From 315016f55265621cc7448c31817b41e66b694e49 Mon Sep 17 00:00:00 2001
From: Fabian Kaczmarczyck <kaczmarczyck@google.com>
Date: Fri, 20 Nov 2020 02:50:47 +0100
Subject: [PATCH 1/3] unwraps credentials in the exclude list

---
 src/ctap/mod.rs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/ctap/mod.rs b/src/ctap/mod.rs
index 1a98ce5..66ef234 100644
--- a/src/ctap/mod.rs
+++ b/src/ctap/mod.rs
@@ -392,12 +392,16 @@ where
         let has_extension_output = use_hmac_extension || cred_protect_policy.is_some();
 
         let rp_id = rp.rp_id;
+        let rp_id_hash = Sha256::hash(rp_id.as_bytes());
         if let Some(exclude_list) = exclude_list {
             for cred_desc in exclude_list {
                 if self
                     .persistent_store
                     .find_credential(&rp_id, &cred_desc.key_id, pin_uv_auth_param.is_none())?
                     .is_some()
+                    || self
+                        .decrypt_credential_source(cred_desc.key_id, &rp_id_hash)?
+                        .is_some()
                 {
                     // Perform this check, so bad actors can't brute force exclude_list
                     // without user interaction.
@@ -446,7 +450,6 @@ where
         let sk = crypto::ecdsa::SecKey::gensk(self.rng);
         let pk = sk.genpk();
 
-        let rp_id_hash = Sha256::hash(rp_id.as_bytes());
         let credential_id = if options.rk {
             let random_id = self.rng.gen_uniform_u8x32().to_vec();
             let credential_source = PublicKeyCredentialSource {

From 9a29795ca65870508267b45d5744878357a97c62 Mon Sep 17 00:00:00 2001
From: Fabian Kaczmarczyck <kaczmarczyck@google.com>
Date: Fri, 20 Nov 2020 06:03:52 +0100
Subject: [PATCH 2/3] changes priority of error codes

---
 src/ctap/hid/mod.rs | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/ctap/hid/mod.rs b/src/ctap/hid/mod.rs
index 7489f6e..e975f33 100644
--- a/src/ctap/hid/mod.rs
+++ b/src/ctap/hid/mod.rs
@@ -307,7 +307,9 @@ impl CtapHid {
                 HidPacketIterator::none()
             }
             Err((cid, error)) => {
-                if !self.is_allocated_channel(cid) {
+                if !self.is_allocated_channel(cid)
+                    && error != receive::Error::UnexpectedContinuation
+                {
                     CtapHid::error_message(cid, CtapHid::ERR_INVALID_CHANNEL)
                 } else {
                     match error {
@@ -523,6 +525,27 @@ mod test {
         }
     }
 
+    #[test]
+    fn test_spurious_continuation_packet() {
+        let mut rng = ThreadRng256 {};
+        let user_immediately_present = |_| Ok(());
+        let mut ctap_state = CtapState::new(&mut rng, user_immediately_present);
+        let mut ctap_hid = CtapHid::new();
+
+        let mut packet = [0x00; 64];
+        packet[0..7].copy_from_slice(&[0xC1, 0xC1, 0xC1, 0xC1, 0x00, 0x51, 0x51]);
+        let mut assembler_reply = MessageAssembler::new();
+        for pkt_reply in ctap_hid.process_hid_packet(&packet, DUMMY_CLOCK_VALUE, &mut ctap_state) {
+            // Continuation packets are silently ignored.
+            assert_eq!(
+                assembler_reply
+                    .parse_packet(&pkt_reply, DUMMY_TIMESTAMP)
+                    .unwrap(),
+                None
+            );
+        }
+    }
+
     #[test]
     fn test_command_init() {
         let mut rng = ThreadRng256 {};

From dab0077b87451fa448f72f1dadd1d2c42c142ca6 Mon Sep 17 00:00:00 2001
From: Jean-Michel Picod <jmichel@google.com>
Date: Fri, 20 Nov 2020 11:58:39 +0100
Subject: [PATCH 3/3] Fix broken crypto_test workflow.

The use of `::set-env` command in workflows is not being depreacted.
Moving to the new way of setting environment variables.
---
 .github/workflows/crypto_test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/crypto_test.yml b/.github/workflows/crypto_test.yml
index 1740280..50fdf88 100644
--- a/.github/workflows/crypto_test.yml
+++ b/.github/workflows/crypto_test.yml
@@ -27,7 +27,7 @@ jobs:
       - name: Set up OpenSK
         run: ./setup.sh
 
-      - run: echo "::set-env name=RUSTFLAGS::-C target-feature=+aes"
+      - run: echo "RUSTFLAGS=-C target-feature=+aes" >> $GITHUB_ENV
 
       - name: Unit testing of crypto library (release mode)
         uses: actions-rs/cargo@v1