libcrypt,
libopenssl,
libfdisk,
- libp11kit,
- libfido2],
+ libp11kit],
install_rpath : rootlibexecdir,
install : true,
install_dir : rootlibexecdir)
libcrypt,
libopenssl,
libp11kit,
- libfido2,
libdl],
install_rpath : rootlibexecdir,
install : true,
#include "homectl-fido2.h"
#include "homectl-pkcs11.h"
#include "libcrypt-util.h"
+#include "libfido2-util.h"
#include "locale-util.h"
#include "memory-util.h"
#include "random-util.h"
const char *device) {
#if HAVE_LIBFIDO2
- _cleanup_(fido_cbor_info_free) fido_cbor_info_t *di = NULL;
- _cleanup_(fido_assert_free) fido_assert_t *a = NULL;
+ _cleanup_(fido_cbor_info_free_wrapper) fido_cbor_info_t *di = NULL;
+ _cleanup_(fido_assert_free_wrapper) fido_assert_t *a = NULL;
+ _cleanup_(fido_cred_free_wrapper) fido_cred_t *c = NULL;
+ _cleanup_(fido_dev_free_wrapper) fido_dev_t *d = NULL;
_cleanup_(erase_and_freep) char *used_pin = NULL;
- _cleanup_(fido_cred_free) fido_cred_t *c = NULL;
- _cleanup_(fido_dev_free) fido_dev_t *d = NULL;
_cleanup_(erase_and_freep) void *salt = NULL;
JsonVariant *un, *realm, *rn;
bool found_extension = false;
assert(v);
assert(device);
+ r = dlopen_libfido2();
+ if (r < 0)
+ return log_error_errno(r, "FIDO2 token support is not installed.");
+
salt = malloc(FIDO2_SALT_SIZE);
if (!salt)
return log_oom();
if (r < 0)
return log_error_errno(r, "Failed to generate salt: %m");
- d = fido_dev_new();
+ d = sym_fido_dev_new();
if (!d)
return log_oom();
- r = fido_dev_open(d, device);
+ r = sym_fido_dev_open(d, device);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to open FIDO2 device %s: %s", device, fido_strerr(r));
+ "Failed to open FIDO2 device %s: %s", device, sym_fido_strerr(r));
- if (!fido_dev_is_fido2(d))
+ if (!sym_fido_dev_is_fido2(d))
return log_error_errno(SYNTHETIC_ERRNO(ENODEV),
"Specified device %s is not a FIDO2 device.", device);
- di = fido_cbor_info_new();
+ di = sym_fido_cbor_info_new();
if (!di)
return log_oom();
- r = fido_dev_get_cbor_info(d, di);
+ r = sym_fido_dev_get_cbor_info(d, di);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to get CBOR device info for %s: %s", device, fido_strerr(r));
+ "Failed to get CBOR device info for %s: %s", device, sym_fido_strerr(r));
- e = fido_cbor_info_extensions_ptr(di);
- n = fido_cbor_info_extensions_len(di);
+ e = sym_fido_cbor_info_extensions_ptr(di);
+ n = sym_fido_cbor_info_extensions_len(di);
for (size_t i = 0; i < n; i++)
if (streq(e[i], "hmac-secret")) {
return log_error_errno(SYNTHETIC_ERRNO(ENODEV),
"Specified device %s is a FIDO2 device, but does not support the required HMAC-SECRET extension.", device);
- c = fido_cred_new();
+ c = sym_fido_cred_new();
if (!c)
return log_oom();
- r = fido_cred_set_extensions(c, FIDO_EXT_HMAC_SECRET);
+ r = sym_fido_cred_set_extensions(c, FIDO_EXT_HMAC_SECRET);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to enable HMAC-SECRET extension on FIDO2 credential: %s", fido_strerr(r));
+ "Failed to enable HMAC-SECRET extension on FIDO2 credential: %s", sym_fido_strerr(r));
- r = fido_cred_set_rp(c, "io.systemd.home", "Home Directory");
+ r = sym_fido_cred_set_rp(c, "io.systemd.home", "Home Directory");
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to set FIDO2 credential relying party ID/name: %s", fido_strerr(r));
+ "Failed to set FIDO2 credential relying party ID/name: %s", sym_fido_strerr(r));
- r = fido_cred_set_type(c, COSE_ES256);
+ r = sym_fido_cred_set_type(c, COSE_ES256);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to set FIDO2 credential type to ES256: %s", fido_strerr(r));
+ "Failed to set FIDO2 credential type to ES256: %s", sym_fido_strerr(r));
un = json_variant_by_key(*v, "userName");
if (!un)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"realName field of user record is not a string");
- r = fido_cred_set_user(c,
+ r = sym_fido_cred_set_user(c,
(const unsigned char*) fido_un, strlen(fido_un), /* We pass the user ID and name as the same */
fido_un,
rn ? json_variant_string(rn) : NULL,
NULL /* icon URL */);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to set FIDO2 credential user data: %s", fido_strerr(r));
+ "Failed to set FIDO2 credential user data: %s", sym_fido_strerr(r));
- r = fido_cred_set_clientdata_hash(c, (const unsigned char[32]) {}, 32);
+ r = sym_fido_cred_set_clientdata_hash(c, (const unsigned char[32]) {}, 32);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to set FIDO2 client data hash: %s", fido_strerr(r));
+ "Failed to set FIDO2 client data hash: %s", sym_fido_strerr(r));
- r = fido_cred_set_rk(c, FIDO_OPT_FALSE);
+ r = sym_fido_cred_set_rk(c, FIDO_OPT_FALSE);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to turn off FIDO2 resident key option of credential: %s", fido_strerr(r));
+ "Failed to turn off FIDO2 resident key option of credential: %s", sym_fido_strerr(r));
- r = fido_cred_set_uv(c, FIDO_OPT_FALSE);
+ r = sym_fido_cred_set_uv(c, FIDO_OPT_FALSE);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to turn off FIDO2 user verification option of credential: %s", fido_strerr(r));
+ "Failed to turn off FIDO2 user verification option of credential: %s", sym_fido_strerr(r));
log_info("Initializing FIDO2 credential on security token.");
emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "",
emoji_enabled() ? " " : "");
- r = fido_dev_make_cred(d, c, NULL);
+ r = sym_fido_dev_make_cred(d, c, NULL);
if (r == FIDO_ERR_PIN_REQUIRED) {
_cleanup_free_ char *text = NULL;
continue;
}
- r = fido_dev_make_cred(d, c, *i);
+ r = sym_fido_dev_make_cred(d, c, *i);
if (r == FIDO_OK) {
used_pin = strdup(*i);
if (!used_pin)
"Token action timeout. (User didn't interact with token quickly enough.)");
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to generate FIDO2 credential: %s", fido_strerr(r));
+ "Failed to generate FIDO2 credential: %s", sym_fido_strerr(r));
- cid = fido_cred_id_ptr(c);
+ cid = sym_fido_cred_id_ptr(c);
if (!cid)
return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to get FIDO2 credential ID.");
- cid_size = fido_cred_id_len(c);
+ cid_size = sym_fido_cred_id_len(c);
- a = fido_assert_new();
+ a = sym_fido_assert_new();
if (!a)
return log_oom();
- r = fido_assert_set_extensions(a, FIDO_EXT_HMAC_SECRET);
+ r = sym_fido_assert_set_extensions(a, FIDO_EXT_HMAC_SECRET);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to enable HMAC-SECRET extension on FIDO2 assertion: %s", fido_strerr(r));
+ "Failed to enable HMAC-SECRET extension on FIDO2 assertion: %s", sym_fido_strerr(r));
- r = fido_assert_set_hmac_salt(a, salt, FIDO2_SALT_SIZE);
+ r = sym_fido_assert_set_hmac_salt(a, salt, FIDO2_SALT_SIZE);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to set salt on FIDO2 assertion: %s", fido_strerr(r));
+ "Failed to set salt on FIDO2 assertion: %s", sym_fido_strerr(r));
- r = fido_assert_set_rp(a, "io.systemd.home");
+ r = sym_fido_assert_set_rp(a, "io.systemd.home");
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to set FIDO2 assertion ID: %s", fido_strerr(r));
+ "Failed to set FIDO2 assertion ID: %s", sym_fido_strerr(r));
- r = fido_assert_set_clientdata_hash(a, (const unsigned char[32]) {}, 32);
+ r = sym_fido_assert_set_clientdata_hash(a, (const unsigned char[32]) {}, 32);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to set FIDO2 assertion client data hash: %s", fido_strerr(r));
+ "Failed to set FIDO2 assertion client data hash: %s", sym_fido_strerr(r));
- r = fido_assert_allow_cred(a, cid, cid_size);
+ r = sym_fido_assert_allow_cred(a, cid, cid_size);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to add FIDO2 assertion credential ID: %s", fido_strerr(r));
+ "Failed to add FIDO2 assertion credential ID: %s", sym_fido_strerr(r));
- r = fido_assert_set_up(a, FIDO_OPT_FALSE);
+ r = sym_fido_assert_set_up(a, FIDO_OPT_FALSE);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to turn off FIDO2 assertion user presence: %s", fido_strerr(r));
+ "Failed to turn off FIDO2 assertion user presence: %s", sym_fido_strerr(r));
log_info("Generating secret key on FIDO2 security token.");
- r = fido_dev_get_assert(d, a, used_pin);
+ r = sym_fido_dev_get_assert(d, a, used_pin);
if (r == FIDO_ERR_UP_REQUIRED) {
- r = fido_assert_set_up(a, FIDO_OPT_TRUE);
+ r = sym_fido_assert_set_up(a, FIDO_OPT_TRUE);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to turn on FIDO2 assertion user presence: %s", fido_strerr(r));
+ "Failed to turn on FIDO2 assertion user presence: %s", sym_fido_strerr(r));
log_notice("%s%sIn order to allow secret key generation, please verify presence on security token.",
emoji_enabled() ? special_glyph(SPECIAL_GLYPH_TOUCH) : "",
emoji_enabled() ? " " : "");
- r = fido_dev_get_assert(d, a, used_pin);
+ r = sym_fido_dev_get_assert(d, a, used_pin);
}
if (r == FIDO_ERR_ACTION_TIMEOUT)
return log_error_errno(SYNTHETIC_ERRNO(ENOSTR),
"Token action timeout. (User didn't interact with token quickly enough.)");
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to ask token for assertion: %s", fido_strerr(r));
+ "Failed to ask token for assertion: %s", sym_fido_strerr(r));
- secret = fido_assert_hmac_secret_ptr(a, 0);
+ secret = sym_fido_assert_hmac_secret_ptr(a, 0);
if (!secret)
return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to retrieve HMAC secret.");
- secret_size = fido_assert_hmac_secret_len(a, 0);
+ secret_size = sym_fido_assert_hmac_secret_len(a, 0);
r = add_fido2_credential_id(v, cid, cid_size);
if (r < 0)
fido_dev_info_t *di = NULL;
int r;
- di = fido_dev_info_new(allocated);
+ r = dlopen_libfido2();
+ if (r < 0)
+ return log_error_errno(r, "FIDO2 token support is not installed.");
+
+ di = sym_fido_dev_info_new(allocated);
if (!di)
return log_oom();
- r = fido_dev_info_manifest(di, allocated, &found);
+ r = sym_fido_dev_info_manifest(di, allocated, &found);
if (r == FIDO_ERR_INTERNAL || (r == FIDO_OK && found == 0)) {
/* The library returns FIDO_ERR_INTERNAL when no devices are found. I wish it wouldn't. */
log_info("No FIDO2 devices found.");
goto finish;
}
if (r != FIDO_OK) {
- r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", fido_strerr(r));
+ r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", sym_fido_strerr(r));
goto finish;
}
for (size_t i = 0; i < found; i++) {
const fido_dev_info_t *entry;
- entry = fido_dev_info_ptr(di, i);
+ entry = sym_fido_dev_info_ptr(di, i);
if (!entry) {
r = log_error_errno(SYNTHETIC_ERRNO(EIO),
"Failed to get device information for FIDO device %zu.", i);
r = table_add_many(
t,
- TABLE_PATH, fido_dev_info_path(entry),
- TABLE_STRING, fido_dev_info_manufacturer_string(entry),
- TABLE_STRING, fido_dev_info_product_string(entry));
+ TABLE_PATH, sym_fido_dev_info_path(entry),
+ TABLE_STRING, sym_fido_dev_info_manufacturer_string(entry),
+ TABLE_STRING, sym_fido_dev_info_product_string(entry));
if (r < 0) {
table_log_add_error(r);
goto finish;
r = 0;
finish:
- fido_dev_info_free(&di, allocated);
+ sym_fido_dev_info_free(&di, allocated);
return r;
#else
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
const char *path;
int r;
- di = fido_dev_info_new(di_size);
+ r = dlopen_libfido2();
+ if (r < 0)
+ return log_error_errno(r, "FIDO2 token support is not installed.");
+
+ di = sym_fido_dev_info_new(di_size);
if (!di)
return log_oom();
- r = fido_dev_info_manifest(di, di_size, &found);
+ r = sym_fido_dev_info_manifest(di, di_size, &found);
if (r == FIDO_ERR_INTERNAL || (r == FIDO_OK && found == 0)) {
/* The library returns FIDO_ERR_INTERNAL when no devices are found. I wish it wouldn't. */
r = log_error_errno(SYNTHETIC_ERRNO(ENODEV), "No FIDO2 devices found.");
goto finish;
}
if (r != FIDO_OK) {
- r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", fido_strerr(r));
+ r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", sym_fido_strerr(r));
goto finish;
}
if (found > 1) {
goto finish;
}
- entry = fido_dev_info_ptr(di, 0);
+ entry = sym_fido_dev_info_ptr(di, 0);
if (!entry) {
r = log_error_errno(SYNTHETIC_ERRNO(EIO),
"Failed to get device information for FIDO device 0.");
goto finish;
}
- path = fido_dev_info_path(entry);
+ path = sym_fido_dev_info_path(entry);
if (!path) {
r = log_error_errno(SYNTHETIC_ERRNO(EIO),
"Failed to query FIDO device path.");
r = 0;
finish:
- fido_dev_info_free(&di, di_size);
+ sym_fido_dev_info_free(&di, di_size);
return r;
#else
return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
#include "hexdecoct.h"
#include "homework-fido2.h"
+#include "libfido2-util.h"
#include "strv.h"
static int fido2_use_specific_token(
const Fido2HmacSalt *salt,
char **ret) {
- _cleanup_(fido_cbor_info_free) fido_cbor_info_t *di = NULL;
- _cleanup_(fido_assert_free) fido_assert_t *a = NULL;
- _cleanup_(fido_dev_free) fido_dev_t *d = NULL;
+ _cleanup_(fido_cbor_info_free_wrapper) fido_cbor_info_t *di = NULL;
+ _cleanup_(fido_assert_free_wrapper) fido_assert_t *a = NULL;
+ _cleanup_(fido_dev_free_wrapper) fido_dev_t *d = NULL;
bool found_extension = false;
size_t n, hmac_size;
const void *hmac;
char **e;
int r;
- d = fido_dev_new();
+ d = sym_fido_dev_new();
if (!d)
return log_oom();
- r = fido_dev_open(d, path);
+ r = sym_fido_dev_open(d, path);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to open FIDO2 device %s: %s", path, fido_strerr(r));
+ "Failed to open FIDO2 device %s: %s", path, sym_fido_strerr(r));
- if (!fido_dev_is_fido2(d))
+ if (!sym_fido_dev_is_fido2(d))
return log_error_errno(SYNTHETIC_ERRNO(ENODEV),
"Specified device %s is not a FIDO2 device.", path);
- di = fido_cbor_info_new();
+ di = sym_fido_cbor_info_new();
if (!di)
return log_oom();
- r = fido_dev_get_cbor_info(d, di);
+ r = sym_fido_dev_get_cbor_info(d, di);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to get CBOR device info for %s: %s", path, fido_strerr(r));
+ "Failed to get CBOR device info for %s: %s", path, sym_fido_strerr(r));
- e = fido_cbor_info_extensions_ptr(di);
- n = fido_cbor_info_extensions_len(di);
+ e = sym_fido_cbor_info_extensions_ptr(di);
+ n = sym_fido_cbor_info_extensions_len(di);
for (size_t i = 0; i < n; i++)
if (streq(e[i], "hmac-secret")) {
return log_error_errno(SYNTHETIC_ERRNO(ENODEV),
"Specified device %s is a FIDO2 device, but does not support the required HMAC-SECRET extension.", path);
- a = fido_assert_new();
+ a = sym_fido_assert_new();
if (!a)
return log_oom();
- r = fido_assert_set_extensions(a, FIDO_EXT_HMAC_SECRET);
+ r = sym_fido_assert_set_extensions(a, FIDO_EXT_HMAC_SECRET);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to enable HMAC-SECRET extension on FIDO2 assertion: %s", fido_strerr(r));
+ "Failed to enable HMAC-SECRET extension on FIDO2 assertion: %s", sym_fido_strerr(r));
- r = fido_assert_set_hmac_salt(a, salt->salt, salt->salt_size);
+ r = sym_fido_assert_set_hmac_salt(a, salt->salt, salt->salt_size);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to set salt on FIDO2 assertion: %s", fido_strerr(r));
+ "Failed to set salt on FIDO2 assertion: %s", sym_fido_strerr(r));
- r = fido_assert_set_rp(a, "io.systemd.home");
+ r = sym_fido_assert_set_rp(a, "io.systemd.home");
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to set FIDO2 assertion ID: %s", fido_strerr(r));
+ "Failed to set FIDO2 assertion ID: %s", sym_fido_strerr(r));
- r = fido_assert_set_clientdata_hash(a, (const unsigned char[32]) {}, 32);
+ r = sym_fido_assert_set_clientdata_hash(a, (const unsigned char[32]) {}, 32);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to set FIDO2 assertion client data hash: %s", fido_strerr(r));
+ "Failed to set FIDO2 assertion client data hash: %s", sym_fido_strerr(r));
- r = fido_assert_allow_cred(a, salt->credential.id, salt->credential.size);
+ r = sym_fido_assert_allow_cred(a, salt->credential.id, salt->credential.size);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to add FIDO2 assertion credential ID: %s", fido_strerr(r));
+ "Failed to add FIDO2 assertion credential ID: %s", sym_fido_strerr(r));
- r = fido_assert_set_up(a, h->fido2_user_presence_permitted <= 0 ? FIDO_OPT_FALSE : FIDO_OPT_TRUE);
+ r = sym_fido_assert_set_up(a, h->fido2_user_presence_permitted <= 0 ? FIDO_OPT_FALSE : FIDO_OPT_TRUE);
if (r != FIDO_OK)
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to set FIDO2 assertion user presence: %s", fido_strerr(r));
+ "Failed to set FIDO2 assertion user presence: %s", sym_fido_strerr(r));
log_info("Asking FIDO2 token for authentication.");
- r = fido_dev_get_assert(d, a, NULL); /* try without pin first */
+ r = sym_fido_dev_get_assert(d, a, NULL); /* try without pin first */
if (r == FIDO_ERR_PIN_REQUIRED) {
char **i;
/* OK, we needed a pin, try with all pins in turn */
STRV_FOREACH(i, secret->token_pin) {
- r = fido_dev_get_assert(d, a, *i);
+ r = sym_fido_dev_get_assert(d, a, *i);
if (r != FIDO_ERR_PIN_INVALID)
break;
}
"Token action timeout. (User didn't interact with token quickly enough.)");
default:
return log_error_errno(SYNTHETIC_ERRNO(EIO),
- "Failed to ask token for assertion: %s", fido_strerr(r));
+ "Failed to ask token for assertion: %s", sym_fido_strerr(r));
}
- hmac = fido_assert_hmac_secret_ptr(a, 0);
+ hmac = sym_fido_assert_hmac_secret_ptr(a, 0);
if (!hmac)
return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to retrieve HMAC secret.");
- hmac_size = fido_assert_hmac_secret_len(a, 0);
+ hmac_size = sym_fido_assert_hmac_secret_len(a, 0);
r = base64mem(hmac, hmac_size, ret);
if (r < 0)
fido_dev_info_t *di = NULL;
int r;
- di = fido_dev_info_new(allocated);
+ r = dlopen_libfido2();
+ if (r < 0)
+ return log_error_errno(r, "FIDO2 support is not installed.");
+
+ di = sym_fido_dev_info_new(allocated);
if (!di)
return log_oom();
- r = fido_dev_info_manifest(di, allocated, &found);
+ r = sym_fido_dev_info_manifest(di, allocated, &found);
if (r == FIDO_ERR_INTERNAL) {
/* The library returns FIDO_ERR_INTERNAL when no devices are found. I wish it wouldn't. */
r = log_debug_errno(SYNTHETIC_ERRNO(EAGAIN), "Got FIDO_ERR_INTERNAL, assuming no devices.");
goto finish;
}
if (r != FIDO_OK) {
- r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", fido_strerr(r));
+ r = log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to enumerate FIDO2 devices: %s", sym_fido_strerr(r));
goto finish;
}
const fido_dev_info_t *entry;
const char *path;
- entry = fido_dev_info_ptr(di, i);
+ entry = sym_fido_dev_info_ptr(di, i);
if (!entry) {
r = log_error_errno(SYNTHETIC_ERRNO(EIO),
"Failed to get device information for FIDO device %zu.", i);
goto finish;
}
- path = fido_dev_info_path(entry);
+ path = sym_fido_dev_info_path(entry);
if (!path) {
r = log_error_errno(SYNTHETIC_ERRNO(EIO),
"Failed to query FIDO device path.");
r = -EAGAIN;
finish:
- fido_dev_info_free(&di, allocated);
+ sym_fido_dev_info_free(&di, allocated);
return r;
}
--- /dev/null
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include "libfido2-util.h"
+
+#if HAVE_LIBFIDO2
+#include "alloc-util.h"
+#include "dlfcn-util.h"
+#include "log.h"
+
+static void *libfido2_dl = NULL;
+
+int (*sym_fido_assert_allow_cred)(fido_assert_t *, const unsigned char *, size_t) = NULL;
+void (*sym_fido_assert_free)(fido_assert_t **) = NULL;
+size_t (*sym_fido_assert_hmac_secret_len)(const fido_assert_t *, size_t) = NULL;
+const unsigned char* (*sym_fido_assert_hmac_secret_ptr)(const fido_assert_t *, size_t) = NULL;
+fido_assert_t* (*sym_fido_assert_new)(void) = NULL;
+int (*sym_fido_assert_set_clientdata_hash)(fido_assert_t *, const unsigned char *, size_t) = NULL;
+int (*sym_fido_assert_set_extensions)(fido_assert_t *, int) = NULL;
+int (*sym_fido_assert_set_hmac_salt)(fido_assert_t *, const unsigned char *, size_t) = NULL;
+int (*sym_fido_assert_set_rp)(fido_assert_t *, const char *) = NULL;
+int (*sym_fido_assert_set_up)(fido_assert_t *, fido_opt_t) = NULL;
+size_t (*sym_fido_cbor_info_extensions_len)(const fido_cbor_info_t *) = NULL;
+char **(*sym_fido_cbor_info_extensions_ptr)(const fido_cbor_info_t *) = NULL;
+void (*sym_fido_cbor_info_free)(fido_cbor_info_t **) = NULL;
+fido_cbor_info_t* (*sym_fido_cbor_info_new)(void) = NULL;
+void (*sym_fido_cred_free)(fido_cred_t **) = NULL;
+size_t (*sym_fido_cred_id_len)(const fido_cred_t *) = NULL;
+const unsigned char* (*sym_fido_cred_id_ptr)(const fido_cred_t *) = NULL;
+fido_cred_t* (*sym_fido_cred_new)(void) = NULL;
+int (*sym_fido_cred_set_clientdata_hash)(fido_cred_t *, const unsigned char *, size_t) = NULL;
+int (*sym_fido_cred_set_extensions)(fido_cred_t *, int) = NULL;
+int (*sym_fido_cred_set_rk)(fido_cred_t *, fido_opt_t) = NULL;
+int (*sym_fido_cred_set_rp)(fido_cred_t *, const char *, const char *) = NULL;
+int (*sym_fido_cred_set_type)(fido_cred_t *, int) = NULL;
+int (*sym_fido_cred_set_user)(fido_cred_t *, const unsigned char *, size_t, const char *, const char *, const char *) = NULL;
+int (*sym_fido_cred_set_uv)(fido_cred_t *, fido_opt_t) = NULL;
+void (*sym_fido_dev_free)(fido_dev_t **) = NULL;
+int (*sym_fido_dev_get_assert)(fido_dev_t *, fido_assert_t *, const char *) = NULL;
+int (*sym_fido_dev_get_cbor_info)(fido_dev_t *, fido_cbor_info_t *) = NULL;
+void (*sym_fido_dev_info_free)(fido_dev_info_t **, size_t) = NULL;
+int (*sym_fido_dev_info_manifest)(fido_dev_info_t *, size_t, size_t *) = NULL;
+const char* (*sym_fido_dev_info_manufacturer_string)(const fido_dev_info_t *) = NULL;
+const char* (*sym_fido_dev_info_product_string)(const fido_dev_info_t *) = NULL;
+fido_dev_info_t* (*sym_fido_dev_info_new)(size_t) = NULL;
+const char* (*sym_fido_dev_info_path)(const fido_dev_info_t *) = NULL;
+const fido_dev_info_t* (*sym_fido_dev_info_ptr)(const fido_dev_info_t *, size_t) = NULL;
+bool (*sym_fido_dev_is_fido2)(const fido_dev_t *) = NULL;
+int (*sym_fido_dev_make_cred)(fido_dev_t *, fido_cred_t *, const char *) = NULL;
+fido_dev_t* (*sym_fido_dev_new)(void) = NULL;
+int (*sym_fido_dev_open)(fido_dev_t *, const char *) = NULL;
+const char* (*sym_fido_strerr)(int) = NULL;
+
+int dlopen_libfido2(void) {
+ _cleanup_(dlclosep) void *dl = NULL;
+ int r;
+
+ if (libfido2_dl)
+ return 0; /* Already loaded */
+
+ dl = dlopen("libfido2.so.1", RTLD_LAZY);
+ if (!dl)
+ return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
+ "libfido2 support is not installed: %s", dlerror());
+
+ r = dlsym_many_and_warn(
+ dl,
+ LOG_DEBUG,
+ DLSYM_ARG(fido_assert_allow_cred),
+ DLSYM_ARG(fido_assert_free),
+ DLSYM_ARG(fido_assert_hmac_secret_len),
+ DLSYM_ARG(fido_assert_hmac_secret_ptr),
+ DLSYM_ARG(fido_assert_new),
+ DLSYM_ARG(fido_assert_set_clientdata_hash),
+ DLSYM_ARG(fido_assert_set_extensions),
+ DLSYM_ARG(fido_assert_set_hmac_salt),
+ DLSYM_ARG(fido_assert_set_rp),
+ DLSYM_ARG(fido_assert_set_up),
+ DLSYM_ARG(fido_cbor_info_extensions_len),
+ DLSYM_ARG(fido_cbor_info_extensions_ptr),
+ DLSYM_ARG(fido_cbor_info_free),
+ DLSYM_ARG(fido_cbor_info_new),
+ DLSYM_ARG(fido_cred_free),
+ DLSYM_ARG(fido_cred_id_len),
+ DLSYM_ARG(fido_cred_id_ptr),
+ DLSYM_ARG(fido_cred_new),
+ DLSYM_ARG(fido_cred_set_clientdata_hash),
+ DLSYM_ARG(fido_cred_set_extensions),
+ DLSYM_ARG(fido_cred_set_rk),
+ DLSYM_ARG(fido_cred_set_rp),
+ DLSYM_ARG(fido_cred_set_type),
+ DLSYM_ARG(fido_cred_set_user),
+ DLSYM_ARG(fido_cred_set_uv),
+ DLSYM_ARG(fido_dev_free),
+ DLSYM_ARG(fido_dev_get_assert),
+ DLSYM_ARG(fido_dev_get_cbor_info),
+ DLSYM_ARG(fido_dev_info_free),
+ DLSYM_ARG(fido_dev_info_manifest),
+ DLSYM_ARG(fido_dev_info_manufacturer_string),
+ DLSYM_ARG(fido_dev_info_new),
+ DLSYM_ARG(fido_dev_info_path),
+ DLSYM_ARG(fido_dev_info_product_string),
+ DLSYM_ARG(fido_dev_info_ptr),
+ DLSYM_ARG(fido_dev_is_fido2),
+ DLSYM_ARG(fido_dev_make_cred),
+ DLSYM_ARG(fido_dev_new),
+ DLSYM_ARG(fido_dev_open),
+ DLSYM_ARG(fido_strerr),
+ NULL);
+ if (r < 0)
+ return r;
+
+ /* Note that we never release the reference here, because there's no real reason to, after all this
+ * was traditionally a regular shared library dependency which lives forever too. */
+ libfido2_dl = TAKE_PTR(dl);
+ return 1;
+}
+#endif
--- /dev/null
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "macro.h"
+
+#if HAVE_LIBFIDO2
+#include <fido.h>
+
+extern int (*sym_fido_assert_allow_cred)(fido_assert_t *, const unsigned char *, size_t);
+extern void (*sym_fido_assert_free)(fido_assert_t **);
+extern size_t (*sym_fido_assert_hmac_secret_len)(const fido_assert_t *, size_t);
+extern const unsigned char* (*sym_fido_assert_hmac_secret_ptr)(const fido_assert_t *, size_t);
+extern fido_assert_t* (*sym_fido_assert_new)(void);
+extern int (*sym_fido_assert_set_clientdata_hash)(fido_assert_t *, const unsigned char *, size_t);
+extern int (*sym_fido_assert_set_extensions)(fido_assert_t *, int);
+extern int (*sym_fido_assert_set_hmac_salt)(fido_assert_t *, const unsigned char *, size_t);
+extern int (*sym_fido_assert_set_rp)(fido_assert_t *, const char *);
+extern int (*sym_fido_assert_set_up)(fido_assert_t *, fido_opt_t);
+extern size_t (*sym_fido_cbor_info_extensions_len)(const fido_cbor_info_t *);
+extern char **(*sym_fido_cbor_info_extensions_ptr)(const fido_cbor_info_t *);
+extern void (*sym_fido_cbor_info_free)(fido_cbor_info_t **);
+extern fido_cbor_info_t* (*sym_fido_cbor_info_new)(void);
+extern void (*sym_fido_cred_free)(fido_cred_t **);
+extern size_t (*sym_fido_cred_id_len)(const fido_cred_t *);
+extern const unsigned char* (*sym_fido_cred_id_ptr)(const fido_cred_t *);
+extern fido_cred_t* (*sym_fido_cred_new)(void);
+extern int (*sym_fido_cred_set_clientdata_hash)(fido_cred_t *, const unsigned char *, size_t);
+extern int (*sym_fido_cred_set_extensions)(fido_cred_t *, int);
+extern int (*sym_fido_cred_set_rk)(fido_cred_t *, fido_opt_t);
+extern int (*sym_fido_cred_set_rp)(fido_cred_t *, const char *, const char *);
+extern int (*sym_fido_cred_set_type)(fido_cred_t *, int);
+extern int (*sym_fido_cred_set_user)(fido_cred_t *, const unsigned char *, size_t, const char *, const char *, const char *);
+extern int (*sym_fido_cred_set_uv)(fido_cred_t *, fido_opt_t);
+extern void (*sym_fido_dev_free)(fido_dev_t **);
+extern int (*sym_fido_dev_get_assert)(fido_dev_t *, fido_assert_t *, const char *);
+extern int (*sym_fido_dev_get_cbor_info)(fido_dev_t *, fido_cbor_info_t *);
+extern void (*sym_fido_dev_info_free)(fido_dev_info_t **, size_t);
+extern int (*sym_fido_dev_info_manifest)(fido_dev_info_t *, size_t, size_t *);
+extern const char* (*sym_fido_dev_info_manufacturer_string)(const fido_dev_info_t *);
+extern const char* (*sym_fido_dev_info_product_string)(const fido_dev_info_t *);
+extern fido_dev_info_t* (*sym_fido_dev_info_new)(size_t);
+extern const char* (*sym_fido_dev_info_path)(const fido_dev_info_t *);
+extern const fido_dev_info_t* (*sym_fido_dev_info_ptr)(const fido_dev_info_t *, size_t);
+extern bool (*sym_fido_dev_is_fido2)(const fido_dev_t *);
+extern int (*sym_fido_dev_make_cred)(fido_dev_t *, fido_cred_t *, const char *);
+extern fido_dev_t* (*sym_fido_dev_new)(void);
+extern int (*sym_fido_dev_open)(fido_dev_t *, const char *);
+extern const char* (*sym_fido_strerr)(int);
+
+int dlopen_libfido2(void);
+
+static inline void fido_cbor_info_free_wrapper(fido_cbor_info_t **p) {
+ if (*p)
+ sym_fido_cbor_info_free(p);
+}
+
+static inline void fido_assert_free_wrapper(fido_assert_t **p) {
+ if (*p)
+ sym_fido_assert_free(p);
+}
+
+static inline void fido_dev_free_wrapper(fido_dev_t **p) {
+ if (*p)
+ sym_fido_dev_free(p);
+}
+
+static inline void fido_cred_free_wrapper(fido_cred_t **p) {
+ if (*p)
+ sym_fido_cred_free(p);
+}
+
+#endif
json.h
libcrypt-util.c
libcrypt-util.h
+ libfido2-util.c
+ libfido2-util.h
libmount-util.h
linux/auto_dev-ioctl.h
linux/bpf.h
projects / thirdparty / systemd.git / commitdiff
