wireguard-openbsd/lib/libfido2, branch master

Back-out USB data toggle fix for HID devices, since we received multiple

2021-02-15T11:26:00Z

reports about broken devices, e.g. for ukbd(4) and fido(4). ok mpi@

Remove the terrible_ping_kludge() workaround. We have committed a fix to

2021-02-05T14:19:21Z

the USB stack in the meantime for uhidev(4) and ugen(4) to resolve the data toggle issue in relation to xhci(4). ok gnezdo@, djm@

sync a couple of minor fixes (no API/ABI change) to bring libfido2

2020-09-07T01:09:47Z

in line with upstream 1.5.0

check errno against EINTR; not return value from poll()

2020-08-23T10:31:27Z

spotted by Pedro Martelletto

update to libfido2 46710ac06, picking up a few API changes

2020-08-23T03:34:57Z

ok tb@ deraadt@ NB. major crank

sync with upstream libfido2 rev 2fa20b889, picking up ~7 months

2020-08-11T08:44:53Z

of fixes and a few new APIs that we'd like to use in OpenSSH ok deraadt@

It appears we have come full-circle, where source code starts to use

2020-02-07T06:24:08Z

clang / "super new gcc" ism's, in particular ones which are totally pointless as far as language goes. Delete them.

update to upstream libfido2 780ad3c25 (20120123)

2020-02-07T00:57:49Z

install manual pages crank major feedback & ok jmc@ and naddy@

Add fido(4), a HID driver for FIDO/U2F security keys

2019-12-17T13:08:54Z

While FIDO/U2F keys were already supported by the generic uhid(4) driver, this driver adds the first step to tighten the security of FIDO/U2F access. Specifically, users don't need read/write access to all USB/HID devices anymore and the driver also improves integration with pledge(2) and unveil(2): It is pledge-friendly because it doesn't require any ioctls to discover the device and unveil-friendly because it uses a single /dev/fido/* directory for its device nodes. It also allows to support FIDO/U2F in firefox without further weakening the "sandbox" of the browser. Firefox does not have a proper privsep design and many operations, such as U2F access, are handled directly by the main process. This means that the browser's "fat" main process needs direct read/write access to all USB HID devices, at least on other operating systems. With fido(4) we can support security keys in Firefox under OpenBSD without such a compromise. With this change, libfido2 stops using the ioctl to query the device vendor/product and just assumes "OpenBSD" "fido(4)" instead. The ioctl is still supported but there was no benefit in obtaining the vendor product or name; it also allows to use libfido2 under pledge. With feedback from deraadt@ and many others OK kettenis@ djm@ and jmc@ for the manpage bits

sync upstream commit with manpage fixes from jmc@

2019-11-27T05:07:21Z

> commit 437896dcafc67d9596774c3bb9f97bfdb4810bb1 > Author: pedro martelletto > Date: Wed Nov 20 09:38:22 2019 +0100 > > man: mop up dangling .Xr's; Jason McIntyre