From 69cb28965b9a835270a7def918e765ac156ae07a Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 25 Nov 2020 15:07:06 +0100 Subject: [PATCH] homed: turn libfido2 into a dlopen() type dependency --- meson.build | 4 +- src/home/homectl-fido2.c | 147 ++++++++++++++++++++----------------- src/home/homework-fido2.c | 77 ++++++++++--------- src/shared/libfido2-util.c | 117 +++++++++++++++++++++++++++++ src/shared/libfido2-util.h | 72 ++++++++++++++++++ src/shared/meson.build | 2 + 6 files changed, 313 insertions(+), 106 deletions(-) create mode 100644 src/shared/libfido2-util.c create mode 100644 src/shared/libfido2-util.h diff --git a/meson.build b/meson.build index 82c6de900c..9a7f9be3cb 100644 --- a/meson.build +++ b/meson.build @@ -2271,8 +2271,7 @@ if conf.get('ENABLE_HOMED') == 1 libcrypt, libopenssl, libfdisk, - libp11kit, - libfido2], + libp11kit], install_rpath : rootlibexecdir, install : true, install_dir : rootlibexecdir) @@ -2298,7 +2297,6 @@ if conf.get('ENABLE_HOMED') == 1 libcrypt, libopenssl, libp11kit, - libfido2, libdl], install_rpath : rootlibexecdir, install : true, diff --git a/src/home/homectl-fido2.c b/src/home/homectl-fido2.c index 5557b70e67..983891e0e0 100644 --- a/src/home/homectl-fido2.c +++ b/src/home/homectl-fido2.c @@ -11,6 +11,7 @@ #include "homectl-fido2.h" #include "homectl-pkcs11.h" #include "libcrypt-util.h" +#include "libfido2-util.h" #include "locale-util.h" #include "memory-util.h" #include "random-util.h" @@ -116,11 +117,11 @@ int identity_add_fido2_parameters( const char *device) { #if HAVE_LIBFIDO2 - _cleanup_(fido_cbor_info_free) fido_cbor_info_t *di = NULL; - _cleanup_(fido_assert_free) fido_assert_t *a = NULL; + _cleanup_(fido_cbor_info_free_wrapper) fido_cbor_info_t *di = NULL; + _cleanup_(fido_assert_free_wrapper) fido_assert_t *a = NULL; + _cleanup_(fido_cred_free_wrapper) fido_cred_t *c = NULL; + _cleanup_(fido_dev_free_wrapper) fido_dev_t *d = NULL; _cleanup_(erase_and_freep) char *used_pin = NULL; - _cleanup_(fido_cred_free) fido_cred_t *c = NULL; - _cleanup_(fido_dev_free) fido_dev_t *d = NULL; _cleanup_(erase_and_freep) void *salt = NULL; JsonVariant *un, *realm, *rn; bool found_extension = false; @@ -146,6 +147,10 @@ int identity_add_fido2_parameters( assert(v); assert(device); + r = dlopen_libfido2(); + if (r < 0) + return log_error_errno(r, "FIDO2 token support is not installed."); + salt = malloc(FIDO2_SALT_SIZE); if (!salt) return log_oom(); @@ -154,30 +159,30 @@ int identity_add_fido2_parameters( if (r < 0) return log_error_errno(r, "Failed to generate salt: %m"); - d = fido_dev_new(); + d = sym_fido_dev_new(); if (!d) return log_oom(); - r = fido_dev_open(d, device); + r = sym_fido_dev_open(d, device); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to open FIDO2 device %s: %s", device, fido_strerr(r)); + "Failed to open FIDO2 device %s: %s", device, sym_fido_strerr(r)); - if (!fido_dev_is_fido2(d)) + if (!sym_fido_dev_is_fido2(d)) return log_error_errno(SYNTHETIC_ERRNO(ENODEV), "Specified device %s is not a FIDO2 device.", device); - di = fido_cbor_info_new(); + di = sym_fido_cbor_info_new(); if (!di) return log_oom(); - r = fido_dev_get_cbor_info(d, di); + r = sym_fido_dev_get_cbor_info(d, di); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to get CBOR device info for %s: %s", device, fido_strerr(r)); + "Failed to get CBOR device info for %s: %s", device, sym_fido_strerr(r)); - e = fido_cbor_info_extensions_ptr(di); - n = fido_cbor_info_extensions_len(di); + e = sym_fido_cbor_info_extensions_ptr(di); + n = sym_fido_cbor_info_extensions_len(di); for (size_t i = 0; i < n; i++) if (streq(e[i], "hmac-secret")) { @@ -189,24 +194,24 @@ int identity_add_fido2_parameters( return log_error_errno(SYNTHETIC_ERRNO(ENODEV), "Specified device %s is a FIDO2 device, but does not support the required HMAC-SECRET extension.", device); - c = fido_cred_new(); + c = sym_fido_cred_new(); if (!c) return log_oom(); - r = fido_cred_set_extensions(c, FIDO_EXT_HMAC_SECRET); + r = sym_fido_cred_set_extensions(c, FIDO_EXT_HMAC_SECRET); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to enable HMAC-SECRET extension on FIDO2 credential: %s", fido_strerr(r)); + "Failed to enable HMAC-SECRET extension on FIDO2 credential: %s", sym_fido_strerr(r)); - r = fido_cred_set_rp(c, "io.systemd.home", "Home Directory"); + r = sym_fido_cred_set_rp(c, "io.systemd.home", "Home Directory"); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to set FIDO2 credential relying party ID/name: %s", fido_strerr(r)); + "Failed to set FIDO2 credential relying party ID/name: %s", sym_fido_strerr(r)); - r = fido_cred_set_type(c, COSE_ES256); + r = sym_fido_cred_set_type(c, COSE_ES256); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to set FIDO2 credential type to ES256: %s", fido_strerr(r)); + "Failed to set FIDO2 credential type to ES256: %s", sym_fido_strerr(r)); un = json_variant_by_key(*v, "userName"); if (!un) @@ -231,29 +236,29 @@ int identity_add_fido2_parameters( return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "realName field of user record is not a string"); - r = fido_cred_set_user(c, + r = sym_fido_cred_set_user(c, (const unsigned char*) fido_un, strlen(fido_un), /* We pass the user ID and name as the same */ fido_un, rn ? json_variant_string(rn) : NULL, NULL /* icon URL */); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to set FIDO2 credential user data: %s", fido_strerr(r)); + "Failed to set FIDO2 credential user data: %s", sym_fido_strerr(r)); - r = fido_cred_set_clientdata_hash(c, (const unsigned char[32]) {}, 32); + r = sym_fido_cred_set_clientdata_hash(c, (const unsigned char[32]) {}, 32); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to set FIDO2 client data hash: %s", fido_strerr(r)); + "Failed to set FIDO2 client data hash: %s", sym_fido_strerr(r)); - r = fido_cred_set_rk(c, FIDO_OPT_FALSE); + r = sym_fido_cred_set_rk(c, FIDO_OPT_FALSE); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to turn off FIDO2 resident key option of credential: %s", fido_strerr(r)); + "Failed to turn off FIDO2 resident key option of credential: %s", sym_fido_strerr(r)); - r = fido_cred_set_uv(c, FIDO_OPT_FALSE); + r = sym_fido_cred_set_uv(c, FIDO_OPT_FALSE); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to turn off FIDO2 user verification option of credential: %s", fido_strerr(r)); + "Failed to turn off FIDO2 user verification option of credential: %s", sym_fido_strerr(r)); log_info("Initializing FIDO2 credential on security token."); @@ -261,7 +266,7 @@ int identity_add_fido2_parameters( emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "", emoji_enabled() ? " " : ""); - r = fido_dev_make_cred(d, c, NULL); + r = sym_fido_dev_make_cred(d, c, NULL); if (r == FIDO_ERR_PIN_REQUIRED) { _cleanup_free_ char *text = NULL; @@ -283,7 +288,7 @@ int identity_add_fido2_parameters( continue; } - r = fido_dev_make_cred(d, c, *i); + r = sym_fido_dev_make_cred(d, c, *i); if (r == FIDO_OK) { used_pin = strdup(*i); if (!used_pin) @@ -308,75 +313,75 @@ int identity_add_fido2_parameters( "Token action timeout. (User didn't interact with token quickly enough.)"); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to generate FIDO2 credential: %s", fido_strerr(r)); + "Failed to generate FIDO2 credential: %s", sym_fido_strerr(r)); - cid = fido_cred_id_ptr(c); + cid = sym_fido_cred_id_ptr(c); if (!cid) return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get FIDO2 credential ID."); - cid_size = fido_cred_id_len(c); + cid_size = sym_fido_cred_id_len(c); - a = fido_assert_new(); + a = sym_fido_assert_new(); if (!a) return log_oom(); - r = fido_assert_set_extensions(a, FIDO_EXT_HMAC_SECRET); + r = sym_fido_assert_set_extensions(a, FIDO_EXT_HMAC_SECRET); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to enable HMAC-SECRET extension on FIDO2 assertion: %s", fido_strerr(r)); + "Failed to enable HMAC-SECRET extension on FIDO2 assertion: %s", sym_fido_strerr(r)); - r = fido_assert_set_hmac_salt(a, salt, FIDO2_SALT_SIZE); + r = sym_fido_assert_set_hmac_salt(a, salt, FIDO2_SALT_SIZE); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to set salt on FIDO2 assertion: %s", fido_strerr(r)); + "Failed to set salt on FIDO2 assertion: %s", sym_fido_strerr(r)); - r = fido_assert_set_rp(a, "io.systemd.home"); + r = sym_fido_assert_set_rp(a, "io.systemd.home"); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to set FIDO2 assertion ID: %s", fido_strerr(r)); + "Failed to set FIDO2 assertion ID: %s", sym_fido_strerr(r)); - r = fido_assert_set_clientdata_hash(a, (const unsigned char[32]) {}, 32); + r = sym_fido_assert_set_clientdata_hash(a, (const unsigned char[32]) {}, 32); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to set FIDO2 assertion client data hash: %s", fido_strerr(r)); + "Failed to set FIDO2 assertion client data hash: %s", sym_fido_strerr(r)); - r = fido_assert_allow_cred(a, cid, cid_size); + r = sym_fido_assert_allow_cred(a, cid, cid_size); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to add FIDO2 assertion credential ID: %s", fido_strerr(r)); + "Failed to add FIDO2 assertion credential ID: %s", sym_fido_strerr(r)); - r = fido_assert_set_up(a, FIDO_OPT_FALSE); + r = sym_fido_assert_set_up(a, FIDO_OPT_FALSE); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to turn off FIDO2 assertion user presence: %s", fido_strerr(r)); + "Failed to turn off FIDO2 assertion user presence: %s", sym_fido_strerr(r)); log_info("Generating secret key on FIDO2 security token."); - r = fido_dev_get_assert(d, a, used_pin); + r = sym_fido_dev_get_assert(d, a, used_pin); if (r == FIDO_ERR_UP_REQUIRED) { - r = fido_assert_set_up(a, FIDO_OPT_TRUE); + r = sym_fido_assert_set_up(a, FIDO_OPT_TRUE); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to turn on FIDO2 assertion user presence: %s", fido_strerr(r)); + "Failed to turn on FIDO2 assertion user presence: %s", sym_fido_strerr(r)); log_notice("%s%sIn order to allow secret key generation, please verify presence on security token.", emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "", emoji_enabled() ? " " : ""); - r = fido_dev_get_assert(d, a, used_pin); + r = sym_fido_dev_get_assert(d, a, used_pin); } if (r == FIDO_ERR_ACTION_TIMEOUT) return log_error_errno(SYNTHETIC_ERRNO(ENOSTR), "Token action timeout. (User didn't interact with token quickly enough.)"); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to ask token for assertion: %s", fido_strerr(r)); + "Failed to ask token for assertion: %s", sym_fido_strerr(r)); - secret = fido_assert_hmac_secret_ptr(a, 0); + secret = sym_fido_assert_hmac_secret_ptr(a, 0); if (!secret) return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to retrieve HMAC secret."); - secret_size = fido_assert_hmac_secret_len(a, 0); + secret_size = sym_fido_assert_hmac_secret_len(a, 0); r = add_fido2_credential_id(v, cid, cid_size); if (r < 0) @@ -413,11 +418,15 @@ int list_fido2_devices(void) { fido_dev_info_t *di = NULL; int r; - di = fido_dev_info_new(allocated); + r = dlopen_libfido2(); + if (r < 0) + return log_error_errno(r, "FIDO2 token support is not installed."); + + di = sym_fido_dev_info_new(allocated); if (!di) return log_oom(); - r = fido_dev_info_manifest(di, allocated, &found); + r = sym_fido_dev_info_manifest(di, allocated, &found); if (r == FIDO_ERR_INTERNAL || (r == FIDO_OK && found == 0)) { /* The library returns FIDO_ERR_INTERNAL when no devices are found. I wish it wouldn't. */ log_info("No FIDO2 devices found."); @@ -425,7 +434,7 @@ int list_fido2_devices(void) { goto finish; } if (r != FIDO_OK) { - r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", fido_strerr(r)); + r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", sym_fido_strerr(r)); goto finish; } @@ -438,7 +447,7 @@ int list_fido2_devices(void) { for (size_t i = 0; i < found; i++) { const fido_dev_info_t *entry; - entry = fido_dev_info_ptr(di, i); + entry = sym_fido_dev_info_ptr(di, i); if (!entry) { r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get device information for FIDO device %zu.", i); @@ -447,9 +456,9 @@ int list_fido2_devices(void) { r = table_add_many( t, - TABLE_PATH, fido_dev_info_path(entry), - TABLE_STRING, fido_dev_info_manufacturer_string(entry), - TABLE_STRING, fido_dev_info_product_string(entry)); + TABLE_PATH, sym_fido_dev_info_path(entry), + TABLE_STRING, sym_fido_dev_info_manufacturer_string(entry), + TABLE_STRING, sym_fido_dev_info_product_string(entry)); if (r < 0) { table_log_add_error(r); goto finish; @@ -465,7 +474,7 @@ int list_fido2_devices(void) { r = 0; finish: - fido_dev_info_free(&di, allocated); + sym_fido_dev_info_free(&di, allocated); return r; #else return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), @@ -482,18 +491,22 @@ int find_fido2_auto(char **ret) { const char *path; int r; - di = fido_dev_info_new(di_size); + r = dlopen_libfido2(); + if (r < 0) + return log_error_errno(r, "FIDO2 token support is not installed."); + + di = sym_fido_dev_info_new(di_size); if (!di) return log_oom(); - r = fido_dev_info_manifest(di, di_size, &found); + r = sym_fido_dev_info_manifest(di, di_size, &found); if (r == FIDO_ERR_INTERNAL || (r == FIDO_OK && found == 0)) { /* The library returns FIDO_ERR_INTERNAL when no devices are found. I wish it wouldn't. */ r = log_error_errno(SYNTHETIC_ERRNO(ENODEV), "No FIDO2 devices found."); goto finish; } if (r != FIDO_OK) { - r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", fido_strerr(r)); + r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", sym_fido_strerr(r)); goto finish; } if (found > 1) { @@ -501,14 +514,14 @@ int find_fido2_auto(char **ret) { goto finish; } - entry = fido_dev_info_ptr(di, 0); + entry = sym_fido_dev_info_ptr(di, 0); if (!entry) { r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get device information for FIDO device 0."); goto finish; } - path = fido_dev_info_path(entry); + path = sym_fido_dev_info_path(entry); if (!path) { r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to query FIDO device path."); @@ -525,7 +538,7 @@ int find_fido2_auto(char **ret) { r = 0; finish: - fido_dev_info_free(&di, di_size); + sym_fido_dev_info_free(&di, di_size); return r; #else return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), diff --git a/src/home/homework-fido2.c b/src/home/homework-fido2.c index 2f717a5938..7c21dd34f3 100644 --- a/src/home/homework-fido2.c +++ b/src/home/homework-fido2.c @@ -4,6 +4,7 @@ #include "hexdecoct.h" #include "homework-fido2.h" +#include "libfido2-util.h" #include "strv.h" static int fido2_use_specific_token( @@ -13,39 +14,39 @@ static int fido2_use_specific_token( const Fido2HmacSalt *salt, char **ret) { - _cleanup_(fido_cbor_info_free) fido_cbor_info_t *di = NULL; - _cleanup_(fido_assert_free) fido_assert_t *a = NULL; - _cleanup_(fido_dev_free) fido_dev_t *d = NULL; + _cleanup_(fido_cbor_info_free_wrapper) fido_cbor_info_t *di = NULL; + _cleanup_(fido_assert_free_wrapper) fido_assert_t *a = NULL; + _cleanup_(fido_dev_free_wrapper) fido_dev_t *d = NULL; bool found_extension = false; size_t n, hmac_size; const void *hmac; char **e; int r; - d = fido_dev_new(); + d = sym_fido_dev_new(); if (!d) return log_oom(); - r = fido_dev_open(d, path); + r = sym_fido_dev_open(d, path); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to open FIDO2 device %s: %s", path, fido_strerr(r)); + "Failed to open FIDO2 device %s: %s", path, sym_fido_strerr(r)); - if (!fido_dev_is_fido2(d)) + if (!sym_fido_dev_is_fido2(d)) return log_error_errno(SYNTHETIC_ERRNO(ENODEV), "Specified device %s is not a FIDO2 device.", path); - di = fido_cbor_info_new(); + di = sym_fido_cbor_info_new(); if (!di) return log_oom(); - r = fido_dev_get_cbor_info(d, di); + r = sym_fido_dev_get_cbor_info(d, di); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to get CBOR device info for %s: %s", path, fido_strerr(r)); + "Failed to get CBOR device info for %s: %s", path, sym_fido_strerr(r)); - e = fido_cbor_info_extensions_ptr(di); - n = fido_cbor_info_extensions_len(di); + e = sym_fido_cbor_info_extensions_ptr(di); + n = sym_fido_cbor_info_extensions_len(di); for (size_t i = 0; i < n; i++) if (streq(e[i], "hmac-secret")) { @@ -57,49 +58,49 @@ static int fido2_use_specific_token( return log_error_errno(SYNTHETIC_ERRNO(ENODEV), "Specified device %s is a FIDO2 device, but does not support the required HMAC-SECRET extension.", path); - a = fido_assert_new(); + a = sym_fido_assert_new(); if (!a) return log_oom(); - r = fido_assert_set_extensions(a, FIDO_EXT_HMAC_SECRET); + r = sym_fido_assert_set_extensions(a, FIDO_EXT_HMAC_SECRET); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to enable HMAC-SECRET extension on FIDO2 assertion: %s", fido_strerr(r)); + "Failed to enable HMAC-SECRET extension on FIDO2 assertion: %s", sym_fido_strerr(r)); - r = fido_assert_set_hmac_salt(a, salt->salt, salt->salt_size); + r = sym_fido_assert_set_hmac_salt(a, salt->salt, salt->salt_size); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to set salt on FIDO2 assertion: %s", fido_strerr(r)); + "Failed to set salt on FIDO2 assertion: %s", sym_fido_strerr(r)); - r = fido_assert_set_rp(a, "io.systemd.home"); + r = sym_fido_assert_set_rp(a, "io.systemd.home"); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to set FIDO2 assertion ID: %s", fido_strerr(r)); + "Failed to set FIDO2 assertion ID: %s", sym_fido_strerr(r)); - r = fido_assert_set_clientdata_hash(a, (const unsigned char[32]) {}, 32); + r = sym_fido_assert_set_clientdata_hash(a, (const unsigned char[32]) {}, 32); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to set FIDO2 assertion client data hash: %s", fido_strerr(r)); + "Failed to set FIDO2 assertion client data hash: %s", sym_fido_strerr(r)); - r = fido_assert_allow_cred(a, salt->credential.id, salt->credential.size); + r = sym_fido_assert_allow_cred(a, salt->credential.id, salt->credential.size); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to add FIDO2 assertion credential ID: %s", fido_strerr(r)); + "Failed to add FIDO2 assertion credential ID: %s", sym_fido_strerr(r)); - r = fido_assert_set_up(a, h->fido2_user_presence_permitted <= 0 ? FIDO_OPT_FALSE : FIDO_OPT_TRUE); + r = sym_fido_assert_set_up(a, h->fido2_user_presence_permitted <= 0 ? FIDO_OPT_FALSE : FIDO_OPT_TRUE); if (r != FIDO_OK) return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to set FIDO2 assertion user presence: %s", fido_strerr(r)); + "Failed to set FIDO2 assertion user presence: %s", sym_fido_strerr(r)); log_info("Asking FIDO2 token for authentication."); - r = fido_dev_get_assert(d, a, NULL); /* try without pin first */ + r = sym_fido_dev_get_assert(d, a, NULL); /* try without pin first */ if (r == FIDO_ERR_PIN_REQUIRED) { char **i; /* OK, we needed a pin, try with all pins in turn */ STRV_FOREACH(i, secret->token_pin) { - r = fido_dev_get_assert(d, a, *i); + r = sym_fido_dev_get_assert(d, a, *i); if (r != FIDO_ERR_PIN_INVALID) break; } @@ -128,14 +129,14 @@ static int fido2_use_specific_token( "Token action timeout. (User didn't interact with token quickly enough.)"); default: return log_error_errno(SYNTHETIC_ERRNO(EIO), - "Failed to ask token for assertion: %s", fido_strerr(r)); + "Failed to ask token for assertion: %s", sym_fido_strerr(r)); } - hmac = fido_assert_hmac_secret_ptr(a, 0); + hmac = sym_fido_assert_hmac_secret_ptr(a, 0); if (!hmac) return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to retrieve HMAC secret."); - hmac_size = fido_assert_hmac_secret_len(a, 0); + hmac_size = sym_fido_assert_hmac_secret_len(a, 0); r = base64mem(hmac, hmac_size, ret); if (r < 0) @@ -149,18 +150,22 @@ int fido2_use_token(UserRecord *h, UserRecord *secret, const Fido2HmacSalt *salt fido_dev_info_t *di = NULL; int r; - di = fido_dev_info_new(allocated); + r = dlopen_libfido2(); + if (r < 0) + return log_error_errno(r, "FIDO2 support is not installed."); + + di = sym_fido_dev_info_new(allocated); if (!di) return log_oom(); - r = fido_dev_info_manifest(di, allocated, &found); + r = sym_fido_dev_info_manifest(di, allocated, &found); if (r == FIDO_ERR_INTERNAL) { /* The library returns FIDO_ERR_INTERNAL when no devices are found. I wish it wouldn't. */ r = log_debug_errno(SYNTHETIC_ERRNO(EAGAIN), "Got FIDO_ERR_INTERNAL, assuming no devices."); goto finish; } if (r != FIDO_OK) { - r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", fido_strerr(r)); + r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", sym_fido_strerr(r)); goto finish; } @@ -168,14 +173,14 @@ int fido2_use_token(UserRecord *h, UserRecord *secret, const Fido2HmacSalt *salt const fido_dev_info_t *entry; const char *path; - entry = fido_dev_info_ptr(di, i); + entry = sym_fido_dev_info_ptr(di, i); if (!entry) { r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get device information for FIDO device %zu.", i); goto finish; } - path = fido_dev_info_path(entry); + path = sym_fido_dev_info_path(entry); if (!path) { r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to query FIDO device path."); @@ -192,6 +197,6 @@ int fido2_use_token(UserRecord *h, UserRecord *secret, const Fido2HmacSalt *salt r = -EAGAIN; finish: - fido_dev_info_free(&di, allocated); + sym_fido_dev_info_free(&di, allocated); return r; } diff --git a/src/shared/libfido2-util.c b/src/shared/libfido2-util.c new file mode 100644 index 0000000000..281eb7537a --- /dev/null +++ b/src/shared/libfido2-util.c @@ -0,0 +1,117 @@ +/* SPDX-License-Identifier: LGPL-2.1-or-later */ + +#include "libfido2-util.h" + +#if HAVE_LIBFIDO2 +#include "alloc-util.h" +#include "dlfcn-util.h" +#include "log.h" + +static void *libfido2_dl = NULL; + +int (*sym_fido_assert_allow_cred)(fido_assert_t *, const unsigned char *, size_t) = NULL; +void (*sym_fido_assert_free)(fido_assert_t **) = NULL; +size_t (*sym_fido_assert_hmac_secret_len)(const fido_assert_t *, size_t) = NULL; +const unsigned char* (*sym_fido_assert_hmac_secret_ptr)(const fido_assert_t *, size_t) = NULL; +fido_assert_t* (*sym_fido_assert_new)(void) = NULL; +int (*sym_fido_assert_set_clientdata_hash)(fido_assert_t *, const unsigned char *, size_t) = NULL; +int (*sym_fido_assert_set_extensions)(fido_assert_t *, int) = NULL; +int (*sym_fido_assert_set_hmac_salt)(fido_assert_t *, const unsigned char *, size_t) = NULL; +int (*sym_fido_assert_set_rp)(fido_assert_t *, const char *) = NULL; +int (*sym_fido_assert_set_up)(fido_assert_t *, fido_opt_t) = NULL; +size_t (*sym_fido_cbor_info_extensions_len)(const fido_cbor_info_t *) = NULL; +char **(*sym_fido_cbor_info_extensions_ptr)(const fido_cbor_info_t *) = NULL; +void (*sym_fido_cbor_info_free)(fido_cbor_info_t **) = NULL; +fido_cbor_info_t* (*sym_fido_cbor_info_new)(void) = NULL; +void (*sym_fido_cred_free)(fido_cred_t **) = NULL; +size_t (*sym_fido_cred_id_len)(const fido_cred_t *) = NULL; +const unsigned char* (*sym_fido_cred_id_ptr)(const fido_cred_t *) = NULL; +fido_cred_t* (*sym_fido_cred_new)(void) = NULL; +int (*sym_fido_cred_set_clientdata_hash)(fido_cred_t *, const unsigned char *, size_t) = NULL; +int (*sym_fido_cred_set_extensions)(fido_cred_t *, int) = NULL; +int (*sym_fido_cred_set_rk)(fido_cred_t *, fido_opt_t) = NULL; +int (*sym_fido_cred_set_rp)(fido_cred_t *, const char *, const char *) = NULL; +int (*sym_fido_cred_set_type)(fido_cred_t *, int) = NULL; +int (*sym_fido_cred_set_user)(fido_cred_t *, const unsigned char *, size_t, const char *, const char *, const char *) = NULL; +int (*sym_fido_cred_set_uv)(fido_cred_t *, fido_opt_t) = NULL; +void (*sym_fido_dev_free)(fido_dev_t **) = NULL; +int (*sym_fido_dev_get_assert)(fido_dev_t *, fido_assert_t *, const char *) = NULL; +int (*sym_fido_dev_get_cbor_info)(fido_dev_t *, fido_cbor_info_t *) = NULL; +void (*sym_fido_dev_info_free)(fido_dev_info_t **, size_t) = NULL; +int (*sym_fido_dev_info_manifest)(fido_dev_info_t *, size_t, size_t *) = NULL; +const char* (*sym_fido_dev_info_manufacturer_string)(const fido_dev_info_t *) = NULL; +const char* (*sym_fido_dev_info_product_string)(const fido_dev_info_t *) = NULL; +fido_dev_info_t* (*sym_fido_dev_info_new)(size_t) = NULL; +const char* (*sym_fido_dev_info_path)(const fido_dev_info_t *) = NULL; +const fido_dev_info_t* (*sym_fido_dev_info_ptr)(const fido_dev_info_t *, size_t) = NULL; +bool (*sym_fido_dev_is_fido2)(const fido_dev_t *) = NULL; +int (*sym_fido_dev_make_cred)(fido_dev_t *, fido_cred_t *, const char *) = NULL; +fido_dev_t* (*sym_fido_dev_new)(void) = NULL; +int (*sym_fido_dev_open)(fido_dev_t *, const char *) = NULL; +const char* (*sym_fido_strerr)(int) = NULL; + +int dlopen_libfido2(void) { + _cleanup_(dlclosep) void *dl = NULL; + int r; + + if (libfido2_dl) + return 0; /* Already loaded */ + + dl = dlopen("libfido2.so.1", RTLD_LAZY); + if (!dl) + return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), + "libfido2 support is not installed: %s", dlerror()); + + r = dlsym_many_and_warn( + dl, + LOG_DEBUG, + DLSYM_ARG(fido_assert_allow_cred), + DLSYM_ARG(fido_assert_free), + DLSYM_ARG(fido_assert_hmac_secret_len), + DLSYM_ARG(fido_assert_hmac_secret_ptr), + DLSYM_ARG(fido_assert_new), + DLSYM_ARG(fido_assert_set_clientdata_hash), + DLSYM_ARG(fido_assert_set_extensions), + DLSYM_ARG(fido_assert_set_hmac_salt), + DLSYM_ARG(fido_assert_set_rp), + DLSYM_ARG(fido_assert_set_up), + DLSYM_ARG(fido_cbor_info_extensions_len), + DLSYM_ARG(fido_cbor_info_extensions_ptr), + DLSYM_ARG(fido_cbor_info_free), + DLSYM_ARG(fido_cbor_info_new), + DLSYM_ARG(fido_cred_free), + DLSYM_ARG(fido_cred_id_len), + DLSYM_ARG(fido_cred_id_ptr), + DLSYM_ARG(fido_cred_new), + DLSYM_ARG(fido_cred_set_clientdata_hash), + DLSYM_ARG(fido_cred_set_extensions), + DLSYM_ARG(fido_cred_set_rk), + DLSYM_ARG(fido_cred_set_rp), + DLSYM_ARG(fido_cred_set_type), + DLSYM_ARG(fido_cred_set_user), + DLSYM_ARG(fido_cred_set_uv), + DLSYM_ARG(fido_dev_free), + DLSYM_ARG(fido_dev_get_assert), + DLSYM_ARG(fido_dev_get_cbor_info), + DLSYM_ARG(fido_dev_info_free), + DLSYM_ARG(fido_dev_info_manifest), + DLSYM_ARG(fido_dev_info_manufacturer_string), + DLSYM_ARG(fido_dev_info_new), + DLSYM_ARG(fido_dev_info_path), + DLSYM_ARG(fido_dev_info_product_string), + DLSYM_ARG(fido_dev_info_ptr), + DLSYM_ARG(fido_dev_is_fido2), + DLSYM_ARG(fido_dev_make_cred), + DLSYM_ARG(fido_dev_new), + DLSYM_ARG(fido_dev_open), + DLSYM_ARG(fido_strerr), + NULL); + if (r < 0) + return r; + + /* Note that we never release the reference here, because there's no real reason to, after all this + * was traditionally a regular shared library dependency which lives forever too. */ + libfido2_dl = TAKE_PTR(dl); + return 1; +} +#endif diff --git a/src/shared/libfido2-util.h b/src/shared/libfido2-util.h new file mode 100644 index 0000000000..baa5ee9212 --- /dev/null +++ b/src/shared/libfido2-util.h @@ -0,0 +1,72 @@ +/* SPDX-License-Identifier: LGPL-2.1-or-later */ +#pragma once + +#include "macro.h" + +#if HAVE_LIBFIDO2 +#include + +extern int (*sym_fido_assert_allow_cred)(fido_assert_t *, const unsigned char *, size_t); +extern void (*sym_fido_assert_free)(fido_assert_t **); +extern size_t (*sym_fido_assert_hmac_secret_len)(const fido_assert_t *, size_t); +extern const unsigned char* (*sym_fido_assert_hmac_secret_ptr)(const fido_assert_t *, size_t); +extern fido_assert_t* (*sym_fido_assert_new)(void); +extern int (*sym_fido_assert_set_clientdata_hash)(fido_assert_t *, const unsigned char *, size_t); +extern int (*sym_fido_assert_set_extensions)(fido_assert_t *, int); +extern int (*sym_fido_assert_set_hmac_salt)(fido_assert_t *, const unsigned char *, size_t); +extern int (*sym_fido_assert_set_rp)(fido_assert_t *, const char *); +extern int (*sym_fido_assert_set_up)(fido_assert_t *, fido_opt_t); +extern size_t (*sym_fido_cbor_info_extensions_len)(const fido_cbor_info_t *); +extern char **(*sym_fido_cbor_info_extensions_ptr)(const fido_cbor_info_t *); +extern void (*sym_fido_cbor_info_free)(fido_cbor_info_t **); +extern fido_cbor_info_t* (*sym_fido_cbor_info_new)(void); +extern void (*sym_fido_cred_free)(fido_cred_t **); +extern size_t (*sym_fido_cred_id_len)(const fido_cred_t *); +extern const unsigned char* (*sym_fido_cred_id_ptr)(const fido_cred_t *); +extern fido_cred_t* (*sym_fido_cred_new)(void); +extern int (*sym_fido_cred_set_clientdata_hash)(fido_cred_t *, const unsigned char *, size_t); +extern int (*sym_fido_cred_set_extensions)(fido_cred_t *, int); +extern int (*sym_fido_cred_set_rk)(fido_cred_t *, fido_opt_t); +extern int (*sym_fido_cred_set_rp)(fido_cred_t *, const char *, const char *); +extern int (*sym_fido_cred_set_type)(fido_cred_t *, int); +extern int (*sym_fido_cred_set_user)(fido_cred_t *, const unsigned char *, size_t, const char *, const char *, const char *); +extern int (*sym_fido_cred_set_uv)(fido_cred_t *, fido_opt_t); +extern void (*sym_fido_dev_free)(fido_dev_t **); +extern int (*sym_fido_dev_get_assert)(fido_dev_t *, fido_assert_t *, const char *); +extern int (*sym_fido_dev_get_cbor_info)(fido_dev_t *, fido_cbor_info_t *); +extern void (*sym_fido_dev_info_free)(fido_dev_info_t **, size_t); +extern int (*sym_fido_dev_info_manifest)(fido_dev_info_t *, size_t, size_t *); +extern const char* (*sym_fido_dev_info_manufacturer_string)(const fido_dev_info_t *); +extern const char* (*sym_fido_dev_info_product_string)(const fido_dev_info_t *); +extern fido_dev_info_t* (*sym_fido_dev_info_new)(size_t); +extern const char* (*sym_fido_dev_info_path)(const fido_dev_info_t *); +extern const fido_dev_info_t* (*sym_fido_dev_info_ptr)(const fido_dev_info_t *, size_t); +extern bool (*sym_fido_dev_is_fido2)(const fido_dev_t *); +extern int (*sym_fido_dev_make_cred)(fido_dev_t *, fido_cred_t *, const char *); +extern fido_dev_t* (*sym_fido_dev_new)(void); +extern int (*sym_fido_dev_open)(fido_dev_t *, const char *); +extern const char* (*sym_fido_strerr)(int); + +int dlopen_libfido2(void); + +static inline void fido_cbor_info_free_wrapper(fido_cbor_info_t **p) { + if (*p) + sym_fido_cbor_info_free(p); +} + +static inline void fido_assert_free_wrapper(fido_assert_t **p) { + if (*p) + sym_fido_assert_free(p); +} + +static inline void fido_dev_free_wrapper(fido_dev_t **p) { + if (*p) + sym_fido_dev_free(p); +} + +static inline void fido_cred_free_wrapper(fido_cred_t **p) { + if (*p) + sym_fido_cred_free(p); +} + +#endif diff --git a/src/shared/meson.build b/src/shared/meson.build index ebe98df24a..45b8d1b07c 100644 --- a/src/shared/meson.build +++ b/src/shared/meson.build @@ -146,6 +146,8 @@ shared_sources = files(''' json.h libcrypt-util.c libcrypt-util.h + libfido2-util.c + libfido2-util.h libmount-util.h linux/auto_dev-ioctl.h linux/bpf.h