123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645 |
- // Copyright 2017 The Chromium Authors. All rights reserved.
- // Use of this source code is governed by a BSD-style license that can be
- // found in the LICENSE file.
- #include "device/fido/hid/fido_hid_device.h"
- #include <limits>
- #include <vector>
- #include "base/bind.h"
- #include "base/callback_helpers.h"
- #include "base/command_line.h"
- #include "base/containers/contains.h"
- #include "base/containers/fixed_flat_set.h"
- #include "base/logging.h"
- #include "base/strings/string_number_conversions.h"
- #include "base/strings/string_piece.h"
- #include "base/strings/string_util.h"
- #include "base/threading/thread_task_runner_handle.h"
- #include "components/device_event_log/device_event_log.h"
- #include "crypto/random.h"
- #include "device/fido/hid/fido_hid_message.h"
- namespace device {
- // U2F devices only provide a single report so specify a report ID of 0 here.
- static constexpr uint8_t kReportId = 0x00;
- static constexpr uint8_t kWinkCapability = 0x01;
- FidoHidDevice::FidoHidDevice(device::mojom::HidDeviceInfoPtr device_info,
- device::mojom::HidManager* hid_manager)
- : FidoDevice(),
- output_report_size_(device_info->max_output_report_size),
- hid_manager_(hid_manager),
- device_info_(std::move(device_info)) {
- DCHECK_GE(std::numeric_limits<decltype(output_report_size_)>::max(),
- device_info_->max_output_report_size);
- // These limits on the report size are enforced in fido_hid_discovery.cc.
- DCHECK_LT(kHidInitPacketHeaderSize, output_report_size_);
- DCHECK_GE(kHidMaxPacketSize, output_report_size_);
- }
- FidoHidDevice::~FidoHidDevice() = default;
- FidoDevice::CancelToken FidoHidDevice::DeviceTransact(
- std::vector<uint8_t> command,
- DeviceCallback callback) {
- const CancelToken token = next_cancel_token_++;
- const auto command_type = supported_protocol() == ProtocolVersion::kCtap2
- ? FidoHidDeviceCommand::kCbor
- : FidoHidDeviceCommand::kMsg;
- pending_transactions_.emplace_back(command_type, std::move(command),
- std::move(callback), token);
- Transition();
- return token;
- }
- void FidoHidDevice::Cancel(CancelToken token) {
- if (state_ == State::kBusy && current_token_ == token) {
- // Sending a Cancel request should cause the outstanding request to return
- // with CTAP2_ERR_KEEPALIVE_CANCEL if the device is CTAP2. That error will
- // cause the request to complete in the usual way. U2F doesn't have a cancel
- // message, but U2F devices are not expected to block on requests and also
- // no U2F command alters state in a meaningful way, as CTAP2 commands do.
- if (supported_protocol() != ProtocolVersion::kCtap2) {
- return;
- }
- switch (busy_state_) {
- case BusyState::kWriting:
- // Send a cancelation message once the transmission is complete.
- busy_state_ = BusyState::kWritingPendingCancel;
- break;
- case BusyState::kWritingPendingCancel:
- // A cancelation message is already scheduled.
- break;
- case BusyState::kWaiting:
- // Waiting for reply. Send cancelation message.
- busy_state_ = BusyState::kReading;
- WriteCancel();
- break;
- case BusyState::kReading:
- // Have either already sent a cancel message, or else have started
- // reading the response.
- break;
- }
- return;
- }
- // The request with the given |token| isn't the current request. Remove it
- // from the list of pending requests if found.
- for (auto it = pending_transactions_.begin();
- it != pending_transactions_.end(); it++) {
- if (it->token != token) {
- continue;
- }
- auto callback = std::move(it->callback);
- pending_transactions_.erase(it);
- std::vector<uint8_t> cancel_reply = {
- static_cast<uint8_t>(CtapDeviceResponseCode::kCtap2ErrKeepAliveCancel)};
- std::move(callback).Run(std::move(cancel_reply));
- break;
- }
- }
- void FidoHidDevice::Transition(absl::optional<State> next_state) {
- if (next_state) {
- state_ = *next_state;
- }
- switch (state_) {
- case State::kInit:
- state_ = State::kConnecting;
- ArmTimeout();
- Connect(base::BindOnce(&FidoHidDevice::OnConnect,
- weak_factory_.GetWeakPtr()));
- break;
- case State::kReady: {
- DCHECK(!pending_transactions_.empty());
- // Some devices fail when sent a wink command immediately followed by a
- // CBOR command. Only try to wink if device claims support and it is
- // required to signal user presence.
- if (pending_transactions_.front().command_type ==
- FidoHidDeviceCommand::kWink &&
- !(capabilities_ & kWinkCapability && needs_explicit_wink_)) {
- DeviceCallback pending_cb =
- std::move(pending_transactions_.front().callback);
- pending_transactions_.pop_front();
- std::move(pending_cb).Run(absl::nullopt);
- break;
- }
- state_ = State::kBusy;
- busy_state_ = BusyState::kWriting;
- ArmTimeout();
- // Write message to the device.
- current_token_ = pending_transactions_.front().token;
- auto maybe_message(FidoHidMessage::Create(
- channel_id_, pending_transactions_.front().command_type,
- output_report_size_,
- std::move(pending_transactions_.front().command)));
- DCHECK(maybe_message);
- WriteMessage(std::move(*maybe_message));
- break;
- }
- case State::kConnecting:
- case State::kBusy:
- break;
- case State::kDeviceError:
- case State::kMsgError:
- base::WeakPtr<FidoHidDevice> self = weak_factory_.GetWeakPtr();
- // Executing callbacks may free |this|. Check |self| first.
- while (self && !pending_transactions_.empty()) {
- // Respond to any pending requests.
- DeviceCallback pending_cb =
- std::move(pending_transactions_.front().callback);
- pending_transactions_.pop_front();
- std::move(pending_cb).Run(absl::nullopt);
- }
- break;
- }
- }
- FidoHidDevice::PendingTransaction::PendingTransaction(
- FidoHidDeviceCommand command_type,
- std::vector<uint8_t> in_command,
- DeviceCallback in_callback,
- CancelToken in_token)
- : command_type(command_type),
- command(std::move(in_command)),
- callback(std::move(in_callback)),
- token(in_token) {}
- FidoHidDevice::PendingTransaction::~PendingTransaction() = default;
- void FidoHidDevice::Connect(
- device::mojom::HidManager::ConnectCallback callback) {
- DCHECK(hid_manager_);
- hid_manager_->Connect(device_info_->guid,
- /*connection_client=*/mojo::NullRemote(),
- /*watcher=*/mojo::NullRemote(),
- /*allow_protected_reports=*/true,
- /*allow_fido_reports=*/true, std::move(callback));
- }
- void FidoHidDevice::OnConnect(
- mojo::PendingRemote<device::mojom::HidConnection> connection) {
- timeout_callback_.Cancel();
- if (!connection) {
- Transition(State::kDeviceError);
- return;
- }
- connection_ = base::MakeRefCounted<RefCountedHidConnection>(
- mojo::Remote<mojom::HidConnection>(std::move(connection)));
- // Send random nonce to device to verify received message.
- std::vector<uint8_t> nonce(8);
- crypto::RandBytes(nonce.data(), nonce.size());
- DCHECK_EQ(State::kConnecting, state_);
- ArmTimeout();
- FidoHidInitPacket init(kHidBroadcastChannel, FidoHidDeviceCommand::kInit,
- nonce, nonce.size());
- std::vector<uint8_t> init_packet = init.GetSerializedData();
- init_packet.resize(output_report_size_, 0);
- connection_->data->Write(
- kReportId, std::move(init_packet),
- base::BindOnce(&FidoHidDevice::OnInitWriteComplete,
- weak_factory_.GetWeakPtr(), std::move(nonce)));
- }
- void FidoHidDevice::OnInitWriteComplete(std::vector<uint8_t> nonce,
- bool success) {
- if (state_ == State::kDeviceError) {
- return;
- }
- if (!success) {
- Transition(State::kDeviceError);
- }
- connection_->data->Read(base::BindOnce(&FidoHidDevice::OnPotentialInitReply,
- weak_factory_.GetWeakPtr(),
- std::move(nonce)));
- }
- // ParseInitReply parses a potential reply to a U2FHID_INIT message. If the
- // reply matches the given nonce then the assigned channel ID is returned.
- absl::optional<uint32_t> FidoHidDevice::ParseInitReply(
- const std::vector<uint8_t>& nonce,
- const std::vector<uint8_t>& buf) {
- auto message = FidoHidMessage::CreateFromSerializedData(buf);
- if (!message ||
- // Any reply will be sent to the broadcast channel.
- message->channel_id() != kHidBroadcastChannel ||
- // Init replies must fit in a single frame.
- !message->MessageComplete() ||
- message->cmd() != FidoHidDeviceCommand::kInit) {
- return absl::nullopt;
- }
- auto payload = message->GetMessagePayload();
- // The channel allocation response is defined as:
- // 0: 8 byte nonce
- // 8: 4 byte channel id
- // 12: Protocol version id
- // 13: Major device version
- // 14: Minor device version
- // 15: Build device version
- // 16: Capabilities
- DCHECK_EQ(8u, nonce.size());
- if (payload.size() != 17 || memcmp(nonce.data(), payload.data(), 8) != 0) {
- return absl::nullopt;
- }
- capabilities_ = payload[16];
- return static_cast<uint32_t>(payload[8]) << 24 |
- static_cast<uint32_t>(payload[9]) << 16 |
- static_cast<uint32_t>(payload[10]) << 8 |
- static_cast<uint32_t>(payload[11]);
- }
- void FidoHidDevice::OnPotentialInitReply(
- std::vector<uint8_t> nonce,
- bool success,
- uint8_t report_id,
- const absl::optional<std::vector<uint8_t>>& buf) {
- if (state_ == State::kDeviceError) {
- return;
- }
- if (!success) {
- Transition(State::kDeviceError);
- return;
- }
- DCHECK(buf);
- absl::optional<uint32_t> maybe_channel_id = ParseInitReply(nonce, *buf);
- if (!maybe_channel_id) {
- // This instance of Chromium may not be the only process communicating with
- // this HID device, but all processes will see all the messages from the
- // device. Thus it is not an error to observe unexpected messages from the
- // device and they are ignored.
- connection_->data->Read(base::BindOnce(&FidoHidDevice::OnPotentialInitReply,
- weak_factory_.GetWeakPtr(),
- std::move(nonce)));
- return;
- }
- timeout_callback_.Cancel();
- channel_id_ = *maybe_channel_id;
- Transition(State::kReady);
- }
- void FidoHidDevice::WriteMessage(FidoHidMessage message) {
- DCHECK_EQ(State::kBusy, state_);
- DCHECK(message.NumPackets() > 0);
- auto packet = message.PopNextPacket();
- DCHECK_LE(packet.size(), output_report_size_);
- packet.resize(output_report_size_, 0);
- connection_->data->Write(
- kReportId, packet,
- base::BindOnce(&FidoHidDevice::PacketWritten, weak_factory_.GetWeakPtr(),
- std::move(message)));
- }
- void FidoHidDevice::PacketWritten(FidoHidMessage message, bool success) {
- if (state_ == State::kDeviceError) {
- return;
- }
- DCHECK_EQ(State::kBusy, state_);
- if (!success) {
- Transition(State::kDeviceError);
- return;
- }
- if (message.NumPackets() > 0) {
- WriteMessage(std::move(message));
- return;
- }
- switch (busy_state_) {
- case BusyState::kWriting:
- busy_state_ = BusyState::kWaiting;
- ReadMessage();
- break;
- case BusyState::kWritingPendingCancel:
- busy_state_ = BusyState::kReading;
- WriteCancel();
- ReadMessage();
- break;
- default:
- NOTREACHED();
- }
- }
- void FidoHidDevice::ReadMessage() {
- connection_->data->Read(
- base::BindOnce(&FidoHidDevice::OnRead, weak_factory_.GetWeakPtr()));
- }
- void FidoHidDevice::OnRead(bool success,
- uint8_t report_id,
- const absl::optional<std::vector<uint8_t>>& buf) {
- if (state_ == State::kDeviceError) {
- return;
- }
- DCHECK_EQ(State::kBusy, state_);
- if (!success) {
- Transition(State::kDeviceError);
- return;
- }
- DCHECK(buf);
- auto message = FidoHidMessage::CreateFromSerializedData(*buf);
- if (!message) {
- Transition(State::kDeviceError);
- return;
- }
- if (!message->MessageComplete()) {
- // Continue reading additional packets.
- connection_->data->Read(base::BindOnce(&FidoHidDevice::OnReadContinuation,
- weak_factory_.GetWeakPtr(),
- std::move(*message)));
- return;
- }
- // Received a message from a different channel, so try again.
- if (channel_id_ != message->channel_id()) {
- ReadMessage();
- return;
- }
- // If received HID packet is a keep-alive message then reset the timeout and
- // read again.
- if (supported_protocol() == ProtocolVersion::kCtap2 &&
- message->cmd() == FidoHidDeviceCommand::kKeepAlive) {
- timeout_callback_.Cancel();
- ArmTimeout();
- ReadMessage();
- return;
- }
- switch (busy_state_) {
- case BusyState::kWaiting:
- busy_state_ = BusyState::kReading;
- break;
- case BusyState::kReading:
- break;
- default:
- NOTREACHED();
- }
- MessageReceived(std::move(*message));
- }
- void FidoHidDevice::OnReadContinuation(
- FidoHidMessage message,
- bool success,
- uint8_t report_id,
- const absl::optional<std::vector<uint8_t>>& buf) {
- if (state_ == State::kDeviceError) {
- return;
- }
- if (!success) {
- Transition(State::kDeviceError);
- return;
- }
- DCHECK(buf);
- if (!message.AddContinuationPacket(*buf)) {
- Transition(State::kDeviceError);
- return;
- }
- if (!message.MessageComplete()) {
- connection_->data->Read(base::BindOnce(&FidoHidDevice::OnReadContinuation,
- weak_factory_.GetWeakPtr(),
- std::move(message)));
- return;
- }
- // Received a message from a different channel, so try again.
- if (channel_id_ != message.channel_id()) {
- ReadMessage();
- return;
- }
- MessageReceived(std::move(message));
- }
- void FidoHidDevice::MessageReceived(FidoHidMessage message) {
- timeout_callback_.Cancel();
- const FidoHidDeviceCommand cmd = message.cmd();
- std::vector<uint8_t> response = message.GetMessagePayload();
- constexpr FidoHidDeviceCommand kValidCommands[] = {
- FidoHidDeviceCommand::kMsg, FidoHidDeviceCommand::kCbor,
- FidoHidDeviceCommand::kWink, FidoHidDeviceCommand::kError};
- if (!base::Contains(kValidCommands, cmd)) {
- FIDO_LOG(ERROR) << "Unknown CTAPHID command: " << static_cast<int>(cmd)
- << " " << base::HexEncode(response.data(), response.size());
- Transition(State::kDeviceError);
- return;
- }
- if (cmd == FidoHidDeviceCommand::kError) {
- if (response.size() != 1) {
- FIDO_LOG(ERROR) << "Invalid CTAPHID_ERROR payload: "
- << base::HexEncode(response.data(), response.size());
- Transition(State::kDeviceError);
- return;
- }
- // HID transport layer error constants that are returned to the client.
- // https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-client-to-authenticator-protocol-v2.0-rd-20170927.html#ctaphid-commands
- enum class HidErrorConstant : uint8_t {
- kInvalidCommand = 0x01,
- kInvalidParameter = 0x02,
- kInvalidLength = 0x03,
- kMessageTimeout = 0x05,
- kChannelBusy = 0x06,
- // (Other errors omitted.)
- };
- switch (static_cast<HidErrorConstant>(response[0])) {
- case HidErrorConstant::kInvalidCommand:
- case HidErrorConstant::kInvalidParameter:
- case HidErrorConstant::kInvalidLength:
- Transition(State::kMsgError);
- break;
- case HidErrorConstant::kMessageTimeout:
- Transition(State::kDeviceError);
- break;
- case HidErrorConstant::kChannelBusy:
- // Retry the pending transaction after a short delay. |state_| is still
- // |State::kBusy|, so no other transaction will run in the meantime.
- DCHECK_EQ(State::kBusy, state_);
- base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
- FROM_HERE,
- base::BindOnce(&FidoHidDevice::RetryAfterChannelBusy,
- weak_factory_.GetWeakPtr()),
- base::Milliseconds(100));
- break;
- default:
- FIDO_LOG(DEBUG) << "Invalid CTAPHID_ERROR "
- << static_cast<int>(response[0]);
- Transition(State::kDeviceError);
- break;
- }
- return;
- }
- DCHECK(!pending_transactions_.empty());
- auto callback = std::move(pending_transactions_.front().callback);
- pending_transactions_.pop_front();
- current_token_ = FidoDevice::kInvalidCancelToken;
- base::WeakPtr<FidoHidDevice> self = weak_factory_.GetWeakPtr();
- // The callback may call back into this object thus |state_| is set ahead of
- // time.
- state_ = State::kReady;
- std::move(callback).Run(std::move(response));
- // Executing |callback| may have freed |this|. Check |self| first.
- if (self && !pending_transactions_.empty()) {
- Transition();
- }
- }
- void FidoHidDevice::RetryAfterChannelBusy() {
- DCHECK(!pending_transactions_.empty());
- DCHECK_EQ(State::kBusy, state_);
- Transition(State::kReady);
- }
- void FidoHidDevice::TryWink(base::OnceClosure callback) {
- const CancelToken token = next_cancel_token_++;
- pending_transactions_.emplace_back(
- FidoHidDeviceCommand::kWink, std::vector<uint8_t>(),
- base::BindOnce(
- [](base::OnceClosure cb, absl::optional<std::vector<uint8_t>> data) {
- std::move(cb).Run();
- },
- std::move(callback)),
- token);
- Transition();
- }
- void FidoHidDevice::ArmTimeout() {
- DCHECK(timeout_callback_.IsCancelled());
- timeout_callback_.Reset(
- base::BindOnce(&FidoHidDevice::OnTimeout, weak_factory_.GetWeakPtr()));
- // Setup timeout task for 3 seconds.
- base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
- FROM_HERE, timeout_callback_.callback(), kDeviceTimeout);
- }
- void FidoHidDevice::OnTimeout() {
- FIDO_LOG(ERROR) << "FIDO HID device timeout for " << GetId();
- Transition(State::kDeviceError);
- }
- // WriteCancelComplete is the callback from writing a cancellation message. Its
- // primary purpose is to hold a reference to the HidConnection so that the write
- // doesn't get discarded. It's a static function because it may be called after
- // the destruction of the |FidoHidDevice| that created it.
- // static
- void FidoHidDevice::WriteCancelComplete(
- scoped_refptr<FidoHidDevice::RefCountedHidConnection> connection,
- bool success) {
- if (!success) {
- FIDO_LOG(ERROR) << "Failed to write Cancel message";
- }
- }
- void FidoHidDevice::WriteCancel() {
- FidoHidInitPacket cancel(channel_id_, FidoHidDeviceCommand::kCancel, {},
- /*payload_length=*/0);
- std::vector<uint8_t> cancel_packet = cancel.GetSerializedData();
- DCHECK_LE(cancel_packet.size(), output_report_size_);
- cancel_packet.resize(output_report_size_, 0);
- // This |FidoHidDevice| might be destructed immediately after this call. On
- // Windows, pending writes are dropped when the |HidConnection| is destructed.
- // Since it's important that the Cancel message actually gets written, this
- // callback takes a reference to the HidConnection to hold it open at least
- // until the Write completes.
- //
- // Note that, if this object is in the process of a multi-packet write that
- // will eventually be canceled, the packet sequence will still be truncated
- // when this object is destroyed. Fixing that would involve reference counting
- // this object itself.
- connection_->data->Write(kReportId, std::move(cancel_packet),
- base::BindOnce(WriteCancelComplete, connection_));
- }
- // VidPidToString returns the device's vendor and product IDs as formatted by
- // the lsusb utility.
- static std::string VidPidToString(const mojom::HidDeviceInfoPtr& device_info) {
- static_assert(sizeof(device_info->vendor_id) == 2,
- "vendor_id must be uint16_t");
- static_assert(sizeof(device_info->product_id) == 2,
- "product_id must be uint16_t");
- uint16_t vendor_id = ((device_info->vendor_id & 0xff) << 8) |
- ((device_info->vendor_id & 0xff00) >> 8);
- uint16_t product_id = ((device_info->product_id & 0xff) << 8) |
- ((device_info->product_id & 0xff00) >> 8);
- return base::ToLowerASCII(base::HexEncode(&vendor_id, 2) + ":" +
- base::HexEncode(&product_id, 2));
- }
- std::string FidoHidDevice::GetDisplayName() const {
- return "usb-" + VidPidToString(device_info_);
- }
- std::string FidoHidDevice::GetId() const {
- return GetIdForDevice(*device_info_);
- }
- FidoTransportProtocol FidoHidDevice::DeviceTransport() const {
- return FidoTransportProtocol::kUsbHumanInterfaceDevice;
- }
- void FidoHidDevice::DiscoverSupportedProtocolAndDeviceInfo(
- base::OnceClosure done) {
- // The following devices cannot handle GetInfo messages.
- static constexpr auto kForceU2fCompatibilitySet =
- base::MakeFixedFlatSet<base::StringPiece>({
- "10c4:8acf", // U2F Zero
- "20a0:4287", // Nitrokey FIDO U2F
- });
- if (base::Contains(kForceU2fCompatibilitySet, VidPidToString(device_info_))) {
- supported_protocol_ = ProtocolVersion::kU2f;
- DCHECK(SupportedProtocolIsInitialized());
- std::move(done).Run();
- return;
- }
- FidoDevice::DiscoverSupportedProtocolAndDeviceInfo(std::move(done));
- }
- // static
- std::string FidoHidDevice::GetIdForDevice(
- const device::mojom::HidDeviceInfo& device_info) {
- return "hid:" + device_info.guid;
- }
- base::WeakPtr<FidoDevice> FidoHidDevice::GetWeakPtr() {
- return weak_factory_.GetWeakPtr();
- }
- } // namespace device
|