1 /*
2 * Copyright (c) 2020 Yubico AB. All rights reserved.
3 * Use of this source code is governed by a BSD-style
4 * license that can be found in the LICENSE file.
5 */
6
7 #include <assert.h>
8 #include <stdint.h>
9 #include <stdlib.h>
10 #include <string.h>
11 #include <stdio.h>
12
13 #include "../openbsd-compat/openbsd-compat.h"
14 #include "mutator_aux.h"
15
16 extern int fido_hid_get_usage(const uint8_t *, size_t, uint32_t *);
17 extern int fido_hid_get_report_len(const uint8_t *, size_t, size_t *, size_t *);
18 extern void set_udev_parameters(const char *, const struct blob *);
19
20 struct param {
21 int seed;
22 char uevent[MAXSTR];
23 struct blob report_descriptor;
24 };
25
26 /*
27 * Sample HID report descriptor from the FIDO HID interface of a YubiKey 5.
28 */
29 static const uint8_t dummy_report_descriptor[] = {
30 0x06, 0xd0, 0xf1, 0x09, 0x01, 0xa1, 0x01, 0x09,
31 0x20, 0x15, 0x00, 0x26, 0xff, 0x00, 0x75, 0x08,
32 0x95, 0x40, 0x81, 0x02, 0x09, 0x21, 0x15, 0x00,
33 0x26, 0xff, 0x00, 0x75, 0x08, 0x95, 0x40, 0x91,
34 0x02, 0xc0
35 };
36
37 /*
38 * Sample uevent file from a Yubico Security Key.
39 */
40 static const char dummy_uevent[] =
41 "DRIVER=hid-generic\n"
42 "HID_ID=0003:00001050:00000120\n"
43 "HID_NAME=Yubico Security Key by Yubico\n"
44 "HID_PHYS=usb-0000:00:14.0-3/input0\n"
45 "HID_UNIQ=\n"
46 "MODALIAS=hid:b0003g0001v00001050p00000120\n";
47
48 struct param *
unpack(const uint8_t * ptr,size_t len)49 unpack(const uint8_t *ptr, size_t len)
50 {
51 cbor_item_t *item = NULL, **v;
52 struct cbor_load_result cbor;
53 struct param *p;
54 int ok = -1;
55
56 if ((p = calloc(1, sizeof(*p))) == NULL ||
57 (item = cbor_load(ptr, len, &cbor)) == NULL ||
58 cbor.read != len ||
59 cbor_isa_array(item) == false ||
60 cbor_array_is_definite(item) == false ||
61 cbor_array_size(item) != 3 ||
62 (v = cbor_array_handle(item)) == NULL)
63 goto fail;
64
65 if (unpack_int(v[0], &p->seed) < 0 ||
66 unpack_string(v[1], p->uevent) < 0 ||
67 unpack_blob(v[2], &p->report_descriptor) < 0)
68 goto fail;
69
70 ok = 0;
71 fail:
72 if (ok < 0) {
73 free(p);
74 p = NULL;
75 }
76
77 if (item)
78 cbor_decref(&item);
79
80 return p;
81 }
82
83 size_t
pack(uint8_t * ptr,size_t len,const struct param * p)84 pack(uint8_t *ptr, size_t len, const struct param *p)
85 {
86 cbor_item_t *argv[3], *array = NULL;
87 size_t cbor_alloc_len, cbor_len = 0;
88 unsigned char *cbor = NULL;
89
90 memset(argv, 0, sizeof(argv));
91
92 if ((array = cbor_new_definite_array(3)) == NULL ||
93 (argv[0] = pack_int(p->seed)) == NULL ||
94 (argv[1] = pack_string(p->uevent)) == NULL ||
95 (argv[2] = pack_blob(&p->report_descriptor)) == NULL)
96 goto fail;
97
98 for (size_t i = 0; i < 3; i++)
99 if (cbor_array_push(array, argv[i]) == false)
100 goto fail;
101
102 if ((cbor_len = cbor_serialize_alloc(array, &cbor,
103 &cbor_alloc_len)) > len) {
104 cbor_len = 0;
105 goto fail;
106 }
107
108 memcpy(ptr, cbor, cbor_len);
109 fail:
110 for (size_t i = 0; i < 3; i++)
111 if (argv[i])
112 cbor_decref(&argv[i]);
113
114 if (array)
115 cbor_decref(&array);
116
117 free(cbor);
118
119 return cbor_len;
120 }
121
122 size_t
pack_dummy(uint8_t * ptr,size_t len)123 pack_dummy(uint8_t *ptr, size_t len)
124 {
125 struct param dummy;
126 uint8_t blob[4096];
127 size_t blob_len;
128
129 memset(&dummy, 0, sizeof(dummy));
130
131 dummy.report_descriptor.len = sizeof(dummy_report_descriptor);
132 strlcpy(dummy.uevent, dummy_uevent, sizeof(dummy.uevent));
133 memcpy(&dummy.report_descriptor.body, &dummy_report_descriptor,
134 dummy.report_descriptor.len);
135
136 assert((blob_len = pack(blob, sizeof(blob), &dummy)) != 0);
137 if (blob_len > len)
138 blob_len = len;
139
140 memcpy(ptr, blob, blob_len);
141
142 return blob_len;
143 }
144
145 static void
get_usage(const struct param * p)146 get_usage(const struct param *p)
147 {
148 uint32_t usage_page = 0;
149
150 fido_hid_get_usage(p->report_descriptor.body, p->report_descriptor.len,
151 &usage_page);
152 consume(&usage_page, sizeof(usage_page));
153 }
154
155 static void
get_report_len(const struct param * p)156 get_report_len(const struct param *p)
157 {
158 size_t report_in_len = 0;
159 size_t report_out_len = 0;
160
161 fido_hid_get_report_len(p->report_descriptor.body,
162 p->report_descriptor.len, &report_in_len, &report_out_len);
163 consume(&report_in_len, sizeof(report_in_len));
164 consume(&report_out_len, sizeof(report_out_len));
165 }
166
167 static void
manifest(const struct param * p)168 manifest(const struct param *p)
169 {
170 size_t ndevs, nfound;
171 fido_dev_info_t *devlist;
172 int16_t vendor_id, product_id;
173
174 set_udev_parameters(p->uevent, &p->report_descriptor);
175 ndevs = uniform_random(64);
176 if ((devlist = fido_dev_info_new(ndevs)) == NULL ||
177 fido_dev_info_manifest(devlist, ndevs, &nfound) != FIDO_OK)
178 goto out;
179 for (size_t i = 0; i < nfound; i++) {
180 const fido_dev_info_t *di = fido_dev_info_ptr(devlist, i);
181 consume_str(fido_dev_info_path(di));
182 consume_str(fido_dev_info_manufacturer_string(di));
183 consume_str(fido_dev_info_product_string(di));
184 vendor_id = fido_dev_info_vendor(di);
185 product_id = fido_dev_info_product(di);
186 consume(&vendor_id, sizeof(vendor_id));
187 consume(&product_id, sizeof(product_id));
188 }
189 out:
190 fido_dev_info_free(&devlist, ndevs);
191 }
192
193 void
test(const struct param * p)194 test(const struct param *p)
195 {
196 prng_init((unsigned int)p->seed);
197 fido_init(FIDO_DEBUG);
198 fido_set_log_handler(consume_str);
199
200 get_usage(p);
201 get_report_len(p);
202 manifest(p);
203 }
204
205 void
mutate(struct param * p,unsigned int seed,unsigned int flags)206 mutate(struct param *p, unsigned int seed, unsigned int flags) NO_MSAN
207 {
208 if (flags & MUTATE_SEED)
209 p->seed = (int)seed;
210
211 if (flags & MUTATE_PARAM) {
212 mutate_blob(&p->report_descriptor);
213 mutate_string(p->uevent);
214 }
215 }
216