diff --git a/npa/src/npa-tool.c b/npa/src/npa-tool.c index deaa60f..14df4bf 100644 --- a/npa/src/npa-tool.c +++ b/npa/src/npa-tool.c @@ -224,6 +224,8 @@ main (int argc, char **argv) } if (cmdline.tr_03110v201_flag) tr_version = EAC_TR_VERSION_2_01; + if (cmdline.disable_checks_flag) + npa_default_flags |= NPA_FLAG_DISABLE_CHECKS; if (cmdline.info_flag) diff --git a/npa/src/npa-tool.ggo.in b/npa/src/npa-tool.ggo.in index 257a8bc..634aa51 100644 --- a/npa/src/npa-tool.ggo.in +++ b/npa/src/npa-tool.ggo.in @@ -92,6 +92,9 @@ option "translate" t option "tr-03110v201" - "Force compliance to BSI TR-03110 version 2.01" flag off +option "disable-checks" - + "Disable checking fly-by-data" + flag off text " Report bugs to @PACKAGE_BUGREPORT@ diff --git a/npa/src/npa.c b/npa/src/npa.c index 0b24b8b..09d664c 100644 --- a/npa/src/npa.c +++ b/npa/src/npa.c @@ -214,7 +214,6 @@ IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_CA_R) #define maxresp SC_MAX_APDU_BUFFER_SIZE - 2 -#define NPA_FLAG_DISABLE_CHECKS 1 /** NPA secure messaging context */ struct npa_sm_ctx { /** Send sequence counter */ @@ -259,6 +258,10 @@ static int increment_ssc(struct npa_sm_ctx *eacsmctx); static int decrement_ssc(struct npa_sm_ctx *eacsmctx); static int reset_ssc(struct npa_sm_ctx *eacsmctx); + +char npa_default_flags = 0; + + static struct npa_sm_ctx * npa_sm_ctx_create(EAC_CTX *ctx, const unsigned char *certificate_description, size_t certificate_description_length, @@ -290,7 +293,9 @@ npa_sm_ctx_create(EAC_CTX *ctx, const unsigned char *certificate_description, out->eph_pub_key = NULL; out->auxiliary_data = NULL; - out->flags = NPA_FLAG_DISABLE_CHECKS; + out->flags = npa_default_flags; + if (out->flags & NPA_FLAG_DISABLE_CHECKS) + TA_disable_checks(out->ctx); return out; @@ -1630,8 +1635,6 @@ int perform_terminal_authentication(struct sm_ctx *ctx, sc_card_t *card, } struct npa_sm_ctx *eacsmctx = ctx->priv_data; - eacsmctx->flags = 0; - while (*certs && *certs_lens) { cert = *certs; @@ -1670,6 +1673,8 @@ int perform_terminal_authentication(struct sm_ctx *ctx, sc_card_t *card, r = SC_ERROR_INTERNAL; goto err; } + + if (eacsmctx->eph_pub_key) BUF_MEM_free(eacsmctx->eph_pub_key); eacsmctx->eph_pub_key = TA_STEP3_generate_ephemeral_key(eacsmctx->ctx); @@ -1852,8 +1857,6 @@ int perform_chip_authentication(struct sm_ctx *ctx, sc_card_t *card) } struct npa_sm_ctx *eacsmctx = ctx->priv_data; - eacsmctx->flags = 0; - /* Passive Authentication */ r = get_ef_card_security(ctx, card, &ef_cardsecurity, &ef_cardsecurity_len); @@ -2213,7 +2216,7 @@ npa_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx, } struct npa_sm_ctx *eacsmctx = ctx->priv_data; - if (eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS) { + if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS)) { if (apdu->ins == 0x2a && apdu->p1 == 0x00 && apdu->p2 == 0xbe) { /* PSO:Verify Certificate * check certificate description to match given certificate */ @@ -2430,7 +2433,7 @@ npa_sm_finish(sc_card_t *card, const struct sm_ctx *ctx, SC_ERROR_INVALID_ARGUMENTS); struct npa_sm_ctx *eacsmctx = ctx->priv_data; - if (eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS) { + if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECKS)) { if (apdu->sw1 == 0x90 && apdu->sw2 == 0x00) { if (apdu->ins == 0x84 && apdu->p1 == 0x00 && apdu->p2 == 0x00 && apdu->le == 8 && apdu->resplen == 8) { diff --git a/npa/src/npa/npa.h b/npa/src/npa/npa.h index f685a9c..7a39ae0 100644 --- a/npa/src/npa/npa.h +++ b/npa/src/npa/npa.h @@ -198,6 +198,9 @@ int npa_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card, #define npa_change_pin(ctx, card, newp, newplen) \ npa_reset_retry_counter(ctx, card, PACE_PIN, 1, newp, newplen) +#define NPA_FLAG_DISABLE_CHECKS 1 +extern char npa_default_flags; + #ifdef __cplusplus } #endif diff --git a/virtualsmartcard/src/vpicc/vicc.in b/virtualsmartcard/src/vpicc/vicc.in index e13d161..ee4906b 100644 --- a/virtualsmartcard/src/vpicc/vicc.in +++ b/virtualsmartcard/src/vpicc/vicc.in @@ -81,6 +81,10 @@ npa.add_argument("-c", "--ca", action="store", type=str, help="CHR of the CVCA.") +npa.add_argument("-d", "--disable-checks", + action="store_true", default=False, + help="Disable checking validity period of TA certificate") + args = parser.parse_args() @@ -106,5 +110,5 @@ if (args.ca_pubkey): vicc = VirtualICC(args.file, args.type, args.hostname, args.port, readernum=args.reader, ef_cardaccess=ef_cardaccess_data, ef_cardsecurity=ef_cardsecurity_data, ca_pubkey=ca_pubkey_data, - ca_key=ca_key_data, ca=args.ca) + ca_key=ca_key_data, ca=args.ca, disable_checks=args.disable_checks) vicc.run() diff --git a/virtualsmartcard/src/vpicc/virtualsmartcard/VirtualSmartcard.py b/virtualsmartcard/src/vpicc/virtualsmartcard/VirtualSmartcard.py index a2628bc..e997412 100644 --- a/virtualsmartcard/src/vpicc/virtualsmartcard/VirtualSmartcard.py +++ b/virtualsmartcard/src/vpicc/virtualsmartcard/VirtualSmartcard.py @@ -499,11 +499,12 @@ class RelayOS(SmartcardOS): class NPAOS(Iso7816OS): - def __init__(self, mf, sam, ins2handler=None, maxle=MAX_EXTENDED_LE, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None): + def __init__(self, mf, sam, ins2handler=None, maxle=MAX_EXTENDED_LE, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None, disable_checks=False): Iso7816OS.__init__(self, mf, sam, ins2handler, maxle) self.ins2handler[0x86] = self.SAM.general_authenticate self.ins2handler[0x2c] = self.SAM.reset_retry_counter self.atr = '\x3B\x8A\x80\x01\x80\x31\xF8\x73\xF7\x41\xE0\x82\x90\x00\x75' + self.SAM.current_SE.disable_checks = disable_checks if ef_cardsecurity: ef = self.mf.select('fid', 0x011d) ef.data = ef_cardsecurity @@ -556,7 +557,7 @@ class VirtualICC(object): the vpcd, which forwards it to the application. """ - def __init__(self, filename, card_type, host, port, lenlen=3, readernum=None, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None): + def __init__(self, filename, card_type, host, port, lenlen=3, readernum=None, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, ca_pubkey=None, ca=None, disable_checks=False): from os.path import exists logging.basicConfig(level = logging.INFO, @@ -581,7 +582,7 @@ class VirtualICC(object): if card_type == "iso7816" or card_type == "ePass": self.os = Iso7816OS(MF, SAM) elif card_type == "nPA": - self.os = NPAOS(MF, SAM, ef_cardsecurity=ef_cardsecurity, ef_cardaccess=ef_cardaccess, ca_key=ca_key, ca_pubkey=ca_pubkey, ca=ca) + self.os = NPAOS(MF, SAM, ef_cardsecurity=ef_cardsecurity, ef_cardaccess=ef_cardaccess, ca_key=ca_key, ca_pubkey=ca_pubkey, ca=ca, disable_checks=disable_checks) elif card_type == "cryptoflex": self.os = CryptoflexOS(MF, SAM) elif card_type == "relay": diff --git a/virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py b/virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py index 2f407df..50f8c1d 100644 --- a/virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py +++ b/virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py @@ -109,6 +109,7 @@ class nPA_SE(Security_Environment): self.ca = "DECVCAeID00102" self.ca_key = None self.ca_pubkey = None + self.disable_checks = False def _set_SE(self, p2, data): sw, resp = Security_Environment._set_SE(self, p2, data) @@ -302,6 +303,8 @@ class nPA_SE(Security_Environment): pace.print_ossl_err() raise SwError(SW["WARN_NOINFO63"]) result.append([0x87, len(self.ca), self.ca]) + if (self.disable_checks): + pace.TA_disable_checks(self.eac_ctx) return 0x9000, nPA_SE.__pack_general_authenticate(result)