1 /* 2 * Copyright (c) 2019 Google LLC. All rights reserved. 3 * Use of this source code is governed by a BSD-style 4 * license that can be found in the LICENSE file. 5 */ 6 7 #include <sys/types.h> 8 9 #include <sys/ioctl.h> 10 #include <sys/time.h> 11 #include <dev/usb/usb.h> 12 #include <dev/usb/usbhid.h> 13 14 #include <errno.h> 15 #include <fcntl.h> 16 #include <signal.h> 17 #include <string.h> 18 #include <unistd.h> 19 #include <usbhid.h> 20 #include <poll.h> 21 22 #include "fido.h" 23 24 #define MAX_UHID 64 25 #define MAX_U2FHID_LEN 64 26 27 struct hid_openbsd { 28 int fd; 29 size_t report_in_len; 30 size_t report_out_len; 31 sigset_t sigmask; 32 const sigset_t *sigmaskp; 33 }; 34 35 int 36 fido_hid_manifest(fido_dev_info_t *devlist, size_t ilen, size_t *olen) 37 { 38 size_t i; 39 char path[64]; 40 int fd; 41 struct usb_device_info udi; 42 fido_dev_info_t *di; 43 44 if (ilen == 0) 45 return (FIDO_OK); /* nothing to do */ 46 47 if (devlist == NULL || olen == NULL) 48 return (FIDO_ERR_INVALID_ARGUMENT); 49 50 for (i = *olen = 0; i < MAX_UHID && *olen < ilen; i++) { 51 snprintf(path, sizeof(path), "/dev/fido/%zu", i); 52 if ((fd = fido_hid_unix_open(path)) == -1) 53 continue; 54 if (close(fd) == -1) 55 fido_log_error(errno, "%s: close", __func__); 56 57 memset(&udi, 0, sizeof(udi)); 58 strlcpy(udi.udi_vendor, "OpenBSD", sizeof(udi.udi_vendor)); 59 strlcpy(udi.udi_product, "fido(4)", sizeof(udi.udi_product)); 60 udi.udi_vendorNo = 0x0b5d; /* stolen from PCI_VENDOR_OPENBSD */ 61 62 fido_log_debug("%s: %s: vendor = \"%s\", product = \"%s\"", 63 __func__, path, udi.udi_vendor, udi.udi_product); 64 65 di = &devlist[*olen]; 66 memset(di, 0, sizeof(*di)); 67 di->io = (fido_dev_io_t) { 68 fido_hid_open, 69 fido_hid_close, 70 fido_hid_read, 71 fido_hid_write, 72 }; 73 if ((di->path = strdup(path)) == NULL || 74 (di->manufacturer = strdup(udi.udi_vendor)) == NULL || 75 (di->product = strdup(udi.udi_product)) == NULL) { 76 free(di->path); 77 free(di->manufacturer); 78 free(di->product); 79 explicit_bzero(di, sizeof(*di)); 80 return FIDO_ERR_INTERNAL; 81 } 82 di->vendor_id = (int16_t)udi.udi_vendorNo; 83 di->product_id = (int16_t)udi.udi_productNo; 84 (*olen)++; 85 } 86 87 return FIDO_OK; 88 } 89 90 /* 91 * Workaround for OpenBSD <=6.6-current (as of 201910) bug that loses 92 * sync of DATA0/DATA1 sequence bit across uhid open/close. 93 * Send pings until we get a response - early pings with incorrect 94 * sequence bits will be ignored as duplicate packets by the device. 95 */ 96 static int 97 terrible_ping_kludge(struct hid_openbsd *ctx) 98 { 99 u_char data[256]; 100 int i, n; 101 struct pollfd pfd; 102 103 if (sizeof(data) < ctx->report_out_len + 1) 104 return -1; 105 for (i = 0; i < 4; i++) { 106 memset(data, 0, sizeof(data)); 107 /* broadcast channel ID */ 108 data[1] = 0xff; 109 data[2] = 0xff; 110 data[3] = 0xff; 111 data[4] = 0xff; 112 /* Ping command */ 113 data[5] = 0x81; 114 /* One byte ping only, Vasili */ 115 data[6] = 0; 116 data[7] = 1; 117 fido_log_debug("%s: send ping %d", __func__, i); 118 if (fido_hid_write(ctx, data, ctx->report_out_len + 1) == -1) 119 return -1; 120 fido_log_debug("%s: wait reply", __func__); 121 memset(&pfd, 0, sizeof(pfd)); 122 pfd.fd = ctx->fd; 123 pfd.events = POLLIN; 124 if ((n = poll(&pfd, 1, 100)) == -1) { 125 fido_log_debug("%s: poll: %s", __func__, strerror(errno)); 126 return -1; 127 } else if (n == 0) { 128 fido_log_debug("%s: timed out", __func__); 129 continue; 130 } 131 if (fido_hid_read(ctx, data, ctx->report_out_len, 250) == -1) 132 return -1; 133 /* 134 * Ping isn't always supported on the broadcast channel, 135 * so we might get an error, but we don't care - we're 136 * synched now. 137 */ 138 fido_log_debug("%s: got reply", __func__); 139 fido_log_xxd(data, ctx->report_out_len, "%s", __func__); 140 return 0; 141 } 142 fido_log_debug("%s: no response", __func__); 143 return -1; 144 } 145 146 void * 147 fido_hid_open(const char *path) 148 { 149 struct hid_openbsd *ret = NULL; 150 151 if ((ret = calloc(1, sizeof(*ret))) == NULL || 152 (ret->fd = fido_hid_unix_open(path)) == -1) { 153 free(ret); 154 return (NULL); 155 } 156 ret->report_in_len = ret->report_out_len = CTAP_MAX_REPORT_LEN; 157 fido_log_debug("%s: inlen = %zu outlen = %zu", __func__, 158 ret->report_in_len, ret->report_out_len); 159 160 /* 161 * OpenBSD (as of 201910) has a bug that causes it to lose 162 * track of the DATA0/DATA1 sequence toggle across uhid device 163 * open and close. This is a terrible hack to work around it. 164 */ 165 if (terrible_ping_kludge(ret) != 0) { 166 fido_hid_close(ret); 167 return NULL; 168 } 169 170 return (ret); 171 } 172 173 void 174 fido_hid_close(void *handle) 175 { 176 struct hid_openbsd *ctx = (struct hid_openbsd *)handle; 177 178 if (close(ctx->fd) == -1) 179 fido_log_error(errno, "%s: close", __func__); 180 181 free(ctx); 182 } 183 184 int 185 fido_hid_set_sigmask(void *handle, const fido_sigset_t *sigmask) 186 { 187 struct hid_openbsd *ctx = handle; 188 189 ctx->sigmask = *sigmask; 190 ctx->sigmaskp = &ctx->sigmask; 191 192 return (FIDO_OK); 193 } 194 195 int 196 fido_hid_read(void *handle, unsigned char *buf, size_t len, int ms) 197 { 198 struct hid_openbsd *ctx = (struct hid_openbsd *)handle; 199 ssize_t r; 200 201 if (len != ctx->report_in_len) { 202 fido_log_debug("%s: invalid len: got %zu, want %zu", __func__, 203 len, ctx->report_in_len); 204 return (-1); 205 } 206 207 if (fido_hid_unix_wait(ctx->fd, ms, ctx->sigmaskp) < 0) { 208 fido_log_debug("%s: fd not ready", __func__); 209 return (-1); 210 } 211 212 if ((r = read(ctx->fd, buf, len)) == -1) { 213 fido_log_error(errno, "%s: read", __func__); 214 return (-1); 215 } 216 217 if (r < 0 || (size_t)r != len) { 218 fido_log_debug("%s: %zd != %zu", __func__, r, len); 219 return (-1); 220 } 221 222 return ((int)len); 223 } 224 225 int 226 fido_hid_write(void *handle, const unsigned char *buf, size_t len) 227 { 228 struct hid_openbsd *ctx = (struct hid_openbsd *)handle; 229 ssize_t r; 230 231 if (len != ctx->report_out_len + 1) { 232 fido_log_debug("%s: invalid len: got %zu, want %zu", __func__, 233 len, ctx->report_out_len); 234 return (-1); 235 } 236 237 if ((r = write(ctx->fd, buf + 1, len - 1)) == -1) { 238 fido_log_error(errno, "%s: write", __func__); 239 return (-1); 240 } 241 242 if (r < 0 || (size_t)r != len - 1) { 243 fido_log_debug("%s: %zd != %zu", __func__, r, len - 1); 244 return (-1); 245 } 246 247 return ((int)len); 248 } 249 250 size_t 251 fido_hid_report_in_len(void *handle) 252 { 253 struct hid_openbsd *ctx = handle; 254 255 return (ctx->report_in_len); 256 } 257 258 size_t 259 fido_hid_report_out_len(void *handle) 260 { 261 struct hid_openbsd *ctx = handle; 262 263 return (ctx->report_out_len); 264 } 265