1 /*
2 * Copyright (c) 2019 Google LLC. All rights reserved.
3 * Use of this source code is governed by a BSD-style
4 * license that can be found in the LICENSE file.
5 */
6
7 #include <sys/types.h>
8
9 #include <sys/ioctl.h>
10 #include <sys/time.h>
11 #include <dev/usb/usb.h>
12 #include <dev/usb/usbhid.h>
13
14 #include <errno.h>
15 #include <fcntl.h>
16 #include <signal.h>
17 #include <string.h>
18 #include <unistd.h>
19 #include <usbhid.h>
20 #include <poll.h>
21
22 #include "fido.h"
23
24 #define MAX_UHID 64
25 #define MAX_U2FHID_LEN 64
26
27 struct hid_openbsd {
28 int fd;
29 size_t report_in_len;
30 size_t report_out_len;
31 sigset_t sigmask;
32 const sigset_t *sigmaskp;
33 };
34
35 int
fido_hid_manifest(fido_dev_info_t * devlist,size_t ilen,size_t * olen)36 fido_hid_manifest(fido_dev_info_t *devlist, size_t ilen, size_t *olen)
37 {
38 size_t i;
39 char path[64];
40 int fd;
41 struct usb_device_info udi;
42 fido_dev_info_t *di;
43
44 if (ilen == 0)
45 return (FIDO_OK); /* nothing to do */
46
47 if (devlist == NULL || olen == NULL)
48 return (FIDO_ERR_INVALID_ARGUMENT);
49
50 for (i = *olen = 0; i < MAX_UHID && *olen < ilen; i++) {
51 snprintf(path, sizeof(path), "/dev/fido/%zu", i);
52 if ((fd = fido_hid_unix_open(path)) == -1)
53 continue;
54 if (close(fd) == -1)
55 fido_log_error(errno, "%s: close", __func__);
56
57 memset(&udi, 0, sizeof(udi));
58 strlcpy(udi.udi_vendor, "OpenBSD", sizeof(udi.udi_vendor));
59 strlcpy(udi.udi_product, "fido(4)", sizeof(udi.udi_product));
60 udi.udi_vendorNo = 0x0b5d; /* stolen from PCI_VENDOR_OPENBSD */
61
62 fido_log_debug("%s: %s: vendor = \"%s\", product = \"%s\"",
63 __func__, path, udi.udi_vendor, udi.udi_product);
64
65 di = &devlist[*olen];
66 memset(di, 0, sizeof(*di));
67 di->io = (fido_dev_io_t) {
68 fido_hid_open,
69 fido_hid_close,
70 fido_hid_read,
71 fido_hid_write,
72 };
73 if ((di->path = strdup(path)) == NULL ||
74 (di->manufacturer = strdup(udi.udi_vendor)) == NULL ||
75 (di->product = strdup(udi.udi_product)) == NULL) {
76 free(di->path);
77 free(di->manufacturer);
78 free(di->product);
79 explicit_bzero(di, sizeof(*di));
80 return FIDO_ERR_INTERNAL;
81 }
82 di->vendor_id = (int16_t)udi.udi_vendorNo;
83 di->product_id = (int16_t)udi.udi_productNo;
84 (*olen)++;
85 }
86
87 return FIDO_OK;
88 }
89
90 /*
91 * Workaround for OpenBSD <=6.6-current (as of 201910) bug that loses
92 * sync of DATA0/DATA1 sequence bit across uhid open/close.
93 * Send pings until we get a response - early pings with incorrect
94 * sequence bits will be ignored as duplicate packets by the device.
95 */
96 static int
terrible_ping_kludge(struct hid_openbsd * ctx)97 terrible_ping_kludge(struct hid_openbsd *ctx)
98 {
99 u_char data[256];
100 int i, n;
101 struct pollfd pfd;
102
103 if (sizeof(data) < ctx->report_out_len + 1)
104 return -1;
105 for (i = 0; i < 4; i++) {
106 memset(data, 0, sizeof(data));
107 /* broadcast channel ID */
108 data[1] = 0xff;
109 data[2] = 0xff;
110 data[3] = 0xff;
111 data[4] = 0xff;
112 /* Ping command */
113 data[5] = 0x81;
114 /* One byte ping only, Vasili */
115 data[6] = 0;
116 data[7] = 1;
117 fido_log_debug("%s: send ping %d", __func__, i);
118 if (fido_hid_write(ctx, data, ctx->report_out_len + 1) == -1)
119 return -1;
120 fido_log_debug("%s: wait reply", __func__);
121 memset(&pfd, 0, sizeof(pfd));
122 pfd.fd = ctx->fd;
123 pfd.events = POLLIN;
124 if ((n = poll(&pfd, 1, 100)) == -1) {
125 fido_log_debug("%s: poll: %s", __func__, strerror(errno));
126 return -1;
127 } else if (n == 0) {
128 fido_log_debug("%s: timed out", __func__);
129 continue;
130 }
131 if (fido_hid_read(ctx, data, ctx->report_out_len, 250) == -1)
132 return -1;
133 /*
134 * Ping isn't always supported on the broadcast channel,
135 * so we might get an error, but we don't care - we're
136 * synched now.
137 */
138 fido_log_debug("%s: got reply", __func__);
139 fido_log_xxd(data, ctx->report_out_len, "%s", __func__);
140 return 0;
141 }
142 fido_log_debug("%s: no response", __func__);
143 return -1;
144 }
145
146 void *
fido_hid_open(const char * path)147 fido_hid_open(const char *path)
148 {
149 struct hid_openbsd *ret = NULL;
150
151 if ((ret = calloc(1, sizeof(*ret))) == NULL ||
152 (ret->fd = fido_hid_unix_open(path)) == -1) {
153 free(ret);
154 return (NULL);
155 }
156 ret->report_in_len = ret->report_out_len = CTAP_MAX_REPORT_LEN;
157 fido_log_debug("%s: inlen = %zu outlen = %zu", __func__,
158 ret->report_in_len, ret->report_out_len);
159
160 /*
161 * OpenBSD (as of 201910) has a bug that causes it to lose
162 * track of the DATA0/DATA1 sequence toggle across uhid device
163 * open and close. This is a terrible hack to work around it.
164 */
165 if (terrible_ping_kludge(ret) != 0) {
166 fido_hid_close(ret);
167 return NULL;
168 }
169
170 return (ret);
171 }
172
173 void
fido_hid_close(void * handle)174 fido_hid_close(void *handle)
175 {
176 struct hid_openbsd *ctx = (struct hid_openbsd *)handle;
177
178 if (close(ctx->fd) == -1)
179 fido_log_error(errno, "%s: close", __func__);
180
181 free(ctx);
182 }
183
184 int
fido_hid_set_sigmask(void * handle,const fido_sigset_t * sigmask)185 fido_hid_set_sigmask(void *handle, const fido_sigset_t *sigmask)
186 {
187 struct hid_openbsd *ctx = handle;
188
189 ctx->sigmask = *sigmask;
190 ctx->sigmaskp = &ctx->sigmask;
191
192 return (FIDO_OK);
193 }
194
195 int
fido_hid_read(void * handle,unsigned char * buf,size_t len,int ms)196 fido_hid_read(void *handle, unsigned char *buf, size_t len, int ms)
197 {
198 struct hid_openbsd *ctx = (struct hid_openbsd *)handle;
199 ssize_t r;
200
201 if (len != ctx->report_in_len) {
202 fido_log_debug("%s: invalid len: got %zu, want %zu", __func__,
203 len, ctx->report_in_len);
204 return (-1);
205 }
206
207 if (fido_hid_unix_wait(ctx->fd, ms, ctx->sigmaskp) < 0) {
208 fido_log_debug("%s: fd not ready", __func__);
209 return (-1);
210 }
211
212 if ((r = read(ctx->fd, buf, len)) == -1) {
213 fido_log_error(errno, "%s: read", __func__);
214 return (-1);
215 }
216
217 if (r < 0 || (size_t)r != len) {
218 fido_log_debug("%s: %zd != %zu", __func__, r, len);
219 return (-1);
220 }
221
222 return ((int)len);
223 }
224
225 int
fido_hid_write(void * handle,const unsigned char * buf,size_t len)226 fido_hid_write(void *handle, const unsigned char *buf, size_t len)
227 {
228 struct hid_openbsd *ctx = (struct hid_openbsd *)handle;
229 ssize_t r;
230
231 if (len != ctx->report_out_len + 1) {
232 fido_log_debug("%s: invalid len: got %zu, want %zu", __func__,
233 len, ctx->report_out_len);
234 return (-1);
235 }
236
237 if ((r = write(ctx->fd, buf + 1, len - 1)) == -1) {
238 fido_log_error(errno, "%s: write", __func__);
239 return (-1);
240 }
241
242 if (r < 0 || (size_t)r != len - 1) {
243 fido_log_debug("%s: %zd != %zu", __func__, r, len - 1);
244 return (-1);
245 }
246
247 return ((int)len);
248 }
249
250 size_t
fido_hid_report_in_len(void * handle)251 fido_hid_report_in_len(void *handle)
252 {
253 struct hid_openbsd *ctx = handle;
254
255 return (ctx->report_in_len);
256 }
257
258 size_t
fido_hid_report_out_len(void * handle)259 fido_hid_report_out_len(void *handle)
260 {
261 struct hid_openbsd *ctx = handle;
262
263 return (ctx->report_out_len);
264 }
265