VivoKey/vsmartcard
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

nPA: added option to disable validity period check

Browse Source
This commit is contained in:
Frank Morgner
2012-10-01 12:40:26 +02:00
parent 765d284bc4
commit 4f6945917e
7 changed files with 31 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
npa/src/npa-tool.c
View File

@@ -224,6 +224,8 @@ main (int argc, char **argv)
}
if (cmdline.tr_03110v201_flag)
tr_version = EAC_TR_VERSION_2_01;
if (cmdline.disable_checks_flag)
npa_default_flags |= NPA_FLAG_DISABLE_CHECKS;
if (cmdline.info_flag)

3
npa/src/npa-tool.ggo.in
View File

@@ -92,6 +92,9 @@ option "translate" t
option "tr-03110v201" -
"Force compliance to BSI TR-03110 version 2.01"
flag off
option "disable-checks" -
"Disable checking fly-by-data"
flag off
text "
Report bugs to @PACKAGE_BUGREPORT@

19
npa/src/npa.c
View File

@@ -214,7 +214,6 @@ IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_CA_R)
#define maxresp SC_MAX_APDU_BUFFER_SIZE - 2
#define NPA_FLAG_DISABLE_CHECKS 1
/** NPA secure messaging context */
struct npa_sm_ctx {
/** Send sequence counter */
@@ -259,6 +258,10 @@ static int increment_ssc(struct npa_sm_ctx *eacsmctx);
static int decrement_ssc(struct npa_sm_ctx *eacsmctx);
static int reset_ssc(struct npa_sm_ctx *eacsmctx);
char npa_default_flags = 0;
static struct npa_sm_ctx *
npa_sm_ctx_create(EAC_CTX *ctx, const unsigned char *certificate_description,
size_t certificate_description_length,
@@ -290,7 +293,9 @@ npa_sm_ctx_create(EAC_CTX *ctx, const unsigned char *certificate_description,
out->eph_pub_key = NULL;
out->auxiliary_data = NULL;
out->flags = NPA_FLAG_DISABLE_CHECKS;
out->flags = npa_default_flags;
if (out->flags & NPA_FLAG_DISABLE_CHECKS)
TA_disable_checks(out->ctx);
return out;
@@ -1630,8 +1635,6 @@ int perform_terminal_authentication(struct sm_ctx *ctx, sc_card_t *card,
}
struct npa_sm_ctx *eacsmctx = ctx->priv_data;
eacsmctx->flags = 0;
while (*certs && *certs_lens) {
cert = *certs;
@@ -1670,6 +1673,8 @@ int perform_terminal_authentication(struct sm_ctx *ctx, sc_card_t *card,
r = SC_ERROR_INTERNAL;
goto err;
}
if (eacsmctx->eph_pub_key)
BUF_MEM_free(eacsmctx->eph_pub_key);
eacsmctx->eph_pub_key = TA_STEP3_generate_ephemeral_key(eacsmctx->ctx);
@@ -1852,8 +1857,6 @@ int perform_chip_authentication(struct sm_ctx *ctx, sc_card_t *card)
}
struct npa_sm_ctx *eacsmctx = ctx->priv_data;
eacsmctx->flags = 0;
/* Passive Authentication */
r = get_ef_card_security(ctx, card, &ef_cardsecurity, &ef_cardsecurity_len);
@@ -2213,7 +2216,7 @@ npa_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx,
}
struct npa_sm_ctx *eacsmctx = ctx->priv_data;
if (eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS) {
if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS)) {
if (apdu->ins == 0x2a && apdu->p1 == 0x00 && apdu->p2 == 0xbe) {
/* PSO:Verify Certificate
* check certificate description to match given certificate */
@@ -2430,7 +2433,7 @@ npa_sm_finish(sc_card_t *card, const struct sm_ctx *ctx,
SC_ERROR_INVALID_ARGUMENTS);
struct npa_sm_ctx *eacsmctx = ctx->priv_data;
if (eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS) {
if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS)) {
if (apdu->sw1 == 0x90 && apdu->sw2 == 0x00) {
if (apdu->ins == 0x84 && apdu->p1 == 0x00 && apdu->p2 == 0x00
&& apdu->le == 8 && apdu->resplen == 8) {

3
npa/src/npa/npa.h
View File

@@ -198,6 +198,9 @@ int npa_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card,
#define npa_change_pin(ctx, card, newp, newplen) \
npa_reset_retry_counter(ctx, card, PACE_PIN, 1, newp, newplen)
#define NPA_FLAG_DISABLE_CHECKS 1
extern char npa_default_flags;
#ifdef __cplusplus
}
#endif

6
virtualsmartcard/src/vpicc/vicc.in
View File

@@ -81,6 +81,10 @@ npa.add_argument("-c", "--ca",
action="store",
type=str,
help="CHR of the CVCA.")
npa.add_argument("-d", "--disable-checks",
action="store_true", default=False,
help="Disable checking validity period of TA certificate")
args = parser.parse_args()
@@ -106,5 +110,5 @@ if (args.ca_pubkey):
vicc = VirtualICC(args.file, args.type,
args.hostname, args.port, readernum=args.reader,
ef_cardaccess=ef_cardaccess_data, ef_cardsecurity=ef_cardsecurity_data, ca_pubkey=ca_pubkey_data,
ca_key=ca_key_data, ca=args.ca)
ca_key=ca_key_data, ca=args.ca, disable_checks=args.disable_checks)
vicc.run()

7
virtualsmartcard/src/vpicc/virtualsmartcard/VirtualSmartcard.py
View File

@@ -499,11 +499,12 @@ class RelayOS(SmartcardOS):
class NPAOS(Iso7816OS):
def __init__(self, mf, sam, ins2handler=None, maxle=MAX_EXTENDED_LE, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None):
def __init__(self, mf, sam, ins2handler=None, maxle=MAX_EXTENDED_LE, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None, disable_checks=False):
Iso7816OS.__init__(self, mf, sam, ins2handler, maxle)
self.ins2handler[0x86] = self.SAM.general_authenticate
self.ins2handler[0x2c] = self.SAM.reset_retry_counter
self.atr = '\x3B\x8A\x80\x01\x80\x31\xF8\x73\xF7\x41\xE0\x82\x90\x00\x75'
self.SAM.current_SE.disable_checks = disable_checks
if ef_cardsecurity:
ef = self.mf.select('fid', 0x011d)
ef.data = ef_cardsecurity
@@ -556,7 +557,7 @@ class VirtualICC(object):
the vpcd, which forwards it to the application.
"""
def __init__(self, filename, card_type, host, port, lenlen=3, readernum=None, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None):
def __init__(self, filename, card_type, host, port, lenlen=3, readernum=None, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None, disable_checks=False):
from os.path import exists
logging.basicConfig(level = logging.INFO,
@@ -581,7 +582,7 @@ class VirtualICC(object):
if card_type == "iso7816" or card_type == "ePass":
self.os = Iso7816OS(MF, SAM)
elif card_type == "nPA":
self.os = NPAOS(MF, SAM, ef_cardsecurity=ef_cardsecurity, ef_cardaccess=ef_cardaccess, ca_key=ca_key, ca_pubkey=ca_pubkey, ca=ca)
self.os = NPAOS(MF, SAM, ef_cardsecurity=ef_cardsecurity, ef_cardaccess=ef_cardaccess, ca_key=ca_key, ca_pubkey=ca_pubkey, ca=ca, disable_checks=disable_checks)
elif card_type == "cryptoflex":
self.os = CryptoflexOS(MF, SAM)
elif card_type == "relay":

3
virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py
View File

@@ -109,6 +109,7 @@ class nPA_SE(Security_Environment):
self.ca = "DECVCAeID00102"
self.ca_key = None
self.ca_pubkey = None
self.disable_checks = False
def _set_SE(self, p2, data):
sw, resp = Security_Environment._set_SE(self, p2, data)
@@ -302,6 +303,8 @@ class nPA_SE(Security_Environment):
pace.print_ossl_err()
raise SwError(SW["WARN_NOINFO63"])
result.append([0x87, len(self.ca), self.ca])
if (self.disable_checks):
pace.TA_disable_checks(self.eac_ctx)
return 0x9000, nPA_SE.__pack_general_authenticate(result)