8000 Add support for hidg devices on Linux by rgerganov · Pull Request #131 · solokeys/solo1 · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Add support for hidg devices on Linux #131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Apr 24, 2019
Merged

Add support for hidg devices on Linux #131

merged 2 commits into from
Apr 24, 2019

Conversation

rgerganov
Copy link

There is a HID gadget driver on Linux which provides emulation of USB
HID devices. This could be very useful for testing the Solo firmware
without actual hardware, using only a Linux box.

This patch adds a command line argument which specifies whether the
existing UDP backing should be used or the new one which reads and
writes to /dev/hidg0.

Testing done:

  1. Created HID device with configfs
  2. Started "./main -b hidg" as root
  3. Successfully executed Webauthn registration and authentication on
    the same Linux machine

Closes: #122

@ghost
Copy link
ghost commented Mar 6, 2019

Please, #include <stdbool.h> in files with bool.

@nickray
Copy link
Member
nickray commented Mar 6, 2019 •
edited
Loading

Cool, thanks! This is a really neat idea. Will try it out. Maybe we can add a script to build the dummy_hcd kernel module, and general setup on Debian/Ubuntu?

@ghost
Copy link
ghost commented Mar 7, 2019 •
edited by ghost
Loading

PIN is not asked, also no user presense check.

[ERR] CborError: 0x31: fido2/ctap.c: 1341: unknown error if invalid PIN

@conorpp
Copy link
Member
conorpp commented Mar 7, 2019

It is on the browser / platform that interfaces with the authenticator to get the pin from the user

@ghost
Copy link
ghost commented Mar 7, 2019

Why no user presense check like YES input?
See: https://github.com/concise/v2f.py

@conorpp
Copy link
Member
conorpp commented Mar 7, 2019 •
edited
Loading

That could be easily added. The use case for running on PC generally is for development and testing, not using it as a software authenticator. Probably worth opening new issues for:

  1. User presence check option for local builds
  2. Windows HID emulation

@ghost
Copy link
ghost commented Mar 7, 2019

It is on the browser / platform that interfaces with the authenticator to get the pin from the user

It was said that Firefox does not support it. Will Firefox support PIN authentication? When if yes?

@conorpp
Copy link
Member
conorpp commented Mar 7, 2019

I'm not sure, you should follow up on one of their forums

@ghost
Copy link
ghost commented Mar 7, 2019

Looks like no browser support FIDO2 (Edge only partially). Why?
https://html5test.com/compare/feature/security.authentication.html

@ghost ghost mentioned this pull request Mar 7, 2019
Closed
@rgerganov
Copy link
Author
rgerganov commented Mar 8, 2019 •
edited
Loading

Cool, thanks! This is a really neat idea. Will try it out. Maybe we can add a script to build the dummy_hcd kernel module, and general setup on Debian/Ubuntu?

@nickray, I have reworked your patch into a single Makefile which can build, install and uninstall the HID gadget. Tested on Ubuntu 18.04

@ghost
Copy link
ghost commented Mar 8, 2019

There is no kernel source archive on Arch Linux, but there is directory.
Does not work.

@ghost
Copy link
ghost commented Mar 15, 2019

dummy_hcd MAY be already available, there must be check.

@ghost
Copy link
ghost commented Mar 15, 2019

Running main as root is required, otherwise permission denied.

@nickray
Copy link
Member
nickray commented Mar 15, 2019

@rgerganov we've discussed this PR internally. We'd like to put it on hold for the time being:

  • some/most current kernels don't work as-is with it, plus it's Linux only (currently)
  • gives the impression that we develop/support a virtual/software authenticator

In both cases, it seems it will mostly generate support requests for us, while developing/testing the fido2 library works equally well via the UDP transport.

Are you OK if we leave this PR open for the time being?

In the future we may want to modularize the code base and build system a bit more, so that this could fit in as a "third party extension".

@rgerganov
Copy link
Author

@nickray OK, thanks for the update. I am working with Linux developers to get this fixed in the mainline kernel and eventually backport to stable. I will ping you when the fix is merged.

@rgerganov
Copy link
Author

The kernel bug is fixed in Linux 5.1-rc3 and the patch is being backported to the stable 4.x branches, so I thought you may consider this PR again.

One interesting use case would be attaching the emulated HID device to a Windows virtual machine running on the Linux host. That will enable to run and debug the solo firmware against Windows services and browsers. Let me know what you think.

@ranisalt
Copy link
ranisalt commented Apr 2, 2019

Created HID device with configfs

How would one do that?

@rgerganov
Copy link
Author

Created HID device with configfs

How would one do that?

See the Makefile in my pull request

@arthurchan35
Copy link
arthurchan35 commented Apr 3, 2019 •
edited
Loading

Hi @rgerganov
I followed the steps and tried to test https://webauthn.org/ but nothing happened after pop-up of "use your security key with webauthn.org"

I am on ubuntu 18.04 with linux kernel 5.1 RC3
I am able to see the following hid info after sudo make install with configfs:

T: Bus=03 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=480 MxCh= 1
D: Ver= 2.00 Cls=09(hub ) Sub=00 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=1d6b ProdID=0002 Rev=05.01
S: Manufacturer=Linux 5.1.0-050100rc3-generic dummy_hcd
S: Product=Dummy host controller
S: SerialNumber=dummy_hcd.0
C: #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=0mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub

T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=0483 ProdID=a2ca Rev=05.01
S: Manufacturer=Solo
S: Product=Solo Software Authenticator
S: SerialNumber=1234567890
C: #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=120mA
I: If#= 0 Alt= 0 #EPs= 2 Cls=03(HID ) Sub=00 Prot=00 Driver=usbhid

I applied the your patch and make all Solo and sudo ./main -b hidg
console outputs:

$ sudo ./main -b hidg
[DEBUG] Using hidg backing
state file exists
[STOR] Auth state is initialized
[STOR] pin not set.

Can you suggest where should I look into in order to get it to work?

@rgerganov
Copy link
Author

Can you suggest where should I look into in order to get it to work?

Did you install the udev rules for the solo key?

@arthurchan35
Copy link

Can you suggest where should I look into in order to get it to work?

Did you install the udev rules for the solo key?

Aha, thanks. It works now.

@ghost
Copy link
ghost commented Apr 6, 2019

Cannot enter bootloader or DFU. Is it Solo Secure or Solo Hacker? I think Solo must be emulated as close to real as possible.

@conorpp
Copy link
Member
conorpp commented Apr 6, 2019

@andy-dicki For bootloader and DFU, emulation, we would need a good emulation platform for STM32L4 chipset. QEMU would be a good option, but STM32L4 emulation isn't complete AFAIK.

@conorpp
Copy link
Member
conorpp commented Apr 11, 2019

I'm planning to merge this as soon as it's in 4.x branches. What is a good way to track the backport?

@rgerganov
Copy link
Author

@conorpp Awesome! The kernel fix is already backported to 4.9.167, 4.14.110 and 4.19.33

@conorpp conorpp mentioned this pull request Apr 14, 2019
Closed
@rgerganov
Copy link
Author

Any idea how to make Codacy happy when reading a file descriptor?

Radoslav G 9E88 erganov and others added 2 commits April 16, 2019 10:54
Add support for hidg devices on Linux
955d4f7 
There is a HID gadget driver on Linux which provides emulation of USB
HID devices. This could be very useful for testing the Solo firmware
without actual hardware, using only a Linux box.

This patch adds a command line argument which specifies whether the
existing UDP backing should be used or the new one which reads and
writes to /dev/hidg0.

Testing done:
 1. Created HID device with configfs
 2. Started "./main -b hidg" as root
 3. Successfully executed Webauthn registration and authentication on
 the same Linux machine

Closes: solokeys#122
@nickray
Add Makefile for installing a HID gadget
6a28824 
The Makefile has targets for building, installing and uninstalling a HID
gadget which acts as FIDO2 authenticator.

Tested on Ubuntu 18.04 but should work on other distros as well. The
only assumption being made is that kernel source is available at
/usr/src/linux-source-$(KERNEL_VERSION).tar.bz2. A possible improvement
would be to have a configure script which finds the correct kernel
source archive.
@conorpp conorpp merged commit 494e856 into solokeys:master Apr 24, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Support for HID gadgets on Linux
5 participants
@rgerganov @nickray @conorpp @ranisalt @arthurchan35
0