1 /* 2 * Copyright (c) 2020 Yubico AB. All rights reserved. 3 * Use of this source code is governed by a BSD-style 4 * license that can be found in the LICENSE file. 5 */ 6 7 #include <assert.h> 8 #include <stdint.h> 9 #include <stdlib.h> 10 #include <string.h> 11 #include <stdio.h> 12 13 #include "../openbsd-compat/openbsd-compat.h" 14 #include "mutator_aux.h" 15 16 extern int fido_hid_get_usage(const uint8_t *, size_t, uint32_t *); 17 extern int fido_hid_get_report_len(const uint8_t *, size_t, size_t *, size_t *); 18 extern void set_udev_parameters(const char *, const struct blob *); 19 20 struct param { 21 int seed; 22 char uevent[MAXSTR]; 23 struct blob report_descriptor; 24 }; 25 26 /* 27 * Sample HID report descriptor from the FIDO HID interface of a YubiKey 5. 28 */ 29 static const uint8_t dummy_report_descriptor[] = { 30 0x06, 0xd0, 0xf1, 0x09, 0x01, 0xa1, 0x01, 0x09, 31 0x20, 0x15, 0x00, 0x26, 0xff, 0x00, 0x75, 0x08, 32 0x95, 0x40, 0x81, 0x02, 0x09, 0x21, 0x15, 0x00, 33 0x26, 0xff, 0x00, 0x75, 0x08, 0x95, 0x40, 0x91, 34 0x02, 0xc0 35 }; 36 37 /* 38 * Sample uevent file from a Yubico Security Key. 39 */ 40 static const char dummy_uevent[] = 41 "DRIVER=hid-generic\n" 42 "HID_ID=0003:00001050:00000120\n" 43 "HID_NAME=Yubico Security Key by Yubico\n" 44 "HID_PHYS=usb-0000:00:14.0-3/input0\n" 45 "HID_UNIQ=\n" 46 "MODALIAS=hid:b0003g0001v00001050p00000120\n"; 47 48 struct param * 49 unpack(const uint8_t *ptr, size_t len) 50 { 51 cbor_item_t *item = NULL, **v; 52 struct cbor_load_result cbor; 53 struct param *p; 54 int ok = -1; 55 56 if ((p = calloc(1, sizeof(*p))) == NULL || 57 (item = cbor_load(ptr, len, &cbor)) == NULL || 58 cbor.read != len || 59 cbor_isa_array(item) == false || 60 cbor_array_is_definite(item) == false || 61 cbor_array_size(item) != 3 || 62 (v = cbor_array_handle(item)) == NULL) 63 goto fail; 64 65 if (unpack_int(v[0], &p->seed) < 0 || 66 unpack_string(v[1], p->uevent) < 0 || 67 unpack_blob(v[2], &p->report_descriptor) < 0) 68 goto fail; 69 70 ok = 0; 71 fail: 72 if (ok < 0) { 73 free(p); 74 p = NULL; 75 } 76 77 if (item) 78 cbor_decref(&item); 79 80 return p; 81 } 82 83 size_t 84 pack(uint8_t *ptr, size_t len, const struct param *p) 85 { 86 cbor_item_t *argv[3], *array = NULL; 87 size_t cbor_alloc_len, cbor_len = 0; 88 unsigned char *cbor = NULL; 89 90 memset(argv, 0, sizeof(argv)); 91 92 if ((array = cbor_new_definite_array(3)) == NULL || 93 (argv[0] = pack_int(p->seed)) == NULL || 94 (argv[1] = pack_string(p->uevent)) == NULL || 95 (argv[2] = pack_blob(&p->report_descriptor)) == NULL) 96 goto fail; 97 98 for (size_t i = 0; i < 3; i++) 99 if (cbor_array_push(array, argv[i]) == false) 100 goto fail; 101 102 if ((cbor_len = cbor_serialize_alloc(array, &cbor, 103 &cbor_alloc_len)) > len) { 104 cbor_len = 0; 105 goto fail; 106 } 107 108 memcpy(ptr, cbor, cbor_len); 109 fail: 110 for (size_t i = 0; i < 3; i++) 111 if (argv[i]) 112 cbor_decref(&argv[i]); 113 114 if (array) 115 cbor_decref(&array); 116 117 free(cbor); 118 119 return cbor_len; 120 } 121 122 size_t 123 pack_dummy(uint8_t *ptr, size_t len) 124 { 125 struct param dummy; 126 uint8_t blob[4096]; 127 size_t blob_len; 128 129 memset(&dummy, 0, sizeof(dummy)); 130 131 dummy.report_descriptor.len = sizeof(dummy_report_descriptor); 132 strlcpy(dummy.uevent, dummy_uevent, sizeof(dummy.uevent)); 133 memcpy(&dummy.report_descriptor.body, &dummy_report_descriptor, 134 dummy.report_descriptor.len); 135 136 assert((blob_len = pack(blob, sizeof(blob), &dummy)) != 0); 137 if (blob_len > len) 138 blob_len = len; 139 140 memcpy(ptr, blob, blob_len); 141 142 return blob_len; 143 } 144 145 static void 146 get_usage(const struct param *p) 147 { 148 uint32_t usage_page = 0; 149 150 fido_hid_get_usage(p->report_descriptor.body, p->report_descriptor.len, 151 &usage_page); 152 consume(&usage_page, sizeof(usage_page)); 153 } 154 155 static void 156 get_report_len(const struct param *p) 157 { 158 size_t report_in_len = 0; 159 size_t report_out_len = 0; 160 161 fido_hid_get_report_len(p->report_descriptor.body, 162 p->report_descriptor.len, &report_in_len, &report_out_len); 163 consume(&report_in_len, sizeof(report_in_len)); 164 consume(&report_out_len, sizeof(report_out_len)); 165 } 166 167 static void 168 manifest(const struct param *p) 169 { 170 size_t ndevs, nfound; 171 fido_dev_info_t *devlist; 172 int16_t vendor_id, product_id; 173 174 set_udev_parameters(p->uevent, &p->report_descriptor); 175 ndevs = uniform_random(64); 176 if ((devlist = fido_dev_info_new(ndevs)) == NULL || 177 fido_dev_info_manifest(devlist, ndevs, &nfound) != FIDO_OK) 178 goto out; 179 for (size_t i = 0; i < nfound; i++) { 180 const fido_dev_info_t *di = fido_dev_info_ptr(devlist, i); 181 consume_str(fido_dev_info_path(di)); 182 consume_str(fido_dev_info_manufacturer_string(di)); 183 consume_str(fido_dev_info_product_string(di)); 184 vendor_id = fido_dev_info_vendor(di); 185 product_id = fido_dev_info_product(di); 186 consume(&vendor_id, sizeof(vendor_id)); 187 consume(&product_id, sizeof(product_id)); 188 } 189 out: 190 fido_dev_info_free(&devlist, ndevs); 191 } 192 193 void 194 test(const struct param *p) 195 { 196 prng_init((unsigned int)p->seed); 197 fido_init(FIDO_DEBUG); 198 fido_set_log_handler(consume_str); 199 200 get_usage(p); 201 get_report_len(p); 202 manifest(p); 203 } 204 205 void 206 mutate(struct param *p, unsigned int seed, unsigned int flags) NO_MSAN 207 { 208 if (flags & MUTATE_SEED) 209 p->seed = (int)seed; 210 211 if (flags & MUTATE_PARAM) { 212 mutate_blob(&p->report_descriptor); 213 mutate_string(p->uevent); 214 } 215 } 216