Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright (c) 2020 Yubico AB. All rights reserved. |
3 | | * Use of this source code is governed by a BSD-style |
4 | | * license that can be found in the LICENSE file. |
5 | | */ |
6 | | |
7 | | #include "fido.h" |
8 | | #include "fido/config.h" |
9 | | #include "fido/es256.h" |
10 | | |
11 | 526 | #define CMD_ENABLE_ENTATTEST 0x01 |
12 | 517 | #define CMD_TOGGLE_ALWAYS_UV 0x02 |
13 | 814 | #define CMD_SET_PIN_MINLEN 0x03 |
14 | | |
15 | | static int |
16 | | config_prepare_hmac(uint8_t subcmd, const cbor_item_t *item, fido_blob_t *hmac) |
17 | 1.26k | { |
18 | 1.26k | uint8_t prefix[32 + 2 * sizeof(uint8_t)], cbor[128]; |
19 | 1.26k | size_t cbor_len; |
20 | 1.26k | |
21 | 1.26k | memset(prefix, 0xff, sizeof(prefix)); |
22 | 1.26k | prefix[sizeof(prefix) - 2] = CTAP_CBOR_CONFIG; |
23 | 1.26k | prefix[sizeof(prefix) - 1] = subcmd; |
24 | 1.26k | |
25 | 1.26k | if ((cbor_len = cbor_serialize(item, cbor, sizeof(cbor))) == 0) { |
26 | 0 | fido_log_debug("%s: cbor_serialize", __func__); |
27 | 0 | return -1; |
28 | 0 | } |
29 | 1.26k | if ((hmac->ptr = malloc(cbor_len + sizeof(prefix))) == NULL) { |
30 | 10 | fido_log_debug("%s: malloc", __func__); |
31 | 10 | return -1; |
32 | 10 | } |
33 | 1.25k | memcpy(hmac->ptr, prefix, sizeof(prefix)); |
34 | 1.25k | memcpy(hmac->ptr + sizeof(prefix), cbor, cbor_len); |
35 | 1.25k | hmac->len = cbor_len + sizeof(prefix); |
36 | 1.25k | |
37 | 1.25k | return 0; |
38 | 1.25k | } |
39 | | |
40 | | static int |
41 | | config_tx(fido_dev_t *dev, uint8_t subcmd, cbor_item_t **paramv, size_t paramc, |
42 | | const char *pin) |
43 | 1.85k | { |
44 | 1.85k | cbor_item_t *argv[4]; |
45 | 1.85k | es256_pk_t *pk = NULL; |
46 | 1.85k | fido_blob_t *ecdh = NULL, f, hmac; |
47 | 1.85k | const uint8_t cmd = CTAP_CBOR_CONFIG; |
48 | 1.85k | int r = FIDO_ERR_INTERNAL; |
49 | 1.85k | |
50 | 1.85k | memset(&f, 0, sizeof(f)); |
51 | 1.85k | memset(&hmac, 0, sizeof(hmac)); |
52 | 1.85k | memset(&argv, 0, sizeof(argv)); |
53 | 1.85k | |
54 | 1.85k | /* subCommand */ |
55 | 1.85k | if ((argv[0] = cbor_build_uint8(subcmd)) == NULL) { |
56 | 11 | fido_log_debug("%s: cbor encode", __func__); |
57 | 11 | goto fail; |
58 | 11 | } |
59 | 1.84k | |
60 | 1.84k | /* pinProtocol, pinAuth */ |
61 | 1.84k | if (pin != NULL || (fido_dev_supports_permissions(dev) && |
62 | 1.28k | fido_dev_has_uv(dev))) { |
63 | 1.28k | if ((argv[1] = cbor_flatten_vector(paramv, paramc)) == NULL) { |
64 | 20 | fido_log_debug("%s: cbor_flatten_vector", __func__); |
65 | 20 | goto fail; |
66 | 20 | } |
67 | 1.26k | if (config_prepare_hmac(subcmd, argv[1], &hmac) < 0) { |
68 | 10 | fido_log_debug("%s: config_prepare_hmac", __func__); |
69 | 10 | goto fail; |
70 | 10 | } |
71 | 1.25k | if ((r = fido_do_ecdh(dev, &pk, &ecdh)) != FIDO_OK) { |
72 | 1.06k | fido_log_debug("%s: fido_do_ecdh", __func__); |
73 | 1.06k | goto fail; |
74 | 1.06k | } |
75 | 195 | if ((r = cbor_add_uv_params(dev, cmd, &hmac, pk, ecdh, pin, |
76 | 195 | NULL, &argv[3], &argv[2])) != FIDO_OK) { |
77 | 179 | fido_log_debug("%s: cbor_add_uv_params", __func__); |
78 | 179 | goto fail; |
79 | 179 | } |
80 | 576 | } |
81 | 576 | |
82 | 576 | /* framing and transmission */ |
83 | 576 | if (cbor_build_frame(cmd, argv, nitems(argv), &f) < 0 || |
84 | 576 | fido_tx(dev, CTAP_CMD_CBOR, f.ptr, f.len) < 0) { |
85 | 47 | fido_log_debug("%s: fido_tx", __func__); |
86 | 47 | r = FIDO_ERR_TX; |
87 | 47 | goto fail; |
88 | 47 | } |
89 | 529 | |
90 | 529 | r = FIDO_OK; |
91 | 1.85k | fail: |
92 | 1.85k | cbor_vector_free(argv, nitems(argv)); |
93 | 1.85k | es256_pk_free(&pk); |
94 | 1.85k | fido_blob_free(&ecdh); |
95 | 1.85k | free(f.ptr); |
96 | 1.85k | free(hmac.ptr); |
97 | 1.85k | |
98 | 1.85k | return r; |
99 | 529 | } |
100 | | |
101 | | static int |
102 | | config_enable_entattest_wait(fido_dev_t *dev, const char *pin, int ms) |
103 | 526 | { |
104 | 526 | int r; |
105 | 526 | |
106 | 526 | if ((r = config_tx(dev, CMD_ENABLE_ENTATTEST, NULL, 0, pin)) != FIDO_OK) |
107 | 526 | return r; |
108 | 159 | |
109 | 159 | return fido_rx_cbor_status(dev, ms); |
110 | 159 | } |
111 | | |
112 | | int |
113 | | fido_dev_enable_entattest(fido_dev_t *dev, const char *pin) |
114 | 526 | { |
115 | 526 | return (config_enable_entattest_wait(dev, pin, -1)); |
116 | 526 | } |
117 | | |
118 | | static int |
119 | | config_toggle_always_uv_wait(fido_dev_t *dev, const char *pin, int ms) |
120 | 517 | { |
121 | 517 | int r; |
122 | 517 | |
123 | 517 | if ((r = config_tx(dev, CMD_TOGGLE_ALWAYS_UV, NULL, 0, pin)) != FIDO_OK) |
124 | 517 | return r; |
125 | 163 | |
126 | 163 | return (fido_rx_cbor_status(dev, ms)); |
127 | 163 | } |
128 | | |
129 | | int |
130 | | fido_dev_toggle_always_uv(fido_dev_t *dev, const char *pin) |
131 | 517 | { |
132 | 517 | return config_toggle_always_uv_wait(dev, pin, -1); |
133 | 517 | } |
134 | | |
135 | | static int |
136 | | config_pin_minlen_tx(fido_dev_t *dev, size_t len, bool force, const char *pin) |
137 | 1.06k | { |
138 | 1.06k | cbor_item_t *argv[3]; |
139 | 1.06k | int r; |
140 | 1.06k | |
141 | 1.06k | memset(argv, 0, sizeof(argv)); |
142 | 1.06k | |
143 | 1.06k | if ((!len && !force) || len > UINT8_MAX) { |
144 | 242 | r = FIDO_ERR_INVALID_ARGUMENT; |
145 | 242 | goto fail; |
146 | 242 | } |
147 | 818 | if (len && (argv[0] = cbor_build_uint8((uint8_t)len)) == NULL) { |
148 | 2 | fido_log_debug("%s: cbor_encode_uint8", __func__); |
149 | 2 | r = FIDO_ERR_INTERNAL; |
150 | 2 | goto fail; |
151 | 2 | } |
152 | 816 | if (force && (argv[2] = cbor_build_bool(true)) == NULL) { |
153 | 2 | fido_log_debug("%s: cbor_build_bool", __func__); |
154 | 2 | r = FIDO_ERR_INTERNAL; |
155 | 2 | goto fail; |
156 | 2 | } |
157 | 814 | if ((r = config_tx(dev, CMD_SET_PIN_MINLEN, argv, nitems(argv), |
158 | 814 | pin)) != FIDO_OK) { |
159 | 607 | fido_log_debug("%s: config_tx", __func__); |
160 | 607 | goto fail; |
161 | 607 | } |
162 | 1.06k | |
163 | 1.06k | fail: |
164 | 1.06k | cbor_vector_free(argv, nitems(argv)); |
165 | 1.06k | |
166 | 1.06k | return r; |
167 | 814 | } |
168 | | |
169 | | static int |
170 | | config_pin_minlen(fido_dev_t *dev, size_t len, bool force, const char *pin, |
171 | | int ms) |
172 | 1.06k | { |
173 | 1.06k | int r; |
174 | 1.06k | |
175 | 1.06k | if ((r = config_pin_minlen_tx(dev, len, force, pin)) != FIDO_OK) |
176 | 1.06k | return r; |
177 | 207 | |
178 | 207 | return fido_rx_cbor_status(dev, ms); |
179 | 207 | } |
180 | | |
181 | | int |
182 | | fido_dev_set_pin_minlen(fido_dev_t *dev, size_t len, const char *pin) |
183 | 532 | { |
184 | 532 | return config_pin_minlen(dev, len, false, pin, -1); |
185 | 532 | } |
186 | | |
187 | | int |
188 | | fido_dev_force_pin_change(fido_dev_t *dev, const char *pin) |
189 | 528 | { |
190 | 528 | return config_pin_minlen(dev, 0, true, pin, -1); |
191 | 528 | } |