VivoKey/vsmartcard
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

only use built in mechanisms for caching

Browse Source 
drops caching of EF.CardAccess and CAN at the driver level. The CAN is
now cached at the PKCS#15 layer.
This commit is contained in:
Frank Morgner
2014-08-08 07:34:22 +02:00
parent 68f59aabc9
commit 90892cb40f
3 changed files with 20 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files

88
npa/src/card-npa.c
View File

@@ -26,13 +26,6 @@
#include <npa/npa.h>
#include <string.h>
struct npa_drv_data {
unsigned char *can;
size_t can_length;
unsigned char *ef_cardaccess;
size_t ef_cardaccess_length;
};
static struct sc_atr_table npa_atrs[] = {
{"3B:8A:80:01:80:31:F8:73:F7:41:E0:82:90:00:75", NULL, "German ID card (neuer Personalausweis, nPA)", SC_CARD_TYPE_NPA, 0, NULL},
{"3B:84:80:01:00:00:90:00:95", NULL, "German ID card (Test neuer Personalausweis)", SC_CARD_TYPE_NPA_TEST, 0, NULL},
@@ -57,8 +50,6 @@ static int npa_match_card(sc_card_t * card)
static int npa_init(sc_card_t * card)
{
struct npa_drv_data *drv_data;
if (card) {
#if 0
/* we wait for https://github.com/OpenSC/OpenSC/pull/260 to be
@@ -66,15 +57,6 @@ static int npa_init(sc_card_t * card)
card->max_recv_size = 0xFFFF+1;
card->max_send_size = 0xFFFF;
#endif
drv_data = calloc(1, sizeof *drv_data);
card->drv_data = drv_data;
if (drv_data) {
drv_data->can = NULL;
drv_data->can_length = 0;
drv_data->ef_cardaccess = NULL;
drv_data->ef_cardaccess_length = 0;
}
card->caps |= SC_CARD_CAP_APDU_EXT | SC_CARD_CAP_RNG;
memset(&card->sm_ctx, 0, sizeof card->sm_ctx);
#ifdef DISABLE_GLOBAL_BOXING_INITIALIZATION
@@ -87,18 +69,7 @@ static int npa_init(sc_card_t * card)
static int npa_finish(sc_card_t * card)
{
struct npa_drv_data *drv_data;
if (card) {
sm_stop(card);
drv_data = card->drv_data;
if (drv_data) {
free(drv_data->ef_cardaccess);
free(drv_data->can);
free(drv_data);
}
card->drv_data = NULL;
}
return SC_SUCCESS;
}
@@ -163,9 +134,6 @@ static int npa_pace_verify(struct sc_card *card,
pace_input.pin = pin->data;
pace_input.pin_length = pin->len;
}
npa_get_cache(card, pace_input.pin_id, &pace_input.pin,
&pace_input.pin_length, &pace_output.ef_cardaccess,
&pace_output.ef_cardaccess_length);
r = perform_pace(card, pace_input, &pace_output, EAC_TR_VERSION_2_02);
@@ -191,8 +159,6 @@ static int npa_pace_verify(struct sc_card *card,
pace_input.pin_id = PACE_PIN_ID_CAN;
pace_input.pin = NULL;
pace_input.pin_length = 0;
npa_get_cache(card, pace_input.pin_id, &pace_input.pin,
&pace_input.pin_length, NULL, NULL);
r = perform_pace(card, pace_input, &pace_output, EAC_TR_VERSION_2_02);
@@ -233,10 +199,6 @@ static int npa_pace_verify(struct sc_card *card,
}
}
npa_set_cache(card, pace_input.pin_id, pace_input.pin,
pace_input.pin_length, pace_output.ef_cardaccess,
pace_output.ef_cardaccess_length);
free(pace_output.ef_cardaccess);
free(pace_output.recent_car);
free(pace_output.previous_car);
@@ -322,7 +284,7 @@ static int npa_pin_cmd(struct sc_card *card,
case NPA_PIN_ID_ESIGN_PIN:
if (card->reader->capabilities & SC_READER_CAP_PACE_ESIGN) {
sc_log(card->ctx, "Found a comfort reader (CAT-K).\n");
sc_log(card->ctx, "Will verify cached CAN first.\n");
sc_log(card->ctx, "Will verify CAN first.\n");
r = npa_pace_verify(card, PACE_PIN_ID_CAN, NULL,
esign_chat, sizeof esign_chat, tries_left);
if (r != SC_SUCCESS)
@@ -398,51 +360,3 @@ const char *sc_driver_version(void)
* tell OpenSC that everything is fine, here. */
return sc_get_version();
}
void npa_get_cache(struct sc_card *card,
unsigned char pin_id, const unsigned char **pin, size_t *pin_length,
unsigned char **ef_cardaccess, size_t *ef_cardaccess_length)
{
struct npa_drv_data *drv_data;
if (card && card->drv_data) {
drv_data = card->drv_data;
if (pin_id == PACE_PIN_ID_CAN && pin && pin_length && !*pin) {
/* set CAN if *pin is NULL */
*pin = drv_data->can;
*pin_length = drv_data->can_length;
sc_log(card->ctx, "Using the cached CAN\n");
}
if (ef_cardaccess && ef_cardaccess_length && !*ef_cardaccess) {
/* set EF.CardAccess if *ef_cardaccess is NULL */
*ef_cardaccess = drv_data->ef_cardaccess;
*ef_cardaccess_length = drv_data->ef_cardaccess_length;
}
}
}
void npa_set_cache(struct sc_card *card,
unsigned char pin_id, const unsigned char *pin, size_t pin_length,
const unsigned char *ef_cardaccess, size_t ef_cardaccess_length)
{
unsigned char *p;
struct npa_drv_data *drv_data;
if (card && card->drv_data) {
drv_data = card->drv_data;
if (pin_id == PACE_PIN_ID_CAN && pin) {
p = realloc(drv_data->can, pin_length);
if (p) {
memcpy(p, pin, pin_length);
drv_data->can = p;
drv_data->can_length = pin_length;
}
}
if (ef_cardaccess) {
p = realloc(drv_data->ef_cardaccess, ef_cardaccess_length);
if (p) {
memcpy(p, ef_cardaccess, ef_cardaccess_length);
drv_data->ef_cardaccess = p;
drv_data->ef_cardaccess_length = ef_cardaccess_length;
}
}
}
}

8
npa/src/card-npa.h
View File

@@ -44,14 +44,6 @@ static const unsigned char df_esign_aid[] = { 0xa0, 0x00, 0x00, 0x01, 0x67, 0x4
static const unsigned char df_esign_path[] = { 0x3f, 0x00, 0x50, 0x15, 0x1f, 0xff};
static const unsigned char ef_cardaccess_path[] = { 0x3f, 0x00, 0x01, 0x1c};
void npa_get_cache(struct sc_card *card,
unsigned char pin_id, const unsigned char **pin, size_t *pin_length,
unsigned char **ef_cardaccess, size_t *ef_cardaccess_length);
void npa_set_cache(struct sc_card *card,
unsigned char pin_id, const unsigned char *pin, size_t pin_length,
const unsigned char *ef_cardaccess, size_t ef_cardaccess_length);
#ifdef __cplusplus
}
#endif

34
npa/src/pkcs15-npa.c
View File

@@ -46,7 +46,8 @@ static int npa_add_pin(sc_pkcs15_card_t *p15card,
const char *label, int max_tries,
unsigned int flags, size_t min_length,
size_t max_length, unsigned char reference,
unsigned char auth_id, const struct sc_path *path)
unsigned char auth_id, const struct sc_path *path,
const char *pin, size_t pin_length)
{
struct sc_pkcs15_auth_info pin_info;
struct sc_pkcs15_object pin_obj;
@@ -75,10 +76,14 @@ static int npa_add_pin(sc_pkcs15_card_t *p15card,
pin_info.attrs.pin.max_length = max_length;
pin_info.attrs.pin.reference = reference;
if (pin && pin_length) {
sc_pkcs15_pincache_add(p15card, &pin_obj, pin, pin_length);
}
return sc_pkcs15emu_add_pin_obj(p15card, &pin_obj, &pin_info);
}
static int npa_add_pins(sc_pkcs15_card_t *p15card)
static int npa_add_pins(sc_pkcs15_card_t *p15card, const char *can)
{
int r;
const sc_path_t *mf = sc_get_mf_path();
@@ -95,7 +100,7 @@ static int npa_add_pins(sc_pkcs15_card_t *p15card)
| SC_PKCS15_PIN_FLAG_SO_PIN
| SC_PKCS15_PIN_FLAG_UNBLOCK_DISABLED
| SC_PKCS15_PIN_FLAG_CHANGE_DISABLED,
90, 90, PACE_PIN_ID_MRZ, 0, mf);
90, 90, PACE_PIN_ID_MRZ, 0, mf, NULL, 0);
if (r != SC_SUCCESS)
goto err;
@@ -104,14 +109,16 @@ static int npa_add_pins(sc_pkcs15_card_t *p15card)
| SC_PKCS15_PIN_FLAG_INITIALIZED
| SC_PKCS15_PIN_FLAG_SO_PIN
| SC_PKCS15_PIN_FLAG_UNBLOCK_DISABLED,
6, 6, PACE_PIN_ID_CAN, 0, mf);
6, 6, PACE_PIN_ID_CAN, 0, mf, can, can ? strlen(can) : 0);
if (r != SC_SUCCESS)
goto err;
/* TODO */
/*r = sc_pkcs15_pincache_add(p15card, pin_obj, pinbuf, *pinsize);*/
r = npa_add_pin(p15card, npa_secret_name(PACE_PIN_ID_PIN), 3,
SC_PKCS15_PIN_FLAG_CASE_SENSITIVE
| SC_PKCS15_PIN_FLAG_INITIALIZED,
5, 6, PACE_PIN_ID_PIN, PACE_PIN_ID_PUK, mf);
5, 6, PACE_PIN_ID_PIN, PACE_PIN_ID_PUK, mf, NULL, 0);
if (r != SC_SUCCESS)
goto err;
@@ -122,7 +129,7 @@ static int npa_add_pins(sc_pkcs15_card_t *p15card)
| SC_PKCS15_PIN_FLAG_UNBLOCK_DISABLED
| SC_PKCS15_PIN_FLAG_UNBLOCKING_PIN
| SC_PKCS15_PIN_FLAG_CHANGE_DISABLED,
10, 10, PACE_PIN_ID_PUK, 0, mf);
10, 10, PACE_PIN_ID_PUK, 0, mf, NULL, 0);
if (r != SC_SUCCESS)
goto err;
@@ -131,7 +138,7 @@ static int npa_add_pins(sc_pkcs15_card_t *p15card)
| SC_PKCS15_PIN_FLAG_LOCAL
| SC_PKCS15_PIN_FLAG_INTEGRITY_PROTECTED
| SC_PKCS15_PIN_FLAG_INITIALIZED,
6, 6, NPA_PIN_ID_ESIGN_PIN, PACE_PIN_ID_PUK, &df_esign);
6, 6, NPA_PIN_ID_ESIGN_PIN, PACE_PIN_ID_PUK, &df_esign, NULL, 0);
if (r != SC_SUCCESS)
goto err;
@@ -191,9 +198,6 @@ static int npa_get_cert(sc_pkcs15_card_t *p15card, const char *can)
pace_input.pin = (const unsigned char *) can;
pace_input.pin_length = strlen(can);
}
npa_get_cache(p15card->card, pace_input.pin_id, &pace_input.pin,
&pace_input.pin_length, &pace_output.ef_cardaccess,
&pace_output.ef_cardaccess_length);
r = perform_pace(p15card->card, pace_input, &pace_output, EAC_TR_VERSION_2_02);
if (r != SC_SUCCESS)
@@ -229,16 +233,14 @@ int sc_pkcs15emu_npa_init_ex(sc_pkcs15_card_t *p15card,
if (r != SC_SUCCESS)
goto err;
r = npa_add_pins(p15card);
if (r != SC_SUCCESS)
goto err;
if (opts) {
can = scconf_get_str(opts->blk, "can", NULL);
npa_set_cache(p15card->card, PACE_PIN_ID_CAN,
(const unsigned char *) can, strlen(can), NULL, 0);
}
r = npa_add_pins(p15card, can);
if (r != SC_SUCCESS)
goto err;
r = npa_get_cert(p15card, can);
if (r != SC_SUCCESS) {
sc_log(p15card->card->ctx, "No certificate found, will continue anyway\n");