1 /*
2 * Copyright (c) 2019 Google LLC. All rights reserved.
3 * Use of this source code is governed by a BSD-style
4 * license that can be found in the LICENSE file.
5 */
6
7 #include <sys/types.h>
8
9 #include <sys/ioctl.h>
10 #include <dev/usb/usb.h>
11
12 #include <errno.h>
13 #include <fcntl.h>
14 #include <poll.h>
15 #include <signal.h>
16 #include <unistd.h>
17
18 #include "fido.h"
19
20 #define MAX_UHID 64
21
22 struct hid_openbsd {
23 int fd;
24 size_t report_in_len;
25 size_t report_out_len;
26 sigset_t sigmask;
27 const sigset_t *sigmaskp;
28 };
29
30 int
fido_hid_manifest(fido_dev_info_t * devlist,size_t ilen,size_t * olen)31 fido_hid_manifest(fido_dev_info_t *devlist, size_t ilen, size_t *olen)
32 {
33 size_t i;
34 char path[64];
35 int fd;
36 struct usb_device_info udi;
37 fido_dev_info_t *di;
38
39 if (ilen == 0)
40 return (FIDO_OK); /* nothing to do */
41
42 if (devlist == NULL || olen == NULL)
43 return (FIDO_ERR_INVALID_ARGUMENT);
44
45 for (i = *olen = 0; i < MAX_UHID && *olen < ilen; i++) {
46 snprintf(path, sizeof(path), "/dev/fido/%zu", i);
47 if ((fd = fido_hid_unix_open(path)) == -1)
48 continue;
49 memset(&udi, 0, sizeof(udi));
50 if (ioctl(fd, IOCTL_REQ(USB_GET_DEVICEINFO), &udi) == -1) {
51 fido_log_error(errno, "%s: get device info %s",
52 __func__, path);
53 if (close(fd) == -1)
54 fido_log_error(errno, "%s: close", __func__);
55 continue;
56 }
57 if (close(fd) == -1)
58 fido_log_error(errno, "%s: close", __func__);
59
60 fido_log_debug("%s: %s: bus = 0x%02x, addr = 0x%02x",
61 __func__, path, udi.udi_bus, udi.udi_addr);
62 fido_log_debug("%s: %s: vendor = \"%s\", product = \"%s\"",
63 __func__, path, udi.udi_vendor, udi.udi_product);
64 fido_log_debug("%s: %s: productNo = 0x%04x, vendorNo = 0x%04x, "
65 "releaseNo = 0x%04x", __func__, path, udi.udi_productNo,
66 udi.udi_vendorNo, udi.udi_releaseNo);
67
68 di = &devlist[*olen];
69 memset(di, 0, sizeof(*di));
70 di->io = (fido_dev_io_t) {
71 fido_hid_open,
72 fido_hid_close,
73 fido_hid_read,
74 fido_hid_write,
75 };
76 if ((di->path = strdup(path)) == NULL ||
77 (di->manufacturer = strdup(udi.udi_vendor)) == NULL ||
78 (di->product = strdup(udi.udi_product)) == NULL) {
79 free(di->path);
80 free(di->manufacturer);
81 free(di->product);
82 explicit_bzero(di, sizeof(*di));
83 return FIDO_ERR_INTERNAL;
84 }
85 di->vendor_id = (int16_t)udi.udi_vendorNo;
86 di->product_id = (int16_t)udi.udi_productNo;
87 (*olen)++;
88 }
89
90 return FIDO_OK;
91 }
92
93 /*
94 * Workaround for OpenBSD <=6.6-current (as of 201910) bug that loses
95 * sync of DATA0/DATA1 sequence bit across uhid open/close.
96 * Send pings until we get a response - early pings with incorrect
97 * sequence bits will be ignored as duplicate packets by the device.
98 */
99 static int
terrible_ping_kludge(struct hid_openbsd * ctx)100 terrible_ping_kludge(struct hid_openbsd *ctx)
101 {
102 u_char data[256];
103 int i, n;
104 struct pollfd pfd;
105
106 if (sizeof(data) < ctx->report_out_len + 1)
107 return -1;
108 for (i = 0; i < 4; i++) {
109 memset(data, 0, sizeof(data));
110 /* broadcast channel ID */
111 data[1] = 0xff;
112 data[2] = 0xff;
113 data[3] = 0xff;
114 data[4] = 0xff;
115 /* Ping command */
116 data[5] = 0x81;
117 /* One byte ping only, Vasili */
118 data[6] = 0;
119 data[7] = 1;
120 fido_log_debug("%s: send ping %d", __func__, i);
121 if (fido_hid_write(ctx, data, ctx->report_out_len + 1) == -1)
122 return -1;
123 fido_log_debug("%s: wait reply", __func__);
124 memset(&pfd, 0, sizeof(pfd));
125 pfd.fd = ctx->fd;
126 pfd.events = POLLIN;
127 if ((n = poll(&pfd, 1, 100)) == -1) {
128 fido_log_error(errno, "%s: poll", __func__);
129 return -1;
130 } else if (n == 0) {
131 fido_log_debug("%s: timed out", __func__);
132 continue;
133 }
134 if (fido_hid_read(ctx, data, ctx->report_out_len, 250) == -1)
135 return -1;
136 /*
137 * Ping isn't always supported on the broadcast channel,
138 * so we might get an error, but we don't care - we're
139 * synched now.
140 */
141 fido_log_xxd(data, ctx->report_out_len, "%s: got reply",
142 __func__);
143 return 0;
144 }
145 fido_log_debug("%s: no response", __func__);
146 return -1;
147 }
148
149 void *
fido_hid_open(const char * path)150 fido_hid_open(const char *path)
151 {
152 struct hid_openbsd *ret = NULL;
153
154 if ((ret = calloc(1, sizeof(*ret))) == NULL ||
155 (ret->fd = fido_hid_unix_open(path)) == -1) {
156 free(ret);
157 return (NULL);
158 }
159 ret->report_in_len = ret->report_out_len = CTAP_MAX_REPORT_LEN;
160 fido_log_debug("%s: inlen = %zu outlen = %zu", __func__,
161 ret->report_in_len, ret->report_out_len);
162
163 /*
164 * OpenBSD (as of 201910) has a bug that causes it to lose
165 * track of the DATA0/DATA1 sequence toggle across uhid device
166 * open and close. This is a terrible hack to work around it.
167 */
168 if (terrible_ping_kludge(ret) != 0) {
169 fido_hid_close(ret);
170 return NULL;
171 }
172
173 return (ret);
174 }
175
176 void
fido_hid_close(void * handle)177 fido_hid_close(void *handle)
178 {
179 struct hid_openbsd *ctx = (struct hid_openbsd *)handle;
180
181 if (close(ctx->fd) == -1)
182 fido_log_error(errno, "%s: close", __func__);
183
184 free(ctx);
185 }
186
187 int
fido_hid_set_sigmask(void * handle,const fido_sigset_t * sigmask)188 fido_hid_set_sigmask(void *handle, const fido_sigset_t *sigmask)
189 {
190 struct hid_openbsd *ctx = handle;
191
192 ctx->sigmask = *sigmask;
193 ctx->sigmaskp = &ctx->sigmask;
194
195 return (FIDO_OK);
196 }
197
198 int
fido_hid_read(void * handle,unsigned char * buf,size_t len,int ms)199 fido_hid_read(void *handle, unsigned char *buf, size_t len, int ms)
200 {
201 struct hid_openbsd *ctx = (struct hid_openbsd *)handle;
202 ssize_t r;
203
204 if (len != ctx->report_in_len) {
205 fido_log_debug("%s: invalid len: got %zu, want %zu", __func__,
206 len, ctx->report_in_len);
207 return (-1);
208 }
209
210 if (fido_hid_unix_wait(ctx->fd, ms, ctx->sigmaskp) < 0) {
211 fido_log_debug("%s: fd not ready", __func__);
212 return (-1);
213 }
214
215 if ((r = read(ctx->fd, buf, len)) == -1) {
216 fido_log_error(errno, "%s: read", __func__);
217 return (-1);
218 }
219
220 if (r < 0 || (size_t)r != len) {
221 fido_log_debug("%s: %zd != %zu", __func__, r, len);
222 return (-1);
223 }
224
225 return ((int)len);
226 }
227
228 int
fido_hid_write(void * handle,const unsigned char * buf,size_t len)229 fido_hid_write(void *handle, const unsigned char *buf, size_t len)
230 {
231 struct hid_openbsd *ctx = (struct hid_openbsd *)handle;
232 ssize_t r;
233
234 if (len != ctx->report_out_len + 1) {
235 fido_log_debug("%s: invalid len: got %zu, want %zu", __func__,
236 len, ctx->report_out_len);
237 return (-1);
238 }
239
240 if ((r = write(ctx->fd, buf + 1, len - 1)) == -1) {
241 fido_log_error(errno, "%s: write", __func__);
242 return (-1);
243 }
244
245 if (r < 0 || (size_t)r != len - 1) {
246 fido_log_debug("%s: %zd != %zu", __func__, r, len - 1);
247 return (-1);
248 }
249
250 return ((int)len);
251 }
252
253 size_t
fido_hid_report_in_len(void * handle)254 fido_hid_report_in_len(void *handle)
255 {
256 struct hid_openbsd *ctx = handle;
257
258 return (ctx->report_in_len);
259 }
260
261 size_t
fido_hid_report_out_len(void * handle)262 fido_hid_report_out_len(void *handle)
263 {
264 struct hid_openbsd *ctx = handle;
265
266 return (ctx->report_out_len);
267 }
268