Coverage Report

Created: 2020-12-02 17:02

/libfido2/src/u2f.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright (c) 2018 Yubico AB. All rights reserved.
3
 * Use of this source code is governed by a BSD-style
4
 * license that can be found in the LICENSE file.
5
 */
6
7
#include <openssl/sha.h>
8
#include <openssl/x509.h>
9
10
#include <string.h>
11
#ifdef HAVE_UNISTD_H
12
#include <unistd.h>
13
#endif
14
15
#include "fido.h"
16
#include "fido/es256.h"
17
18
#if defined(_MSC_VER)
19
static int
20
usleep(unsigned int usec)
21
{
22
        Sleep(usec / 1000);
23
24
        return (0);
25
}
26
#endif
27
28
static int
29
sig_get(fido_blob_t *sig, const unsigned char **buf, size_t *len)
30
161
{
31
161
        sig->len = *len; /* consume the whole buffer */
32
161
        if ((sig->ptr = calloc(1, sig->len)) == NULL ||
33
161
            fido_buf_read(buf, len, sig->ptr, sig->len) < 0) {
34
4
                fido_log_debug("%s: fido_buf_read", __func__);
35
4
                if (sig->ptr != NULL) {
36
0
                        explicit_bzero(sig->ptr, sig->len);
37
0
                        free(sig->ptr);
38
0
                        sig->ptr = NULL;
39
0
                        sig->len = 0;
40
0
                        return (-1);
41
0
                }
42
161
        }
43
161
44
161
        return (0);
45
161
}
46
47
static int
48
x5c_get(fido_blob_t *x5c, const unsigned char **buf, size_t *len)
49
57
{
50
57
        X509    *cert = NULL;
51
57
        int      ok = -1;
52
57
53
57
        if (*len > LONG_MAX) {
54
0
                fido_log_debug("%s: invalid len %zu", __func__, *len);
55
0
                goto fail;
56
0
        }
57
57
58
57
        /* find out the certificate's length */
59
57
        const unsigned char *end = *buf;
60
57
        if ((cert = d2i_X509(NULL, &end, (long)*len)) == NULL || end <= *buf ||
61
57
            (x5c->len = (size_t)(end - *buf)) >= *len) {
62
11
                fido_log_debug("%s: d2i_X509", __func__);
63
11
                goto fail;
64
11
        }
65
46
66
46
        /* read accordingly */
67
46
        if ((x5c->ptr = calloc(1, x5c->len)) == NULL ||
68
46
            fido_buf_read(buf, len, x5c->ptr, x5c->len) < 0) {
69
1
                fido_log_debug("%s: fido_buf_read", __func__);
70
1
                goto fail;
71
1
        }
72
45
73
45
        ok = 0;
74
57
fail:
75
57
        if (cert != NULL)
76
57
                X509_free(cert);
77
57
78
57
        if (ok < 0) {
79
12
                free(x5c->ptr);
80
12
                x5c->ptr = NULL;
81
12
                x5c->len = 0;
82
12
        }
83
57
84
57
        return (ok);
85
45
}
86
87
static int
88
authdata_fake(const char *rp_id, uint8_t flags, uint32_t sigcount,
89
    fido_blob_t *fake_cbor_ad)
90
116
{
91
116
        fido_authdata_t  ad;
92
116
        cbor_item_t     *item = NULL;
93
116
        size_t           alloc_len;
94
116
95
116
        memset(&ad, 0, sizeof(ad));
96
116
97
116
        if (SHA256((const void *)rp_id, strlen(rp_id),
98
116
            ad.rp_id_hash) != ad.rp_id_hash) {
99
1
                fido_log_debug("%s: sha256", __func__);
100
1
                return (-1);
101
1
        }
102
115
103
115
        ad.flags = flags; /* XXX translate? */
104
115
        ad.sigcount = sigcount;
105
115
106
115
        if ((item = cbor_build_bytestring((const unsigned char *)&ad,
107
115
            sizeof(ad))) == NULL) {
108
1
                fido_log_debug("%s: cbor_build_bytestring", __func__);
109
1
                return (-1);
110
1
        }
111
114
112
114
        if (fake_cbor_ad->ptr != NULL ||
113
114
            (fake_cbor_ad->len = cbor_serialize_alloc(item, &fake_cbor_ad->ptr,
114
114
            &alloc_len)) == 0) {
115
1
                fido_log_debug("%s: cbor_serialize_alloc", __func__);
116
1
                cbor_decref(&item);
117
1
                return (-1);
118
1
        }
119
113
120
113
        cbor_decref(&item);
121
113
122
113
        return (0);
123
113
}
124
125
/* TODO: use u2f_get_touch_begin & u2f_get_touch_status instead */
126
static int
127
send_dummy_register(fido_dev_t *dev, int ms)
128
21
{
129
21
        iso7816_apdu_t  *apdu = NULL;
130
21
        unsigned char    challenge[SHA256_DIGEST_LENGTH];
131
21
        unsigned char    application[SHA256_DIGEST_LENGTH];
132
21
        unsigned char    reply[FIDO_MAXMSG];
133
21
        int              r;
134
21
135
21
#ifdef FIDO_FUZZ
136
21
        ms = 0; /* XXX */
137
21
#endif
138
21
139
21
        /* dummy challenge & application */
140
21
        memset(&challenge, 0xff, sizeof(challenge));
141
21
        memset(&application, 0xff, sizeof(application));
142
21
143
21
        if ((apdu = iso7816_new(U2F_CMD_REGISTER, 0, 2 *
144
21
            SHA256_DIGEST_LENGTH)) == NULL ||
145
21
            iso7816_add(apdu, &challenge, sizeof(challenge)) < 0 ||
146
21
            iso7816_add(apdu, &application, sizeof(application)) < 0) {
147
1
                fido_log_debug("%s: iso7816", __func__);
148
1
                r = FIDO_ERR_INTERNAL;
149
1
                goto fail;
150
1
        }
151
20
152
57
        do {
153
57
                if (fido_tx(dev, CTAP_CMD_MSG, iso7816_ptr(apdu),
154
57
                    iso7816_len(apdu)) < 0) {
155
1
                        fido_log_debug("%s: fido_tx", __func__);
156
1
                        r = FIDO_ERR_TX;
157
1
                        goto fail;
158
1
                }
159
56
                if (fido_rx(dev, CTAP_CMD_MSG, &reply, sizeof(reply), ms) < 2) {
160
11
                        fido_log_debug("%s: fido_rx", __func__);
161
11
                        r = FIDO_ERR_RX;
162
11
                        goto fail;
163
11
                }
164
45
                if (usleep((unsigned)(ms == -1 ? 100 : ms) * 1000) < 0) {
165
1
                        fido_log_debug("%s: usleep", __func__);
166
1
                        r = FIDO_ERR_RX;
167
1
                        goto fail;
168
1
                }
169
44
        } while (((reply[0] << 8) | reply[1]) == SW_CONDITIONS_NOT_SATISFIED);
170
20
171
20
        r = FIDO_OK;
172
21
fail:
173
21
        iso7816_free(&apdu);
174
21
175
21
        return (r);
176
7
}
177
178
static int
179
key_lookup(fido_dev_t *dev, const char *rp_id, const fido_blob_t *key_id,
180
    int *found, int ms)
181
723
{
182
723
        iso7816_apdu_t  *apdu = NULL;
183
723
        unsigned char    challenge[SHA256_DIGEST_LENGTH];
184
723
        unsigned char    rp_id_hash[SHA256_DIGEST_LENGTH];
185
723
        unsigned char    reply[FIDO_MAXMSG];
186
723
        uint8_t          key_id_len;
187
723
        int              r;
188
723
189
723
        if (key_id->len > UINT8_MAX || rp_id == NULL) {
190
12
                fido_log_debug("%s: key_id->len=%zu, rp_id=%p", __func__,
191
12
                    key_id->len, (const void *)rp_id);
192
12
                r = FIDO_ERR_INVALID_ARGUMENT;
193
12
                goto fail;
194
12
        }
195
711
196
711
        memset(&challenge, 0xff, sizeof(challenge));
197
711
        memset(&rp_id_hash, 0, sizeof(rp_id_hash));
198
711
199
711
        if (SHA256((const void *)rp_id, strlen(rp_id),
200
711
            rp_id_hash) != rp_id_hash) {
201
4
                fido_log_debug("%s: sha256", __func__);
202
4
                r = FIDO_ERR_INTERNAL;
203
4
                goto fail;
204
4
        }
205
707
206
707
        key_id_len = (uint8_t)key_id->len;
207
707
208
707
        if ((apdu = iso7816_new(U2F_CMD_AUTH, U2F_AUTH_CHECK, (uint16_t)(2 *
209
707
            SHA256_DIGEST_LENGTH + sizeof(key_id_len) + key_id_len))) == NULL ||
210
707
            iso7816_add(apdu, &challenge, sizeof(challenge)) < 0 ||
211
707
            iso7816_add(apdu, &rp_id_hash, sizeof(rp_id_hash)) < 0 ||
212
707
            iso7816_add(apdu, &key_id_len, sizeof(key_id_len)) < 0 ||
213
707
            iso7816_add(apdu, key_id->ptr, key_id_len) < 0) {
214
4
                fido_log_debug("%s: iso7816", __func__);
215
4
                r = FIDO_ERR_INTERNAL;
216
4
                goto fail;
217
4
        }
218
703
219
703
        if (fido_tx(dev, CTAP_CMD_MSG, iso7816_ptr(apdu),
220
703
            iso7816_len(apdu)) < 0) {
221
12
                fido_log_debug("%s: fido_tx", __func__);
222
12
                r = FIDO_ERR_TX;
223
12
                goto fail;
224
12
        }
225
691
        if (fido_rx(dev, CTAP_CMD_MSG, &reply, sizeof(reply), ms) != 2) {
226
312
                fido_log_debug("%s: fido_rx", __func__);
227
312
                r = FIDO_ERR_RX;
228
312
                goto fail;
229
312
        }
230
379
231
379
        switch ((reply[0] << 8) | reply[1]) {
232
267
        case SW_CONDITIONS_NOT_SATISFIED:
233
267
                *found = 1; /* key exists */
234
267
                break;
235
15
        case SW_WRONG_DATA:
236
15
                *found = 0; /* key does not exist */
237
15
                break;
238
97
        default:
239
97
                /* unexpected sw */
240
97
                r = FIDO_ERR_INTERNAL;
241
97
                goto fail;
242
282
        }
243
282
244
282
        r = FIDO_OK;
245
723
fail:
246
723
        iso7816_free(&apdu);
247
723
248
723
        return (r);
249
282
}
250
251
static int
252
parse_auth_reply(fido_blob_t *sig, fido_blob_t *ad, const char *rp_id,
253
    const unsigned char *reply, size_t len)
254
152
{
255
152
        uint8_t         flags;
256
152
        uint32_t        sigcount;
257
152
258
152
        if (len < 2 || ((reply[len - 2] << 8) | reply[len - 1]) != SW_NO_ERROR) {
259
35
                fido_log_debug("%s: unexpected sw", __func__);
260
35
                return (FIDO_ERR_RX);
261
35
        }
262
117
263
117
        len -= 2;
264
117
265
117
        if (fido_buf_read(&reply, &len, &flags, sizeof(flags)) < 0 ||
266
117
            fido_buf_read(&reply, &len, &sigcount, sizeof(sigcount)) < 0) {
267
1
                fido_log_debug("%s: fido_buf_read", __func__);
268
1
                return (FIDO_ERR_RX);
269
1
        }
270
116
271
116
        if (sig_get(sig, &reply, &len) < 0) {
272
0
                fido_log_debug("%s: sig_get", __func__);
273
0
                return (FIDO_ERR_RX);
274
0
        }
275
116
276
116
        if (authdata_fake(rp_id, flags, sigcount, ad) < 0) {
277
3
                fido_log_debug("%s; authdata_fake", __func__);
278
3
                return (FIDO_ERR_RX);
279
3
        }
280
113
281
113
        return (FIDO_OK);
282
113
}
283
284
static int
285
do_auth(fido_dev_t *dev, const fido_blob_t *cdh, const char *rp_id,
286
    const fido_blob_t *key_id, fido_blob_t *sig, fido_blob_t *ad, int ms)
287
184
{
288
184
        iso7816_apdu_t  *apdu = NULL;
289
184
        unsigned char    rp_id_hash[SHA256_DIGEST_LENGTH];
290
184
        unsigned char    reply[FIDO_MAXMSG];
291
184
        int              reply_len;
292
184
        uint8_t          key_id_len;
293
184
        int              r;
294
184
295
184
#ifdef FIDO_FUZZ
296
184
        ms = 0; /* XXX */
297
184
#endif
298
184
299
184
        if (cdh->len != SHA256_DIGEST_LENGTH || key_id->len > UINT8_MAX ||
300
184
            rp_id == NULL) {
301
14
                r = FIDO_ERR_INVALID_ARGUMENT;
302
14
                goto fail;
303
14
        }
304
170
305
170
        memset(&rp_id_hash, 0, sizeof(rp_id_hash));
306
170
307
170
        if (SHA256((const void *)rp_id, strlen(rp_id),
308
170
            rp_id_hash) != rp_id_hash) {
309
1
                fido_log_debug("%s: sha256", __func__);
310
1
                r = FIDO_ERR_INTERNAL;
311
1
                goto fail;
312
1
        }
313
169
314
169
        key_id_len = (uint8_t)key_id->len;
315
169
316
169
        if ((apdu = iso7816_new(U2F_CMD_AUTH, U2F_AUTH_SIGN, (uint16_t)(2 *
317
169
            SHA256_DIGEST_LENGTH + sizeof(key_id_len) + key_id_len))) == NULL ||
318
169
            iso7816_add(apdu, cdh->ptr, cdh->len) < 0 ||
319
169
            iso7816_add(apdu, &rp_id_hash, sizeof(rp_id_hash)) < 0 ||
320
169
            iso7816_add(apdu, &key_id_len, sizeof(key_id_len)) < 0 ||
321
169
            iso7816_add(apdu, key_id->ptr, key_id_len) < 0) {
322
1
                fido_log_debug("%s: iso7816", __func__);
323
1
                r = FIDO_ERR_INTERNAL;
324
1
                goto fail;
325
1
        }
326
168
327
315
        do {
328
315
                if (fido_tx(dev, CTAP_CMD_MSG, iso7816_ptr(apdu),
329
315
                    iso7816_len(apdu)) < 0) {
330
2
                        fido_log_debug("%s: fido_tx", __func__);
331
2
                        r = FIDO_ERR_TX;
332
2
                        goto fail;
333
2
                }
334
313
                if ((reply_len = fido_rx(dev, CTAP_CMD_MSG, &reply,
335
313
                    sizeof(reply), ms)) < 2) {
336
13
                        fido_log_debug("%s: fido_rx", __func__);
337
13
                        r = FIDO_ERR_RX;
338
13
                        goto fail;
339
13
                }
340
300
                if (usleep((unsigned)(ms == -1 ? 100 : ms) * 1000) < 0) {
341
1
                        fido_log_debug("%s: usleep", __func__);
342
1
                        r = FIDO_ERR_RX;
343
1
                        goto fail;
344
1
                }
345
299
        } while (((reply[0] << 8) | reply[1]) == SW_CONDITIONS_NOT_SATISFIED);
346
168
347
168
        if ((r = parse_auth_reply(sig, ad, rp_id, reply,
348
152
            (size_t)reply_len)) != FIDO_OK) {
349
39
                fido_log_debug("%s: parse_auth_reply", __func__);
350
39
                goto fail;
351
39
        }
352
184
353
184
fail:
354
184
        iso7816_free(&apdu);
355
184
356
184
        return (r);
357
152
}
358
359
static int
360
cbor_blob_from_ec_point(const uint8_t *ec_point, size_t ec_point_len,
361
    fido_blob_t *cbor_blob)
362
45
{
363
45
        es256_pk_t      *pk = NULL;
364
45
        cbor_item_t     *pk_cbor = NULL;
365
45
        size_t           alloc_len;
366
45
        int              ok = -1;
367
45
368
45
        /* only handle uncompressed points */
369
45
        if (ec_point_len != 65 || ec_point[0] != 0x04) {
370
2
                fido_log_debug("%s: unexpected format", __func__);
371
2
                goto fail;
372
2
        }
373
43
374
43
        if ((pk = es256_pk_new()) == NULL ||
375
43
            es256_pk_set_x(pk, &ec_point[1]) < 0 ||
376
43
            es256_pk_set_y(pk, &ec_point[33]) < 0) {
377
1
                fido_log_debug("%s: es256_pk_set", __func__);
378
1
                goto fail;
379
1
        }
380
42
381
42
        if ((pk_cbor = es256_pk_encode(pk, 0)) == NULL) {
382
1
                fido_log_debug("%s: es256_pk_encode", __func__);
383
1
                goto fail;
384
1
        }
385
41
386
41
        if ((cbor_blob->len = cbor_serialize_alloc(pk_cbor, &cbor_blob->ptr,
387
41
            &alloc_len)) != 77) {
388
1
                fido_log_debug("%s: cbor_serialize_alloc", __func__);
389
1
                goto fail;
390
1
        }
391
40
392
40
        ok = 0;
393
45
fail:
394
45
        es256_pk_free(&pk);
395
45
396
45
        if (pk_cbor)
397
41
                cbor_decref(&pk_cbor);
398
45
399
45
        return (ok);
400
40
}
401
402
static int
403
encode_cred_authdata(const char *rp_id, const uint8_t *kh, uint8_t kh_len,
404
    const uint8_t *pubkey, size_t pubkey_len, fido_blob_t *out)
405
45
{
406
45
        fido_authdata_t          authdata;
407
45
        fido_attcred_raw_t       attcred_raw;
408
45
        fido_blob_t              pk_blob;
409
45
        fido_blob_t              authdata_blob;
410
45
        cbor_item_t             *authdata_cbor = NULL;
411
45
        unsigned char           *ptr;
412
45
        size_t                   len;
413
45
        size_t                   alloc_len;
414
45
        int                      ok = -1;
415
45
416
45
        memset(&pk_blob, 0, sizeof(pk_blob));
417
45
        memset(&authdata, 0, sizeof(authdata));
418
45
        memset(&authdata_blob, 0, sizeof(authdata_blob));
419
45
        memset(out, 0, sizeof(*out));
420
45
421
45
        if (rp_id == NULL) {
422
0
                fido_log_debug("%s: NULL rp_id", __func__);
423
0
                goto fail;
424
0
        }
425
45
426
45
        if (cbor_blob_from_ec_point(pubkey, pubkey_len, &pk_blob) < 0) {
427
5
                fido_log_debug("%s: cbor_blob_from_ec_point", __func__);
428
5
                goto fail;
429
5
        }
430
40
431
40
        if (SHA256((const void *)rp_id, strlen(rp_id),
432
40
            authdata.rp_id_hash) != authdata.rp_id_hash) {
433
1
                fido_log_debug("%s: sha256", __func__);
434
1
                goto fail;
435
1
        }
436
39
437
39
        authdata.flags = (CTAP_AUTHDATA_ATT_CRED | CTAP_AUTHDATA_USER_PRESENT);
438
39
        authdata.sigcount = 0;
439
39
440
39
        memset(&attcred_raw.aaguid, 0, sizeof(attcred_raw.aaguid));
441
39
        attcred_raw.id_len = htobe16(kh_len);
442
39
443
39
        len = authdata_blob.len = sizeof(authdata) + sizeof(attcred_raw) +
444
39
            kh_len + pk_blob.len;
445
39
        ptr = authdata_blob.ptr = calloc(1, authdata_blob.len);
446
39
447
39
        fido_log_debug("%s: ptr=%p, len=%zu", __func__, (void *)ptr, len);
448
39
449
39
        if (authdata_blob.ptr == NULL)
450
39
                goto fail;
451
38
452
38
        if (fido_buf_write(&ptr, &len, &authdata, sizeof(authdata)) < 0 ||
453
38
            fido_buf_write(&ptr, &len, &attcred_raw, sizeof(attcred_raw)) < 0 ||
454
38
            fido_buf_write(&ptr, &len, kh, kh_len) < 0 ||
455
38
            fido_buf_write(&ptr, &len, pk_blob.ptr, pk_blob.len) < 0) {
456
0
                fido_log_debug("%s: fido_buf_write", __func__);
457
0
                goto fail;
458
0
        }
459
38
460
38
        if ((authdata_cbor = fido_blob_encode(&authdata_blob)) == NULL) {
461
1
                fido_log_debug("%s: fido_blob_encode", __func__);
462
1
                goto fail;
463
1
        }
464
37
465
37
        if ((out->len = cbor_serialize_alloc(authdata_cbor, &out->ptr,
466
37
            &alloc_len)) == 0) {
467
1
                fido_log_debug("%s: cbor_serialize_alloc", __func__);
468
1
                goto fail;
469
1
        }
470
36
471
36
        ok = 0;
472
45
fail:
473
45
        if (authdata_cbor)
474
37
                cbor_decref(&authdata_cbor);
475
45
476
45
        if (pk_blob.ptr) {
477
40
                explicit_bzero(pk_blob.ptr, pk_blob.len);
478
40
                free(pk_blob.ptr);
479
40
        }
480
45
        if (authdata_blob.ptr) {
481
38
                explicit_bzero(authdata_blob.ptr, authdata_blob.len);
482
38
                free(authdata_blob.ptr);
483
38
        }
484
45
485
45
        return (ok);
486
36
}
487
488
static int
489
parse_register_reply(fido_cred_t *cred, const unsigned char *reply, size_t len)
490
107
{
491
107
        fido_blob_t      x5c;
492
107
        fido_blob_t      sig;
493
107
        fido_blob_t      ad;
494
107
        uint8_t          dummy;
495
107
        uint8_t          pubkey[65];
496
107
        uint8_t          kh_len = 0;
497
107
        uint8_t         *kh = NULL;
498
107
        int              r;
499
107
500
107
        memset(&x5c, 0, sizeof(x5c));
501
107
        memset(&sig, 0, sizeof(sig));
502
107
        memset(&ad, 0, sizeof(ad));
503
107
        r = FIDO_ERR_RX;
504
107
505
107
        /* status word */
506
107
        if (len < 2 || ((reply[len - 2] << 8) | reply[len - 1]) != SW_NO_ERROR) {
507
40
                fido_log_debug("%s: unexpected sw", __func__);
508
40
                goto fail;
509
40
        }
510
67
511
67
        len -= 2;
512
67
513
67
        /* reserved byte */
514
67
        if (fido_buf_read(&reply, &len, &dummy, sizeof(dummy)) < 0 ||
515
67
            dummy != 0x05) {
516
9
                fido_log_debug("%s: reserved byte", __func__);
517
9
                goto fail;
518
9
        }
519
58
520
58
        /* pubkey + key handle */
521
58
        if (fido_buf_read(&reply, &len, &pubkey, sizeof(pubkey)) < 0 ||
522
58
            fido_buf_read(&reply, &len, &kh_len, sizeof(kh_len)) < 0 ||
523
58
            (kh = calloc(1, kh_len)) == NULL ||
524
58
            fido_buf_read(&reply, &len, kh, kh_len) < 0) {
525
1
                fido_log_debug("%s: fido_buf_read", __func__);
526
1
                goto fail;
527
1
        }
528
57
529
57
        /* x5c + sig */
530
57
        if (x5c_get(&x5c, &reply, &len) < 0 ||
531
57
            sig_get(&sig, &reply, &len) < 0) {
532
12
                fido_log_debug("%s: x5c || sig", __func__);
533
12
                goto fail;
534
12
        }
535
45
536
45
        /* authdata */
537
45
        if (encode_cred_authdata(cred->rp.id, kh, kh_len, pubkey,
538
45
            sizeof(pubkey), &ad) < 0) {
539
9
                fido_log_debug("%s: encode_cred_authdata", __func__);
540
9
                goto fail;
541
9
        }
542
36
543
36
        if (fido_cred_set_fmt(cred, "fido-u2f") != FIDO_OK ||
544
36
            fido_cred_set_authdata(cred, ad.ptr, ad.len) != FIDO_OK ||
545
36
            fido_cred_set_x509(cred, x5c.ptr, x5c.len) != FIDO_OK ||
546
36
            fido_cred_set_sig(cred, sig.ptr, sig.len) != FIDO_OK) {
547
7
                fido_log_debug("%s: fido_cred_set", __func__);
548
7
                r = FIDO_ERR_INTERNAL;
549
7
                goto fail;
550
7
        }
551
29
552
29
        r = FIDO_OK;
553
107
fail:
554
107
        if (kh) {
555
57
                explicit_bzero(kh, kh_len);
556
57
                free(kh);
557
57
        }
558
107
        if (x5c.ptr) {
559
45
                explicit_bzero(x5c.ptr, x5c.len);
560
45
                free(x5c.ptr);
561
45
        }
562
107
        if (sig.ptr) {
563
43
                explicit_bzero(sig.ptr, sig.len);
564
43
                free(sig.ptr);
565
43
        }
566
107
        if (ad.ptr) {
567
36
                explicit_bzero(ad.ptr, ad.len);
568
36
                free(ad.ptr);
569
36
        }
570
107
571
107
        return (r);
572
29
}
573
574
int
575
u2f_register(fido_dev_t *dev, fido_cred_t *cred, int ms)
576
299
{
577
299
        iso7816_apdu_t  *apdu = NULL;
578
299
        unsigned char    rp_id_hash[SHA256_DIGEST_LENGTH];
579
299
        unsigned char    reply[FIDO_MAXMSG];
580
299
        int              reply_len;
581
299
        int              found;
582
299
        int              r;
583
299
584
299
#ifdef FIDO_FUZZ
585
299
        ms = 0; /* XXX */
586
299
#endif
587
299
588
299
        if (cred->rk == FIDO_OPT_TRUE || cred->uv == FIDO_OPT_TRUE) {
589
18
                fido_log_debug("%s: rk=%d, uv=%d", __func__, cred->rk,
590
18
                    cred->uv);
591
18
                return (FIDO_ERR_UNSUPPORTED_OPTION);
592
18
        }
593
281
594
281
        if (cred->type != COSE_ES256 || cred->cdh.ptr == NULL ||
595
281
            cred->rp.id == NULL || cred->cdh.len != SHA256_DIGEST_LENGTH) {
596
37
                fido_log_debug("%s: type=%d, cdh=(%p,%zu)" , __func__,
597
37
                    cred->type, (void *)cred->cdh.ptr, cred->cdh.len);
598
37
                return (FIDO_ERR_INVALID_ARGUMENT);
599
37
        }
600
244
601
253
        for (size_t i = 0; i < cred->excl.len; i++) {
602
133
                if ((r = key_lookup(dev, cred->rp.id, &cred->excl.ptr[i],
603
133
                    &found, ms)) != FIDO_OK) {
604
103
                        fido_log_debug("%s: key_lookup", __func__);
605
103
                        return (r);
606
103
                }
607
30
                if (found) {
608
21
                        if ((r = send_dummy_register(dev, ms)) != FIDO_OK) {
609
14
                                fido_log_debug("%s: send_dummy_register",
610
14
                                    __func__);
611
14
                                return (r);
612
14
                        }
613
7
                        return (FIDO_ERR_CREDENTIAL_EXCLUDED);
614
7
                }
615
30
        }
616
244
617
244
        memset(&rp_id_hash, 0, sizeof(rp_id_hash));
618
120
619
120
        if (SHA256((const void *)cred->rp.id, strlen(cred->rp.id),
620
120
            rp_id_hash) != rp_id_hash) {
621
1
                fido_log_debug("%s: sha256", __func__);
622
1
                return (FIDO_ERR_INTERNAL);
623
1
        }
624
119
625
119
        if ((apdu = iso7816_new(U2F_CMD_REGISTER, 0, 2 *
626
119
            SHA256_DIGEST_LENGTH)) == NULL ||
627
119
            iso7816_add(apdu, cred->cdh.ptr, cred->cdh.len) < 0 ||
628
119
            iso7816_add(apdu, rp_id_hash, sizeof(rp_id_hash)) < 0) {
629
2
                fido_log_debug("%s: iso7816", __func__);
630
2
                r = FIDO_ERR_INTERNAL;
631
2
                goto fail;
632
2
        }
633
117
634
366
        do {
635
366
                if (fido_tx(dev, CTAP_CMD_MSG, iso7816_ptr(apdu),
636
366
                    iso7816_len(apdu)) < 0) {
637
2
                        fido_log_debug("%s: fido_tx", __func__);
638
2
                        r = FIDO_ERR_TX;
639
2
                        goto fail;
640
2
                }
641
364
                if ((reply_len = fido_rx(dev, CTAP_CMD_MSG, &reply,
642
364
                    sizeof(reply), ms)) < 2) {
643
7
                        fido_log_debug("%s: fido_rx", __func__);
644
7
                        r = FIDO_ERR_RX;
645
7
                        goto fail;
646
7
                }
647
357
                if (usleep((unsigned)(ms == -1 ? 100 : ms) * 1000) < 0) {
648
1
                        fido_log_debug("%s: usleep", __func__);
649
1
                        r = FIDO_ERR_RX;
650
1
                        goto fail;
651
1
                }
652
356
        } while (((reply[0] << 8) | reply[1]) == SW_CONDITIONS_NOT_SATISFIED);
653
117
654
117
        if ((r = parse_register_reply(cred, reply,
655
107
            (size_t)reply_len)) != FIDO_OK) {
656
78
                fido_log_debug("%s: parse_register_reply", __func__);
657
78
                goto fail;
658
78
        }
659
119
fail:
660
119
        iso7816_free(&apdu);
661
119
662
119
        return (r);
663
107
}
664
665
static int
666
u2f_authenticate_single(fido_dev_t *dev, const fido_blob_t *key_id,
667
    fido_assert_t *fa, size_t idx, int ms)
668
590
{
669
590
        fido_blob_t     sig;
670
590
        fido_blob_t     ad;
671
590
        int             found;
672
590
        int             r;
673
590
674
590
        memset(&sig, 0, sizeof(sig));
675
590
        memset(&ad, 0, sizeof(ad));
676
590
677
590
        if ((r = key_lookup(dev, fa->rp_id, key_id, &found, ms)) != FIDO_OK) {
678
338
                fido_log_debug("%s: key_lookup", __func__);
679
338
                goto fail;
680
338
        }
681
252
682
252
        if (!found) {
683
6
                fido_log_debug("%s: not found", __func__);
684
6
                r = FIDO_ERR_CREDENTIAL_EXCLUDED;
685
6
                goto fail;
686
6
        }
687
246
688
246
        if (fido_blob_set(&fa->stmt[idx].id, key_id->ptr, key_id->len) < 0) {
689
1
                fido_log_debug("%s: fido_blob_set", __func__);
690
1
                r = FIDO_ERR_INTERNAL;
691
1
                goto fail;
692
1
        }
693
245
694
245
        if (fa->up == FIDO_OPT_FALSE) {
695
61
                fido_log_debug("%s: checking for key existence only", __func__);
696
61
                r = FIDO_ERR_USER_PRESENCE_REQUIRED;
697
61
                goto fail;
698
61
        }
699
184
700
184
        if ((r = do_auth(dev, &fa->cdh, fa->rp_id, key_id, &sig, &ad,
701
184
            ms)) != FIDO_OK) {
702
71
                fido_log_debug("%s: do_auth", __func__);
703
71
                goto fail;
704
71
        }
705
113
706
113
        if (fido_assert_set_authdata(fa, idx, ad.ptr, ad.len) != FIDO_OK ||
707
113
            fido_assert_set_sig(fa, idx, sig.ptr, sig.len) != FIDO_OK) {
708
5
                fido_log_debug("%s: fido_assert_set", __func__);
709
5
                r = FIDO_ERR_INTERNAL;
710
5
                goto fail;
711
5
        }
712
108
713
108
        r = FIDO_OK;
714
590
fail:
715
590
        if (sig.ptr) {
716
114
                explicit_bzero(sig.ptr, sig.len);
717
114
                free(sig.ptr);
718
114
        }
719
590
        if (ad.ptr) {
720
113
                explicit_bzero(ad.ptr, ad.len);
721
113
                free(ad.ptr);
722
113
        }
723
590
724
590
        return (r);
725
108
}
726
727
int
728
u2f_authenticate(fido_dev_t *dev, fido_assert_t *fa, int ms)
729
496
{
730
496
        size_t  nfound = 0;
731
496
        size_t  nauth_ok = 0;
732
496
        int     r;
733
496
734
496
        if (fa->uv == FIDO_OPT_TRUE || fa->allow_list.ptr == NULL) {
735
64
                fido_log_debug("%s: uv=%d, allow_list=%p", __func__, fa->uv,
736
64
                    (void *)fa->allow_list.ptr);
737
64
                return (FIDO_ERR_UNSUPPORTED_OPTION);
738
64
        }
739
432
740
432
        if ((r = fido_assert_set_count(fa, fa->allow_list.len)) != FIDO_OK) {
741
1
                fido_log_debug("%s: fido_assert_set_count", __func__);
742
1
                return (r);
743
1
        }
744
431
745
606
        for (size_t i = 0; i < fa->allow_list.len; i++) {
746
590
                switch ((r = u2f_authenticate_single(dev,
747
590
                    &fa->allow_list.ptr[i], fa, nfound, ms))) {
748
108
                case FIDO_OK:
749
108
                        nauth_ok++;
750
108
                        /* FALLTHROUGH */
751
169
                case FIDO_ERR_USER_PRESENCE_REQUIRED:
752
169
                        nfound++;
753
169
                        break;
754
421
                default:
755
421
                        if (r != FIDO_ERR_CREDENTIAL_EXCLUDED) {
756
415
                                fido_log_debug("%s: u2f_authenticate_single",
757
415
                                    __func__);
758
415
                                return (r);
759
415
                        }
760
590
                        /* ignore credentials that don't exist */
761
590
                }
762
590
        }
763
431
764
431
        fa->stmt_len = nfound;
765
16
766
16
        if (nfound == 0)
767
2
                return (FIDO_ERR_NO_CREDENTIALS);
768
14
        if (nauth_ok == 0)
769
3
                return (FIDO_ERR_USER_PRESENCE_REQUIRED);
770
11
771
11
        return (FIDO_OK);
772
11
}
773
774
int
775
u2f_get_touch_begin(fido_dev_t *dev)
776
1.32k
{
777
1.32k
        iso7816_apdu_t  *apdu = NULL;
778
1.32k
        const char      *clientdata = FIDO_DUMMY_CLIENTDATA;
779
1.32k
        const char      *rp_id = FIDO_DUMMY_RP_ID;
780
1.32k
        unsigned char    clientdata_hash[SHA256_DIGEST_LENGTH];
781
1.32k
        unsigned char    rp_id_hash[SHA256_DIGEST_LENGTH];
782
1.32k
        unsigned char    reply[FIDO_MAXMSG];
783
1.32k
        int              r;
784
1.32k
785
1.32k
        memset(&clientdata_hash, 0, sizeof(clientdata_hash));
786
1.32k
        memset(&rp_id_hash, 0, sizeof(rp_id_hash));
787
1.32k
788
1.32k
        if (SHA256((const void *)clientdata, strlen(clientdata),
789
1.32k
            clientdata_hash) != clientdata_hash || SHA256((const void *)rp_id,
790
1.32k
            strlen(rp_id), rp_id_hash) != rp_id_hash) {
791
16
                fido_log_debug("%s: sha256", __func__);
792
16
                return (FIDO_ERR_INTERNAL);
793
16
        }
794
1.31k
795
1.31k
        if ((apdu = iso7816_new(U2F_CMD_REGISTER, 0, 2 *
796
1.31k
            SHA256_DIGEST_LENGTH)) == NULL ||
797
1.31k
            iso7816_add(apdu, clientdata_hash, sizeof(clientdata_hash)) < 0 ||
798
1.31k
            iso7816_add(apdu, rp_id_hash, sizeof(rp_id_hash)) < 0) {
799
12
                fido_log_debug("%s: iso7816", __func__);
800
12
                r = FIDO_ERR_INTERNAL;
801
12
                goto fail;
802
12
        }
803
1.30k
804
1.30k
        if (dev->attr.flags & FIDO_CAP_WINK) {
805
921
                fido_tx(dev, CTAP_CMD_WINK, NULL, 0);
806
921
                fido_rx(dev, CTAP_CMD_WINK, &reply, sizeof(reply), 200);
807
921
        }
808
1.30k
809
1.30k
        if (fido_tx(dev, CTAP_CMD_MSG, iso7816_ptr(apdu),
810
1.30k
            iso7816_len(apdu)) < 0) {
811
20
                fido_log_debug("%s: fido_tx", __func__);
812
20
                r = FIDO_ERR_TX;
813
20
                goto fail;
814
20
        }
815
1.28k
816
1.28k
        r = FIDO_OK;
817
1.31k
fail:
818
1.31k
        iso7816_free(&apdu);
819
1.31k
820
1.31k
        return (r);
821
1.28k
}
822
823
int
824
u2f_get_touch_status(fido_dev_t *dev, int *touched, int ms)
825
1.31k
{
826
1.31k
        unsigned char   reply[FIDO_MAXMSG];
827
1.31k
        int             reply_len;
828
1.31k
        int             r;
829
1.31k
830
1.31k
        if ((reply_len = fido_rx(dev, CTAP_CMD_MSG, &reply, sizeof(reply),
831
1.31k
            ms)) < 2) {
832
1.18k
                fido_log_debug("%s: fido_rx", __func__);
833
1.18k
                return (FIDO_OK); /* ignore */
834
1.18k
        }
835
133
836
133
        switch ((reply[reply_len - 2] << 8) | reply[reply_len - 1]) {
837
14
        case SW_CONDITIONS_NOT_SATISFIED:
838
14
                if ((r = u2f_get_touch_begin(dev)) != FIDO_OK) {
839
8
                        fido_log_debug("%s: u2f_get_touch_begin", __func__);
840
8
                        return (r);
841
8
                }
842
6
                *touched = 0;
843
6
                break;
844
6
        case SW_NO_ERROR:
845
1
                *touched = 1;
846
1
                break;
847
118
        default:
848
118
                fido_log_debug("%s: unexpected sw", __func__);
849
118
                return (FIDO_ERR_RX);
850
7
        }
851
7
852
7
        return (FIDO_OK);
853
7
}