Deserialization issue for CtapPinUvAuthProtocolVersion

[CyrilCadoux]

Hi everyone,

I have already set up a working FIDO2 pipeline with registration and authentication ceremonies.
I am now trying to include the connection to the FIDO Metadata service in my implementation. I followed the instructions given on the README to setup the FidoMetadataDownloader & FidoMetadataServices objects.

The connection to fidoalliance's website is working fine, and the Blob is correctly retrieved.

My problem appears during the verification of the blob:

com.fasterxml.jackson.databind.exc.InvalidFormatException: Cannot deserialize value of type com.yubico.fido.metadata.CtapPinUvAuthProtocolVersion from number 2: index value outside legal index range [0..1]
 at [Source: (byte[])"{"legalHeader":"Retrieval and use of this BLOB indicates acceptance of the appropriate agreement located at https://fidoalliance.org/metadata/metadata-legal-terms/","no":17,"nextUpdate":"2022-08-01","entries":[{"attesta
tionCertificateKeyIdentifiers":["1434d2f277fe479c35ddf6aa4d08a07cbce99dd7"],"metadataStatement":{"legalHeader":"https://fidoalliance.org/metadata/metadata-statement-legal-header/","attestationCertificateKeyIdentifiers":["1434d2f277fe479c35dd
f6aa4d08a07cbce99dd7"],"description":"NE"[truncated 898225 bytes]; line: 1, column: 26546] (through reference chain: com.yubico.fido.metadata.MetadataBLOBPayload$MetadataBLOBPayloadBuilder["entries"]->java.util.HashSet[4]->com.yubico.fido.me
tadata.MetadataBLOBPayloadEntry$MetadataBLOBPayloadEntryBuilder["metadataStatement"]->com.yubico.fido.metadata.MetadataStatement$MetadataStatementBuilder["authenticatorGetInfo"]->com.yubico.fido.metadata.AuthenticatorGetInfo$AuthenticatorGet
InfoBuilder["pinUvAuthProtocols"]->java.util.HashSet[0])

at com.fasterxml.jackson.databind.exc.InvalidFormatException.from(InvalidFormatException.java:67)
        at com.fasterxml.jackson.databind.DeserializationContext.weirdNumberException(DeserializationContext.java:1863)
        at com.fasterxml.jackson.databind.DeserializationContext.handleWeirdNumberValue(DeserializationContext.java:1124)
        at com.fasterxml.jackson.databind.deser.std.EnumDeserializer._fromInteger(EnumDeserializer.java:254)
        at com.fasterxml.jackson.databind.deser.std.EnumDeserializer.deserialize(EnumDeserializer.java:193)
        at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer._deserializeFromArray(CollectionDeserializer.java:355)
        at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:244)
        at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:28)
        at com.fasterxml.jackson.databind.deser.impl.MethodProperty.deserializeSetAndReturn(MethodProperty.java:158)
        at com.fasterxml.jackson.databind.deser.BuilderBasedDeserializer.vanillaDeserialize(BuilderBasedDeserializer.java:293)
        at com.fasterxml.jackson.databind.deser.BuilderBasedDeserializer.deserialize(BuilderBasedDeserializer.java:217)
        at com.fasterxml.jackson.databind.deser.impl.MethodProperty.deserializeSetAndReturn(MethodProperty.java:158)
        at com.fasterxml.jackson.databind.deser.BuilderBasedDeserializer.vanillaDeserialize(BuilderBasedDeserializer.java:293)
        at com.fasterxml.jackson.databind.deser.BuilderBasedDeserializer.deserialize(BuilderBasedDeserializer.java:217)
        at com.fasterxml.jackson.databind.deser.impl.MethodProperty.deserializeSetAndReturn(MethodProperty.java:158)
        at com.fasterxml.jackson.databind.deser.BuilderBasedDeserializer.vanillaDeserialize(BuilderBasedDeserializer.java:293)
        at com.fasterxml.jackson.databind.deser.BuilderBasedDeserializer.deserialize(BuilderBasedDeserializer.java:217)
        at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer._deserializeFromArray(CollectionDeserializer.java:355)
        at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:244)
        at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:28)
        at com.fasterxml.jackson.databind.deser.impl.MethodProperty.deserializeSetAndReturn(MethodProperty.java:158)
        at com.fasterxml.jackson.databind.deser.BuilderBasedDeserializer.vanillaDeserialize(BuilderBasedDeserializer.java:293)
        at com.fasterxml.jackson.databind.deser.BuilderBasedDeserializer.deserialize(BuilderBasedDeserializer.java:217)
        at com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue(DefaultDeserializationContext.java:322)
        at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:4593)
        at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3609)
        at com.yubico.fido.metadata.FidoMetadataDownloader.verifyBlob(FidoMetadataDownloader.java:970)
        at com.yubico.fido.metadata.FidoMetadataDownloader.parseAndVerifyBlob(FidoMetadataDownloader.java:886)
        at com.yubico.fido.metadata.FidoMetadataDownloader.retrieveBlob(FidoMetadataDownloader.java:806)
        at com.yubico.fido.metadata.FidoMetadataDownloader.loadCachedBlob(FidoMetadataDownloader.java:684)

Have I actually missed something in the Downloader instantiation ?

I have version 2.13.3 for fasterxml:jackson-databind, could this play a role in this verification ?

Any help appreciated ! Thanks a lot 👍

[CyrilCadoux]

Ok so this issue relates to a jackson-databind bug: FasterXML/jackson-databind#1850

So it is really about the jackson-databind version, which should be 2.13.3 at least

[emlun]

Thanks for the report, and for looking into it! I've been able to reproduce the issue with com.fasterxml.jackson.core:jackson-databind:2.12.7, both in the integration test against the current FIDO MDS BLOB and in the self-contained unit tests. Running on commit 76119b9 with this diff applied (pipe into git apply):

diff --git a/build.gradle b/build.gradle
index 3405b27c..a88dc63b 100644
--- a/build.gradle
+++ b/build.gradle
@@ -45,17 +45,10 @@ wrapper {
 dependencies {
   constraints {
     api('com.augustcellars.cose:cose-java:[1.0.0,2)')
-    api('com.fasterxml.jackson.core:jackson-databind:[2.13.2.1,3)')
-    api('com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:[2.13.2,3)')
-    api('com.fasterxml.jackson.datatype:jackson-datatype-jdk8:[2.13.2,3)')
-    api('com.fasterxml.jackson.datatype:jackson-datatype-jsr310:[2.13.2,3)')
-    api('com.fasterxml.jackson:jackson-bom') {
-      version {
-        strictly '[2.13.2.1,3)'
-        reject '2.13.2.1'
-      }
-      because 'jackson-databind 2.13.2.1 references nonexistent BOM'
-    }
+    api('com.fasterxml.jackson.core:jackson-databind:2.12.7')
+    api('com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.12.7')
+    api('com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.12.7')
+    api('com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.12.7')
     api('com.google.guava:guava:[24.1.1,31)')
     api('com.upokecenter:cbor:[4.5.1,5)')
     api('javax.ws.rs:javax.ws.rs-api:[2.1,3)')

then both ./gradlew :webauthn-server-attestation:test and ./gradlew :webauthn-server-attestation:integrationTest fail with the above error. With Jackson version 2.13.0 or newer both test suites pass.

I've not been able to reproduce the issue with Jackson 2.13.3. If you're still having issues seemingly with that version, I'd suggest investigating your resolved dependencies in detail to see if there's something "pulling down" the Jackson version to an older one. With Gradle you can get such a report with gradle dependencies, and I'm sure there are analogues for other build tools too.