fix(cable): send shutdown on close and linger for late linking data

close() now asks the connection loop to send a Shutdown control frame over
the encrypted channel and waits for it to terminate before the channel is
dropped. After a CTAP response the loop lingers briefly to capture a late
linking Update before sending Shutdown and tearing down.

Author: AlfioEmanueleFresta

libwebauthn/Cargo.toml

@@ -118,6 +118,8 @@ reqwest = { version = "0.12", default-features = false, features = [
 [dev-dependencies]
 tracing-subscriber = { version = "0.3.3", features = ["env-filter"] }
 qrcode = "0.14.1"
+# test-util enables paused time for deterministic timeout/linger tests
+tokio = { version = "1.45", features = ["test-util"] }
 # For turning on logging in unittests
 test-log = { version = "0.2" }
 

libwebauthn/src/transport/cable/channel.rs

@@ -47,6 +47,7 @@ pub struct CableChannel {
     pub(crate) ux_update_sender: broadcast::Sender<CableUxUpdate>,
     pub(crate) connection_state_receiver: watch::Receiver<ConnectionState>,
     pub(crate) persistent_token_store: Option<Arc<dyn PersistentTokenStore>>,
+    pub(crate) close_sender: Option<mpsc::Sender<()>>,
 }
 
 impl CableChannel {
@@ -137,7 +138,14 @@ impl Channel for CableChannel {
     }
 
     async fn close(&mut self) {
-        // TODO Send CableTunnelMessageType#Shutdown and drop the connection
+        // Signal the loop to send Shutdown, then wait for it to flush and terminate.
+        if let Some(close_sender) = self.close_sender.take() {
+            let _ = close_sender.send(()).await;
+        }
+        let mut connection_state = self.connection_state_receiver.clone();
+        let _ = connection_state
+            .wait_for(|state| *state == ConnectionState::Terminated)
+            .await;
     }
 
     async fn apdu_send(&mut self, _request: &ApduRequest, _timeout: Duration) -> Result<(), Error> {

libwebauthn/src/transport/cable/connection_stages.rs

@@ -198,6 +198,7 @@ pub(crate) struct TunnelConnectionInput {
     pub noise_state: TunnelNoiseState,
     pub cbor_tx_recv: mpsc::Receiver<CborRequest>,
     pub cbor_rx_send: mpsc::Sender<CborResponse>,
+    pub close_rx: mpsc::Receiver<()>,
 }
 
 impl TunnelConnectionInput {
@@ -206,6 +207,7 @@ impl TunnelConnectionInput {
         known_device_store: Option<Arc<dyn CableKnownDeviceInfoStore>>,
         cbor_tx_recv: mpsc::Receiver<CborRequest>,
         cbor_rx_send: mpsc::Sender<CborResponse>,
+        close_rx: mpsc::Receiver<()>,
     ) -> Self {
         Self {
             connection_type: handshake_output.connection_type,
@@ -215,6 +217,7 @@ impl TunnelConnectionInput {
             noise_state: handshake_output.noise_state,
             cbor_tx_recv,
             cbor_rx_send,
+            close_rx,
         }
     }
 }

libwebauthn/src/transport/cable/known_devices.rs

@@ -198,6 +198,7 @@ impl<'d> Device<'d, Cable, CableChannel> for CableKnownDevice {
         let (ux_update_sender, _) = broadcast::channel(16);
         let (cbor_tx_send, cbor_tx_recv) = mpsc::channel(16);
         let (cbor_rx_send, cbor_rx_recv) = mpsc::channel(16);
+        let (close_sender, close_rx) = mpsc::channel(1);
         let (connection_state_sender, connection_state_receiver) =
             watch::channel(ConnectionState::Connecting);
 
@@ -225,6 +226,7 @@ impl<'d> Device<'d, Cable, CableChannel> for CableKnownDevice {
                 Some(known_device.store),
                 cbor_tx_recv,
                 cbor_rx_send,
+                close_rx,
             );
 
             match protocol::connection(tunnel_input).await {
@@ -247,6 +249,7 @@ impl<'d> Device<'d, Cable, CableChannel> for CableKnownDevice {
             ux_update_sender,
             connection_state_receiver,
             persistent_token_store: settings.persistent_token_store,
+            close_sender: Some(close_sender),
         })
     }
 }