From 7fd92afc4f45080344ac36abf4992f5022be8468 Mon Sep 17 00:00:00 2001 From: frankmorgner Date: Wed, 26 May 2010 20:32:29 +0000 Subject: [PATCH] removed some messages, when less verbose. fixed little endian problem when parsing input buffer of EstablishPACEChannel. git-svn-id: https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@111 96b47cad-a561-4643-ad3b-153ac7d7599c --- ccid/src/pace-tool.c | 9 ++++--- ccid/src/pace.c | 56 ++++++++++++++++++++++++-------------------- ccid/src/pace.h | 6 ++--- ccid/src/sm.c | 52 +++++++++++++++++++++++++--------------- 4 files changed, 71 insertions(+), 52 deletions(-) diff --git a/ccid/src/pace-tool.c b/ccid/src/pace-tool.c index 48e15a6..d8b6202 100644 --- a/ccid/src/pace-tool.c +++ b/ccid/src/pace-tool.c @@ -113,8 +113,7 @@ int pace_get_channel(struct sm_ctx *oldpacectx, sc_card_t *card, buf[3 + pinlen] = 0; // length_cert_desc buf[4 + pinlen]= 0; // length_cert_desc - SC_FUNC_RETURN(card->ctx, SC_LOG_TYPE_ERROR, - EstablishPACEChannel(oldpacectx, card, buf, out, outlen, sctx)); + return EstablishPACEChannel(oldpacectx, card, buf, out, outlen, sctx); } int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card) @@ -146,6 +145,7 @@ int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card) read[linelen - 1] = 0; if (sc_hex_to_bin(read, buf, &apdulen) < 0) { sc_error(card->ctx, "Could not format binary string"); + continue; } r = build_apdu(card->ctx, buf, apdulen, &apdu); @@ -167,11 +167,10 @@ int pace_translate_apdus(struct sm_ctx *sctx, sc_card_t *card) bin_print(stdout, "Decrypted APDU response data", apdu.resp, apdu.resplen); } -err: if (read) free(read); - SC_FUNC_RETURN(card->ctx, SC_LOG_TYPE_ERROR, r); + return r; } int @@ -345,5 +344,5 @@ err: sc_disconnect_card(card, 0); sc_release_context(ctx); - return i; + return -i; } diff --git a/ccid/src/pace.c b/ccid/src/pace.c index 3c4349b..b073817 100644 --- a/ccid/src/pace.c +++ b/ccid/src/pace.c @@ -24,11 +24,9 @@ #include #include #include -#include #include #include #include -#include #include #include #include @@ -293,7 +291,8 @@ static int pace_mse_set_at(const struct sm_ctx *oldpacectx, sc_card_t *card, apdu.data = sc_asn1_find_tag(card->ctx, d, r, 0x30, &apdu.datalen); apdu.lc = apdu.datalen; - bin_log(card->ctx, "MSE:Set AT command data", apdu.data, apdu.datalen); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "MSE:Set AT command data", apdu.data, apdu.datalen); if (oldpacectx) r = pace_transmit_apdu(oldpacectx, card, &apdu); @@ -314,13 +313,15 @@ static int pace_mse_set_at(const struct sm_ctx *oldpacectx, sc_card_t *card, if (apdu.sw1 == 0x63) { if ((apdu.sw2 & 0xc0) == 0xc0) { tries = apdu.sw2 & 0x0f; - /* this is only a warning... */ - sc_error(card->ctx, "Remaining tries: %d%s\n", - tries, tries == 1? ", (password must be resumed)": - tries == 0? ", (password must be unblocked)": ""); - r = SC_SUCCESS; + if (tries <= 1) { + /* this is only a warning... */ + sc_error(card->ctx, "Remaining tries: %d (%s must be %s)\n", + tries, pace_secret_name(secret_key), + tries ? "resumed" : "unblocked"); + } + r = SC_SUCCESS; } else { - sc_error(card->ctx, "Unknown SWs; SW1=%02X, SW2=%02X\n", + sc_error(card->ctx, "Unknown status bytes: SW1=%02X, SW2=%02X\n", apdu.sw1, apdu.sw2); r = SC_ERROR_CARD_CMD_FAILED; goto err; @@ -416,7 +417,8 @@ static int pace_gen_auth(const struct sm_ctx *oldpacectx, sc_card_t *card, apdu.datalen = r; apdu.lc = r; - bin_log(card->ctx, "General authenticate command data", apdu.data, apdu.datalen); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "General authenticate command data", apdu.data, apdu.datalen); apdu.resplen = maxresp; apdu.resp = malloc(apdu.resplen); @@ -431,7 +433,8 @@ static int pace_gen_auth(const struct sm_ctx *oldpacectx, sc_card_t *card, if (r < 0) goto err; - bin_log(card->ctx, "General authenticate response data", apdu.resp, apdu.resplen); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "General authenticate response data", apdu.resp, apdu.resplen); if (!d2i_PACE_GEN_AUTH_R(&r_data, (const unsigned char **) &apdu.resp, apdu.resplen)) { @@ -610,8 +613,8 @@ get_psec(sc_card_t *card, const char *pin, size_t length_pin, enum s_type pin_id hints.usage = SC_UI_USAGE_OTHER; sc_result = sc_ui_get_pin(&hints, &p); if (sc_result < 0) { - sc_error(card->ctx, "Could not read PACE secret (%s).\n", - sc_strerror(sc_result)); + sc_error(card->ctx, "Could not read %s (%s).\n", + pace_secret_name(pin_id), sc_strerror(sc_result)); return NULL; } length_pin = strlen(p); @@ -643,7 +646,7 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card, const __u8 *chat, *pin, *certificate_description; __u8 *ef_cardaccess = NULL; PACEInfo *info = NULL; - uint16_t word; + __le16 word; PACEDomainParameterInfo *static_dp = NULL, *eph_dp = NULL; BUF_MEM *enc_nonce, *nonce = NULL, *mdata = NULL, *mdata_opp = NULL, *k_enc = NULL, *k_mac = NULL, *token_opp = NULL, @@ -670,8 +673,9 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card, pin = in; in += length_pin; - length_cert_desc = (__le16_to_cpu((__le16) *in)); - in += sizeof (__le16); + memcpy(&word, in, sizeof word); + length_cert_desc = __le16_to_cpu(word); + in += sizeof word; certificate_description = in; @@ -687,8 +691,7 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card, r = SC_ERROR_OUT_OF_MEMORY; goto err; } - word = length_ef_cardaccess; - word = htons(word); + word = __cpu_to_le16(length_ef_cardaccess); memcpy(*out + 2, &word, sizeof word); memcpy(*out + 4, ef_cardaccess, length_ef_cardaccess); /* XXX CAR */ @@ -698,8 +701,7 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card, } else { second_execution = 1; memcpy(&word, *out + 2, sizeof word); - word = ntohs(word); - length_ef_cardaccess = word; + length_ef_cardaccess = __le16_to_cpu(word); ef_cardaccess = *out + 4; } bin_log(card->ctx, "EF.CardAccess", ef_cardaccess, length_ef_cardaccess); @@ -731,7 +733,8 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card, "(General Authenticate step 1 failed)."); goto err; } - bin_log(card->ctx, "Encrypted nonce from MRTD", (u8 *)enc_nonce->data, enc_nonce->length); + if (card->ctx->debug >= SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Encrypted nonce from MRTD", (u8 *)enc_nonce->data, enc_nonce->length); enc_nonce->max = enc_nonce->length; sec = get_psec(card, (char *) pin, length_pin, pin_id); @@ -765,7 +768,8 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card, goto err; } mdata_opp->max = mdata_opp->length; - bin_log(card->ctx, "Mapping data from MRTD", (u8 *) mdata_opp->data, mdata_opp->length); + if (card->ctx->debug >= SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Mapping data from MRTD", (u8 *) mdata_opp->data, mdata_opp->length); eph_dp = PACE_STEP3A_map_dp(static_dp, pctx, nonce, mdata_opp); pub = PACE_STEP3B_generate_ephemeral_key(eph_dp, pctx); @@ -783,7 +787,8 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card, goto err; } pub_opp->max = pub_opp->length; - bin_log(card->ctx, "Public key from MRTD", (u8 *) pub_opp->data, pub_opp->length); + if (card->ctx->debug >= SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Public key from MRTD", (u8 *) pub_opp->data, pub_opp->length); key = PACE_STEP3B_compute_ephemeral_key(eph_dp, pctx, pub_opp); if (!key || @@ -1091,11 +1096,12 @@ int pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx, if (my_mac->length != maclen || memcmp(my_mac->data, mac, maclen) != 0) { r = SC_ERROR_OBJECT_NOT_VALID; - sc_debug(card->ctx, "Authentication data not verified"); + sc_error(card->ctx, "Authentication data not verified"); goto err; } - sc_debug(card->ctx, "Authentication data verified"); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + sc_debug(card->ctx, "Authentication data verified"); err: if (my_mac) diff --git a/ccid/src/pace.h b/ccid/src/pace.h index 7fecf39..d10cff1 100644 --- a/ccid/src/pace.h +++ b/ccid/src/pace.h @@ -59,10 +59,10 @@ int pace_sm_verify_authentication(sc_card_t *card, const struct sm_ctx *ctx, const u8 *mac, size_t maclen, const u8 *macdata, size_t macdatalen); -int GetReadersPACECapabilities(sc_card_t *card, const __u8 - *in, __u8 **out, size_t *outlen); +int GetReadersPACECapabilities(sc_card_t *card, const unsigned char *in, + unsigned char **out, size_t *outlen); int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card, - const __u8 *in, __u8 **out, size_t *outlen, struct sm_ctx *sctx); + const unsigned char *in, unsigned char **out, size_t *outlen, struct sm_ctx *sctx); int pace_transmit_apdu(const struct sm_ctx *sctx, sc_card_t *card, sc_apdu_t *apdu); diff --git a/ccid/src/sm.c b/ccid/src/sm.c index 355f062..4044d57 100644 --- a/ccid/src/sm.c +++ b/ccid/src/sm.c @@ -195,13 +195,15 @@ static int format_data(sc_card_t *card, const struct sm_ctx *ctx, goto err; pad_data_len = r; - bin_log(card->ctx, "Data to encrypt", pad_data, pad_data_len); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Data to encrypt", pad_data, pad_data_len); r = ctx->encrypt(card, ctx, pad_data, pad_data_len, formatted_data); if (r < 0) { sc_error(card->ctx, "Could not encrypt the data"); goto err; } - bin_log(card->ctx, "Cryptogram", *formatted_data, r); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Cryptogram", *formatted_data, r); r = prefix_buf(ctx->padding_indicator, *formatted_data, r, formatted_data); if (r < 0) @@ -288,7 +290,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, sc_error(card->ctx, "Could not format Le of SM apdu"); goto err; } - bin_log(card->ctx, "Protected Le (plain)", le, le_len); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Protected Le (plain)", le, le_len); break; case SC_APDU_CASE_2_EXT: if (card->slot->active_protocol == SC_PROTO_T0) { @@ -308,7 +311,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, goto err; } } - bin_log(card->ctx, "Protected Le (plain)", le, le_len); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Protected Le (plain)", le, le_len); break; case SC_APDU_CASE_3_SHORT: case SC_APDU_CASE_3_EXT: @@ -318,8 +322,9 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, sc_error(card->ctx, "Could not format data of SM apdu"); goto err; } - bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)", - fdata, fdata_len); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)", + fdata, fdata_len); break; case SC_APDU_CASE_4_SHORT: /* in case of T0 no Le byte is added */ @@ -330,7 +335,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, sc_error(card->ctx, "Could not format Le of SM apdu"); goto err; } - bin_log(card->ctx, "Protected Le (plain)", le, le_len); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Protected Le (plain)", le, le_len); } r = format_data(card, ctx, apdu->data, apdu->datalen, @@ -339,8 +345,9 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, sc_error(card->ctx, "Could not format data of SM apdu"); goto err; } - bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)", - fdata, fdata_len); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)", + fdata, fdata_len); break; case SC_APDU_CASE_4_EXT: if (card->slot->active_protocol == SC_PROTO_T0) { @@ -356,7 +363,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, sc_error(card->ctx, "Could not format Le of SM apdu"); goto err; } - bin_log(card->ctx, "Protected Le (plain)", le, le_len); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Protected Le (plain)", le, le_len); } r = format_data(card, ctx, apdu->data, apdu->datalen, @@ -365,8 +373,9 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, sc_error(card->ctx, "Could not format data of SM apdu"); goto err; } - bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)", - fdata, fdata_len); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Padding-content indicator followed by cryptogram (plain)", + fdata, fdata_len); break; default: sc_error(card->ctx, "Unhandled apdu case"); @@ -394,7 +403,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, } mac_data_len = r; } - bin_log(card->ctx, "Data to authenticate", mac_data, mac_data_len); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Data to authenticate", mac_data, mac_data_len); r = ctx->authenticate(card, ctx, mac_data, mac_data_len, &mac); @@ -405,7 +415,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, mac_len = r; sc_format_asn1_entry(sm_capdu + 2, mac, &mac_len, SC_ASN1_PRESENT); - bin_log(card->ctx, "Cryptographic Checksum (plain)", mac, mac_len); + if (card->ctx->debug > SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "Cryptographic Checksum (plain)", mac, mac_len); /* format SM apdu */ @@ -422,7 +433,8 @@ static int sm_encrypt(const struct sm_ctx *ctx, sc_card_t *card, sm_apdu->lc = sm_apdu->datalen; sm_apdu->le = 0; sm_apdu->cse = SC_APDU_CASE_4; - bin_log(card->ctx, "ASN.1 encoded APDU data", sm_apdu->data, sm_apdu->datalen); + if (card->ctx->debug >= SC_LOG_TYPE_DEBUG) + bin_log(card->ctx, "ASN.1 encoded encrypted APDU data", sm_apdu->data, sm_apdu->datalen); err: if (fdata) @@ -529,10 +541,12 @@ static int sm_decrypt(const struct sm_ctx *ctx, sc_card_t *card, goto err; } - sc_debug(card->ctx, "Decrypted APDU sw1=%02x sw2=%02x", - apdu->sw1, apdu->sw2); - bin_log(card->ctx, "Decrypted APDU response data", - apdu->resp, apdu->resplen); + if (card->ctx->debug >= SC_LOG_TYPE_DEBUG) { + sc_debug(card->ctx, "Decrypted APDU sw1=%02x sw2=%02x", + apdu->sw1, apdu->sw2); + bin_log(card->ctx, "Decrypted APDU response data", + apdu->resp, apdu->resplen); + } /* XXX verify mac */