1 /* 2 * Copyright (c) 2019 Google LLC. All rights reserved. 3 * Use of this source code is governed by a BSD-style 4 * license that can be found in the LICENSE file. 5 */ 6 7 #include <sys/types.h> 8 9 #include <sys/ioctl.h> 10 #include <sys/time.h> 11 #include <dev/usb/usb.h> 12 #include <dev/usb/usbhid.h> 13 14 #include <errno.h> 15 #include <fcntl.h> 16 #include <string.h> 17 #include <unistd.h> 18 #include <usbhid.h> 19 #include <poll.h> 20 21 #include "fido.h" 22 23 #define MAX_UHID 64 24 #define MAX_U2FHID_LEN 64 25 26 struct hid_openbsd { 27 int fd; 28 size_t report_in_len; 29 size_t report_out_len; 30 }; 31 32 int 33 fido_hid_manifest(fido_dev_info_t *devlist, size_t ilen, size_t *olen) 34 { 35 size_t i; 36 char path[64]; 37 int fd; 38 struct usb_device_info udi; 39 fido_dev_info_t *di; 40 41 if (ilen == 0) 42 return (FIDO_OK); /* nothing to do */ 43 44 if (devlist == NULL || olen == NULL) 45 return (FIDO_ERR_INVALID_ARGUMENT); 46 47 for (i = *olen = 0; i < MAX_UHID && *olen < ilen; i++) { 48 snprintf(path, sizeof(path), "/dev/fido/%zu", i); 49 if ((fd = open(path, O_RDWR)) == -1) { 50 if (errno != ENOENT && errno != ENXIO) { 51 fido_log_debug("%s: open %s: %s", __func__, 52 path, strerror(errno)); 53 } 54 continue; 55 } 56 close(fd); 57 58 memset(&udi, 0, sizeof(udi)); 59 strlcpy(udi.udi_vendor, "OpenBSD", sizeof(udi.udi_vendor)); 60 strlcpy(udi.udi_product, "fido(4)", sizeof(udi.udi_product)); 61 udi.udi_vendorNo = 0x0b5d; /* stolen from PCI_VENDOR_OPENBSD */ 62 63 fido_log_debug("%s: %s: vendor = \"%s\", product = \"%s\"", 64 __func__, path, udi.udi_vendor, udi.udi_product); 65 66 di = &devlist[*olen]; 67 memset(di, 0, sizeof(*di)); 68 if ((di->path = strdup(path)) == NULL || 69 (di->manufacturer = strdup(udi.udi_vendor)) == NULL || 70 (di->product = strdup(udi.udi_product)) == NULL) { 71 free(di->path); 72 free(di->manufacturer); 73 free(di->product); 74 explicit_bzero(di, sizeof(*di)); 75 return FIDO_ERR_INTERNAL; 76 } 77 di->vendor_id = udi.udi_vendorNo; 78 di->product_id = udi.udi_productNo; 79 di->io = (fido_dev_io_t) { 80 fido_hid_open, 81 fido_hid_close, 82 fido_hid_read, 83 fido_hid_write, 84 }; 85 (*olen)++; 86 } 87 88 return FIDO_OK; 89 } 90 91 /* 92 * Workaround for OpenBSD <=6.6-current (as of 201910) bug that loses 93 * sync of DATA0/DATA1 sequence bit across uhid open/close. 94 * Send pings until we get a response - early pings with incorrect 95 * sequence bits will be ignored as duplicate packets by the device. 96 */ 97 static int 98 terrible_ping_kludge(struct hid_openbsd *ctx) 99 { 100 u_char data[256]; 101 int i, n; 102 struct pollfd pfd; 103 104 if (sizeof(data) < ctx->report_out_len + 1) 105 return -1; 106 for (i = 0; i < 4; i++) { 107 memset(data, 0, sizeof(data)); 108 /* broadcast channel ID */ 109 data[1] = 0xff; 110 data[2] = 0xff; 111 data[3] = 0xff; 112 data[4] = 0xff; 113 /* Ping command */ 114 data[5] = 0x81; 115 /* One byte ping only, Vasili */ 116 data[6] = 0; 117 data[7] = 1; 118 fido_log_debug("%s: send ping %d", __func__, i); 119 if (fido_hid_write(ctx, data, ctx->report_out_len + 1) == -1) 120 return -1; 121 fido_log_debug("%s: wait reply", __func__); 122 memset(&pfd, 0, sizeof(pfd)); 123 pfd.fd = ctx->fd; 124 pfd.events = POLLIN; 125 if ((n = poll(&pfd, 1, 100)) == -1) { 126 fido_log_debug("%s: poll: %s", __func__, strerror(errno)); 127 return -1; 128 } else if (n == 0) { 129 fido_log_debug("%s: timed out", __func__); 130 continue; 131 } 132 if (fido_hid_read(ctx, data, ctx->report_out_len, 250) == -1) 133 return -1; 134 /* 135 * Ping isn't always supported on the broadcast channel, 136 * so we might get an error, but we don't care - we're 137 * synched now. 138 */ 139 fido_log_debug("%s: got reply", __func__); 140 fido_log_xxd(data, ctx->report_out_len); 141 return 0; 142 } 143 fido_log_debug("%s: no response", __func__); 144 return -1; 145 } 146 147 void * 148 fido_hid_open(const char *path) 149 { 150 struct hid_openbsd *ret = NULL; 151 152 if ((ret = calloc(1, sizeof(*ret))) == NULL || 153 (ret->fd = open(path, O_RDWR)) < 0) { 154 free(ret); 155 return (NULL); 156 } 157 ret->report_in_len = ret->report_out_len = MAX_U2FHID_LEN; 158 fido_log_debug("%s: inlen = %zu outlen = %zu", __func__, 159 ret->report_in_len, ret->report_out_len); 160 161 /* 162 * OpenBSD (as of 201910) has a bug that causes it to lose 163 * track of the DATA0/DATA1 sequence toggle across uhid device 164 * open and close. This is a terrible hack to work around it. 165 */ 166 if (terrible_ping_kludge(ret) != 0) { 167 fido_hid_close(ret); 168 return NULL; 169 } 170 171 return (ret); 172 } 173 174 void 175 fido_hid_close(void *handle) 176 { 177 struct hid_openbsd *ctx = (struct hid_openbsd *)handle; 178 179 close(ctx->fd); 180 free(ctx); 181 } 182 183 int 184 waitfd(int fd, int ms) 185 { 186 struct timespec ts_start, ts_now, ts_delta; 187 struct pollfd pfd; 188 int ms_remain, r; 189 190 if (ms < 0) 191 return 0; 192 memset(&pfd, 0, sizeof(pfd)); 193 pfd.fd = fd; 194 pfd.events = POLLIN; 195 if (clock_gettime(CLOCK_MONOTONIC, &ts_start) != 0) { 196 fido_log_debug("%s: clock_gettime: %s", 197 __func__, strerror(errno)); 198 return -1; 199 } 200 for (ms_remain = ms; ms_remain > 0;) { 201 if ((r = poll(&pfd, 1, ms_remain)) > 0) 202 return 0; 203 else if (r == 0) 204 break; 205 else if (errno != EINTR) { 206 fido_log_debug("%s: poll: %s", 207 __func__, strerror(errno)); 208 return -1; 209 } 210 /* poll interrupted - subtract time already waited */ 211 if (clock_gettime(CLOCK_MONOTONIC, &ts_now) != 0) { 212 fido_log_debug("%s: clock_gettime: %s", 213 __func__, strerror(errno)); 214 return -1; 215 } 216 timespecsub(&ts_now, &ts_start, &ts_delta); 217 ms_remain = ms - ((ts_delta.tv_sec * 1000) + 218 (ts_delta.tv_nsec / 1000000)); 219 } 220 return -1; 221 } 222 223 int 224 fido_hid_read(void *handle, unsigned char *buf, size_t len, int ms) 225 { 226 struct hid_openbsd *ctx = (struct hid_openbsd *)handle; 227 ssize_t r; 228 229 fido_log_debug("%s: %zu timeout %d", __func__, len, ms); 230 if (len != ctx->report_in_len) { 231 fido_log_debug("%s: invalid len: got %zu, want %zu", __func__, 232 len, ctx->report_in_len); 233 return (-1); 234 } 235 if (waitfd(ctx->fd, ms) != 0) { 236 fido_log_debug("%s: fd not ready", __func__); 237 return (-1); 238 } 239 if ((r = read(ctx->fd, buf, len)) == -1 || (size_t)r != len) { 240 fido_log_debug("%s: read: %s", __func__, strerror(errno)); 241 return (-1); 242 } 243 return ((int)len); 244 } 245 246 int 247 fido_hid_write(void *handle, const unsigned char *buf, size_t len) 248 { 249 struct hid_openbsd *ctx = (struct hid_openbsd *)handle; 250 ssize_t r; 251 252 if (len != ctx->report_out_len + 1) { 253 fido_log_debug("%s: invalid len: got %zu, want %zu", __func__, 254 len, ctx->report_out_len); 255 return (-1); 256 } 257 if ((r = write(ctx->fd, buf + 1, len - 1)) == -1 || 258 (size_t)r != len - 1) { 259 fido_log_debug("%s: write: %s", __func__, strerror(errno)); 260 return (-1); 261 } 262 return ((int)len); 263 } 264 265 size_t 266 fido_hid_report_in_len(void *handle) 267 { 268 struct hid_openbsd *ctx = handle; 269 270 return (ctx->report_in_len); 271 } 272 273 size_t 274 fido_hid_report_out_len(void *handle) 275 { 276 struct hid_openbsd *ctx = handle; 277 278 return (ctx->report_out_len); 279 } 280