1 /* 2 * Copyright (c) 2019 Google LLC. All rights reserved. 3 * Use of this source code is governed by a BSD-style 4 * license that can be found in the LICENSE file. 5 */ 6 7 #include <sys/types.h> 8 9 #include <sys/ioctl.h> 10 #include <dev/usb/usb.h> 11 12 #include <errno.h> 13 #include <fcntl.h> 14 #include <string.h> 15 #include <unistd.h> 16 #include <poll.h> 17 18 #include "fido.h" 19 20 #define MAX_UHID 64 21 22 struct hid_openbsd { 23 int fd; 24 size_t report_in_len; 25 size_t report_out_len; 26 }; 27 28 int 29 fido_hid_manifest(fido_dev_info_t *devlist, size_t ilen, size_t *olen) 30 { 31 size_t i; 32 char path[64]; 33 int fd; 34 struct usb_device_info udi; 35 fido_dev_info_t *di; 36 37 if (ilen == 0) 38 return (FIDO_OK); /* nothing to do */ 39 40 if (devlist == NULL || olen == NULL) 41 return (FIDO_ERR_INVALID_ARGUMENT); 42 43 for (i = *olen = 0; i < MAX_UHID && *olen < ilen; i++) { 44 snprintf(path, sizeof(path), "/dev/fido/%zu", i); 45 if ((fd = open(path, O_RDWR)) == -1) { 46 if (errno != ENOENT && errno != ENXIO) { 47 fido_log_debug("%s: open %s: %s", __func__, 48 path, strerror(errno)); 49 } 50 continue; 51 } 52 53 memset(&udi, 0, sizeof(udi)); 54 if (ioctl(fd, USB_GET_DEVICEINFO, &udi) != 0) { 55 fido_log_debug("%s: get device info %s: %s", __func__, 56 path, strerror(errno)); 57 close(fd); 58 continue; 59 } 60 close(fd); 61 62 fido_log_debug("%s: %s: bus = 0x%02x, addr = 0x%02x", 63 __func__, path, udi.udi_bus, udi.udi_addr); 64 fido_log_debug("%s: %s: vendor = \"%s\", product = \"%s\"", 65 __func__, path, udi.udi_vendor, udi.udi_product); 66 fido_log_debug("%s: %s: productNo = 0x%04x, vendorNo = 0x%04x, " 67 "releaseNo = 0x%04x", __func__, path, udi.udi_productNo, 68 udi.udi_vendorNo, udi.udi_releaseNo); 69 70 di = &devlist[*olen]; 71 memset(di, 0, sizeof(*di)); 72 di->io = (fido_dev_io_t) { 73 fido_hid_open, 74 fido_hid_close, 75 fido_hid_read, 76 fido_hid_write, 77 }; 78 if ((di->path = strdup(path)) == NULL || 79 (di->manufacturer = strdup(udi.udi_vendor)) == NULL || 80 (di->product = strdup(udi.udi_product)) == NULL) { 81 free(di->path); 82 free(di->manufacturer); 83 free(di->product); 84 explicit_bzero(di, sizeof(*di)); 85 return FIDO_ERR_INTERNAL; 86 } 87 di->vendor_id = (int16_t)udi.udi_vendorNo; 88 di->product_id = (int16_t)udi.udi_productNo; 89 (*olen)++; 90 } 91 92 return FIDO_OK; 93 } 94 95 /* 96 * Workaround for OpenBSD <=6.6-current (as of 201910) bug that loses 97 * sync of DATA0/DATA1 sequence bit across uhid open/close. 98 * Send pings until we get a response - early pings with incorrect 99 * sequence bits will be ignored as duplicate packets by the device. 100 */ 101 static int 102 terrible_ping_kludge(struct hid_openbsd *ctx) 103 { 104 u_char data[256]; 105 int i, n; 106 struct pollfd pfd; 107 108 if (sizeof(data) < ctx->report_out_len + 1) 109 return -1; 110 for (i = 0; i < 4; i++) { 111 memset(data, 0, sizeof(data)); 112 /* broadcast channel ID */ 113 data[1] = 0xff; 114 data[2] = 0xff; 115 data[3] = 0xff; 116 data[4] = 0xff; 117 /* Ping command */ 118 data[5] = 0x81; 119 /* One byte ping only, Vasili */ 120 data[6] = 0; 121 data[7] = 1; 122 fido_log_debug("%s: send ping %d", __func__, i); 123 if (fido_hid_write(ctx, data, ctx->report_out_len + 1) == -1) 124 return -1; 125 fido_log_debug("%s: wait reply", __func__); 126 memset(&pfd, 0, sizeof(pfd)); 127 pfd.fd = ctx->fd; 128 pfd.events = POLLIN; 129 if ((n = poll(&pfd, 1, 100)) == -1) { 130 fido_log_debug("%s: poll: %s", __func__, strerror(errno)); 131 return -1; 132 } else if (n == 0) { 133 fido_log_debug("%s: timed out", __func__); 134 continue; 135 } 136 if (fido_hid_read(ctx, data, ctx->report_out_len, 250) == -1) 137 return -1; 138 /* 139 * Ping isn't always supported on the broadcast channel, 140 * so we might get an error, but we don't care - we're 141 * synched now. 142 */ 143 fido_log_debug("%s: got reply", __func__); 144 fido_log_xxd(data, ctx->report_out_len); 145 return 0; 146 } 147 fido_log_debug("%s: no response", __func__); 148 return -1; 149 } 150 151 void * 152 fido_hid_open(const char *path) 153 { 154 struct hid_openbsd *ret = NULL; 155 156 if ((ret = calloc(1, sizeof(*ret))) == NULL || 157 (ret->fd = open(path, O_RDWR)) < 0) { 158 free(ret); 159 return (NULL); 160 } 161 ret->report_in_len = ret->report_out_len = CTAP_MAX_REPORT_LEN; 162 fido_log_debug("%s: inlen = %zu outlen = %zu", __func__, 163 ret->report_in_len, ret->report_out_len); 164 165 /* 166 * OpenBSD (as of 201910) has a bug that causes it to lose 167 * track of the DATA0/DATA1 sequence toggle across uhid device 168 * open and close. This is a terrible hack to work around it. 169 */ 170 if (terrible_ping_kludge(ret) != 0) { 171 fido_hid_close(ret); 172 return NULL; 173 } 174 175 return (ret); 176 } 177 178 void 179 fido_hid_close(void *handle) 180 { 181 struct hid_openbsd *ctx = (struct hid_openbsd *)handle; 182 183 close(ctx->fd); 184 free(ctx); 185 } 186 187 int 188 fido_hid_read(void *handle, unsigned char *buf, size_t len, int ms) 189 { 190 struct hid_openbsd *ctx = (struct hid_openbsd *)handle; 191 ssize_t r; 192 193 (void)ms; /* XXX */ 194 195 if (len != ctx->report_in_len) { 196 fido_log_debug("%s: invalid len: got %zu, want %zu", __func__, 197 len, ctx->report_in_len); 198 return (-1); 199 } 200 if ((r = read(ctx->fd, buf, len)) == -1 || (size_t)r != len) { 201 fido_log_debug("%s: read: %s", __func__, strerror(errno)); 202 return (-1); 203 } 204 return ((int)len); 205 } 206 207 int 208 fido_hid_write(void *handle, const unsigned char *buf, size_t len) 209 { 210 struct hid_openbsd *ctx = (struct hid_openbsd *)handle; 211 ssize_t r; 212 213 if (len != ctx->report_out_len + 1) { 214 fido_log_debug("%s: invalid len: got %zu, want %zu", __func__, 215 len, ctx->report_out_len); 216 return (-1); 217 } 218 if ((r = write(ctx->fd, buf + 1, len - 1)) == -1 || 219 (size_t)r != len - 1) { 220 fido_log_debug("%s: write: %s", __func__, strerror(errno)); 221 return (-1); 222 } 223 return ((int)len); 224 } 225 226 size_t 227 fido_hid_report_in_len(void *handle) 228 { 229 struct hid_openbsd *ctx = handle; 230 231 return (ctx->report_in_len); 232 } 233 234 size_t 235 fido_hid_report_out_len(void *handle) 236 { 237 struct hid_openbsd *ctx = handle; 238 239 return (ctx->report_out_len); 240 } 241