nPA: added --cvca parameter

virtualsmartcard/src/vpicc/vicc.in

@@ -77,9 +77,13 @@ npa.add_argument("-c", "--car",
         action="store",
         type=str,
         help="certificate authority reference (CHR of the CVCA)")
+npa.add_argument("-C", "--cvca",
+        action="store",
+        type=argparse.FileType('rb'),
+        help="CVCA certificate")
 npa.add_argument("-d", "--disable-checks",
         action="store_true", default=False,
-        help="Disables checking validity period of TA certificate and always accepts the first CV certificate of a chain")
+        help="Disables checking validity period of TA certificates")
 
 
 args = parser.parse_args()
@@ -89,6 +93,7 @@ from virtualsmartcard.VirtualSmartcard import VirtualICC
 ef_cardsecurity_data = None
 ef_cardaccess_data = None
 ca_key_data = None
+cvca = None
 if (args.ef_cardsecurity):
     ef_cardsecurity_data = args.ef_cardsecurity.read()
     args.ef_cardsecurity.close()
@@ -98,9 +103,12 @@ if (args.ef_cardaccess):
 if (args.ca_key):
     ca_key_data = args.ca_key.read()
     args.ca_key.close()
+if (args.cvca):
+    cvca = args.cvca.read()
+    args.cvca.close()
 
 vicc = VirtualICC(args.file, args.type,
         args.hostname, args.port, readernum=args.reader,
         ef_cardaccess=ef_cardaccess_data, ef_cardsecurity=ef_cardsecurity_data,
-        ca_key=ca_key_data, car=args.car, disable_checks=args.disable_checks)
+        ca_key=ca_key_data, car=args.car, cvca=cvca, disable_checks=args.disable_checks)
 vicc.run()

virtualsmartcard/src/vpicc/virtualsmartcard/VirtualSmartcard.py

@@ -499,7 +499,7 @@ class RelayOS(SmartcardOS):
 
 
 class NPAOS(Iso7816OS):
-    def __init__(self, mf, sam, ins2handler=None, maxle=MAX_EXTENDED_LE, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, car=None, disable_checks=False):
+    def __init__(self, mf, sam, ins2handler=None, maxle=MAX_EXTENDED_LE, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, car=None, cvca=None, disable_checks=False):
         Iso7816OS.__init__(self, mf, sam, ins2handler, maxle)
         self.ins2handler[0x86] = self.SAM.general_authenticate
         self.ins2handler[0x2c] = self.SAM.reset_retry_counter
@@ -513,6 +513,8 @@ class NPAOS(Iso7816OS):
             ef.data = ef_cardaccess
         if car:
             self.SAM.current_SE.car = car
+        if cvca:
+            self.SAM.current_SE.cvca = cvca
         if ca_key:
             self.SAM.current_SE.ca_key = ca_key
 
@@ -555,7 +557,7 @@ class VirtualICC(object):
     the vpcd, which forwards it to the application.
     """ 
     
-    def __init__(self, filename, card_type, host, port, lenlen=3, readernum=None, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, car=None, disable_checks=False):
+    def __init__(self, filename, card_type, host, port, lenlen=3, readernum=None, ef_cardsecurity=None, ef_cardaccess=None, ca_key=None, car=None, cvca=None, disable_checks=False):
         from os.path import exists
         
         logging.basicConfig(level = logging.INFO, 
@@ -580,7 +582,7 @@ class VirtualICC(object):
         if card_type == "iso7816" or card_type == "ePass":
             self.os = Iso7816OS(MF, SAM)
         elif card_type == "nPA":
-            self.os = NPAOS(MF, SAM, ef_cardsecurity=ef_cardsecurity, ef_cardaccess=ef_cardaccess, ca_key=ca_key, car=car, disable_checks=disable_checks)
+            self.os = NPAOS(MF, SAM, ef_cardsecurity=ef_cardsecurity, ef_cardaccess=ef_cardaccess, ca_key=ca_key, car=car, cvca=cvca, disable_checks=disable_checks)
         elif card_type == "cryptoflex":
             self.os = CryptoflexOS(MF, SAM)
         elif card_type == "relay":

virtualsmartcard/src/vpicc/virtualsmartcard/cards/nPA.py

@@ -107,6 +107,7 @@ class nPA_SE(Security_Environment):
         self.eac_ctx = None
         self.ssc = 0
         self.car = "DECVCAeID00102"
+        self.cvca = None
         self.ca_key = None
         self.disable_checks = False
 
@@ -304,8 +305,7 @@ class nPA_SE(Security_Environment):
             result.append([0x87, len(self.car), self.car])
             if (self.disable_checks):
                 pace.TA_disable_checks(self.eac_ctx)
-            else:
+            if not pace.EAC_CTX_init_ta(self.eac_ctx, None, self.cvca, self.car):
-                if not pace.EAC_CTX_init_ta(self.eac_ctx, None, None, self.car):
                 pace.print_ossl_err()
                 raise SwError(SW["WARN_NOINFO63"])