1 /* 2 * Copyright (c) 2019 Google LLC. All rights reserved. 3 * Use of this source code is governed by a BSD-style 4 * license that can be found in the LICENSE file. 5 */ 6 7 #include <sys/types.h> 8 9 #include <sys/ioctl.h> 10 #include <dev/usb/usb.h> 11 12 #include <errno.h> 13 #include <fcntl.h> 14 #include <poll.h> 15 #include <signal.h> 16 #include <unistd.h> 17 18 #include "fido.h" 19 20 #define MAX_UHID 64 21 22 struct hid_openbsd { 23 int fd; 24 size_t report_in_len; 25 size_t report_out_len; 26 sigset_t sigmask; 27 const sigset_t *sigmaskp; 28 }; 29 30 int 31 fido_hid_manifest(fido_dev_info_t *devlist, size_t ilen, size_t *olen) 32 { 33 size_t i; 34 char path[64]; 35 int fd; 36 struct usb_device_info udi; 37 fido_dev_info_t *di; 38 39 if (ilen == 0) 40 return (FIDO_OK); /* nothing to do */ 41 42 if (devlist == NULL || olen == NULL) 43 return (FIDO_ERR_INVALID_ARGUMENT); 44 45 for (i = *olen = 0; i < MAX_UHID && *olen < ilen; i++) { 46 snprintf(path, sizeof(path), "/dev/fido/%zu", i); 47 if ((fd = fido_hid_unix_open(path)) == -1) 48 continue; 49 memset(&udi, 0, sizeof(udi)); 50 if (ioctl(fd, IOCTL_REQ(USB_GET_DEVICEINFO), &udi) == -1) { 51 fido_log_error(errno, "%s: get device info %s", 52 __func__, path); 53 if (close(fd) == -1) 54 fido_log_error(errno, "%s: close", __func__); 55 continue; 56 } 57 if (close(fd) == -1) 58 fido_log_error(errno, "%s: close", __func__); 59 60 fido_log_debug("%s: %s: bus = 0x%02x, addr = 0x%02x", 61 __func__, path, udi.udi_bus, udi.udi_addr); 62 fido_log_debug("%s: %s: vendor = \"%s\", product = \"%s\"", 63 __func__, path, udi.udi_vendor, udi.udi_product); 64 fido_log_debug("%s: %s: productNo = 0x%04x, vendorNo = 0x%04x, " 65 "releaseNo = 0x%04x", __func__, path, udi.udi_productNo, 66 udi.udi_vendorNo, udi.udi_releaseNo); 67 68 di = &devlist[*olen]; 69 memset(di, 0, sizeof(*di)); 70 di->io = (fido_dev_io_t) { 71 fido_hid_open, 72 fido_hid_close, 73 fido_hid_read, 74 fido_hid_write, 75 }; 76 if ((di->path = strdup(path)) == NULL || 77 (di->manufacturer = strdup(udi.udi_vendor)) == NULL || 78 (di->product = strdup(udi.udi_product)) == NULL) { 79 free(di->path); 80 free(di->manufacturer); 81 free(di->product); 82 explicit_bzero(di, sizeof(*di)); 83 return FIDO_ERR_INTERNAL; 84 } 85 di->vendor_id = (int16_t)udi.udi_vendorNo; 86 di->product_id = (int16_t)udi.udi_productNo; 87 (*olen)++; 88 } 89 90 return FIDO_OK; 91 } 92 93 /* 94 * Workaround for OpenBSD <=6.6-current (as of 201910) bug that loses 95 * sync of DATA0/DATA1 sequence bit across uhid open/close. 96 * Send pings until we get a response - early pings with incorrect 97 * sequence bits will be ignored as duplicate packets by the device. 98 */ 99 static int 100 terrible_ping_kludge(struct hid_openbsd *ctx) 101 { 102 u_char data[256]; 103 int i, n; 104 struct pollfd pfd; 105 106 if (sizeof(data) < ctx->report_out_len + 1) 107 return -1; 108 for (i = 0; i < 4; i++) { 109 memset(data, 0, sizeof(data)); 110 /* broadcast channel ID */ 111 data[1] = 0xff; 112 data[2] = 0xff; 113 data[3] = 0xff; 114 data[4] = 0xff; 115 /* Ping command */ 116 data[5] = 0x81; 117 /* One byte ping only, Vasili */ 118 data[6] = 0; 119 data[7] = 1; 120 fido_log_debug("%s: send ping %d", __func__, i); 121 if (fido_hid_write(ctx, data, ctx->report_out_len + 1) == -1) 122 return -1; 123 fido_log_debug("%s: wait reply", __func__); 124 memset(&pfd, 0, sizeof(pfd)); 125 pfd.fd = ctx->fd; 126 pfd.events = POLLIN; 127 if ((n = poll(&pfd, 1, 100)) == -1) { 128 fido_log_error(errno, "%s: poll", __func__); 129 return -1; 130 } else if (n == 0) { 131 fido_log_debug("%s: timed out", __func__); 132 continue; 133 } 134 if (fido_hid_read(ctx, data, ctx->report_out_len, 250) == -1) 135 return -1; 136 /* 137 * Ping isn't always supported on the broadcast channel, 138 * so we might get an error, but we don't care - we're 139 * synched now. 140 */ 141 fido_log_xxd(data, ctx->report_out_len, "%s: got reply", 142 __func__); 143 return 0; 144 } 145 fido_log_debug("%s: no response", __func__); 146 return -1; 147 } 148 149 void * 150 fido_hid_open(const char *path) 151 { 152 struct hid_openbsd *ret = NULL; 153 154 if ((ret = calloc(1, sizeof(*ret))) == NULL || 155 (ret->fd = fido_hid_unix_open(path)) == -1) { 156 free(ret); 157 return (NULL); 158 } 159 ret->report_in_len = ret->report_out_len = CTAP_MAX_REPORT_LEN; 160 fido_log_debug("%s: inlen = %zu outlen = %zu", __func__, 161 ret->report_in_len, ret->report_out_len); 162 163 /* 164 * OpenBSD (as of 201910) has a bug that causes it to lose 165 * track of the DATA0/DATA1 sequence toggle across uhid device 166 * open and close. This is a terrible hack to work around it. 167 */ 168 if (terrible_ping_kludge(ret) != 0) { 169 fido_hid_close(ret); 170 return NULL; 171 } 172 173 return (ret); 174 } 175 176 void 177 fido_hid_close(void *handle) 178 { 179 struct hid_openbsd *ctx = (struct hid_openbsd *)handle; 180 181 if (close(ctx->fd) == -1) 182 fido_log_error(errno, "%s: close", __func__); 183 184 free(ctx); 185 } 186 187 int 188 fido_hid_set_sigmask(void *handle, const fido_sigset_t *sigmask) 189 { 190 struct hid_openbsd *ctx = handle; 191 192 ctx->sigmask = *sigmask; 193 ctx->sigmaskp = &ctx->sigmask; 194 195 return (FIDO_OK); 196 } 197 198 int 199 fido_hid_read(void *handle, unsigned char *buf, size_t len, int ms) 200 { 201 struct hid_openbsd *ctx = (struct hid_openbsd *)handle; 202 ssize_t r; 203 204 if (len != ctx->report_in_len) { 205 fido_log_debug("%s: invalid len: got %zu, want %zu", __func__, 206 len, ctx->report_in_len); 207 return (-1); 208 } 209 210 if (fido_hid_unix_wait(ctx->fd, ms, ctx->sigmaskp) < 0) { 211 fido_log_debug("%s: fd not ready", __func__); 212 return (-1); 213 } 214 215 if ((r = read(ctx->fd, buf, len)) == -1) { 216 fido_log_error(errno, "%s: read", __func__); 217 return (-1); 218 } 219 220 if (r < 0 || (size_t)r != len) { 221 fido_log_debug("%s: %zd != %zu", __func__, r, len); 222 return (-1); 223 } 224 225 return ((int)len); 226 } 227 228 int 229 fido_hid_write(void *handle, const unsigned char *buf, size_t len) 230 { 231 struct hid_openbsd *ctx = (struct hid_openbsd *)handle; 232 ssize_t r; 233 234 if (len != ctx->report_out_len + 1) { 235 fido_log_debug("%s: invalid len: got %zu, want %zu", __func__, 236 len, ctx->report_out_len); 237 return (-1); 238 } 239 240 if ((r = write(ctx->fd, buf + 1, len - 1)) == -1) { 241 fido_log_error(errno, "%s: write", __func__); 242 return (-1); 243 } 244 245 if (r < 0 || (size_t)r != len - 1) { 246 fido_log_debug("%s: %zd != %zu", __func__, r, len - 1); 247 return (-1); 248 } 249 250 return ((int)len); 251 } 252 253 size_t 254 fido_hid_report_in_len(void *handle) 255 { 256 struct hid_openbsd *ctx = handle; 257 258 return (ctx->report_in_len); 259 } 260 261 size_t 262 fido_hid_report_out_len(void *handle) 263 { 264 struct hid_openbsd *ctx = handle; 265 266 return (ctx->report_out_len); 267 } 268