removed some messages, when less verbose. fixed little endian problem when parsing input buffer of EstablishPACEChannel.

git-svn-id: https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@111 96b47cad-a561-4643-ad3b-153ac7d7599c
2010-05-26 20:32:29 +00:00
parent 34b91882da
commit 7fd92afc4f
4 changed files with 71 additions and 52 deletions
--- a/ccid/src/pace-tool.c
+++ b/ccid/src/pace-tool.c
@@ -113,8 +113,7 @@ int pace_get_channel(struct sm_ctx *oldpacectx, sc_card_t *card,
    buf[3 + pinlen] = 0;    // length_cert_desc
    buf[4 + pinlen]= 0;     // length_cert_desc

-    SC_FUNC_RETURN(card->ctx, SC_LOG_TYPE_ERROR,
-            EstablishPACEChannel(oldpacectx, card, buf, out, outlen, sctx));
+    return EstablishPACEChannel(oldpacectx, card, buf, out, outlen, sctx);
 }

 int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card)
@@ -146,6 +145,7 @@ int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card)
        read[linelen - 1] = 0;
        if (sc_hex_to_bin(read, buf, &apdulen) < 0) {
            sc_error(card->ctx, "Could not format binary string");
+            continue;
        }

        r = build_apdu(card->ctx, buf, apdulen, &apdu);
@@ -167,11 +167,10 @@ int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card)
        bin_print(stdout, "Decrypted APDU response data", apdu.resp, apdu.resplen);
    }

-err:
    if (read)
        free(read);

-    SC_FUNC_RETURN(card->ctx, SC_LOG_TYPE_ERROR, r);
+    return r;
 }

 int
@@ -345,5 +344,5 @@ err:
    sc_disconnect_card(card, 0);
    sc_release_context(ctx);

-    return i;
+    return -i;
 }
--- a/ccid/src/pace.c
+++ b/ccid/src/pace.c
@@ -24,11 +24,9 @@
 #include <opensc/log.h>
 #include <opensc/opensc.h>
 #include <opensc/ui.h>
-#include <openssl/asn1.h>
 #include <openssl/asn1t.h>
 #include <openssl/buffer.h>
 #include <openssl/err.h>
-#include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/pace.h>
 #include <string.h>
@@ -293,7 +291,8 @@ static int pace_mse_set_at(const struct sm_ctx *oldpacectx, sc_card_t *card,
    apdu.data = sc_asn1_find_tag(card->ctx, d, r, 0x30, &apdu.datalen);
    apdu.lc = apdu.datalen;

-    bin_log(card->ctx, "MSE:Set AT command data", apdu.data, apdu.datalen);
+    if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+        bin_log(card->ctx, "MSE:Set AT command data", apdu.data, apdu.datalen);

    if (oldpacectx)
        r = pace_transmit_apdu(oldpacectx, card, &apdu);
@@ -314,13 +313,15 @@ static int pace_mse_set_at(const struct sm_ctx *oldpacectx, sc_card_t *card,
    if (apdu.sw1 == 0x63) {
        if ((apdu.sw2 & 0xc0) == 0xc0) {
            tries = apdu.sw2 & 0x0f;
-            /* this is only a warning... */
-             sc_error(card->ctx, "Remaining tries: %d%s\n",
-                   tries, tries == 1? ", (password must be resumed)":
-                   tries == 0? ", (password must be unblocked)": "");
-             r = SC_SUCCESS;
+            if (tries <= 1) {
+                /* this is only a warning... */
+                sc_error(card->ctx, "Remaining tries: %d (%s must be %s)\n",
+                        tries, pace_secret_name(secret_key),
+                        tries ? "resumed" : "unblocked");
+            }
+            r = SC_SUCCESS;
        } else {
-            sc_error(card->ctx, "Unknown SWs; SW1=%02X, SW2=%02X\n",
+            sc_error(card->ctx, "Unknown status bytes: SW1=%02X, SW2=%02X\n",
                    apdu.sw1, apdu.sw2);
            r = SC_ERROR_CARD_CMD_FAILED;
            goto err;
@@ -416,7 +417,8 @@ static int pace_gen_auth(const struct sm_ctx *oldpacectx, sc_card_t *card,
    apdu.datalen = r;
    apdu.lc = r;

-    bin_log(card->ctx, "General authenticate command data", apdu.data, apdu.datalen);
+    if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+        bin_log(card->ctx, "General authenticate command data", apdu.data, apdu.datalen);

    apdu.resplen = maxresp;
    apdu.resp = malloc(apdu.resplen);
@@ -431,7 +433,8 @@ static int pace_gen_auth(const struct sm_ctx *oldpacectx, sc_card_t *card,
    if (r < 0)
        goto err;

-    bin_log(card->ctx, "General authenticate response data", apdu.resp, apdu.resplen);
+    if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+        bin_log(card->ctx, "General authenticate response data", apdu.resp, apdu.resplen);

    if (!d2i_PACE_GEN_AUTH_R(&r_data,
                (const unsigned char **) &apdu.resp, apdu.resplen)) {
@@ -610,8 +613,8 @@ get_psec(sc_card_t *card, const char *pin, size_t length_pin, enum s_type pin_id
        hints.usage = SC_UI_USAGE_OTHER;
        sc_result = sc_ui_get_pin(&hints, &p);
        if (sc_result < 0) {
-            sc_error(card->ctx, "Could not read PACE secret (%s).\n",
-                    sc_strerror(sc_result));
+            sc_error(card->ctx, "Could not read %s (%s).\n",
+                    pace_secret_name(pin_id), sc_strerror(sc_result));
            return NULL;
        }
        length_pin = strlen(p);
@@ -643,7 +646,7 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card,
    const __u8 *chat, *pin, *certificate_description;
    __u8 *ef_cardaccess = NULL;
    PACEInfo *info = NULL;
-    uint16_t word;
+    __le16 word;
    PACEDomainParameterInfo *static_dp = NULL, *eph_dp = NULL;
    BUF_MEM *enc_nonce, *nonce = NULL, *mdata = NULL, *mdata_opp = NULL,
            *k_enc = NULL, *k_mac = NULL, *token_opp = NULL,
@@ -670,8 +673,9 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card,
    pin = in;
    in += length_pin;

-    length_cert_desc = (__le16_to_cpu((__le16) *in));
-    in += sizeof (__le16);
+    memcpy(&word, in, sizeof word);
+    length_cert_desc = __le16_to_cpu(word);
+    in += sizeof word;
    certificate_description = in;


@@ -687,8 +691,7 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card,
            r = SC_ERROR_OUT_OF_MEMORY;
            goto err;
        }
-        word = length_ef_cardaccess;
-        word = htons(word);
+        word = __cpu_to_le16(length_ef_cardaccess);
        memcpy(*out + 2, &word, sizeof word);
        memcpy(*out + 4, ef_cardaccess, length_ef_cardaccess);
        /* XXX CAR */
@@ -698,8 +701,7 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card,
    } else {
        second_execution = 1;
        memcpy(&word, *out + 2, sizeof word);
-        word = ntohs(word);
-        length_ef_cardaccess = word;
+        length_ef_cardaccess = __le16_to_cpu(word);
        ef_cardaccess = *out + 4;
    }
    bin_log(card->ctx, "EF.CardAccess", ef_cardaccess, length_ef_cardaccess);
@@ -731,7 +733,8 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card,
                "(General Authenticate step 1 failed).");
        goto err;
    }
-    bin_log(card->ctx, "Encrypted nonce from MRTD", (u8 *)enc_nonce->data, enc_nonce->length);
+    if (card->ctx->debug >= SC_LOG_TYPE_DEBUG)
+        bin_log(card->ctx, "Encrypted nonce from MRTD", (u8 *)enc_nonce->data, enc_nonce->length);
    enc_nonce->max = enc_nonce->length;

    sec = get_psec(card, (char *) pin, length_pin, pin_id);
@@ -765,7 +768,8 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card,
        goto err;
    }
    mdata_opp->max = mdata_opp->length;
-    bin_log(card->ctx, "Mapping data from MRTD", (u8 *) mdata_opp->data, mdata_opp->length);
+    if (card->ctx->debug >= SC_LOG_TYPE_DEBUG)
+        bin_log(card->ctx, "Mapping data from MRTD", (u8 *) mdata_opp->data, mdata_opp->length);

    eph_dp = PACE_STEP3A_map_dp(static_dp, pctx, nonce, mdata_opp);
    pub = PACE_STEP3B_generate_ephemeral_key(eph_dp, pctx);
@@ -783,7 +787,8 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card,
        goto err;
    }
    pub_opp->max = pub_opp->length;
-    bin_log(card->ctx, "Public key from MRTD", (u8 *) pub_opp->data, pub_opp->length);
+    if (card->ctx->debug >= SC_LOG_TYPE_DEBUG)
+        bin_log(card->ctx, "Public key from MRTD", (u8 *) pub_opp->data, pub_opp->length);

    key = PACE_STEP3B_compute_ephemeral_key(eph_dp, pctx, pub_opp);
    if (!key ||
@@ -1091,11 +1096,12 @@ int pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
    if (my_mac->length != maclen ||
            memcmp(my_mac->data, mac, maclen) != 0) {
        r = SC_ERROR_OBJECT_NOT_VALID;
-        sc_debug(card->ctx, "Authentication data not verified");
+        sc_error(card->ctx, "Authentication data not verified");
        goto err;
    }

-    sc_debug(card->ctx, "Authentication data verified");
+    if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+        sc_debug(card->ctx, "Authentication data verified");

 err:
    if (my_mac)
--- a/ccid/src/pace.h
+++ b/ccid/src/pace.h
@@ -59,10 +59,10 @@ int pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx,
        const u8 *mac, size_t maclen,
        const u8 *macdata, size_t macdatalen);

-int GetReadersPACECapabilities(sc_card_t *card, const __u8
-        *in, __u8 **out, size_t *outlen);
+int GetReadersPACECapabilities(sc_card_t *card, const unsigned char *in,
+        unsigned char **out, size_t *outlen);
 int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card,
-        const __u8 *in, __u8 **out, size_t *outlen, struct sm_ctx *sctx);
+        const unsigned char *in, unsigned char **out, size_t *outlen, struct sm_ctx *sctx);

 int pace_transmit_apdu(const struct sm_ctx *sctx, sc_card_t *card,
        sc_apdu_t *apdu);
--- a/ccid/src/sm.c
+++ b/ccid/src/sm.c
@@ -195,13 +195,15 @@ static int format_data(sc_card_t *card, const struct sm_ctx *ctx,
        goto err;
    pad_data_len = r;

-    bin_log(card->ctx, "Data to encrypt", pad_data, pad_data_len);
+    if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+        bin_log(card->ctx, "Data to encrypt", pad_data, pad_data_len);
    r = ctx->encrypt(card, ctx, pad_data, pad_data_len, formatted_data);
    if (r < 0) {
        sc_error(card->ctx, "Could not encrypt the data");
        goto err;
    }
-    bin_log(card->ctx, "Cryptogram", *formatted_data, r);
+    if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+        bin_log(card->ctx, "Cryptogram", *formatted_data, r);

    r = prefix_buf(ctx->padding_indicator, *formatted_data, r, formatted_data);
    if (r < 0)
@@ -288,7 +290,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card,
                sc_error(card->ctx, "Could not format Le of SM apdu");
                goto err;
            }
-            bin_log(card->ctx, "Protected Le (plain)", le, le_len);
+            if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+                bin_log(card->ctx, "Protected Le (plain)", le, le_len);
            break;
 	case SC_APDU_CASE_2_EXT:
            if (card->slot->active_protocol == SC_PROTO_T0) {
@@ -308,7 +311,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card,
                    goto err;
                }
            }
-            bin_log(card->ctx, "Protected Le (plain)", le, le_len);
+            if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+                bin_log(card->ctx, "Protected Le (plain)", le, le_len);
            break;
        case SC_APDU_CASE_3_SHORT:
        case SC_APDU_CASE_3_EXT:
@@ -318,8 +322,9 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card,
                sc_error(card->ctx, "Could not format data of SM apdu");
                goto err;
            }
-            bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)",
-                    fdata, fdata_len);
+            if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+                bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)",
+                        fdata, fdata_len);
            break;
        case SC_APDU_CASE_4_SHORT:
            /* in case of T0 no Le byte is added */
@@ -330,7 +335,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card,
                    sc_error(card->ctx, "Could not format Le of SM apdu");
                    goto err;
                }
-                bin_log(card->ctx, "Protected Le (plain)", le, le_len);
+                if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+                    bin_log(card->ctx, "Protected Le (plain)", le, le_len);
            }

            r = format_data(card, ctx, apdu->data, apdu->datalen,
@@ -339,8 +345,9 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card,
                sc_error(card->ctx, "Could not format data of SM apdu");
                goto err;
            }
-            bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)",
-                    fdata, fdata_len);
+            if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+                bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)",
+                        fdata, fdata_len);
            break;
        case SC_APDU_CASE_4_EXT:
            if (card->slot->active_protocol == SC_PROTO_T0) {
@@ -356,7 +363,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card,
                    sc_error(card->ctx, "Could not format Le of SM apdu");
                    goto err;
                }
-                bin_log(card->ctx, "Protected Le (plain)", le, le_len);
+                if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+                    bin_log(card->ctx, "Protected Le (plain)", le, le_len);
            }

            r = format_data(card, ctx, apdu->data, apdu->datalen,
@@ -365,8 +373,9 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card,
                sc_error(card->ctx, "Could not format data of SM apdu");
                goto err;
            }
-            bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)",
-                    fdata, fdata_len);
+            if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+                bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)",
+                        fdata, fdata_len);
            break;
        default:
            sc_error(card->ctx, "Unhandled apdu case");
@@ -394,7 +403,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card,
        }
        mac_data_len = r;
    }
-    bin_log(card->ctx, "Data to authenticate", mac_data, mac_data_len);
+    if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+        bin_log(card->ctx, "Data to authenticate", mac_data, mac_data_len);

    r = ctx->authenticate(card, ctx, mac_data, mac_data_len,
            &mac);
@@ -405,7 +415,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card,
    mac_len = r;
    sc_format_asn1_entry(sm_capdu + 2, mac, &mac_len,
            SC_ASN1_PRESENT);
-    bin_log(card->ctx, "Cryptographic Checksum (plain)", mac, mac_len);
+    if (card->ctx->debug > SC_LOG_TYPE_DEBUG)
+        bin_log(card->ctx, "Cryptographic Checksum (plain)", mac, mac_len);


    /* format SM apdu */
@@ -422,7 +433,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card,
    sm_apdu->lc = sm_apdu->datalen;
    sm_apdu->le = 0;
    sm_apdu->cse = SC_APDU_CASE_4;
-    bin_log(card->ctx, "ASN.1 encoded APDU data", sm_apdu->data, sm_apdu->datalen);
+    if (card->ctx->debug >= SC_LOG_TYPE_DEBUG)
+        bin_log(card->ctx, "ASN.1 encoded encrypted APDU data", sm_apdu->data, sm_apdu->datalen);

 err:
    if (fdata)
@@ -529,10 +541,12 @@ static int sm_decrypt(const struct sm_ctx *ctx, sc_card_t *card,
        goto err;
    }

-    sc_debug(card->ctx, "Decrypted APDU sw1=%02x sw2=%02x",
-            apdu->sw1, apdu->sw2);
-    bin_log(card->ctx, "Decrypted APDU response data",
-            apdu->resp, apdu->resplen);
+    if (card->ctx->debug >= SC_LOG_TYPE_DEBUG) {
+        sc_debug(card->ctx, "Decrypted APDU sw1=%02x sw2=%02x",
+                apdu->sw1, apdu->sw2);
+        bin_log(card->ctx, "Decrypted APDU response data",
+                apdu->resp, apdu->resplen);
+    }

    /* XXX verify mac */