/libfido2/src/nfc.c

Source (jump to first uncovered line)
/*
 * Copyright (c) 2020-2022 Yubico AB. All rights reserved.
 * Use of this source code is governed by a BSD-style
 * license that can be found in the LICENSE file.
 * SPDX-License-Identifier: BSD-2-Clause
 */

#include <stdio.h>
#include <string.h>

#include "fido.h"
#include "fido/param.h"
#include "iso7816.h"

#define TX_CHUNK_SIZE   240

static const uint8_t aid[] = { 0xa0, 0x00, 0x00, 0x06, 0x47, 0x2f, 0x00, 0x01 };
static const uint8_t v_u2f[] = { 'U', '2', 'F', '_', 'V', '2' };
static const uint8_t v_fido[] = { 'F', 'I', 'D', 'O', '_', '2', '_', '0' };

static int
tx_short_apdu(fido_dev_t *d, const iso7816_header_t *h, const uint8_t *payload,
    uint8_t payload_len, uint8_t cla_flags)
{
        uint8_t apdu[5 + UINT8_MAX + 1];
        uint8_t sw[2];
        size_t apdu_len;
        int ok = -1;

        memset(&apdu, 0, sizeof(apdu));
        apdu[0] = h->cla | cla_flags;
        apdu[1] = h->ins;
        apdu[2] = h->p1;
        apdu[3] = h->p2;
        apdu[4] = payload_len;
        memcpy(&apdu[5], payload, payload_len);
        apdu_len = (size_t)(5 + payload_len + 1);

        if (d->io.write(d->io_handle, apdu, apdu_len) < 0) {
                fido_log_debug("%s: write", __func__);
                goto fail;
        }

        if (cla_flags & 0x10) {
                if (d->io.read(d->io_handle, sw, sizeof(sw), -1) != 2) {
                        fido_log_debug("%s: read", __func__);
                        goto fail;
                }
                if ((sw[0] << 8 | sw[1]) != SW_NO_ERROR) {
                        fido_log_debug("%s: unexpected sw", __func__);
                        goto fail;
                }
        }

        ok = 0;
fail:
        explicit_bzero(apdu, sizeof(apdu));

        return ok;
}

static int
nfc_do_tx(fido_dev_t *d, const uint8_t *apdu_ptr, size_t apdu_len)
{
        iso7816_header_t h;

        if (fido_buf_read(&apdu_ptr, &apdu_len, &h, sizeof(h)) < 0) {
                fido_log_debug("%s: header", __func__);
                return -1;
        }
        if (apdu_len < 2) {
                fido_log_debug("%s: apdu_len %zu", __func__, apdu_len);
                return -1;
        }

        apdu_len -= 2; /* trim le1 le2 */

        while (apdu_len > TX_CHUNK_SIZE) {
                if (tx_short_apdu(d, &h, apdu_ptr, TX_CHUNK_SIZE, 0x10) < 0) {
                        fido_log_debug("%s: chain", __func__);
                        return -1;
                }
                apdu_ptr += TX_CHUNK_SIZE;
                apdu_len -= TX_CHUNK_SIZE;
        }

        if (tx_short_apdu(d, &h, apdu_ptr, (uint8_t)apdu_len, 0) < 0) {
                fido_log_debug("%s: tx_short_apdu", __func__);
                return -1;
        }

        return 0;
}

int
fido_nfc_tx(fido_dev_t *d, uint8_t cmd, const unsigned char *buf, size_t count)
{
        iso7816_apdu_t *apdu = NULL;
        const uint8_t *ptr;
        size_t len;
        int ok = -1;

        switch (cmd) {
        case CTAP_CMD_INIT: /* select */
                if ((apdu = iso7816_new(0, 0xa4, 0x04, sizeof(aid))) == NULL ||
                    iso7816_add(apdu, aid, sizeof(aid)) < 0) {
                        fido_log_debug("%s: iso7816", __func__);
                        goto fail;
                }
                break;
        case CTAP_CMD_CBOR: /* wrap cbor */
                if (count > UINT16_MAX || (apdu = iso7816_new(0x80, 0x10, 0x00,
                    (uint16_t)count)) == NULL ||
                    iso7816_add(apdu, buf, count) < 0) {
                        fido_log_debug("%s: iso7816", __func__);
                        goto fail;
                }
                break;
        case CTAP_CMD_MSG: /* already an apdu */
                break;
        default:
                fido_log_debug("%s: cmd=%02x", __func__, cmd);
                goto fail;
        }

        if (apdu != NULL) {
                ptr = iso7816_ptr(apdu);
                len = iso7816_len(apdu);
        } else {
                ptr = buf;
                len = count;
        }

        if (nfc_do_tx(d, ptr, len) < 0) {
                fido_log_debug("%s: nfc_do_tx", __func__);
                goto fail;
        }

        ok = 0;
fail:
        iso7816_free(&apdu);

        return ok;
}

static int
rx_init(fido_dev_t *d, unsigned char *buf, size_t count, int ms)
{
        fido_ctap_info_t *attr = (fido_ctap_info_t *)buf;
        uint8_t f[64];
        int n;

        if (count != sizeof(*attr)) {
                fido_log_debug("%s: count=%zu", __func__, count);
                return -1;
        }

        memset(attr, 0, sizeof(*attr));

        if ((n = d->io.read(d->io_handle, f, sizeof(f), ms)) < 2 ||
            (f[n - 2] << 8 | f[n - 1]) != SW_NO_ERROR) {
                fido_log_debug("%s: read", __func__);
                return -1;
        }

        n -= 2;

        if (n == sizeof(v_u2f) && memcmp(f, v_u2f, sizeof(v_u2f)) == 0)
                attr->flags = FIDO_CAP_CBOR;
        else if (n == sizeof(v_fido) && memcmp(f, v_fido, sizeof(v_fido)) == 0)
                attr->flags = FIDO_CAP_CBOR | FIDO_CAP_NMSG;
        else {
                fido_log_debug("%s: unknown version string", __func__);
#ifdef FIDO_FUZZ
                attr->flags = FIDO_CAP_CBOR | FIDO_CAP_NMSG;
#else
                return -1;
#endif
        }

        memcpy(&attr->nonce, &d->nonce, sizeof(attr->nonce)); /* XXX */

        return (int)count;
}

static int
tx_get_response(fido_dev_t *d, uint8_t count)
{
        uint8_t apdu[5];

        memset(apdu, 0, sizeof(apdu));
        apdu[1] = 0xc0; /* GET_RESPONSE */
        apdu[4] = count;

        if (d->io.write(d->io_handle, apdu, sizeof(apdu)) < 0) {
                fido_log_debug("%s: write", __func__);
                return -1;
        }

        return 0;
}

static int
rx_apdu(fido_dev_t *d, uint8_t sw[2], unsigned char **buf, size_t *count, int *ms)
{
        uint8_t f[256 + 2];
        struct timespec ts;
        int n, ok = -1;

        if (fido_time_now(&ts) != 0)
                goto fail;

        if ((n = d->io.read(d->io_handle, f, sizeof(f), *ms)) < 2) {
                fido_log_debug("%s: read", __func__);
                goto fail;
        }

        if (fido_time_delta(&ts, ms) != 0)
                goto fail;

        if (fido_buf_write(buf, count, f, (size_t)(n - 2)) < 0) {
                fido_log_debug("%s: fido_buf_write", __func__);
                goto fail;
        }

        memcpy(sw, f + n - 2, 2);

        ok = 0;
fail:
        explicit_bzero(f, sizeof(f));

        return ok;
}

static int
rx_msg(fido_dev_t *d, unsigned char *buf, size_t count, int ms)
{
        uint8_t sw[2];
        const size_t bufsiz = count;

        if (rx_apdu(d, sw, &buf, &count, &ms) < 0) {
                fido_log_debug("%s: preamble", __func__);
                return -1;
        }

        while (sw[0] == SW1_MORE_DATA)
                if (tx_get_response(d, sw[1]) < 0 ||
                    rx_apdu(d, sw, &buf, &count, &ms) < 0) {
                        fido_log_debug("%s: chain", __func__);
                        return -1;
                }

        if (fido_buf_write(&buf, &count, sw, sizeof(sw)) < 0) {
                fido_log_debug("%s: sw", __func__);
                return -1;
        }

        if (bufsiz - count > INT_MAX) {
                fido_log_debug("%s: bufsiz", __func__);
                return -1;
        }

        return (int)(bufsiz - count);
}

static int
rx_cbor(fido_dev_t *d, unsigned char *buf, size_t count, int ms)
{
        int r;

        if ((r = rx_msg(d, buf, count, ms)) < 2)
                return -1;

        return r - 2;
}

int
fido_nfc_rx(fido_dev_t *d, uint8_t cmd, unsigned char *buf, size_t count, int ms)
{
        switch (cmd) {
        case CTAP_CMD_INIT:
                return rx_init(d, buf, count, ms);
        case CTAP_CMD_CBOR:
                return rx_cbor(d, buf, count, ms);
        case CTAP_CMD_MSG:
                return rx_msg(d, buf, count, ms);
        default:
                fido_log_debug("%s: cmd=%02x", __func__, cmd);
                return -1;
        }
}

bool
nfc_is_fido(const char *path)
{
        bool fido = false;
        fido_dev_t *d;
        int r;

        if ((d = fido_dev_new()) == NULL) {
                fido_log_debug("%s: fido_dev_new", __func__);
                goto fail;
        }
        /* fido_dev_open selects the fido applet */
        if ((r = fido_dev_open(d, path)) != FIDO_OK) {
                fido_log_debug("%s: fido_dev_open: 0x%x", __func__, r);
                goto fail;
        }
        if ((r = fido_dev_close(d)) != FIDO_OK) {
                fido_log_debug("%s: fido_dev_close: 0x%x", __func__, r);
                goto fail;

        }

        fido = true;
fail:
        fido_dev_free(&d);

        return fido;
}

#ifdef USE_NFC
bool
fido_is_nfc(const char *path)
{
        return strncmp(path, FIDO_NFC_PREFIX, strlen(FIDO_NFC_PREFIX)) == 0;
}

int
fido_dev_set_nfc(fido_dev_t *d)
{
        if (d->io_handle != NULL) {
                fido_log_debug("%s: device open", __func__);
                return -1;
        }
        d->io_own = true;
        d->io = (fido_dev_io_t) {
                fido_nfc_open,
                fido_nfc_close,
                fido_nfc_read,
                fido_nfc_write,
        };
        d->transport = (fido_dev_transport_t) {
                fido_nfc_rx,
                fido_nfc_tx,
        };

        return 0;
}
#endif /* USE_NFC */

Coverage Report

Created: 2024-02-05 19:20

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright (c) 2020-2022 Yubico AB. All rights reserved.
3		* Use of this source code is governed by a BSD-style
4		* license that can be found in the LICENSE file.
5		* SPDX-License-Identifier: BSD-2-Clause
6		*/
7
8		#include <stdio.h>
9		#include <string.h>
10
11		#include "fido.h"
12		#include "fido/param.h"
13		#include "iso7816.h"
14
15	165k	#define TX_CHUNK_SIZE 240
16
17		static const uint8_t aid[] = { 0xa0, 0x00, 0x00, 0x06, 0x47, 0x2f, 0x00, 0x01 };
18		static const uint8_t v_u2f[] = { 'U', '2', 'F', '_', 'V', '2' };
19		static const uint8_t v_fido[] = { 'F', 'I', 'D', 'O', '_', '2', '_', '0' };
20
21		static int
22		tx_short_apdu(fido_dev_t d, const iso7816_header_t h, const uint8_t *payload,
23		uint8_t payload_len, uint8_t cla_flags)
24	158k	{
25	158k	uint8_t apdu[5 + UINT8_MAX + 1];
26	158k	uint8_t sw[2];
27	158k	size_t apdu_len;
28	158k	int ok = -1;
29
30	158k	memset(&apdu, 0, sizeof(apdu));
31	158k	apdu[0] = h->cla \| cla_flags;
32	158k	apdu[1] = h->ins;
33	158k	apdu[2] = h->p1;
34	158k	apdu[3] = h->p2;
35	158k	apdu[4] = payload_len;
36	158k	memcpy(&apdu[5], payload, payload_len);
37	158k	apdu_len = (size_t)(5 + payload_len + 1);
38
39	158k	if (d->io.write(d->io_handle, apdu, apdu_len) < 0) {
40	904	fido_log_debug("%s: write", __func__);
41	904	goto fail;
42	904	}
43
44	157k	if (cla_flags & 0x10) {
45	5.08k	if (d->io.read(d->io_handle, sw, sizeof(sw), -1) != 2) {
46	3.41k	fido_log_debug("%s: read", __func__);
47	3.41k	goto fail;
48	3.41k	}
49	1.67k	if ((sw[0] << 8 \| sw[1]) != SW_NO_ERROR) {
50	696	fido_log_debug("%s: unexpected sw", __func__);
51	696	goto fail;
52	696	}
53	1.67k	}
54
55	153k	ok = 0;
56	158k	fail:
57	158k	explicit_bzero(apdu, sizeof(apdu));
58
59	158k	return ok;
60	153k	}
61
62		static int
63		nfc_do_tx(fido_dev_t d, const uint8_t apdu_ptr, size_t apdu_len)
64	161k	{
65	161k	iso7816_header_t h;
66
67	161k	if (fido_buf_read(&apdu_ptr, &apdu_len, &h, sizeof(h)) < 0) {
68	3.87k	fido_log_debug("%s: header", __func__);
69	3.87k	return -1;
70	3.87k	}
71	157k	if (apdu_len < 2) {
72	2	fido_log_debug("%s: apdu_len %zu", __func__, apdu_len);
73	2	return -1;
74	2	}
75
76	157k	apdu_len -= 2; /* trim le1 le2 */
77
78	158k	while (apdu_len > TX_CHUNK_SIZE) {
79	5.38k	if (tx_short_apdu(d, &h, apdu_ptr, TX_CHUNK_SIZE, 0x10) < 0) {
80	4.40k	fido_log_debug("%s: chain", __func__);
81	4.40k	return -1;
82	4.40k	}
83	975	apdu_ptr += TX_CHUNK_SIZE;
84	975	apdu_len -= TX_CHUNK_SIZE;
85	975	}
86
87	153k	if (tx_short_apdu(d, &h, apdu_ptr, (uint8_t)apdu_len, 0) < 0) {
88	605	fido_log_debug("%s: tx_short_apdu", __func__);
89	605	return -1;
90	605	}
91
92	152k	return 0;
93	153k	}
94
95		int
96		fido_nfc_tx(fido_dev_t d, uint8_t cmd, const unsigned char buf, size_t count)
97	176k	{
98	176k	iso7816_apdu_t *apdu = NULL;
99	176k	const uint8_t *ptr;
100	176k	size_t len;
101	176k	int ok = -1;
102
103	176k	switch (cmd) {
104	125k	case CTAP_CMD_INIT: /* select */
105	125k	if ((apdu = iso7816_new(0, 0xa4, 0x04, sizeof(aid))) == NULL \|\|
106	125k	iso7816_add(apdu, aid, sizeof(aid)) < 0) {
107	70	fido_log_debug("%s: iso7816", __func__);
108	70	goto fail;
109	70	}
110	125k	break;
111	125k	case CTAP_CMD_CBOR: /* wrap cbor */
112	20.1k	if (count > UINT16_MAX \|\| (apdu = iso7816_new(0x80, 0x10, 0x00,
113	20.1k	(uint16_t)count)) == NULL \|\|
114	20.1k	iso7816_add(apdu, buf, count) < 0) {
115	31	fido_log_debug("%s: iso7816", __func__);
116	31	goto fail;
117	31	}
118	20.1k	break;
119	20.1k	case CTAP_CMD_MSG: /* already an apdu */
120	15.7k	break;
121	14.9k	default:
122	14.9k	fido_log_debug("%s: cmd=%02x", __func__, cmd);
123	14.9k	goto fail;
124	176k	}
125
126	161k	if (apdu != NULL) {
127	145k	ptr = iso7816_ptr(apdu);
128	145k	len = iso7816_len(apdu);
129	145k	} else {
130	15.7k	ptr = buf;
131	15.7k	len = count;
132	15.7k	}
133
134	161k	if (nfc_do_tx(d, ptr, len) < 0) {
135	8.88k	fido_log_debug("%s: nfc_do_tx", __func__);
136	8.88k	goto fail;
137	8.88k	}
138
139	152k	ok = 0;
140	176k	fail:
141	176k	iso7816_free(&apdu);
142
143	176k	return ok;
144	152k	}
145
146		static int
147		rx_init(fido_dev_t d, unsigned char buf, size_t count, int ms)
148	124k	{
149	124k	fido_ctap_info_t attr = (fido_ctap_info_t )buf;
150	124k	uint8_t f[64];
151	124k	int n;
152
153	124k	if (count != sizeof(*attr)) {
154	13.9k	fido_log_debug("%s: count=%zu", __func__, count);
155	13.9k	return -1;
156	13.9k	}
157
158	110k	memset(attr, 0, sizeof(*attr));
159
160	110k	if ((n = d->io.read(d->io_handle, f, sizeof(f), ms)) < 2 \|\|
161	110k	(f[n - 2] << 8 \| f[n - 1]) != SW_NO_ERROR) {
162	105k	fido_log_debug("%s: read", __func__);
163	105k	return -1;
164	105k	}
165
166	5.20k	n -= 2;
167
168	5.20k	if (n == sizeof(v_u2f) && memcmp(f, v_u2f, sizeof(v_u2f)) == 0)
169	8	attr->flags = FIDO_CAP_CBOR;
170	5.19k	else if (n == sizeof(v_fido) && memcmp(f, v_fido, sizeof(v_fido)) == 0)
171	7	attr->flags = FIDO_CAP_CBOR \| FIDO_CAP_NMSG;
172	5.19k	else {
173	5.19k	fido_log_debug("%s: unknown version string", __func__);
174	5.19k	#ifdef FIDO_FUZZ
175	5.19k	attr->flags = FIDO_CAP_CBOR \| FIDO_CAP_NMSG;
176		#else
177		return -1;
178		#endif
179	5.19k	}
180
181	5.20k	memcpy(&attr->nonce, &d->nonce, sizeof(attr->nonce)); /* XXX */
182
183	5.20k	return (int)count;
184	110k	}
185
186		static int
187		tx_get_response(fido_dev_t *d, uint8_t count)
188	3.52k	{
189	3.52k	uint8_t apdu[5];
190
191	3.52k	memset(apdu, 0, sizeof(apdu));
192	3.52k	apdu[1] = 0xc0; /* GET_RESPONSE */
193	3.52k	apdu[4] = count;
194
195	3.52k	if (d->io.write(d->io_handle, apdu, sizeof(apdu)) < 0) {
196	148	fido_log_debug("%s: write", __func__);
197	148	return -1;
198	148	}
199
200	3.37k	return 0;
201	3.52k	}
202
203		static int
204		rx_apdu(fido_dev_t d, uint8_t sw[2], unsigned char buf, size_t count, int *ms)
205	39.1k	{
206	39.1k	uint8_t f[256 + 2];
207	39.1k	struct timespec ts;
208	39.1k	int n, ok = -1;
209
210	39.1k	if (fido_time_now(&ts) != 0)
211	45	goto fail;
212
213	39.1k	if ((n = d->io.read(d->io_handle, f, sizeof(f), *ms)) < 2) {
214	16.8k	fido_log_debug("%s: read", __func__);
215	16.8k	goto fail;
216	16.8k	}
217
218	22.2k	if (fido_time_delta(&ts, ms) != 0)
219	22	goto fail;
220
221	22.2k	if (fido_buf_write(buf, count, f, (size_t)(n - 2)) < 0) {
222	3	fido_log_debug("%s: fido_buf_write", __func__);
223	3	goto fail;
224	3	}
225
226	22.2k	memcpy(sw, f + n - 2, 2);
227
228	22.2k	ok = 0;
229	39.1k	fail:
230	39.1k	explicit_bzero(f, sizeof(f));
231
232	39.1k	return ok;
233	22.2k	}
234
235		static int
236		rx_msg(fido_dev_t d, unsigned char buf, size_t count, int ms)
237	35.8k	{
238	35.8k	uint8_t sw[2];
239	35.8k	const size_t bufsiz = count;
240
241	35.8k	if (rx_apdu(d, sw, &buf, &count, &ms) < 0) {
242	13.6k	fido_log_debug("%s: preamble", __func__);
243	13.6k	return -1;
244	13.6k	}
245
246	22.2k	while (sw[0] == SW1_MORE_DATA)
247	3.52k	if (tx_get_response(d, sw[1]) < 0 \|\|
248	3.52k	rx_apdu(d, sw, &buf, &count, &ms) < 0) {
249	3.41k	fido_log_debug("%s: chain", __func__);
250	3.41k	return -1;
251	3.41k	}
252
253	18.6k	if (fido_buf_write(&buf, &count, sw, sizeof(sw)) < 0) {
254	3	fido_log_debug("%s: sw", __func__);
255	3	return -1;
256	3	}
257
258	18.6k	if (bufsiz - count > INT_MAX) {
259	0	fido_log_debug("%s: bufsiz", __func__);
260	0	return -1;
261	0	}
262
263	18.6k	return (int)(bufsiz - count);
264	18.6k	}
265
266		static int
267		rx_cbor(fido_dev_t d, unsigned char buf, size_t count, int ms)
268	20.0k	{
269	20.0k	int r;
270
271	20.0k	if ((r = rx_msg(d, buf, count, ms)) < 2)
272	9.27k	return -1;
273
274	10.7k	return r - 2;
275	20.0k	}
276
277		int
278		fido_nfc_rx(fido_dev_t d, uint8_t cmd, unsigned char buf, size_t count, int ms)
279	175k	{
280	175k	switch (cmd) {
281	124k	case CTAP_CMD_INIT:
282	124k	return rx_init(d, buf, count, ms);
283	20.0k	case CTAP_CMD_CBOR:
284	20.0k	return rx_cbor(d, buf, count, ms);
285	15.7k	case CTAP_CMD_MSG:
286	15.7k	return rx_msg(d, buf, count, ms);
287	14.6k	default:
288	14.6k	fido_log_debug("%s: cmd=%02x", __func__, cmd);
289	14.6k	return -1;
290	175k	}
291	175k	}
292
293		bool
294		nfc_is_fido(const char *path)
295	5.28M	{
296	5.28M	bool fido = false;
297	5.28M	fido_dev_t *d;
298	5.28M	int r;
299
300	5.28M	if ((d = fido_dev_new()) == NULL) {
301	12.9k	fido_log_debug("%s: fido_dev_new", __func__);
302	12.9k	goto fail;
303	12.9k	}
304		/* fido_dev_open selects the fido applet */
305	5.27M	if ((r = fido_dev_open(d, path)) != FIDO_OK) {
306	5.26M	fido_log_debug("%s: fido_dev_open: 0x%x", __func__, r);
307	5.26M	goto fail;
308	5.26M	}
309	3.64k	if ((r = fido_dev_close(d)) != FIDO_OK) {
310	0	fido_log_debug("%s: fido_dev_close: 0x%x", __func__, r);
311	0	goto fail;
312
313	0	}
314
315	3.64k	fido = true;
316	5.28M	fail:
317	5.28M	fido_dev_free(&d);
318
319	5.28M	return fido;
320	3.64k	}
321
322		#ifdef USE_NFC
323		bool
324		fido_is_nfc(const char *path)
325	6.68M	{
326	6.68M	return strncmp(path, FIDO_NFC_PREFIX, strlen(FIDO_NFC_PREFIX)) == 0;
327	6.68M	}
328
329		int
330		fido_dev_set_nfc(fido_dev_t *d)
331	5.15M	{
332	5.15M	if (d->io_handle != NULL) {
333	0	fido_log_debug("%s: device open", __func__);
334	0	return -1;
335	0	}
336	5.15M	d->io_own = true;
337	5.15M	d->io = (fido_dev_io_t) {
338	5.15M	fido_nfc_open,
339	5.15M	fido_nfc_close,
340	5.15M	fido_nfc_read,
341	5.15M	fido_nfc_write,
342	5.15M	};
343	5.15M	d->transport = (fido_dev_transport_t) {
344	5.15M	fido_nfc_rx,
345	5.15M	fido_nfc_tx,
346	5.15M	};
347
348	5.15M	return 0;
349	5.15M	}
350		#endif /* USE_NFC */