mirror of
git://git.gnupg.org/gnupg.git
synced 2024-05-29 21:58:04 +02:00
2f761251c5
* tools/card-yubikey.c (yubikey_commands): Add new arg INFO and test for Yubikey-5. * tools/gpg-card.c (cmd_yubikey): Pass info to yubikey_commands. -- The configuration can be read from a Yubikey-4 but not be written. The mode command is also not useful because it allows only the selection of transports. It does not allow to disable single applications based on one transport (like OPGP and PIV). Thsi patch shows an appropriate error message. Signed-off-by: Werner Koch <wk@gnupg.org>
447 lines
14 KiB
C
447 lines
14 KiB
C
/* card-yubikey.c - Yubikey specific functions.
|
|
* Copyright (C) 2019 g10 Code GmbH
|
|
*
|
|
* This file is part of GnuPG.
|
|
*
|
|
* GnuPG is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* GnuPG is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, see <https://www.gnu.org/licenses/>.
|
|
* SPDX-License-Identifier: GPL-3.0-or-later
|
|
*/
|
|
|
|
#include <config.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <errno.h>
|
|
#include <unistd.h>
|
|
|
|
#include "../common/util.h"
|
|
#include "../common/i18n.h"
|
|
#include "../common/tlv.h"
|
|
#include "../common/ttyio.h"
|
|
#include "gpg-card.h"
|
|
|
|
|
|
/* Object to describe requested interface options. */
|
|
struct iface_s {
|
|
unsigned int usb:1;
|
|
unsigned int nfc:1;
|
|
};
|
|
|
|
|
|
/* Bit flags as used by the fields in struct ykapps_s. */
|
|
#define YKAPP_USB_SUPPORTED 0x01
|
|
#define YKAPP_USB_ENABLED 0x02
|
|
#define YKAPP_NFC_SUPPORTED 0x04
|
|
#define YKAPP_NFC_ENABLED 0x08
|
|
#define YKAPP_SELECTED 0x80 /* Selected by the command. */
|
|
|
|
/* An object to describe the applications on a Yubikey. Each field
|
|
* has 8 bits to hold the above flag values. */
|
|
struct ykapps_s {
|
|
unsigned int otp:8;
|
|
unsigned int u2f:8;
|
|
unsigned int opgp:8;
|
|
unsigned int piv:8;
|
|
unsigned int oath:8;
|
|
unsigned int fido2:8;
|
|
};
|
|
|
|
|
|
|
|
/* Helper to parse an unsigned integer config value consisting of bit
|
|
* flags. TAG select the config item and MASK is the mask ORed into
|
|
* the value for a set bit. The function modifies YK. */
|
|
static gpg_error_t
|
|
parse_ul_config_value (struct ykapps_s *yk,
|
|
const unsigned char *config, size_t configlen,
|
|
int tag, unsigned int mask)
|
|
{
|
|
const unsigned char *s;
|
|
size_t n;
|
|
unsigned long ul = 0;
|
|
int i;
|
|
|
|
s = find_tlv (config, configlen, tag, &n);
|
|
if (s && n)
|
|
{
|
|
if (n > sizeof ul)
|
|
{
|
|
log_error ("too large integer in Yubikey config tag %02x detected\n",
|
|
tag);
|
|
if (opt.verbose)
|
|
log_printhex (config, configlen, "config:");
|
|
return gpg_error (GPG_ERR_CARD);
|
|
}
|
|
for (i=0; i < n; i++)
|
|
{
|
|
ul <<=8;
|
|
ul |= s[i];
|
|
}
|
|
if (ul & 0x01)
|
|
yk->otp |= mask;
|
|
if (ul & 0x02)
|
|
yk->u2f |= mask;
|
|
if (ul & 0x08)
|
|
yk->opgp |= mask;
|
|
if (ul & 0x10)
|
|
yk->piv |= mask;
|
|
if (ul & 0x20)
|
|
yk->oath |= mask;
|
|
if (ul & 0x200)
|
|
yk->fido2 |= mask;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
|
|
/* Create an unsigned integer config value for TAG from the data in YK
|
|
* and store it the provided 4 byte buffer RESULT. If ENABLE is true
|
|
* the respective APP_SELECTED bit in YK sets the corresponding bit
|
|
* flags, it is is false that bit flag is cleared. IF APP_SELECTED is
|
|
* not set the bit flag is not changed. */
|
|
static void
|
|
set_ul_config_value (struct ykapps_s *yk,
|
|
unsigned int bitflag, int tag, unsigned int enable,
|
|
unsigned char *result)
|
|
{
|
|
unsigned long ul = 0;
|
|
|
|
/* First set the current values. */
|
|
if ((yk->otp & bitflag))
|
|
ul |= 0x01;
|
|
if ((yk->u2f & bitflag))
|
|
ul |= 0x02;
|
|
if ((yk->opgp & bitflag))
|
|
ul |= 0x08;
|
|
if ((yk->piv & bitflag))
|
|
ul |= 0x10;
|
|
if ((yk->oath & bitflag))
|
|
ul |= 0x20;
|
|
if ((yk->fido2 & bitflag))
|
|
ul |= 0x200;
|
|
|
|
/* Then enable or disable the bits according to the selection flag. */
|
|
if (enable)
|
|
{
|
|
if ((yk->otp & YKAPP_SELECTED))
|
|
ul |= 0x01;
|
|
if ((yk->u2f & YKAPP_SELECTED))
|
|
ul |= 0x02;
|
|
if ((yk->opgp & YKAPP_SELECTED))
|
|
ul |= 0x08;
|
|
if ((yk->piv & YKAPP_SELECTED))
|
|
ul |= 0x10;
|
|
if ((yk->oath & YKAPP_SELECTED))
|
|
ul |= 0x20;
|
|
if ((yk->fido2 & YKAPP_SELECTED))
|
|
ul |= 0x200;
|
|
}
|
|
else
|
|
{
|
|
if ((yk->otp & YKAPP_SELECTED))
|
|
ul &= ~0x01;
|
|
if ((yk->u2f & YKAPP_SELECTED))
|
|
ul &= ~0x02;
|
|
if ((yk->opgp & YKAPP_SELECTED))
|
|
ul &= ~0x08;
|
|
if ((yk->piv & YKAPP_SELECTED))
|
|
ul &= ~0x10;
|
|
if ((yk->oath & YKAPP_SELECTED))
|
|
ul &= ~0x20;
|
|
if ((yk->fido2 & YKAPP_SELECTED))
|
|
ul &= ~0x200;
|
|
}
|
|
|
|
/* Make sure that we do not disable the CCID transport. Without
|
|
* CCID we won't have any way to change the configuration again. We
|
|
* would instead need one of the other Yubikey tools to enable an
|
|
* application and thus its transport again. */
|
|
if (bitflag == YKAPP_USB_ENABLED && !(ul & (0x08|0x10|0x20)))
|
|
{
|
|
log_info ("Enabling PIV to have at least one CCID transport\n");
|
|
ul |= 0x10;
|
|
}
|
|
|
|
result[0] = tag;
|
|
result[1] = 2;
|
|
result[2] = ul >> 8;
|
|
result[3] = ul;
|
|
}
|
|
|
|
|
|
/* Print the info from YK. */
|
|
static void
|
|
yk_list (estream_t fp, struct ykapps_s *yk)
|
|
{
|
|
if (opt.interactive)
|
|
tty_fprintf (fp, ("Application USB NFC\n"
|
|
"-----------------------\n"));
|
|
tty_fprintf (fp, "OTP %s %s\n",
|
|
(yk->otp & YKAPP_USB_SUPPORTED)?
|
|
(yk->otp & YKAPP_USB_ENABLED? "yes" : "no ") : "- ",
|
|
(yk->otp & YKAPP_NFC_SUPPORTED)?
|
|
(yk->otp & YKAPP_NFC_ENABLED? "yes" : "no ") : "- ");
|
|
tty_fprintf (fp, "U2F %s %s\n",
|
|
(yk->otp & YKAPP_USB_SUPPORTED)?
|
|
(yk->otp & YKAPP_USB_ENABLED? "yes" : "no ") : "- ",
|
|
(yk->otp & YKAPP_NFC_SUPPORTED)?
|
|
(yk->otp & YKAPP_NFC_ENABLED? "yes" : "no ") : "- ");
|
|
tty_fprintf (fp, "OPGP %s %s\n",
|
|
(yk->opgp & YKAPP_USB_SUPPORTED)?
|
|
(yk->opgp & YKAPP_USB_ENABLED? "yes" : "no ") : "- ",
|
|
(yk->opgp & YKAPP_NFC_SUPPORTED)?
|
|
(yk->opgp & YKAPP_NFC_ENABLED? "yes" : "no ") : "- ");
|
|
tty_fprintf (fp, "PIV %s %s\n",
|
|
(yk->piv & YKAPP_USB_SUPPORTED)?
|
|
(yk->piv & YKAPP_USB_ENABLED? "yes" : "no ") : "- ",
|
|
(yk->piv & YKAPP_NFC_SUPPORTED)?
|
|
(yk->piv & YKAPP_NFC_ENABLED? "yes" : "no ") : "- ");
|
|
tty_fprintf (fp, "OATH %s %s\n",
|
|
(yk->oath & YKAPP_USB_SUPPORTED)?
|
|
(yk->oath & YKAPP_USB_ENABLED? "yes" : "no ") : "- ",
|
|
(yk->oath & YKAPP_NFC_SUPPORTED)?
|
|
(yk->oath & YKAPP_NFC_ENABLED? "yes" : "no ") : "- ");
|
|
tty_fprintf (fp, "FIDO2 %s %s\n",
|
|
(yk->fido2 & YKAPP_USB_SUPPORTED)?
|
|
(yk->fido2 & YKAPP_USB_ENABLED? "yes" : "no ") : "- ",
|
|
(yk->fido2 & YKAPP_NFC_SUPPORTED)?
|
|
(yk->fido2 & YKAPP_NFC_ENABLED? "yes" : "no ") : "- ");
|
|
}
|
|
|
|
|
|
/* Enable disable the apps as marked in YK with flag YKAPP_SELECTED. */
|
|
static gpg_error_t
|
|
yk_enable_disable (struct ykapps_s *yk, struct iface_s *iface,
|
|
const unsigned char *config, size_t configlen, int enable)
|
|
{
|
|
gpg_error_t err = 0;
|
|
unsigned char apdu[100];
|
|
unsigned int apdulen;
|
|
/* const unsigned char *s; */
|
|
/* size_t n; */
|
|
char *hexapdu = NULL;
|
|
|
|
apdulen = 0;
|
|
apdu[apdulen++] = 0x00;
|
|
apdu[apdulen++] = 0x1c; /* Write Config instruction. */
|
|
apdu[apdulen++] = 0x00;
|
|
apdu[apdulen++] = 0x00;
|
|
apdu[apdulen++] = 0x00; /* Lc will be fixed up later. */
|
|
apdu[apdulen++] = 0x00; /* Length of data will also be fixed up later. */
|
|
|
|
/* The ykman tool has no way to set NFC and USB flags in one go.
|
|
* Reasoning about the Yubikey's firmware it seems plausible that
|
|
* combining should work. Let's try it here if the user called for
|
|
* setting both interfaces. */
|
|
if (iface->nfc)
|
|
{
|
|
set_ul_config_value (yk, YKAPP_NFC_ENABLED, 0x0e, enable, apdu+apdulen);
|
|
apdulen += 4;
|
|
}
|
|
if (iface->usb)
|
|
{
|
|
set_ul_config_value (yk, YKAPP_USB_ENABLED, 0x03, enable, apdu+apdulen);
|
|
apdulen += 4;
|
|
/* Yubikey's ykman copies parts of the config data when writing
|
|
* the config for USB. Below is a commented example on how that
|
|
* can be done. */
|
|
(void)config;
|
|
(void)configlen;
|
|
/* Copy the device flags. */
|
|
/* s = find_tlv (config, configlen, 0x08, &n); */
|
|
/* if (s && n) */
|
|
/* { */
|
|
/* s -= 2; */
|
|
/* n += 2; */
|
|
/* if (apdulen + n > sizeof apdu) */
|
|
/* { */
|
|
/* err = gpg_error (GPG_ERR_BUFFER_TOO_SHORT); */
|
|
/* goto leave; */
|
|
/* } */
|
|
/* memcpy (apdu+apdulen, s, n); */
|
|
/* apdulen += n; */
|
|
/* } */
|
|
}
|
|
if (iface->nfc || iface->usb)
|
|
{
|
|
if (apdulen + 2 > sizeof apdu)
|
|
{
|
|
err = gpg_error (GPG_ERR_BUFFER_TOO_SHORT);
|
|
goto leave;
|
|
}
|
|
/* Disable the next two lines to let the card reboot. Not doing
|
|
* this is however more convenient for this tool because further
|
|
* commands don't end up with an error. It seems to be better
|
|
* that a "reset" command from gpg-card-tool is run at the
|
|
* user's discretion. */
|
|
/* apdu[apdulen++] = 0x0c; /\* Reboot tag *\/ */
|
|
/* apdu[apdulen++] = 0; /\* No data for reboot. *\/ */
|
|
/* Fixup the lngth bytes. */
|
|
apdu[4] = apdulen - 6 + 1;
|
|
apdu[5] = apdulen - 6;
|
|
|
|
hexapdu = bin2hex (apdu, apdulen, NULL);
|
|
if (!hexapdu)
|
|
err = gpg_error_from_syserror ();
|
|
else
|
|
err = send_apdu (hexapdu, "YK.write_config", 0, NULL, NULL);
|
|
}
|
|
|
|
leave:
|
|
xfree (hexapdu);
|
|
return err;
|
|
}
|
|
|
|
|
|
/* Implementation part of cmd_yubikey. ARGV is an array of size ARGc
|
|
* with the argumets given to the yubikey command. Note that ARGV has
|
|
* no terminating NULL so that ARGC must be considred. FP is the
|
|
* stream to output information. This function must only be called on
|
|
* Yubikeys. */
|
|
gpg_error_t
|
|
yubikey_commands (card_info_t info, estream_t fp, int argc, char *argv[])
|
|
{
|
|
gpg_error_t err;
|
|
enum {ykLIST, ykENABLE, ykDISABLE } cmd;
|
|
struct iface_s iface = {0,0};
|
|
struct ykapps_s ykapps = {0};
|
|
unsigned char *config = NULL;
|
|
size_t configlen;
|
|
int i;
|
|
|
|
if (!argc)
|
|
return gpg_error (GPG_ERR_SYNTAX);
|
|
|
|
/* Parse command. */
|
|
if (!ascii_strcasecmp (argv[0], "list"))
|
|
cmd = ykLIST;
|
|
else if (!ascii_strcasecmp (argv[0], "enable"))
|
|
cmd = ykENABLE;
|
|
else if (!ascii_strcasecmp (argv[0], "disable"))
|
|
cmd = ykDISABLE;
|
|
else
|
|
{
|
|
err = gpg_error (GPG_ERR_UNKNOWN_COMMAND);
|
|
goto leave;
|
|
}
|
|
|
|
if (info->cardversion < 0x050000 && cmd != ykLIST)
|
|
{
|
|
log_info ("Sub-command '%s' is only support by Yubikey-5 and later\n",
|
|
argv[0]);
|
|
err = gpg_error (GPG_ERR_NOT_SUPPORTED);
|
|
goto leave;
|
|
}
|
|
|
|
/* Parse interface if needed. */
|
|
if (cmd == ykLIST)
|
|
iface.usb = iface.nfc = 1;
|
|
else if (argc < 2)
|
|
{
|
|
err = gpg_error (GPG_ERR_SYNTAX);
|
|
goto leave;
|
|
}
|
|
else if (!ascii_strcasecmp (argv[1], "usb"))
|
|
iface.usb = 1;
|
|
else if (!ascii_strcasecmp (argv[1], "nfc"))
|
|
iface.nfc = 1;
|
|
else if (!ascii_strcasecmp (argv[1], "all") || !strcmp (argv[1], "*"))
|
|
iface.usb = iface.nfc = 1;
|
|
else
|
|
{
|
|
err = gpg_error (GPG_ERR_SYNTAX);
|
|
goto leave;
|
|
}
|
|
|
|
/* Parse list of applications. */
|
|
for (i=2; i < argc; i++)
|
|
{
|
|
if (!ascii_strcasecmp (argv[i], "otp"))
|
|
ykapps.otp = 0x80;
|
|
else if (!ascii_strcasecmp (argv[i], "u2f"))
|
|
ykapps.u2f = 0x80;
|
|
else if (!ascii_strcasecmp (argv[i], "opgp")
|
|
||!ascii_strcasecmp (argv[i], "openpgp"))
|
|
ykapps.opgp = 0x80;
|
|
else if (!ascii_strcasecmp (argv[i], "piv"))
|
|
ykapps.piv = 0x80;
|
|
else if (!ascii_strcasecmp (argv[i], "oath")
|
|
|| !ascii_strcasecmp (argv[i], "oauth"))
|
|
ykapps.oath = 0x80;
|
|
else if (!ascii_strcasecmp (argv[i], "fido2"))
|
|
ykapps.fido2 = 0x80;
|
|
else if (!ascii_strcasecmp (argv[i], "all")|| !strcmp (argv[i], "*"))
|
|
{
|
|
ykapps.otp = ykapps.u2f = ykapps.opgp = ykapps.piv = ykapps.oath
|
|
= ykapps.fido2 = 0x80;
|
|
}
|
|
else
|
|
{
|
|
err = gpg_error (GPG_ERR_SYNTAX);
|
|
goto leave;
|
|
}
|
|
}
|
|
|
|
/* Select the Yubikey Manager application. */
|
|
err = send_apdu ("00A4040008a000000527471117", "Select.YK-Manager", 0,
|
|
NULL, NULL);
|
|
if (err)
|
|
goto leave;
|
|
/* Send the read config command. */
|
|
err = send_apdu ("001D000000", "YK.read_config", 0, &config, &configlen);
|
|
if (err)
|
|
goto leave;
|
|
if (!configlen || *config > configlen - 1)
|
|
{
|
|
/* The length byte is shorter than the actual length. */
|
|
log_error ("Yubikey returned improper config data\n");
|
|
log_printhex (config, configlen, "config:");
|
|
err = gpg_error (GPG_ERR_CARD);
|
|
goto leave;
|
|
}
|
|
if (configlen-1 > *config)
|
|
{
|
|
log_info ("Extra config data ignored\n");
|
|
log_printhex (config, configlen, "config:");
|
|
}
|
|
configlen = *config;
|
|
|
|
err = parse_ul_config_value (&ykapps, config+1, configlen,
|
|
0x01, YKAPP_USB_SUPPORTED);
|
|
if (!err)
|
|
err = parse_ul_config_value (&ykapps, config+1, configlen,
|
|
0x03, YKAPP_USB_ENABLED);
|
|
if (!err)
|
|
err = parse_ul_config_value (&ykapps, config+1, configlen,
|
|
0x0d, YKAPP_NFC_SUPPORTED);
|
|
if (!err)
|
|
err = parse_ul_config_value (&ykapps, config+1, configlen,
|
|
0x0e, YKAPP_NFC_ENABLED);
|
|
if (err)
|
|
goto leave;
|
|
|
|
switch (cmd)
|
|
{
|
|
case ykLIST: yk_list (fp, &ykapps); break;
|
|
case ykENABLE: err = yk_enable_disable (&ykapps, &iface,
|
|
config+1, configlen, 1); break;
|
|
case ykDISABLE: err = yk_enable_disable (&ykapps, &iface,
|
|
config+1, configlen, 0); break;
|
|
}
|
|
|
|
leave:
|
|
xfree (config);
|
|
return err;
|
|
}
|