/sync/apply-actions/dispatch-parent-action/reportu2flogin.ts

@@ -0,0 +1,34 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { ReportU2fLoginAction } from '../../../../action'
+import { Cache } from '../cache'
+import { ApplyActionUnacceptableAuthMethodException } from '../exception/auth'
+import { AuthenticationMethod } from '../types'
+
+export async function dispatchReportU2fLogin ({ authentication }: {
+  action: ReportU2fLoginAction
+  cache: Cache
+  authentication: AuthenticationMethod
+}) {
+  if (authentication !== 'u2f') {
+    throw new ApplyActionUnacceptableAuthMethodException()
+  }
+
+  // nothing to do; the goal was already reached by the authentication
+  // validation that expired the dh key
+}

src/function/sync/apply-actions/exception/auth.ts

@@ -0,0 +1,22 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { ApplyActionException } from './index'
+
+export class ApplyActionUnacceptableAuthMethodException extends ApplyActionException {
+  constructor() { super({ staticMessage: 'invalid auth method for the action' }) }
+}

src/function/sync/apply-actions/exception/integrity.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2020 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -27,6 +27,10 @@ export class InvalidParentActionIntegrityValue extends ApplyActionIntegrityExcep
   constructor () { super({ staticMessage: 'invalid parent action integrity value' }) }
 }
 
+export class InvalidU2fIntegrityValue extends ApplyActionIntegrityException {
+  constructor (message: string) { super({ staticMessage: 'invalid parent action u2f integrity value: ' + message }) }
+}
+
 export class InvalidChildActionIntegrityValue extends ApplyActionIntegrityException {
   constructor () { super({ staticMessage: 'invalid child action integrity value' }) }
 }

src/function/sync/apply-actions/exception/limit.ts

@@ -0,0 +1,24 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { ApplyActionException } from './index'
+
+export class LimitReachedException extends ApplyActionException {
+  constructor({type}: { type: string }) {
+    super({ staticMessage: 'limit reached: ' + type })
+  }
+}

src/function/sync/apply-actions/index.ts

@@ -71,12 +71,6 @@ export const applyActionsFromDevice = async ({ database, request, websocket, con
           // update the next sequence number
           nextSequenceNumber = action.sequenceNumber + 1
 
-          const { isChildLimitAdding } = await assertActionIntegrity({
-            deviceId: baseInfo.deviceId,
-            cache,
-            action
-          })
-
           if (action.type === 'appLogic') {
             await dispatchAppLogicAction({
               action,
@@ -85,14 +79,27 @@ export const applyActionsFromDevice = async ({ database, request, websocket, con
               eventHandler
             })
           } else if (action.type === 'parent') {
+            const { isChildLimitAdding, authentication } = await assertActionIntegrity({
+              deviceId: baseInfo.deviceId,
+              cache,
+              action
+            })
+
             await dispatchParentAction({
               action,
               cache,
               deviceId: baseInfo.deviceId,
               eventHandler,
-              isChildLimitAdding
+              isChildLimitAdding,
+              authentication
             })
           } else if (action.type === 'child') {
+            await assertActionIntegrity({
+              deviceId: baseInfo.deviceId,
+              cache,
+              action
+            })
+
             await dispatchChildAction({
               action,
               cache,

src/function/sync/apply-actions/integrity.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2020 Jonas Lochmann
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -15,20 +15,26 @@
  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
 
-import { createHash } from 'crypto'
+import { createHash, createHmac, timingSafeEqual } from 'crypto'
 import { ClientPushChangesRequestAction } from '../../../api/schema'
+import { intToBuffer, longToBuffer } from '../../../util/binary-number'
+import { validateU2fIntegrity, U2fValidationError } from '../../u2f'
 import { Cache } from './cache'
 import {
-  InvalidChildActionIntegrityValue, InvalidParentActionIntegrityValue, ParentDeviceActionWithoutParentDeviceException
+  InvalidChildActionIntegrityValue, InvalidParentActionIntegrityValue,
+  ParentDeviceActionWithoutParentDeviceException, InvalidU2fIntegrityValue
 } from './exception/integrity'
+import { ActionObjectTypeNotHandledException } from './exception/illegal-state'
+import { AuthenticationMethod } from './types'
 
 export async function assertActionIntegrity ({ action, cache, deviceId }: {
   action: ClientPushChangesRequestAction
   cache: Cache
   deviceId: string
-}): Promise<{ isChildLimitAdding: boolean }> {
-  let isChildLimitAdding = false
-
+}): Promise<{
+  isChildLimitAdding: boolean
+  authentication: AuthenticationMethod
+}> {
   if (action.type === 'parent') {
     if (action.integrity === 'device') {
       const deviceEntryUnsafe = await cache.database.device.findOne({
@@ -48,10 +54,69 @@ export async function assertActionIntegrity ({ action, cache, deviceId }: {
 
       // this ensures that the parent exists
       await cache.getSecondPasswordHashOfParent(action.userId)
+
+      return {
+        isChildLimitAdding: false,
+        authentication: 'device'
+      }
     } else if (action.integrity === 'childDevice') {
-      // will be checked later
-      isChildLimitAdding = true
+      return {
+        isChildLimitAdding: true, // will be checked later
+        authentication: 'device'
+      }
+    } else if (action.integrity.startsWith('u2f:')) {
+      // this ensures that the parent exists
+      await cache.getSecondPasswordHashOfParent(action.userId)
+
+      try {
+        const checkResult = await validateU2fIntegrity({
+          integrity: action.integrity,
+          hasFullVersion: cache.hasFullVersion,
+          familyId: cache.familyId,
+          deviceId,
+          database: cache.database,
+          transaction: cache.transaction,
+          calculateHmac: (secret) => calculateActionHmac({
+            action,
+            deviceId,
+            secret
+          })
+        })
+
+        if (checkResult.userId !== action.userId) {
+          throw new InvalidParentActionIntegrityValue()
+        }
+      } catch (ex) {
+        if (ex instanceof U2fValidationError) throw new InvalidU2fIntegrityValue(ex.message)
+        else throw ex
+      }
+
+      return {
+        isChildLimitAdding: false,
+        authentication: 'u2f'
+      }
+    } else if (action.integrity.startsWith('password:')) {
+      // password method with hmac
+      const parentSecondHash = await cache.getSecondPasswordHashOfParent(action.userId)
+
+      const correctResponse = calculateActionHmac({
+        action,
+        deviceId,
+        secret: Buffer.from(parentSecondHash, 'utf8')
+      })
+
+      const providedResult = Buffer.from(action.integrity.substring(9), 'base64')
+
+      if (!timingSafeEqual(providedResult, correctResponse)) {
+        throw new InvalidParentActionIntegrityValue()
+      }
+
+      return {
+        isChildLimitAdding: false,
+        authentication: 'password'
+      }
     } else {
+      // legacy password method
       const parentSecondHash = await cache.getSecondPasswordHashOfParent(action.userId)
 
       const integrityData = action.sequenceNumber.toString(10) +
@@ -64,10 +129,13 @@ export async function assertActionIntegrity ({ action, cache, deviceId }: {
       if (action.integrity !== expectedIntegrityValue) {
         throw new InvalidParentActionIntegrityValue()
       }
-    }
-  }
 
-  if (action.type === 'child') {
+      return {
+        isChildLimitAdding: false,
+        authentication: 'password'
+      }
+    }
+  } else if (action.type === 'child') {
     const childSecondHash = await cache.getSecondPasswordHashOfChild(action.userId)
 
     const integrityData = action.sequenceNumber.toString(10) +
@@ -80,7 +148,29 @@ export async function assertActionIntegrity ({ action, cache, deviceId }: {
     if (action.integrity !== expectedIntegrityValue) {
       throw new InvalidChildActionIntegrityValue()
     }
-  }
 
-  return { isChildLimitAdding }
+    return {
+      isChildLimitAdding: false,
+      authentication: 'password'
+    }
+  } else {
+    throw new ActionObjectTypeNotHandledException()
+  }
+}
+
+function calculateActionHmac({ action, deviceId, secret }: {
+  action: ClientPushChangesRequestAction
+  deviceId: string
+  secret: Buffer
+}): Buffer {
+  const binaryDeviceId = Buffer.from(deviceId, 'utf8')
+  const binaryAction = Buffer.from(action.encodedAction, 'utf8')
+
+  return createHmac('sha256', secret)
+    .update(longToBuffer(BigInt(action.sequenceNumber)))
+    .update(intToBuffer(binaryDeviceId.length))
+    .update(binaryDeviceId)
+    .update(intToBuffer(binaryAction.length))
+    .update(binaryAction)
+    .digest()
 }

src/function/sync/apply-actions/types.ts

@@ -0,0 +1,18 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 - 2022 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export type AuthenticationMethod = 'device' | 'password' | 'u2f'