1 /* $OpenBSD: sk-usbhid.c,v 1.46 2023/03/28 06:12:38 dtucker Exp $ */
2 /*
3 * Copyright (c) 2019 Markus Friedl
4 * Copyright (c) 2020 Pedro Martelletto
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 #include "includes.h"
20
21 #ifdef ENABLE_SK_INTERNAL
22
23 #ifdef HAVE_STDINT_H
24 # include <stdint.h>
25 #endif
26 #include <stdlib.h>
27 #include <string.h>
28 #include <stdio.h>
29 #include <stddef.h>
30 #include <stdarg.h>
31 #include <time.h>
32 #ifdef HAVE_SHA2_H
33 #include <sha2.h>
34 #endif
35
36 /*
37 * Almost every use of OpenSSL in this file is for ECDSA-NISTP256.
38 * This is strictly a larger hammer than necessary, but it reduces changes
39 * with upstream.
40 */
41 #ifndef OPENSSL_HAS_ECC
42 # undef WITH_OPENSSL
43 #endif
44
45 #ifdef WITH_OPENSSL
46 #include <openssl/opensslv.h>
47 #include <openssl/crypto.h>
48 #include <openssl/bn.h>
49 #include <openssl/ec.h>
50 #include <openssl/ecdsa.h>
51 #include <openssl/evp.h>
52 #endif /* WITH_OPENSSL */
53
54 #include <fido.h>
55 #include <fido/credman.h>
56
57 /* backwards compat for libfido2 */
58 #ifndef HAVE_FIDO_CRED_PROT
59 #define fido_cred_prot(x) (0)
60 #endif
61 #ifndef HAVE_FIDO_CRED_SET_PROT
62 #define fido_cred_set_prot(x, y) (FIDO_ERR_UNSUPPORTED_OPTION)
63 #endif
64 #ifndef HAVE_FIDO_DEV_SUPPORTS_CRED_PROT
65 #define fido_dev_supports_cred_prot(x) (0)
66 #endif
67 #ifndef HAVE_FIDO_DEV_GET_TOUCH_BEGIN
68 #define fido_dev_get_touch_begin(x) (FIDO_ERR_UNSUPPORTED_OPTION)
69 #endif
70 #ifndef HAVE_FIDO_DEV_GET_TOUCH_STATUS
71 #define fido_dev_get_touch_status(x, y, z) (FIDO_ERR_UNSUPPORTED_OPTION)
72 #endif
73 #ifndef FIDO_CRED_PROT_UV_REQUIRED
74 #define FIDO_CRED_PROT_UV_REQUIRED 0
75 #endif
76 #ifndef FIDO_CRED_PROT_UV_OPTIONAL_WITH_ID
77 #define FIDO_CRED_PROT_UV_OPTIONAL_WITH_ID 0
78 #endif
79
80 #ifndef SK_STANDALONE
81 # include "log.h"
82 # include "xmalloc.h"
83 # include "misc.h"
84 /*
85 * If building as part of OpenSSH, then rename exported functions.
86 * This must be done before including sk-api.h.
87 */
88 # define sk_api_version ssh_sk_api_version
89 # define sk_enroll ssh_sk_enroll
90 # define sk_sign ssh_sk_sign
91 # define sk_load_resident_keys ssh_sk_load_resident_keys
92 #endif /* !SK_STANDALONE */
93
94 #include "sk-api.h"
95
96 /* #define SK_DEBUG 1 */
97
98 #ifdef SK_DEBUG
99 #define SSH_FIDO_INIT_ARG FIDO_DEBUG
100 #else
101 #define SSH_FIDO_INIT_ARG 0
102 #endif
103
104 #define MAX_FIDO_DEVICES 8
105 #define FIDO_POLL_MS 50
106 #define SELECT_MS 15000
107 #define POLL_SLEEP_NS 200000000
108
109 #ifndef FIDO_ERR_OPERATION_DENIED
110 #define FIDO_ERR_OPERATION_DENIED 0x27
111 #endif
112
113 struct sk_usbhid {
114 fido_dev_t *dev;
115 char *path;
116 };
117
118 /* Return the version of the middleware API */
119 uint32_t sk_api_version(void);
120
121 /* Enroll a U2F key (private key generation) */
122 int sk_enroll(uint32_t alg, const uint8_t *challenge, size_t challenge_len,
123 const char *application, uint8_t flags, const char *pin,
124 struct sk_option **options, struct sk_enroll_response **enroll_response);
125
126 /* Sign a challenge */
127 int sk_sign(uint32_t alg, const uint8_t *data, size_t data_len,
128 const char *application, const uint8_t *key_handle, size_t key_handle_len,
129 uint8_t flags, const char *pin, struct sk_option **options,
130 struct sk_sign_response **sign_response);
131
132 /* Load resident keys */
133 int sk_load_resident_keys(const char *pin, struct sk_option **options,
134 struct sk_resident_key ***rks, size_t *nrks);
135
136 static void skdebug(const char *func, const char *fmt, ...)
137 __attribute__((__format__ (printf, 2, 3)));
138
139 static void
skdebug(const char * func,const char * fmt,...)140 skdebug(const char *func, const char *fmt, ...)
141 {
142 #if !defined(SK_STANDALONE)
143 char *msg;
144 va_list ap;
145
146 va_start(ap, fmt);
147 xvasprintf(&msg, fmt, ap);
148 va_end(ap);
149 debug("%s: %s", func, msg);
150 free(msg);
151 #elif defined(SK_DEBUG)
152 va_list ap;
153
154 va_start(ap, fmt);
155 fprintf(stderr, "%s: ", func);
156 vfprintf(stderr, fmt, ap);
157 fputc('\n', stderr);
158 va_end(ap);
159 #else
160 (void)func; /* XXX */
161 (void)fmt; /* XXX */
162 #endif
163 }
164
165 uint32_t
sk_api_version(void)166 sk_api_version(void)
167 {
168 return SSH_SK_VERSION_MAJOR;
169 }
170
171 static struct sk_usbhid *
sk_open(const char * path)172 sk_open(const char *path)
173 {
174 struct sk_usbhid *sk;
175 int r;
176
177 if (path == NULL) {
178 skdebug(__func__, "path == NULL");
179 return NULL;
180 }
181 if ((sk = calloc(1, sizeof(*sk))) == NULL) {
182 skdebug(__func__, "calloc sk failed");
183 return NULL;
184 }
185 if ((sk->path = strdup(path)) == NULL) {
186 skdebug(__func__, "strdup path failed");
187 free(sk);
188 return NULL;
189 }
190 if ((sk->dev = fido_dev_new()) == NULL) {
191 skdebug(__func__, "fido_dev_new failed");
192 free(sk->path);
193 free(sk);
194 return NULL;
195 }
196 if ((r = fido_dev_open(sk->dev, sk->path)) != FIDO_OK) {
197 skdebug(__func__, "fido_dev_open %s failed: %s", sk->path,
198 fido_strerr(r));
199 fido_dev_free(&sk->dev);
200 free(sk->path);
201 free(sk);
202 return NULL;
203 }
204 return sk;
205 }
206
207 static void
sk_close(struct sk_usbhid * sk)208 sk_close(struct sk_usbhid *sk)
209 {
210 if (sk == NULL)
211 return;
212 fido_dev_cancel(sk->dev); /* cancel any pending operation */
213 fido_dev_close(sk->dev);
214 fido_dev_free(&sk->dev);
215 free(sk->path);
216 free(sk);
217 }
218
219 static struct sk_usbhid **
sk_openv(const fido_dev_info_t * devlist,size_t ndevs,size_t * nopen)220 sk_openv(const fido_dev_info_t *devlist, size_t ndevs, size_t *nopen)
221 {
222 const fido_dev_info_t *di;
223 struct sk_usbhid **skv;
224 size_t i;
225
226 *nopen = 0;
227 if ((skv = calloc(ndevs, sizeof(*skv))) == NULL) {
228 skdebug(__func__, "calloc skv failed");
229 return NULL;
230 }
231 for (i = 0; i < ndevs; i++) {
232 if ((di = fido_dev_info_ptr(devlist, i)) == NULL)
233 skdebug(__func__, "fido_dev_info_ptr failed");
234 else if ((skv[*nopen] = sk_open(fido_dev_info_path(di))) == NULL)
235 skdebug(__func__, "sk_open failed");
236 else
237 (*nopen)++;
238 }
239 if (*nopen == 0) {
240 for (i = 0; i < ndevs; i++)
241 sk_close(skv[i]);
242 free(skv);
243 skv = NULL;
244 }
245
246 return skv;
247 }
248
249 static void
sk_closev(struct sk_usbhid ** skv,size_t nsk)250 sk_closev(struct sk_usbhid **skv, size_t nsk)
251 {
252 size_t i;
253
254 for (i = 0; i < nsk; i++)
255 sk_close(skv[i]);
256 free(skv);
257 }
258
259 static int
sk_touch_begin(struct sk_usbhid ** skv,size_t nsk)260 sk_touch_begin(struct sk_usbhid **skv, size_t nsk)
261 {
262 size_t i, ok = 0;
263 int r;
264
265 for (i = 0; i < nsk; i++)
266 if ((r = fido_dev_get_touch_begin(skv[i]->dev)) != FIDO_OK)
267 skdebug(__func__, "fido_dev_get_touch_begin %s failed:"
268 " %s", skv[i]->path, fido_strerr(r));
269 else
270 ok++;
271
272 return ok ? 0 : -1;
273 }
274
275 static int
sk_touch_poll(struct sk_usbhid ** skv,size_t nsk,int * touch,size_t * idx)276 sk_touch_poll(struct sk_usbhid **skv, size_t nsk, int *touch, size_t *idx)
277 {
278 struct timespec ts_pause;
279 size_t npoll, i;
280 int r;
281
282 ts_pause.tv_sec = 0;
283 ts_pause.tv_nsec = POLL_SLEEP_NS;
284 nanosleep(&ts_pause, NULL);
285 npoll = nsk;
286 for (i = 0; i < nsk; i++) {
287 if (skv[i] == NULL)
288 continue; /* device discarded */
289 skdebug(__func__, "polling %s", skv[i]->path);
290 if ((r = fido_dev_get_touch_status(skv[i]->dev, touch,
291 FIDO_POLL_MS)) != FIDO_OK) {
292 skdebug(__func__, "fido_dev_get_touch_status %s: %s",
293 skv[i]->path, fido_strerr(r));
294 sk_close(skv[i]); /* discard device */
295 skv[i] = NULL;
296 if (--npoll == 0) {
297 skdebug(__func__, "no device left to poll");
298 return -1;
299 }
300 } else if (*touch) {
301 *idx = i;
302 return 0;
303 }
304 }
305 *touch = 0;
306 return 0;
307 }
308
309 #if !defined(HAVE_FIDO_ASSERT_SET_CLIENTDATA) || \
310 !defined(HAVE_FIDO_CRED_SET_CLIENTDATA)
311 /* Calculate SHA256(m) */
312 static int
sha256_mem(const void * m,size_t mlen,u_char * d,size_t dlen)313 sha256_mem(const void *m, size_t mlen, u_char *d, size_t dlen)
314 {
315 #ifdef WITH_OPENSSL
316 u_int mdlen;
317 #else
318 SHA2_CTX ctx;
319 #endif
320
321 if (dlen != 32)
322 return -1;
323 #ifdef WITH_OPENSSL
324 mdlen = dlen;
325 if (!EVP_Digest(m, mlen, d, &mdlen, EVP_sha256(), NULL))
326 return -1;
327 #else
328 SHA256Init(&ctx);
329 SHA256Update(&ctx, (const uint8_t *)m, mlen);
330 SHA256Final(d, &ctx);
331 #endif
332 return 0;
333 }
334 #endif /* !HAVE_FIDO_ASSERT_SET_CLIENTDATA || !HAVE_FIDO_CRED_SET_CLIENTDATA */
335
336 #ifndef HAVE_FIDO_CRED_SET_CLIENTDATA
337 static int
fido_cred_set_clientdata(fido_cred_t * cred,const u_char * ptr,size_t len)338 fido_cred_set_clientdata(fido_cred_t *cred, const u_char *ptr, size_t len)
339 {
340 uint8_t d[32];
341 int r;
342
343 if (sha256_mem(ptr, len, d, sizeof(d)) != 0) {
344 skdebug(__func__, "hash challenge failed");
345 return FIDO_ERR_INTERNAL;
346 }
347 r = fido_cred_set_clientdata_hash(cred, d, sizeof(d));
348 explicit_bzero(d, sizeof(d));
349 if (r != FIDO_OK) {
350 skdebug(__func__, "fido_cred_set_clientdata_hash failed: %s",
351 fido_strerr(r));
352 }
353 return r;
354 }
355 #endif /* HAVE_FIDO_CRED_SET_CLIENTDATA */
356
357 #ifndef HAVE_FIDO_ASSERT_SET_CLIENTDATA
358 static int
fido_assert_set_clientdata(fido_assert_t * assert,const u_char * ptr,size_t len)359 fido_assert_set_clientdata(fido_assert_t *assert, const u_char *ptr, size_t len)
360 {
361 uint8_t d[32];
362 int r;
363
364 if (sha256_mem(ptr, len, d, sizeof(d)) != 0) {
365 skdebug(__func__, "hash challenge failed");
366 return FIDO_ERR_INTERNAL;
367 }
368 r = fido_assert_set_clientdata_hash(assert, d, sizeof(d));
369 explicit_bzero(d, sizeof(d));
370 if (r != FIDO_OK) {
371 skdebug(__func__, "fido_assert_set_clientdata_hash failed: %s",
372 fido_strerr(r));
373 }
374 return r;
375 }
376 #endif /* HAVE_FIDO_ASSERT_SET_CLIENTDATA */
377
378 #ifndef HAVE_FIDO_DEV_IS_WINHELLO
379 static bool
fido_dev_is_winhello(const fido_dev_t * fdev)380 fido_dev_is_winhello(const fido_dev_t *fdev)
381 {
382 return 0;
383 }
384 #endif /* HAVE_FIDO_DEV_IS_WINHELLO */
385
386 /* Check if the specified key handle exists on a given sk. */
387 static int
sk_try(const struct sk_usbhid * sk,const char * application,const uint8_t * key_handle,size_t key_handle_len)388 sk_try(const struct sk_usbhid *sk, const char *application,
389 const uint8_t *key_handle, size_t key_handle_len)
390 {
391 fido_assert_t *assert = NULL;
392 int r = FIDO_ERR_INTERNAL;
393 uint8_t message[32];
394
395 memset(message, '\0', sizeof(message));
396 if ((assert = fido_assert_new()) == NULL) {
397 skdebug(__func__, "fido_assert_new failed");
398 goto out;
399 }
400 /* generate an invalid signature on FIDO2 tokens */
401 if ((r = fido_assert_set_clientdata(assert, message,
402 sizeof(message))) != FIDO_OK) {
403 skdebug(__func__, "fido_assert_set_clientdata: %s",
404 fido_strerr(r));
405 goto out;
406 }
407 if ((r = fido_assert_set_rp(assert, application)) != FIDO_OK) {
408 skdebug(__func__, "fido_assert_set_rp: %s", fido_strerr(r));
409 goto out;
410 }
411 if ((r = fido_assert_allow_cred(assert, key_handle,
412 key_handle_len)) != FIDO_OK) {
413 skdebug(__func__, "fido_assert_allow_cred: %s", fido_strerr(r));
414 goto out;
415 }
416 if ((r = fido_assert_set_up(assert, FIDO_OPT_FALSE)) != FIDO_OK) {
417 skdebug(__func__, "fido_assert_up: %s", fido_strerr(r));
418 goto out;
419 }
420 r = fido_dev_get_assert(sk->dev, assert, NULL);
421 skdebug(__func__, "fido_dev_get_assert: %s", fido_strerr(r));
422 if (r == FIDO_ERR_USER_PRESENCE_REQUIRED) {
423 /* U2F tokens may return this */
424 r = FIDO_OK;
425 }
426 out:
427 fido_assert_free(&assert);
428
429 return r != FIDO_OK ? -1 : 0;
430 }
431
432 static int
check_sk_options(fido_dev_t * dev,const char * opt,int * ret)433 check_sk_options(fido_dev_t *dev, const char *opt, int *ret)
434 {
435 fido_cbor_info_t *info;
436 char * const *name;
437 const bool *value;
438 size_t len, i;
439 int r;
440
441 *ret = -1;
442
443 if (!fido_dev_is_fido2(dev)) {
444 skdebug(__func__, "device is not fido2");
445 return 0;
446 }
447 if ((info = fido_cbor_info_new()) == NULL) {
448 skdebug(__func__, "fido_cbor_info_new failed");
449 return -1;
450 }
451 if ((r = fido_dev_get_cbor_info(dev, info)) != FIDO_OK) {
452 skdebug(__func__, "fido_dev_get_cbor_info: %s", fido_strerr(r));
453 fido_cbor_info_free(&info);
454 return -1;
455 }
456 name = fido_cbor_info_options_name_ptr(info);
457 value = fido_cbor_info_options_value_ptr(info);
458 len = fido_cbor_info_options_len(info);
459 for (i = 0; i < len; i++) {
460 if (!strcmp(name[i], opt)) {
461 *ret = value[i];
462 break;
463 }
464 }
465 fido_cbor_info_free(&info);
466 if (*ret == -1)
467 skdebug(__func__, "option %s is unknown", opt);
468 else
469 skdebug(__func__, "option %s is %s", opt, *ret ? "on" : "off");
470
471 return 0;
472 }
473
474 static struct sk_usbhid *
sk_select_by_cred(const fido_dev_info_t * devlist,size_t ndevs,const char * application,const uint8_t * key_handle,size_t key_handle_len)475 sk_select_by_cred(const fido_dev_info_t *devlist, size_t ndevs,
476 const char *application, const uint8_t *key_handle, size_t key_handle_len)
477 {
478 struct sk_usbhid **skv, *sk;
479 size_t skvcnt, i;
480 int internal_uv;
481
482 if ((skv = sk_openv(devlist, ndevs, &skvcnt)) == NULL) {
483 skdebug(__func__, "sk_openv failed");
484 return NULL;
485 }
486 if (skvcnt == 1 && check_sk_options(skv[0]->dev, "uv",
487 &internal_uv) == 0 && internal_uv != -1) {
488 sk = skv[0];
489 skv[0] = NULL;
490 goto out;
491 }
492 sk = NULL;
493 for (i = 0; i < skvcnt; i++) {
494 if (sk_try(skv[i], application, key_handle,
495 key_handle_len) == 0) {
496 sk = skv[i];
497 skv[i] = NULL;
498 skdebug(__func__, "found key in %s", sk->path);
499 break;
500 }
501 }
502 out:
503 sk_closev(skv, skvcnt);
504 return sk;
505 }
506
507 static struct sk_usbhid *
sk_select_by_touch(const fido_dev_info_t * devlist,size_t ndevs)508 sk_select_by_touch(const fido_dev_info_t *devlist, size_t ndevs)
509 {
510 struct sk_usbhid **skv, *sk;
511 struct timeval tv_start, tv_now, tv_delta;
512 size_t skvcnt, idx;
513 int touch, ms_remain;
514
515 if ((skv = sk_openv(devlist, ndevs, &skvcnt)) == NULL) {
516 skdebug(__func__, "sk_openv failed");
517 return NULL;
518 }
519 sk = NULL;
520 if (skvcnt < 2) {
521 if (skvcnt == 1) {
522 /* single candidate */
523 sk = skv[0];
524 skv[0] = NULL;
525 }
526 goto out;
527 }
528 #ifndef HAVE_FIDO_DEV_GET_TOUCH_STATUS
529 skdebug(__func__, "libfido2 version does not support a feature needed for multiple tokens. Please upgrade to >=1.5.0");
530 goto out;
531 #endif
532
533 if (sk_touch_begin(skv, skvcnt) == -1) {
534 skdebug(__func__, "sk_touch_begin failed");
535 goto out;
536 }
537 monotime_tv(&tv_start);
538 do {
539 if (sk_touch_poll(skv, skvcnt, &touch, &idx) == -1) {
540 skdebug(__func__, "sk_touch_poll failed");
541 goto out;
542 }
543 if (touch) {
544 sk = skv[idx];
545 skv[idx] = NULL;
546 goto out;
547 }
548 monotime_tv(&tv_now);
549 timersub(&tv_now, &tv_start, &tv_delta);
550 ms_remain = SELECT_MS - tv_delta.tv_sec * 1000 -
551 tv_delta.tv_usec / 1000;
552 } while (ms_remain >= FIDO_POLL_MS);
553 skdebug(__func__, "timeout");
554 out:
555 sk_closev(skv, skvcnt);
556 return sk;
557 }
558
559 static struct sk_usbhid *
sk_probe(const char * application,const uint8_t * key_handle,size_t key_handle_len,int probe_resident)560 sk_probe(const char *application, const uint8_t *key_handle,
561 size_t key_handle_len, int probe_resident)
562 {
563 struct sk_usbhid *sk;
564 fido_dev_info_t *devlist;
565 size_t ndevs;
566 int r;
567
568 #ifdef HAVE_CYGWIN
569 if (!probe_resident && (sk = sk_open("windows://hello")) != NULL)
570 return sk;
571 #endif /* HAVE_CYGWIN */
572 if ((devlist = fido_dev_info_new(MAX_FIDO_DEVICES)) == NULL) {
573 skdebug(__func__, "fido_dev_info_new failed");
574 return NULL;
575 }
576 if ((r = fido_dev_info_manifest(devlist, MAX_FIDO_DEVICES,
577 &ndevs)) != FIDO_OK) {
578 skdebug(__func__, "fido_dev_info_manifest failed: %s",
579 fido_strerr(r));
580 fido_dev_info_free(&devlist, MAX_FIDO_DEVICES);
581 return NULL;
582 }
583 skdebug(__func__, "%zu device(s) detected", ndevs);
584 if (ndevs == 0) {
585 sk = NULL;
586 } else if (application != NULL && key_handle != NULL) {
587 skdebug(__func__, "selecting sk by cred");
588 sk = sk_select_by_cred(devlist, ndevs, application, key_handle,
589 key_handle_len);
590 } else {
591 skdebug(__func__, "selecting sk by touch");
592 sk = sk_select_by_touch(devlist, ndevs);
593 }
594 fido_dev_info_free(&devlist, MAX_FIDO_DEVICES);
595 return sk;
596 }
597
598 #ifdef WITH_OPENSSL
599 /*
600 * The key returned via fido_cred_pubkey_ptr() is in affine coordinates,
601 * but the API expects a SEC1 octet string.
602 */
603 static int
pack_public_key_ecdsa(const fido_cred_t * cred,struct sk_enroll_response * response)604 pack_public_key_ecdsa(const fido_cred_t *cred,
605 struct sk_enroll_response *response)
606 {
607 const uint8_t *ptr;
608 BIGNUM *x = NULL, *y = NULL;
609 EC_POINT *q = NULL;
610 EC_GROUP *g = NULL;
611 int ret = -1;
612
613 response->public_key = NULL;
614 response->public_key_len = 0;
615
616 if ((x = BN_new()) == NULL ||
617 (y = BN_new()) == NULL ||
618 (g = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1)) == NULL ||
619 (q = EC_POINT_new(g)) == NULL) {
620 skdebug(__func__, "libcrypto setup failed");
621 goto out;
622 }
623 if ((ptr = fido_cred_pubkey_ptr(cred)) == NULL) {
624 skdebug(__func__, "fido_cred_pubkey_ptr failed");
625 goto out;
626 }
627 if (fido_cred_pubkey_len(cred) != 64) {
628 skdebug(__func__, "bad fido_cred_pubkey_len %zu",
629 fido_cred_pubkey_len(cred));
630 goto out;
631 }
632
633 if (BN_bin2bn(ptr, 32, x) == NULL ||
634 BN_bin2bn(ptr + 32, 32, y) == NULL) {
635 skdebug(__func__, "BN_bin2bn failed");
636 goto out;
637 }
638 if (EC_POINT_set_affine_coordinates_GFp(g, q, x, y, NULL) != 1) {
639 skdebug(__func__, "EC_POINT_set_affine_coordinates_GFp failed");
640 goto out;
641 }
642 response->public_key_len = EC_POINT_point2oct(g, q,
643 POINT_CONVERSION_UNCOMPRESSED, NULL, 0, NULL);
644 if (response->public_key_len == 0 || response->public_key_len > 2048) {
645 skdebug(__func__, "bad pubkey length %zu",
646 response->public_key_len);
647 goto out;
648 }
649 if ((response->public_key = malloc(response->public_key_len)) == NULL) {
650 skdebug(__func__, "malloc pubkey failed");
651 goto out;
652 }
653 if (EC_POINT_point2oct(g, q, POINT_CONVERSION_UNCOMPRESSED,
654 response->public_key, response->public_key_len, NULL) == 0) {
655 skdebug(__func__, "EC_POINT_point2oct failed");
656 goto out;
657 }
658 /* success */
659 ret = 0;
660 out:
661 if (ret != 0 && response->public_key != NULL) {
662 memset(response->public_key, 0, response->public_key_len);
663 free(response->public_key);
664 response->public_key = NULL;
665 }
666 EC_POINT_free(q);
667 EC_GROUP_free(g);
668 BN_clear_free(x);
669 BN_clear_free(y);
670 return ret;
671 }
672 #endif /* WITH_OPENSSL */
673
674 static int
pack_public_key_ed25519(const fido_cred_t * cred,struct sk_enroll_response * response)675 pack_public_key_ed25519(const fido_cred_t *cred,
676 struct sk_enroll_response *response)
677 {
678 const uint8_t *ptr;
679 size_t len;
680 int ret = -1;
681
682 response->public_key = NULL;
683 response->public_key_len = 0;
684
685 if ((len = fido_cred_pubkey_len(cred)) != 32) {
686 skdebug(__func__, "bad fido_cred_pubkey_len len %zu", len);
687 goto out;
688 }
689 if ((ptr = fido_cred_pubkey_ptr(cred)) == NULL) {
690 skdebug(__func__, "fido_cred_pubkey_ptr failed");
691 goto out;
692 }
693 response->public_key_len = len;
694 if ((response->public_key = malloc(response->public_key_len)) == NULL) {
695 skdebug(__func__, "malloc pubkey failed");
696 goto out;
697 }
698 memcpy(response->public_key, ptr, len);
699 ret = 0;
700 out:
701 if (ret != 0)
702 free(response->public_key);
703 return ret;
704 }
705
706 static int
pack_public_key(uint32_t alg,const fido_cred_t * cred,struct sk_enroll_response * response)707 pack_public_key(uint32_t alg, const fido_cred_t *cred,
708 struct sk_enroll_response *response)
709 {
710 switch(alg) {
711 #ifdef WITH_OPENSSL
712 case SSH_SK_ECDSA:
713 return pack_public_key_ecdsa(cred, response);
714 #endif /* WITH_OPENSSL */
715 case SSH_SK_ED25519:
716 return pack_public_key_ed25519(cred, response);
717 default:
718 return -1;
719 }
720 }
721
722 static int
fidoerr_to_skerr(int fidoerr)723 fidoerr_to_skerr(int fidoerr)
724 {
725 switch (fidoerr) {
726 case FIDO_ERR_UNSUPPORTED_OPTION:
727 case FIDO_ERR_UNSUPPORTED_ALGORITHM:
728 return SSH_SK_ERR_UNSUPPORTED;
729 case FIDO_ERR_PIN_REQUIRED:
730 case FIDO_ERR_PIN_INVALID:
731 case FIDO_ERR_OPERATION_DENIED:
732 return SSH_SK_ERR_PIN_REQUIRED;
733 default:
734 return -1;
735 }
736 }
737
738 static int
check_enroll_options(struct sk_option ** options,char ** devicep,uint8_t * user_id,size_t user_id_len)739 check_enroll_options(struct sk_option **options, char **devicep,
740 uint8_t *user_id, size_t user_id_len)
741 {
742 size_t i;
743
744 if (options == NULL)
745 return 0;
746 for (i = 0; options[i] != NULL; i++) {
747 if (strcmp(options[i]->name, "device") == 0) {
748 if ((*devicep = strdup(options[i]->value)) == NULL) {
749 skdebug(__func__, "strdup device failed");
750 return -1;
751 }
752 skdebug(__func__, "requested device %s", *devicep);
753 } else if (strcmp(options[i]->name, "user") == 0) {
754 if (strlcpy(user_id, options[i]->value, user_id_len) >=
755 user_id_len) {
756 skdebug(__func__, "user too long");
757 return -1;
758 }
759 skdebug(__func__, "requested user %s",
760 (char *)user_id);
761 } else {
762 skdebug(__func__, "requested unsupported option %s",
763 options[i]->name);
764 if (options[i]->required) {
765 skdebug(__func__, "unknown required option");
766 return -1;
767 }
768 }
769 }
770 return 0;
771 }
772
773 static int
key_lookup(fido_dev_t * dev,const char * application,const uint8_t * user_id,size_t user_id_len,const char * pin)774 key_lookup(fido_dev_t *dev, const char *application, const uint8_t *user_id,
775 size_t user_id_len, const char *pin)
776 {
777 fido_assert_t *assert = NULL;
778 uint8_t message[32];
779 int r = FIDO_ERR_INTERNAL;
780 int sk_supports_uv, uv;
781 size_t i;
782
783 memset(message, '\0', sizeof(message));
784 if ((assert = fido_assert_new()) == NULL) {
785 skdebug(__func__, "fido_assert_new failed");
786 goto out;
787 }
788 /* generate an invalid signature on FIDO2 tokens */
789 if ((r = fido_assert_set_clientdata(assert, message,
790 sizeof(message))) != FIDO_OK) {
791 skdebug(__func__, "fido_assert_set_clientdata: %s",
792 fido_strerr(r));
793 goto out;
794 }
795 if ((r = fido_assert_set_rp(assert, application)) != FIDO_OK) {
796 skdebug(__func__, "fido_assert_set_rp: %s", fido_strerr(r));
797 goto out;
798 }
799 if ((r = fido_assert_set_up(assert, FIDO_OPT_FALSE)) != FIDO_OK) {
800 skdebug(__func__, "fido_assert_set_up: %s", fido_strerr(r));
801 goto out;
802 }
803 uv = FIDO_OPT_OMIT;
804 if (pin == NULL && check_sk_options(dev, "uv", &sk_supports_uv) == 0 &&
805 sk_supports_uv != -1)
806 uv = FIDO_OPT_TRUE;
807 if ((r = fido_assert_set_uv(assert, uv)) != FIDO_OK) {
808 skdebug(__func__, "fido_assert_set_uv: %s", fido_strerr(r));
809 goto out;
810 }
811 if ((r = fido_dev_get_assert(dev, assert, pin)) != FIDO_OK) {
812 skdebug(__func__, "fido_dev_get_assert: %s", fido_strerr(r));
813 goto out;
814 }
815 r = FIDO_ERR_NO_CREDENTIALS;
816 skdebug(__func__, "%zu signatures returned", fido_assert_count(assert));
817 for (i = 0; i < fido_assert_count(assert); i++) {
818 if (fido_assert_user_id_len(assert, i) == user_id_len &&
819 memcmp(fido_assert_user_id_ptr(assert, i), user_id,
820 user_id_len) == 0) {
821 skdebug(__func__, "credential exists");
822 r = FIDO_OK;
823 goto out;
824 }
825 }
826 out:
827 fido_assert_free(&assert);
828
829 return r;
830 }
831
832 int
sk_enroll(uint32_t alg,const uint8_t * challenge,size_t challenge_len,const char * application,uint8_t flags,const char * pin,struct sk_option ** options,struct sk_enroll_response ** enroll_response)833 sk_enroll(uint32_t alg, const uint8_t *challenge, size_t challenge_len,
834 const char *application, uint8_t flags, const char *pin,
835 struct sk_option **options, struct sk_enroll_response **enroll_response)
836 {
837 fido_cred_t *cred = NULL;
838 const uint8_t *ptr;
839 uint8_t user_id[32];
840 struct sk_usbhid *sk = NULL;
841 struct sk_enroll_response *response = NULL;
842 size_t len;
843 int credprot;
844 int cose_alg;
845 int ret = SSH_SK_ERR_GENERAL;
846 int r;
847 char *device = NULL;
848
849 fido_init(SSH_FIDO_INIT_ARG);
850
851 if (enroll_response == NULL) {
852 skdebug(__func__, "enroll_response == NULL");
853 goto out;
854 }
855 *enroll_response = NULL;
856 memset(user_id, 0, sizeof(user_id));
857 if (check_enroll_options(options, &device, user_id,
858 sizeof(user_id)) != 0)
859 goto out; /* error already logged */
860
861 switch(alg) {
862 #ifdef WITH_OPENSSL
863 case SSH_SK_ECDSA:
864 cose_alg = COSE_ES256;
865 break;
866 #endif /* WITH_OPENSSL */
867 case SSH_SK_ED25519:
868 cose_alg = COSE_EDDSA;
869 break;
870 default:
871 skdebug(__func__, "unsupported key type %d", alg);
872 goto out;
873 }
874 if (device != NULL)
875 sk = sk_open(device);
876 else
877 sk = sk_probe(NULL, NULL, 0, 0);
878 if (sk == NULL) {
879 ret = SSH_SK_ERR_DEVICE_NOT_FOUND;
880 skdebug(__func__, "failed to find sk");
881 goto out;
882 }
883 skdebug(__func__, "using device %s", sk->path);
884 if ((flags & SSH_SK_RESIDENT_KEY) != 0 &&
885 (flags & SSH_SK_FORCE_OPERATION) == 0 &&
886 (r = key_lookup(sk->dev, application, user_id, sizeof(user_id),
887 pin)) != FIDO_ERR_NO_CREDENTIALS) {
888 if (r != FIDO_OK) {
889 ret = fidoerr_to_skerr(r);
890 skdebug(__func__, "key_lookup failed");
891 } else {
892 ret = SSH_SK_ERR_CREDENTIAL_EXISTS;
893 skdebug(__func__, "key exists");
894 }
895 goto out;
896 }
897 if ((cred = fido_cred_new()) == NULL) {
898 skdebug(__func__, "fido_cred_new failed");
899 goto out;
900 }
901 if ((r = fido_cred_set_type(cred, cose_alg)) != FIDO_OK) {
902 skdebug(__func__, "fido_cred_set_type: %s", fido_strerr(r));
903 goto out;
904 }
905 if ((r = fido_cred_set_clientdata(cred,
906 challenge, challenge_len)) != FIDO_OK) {
907 skdebug(__func__, "fido_cred_set_clientdata: %s",
908 fido_strerr(r));
909 goto out;
910 }
911 if ((r = fido_cred_set_rk(cred, (flags & SSH_SK_RESIDENT_KEY) != 0 ?
912 FIDO_OPT_TRUE : FIDO_OPT_OMIT)) != FIDO_OK) {
913 skdebug(__func__, "fido_cred_set_rk: %s", fido_strerr(r));
914 goto out;
915 }
916 if ((r = fido_cred_set_user(cred, user_id, sizeof(user_id),
917 "openssh", "openssh", NULL)) != FIDO_OK) {
918 skdebug(__func__, "fido_cred_set_user: %s", fido_strerr(r));
919 goto out;
920 }
921 if ((r = fido_cred_set_rp(cred, application, NULL)) != FIDO_OK) {
922 skdebug(__func__, "fido_cred_set_rp: %s", fido_strerr(r));
923 goto out;
924 }
925 if ((flags & (SSH_SK_RESIDENT_KEY|SSH_SK_USER_VERIFICATION_REQD)) != 0) {
926 #if !defined(HAVE_FIDO_DEV_SUPPORTS_CRED_PROT) || \
927 !defined(HAVE_FIDO_CRED_SET_PROT)
928 skdebug(__func__, "libfido2 version does not support a feature required for this operation. Please upgrade to >=1.5.0");
929 ret = SSH_SK_ERR_UNSUPPORTED;
930 goto out;
931 credprot = 0; (void)credprot; /* avoid warning */
932 #endif
933 if (!fido_dev_supports_cred_prot(sk->dev)) {
934 skdebug(__func__, "%s does not support credprot, "
935 "refusing to create unprotected "
936 "resident/verify-required key", sk->path);
937 ret = SSH_SK_ERR_UNSUPPORTED;
938 goto out;
939 }
940 if ((flags & SSH_SK_USER_VERIFICATION_REQD))
941 credprot = FIDO_CRED_PROT_UV_REQUIRED;
942 else
943 credprot = FIDO_CRED_PROT_UV_OPTIONAL_WITH_ID;
944
945 if ((r = fido_cred_set_prot(cred, credprot)) != FIDO_OK) {
946 skdebug(__func__, "fido_cred_set_prot: %s",
947 fido_strerr(r));
948 ret = fidoerr_to_skerr(r);
949 goto out;
950 }
951 }
952 if ((r = fido_dev_make_cred(sk->dev, cred, pin)) != FIDO_OK) {
953 skdebug(__func__, "fido_dev_make_cred: %s", fido_strerr(r));
954 ret = fidoerr_to_skerr(r);
955 goto out;
956 }
957 if (fido_cred_x5c_ptr(cred) != NULL) {
958 if ((r = fido_cred_verify(cred)) != FIDO_OK) {
959 skdebug(__func__, "fido_cred_verify: %s",
960 fido_strerr(r));
961 goto out;
962 }
963 } else {
964 skdebug(__func__, "self-attested credential");
965 if ((r = fido_cred_verify_self(cred)) != FIDO_OK) {
966 skdebug(__func__, "fido_cred_verify_self: %s",
967 fido_strerr(r));
968 goto out;
969 }
970 }
971 if ((response = calloc(1, sizeof(*response))) == NULL) {
972 skdebug(__func__, "calloc response failed");
973 goto out;
974 }
975 response->flags = flags;
976 if (pack_public_key(alg, cred, response) != 0) {
977 skdebug(__func__, "pack_public_key failed");
978 goto out;
979 }
980 if ((ptr = fido_cred_id_ptr(cred)) != NULL) {
981 len = fido_cred_id_len(cred);
982 if ((response->key_handle = calloc(1, len)) == NULL) {
983 skdebug(__func__, "calloc key handle failed");
984 goto out;
985 }
986 memcpy(response->key_handle, ptr, len);
987 response->key_handle_len = len;
988 }
989 if ((ptr = fido_cred_sig_ptr(cred)) != NULL) {
990 len = fido_cred_sig_len(cred);
991 if ((response->signature = calloc(1, len)) == NULL) {
992 skdebug(__func__, "calloc signature failed");
993 goto out;
994 }
995 memcpy(response->signature, ptr, len);
996 response->signature_len = len;
997 }
998 if ((ptr = fido_cred_x5c_ptr(cred)) != NULL) {
999 len = fido_cred_x5c_len(cred);
1000 skdebug(__func__, "attestation cert len=%zu", len);
1001 if ((response->attestation_cert = calloc(1, len)) == NULL) {
1002 skdebug(__func__, "calloc attestation cert failed");
1003 goto out;
1004 }
1005 memcpy(response->attestation_cert, ptr, len);
1006 response->attestation_cert_len = len;
1007 }
1008 if ((ptr = fido_cred_authdata_ptr(cred)) != NULL) {
1009 len = fido_cred_authdata_len(cred);
1010 skdebug(__func__, "authdata len=%zu", len);
1011 if ((response->authdata = calloc(1, len)) == NULL) {
1012 skdebug(__func__, "calloc authdata failed");
1013 goto out;
1014 }
1015 memcpy(response->authdata, ptr, len);
1016 response->authdata_len = len;
1017 }
1018 *enroll_response = response;
1019 response = NULL;
1020 ret = 0;
1021 out:
1022 free(device);
1023 if (response != NULL) {
1024 free(response->public_key);
1025 free(response->key_handle);
1026 free(response->signature);
1027 free(response->attestation_cert);
1028 free(response->authdata);
1029 free(response);
1030 }
1031 sk_close(sk);
1032 fido_cred_free(&cred);
1033 return ret;
1034 }
1035
1036 #ifdef WITH_OPENSSL
1037 static int
pack_sig_ecdsa(fido_assert_t * assert,struct sk_sign_response * response)1038 pack_sig_ecdsa(fido_assert_t *assert, struct sk_sign_response *response)
1039 {
1040 ECDSA_SIG *sig = NULL;
1041 const BIGNUM *sig_r, *sig_s;
1042 const unsigned char *cp;
1043 size_t sig_len;
1044 int ret = -1;
1045
1046 cp = fido_assert_sig_ptr(assert, 0);
1047 sig_len = fido_assert_sig_len(assert, 0);
1048 if ((sig = d2i_ECDSA_SIG(NULL, &cp, sig_len)) == NULL) {
1049 skdebug(__func__, "d2i_ECDSA_SIG failed");
1050 goto out;
1051 }
1052 ECDSA_SIG_get0(sig, &sig_r, &sig_s);
1053 response->sig_r_len = BN_num_bytes(sig_r);
1054 response->sig_s_len = BN_num_bytes(sig_s);
1055 if ((response->sig_r = calloc(1, response->sig_r_len)) == NULL ||
1056 (response->sig_s = calloc(1, response->sig_s_len)) == NULL) {
1057 skdebug(__func__, "calloc signature failed");
1058 goto out;
1059 }
1060 BN_bn2bin(sig_r, response->sig_r);
1061 BN_bn2bin(sig_s, response->sig_s);
1062 ret = 0;
1063 out:
1064 ECDSA_SIG_free(sig);
1065 if (ret != 0) {
1066 free(response->sig_r);
1067 free(response->sig_s);
1068 response->sig_r = NULL;
1069 response->sig_s = NULL;
1070 }
1071 return ret;
1072 }
1073 #endif /* WITH_OPENSSL */
1074
1075 static int
pack_sig_ed25519(fido_assert_t * assert,struct sk_sign_response * response)1076 pack_sig_ed25519(fido_assert_t *assert, struct sk_sign_response *response)
1077 {
1078 const unsigned char *ptr;
1079 size_t len;
1080 int ret = -1;
1081
1082 ptr = fido_assert_sig_ptr(assert, 0);
1083 len = fido_assert_sig_len(assert, 0);
1084 if (len != 64) {
1085 skdebug(__func__, "bad length %zu", len);
1086 goto out;
1087 }
1088 response->sig_r_len = len;
1089 if ((response->sig_r = calloc(1, response->sig_r_len)) == NULL) {
1090 skdebug(__func__, "calloc signature failed");
1091 goto out;
1092 }
1093 memcpy(response->sig_r, ptr, len);
1094 ret = 0;
1095 out:
1096 if (ret != 0) {
1097 free(response->sig_r);
1098 response->sig_r = NULL;
1099 }
1100 return ret;
1101 }
1102
1103 static int
pack_sig(uint32_t alg,fido_assert_t * assert,struct sk_sign_response * response)1104 pack_sig(uint32_t alg, fido_assert_t *assert,
1105 struct sk_sign_response *response)
1106 {
1107 switch(alg) {
1108 #ifdef WITH_OPENSSL
1109 case SSH_SK_ECDSA:
1110 return pack_sig_ecdsa(assert, response);
1111 #endif /* WITH_OPENSSL */
1112 case SSH_SK_ED25519:
1113 return pack_sig_ed25519(assert, response);
1114 default:
1115 return -1;
1116 }
1117 }
1118
1119 /* Checks sk_options for sk_sign() and sk_load_resident_keys() */
1120 static int
check_sign_load_resident_options(struct sk_option ** options,char ** devicep)1121 check_sign_load_resident_options(struct sk_option **options, char **devicep)
1122 {
1123 size_t i;
1124
1125 if (options == NULL)
1126 return 0;
1127 for (i = 0; options[i] != NULL; i++) {
1128 if (strcmp(options[i]->name, "device") == 0) {
1129 if ((*devicep = strdup(options[i]->value)) == NULL) {
1130 skdebug(__func__, "strdup device failed");
1131 return -1;
1132 }
1133 skdebug(__func__, "requested device %s", *devicep);
1134 } else {
1135 skdebug(__func__, "requested unsupported option %s",
1136 options[i]->name);
1137 if (options[i]->required) {
1138 skdebug(__func__, "unknown required option");
1139 return -1;
1140 }
1141 }
1142 }
1143 return 0;
1144 }
1145
1146 int
sk_sign(uint32_t alg,const uint8_t * data,size_t datalen,const char * application,const uint8_t * key_handle,size_t key_handle_len,uint8_t flags,const char * pin,struct sk_option ** options,struct sk_sign_response ** sign_response)1147 sk_sign(uint32_t alg, const uint8_t *data, size_t datalen,
1148 const char *application,
1149 const uint8_t *key_handle, size_t key_handle_len,
1150 uint8_t flags, const char *pin, struct sk_option **options,
1151 struct sk_sign_response **sign_response)
1152 {
1153 fido_assert_t *assert = NULL;
1154 char *device = NULL;
1155 struct sk_usbhid *sk = NULL;
1156 struct sk_sign_response *response = NULL;
1157 int ret = SSH_SK_ERR_GENERAL, internal_uv;
1158 int r;
1159
1160 fido_init(SSH_FIDO_INIT_ARG);
1161
1162 if (sign_response == NULL) {
1163 skdebug(__func__, "sign_response == NULL");
1164 goto out;
1165 }
1166 *sign_response = NULL;
1167 if (check_sign_load_resident_options(options, &device) != 0)
1168 goto out; /* error already logged */
1169 if (device != NULL)
1170 sk = sk_open(device);
1171 else if (pin != NULL || (flags & SSH_SK_USER_VERIFICATION_REQD))
1172 sk = sk_probe(NULL, NULL, 0, 0);
1173 else
1174 sk = sk_probe(application, key_handle, key_handle_len, 0);
1175 if (sk == NULL) {
1176 ret = SSH_SK_ERR_DEVICE_NOT_FOUND;
1177 skdebug(__func__, "failed to find sk");
1178 goto out;
1179 }
1180 if ((assert = fido_assert_new()) == NULL) {
1181 skdebug(__func__, "fido_assert_new failed");
1182 goto out;
1183 }
1184 if ((r = fido_assert_set_clientdata(assert,
1185 data, datalen)) != FIDO_OK) {
1186 skdebug(__func__, "fido_assert_set_clientdata: %s",
1187 fido_strerr(r));
1188 goto out;
1189 }
1190 if ((r = fido_assert_set_rp(assert, application)) != FIDO_OK) {
1191 skdebug(__func__, "fido_assert_set_rp: %s", fido_strerr(r));
1192 goto out;
1193 }
1194 if ((r = fido_assert_allow_cred(assert, key_handle,
1195 key_handle_len)) != FIDO_OK) {
1196 skdebug(__func__, "fido_assert_allow_cred: %s", fido_strerr(r));
1197 goto out;
1198 }
1199 if ((r = fido_assert_set_up(assert,
1200 (flags & SSH_SK_USER_PRESENCE_REQD) ?
1201 FIDO_OPT_TRUE : FIDO_OPT_FALSE)) != FIDO_OK) {
1202 skdebug(__func__, "fido_assert_set_up: %s", fido_strerr(r));
1203 goto out;
1204 }
1205 /*
1206 * WinHello requests the PIN by default. Make "uv" request explicit
1207 * to allow keys with and without -O verify-required to make sense.
1208 */
1209 if (pin == NULL && fido_dev_is_winhello (sk->dev) &&
1210 (r = fido_assert_set_uv(assert, FIDO_OPT_FALSE)) != FIDO_OK) {
1211 skdebug(__func__, "fido_assert_set_uv: %s", fido_strerr(r));
1212 }
1213 if (pin == NULL && (flags & SSH_SK_USER_VERIFICATION_REQD)) {
1214 if (check_sk_options(sk->dev, "uv", &internal_uv) < 0 ||
1215 internal_uv != 1) {
1216 skdebug(__func__, "check_sk_options uv");
1217 ret = SSH_SK_ERR_PIN_REQUIRED;
1218 goto out;
1219 }
1220 if ((r = fido_assert_set_uv(assert,
1221 FIDO_OPT_TRUE)) != FIDO_OK) {
1222 skdebug(__func__, "fido_assert_set_uv: %s",
1223 fido_strerr(r));
1224 ret = fidoerr_to_skerr(r);
1225 goto out;
1226 }
1227 }
1228 if ((r = fido_dev_get_assert(sk->dev, assert, pin)) != FIDO_OK) {
1229 skdebug(__func__, "fido_dev_get_assert: %s", fido_strerr(r));
1230 ret = fidoerr_to_skerr(r);
1231 goto out;
1232 }
1233 if ((response = calloc(1, sizeof(*response))) == NULL) {
1234 skdebug(__func__, "calloc response failed");
1235 goto out;
1236 }
1237 response->flags = fido_assert_flags(assert, 0);
1238 response->counter = fido_assert_sigcount(assert, 0);
1239 if (pack_sig(alg, assert, response) != 0) {
1240 skdebug(__func__, "pack_sig failed");
1241 goto out;
1242 }
1243 *sign_response = response;
1244 response = NULL;
1245 ret = 0;
1246 out:
1247 free(device);
1248 if (response != NULL) {
1249 free(response->sig_r);
1250 free(response->sig_s);
1251 free(response);
1252 }
1253 sk_close(sk);
1254 fido_assert_free(&assert);
1255 return ret;
1256 }
1257
1258 static int
read_rks(struct sk_usbhid * sk,const char * pin,struct sk_resident_key *** rksp,size_t * nrksp)1259 read_rks(struct sk_usbhid *sk, const char *pin,
1260 struct sk_resident_key ***rksp, size_t *nrksp)
1261 {
1262 int ret = SSH_SK_ERR_GENERAL, r = -1, internal_uv;
1263 fido_credman_metadata_t *metadata = NULL;
1264 fido_credman_rp_t *rp = NULL;
1265 fido_credman_rk_t *rk = NULL;
1266 size_t i, j, nrp, nrk, user_id_len;
1267 const fido_cred_t *cred;
1268 const char *rp_id, *rp_name, *user_name;
1269 struct sk_resident_key *srk = NULL, **tmp;
1270 const u_char *user_id;
1271
1272 if (pin == NULL) {
1273 skdebug(__func__, "no PIN specified");
1274 ret = SSH_SK_ERR_PIN_REQUIRED;
1275 goto out;
1276 }
1277 if ((metadata = fido_credman_metadata_new()) == NULL) {
1278 skdebug(__func__, "alloc failed");
1279 goto out;
1280 }
1281 if (check_sk_options(sk->dev, "uv", &internal_uv) != 0) {
1282 skdebug(__func__, "check_sk_options failed");
1283 goto out;
1284 }
1285
1286 if ((r = fido_credman_get_dev_metadata(sk->dev, metadata, pin)) != 0) {
1287 if (r == FIDO_ERR_INVALID_COMMAND) {
1288 skdebug(__func__, "device %s does not support "
1289 "resident keys", sk->path);
1290 ret = 0;
1291 goto out;
1292 }
1293 skdebug(__func__, "get metadata for %s failed: %s",
1294 sk->path, fido_strerr(r));
1295 ret = fidoerr_to_skerr(r);
1296 goto out;
1297 }
1298 skdebug(__func__, "existing %llu, remaining %llu",
1299 (unsigned long long)fido_credman_rk_existing(metadata),
1300 (unsigned long long)fido_credman_rk_remaining(metadata));
1301 if ((rp = fido_credman_rp_new()) == NULL) {
1302 skdebug(__func__, "alloc rp failed");
1303 goto out;
1304 }
1305 if ((r = fido_credman_get_dev_rp(sk->dev, rp, pin)) != 0) {
1306 skdebug(__func__, "get RPs for %s failed: %s",
1307 sk->path, fido_strerr(r));
1308 goto out;
1309 }
1310 nrp = fido_credman_rp_count(rp);
1311 skdebug(__func__, "Device %s has resident keys for %zu RPs",
1312 sk->path, nrp);
1313
1314 /* Iterate over RP IDs that have resident keys */
1315 for (i = 0; i < nrp; i++) {
1316 rp_id = fido_credman_rp_id(rp, i);
1317 rp_name = fido_credman_rp_name(rp, i);
1318 skdebug(__func__, "rp %zu: name=\"%s\" id=\"%s\" hashlen=%zu",
1319 i, rp_name == NULL ? "(none)" : rp_name,
1320 rp_id == NULL ? "(none)" : rp_id,
1321 fido_credman_rp_id_hash_len(rp, i));
1322
1323 /* Skip non-SSH RP IDs */
1324 if (rp_id == NULL ||
1325 strncasecmp(fido_credman_rp_id(rp, i), "ssh:", 4) != 0)
1326 continue;
1327
1328 fido_credman_rk_free(&rk);
1329 if ((rk = fido_credman_rk_new()) == NULL) {
1330 skdebug(__func__, "alloc rk failed");
1331 goto out;
1332 }
1333 if ((r = fido_credman_get_dev_rk(sk->dev,
1334 fido_credman_rp_id(rp, i), rk, pin)) != 0) {
1335 skdebug(__func__, "get RKs for %s slot %zu failed: %s",
1336 sk->path, i, fido_strerr(r));
1337 goto out;
1338 }
1339 nrk = fido_credman_rk_count(rk);
1340 skdebug(__func__, "RP \"%s\" has %zu resident keys",
1341 fido_credman_rp_id(rp, i), nrk);
1342
1343 /* Iterate over resident keys for this RP ID */
1344 for (j = 0; j < nrk; j++) {
1345 if ((cred = fido_credman_rk(rk, j)) == NULL) {
1346 skdebug(__func__, "no RK in slot %zu", j);
1347 continue;
1348 }
1349 if ((user_name = fido_cred_user_name(cred)) == NULL)
1350 user_name = "";
1351 user_id = fido_cred_user_id_ptr(cred);
1352 user_id_len = fido_cred_user_id_len(cred);
1353 skdebug(__func__, "Device %s RP \"%s\" user \"%s\" "
1354 "uidlen %zu slot %zu: type %d flags 0x%02x "
1355 "prot 0x%02x", sk->path, rp_id, user_name,
1356 user_id_len, j, fido_cred_type(cred),
1357 fido_cred_flags(cred), fido_cred_prot(cred));
1358
1359 /* build response entry */
1360 if ((srk = calloc(1, sizeof(*srk))) == NULL ||
1361 (srk->key.key_handle = calloc(1,
1362 fido_cred_id_len(cred))) == NULL ||
1363 (srk->application = strdup(rp_id)) == NULL ||
1364 (user_id_len > 0 &&
1365 (srk->user_id = calloc(1, user_id_len)) == NULL)) {
1366 skdebug(__func__, "alloc sk_resident_key");
1367 goto out;
1368 }
1369
1370 srk->key.key_handle_len = fido_cred_id_len(cred);
1371 memcpy(srk->key.key_handle, fido_cred_id_ptr(cred),
1372 srk->key.key_handle_len);
1373 srk->user_id_len = user_id_len;
1374 if (srk->user_id_len != 0)
1375 memcpy(srk->user_id, user_id, srk->user_id_len);
1376
1377 switch (fido_cred_type(cred)) {
1378 case COSE_ES256:
1379 srk->alg = SSH_SK_ECDSA;
1380 break;
1381 case COSE_EDDSA:
1382 srk->alg = SSH_SK_ED25519;
1383 break;
1384 default:
1385 skdebug(__func__, "unsupported key type %d",
1386 fido_cred_type(cred));
1387 goto out; /* XXX free rk and continue */
1388 }
1389
1390 if (fido_cred_prot(cred) == FIDO_CRED_PROT_UV_REQUIRED
1391 && internal_uv == -1)
1392 srk->flags |= SSH_SK_USER_VERIFICATION_REQD;
1393
1394 if ((r = pack_public_key(srk->alg, cred,
1395 &srk->key)) != 0) {
1396 skdebug(__func__, "pack public key failed");
1397 goto out;
1398 }
1399 /* append */
1400 if ((tmp = recallocarray(*rksp, *nrksp, (*nrksp) + 1,
1401 sizeof(**rksp))) == NULL) {
1402 skdebug(__func__, "alloc rksp");
1403 goto out;
1404 }
1405 *rksp = tmp;
1406 (*rksp)[(*nrksp)++] = srk;
1407 srk = NULL;
1408 }
1409 }
1410 /* Success */
1411 ret = 0;
1412 out:
1413 if (srk != NULL) {
1414 free(srk->application);
1415 freezero(srk->key.public_key, srk->key.public_key_len);
1416 freezero(srk->key.key_handle, srk->key.key_handle_len);
1417 freezero(srk->user_id, srk->user_id_len);
1418 freezero(srk, sizeof(*srk));
1419 }
1420 fido_credman_rp_free(&rp);
1421 fido_credman_rk_free(&rk);
1422 fido_credman_metadata_free(&metadata);
1423 return ret;
1424 }
1425
1426 int
sk_load_resident_keys(const char * pin,struct sk_option ** options,struct sk_resident_key *** rksp,size_t * nrksp)1427 sk_load_resident_keys(const char *pin, struct sk_option **options,
1428 struct sk_resident_key ***rksp, size_t *nrksp)
1429 {
1430 int ret = SSH_SK_ERR_GENERAL, r = -1;
1431 size_t i, nrks = 0;
1432 struct sk_resident_key **rks = NULL;
1433 struct sk_usbhid *sk = NULL;
1434 char *device = NULL;
1435
1436 *rksp = NULL;
1437 *nrksp = 0;
1438
1439 fido_init(SSH_FIDO_INIT_ARG);
1440
1441 if (check_sign_load_resident_options(options, &device) != 0)
1442 goto out; /* error already logged */
1443 if (device != NULL)
1444 sk = sk_open(device);
1445 else
1446 sk = sk_probe(NULL, NULL, 0, 1);
1447 if (sk == NULL) {
1448 ret = SSH_SK_ERR_DEVICE_NOT_FOUND;
1449 skdebug(__func__, "failed to find sk");
1450 goto out;
1451 }
1452 skdebug(__func__, "trying %s", sk->path);
1453 if ((r = read_rks(sk, pin, &rks, &nrks)) != 0) {
1454 skdebug(__func__, "read_rks failed for %s", sk->path);
1455 ret = r;
1456 goto out;
1457 }
1458 /* success, unless we have no keys but a specific error */
1459 if (nrks > 0 || ret == SSH_SK_ERR_GENERAL)
1460 ret = 0;
1461 *rksp = rks;
1462 *nrksp = nrks;
1463 rks = NULL;
1464 nrks = 0;
1465 out:
1466 sk_close(sk);
1467 for (i = 0; i < nrks; i++) {
1468 free(rks[i]->application);
1469 freezero(rks[i]->key.public_key, rks[i]->key.public_key_len);
1470 freezero(rks[i]->key.key_handle, rks[i]->key.key_handle_len);
1471 freezero(rks[i]->user_id, rks[i]->user_id_len);
1472 freezero(rks[i], sizeof(*rks[i]));
1473 }
1474 free(device);
1475 free(rks);
1476 return ret;
1477 }
1478
1479 #endif /* ENABLE_SK_INTERNAL */
1480