Coverage Report

Created: 2021-10-21 13:35

/libfido2/src/config.c
Line
Count
Source
1
/*
2
 * Copyright (c) 2020 Yubico AB. All rights reserved.
3
 * Use of this source code is governed by a BSD-style
4
 * license that can be found in the LICENSE file.
5
 */
6
7
#include "fido.h"
8
#include "fido/config.h"
9
#include "fido/es256.h"
10
11
872
#define CMD_ENABLE_ENTATTEST    0x01
12
855
#define CMD_TOGGLE_ALWAYS_UV    0x02
13
1.85k
#define CMD_SET_PIN_MINLEN      0x03
14
15
static int
16
config_prepare_hmac(uint8_t subcmd, const cbor_item_t *item, fido_blob_t *hmac)
17
1.83k
{
18
1.83k
        uint8_t prefix[32 + 2 * sizeof(uint8_t)], cbor[128];
19
1.83k
        size_t cbor_len;
20
21
1.83k
        memset(prefix, 0xff, sizeof(prefix));
22
1.83k
        prefix[sizeof(prefix) - 2] = CTAP_CBOR_CONFIG;
23
1.83k
        prefix[sizeof(prefix) - 1] = subcmd;
24
25
1.83k
        if ((cbor_len = cbor_serialize(item, cbor, sizeof(cbor))) == 0) {
26
220
                fido_log_debug("%s: cbor_serialize", __func__);
27
220
                return -1;
28
220
        }
29
1.61k
        if ((hmac->ptr = malloc(cbor_len + sizeof(prefix))) == NULL) {
30
14
                fido_log_debug("%s: malloc", __func__);
31
14
                return -1;
32
14
        }
33
1.59k
        memcpy(hmac->ptr, prefix, sizeof(prefix));
34
1.59k
        memcpy(hmac->ptr + sizeof(prefix), cbor, cbor_len);
35
1.59k
        hmac->len = cbor_len + sizeof(prefix);
36
37
1.59k
        return 0;
38
1.59k
}
39
40
static int
41
config_tx(fido_dev_t *dev, uint8_t subcmd, cbor_item_t **paramv, size_t paramc,
42
    const char *pin, int *ms)
43
3.57k
{
44
3.57k
        cbor_item_t *argv[4];
45
3.57k
        es256_pk_t *pk = NULL;
46
3.57k
        fido_blob_t *ecdh = NULL, f, hmac;
47
3.57k
        const uint8_t cmd = CTAP_CBOR_CONFIG;
48
3.57k
        int r = FIDO_ERR_INTERNAL;
49
50
3.57k
        memset(&f, 0, sizeof(f));
51
3.57k
        memset(&hmac, 0, sizeof(hmac));
52
3.57k
        memset(&argv, 0, sizeof(argv));
53
54
        /* subCommand */
55
3.57k
        if ((argv[0] = cbor_build_uint8(subcmd)) == NULL) {
56
26
                fido_log_debug("%s: cbor encode", __func__);
57
26
                goto fail;
58
26
        }
59
60
        /* pinProtocol, pinAuth */
61
3.55k
        if (pin != NULL || (fido_dev_supports_permissions(dev) &&
62
1.85k
            fido_dev_has_uv(dev))) {
63
1.85k
                if ((argv[1] = cbor_flatten_vector(paramv, paramc)) == NULL) {
64
26
                        fido_log_debug("%s: cbor_flatten_vector", __func__);
65
26
                        goto fail;
66
26
                }
67
1.83k
                if (config_prepare_hmac(subcmd, argv[1], &hmac) < 0) {
68
234
                        fido_log_debug("%s: config_prepare_hmac", __func__);
69
234
                        goto fail;
70
234
                }
71
1.59k
                if ((r = fido_do_ecdh(dev, &pk, &ecdh, ms)) != FIDO_OK) {
72
1.43k
                        fido_log_debug("%s: fido_do_ecdh", __func__);
73
1.43k
                        goto fail;
74
1.43k
                }
75
159
                if ((r = cbor_add_uv_params(dev, cmd, &hmac, pk, ecdh, pin,
76
159
                    NULL, &argv[3], &argv[2], ms)) != FIDO_OK) {
77
136
                        fido_log_debug("%s: cbor_add_uv_params", __func__);
78
136
                        goto fail;
79
136
                }
80
1.71k
        }
81
82
        /* framing and transmission */
83
1.71k
        if (cbor_build_frame(cmd, argv, nitems(argv), &f) < 0 ||
84
1.71k
            fido_tx(dev, CTAP_CMD_CBOR, f.ptr, f.len, ms) < 0) {
85
103
                fido_log_debug("%s: fido_tx", __func__);
86
103
                r = FIDO_ERR_TX;
87
103
                goto fail;
88
103
        }
89
90
1.61k
        r = FIDO_OK;
91
3.57k
fail:
92
3.57k
        cbor_vector_free(argv, nitems(argv));
93
3.57k
        es256_pk_free(&pk);
94
3.57k
        fido_blob_free(&ecdh);
95
3.57k
        free(f.ptr);
96
3.57k
        free(hmac.ptr);
97
98
3.57k
        return r;
99
1.61k
}
100
101
static int
102
config_enable_entattest_wait(fido_dev_t *dev, const char *pin, int *ms)
103
872
{
104
872
        int r;
105
106
872
        if ((r = config_tx(dev, CMD_ENABLE_ENTATTEST, NULL, 0, pin,
107
872
            ms)) != FIDO_OK)
108
872
                return r;
109
110
406
        return fido_rx_cbor_status(dev, ms);
111
406
}
112
113
int
114
fido_dev_enable_entattest(fido_dev_t *dev, const char *pin)
115
872
{
116
872
        int ms = dev->timeout_ms;
117
118
872
        return (config_enable_entattest_wait(dev, pin, &ms));
119
872
}
120
121
static int
122
config_toggle_always_uv_wait(fido_dev_t *dev, const char *pin, int *ms)
123
855
{
124
855
        int r;
125
126
855
        if ((r = config_tx(dev, CMD_TOGGLE_ALWAYS_UV, NULL, 0, pin,
127
855
            ms)) != FIDO_OK)
128
855
                return r;
129
130
384
        return (fido_rx_cbor_status(dev, ms));
131
384
}
132
133
int
134
fido_dev_toggle_always_uv(fido_dev_t *dev, const char *pin)
135
855
{
136
855
        int ms = dev->timeout_ms;
137
138
855
        return config_toggle_always_uv_wait(dev, pin, &ms);
139
855
}
140
141
static int
142
config_pin_minlen_tx(fido_dev_t *dev, size_t len, bool force,
143
    const fido_str_array_t *rpid, const char *pin, int *ms)
144
2.52k
{
145
2.52k
        cbor_item_t *argv[3];
146
2.52k
        int r;
147
148
2.52k
        memset(argv, 0, sizeof(argv));
149
150
2.52k
        if ((rpid == NULL && len == 0 && !force) || len > UINT8_MAX) {
151
571
                r = FIDO_ERR_INVALID_ARGUMENT;
152
571
                goto fail;
153
571
        }
154
1.95k
        if (len && (argv[0] = cbor_build_uint8((uint8_t)len)) == NULL) {
155
2
                fido_log_debug("%s: cbor_encode_uint8", __func__);
156
2
                r = FIDO_ERR_INTERNAL;
157
2
                goto fail;
158
2
        }
159
1.95k
        if (rpid != NULL && (argv[1] = cbor_encode_str_array(rpid)) == NULL) {
160
99
                fido_log_debug("%s: cbor_encode_str_array", __func__);
161
99
                r = FIDO_ERR_INTERNAL;
162
99
                goto fail;
163
99
        }
164
1.85k
        if (force && (argv[2] = cbor_build_bool(true)) == NULL) {
165
3
                fido_log_debug("%s: cbor_build_bool", __func__);
166
3
                r = FIDO_ERR_INTERNAL;
167
3
                goto fail;
168
3
        }
169
1.85k
        if ((r = config_tx(dev, CMD_SET_PIN_MINLEN, argv, nitems(argv),
170
1.85k
            pin, ms)) != FIDO_OK) {
171
1.02k
                fido_log_debug("%s: config_tx", __func__);
172
1.02k
                goto fail;
173
1.02k
        }
174
175
2.52k
fail:
176
2.52k
        cbor_vector_free(argv, nitems(argv));
177
178
2.52k
        return r;
179
1.85k
}
180
181
static int
182
config_pin_minlen(fido_dev_t *dev, size_t len, bool force,
183
    const fido_str_array_t *rpid, const char *pin, int *ms)
184
2.52k
{
185
2.52k
        int r;
186
187
2.52k
        if ((r = config_pin_minlen_tx(dev, len, force, rpid, pin,
188
2.52k
            ms)) != FIDO_OK)
189
2.52k
                return r;
190
191
824
        return fido_rx_cbor_status(dev, ms);
192
824
}
193
194
int
195
fido_dev_set_pin_minlen(fido_dev_t *dev, size_t len, const char *pin)
196
854
{
197
854
        int ms = dev->timeout_ms;
198
199
854
        return config_pin_minlen(dev, len, false, NULL, pin, &ms);
200
854
}
201
202
int
203
fido_dev_force_pin_change(fido_dev_t *dev, const char *pin)
204
879
{
205
879
        int ms = dev->timeout_ms;
206
207
879
        return config_pin_minlen(dev, 0, true, NULL, pin, &ms);
208
879
}
209
210
int
211
fido_dev_set_pin_minlen_rpid(fido_dev_t *dev, const char * const *rpid,
212
    size_t n, const char *pin)
213
842
{
214
842
        fido_str_array_t sa;
215
842
        int ms = dev->timeout_ms;
216
842
        int r;
217
218
842
        memset(&sa, 0, sizeof(sa));
219
842
        if (fido_str_array_pack(&sa, rpid, n) < 0) {
220
49
                fido_log_debug("%s: fido_str_array_pack", __func__);
221
49
                r = FIDO_ERR_INTERNAL;
222
49
                goto fail;
223
49
        }
224
793
        r = config_pin_minlen(dev, 0, false, &sa, pin, &ms);
225
842
fail:
226
842
        fido_str_array_free(&sa);
227
228
842
        return r;
229
793
}