Line | Count | Source |
1 | | /* |
2 | | * Copyright (c) 2020-2022 Yubico AB. All rights reserved. |
3 | | * Use of this source code is governed by a BSD-style |
4 | | * license that can be found in the LICENSE file. |
5 | | * SPDX-License-Identifier: BSD-2-Clause |
6 | | */ |
7 | | |
8 | | #include "fido.h" |
9 | | #include "fido/config.h" |
10 | | #include "fido/es256.h" |
11 | | |
12 | 930 | #define CMD_ENABLE_ENTATTEST 0x01 |
13 | 925 | #define CMD_TOGGLE_ALWAYS_UV 0x02 |
14 | 2.18k | #define CMD_SET_PIN_MINLEN 0x03 |
15 | | |
16 | | static int |
17 | | config_prepare_hmac(uint8_t subcmd, const cbor_item_t *item, fido_blob_t *hmac) |
18 | 1.81k | { |
19 | 1.81k | uint8_t prefix[32 + 2 * sizeof(uint8_t)], cbor[128]; |
20 | 1.81k | size_t cbor_len = 0; |
21 | | |
22 | 1.81k | memset(prefix, 0xff, sizeof(prefix)); |
23 | 1.81k | prefix[sizeof(prefix) - 2] = CTAP_CBOR_CONFIG; |
24 | 1.81k | prefix[sizeof(prefix) - 1] = subcmd; |
25 | | |
26 | 1.81k | if (item != NULL) { |
27 | 990 | if ((cbor_len = cbor_serialize(item, cbor, sizeof(cbor))) == 0) { |
28 | 239 | fido_log_debug("%s: cbor_serialize", __func__); |
29 | 239 | return -1; |
30 | 239 | } |
31 | 990 | } |
32 | 1.57k | if ((hmac->ptr = malloc(cbor_len + sizeof(prefix))) == NULL) { |
33 | 17 | fido_log_debug("%s: malloc", __func__); |
34 | 17 | return -1; |
35 | 17 | } |
36 | 1.55k | memcpy(hmac->ptr, prefix, sizeof(prefix)); |
37 | 1.55k | memcpy(hmac->ptr + sizeof(prefix), cbor, cbor_len); |
38 | 1.55k | hmac->len = cbor_len + sizeof(prefix); |
39 | | |
40 | 1.55k | return 0; |
41 | 1.57k | } |
42 | | |
43 | | static int |
44 | | config_tx(fido_dev_t *dev, uint8_t subcmd, cbor_item_t **paramv, size_t paramc, |
45 | | const char *pin, int *ms) |
46 | 4.04k | { |
47 | 4.04k | cbor_item_t *argv[4]; |
48 | 4.04k | es256_pk_t *pk = NULL; |
49 | 4.04k | fido_blob_t *ecdh = NULL, f, hmac; |
50 | 4.04k | const uint8_t cmd = CTAP_CBOR_CONFIG; |
51 | 4.04k | int r = FIDO_ERR_INTERNAL; |
52 | | |
53 | 4.04k | memset(&f, 0, sizeof(f)); |
54 | 4.04k | memset(&hmac, 0, sizeof(hmac)); |
55 | 4.04k | memset(&argv, 0, sizeof(argv)); |
56 | | |
57 | | /* subCommand */ |
58 | 4.04k | if ((argv[0] = cbor_build_uint8(subcmd)) == NULL) { |
59 | 19 | fido_log_debug("%s: cbor encode", __func__); |
60 | 19 | goto fail; |
61 | 19 | } |
62 | | |
63 | | /* subCommandParams */ |
64 | 4.02k | if (paramc != 0 && |
65 | 4.02k | (argv[1] = cbor_flatten_vector(paramv, paramc)) == NULL) { |
66 | 20 | fido_log_debug("%s: cbor_flatten_vector", __func__); |
67 | 20 | goto fail; |
68 | 20 | } |
69 | | |
70 | | /* pinProtocol, pinAuth */ |
71 | 4.00k | if (pin != NULL || |
72 | 4.00k | (fido_dev_supports_permissions(dev) && fido_dev_has_uv(dev))) { |
73 | 1.81k | if (config_prepare_hmac(subcmd, argv[1], &hmac) < 0) { |
74 | 256 | fido_log_debug("%s: config_prepare_hmac", __func__); |
75 | 256 | goto fail; |
76 | 256 | } |
77 | 1.55k | if ((r = fido_do_ecdh(dev, &pk, &ecdh, ms)) != FIDO_OK) { |
78 | 1.31k | fido_log_debug("%s: fido_do_ecdh", __func__); |
79 | 1.31k | goto fail; |
80 | 1.31k | } |
81 | 238 | if ((r = cbor_add_uv_params(dev, cmd, &hmac, pk, ecdh, pin, |
82 | 238 | NULL, &argv[3], &argv[2], ms)) != FIDO_OK) { |
83 | 228 | fido_log_debug("%s: cbor_add_uv_params", __func__); |
84 | 228 | goto fail; |
85 | 228 | } |
86 | 238 | } |
87 | | |
88 | | /* framing and transmission */ |
89 | 2.20k | if (cbor_build_frame(cmd, argv, nitems(argv), &f) < 0 || |
90 | 2.20k | fido_tx(dev, CTAP_CMD_CBOR, f.ptr, f.len, ms) < 0) { |
91 | 158 | fido_log_debug("%s: fido_tx", __func__); |
92 | 158 | r = FIDO_ERR_TX; |
93 | 158 | goto fail; |
94 | 158 | } |
95 | | |
96 | 2.04k | r = FIDO_OK; |
97 | 4.04k | fail: |
98 | 4.04k | cbor_vector_free(argv, nitems(argv)); |
99 | 4.04k | es256_pk_free(&pk); |
100 | 4.04k | fido_blob_free(&ecdh); |
101 | 4.04k | free(f.ptr); |
102 | 4.04k | free(hmac.ptr); |
103 | | |
104 | 4.04k | return r; |
105 | 2.04k | } |
106 | | |
107 | | static int |
108 | | config_enable_entattest_wait(fido_dev_t *dev, const char *pin, int *ms) |
109 | 930 | { |
110 | 930 | int r; |
111 | | |
112 | 930 | if ((r = config_tx(dev, CMD_ENABLE_ENTATTEST, NULL, 0, pin, |
113 | 930 | ms)) != FIDO_OK) |
114 | 454 | return r; |
115 | | |
116 | 476 | return fido_rx_cbor_status(dev, ms); |
117 | 930 | } |
118 | | |
119 | | int |
120 | | fido_dev_enable_entattest(fido_dev_t *dev, const char *pin) |
121 | 930 | { |
122 | 930 | int ms = dev->timeout_ms; |
123 | | |
124 | 930 | return (config_enable_entattest_wait(dev, pin, &ms)); |
125 | 930 | } |
126 | | |
127 | | static int |
128 | | config_toggle_always_uv_wait(fido_dev_t *dev, const char *pin, int *ms) |
129 | 925 | { |
130 | 925 | int r; |
131 | | |
132 | 925 | if ((r = config_tx(dev, CMD_TOGGLE_ALWAYS_UV, NULL, 0, pin, |
133 | 925 | ms)) != FIDO_OK) |
134 | 423 | return r; |
135 | | |
136 | 502 | return (fido_rx_cbor_status(dev, ms)); |
137 | 925 | } |
138 | | |
139 | | int |
140 | | fido_dev_toggle_always_uv(fido_dev_t *dev, const char *pin) |
141 | 925 | { |
142 | 925 | int ms = dev->timeout_ms; |
143 | | |
144 | 925 | return config_toggle_always_uv_wait(dev, pin, &ms); |
145 | 925 | } |
146 | | |
147 | | static int |
148 | | config_pin_minlen_tx(fido_dev_t *dev, size_t len, bool force, |
149 | | const fido_str_array_t *rpid, const char *pin, int *ms) |
150 | 2.69k | { |
151 | 2.69k | cbor_item_t *argv[3]; |
152 | 2.69k | int r; |
153 | | |
154 | 2.69k | memset(argv, 0, sizeof(argv)); |
155 | | |
156 | 2.69k | if ((rpid == NULL && len == 0 && !force) || len > UINT8_MAX) { |
157 | 371 | r = FIDO_ERR_INVALID_ARGUMENT; |
158 | 371 | goto fail; |
159 | 371 | } |
160 | 2.32k | if (len && (argv[0] = cbor_build_uint8((uint8_t)len)) == NULL) { |
161 | 1 | fido_log_debug("%s: cbor_encode_uint8", __func__); |
162 | 1 | r = FIDO_ERR_INTERNAL; |
163 | 1 | goto fail; |
164 | 1 | } |
165 | 2.32k | if (rpid != NULL && (argv[1] = cbor_encode_str_array(rpid)) == NULL) { |
166 | 132 | fido_log_debug("%s: cbor_encode_str_array", __func__); |
167 | 132 | r = FIDO_ERR_INTERNAL; |
168 | 132 | goto fail; |
169 | 132 | } |
170 | 2.19k | if (force && (argv[2] = cbor_build_bool(true)) == NULL) { |
171 | 4 | fido_log_debug("%s: cbor_build_bool", __func__); |
172 | 4 | r = FIDO_ERR_INTERNAL; |
173 | 4 | goto fail; |
174 | 4 | } |
175 | 2.18k | if ((r = config_tx(dev, CMD_SET_PIN_MINLEN, argv, nitems(argv), |
176 | 2.18k | pin, ms)) != FIDO_OK) { |
177 | 1.12k | fido_log_debug("%s: config_tx", __func__); |
178 | 1.12k | goto fail; |
179 | 1.12k | } |
180 | | |
181 | 2.69k | fail: |
182 | 2.69k | cbor_vector_free(argv, nitems(argv)); |
183 | | |
184 | 2.69k | return r; |
185 | 2.18k | } |
186 | | |
187 | | static int |
188 | | config_pin_minlen(fido_dev_t *dev, size_t len, bool force, |
189 | | const fido_str_array_t *rpid, const char *pin, int *ms) |
190 | 2.69k | { |
191 | 2.69k | int r; |
192 | | |
193 | 2.69k | if ((r = config_pin_minlen_tx(dev, len, force, rpid, pin, |
194 | 2.69k | ms)) != FIDO_OK) |
195 | 1.63k | return r; |
196 | | |
197 | 1.06k | return fido_rx_cbor_status(dev, ms); |
198 | 2.69k | } |
199 | | |
200 | | int |
201 | | fido_dev_set_pin_minlen(fido_dev_t *dev, size_t len, const char *pin) |
202 | 872 | { |
203 | 872 | int ms = dev->timeout_ms; |
204 | | |
205 | 872 | return config_pin_minlen(dev, len, false, NULL, pin, &ms); |
206 | 872 | } |
207 | | |
208 | | int |
209 | | fido_dev_force_pin_change(fido_dev_t *dev, const char *pin) |
210 | 930 | { |
211 | 930 | int ms = dev->timeout_ms; |
212 | | |
213 | 930 | return config_pin_minlen(dev, 0, true, NULL, pin, &ms); |
214 | 930 | } |
215 | | |
216 | | int |
217 | | fido_dev_set_pin_minlen_rpid(fido_dev_t *dev, const char * const *rpid, |
218 | | size_t n, const char *pin) |
219 | 953 | { |
220 | 953 | fido_str_array_t sa; |
221 | 953 | int ms = dev->timeout_ms; |
222 | 953 | int r; |
223 | | |
224 | 953 | memset(&sa, 0, sizeof(sa)); |
225 | 953 | if (fido_str_array_pack(&sa, rpid, n) < 0) { |
226 | 58 | fido_log_debug("%s: fido_str_array_pack", __func__); |
227 | 58 | r = FIDO_ERR_INTERNAL; |
228 | 58 | goto fail; |
229 | 58 | } |
230 | 895 | r = config_pin_minlen(dev, 0, false, &sa, pin, &ms); |
231 | 953 | fail: |
232 | 953 | fido_str_array_free(&sa); |
233 | | |
234 | 953 | return r; |
235 | 895 | } |