From 79dc468cc5fa610244ab50b79b6e482c9c677471 Mon Sep 17 00:00:00 2001 From: frankmorgner Date: Fri, 14 Jan 2011 14:24:04 +0000 Subject: [PATCH] switched to opensc.0.12.0. note that this has some issues when linking against both libnpa and the opensc libraries at the same time. readme information would be usefull for this... git-svn-id: https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@385 96b47cad-a561-4643-ad3b-153ac7d7599c --- ccid/configure.ac | 21 +-- ccid/src/Makefile.am | 15 +++ ccid/src/ccid.c | 293 +++++++++++++++++++----------------------- ccid/src/ccid.h | 2 +- npa/Makefile.am | 14 ++ npa/configure.ac | 15 +-- npa/src/Makefile.am | 23 +++- npa/src/pace-tool.c | 27 ++-- npa/src/pace.c | 178 ++++++++++++------------- npa/src/pace/pace.h | 2 +- npa/src/pace/scutil.h | 6 +- npa/src/pace/sm.h | 2 +- npa/src/scutil.c | 24 ++-- npa/src/sm.c | 121 ++++++++--------- 14 files changed, 350 insertions(+), 393 deletions(-) diff --git a/ccid/configure.ac b/ccid/configure.ac index 1e7e186..73bc5af 100644 --- a/ccid/configure.ac +++ b/ccid/configure.ac @@ -19,21 +19,6 @@ AM_PROG_CC_C_O PKG_PROG_PKG_CONFIG # Checks for libraries. -PKG_CHECK_EXISTS([libopensc], - [PKG_CHECK_MODULES([OPENSC], [libopensc < 0.12])], - [AC_MSG_WARN([libopensc < 0.12 not found by pkg-config])]) - -saved_CPPFLAGS="$CPPFLAGS" -saved_LIBS="$LIBS" -CPPFLAGS="$CPPFLAGS $OPENSC_CFLAGS" -LIBS="$LDFLAGS $OPENSC_LIBS" -AC_CHECK_HEADERS(opensc/opensc.h,, - [ AC_MSG_ERROR([opensc/opensc.h not found, install libopensc < 0.12 or use ./configure OPENSC_CFLAGS=...]) ]) -AC_MSG_CHECKING([for sc_context_create]) -AC_TRY_LINK_FUNC(sc_context_create, [ AC_MSG_RESULT([yes]) ], - [ AC_MSG_ERROR([libopensc < 0.12 not found, use ./configure OPENSC_LIBS=...]) ]) -CPPFLAGS="$saved_CPPFLAGS" -LIBS="$saved_LIBS" # --disable-ccid AC_ARG_ENABLE(ccid, @@ -92,7 +77,7 @@ if test "x$enable_pace" != xno ; then [AC_MSG_WARN([libpace not found by pkg-config])]) saved_CPPFLAGS="$CPPFLAGS" saved_LIBS="$LIBS" - CPPFLAGS="$CPPFLAGS $LIBPACE_CFLAGS" + CPPFLAGS="$CPPFLAGS $LIBPACE_CFLAGS -I$(pwd)/src/opensc-0.12.0/src" LIBS="$LDFLAGS $LIBPACE_LIBS" AC_CHECK_HEADERS(pace/pace.h, [], [ AC_MSG_ERROR([pace/pace.h not found, install libpace or use ./configure LIBPACE_CFLAGS=...]) ]) AC_MSG_CHECKING([for EstablishPACEChannel]) @@ -126,7 +111,7 @@ if test "x$enable_cats" != xno ; then AC_CHECK_HEADERS(reader.h, [AC_DEFINE(HAVE_READER_H, 1, [use reader.h from PC/SC Lite])], []) AC_CHECK_HEADERS(pcsclite.h, [AC_DEFINE(HAVE_PCSCLITE_H, 1, [use pcsclite.h from PC/SC Lite])], []) AC_CHECK_DECL(FEATURE_EXECUTE_PACE, [], - [AC_MSG_ERROR([libpcsclite > 1.4.102 patched with pcsclite_trunk.patch not found, use ./configure PCSC_LIBS=...]) ], + [AC_MSG_WARN([libpcsclite > 1.4.102 patched with pcsclite_trunk.patch not found]) ], [#include ]) AC_MSG_CHECKING([for SCardEstablishContext]) AC_TRY_LINK_FUNC(SCardEstablishContext, [ AC_MSG_RESULT([yes]) ], @@ -188,8 +173,6 @@ Linker flags: ${LDFLAGS} Libraries: ${LIBS} PTHREAD_CFLAGS: ${PTHREAD_CFLAGS} PTHREAD_LIBS: ${PTHREAD_LIBS} -OPENSC_CFLAGS: ${OPENSC_CFLAGS} -OPENSC_LIBS: ${OPENSC_LIBS} OPENSSL_CFLAGS: ${OPENSSL_CFLAGS} OPENSSL_LIBS: ${OPENSSL_LIBS} LIBPACE_CFLAGS: ${LIBPACE_CFLAGS} diff --git a/ccid/src/Makefile.am b/ccid/src/Makefile.am index 901e161..b47c5da 100644 --- a/ccid/src/Makefile.am +++ b/ccid/src/Makefile.am @@ -1,3 +1,9 @@ +OPENSCVERSION = 0.12.0 + +EXTRA_DIST = opensc-$(OPENSCVERSION) + +AM_CPPFLAGS = -I$(top_srcdir)/src/opensc-$(OPENSCVERSION)/src + ccid_emulator_SOURCES = ccid.c usbstring.c usb.c binutil.c ccid_emulator_LDADD = $(OPENSC_LIBS) $(OPENSSL_LIBS) $(PTHREAD_LIBS) ccid_emulator_CFLAGS = $(OPENSC_CFLAGS) $(OPENSSL_CFLAGS) $(PTHREAD_CFLAGS) @@ -15,6 +21,14 @@ noinst_HEADERS = \ ccid.h \ usbstring.h +opensc: opensc-$(OPENSCVERSION) + cd $(top_builddir)/src && cp -r opensc-$(OPENSCVERSION) opensc + +libopensc.la: opensc + cd $(top_builddir)/src/opensc && ./configure + $(MAKE) -C opensc + cp $(top_builddir)/src/opensc/src/libopensc/.libs/libopensc* $(top_builddir)/src + flaw: flawfinder -SQD *.h *.c @@ -33,4 +47,5 @@ ccid_emulator_LDADD += $(LIBPACE_LIBS) ccid_emulator_CFLAGS += $(LIBPACE_CFLAGS) else ccid_emulator_SOURCES += scutil.c +ccid_emulator_LDADD += libopensc.la endif diff --git a/ccid/src/ccid.c b/ccid/src/ccid.c index 4e4cf99..77fdee9 100644 --- a/ccid/src/ccid.c +++ b/ccid/src/ccid.c @@ -16,15 +16,15 @@ * You should have received a copy of the GNU General Public License along with * ccid. If not, see . */ -#include -#include -#include -#include -#include #include -#include +#include +#include #include -#include +#include +#include +#include +#include +#include #include "ccid.h" #include "config.h" @@ -45,11 +45,8 @@ static size_t ef_cardaccess_length = 0; #endif static sc_context_t *ctx = NULL; -#ifdef BUERGERCLIENT_WORKAROUND -static sc_card_t *card_in_slot[1]; -#else +#define SC_MAX_SLOTS 1 static sc_card_t *card_in_slot[SC_MAX_SLOTS]; -#endif static sc_reader_t *reader; struct ccid_class_descriptor @@ -98,35 +95,30 @@ ccid_desc = { #define debug_sc_result(sc_result) \ { \ if (sc_result < 0) \ - sc_error(ctx, sc_strerror(sc_result)); \ + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, sc_strerror(sc_result)); \ else \ - sc_debug(ctx, sc_strerror(sc_result)); \ + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, sc_strerror(sc_result)); \ } static int -detect_card_presence(int slot) +detect_card_presence(void) { int sc_result; - if (slot >= sizeof card_in_slot/sizeof *card_in_slot ) - return SC_ERROR_INVALID_ARGUMENTS; - - sc_result = sc_detect_card_presence(reader, slot); + sc_result = sc_detect_card_presence(reader); if (sc_result == 0 - && card_in_slot[slot] - && sc_card_valid(card_in_slot[slot])) { - sc_disconnect_card(card_in_slot[slot], 0); - sc_debug(ctx, "Card removed from slot %d", slot); + && card_in_slot[0]) { + sc_disconnect_card(card_in_slot[0]); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "Card removed from slot 0"); } - if (sc_result & SC_SLOT_CARD_CHANGED) { - sc_disconnect_card(card_in_slot[slot], 0); - sc_debug(ctx, "Card exchanged in slot %d", slot); + if (sc_result & SC_READER_CARD_CHANGED) { + sc_disconnect_card(card_in_slot[0]); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "Card exchanged in slot 0"); } - if (sc_result & SC_SLOT_CARD_PRESENT - && (!card_in_slot[slot] - || !sc_card_valid(card_in_slot[slot]))) { - sc_debug(ctx, "Unused card in slot %d", slot); + if (sc_result & SC_READER_CARD_PRESENT + && !card_in_slot[0]) { + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "Unused card in slot 0"); } return sc_result; @@ -144,7 +136,7 @@ int ccid_initialize(int reader_id, const char *cdriver, int verbose) if (i < 0) return i; - ccid_desc.bMaxSlotIndex = reader->slot_count - 1; + ccid_desc.bMaxSlotIndex = 1; #ifdef WITH_PACE memset(&sctx, 0, sizeof(sctx)); @@ -162,8 +154,8 @@ void ccid_shutdown() { int i; for (i = 0; i < sizeof card_in_slot/sizeof *card_in_slot; i++) { - if (card_in_slot[i] && sc_card_valid(card_in_slot[i])) { - sc_disconnect_card(card_in_slot[i], 0); + if (card_in_slot[i]) { + sc_disconnect_card(card_in_slot[i]); } } if (ctx) @@ -208,7 +200,7 @@ static int get_rapdu(sc_apdu_t *apdu, size_t slot, __u8 **buf, size_t *resplen) } if (apdu->sw1 > 0xff || apdu->sw2 > 0xff || apdu->sw1 < 0 || apdu->sw2 < 0) { - sc_error(ctx, "Received invalid status bytes SW1=%d SW2=%d", apdu->sw1, apdu->sw2); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Received invalid status bytes SW1=%d SW2=%d", apdu->sw1, apdu->sw2); sc_result = SC_ERROR_INVALID_DATA; goto err; } @@ -219,7 +211,7 @@ static int get_rapdu(sc_apdu_t *apdu, size_t slot, __u8 **buf, size_t *resplen) *buf = apdu->resp; *resplen = apdu->resplen + sizeof(__u8) + sizeof(__u8); - sc_debug(ctx, "R-APDU, %d byte%s:\tsw1=%02x sw2=%02x", + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "R-APDU, %d byte%s:\tsw1=%02x sw2=%02x", (unsigned int) *resplen, !*resplen ? "" : "s", apdu->sw1, apdu->sw2); @@ -236,9 +228,6 @@ static __u8 get_bError(int sc_result) case SC_SUCCESS: return CCID_BERROR_OK; - case SC_ERROR_SLOT_ALREADY_CONNECTED: - return CCID_BERROR_CMD_SLOT_BUSY; - case SC_ERROR_KEYPAD_TIMEOUT: return CCID_BERROR_PIN_TIMEOUT; @@ -261,43 +250,41 @@ static __u8 get_bStatus(int sc_result, __u8 bSlot) int flags; __u8 bstatus = 0; - flags = detect_card_presence(bSlot); + flags = detect_card_presence(); if (flags >= 0) { if (sc_result < 0) { - if (flags & SC_SLOT_CARD_PRESENT) { - if (flags & SC_SLOT_CARD_CHANGED - || (card_in_slot[bSlot] - && !sc_card_valid(card_in_slot[bSlot]))) { - /*sc_debug(ctx, "error inactive");*/ + if (flags & SC_READER_CARD_PRESENT) { + if (flags & SC_READER_CARD_CHANGED + || (card_in_slot[bSlot])) { + /*sc_debug(ctx, SC_LOG_DEBUG_NORMAL, SC_LOG_DEBUG_NORMAL, "error inactive");*/ bstatus = CCID_BSTATUS_ERROR_INACTIVE; } else { - /*sc_debug(ctx, "error active");*/ + /*sc_debug(ctx, SC_LOG_DEBUG_NORMAL, SC_LOG_DEBUG_NORMAL, "error active");*/ bstatus = CCID_BSTATUS_ERROR_ACTIVE; } } else { - /*sc_debug(ctx, "error no icc");*/ + /*sc_debug(ctx, SC_LOG_DEBUG_NORMAL, SC_LOG_DEBUG_NORMAL, "error no icc");*/ bstatus = CCID_BSTATUS_ERROR_NOICC; } } else { - if (flags & SC_SLOT_CARD_PRESENT) { - if (flags & SC_SLOT_CARD_CHANGED || ( - card_in_slot[bSlot] - && !sc_card_valid(card_in_slot[bSlot]))) { - /*sc_debug(ctx, "ok inactive");*/ + if (flags & SC_READER_CARD_PRESENT) { + if (flags & SC_READER_CARD_CHANGED || ( + card_in_slot[bSlot])) { + /*sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "ok inactive");*/ bstatus = CCID_BSTATUS_OK_INACTIVE; } else { - /*sc_debug(ctx, "ok active");*/ + /*sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "ok active");*/ bstatus = CCID_BSTATUS_OK_ACTIVE; } } else { - /*sc_debug(ctx, "ok no icc");*/ + /*sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "ok no icc");*/ bstatus = CCID_BSTATUS_OK_NOICC; } } } else { debug_sc_result(flags); - sc_error(ctx, "Could not detect card presence." + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Could not detect card presence." " Falling back to default (bStatus=0x%02X).", bstatus); } @@ -311,7 +298,7 @@ get_RDR_to_PC_SlotStatus(__u8 bSlot, __u8 bSeq, int sc_result, __u8 **outbuf, si if (!outbuf) return SC_ERROR_INVALID_ARGUMENTS; if (abProtocolDataStructureLen > 0xffff) { - sc_error(ctx, "abProtocolDataStructure %u bytes too long", + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "abProtocolDataStructure %u bytes too long", abProtocolDataStructureLen-0xffff); return SC_ERROR_INVALID_DATA; } @@ -343,7 +330,7 @@ get_RDR_to_PC_DataBlock(__u8 bSlot, __u8 bSeq, int sc_result, __u8 **outbuf, if (!outbuf) return SC_ERROR_INVALID_ARGUMENTS; if (abDataLen > 0xffff) { - sc_error(ctx, "abProtocolDataStructure %u bytes too long", + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "abProtocolDataStructure %u bytes too long", abDataLen-0xffff); return SC_ERROR_INVALID_DATA; } @@ -377,7 +364,7 @@ perform_PC_to_RDR_GetSlotStatus(const __u8 *in, size_t inlen, __u8 **out, size_t return SC_ERROR_INVALID_ARGUMENTS; if (inlen < sizeof *request) - SC_FUNC_RETURN(ctx, SC_LOG_TYPE_ERROR, SC_ERROR_INVALID_DATA); + SC_FUNC_RETURN(ctx, SC_LOG_DEBUG_VERBOSE, SC_ERROR_INVALID_DATA); *outlen = sizeof(RDR_to_PC_SlotStatus_t); @@ -385,7 +372,7 @@ perform_PC_to_RDR_GetSlotStatus(const __u8 *in, size_t inlen, __u8 **out, size_t request->dwLength != __constant_cpu_to_le32(0) || request->abRFU1 != 0 || request->abRFU2 != 0) - sc_debug(ctx, "warning: malformed PC_to_RDR_GetSlotStatus"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "warning: malformed PC_to_RDR_GetSlotStatus"); return get_RDR_to_PC_SlotStatus(request->bSlot, request->bSeq, SC_SUCCESS, out, outlen, NULL, 0); @@ -401,29 +388,28 @@ perform_PC_to_RDR_IccPowerOn(const __u8 *in, size_t inlen, __u8 **out, size_t *o return SC_ERROR_INVALID_ARGUMENTS; if (inlen < sizeof *request) - SC_FUNC_RETURN(ctx, SC_LOG_TYPE_ERROR, SC_ERROR_INVALID_DATA); + SC_FUNC_RETURN(ctx, SC_LOG_DEBUG_VERBOSE, SC_ERROR_INVALID_DATA); if ( request->bMessageType != 0x62 || request->dwLength != __constant_cpu_to_le32(0) || !( request->bPowerSelect == 0 || request->bPowerSelect & ccid_desc.bVoltageSupport ) || request->abRFU != 0) - sc_debug(ctx, "warning: malformed PC_to_RDR_IccPowerOn"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "warning: malformed PC_to_RDR_IccPowerOn"); if (request->bSlot < sizeof card_in_slot/sizeof *card_in_slot) { - if (card_in_slot[request->bSlot] - && sc_card_valid(card_in_slot[request->bSlot])) { - sc_debug(ctx, "Card is already powered on."); - /*sc_reset(card_in_slot[request->bSlot]);*/ - /*sc_disconnect_card(card_in_slot[request->bSlot], 0);*/ + if (card_in_slot[request->bSlot]) { + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "Card is already powered on."); + /*sc_reset(card_in_slot[request->bSlot], 0);*/ + /*sc_disconnect_card(card_in_slot[request->bSlot]);*/ } else { - sc_result = sc_connect_card(reader, request->bSlot, + sc_result = sc_connect_card(reader, &card_in_slot[request->bSlot]); #ifdef BUERGERCLIENT_WORKAROUND if (sc_result >= 0) { if (get_ef_card_access(card_in_slot[request->bSlot], (u8 **) &ef_cardaccess, &ef_cardaccess_length) < 0) { - sc_error(ctx, "Could not get EF.CardAccess."); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Could not get EF.CardAccess."); } } #endif @@ -437,7 +423,7 @@ perform_PC_to_RDR_IccPowerOn(const __u8 *in, size_t inlen, __u8 **out, size_t *o sc_result, out, outlen, card_in_slot[request->bSlot]->atr, card_in_slot[request->bSlot]->atr_len); } else { - sc_error(ctx, "Returning default status package."); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Returning default status package."); return get_RDR_to_PC_SlotStatus(request->bSlot, request->bSeq, sc_result, out, outlen, NULL, 0); } @@ -453,19 +439,19 @@ perform_PC_to_RDR_IccPowerOff(const __u8 *in, size_t inlen, __u8 **out, size_t * return SC_ERROR_INVALID_ARGUMENTS; if (inlen < sizeof *request) - SC_FUNC_RETURN(ctx, SC_LOG_TYPE_ERROR, SC_ERROR_INVALID_DATA); + SC_FUNC_RETURN(ctx, SC_LOG_DEBUG_VERBOSE, SC_ERROR_INVALID_DATA); if ( request->bMessageType != 0x63 || request->dwLength != __constant_cpu_to_le32(0) || request->abRFU1 != 0 || request->abRFU2 != 0) - sc_debug(ctx, "warning: malformed PC_to_RDR_IccPowerOff"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "warning: malformed PC_to_RDR_IccPowerOff"); if (request->bSlot > sizeof card_in_slot/sizeof *card_in_slot) sc_result = SC_ERROR_INVALID_DATA; else { - sc_reset(card_in_slot[request->bSlot]); - sc_result = sc_disconnect_card(card_in_slot[request->bSlot], 0); + sc_reset(card_in_slot[request->bSlot], 1); + sc_result = sc_disconnect_card(card_in_slot[request->bSlot]); } return get_RDR_to_PC_SlotStatus(request->bSlot, request->bSeq, sc_result, @@ -486,11 +472,11 @@ perform_PC_to_RDR_XfrBlock(const u8 *in, size_t inlen, __u8** out, size_t *outle return SC_ERROR_INVALID_ARGUMENTS; if (inlen < sizeof *request) - SC_FUNC_RETURN(ctx, SC_LOG_TYPE_ERROR, SC_ERROR_INVALID_DATA); + SC_FUNC_RETURN(ctx, SC_LOG_DEBUG_VERBOSE, SC_ERROR_INVALID_DATA); if ( request->bMessageType != 0x6F || request->bBWI != 0) - sc_debug(ctx, "malformed PC_to_RDR_XfrBlock, will continue anyway"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "malformed PC_to_RDR_XfrBlock, will continue anyway"); if (request->bSlot > sizeof card_in_slot/sizeof *card_in_slot) sc_result = SC_ERROR_INVALID_DATA; @@ -501,7 +487,7 @@ perform_PC_to_RDR_XfrBlock(const u8 *in, size_t inlen, __u8** out, size_t *outle sc_result = get_rapdu(&apdu, request->bSlot, &abDataOut, &abDataOutLen); else - bin_log(ctx, "Invalid APDU", abDataIn, + bin_log(ctx, SC_LOG_DEBUG_VERBOSE, "Invalid APDU", abDataIn, __le32_to_cpu(request->dwLength)); } @@ -526,14 +512,14 @@ perform_PC_to_RDR_GetParamters(const __u8 *in, size_t inlen, __u8** out, size_t return SC_ERROR_INVALID_ARGUMENTS; if (inlen < sizeof *request) - SC_FUNC_RETURN(ctx, SC_LOG_TYPE_ERROR, SC_ERROR_INVALID_DATA); + SC_FUNC_RETURN(ctx, SC_LOG_DEBUG_VERBOSE, SC_ERROR_INVALID_DATA); if ( request->bMessageType != 0x6C || request->dwLength != __constant_cpu_to_le32(0)) - sc_debug(ctx, "warning: malformed PC_to_RDR_GetParamters"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "warning: malformed PC_to_RDR_GetParamters"); if (request->bSlot < sizeof card_in_slot/sizeof *card_in_slot) { - switch (reader->slot[request->bSlot].active_protocol) { + switch (reader->active_protocol) { case SC_PROTO_T0: result = realloc(*out, sizeof *result + sizeof *t0); if (!result) @@ -650,7 +636,7 @@ write_pin_length(sc_apdu_t *apdu, const struct sc_pin_cmd_pin *pin, if (length_size) { if (length_size != 8) { - sc_error(ctx, "Writing PIN length only if it fits into " + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Writing PIN length only if it fits into " "a full byte (length of PIN size was %u bits)", length_size); *sc_result = SC_ERROR_NOT_SUPPORTED; @@ -728,7 +714,7 @@ encode_pin(u8 *buf, size_t buf_len, struct sc_pin_cmd_pin *pin, else if (encoding == CCID_PIN_ENCODING_ASCII) pin->encoding = SC_PIN_ENCODING_ASCII; else { - sc_error(ctx, "PIN encoding not supported (0x%02x)", encoding); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "PIN encoding not supported (0x%02x)", encoding); *sc_result = SC_ERROR_NOT_SUPPORTED; return 0; } @@ -758,7 +744,7 @@ write_pin(sc_apdu_t *apdu, struct sc_pin_cmd_pin *pin, uint8_t blocksize, if (justify_right) { if (encoding == CCID_PIN_ENCODING_BCD) { if (pin->len % 2) { - sc_error(ctx, "Right aligning BCD encoded PIN only if it fits " + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Right aligning BCD encoded PIN only if it fits " "into a full byte (length of encoded PIN was %u bits)", (pin->len)*4); *sc_result = SC_ERROR_NOT_SUPPORTED; @@ -800,7 +786,7 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, } if (abDatalen < parsed+1) { - sc_error(ctx, "Buffer too small, could not get PinID"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Buffer too small, could not get PinID"); sc_result = SC_ERROR_INVALID_ARGUMENTS; goto err; } @@ -809,7 +795,7 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, if (abDatalen < parsed+1) { - sc_error(ctx, "Buffer too small, could not get lengthCHAT"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Buffer too small, could not get lengthCHAT"); sc_result = SC_ERROR_INVALID_ARGUMENTS; goto err; } @@ -817,19 +803,19 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, parsed++; if (abDatalen < parsed+pace_input.chat_length) { - sc_error(ctx, "Buffer too small, could not get CHAT"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Buffer too small, could not get CHAT"); sc_result = SC_ERROR_INVALID_ARGUMENTS; goto err; } pace_input.chat = &abData[parsed]; parsed += pace_input.chat_length; if (pace_input.chat_length) - bin_log(ctx, "Card holder authorization template", + bin_log(ctx, SC_LOG_DEBUG_VERBOSE, "Card holder authorization template", pace_input.chat, pace_input.chat_length); if (abDatalen < parsed+1) { - sc_error(ctx, "Buffer too small, could not get lengthPIN"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Buffer too small, could not get lengthPIN"); sc_result = SC_ERROR_INVALID_ARGUMENTS; goto err; } @@ -837,7 +823,7 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, parsed++; if (abDatalen < parsed+pace_input.pin_length) { - sc_error(ctx, "Buffer too small, could not get PIN"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Buffer too small, could not get PIN"); sc_result = SC_ERROR_INVALID_ARGUMENTS; goto err; } @@ -846,7 +832,7 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, if (abDatalen < parsed+sizeof word) { - sc_error(ctx, "Buffer too small, could not get lengthCertificateDescription"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Buffer too small, could not get lengthCertificateDescription"); sc_result = SC_ERROR_INVALID_ARGUMENTS; goto err; } @@ -856,14 +842,14 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, parsed += sizeof word; if (abDatalen < parsed+pace_input.certificate_description_length) { - sc_error(ctx, "Buffer too small, could not get CertificateDescription"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Buffer too small, could not get CertificateDescription"); sc_result = SC_ERROR_INVALID_ARGUMENTS; goto err; } pace_input.certificate_description = &abData[parsed]; parsed += pace_input.certificate_description_length; if (pace_input.certificate_description_length) - bin_log(ctx, "Certificate description", + bin_log(ctx, SC_LOG_DEBUG_VERBOSE, "Certificate description", pace_input.certificate_description, pace_input.certificate_description_length); @@ -919,7 +905,7 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, if (pace_output.ef_cardaccess_length > 0xffff) { - sc_error(ctx, "EF.CardAcces %u bytes too long", + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "EF.CardAcces %u bytes too long", pace_output.ef_cardaccess_length-0xffff); sc_result = SC_ERROR_INVALID_DATA; goto err; @@ -936,7 +922,7 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, if (pace_output.recent_car_length > 0xff) { - sc_error(ctx, "Most recent CAR %u bytes too long", + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Most recent CAR %u bytes too long", pace_output.recent_car_length-0xff); sc_result = SC_ERROR_INVALID_DATA; goto err; @@ -951,7 +937,7 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, if (pace_output.previous_car_length > 0xff) { - sc_error(ctx, "Previous CAR %u bytes too long", + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Previous CAR %u bytes too long", pace_output.previous_car_length-0xff); sc_result = SC_ERROR_INVALID_DATA; goto err; @@ -966,7 +952,7 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, if (pace_output.id_icc_length > 0xffff) { - sc_error(ctx, "ID ICC %u bytes too long", + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "ID ICC %u bytes too long", pace_output.id_icc_length-0xffff); sc_result = SC_ERROR_INVALID_DATA; goto err; @@ -1050,14 +1036,14 @@ perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, const __u8 *abData, size_t abDatalen, __u8 **abDataOut, size_t *abDataOutLen) { - sc_error(ctx, "ccid compiled without PACE support."); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "ccid compiled without PACE support."); return SC_ERROR_NOT_SUPPORTED; } static int perform_PC_to_RDR_Secure_GetReadersPACECapabilities(__u8 **abDataOut, size_t *abDataOutLen) { - sc_error(ctx, "ccid compiled without PACE support."); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "ccid compiled without PACE support."); return SC_ERROR_NOT_SUPPORTED; } #endif @@ -1083,18 +1069,18 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle return SC_ERROR_INVALID_ARGUMENTS; if (inlen < sizeof *request + 1) - SC_FUNC_RETURN(ctx, SC_LOG_TYPE_ERROR, SC_ERROR_INVALID_DATA); + SC_FUNC_RETURN(ctx, SC_LOG_DEBUG_VERBOSE, SC_ERROR_INVALID_DATA); if (request->bMessageType != 0x69) - sc_debug(ctx, "warning: malformed PC_to_RDR_Secure"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "warning: malformed PC_to_RDR_Secure"); if (request->bSlot > sizeof card_in_slot/sizeof *card_in_slot) { - sc_error(ctx, "Received request to invalid slot (bSlot=0x%02x)", request->bSlot); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Received request to invalid slot (bSlot=0x%02x)", request->bSlot); goto err; } if (request->wLevelParameter != CCID_WLEVEL_DIRECT) { - sc_error(ctx, "Received request with unsupported wLevelParameter (0x%04x)", + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Received request with unsupported wLevelParameter (0x%04x)", __le16_to_cpu(request->wLevelParameter)); sc_result = SC_ERROR_NOT_SUPPORTED; goto err; @@ -1131,7 +1117,7 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle (abData + sizeof(__u8)); if (abDatalen < sizeof *modify) { - sc_error(ctx, "Not enough data for abPINDataStucture_Modification_t"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Not enough data for abPINDataStucture_Modification_t"); sc_result = SC_ERROR_INVALID_DATA; goto err; } @@ -1150,7 +1136,7 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle &abDataOut, &abDataOutLen); if (card_in_slot[request->bSlot]) - bin_log(card_in_slot[request->bSlot]->ctx, "PACE Capabilities", abDataOut, abDataOutLen); + bin_log(card_in_slot[request->bSlot]->ctx, SC_LOG_DEBUG_VERBOSE, "PACE Capabilities", abDataOut, abDataOutLen); goto err; break; @@ -1164,7 +1150,7 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle case 0x04: // Cancel PIN function default: - sc_error(ctx, "Received request with unsupported PIN operation (bPINOperation=0x%02x)", + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Received request with unsupported PIN operation (bPINOperation=0x%02x)", *abData); sc_result = SC_ERROR_NOT_SUPPORTED; goto err; @@ -1172,10 +1158,9 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle sc_result = build_apdu(ctx, abPINApdu, apdulen, &apdu); if (sc_result < 0) { - bin_log(ctx, "Invalid APDU", abPINApdu, apdulen); + bin_log(ctx, SC_LOG_DEBUG_VERBOSE, "Invalid APDU", abPINApdu, apdulen); goto err; } - apdu.sensitive = 1; new_pin.min_length = curr_pin.min_length = wPINMaxExtraDigit >> 8; new_pin.min_length = curr_pin.max_length = wPINMaxExtraDigit & 0x00ff; @@ -1187,7 +1172,7 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle uint8_t encoding = bmFormatString & 2; uint8_t blocksize = bmPINBlockString & 0xf; - sc_debug(ctx, "PIN %s block (%d bytes) proberties:\n" + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "PIN %s block (%d bytes) proberties:\n" "\tminimum %d, maximum %d PIN digits\n" "\t%s PIN encoding, %s justification\n" "\tsystem units are %s\n" @@ -1212,7 +1197,7 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle "Please enter your PIN for verification: ", 0)) { sc_result = SC_ERROR_INTERNAL; - sc_error(ctx, "Could not read PIN.\n"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Could not read PIN.\n"); goto err; } } else { @@ -1223,7 +1208,7 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle "Please enter your current PIN for modification: ", 0)) { sc_result = SC_ERROR_INTERNAL; - sc_error(ctx, "Could not read current PIN.\n"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Could not read current PIN.\n"); goto err; } } @@ -1233,7 +1218,7 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle "Please enter your new PIN for modification: ", modify->bConfirmPIN & CCID_PIN_CONFIRM_NEW)) { sc_result = SC_ERROR_INTERNAL; - sc_error(ctx, "Could not read new PIN.\n"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Could not read new PIN.\n"); goto err; } } @@ -1325,46 +1310,38 @@ get_RDR_to_PC_NotifySlotChange(RDR_to_PC_NotifySlotChange_t **out) result->bmSlotICCState = CCID_SLOTS_UNCHANGED; oldmask = CCID_SLOTS_UNCHANGED; - for (i = 0; i < reader->slot_count; i++) { - sc_result = detect_card_presence(i); - if (sc_result < 0) { - sc_error(ctx, "Could not detect card presence, skipping slot %d.", - i); - debug_sc_result(sc_result); - continue; - } - - if (sc_result & SC_SLOT_CARD_PRESENT) - oldmask |= present[i]; - if (sc_result & SC_SLOT_CARD_CHANGED) { - sc_debug(ctx, "Card status changed in slot %d.", i); - result->bmSlotICCState |= changed[i]; - } - + sc_result = detect_card_presence(); + if (sc_result < 0) { + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Could not detect card presence."); + debug_sc_result(sc_result); } + if (sc_result & SC_READER_CARD_PRESENT) + oldmask |= present[0]; + if (sc_result & SC_READER_CARD_CHANGED) { + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "Card status changed in slot 0."); + result->bmSlotICCState |= changed[0]; + } + + sleep(10); - for (i = 0; i < reader->slot_count; i++) { - sc_result = detect_card_presence(i); - if (sc_result < 0) { - sc_error(ctx, "Could not detect card presence, skipping slot %d.", - i); - debug_sc_result(sc_result); - continue; - } + sc_result = detect_card_presence(); + if (sc_result < 0) { + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Could not detect card presence."); + debug_sc_result(sc_result); + } - if (sc_result & SC_SLOT_CARD_PRESENT) - result->bmSlotICCState |= present[i]; - if (sc_result & SC_SLOT_CARD_CHANGED) { - sc_debug(ctx, "Card status changed in slot %d.", i); - result->bmSlotICCState |= changed[i]; - } + if (sc_result & SC_READER_CARD_PRESENT) + result->bmSlotICCState |= present[0]; + if (sc_result & SC_READER_CARD_CHANGED) { + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "Card status changed in slot 0."); + result->bmSlotICCState |= changed[0]; + } - if ((oldmask & present[i]) != (result->bmSlotICCState & present[i])) { - sc_debug(ctx, "Card status changed in slot %d.", i); - result->bmSlotICCState |= changed[i]; - } + if ((oldmask & present[0]) != (result->bmSlotICCState & present[0])) { + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "Card status changed in slot 0."); + result->bmSlotICCState |= changed[0]; } return SC_SUCCESS; @@ -1380,7 +1357,7 @@ perform_unknown(const __u8 *in, size_t inlen, __u8 **out, size_t *outlen) return SC_ERROR_INVALID_ARGUMENTS; if (inlen < sizeof *request) - SC_FUNC_RETURN(ctx, SC_LOG_TYPE_ERROR, SC_ERROR_INVALID_DATA); + SC_FUNC_RETURN(ctx, SC_LOG_DEBUG_VERBOSE, SC_ERROR_INVALID_DATA); result = realloc(*out, sizeof *result); if (!result) @@ -1413,7 +1390,7 @@ perform_unknown(const __u8 *in, size_t inlen, __u8 **out, size_t *outlen) result->bMessageType = 0x84; break; default: - sc_debug(ctx, "Unknown message type in request (0x%02x). " + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "Unknown message type in request (0x%02x). " "Using bMessageType=0x%02x for output.", request->bMessageType, 0); result->bMessageType = 0; @@ -1441,37 +1418,37 @@ int ccid_parse_bulkout(const __u8* inbuf, size_t inlen, __u8** outbuf) switch (*inbuf) { case 0x62: - sc_debug(ctx, "PC_to_RDR_IccPowerOn"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "PC_to_RDR_IccPowerOn"); sc_result = perform_PC_to_RDR_IccPowerOn(inbuf, inlen, outbuf, &outlen); break; case 0x63: - sc_debug(ctx, "PC_to_RDR_IccPowerOff"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "PC_to_RDR_IccPowerOff"); sc_result = perform_PC_to_RDR_IccPowerOff(inbuf, inlen, outbuf, &outlen); break; case 0x65: - sc_debug(ctx, "PC_to_RDR_GetSlotStatus"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "PC_to_RDR_GetSlotStatus"); sc_result = perform_PC_to_RDR_GetSlotStatus(inbuf, inlen, outbuf, &outlen); break; case 0x6F: - sc_debug(ctx, "PC_to_RDR_XfrBlock"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "PC_to_RDR_XfrBlock"); sc_result = perform_PC_to_RDR_XfrBlock(inbuf, inlen, outbuf, &outlen); break; case 0x6C: - sc_debug(ctx, "PC_to_RDR_GetParameters"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "PC_to_RDR_GetParameters"); sc_result = perform_PC_to_RDR_GetParamters(inbuf, inlen, outbuf, &outlen); break; case 0x69: - sc_debug(ctx, "PC_to_RDR_Secure"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "PC_to_RDR_Secure"); sc_result = perform_PC_to_RDR_Secure(inbuf, inlen, outbuf, &outlen); break; default: - sc_error(ctx, "Unknown ccid bulk-in message. " + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Unknown ccid bulk-in message. " "Starting default handler..."); sc_result = perform_unknown(inbuf, inlen, outbuf, &outlen); } @@ -1500,18 +1477,18 @@ int ccid_parse_control(struct usb_ctrlrequest *setup, __u8 **outbuf) if (setup->bRequestType == USB_REQ_CCID) { switch(setup->bRequest) { case CCID_CONTROL_ABORT: - sc_debug(ctx, "ABORT"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "ABORT"); if (length != 0x00) { - sc_debug(ctx, "warning: malformed ABORT"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "warning: malformed ABORT"); } r = 0; break; case CCID_CONTROL_GET_CLOCK_FREQUENCIES: - sc_debug(ctx, "GET_CLOCK_FREQUENCIES"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "GET_CLOCK_FREQUENCIES"); if (value != 0x00) { - sc_debug(ctx, "warning: malformed GET_CLOCK_FREQUENCIES"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "warning: malformed GET_CLOCK_FREQUENCIES"); } r = sizeof(__le32); @@ -1527,9 +1504,9 @@ int ccid_parse_control(struct usb_ctrlrequest *setup, __u8 **outbuf) break; case CCID_CONTROL_GET_DATA_RATES: - sc_debug(ctx, "GET_DATA_RATES"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "GET_DATA_RATES"); if (value != 0x00) { - sc_debug(ctx, "warning: malformed GET_DATA_RATES"); + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "warning: malformed GET_DATA_RATES"); } r = sizeof (__le32); @@ -1545,7 +1522,7 @@ int ccid_parse_control(struct usb_ctrlrequest *setup, __u8 **outbuf) break; default: - sc_error(ctx, "Unknown ccid control command."); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Unknown ccid control command."); r = SC_ERROR_NOT_SUPPORTED; } diff --git a/ccid/src/ccid.h b/ccid/src/ccid.h index 69b7772..72f0563 100644 --- a/ccid/src/ccid.h +++ b/ccid/src/ccid.h @@ -23,7 +23,7 @@ #define _CCID_H #include -#include +#include #ifdef __cplusplus extern "C" { diff --git a/npa/Makefile.am b/npa/Makefile.am index ed6f810..fadac87 100644 --- a/npa/Makefile.am +++ b/npa/Makefile.am @@ -16,6 +16,20 @@ do_subst = sed \ -e 's,[@]VERSION[@],$(VERSION),g' \ -e 's,[@]top_srcdir[@],$(top_srcdir),g' +opensc-0.11.13.tar.gz: + wget http://www.opensc-project.org/files/opensc/opensc-0.11.13.tar.gz + +opensc-0.11.13: opensc-0.11.13.tar.gz + tar xzf opensc-0.11.13.tar.gz + patch -p1 -d opensc-0.11.13 < opensc/le0.patch + patch -p0 -d opensc-0.11.13 < opensc/hex_dump_align.2.patch + +win: opensc-0.11.13 + cd opensc-0.11.13 && \ + ./bootstrap && \ + ./configure --disable-doc && \ + env OPENSSL_VERSION="1.0.0c_with_openpace-0.4.1" OPENSSL_URL="http://downloads.sourceforge.net/project/openpace/openssl-1.0.0c_with_openpace-0.4.1.tar.gz" EXTRA_OPENSSL_CONFIG="experimental-pace" ../opensc/installer_from_build.sh opensc/win32/build + if DOC_ENABLED clean-local: rm -rf doc diff --git a/npa/configure.ac b/npa/configure.ac index ac32c6a..ff449be 100644 --- a/npa/configure.ac +++ b/npa/configure.ac @@ -19,9 +19,6 @@ AM_PROG_CC_C_O PKG_PROG_PKG_CONFIG # Checks for libraries. -PKG_CHECK_EXISTS([libopensc], - [PKG_CHECK_MODULES([OPENSC], [libopensc < 0.12 ])], - [AC_MSG_WARN([libopensc < 0.12 not found by pkg-config])]) PKG_CHECK_EXISTS([libssl], [PKG_CHECK_MODULES([OPENSSL], [libssl])], [AC_MSG_WARN([libssl not found by pkg-config])]) @@ -29,14 +26,8 @@ PKG_CHECK_EXISTS([libssl], saved_CPPFLAGS="$CPPFLAGS" saved_LIBS="$LIBS" -CPPFLAGS="$CPPFLAGS $OPENSC_CFLAGS $OPENSSL_CFLAGS" -LIBS="$LDFLAGS $OPENSC_LIBS $OPENSSL_LIBS" - -AC_CHECK_HEADERS(opensc/opensc.h,, - [ AC_MSG_ERROR([opensc/opensc.h not found, install libopensc < 0.12 or use ./configure OPENSC_CFLAGS=...]) ]) -AC_MSG_CHECKING([for sc_context_create]) -AC_TRY_LINK_FUNC(sc_context_create, [ AC_MSG_RESULT([yes]) ], - [ AC_MSG_ERROR([libopensc < 0.12 not found, use ./configure OPENSC_LIBS=...]) ]) +CPPFLAGS="$CPPFLAGS $OPENSSL_CFLAGS" +LIBS="$LDFLAGS $OPENSSL_LIBS" AC_CHECK_HEADERS(openssl/evp.h, [], [ AC_MSG_ERROR([openssl/evp.h not found, install OpenSSL or use ./configure OPENSSL_CFLAGS=...]) ]) AC_MSG_CHECKING([for EVP_read_pw_string_min]) @@ -100,8 +91,6 @@ Compiler flags: ${CFLAGS} Preprocessor flags: ${CPPFLAGS} Linker flags: ${LDFLAGS} Libraries: ${LIBS} -OPENSC_CFLAGS: ${OPENSC_CFLAGS} -OPENSC_LIBS: ${OPENSC_LIBS} OPENSSL_CFLAGS: ${OPENSSL_CFLAGS} OPENSSL_LIBS: ${OPENSSL_LIBS} diff --git a/npa/src/Makefile.am b/npa/src/Makefile.am index 49931a5..203138d 100644 --- a/npa/src/Makefile.am +++ b/npa/src/Makefile.am @@ -1,17 +1,26 @@ -AM_CPPFLAGS = -I$(top_srcdir)/src/pace -I$(top_builddir)/src/pace +OPENSCVERSION = 0.12.0 + +EXTRA_DIST = opensc-$(OPENSCVERSION) + +AM_CPPFLAGS = -I$(top_srcdir)/src/pace -I$(top_srcdir)/src/opensc-$(OPENSCVERSION)/src libpace_la_SOURCES = sm.c scutil.c pace.c pace_lib.c -libpace_la_LIBADD = $(OPENSC_LIBS) $(OPENSSL_LIBS) -libpace_la_CFLAGS = $(OPENSC_CFLAGS) $(OPENSSL_CFLAGS) +libpace_la_LIBADD = $(OPENSSL_LIBS) libopensc.la +libpace_la_CFLAGS = $(OPENSSL_CFLAGS) pace_tool_SOURCES = pace-tool.c binutil.c -pace_tool_LDADD = $(OPENSC_LIBS) $(OPENSSL_LIBS) libpace.la -pace_tool_CFLAGS = $(OPENSC_CFLAGS) $(OPENSSL_CFLAGS) +pace_tool_LDADD = $(OPENSSL_LIBS) libpace.la libopensc.la +pace_tool_CFLAGS = $(OPENSSL_CFLAGS) noinst_HEADERS = \ binutil.h -flaw: - flawfinder -SQD *.h *.c +opensc: opensc-$(OPENSCVERSION) + cd $(top_builddir)/src && cp -r opensc-$(OPENSCVERSION) opensc + +libopensc.la: opensc + cd $(top_builddir)/src/opensc && ./configure + $(MAKE) -C opensc + cp $(top_builddir)/src/opensc/src/libopensc/.libs/libopensc* $(top_builddir)/src bin_PROGRAMS = pace-tool diff --git a/npa/src/pace-tool.c b/npa/src/pace-tool.c index 6591999..43dc96c 100644 --- a/npa/src/pace-tool.c +++ b/npa/src/pace-tool.c @@ -19,7 +19,7 @@ #include "binutil.h" #include "pace.h" #include "scutil.h" -#include +#include #include #include #include @@ -130,7 +130,8 @@ int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card, FILE *input) if (linelen <= 1) { if (linelen < 0) { r = SC_ERROR_INTERNAL; - sc_error(card->ctx, "Could not read line"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE_TOOL, + "Could not read line"); } else { r = SC_SUCCESS; printf("Thanks for flying with ccid\n"); @@ -141,7 +142,8 @@ int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card, FILE *input) apdulen = sizeof buf; if (sc_hex_to_bin(read, buf, &apdulen) < 0) { - sc_error(card->ctx, "Could not format binary string"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE_TOOL, + "Could not format binary string"); continue; } if (input != stdin) @@ -149,7 +151,7 @@ int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card, FILE *input) r = build_apdu(card->ctx, buf, apdulen, &apdu); if (r < 0) { - bin_log(ctx, "Invalid C-APDU", buf, apdulen); + bin_log(ctx, SC_LOG_DEBUG_NORMAL, "Invalid C-APDU", buf, apdulen); continue; } @@ -158,7 +160,8 @@ int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card, FILE *input) r = sm_transmit_apdu(sctx, card, &apdu); if (r < 0) { - sc_error(card->ctx, "Could not send C-APDU: %s", sc_strerror(r)); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE_TOOL, + "Could not send C-APDU: %s", sc_strerror(r)); continue; } @@ -312,14 +315,8 @@ main (int argc, char **argv) exit(1); } - for (i = 0; i < SC_MAX_SLOTS; i++) { - if (sc_detect_card_presence(reader, 0) & SC_SLOT_CARD_PRESENT) { - sc_connect_card(reader, i, &card); - break; - } - } - if (i == SC_MAX_SLOTS) { - fprintf(stderr, "No card found\n"); + if (sc_connect_card(reader, &card) < 0) { + fprintf(stderr, "Could not connect to card\n"); sc_release_context(ctx); exit(1); } @@ -547,8 +544,8 @@ err: if (pace_output.id_pcd) free(pace_output.id_pcd); - sc_reset(card); - sc_disconnect_card(card, 0); + sc_reset(card, 1); + sc_disconnect_card(card); sc_release_context(ctx); return -i; diff --git a/npa/src/pace.c b/npa/src/pace.c index 7e02166..2ae0f9b 100644 --- a/npa/src/pace.c +++ b/npa/src/pace.c @@ -19,9 +19,9 @@ #include "pace.h" #include "sm.h" #include "scutil.h" -#include -#include -#include +#include +#include +#include #include #include #include @@ -198,18 +198,18 @@ int get_ef_card_access(sc_card_t *card, memset(&path, 0, sizeof path); r = sc_append_file_id(&path, FID_EF_CARDACCESS); if (r < 0) { - sc_error(card->ctx, "Could not create path object."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not create path object."); goto err; } r = sc_concatenate_path(&path, sc_get_mf_path(), &path); if (r < 0) { - sc_error(card->ctx, "Could not create path object."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not create path object."); goto err; } r = sc_select_file(card, &path, &file); if (r < 0) { - sc_error(card->ctx, "Could not select EF.CardAccess."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not select EF.CardAccess."); goto err; } @@ -231,7 +231,7 @@ int get_ef_card_access(sc_card_t *card, } if (r < 0) { - sc_error(card->ctx, "Could not read EF.CardAccess."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not read EF.CardAccess."); goto err; } @@ -241,7 +241,7 @@ int get_ef_card_access(sc_card_t *card, /* test cards only return an empty FCI template, * so we can't determine any file proberties */ if (*length_ef_cardaccess < file->size) { - sc_error(card->ctx, "Actual filesize differs from the size in file " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Actual filesize differs from the size in file " "proberties (%u!=%u).", *length_ef_cardaccess, file->size); r = SC_ERROR_FILE_TOO_SMALL; goto err; @@ -298,7 +298,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card, } if (!ASN1_INTEGER_set(data->key_reference1, secret_key)) { - sc_error(card->ctx, "Error setting key reference 1 of MSE:Set AT data"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Error setting key reference 1 of MSE:Set AT data"); r = SC_ERROR_INTERNAL; goto err; } @@ -308,7 +308,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card, r = i2d_PACE_MSE_SET_AT_C(data, &d); if (r < 0) { - sc_error(card->ctx, "Error encoding MSE:Set AT APDU data"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Error encoding MSE:Set AT APDU data"); r = SC_ERROR_INTERNAL; goto err; } @@ -318,8 +318,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card, apdu.data = sc_asn1_find_tag(card->ctx, d, r, 0x30, &apdu.datalen); apdu.lc = apdu.datalen; - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "MSE:Set AT command data", apdu.data, apdu.datalen); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "MSE:Set AT command data", apdu.data, apdu.datalen); if (oldpacectx) r = sm_transmit_apdu(oldpacectx, card, &apdu); @@ -329,7 +328,7 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card, goto err; if (apdu.resplen) { - sc_error(card->ctx, "MSE:Set AT response data should be empty " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "MSE:Set AT response data should be empty " "(contains %u bytes)", apdu.resplen); r = SC_ERROR_UNKNOWN_DATA_RECEIVED; goto err; @@ -343,19 +342,19 @@ static int pace_mse_set_at(struct sm_ctx *oldpacectx, sc_card_t *card, tries = apdu.sw2 & 0x0f; if (tries <= 1) { /* this is only a warning... */ - sc_error(card->ctx, "Remaining tries: %d (%s must be %s)\n", + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Remaining tries: %d (%s must be %s)\n", tries, pace_secret_name(secret_key), tries ? "resumed" : "unblocked"); } r = SC_SUCCESS; } else { - sc_error(card->ctx, "Unknown status bytes: SW1=%02X, SW2=%02X\n", + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Unknown status bytes: SW1=%02X, SW2=%02X\n", apdu.sw1, apdu.sw2); r = SC_ERROR_CARD_CMD_FAILED; goto err; } } else if (apdu.sw1 == 0x62 && apdu.sw2 == 0x83) { - sc_error(card->ctx, "Password is deactivated\n"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Password is deactivated\n"); r = SC_ERROR_AUTH_METHOD_BLOCKED; goto err; } else { @@ -405,8 +404,7 @@ static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx, apdu.datalen = r; apdu.lc = r; - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "General authenticate (Encrypted Nonce) command data", apdu.data, apdu.datalen); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Encrypted Nonce) command data", apdu.data, apdu.datalen); apdu.resplen = maxresp; apdu.resp = malloc(apdu.resplen); @@ -421,12 +419,11 @@ static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx, if (r < 0) goto err; - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "General authenticate (Encrypted Nonce) response data", apdu.resp, apdu.resplen); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Encrypted Nonce) response data", apdu.resp, apdu.resplen); if (!d2i_PACE_GEN_AUTH_R(&r_data, (const unsigned char **) &apdu.resp, apdu.resplen)) { - sc_error(card->ctx, "Could not parse general authenticate response data."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); r = SC_ERROR_INTERNAL; goto err; } @@ -437,7 +434,7 @@ static int pace_gen_auth_1_encrypted_nonce(struct sm_ctx *oldpacectx, || r_data->auth_token || r_data->cur_car || r_data->prev_car) { - sc_error(card->ctx, "Response data of general authenticate for " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Response data of general authenticate for " "step 1 should (only) contain the encrypted nonce."); r = SC_ERROR_UNKNOWN_DATA_RECEIVED; goto err; @@ -520,8 +517,7 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx, apdu.datalen = r; apdu.lc = r; - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "General authenticate (Map Nonce) command data", apdu.data, apdu.datalen); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Map Nonce) command data", apdu.data, apdu.datalen); apdu.resplen = maxresp; apdu.resp = malloc(apdu.resplen); @@ -536,12 +532,11 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx, if (r < 0) goto err; - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "General authenticate (Map Nonce) response data", apdu.resp, apdu.resplen); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Map Nonce) response data", apdu.resp, apdu.resplen); if (!d2i_PACE_GEN_AUTH_R(&r_data, (const unsigned char **) &apdu.resp, apdu.resplen)) { - sc_error(card->ctx, "Could not parse general authenticate response data."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); r = SC_ERROR_INTERNAL; goto err; } @@ -552,7 +547,7 @@ static int pace_gen_auth_2_map_nonce(struct sm_ctx *oldpacectx, || r_data->auth_token || r_data->cur_car || r_data->prev_car) { - sc_error(card->ctx, "Response data of general authenticate for " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Response data of general authenticate for " "step 2 should (only) contain the mapping data."); r = SC_ERROR_UNKNOWN_DATA_RECEIVED; goto err; @@ -635,8 +630,7 @@ static int pace_gen_auth_3_perform_key_agreement( apdu.datalen = r; apdu.lc = r; - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "General authenticate (Perform Key Agreement) command data", apdu.data, apdu.datalen); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) command data", apdu.data, apdu.datalen); apdu.resplen = maxresp; apdu.resp = malloc(apdu.resplen); @@ -651,12 +645,11 @@ static int pace_gen_auth_3_perform_key_agreement( if (r < 0) goto err; - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen); if (!d2i_PACE_GEN_AUTH_R(&r_data, (const unsigned char **) &apdu.resp, apdu.resplen)) { - sc_error(card->ctx, "Could not parse general authenticate response data."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); r = SC_ERROR_INTERNAL; goto err; } @@ -667,7 +660,7 @@ static int pace_gen_auth_3_perform_key_agreement( || r_data->auth_token || r_data->cur_car || r_data->prev_car) { - sc_error(card->ctx, "Response data of general authenticate for " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Response data of general authenticate for " "step 3 should (only) contain the ephemeral public key."); r = SC_ERROR_UNKNOWN_DATA_RECEIVED; goto err; @@ -753,8 +746,7 @@ static int pace_gen_auth_4_mutual_authentication( apdu.datalen = r; apdu.lc = r; - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "General authenticate (Perform Key Agreement) command data", apdu.data, apdu.datalen); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) command data", apdu.data, apdu.datalen); apdu.resplen = maxresp; apdu.resp = malloc(apdu.resplen); @@ -769,12 +761,11 @@ static int pace_gen_auth_4_mutual_authentication( if (r < 0) goto err; - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen); if (!d2i_PACE_GEN_AUTH_R(&r_data, (const unsigned char **) &apdu.resp, apdu.resplen)) { - sc_error(card->ctx, "Could not parse general authenticate response data."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); r = SC_ERROR_INTERNAL; goto err; } @@ -783,7 +774,7 @@ static int pace_gen_auth_4_mutual_authentication( || r_data->mapping_data || r_data->eph_pub_key || !r_data->auth_token) { - sc_error(card->ctx, "Response data of general authenticate for " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Response data of general authenticate for " "step 4 should (only) contain the authentication token."); r = SC_ERROR_UNKNOWN_DATA_RECEIVED; goto err; @@ -792,7 +783,7 @@ static int pace_gen_auth_4_mutual_authentication( l = r_data->auth_token->length; /* XXX CAR sould be returned as result in some way */ if (r_data->cur_car) { - bin_log(card->ctx, "Most recent Certificate Authority Reference", + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Most recent Certificate Authority Reference", r_data->cur_car->data, r_data->cur_car->length); *recent_car = malloc(r_data->cur_car->length); if (!*recent_car) { @@ -805,7 +796,7 @@ static int pace_gen_auth_4_mutual_authentication( } else *recent_car_len = 0; if (r_data->prev_car) { - bin_log(card->ctx, "Previous Certificate Authority Reference", + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Previous Certificate Authority Reference", r_data->prev_car->data, r_data->prev_car->length); *prev_car = malloc(r_data->prev_car->length); if (!*prev_car) { @@ -869,13 +860,13 @@ pace_reset_retry_counter(struct sm_ctx *ctx, sc_card_t *card, if (ask_for_secret && (!new || !new_len)) { p = malloc(MAX_PIN_LEN+1); if (!p) { - sc_error(card->ctx, "Not enough memory for new PIN.\n"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for new PIN.\n"); return SC_ERROR_OUT_OF_MEMORY; } if (0 > EVP_read_pw_string_min(p, MIN_PIN_LEN, MAX_PIN_LEN+1, "Please enter your new PIN: ", 0)) { - sc_error(card->ctx, "Could not read new PIN.\n"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not read new PIN.\n"); free(p); return SC_ERROR_INTERNAL; } @@ -921,17 +912,17 @@ get_psec(sc_card_t *card, const char *pin, size_t length_pin, enum s_type pin_id if (!length_pin || !pin) { if (0 > snprintf(buf, sizeof buf, "Please enter your %s: ", pace_secret_name(pin_id))) { - sc_error(card->ctx, "Could not create password prompt.\n"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not create password prompt.\n"); return NULL; } p = malloc(MAX_MRZ_LEN); if (!p) { - sc_error(card->ctx, "Not enough memory for %s.\n", + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for %s.\n", pace_secret_name(pin_id)); return NULL; } if (0 > EVP_read_pw_string_min(p, 0, MAX_MRZ_LEN, buf, 0)) { - sc_error(card->ctx, "Could not read %s.\n", + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not read %s.\n", pace_secret_name(pin_id)); return NULL; } @@ -953,7 +944,7 @@ void ssl_error(sc_context_t *ctx) { unsigned long r; ERR_load_crypto_strings(); for (r = ERR_get_error(); r; r = ERR_get_error()) { - sc_error(ctx, ERR_error_string(r, NULL)); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, ERR_error_string(r, NULL)); } ERR_free_strings(); } @@ -989,7 +980,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, if (!bio_stdout) bio_stdout = BIO_new_fp(stdout, BIO_NOCLOSE); if (!bio_stdout) { - sc_error(card->ctx, "Could not create output buffer."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not create output buffer."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1000,24 +991,24 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, pace_input.certificate_description, pace_input.certificate_description_length, "\t")) { case -1: - sc_error(card->ctx, "Could not print certificate description."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not print certificate description."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; case 0: break; case 1: - sc_error(card->ctx, "Certificate description in " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Certificate description in " "HTML format can not (yet) be handled."); r = SC_ERROR_NOT_SUPPORTED; goto err; case 2: - sc_error(card->ctx, "Certificate description in " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Certificate description in " "PDF format can not (yet) be handled."); r = SC_ERROR_NOT_SUPPORTED; goto err; default: - sc_error(card->ctx, "Certificate description in " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Certificate description in " "unknown format can not (yet) be handled."); r = SC_ERROR_NOT_SUPPORTED; goto err; @@ -1027,7 +1018,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, pace_input.certificate_description, pace_input.certificate_description_length); if (!hash_cert_desc) { - sc_error(card->ctx, "Could not hash certificate description."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not hash certificate description."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1035,7 +1026,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, p = realloc(pace_output->hash_cert_desc, hash_cert_desc->length); if (!p) { - sc_error(card->ctx, "Not enough memory for hash of certificate description.\n"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for hash of certificate description.\n"); r = SC_ERROR_OUT_OF_MEMORY; goto err; } @@ -1050,7 +1041,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, if (!bio_stdout) bio_stdout = BIO_new_fp(stdout, BIO_NOCLOSE); if (!bio_stdout) { - sc_error(card->ctx, "Could not create output buffer."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not create output buffer."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1058,14 +1049,14 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, if (!d2i_CVC_CHAT(&chat, (const unsigned char **) &pace_input.chat, pace_input.chat_length)) { - sc_error(card->ctx, "Could not parse card holder authorization template (CHAT)."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse card holder authorization template (CHAT)."); r = SC_ERROR_INTERNAL; goto err; } printf("Card holder authorization template (CHAT)\n"); if (!cvc_chat_print(bio_stdout, chat, "\t")) { - sc_error(card->ctx, "Could not print card holder authorization template (CHAT)."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not print card holder authorization template (CHAT)."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1076,16 +1067,16 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, r = get_ef_card_access(card, &pace_output->ef_cardaccess, &pace_output->ef_cardaccess_length); if (r < 0) { - sc_error(card->ctx, "Could not get EF.CardAccess."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get EF.CardAccess."); goto err; } } - bin_log(card->ctx, "EF.CardAccess", pace_output->ef_cardaccess, + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "EF.CardAccess", pace_output->ef_cardaccess, pace_output->ef_cardaccess_length); if (!parse_ef_card_access(pace_output->ef_cardaccess, pace_output->ef_cardaccess_length, &info, &static_dp)) { - sc_error(card->ctx, "Could not parse EF.CardAccess."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse EF.CardAccess."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1093,7 +1084,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, pctx = PACE_CTX_new(); if (!pctx || !PACE_init(pctx, &static_dp, info)) { - sc_error(card->ctx, "Could not initialize PACE parameters."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not initialize PACE parameters."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1103,7 +1094,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, r = pace_mse_set_at(oldpacectx, card, info->protocol, pace_input.pin_id, chat, &pace_output->mse_set_at_sw1, &pace_output->mse_set_at_sw2); if (r < 0) { - sc_error(card->ctx, "Could not select protocol proberties " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not select protocol proberties " "(MSE: Set AT failed)."); goto err; } @@ -1115,18 +1106,17 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, r = pace_gen_auth_1_encrypted_nonce(oldpacectx, card, (u8 **) &enc_nonce->data, &enc_nonce->length); if (r < 0) { - sc_error(card->ctx, "Could not get encrypted nonce from card " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get encrypted nonce from card " "(General Authenticate step 1 failed)."); goto err; } - if (card->ctx->debug >= SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Encrypted nonce from MRTD", (u8 *)enc_nonce->data, enc_nonce->length); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Encrypted nonce from MRTD", (u8 *)enc_nonce->data, enc_nonce->length); enc_nonce->max = enc_nonce->length; sec = get_psec(card, (char *) pace_input.pin, pace_input.pin_length, pace_input.pin_id); if (!sec) { - sc_error(card->ctx, "Could not encode PACE secret."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not encode PACE secret."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1137,7 +1127,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, mdata_opp = BUF_MEM_new(); mdata = PACE_STEP3A_generate_mapping_data(static_dp, pctx); if (!nonce || !mdata || !mdata_opp) { - sc_error(card->ctx, "Could not generate mapping data."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not generate mapping data."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1145,19 +1135,18 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, r = pace_gen_auth_2_map_nonce(oldpacectx, card, (u8 *) mdata->data, mdata->length, (u8 **) &mdata_opp->data, &mdata_opp->length); if (r < 0) { - sc_error(card->ctx, "Could not exchange mapping data with card " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange mapping data with card " "(General Authenticate step 2 failed)."); goto err; } mdata_opp->max = mdata_opp->length; - if (card->ctx->debug >= SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Mapping data from MRTD", (u8 *) mdata_opp->data, mdata_opp->length); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Mapping data from MRTD", (u8 *) mdata_opp->data, mdata_opp->length); eph_dp = PACE_STEP3A_map_dp(static_dp, pctx, nonce, mdata_opp); pub = PACE_STEP3B_generate_ephemeral_key(eph_dp, pctx); pub_opp = BUF_MEM_new(); if (!eph_dp || !pub || !pub_opp) { - sc_error(card->ctx, "Could not generate ephemeral domain parameter or " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not generate ephemeral domain parameter or " "ephemeral key pair."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; @@ -1166,18 +1155,17 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, r = pace_gen_auth_3_perform_key_agreement(oldpacectx, card, (u8 *) pub->data, pub->length, (u8 **) &pub_opp->data, &pub_opp->length); if (r < 0) { - sc_error(card->ctx, "Could not exchange ephemeral public key with card " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange ephemeral public key with card " "(General Authenticate step 3 failed)."); goto err; } pub_opp->max = pub_opp->length; - if (card->ctx->debug >= SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Ephemeral public key from MRTD", (u8 *) pub_opp->data, pub_opp->length); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Ephemeral public key from MRTD", (u8 *) pub_opp->data, pub_opp->length); key = PACE_STEP3B_compute_ephemeral_key(eph_dp, pctx, pub_opp); if (!key || !PACE_STEP3C_derive_keys(key, pctx, info, &k_mac, &k_enc)) { - sc_error(card->ctx, "Could not compute ephemeral shared secret or " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not compute ephemeral shared secret or " "derive keys for encryption and authentication."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; @@ -1187,7 +1175,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, eph_dp, info, pub_opp, k_mac); token_opp = BUF_MEM_new(); if (!token || !token_opp) { - sc_error(card->ctx, "Could not compute authentication token."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not compute authentication token."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1198,7 +1186,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, &pace_output->previous_car, &pace_output->previous_car_length); if (r < 0) { - sc_error(card->ctx, "Could not exchange authentication token with card " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange authentication token with card " "(General Authenticate step 4 failed)."); goto err; } @@ -1206,7 +1194,7 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, if (!PACE_STEP3D_verify_authentication_token(pctx, eph_dp, info, k_mac, token_opp)) { - sc_error(card->ctx, "Could not verify authentication token."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not verify authentication token."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1216,32 +1204,32 @@ int EstablishPACEChannel(struct sm_ctx *oldpacectx, sc_card_t *card, comp_pub = PACE_Comp(eph_dp, pctx, pub); comp_pub_opp = PACE_Comp(eph_dp, pctx, pub_opp); if (!comp_pub || !comp_pub_opp) { - sc_error(card->ctx, "Could not compress public keys for identification."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not compress public keys for identification."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; } p = realloc(pace_output->id_icc, comp_pub_opp->length); if (!p) { - sc_error(card->ctx, "Not enough memory for ID ICC.\n"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for ID ICC.\n"); return SC_ERROR_OUT_OF_MEMORY; } pace_output->id_icc = p; pace_output->id_icc_length = comp_pub_opp->length; /* Flawfinder: ignore */ memcpy(pace_output->id_icc, comp_pub_opp->data, comp_pub_opp->length); - bin_log(card->ctx, "ID ICC", pace_output->id_icc, + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "ID ICC", pace_output->id_icc, pace_output->id_icc_length); p = realloc(pace_output->id_pcd, comp_pub->length); if (!p) { - sc_error(card->ctx, "Not enough memory for ID PCD.\n"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for ID PCD.\n"); return SC_ERROR_OUT_OF_MEMORY; } pace_output->id_pcd = p; pace_output->id_pcd_length = comp_pub->length; /* Flawfinder: ignore */ memcpy(pace_output->id_pcd, comp_pub->data, comp_pub->length); - bin_log(card->ctx, "ID PCD", pace_output->id_pcd, + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "ID PCD", pace_output->id_pcd, pace_output->id_pcd_length); sctx->authentication_ctx = pace_sm_ctx_create(k_mac, @@ -1392,7 +1380,7 @@ pace_sm_encrypt(sc_card_t *card, const struct sm_ctx *ctx, databuf = BUF_MEM_create_init(data, datalen); encbuf = PACE_encrypt(psmctx->ctx, psmctx->ssc, psmctx->key_enc, databuf); if (!databuf || !encbuf) { - sc_error(card->ctx, "Could not encrypt data."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not encrypt data."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1436,7 +1424,7 @@ pace_sm_decrypt(sc_card_t *card, const struct sm_ctx *ctx, encbuf = BUF_MEM_create_init(enc, enclen); databuf = PACE_decrypt(psmctx->ctx, psmctx->ssc, psmctx->key_enc, encbuf); if (!encbuf || !databuf) { - sc_error(card->ctx, "Could not decrypt data."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not decrypt data."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1480,8 +1468,8 @@ pace_sm_authenticate(sc_card_t *card, const struct sm_ctx *ctx, macbuf = PACE_authenticate(psmctx->ctx, psmctx->ssc, psmctx->key_mac, data, datalen); if (!macbuf) { - sc_error(card->ctx, "Could not compute message authentication code " - "(MAC)."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, + "Could not compute message authentication code (MAC)."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1524,8 +1512,8 @@ pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx, my_mac = PACE_authenticate(psmctx->ctx, psmctx->ssc, psmctx->key_mac, macdata, macdatalen); if (!my_mac) { - sc_error(card->ctx, "Could not compute message authentication code " - "(MAC) for verification."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, + "Could not compute message authentication code (MAC) for verification."); ssl_error(card->ctx); r = SC_ERROR_INTERNAL; goto err; @@ -1534,12 +1522,12 @@ pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx, if (my_mac->length != maclen || memcmp(my_mac->data, mac, maclen) != 0) { r = SC_ERROR_OBJECT_NOT_VALID; - sc_error(card->ctx, "Authentication data not verified"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, + "Authentication data not verified"); goto err; } - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - sc_debug(card->ctx, "Authentication data verified"); + sc_debug(card->ctx, SC_LOG_DEBUG_NORMAL, "Authentication data verified"); r = SC_SUCCESS; @@ -1554,13 +1542,13 @@ static int pace_sm_pre_transmit(sc_card_t *card, const struct sm_ctx *ctx, sc_apdu_t *apdu) { - SC_FUNC_RETURN(card->ctx, SC_LOG_TYPE_DEBUG, + SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, increment_ssc(ctx->cipher_ctx)); } static int pace_sm_post_transmit(sc_card_t *card, const struct sm_ctx *ctx, sc_apdu_t *sm_apdu) { - SC_FUNC_RETURN(card->ctx, SC_LOG_TYPE_DEBUG, + SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, increment_ssc(ctx->cipher_ctx)); } diff --git a/npa/src/pace/pace.h b/npa/src/pace/pace.h index b8b89ac..8021dbd 100644 --- a/npa/src/pace/pace.h +++ b/npa/src/pace/pace.h @@ -24,7 +24,7 @@ #include #include -#include +#include #include #include diff --git a/npa/src/pace/scutil.h b/npa/src/pace/scutil.h index 0082682..a56b477 100644 --- a/npa/src/pace/scutil.h +++ b/npa/src/pace/scutil.h @@ -22,7 +22,7 @@ #ifndef _CCID_SCUTIL_H #define _CCID_SCUTIL_H -#include +#include /** * @brief Initializes smart card context and reader @@ -68,8 +68,8 @@ int build_apdu(sc_context_t *ctx, const u8 *buf, size_t len, sc_apdu_t *apdu); * @param[in] data Binary data * @param[in] len Length of \a data */ -#define bin_log(ctx, label, data, len) \ - _bin_log(ctx, SC_LOG_TYPE_DEBUG, __FILE__, __LINE__, __FUNCTION__, label, data, len, NULL) +#define bin_log(ctx, level, label, data, len) \ + _bin_log(ctx, level, __FILE__, __LINE__, __FUNCTION__, label, data, len, NULL) /** * @brief Log binary data * diff --git a/npa/src/pace/sm.h b/npa/src/pace/sm.h index a65a442..c174d95 100644 --- a/npa/src/pace/sm.h +++ b/npa/src/pace/sm.h @@ -22,7 +22,7 @@ #ifndef _CCID_SM_H #define _CCID_SM_H -#include +#include #ifdef __cplusplus extern "C" { diff --git a/npa/src/scutil.c b/npa/src/scutil.c index 74ae556..2672a5c 100644 --- a/npa/src/scutil.c +++ b/npa/src/scutil.c @@ -19,7 +19,7 @@ #include "scutil.h" #include #include -#include +#include int initialize(int reader_id, const char *cdriver, int verbose, sc_context_t **ctx, sc_reader_t **reader) @@ -38,7 +38,7 @@ int initialize(int reader_id, const char *cdriver, int verbose, if (cdriver != NULL) { r = sc_set_card_driver(*ctx, cdriver); if (r < 0) { - sc_error(*ctx, "Card driver '%s' not found!\n", cdriver); + sc_debug(*ctx, SC_LOG_DEBUG_VERBOSE, "Card driver '%s' not found!\n", cdriver); return r; } } @@ -54,14 +54,14 @@ int initialize(int reader_id, const char *cdriver, int verbose, /* Automatically try to skip to a reader with a card if reader not specified */ for (i = 0; i < reader_count; i++) { *reader = sc_ctx_get_reader(*ctx, i); - if (sc_detect_card_presence(*reader, 0) & SC_SLOT_CARD_PRESENT) { + if (sc_detect_card_presence(*reader) & SC_READER_CARD_PRESENT) { reader_id = i; - sc_debug(*ctx, "Using the first reader with a card: %s", (*reader)->name); + sc_debug(*ctx, SC_LOG_DEBUG_NORMAL, "Using the first reader with a card: %s", (*reader)->name); break; } } if (reader_id >= reader_count) { - sc_debug(*ctx, "No card found, using the first reader."); + sc_debug(*ctx, SC_LOG_DEBUG_NORMAL, "No card found, using the first reader."); reader_id = 0; } } @@ -85,7 +85,7 @@ int build_apdu(sc_context_t *ctx, const u8 *buf, size_t len, sc_apdu_t *apdu) len0 = len; if (len < 4) { - sc_error(ctx, "APDU too short (must be at least 4 bytes)"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "APDU too short (must be at least 4 bytes)"); return SC_ERROR_INVALID_DATA; } @@ -115,7 +115,7 @@ int build_apdu(sc_context_t *ctx, const u8 *buf, size_t len, sc_apdu_t *apdu) apdu->lc += *p++; len -= 3; if (len < apdu->lc) { - sc_error(ctx, "APDU too short (need %lu more bytes)\n", + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "APDU too short (need %lu more bytes)\n", (unsigned long) apdu->lc - len); return SC_ERROR_INVALID_DATA; } @@ -128,7 +128,7 @@ int build_apdu(sc_context_t *ctx, const u8 *buf, size_t len, sc_apdu_t *apdu) } else { /* at this point the apdu has a Lc, so Le is on 2 bytes */ if (len < 2) { - sc_error(ctx, "APDU too short (need 2 more bytes)\n"); + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "APDU too short (need 2 more bytes)\n"); return SC_ERROR_INVALID_DATA; } apdu->le = (*p++)<<8; @@ -151,7 +151,7 @@ int build_apdu(sc_context_t *ctx, const u8 *buf, size_t len, sc_apdu_t *apdu) apdu->lc = *p++; len--; if (len < apdu->lc) { - sc_error(ctx, "APDU too short (need %lu more bytes)\n", + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "APDU too short (need %lu more bytes)\n", (unsigned long) apdu->lc - len); return SC_ERROR_INVALID_DATA; } @@ -172,7 +172,7 @@ int build_apdu(sc_context_t *ctx, const u8 *buf, size_t len, sc_apdu_t *apdu) } } if (len) { - sc_error(ctx, "APDU too long (%lu bytes extra)\n", + sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "APDU too long (%lu bytes extra)\n", (unsigned long) len); return SC_ERROR_INVALID_DATA; } @@ -180,7 +180,7 @@ int build_apdu(sc_context_t *ctx, const u8 *buf, size_t len, sc_apdu_t *apdu) apdu->flags = SC_APDU_FLAGS_NO_GET_RESP|SC_APDU_FLAGS_NO_RETRY_WL; - sc_debug(ctx, "Case %d %s APDU, %lu bytes:\tins=%02x p1=%02x p2=%02x lc=%04x le=%04x", + sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "Case %d %s APDU, %lu bytes:\tins=%02x p1=%02x p2=%02x lc=%04x le=%04x", apdu->cse & SC_APDU_SHORT_MASK, (apdu->cse & SC_APDU_EXT) != 0 ? "extended" : "short", (unsigned long) len0, apdu->ins, apdu->p1, apdu->p2, apdu->lc, apdu->le); @@ -197,7 +197,7 @@ void _bin_log(sc_context_t *ctx, int type, const char *file, int line, char buf[1800]; if (data) - sc_hex_dump(ctx, data, len, buf, sizeof buf); + sc_hex_dump(ctx, SC_LOG_DEBUG_NORMAL, data, len, buf, sizeof buf); else buf[0] = 0; if (!f) { diff --git a/npa/src/sm.c b/npa/src/sm.c index 2af45dd..c2faae6 100644 --- a/npa/src/sm.c +++ b/npa/src/sm.c @@ -19,8 +19,8 @@ #include "scutil.h" #include "sm.h" #include -#include -#include +#include +#include #include #include @@ -201,25 +201,23 @@ static int format_data(sc_card_t *card, const struct sm_ctx *ctx, r = add_padding(ctx, data, datalen, &pad_data); if (r < 0) { - sc_error(card->ctx, "Could not add padding to data: %s", + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not add padding to data: %s", sc_strerror(r)); goto err; } pad_data_len = r; - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Data to encrypt", pad_data, pad_data_len); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Data to encrypt", pad_data, pad_data_len); r = ctx->encrypt(card, ctx, pad_data, pad_data_len, formatted_data); if (r < 0) { - sc_error(card->ctx, "Could not encrypt the data"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not encrypt the data"); goto err; } - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Cryptogram", *formatted_data, r); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Cryptogram", *formatted_data, r); r = prefix_buf(ctx->padding_indicator, *formatted_data, r, formatted_data); if (r < 0) { - sc_error(card->ctx, "Could not prepend padding indicator to formatted " + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not prepend padding indicator to formatted " "data: %s", sc_strerror(r)); goto err; } @@ -267,20 +265,19 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, size_t sm_data_len, fdata_len, mac_data_len, asn1_len, mac_len, le_len; int r; - if (!apdu || !ctx || !card || !card->slot || !sm_apdu) { + if (!apdu || !ctx || !card || !card->reader || !sm_apdu) { r = SC_ERROR_INVALID_ARGUMENTS; goto err; } if ((apdu->cla & 0x0C) == 0x0C) { r = SC_ERROR_INVALID_ARGUMENTS; - sc_error(card->ctx, "Given APDU is already protected with some secure messaging"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Given APDU is already protected with some secure messaging"); goto err; } sc_copy_asn1_entry(c_sm_capdu, sm_capdu); - sm_apdu->sensitive = 0; sm_apdu->control = apdu->control; sm_apdu->flags = apdu->flags; sm_apdu->cla = apdu->cla|0x0C; @@ -289,7 +286,7 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, sm_apdu->p2 = apdu->p2; r = format_head(ctx, sm_apdu, &mac_data); if (r < 0) { - sc_error(card->ctx, "Could not format header of SM apdu"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format header of SM apdu"); goto err; } mac_data_len = r; @@ -302,19 +299,18 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, le_len = 1; r = format_le(apdu->le, sm_capdu + 1, &le, &le_len); if (r < 0) { - sc_error(card->ctx, "Could not format Le of SM apdu"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format Le of SM apdu"); goto err; } - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Protected Le (plain)", le, le_len); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Protected Le (plain)", le, le_len); break; case SC_APDU_CASE_2_EXT: - if (card->slot->active_protocol == SC_PROTO_T0) { + if (card->reader->active_protocol == SC_PROTO_T0) { /* T0 extended APDUs look just like short APDUs */ le_len = 1; r = format_le(apdu->le, sm_capdu + 1, &le, &le_len); if (r < 0) { - sc_error(card->ctx, "Could not format Le of SM apdu"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format Le of SM apdu"); goto err; } } else { @@ -322,50 +318,46 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, le_len = 3; r = format_le(apdu->le, sm_capdu + 1, &le, &le_len); if (r < 0) { - sc_error(card->ctx, "Could not format Le of SM apdu"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format Le of SM apdu"); goto err; } } - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Protected Le (plain)", le, le_len); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Protected Le (plain)", le, le_len); break; case SC_APDU_CASE_3_SHORT: case SC_APDU_CASE_3_EXT: r = format_data(card, ctx, apdu->data, apdu->datalen, sm_capdu + 0, &fdata, &fdata_len); if (r < 0) { - sc_error(card->ctx, "Could not format data of SM apdu"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format data of SM apdu"); goto err; } - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)", - fdata, fdata_len); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Padding-content indicator followed by cryptogram (plain)", + fdata, fdata_len); break; case SC_APDU_CASE_4_SHORT: /* in case of T0 no Le byte is added */ - if (card->slot->active_protocol != SC_PROTO_T0) { + if (card->reader->active_protocol != SC_PROTO_T0) { le_len = 1; r = format_le(apdu->le, sm_capdu + 1, &le, &le_len); if (r < 0) { - sc_error(card->ctx, "Could not format Le of SM apdu"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format Le of SM apdu"); goto err; } - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Protected Le (plain)", le, le_len); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Protected Le (plain)", le, le_len); } r = format_data(card, ctx, apdu->data, apdu->datalen, sm_capdu + 0, &fdata, &fdata_len); if (r < 0) { - sc_error(card->ctx, "Could not format data of SM apdu"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format data of SM apdu"); goto err; } - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)", - fdata, fdata_len); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Padding-content indicator followed by cryptogram (plain)", + fdata, fdata_len); break; case SC_APDU_CASE_4_EXT: - if (card->slot->active_protocol == SC_PROTO_T0) { + if (card->reader->active_protocol == SC_PROTO_T0) { /* again a T0 extended case 4 APDU looks just * like a short APDU, the additional data is * transferred using ENVELOPE and GET RESPONSE */ @@ -375,25 +367,23 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, le_len = 2; r = format_le(apdu->le, sm_capdu + 1, &le, &le_len); if (r < 0) { - sc_error(card->ctx, "Could not format Le of SM apdu"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format Le of SM apdu"); goto err; } - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Protected Le (plain)", le, le_len); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Protected Le (plain)", le, le_len); } r = format_data(card, ctx, apdu->data, apdu->datalen, sm_capdu + 0, &fdata, &fdata_len); if (r < 0) { - sc_error(card->ctx, "Could not format data of SM apdu"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format data of SM apdu"); goto err; } - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)", - fdata, fdata_len); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Padding-content indicator followed by cryptogram (plain)", + fdata, fdata_len); break; default: - sc_error(card->ctx, "Unhandled apdu case"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Unhandled apdu case"); r = SC_ERROR_INVALID_DATA; goto err; } @@ -419,20 +409,18 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, } mac_data_len = r; } - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Data to authenticate", mac_data, mac_data_len); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Data to authenticate", mac_data, mac_data_len); r = ctx->authenticate(card, ctx, mac_data, mac_data_len, &mac); if (r < 0) { - sc_error(card->ctx, "Could not get authentication code"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get authentication code"); goto err; } mac_len = r; sc_format_asn1_entry(sm_capdu + 2, mac, &mac_len, SC_ASN1_PRESENT); - if (card->ctx->debug > SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "Cryptographic Checksum (plain)", mac, mac_len); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Cryptographic Checksum (plain)", mac, mac_len); /* format SM apdu */ @@ -440,7 +428,7 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, if (r < 0) goto err; if (sm_apdu->datalen < sm_data_len) { - sc_error(card->ctx, "Data for SM APDU too long"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Data for SM APDU too long"); r = SC_ERROR_OUT_OF_MEMORY; goto err; } @@ -450,8 +438,7 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, sm_apdu->lc = sm_apdu->datalen; sm_apdu->le = 0; sm_apdu->cse = SC_APDU_CASE_4; - if (card->ctx->debug >= SC_LOG_TYPE_DEBUG) - bin_log(card->ctx, "ASN.1 encoded encrypted APDU data", sm_apdu->data, sm_apdu->datalen); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "ASN.1 encoded encrypted APDU data", sm_apdu->data, sm_apdu->datalen); err: if (fdata) @@ -515,7 +502,7 @@ static int sm_decrypt(const struct sm_ctx *ctx, sc_card_t *card, if (r < 0) goto err; } else { - sc_error(card->ctx, "Cryptographic Checksum missing"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Cryptographic Checksum missing"); r = SC_ERROR_ASN1_OBJECT_NOT_FOUND; goto err; } @@ -533,12 +520,12 @@ static int sm_decrypt(const struct sm_ctx *ctx, sc_card_t *card, r = no_padding(ctx->padding_indicator, data, buf_len); if (r < 0) { - sc_error(card->ctx, "Could not remove padding"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not remove padding"); goto err; } if (apdu->resplen < r) { - sc_error(card->ctx, "Response of SM APDU too long"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Response of SM APDU too long"); r = SC_ERROR_OUT_OF_MEMORY; goto err; } @@ -551,24 +538,22 @@ static int sm_decrypt(const struct sm_ctx *ctx, sc_card_t *card, if (sm_rapdu[1].flags & SC_ASN1_PRESENT) { if (sw_len != 2) { - sc_error(card->ctx, "Length of processing status bytes must be 2"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Length of processing status bytes must be 2"); r = SC_ERROR_ASN1_END_OF_CONTENTS; goto err; } apdu->sw1 = sw[0]; apdu->sw2 = sw[1]; } else { - sc_error(card->ctx, "Authenticated status bytes are missing"); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Authenticated status bytes are missing"); r = SC_ERROR_ASN1_OBJECT_NOT_FOUND; goto err; } - if (card->ctx->debug >= SC_LOG_TYPE_DEBUG) { - sc_debug(card->ctx, "Decrypted APDU sw1=%02x sw2=%02x", - apdu->sw1, apdu->sw2); - bin_log(card->ctx, "Decrypted APDU response data", - apdu->resp, apdu->resplen); - } + sc_debug(card->ctx, SC_LOG_DEBUG_NORMAL, "Decrypted APDU sw1=%02x sw2=%02x", + apdu->sw1, apdu->sw2); + bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Decrypted APDU response data", + apdu->resp, apdu->resplen); r = SC_SUCCESS; @@ -595,27 +580,27 @@ int sm_transmit_apdu(struct sm_ctx *sctx, sc_card_t *card, sm_apdu.resplen = sizeof rbuf; if (!sctx || !sctx->active) { - sc_debug(card->ctx, "Secure messaging disabled."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Secure messaging disabled."); return sc_transmit_apdu(card, apdu); } if ((apdu->cla & 0x0C) == 0x0C) { - sc_debug(card->ctx, "Given APDU is already protected with some secure messaging. Deactivating own SM context."); + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Given APDU is already protected with some secure messaging. Deactivating own SM context."); sctx->active = 0; return sc_transmit_apdu(card, apdu); } if (sctx->pre_transmit) - SC_TEST_RET(card->ctx, sctx->pre_transmit(card, sctx, apdu), + SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, sctx->pre_transmit(card, sctx, apdu), "Could not complete SM specific pre transmit routine"); - SC_TEST_RET(card->ctx, sm_encrypt(sctx, card, apdu, &sm_apdu), + SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, sm_encrypt(sctx, card, apdu, &sm_apdu), "Could not encrypt APDU"); - SC_TEST_RET(card->ctx, sc_transmit_apdu(card, &sm_apdu), + SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, sc_transmit_apdu(card, &sm_apdu), "Could not transmit SM APDU"); if (sctx->post_transmit) - SC_TEST_RET(card->ctx, sctx->post_transmit(card, sctx, &sm_apdu), + SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, sctx->post_transmit(card, sctx, &sm_apdu), "Could not complete SM specific post transmit routine"); - SC_TEST_RET(card->ctx, sm_decrypt(sctx, card, &sm_apdu, apdu), + SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, sm_decrypt(sctx, card, &sm_apdu, apdu), "Could not decrypt APDU"); return SC_SUCCESS;