VivoKey/vsmartcard
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

added CLI flags do disable various checks

Browse Source
This commit is contained in:
Frank Morgner
2013-02-09 23:44:00 +01:00
parent 19f1db1b30
commit 2e029de07d
5 changed files with 26 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
npa/src/npa-tool.c
View File

@@ -342,8 +342,12 @@ main (int argc, char **argv)
}
if (cmdline.tr_03110v201_flag)
tr_version = EAC_TR_VERSION_2_01;
if (cmdline.disable_checks_flag)
npa_default_flags |= NPA_FLAG_DISABLE_CHECKS;
if (cmdline.disable_all_checks_flag)
npa_default_flags |= NPA_FLAG_DISABLE_CHECK_ALL;
if (cmdline.disable_ta_checks_flag)
npa_default_flags |= NPA_FLAG_DISABLE_CHECK_TA;
if (cmdline.disable_ca_checks_flag)
npa_default_flags |= NPA_FLAG_DISABLE_CHECK_CA;
if (cmdline.info_flag)

10
npa/src/npa-tool.ggo.in
View File

@@ -196,8 +196,14 @@ option "translate" t
option "tr-03110v201" -
"Force compliance to BSI TR-03110 version 2.01"
flag off
option "disable-checks" -
"Disable checking fly-by-data and validity period of CV certifcates"
option "disable-all-checks" -
"Disable all checking of fly-by-data"
flag off
option "disable-ta-checks" -
"Disable checking the validity period of CV certifcates"
flag off
option "disable-ca-checks" -
"Disable passive authentication"
flag off
text "

8
npa/src/npa.c
View File

@@ -306,8 +306,10 @@ npa_sm_ctx_create(EAC_CTX *ctx, const unsigned char *certificate_description,
out->auxiliary_data = NULL;
out->flags = npa_default_flags;
if (out->flags & NPA_FLAG_DISABLE_CHECKS)
if (out->flags & NPA_FLAG_DISABLE_CHECK_TA)
TA_disable_checks(out->ctx);
if (out->flags & NPA_FLAG_DISABLE_CHECK_CA)
CA_disable_passive_authentication(out->ctx);
return out;
@@ -2250,7 +2252,7 @@ npa_sm_pre_transmit(sc_card_t *card, const struct iso_sm_ctx *ctx,
}
struct npa_sm_ctx *eacsmctx = ctx->priv_data;
if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS)) {
if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECK_ALL)) {
if (apdu->ins == 0x2a && apdu->p1 == 0x00 && apdu->p2 == 0xbe) {
/* PSO:Verify Certificate
* check certificate description to match given certificate */
@@ -2443,7 +2445,7 @@ npa_sm_finish(sc_card_t *card, const struct iso_sm_ctx *ctx,
SC_ERROR_INVALID_ARGUMENTS);
struct npa_sm_ctx *eacsmctx = ctx->priv_data;
if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS)) {
if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECK_ALL)) {
if (apdu->sw1 == 0x90 && apdu->sw2 == 0x00) {
if (apdu->ins == 0x84 && apdu->p1 == 0x00 && apdu->p2 == 0x00
&& apdu->le == 8 && apdu->resplen == 8) {

13
npa/src/npa/npa.h
View File

@@ -213,13 +213,12 @@ int npa_reset_retry_counter(sc_card_t *card,
#define npa_change_pin(card, newp, newplen) \
npa_reset_retry_counter(card, PACE_PIN, 1, newp, newplen)
/**
* @brief Disable all sanity checks done by OpenPACE
*
* Currently used to set \c TA_FLAG_SKIP_TIMECHECK (Skip checking effective and
* expiration date of cv certificates against the system's current time).
*/
#define NPA_FLAG_DISABLE_CHECKS 1
/** @brief Disable all sanity checks done by libnpa */
#define NPA_FLAG_DISABLE_CHECK_ALL 1
/** Disable checking validity period of CV certificates */
#define NPA_FLAG_DISABLE_CHECK_TA 2
/** Disable checking passive authentication during CA */
#define NPA_FLAG_DISABLE_CHECK_CA 4
/** Use \c npa_default_flags to disable checks for EAC/SM */
extern char npa_default_flags;

2
npa/test_vicc_with_npa-tool.sh
View File

@@ -64,7 +64,7 @@ do
--older-than=19991231 --verify-validity \
--read-dg1 --read-dg2 --read-dg3 --read-dg4 --read-dg5 --read-dg6 --read-dg7 --read-dg8 --read-dg9 --read-dg10 --read-dg11 --read-dg12 --read-dg13 --read-dg14 --read-dg15 --read-dg16 --read-dg17 --read-dg18 --read-dg19 --read-dg20 --read-dg21 \
--write-dg17=0107 --write-dg18=0108 --write-dg19=0109 --write-dg20=0200 --write-dg21=0201 \
--disable-checks
--disable-ta-check --disable-ca-check
NPA_RESULT=$?
kill $VICC_PID 2>/dev/null