Line | Count | Source |
1 | | /* |
2 | | * Copyright (c) 2020 Yubico AB. All rights reserved. |
3 | | * Use of this source code is governed by a BSD-style |
4 | | * license that can be found in the LICENSE file. |
5 | | */ |
6 | | |
7 | | #include "fido.h" |
8 | | #include "fido/config.h" |
9 | | #include "fido/es256.h" |
10 | | |
11 | 872 | #define CMD_ENABLE_ENTATTEST 0x01 |
12 | 855 | #define CMD_TOGGLE_ALWAYS_UV 0x02 |
13 | 1.85k | #define CMD_SET_PIN_MINLEN 0x03 |
14 | | |
15 | | static int |
16 | | config_prepare_hmac(uint8_t subcmd, const cbor_item_t *item, fido_blob_t *hmac) |
17 | 1.83k | { |
18 | 1.83k | uint8_t prefix[32 + 2 * sizeof(uint8_t)], cbor[128]; |
19 | 1.83k | size_t cbor_len; |
20 | | |
21 | 1.83k | memset(prefix, 0xff, sizeof(prefix)); |
22 | 1.83k | prefix[sizeof(prefix) - 2] = CTAP_CBOR_CONFIG; |
23 | 1.83k | prefix[sizeof(prefix) - 1] = subcmd; |
24 | | |
25 | 1.83k | if ((cbor_len = cbor_serialize(item, cbor, sizeof(cbor))) == 0) { |
26 | 220 | fido_log_debug("%s: cbor_serialize", __func__); |
27 | 220 | return -1; |
28 | 220 | } |
29 | 1.61k | if ((hmac->ptr = malloc(cbor_len + sizeof(prefix))) == NULL) { |
30 | 14 | fido_log_debug("%s: malloc", __func__); |
31 | 14 | return -1; |
32 | 14 | } |
33 | 1.59k | memcpy(hmac->ptr, prefix, sizeof(prefix)); |
34 | 1.59k | memcpy(hmac->ptr + sizeof(prefix), cbor, cbor_len); |
35 | 1.59k | hmac->len = cbor_len + sizeof(prefix); |
36 | | |
37 | 1.59k | return 0; |
38 | 1.59k | } |
39 | | |
40 | | static int |
41 | | config_tx(fido_dev_t *dev, uint8_t subcmd, cbor_item_t **paramv, size_t paramc, |
42 | | const char *pin, int *ms) |
43 | 3.57k | { |
44 | 3.57k | cbor_item_t *argv[4]; |
45 | 3.57k | es256_pk_t *pk = NULL; |
46 | 3.57k | fido_blob_t *ecdh = NULL, f, hmac; |
47 | 3.57k | const uint8_t cmd = CTAP_CBOR_CONFIG; |
48 | 3.57k | int r = FIDO_ERR_INTERNAL; |
49 | | |
50 | 3.57k | memset(&f, 0, sizeof(f)); |
51 | 3.57k | memset(&hmac, 0, sizeof(hmac)); |
52 | 3.57k | memset(&argv, 0, sizeof(argv)); |
53 | | |
54 | | /* subCommand */ |
55 | 3.57k | if ((argv[0] = cbor_build_uint8(subcmd)) == NULL) { |
56 | 26 | fido_log_debug("%s: cbor encode", __func__); |
57 | 26 | goto fail; |
58 | 26 | } |
59 | | |
60 | | /* pinProtocol, pinAuth */ |
61 | 3.55k | if (pin != NULL || (fido_dev_supports_permissions(dev) && |
62 | 1.85k | fido_dev_has_uv(dev))) { |
63 | 1.85k | if ((argv[1] = cbor_flatten_vector(paramv, paramc)) == NULL) { |
64 | 26 | fido_log_debug("%s: cbor_flatten_vector", __func__); |
65 | 26 | goto fail; |
66 | 26 | } |
67 | 1.83k | if (config_prepare_hmac(subcmd, argv[1], &hmac) < 0) { |
68 | 234 | fido_log_debug("%s: config_prepare_hmac", __func__); |
69 | 234 | goto fail; |
70 | 234 | } |
71 | 1.59k | if ((r = fido_do_ecdh(dev, &pk, &ecdh, ms)) != FIDO_OK) { |
72 | 1.43k | fido_log_debug("%s: fido_do_ecdh", __func__); |
73 | 1.43k | goto fail; |
74 | 1.43k | } |
75 | 159 | if ((r = cbor_add_uv_params(dev, cmd, &hmac, pk, ecdh, pin, |
76 | 159 | NULL, &argv[3], &argv[2], ms)) != FIDO_OK) { |
77 | 136 | fido_log_debug("%s: cbor_add_uv_params", __func__); |
78 | 136 | goto fail; |
79 | 136 | } |
80 | 1.71k | } |
81 | | |
82 | | /* framing and transmission */ |
83 | 1.71k | if (cbor_build_frame(cmd, argv, nitems(argv), &f) < 0 || |
84 | 1.71k | fido_tx(dev, CTAP_CMD_CBOR, f.ptr, f.len, ms) < 0) { |
85 | 103 | fido_log_debug("%s: fido_tx", __func__); |
86 | 103 | r = FIDO_ERR_TX; |
87 | 103 | goto fail; |
88 | 103 | } |
89 | | |
90 | 1.61k | r = FIDO_OK; |
91 | 3.57k | fail: |
92 | 3.57k | cbor_vector_free(argv, nitems(argv)); |
93 | 3.57k | es256_pk_free(&pk); |
94 | 3.57k | fido_blob_free(&ecdh); |
95 | 3.57k | free(f.ptr); |
96 | 3.57k | free(hmac.ptr); |
97 | | |
98 | 3.57k | return r; |
99 | 1.61k | } |
100 | | |
101 | | static int |
102 | | config_enable_entattest_wait(fido_dev_t *dev, const char *pin, int *ms) |
103 | 872 | { |
104 | 872 | int r; |
105 | | |
106 | 872 | if ((r = config_tx(dev, CMD_ENABLE_ENTATTEST, NULL, 0, pin, |
107 | 872 | ms)) != FIDO_OK) |
108 | 872 | return r; |
109 | | |
110 | 406 | return fido_rx_cbor_status(dev, ms); |
111 | 406 | } |
112 | | |
113 | | int |
114 | | fido_dev_enable_entattest(fido_dev_t *dev, const char *pin) |
115 | 872 | { |
116 | 872 | int ms = dev->timeout_ms; |
117 | | |
118 | 872 | return (config_enable_entattest_wait(dev, pin, &ms)); |
119 | 872 | } |
120 | | |
121 | | static int |
122 | | config_toggle_always_uv_wait(fido_dev_t *dev, const char *pin, int *ms) |
123 | 855 | { |
124 | 855 | int r; |
125 | | |
126 | 855 | if ((r = config_tx(dev, CMD_TOGGLE_ALWAYS_UV, NULL, 0, pin, |
127 | 855 | ms)) != FIDO_OK) |
128 | 855 | return r; |
129 | | |
130 | 384 | return (fido_rx_cbor_status(dev, ms)); |
131 | 384 | } |
132 | | |
133 | | int |
134 | | fido_dev_toggle_always_uv(fido_dev_t *dev, const char *pin) |
135 | 855 | { |
136 | 855 | int ms = dev->timeout_ms; |
137 | | |
138 | 855 | return config_toggle_always_uv_wait(dev, pin, &ms); |
139 | 855 | } |
140 | | |
141 | | static int |
142 | | config_pin_minlen_tx(fido_dev_t *dev, size_t len, bool force, |
143 | | const fido_str_array_t *rpid, const char *pin, int *ms) |
144 | 2.52k | { |
145 | 2.52k | cbor_item_t *argv[3]; |
146 | 2.52k | int r; |
147 | | |
148 | 2.52k | memset(argv, 0, sizeof(argv)); |
149 | | |
150 | 2.52k | if ((rpid == NULL && len == 0 && !force) || len > UINT8_MAX) { |
151 | 571 | r = FIDO_ERR_INVALID_ARGUMENT; |
152 | 571 | goto fail; |
153 | 571 | } |
154 | 1.95k | if (len && (argv[0] = cbor_build_uint8((uint8_t)len)) == NULL) { |
155 | 2 | fido_log_debug("%s: cbor_encode_uint8", __func__); |
156 | 2 | r = FIDO_ERR_INTERNAL; |
157 | 2 | goto fail; |
158 | 2 | } |
159 | 1.95k | if (rpid != NULL && (argv[1] = cbor_encode_str_array(rpid)) == NULL) { |
160 | 99 | fido_log_debug("%s: cbor_encode_str_array", __func__); |
161 | 99 | r = FIDO_ERR_INTERNAL; |
162 | 99 | goto fail; |
163 | 99 | } |
164 | 1.85k | if (force && (argv[2] = cbor_build_bool(true)) == NULL) { |
165 | 3 | fido_log_debug("%s: cbor_build_bool", __func__); |
166 | 3 | r = FIDO_ERR_INTERNAL; |
167 | 3 | goto fail; |
168 | 3 | } |
169 | 1.85k | if ((r = config_tx(dev, CMD_SET_PIN_MINLEN, argv, nitems(argv), |
170 | 1.85k | pin, ms)) != FIDO_OK) { |
171 | 1.02k | fido_log_debug("%s: config_tx", __func__); |
172 | 1.02k | goto fail; |
173 | 1.02k | } |
174 | | |
175 | 2.52k | fail: |
176 | 2.52k | cbor_vector_free(argv, nitems(argv)); |
177 | | |
178 | 2.52k | return r; |
179 | 1.85k | } |
180 | | |
181 | | static int |
182 | | config_pin_minlen(fido_dev_t *dev, size_t len, bool force, |
183 | | const fido_str_array_t *rpid, const char *pin, int *ms) |
184 | 2.52k | { |
185 | 2.52k | int r; |
186 | | |
187 | 2.52k | if ((r = config_pin_minlen_tx(dev, len, force, rpid, pin, |
188 | 2.52k | ms)) != FIDO_OK) |
189 | 2.52k | return r; |
190 | | |
191 | 824 | return fido_rx_cbor_status(dev, ms); |
192 | 824 | } |
193 | | |
194 | | int |
195 | | fido_dev_set_pin_minlen(fido_dev_t *dev, size_t len, const char *pin) |
196 | 854 | { |
197 | 854 | int ms = dev->timeout_ms; |
198 | | |
199 | 854 | return config_pin_minlen(dev, len, false, NULL, pin, &ms); |
200 | 854 | } |
201 | | |
202 | | int |
203 | | fido_dev_force_pin_change(fido_dev_t *dev, const char *pin) |
204 | 879 | { |
205 | 879 | int ms = dev->timeout_ms; |
206 | | |
207 | 879 | return config_pin_minlen(dev, 0, true, NULL, pin, &ms); |
208 | 879 | } |
209 | | |
210 | | int |
211 | | fido_dev_set_pin_minlen_rpid(fido_dev_t *dev, const char * const *rpid, |
212 | | size_t n, const char *pin) |
213 | 842 | { |
214 | 842 | fido_str_array_t sa; |
215 | 842 | int ms = dev->timeout_ms; |
216 | 842 | int r; |
217 | | |
218 | 842 | memset(&sa, 0, sizeof(sa)); |
219 | 842 | if (fido_str_array_pack(&sa, rpid, n) < 0) { |
220 | 49 | fido_log_debug("%s: fido_str_array_pack", __func__); |
221 | 49 | r = FIDO_ERR_INTERNAL; |
222 | 49 | goto fail; |
223 | 49 | } |
224 | 793 | r = config_pin_minlen(dev, 0, false, &sa, pin, &ms); |
225 | 842 | fail: |
226 | 842 | fido_str_array_free(&sa); |
227 | | |
228 | 842 | return r; |
229 | 793 | } |