From a8b22f7befe01aeee0cea37fe4e341dd5671bb62 Mon Sep 17 00:00:00 2001 From: Frank Morgner Date: Wed, 5 Oct 2016 20:51:13 +0200 Subject: [PATCH] removed npa project It has been replaced by https://github.com/frankmorgner/OpenSC --- .gitmodules | 7 +- .travis.yml | 34 +- ccid/configure.ac | 46 +- ccid/src/Makefile.am | 20 +- ccid/src/OpenSC | 1 + ccid/src/ccid.c | 46 +- ccid/src/npa | 1 - ccid/src/opensc | 1 - ccid/src/scutil.c | 346 ++- {npa/src/npa => ccid/src}/scutil.h | 0 ccid/src/sslutil.h | 1 - doc/conf.py | 12 +- doc/index.txt | 2 - doc/npa | 1 - npa/AUTHORS | 1 - npa/COPYING | 674 ----- npa/ChangeLog | 2009 -------------- npa/Makefile.am | 48 - npa/NEWS | 0 npa/README | 8 +- npa/apdus | 29 - npa/certs/DECVCAEPASS00102 | 1 - npa/certs/DECVCAeID00102 | 1 - npa/certs/DECVCAeSign00102 | 1 - npa/certs/Makefile.am | 14 - .../csca-germany_013_self_signed_cer.cer | Bin 899 -> 0 bytes npa/certs/cvca-eid.cv | Bin 443 -> 0 bytes npa/certs/cvca-epass.cv | Bin 443 -> 0 bytes npa/certs/cvca-esign.cv | Bin 443 -> 0 bytes npa/certs/ff3d20d2 | 1 - npa/configure.ac | 239 -- npa/cross/MacOSX_install/postinstall | 13 - npa/cross/MacOSX_uninstall/postinstall | 20 - npa/cross/Makefile.am | 181 -- npa/cross/opensc.conf_win32 | 41 - npa/doc/Doxyfile.in | 12 - npa/doc/Makefile.am | 35 - npa/doc/README.txt | 253 -- npa/doc/README.txt.in | 253 -- npa/doc/api.txt | 87 - npa/doc/autotools.txt | 25 - npa/doc/autotools.txt.in | 1 - npa/doc/download.txt | 14 - npa/doc/download.txt.in | 1 - npa/doc/example.c | 1 - npa/doc/questions.txt | 6 - npa/doc/questions.txt.in | 1 - npa/libnpa.pc.in | 11 - npa/m4/.gitignore | 4 - npa/m4/Makefile.am | 1 - npa/npa-example-data | 1 - npa/opensc.conf.in | 40 - npa/src/Makefile.am | 71 - npa/src/boxing.c | 996 ------- npa/src/card-npa.c | 704 ----- npa/src/card-npa.h | 48 - npa/src/ccid-types.h | 1 - npa/src/example.c | 138 - npa/src/iso-sm-internal.h | 90 - npa/src/iso-sm.c | 749 ----- npa/src/npa-tool.c | 804 ------ npa/src/npa-tool.ggo.in | 228 -- npa/src/npa.c | 2438 ----------------- npa/src/npa/boxing.h | 67 - npa/src/npa/iso-sm.h | 125 - npa/src/npa/npa.h | 257 -- npa/src/opensc | 1 - npa/src/scutil.c | 345 --- npa/src/sslutil.h | 35 - npa/test_vicc_with_npa-tool.sh | 86 - virtualsmartcard/doc/README.txt.in | 3 +- virtualsmartcard/test_vicc_with_npa-tool.sh | 87 +- 72 files changed, 469 insertions(+), 11349 deletions(-) create mode 160000 ccid/src/OpenSC delete mode 120000 ccid/src/npa delete mode 120000 ccid/src/opensc mode change 120000 => 100644 ccid/src/scutil.c rename {npa/src/npa => ccid/src}/scutil.h (100%) delete mode 120000 ccid/src/sslutil.h delete mode 120000 doc/npa delete mode 100644 npa/AUTHORS delete mode 100644 npa/COPYING delete mode 100644 npa/ChangeLog delete mode 100644 npa/Makefile.am delete mode 100644 npa/NEWS mode change 120000 => 100644 npa/README delete mode 100644 npa/apdus delete mode 120000 npa/certs/DECVCAEPASS00102 delete mode 120000 npa/certs/DECVCAeID00102 delete mode 120000 npa/certs/DECVCAeSign00102 delete mode 100644 npa/certs/Makefile.am delete mode 100644 npa/certs/csca-germany_013_self_signed_cer.cer delete mode 100644 npa/certs/cvca-eid.cv delete mode 100644 npa/certs/cvca-epass.cv delete mode 100644 npa/certs/cvca-esign.cv delete mode 120000 npa/certs/ff3d20d2 delete mode 100644 npa/configure.ac delete mode 100755 npa/cross/MacOSX_install/postinstall delete mode 100755 npa/cross/MacOSX_uninstall/postinstall delete mode 100644 npa/cross/Makefile.am delete mode 100644 npa/cross/opensc.conf_win32 delete mode 100644 npa/doc/Doxyfile.in delete mode 100644 npa/doc/Makefile.am delete mode 100644 npa/doc/README.txt delete mode 100644 npa/doc/README.txt.in delete mode 100644 npa/doc/api.txt delete mode 100644 npa/doc/autotools.txt delete mode 120000 npa/doc/autotools.txt.in delete mode 100644 npa/doc/download.txt delete mode 120000 npa/doc/download.txt.in delete mode 120000 npa/doc/example.c delete mode 100644 npa/doc/questions.txt delete mode 120000 npa/doc/questions.txt.in delete mode 100644 npa/libnpa.pc.in delete mode 100644 npa/m4/.gitignore delete mode 100644 npa/m4/Makefile.am delete mode 120000 npa/npa-example-data delete mode 100644 npa/opensc.conf.in delete mode 100644 npa/src/Makefile.am delete mode 100644 npa/src/boxing.c delete mode 100644 npa/src/card-npa.c delete mode 100644 npa/src/card-npa.h delete mode 120000 npa/src/ccid-types.h delete mode 100644 npa/src/example.c delete mode 100644 npa/src/iso-sm-internal.h delete mode 100644 npa/src/iso-sm.c delete mode 100644 npa/src/npa-tool.c delete mode 100644 npa/src/npa-tool.ggo.in delete mode 100644 npa/src/npa.c delete mode 100644 npa/src/npa/boxing.h delete mode 100644 npa/src/npa/iso-sm.h delete mode 100644 npa/src/npa/npa.h delete mode 160000 npa/src/opensc delete mode 100644 npa/src/scutil.c delete mode 100644 npa/src/sslutil.h delete mode 100755 npa/test_vicc_with_npa-tool.sh mode change 120000 => 100755 virtualsmartcard/test_vicc_with_npa-tool.sh diff --git a/.gitmodules b/.gitmodules index 1af27a6..5dc9ae1 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,7 +1,3 @@ -[submodule "npa/src/opensc"] - path = npa/src/opensc - url = git://github.com/OpenSC/OpenSC.git - ignore = dirty [submodule "ACardEmulator/app/src/main/external/ykneo-openpgp"] path = ACardEmulator/app/src/main/external/ykneo-openpgp url = https://github.com/Yubico/ykneo-openpgp.git @@ -17,3 +13,6 @@ [submodule "ACardEmulator/app/src/main/external/GidsApplet"] path = ACardEmulator/app/src/main/external/GidsApplet url = https://github.com/vletoux/GidsApplet.git +[submodule "ccid/src/OpenSC"] + path = ccid/src/OpenSC + url = https://github.com/frankmorgner/OpenSC diff --git a/.travis.yml b/.travis.yml index fdd615a..f44f905 100644 --- a/.travis.yml +++ b/.travis.yml @@ -39,25 +39,8 @@ install: fi before_script: - # libnpa requires OpenPACE - - git clone https://github.com/frankmorgner/openpace && cd openpace - - autoreconf -vis - - if [ -z "$HOST" ]; then - ./configure --prefix=$PREFIX --enable-openssl-install --enable-python || cat config.log; - else - export CROSS_COMPILE=$HOST-; - ./configure --prefix=$PREFIX --enable-openssl-install --host=$HOST --enable-openssl-install || cat config.log; - touch src/cvc-create.1 src/cvc-print.1; - fi - - make install - # libnpa requires OpenSC - - cd $TRAVIS_BUILD_DIR/npa/src/opensc - - grep _sc_card_add_ec_alg src/libopensc/libopensc.exports || echo _sc_card_add_ec_alg >> src/libopensc/libopensc.exports - - grep _sc_card_add_rsa_alg src/libopensc/libopensc.exports || echo _sc_card_add_rsa_alg >> src/libopensc/libopensc.exports - - grep _sc_match_atr src/libopensc/libopensc.exports || echo _sc_match_atr >> src/libopensc/libopensc.exports - - grep sc_apdu_set_resp src/libopensc/libopensc.exports || echo sc_apdu_set_resp >> src/libopensc/libopensc.exports - - grep sc_apdu_get_octets src/libopensc/libopensc.exports || echo sc_apdu_get_octets >> src/libopensc/libopensc.exports - - grep sc_pkcs15_pincache_add src/libopensc/libopensc.exports || echo sc_pkcs15_pincache_add >> src/libopensc/libopensc.exports + # ccid requires OpenSC + - git clone https://github.com/frankmorgner/OpenSC && cd OpenSC - ./bootstrap - if [ -z "$HOST" ]; then ./configure --prefix=$PREFIX || cat config.log; @@ -65,15 +48,6 @@ before_script: ./configure --prefix=$PREFIX --host=$HOST LDFLAGS="-I$PREFIX/include" CFLAGS="-I$PREFIX/include" CXXFLAGS="-I$PREFIX/include" LIBS="-I$PREFIX/include" || cat config.log; fi - make install - # Configure libnpa - - cd $TRAVIS_BUILD_DIR/npa - - autoreconf -vsi - - if [ -z "$HOST" ]; then - ./configure OPENSC_LIBS="-L$PREFIX/lib -lopensc -lcrypto" || cat config.log; - else - ./configure --host=$HOST OPENSC_LIBS="-L$PREFIX/lib -lopensc -lcrypto" || cat config.log; - touch src/npa-tool.1; - fi # Configure virtualsmartcard - cd $TRAVIS_BUILD_DIR/virtualsmartcard && autoreconf -vsi - if [ -z "$HOST" ]; then @@ -94,7 +68,7 @@ before_script: ./configure --host=$HOST || cat config.log; fi - if [ -z "$HOST" ]; then - cd $TRAVIS_BUILD_DIR/ccid && autoreconf -vsi && ./configure OPENSSL_CFLAGS="-I$PREFIX/include" OPENSSL_LIBS="-L$PREFIX/lib -lcrypto" OPENSC_LIBS="-L$PREFIX/lib -lopensc" || cat config.log; + cd $TRAVIS_BUILD_DIR/ccid && autoreconf -vsi && ./configure OPENSC_LIBS="-L$PREFIX/lib -lopensc" || cat config.log; fi addons: @@ -107,8 +81,6 @@ addons: branch_pattern: coverity_scan script: - # Build libnpa - - make -C $TRAVIS_BUILD_DIR/npa # Build virtualsmartcard - make -C $TRAVIS_BUILD_DIR/virtualsmartcard # Verify virtualsmartcard diff --git a/ccid/configure.ac b/ccid/configure.ac index 21cc586..0f5ecfb 100644 --- a/ccid/configure.ac +++ b/ccid/configure.ac @@ -75,44 +75,20 @@ CPPFLAGS="$saved_CPPFLAGS" LIBS="$saved_LIBS" # --enable-pace -WITH_PACE=no -AC_ARG_ENABLE(pace, - AS_HELP_STRING([--enable-pace], [Enable Password Authenticated Connection Establishment (PACE) @<:@detect@:>@]), - [enable_pace="${enableval}"], [enable_pace=detect]) saved_CPPFLAGS="$CPPFLAGS" saved_LIBS="$LIBS" -if test "x$enable_pace" != xno ; then - WITH_PACE=yes - PKG_CHECK_EXISTS([libnpa], - [PKG_CHECK_MODULES([LIBNPA], [libnpa])], - [AC_MSG_WARN([libnpa not found by pkg-config])]) - CPPFLAGS="$CPPFLAGS $LIBNPA_CFLAGS -I${srcdir}/src/opensc/src" - LIBS="$LDFLAGS $LIBNPA_LIBS" - AC_CHECK_HEADERS(npa/npa.h, [], [ WITH_PACE=no ]) - AC_MSG_CHECKING([for perform_pace]) - AC_TRY_LINK_FUNC(perform_pace, [ AC_MSG_RESULT([yes]) ], [ WITH_PACE=no ]) - - if test x$WITH_PACE = xno -a x$enable_pace = xyes ; then - AC_MSG_ERROR([libnpa not found, use ./configure LIBNPA_CFLAGS=... LIBNPA_LIBS=...]) - fi -fi -if test "x$WITH_PACE" == xno ; then - PKG_CHECK_EXISTS([libopensc], - [PKG_CHECK_MODULES([OPENSC], [libopensc >= 0.12.1])], - [AC_MSG_WARN([libopensc >= 0.12.1 not found by pkg-config])]) - test -z "$OPENSC_LIBS" && OPENSC_LIBS="-lopensc $OPENSSL_LIBS" - LIBS="$LDFLAGS $OPENSC_LIBS" - AC_MSG_CHECKING([for sc_bytes2apdu]) - AC_TRY_LINK_FUNC(sc_bytes2apdu, [ AC_MSG_RESULT([yes]) ], - [ AC_MSG_ERROR([libopensc >= 0.12.1 not found, use ./configure OPENSC_LIBS=...]) ]) -fi -AC_CHECK_FUNCS([sc_apdu_set_resp sc_apdu_get_octets _sc_match_atr]) +PKG_CHECK_EXISTS([libopensc], + [PKG_CHECK_MODULES([OPENSC], [libopensc >= 0.12.1])], + [AC_MSG_WARN([libopensc >= 0.12.1 not found by pkg-config])]) +test -z "$OPENSC_LIBS" && OPENSC_LIBS="-lopensc $OPENSSL_LIBS" +LIBS="$LDFLAGS $OPENSC_LIBS" +AC_MSG_CHECKING([for sc_bytes2apdu]) +AC_TRY_LINK_FUNC(sc_bytes2apdu, [ AC_MSG_RESULT([yes]) ], +[ AC_MSG_ERROR([libopensc >= 0.12.1 not found, use ./configure OPENSC_LIBS=...]) ]) +AC_CHECK_FUNCS([sc_apdu_set_resp sc_apdu_get_octets _sc_match_atr boxing_buf_to_pace_input]) CPPFLAGS="$saved_CPPFLAGS" LIBS="$saved_LIBS" -AM_CONDITIONAL(WITH_PACE, test "${WITH_PACE}" = "yes") -AM_COND_IF(WITH_PACE, [AC_DEFINE(WITH_PACE, 1, [enable PACE support])]) - PACKAGE_SUMMARY="Emulate a USB CCID compliant smart card reader" AC_SUBST(PACKAGE_SUMMARY) @@ -157,10 +133,6 @@ PTHREAD_LIBS: ${PTHREAD_LIBS} OPENSC_LIBS: ${OPENSC_LIBS} OPENSSL_CFLAGS: ${OPENSSL_CFLAGS} OPENSSL_LIBS: ${OPENSSL_LIBS} -LIBNPA_CFLAGS: ${LIBNPA_CFLAGS} -LIBNPA_LIBS: ${LIBNPA_LIBS} - -PACE support: ${WITH_PACE} HELP2MAN: ${HELP2MAN} diff --git a/ccid/src/Makefile.am b/ccid/src/Makefile.am index 0fa320d..23d2a3a 100644 --- a/ccid/src/Makefile.am +++ b/ccid/src/Makefile.am @@ -10,14 +10,14 @@ do_subst = $(SED) \ BUILT_SOURCES = cmdline.h cmdline.c EXTRA_DIST = ccid-emulator.ggo ccid-emulator.ggo.in -EXTRA_DIST += $(shell find $(top_srcdir)/src/opensc/src -path '*/.git' -prune -o -type f -a -name '*.h' -print) +EXTRA_DIST += $(shell find $(top_srcdir)/src/OpenSC/src -path '*/.git' -prune -o -type f -a -name '*.h' -print) MAINTAINERCLEANFILES = $(BUILT_SOURCES) ccid-emulator.ggo $(dist_man1_MANS) dist_man1_MANS = $(abs_builddir)/ccid-emulator.1 -ccid_emulator_SOURCES = ccid.c usbstring.c usb.c $(BUILT_SOURCES) -ccid_emulator_LDADD = $(OPENSSL_LIBS) $(PTHREAD_LIBS) -ccid_emulator_CFLAGS = $(OPENSSL_CFLAGS) $(PTHREAD_CFLAGS) -I$(top_srcdir)/src/opensc/src +ccid_emulator_SOURCES = ccid.c usbstring.c usb.c scutil.c $(BUILT_SOURCES) +ccid_emulator_LDADD = $(OPENSC_LIBS) $(OPENSSL_LIBS) $(PTHREAD_LIBS) +ccid_emulator_CFLAGS = $(OPENSSL_CFLAGS) $(PTHREAD_CFLAGS) -I$(top_srcdir)/src/OpenSC/src ccid-emulator.c: $(BUILT_SOURCES) @@ -43,15 +43,5 @@ bin_PROGRAMS = ccid-emulator noinst_HEADERS = \ ccid.h \ ccid-types.h \ - npa/scutil.h \ - sslutil.h \ + scutil.h \ usbstring.h - - -if WITH_PACE -ccid_emulator_LDADD += $(LIBNPA_LIBS) -ccid_emulator_CFLAGS += $(LIBNPA_CFLAGS) -else -ccid_emulator_SOURCES += scutil.c -ccid_emulator_LDADD += $(OPENSC_LIBS) -endif diff --git a/ccid/src/OpenSC b/ccid/src/OpenSC new file mode 160000 index 0000000..78882fd --- /dev/null +++ b/ccid/src/OpenSC @@ -0,0 +1 @@ +Subproject commit 78882fd9278bd900ae9abd6e812155d2a401ba00 diff --git a/ccid/src/ccid.c b/ccid/src/ccid.c index 33e50f1..d17d314 100644 --- a/ccid/src/ccid.c +++ b/ccid/src/ccid.c @@ -19,6 +19,8 @@ #include #include #include +#include +#include #include #include #include @@ -28,20 +30,18 @@ #include #include "ccid.h" -#include "sslutil.h" #include "config.h" #include +#ifndef HAVE_BOXING_BUF_TO_PACE_INPUT +#include +#endif + static sc_context_t *ctx = NULL; static sc_card_t *card = NULL; static sc_reader_t *reader = NULL; -#ifdef WITH_PACE -#include -#include -#include - static int perform_pseudo_apdu_EstablishPACEChannel(sc_apdu_t *apdu) { @@ -88,9 +88,6 @@ perform_pseudo_apdu_GetReaderPACECapabilities(sc_apdu_t *apdu) return boxing_pace_capabilities_to_buf(reader->ctx, sc_reader_t_capabilities, &apdu->resp, &apdu->resplen); } -#else -int sc_sm_stop(struct sc_card *card) { return SC_SUCCESS; } -#endif static int perform_PC_to_RDR_GetSlotStatus(const __u8 *in, size_t inlen, __u8 **out, size_t *outlen); @@ -577,29 +574,19 @@ perform_pseudo_apdu(sc_reader_t *reader, sc_apdu_t *apdu) break; case 0x01: /* GetReaderPACECapabilities */ -#ifdef WITH_PACE LOG_TEST_RET(ctx, perform_pseudo_apdu_GetReaderPACECapabilities(apdu), "Could not get reader's PACE Capabilities"); apdu->sw1 = iso_sw_ok.sw1; apdu->sw2 = iso_sw_ok.sw2; -#else - apdu->sw1 = 0x6D; - apdu->sw2 = 0x00; -#endif break; case 0x02: /* EstablishPACEChannel */ -#ifdef WITH_PACE LOG_TEST_RET(ctx, perform_pseudo_apdu_EstablishPACEChannel(apdu), "Could not perform PACE"); apdu->sw1 = iso_sw_ok.sw1; apdu->sw2 = iso_sw_ok.sw2; -#else - apdu->sw1 = 0x6D; - apdu->sw2 = 0x00; -#endif break; case 0x03: /* DestroyPACEChannel */ @@ -949,7 +936,6 @@ write_pin(sc_apdu_t *apdu, struct sc_pin_cmd_pin *pin, uint8_t blocksize, blocksize - justify_offset, pin, encoding, sc_result); } -#ifdef WITH_PACE static int perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, const __u8 *abData, size_t abDatalen, @@ -1197,23 +1183,6 @@ perform_PC_to_RDR_Secure_GetReadersPACECapabilities(__u8 **abDataOut, return SC_SUCCESS; } -#else -static int -perform_PC_to_RDR_Secure_EstablishPACEChannel(sc_card_t *card, - const __u8 *abData, size_t abDatalen, - __u8 **abDataOut, size_t *abDataOutLen) -{ - sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "ccid compiled without PACE support."); - return SC_ERROR_NOT_SUPPORTED; -} -static int -perform_PC_to_RDR_Secure_GetReadersPACECapabilities(__u8 **abDataOut, - size_t *abDataOutLen) -{ - sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "ccid compiled without PACE support."); - return SC_ERROR_NOT_SUPPORTED; -} -#endif static int perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outlen) @@ -1394,7 +1363,6 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle 0)) { sc_result = SC_ERROR_INTERNAL; sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Could not read PIN.\n"); - ssl_error(ctx); goto err; } } else { @@ -1406,7 +1374,6 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle 0)) { sc_result = SC_ERROR_INTERNAL; sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Could not read current PIN.\n"); - ssl_error(ctx); goto err; } } @@ -1417,7 +1384,6 @@ perform_PC_to_RDR_Secure(const __u8 *in, size_t inlen, __u8** out, size_t *outle modify->bConfirmPIN & CCID_PIN_CONFIRM_NEW)) { sc_result = SC_ERROR_INTERNAL; sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Could not read new PIN.\n"); - ssl_error(ctx); goto err; } } diff --git a/ccid/src/npa b/ccid/src/npa deleted file mode 120000 index 484d817..0000000 --- a/ccid/src/npa +++ /dev/null @@ -1 +0,0 @@ -../../npa/src/npa \ No newline at end of file diff --git a/ccid/src/opensc b/ccid/src/opensc deleted file mode 120000 index 0bccc20..0000000 --- a/ccid/src/opensc +++ /dev/null @@ -1 +0,0 @@ -../../npa/src/opensc/ \ No newline at end of file diff --git a/ccid/src/scutil.c b/ccid/src/scutil.c deleted file mode 120000 index 22ced4a..0000000 --- a/ccid/src/scutil.c +++ /dev/null @@ -1 +0,0 @@ -../../npa/src/scutil.c \ No newline at end of file diff --git a/ccid/src/scutil.c b/ccid/src/scutil.c new file mode 100644 index 0000000..b69528a --- /dev/null +++ b/ccid/src/scutil.c @@ -0,0 +1,345 @@ +/* + * Copyright (C) 2010 Frank Morgner + * + * This file is part of libnpa. + * + * libnpa is free software: you can redistribute it and/or modify it under the + * terms of the GNU General Public License as published by the Free Software + * Foundation, either version 3 of the License, or (at your option) any later + * version. + * + * libnpa is distributed in the hope that it will be useful, but WITHOUT ANY + * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS + * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more + * details. + * + * You should have received a copy of the GNU General Public License along with + * libnpa. If not, see . + */ +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include "libopensc/internal.h" + +#ifndef HAVE__SC_MATCH_ATR +int sc_dlclose(void *handle) {} +const char *sc_dlerror() {} +void *sc_dlsym(void *handle, const char *symbol) {} +size_t strlcpy(char *dst, const char *src, size_t siz) {} +int sc_mutex_create(const sc_context_t *ctx, void **mutex) {} +int sc_mutex_destroy(const sc_context_t *ctx, void *mutex) {} +int _sc_parse_atr(sc_reader_t *reader) {} +void *sc_dlopen(const char *filename) {} +int sc_mutex_lock(const sc_context_t *ctx, void *mutex) {} +int sc_mutex_unlock(const sc_context_t *ctx, void *mutex) {} +#include "libopensc/card.c" +#endif + +#if !defined(HAVE_SC_APDU_GET_OCTETS) || !defined(HAVE_SC_APDU_SET_RESP) +#ifdef HAVE__SC_MATCH_ATR +size_t sc_get_max_send_size(const sc_card_t *card) {} +#endif +#include "libopensc/apdu.c" +#endif + +#include +#include +#include +#include +#include +#include + +int initialize(int reader_id, int verbose, + sc_context_t **ctx, sc_reader_t **reader) +{ + unsigned int i, reader_count; + + if (!ctx || !reader) + return SC_ERROR_INVALID_ARGUMENTS; + + int r = sc_establish_context(ctx, ""); + if (r < 0 || !*ctx) { + fprintf(stderr, "Failed to create initial context: %s", sc_strerror(r)); + return r; + } + + (*ctx)->debug = verbose; + (*ctx)->flags |= SC_CTX_FLAG_ENABLE_DEFAULT_DRIVER; + + reader_count = sc_ctx_get_reader_count(*ctx); + + if (reader_count == 0) { + sc_debug(*ctx, SC_LOG_DEBUG_NORMAL, "No reader not found.\n"); + return SC_ERROR_NO_READERS_FOUND; + } + + if (reader_id < 0) { + /* Automatically try to skip to a reader with a card if reader not specified */ + for (i = 0; i < reader_count; i++) { + *reader = sc_ctx_get_reader(*ctx, i); + if (sc_detect_card_presence(*reader) & SC_READER_CARD_PRESENT) { + reader_id = i; + sc_debug(*ctx, SC_LOG_DEBUG_NORMAL, "Using the first reader" + " with a card: %s", (*reader)->name); + break; + } + } + if (reader_id >= reader_count) { + sc_debug(*ctx, SC_LOG_DEBUG_NORMAL, "No card found, using the first reader."); + reader_id = 0; + } + } + + if (reader_id >= reader_count) { + sc_debug(*ctx, SC_LOG_DEBUG_NORMAL, "Invalid reader number " + "(%d), only %d available.\n", reader_id, reader_count); + return SC_ERROR_NO_READERS_FOUND; + } + + *reader = sc_ctx_get_reader(*ctx, reader_id); + + return SC_SUCCESS; +} + +void _bin_log(sc_context_t *ctx, int type, const char *file, int line, + const char *func, const char *label, const u8 *data, size_t len, + FILE *f) +{ + if (!f) { + char buf[1800]; + if (data) + sc_hex_dump(ctx, SC_LOG_DEBUG_NORMAL, data, len, buf, sizeof buf); + else + buf[0] = 0; + sc_do_log(ctx, type, file, line, func, + "\n%s (%u byte%s)%s%s", + label, (unsigned int) len, len==1?"":"s", len==0?"":":\n", buf); + } else { + fprintf(f, "%s (%u byte%s)%s%s\n", + label, (unsigned int) len, len==1?"":"s", len==0?"":":\n", sc_dump_hex(data, len)); + } +} + +static int list_readers(sc_context_t *ctx) +{ + char card_atr[0x3e]; + sc_card_t *card; + sc_reader_t *reader; + size_t i, rcount = sc_ctx_get_reader_count(ctx); + + if (rcount == 0) { + printf("No smart card readers found.\n"); + return 0; + } + printf("%-4s %-7s %s\n", "Nr.", "Driver", "Smart Card Reader"); + for (i = 0; i < rcount; i++) { + reader = sc_ctx_get_reader(ctx, i); + memset(card_atr, '\0', sizeof card_atr); + if (sc_detect_card_presence(reader) & SC_READER_CARD_PRESENT) { + if (sc_connect_card(reader, &card) == SC_SUCCESS) { + sc_bin_to_hex(card->atr.value, card->atr.len, + card_atr, sizeof card_atr, ':'); + } + sc_disconnect_card(card); + } else { + strncpy(card_atr, "[no card present]", sizeof card_atr); + } + printf("%-4zu %-7s %s\n", i, reader->driver->short_name, reader->name); + printf(" ATR: %s\n", card_atr); + } + + return 0; +} + +int print_avail(int verbose) +{ + sc_context_t *ctx = NULL; + + int r; + r = sc_establish_context(&ctx, ""); + if (r) { + fprintf(stderr, "Failed to establish context: %s\n", sc_strerror(r)); + return 1; + } + ctx->debug = verbose; + ctx->flags |= SC_CTX_FLAG_ENABLE_DEFAULT_DRIVER; + + r = list_readers(ctx); + + sc_release_context(ctx); + + return r; +} + +#define ISO_READ_BINARY 0xB0 +#define ISO_P1_FLAG_SFID 0x80 +int read_binary_rec(sc_card_t *card, unsigned char sfid, + u8 **ef, size_t *ef_len) +{ + int r; + size_t read = MAX_SM_APDU_RESP_SIZE; + sc_apdu_t apdu; + u8 *p; + + if (!card || !ef || !ef_len) { + r = SC_ERROR_INVALID_ARGUMENTS; + goto err; + } + *ef_len = 0; + + if (read > 0xff+1) + sc_format_apdu(card, &apdu, SC_APDU_CASE_2_EXT, + ISO_READ_BINARY, ISO_P1_FLAG_SFID|sfid, 0); + else + sc_format_apdu(card, &apdu, SC_APDU_CASE_2_SHORT, + ISO_READ_BINARY, ISO_P1_FLAG_SFID|sfid, 0); + + p = realloc(*ef, read); + if (!p) { + r = SC_ERROR_OUT_OF_MEMORY; + goto err; + } + *ef = p; + apdu.resp = *ef; + apdu.resplen = read; + apdu.le = read; + + r = sc_transmit_apdu(card, &apdu); + /* emulate the behaviour of sc_read_binary */ + if (r >= 0) + r = apdu.resplen; + + while(1) { + if (r >= 0 && r != read) { + *ef_len += r; + break; + } + if (r < 0) { + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not read EF."); + goto err; + } + *ef_len += r; + + p = realloc(*ef, *ef_len + read); + if (!p) { + r = SC_ERROR_OUT_OF_MEMORY; + goto err; + } + *ef = p; + + r = sc_read_binary(card, *ef_len, + *ef + *ef_len, read, 0); + } + + r = SC_SUCCESS; + +err: + return r; +} + +#define ISO_WRITE_BINARY 0xD0 +int write_binary_rec(sc_card_t *card, unsigned char sfid, + u8 *ef, size_t ef_len) +{ + int r; + size_t write = MAX_SM_APDU_DATA_SIZE, wrote = 0; + sc_apdu_t apdu; +#ifdef ENABLE_SM + struct iso_sm_ctx *iso_sm_ctx; +#endif + + if (!card) { + r = SC_ERROR_INVALID_ARGUMENTS; + goto err; + } + +#ifdef ENABLE_SM + iso_sm_ctx = card->sm_ctx.info.cmd_data; + if (write > SC_MAX_APDU_BUFFER_SIZE-2 + || (card->sm_ctx.sm_mode == SM_MODE_TRANSMIT + && write > (((SC_MAX_APDU_BUFFER_SIZE-2 + /* for encrypted APDUs we usually get authenticated status + * bytes (4B), a MAC (11B) and a cryptogram with padding + * indicator (3B without data). The cryptogram is always + * padded to the block size. */ + -18) / iso_sm_ctx->block_length) + * iso_sm_ctx->block_length - 1))) + sc_format_apdu(card, &apdu, SC_APDU_CASE_3_EXT, + ISO_WRITE_BINARY, ISO_P1_FLAG_SFID|sfid, 0); + else +#endif + sc_format_apdu(card, &apdu, SC_APDU_CASE_3_SHORT, + ISO_WRITE_BINARY, ISO_P1_FLAG_SFID|sfid, 0); + + if (write > ef_len) { + apdu.datalen = ef_len; + apdu.lc = ef_len; + } else { + apdu.datalen = write; + apdu.lc = write; + } + apdu.data = ef; + + + r = sc_transmit_apdu(card, &apdu); + /* emulate the behaviour of sc_write_binary */ + if (r >= 0) + r = apdu.datalen; + + while (1) { + if (r < 0 || r > ef_len) { + sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not write EF."); + goto err; + } + wrote += r; + apdu.data += r; + if (wrote >= ef_len) + break; + + r = sc_write_binary(card, wrote, ef, write, 0); + } + + r = SC_SUCCESS; + +err: + return r; +} + +int fread_to_eof(const char *file, unsigned char **buf, size_t *buflen) +{ + FILE *input = NULL; + int r = 0; + unsigned char *p; + + if (!buflen || !buf || !file) + goto err; + +#define MAX_READ_LEN 0xfff + p = realloc(*buf, MAX_READ_LEN); + if (!p) + goto err; + *buf = p; + + input = fopen(file, "rb"); + if (!input) { + fprintf(stderr, "Could not open %s.\n", file); + goto err; + } + + *buflen = 0; + while (feof(input) == 0 && *buflen < MAX_READ_LEN) { + *buflen += fread(*buf+*buflen, 1, MAX_READ_LEN-*buflen, input); + if (ferror(input)) { + fprintf(stderr, "Could not read %s.\n", file); + goto err; + } + } + + r = 1; +err: + if (input) + fclose(input); + + return r; +} diff --git a/npa/src/npa/scutil.h b/ccid/src/scutil.h similarity index 100% rename from npa/src/npa/scutil.h rename to ccid/src/scutil.h diff --git a/ccid/src/sslutil.h b/ccid/src/sslutil.h deleted file mode 120000 index ae68de1..0000000 --- a/ccid/src/sslutil.h +++ /dev/null @@ -1 +0,0 @@ -../../npa/src/sslutil.h \ No newline at end of file diff --git a/doc/conf.py b/doc/conf.py index 60eb1fa..b7b60dd 100644 --- a/doc/conf.py +++ b/doc/conf.py @@ -11,16 +11,13 @@ # All configuration values have a default; values that are commented out # serve to show the default. -import sys, os, breathe, sphinx_bootstrap_theme -from sphinxcontrib.doxylink import doxylink +import sys, os, sphinx_bootstrap_theme from datetime import date -os.system("make doc -C npa") os.system("make doc -C virtualsmartcard") os.system("make doc -C ccid") os.system("make doc -C pcsc-relay") -os.environ['PATH'] = os.path.abspath('../npa/src') + os.pathsep + os.environ['PATH'] os.environ['PATH'] = os.path.abspath('../pcsc-relay/src') + os.pathsep + os.environ['PATH'] os.environ['PATH'] = os.path.abspath('../virtualsmartcard/src/vpicc') + os.pathsep + os.environ['PATH'] @@ -36,7 +33,7 @@ needs_sphinx = '1.1' # Add any Sphinx extension module names here, as strings. They can be extensions # coming with Sphinx (named 'sphinx.ext.*') or your custom ones. -extensions = ["breathe", "sphinxcontrib.doxylink", "sphinx.ext.autosummary", "sphinxcontrib.programoutput", "sphinx.ext.inheritance_diagram", "sphinxcontrib.tikz", 'sphinxcontrib.bibtex'] +extensions = ["sphinx.ext.autosummary", "sphinxcontrib.programoutput", "sphinx.ext.inheritance_diagram", "sphinxcontrib.tikz", 'sphinxcontrib.bibtex'] # Add any paths that contain templates here, relative to this directory. templates_path = ['_templates'] @@ -247,8 +244,3 @@ man_pages = [ ('index', 'virtualsmartcardarchitecture', u'Virtual Smartcard Architecture Documentation', [u'Dominik Oepen, Frank Morgner'], 1) ] - -breathe_projects = {"npa": "npa/xml"} -breathe_default_project = "npa" - -doxylink = { 'npa' : ('npa/npa.tag', '_static/doxygen-npa/'), } diff --git a/doc/index.txt b/doc/index.txt index 06e3da5..59a9112 100644 --- a/doc/index.txt +++ b/doc/index.txt @@ -50,7 +50,6 @@ Currently the following projects are part of |vsmartcard|: ACardEmulator/README pcsc-relay/README ccid/README - npa/README Looking for a feature the included programs do not offer? Want to extend the functionality of some library? Apart from requesting a new feature, you can @@ -60,7 +59,6 @@ have a look at these programming guides and try yourself: :maxdepth: 1 virtualsmartcard/api - npa/api .. image:: https://img.shields.io/travis/frankmorgner/vsmartcard/master.svg?label=Travis%20CI%20build :target: https://travis-ci.org/frankmorgner/vsmartcard diff --git a/doc/npa b/doc/npa deleted file mode 120000 index c8c8928..0000000 --- a/doc/npa +++ /dev/null @@ -1 +0,0 @@ -../npa/doc \ No newline at end of file diff --git a/npa/AUTHORS b/npa/AUTHORS deleted file mode 100644 index b66bfee..0000000 --- a/npa/AUTHORS +++ /dev/null @@ -1 +0,0 @@ -Frank Morgner diff --git a/npa/COPYING b/npa/COPYING deleted file mode 100644 index 94a9ed0..0000000 --- a/npa/COPYING +++ /dev/null @@ -1,674 +0,0 @@ - GNU GENERAL PUBLIC LICENSE - Version 3, 29 June 2007 - - Copyright (C) 2007 Free Software Foundation, Inc. - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The GNU General Public License is a free, copyleft license for -software and other kinds of works. - - The licenses for most software and other practical works are designed -to take away your freedom to share and change the works. By contrast, -the GNU General Public License is intended to guarantee your freedom to -share and change all versions of a program--to make sure it remains free -software for all its users. We, the Free Software Foundation, use the -GNU General Public License for most of our software; it applies also to -any other work released this way by its authors. You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -them if you wish), that you receive source code or can get it if you -want it, that you can change the software or use pieces of it in new -free programs, and that you know you can do these things. - - To protect your rights, we need to prevent others from denying you -these rights or asking you to surrender the rights. Therefore, you have -certain responsibilities if you distribute copies of the software, or if -you modify it: responsibilities to respect the freedom of others. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must pass on to the recipients the same -freedoms that you received. You must make sure that they, too, receive -or can get the source code. And you must show them these terms so they -know their rights. - - Developers that use the GNU GPL protect your rights with two steps: -(1) assert copyright on the software, and (2) offer you this License -giving you legal permission to copy, distribute and/or modify it. - - For the developers' and authors' protection, the GPL clearly explains -that there is no warranty for this free software. For both users' and -authors' sake, the GPL requires that modified versions be marked as -changed, so that their problems will not be attributed erroneously to -authors of previous versions. - - Some devices are designed to deny users access to install or run -modified versions of the software inside them, although the manufacturer -can do so. This is fundamentally incompatible with the aim of -protecting users' freedom to change the software. The systematic -pattern of such abuse occurs in the area of products for individuals to -use, which is precisely where it is most unacceptable. Therefore, we -have designed this version of the GPL to prohibit the practice for those -products. If such problems arise substantially in other domains, we -stand ready to extend this provision to those domains in future versions -of the GPL, as needed to protect the freedom of users. - - Finally, every program is threatened constantly by software patents. -States should not allow patents to restrict development and use of -software on general-purpose computers, but in those that do, we wish to -avoid the special danger that patents applied to a free program could -make it effectively proprietary. To prevent this, the GPL assures that -patents cannot be used to render the program non-free. - - The precise terms and conditions for copying, distribution and -modification follow. - - TERMS AND CONDITIONS - - 0. Definitions. - - "This License" refers to version 3 of the GNU General Public License. - - "Copyright" also means copyright-like laws that apply to other kinds of -works, such as semiconductor masks. - - "The Program" refers to any copyrightable work licensed under this -License. Each licensee is addressed as "you". "Licensees" and -"recipients" may be individuals or organizations. - - To "modify" a work means to copy from or adapt all or part of the work -in a fashion requiring copyright permission, other than the making of an -exact copy. The resulting work is called a "modified version" of the -earlier work or a work "based on" the earlier work. - - A "covered work" means either the unmodified Program or a work based -on the Program. - - To "propagate" a work means to do anything with it that, without -permission, would make you directly or secondarily liable for -infringement under applicable copyright law, except executing it on a -computer or modifying a private copy. Propagation includes copying, -distribution (with or without modification), making available to the -public, and in some countries other activities as well. - - To "convey" a work means any kind of propagation that enables other -parties to make or receive copies. Mere interaction with a user through -a computer network, with no transfer of a copy, is not conveying. - - An interactive user interface displays "Appropriate Legal Notices" -to the extent that it includes a convenient and prominently visible -feature that (1) displays an appropriate copyright notice, and (2) -tells the user that there is no warranty for the work (except to the -extent that warranties are provided), that licensees may convey the -work under this License, and how to view a copy of this License. If -the interface presents a list of user commands or options, such as a -menu, a prominent item in the list meets this criterion. - - 1. Source Code. - - The "source code" for a work means the preferred form of the work -for making modifications to it. "Object code" means any non-source -form of a work. - - A "Standard Interface" means an interface that either is an official -standard defined by a recognized standards body, or, in the case of -interfaces specified for a particular programming language, one that -is widely used among developers working in that language. - - The "System Libraries" of an executable work include anything, other -than the work as a whole, that (a) is included in the normal form of -packaging a Major Component, but which is not part of that Major -Component, and (b) serves only to enable use of the work with that -Major Component, or to implement a Standard Interface for which an -implementation is available to the public in source code form. A -"Major Component", in this context, means a major essential component -(kernel, window system, and so on) of the specific operating system -(if any) on which the executable work runs, or a compiler used to -produce the work, or an object code interpreter used to run it. - - The "Corresponding Source" for a work in object code form means all -the source code needed to generate, install, and (for an executable -work) run the object code and to modify the work, including scripts to -control those activities. However, it does not include the work's -System Libraries, or general-purpose tools or generally available free -programs which are used unmodified in performing those activities but -which are not part of the work. For example, Corresponding Source -includes interface definition files associated with source files for -the work, and the source code for shared libraries and dynamically -linked subprograms that the work is specifically designed to require, -such as by intimate data communication or control flow between those -subprograms and other parts of the work. - - The Corresponding Source need not include anything that users -can regenerate automatically from other parts of the Corresponding -Source. - - The Corresponding Source for a work in source code form is that -same work. - - 2. Basic Permissions. - - All rights granted under this License are granted for the term of -copyright on the Program, and are irrevocable provided the stated -conditions are met. This License explicitly affirms your unlimited -permission to run the unmodified Program. The output from running a -covered work is covered by this License only if the output, given its -content, constitutes a covered work. This License acknowledges your -rights of fair use or other equivalent, as provided by copyright law. - - You may make, run and propagate covered works that you do not -convey, without conditions so long as your license otherwise remains -in force. You may convey covered works to others for the sole purpose -of having them make modifications exclusively for you, or provide you -with facilities for running those works, provided that you comply with -the terms of this License in conveying all material for which you do -not control copyright. Those thus making or running the covered works -for you must do so exclusively on your behalf, under your direction -and control, on terms that prohibit them from making any copies of -your copyrighted material outside their relationship with you. - - Conveying under any other circumstances is permitted solely under -the conditions stated below. Sublicensing is not allowed; section 10 -makes it unnecessary. - - 3. Protecting Users' Legal Rights From Anti-Circumvention Law. - - No covered work shall be deemed part of an effective technological -measure under any applicable law fulfilling obligations under article -11 of the WIPO copyright treaty adopted on 20 December 1996, or -similar laws prohibiting or restricting circumvention of such -measures. - - When you convey a covered work, you waive any legal power to forbid -circumvention of technological measures to the extent such circumvention -is effected by exercising rights under this License with respect to -the covered work, and you disclaim any intention to limit operation or -modification of the work as a means of enforcing, against the work's -users, your or third parties' legal rights to forbid circumvention of -technological measures. - - 4. Conveying Verbatim Copies. - - You may convey verbatim copies of the Program's source code as you -receive it, in any medium, provided that you conspicuously and -appropriately publish on each copy an appropriate copyright notice; -keep intact all notices stating that this License and any -non-permissive terms added in accord with section 7 apply to the code; -keep intact all notices of the absence of any warranty; and give all -recipients a copy of this License along with the Program. - - You may charge any price or no price for each copy that you convey, -and you may offer support or warranty protection for a fee. - - 5. Conveying Modified Source Versions. - - You may convey a work based on the Program, or the modifications to -produce it from the Program, in the form of source code under the -terms of section 4, provided that you also meet all of these conditions: - - a) The work must carry prominent notices stating that you modified - it, and giving a relevant date. - - b) The work must carry prominent notices stating that it is - released under this License and any conditions added under section - 7. This requirement modifies the requirement in section 4 to - "keep intact all notices". - - c) You must license the entire work, as a whole, under this - License to anyone who comes into possession of a copy. This - License will therefore apply, along with any applicable section 7 - additional terms, to the whole of the work, and all its parts, - regardless of how they are packaged. This License gives no - permission to license the work in any other way, but it does not - invalidate such permission if you have separately received it. - - d) If the work has interactive user interfaces, each must display - Appropriate Legal Notices; however, if the Program has interactive - interfaces that do not display Appropriate Legal Notices, your - work need not make them do so. - - A compilation of a covered work with other separate and independent -works, which are not by their nature extensions of the covered work, -and which are not combined with it such as to form a larger program, -in or on a volume of a storage or distribution medium, is called an -"aggregate" if the compilation and its resulting copyright are not -used to limit the access or legal rights of the compilation's users -beyond what the individual works permit. Inclusion of a covered work -in an aggregate does not cause this License to apply to the other -parts of the aggregate. - - 6. Conveying Non-Source Forms. - - You may convey a covered work in object code form under the terms -of sections 4 and 5, provided that you also convey the -machine-readable Corresponding Source under the terms of this License, -in one of these ways: - - a) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by the - Corresponding Source fixed on a durable physical medium - customarily used for software interchange. - - b) Convey the object code in, or embodied in, a physical product - (including a physical distribution medium), accompanied by a - written offer, valid for at least three years and valid for as - long as you offer spare parts or customer support for that product - model, to give anyone who possesses the object code either (1) a - copy of the Corresponding Source for all the software in the - product that is covered by this License, on a durable physical - medium customarily used for software interchange, for a price no - more than your reasonable cost of physically performing this - conveying of source, or (2) access to copy the - Corresponding Source from a network server at no charge. - - c) Convey individual copies of the object code with a copy of the - written offer to provide the Corresponding Source. This - alternative is allowed only occasionally and noncommercially, and - only if you received the object code with such an offer, in accord - with subsection 6b. - - d) Convey the object code by offering access from a designated - place (gratis or for a charge), and offer equivalent access to the - Corresponding Source in the same way through the same place at no - further charge. You need not require recipients to copy the - Corresponding Source along with the object code. If the place to - copy the object code is a network server, the Corresponding Source - may be on a different server (operated by you or a third party) - that supports equivalent copying facilities, provided you maintain - clear directions next to the object code saying where to find the - Corresponding Source. Regardless of what server hosts the - Corresponding Source, you remain obligated to ensure that it is - available for as long as needed to satisfy these requirements. - - e) Convey the object code using peer-to-peer transmission, provided - you inform other peers where the object code and Corresponding - Source of the work are being offered to the general public at no - charge under subsection 6d. - - A separable portion of the object code, whose source code is excluded -from the Corresponding Source as a System Library, need not be -included in conveying the object code work. - - A "User Product" is either (1) a "consumer product", which means any -tangible personal property which is normally used for personal, family, -or household purposes, or (2) anything designed or sold for incorporation -into a dwelling. In determining whether a product is a consumer product, -doubtful cases shall be resolved in favor of coverage. For a particular -product received by a particular user, "normally used" refers to a -typical or common use of that class of product, regardless of the status -of the particular user or of the way in which the particular user -actually uses, or expects or is expected to use, the product. A product -is a consumer product regardless of whether the product has substantial -commercial, industrial or non-consumer uses, unless such uses represent -the only significant mode of use of the product. - - "Installation Information" for a User Product means any methods, -procedures, authorization keys, or other information required to install -and execute modified versions of a covered work in that User Product from -a modified version of its Corresponding Source. The information must -suffice to ensure that the continued functioning of the modified object -code is in no case prevented or interfered with solely because -modification has been made. - - If you convey an object code work under this section in, or with, or -specifically for use in, a User Product, and the conveying occurs as -part of a transaction in which the right of possession and use of the -User Product is transferred to the recipient in perpetuity or for a -fixed term (regardless of how the transaction is characterized), the -Corresponding Source conveyed under this section must be accompanied -by the Installation Information. But this requirement does not apply -if neither you nor any third party retains the ability to install -modified object code on the User Product (for example, the work has -been installed in ROM). - - The requirement to provide Installation Information does not include a -requirement to continue to provide support service, warranty, or updates -for a work that has been modified or installed by the recipient, or for -the User Product in which it has been modified or installed. Access to a -network may be denied when the modification itself materially and -adversely affects the operation of the network or violates the rules and -protocols for communication across the network. - - Corresponding Source conveyed, and Installation Information provided, -in accord with this section must be in a format that is publicly -documented (and with an implementation available to the public in -source code form), and must require no special password or key for -unpacking, reading or copying. - - 7. Additional Terms. - - "Additional permissions" are terms that supplement the terms of this -License by making exceptions from one or more of its conditions. -Additional permissions that are applicable to the entire Program shall -be treated as though they were included in this License, to the extent -that they are valid under applicable law. If additional permissions -apply only to part of the Program, that part may be used separately -under those permissions, but the entire Program remains governed by -this License without regard to the additional permissions. - - When you convey a copy of a covered work, you may at your option -remove any additional permissions from that copy, or from any part of -it. (Additional permissions may be written to require their own -removal in certain cases when you modify the work.) You may place -additional permissions on material, added by you to a covered work, -for which you have or can give appropriate copyright permission. - - Notwithstanding any other provision of this License, for material you -add to a covered work, you may (if authorized by the copyright holders of -that material) supplement the terms of this License with terms: - - a) Disclaiming warranty or limiting liability differently from the - terms of sections 15 and 16 of this License; or - - b) Requiring preservation of specified reasonable legal notices or - author attributions in that material or in the Appropriate Legal - Notices displayed by works containing it; or - - c) Prohibiting misrepresentation of the origin of that material, or - requiring that modified versions of such material be marked in - reasonable ways as different from the original version; or - - d) Limiting the use for publicity purposes of names of licensors or - authors of the material; or - - e) Declining to grant rights under trademark law for use of some - trade names, trademarks, or service marks; or - - f) Requiring indemnification of licensors and authors of that - material by anyone who conveys the material (or modified versions of - it) with contractual assumptions of liability to the recipient, for - any liability that these contractual assumptions directly impose on - those licensors and authors. - - All other non-permissive additional terms are considered "further -restrictions" within the meaning of section 10. If the Program as you -received it, or any part of it, contains a notice stating that it is -governed by this License along with a term that is a further -restriction, you may remove that term. If a license document contains -a further restriction but permits relicensing or conveying under this -License, you may add to a covered work material governed by the terms -of that license document, provided that the further restriction does -not survive such relicensing or conveying. - - If you add terms to a covered work in accord with this section, you -must place, in the relevant source files, a statement of the -additional terms that apply to those files, or a notice indicating -where to find the applicable terms. - - Additional terms, permissive or non-permissive, may be stated in the -form of a separately written license, or stated as exceptions; -the above requirements apply either way. - - 8. Termination. - - You may not propagate or modify a covered work except as expressly -provided under this License. Any attempt otherwise to propagate or -modify it is void, and will automatically terminate your rights under -this License (including any patent licenses granted under the third -paragraph of section 11). - - However, if you cease all violation of this License, then your -license from a particular copyright holder is reinstated (a) -provisionally, unless and until the copyright holder explicitly and -finally terminates your license, and (b) permanently, if the copyright -holder fails to notify you of the violation by some reasonable means -prior to 60 days after the cessation. - - Moreover, your license from a particular copyright holder is -reinstated permanently if the copyright holder notifies you of the -violation by some reasonable means, this is the first time you have -received notice of violation of this License (for any work) from that -copyright holder, and you cure the violation prior to 30 days after -your receipt of the notice. - - Termination of your rights under this section does not terminate the -licenses of parties who have received copies or rights from you under -this License. If your rights have been terminated and not permanently -reinstated, you do not qualify to receive new licenses for the same -material under section 10. - - 9. Acceptance Not Required for Having Copies. - - You are not required to accept this License in order to receive or -run a copy of the Program. Ancillary propagation of a covered work -occurring solely as a consequence of using peer-to-peer transmission -to receive a copy likewise does not require acceptance. However, -nothing other than this License grants you permission to propagate or -modify any covered work. These actions infringe copyright if you do -not accept this License. Therefore, by modifying or propagating a -covered work, you indicate your acceptance of this License to do so. - - 10. Automatic Licensing of Downstream Recipients. - - Each time you convey a covered work, the recipient automatically -receives a license from the original licensors, to run, modify and -propagate that work, subject to this License. You are not responsible -for enforcing compliance by third parties with this License. - - An "entity transaction" is a transaction transferring control of an -organization, or substantially all assets of one, or subdividing an -organization, or merging organizations. If propagation of a covered -work results from an entity transaction, each party to that -transaction who receives a copy of the work also receives whatever -licenses to the work the party's predecessor in interest had or could -give under the previous paragraph, plus a right to possession of the -Corresponding Source of the work from the predecessor in interest, if -the predecessor has it or can get it with reasonable efforts. - - You may not impose any further restrictions on the exercise of the -rights granted or affirmed under this License. For example, you may -not impose a license fee, royalty, or other charge for exercise of -rights granted under this License, and you may not initiate litigation -(including a cross-claim or counterclaim in a lawsuit) alleging that -any patent claim is infringed by making, using, selling, offering for -sale, or importing the Program or any portion of it. - - 11. Patents. - - A "contributor" is a copyright holder who authorizes use under this -License of the Program or a work on which the Program is based. The -work thus licensed is called the contributor's "contributor version". - - A contributor's "essential patent claims" are all patent claims -owned or controlled by the contributor, whether already acquired or -hereafter acquired, that would be infringed by some manner, permitted -by this License, of making, using, or selling its contributor version, -but do not include claims that would be infringed only as a -consequence of further modification of the contributor version. For -purposes of this definition, "control" includes the right to grant -patent sublicenses in a manner consistent with the requirements of -this License. - - Each contributor grants you a non-exclusive, worldwide, royalty-free -patent license under the contributor's essential patent claims, to -make, use, sell, offer for sale, import and otherwise run, modify and -propagate the contents of its contributor version. - - In the following three paragraphs, a "patent license" is any express -agreement or commitment, however denominated, not to enforce a patent -(such as an express permission to practice a patent or covenant not to -sue for patent infringement). To "grant" such a patent license to a -party means to make such an agreement or commitment not to enforce a -patent against the party. - - If you convey a covered work, knowingly relying on a patent license, -and the Corresponding Source of the work is not available for anyone -to copy, free of charge and under the terms of this License, through a -publicly available network server or other readily accessible means, -then you must either (1) cause the Corresponding Source to be so -available, or (2) arrange to deprive yourself of the benefit of the -patent license for this particular work, or (3) arrange, in a manner -consistent with the requirements of this License, to extend the patent -license to downstream recipients. "Knowingly relying" means you have -actual knowledge that, but for the patent license, your conveying the -covered work in a country, or your recipient's use of the covered work -in a country, would infringe one or more identifiable patents in that -country that you have reason to believe are valid. - - If, pursuant to or in connection with a single transaction or -arrangement, you convey, or propagate by procuring conveyance of, a -covered work, and grant a patent license to some of the parties -receiving the covered work authorizing them to use, propagate, modify -or convey a specific copy of the covered work, then the patent license -you grant is automatically extended to all recipients of the covered -work and works based on it. - - A patent license is "discriminatory" if it does not include within -the scope of its coverage, prohibits the exercise of, or is -conditioned on the non-exercise of one or more of the rights that are -specifically granted under this License. You may not convey a covered -work if you are a party to an arrangement with a third party that is -in the business of distributing software, under which you make payment -to the third party based on the extent of your activity of conveying -the work, and under which the third party grants, to any of the -parties who would receive the covered work from you, a discriminatory -patent license (a) in connection with copies of the covered work -conveyed by you (or copies made from those copies), or (b) primarily -for and in connection with specific products or compilations that -contain the covered work, unless you entered into that arrangement, -or that patent license was granted, prior to 28 March 2007. - - Nothing in this License shall be construed as excluding or limiting -any implied license or other defenses to infringement that may -otherwise be available to you under applicable patent law. - - 12. No Surrender of Others' Freedom. - - If conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot convey a -covered work so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you may -not convey it at all. For example, if you agree to terms that obligate you -to collect a royalty for further conveying from those to whom you convey -the Program, the only way you could satisfy both those terms and this -License would be to refrain entirely from conveying the Program. - - 13. Use with the GNU Affero General Public License. - - Notwithstanding any other provision of this License, you have -permission to link or combine any covered work with a work licensed -under version 3 of the GNU Affero General Public License into a single -combined work, and to convey the resulting work. The terms of this -License will continue to apply to the part which is the covered work, -but the special requirements of the GNU Affero General Public License, -section 13, concerning interaction through a network will apply to the -combination as such. - - 14. Revised Versions of this License. - - The Free Software Foundation may publish revised and/or new versions of -the GNU General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - - Each version is given a distinguishing version number. If the -Program specifies that a certain numbered version of the GNU General -Public License "or any later version" applies to it, you have the -option of following the terms and conditions either of that numbered -version or of any later version published by the Free Software -Foundation. If the Program does not specify a version number of the -GNU General Public License, you may choose any version ever published -by the Free Software Foundation. - - If the Program specifies that a proxy can decide which future -versions of the GNU General Public License can be used, that proxy's -public statement of acceptance of a version permanently authorizes you -to choose that version for the Program. - - Later license versions may give you additional or different -permissions. However, no additional obligations are imposed on any -author or copyright holder as a result of your choosing to follow a -later version. - - 15. Disclaimer of Warranty. - - THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY -APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT -HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY -OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, -THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR -PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM -IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF -ALL NECESSARY SERVICING, REPAIR OR CORRECTION. - - 16. Limitation of Liability. - - IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS -THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY -GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE -USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF -DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD -PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), -EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF -SUCH DAMAGES. - - 17. Interpretation of Sections 15 and 16. - - If the disclaimer of warranty and limitation of liability provided -above cannot be given local legal effect according to their terms, -reviewing courts shall apply local law that most closely approximates -an absolute waiver of all civil liability in connection with the -Program, unless a warranty or assumption of liability accompanies a -copy of the Program in return for a fee. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -state the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software: you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation, either version 3 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program. If not, see . - -Also add information on how to contact you by electronic and paper mail. - - If the program does terminal interaction, make it output a short -notice like this when it starts in an interactive mode: - - Copyright (C) - This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, your program's commands -might be different; for a GUI interface, you would use an "about box". - - You should also get your employer (if you work as a programmer) or school, -if any, to sign a "copyright disclaimer" for the program, if necessary. -For more information on this, and how to apply and follow the GNU GPL, see -. - - The GNU General Public License does not permit incorporating your program -into proprietary programs. If your program is a subroutine library, you -may consider it more useful to permit linking proprietary applications with -the library. If this is what you want to do, use the GNU Lesser General -Public License instead of this License. But first, please read -. diff --git a/npa/ChangeLog b/npa/ChangeLog deleted file mode 100644 index 36344e1..0000000 --- a/npa/ChangeLog +++ /dev/null @@ -1,2009 +0,0 @@ -2016-01-04 Frank Morgner - - * npa/cross/Makefile.am: renamed android distribution directory - -2016-01-04 Frank Morgner - - * npa/cross/Makefile.am: Building with PIE for Android 4.1+ - -2016-01-04 Frank Morgner - - * npa/certs/Makefile.am: uninstall CV and X.509 certificates - -2016-01-04 Frank Morgner - - * npa/ChangeLog, npa/certs/Makefile.am: install CVC and X.509 - directory if needed - -2016-01-04 Frank Morgner - - * npa/ChangeLog, npa/src/Makefile.am: added missing files from - OpenSC - -2016-01-04 Frank Morgner - - * npa/src/Makefile.am: fixed build location of manual files - -2015-12-15 Frank Morgner - - * npa/AUTHORS, npa/doc/README.txt, npa/doc/README.txt.in, - npa/src/boxing.c, npa/src/card-npa.c, npa/src/npa-tool.c, - npa/src/npa-tool.ggo.in, npa/src/npa/boxing.h: Updated mail address - -2015-12-11 Frank Morgner - - * npa/src/iso-sm.c: fixed wiping SM state when receiving protected - APDU - -2015-11-02 Frank Morgner - - * npa/src/scutil.c: again, include source files from OpenSC (unused) dependencies are satisfied with dummy implementations - -2015-11-02 Frank Morgner - - * npa/src/scutil.c: added missing sc_apdu2bytes - -2015-11-02 Frank Morgner - - * npa/cross/Makefile.am: export sc_apdu_set_resp from OpenSC - -2015-11-02 Frank Morgner - - * npa/configure.ac, npa/src/Makefile.am, npa/src/scutil.c: copy code - from OpenSC instead of including its source files - -2015-11-02 Frank Morgner - - * npa/cross/Makefile.am: we need sc_apdu_set_resp to avoid including - apdu.c - -2015-11-02 Frank Morgner - - * npa/src/opensc, npa/src/scutil.c: updated OpenSC - -2015-09-03 Frank Morgner - - * npa/src/npa-tool.c: Adapt to changes of - - https://github.com/frankmorgner/openpace/commit/c2256ad61a1c8c9148b1ab5e76bdb752c73d9455This should also fix a bug where the commandline input of the lookup - directories given via npa-tool is overwritten with OpenPACE's - default. - -2015-08-21 Frank Morgner - - * npa/src/Makefile.am: fixed manpage build dependency - -2015-07-31 Frank Morgner - - * npa/configure.ac: test for strings with `test` - -2015-07-31 Frank Morgner - - * npa/configure.ac: fixed typo - -2015-07-31 Frank Morgner - - * npa/configure.ac: make sure built files are most recent closes #61 - -2015-07-17 Frank Morgner - - * npa/doc/README.txt, npa/doc/api.txt: sm_stop is now part of OpenSC - as sc_sm_stop - -2015-07-22 Frank Morgner - - * npa/src/boxing.c: stop iterating - -2015-05-19 Frank Morgner - - * npa/doc/README.txt.in: added Mac OS X to the compatibility list - -2015-05-11 Frank Morgner - - * npa/cross/Makefile.am: fixed cross compiling for windows - -2015-05-11 Frank Morgner - - * npa/src/Makefile.am: fixed missing openpace libs - -2015-05-11 Frank Morgner - - * npa/cross/MacOSX_install/postinstall, - npa/cross/MacOSX_uninstall/postinstall, npa/cross/Makefile.am: build - OS X installer - -2015-05-11 Frank Morgner - - * npa/src/opensc: updated OpenSC - -2015-04-27 Frank Morgner - - * npa/Makefile.am, npa/cross/Makefile.am: build universal binaries - for Mac OS X - -2015-04-23 Frank Morgner - - * npa/src/boxing.c: if boxing is not supported, select MF resets the state of the card which may be confused by the commands - with CLA=FF (and is more lightweight than an actual reset) - -2015-04-14 Frank Morgner - - * npa/src/opensc: updated OpenSC - -2015-04-13 Frank Morgner - - * npa/configure.ac, npa/src/boxing.c: fixed compilation on Mac OS X - -2015-04-07 Frank Morgner - - * npa/configure.ac, npa/src/card-npa.c, npa/src/example.c, - npa/src/iso-sm.c, npa/src/npa-tool.c, npa/src/npa/iso-sm.h, - npa/src/opensc: moved sm_stop() to OpenSC as sc_sm_stop() - -2015-04-01 Frank Morgner - - * npa/src/npa.c: catch non initialized pace context - -2015-03-31 Frank Morgner - - * npa/src/opensc: updated OpenSC - -2015-03-25 Frank Morgner - - * npa/src/card-npa.c: fixed logging out with PACE reader - -2015-03-24 Frank Morgner - - * npa/src/card-npa.c: fixed handling scconf_block - -2015-02-28 Frank Morgner - - * npa/src/Makefile.am, npa/src/scutil.c: fixed undefined reference - to strlcpy - -2015-02-27 Frank Morgner - - * npa/src/card-npa.c, npa/src/opensc: updated OpenSC - -2015-02-02 Frank Morgner - - * npa/doc/README.txt, npa/doc/README.txt.in: clearification on QES - -2015-01-25 Frank Morgner - - * npa/src/npa-tool.c: fixed check for pin length - -2015-01-25 Frank Morgner - - * npa/src/boxing.c, npa/src/card-npa.c, npa/src/npa.c: fixed - potentially dereferencing null pointer - -2015-01-25 Frank Morgner - - * npa/src/iso-sm.c: fixed memory leak - -2015-01-25 Frank Morgner - - * npa/src/card-npa.c, npa/src/scutil.c: removed unused check - -2015-01-25 Frank Morgner - - * npa/src/scutil.c: fixed handling of bad arguments - -2015-01-25 Frank Morgner - - * npa/src/npa.c: fixed uninitialized value - -2015-01-25 Frank Morgner - - * npa/src/card-npa.c: fixed handling of missing st keys - -2015-01-18 Frank Morgner - - * npa/doc/README.txt, npa/doc/README.txt.in, npa/opensc.conf.in, - npa/src/Makefile.am, npa/src/card-npa.c, npa/src/card-npa.h, - npa/src/npa-tool.c, npa/src/npa.c, npa/src/npa/npa.h, - npa/src/npa/scutil.h, npa/src/pkcs15-npa.c, npa/src/scutil.c: added - support for QES with German ID card libnpa: requires an ID card that is initialized for QES. Today, this - means you need to register at sign-me. virtualsmartcard: We don't actually create a real signature, because - PyCrypto can't handle ECDSA, let alone brainpoolP256r1. We only - return a 64 byte buffer. - -2014-11-22 Frank Morgner - - * npa/src/Makefile.am: use absolute path of manuals - -2014-11-21 Frank Morgner - - * npa/src/Makefile.am: fixed building of manuals - -2014-11-20 Frank Morgner - - * npa/configure.ac: version bump - -2014-11-20 Frank Morgner - - * npa/doc/README.txt, npa/doc/README.txt.in, npa/doc/autotools.txt, - npa/doc/download.txt: updated documentation - -2014-11-11 Frank Morgner - - * npa/Makefile.am: perform git2cl on local project only - -2014-11-11 Frank Morgner - - * npa/ChangeLog: released 0.6 - -2014-11-11 Frank Morgner - - * npa/cross/Makefile.am: fixed cross compiling for Windows - -2014-11-11 Frank Morgner - - * npa/src/opensc: update to OpenSC's master - -2014-11-04 Frank Morgner - - * npa/cross/Makefile.am: cross compile for windows with static - libgcc - -2014-10-27 Frank Morgner - - * npa/src/npa.c: initialize EAC_CTX when doing TA/CA without PACE - -2014-10-22 Frank Morgner - - * : Merge pull request #29 from psytester/patch-5 DG13 = Birth Name - -2014-10-22 psytester - - * npa/src/npa-tool.ggo.in: since some new nPA version: DG13 = Birth - Name - -2014-09-15 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa.c: allow TA without PACE - -2014-08-08 Frank Morgner - - * npa/src/card-npa.c, npa/src/card-npa.h, npa/src/pkcs15-npa.c: only - use built in mechanisms for caching drops caching of EF.CardAccess and CAN at the driver level. The CAN - is now cached at the PKCS#15 layer. - -2014-08-08 Frank Morgner - - * npa/src/card-npa.c: implemented npa_logout - -2014-07-25 Frank Morgner - - * npa/src/card-npa.c: card-npa: free SM data when shutting down the - card fixes memory leak - -2014-07-24 Frank Morgner - - * npa/src/opensc: use OpenSC 0.14.0 - -2014-07-24 Frank Morgner - - * npa/src/boxing.c, npa/src/card-npa.c, npa/src/npa/scutil.h, - npa/src/scutil.c: include non exported OpenSC functions - -2014-07-21 Dominik - - * npa/doc/README.txt, npa/doc/README.txt.in: Fix an incorrect link - -2014-06-30 Frank Morgner - - * npa/src/boxing.c: fixed memory handling of boxing asn1 structure - -2014-06-27 Frank Morgner - - * npa/src/pkcs15-npa.c: commented sc_driver_version of npa pkcs15 - emulator - -2014-06-27 Frank Morgner - - * npa/src/card-npa.c: set max_send/recv_size - -2014-06-26 Frank Morgner - - * npa/src/boxing.c: fixed parsing of EF.CardAccess and Certificate - Description - -2014-06-25 Frank Morgner - - * npa/src/boxing.c: transmittedPin is of type numeric string - -2014-06-25 Frank Morgner - - * npa/src/boxing.c: pinID has an INTGER tag - -2014-06-24 Frank Morgner - - * npa/src/boxing.c: fixed boxing commands I misread BSI TR-03119: The context specific data structures are - separately wrapped into octet strings or similar. - -2014-06-19 Frank Morgner - - * npa/cross/Makefile.am, npa/cross/opensc.conf_win32: added - opensc.conf for windows binaries - -2014-06-19 Frank Morgner - - * npa/doc/README.txt, npa/doc/README.txt.in: documentation about - setting OPENSC_CONF - -2014-06-19 Frank Morgner - - * npa/cross/Makefile.am: building OpenSC requires its configure - script - -2014-06-19 Frank Morgner - - * npa/doc/README.txt, npa/doc/README.txt.in: documented nPA card - drivers for OpenSC - -2014-06-03 Frank Morgner - - * npa/src/scutil.c: show ATR of unrecognized cards for `npa-tool -i` - -2014-05-31 Frank Morgner - - * npa/src/opensc: use OpenSC 0.13.1 as submodule closes #3 - -2014-05-26 Frank Morgner - - * npa/src/Makefile.am: distribute card-npa.h - -2014-05-02 Frank Morgner - - * npa/doc/README.txt: rebuilt docs - -2014-05-01 Dominik - - * npa/cross/Makefile.am, npa/doc/README.txt: Update more links to - the old repository - -2014-05-01 Dominik - - * npa/doc/README.txt.in: Updated links in the documentation - -2014-04-27 Frank Morgner - - * npa/src/scutil.c: fixed compiling ccid-emulator without libnpa fixes #1 - -2014-04-18 Frank Morgner - - * npa/configure.ac, npa/doc/download.txt, npa/doc/questions.txt: - moved project home to github - -2014-03-26 Frank Morgner - - * npa/doc/README.txt, npa/doc/README.txt.in: updated documentation - -2014-03-08 Frank Morgner - - * npa/cross/Makefile.am: export additional symbols from OpenSC when - cross compiling - -2014-03-08 Frank Morgner - - * npa/cross/Makefile.am: PKG_CONFIG_PATH seems to be required for - pkg-config now - -2014-03-08 Frank Morgner - - * npa/cross/Makefile.am: configure openpace for enabling openssl - installation - -2014-03-08 Frank Morgner - - * npa/cross/Makefile.am: fixed windows target directory - -2014-02-28 Frank Morgner - - * npa/src/npa.c, npa/src/pkcs15-npa.c: use unified names for PACE - secrets - -2014-02-28 Frank Morgner - - * npa/opensc.conf.in, npa/src/Makefile.am, npa/src/pkcs15-npa.c: - implemente PKCS#15 emulator for nPA - -2014-02-28 Frank Morgner - - * npa/src/card-npa.c, npa/src/card-npa.h, npa/src/npa.c, - npa/src/npa/npa.h: better PIN handling - avoid overloading of the unblocking command, instead perform - resuming the pin automatically. - implemented cache for npa card driver - added support for eSign PIN verification - addes support for get pin info cmd - -2014-02-23 Frank Morgner - - * npa/src/opensc: updated to current OpenSC's master - -2014-02-19 Frank Morgner - - * npa/src/boxing.c, npa/src/card-npa.c, npa/src/npa-tool.c, - npa/src/npa.c, npa/src/npa/boxing.h: fixed resuming the PIN initialization of the boxing commands in perform_pace always - destroyed the established security context. - -2014-02-19 Frank Morgner - - * npa/configure.ac, npa/src/boxing.c: fixed missing references to - list operations - -2014-02-19 Frank Morgner - - * npa/src/card-npa.c, npa/src/iso-sm.c, npa/src/npa/npa.h: - implemented npa_pin_cmd - -2014-02-18 Frank Morgner - - * npa/Makefile.am, npa/configure.ac, npa/opensc.conf.in, - npa/src/Makefile.am, npa/src/card-npa.c, npa/src/iso-sm-internal.h, - npa/src/iso-sm.c: added a minimal nPA card driver for OpenSC use as something like env OPENSC_CONF=$PWD/vsmartcard/npa/opensc.conf opensc-tool - --name - -2013-11-13 Frank Morgner - - * npa/configure.ac: try linking OpenSC without including OpenSSL - -2013-10-21 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa.c: catch and debug more errors - -2013-09-30 Frank Morgner - - * npa/doc/README.txt, npa/doc/README.txt.in: use absolute path to - source directories in guide - -2013-09-26 Dominik - - * npa/doc/README.txt: Fixed OpenSC guide: add git submodule init - -2013-09-26 Dominik - - * npa/doc/README.txt.in: Fixed OpenSC guide: add git submodule init - -2013-09-24 Frank Morgner - - * npa/src/example.c, npa/src/npa-tool.c: use EAC_init() and - EAC_cleanup() - -2013-09-09 Frank Morgner - - * npa/Makefile.am, npa/configure.ac, npa/cross/Makefile.am, - npa/win32/Makefile.am: added target to build for Android We use virtualsmartcard's libpcsclite to connect to a smartcard. The - PC/SC service with vicc-interface is implemented elsewhere - (currently un-free). - -2013-08-30 Frank Morgner - - * npa/configure.ac: added required version of OpenPACE - -2013-08-21 Frank Morgner - - * npa/src/scutil.c: enable default driver see OpenSC 1a972920f0dd4959bd6ec3c4cddef2d98e6009a8 - -2013-08-21 Frank Morgner - - * npa/src/opensc: Updated OpenSC (again) - -2013-08-21 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa.c, npa/src/npa/npa.h: adapted to - changes of openpace ce89f8ee374d7926c3f4707b8c4d3ae3de506507 - -2013-08-21 Frank Morgner - - * npa/test_vicc_with_npa-tool.sh: fixed reference date for validity - check - -2013-08-21 Frank Morgner - - * npa/test_vicc_with_npa-tool.sh: print commands before issuing them - -2013-08-16 Frank Morgner - - * npa/src/opensc: updated OpenSC submodule - -2013-08-08 Frank Morgner - - * npa/doc/README.txt: fixed OpenSC guide: use git submodule update - -2013-08-08 Frank Morgner - - * npa/doc/README.txt.in: fixed OpenSC guide: use git submodule - update - -2013-08-08 Frank Morgner - - * npa/doc/README.txt, npa/doc/README.txt.in, npa/doc/download.txt: - fixed references to sf's git repositories - -2013-08-07 Frank Morgner - - * npa/src/opensc: updated OpenSC include SM bugfixes from OpenSC master - -2013-08-07 Frank Morgner - - * npa/src/npa/iso-sm.h, npa/src/scutil.c: read/write chunks in short - length SM APDUs - -2013-07-14 Frank Morgner - - * npa/src/npa-tool.c: avoid uninitialized variable - -2013-07-03 Frank Morgner - - * npa/configure.ac: version bump - -2013-07-03 Frank Morgner - - * npa/ChangeLog: updated ChangeLog - -2013-07-03 Frank Morgner - - * npa/Makefile.am: fixed location of .git - -2013-06-28 Frank Morgner - - * npa/Makefile.am: fixed distcheck-hook - -2013-06-27 Frank Morgner - - * npa/Makefile.am, npa/libnpa.pc.in: use PACKAGE_SUMMARY in libnpa.c - -2013-06-21 Frank Morgner - - * npa/Makefile.am: generate ChangeLog from git - -2013-06-21 Frank Morgner - - * npa/configure.ac, npa/src/Makefile.am, npa/src/boxing.c, - npa/src/ccid-types.h: implemented boxing commands for verify/modify separates type definitions into ccid-types.h to be accessible in - libnpa - -2013-06-19 Frank Morgner - - * npa/src/boxing.c: fixed automatic allocaction of asn1 decoded data - -2013-06-19 Frank Morgner - - * npa/src/boxing.c: fixed asn1 formatting of boxing command for pace - -2013-06-18 Frank Morgner - - * npa/doc/README.txt, npa/doc/README.txt.in: avoid duplicated tikz - code - -2013-06-17 Frank Morgner - - * npa/doc/README.txt, npa/doc/README.txt.in: include references and - pictures from our papers - -2013-06-16 Frank Morgner - - * npa/configure.ac, npa/doc/Makefile.am, npa/doc/README.txt, - npa/doc/README.txt.in, npa/doc/api.txt, npa/src/Makefile.am, - npa/src/npa-tool.ggo.in: include a summary in documentation and - tools - -2013-06-14 Frank Morgner - - * npa/src/npa.c: use sc_format_apdu where possible - -2013-06-14 Frank Morgner - - * npa/src/iso-sm.c: fixed typo - -2013-06-13 Frank Morgner - - * npa/src/boxing.c: avoid multiple copies for asn1 formatting - -2013-06-13 Frank Morgner - - * npa/src/scutil.c: fancier output for print_avail - -2013-06-13 Frank Morgner - - * npa/src/example.c, npa/src/npa-tool.c, npa/src/npa.c, - npa/src/npa/scutil.h, npa/src/scutil.c: cleaned up scutils - moved write/read_binary_rec to scutil.c - removed unused handling of card driver - -2013-06-12 Frank Morgner - - * npa/src/npa.c: fixed memory leak - -2013-06-11 Frank Morgner - - * npa/m4/.gitignore: added empty m4 directories ... to satisfy autoconf - -2013-06-11 Frank Morgner - - * npa/src/boxing.c, npa/src/example.c, npa/src/iso-sm.c, - npa/src/npa-tool.c, npa/src/npa.c, npa/src/scutil.c, - npa/src/sslutil.h: updated license text - -2013-06-06 Frank Morgner - - * npa/src/npa-tool.ggo.in: `--new-pin` optionally takes input - -2013-06-06 Frank Morgner - - * npa/src/npa.c: fixed missing initialization of sm_ctx for PACE on - reader - -2013-06-04 Frank Morgner - - * npa/src/npa.c: allow changing eID-PIN on reader's PIN pad - -2013-06-03 Frank Morgner - - * npa/src/Makefile.am, npa/src/boxing.c, npa/src/npa-tool.c, - npa/src/npa.c, npa/src/npa/boxing.h: implemented boxing commands - according to TR-03119 - -2013-05-29 Frank Morgner - - * npa/certs/Makefile.am: fixed install directories for certificates - -2013-05-29 Frank Morgner - - * npa/src/npa/npa.h: fixed includes - -2013-05-13 Frank Morgner - - * npa/doc/README.txt, npa/doc/README.txt.in, npa/doc/api.txt, - npa/doc/autotools.txt, npa/doc/download.txt: working on - documentation - -2013-05-23 Frank Morgner - - * npa/win32/Makefile.am: fixed opensc host for cross compiling - -2013-05-14 Frank Morgner - - * npa/win32/Makefile.am: fixed missing variable for cross compiling - -2013-03-05 Frank Morgner - - * npa/README, npa/doc/Makefile.am, npa/doc/README.rst, - npa/doc/README.rst.in, npa/doc/README.txt, npa/doc/README.txt.in, - npa/doc/api.rst, npa/doc/api.txt, npa/doc/autotools.rst, - npa/doc/autotools.rst.in, npa/doc/autotools.txt, - npa/doc/autotools.txt.in, npa/doc/download.rst, - npa/doc/download.rst.in, npa/doc/download.txt, - npa/doc/download.txt.in, npa/doc/questions.rst, - npa/doc/questions.rst.in, npa/doc/questions.txt, - npa/doc/questions.txt.in: respect sphinx style guide to some extent see - - http://documentation-style-guide-sphinx.readthedocs.org/en/latest/style-guide.html - -2013-02-27 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa-tool.ggo.in: accept a hex string - for community id - -2013-02-27 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa-tool.ggo.in: add reference date - for validity verification - -2013-02-27 Frank Morgner - - * npa/src/npa-tool.c: use additional data template - -2013-02-27 Frank Morgner - - * npa/src/npa-tool.c: fixed tag of auxiliary data payload - -2013-02-26 Frank Morgner - - * npa/src/npa-tool.c: output "Read " for successful reading - -2013-02-26 Frank Morgner - - * npa/src/scutil.c: allow dumping of empty buffer - -2013-02-26 Frank Morgner - - * npa/src/npa-tool.c: added human readable names for DG13-16 - -2013-02-25 Frank Morgner - - * npa/src/Makefile.am, npa/src/npa-tool.c, npa/src/npa-tool.ggo.in, - npa/test_vicc_with_npa-tool.sh: added option for cvc and x509 - directory - -2013-02-25 Frank Morgner - - * npa/npa-example-data: added cvc_rehash'ed test files - -2013-02-25 Frank Morgner - - * npa/certs/DECVCAEPASS00102, npa/certs/DECVCAeID00102, - npa/certs/DECVCAeSign00102, npa/certs/Makefile.am, - npa/certs/ff3d20d2: removed test certificates, added official ones distributing only the c_rehash'ed/cvc_rehash'ed ones - -2013-02-18 Frank Morgner - - * npa/doc/README.rst: fixed typo - -2013-02-09 Frank Morgner - - * npa/doc/Makefile.am, npa/doc/README.rst, npa/doc/README.rst.in, - npa/doc/download.rst, npa/doc/download.rst.in, npa/src/Makefile.am, - npa/src/npa-tool.ggo.in, npa/src/npa.c, npa/src/npa/iso-sm.h, - npa/src/npa/npa.h, npa/src/npa/scutil.h: updated documentation - -2013-02-09 Frank Morgner - - * npa/win32/Makefile.am, npa/win32/build_fix_zlib.patch, - npa/win32/build_npa.patch: updated windows build - -2013-02-09 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa-tool.ggo.in, npa/src/npa.c, - npa/src/npa/npa.h, npa/test_vicc_with_npa-tool.sh: added CLI flags - do disable various checks - -2013-02-09 Frank Morgner - - * npa/src/npa.c: only warn about missing certificate description - -2013-02-09 Frank Morgner - - * npa/src/npa.c: fixed asn1 - -2013-02-09 Frank Morgner - - * npa/Makefile.am, npa/certs/Makefile.am, npa/configure.ac: - distributing nPA's default trust anchors - -2013-02-09 Frank Morgner - - * npa/src/npa-tool.ggo.in: added example CHAT for signature terminal - -2013-02-09 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa.c, npa/src/npa/npa.h: Added ASN.1 - helper for auxiliary data - -2013-02-09 Frank Morgner - - * npa/src/example.c, npa/src/npa-tool.c, npa/src/npa.c: fixed some - compiler warnings - -2013-02-09 Frank Morgner - - * npa/src/iso-sm.c: fixed bug in iso sm driver - -2013-02-09 Frank Morgner - - * npa/src/npa.c: check for NULL pointer - -2013-02-07 Dominik - - * npa/src/opensc: Fix opensc submodule - -2013-02-04 Frank Morgner - - * npa/src/npa.c: fixed recursive write of EFs - -2013-02-04 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa.c, npa/test_vicc_with_npa-tool.sh: - fixed special functions - -2013-01-31 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa-tool.ggo.in, npa/src/npa.c, - npa/src/npa/npa.h: added verification of age/validity/community - -2013-02-01 Frank Morgner - - * npa/src/iso-sm.c, npa/src/npa.c: handling special Le's for - encryption in iso SM driver - -2013-02-01 Frank Morgner - - * npa/src/npa-tool.c: selectig eid after EAC - -2013-01-31 Frank Morgner - - * npa/src/npa.c: fixed referencing EAC_CTX in TA and CA - -2013-01-29 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa-tool.ggo.in, npa/src/npa.c, - npa/src/npa/scutil.h: added read and write of data groups adds read_binary_rec and write_binary_rec to scutil.h - -2013-01-29 Frank Morgner - - * npa/test_vicc_with_npa-tool.sh: fixed typo - -2012-12-17 Frank Morgner - - * npa/src/npa/npa.h: added missing documentation - -2012-12-16 Frank Morgner - - * npa/doc/api.rst: added overview about TA/CA to documentation - -2012-12-16 Frank Morgner - - * npa/configure.ac, npa/doc/README.rst, npa/doc/README.rst.in, - npa/doc/api.rst, npa/doc/autotools.rst, npa/src/Makefile.am, - npa/src/opensc: include OpenSC as submodule - -2012-12-11 Frank Morgner - - * npa/doc/Makefile.am, npa/doc/README.rst.in, npa/doc/api.rst: fixed - generation of documentation - -2012-12-09 Frank Morgner - - * npa/Makefile.am, npa/configure.ac, npa/src/Makefile.am, - npa/src/example.c, npa/src/iso-sm.c, npa/src/npa-tool.c, - npa/src/npa.c, npa/src/npa/iso-sm.h, npa/src/npa/npa.h, - npa/src/npa/sm.h, npa/src/scutil.c, npa/src/sm.c, npa/src/sslutil.c: - use OpenSC's hooks to wrap and unwrap SM APDUs sm_transmit_apdu is obsolete. libnpa and OpenSC can be used in - parallel now. libnpa modifies OpenSC's card handle to add SM on the - fly to any OpenSC command. This, for example, allows PKCS#XX - commands in a SM channel established by libnpa. - -2012-11-21 Frank Morgner - - * npa/src/npa.c: always declare extended length capabilities allows usage of an unpatched version of OpenPACE. libnpa now works - with the nPA using the default card driver. - -2012-11-21 Frank Morgner - - * npa/src/npa.c, npa/src/npa/npa.h: adapted to changes of OpenSC - master Now works with the stupid changes of OpenSC made in - 41861e42b01539856b31f758dfde9ba53749eaaa - -2012-11-21 Frank Morgner - - * npa/src/npa.c: adapted to changes of OpenPACE Now works with OpenPACE 5182c69ee9dfe4ad7787d4f513d467d81a1f27ed - -2012-11-01 Frank Morgner - - * npa/src/npa.c, npa/test_vicc_with_npa-tool.sh: adapted to latest - changes of openpace works with openpace 702cf84aaa01ef5dc490d32208067a89a33102c1 - -2012-11-01 Frank Morgner - - * npa/test_vicc_with_npa-tool.sh: disable check of validity period - for testing - -2012-11-01 Frank Morgner - - * npa/test_vicc_with_npa-tool.sh: use default CHAT for testing - -2012-11-01 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa-tool.ggo.in: for EAC, use - terminal's CHAT by default - -2012-10-26 Frank Morgner - - * npa/configure.ac: comprehensive checking for help2man and - gengetopt - -2012-10-10 Frank Morgner - - * npa/src/sm.c: fixed wrong encoding of protected Le - -2012-10-09 Frank Morgner - - * npa/Makefile.am, npa/test_vicc_with_npa-tool.sh: added script to - test vicc with npa-tool - -2012-10-08 Frank Morgner - - * npa/src/npa.c: added calculation of longest encrypted short-length - APDU - -2012-10-05 Frank Morgner - - * npa/src/npa.c: adapted to changes of openpace in 91d6ee1ec80f6... - -2012-10-05 Frank Morgner - - * npa/src/npa-tool.ggo.in: updated help for `--disable-checks` - -2012-10-05 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa.c, npa/src/sm.c: fixed memory - leaks - -2012-10-05 Frank Morgner - - * npa/src/npa.c: debug the result from CA's general authenticate - -2012-10-05 Frank Morgner - - * npa/src/sm.c: fixed short length SM APDUs (especially case 2) - -2012-10-04 Frank Morgner - - * npa/src/npa.c: fixed Le for get challenge - -2012-10-04 Frank Morgner - - * npa/src/npa.c: nPA: using case 3 apdu for verify - -2012-10-04 Frank Morgner - - * npa/src/npa.c: fixed CLA of PACE's last general authenticate - -2012-10-01 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa-tool.ggo.in, npa/src/npa.c, - npa/src/npa/npa.h: nPA: added option to disable validity period - check - -2012-09-27 Frank Morgner - - * npa/src/npa.c: Fixes for MSE:Set AT in TA and CA - TA: fixed p1, p2 and include ephemeral pubkey and OID - CA: include OID and leave out key reference Currently it is hard to distinguish between the CA key and the - chip-individual key using the key references in - EF.CardSecurity/EF.CardAccess. The first (default) key in these - files should, however, be the CA key. - -2012-09-21 Frank Morgner - - * npa/src/npa.c: sc_format_apdu instead of manual initialisation - -2012-09-21 Frank Morgner - - * npa/src/npa.c: Send auxiliary data in MSE:Set AT for TA - -2012-09-21 Frank Morgner - - * npa/src/npa-tool.c, npa/src/npa-tool.ggo.in, npa/src/npa.c: - npa-tool: CLI to TA and CA - -2012-09-19 Frank Morgner - - * npa/src/npa.c, npa/src/npa/npa.h: libnpa: Implementation of CA - -2012-09-19 Frank Morgner - - * npa/src/npa/npa.h: added fids for EF.CardSecurity - -2012-09-18 Frank Morgner - - * npa/src/npa.c: libnpa: Implementation of TA - -2012-09-18 Frank Morgner - - * npa/src/npa.c: added switch to disable apdu checking for TA/CA - -2012-09-18 Frank Morgner - - * npa/src/npa.c: fetch CAR for TA from MSE:Set AT - -2012-09-18 Frank Morgner - - * npa/configure.ac, npa/libnpa.pc.in, npa/src/Makefile.am, - npa/src/npa-tool.c, npa/src/npa.c, npa/src/npa/npa.h: adapted to - changes of OpenPACE - -2012-08-31 Frank Morgner - - * npa/configure.ac: fixed autoconf warnings - -2012-06-22 frankmorgner - - * npa/src/npa.c, npa/src/npa/npa.h: using selection by short - identifier when reading ef.cardaccess. Fixes #3532221 git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@783 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-24 frankmorgner - - * npa/src/npa.c: fixed clang --analyze warnings git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@780 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-24 frankmorgner - - * npa/src/example.c, npa/src/npa-tool.c, npa/src/npa.c, - npa/src/scutil.c: fixed clang compiler warnings git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@777 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-15 frankmorgner - - * npa/Makefile.am: use distcheck-hook to generate ChangeLog git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@773 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-15 frankmorgner - - * npa/Makefile.am, npa/Makefile.am.opensc, npa/configure.ac, - npa/win32/Makefile.am, npa/win32/build_fix_zlib.patch, - npa/win32/build_npa.patch: automate cross compile for windows in - win32. use the power of the opensc build script git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@772 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-12 frankmorgner - - * npa/src/Makefile.am: minor improvements of the manpages git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@767 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-12 frankmorgner - - * npa/configure.ac: added missing checks at configure time git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@766 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-11 frankmorgner - - * npa/ChangeLog, npa/configure.ac: released 0.4 git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@762 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-11 frankmorgner - - * npa/src/Makefile.am: fixed distribution of opensc headers git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@761 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-11 frankmorgner - - * npa/Makefile.am: only generate changelog when working in - repository git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@758 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-11 frankmorgner - - * npa/Makefile.am: automatically generate changelog when releasing git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@757 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-11 frankmorgner - - * npa/configure.ac, npa/doc/Makefile.am: using macro for doxygen git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@756 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-11 frankmorgner - - * npa/doc/Makefile.am, npa/src/Makefile.am: use macro for sed im - makefiles git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@755 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-11 frankmorgner - - * npa/doc/api.rst: fixed cross reference to doxygen documentation git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@747 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-11 frankmorgner - - * npa/doc/Doxyfile.in, npa/doc/Makefile.am, npa/doc/api.rst: fixed - name of doxygen generated tag file git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@744 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-11 frankmorgner - - * npa/doc/README.rst, npa/doc/README.rst.in: updated documentation git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@743 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-10 frankmorgner - - * npa/configure.ac, npa/src/Makefile.am: use help2man to generate - minimal man pages git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@739 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-10 frankmorgner - - * npa/Makefile.am, npa/src/Makefile.am: re-enabled clumsy include of - libws2_32 When recognition of windows build at compile time is done, this - should be disabled again. git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@738 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-10 frankmorgner - - * npa/src/Makefile.am, npa/src/binutil.c, npa/src/binutil.h, - npa/src/npa-tool.c, npa/src/npa-tool.ggo.in: switched to command - line handling with gengetopt git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@737 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-09 frankmorgner - - * npa/configure.ac: more readable information via autoconf git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@734 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-05 frankmorgner - - * npa/Makefile.am, npa/src/Makefile.am: moved include of ws2_32 to - the appropriate place git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@732 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-05 frankmorgner - - * npa/doc/README.rst, npa/doc/README.rst.in: updated links and info - for installation git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@731 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-05 frankmorgner - - * npa/Makefile.am, npa/Makefile.am.opensc: fixed cross compiling for - windows git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@730 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-04-04 frankmorgner - - * npa/Makefile.am: updated windows build variables git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@729 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-03-02 frankmorgner - - * npa/doc/Makefile.am, npa/doc/README.rst: added recommended - configure options to documentation git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@727 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-02-26 frankmorgner - - * npa/src/Makefile.am: follow symbolic links when searching for - openscs header files git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@724 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-02-20 frankmorgner - - * npa/src/npa.c: adapted to changes of - https://github.com/frankmorgner/OpenSC git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@719 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-02-03 frankmorgner - - * npa/src/npa.c: removed unused declaration git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@710 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-02-01 frankmorgner - - * npa/src/npa.c: return SC_SUCCESS instead of 0 git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@709 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-02-01 frankmorgner - - * npa/src/npa.c: removed handling of CAR and CHR, this is done in TA - by OpenPACE git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@708 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-02-01 frankmorgner - - * npa/src/npa.c: enable time check for imported certificates git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@707 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-02-01 frankmorgner - - * npa/src/npa.c: removed card driver hack. use a better opensc - instead (see https://github.com/frankmorgner/OpenSC) git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@706 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-02-01 frankmorgner - - * npa/src/npa.c: adapted to openpace git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@705 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-01-29 frankmorgner - - * npa/configure.ac: include shell code for cloning opensc with pace git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@698 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-01-25 frankmorgner - - * npa/src/npa-tool.c: always print a message in case of an error git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@697 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-01-25 frankmorgner - - * npa/Makefile.am.opensc, npa/configure.ac, npa/src/example.c, - npa/src/npa-tool.c, npa/src/npa.c, npa/src/npa/npa.h: using patched - OpenSC enabled with PACE to use the reader's capabilities sourcecode can be fetched from here - https://github.com/frankmorgner/OpenSC git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@696 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2012-01-18 oepen - - * npa/src/npa.c: Adjusted libnpa to API changes in OpenPACE git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@680 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-12-14 frankmorgner - - * npa/configure.ac: use libcrypto instead of libssl git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@668 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-12-09 frankmorgner - - * npa/doc/README.rst, npa/doc/api.rst: small fixes git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@664 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-12-09 frankmorgner - - * npa/src/npa.c: git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@660 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-12-08 frankmorgner - - * npa/Makefile.am, npa/configure.ac: autoconf macros for sed, ln and - mkdir git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@651 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-12-07 frankmorgner - - * npa/doc/README.rst, npa/doc/autotools.rst: adapted to openpace git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@646 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-12-07 frankmorgner - - * npa/doc/README.rst.in: adapted to openpace git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@644 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-12-07 frankmorgner - - * npa/src/npa.c: adapted to openpace git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@641 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-12-01 frankmorgner - - * npa/Makefile.am, npa/configure.ac: minor fixes git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@637 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-08 frankmorgner - - * npa/src/Makefile.am: added no-undefined for building a dll git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@636 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-08 frankmorgner - - * npa/doc/README.rst, npa/doc/README.rst.in: not using static path - for program-output. instead setting the correct envirnment in - conf.py. git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@635 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-07 frankmorgner - - * npa/Makefile.am, npa/configure.ac, npa/src/npa-tool.c: - using unsigned long long for constant max value of puk - fixed fixup_la - guessing building machine git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@634 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-07 frankmorgner - - * npa/Makefile.am: using pkg-config for cross compile build git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@633 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-07 frankmorgner - - * npa/configure.ac, npa/src/npa-tool.c: using 64 bits for value of - puk git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@632 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-07 frankmorgner - - * npa/src/npa-tool.c: break secrets from bottom to top git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@631 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-07 frankmorgner - - * npa/src/npa.c: car and certificate description are now optional - for npa_ctx_create git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@630 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-07 frankmorgner - - * npa/src/npa.c: omitting initialize for ta for unauthenticated - terminals git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@629 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-07 frankmorgner - - * npa/Makefile.am: install requires absolute path git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@628 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/configure.ac, npa/doc/Makefile.am, npa/doc/README.rst, - npa/doc/README.rst.in: included help output from programs in - documentation git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@627 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/Makefile.am: replaced pwd with abs_top_src_dir git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@626 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/configure.ac, npa/doc/Makefile.am: cleaned up build of - documentation git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@625 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/Makefile.am: workaround to undefined reference to rpl_malloc. - cross compiling works now git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@624 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/Makefile.am: using absolute include/library directories git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@623 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/Makefile.am: added fixes for la files git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@622 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/Makefile.am, npa/Makefile.am.opensc: modifying opensc to get - all library functions exported git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@621 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/Makefile.am: library fixup git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@620 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/src/npa.c: fixed reference to cvc_cert function git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@619 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/Makefile.am: library fixup git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@618 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/Makefile.am: work on cross compile build git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@617 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/Makefile.am: work on cross compile build git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@616 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-05 frankmorgner - - * npa/Makefile.am, npa/src/npa/scutil.h: work on cross compile build git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@615 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-03 frankmorgner - - * npa/doc/Makefile.am: - update on ccid documentation - rebuilding documentation when any *.in file changes git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@613 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-02 frankmorgner - - * npa/doc/README.rst, npa/doc/autotools.rst, npa/doc/questions.rst: - added autogenerated files for easier development checkout git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@606 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-01 frankmorgner - - * npa/doc/Makefile.am, npa/doc/api.rst: only refresh documentation - if needed git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@605 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-11-01 frankmorgner - - * npa/doc/README.rst.in: added potential platforms to documentation git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@604 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-29 frankmorgner - - * npa/doc/Makefile.am, npa/doc/README.rst, npa/doc/README.rst.in: - more autotool magic git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@599 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-29 frankmorgner - - * npa/Makefile.am, npa/configure.ac, npa/doc/Makefile.am: - more autotool magic in documentation files - including substituted documentation files with distributed files git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@597 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-29 frankmorgner - - * npa/doc/Makefile.am, npa/doc/README.rst, npa/doc/questions.rst.in: - worked around warnings of sphinx - using generic file for questions for all subprojects git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@595 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-29 frankmorgner - - * npa/src/Makefile.am: correctly include example git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@593 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-29 frankmorgner - - * npa/Makefile.am, npa/doc/Makefile.am, npa/doc/README.rst, - npa/doc/autotools.rst.in: using generic autotools description for - all subprojects git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@591 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-28 frankmorgner - - * npa/doc/README.rst: added more markup git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@590 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-27 frankmorgner - - * npa/doc/Makefile.am: automagically generate documentation of - virtualsmartcard git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@588 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-27 frankmorgner - - * npa/Doxyfile.in, npa/Makefile.am, npa/README, npa/README.dox, - npa/configure.ac, npa/doc/Doxyfile.in, npa/doc/Makefile.am, - npa/doc/README.rst, npa/doc/api.rst, npa/doc/example.c: using a - dedicated folder for documentation in each subproject git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@587 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-27 frankmorgner - - * npa/README.dox: documentation git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@586 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-27 oepen - - * npa/README.dox: -Better install instructions for ccid-emulator - -Added metadata to documentation git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@585 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-27 frankmorgner - - * npa/README.dox: copy and paste friendly installation guide git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@578 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-26 frankmorgner - - * npa/README.dox: more detailed install instructions git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@577 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-26 frankmorgner - - * npa/src/example.c: minor simplifications git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@576 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-26 frankmorgner - - * npa/src/example.c: git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@574 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-26 frankmorgner - - * npa/README.dox, npa/src/Makefile.am, npa/src/example.c, - npa/src/npa-tool.c: including a simple example program mainly for - documentation git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@573 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-26 frankmorgner - - * npa/src/npa-tool.c: include npa.h as global resource git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@572 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-25 frankmorgner - - * npa/Doxyfile.in: automatically update doxygen documentation if - possible git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@568 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-25 frankmorgner - - * npa/Doxyfile.in, npa/README.dox, npa/src/npa/npa.h, - npa/src/npa/sm.h: Compromise with documentation: Include the most - important parts of libnpa with breathe and reference the details - with doxylink to external doxygen pages git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@567 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-24 frankmorgner - - * npa/Doxyfile.in: git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@566 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-24 frankmorgner - - * npa/src/npa/npa.h, npa/src/npa/scutil.h, npa/src/npa/sm.h: - documentation: grouping and other things git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@565 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-23 frankmorgner - - * npa/README.dox: git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@564 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-22 frankmorgner - - * npa/Doxyfile.in: document only public interface git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@562 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-18 frankmorgner - - * npa/src/npa.c: added workaround to avoid potentially conflicting - types of mse:set at's git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@560 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-17 frankmorgner - - * npa/src/npa.c: - found OpenSSL's limitation to not use optional item templates in - other item templates. this caused errors on parsing mse:set at - during ta - checking terminal's signature now seems stable, so it is enabled - by default git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@559 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-17 oepen - - * npa/README.dox: Fixed a typo git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@558 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-17 frankmorgner - - * npa/Doxyfile.in: documenting only interface to the outside world git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@557 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-17 frankmorgner - - * npa/src/npa-tool.c, npa/src/npa.c: - added support for verifying terminal's signature including - auxiliary data (experimental, currently disabled) - debugging openssl where possible/needed - using openssl instead of opensc for asn1 git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@556 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-14 oepen - - * npa/README.dox: -Added Virtual Smartcard logo to documentation - -Changed theme git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@554 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-13 oepen - - * npa/README.dox: Added npa documentation to breathe git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@552 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-13 oepen - - * npa/Doxyfile.in, npa/src/npa.c: -Converted CVC_check_cert function - call to CVC_check_description -Removed README.dox from Doxygen input - -Excluded opensc from the documentation -Enabled generation of XML - documentation (for sphinx) git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@549 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-13 oepen - - * npa/README.dox: Fixed highlighting of configure commands in npa - documentation git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@548 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-10-12 oepen - - * npa/README.dox: Converted npa documentation to reStructuredText - (mostly) git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@546 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-09-30 frankmorgner - - * npa/src/scutil.c: fixed error on using stdout as debug log git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@542 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-09-30 frankmorgner - - * npa/src/sslutil.h: implemented ssl_error as macro git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@541 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-09-30 frankmorgner - - * npa/src/sslutil.c: implemented ssl_error as macro git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@540 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-09-26 frankmorgner - - * npa/Makefile.am, npa/apdus: - moved example apdus to npa-tool git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@539 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-09-23 frankmorgner - - * npa/src/npa.c: - fixed type of auxiliary data in c-apdu - parsing mse:set for ta - check terminals signature for ta git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@538 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-09-23 frankmorgner - - * npa/src/npa.c, npa/src/npa/npa.h, npa/src/npa/sm.h, - npa/src/scutil.c, npa/src/sm.c: - checking description against the certificate is now done - internally in libnpa, removed hash of certificate description from - pace output - importing terminal certificates to verify terminals signature - fixed hex dump without sc_context git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@537 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-09-22 frankmorgner - - * npa/src/npa.c: - fixed corruption of certificate description - adjusted output parsing from certificate_description_print - fixed check for certificate description in terminal certificate git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@536 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-09-21 frankmorgner - - * npa/src/npa.c: generating cv certificate from apdu data to perform - check against certificate description git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@535 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-09-20 frankmorgner - - * npa/src/npa.c: handling certificate description and chat in libnpa - instead of ccid-emulator git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@534 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-09-05 oepen - - * npa/README.dox: Fixed grammar error git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@523 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-09-02 frankmorgner - - * npa/src/sm.c: added error checking git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@522 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-08-30 frankmorgner - - * npa/src/Makefile.am, npa/src/npa.c, npa/src/sslutil.c, - npa/src/sslutil.h: - added openssl debug code to ccid emulator - fixed some bugs due to changes in recent opensc version - added support for changing pin via standard leser git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@511 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-07-28 oepen - - * npa/src/npa-tool.c: Fixed some compiler warnings git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@443 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-07-26 frankmorgner - - * npa/src/npa.c: adjusted to changes of OpenPACE git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@438 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-07-25 frankmorgner - - * npa/configure.ac, npa/src/npa-tool.c, npa/src/scutil.c: switched - to opensc 0.12.1, where build_apdu has been accepted as - sc_bytes2apdu git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@433 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-07-23 frankmorgner - - * npa/configure.ac: silent build rules git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@427 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-05-20 frankmorgner - - * npa/configure.ac: released 0.3 git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@425 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-05-20 frankmorgner - - * npa/ChangeLog: updated changelog git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@424 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-05-20 frankmorgner - - * npa/src/npa.c: fixed memory leaks git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@423 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-05-20 frankmorgner - - * npa/README.dox: updated documentation git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@422 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-05-20 frankmorgner - - * npa/src/npa.c, npa/src/sm.c: - sm.c: added test for available memory - npa.c: removed obsolete comments git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@421 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-05-20 frankmorgner - - * npa/src/npa.c: fixed segfault on cleanup git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@420 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-05-18 frankmorgner - - * npa/src/npa.c: fixed usage of PACE_SEC_clear_free git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@419 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-05-17 frankmorgner - - * npa/configure.ac, npa/src/npa.c, npa/src/npa/npa.h: adapted to - openpace 0.6 git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@418 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-02-08 frankmorgner - - * npa/ChangeLog, npa/configure.ac: released 0.2 git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@410 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-02-07 frankmorgner - - * npa/Makefile.am: git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@409 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-02-06 frankmorgner - - * npa/configure.ac, npa/src/npa-tool.c, npa/src/npa.c: added - compatibility to mingw git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@408 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-02-05 frankmorgner - - * npa/src/npa.c, npa/src/sm.c: avoiding problems due to - uninitialized values git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@407 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-02-05 frankmorgner - - * npa/src/sm.c: - windows dependant include git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@406 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-02-03 frankmorgner - - * npa/src/Makefile.am, npa/src/npa-tool.c, npa/src/npa.c, - npa/src/npa/npa.h, npa/src/npa/npa_lib.h, npa/src/npa/sm.h, - npa/src/npa_lib.c, npa/src/sm.c: - not exporting npa internal stuff anymore - added sm_ctx_clear_free git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@405 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-02-02 frankmorgner - - * npa/src/Makefile.am: building clean distribution file git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@404 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-02-02 frankmorgner - - * npa/Makefile.am, npa/README.dox, npa/configure.ac, - npa/libnpa.pc.in, npa/libpace.pc.in, npa/src/Makefile.am, - npa/src/npa-tool.c, npa/src/npa.c, npa/src/npa/npa.h, - npa/src/npa/npa_lib.h, npa/src/npa/scutil.h, npa/src/npa/sm.h, - npa/src/npa_lib.c, npa/src/pace-tool.c, npa/src/pace.c, - npa/src/pace/pace.h, npa/src/pace/pace_lib.h, - npa/src/pace/scutil.h, npa/src/pace/sm.h, npa/src/pace_lib.c, - npa/src/scutil.c: renamed libpace to libnpa git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@403 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-02-01 oepen - - * npa/configure.ac: Shut up autotools git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@400 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-02-01 frankmorgner - - * npa/src/pace-tool.c: cleaned up time management. might not work - for systems where time_t is not an integer. git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@396 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-01-31 frankmorgner - - * npa/src/pace-tool.c: - fixed description of version parameter git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@395 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-01-31 frankmorgner - - * npa/Makefile.am, npa/README.dox, npa/configure.ac, - npa/libpace.pc.in, npa/src/Makefile.am, npa/src/pace-tool.c: linking - against opensc now as shared library git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@394 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-01-16 frankmorgner - - * npa/src/Makefile.am, npa/src/pace.c: - fixed memory corruption when getting ef.cardaccess - minor changes in build process with libopensc git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@391 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-01-16 frankmorgner - - * npa/Makefile.am, npa/src/Makefile.am: optimized makefile-targets git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@390 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-01-15 frankmorgner - - * npa/README.dox, npa/configure.ac, npa/libpace.pc.in, - npa/src/Makefile.am: - added customization via OPENSC_CONFIGURE - changed information regarding opensc - fixed pkg-config file git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@389 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-01-15 frankmorgner - - * npa/src/scutil.c: added more error messages git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@388 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2011-01-14 frankmorgner - - * npa/Makefile.am, npa/configure.ac, npa/src/Makefile.am, - npa/src/pace-tool.c, npa/src/pace.c, npa/src/pace/pace.h, - npa/src/pace/scutil.h, npa/src/pace/sm.h, npa/src/scutil.c, - npa/src/sm.c: switched to opensc.0.12.0. note that this has some - issues when linking against both libnpa and the opensc libraries at - the same time. readme information would be usefull for this... git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@385 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2010-12-17 frankmorgner - - * npa/src/pace-tool.c: fix error when breaking a secret where all - digits are 9 git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@384 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2010-12-12 frankmorgner - - * npa/src/pace-tool.c: removed byteorder.h from includes, not - needed. thanks Dennis git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@380 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2010-12-11 frankmorgner - - * npa/README.dox: - updated information git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@378 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2010-12-08 frankmorgner - - * npa/ChangeLog, npa/m4/Makefile.am: releasing 0.1 git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@374 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2010-12-08 frankmorgner - - * npa/src/pace-tool.c, npa/src/pace.c, npa/src/pace/pace.h: added - input parameter for version of 03110 git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@373 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2010-12-08 frankmorgner - - * npa/src/pace.c: adapted to the latest changes of OpenPACE git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@369 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2010-12-07 frankmorgner - - * npa/README.dox: updated information git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@368 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2010-12-07 frankmorgner - - * npa/configure.ac: linking against libopensc not easily possible. - we need to remove this dependancy git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@366 - 96b47cad-a561-4643-ad3b-153ac7d7599c - -2010-11-14 frankmorgner - - * extracted libpace from ccid git-svn-id: - https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@359 - 96b47cad-a561-4643-ad3b-153ac7d7599c - diff --git a/npa/Makefile.am b/npa/Makefile.am deleted file mode 100644 index cfe938d..0000000 --- a/npa/Makefile.am +++ /dev/null @@ -1,48 +0,0 @@ -ACLOCAL_AMFLAGS = -I m4 -SUBDIRS = src m4 doc cross certs - -EXTRA_DIST = libnpa.pc.in opensc.conf.in apdus test_vicc_with_npa-tool.sh - -do_subst = $(SED) \ - -e 's,[@]PACKAGE_NAME[@],$(PACKAGE_NAME),g' \ - -e 's,[@]PACKAGE_VERSION[@],$(PACKAGE_VERSION),g' \ - -e 's,[@]PACKAGE_SUMMARY[@],$(PACKAGE_SUMMARY),g' \ - -e 's,[@]builddir[@],$(builddir),g' \ - -e 's,[@]prefix[@],$(prefix),g' \ - -e 's,[@]exec_prefix[@],$(exec_prefix),g' \ - -e 's,[@]libdir[@],$(libdir),g' \ - -e 's,[@]DYN_LIB_EXT[@],$(DYN_LIB_EXT),g' \ - -e 's,[@]includedir[@],$(includedir),g' \ - -e 's,[@]VERSION[@],$(VERSION),g' \ - -e 's,[@]OPENSC_LIBS[@],$(OPENSC_LIBS),g' \ - -e 's,[@]top_srcdir[@],$(top_srcdir),g' - -pkgconfigdir = $(libdir)/pkgconfig -pkgconfig_DATA = libnpa.pc -libnpa.pc: libnpa.pc.in - $(do_subst) < $(srcdir)/libnpa.pc.in > libnpa.pc - -opensc.conf: opensc.conf.in - $(do_subst) < $(srcdir)/opensc.conf.in > opensc.conf - -win: - make -C cross $@ - -android: - make -C cross $@ - -osx: - make -C cross $@ - -all-local: opensc.conf - -clean-local: - rm -f libnpa.pc opensc.conf - -distcheck-hook: - test -d .svn && \ - svn2cl --group-by-day --reparagraph --separate-daylogs --include-actions --include-rev \ - || true - test -d ../.git && \ - git log --pretty --numstat --summary . | git2cl > ChangeLog \ - || true diff --git a/npa/NEWS b/npa/NEWS deleted file mode 100644 index e69de29..0000000 diff --git a/npa/README b/npa/README deleted file mode 120000 index 253de0c..0000000 --- a/npa/README +++ /dev/null @@ -1 +0,0 @@ -doc/README.txt \ No newline at end of file diff --git a/npa/README b/npa/README new file mode 100644 index 0000000..20d0b2b --- /dev/null +++ b/npa/README @@ -0,0 +1,7 @@ +#nPA Smart Card Library + +Access the German electronic identity card (neuer Personalausweis/nPA). + +The functionality of nPA Smart Card Library has been integrated into +OpenSC. Developement and Support will continue at our new home +https://github.com/frankmorgner/OpenSC. diff --git a/npa/apdus b/npa/apdus deleted file mode 100644 index 922c3cd..0000000 --- a/npa/apdus +++ /dev/null @@ -1,29 +0,0 @@ -00:22:81:B6:0F:83:0D:5A:5A:43:56:43:41:41:54:41:30:30:30:31 -00:2a:00:be:e4:7f:4e:81:9d:5f:29:01:00:42:0d:5a:5a:43:56:43:41:41:54:41:30:30:30:31:7f:49:4f:06:0a:04:00:7f:00:07:02:02:02:02:03:86:41:04:52:dd:32:ea:fe:1f:bb:b4:00:0c:d9:ce:75:f6:66:36:cf:cf:1e:dd:44:f7:b1:ed:ae:25:b8:41:93:da:04:a9:1c:77:ee:87:f5:c8:f9:59:ed:27:62:00:de:33:ab:57:4c:e9:80:11:35:ff:44:97:a3:71:62:b7:c8:54:8a:0c:5f:20:0e:5a:5a:44:56:43:41:41:54:41:30:30:30:30:35:7f:4c:12:06:09:04:00:7f:00:07:03:01:02:02:53:05:70:03:01:ff:b7:5f:25:06:01:00:00:06:01:01:5f:24:06:01:00:01:00:03:01:5f:37:40:6f:13:ae:9a:6f:4e:dd:b7:83:9f:f3:f0:4d:71:e0:dc:37:7b:c4:b0:8f:ad:29:5e:ed:24:1b:52:43:28:ad:07:30:eb:55:34:97:b4:fb:66:e9:bb:7a:b9:08:15:f0:42:73:f0:9e:75:1d:7f:d4:b8:61:43:9b:4e:e6:53:81:c3 -002281B610830E5A5A445643414154413030303035 -002a00be0001417f4e81fa5f290100420e5a5a4456434141544130303030357f494f060a04007f000702020202038641049bfe7415d73c4a78d60b2cc1bca11b6d5e523969acfb5b756a3be1551b22239c79ae362b838b00669983c0caf6ed0c781d401c95d2b32857de8ce1b619dac4a75f200a5a5a5349543030304f347f4c12060904007f000703010202530500000000045f25060100000902015f2406010000090206655e732d060904007f0007030103028020b02baa51a94fac0954df204d61fe22da1d408d45db4aa1d70e600dad4faf6799732d060904007f0007030103018020c72e13582f01ba068dd1aac29a2428c0c54ab9c204fd53b3f13e8290e21e50f95f374083c5b441fec5b18efd1caa4a11b8e1cede0a8b42d442f00d7f604e429f339b4e3e6c06f9e76a2daa82c1722ee137a89038b969c634561581e6c26d9f6fa75c52 -00:22:81:A4:53:80:0A:04:00:7F:00:07:02:02:02:02:03:83:0A:5A:5A:53:49:54:30:30:30:4F:34:91:20:88:E5:F2:C6:11:18:0D:0A:C1:0E:BD:E6:FC:2A:5E:62:41:79:C0:A5:77:C3:E4:88:52:DD:81:A4:CD:F7:90:51:67:17:73:15:06:09:04:00:7F:00:07:03:01:04:02:53:08:32:30:31:30:30:39:32:34 -00:84:00:00:08 -00820000400C9E7DB72CB0FAEA15B00FECAE0257546446A9395862239AF240C3C29E857F8403345817760FE13F6597F04D2F7330B59065F68DF71EF7FDEC86743CDE2869DD -00a4000c023f00 -00:A4:02:0C:02:01:1D -00:b0:00:00:80 -00B0008080 -00b0010080 -00:B0:01:80:80 -00:b0:02:00:80 -00B0028080 -00b0030080 -00:B0:03:80:80 -00:b0:04:00:80 -00B0048080 -00b0050080 -00:B0:05:80:80 -00:b0:06:00:80 -00B0068080 -00b0070080 -00:B0:07:80:80 -00:22:41:a4:0c:80:0a:04:00:7f:00:07:02:02:03:02:02 -00860000457C43804104239E3D05EEB059117D30F86AEB5AE7D12E0EBF758889C79115F2A13DC1BB570A5CAD91A384337C09D1B74BED1C0FF195A7C3EA3A2CEDF86DDEF7B95D1FD1B35D00 -0020001006010203040506 - diff --git a/npa/certs/DECVCAEPASS00102 b/npa/certs/DECVCAEPASS00102 deleted file mode 120000 index 58babd7..0000000 --- a/npa/certs/DECVCAEPASS00102 +++ /dev/null @@ -1 +0,0 @@ -cvca-epass.cv \ No newline at end of file diff --git a/npa/certs/DECVCAeID00102 b/npa/certs/DECVCAeID00102 deleted file mode 120000 index 633e1e2..0000000 --- a/npa/certs/DECVCAeID00102 +++ /dev/null @@ -1 +0,0 @@ -cvca-eid.cv \ No newline at end of file diff --git a/npa/certs/DECVCAeSign00102 b/npa/certs/DECVCAeSign00102 deleted file mode 120000 index 98dfcd6..0000000 --- a/npa/certs/DECVCAeSign00102 +++ /dev/null @@ -1 +0,0 @@ -cvca-esign.cv \ No newline at end of file diff --git a/npa/certs/Makefile.am b/npa/certs/Makefile.am deleted file mode 100644 index 74a66a0..0000000 --- a/npa/certs/Makefile.am +++ /dev/null @@ -1,14 +0,0 @@ -CV_CERTS = DECVCAeID00102 DECVCAEPASS00102 DECVCAeSign00102 -X509_CERTS = ff3d20d2 - -EXTRA_DIST = $(CV_CERTS) $(X509_CERTS) - -install-data-local: - $(MKDIR_P) "$(DESTDIR)$(X509DIR)" - for cert in $(X509_CERTS); do $(INSTALL_DATA) $(srcdir)/$${cert} "$(DESTDIR)$(X509DIR)"; done - $(MKDIR_P) "$(DESTDIR)$(CVCDIR)" - for cert in $(CV_CERTS); do $(INSTALL_DATA) $(srcdir)/$${cert} "$(DESTDIR)$(CVCDIR)"; done - -uninstall-local: - for cert in $(X509_CERTS); do rm -f "$(DESTDIR)$(X509DIR)/$${cert}"; done - for cert in $(CV_CERTS); do rm -f "$(DESTDIR)$(CVCDIR)/$${cert}"; done diff --git a/npa/certs/csca-germany_013_self_signed_cer.cer b/npa/certs/csca-germany_013_self_signed_cer.cer deleted file mode 100644 index b645bbeb66a0125ec1062f833de264f4fbcf62a1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 899 zcmXqLVy-u6Vpdte%*4pV#Kb6Tz{AF&)#h=|mW7##mBGN@klTQhjX9KsO_<5W)sWYK z8^qz_VM!{@OEKgz-~w^Ed6<)mGhsYdVP*qEV?$8`VUQd%4^MJ&a-wc}YEf=tUZsJY zIIn?)fsv7!p|Odvfk~7&uaTjF1(0iGY-(y2MSTmK7>x}Y->|WRJ;lUm(D;Cfk-vwv!fm}boPhv%}-+>!X-!@iBh zk)`|6x}B%%!cXgXd+7gZ+`fM2J@to=_bMNzq+iNZk+9!?%w7o&Lj3N+ePC zc9FY#d7}o&S3M*|BOCuu- zOH&IYb0Z@IK9D|sM#ldvz=XueW*`gV^RbArh$Ogta{ct6@XFPcFHg&_nPuL7EfHxT z50X}9kuVTzz^=d%q(Fhi3Yd7z*f?1j>KWLX8G#Y0X`s%=q0Pp~%F52fC?=gzQc_^0 zuU}qXu7~76eUQrygg{0JgPg=+zy_q47#R$-L1F?dDh5go{6+>SDYFqMU}y+Vs?fBF zk~Ns!84O&Q6r?N*m8zz#dOj(lYv~Kx|mnCj_bU|?uqRPWiuD9gsh!cfn^&IAO^jS4G& zhu>cKZsi`kG_DDAn|q7$tiLH=Ra4MV5cZIj&kHVZQmBpMEd8Tn5dQ94sexnF|L4CO zLJz9liOG5CVC&6h1!Ugt>oxnQwuouQe1CW@`^+7Q|2^#6S{zxrFRj~ox-R^* zj<<*YpT_O$civNf_;|1KAuE^Qy|d04C56=eFg<+h$lvKd+@wSjWltU|cNNxs+ZPfe z8**HqC3AW!xHrnLoAMD*6J2 zk7oPKNz$o&YcufoR23}%=+1f+|^WSn{##2>xcL;T~Z zInI%`TT|GME#AO(`txUz=O(kx^Bmj%`t-fO0$c8U_+)r1YKx|m=o;V{9Bg1K)=&%n+E1k8;J zD}RUIUifb19=kNI33Ho!i}I|$DPL7n&`=Qekd@C1E^kt(jp8i*qhk>M?pvvWW7YrX zzZ*gis@;jndFkct^4VbP&1MB;-tOx)`=_>uX~ukicrN?Q9f|)v?Aux#S-LN++j+V! z{Irg@hyI_&?dx~mQ-An)uks-)m*Bm#&KV_z)cr6$eCx>H=|9}0L=t6B9x8Vg)_vO- z5+fUOT%RR#dMmm^3wtc97H>^l_I-jJU(TA^^fc#}HQANTzq7hZNu*yg5uy`7OU zUI8=EeE8Tn!9m8%$ix`Tcrad-jgbKeIpS5=7@5HgbB7669~QpebgpFnX3@>Un)6q( zsL0+^m;QRJaZdl)=evEjlqcECoV_k}`PPJAJ|0iIrXBZxb?0&GlSSn-l(tm<@_GUQ DsLjAN diff --git a/npa/certs/cvca-esign.cv b/npa/certs/cvca-esign.cv deleted file mode 100644 index 4e80d89546718553b742d84ee7cac0fafb0709fd..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 443 zcmbKx|mm>Qg!o@ZcSXkb+D*~BQz#>K)=&%n+E1k8;J zD}RUIUifb19=kNI33Ho!i}I|$DPL7n&`=Qekd@C1E^kt(jp8i*qhk>M?pvvWW7YrX zzZ*gis@;jndFkct^4VbP&1MB;-tOx)`=_>uX~ukicrN?Q9f|)v?Aux#S-LN++j+V! z{Irg@hyI_&?dx~mQ-An)uks-)m*Bm#&KV_z)cr6$eCx>H=|9}0L=t6B9x8Vg)_vO- z5+fUOT%RR#dMmm^3wtc97H>^l_I-jJU(trro>D!jv+hS0HkAu)EB<+L|}NZ$EVJY6x?=$gjIa&*j^$q&-?s+8G(+ z6)*$MhmVaD9AwOlOw7TIhvHS)7#V<&GhT&_5ya$-H+Lw}To|9ou=@2qKUWi@MLSb0 zuT78CK3VqLra{+{sroUqDL0pS__e2}4OWIXn#6o?t6Tf*#QjsuZN)2$M3+ojkOKg1 C>bbiB diff --git a/npa/certs/ff3d20d2 b/npa/certs/ff3d20d2 deleted file mode 120000 index 8348632..0000000 --- a/npa/certs/ff3d20d2 +++ /dev/null @@ -1 +0,0 @@ -csca-germany_013_self_signed_cer.cer \ No newline at end of file diff --git a/npa/configure.ac b/npa/configure.ac deleted file mode 100644 index b2b4e15..0000000 --- a/npa/configure.ac +++ /dev/null @@ -1,239 +0,0 @@ -# -*- Autoconf -*- -# Process this file with autoconf to produce a configure script. - -AC_PREREQ([2.63]) -AC_INIT([nPA Smart Card Library], [0.7], [https://github.com/frankmorgner/vsmartcard/issues], [npa], [http://frankmorgner.github.io/vsmartcard/npa/README.html]) -AC_CONFIG_SRCDIR([src/npa.c]) -AC_CONFIG_HEADERS([config.h]) -AC_CONFIG_MACRO_DIR([m4]) -AM_INIT_AUTOMAKE - -dnl Add libtool support. -ifdef( - [LT_INIT], - [ - LT_INIT([win32-dll]) - ], - [ - AC_LIBTOOL_WIN32_DLL - AC_PROG_LIBTOOL - ] -) - -# Checks for programs. -AC_PROG_CC -AC_PROG_CXX -AC_PROG_INSTALL -AC_PROG_SED -AM_PROG_CC_C_O -PKG_PROG_PKG_CONFIG -AC_ARG_VAR([HELP2MAN], - [absolute path to help2man used for man page generation of npa-tool]) -AC_PATH_PROG(HELP2MAN, help2man, not found) -if test ! -r src/npa-tool.1 -a "${HELP2MAN}" = "not found" -then - if test "${HELP2MAN}" = "not found" - then - AC_MSG_ERROR([Need help2man to generate man page for npa-tool]) - fi -else - # make sure these files are the most recent - touch src/npa-tool.1 -fi -AC_ARG_VAR([GENGETOPT], - [absolute path to gengetopt used for command line parsing of npa-tool]) -AC_PATH_PROG(GENGETOPT, gengetopt, not found) -if test ! -r src/cmdline.h -o ! -r src/cmdline.c -then - if test "${GENGETOPT}" = "not found" - then - AC_MSG_ERROR([Need gengetopt for parsing command line of npa-tool]) - fi -else - # make sure these files are the most recent - touch src/npa-tool.ggo - touch src/cmdline.h src/cmdline.h -fi - -# If you need to see the details, just run make V=1. -m4_ifdef([AM_SILENT_RULES],[AM_SILENT_RULES([yes])]) - - -# Checks for libraries. -test -z "$OPENSC_LIBS" && OPENSC_LIBS="-lopensc" -test -z "$OPENSC_CFLAGS" && OPENSC_CFLAGS="-I${PWD}/${srcdir}/src/opensc/src -DENABLE_SM" - -saved_CPPFLAGS="$CPPFLAGS" -saved_LIBS="$LIBS" -CPPFLAGS="$OPENSC_CFLAGS $CPPFLAGS" -LIBS="$LDFLAGS $OPENSC_LIBS" - -AC_CHECK_HEADERS([libopensc/opensc.h libopensc/sm.h libopensc/pace.h], - [], [AC_MSG_ERROR([OpenSC headers not found])]) -AC_MSG_CHECKING([for sc_sm_stop]) -AC_TRY_LINK_FUNC(sc_sm_stop, - [ AC_MSG_RESULT([yes]) ], - [ AC_MSG_ERROR([Cannot link against libopensc with SM]) ]) -AC_CHECK_FUNCS([sc_apdu_set_resp sc_apdu_get_octets _sc_match_atr list_iterator_next]) - -CPPFLAGS="$saved_CPPFLAGS" -LIBS="$saved_LIBS" -AC_SUBST([OPENSC_LIBS]) -AC_SUBST([OPENSC_CFLAGS]) - - -PKG_CHECK_EXISTS([libcrypto], - [PKG_CHECK_MODULES([OPENSSL], [libcrypto])], - [AC_MSG_WARN([libcrypto not found by pkg-config])]) - -saved_CPPFLAGS="$CPPFLAGS" -saved_LIBS="$LIBS" -CPPFLAGS="$CPPFLAGS $OPENSSL_CFLAGS" -LIBS="$LDFLAGS $OPENSSL_LIBS" - -AC_CHECK_HEADERS(openssl/evp.h, [], - [ AC_MSG_ERROR([OpenSSL headers not found]) ]) -AC_MSG_CHECKING([for EVP_read_pw_string_min]) -AC_TRY_LINK_FUNC(EVP_read_pw_string_min, - [ AC_MSG_RESULT([yes]) ], - [ AC_MSG_ERROR([Cannot link against libcrypto]) ]) - -CPPFLAGS="$saved_CPPFLAGS" -LIBS="$saved_LIBS" - - -PKG_CHECK_EXISTS([libeac], [PKG_CHECK_MODULES([OPENPACE], [libeac >= 0.9])], - [AC_MSG_WARN([libeac not found by pkg-config])]) - -saved_CPPFLAGS="$CPPFLAGS" -saved_LIBS="$LIBS" -CPPFLAGS="$CPPFLAGS $OPENPACE_CFLAGS" -LIBS="$LDFLAGS $OPENPACE_LIBS" - -AC_CHECK_HEADERS(eac/eac.h, [], - [ AC_MSG_ERROR([OpenPACE headers not found]) ]) -AC_MSG_CHECKING([for EAC_CTX_init_pace]) -AC_TRY_LINK_FUNC(EAC_CTX_init_pace, [ AC_MSG_RESULT([yes]) ], - [ AC_MSG_ERROR([Cannot link against libeac]) ]) - -CPPFLAGS="$saved_CPPFLAGS" -LIBS="$saved_LIBS" - - -AC_ARG_ENABLE(cvcdir, - AC_HELP_STRING([--enable-cvcdir=DIR], - [directory containing CV certificates (default is determined by libeac)]), - [cvcdir="${enableval}"], - [cvcdir=false]) -if test "${cvcdir}" = false ; then - cvcdir="`$PKG_CONFIG libeac --variable=cvcdir`" -fi -if test "${cvcdir}" = "" ; then - AC_MSG_ERROR([use --enable-cvcdir=DIR]) -fi -CVCDIR="${cvcdir}" -AC_SUBST(CVCDIR) - -AC_ARG_ENABLE(x509dir, - AC_HELP_STRING([--enable-x509dir=DIR], - [directory containing X.509 certificates (default is determined by libeac)]), - [x509dir="${enableval}"], - [x509dir=false]) -if test "${x509dir}" = false ; then - x509dir="`$PKG_CONFIG libeac --variable=x509dir`" -fi -if test -z "${x509dir}" -then - x509dir="`$PKG_CONFIG libeac --variable=x509dir`" -fi -if test -z "${x509dir}" -then - AC_MSG_ERROR([use --enable-x509dir=DIR]) -fi -X509DIR="${x509dir}" -AC_SUBST(X509DIR) - - -PACKAGE_SUMMARY="Access the German electronic identity card (neuer Personalausweis/nPA)" -AC_SUBST(PACKAGE_SUMMARY) - - -# Checks for header files. -AC_CHECK_HEADERS([arpa/inet.h fcntl.h memory.h stdint.h stdlib.h string.h sys/ioctl.h unistd.h]) - -# Checks for typedefs, structures, and compiler characteristics. -AC_C_INLINE -AC_TYPE_SIZE_T -AC_TYPE_SSIZE_T -AC_TYPE_UINT16_T -AC_TYPE_UINT32_T -AC_TYPE_UINT8_T - -# Checks for library functions. -AC_FUNC_MALLOC -AC_FUNC_REALLOC -AC_CHECK_FUNCS([getline memmove memset strerror gettimeofday strtol strlcpy]) - -AC_SUBST(DYN_LIB_EXT) -case "$host" in -*-*-darwin*) - DYN_LIB_EXT="dylib" - ;; -*-*-freebsd*) - DYN_LIB_EXT="so" - ;; -*-*-openbsd*) - DYN_LIB_EXT="so.0.0" - ;; -*-*-solaris*) - DYN_LIB_EXT="so" - ;; -*-*-dragonfly*) - DYN_LIB_EXT="so" - ;; -*-*-cygwin*) - DYN_LIB_EXT="dll" - ;; -*) - DYN_LIB_EXT="so" -esac - -cat << EOF - -${PACKAGE} has been configured with following options: - -Version: ${PACKAGE_VERSION} -User binaries: $(eval eval eval echo "${bindir}") -Libraries: $(eval eval eval echo "${libdir}") -Configuration files: $(eval eval eval echo "${sysconfdir}") - - -Host: ${host} -Compiler: ${CC} -Preprocessor flags: ${CPPFLAGS} -Compiler flags: ${CFLAGS} -Preprocessor flags: ${CPPFLAGS} -Linker flags: ${LDFLAGS} -Libraries: ${LIBS} -OPENSC_LIBS: ${OPENSC_LIBS} -OPENSC_CFLAGS: ${OPENSC_CFLAGS} -OPENSSL_CFLAGS: ${OPENSSL_CFLAGS} -OPENSSL_LIBS: ${OPENSSL_LIBS} -OPENPACE_CFLAGS: ${OPENPACE_CFLAGS} -OPENPACE_LIBS: ${OPENPACE_LIBS} - - -HELP2MAN: ${HELP2MAN} -GENGETOPT: ${GENGETOPT} - -EOF - -AC_CONFIG_FILES([ - Makefile - certs/Makefile - doc/Makefile - m4/Makefile - src/Makefile - cross/Makefile - ]) -AC_OUTPUT diff --git a/npa/cross/MacOSX_install/postinstall b/npa/cross/MacOSX_install/postinstall deleted file mode 100755 index a1b7923..0000000 --- a/npa/cross/MacOSX_install/postinstall +++ /dev/null @@ -1,13 +0,0 @@ -#!/bin/bash - -if [ -e "/Library/OpenSC/etc/opensc.conf" ] -then - mv /Library/OpenSC/etc/opensc.conf /Library/OpenSC/etc/opensc.conf.orig -fi -mkdir -p /Library/OpenSC/etc -ln -sf /Library/nPA/etc/opensc.conf /Library/OpenSC/etc - -for f in /Library/nPA/bin/* -do - ln -sf $f /usr/local/bin -done diff --git a/npa/cross/MacOSX_uninstall/postinstall b/npa/cross/MacOSX_uninstall/postinstall deleted file mode 100755 index f17024f..0000000 --- a/npa/cross/MacOSX_uninstall/postinstall +++ /dev/null @@ -1,20 +0,0 @@ -#!/bin/bash - -if [ -L "/Library/OpenSC/etc/opensc.conf" ] -then - if [ "$(readlink /Library/OpenSC/etc/opensc.conf)" == "/Library/nPA/etc/opensc.conf" ] - then - rm /Library/OpenSC/etc/opensc.conf - mv /Library/OpenSC/etc/opensc.conf.orig /Library/OpenSC/etc/opensc.conf - fi -fi - -# Remove symlinks to commands -for file in /Library/nPA/bin/*; do - test -L "/usr/local/bin/$(basename $file)" && rm -f "/usr/local/bin/$(basename $file)" -done - -# Remove installed files -rm -rf /Library/nPA - -echo "nPA Smart Card Library has been removed from your system. See you again!" diff --git a/npa/cross/Makefile.am b/npa/cross/Makefile.am deleted file mode 100644 index 40b5323..0000000 --- a/npa/cross/Makefile.am +++ /dev/null @@ -1,181 +0,0 @@ -EXTRA_DIST=opensc.conf_win32 - -all-local: - @echo Use \`$(MAKE) win\` to cross compile for Windows - @echo Use \`$(MAKE) android\` to cross compile for Android - - - -OSX_TOOLS_DIR = "$(shell xcode-select -p)/Platforms/MacOSX.platform/Developer/SDKs" -OSX_TOOL_DIR ?= "$(OSX_TOOLS_DIR)/$(shell ls -1 $(OSX_TOOLS_DIR) | sort -n -k2 -t. -r | head -1)/usr" -OSX_TARGETDIR = $(abs_top_builddir)/$(PACKAGE_TARNAME)-$(PACKAGE_VERSION)_osx -osx: $(OPENPACE_MAKEFILE) $(OPENSC_CONFIGURE) - @echo Compiling OpenPACE - $(MAKE) -C $(OPENPACE) osx - rm -rf $(OSX_TARGETDIR) dmg $(top_builddir)/$(PACKAGE_TARNAME)-$(PACKAGE_VERSION)_osx.dmg - cp -r $(OPENPACE)/*_osx $(OSX_TARGETDIR) - @echo Configuring OpenSC - grep _sc_card_add_ec_alg $(OPENSC)/src/libopensc/libopensc.exports || echo _sc_card_add_ec_alg >> $(OPENSC)/src/libopensc/libopensc.exports - grep _sc_card_add_rsa_alg $(OPENSC)/src/libopensc/libopensc.exports || echo _sc_card_add_rsa_alg >> $(OPENSC)/src/libopensc/libopensc.exports - grep _sc_match_atr $(OPENSC)/src/libopensc/libopensc.exports || echo _sc_match_atr >> $(OPENSC)/src/libopensc/libopensc.exports - grep sc_apdu_set_resp $(OPENSC)/src/libopensc/libopensc.exports || echo sc_apdu_set_resp >> $(OPENSC)/src/libopensc/libopensc.exports - grep sc_apdu_get_octets $(OPENSC)/src/libopensc/libopensc.exports || echo sc_apdu_get_octets >> $(OPENSC)/src/libopensc/libopensc.exports - grep sc_pkcs15_pincache_add $(OPENSC)/src/libopensc/libopensc.exports || echo sc_pkcs15_pincache_add >> $(OPENSC)/src/libopensc/libopensc.exports - @echo Compiling OpenSC - cd $(OPENSC) && OPENSSL_LIBS="-L$(OSX_TARGETDIR)/Library/OpenPACE/lib -lcrypto" OPENSSL_CFLAGS="-I$(OSX_TARGETDIR)/Library/OpenPACE/include" MacOSX/build - @echo Configuring libnpa - cd $(top_builddir) && ./configure --prefix=/Library/nPA \ - PKG_CONFIG_SYSROOT_DIR=$(OSX_TARGETDIR) \ - PKG_CONFIG_PATH=$(OSX_TARGETDIR)/Library/OpenPACE/lib/pkgconfig \ - OPENSC_LIBS="-L$(OPENSC)/target/Library/OpenSC/lib -lopensc" \ - CFLAGS="-arch i386 -arch x86_64" - @echo Compiling libnpa - make -C $(top_builddir) install DESTDIR=$(OSX_TARGETDIR) - mkdir -p $(OSX_TARGETDIR)/Library/nPA/etc - cp $(top_builddir)/opensc.conf $(OSX_TARGETDIR)/Library/nPA/etc/opensc.conf - rm -rf $(OSX_TARGETDIR)/Library/OpenPACE - pkgbuild --root $(OSX_TARGETDIR) --scripts MacOSX_install --identifier com.vsmartcard.npa.mac --version $(PACKAGE_VERSION) --install-location / nPA-$(PACKAGE_VERSION)_install.pkg - pkgbuild --nopayload --identifier com.vsmartcard.npa.mac.uninstall --scripts MacOSX_uninstall Uninstall_nPA.pkg - mkdir -p dmg - cp *.pkg dmg - cp $(OPENPACE)/cross/*.pkg dmg - cp $(OPENSC)/OpenSC-*.pkg dmg - cp $(OPENSC)/Uninstall_OpenSC.pkg dmg - hdiutil create -srcfolder dmg -volname "$(PACKAGE_STRING) for Mac OS X" $(top_builddir)/$(PACKAGE_TARNAME)-$(PACKAGE_VERSION)_osx.dmg - - - -WIN_TOOL ?= i686-w64-mingw32 -WIN_TOOL_DIR ?= /usr/$(WIN_TOOL) -WIN_TARGETDIR = $(abs_top_builddir)/$(PACKAGE_TARNAME)-$(PACKAGE_VERSION)_win32 - -win: - $(MAKE) cross \ - TOOL=$(WIN_TOOL) \ - TOOL_DIR=$(WIN_TOOL_DIR) \ - TARGETDIR=$(WIN_TARGETDIR) \ - LDFLAGS="-static-libgcc" \ - LIBEAC=$(WIN_TARGETDIR)/bin/libeac-0.dll \ - LIBNPA=$(WIN_TARGETDIR)/bin/libnpa-0.dll - cp opensc.conf_win32 $(WIN_TARGETDIR)/etc/opensc.conf - - - -ANDROID_ARCH ?= arm -ANDROID_TOOL ?= $(ANDROID_ARCH)-linux-androideabi -ANDROID_TOOL_DIR ?= $(abs_builddir)/ndk -ANDROID_TARGETDIR = $(abs_top_builddir)/$(PACKAGE_TARNAME)-$(PACKAGE_VERSION)_$(ANDROID_ARCH)-androideabi -MAKE_STANDALONE_TOOLCHAIN ?= $${HOME}/.local/opt/android-ndk-r9/build/tools/make-standalone-toolchain.sh - -android: $(VIRTUALSMARTCARD_CONFIGURE) - test -d $(ANDROID_TOOL_DIR) \ - || $(MAKE_STANDALONE_TOOLCHAIN) --install-dir=$(ANDROID_TOOL_DIR) --arch=$(ANDROID_ARCH) --platform=android-16 - cd $(VIRTUALSMARTCARD) && env PATH=$(ANDROID_TOOL_DIR)/bin:$${PATH} ./configure \ - --prefix=/ \ - --host=$(ANDROID_TOOL) --target=$(ANDROID_TOOL) \ - --enable-libpcsclite --enable-vpcdhost=localhost \ - PKG_CONFIG_SYSROOT_DIR=$(ANDROID_TARGETDIR) \ - PKG_CONFIG_LIBDIR=$(ANDROID_TARGETDIR)/lib/pkgconfig \ - PKG_CONFIG_PATH=$(ANDROID_TARGETDIR)/lib/pkgconfig \ - CFLAGS="-I$(ANDROID_TOOL_DIR)/include -fPIE" \ - LDFLAGS="-L$(ANDROID_TOOL_DIR)/lib -fPIE -pie" - @echo Compiling virtual smartcard - env PATH=$(ANDROID_TOOL_DIR)/bin:$${PATH} $(MAKE) -C $(VIRTUALSMARTCARD) install DESTDIR=$(ANDROID_TARGETDIR) - env PATH=$(ANDROID_TOOL_DIR)/bin:$${PATH} $(MAKE) cross \ - TOOL=$(ANDROID_TOOL) \ - TOOL_DIR=$(ANDROID_TOOL_DIR) \ - TARGETDIR=$(ANDROID_TARGETDIR) \ - LIBEAC=$(ANDROID_TARGETDIR)/lib/libeac.so \ - LIBNPA=$(ANDROID_TARGETDIR)/lib/libnpa.so - @echo Configuring virtual smartcard - - - -clean-local: - rm -rf $(TARGETDIR) - - - -cross: $(LIBNPA) - -$(LIBNPA): $(OPENPACE_MAKEFILE) $(OPENSC_CONFIGURE) - @echo Compiling OpenPACE - env ac_cv_func_malloc_0_nonnull=yes $(MAKE) -C $(OPENPACE)/cross cross \ - TOOL=$(TOOL) \ - TOOL_DIR=$(TOOL_DIR) \ - TARGETDIR=$(TARGETDIR) \ - LDFLAGS="$${LDFLAGS}" \ - CFLAGS="$${CFLAGS}" \ - LIBEAC=$(LIBEAC) - @echo Configuring OpenSC - grep _sc_card_add_ec_alg $(OPENSC)/src/libopensc/libopensc.exports || echo _sc_card_add_ec_alg >> $(OPENSC)/src/libopensc/libopensc.exports - grep _sc_card_add_rsa_alg $(OPENSC)/src/libopensc/libopensc.exports || echo _sc_card_add_rsa_alg >> $(OPENSC)/src/libopensc/libopensc.exports - grep _sc_match_atr $(OPENSC)/src/libopensc/libopensc.exports || echo _sc_match_atr >> $(OPENSC)/src/libopensc/libopensc.exports - grep sc_apdu_set_resp $(OPENSC)/src/libopensc/libopensc.exports || echo sc_apdu_set_resp >> $(OPENSC)/src/libopensc/libopensc.exports - grep sc_apdu_get_octets $(OPENSC)/src/libopensc/libopensc.exports || echo sc_apdu_get_octets >> $(OPENSC)/src/libopensc/libopensc.exports - grep sc_pkcs15_pincache_add $(OPENSC)/src/libopensc/libopensc.exports || echo sc_pkcs15_pincache_add >> $(OPENSC)/src/libopensc/libopensc.exports - cd $(OPENSC) && ./configure \ - --prefix=/ \ - --host=$(TOOL) --target=$(TOOL) \ - --enable-sm \ - PKG_CONFIG_SYSROOT_DIR=$(TARGETDIR) \ - PKG_CONFIG_LIBDIR=$(TARGETDIR)/lib/pkgconfig \ - PKG_CONFIG_PATH=$(TARGETDIR)/lib/pkgconfig \ - CFLAGS="$${CFLAGS} -I$(TOOL_DIR)/include -I$(TARGETDIR)/include" \ - LDFLAGS="$${LDFLAGS} -L$(TOOL_DIR)/lib" - @echo Compiling OpenSC - $(MAKE) -C $(OPENSC) install DESTDIR=$(TARGETDIR) - @echo Configuring libnpa - cd $(top_builddir) && env ac_cv_func_malloc_0_nonnull=yes ac_cv_func_realloc_0_nonnull=yes ./configure \ - --prefix=/ \ - --host=$(TOOL) --target=$(TOOL) \ - PKG_CONFIG_SYSROOT_DIR=$(TARGETDIR) \ - PKG_CONFIG_LIBDIR=$(TARGETDIR)/lib/pkgconfig \ - PKG_CONFIG_PATH=$(TARGETDIR)/lib/pkgconfig \ - OPENSC_LIBS="-L$(TARGETDIR)/lib -lopensc" \ - CFLAGS="$${CFLAGS} -I$(TOOL_DIR)/include -I$(TARGETDIR)/include" \ - LDFLAGS="$${LDFLAGS} -L$(TOOL_DIR)/lib" - @echo Compiling libnpa - env CROSS_COMPILE=$(CROSS_COMPILE) \ - $(MAKE) -C $(top_builddir) install DESTDIR=$(TARGETDIR) - - - -OPENPACE=$(abs_builddir)/openpace -OPENPACE_CONFIGURE_AC=$(OPENPACE)/configure.ac -OPENPACE_CONFIGURE=$(OPENPACE)/configure -OPENPACE_MAKEFILE=$(OPENPACE)/Makefile - -$(OPENPACE_CONFIGURE_AC): - git clone https://github.com/frankmorgner/openpace.git $(OPENPACE) - -$(OPENPACE_CONFIGURE): $(OPENPACE_CONFIGURE_AC) - cd $(OPENPACE) && autoreconf --verbose --install --symlink - -$(OPENPACE_MAKEFILE): $(OPENPACE_CONFIGURE) - cd $(OPENPACE) && ./configure --enable-openssl-install - - - -OPENSC=$(abs_builddir)/opensc -OPENSC_CONFIGURE_AC=$(OPENSC)/configure.ac -OPENSC_CONFIGURE=$(OPENSC)/configure - -$(OPENSC_CONFIGURE_AC): - git clone git://github.com/OpenSC/OpenSC.git $(OPENSC) - -$(OPENSC_CONFIGURE): $(OPENSC_CONFIGURE_AC) - cd $(OPENSC) && autoreconf --verbose --install --symlink - - - -VSMARTCARD=$(abs_builddir)/vsmartcard -VIRTUALSMARTCARD=$(VSMARTCARD)/virtualsmartcard -VIRTUALSMARTCARD_CONFIGURE_AC=$(VIRTUALSMARTCARD)/configure.ac -VIRTUALSMARTCARD_CONFIGURE=$(VIRTUALSMARTCARD)/configure - -$(VIRTUALSMARTCARD_CONFIGURE_AC): - git clone git://github.com/frankmorgner/vsmartcard.git $(VSMARTCARD) - -$(VIRTUALSMARTCARD_CONFIGURE): $(VIRTUALSMARTCARD_CONFIGURE_AC) - cd $(VIRTUALSMARTCARD) && autoreconf --verbose --install --symlink diff --git a/npa/cross/opensc.conf_win32 b/npa/cross/opensc.conf_win32 deleted file mode 100644 index 41c0f2b..0000000 --- a/npa/cross/opensc.conf_win32 +++ /dev/null @@ -1,41 +0,0 @@ -app default { - - # What card drivers to load at start-up - # - # A special value of 'internal' will load all - # statically linked drivers. If an unknown (ie. not - # internal) driver is supplied, a separate configuration - # configuration block has to be written for the driver. - # Default: internal - # NOTE: When "internal" keyword is used, must be last entry - # - card_drivers = npa, internal; - - # Card driver configuration blocks. - # - # For card drivers loaded from an external shared library/DLL, - # you need to specify the path name of the module - # - card_driver npa { - # The location of the driver library - module = libcardnpa-0.dll; - } - - - # PKCS #15 - framework pkcs15 { - # additional settings per driver - # - # For pkcs15 emulators loaded from an external shared - # library/DLL, you need to specify the path name of the module - # and customize the card_atr example above correctly. - # - emulate npa { - # The location of the driver library - module = libpkcs15npa-0.dll; - - function = sc_pkcs15emu_npa_init_ex; - can = 222222; - } - } -} diff --git a/npa/doc/Doxyfile.in b/npa/doc/Doxyfile.in deleted file mode 100644 index 01da733..0000000 --- a/npa/doc/Doxyfile.in +++ /dev/null @@ -1,12 +0,0 @@ -FILE_PATTERNS = *.h -GENERATE_HTML = YES -GENERATE_LATEX = NO -GENERATE_TAGFILE = @builddir@/@PACKAGE@.tag -GENERATE_XML = YES -INPUT = @top_srcdir@/src/npa -OPTIMIZE_OUTPUT_FOR_C = YES -OUTPUT_DIRECTORY = @builddir@ -PROJECT_NAME = @PACKAGE_NAME@ -PROJECT_NUMBER = @PACKAGE_VERSION@ -STRIP_FROM_PATH = @top_srcdir@/src -XML_OUTPUT = xml diff --git a/npa/doc/Makefile.am b/npa/doc/Makefile.am deleted file mode 100644 index bf5942d..0000000 --- a/npa/doc/Makefile.am +++ /dev/null @@ -1,35 +0,0 @@ -do_subst = $(SED) \ - -e 's,[@]PACKAGE[@],$(PACKAGE),g' \ - -e 's,[@]PACKAGE_NAME[@],$(PACKAGE_NAME),g' \ - -e 's,[@]PACKAGE_TARNAME[@],$(PACKAGE_TARNAME),g' \ - -e 's,[@]PACKAGE_BUGREPORT[@],$(PACKAGE_BUGREPORT),g' \ - -e 's,[@]PACKAGE_URL[@],$(PACKAGE_URL),g' \ - -e 's,[@]PACKAGE_SUMMARY[@],$(PACKAGE_SUMMARY),g' \ - -e 's,[@]PACKAGE_VERSION[@],$(PACKAGE_VERSION),g' \ - -e 's,[@]RECOMMENDED_CONF_OPTS[@],,g' \ - -e 's,[@]builddir[@],$(builddir),g' \ - -e 's,[@]prefix[@],$(prefix),g' \ - -e 's,[@]exec_prefix[@],$(exec_prefix),g' \ - -e 's,[@]libdir[@],$(libdir),g' \ - -e 's,[@]includedir[@],$(includedir),g' \ - -e 's,[@]VERSION[@],$(VERSION),g' \ - -e 's,[@]OPENSC_LIBS[@],$(OPENSC_LIBS),g' \ - -e 's,[@]abs_top_srcdir[@],$(abs_top_srcdir),g' \ - -e 's,[@]top_srcdir[@],$(top_srcdir),g' - -EXTRA_DIST = README.txt.in README.txt Doxyfile.in example.c autotools.txt autotools.txt.in questions.txt questions.txt.in download.txt.in download.txt - -DOXYGEN = doxygen - -doc: $(top_srcdir)/src/npa/*.h *.in - $(do_subst) < Doxyfile.in > Doxyfile - $(DOXYGEN) Doxyfile - touch api.txt - $(do_subst) < autotools.txt.in > autotools.txt - $(do_subst) < questions.txt.in > questions.txt - $(do_subst) < download.txt.in > download.txt - $(do_subst) < README.txt.in > README.txt - touch doc - -clean-local: - rm -f doc Doxyfile diff --git a/npa/doc/README.txt b/npa/doc/README.txt deleted file mode 100644 index 47ada8f..0000000 --- a/npa/doc/README.txt +++ /dev/null @@ -1,253 +0,0 @@ -.. highlight:: sh - -.. |PACE| replace:: :abbr:`PACE (Password Authenticated Connection Establishment)` -.. |TA| replace:: :abbr:`TA (Terminal Authenticatation)` -.. |CA| replace:: :abbr:`CA (Chip Authentication)` -.. |EAC| replace:: :abbr:`EAC (Extended Access Control)` -.. |CSCA| replace:: :abbr:`CSCA (Country Signing Certificate Authority)` -.. |npa-tool| replace:: :command:`npa-tool` - -.. _libnpa: - -################################################################################ -nPA Smart Card Library -################################################################################ - -.. sidebar:: Summary - - Access the German electronic identity card (neuer Personalausweis/nPA) - - :Author: - `Frank Morgner `_ - :License: - GPL version 3 - :Tested Platforms: - - Windows - - Mac OS X - - Linux (Debian, Ubuntu, OpenMoko) - -The nPA Smart Card Library offers an easy to use API for the new German identity card -(neuer Personalausweis, nPA). The library also implements secure messaging, -which could also be used for other cards. The included |npa-tool| can -be used for PIN management or to send APDUs inside a secure channel. - -The nPA Smart Card Library is implemented using OpenPACE_ and OpenSC_. nPA Smart Card Library -implements and initializes Secure Messaging wrappers of OpenSC to allow a -transparent SM usage in OpenSC. This allows nPA Smart Card Library to be fully -compatible with OpenSC. - -.. tikz:: Architecture of the nPA Smart Card Library - :stringsubst: - :libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows - - \input{%(wd)s/bilder/tikzstyles.tex} - \node (npa-tool) [aktivbox] {\texttt{npa-tool}}; - \node (libnpa) [box, below=of npa-tool] {\texttt{libnpa}}; - \node (opensc) - [klein, box, shape=rectangle split, rectangle split parts=2, right=of libnpa, - kleiner, yshift=-1cm] - {OpenSC (\texttt{libopensc}) - \nodepart{second} - \footnotesize PC/SC\qquad CT-API - }; - \draw [box] ($(opensc.text split)-(.05cm,0)$) -- ($(opensc.south)-(.05cm,0)$); - \node (openpace) [klein, box, left=of libnpa, yshift=-1cm] {OpenPACE}; - - \begin{pgfonlayer}{background} - \path[linie] - (npa-tool) edge (libnpa) - (libnpa) edge (opensc) - (libnpa) edge (openpace); - \end{pgfonlayer} - -The nPA Smart Card Library has the following dependencies: - -- OpenPACE_ -- OpenSC_ -- OpenSSL_ - - -.. include:: download.txt - - -.. _npa-install: - -.. include:: autotools.txt - - -==================================== -Installation of OpenPACE and OpenSSL -==================================== - -The nPA Smart Card Library links against OpenSSL, which must be patched for OpenPACE. -Here is an example of how to get the standard installation of OpenPACE (with -the required binaries for OpenSSL):: - - PREFIX=/tmp/install - OPENPACE=$PWD/openpace - git clone https://github.com/frankmorgner/openpace.git $OPENPACE - cd $OPENPACE - autoreconf --verbose --install - # with `--enable-openssl-install` OpenSSL will be downloaded and installed along with OpenPACE - ./configure --enable-openssl-install --prefix=$PREFIX - make install && cd - - -The file :file:`libcrypto.pc` should be located in ``$INSTALL/lib/pkgconfig``. - - -====================== -Installation of OpenSC -====================== - -The nPA Smart Card Library needs the OpenSC components to be installed (especially -:file:`libopensc.so`). Here is an example of how to get a suitable installation -of OpenSC:: - - VSMARTCARD=$PWD/vsmartcard - git clone https://github.com/frankmorgner/vsmartcard.git $VSMARTCARD - cd $VSMARTCARD - git submodule init - git submodule update - cd $VSMARTCARD/npa/src/opensc - autoreconf --verbose --install - # adding PKG_CONFIG_PATH here lets OpenSC use the patched OpenSSL - ./configure --prefix=$PREFIX PKG_CONFIG_PATH=$PREFIX/lib/pkgconfig --enable-sm - make install && cd - - -Now :file:`libopensc.so` should be located in ``$PREFIX/lib``. - - -================================================================================ -Installation of the nPA Smart Card Library -================================================================================ - -To complete this step-by-step guide, here is how to install nPA Smart Card Library:: - - cd $VSMARTCARD/npa - autoreconf --verbose --install - ./configure --prefix=$PREFIX PKG_CONFIG_PATH=$PREFIX/lib/pkgconfig OPENSC_LIBS="-L$PREFIX/lib -lopensc -lcrypto" - make install && cd - - - - -.. _npa-usage: - -******************************************************************************** -Using the nPA Smart Card Library -******************************************************************************** - -The API to libnpa is documented in :ref:`npa-api`. It includes a simple -programming example. Here we will focus on the command line interface to the -library offered by the |npa-tool|. It can perform |EAC| (i.e. |PACE|, |TA|, -|CA|) and read data groups from the identity card. - -To pass a secret to |npa-tool| for |PACE|, command line parameters or -environment variables can be used. If the smart card reader supports |PACE|, -its PIN pad is used. If none of these options apply, |npa-tool| will show a -password prompt. - -The certificates certificate chain for |TA| should be passed in the correct -order (finishing with the terminal certificate) so that the card can verify it. -|CA| is always done when the terminal's signature has been verified -successfully. The appropriate |CSCA| certificate will automatically be looked -up by OpenPACE. - -|npa-tool| can send arbitrary APDUs to the nPA in the secure channel (after -|PACE| or |EAC|). APDUs are entered interactively or through a file. APDUs -are formatted in hex (upper or lower case) with an optional colon to separate -the bytes. Example APDUs can be found in :file:`apdus`. - -.. program-output:: npa-tool --help - - -====================== -Linking against libnpa -====================== - -Following the section Installation_ above, you have installed OpenSSL, -OpenPACE, OpenSC and the nPA Smart Card Library to `$PREFIX` which points to -:file:`/tmp/install`. To compile a program using nPA Smart Card Library you also need -the OpenSC header files, which are located in -:file:`$VSMARTCARD/npa/src/opensc` Here is how to compile an external program -with these libraries:: - - PKG_CONFIG_PATH=$PREFIX/lib/pkgconfig - cc example.c -I$VSMARTCARD/npa/src/opensc \ - $(pkg-config --cflags --libs npa) - -Alternatively you can specify libraries and flags by hand:: - - cc example.c -I$VSMARTCARD/npa/src/opensc \ - -I$PREFIX/include \ - -L$PREFIX/lib -lnpa -lopensc -lcrypto" - - -******************************************************************************** -Using the German identity card with OpenSC -******************************************************************************** - -.. versionadded:: 0.6 - Added external card driver and PKCS#15 emulator for supporting nPA in - OpenSC. - -To let OpenSC recognize the German ID card we implemented an external card -driver. We supply a sample :file:`opensc.conf` which adds our driver to all -components of OpenSC. Load it by setting :envvar:`OPENSC_CONF`:: - - export OPENSC_CONF=$VSMARTCARD/npa/opensc.conf - -On Windows you need to use :command:`set` instead of :command:`export`. In -:file:`npa-0.7_win32` do the following:: - - cd bin - set OPENSC_CONF=..\etc\opensc.conf - -The card driver recognizes the PIN verification method by it's ID. MRZ, CAN, -eID-PIN and PUK are verified using |PACE| (ID ``0x01``, ``0x02``, ``0x03`` and -``0x04``). The eSign PIN (ID ``0x83``) is verified using a standard ISO-7816-4 -VERIFY command. Here, for example, we show how to verify the eID-PIN "123456" -with :command:`opensc-explorer`:: - - opensc-explorer - OpenSC [3F00]> verify CHV3 313233343536 - Code correct. - -When the eID-PIN was verified incorrectly three times, it is blocked and must -be unblocked with the PUK. But unlike traditional cards the German ID card does -suspend the eID-PIN after the second try of verification. To unlock the last -retry, the CAN is required. Since the suspended state is not captured by -OpenSC we handle it transparently within the driver. If the eID-PIN shall be -verified and it is suspended, the card driver will verify the CAN first. If no -CAN is given in :file:`opensc.conf`, the driver will request it on the standard -input. You can use |npa-tool| to unblock or resume the eID-PIN. - -The German ID card is capable of creating a qualified electronic signature. -Therefor, the card must be initialized by a trust center with the user's -consent. Today this means, that the user need to register for `sign-me`_. The -process also initializes the QES-PIN, which unlocks the signature key. An -intializesed card can be used for electronic signature, with a Comfort Reader -(KAT-K) [#footnote1]_ that authenticates as signature terminal to the card. -Below, you can see two examples how to create a signature:: - - # SHA256_FILE is set to a file of 32 bytes length - # QES PIN will be prompted by the reader - pkcs15-crypt --sign --sha-256 --input $SHA256_FILE - pkcs11-tool --module opensc-pkcs11.so --sign --input-file $SHA256_FILE - - -.. include:: questions.txt - - -******************** -Notes and References -******************** - -.. target-notes:: - -.. _OpenPACE: https://frankmorgner.github.io/openpace/ -.. _OpenSC: https://github.com/OpenSC/OpenSC -.. _OpenSSL: http://www.openssl.org -.. _sign-me: https://www.bundesdruckerei.de/en/798-sign-me -.. _BSI TR-03119: https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03119/BSI-TR-03119_V1_pdf.pdf -.. _Reiner SCT cyberJack RFID komfort: http://www.reiner-sct.com/produkte/chipkartenleser/cyberJack_RFID_komfort.html -.. [#footnote1] A Comfort Reader is defined by `BSI TR-03119`_. Today the `Reiner SCT cyberJack RFID komfort`_ is the only reader that supports this configuration. diff --git a/npa/doc/README.txt.in b/npa/doc/README.txt.in deleted file mode 100644 index 2915785..0000000 --- a/npa/doc/README.txt.in +++ /dev/null @@ -1,253 +0,0 @@ -.. highlight:: sh - -.. |PACE| replace:: :abbr:`PACE (Password Authenticated Connection Establishment)` -.. |TA| replace:: :abbr:`TA (Terminal Authenticatation)` -.. |CA| replace:: :abbr:`CA (Chip Authentication)` -.. |EAC| replace:: :abbr:`EAC (Extended Access Control)` -.. |CSCA| replace:: :abbr:`CSCA (Country Signing Certificate Authority)` -.. |npa-tool| replace:: :command:`npa-tool` - -.. _libnpa: - -################################################################################ -@PACKAGE_NAME@ -################################################################################ - -.. sidebar:: Summary - - @PACKAGE_SUMMARY@ - - :Author: - `Frank Morgner `_ - :License: - GPL version 3 - :Tested Platforms: - - Windows - - Mac OS X - - Linux (Debian, Ubuntu, OpenMoko) - -The @PACKAGE_NAME@ offers an easy to use API for the new German identity card -(neuer Personalausweis, nPA). The library also implements secure messaging, -which could also be used for other cards. The included |npa-tool| can -be used for PIN management or to send APDUs inside a secure channel. - -The @PACKAGE_NAME@ is implemented using OpenPACE_ and OpenSC_. @PACKAGE_NAME@ -implements and initializes Secure Messaging wrappers of OpenSC to allow a -transparent SM usage in OpenSC. This allows @PACKAGE_NAME@ to be fully -compatible with OpenSC. - -.. tikz:: Architecture of the @PACKAGE_NAME@ - :stringsubst: - :libs: arrows, calc, fit, patterns, plotmarks, shapes.geometric, shapes.misc, shapes.symbols, shapes.arrows, shapes.callouts, shapes.multipart, shapes.gates.logic.US, shapes.gates.logic.IEC, er, automata, backgrounds, chains, topaths, trees, petri, mindmap, matrix, calendar, folding, fadings, through, positioning, scopes, decorations.fractals, decorations.shapes, decorations.text, decorations.pathmorphing, decorations.pathreplacing, decorations.footprints, decorations.markings, shadows - - \input{%(wd)s/bilder/tikzstyles.tex} - \node (npa-tool) [aktivbox] {\texttt{npa-tool}}; - \node (libnpa) [box, below=of npa-tool] {\texttt{libnpa}}; - \node (opensc) - [klein, box, shape=rectangle split, rectangle split parts=2, right=of libnpa, - kleiner, yshift=-1cm] - {OpenSC (\texttt{libopensc}) - \nodepart{second} - \footnotesize PC/SC\qquad CT-API - }; - \draw [box] ($(opensc.text split)-(.05cm,0)$) -- ($(opensc.south)-(.05cm,0)$); - \node (openpace) [klein, box, left=of libnpa, yshift=-1cm] {OpenPACE}; - - \begin{pgfonlayer}{background} - \path[linie] - (npa-tool) edge (libnpa) - (libnpa) edge (opensc) - (libnpa) edge (openpace); - \end{pgfonlayer} - -The @PACKAGE_NAME@ has the following dependencies: - -- OpenPACE_ -- OpenSC_ -- OpenSSL_ - - -.. include:: download.txt - - -.. _npa-install: - -.. include:: autotools.txt - - -==================================== -Installation of OpenPACE and OpenSSL -==================================== - -The @PACKAGE_NAME@ links against OpenSSL, which must be patched for OpenPACE. -Here is an example of how to get the standard installation of OpenPACE (with -the required binaries for OpenSSL):: - - PREFIX=/tmp/install - OPENPACE=$PWD/openpace - git clone https://github.com/frankmorgner/openpace.git $OPENPACE - cd $OPENPACE - autoreconf --verbose --install - # with `--enable-openssl-install` OpenSSL will be downloaded and installed along with OpenPACE - ./configure --enable-openssl-install --prefix=$PREFIX - make install && cd - - -The file :file:`libcrypto.pc` should be located in ``$INSTALL/lib/pkgconfig``. - - -====================== -Installation of OpenSC -====================== - -The @PACKAGE_NAME@ needs the OpenSC components to be installed (especially -:file:`libopensc.so`). Here is an example of how to get a suitable installation -of OpenSC:: - - VSMARTCARD=$PWD/vsmartcard - git clone https://github.com/frankmorgner/vsmartcard.git $VSMARTCARD - cd $VSMARTCARD - git submodule init - git submodule update - cd $VSMARTCARD/npa/src/opensc - autoreconf --verbose --install - # adding PKG_CONFIG_PATH here lets OpenSC use the patched OpenSSL - ./configure --prefix=$PREFIX PKG_CONFIG_PATH=$PREFIX/lib/pkgconfig --enable-sm - make install && cd - - -Now :file:`libopensc.so` should be located in ``$PREFIX/lib``. - - -================================================================================ -Installation of the @PACKAGE_NAME@ -================================================================================ - -To complete this step-by-step guide, here is how to install @PACKAGE_NAME@:: - - cd $VSMARTCARD/npa - autoreconf --verbose --install - ./configure --prefix=$PREFIX PKG_CONFIG_PATH=$PREFIX/lib/pkgconfig OPENSC_LIBS="-L$PREFIX/lib -lopensc -lcrypto" - make install && cd - - - - -.. _npa-usage: - -******************************************************************************** -Using the @PACKAGE_NAME@ -******************************************************************************** - -The API to libnpa is documented in :ref:`npa-api`. It includes a simple -programming example. Here we will focus on the command line interface to the -library offered by the |npa-tool|. It can perform |EAC| (i.e. |PACE|, |TA|, -|CA|) and read data groups from the identity card. - -To pass a secret to |npa-tool| for |PACE|, command line parameters or -environment variables can be used. If the smart card reader supports |PACE|, -its PIN pad is used. If none of these options apply, |npa-tool| will show a -password prompt. - -The certificates certificate chain for |TA| should be passed in the correct -order (finishing with the terminal certificate) so that the card can verify it. -|CA| is always done when the terminal's signature has been verified -successfully. The appropriate |CSCA| certificate will automatically be looked -up by OpenPACE. - -|npa-tool| can send arbitrary APDUs to the nPA in the secure channel (after -|PACE| or |EAC|). APDUs are entered interactively or through a file. APDUs -are formatted in hex (upper or lower case) with an optional colon to separate -the bytes. Example APDUs can be found in :file:`apdus`. - -.. program-output:: npa-tool --help - - -====================== -Linking against libnpa -====================== - -Following the section Installation_ above, you have installed OpenSSL, -OpenPACE, OpenSC and the @PACKAGE_NAME@ to `$PREFIX` which points to -:file:`/tmp/install`. To compile a program using @PACKAGE_NAME@ you also need -the OpenSC header files, which are located in -:file:`$VSMARTCARD/npa/src/opensc` Here is how to compile an external program -with these libraries:: - - PKG_CONFIG_PATH=$PREFIX/lib/pkgconfig - cc example.c -I$VSMARTCARD/npa/src/opensc \ - $(pkg-config --cflags --libs npa) - -Alternatively you can specify libraries and flags by hand:: - - cc example.c -I$VSMARTCARD/npa/src/opensc \ - -I$PREFIX/include \ - -L$PREFIX/lib -lnpa -lopensc -lcrypto" - - -******************************************************************************** -Using the German identity card with OpenSC -******************************************************************************** - -.. versionadded:: 0.6 - Added external card driver and PKCS#15 emulator for supporting nPA in - OpenSC. - -To let OpenSC recognize the German ID card we implemented an external card -driver. We supply a sample :file:`opensc.conf` which adds our driver to all -components of OpenSC. Load it by setting :envvar:`OPENSC_CONF`:: - - export OPENSC_CONF=$VSMARTCARD/npa/opensc.conf - -On Windows you need to use :command:`set` instead of :command:`export`. In -:file:`@PACKAGE_TARNAME@-@PACKAGE_VERSION@_win32` do the following:: - - cd bin - set OPENSC_CONF=..\etc\opensc.conf - -The card driver recognizes the PIN verification method by it's ID. MRZ, CAN, -eID-PIN and PUK are verified using |PACE| (ID ``0x01``, ``0x02``, ``0x03`` and -``0x04``). The eSign PIN (ID ``0x83``) is verified using a standard ISO-7816-4 -VERIFY command. Here, for example, we show how to verify the eID-PIN "123456" -with :command:`opensc-explorer`:: - - opensc-explorer - OpenSC [3F00]> verify CHV3 313233343536 - Code correct. - -When the eID-PIN was verified incorrectly three times, it is blocked and must -be unblocked with the PUK. But unlike traditional cards the German ID card does -suspend the eID-PIN after the second try of verification. To unlock the last -retry, the CAN is required. Since the suspended state is not captured by -OpenSC we handle it transparently within the driver. If the eID-PIN shall be -verified and it is suspended, the card driver will verify the CAN first. If no -CAN is given in :file:`opensc.conf`, the driver will request it on the standard -input. You can use |npa-tool| to unblock or resume the eID-PIN. - -The German ID card is capable of creating a qualified electronic signature. -Therefor, the card must be initialized by a trust center with the user's -consent. Today this means, that the user need to register for `sign-me`_. The -process also initializes the QES-PIN, which unlocks the signature key. An -intializesed card can be used for electronic signature, with a Comfort Reader -(KAT-K) [#footnote1]_ that authenticates as signature terminal to the card. -Below, you can see two examples how to create a signature:: - - # SHA256_FILE is set to a file of 32 bytes length - # QES PIN will be prompted by the reader - pkcs15-crypt --sign --sha-256 --input $SHA256_FILE - pkcs11-tool --module opensc-pkcs11.so --sign --input-file $SHA256_FILE - - -.. include:: questions.txt - - -******************** -Notes and References -******************** - -.. target-notes:: - -.. _OpenPACE: https://frankmorgner.github.io/openpace/ -.. _OpenSC: https://github.com/OpenSC/OpenSC -.. _OpenSSL: http://www.openssl.org -.. _sign-me: https://www.bundesdruckerei.de/en/798-sign-me -.. _BSI TR-03119: https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03119/BSI-TR-03119_V1_pdf.pdf -.. _Reiner SCT cyberJack RFID komfort: http://www.reiner-sct.com/produkte/chipkartenleser/cyberJack_RFID_komfort.html -.. [#footnote1] A Comfort Reader is defined by `BSI TR-03119`_. Today the `Reiner SCT cyberJack RFID komfort`_ is the only reader that supports this configuration. diff --git a/npa/doc/api.txt b/npa/doc/api.txt deleted file mode 100644 index e0568f6..0000000 --- a/npa/doc/api.txt +++ /dev/null @@ -1,87 +0,0 @@ -.. highlight:: c - -.. _npa-api: - -******************************** -Programming with the nPA Library -******************************** - -The nPA library includes a generic implementation for Secure Messaging (SM), -which might also be used in conjunction with other cards. It is implemented to -be close to ISO 7816 focusing only on encoding rather than implementing -everything that is needed to get a secure channel. All cryptographic work is -done by call back functions, which should be appropriatly set for the specific -card. - -Using the German identity card (neuer Personalausweis, nPA) requires user -authentication via entry of the PIN. Transmitting the PIN in plaintext is -risky, since it would be transmitted over the air and could be snooped. That's -why the PACE keyagreement is used to verify the PIN and establish an SM channel -to the nPA. :npa:`perform_pace` does exactly that and if everything went fine, -it initializes the card for use of the SM channel. Now `sc_transmit_apdu` or -any other OpenSC command can be used to securely transmit arbitrary APDUs to -the card. Next in the Extended Access Control (EAC) are the Terminal -Authentication (:npa:`perform_terminal_authentication`) and Chip Authentication -(:npa:`perform_chip_authentication`). When the EAC was successfull, the card -will be initialized for the new SM channel. Again, libopensc can directly be -used to read identity attributes, for example. - -.. note:: - Please consider the following overview to the API as incomplete. The - `Doxygen documentation <../_static/doxygen-npa/modules.html>`_ should be - used as programmer's reference. - - -============================================================== -Interface to German identity card (neuer Personalausweis, nPA) -============================================================== - -.. seealso:: - `Doxygen documentation of the nPA module - <../_static/doxygen-npa/group__npa.html>`__. - ---------- -Functions ---------- -.. doxygenfunction:: perform_pace -.. doxygenfunction:: perform_terminal_authentication -.. doxygenfunction:: perform_chip_authentication -.. doxygenfunction:: npa_reset_retry_counter - -------- -Defines -------- -.. doxygendefine:: npa_change_pin -.. doxygendefine:: npa_unblock_pin - - -======= -Example -======= - -In order to compile and execute this example you need to correctly :ref:`set up -your environment `. - -.. literalinclude:: example.c - :lines: 20- - - -====================================== -Generic ISO 7816 Secure Messaging (SM) -====================================== - -.. seealso:: - `Doxygen documentation of the SM module - <../_static/doxygen-npa/group__sm.html>`__. - ------ -Types ------ -.. doxygenstruct:: iso_sm_ctx - ---------- -Functions ---------- -.. doxygenfunction:: iso_sm_ctx_create -.. doxygenfunction:: iso_sm_ctx_clear_free -.. doxygenfunction:: iso_sm_start diff --git a/npa/doc/autotools.txt b/npa/doc/autotools.txt deleted file mode 100644 index 25b430e..0000000 --- a/npa/doc/autotools.txt +++ /dev/null @@ -1,25 +0,0 @@ -.. highlight:: sh - -************ -Installation -************ - - -======================================= -Installation on Linux, Unix and similar -======================================= - -The nPA Smart Card Library uses the GNU Build System to compile and install. If you are -unfamiliar with it, please have a look at :file:`INSTALL`. If you can not find -it, you are probably working bleeding edge in the repository. Run the -following command in :file:`npa` to get the missing standard -auxiliary files:: - - autoreconf --verbose --install - -To configure (:command:`configure --help` lists possible options), build and -install the nPA Smart Card Library now do the following:: - - ./configure - make - make install diff --git a/npa/doc/autotools.txt.in b/npa/doc/autotools.txt.in deleted file mode 120000 index 25e76b8..0000000 --- a/npa/doc/autotools.txt.in +++ /dev/null @@ -1 +0,0 @@ -../../doc/autotools.txt.in \ No newline at end of file diff --git a/npa/doc/download.txt b/npa/doc/download.txt deleted file mode 100644 index 7f768e6..0000000 --- a/npa/doc/download.txt +++ /dev/null @@ -1,14 +0,0 @@ -.. highlight:: sh - -******** -Download -******** - -You can find the latest release of nPA Smart Card Library on `Github -`_. Older releases are -still available on `Sourceforge -`_. - -Alternatively, you can clone our git repository:: - - git clone https://github.com/frankmorgner/vsmartcard.git diff --git a/npa/doc/download.txt.in b/npa/doc/download.txt.in deleted file mode 120000 index 8ac884d..0000000 --- a/npa/doc/download.txt.in +++ /dev/null @@ -1 +0,0 @@ -../../doc/download.txt.in \ No newline at end of file diff --git a/npa/doc/example.c b/npa/doc/example.c deleted file mode 120000 index f475e86..0000000 --- a/npa/doc/example.c +++ /dev/null @@ -1 +0,0 @@ -../src/example.c \ No newline at end of file diff --git a/npa/doc/questions.txt b/npa/doc/questions.txt deleted file mode 100644 index b31d0be..0000000 --- a/npa/doc/questions.txt +++ /dev/null @@ -1,6 +0,0 @@ -******** -Question -******** - -Do you have questions, suggestions or contributions? Feedback of any kind is -more than welcome! Please use our `project trackers `_. diff --git a/npa/doc/questions.txt.in b/npa/doc/questions.txt.in deleted file mode 120000 index 1859aeb..0000000 --- a/npa/doc/questions.txt.in +++ /dev/null @@ -1 +0,0 @@ -../../doc/questions.txt.in \ No newline at end of file diff --git a/npa/libnpa.pc.in b/npa/libnpa.pc.in deleted file mode 100644 index 1f27108..0000000 --- a/npa/libnpa.pc.in +++ /dev/null @@ -1,11 +0,0 @@ -prefix=@prefix@ -exec_prefix=@exec_prefix@ -libdir=@libdir@ -includedir=@includedir@ - -Name: @PACKAGE_NAME@ -Description: @PACKAGE_SUMMARY@ -Version: @VERSION@ -Requires: libeac -Libs: -L${libdir} -lnpa @OPENSC_LIBS@ -Cflags: -I${includedir} diff --git a/npa/m4/.gitignore b/npa/m4/.gitignore deleted file mode 100644 index 5e7d273..0000000 --- a/npa/m4/.gitignore +++ /dev/null @@ -1,4 +0,0 @@ -# Ignore everything in this directory -* -# Except this file -!.gitignore diff --git a/npa/m4/Makefile.am b/npa/m4/Makefile.am deleted file mode 100644 index 723cd40..0000000 --- a/npa/m4/Makefile.am +++ /dev/null @@ -1 +0,0 @@ -# Process this file with automake to create Makefile.in diff --git a/npa/npa-example-data b/npa/npa-example-data deleted file mode 120000 index 3f4d198..0000000 --- a/npa/npa-example-data +++ /dev/null @@ -1 +0,0 @@ -../virtualsmartcard/npa-example-data \ No newline at end of file diff --git a/npa/opensc.conf.in b/npa/opensc.conf.in deleted file mode 100644 index c099d13..0000000 --- a/npa/opensc.conf.in +++ /dev/null @@ -1,40 +0,0 @@ -app default { - - # What card drivers to load at start-up - # - # A special value of 'internal' will load all - # statically linked drivers. If an unknown (ie. not - # internal) driver is supplied, a separate configuration - # configuration block has to be written for the driver. - # Default: internal - # NOTE: When "internal" keyword is used, must be last entry - # - card_drivers = npa, internal; - - # Card driver configuration blocks. - # - # For card drivers loaded from an external shared library/DLL, - # you need to specify the path name of the module - # - card_driver npa { - # The location of the driver library - module = @libdir@/libcardnpa.@DYN_LIB_EXT@; - - # German ID card requires the CAN to be verified before QES PIN. This, - # however, is not part of the PKCS#15 profile of the card. So for - # verifying the PIN we actually need both. The CAN may be given here. - # If the CAN is not given here, it will be prompted on the command line - # or on the reader. - can = 222222; - - # QES is only possible with a Comfort Reader (CAT-K), which holds a - # cryptographic key to authenticate itself as signature terminal (ST). - # We usually will use the reader's capability to sign the data. - # However, during developement you may specify soft certificates and - # keys for a ST below. - # The following example EAC PKI can be found in npa-example-data - st_dv_certificate = ZZSTDVCA00001.cvcert; - st_certificate = ZZSTTERM00001.cvcert; - st_key = ZZSTTERM00001.pkcs8; - } -} diff --git a/npa/src/Makefile.am b/npa/src/Makefile.am deleted file mode 100644 index e1779ad..0000000 --- a/npa/src/Makefile.am +++ /dev/null @@ -1,71 +0,0 @@ -do_subst = $(SED) \ - -e 's,[@]CVCDIR[@],$(CVCDIR),g' \ - -e 's,[@]PACKAGE[@],$(PACKAGE),g' \ - -e 's,[@]PACKAGE_BUGREPORT[@],$(PACKAGE_BUGREPORT),g' \ - -e 's,[@]PACKAGE_NAME[@],$(PACKAGE_NAME),g' \ - -e 's,[@]PACKAGE_TARNAME[@],$(PACKAGE_TARNAME),g' \ - -e 's,[@]PACKAGE_URL[@],$(PACKAGE_URL),g' \ - -e 's,[@]PACKAGE_SUMMARY[@],$(PACKAGE_SUMMARY),g' \ - -e 's,[@]PACKAGE_VERSION[@],"$(PACKAGE_VERSION)",g' \ - -e 's,[@]X509DIR[@],$(X509DIR),g' - -BUILT_SOURCES = cmdline.h cmdline.c - -EXTRA_DIST = npa-tool.ggo npa-tool.ggo.in opensc/src/common/simclist.c opensc/src/libopensc/apdu.c opensc/src/libopensc/card.c -EXTRA_DIST += $(shell find -L $(top_srcdir)/src/opensc/src -path '*/.git' -prune -o -type f -a -name '*.h' -print) -MAINTAINERCLEANFILES = $(BUILT_SOURCES) npa-tool.ggo $(dist_man1_MANS) - -dist_man1_MANS = $(builddir)/npa-tool.1 - -libnpa_la_SOURCES = iso-sm.c scutil.c npa.c boxing.c -libnpa_la_LIBADD = $(OPENSC_LIBS) $(OPENPACE_LIBS) $(OPENSSL_LIBS) -libnpa_la_CFLAGS = $(OPENSSL_CFLAGS) $(OPENPACE_CFLAGS) $(OPENSC_CFLAGS) -libnpa_la_LDFLAGS = -no-undefined - -libcardnpa_la_SOURCES = card-npa.c -libcardnpa_la_LIBADD = $(OPENSC_LIBS) $(OPENPACE_LIBS) libnpa.la -libcardnpa_la_CFLAGS = $(OPENSSL_CFLAGS) $(OPENPACE_CFLAGS) $(OPENSC_CFLAGS) -libcardnpa_la_LDFLAGS = -no-undefined - -npa_tool_SOURCES = npa-tool.c $(BUILT_SOURCES) -npa_tool_LDADD = libnpa.la $(OPENSC_LIBS) $(OPENPACE_LIBS) $(OPENSSL_LIBS) -npa_tool_CFLAGS = $(OPENSSL_CFLAGS) $(OPENPACE_CFLAGS) $(OPENSC_CFLAGS) - -example_SOURCES = example.c -example_LDADD = $(OPENSSL_LIBS) $(OPENPACE_LIBS) $(OPENSC_LIBS) libnpa.la -example_CFLAGS = $(OPENSSL_CFLAGS) $(OPENPACE_CFLAGS) $(OPENSC_CFLAGS) - - -npa-tool.c: $(BUILT_SOURCES) - -$(BUILT_SOURCES): npa-tool.ggo - $(GENGETOPT) --output-dir=$(srcdir) < $< - -npa-tool.ggo: npa-tool.ggo.in - $(do_subst) < $< > $(srcdir)/$@ - - -npa-tool.1: npa-tool.ggo.in - $(HELP2MAN) \ - --output=$@ \ - --no-info \ - --source='$(PACKAGE_STRING)' \ - $(builddir)/npa-tool - - -bin_PROGRAMS = npa-tool -noinst_PROGRAMS = example - -lib_LTLIBRARIES = libnpa.la libcardnpa.la - -noinst_HEADERS = \ - sslutil.h \ - card-npa.h \ - iso-sm-internal.h \ - ccid-types.h - -nobase_include_HEADERS = \ - npa/iso-sm.h \ - npa/npa.h \ - npa/boxing.h \ - npa/scutil.h diff --git a/npa/src/boxing.c b/npa/src/boxing.c deleted file mode 100644 index 5f7f26f..0000000 --- a/npa/src/boxing.c +++ /dev/null @@ -1,996 +0,0 @@ -/* - * boxing.c: implementation related to boxing commands with pseudo APDUs - * - * Copyright (C) 2013 Frank Morgner - * - * This file is part of libnpa. - * - * libnpa is free software: you can redistribute it and/or modify it under the - * terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * libnpa is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. - * - * You should have received a copy of the GNU General Public License along with - * libnpa. If not, see . - */ - -#include "ccid-types.h" -#include -#include -#include -#include -#include -#include -#include -#include - -#if _WIN32 -/* FIXME might not always work */ -#define htole16(x) (x) -#define htole32(x) (x) -#elif __APPLE__ -#include -#define htole16(x) OSSwapHostToLittleInt16(x) -#define htole32(x) OSSwapHostToLittleInt32(x) -#else -#ifndef _BSD_SOURCE -#define _BSD_SOURCE /* See feature_test_macros(7) */ -#endif -#include -#endif - -static const u8 boxing_cla = 0xff; -static const u8 boxing_ins = 0x9a; -static const u8 boxing_p1 = 0x04; -static const u8 boxing_p2_GetReaderPACECapabilities = 0x01; -static const u8 boxing_p2_EstablishPACEChannel = 0x02; -static const u8 boxing_p2_DestroyPACEChannel = 0x03; -static const u8 boxing_p2_PC_to_RDR_Secure = 0x10; - -struct sc_asn1_entry g_boolean[] = { - { "boolean", - SC_ASN1_BOOLEAN, SC_ASN1_TAG_BOOLEAN, 0, NULL, NULL }, - { NULL , 0 , 0 , 0 , NULL , NULL } -}; -struct sc_asn1_entry g_int_as_octet_string[] = { - { "int as octet string", - SC_ASN1_OCTET_STRING, SC_ASN1_TAG_INTEGER, 0, NULL, NULL }, - { NULL , 0 , 0 , 0 , NULL , NULL } -}; -struct sc_asn1_entry g_octet_string[] = { - { "octet string", - SC_ASN1_OCTET_STRING, SC_ASN1_TAG_OCTET_STRING, SC_ASN1_ALLOC, NULL, NULL }, - { NULL , 0 , 0 , 0 , NULL , NULL } -}; -struct sc_asn1_entry g_numeric_string_as_octet_string[] = { - { "utf8string", - SC_ASN1_OCTET_STRING, SC_ASN1_TAG_NUMERICSTRING, SC_ASN1_ALLOC, NULL, NULL }, - { NULL , 0 , 0 , 0 , NULL , NULL } -}; - -static const struct sc_asn1_entry g_EstablishPACEChannelInput_data[] = { - { "passwordID", - /* use an OCTET STRING to avoid a conversion to int */ - SC_ASN1_STRUCT, SC_ASN1_CTX|0x01|SC_ASN1_CONS, 0, NULL, NULL }, - { "transmittedPassword", - SC_ASN1_STRUCT, SC_ASN1_CTX|0x02|SC_ASN1_CONS, SC_ASN1_OPTIONAL|SC_ASN1_ALLOC, NULL, NULL }, - { "cHAT", - SC_ASN1_STRUCT, SC_ASN1_CTX|0x03|SC_ASN1_CONS, SC_ASN1_OPTIONAL|SC_ASN1_ALLOC, NULL, NULL }, - { "certificateDescription", - SC_ASN1_OCTET_STRING, SC_ASN1_CTX|0x04|SC_ASN1_CONS, SC_ASN1_OPTIONAL|SC_ASN1_ALLOC, NULL, NULL }, - { "hashOID", - /* use an OCTET STRING to avoid a conversion to struct sc_object_id */ - SC_ASN1_STRUCT, SC_ASN1_CTX|0x05|SC_ASN1_CONS, SC_ASN1_OPTIONAL|SC_ASN1_ALLOC, NULL, NULL }, - { NULL , 0 , 0 , 0 , NULL , NULL } -}; -static const struct sc_asn1_entry g_EstablishPACEChannelOutput_data[] = { - { "errorCode", - SC_ASN1_STRUCT, SC_ASN1_CTX|0x01|SC_ASN1_CONS, 0, NULL, NULL }, - { "statusMSESetAT", - SC_ASN1_STRUCT, SC_ASN1_CTX|0x02|SC_ASN1_CONS, 0, NULL, NULL }, - { "efCardAccess", - SC_ASN1_OCTET_STRING, SC_ASN1_CTX|0x03|SC_ASN1_CONS, SC_ASN1_ALLOC, NULL, NULL }, - { "idPICC", - SC_ASN1_STRUCT, SC_ASN1_CTX|0x04|SC_ASN1_CONS, SC_ASN1_OPTIONAL|SC_ASN1_ALLOC, NULL, NULL }, - { "curCAR", - SC_ASN1_STRUCT, SC_ASN1_CTX|0x05|SC_ASN1_CONS, SC_ASN1_OPTIONAL|SC_ASN1_ALLOC, NULL, NULL }, - { "prevCAR", - SC_ASN1_STRUCT, SC_ASN1_CTX|0x06|SC_ASN1_CONS, SC_ASN1_OPTIONAL|SC_ASN1_ALLOC, NULL, NULL }, - { NULL , 0 , 0 , 0 , NULL , NULL } -}; -static const struct sc_asn1_entry g_EstablishPACEChannel[] = { - { "EstablishPACEChannel", - SC_ASN1_STRUCT, SC_ASN1_TAG_SEQUENCE|SC_ASN1_CONS, 0, NULL, NULL }, - { NULL , 0 , 0 , 0 , NULL , NULL } -}; - -int boxing_pace_input_to_buf(sc_context_t *ctx, - const struct establish_pace_channel_input *input, - unsigned char **asn1, size_t *asn1_len) -{ - size_t pin_id_len = sizeof input->pin_id; - struct sc_asn1_entry EstablishPACEChannelInput_data[ - sizeof g_EstablishPACEChannelInput_data/ - sizeof *g_EstablishPACEChannelInput_data]; - struct sc_asn1_entry EstablishPACEChannel[ - sizeof g_EstablishPACEChannel/ - sizeof *g_EstablishPACEChannel]; - struct sc_asn1_entry passwordID[ - sizeof g_int_as_octet_string/ - sizeof *g_int_as_octet_string]; - struct sc_asn1_entry transmittedPassword[ - sizeof g_numeric_string_as_octet_string/ - sizeof *g_numeric_string_as_octet_string]; - struct sc_asn1_entry cHAT[ - sizeof g_octet_string/ - sizeof *g_octet_string]; - - sc_copy_asn1_entry(g_EstablishPACEChannel, - EstablishPACEChannel); - sc_format_asn1_entry(EstablishPACEChannel, - EstablishPACEChannelInput_data, 0, 1); - - sc_copy_asn1_entry(g_EstablishPACEChannelInput_data, - EstablishPACEChannelInput_data); - - sc_format_asn1_entry(EstablishPACEChannelInput_data+0, - passwordID, 0, 1); - sc_copy_asn1_entry(g_int_as_octet_string, - passwordID); - sc_format_asn1_entry(passwordID, - (unsigned char *) &input->pin_id, &pin_id_len, 1); - - if (input->pin) { - sc_format_asn1_entry(EstablishPACEChannelInput_data+1, - transmittedPassword, - 0, 1); - sc_copy_asn1_entry(g_numeric_string_as_octet_string, - transmittedPassword); - sc_format_asn1_entry(transmittedPassword, - (unsigned char *) input->pin, - (size_t *) &input->pin_length, 1); - } - - if (input->chat) { - sc_format_asn1_entry(EstablishPACEChannelInput_data+2, - cHAT, - 0, 1); - sc_copy_asn1_entry(g_octet_string, - cHAT); - sc_format_asn1_entry(cHAT, - (unsigned char *) input->chat, - (size_t *) &input->chat_length, 1); - } - - if (input->certificate_description) { - sc_format_asn1_entry(EstablishPACEChannelInput_data+3, - (unsigned char *) input->certificate_description, - (size_t *) &input->certificate_description_length, 1); - } - - return sc_asn1_encode(ctx, EstablishPACEChannel, asn1, asn1_len); -} - -int boxing_buf_to_pace_input(sc_context_t *ctx, - const unsigned char *asn1, size_t asn1_len, - struct establish_pace_channel_input *input) -{ - size_t pin_id_len = sizeof input->pin_id; - struct sc_asn1_entry EstablishPACEChannelInput_data[ - sizeof g_EstablishPACEChannelInput_data/ - sizeof *g_EstablishPACEChannelInput_data]; - struct sc_asn1_entry EstablishPACEChannel[ - sizeof g_EstablishPACEChannel/ - sizeof *g_EstablishPACEChannel]; - struct sc_asn1_entry passwordID[ - sizeof g_int_as_octet_string/ - sizeof *g_int_as_octet_string]; - struct sc_asn1_entry transmittedPassword[ - sizeof g_numeric_string_as_octet_string/ - sizeof *g_numeric_string_as_octet_string]; - struct sc_asn1_entry cHAT[ - sizeof g_octet_string/ - sizeof *g_octet_string]; - /* FIXME handle hashOID */ - - sc_copy_asn1_entry(g_EstablishPACEChannel, - EstablishPACEChannel); - sc_format_asn1_entry(EstablishPACEChannel, - EstablishPACEChannelInput_data, 0, 0); - - sc_copy_asn1_entry(g_EstablishPACEChannelInput_data, - EstablishPACEChannelInput_data); - - sc_format_asn1_entry(EstablishPACEChannelInput_data+0, - passwordID, 0, 0); - sc_copy_asn1_entry(g_int_as_octet_string, - passwordID); - sc_format_asn1_entry(passwordID, - &input->pin_id, &pin_id_len, 0); - - if (input->pin) { - sc_format_asn1_entry(EstablishPACEChannelInput_data+1, - transmittedPassword, 0, 0); - sc_copy_asn1_entry(g_numeric_string_as_octet_string, - transmittedPassword); - sc_format_asn1_entry(transmittedPassword, - (unsigned char *) &input->pin, &input->pin_length, 0); - } - - if (input->chat) { - sc_format_asn1_entry(EstablishPACEChannelInput_data+2, - cHAT, 0, 0); - sc_copy_asn1_entry(g_octet_string, - cHAT); - sc_format_asn1_entry(cHAT, - (unsigned char *) &input->chat, &input->chat_length, 0); - } - - if (input->certificate_description) { - sc_format_asn1_entry(EstablishPACEChannelInput_data+3, - (unsigned char *) &input->certificate_description, - &input->certificate_description_length, 0); - } - - LOG_TEST_RET(ctx, - sc_asn1_decode(ctx, EstablishPACEChannel, asn1, asn1_len, NULL, NULL), - "Error decoding EstablishPACEChannel"); - - if (pin_id_len != sizeof input->pin_id) - return SC_ERROR_UNKNOWN_DATA_RECEIVED; - - return SC_SUCCESS; -} - -int boxing_pace_output_to_buf(sc_context_t *ctx, - const struct establish_pace_channel_output *output, - unsigned char **asn1, size_t *asn1_len) -{ - uint16_t status_mse_set_at = ((output->mse_set_at_sw1 & 0xff) << 8) | output->mse_set_at_sw2; - size_t result_len = sizeof output->result, - status_mse_set_at_len = sizeof status_mse_set_at; - struct sc_asn1_entry EstablishPACEChannelOutput_data[ - sizeof g_EstablishPACEChannelOutput_data/ - sizeof *g_EstablishPACEChannelOutput_data]; - struct sc_asn1_entry EstablishPACEChannel[ - sizeof g_EstablishPACEChannel/ - sizeof *g_EstablishPACEChannel]; - struct sc_asn1_entry errorCode[ - sizeof g_octet_string/ - sizeof *g_octet_string]; - struct sc_asn1_entry statusMSESetAT[ - sizeof g_octet_string/ - sizeof *g_octet_string]; - struct sc_asn1_entry idPICC[ - sizeof g_octet_string/ - sizeof *g_octet_string]; - struct sc_asn1_entry curCAR[ - sizeof g_octet_string/ - sizeof *g_octet_string]; - struct sc_asn1_entry prevCAR[ - sizeof g_octet_string/ - sizeof *g_octet_string]; - - sc_copy_asn1_entry(g_EstablishPACEChannel, - EstablishPACEChannel); - sc_format_asn1_entry(EstablishPACEChannel, - EstablishPACEChannelOutput_data, 0, 1); - - sc_copy_asn1_entry(g_EstablishPACEChannelOutput_data, - EstablishPACEChannelOutput_data); - - sc_format_asn1_entry(EstablishPACEChannelOutput_data+0, - errorCode, 0, 1); - sc_copy_asn1_entry(g_octet_string, - errorCode); - sc_format_asn1_entry(errorCode, - (unsigned char *) &output->result, &result_len, 1); - - sc_format_asn1_entry(EstablishPACEChannelOutput_data+1, - statusMSESetAT, 0, 1); - sc_copy_asn1_entry(g_octet_string, - statusMSESetAT); - sc_format_asn1_entry(statusMSESetAT, - &status_mse_set_at, &status_mse_set_at_len, 1); - - if (output->ef_cardaccess) { - sc_format_asn1_entry(EstablishPACEChannelOutput_data+2, - output->ef_cardaccess, (size_t *) &output->ef_cardaccess_length, 1); - } - - if (output->id_icc) { - sc_format_asn1_entry(EstablishPACEChannelOutput_data+3, - idPICC, 0, 1); - sc_copy_asn1_entry(g_octet_string, - idPICC); - sc_format_asn1_entry(idPICC, - output->id_icc, (size_t *) &output->id_icc_length, 1); - } - - if (output->recent_car) { - sc_format_asn1_entry(EstablishPACEChannelOutput_data+4, - curCAR, 0, 1); - sc_copy_asn1_entry(g_octet_string, - curCAR); - sc_format_asn1_entry(curCAR, - output->recent_car, (size_t *) &output->recent_car_length, 1); - } - - if (output->previous_car) { - sc_format_asn1_entry(EstablishPACEChannelOutput_data+5, - prevCAR, 0, 1); - sc_copy_asn1_entry(g_octet_string, - prevCAR); - sc_format_asn1_entry(prevCAR, - output->previous_car, (size_t *) &output->previous_car_length, 1); - } - - return sc_asn1_encode(ctx, EstablishPACEChannel, asn1, asn1_len); -} - -int boxing_buf_to_pace_output(sc_context_t *ctx, - const unsigned char *asn1, size_t asn1_len, - struct establish_pace_channel_output *output) -{ - uint16_t status_mse_set_at; - size_t result_len = sizeof output->result, - status_mse_set_at_len = sizeof status_mse_set_at; - struct sc_asn1_entry EstablishPACEChannelOutput_data[ - sizeof g_EstablishPACEChannelOutput_data/ - sizeof *g_EstablishPACEChannelOutput_data]; - struct sc_asn1_entry EstablishPACEChannel[ - sizeof g_EstablishPACEChannel/ - sizeof *g_EstablishPACEChannel]; - struct sc_asn1_entry errorCode[ - sizeof g_octet_string/ - sizeof *g_octet_string]; - struct sc_asn1_entry statusMSESetAT[ - sizeof g_octet_string/ - sizeof *g_octet_string]; - struct sc_asn1_entry idPICC[ - sizeof g_octet_string/ - sizeof *g_octet_string]; - struct sc_asn1_entry curCAR[ - sizeof g_octet_string/ - sizeof *g_octet_string]; - struct sc_asn1_entry prevCAR[ - sizeof g_octet_string/ - sizeof *g_octet_string]; - - sc_copy_asn1_entry(g_EstablishPACEChannel, - EstablishPACEChannel); - sc_format_asn1_entry(EstablishPACEChannel, - EstablishPACEChannelOutput_data, 0, 0); - - sc_copy_asn1_entry(g_EstablishPACEChannelOutput_data, - EstablishPACEChannelOutput_data); - sc_format_asn1_entry(EstablishPACEChannelOutput_data+0, - errorCode, 0, 0); - sc_format_asn1_entry(EstablishPACEChannelOutput_data+1, - statusMSESetAT, 0, 0); - sc_format_asn1_entry(EstablishPACEChannelOutput_data+2, - &output->ef_cardaccess, &output->ef_cardaccess_length, 0); - sc_format_asn1_entry(EstablishPACEChannelOutput_data+3, - idPICC, 0, 0); - sc_format_asn1_entry(EstablishPACEChannelOutput_data+4, - curCAR, 0, 0); - sc_format_asn1_entry(EstablishPACEChannelOutput_data+5, - prevCAR, 0, 0); - - sc_copy_asn1_entry(g_octet_string, - errorCode); - sc_format_asn1_entry(errorCode, - &output->result, &result_len, 0); - /* we already allocated memory for the result */ - errorCode->flags = 0; - - sc_copy_asn1_entry(g_octet_string, - statusMSESetAT); - sc_format_asn1_entry(statusMSESetAT, - &status_mse_set_at, &status_mse_set_at_len, 0); - /* we already allocated memory for the result */ - statusMSESetAT->flags = 0; - - sc_copy_asn1_entry(g_octet_string, - idPICC); - sc_format_asn1_entry(idPICC, - &output->id_icc, &output->id_icc_length, 0); - - sc_copy_asn1_entry(g_octet_string, - curCAR); - sc_format_asn1_entry(curCAR, - &output->recent_car, &output->recent_car_length, 0); - - sc_copy_asn1_entry(g_octet_string, - prevCAR); - sc_format_asn1_entry(prevCAR, - &output->previous_car, &output->previous_car_length, 0); - - LOG_TEST_RET(ctx, - sc_asn1_decode(ctx, EstablishPACEChannel, - asn1, asn1_len, NULL, NULL), - "Error decoding EstablishPACEChannel"); - - if (status_mse_set_at_len != sizeof status_mse_set_at - || result_len != sizeof output->result) - return SC_ERROR_UNKNOWN_DATA_RECEIVED; - - output->mse_set_at_sw1 = (status_mse_set_at >> 8) & 0xff; - output->mse_set_at_sw2 = status_mse_set_at & 0xff; - - return SC_SUCCESS; -} - -#define CCID_PIN_TIMEOUT 30 -#define CCID_DISPLAY_DEFAULT 0xff -static int boxing_pin_cmd_to_buf(sc_context_t *ctx, - const struct sc_pin_cmd_data *data, - unsigned char **pc_to_rdr_secure, size_t *pc_to_rdr_secure_len) -{ - PC_to_RDR_Secure_t *secure; - abPINDataStucture_Modification_t *modify; - abPINDataStucture_Verification_t *verify; - uint16_t wLangId = 0, - bTeoPrologue2 = 0, - wPINMaxExtraDigit; - uint8_t bTimeOut = CCID_PIN_TIMEOUT, - bNumberMessage = CCID_DISPLAY_DEFAULT, - bTeoPrologue1 = 0, - bMsgIndex = 0, - bMessageType = 0x69, - bSlot = 0, - bSeq = 0, - bBWI = 0xff, - wLevelParameter = 0, - bEntryValidationCondition = CCID_ENTRY_VALIDATE, - bmFormatString, bmPINLengthFormat, bmPINBlockString; - const struct sc_pin_cmd_pin *pin_ref; - int r; - unsigned char *pinapdu = NULL; - size_t pinapdu_len = 0; - - if (!data || !pc_to_rdr_secure || !pc_to_rdr_secure_len) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - pin_ref = data->flags & SC_PIN_CMD_IMPLICIT_CHANGE ? - &data->pin2 : &data->pin1; - - wPINMaxExtraDigit = htole16( - (0xff & pin_ref->min_length) << 8) - | (pin_ref->max_length & 0xff); - - bmFormatString = CCID_PIN_UNITS_BYTES - | ((pin_ref->offset & 0xf) << 3); - switch (pin_ref->encoding) { - case SC_PIN_ENCODING_ASCII: - bmFormatString |= CCID_PIN_ENCODING_ASCII; - break; - case SC_PIN_ENCODING_BCD: - bmFormatString |= CCID_PIN_ENCODING_BCD; - break; - default: - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - /* GLP PINs expect the effective PIN length from bit 4 */ - bmPINLengthFormat = pin_ref->encoding == SC_PIN_ENCODING_GLP ? - 0x04 : 0x00; - - if (pin_ref->encoding == SC_PIN_ENCODING_GLP) { - /* GLP PIN length is encoded in 4 bits and block size is always 8 bytes */ - bmPINBlockString = 0x40 | 0x08; - } else if (pin_ref->encoding == SC_PIN_ENCODING_ASCII && data->flags & SC_PIN_CMD_NEED_PADDING) { - bmPINBlockString = pin_ref->pad_length; - } else { - bmPINBlockString = 0x00; - } - - r = sc_apdu_get_octets(ctx, data->apdu, &pinapdu, &pinapdu_len, - SC_PROTO_T1); - if (r < 0) - goto err; - - switch (data->cmd) { - case SC_PIN_CMD_VERIFY: - *pc_to_rdr_secure_len = sizeof *secure + 1 - + sizeof *verify + pinapdu_len; - break; - - case SC_PIN_CMD_CHANGE: - *pc_to_rdr_secure_len = sizeof *secure + 1 - + sizeof *modify + 3 + pinapdu_len; - break; - - default: - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - *pc_to_rdr_secure = malloc(*pc_to_rdr_secure_len); - if (!*pc_to_rdr_secure) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - secure = (PC_to_RDR_Secure_t *) *pc_to_rdr_secure; - secure->bMessageType = bMessageType; - secure->dwLength = htole32((*pc_to_rdr_secure_len) - sizeof *secure); - secure->bSlot = bSlot; - secure->bSeq = bSeq; - secure->bBWI = bBWI; - secure->wLevelParameter = wLevelParameter; - - switch (data->cmd) { - case SC_PIN_CMD_VERIFY: - /* bPINOperation */ - *((*pc_to_rdr_secure) + sizeof *secure) = CCID_OPERATION_VERIFY; - verify = (abPINDataStucture_Verification_t *) - ((*pc_to_rdr_secure) + sizeof *secure + 1); - verify->bTimeOut = bTimeOut; - verify->bmFormatString = bmFormatString; - verify->bmPINBlockString = bmPINBlockString; - verify->bmPINLengthFormat = bmPINLengthFormat; - verify->wPINMaxExtraDigit = wPINMaxExtraDigit; - verify->bEntryValidationCondition = bEntryValidationCondition; - verify->bNumberMessage = bNumberMessage; - verify->wLangId = wLangId; - verify->bMsgIndex = bMsgIndex; - verify->bTeoPrologue1 = bTeoPrologue1; - verify->bTeoPrologue2 = bTeoPrologue2; - - memcpy((*pc_to_rdr_secure) + sizeof *secure + 1 + sizeof *verify, - pinapdu, pinapdu_len); - break; - - case SC_PIN_CMD_CHANGE: - /* bPINOperation */ - *((*pc_to_rdr_secure) + sizeof *secure) = CCID_OPERATION_MODIFY; - modify = (abPINDataStucture_Modification_t *) - ((*pc_to_rdr_secure) + sizeof *secure + 1); - modify->bTimeOut = bTimeOut; - modify->bmFormatString = bmFormatString; - modify->bmPINBlockString = bmPINBlockString; - modify->bmPINLengthFormat = bmPINLengthFormat; - if (!(data->flags & SC_PIN_CMD_IMPLICIT_CHANGE) - && data->pin1.offset) { - modify->bInsertionOffsetOld = data->pin1.offset - 5; - } else { - modify->bInsertionOffsetOld = 0; - } - modify->bInsertionOffsetNew = data->pin2.offset ? data->pin2.offset - 5 : 0; - modify->wPINMaxExtraDigit = wPINMaxExtraDigit; - modify->bConfirmPIN = CCID_PIN_CONFIRM_NEW - | (data->flags & SC_PIN_CMD_IMPLICIT_CHANGE ? 0 : CCID_PIN_INSERT_OLD); - modify->bEntryValidationCondition = bEntryValidationCondition; - modify->bNumberMessage = bNumberMessage; - modify->wLangId = wLangId; - modify->bMsgIndex1 = bMsgIndex; - *((*pc_to_rdr_secure) + sizeof *secure + 1 + sizeof *modify + 0) = - bTeoPrologue1; - *((*pc_to_rdr_secure) + sizeof *secure + 1 + sizeof *modify + 1) = - bTeoPrologue1; - *((*pc_to_rdr_secure) + sizeof *secure + 1 + sizeof *modify + 2) = - bTeoPrologue1; - - memcpy((*pc_to_rdr_secure) + sizeof *secure + 1 + sizeof *modify + 3, - pinapdu, pinapdu_len); - break; - - default: - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - r = SC_SUCCESS; - -err: - free(pinapdu); - if (r < 0 && pc_to_rdr_secure && *pc_to_rdr_secure) { - free(*pc_to_rdr_secure); - *pc_to_rdr_secure = NULL; - } - - return r; -} - -#define CCID_BSTATUS_OK_ACTIVE 0x00 /** No error. An ICC is present and active */ -static int boxing_buf_to_verify_result(sc_context_t *ctx, - const unsigned char *rdr_to_pc_datablock, - size_t rdr_to_pc_datablock_len, - sc_apdu_t *apdu) -{ - RDR_to_PC_DataBlock_t *datablock = - (RDR_to_PC_DataBlock_t *) rdr_to_pc_datablock; - - if (!rdr_to_pc_datablock - || rdr_to_pc_datablock_len < sizeof *datablock - || datablock->bMessageType != 0x80) - return SC_ERROR_UNKNOWN_DATA_RECEIVED; - - if (datablock->bStatus != CCID_BSTATUS_OK_ACTIVE) - return SC_ERROR_TRANSMIT_FAILED; - - return sc_apdu_set_resp(ctx, apdu, - rdr_to_pc_datablock + sizeof *datablock, - htole32(datablock->dwLength)); -} - -static int boxing_perform_verify(struct sc_reader *reader, - struct sc_pin_cmd_data *data) -{ - u8 rbuf[0xff]; - sc_apdu_t apdu; - int r; - - memset(&apdu, 0, sizeof(apdu)); - apdu.cse = SC_APDU_CASE_4_SHORT; - apdu.cla = boxing_cla; - apdu.ins = boxing_ins; - apdu.p1 = boxing_p1; - apdu.p2 = boxing_p2_PC_to_RDR_Secure; - apdu.resp = rbuf; - apdu.resplen = sizeof rbuf; - apdu.le = sizeof rbuf; - - if (!reader || !reader->ops || !reader->ops->transmit) { - r = SC_ERROR_NOT_SUPPORTED; - goto err; - } - - r = boxing_pin_cmd_to_buf(reader->ctx, data, - (unsigned char **) &apdu.data, &apdu.datalen); - if (r < 0) { - sc_debug(reader->ctx, SC_LOG_DEBUG_NORMAL, - "Error encoding PC_to_RDR_Secure"); - goto err; - } - apdu.lc = apdu.datalen; - - r = SC_SUCCESS; - - r = reader->ops->transmit(reader, &apdu); - if (r < 0) { - sc_debug(reader->ctx, SC_LOG_DEBUG_NORMAL, - "Error performing PC_to_RDR_Secure"); - goto err; - } - - if (apdu.sw1 != 0x90 && apdu.sw2 != 0x00) { - sc_debug(reader->ctx, SC_LOG_DEBUG_NORMAL, - "Error decoding PC_to_RDR_Secure"); - r = SC_ERROR_NOT_SUPPORTED; - goto err; - } - - r = boxing_buf_to_verify_result(reader->ctx, apdu.resp, apdu.resplen, - data->apdu); - -err: - free((unsigned char *) apdu.data); - - return r; -} - -static int boxing_perform_pace(struct sc_reader *reader, - void *establish_pace_channel_input, - void *establish_pace_channel_output) -{ - u8 rbuf[0xffff]; - sc_apdu_t apdu; - int r; - struct establish_pace_channel_input *input = - establish_pace_channel_input; - struct establish_pace_channel_output *output = - establish_pace_channel_output; - - memset(&apdu, 0, sizeof(apdu)); - apdu.cse = SC_APDU_CASE_4_EXT; - apdu.cla = boxing_cla; - apdu.ins = boxing_ins; - apdu.p1 = boxing_p1; - apdu.p2 = boxing_p2_EstablishPACEChannel; - apdu.resp = rbuf; - apdu.resplen = sizeof rbuf; - apdu.le = sizeof rbuf; - - if (!reader || !reader->ops || !reader->ops->transmit) { - r = SC_ERROR_NOT_SUPPORTED; - goto err; - } - - r = boxing_pace_input_to_buf(reader->ctx, input, - (unsigned char **) &apdu.data, &apdu.datalen); - if (r < 0) { - sc_debug(reader->ctx, SC_LOG_DEBUG_NORMAL, - "Error encoding EstablishPACEChannel"); - goto err; - } - apdu.lc = apdu.datalen; - - r = reader->ops->transmit(reader, &apdu); - if (r < 0) { - sc_debug(reader->ctx, SC_LOG_DEBUG_NORMAL, - "Error performing EstablishPACEChannel"); - goto err; - } - - if (apdu.sw1 != 0x90 && apdu.sw2 != 0x00) { - sc_debug(reader->ctx, SC_LOG_DEBUG_NORMAL, - "Error decoding EstablishPACEChannel"); - r = SC_ERROR_NOT_SUPPORTED; - goto err; - } - - r = boxing_buf_to_pace_output(reader->ctx, apdu.resp, apdu.resplen, - output); - -err: - free((unsigned char *) apdu.data); - - return r; -} - -struct sc_asn1_entry g_PACECapabilities_data[] = { - { "capabilityPACE", - SC_ASN1_STRUCT, SC_ASN1_CTX|0x01|SC_ASN1_CONS, SC_ASN1_ALLOC, NULL, NULL }, - { "capabilityEID", - SC_ASN1_STRUCT, SC_ASN1_CTX|0x02|SC_ASN1_CONS, SC_ASN1_ALLOC, NULL, NULL }, - { "capabilityESign", - SC_ASN1_STRUCT, SC_ASN1_CTX|0x03|SC_ASN1_CONS, SC_ASN1_ALLOC, NULL, NULL }, - { "capabilityDestroy", - SC_ASN1_STRUCT, SC_ASN1_CTX|0x04|SC_ASN1_CONS, SC_ASN1_ALLOC, NULL, NULL }, - { NULL , 0 , 0 , 0 , NULL , NULL } -}; -struct sc_asn1_entry g_PACECapabilities[] = { - { "PACECapabilities", - SC_ASN1_STRUCT, SC_ASN1_TAG_SEQUENCE|SC_ASN1_CONS, 0, NULL, NULL }, - { NULL , 0 , 0 , 0 , NULL , NULL } -}; - -int boxing_buf_to_pace_capabilities(sc_context_t *ctx, - const unsigned char *asn1, size_t asn1_len, - unsigned long *sc_reader_t_capabilities) -{ - int pace = 0, eid = 0, esign = 0, destroy = 0; - struct sc_asn1_entry PACECapabilities_data[ - sizeof g_PACECapabilities_data/ - sizeof *g_PACECapabilities_data]; - struct sc_asn1_entry PACECapabilities[ - sizeof g_PACECapabilities/ - sizeof *g_PACECapabilities]; - struct sc_asn1_entry capabilityPACE[ - sizeof g_boolean/ - sizeof *g_boolean]; - struct sc_asn1_entry capabilityEID[ - sizeof g_boolean/ - sizeof *g_boolean]; - struct sc_asn1_entry capabilityESign[ - sizeof g_boolean/ - sizeof *g_boolean]; - struct sc_asn1_entry capabilityDestroy[ - sizeof g_boolean/ - sizeof *g_boolean]; - - sc_copy_asn1_entry(g_PACECapabilities, - PACECapabilities); - sc_format_asn1_entry(PACECapabilities, - PACECapabilities_data, 0, 1); - - sc_copy_asn1_entry(g_PACECapabilities_data, - PACECapabilities_data); - sc_format_asn1_entry(PACECapabilities_data+0, - &capabilityPACE, NULL, 1); - sc_format_asn1_entry(PACECapabilities_data+1, - &capabilityEID, NULL, 1); - sc_format_asn1_entry(PACECapabilities_data+2, - &capabilityESign, NULL, 1); - sc_format_asn1_entry(PACECapabilities_data+3, - &capabilityDestroy, NULL, 1); - - sc_copy_asn1_entry(g_boolean, - capabilityPACE); - sc_format_asn1_entry(capabilityPACE+0, - &pace, NULL, 0); - - sc_copy_asn1_entry(g_boolean, - capabilityEID); - sc_format_asn1_entry(capabilityEID+0, - &eid, NULL, 0); - - sc_copy_asn1_entry(g_boolean, - capabilityESign); - sc_format_asn1_entry(capabilityESign+0, - &esign, NULL, 0); - - sc_copy_asn1_entry(g_boolean, - capabilityDestroy); - sc_format_asn1_entry(capabilityDestroy+0, - &destroy, NULL, 0); - - LOG_TEST_RET(ctx, - sc_asn1_decode(ctx, PACECapabilities, - asn1, asn1_len, NULL, NULL), - "Error decoding PACECapabilities"); - - /* We got a valid PACE Capabilities reply. There is currently no mechanism - * to determine support PIN verification/modification with a boxing - * command. Since the reader implements this mechanism it is reasonable to - * assume that PIN verification/modification is available. */ - *sc_reader_t_capabilities = SC_READER_CAP_PIN_PAD; - - if (pace) - *sc_reader_t_capabilities |= SC_READER_CAP_PACE_GENERIC; - if (eid) - *sc_reader_t_capabilities |= SC_READER_CAP_PACE_EID; - if (esign) - *sc_reader_t_capabilities |= SC_READER_CAP_PACE_ESIGN; - if (destroy) - *sc_reader_t_capabilities |= SC_READER_CAP_PACE_DESTROY_CHANNEL; - - return SC_SUCCESS; -} - -int boxing_pace_capabilities_to_buf(sc_context_t *ctx, - const unsigned long sc_reader_t_capabilities, - unsigned char **asn1, size_t *asn1_len) -{ - int yes = 1, no = 0; - struct sc_asn1_entry PACECapabilities_data[ - sizeof g_PACECapabilities_data/ - sizeof *g_PACECapabilities_data]; - struct sc_asn1_entry PACECapabilities[ - sizeof g_PACECapabilities/ - sizeof *g_PACECapabilities]; - struct sc_asn1_entry capabilityPACE[ - sizeof g_boolean/ - sizeof *g_boolean]; - struct sc_asn1_entry capabilityEID[ - sizeof g_boolean/ - sizeof *g_boolean]; - struct sc_asn1_entry capabilityESign[ - sizeof g_boolean/ - sizeof *g_boolean]; - struct sc_asn1_entry capabilityDestroy[ - sizeof g_boolean/ - sizeof *g_boolean]; - - sc_copy_asn1_entry(g_EstablishPACEChannel, - PACECapabilities); - sc_format_asn1_entry(PACECapabilities, - PACECapabilities_data, 0, 1); - - sc_copy_asn1_entry(g_PACECapabilities_data, - PACECapabilities_data); - sc_format_asn1_entry(PACECapabilities_data+0, - &capabilityPACE, NULL, 1); - sc_format_asn1_entry(PACECapabilities_data+1, - &capabilityEID, NULL, 1); - sc_format_asn1_entry(PACECapabilities_data+2, - &capabilityESign, NULL, 1); - sc_format_asn1_entry(PACECapabilities_data+3, - &capabilityDestroy, NULL, 1); - - sc_copy_asn1_entry(g_boolean, - capabilityPACE); - sc_format_asn1_entry(capabilityPACE, - sc_reader_t_capabilities & SC_READER_CAP_PACE_GENERIC - ? &yes : &no, NULL, 1); - - sc_copy_asn1_entry(g_boolean, - capabilityEID); - sc_format_asn1_entry(capabilityEID, - sc_reader_t_capabilities & SC_READER_CAP_PACE_EID - ? &yes : &no, NULL, 1); - - sc_copy_asn1_entry(g_boolean, - capabilityESign); - sc_format_asn1_entry(capabilityESign, - sc_reader_t_capabilities & SC_READER_CAP_PACE_ESIGN - ? &yes : &no, NULL, 1); - - sc_copy_asn1_entry(g_boolean, - capabilityDestroy); - sc_format_asn1_entry(capabilityDestroy, - sc_reader_t_capabilities & SC_READER_CAP_PACE_DESTROY_CHANNEL - ? &yes : &no, NULL, 1); - - return sc_asn1_encode(ctx, PACECapabilities, asn1, asn1_len); -} - -#ifndef DISABLE_GLOBAL_BOXING_INITIALIZATION -static -#endif -void sc_detect_boxing_cmds(sc_reader_t *reader) -{ - u8 rbuf[0xff]; - sc_apdu_t apdu; - unsigned long capabilities; - - memset(&apdu, 0, sizeof(apdu)); - apdu.cse = SC_APDU_CASE_1; - apdu.cla = boxing_cla; - apdu.ins = boxing_ins; - apdu.p1 = boxing_p1; - apdu.p2 = boxing_p2_GetReaderPACECapabilities; - apdu.resp = rbuf; - apdu.resplen = sizeof rbuf; - apdu.le = sizeof rbuf; - - if (!reader || !reader->ops || !reader->ops->transmit - || reader->ops->transmit(reader, &apdu) != SC_SUCCESS - || apdu.sw1 != 0x90 - || apdu.sw2 != 0x00 - || boxing_buf_to_pace_capabilities(reader->ctx, - apdu.resp, apdu.resplen, &capabilities) != SC_SUCCESS) { - if (reader) { - sc_debug(reader->ctx, SC_LOG_DEBUG_NORMAL, - "%s does not support boxing commands", reader->name); - memset(&apdu, 0, sizeof(apdu)); - apdu.cse = SC_APDU_CASE_3; - apdu.cla = 0x00; - apdu.ins = 0xA4; - apdu.p1 = 8; - apdu.p2 = 0x0C; - apdu.data = rbuf; - rbuf[0] = 0x3F; - rbuf[1] = 0x00; - apdu.datalen = 2; - apdu.lc = 2; - apdu.resp = NULL; - apdu.resplen = 0; - apdu.le = 0; - reader->ops->transmit(reader, &apdu); - } - } else { - if (capabilities & SC_READER_CAP_PIN_PAD - && !(reader->capabilities & SC_READER_CAP_PIN_PAD)) { - ((struct sc_reader_operations *) reader->ops)->perform_verify = - boxing_perform_verify; - sc_debug(reader->ctx, SC_LOG_DEBUG_NORMAL, - "Added boxing command wrappers for PIN verification/modification to '%s'", reader->name); - } - - if (capabilities & SC_READER_CAP_PACE_GENERIC - && !(reader->capabilities & SC_READER_CAP_PACE_GENERIC)) { - ((struct sc_reader_operations *) reader->ops)->perform_pace = - boxing_perform_pace; - sc_debug(reader->ctx, SC_LOG_DEBUG_NORMAL, - "Added boxing command wrappers for PACE to '%s'", reader->name); - } - - reader->capabilities |= capabilities; - } -} - -#ifndef DISABLE_GLOBAL_BOXING_INITIALIZATION - -#ifndef HAVE_LIST_ITERATOR_NEXT -#include "opensc/src/common/simclist.c" -#endif - -void sc_initialize_boxing_cmds(sc_context_t *ctx) -{ - sc_reader_t *reader; - - if (!ctx) - return; - - if (!list_iterator_start(&ctx->readers)) - return; - - reader = list_iterator_next(&ctx->readers); - while (reader) { - reader = list_iterator_next(&ctx->readers); - sc_detect_boxing_cmds(reader); - } - - list_iterator_stop(&ctx->readers); -} -#endif diff --git a/npa/src/card-npa.c b/npa/src/card-npa.c deleted file mode 100644 index f008131..0000000 --- a/npa/src/card-npa.c +++ /dev/null @@ -1,704 +0,0 @@ -/* - * card-npa.c: Recognize known German identity cards - * - * Copyright (C) 2011-2014 Frank Morgner - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - */ - -#include "iso-sm-internal.h" -#include "libopensc/internal.h" -#include "libopensc/pace.h" -#include "libopensc/sm.h" -#include "card-npa.h" -#include -#include -#include -#include - -struct npa_drv_data { - const char *can; - unsigned char *st_dv_certificate; - size_t st_dv_certificate_len; - unsigned char *st_certificate; - size_t st_certificate_len; - unsigned char *st_key; - size_t st_key_len; - unsigned char *ef_cardaccess; - size_t ef_cardaccess_length; - unsigned char *ef_cardsecurity; - size_t ef_cardsecurity_length; -}; - -static struct npa_drv_data *npa_drv_data_create(void) -{ - struct npa_drv_data *drv_data = calloc(1, sizeof *drv_data); - return drv_data; -} - -static void npa_drv_data_free(struct npa_drv_data *drv_data) -{ - if (drv_data) { - free(drv_data->ef_cardaccess); - free(drv_data->ef_cardsecurity); - free(drv_data->st_certificate); - free(drv_data->st_dv_certificate); - free(drv_data->st_key); - free(drv_data); - } -} - -static struct sc_atr_table npa_atrs[] = { - {"3B:8A:80:01:80:31:F8:73:F7:41:E0:82:90:00:75", - "FF:FF:FF:FF:FF:FF:00:FF:00:00:FF:FF:FF:FF:00", - "German ID card (neuer Personalausweis, nPA)", SC_CARD_TYPE_NPA, 0, NULL}, - {"3B:88:80:01:00:00:00:00:00:00:00:00:09", NULL, - "German ID card (neuer Personalausweis, nPA)", SC_CARD_TYPE_NPA, 0, NULL}, - {"3B:87:80:01:80:31:B8:73:84:01:E0:19", NULL, - "German ID card (neuer Personalausweis, nPA)", SC_CARD_TYPE_NPA, 0, NULL}, - {"3B:84:80:01:00:00:90:00:95", NULL, - "German ID card (Test neuer Personalausweis)", SC_CARD_TYPE_NPA_TEST, 0, NULL}, - {"3B:88:80:01:00:E1:F3:5E:13:77:83:00:00", - "FF:FF:FF:FF:00:FF:FF:FF:FF:FF:FF:FF:00", - "German ID card (Test Online-Ausweisfunktion)", SC_CARD_TYPE_NPA_ONLINE, 0, NULL}, - {NULL, NULL, NULL, 0, 0, NULL} -}; - -static struct sc_card_operations npa_ops; -static struct sc_card_driver npa_drv = { - "German ID card (neuer Personalausweis, nPA)", - "npa", - &npa_ops, - NULL, 0, NULL -}; - -static int npa_load_options(sc_context_t *ctx, struct npa_drv_data *drv_data) -{ - int r; - size_t i, j; - scconf_block **found_blocks, *block; - const char *file; - - if (!ctx || !drv_data || !ctx->conf_blocks) { - r = SC_ERROR_INTERNAL; - goto err; - } - - for (i = 0; ctx->conf_blocks[i]; i++) { - found_blocks = scconf_find_blocks(ctx->conf, ctx->conf_blocks[i], - "card_driver", "npa"); - if (!found_blocks) - continue; - - for (j = 0, block = found_blocks[j]; block; j++, block = found_blocks[j]) { - if (!drv_data->can) - drv_data->can = scconf_get_str(block, "can", NULL); - - if (!drv_data->st_dv_certificate - || !drv_data->st_dv_certificate_len) { - file = scconf_get_str(block, "st_dv_certificate", NULL); - if (!fread_to_eof(file, - (unsigned char **) &drv_data->st_dv_certificate, - &drv_data->st_dv_certificate_len)) - sc_log(ctx, "Waring: Could not read %s.\n", file); - } - - if (!drv_data->st_certificate - || !drv_data->st_certificate_len) { - file = scconf_get_str(block, "st_certificate", NULL); - if (!fread_to_eof(file, - (unsigned char **) &drv_data->st_certificate, - &drv_data->st_certificate_len)) - sc_log(ctx, "Waring: Could not read %s.\n", file); - } - - if (!drv_data->st_key - || !drv_data->st_key_len) { - file = scconf_get_str(block, "st_key", NULL); - if (!fread_to_eof(file, - (unsigned char **) &drv_data->st_key, - &drv_data->st_key_len)) - sc_log(ctx, "Waring: Could not read %s.\n", file); - } - } - - free(found_blocks); - } - r = SC_SUCCESS; - -err: - return r; -} - -static int npa_match_card(sc_card_t * card) -{ - if (_sc_match_atr(card, npa_atrs, &card->type) < 0) - return 0; - return 1; -} - -static void npa_get_cached_pace_params(sc_card_t *card, - struct establish_pace_channel_input *pace_input, - struct establish_pace_channel_output *pace_output) -{ - struct npa_drv_data *drv_data; - - if (card->drv_data) { - drv_data = card->drv_data; - - if (pace_output) { - pace_output->ef_cardaccess = drv_data->ef_cardaccess; - pace_output->ef_cardaccess_length = drv_data->ef_cardaccess_length; - } - - if (pace_input && pace_input->pin_id == PACE_PIN_ID_CAN) { - pace_input->pin = (const unsigned char *) drv_data->can; - pace_input->pin_length = drv_data->can ? strlen(drv_data->can) : 0; - } - } -} - -static void npa_get_cached_ta_params(sc_card_t *card, - const unsigned char *certs[2], size_t certs_lens[2], - const unsigned char **st_key, size_t *st_key_len) -{ - struct npa_drv_data *drv_data; - size_t i; - - if (card->drv_data) { - drv_data = card->drv_data; - - if (certs && certs_lens) { - i = 0; - if (drv_data->st_dv_certificate) { - certs[i] = drv_data->st_dv_certificate; - certs_lens[i] = drv_data->st_dv_certificate_len; - i++; - } - if (drv_data->st_certificate) { - certs[i] = drv_data->st_certificate; - certs_lens[i] = drv_data->st_certificate_len; - } - } - if (st_key && st_key_len) { - *st_key = drv_data->st_key; - *st_key_len = drv_data->st_key_len; - } - } -} - -static void npa_get_cached_ca_params(sc_card_t *card, - unsigned char **ef_cardsecurity, size_t *ef_cardsecurity_length) -{ - struct npa_drv_data *drv_data; - - if (card->drv_data) { - drv_data = card->drv_data; - - if (ef_cardsecurity && ef_cardsecurity_length) { - *ef_cardsecurity = drv_data->ef_cardsecurity; - *ef_cardsecurity_length = drv_data->ef_cardsecurity_length; - } - } -} - -static void npa_cache_or_free(sc_card_t *card, - unsigned char **ef_cardaccess, size_t *ef_cardaccess_length, - unsigned char **ef_cardsecurity, size_t *ef_cardsecurity_length) -{ - struct npa_drv_data *drv_data; - - if (card && card->drv_data) { - drv_data = card->drv_data; - - if (ef_cardaccess && ef_cardaccess_length - && *ef_cardaccess && *ef_cardaccess_length) { - drv_data->ef_cardaccess = *ef_cardaccess; - drv_data->ef_cardaccess_length = *ef_cardaccess_length; - *ef_cardaccess = NULL; - *ef_cardaccess_length = 0; - } - if (ef_cardsecurity && ef_cardsecurity_length - && *ef_cardsecurity && *ef_cardsecurity_length) { - drv_data->ef_cardsecurity = *ef_cardsecurity; - drv_data->ef_cardsecurity_length = *ef_cardsecurity_length; - *ef_cardsecurity = NULL; - *ef_cardsecurity_length = 0; - } - } else { - if (ef_cardaccess && ef_cardaccess_length) { - free(*ef_cardaccess); - *ef_cardaccess = NULL; - *ef_cardaccess_length = 0; - } - if (ef_cardsecurity && ef_cardsecurity_length) { - free(*ef_cardsecurity); - *ef_cardsecurity = NULL; - *ef_cardsecurity_length = 0; - } - } -} - -static int npa_unlock_esign(sc_card_t *card) -{ - int r = SC_ERROR_INTERNAL; - struct establish_pace_channel_input pace_input; - struct establish_pace_channel_output pace_output; - const unsigned char *certs[] = { NULL, NULL }; - size_t certs_lens[] = { 0, 0}; - const unsigned char *st_key = NULL; - size_t st_key_len = 0; - unsigned char *ef_cardsecurity = NULL; - size_t ef_cardsecurity_len = 0; - memset(&pace_input, 0, sizeof pace_input); - memset(&pace_output, 0, sizeof pace_output); - - if (!card) { - r = SC_ERROR_INVALID_CARD; - goto err; - } - - sc_log(card->ctx, "Will verify CAN first for unlocking eSign application.\n"); - pace_input.chat = esign_chat; - pace_input.chat_length = sizeof esign_chat; - pace_input.pin_id = PACE_PIN_ID_CAN; - npa_get_cached_pace_params(card, &pace_input, &pace_output); - npa_get_cached_ta_params(card, certs, certs_lens, &st_key, &st_key_len); - npa_get_cached_ca_params(card, &ef_cardsecurity, &ef_cardsecurity_len); - - if (!(card->reader && (card->reader->capabilities & SC_READER_CAP_PACE_ESIGN)) - && (!st_key || !st_key_len)) { - sc_log(card->ctx, "QES requires a comfort reader (CAT-K) or a ST certificate.\n"); - r = SC_ERROR_NOT_SUPPORTED; - goto err; - } - - /* FIXME set flags with opensc.conf */ - npa_default_flags |= NPA_FLAG_DISABLE_CHECK_ALL; - npa_default_flags |= NPA_FLAG_DISABLE_CHECK_TA; - npa_default_flags |= NPA_FLAG_DISABLE_CHECK_CA; - - /* FIXME show an alert to the user if can == NULL */ - r = perform_pace(card, pace_input, &pace_output, EAC_TR_VERSION_2_02); - if (SC_SUCCESS != r) { - sc_log(card->ctx, "Error verifying CAN.\n"); - goto err; - } - - if (card->reader->capabilities & SC_READER_CAP_PACE_ESIGN) { - sc_log(card->ctx, "Proved Access rights to eSign application with comfort reader (CAT-K).\n"); - } else { - r = perform_terminal_authentication(card, certs, certs_lens, st_key, - st_key_len, NULL, 0); - if (r != SC_SUCCESS) { - sc_log(card->ctx, "Error authenticating as signature terminal.\n"); - goto err; - } - r = perform_chip_authentication(card, &ef_cardsecurity, &ef_cardsecurity_len); - if ( SC_SUCCESS != r) { - sc_log(card->ctx, "Error verifying the chips authenticy.\n"); - } - - sc_log(card->ctx, "Proved Access rights to eSign application with configured key as ST.\n"); - } - -err: - npa_cache_or_free(card, &pace_output.ef_cardaccess, - &pace_output.ef_cardaccess_length, - &ef_cardsecurity, &ef_cardsecurity_len); - free(pace_output.recent_car); - free(pace_output.previous_car); - free(pace_output.id_icc); - free(pace_output.id_pcd); - - return r; -} - -static int npa_init(sc_card_t * card) -{ - int flags = SC_ALGORITHM_ECDSA_RAW; - int ext_flags = 0; - int r; - - if (!card) { - r = SC_ERROR_INVALID_CARD; - goto err; - } - - card->caps |= SC_CARD_CAP_APDU_EXT | SC_CARD_CAP_RNG; - card->max_recv_size = 0xFFFF+1; - card->max_send_size = 0xFFFF; - memset(&card->sm_ctx, 0, sizeof card->sm_ctx); - - r = _sc_card_add_ec_alg(card, 192, flags, ext_flags, NULL); - if (r != SC_SUCCESS) - goto err; - r = _sc_card_add_ec_alg(card, 224, flags, ext_flags, NULL); - if (r != SC_SUCCESS) - goto err; - r = _sc_card_add_ec_alg(card, 256, flags, ext_flags, NULL); - if (r != SC_SUCCESS) - goto err; - /* nPA does not encode the proprietary fieldSize in PrivateECKeyAttributes, - * which leaves it at 0 for OpenSC, so we need to add 0x00 as supported - * field_length */ - r = _sc_card_add_ec_alg(card, 0, flags, ext_flags, NULL); - if (r != SC_SUCCESS) - goto err; - -#ifdef DISABLE_GLOBAL_BOXING_INITIALIZATION - sc_detect_boxing_cmds(card->reader); -#endif - - EAC_init(); - card->drv_data = npa_drv_data_create(); - r = npa_load_options(card->ctx, card->drv_data); - if (r != SC_SUCCESS) - goto err; - - /* unlock the eSign application for reading the certificates - * by the PKCS#15 layer (i.e. sc_pkcs15_bind_internal) */ - r = npa_unlock_esign(card); - -err: - return r; -} - -static int npa_finish(sc_card_t * card) -{ - sc_sm_stop(card); - npa_drv_data_free(card->drv_data); - card->drv_data = NULL; - EAC_cleanup(); - - return SC_SUCCESS; -} - -static int npa_set_security_env(struct sc_card *card, - const struct sc_security_env *env, int se_num) -{ - int r; - struct sc_card_driver *iso_drv; - struct sc_security_env fixed_env; - - iso_drv = sc_get_iso7816_driver(); - - if (!env || !iso_drv || !iso_drv->ops || !iso_drv->ops->set_security_env) { - r = SC_ERROR_INTERNAL; - } else { - memcpy(&fixed_env, env, sizeof fixed_env); - if (env->operation == SC_SEC_OPERATION_SIGN) { - /* The pkcs#15 layer assumes that the field_size of the private key - * object is correctly initialized and wants to include it as - * algorithm reference. We disable it here */ - fixed_env.flags &= ~SC_SEC_ENV_ALG_REF_PRESENT; - } - r = iso_drv->ops->set_security_env(card, &fixed_env, se_num); - } - - return r; -} - -static int npa_pin_cmd_get_info(struct sc_card *card, - struct sc_pin_cmd_data *data, int *tries_left) -{ - int r; - u8 pin_reference; - - if (!data || data->pin_type != SC_AC_CHV || !tries_left) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - pin_reference = data->pin_reference; - switch (data->pin_reference) { - case PACE_PIN_ID_CAN: - case PACE_PIN_ID_MRZ: - case PACE_PIN_ID_PUK: - /* usually unlimited number of retries */ - *tries_left = -1; - data->pin1.max_tries = -1; - data->pin1.tries_left = -1; - r = SC_SUCCESS; - break; - - case PACE_PIN_ID_PIN: - /* usually 3 tries */ - *tries_left = 3; - data->pin1.max_tries = 3; - r = npa_pace_get_tries_left(card, - pin_reference, tries_left); - data->pin1.tries_left = *tries_left; - break; - - default: - r = SC_ERROR_OBJECT_NOT_FOUND; - goto err; - } - -err: - return r; -} - -static int npa_pace_verify(struct sc_card *card, - unsigned char pin_reference, struct sc_pin_cmd_pin *pin, - const unsigned char *chat, size_t chat_length, int *tries_left) -{ - int r; - struct establish_pace_channel_input pace_input; - struct establish_pace_channel_output pace_output; - - memset(&pace_input, 0, sizeof pace_input); - memset(&pace_output, 0, sizeof pace_output); - if (chat) { - pace_input.chat = chat; - pace_input.chat_length = chat_length; - } - pace_input.pin_id = pin_reference; - if (pin) { - pace_input.pin = pin->data; - pace_input.pin_length = pin->len; - } - npa_get_cached_pace_params(card, &pace_input, &pace_output); - - r = perform_pace(card, pace_input, &pace_output, EAC_TR_VERSION_2_02); - - if (tries_left) { - if (pace_output.mse_set_at_sw1 == 0x63 - && (pace_output.mse_set_at_sw2 & 0xc0) == 0xc0) { - *tries_left = pace_output.mse_set_at_sw2 & 0x0f; - } else { - *tries_left = -1; - } - } - - /* resume the PIN if needed */ - if (pin_reference == PACE_PIN_ID_PIN - && r != SC_SUCCESS - && pace_output.mse_set_at_sw1 == 0x63 - && (pace_output.mse_set_at_sw2 & 0xc0) == 0xc0 - && (pace_output.mse_set_at_sw2 & 0x0f) <= UC_PIN_SUSPENDED) { - /* TODO ask for user consent when automatically resuming the PIN */ - sc_log(card->ctx, "%s is suspended. Will try to resume it with %s.\n", - npa_secret_name(pin_reference), npa_secret_name(PACE_PIN_ID_CAN)); - - pace_input.pin_id = PACE_PIN_ID_CAN; - pace_input.pin = NULL; - pace_input.pin_length = 0; - - r = perform_pace(card, pace_input, &pace_output, EAC_TR_VERSION_2_02); - - if (r == SC_SUCCESS) { - pace_input.pin_id = pin_reference; - if (pin) { - pace_input.pin = pin->data; - pace_input.pin_length = pin->len; - } - - r = perform_pace(card, pace_input, &pace_output, EAC_TR_VERSION_2_02); - - if (r == SC_SUCCESS) { - sc_log(card->ctx, "%s resumed.\n"); - if (tries_left) { - *tries_left = MAX_PIN_TRIES; - } - } else { - if (tries_left) { - if (pace_output.mse_set_at_sw1 == 0x63 - && (pace_output.mse_set_at_sw2 & 0xc0) == 0xc0) { - *tries_left = pace_output.mse_set_at_sw2 & 0x0f; - } else { - *tries_left = -1; - } - } - } - } - } - - if (pin_reference == PACE_PIN_ID_PIN && tries_left) { - if (*tries_left == 0) { - sc_log(card->ctx, "%s is suspended and must be resumed.\n", - npa_secret_name(pin_reference)); - } else if (*tries_left == 1) { - sc_log(card->ctx, "%s is blocked and must be unblocked.\n", - npa_secret_name(pin_reference)); - } - } - - npa_cache_or_free(card, &pace_output.ef_cardaccess, - &pace_output.ef_cardaccess_length, NULL, NULL); - free(pace_output.recent_car); - free(pace_output.previous_car); - free(pace_output.id_icc); - free(pace_output.id_pcd); - - return r; -} - -static int npa_standard_pin_cmd(struct sc_card *card, - struct sc_pin_cmd_data *data, int *tries_left) -{ - int r; - struct sc_card_driver *iso_drv; - - iso_drv = sc_get_iso7816_driver(); - - if (!iso_drv || !iso_drv->ops || !iso_drv->ops->pin_cmd) { - r = SC_ERROR_INTERNAL; - } else { - r = iso_drv->ops->pin_cmd(card, data, tries_left); - } - - return r; -} - -static int npa_pin_cmd(struct sc_card *card, - struct sc_pin_cmd_data *data, int *tries_left) -{ - int r; - - if (!data) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - if (data->pin_type != SC_AC_CHV) { - r = SC_ERROR_NOT_SUPPORTED; - goto err; - } - - switch (data->cmd) { - case SC_PIN_CMD_GET_INFO: - r = npa_pin_cmd_get_info(card, data, tries_left); - if (r != SC_SUCCESS) - goto err; - break; - - case SC_PIN_CMD_UNBLOCK: - /* opensc-explorer unblocks the PIN by only sending - * SC_PIN_CMD_UNBLOCK whereas the PKCS#15 framework first verifies - * the PUK with SC_PIN_CMD_VERIFY and then calls with - * SC_PIN_CMD_UNBLOCK. - * - * Here we determine whether the PUK has been verified or not by - * checking if an SM channel has been established. */ - if (card->sm_ctx.sm_mode != SM_MODE_TRANSMIT) { - /* PUK has not yet been verified */ - r = npa_pace_verify(card, PACE_PIN_ID_PUK, &(data->pin1), NULL, - 0, NULL); - if (r != SC_SUCCESS) - goto err; - } - r = npa_reset_retry_counter(card, data->pin_reference, 0, - NULL, 0); - if (r != SC_SUCCESS) - goto err; - break; - - case SC_PIN_CMD_CHANGE: - case SC_PIN_CMD_VERIFY: - switch (data->pin_reference) { - case PACE_PIN_ID_CAN: - case PACE_PIN_ID_PUK: - case PACE_PIN_ID_MRZ: - case PACE_PIN_ID_PIN: - r = npa_pace_verify(card, data->pin_reference, - &(data->pin1), NULL, 0, tries_left); - if (r != SC_SUCCESS) - goto err; - break; - - default: - /* assuming QES PIN */ - - /* We assume that the eSign application has already been - * unlocked, see npa_init(). - * - * Now, verify the QES PIN. */ - r = npa_standard_pin_cmd(card, data, tries_left); - if (r != SC_SUCCESS) - goto err; - break; - } - - if (data->cmd == SC_PIN_CMD_CHANGE) { - r = npa_reset_retry_counter(card, data->pin_reference, 1, - (const char *) data->pin2.data, data->pin2.len); - if (r != SC_SUCCESS) - goto err; - } - break; - - default: - r = SC_ERROR_INTERNAL; - goto err; - break; - - } - -err: - SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, r); -} - -static int npa_logout(sc_card_t *card) -{ - struct sc_apdu apdu; - - sc_sm_stop(card); - - if (card->reader->capabilities & SC_READER_CAP_PACE_GENERIC) { - /* If PACE is done between reader and card, SM is transparent to us as - * it ends at the reader. With CLA=0x0C we provoque a SM error to - * disable SM on the reader. */ - sc_format_apdu(card, &apdu, SC_APDU_CASE_1, 0xA4, 0x00, 0x00); - apdu.cla = 0x0C; - sc_transmit_apdu(card, &apdu); - /* ignore result */ - } - return sc_select_file(card, sc_get_mf_path(), NULL); -} - -struct sc_card_driver *npa_get_driver(void) -{ - struct sc_card_driver *iso_drv = sc_get_iso7816_driver(); - - npa_ops = *iso_drv->ops; - npa_ops.match_card = npa_match_card; - npa_ops.init = npa_init; - npa_ops.finish = npa_finish; - npa_ops.set_security_env = npa_set_security_env; - npa_ops.pin_cmd = npa_pin_cmd; - npa_ops.logout = npa_logout; - - return &npa_drv; -} - -void *sc_module_init(const char *name) -{ - const char npa_name[] = "npa"; - if (name) { - if (strcmp(npa_name, name) == 0) - return npa_get_driver; - } - return NULL; -} - -const char *sc_driver_version(void) -{ - /* Tested with OpenSC 0.12 and 0.13.0, which can't be captured by checking - * our version info against OpenSC's PACKAGE_VERSION. For this reason we - * tell OpenSC that everything is fine, here. */ - return sc_get_version(); -} diff --git a/npa/src/card-npa.h b/npa/src/card-npa.h deleted file mode 100644 index abf8389..0000000 --- a/npa/src/card-npa.h +++ /dev/null @@ -1,48 +0,0 @@ -/* - * Copyright (C) 2014 Frank Morgner - * - * This file is part of npa. - * - * npa is free software: you can redistribute it and/or modify it under the - * terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * npa is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. - * - * You should have received a copy of the GNU General Public License along with - * npa. If not, see . - */ - -#ifndef _CARD_NPA_H -#define _CARD_NPA_H - -#ifdef __cplusplus -extern "C" { -#endif - -#include "libopensc/opensc.h" - -enum { - SC_CARD_TYPE_NPA = 42000, - SC_CARD_TYPE_NPA_TEST, - SC_CARD_TYPE_NPA_ONLINE, -}; - -const unsigned char esign_chat[] = { - 0x7F, 0x4C, 0x0E, - 0x06, 0x09, 0x04, 0x00, 0x7F, 0x00, 0x07, 0x03, 0x01, 0x02, 0x03, - 0x53, 0x01, 0x03, -}; - -static const unsigned char df_esign_aid[] = { 0xa0, 0x00, 0x00, 0x01, 0x67, 0x45, 0x53, 0x49, 0x47, 0x4e}; -static const unsigned char df_esign_path[] = { 0x3f, 0x00, 0x50, 0x15, 0x1f, 0xff}; -static const unsigned char ef_cardaccess_path[] = { 0x3f, 0x00, 0x01, 0x1c}; - -#ifdef __cplusplus -} -#endif -#endif diff --git a/npa/src/ccid-types.h b/npa/src/ccid-types.h deleted file mode 120000 index 0e46797..0000000 --- a/npa/src/ccid-types.h +++ /dev/null @@ -1 +0,0 @@ -../../ccid/src/ccid-types.h \ No newline at end of file diff --git a/npa/src/example.c b/npa/src/example.c deleted file mode 100644 index 475e26e..0000000 --- a/npa/src/example.c +++ /dev/null @@ -1,138 +0,0 @@ -/* - * Copyright (C) 2011 Frank Morgner - * - * This file is part of libnpa. - * - * libnpa is free software: you can redistribute it and/or modify it under the - * terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * libnpa is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. - * - * You should have received a copy of the GNU General Public License along with - * libnpa. If not, see . - */ - -/* This example shows how to use the library functions perform_pace to - * get a secure channel to the nPA. We use the builtin function npa_change_pin - * to modify the PIN using the secure channel. Then we transmit an arbitrary - * APDU encrypted and authenticated to the card using sm_transmit_apdu. */ -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include -#include -#include -#include - -static int reader_num = -1; - -static const char *newpin = NULL; -static const char *pin = NULL; - -/* SELECT the Master File (MF) */ -const unsigned char apdubuf[] = {0x00, 0xA4, 0x00, 0x0C, 0x02, 0x3F, 0x00}; - -int -main (int argc, char **argv) -{ - /* Set up the environment */ - int r; - - sc_context_t *ctx = NULL; - sc_card_t *card = NULL; - sc_reader_t *reader = NULL; - - sc_apdu_t apdu; - u8 buf[0xffff]; - - struct establish_pace_channel_input pace_input; - struct establish_pace_channel_output pace_output; - - memset(&pace_input, 0, sizeof pace_input); - memset(&pace_output, 0, sizeof pace_output); - - - /* Connect to a reader and the nPA */ - r = initialize(reader_num, 0, &ctx, &reader); - if (r < 0) { - fprintf(stderr, "Can't initialize reader\n"); - exit(1); - } - - if (sc_connect_card(reader, &card) < 0) { - fprintf(stderr, "Could not connect to card\n"); - sc_release_context(ctx); - exit(1); - } - - /* initialize OpenPACE */ - EAC_init(); - - - /* Now we try to change the PIN. Therefor we need to establish a SM channel - * with PACE. - * - * You could set your PIN with pin=“123456”; or just leave it at NULL to be - * asked for it. The same applies to the new PIN newpin. */ - pace_input.pin_id = PACE_PIN; - pace_input.pin = (unsigned char *) pin; - pace_input.pin_length = pin ? strlen(pin) : 0; - - r = perform_pace(card, pace_input, &pace_output, EAC_TR_VERSION_2_02); - if (r < 0) - goto err; - printf("Established PACE channel with PIN.\n"); - - r = npa_change_pin(card, newpin, newpin ? strlen(newpin) : 0); - if (r < 0) - goto err; - printf("Changed PIN.\n"); - - - /* Now we want to transmit additional APDUs in the established SM channel. - * - * Here we are parsing the raw apdu buffer apdubuf to be transformed into - * an sc_apdu_t. Alternatively you could also set CLA, INS, P1, P2, ... by - * hand in the sc_apdu_t object. */ - r = sc_bytes2apdu(ctx, apdubuf, sizeof apdubuf, &apdu); - if (r < 0) - goto err; - - /* write the response data to buf */ - apdu.resp = buf; - apdu.resplen = sizeof buf; - - /* Transmit the APDU with SM */ - r = sc_transmit_apdu(card, &apdu); - - -err: - fprintf(r < 0 ? stderr : stdout, "%s\n", sc_strerror(r)); - - /* Free up memory and wipe it if necessary (e.g. for keys stored in sm_ctx) */ - if (pace_output.ef_cardaccess) - free(pace_output.ef_cardaccess); - if (pace_output.recent_car) - free(pace_output.recent_car); - if (pace_output.previous_car) - free(pace_output.previous_car); - if (pace_output.id_icc) - free(pace_output.id_icc); - if (pace_output.id_pcd) - free(pace_output.id_pcd); - - sc_sm_stop(card); - sc_reset(card, 1); - sc_disconnect_card(card); - sc_release_context(ctx); - EAC_cleanup(); - - return -r; -} diff --git a/npa/src/iso-sm-internal.h b/npa/src/iso-sm-internal.h deleted file mode 100644 index 609d222..0000000 --- a/npa/src/iso-sm-internal.h +++ /dev/null @@ -1,90 +0,0 @@ -/* - * Copyright (C) 2014 Frank Morgner - * - * This file is part of npa. - * - * npa is free software: you can redistribute it and/or modify it under the - * terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * npa is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. - * - * You should have received a copy of the GNU General Public License along with - * npa. If not, see . - */ -/** - * @file - * @defgroup sm Interface to Secure Messaging (SM) defined in ISO 7816 - * @{ - */ -#ifndef _CCID_SM_INTERNAL_H -#define _CCID_SM_INTERNAL_H - -#include - -#ifdef __cplusplus -extern "C" { -#endif - - - -/* @brief Protect an APDU with Secure Messaging - * - * If secure messaging (SM) is activated in \a sctx and \a apdu is not already - * SM protected, \a apdu is processed with the following steps: - * \li call to \a sctx->pre_transmit - * \li encrypt \a apdu calling \a sctx->encrypt - * \li authenticate \a apdu calling \a sctx->authenticate - * \li copy the SM protected data to \a sm_apdu - * - * Data for authentication or encryption is always padded before the callback - * functions are called - * - * @param[in] card - * @param[in] apdu - * @param[in,out] sm_apdu - * - * @return \c SC_SUCCESS or error code if an error occurred - */ -int iso_get_sm_apdu(struct sc_card *card, struct sc_apdu *apdu, struct sc_apdu **sm_apdu); - -/* @brief Remove Secure Messaging from an APDU - * - * If secure messaging (SM) is activated in \a sctx and \a apdu is not already - * SM protected, \a apdu is processed with the following steps: - * \li verify SM protected \a apdu calling \a sctx->verify_authentication - * \li decrypt SM protected \a apdu calling \a sctx->decrypt - * \li copy decrypted/authenticated data and status bytes to \a apdu - * - * Callback functions must not remove padding. - * - * @param[in] card - * @param[in,out] apdu - * @param[in,out] sm_apdu will be freed when done. - * - * @return \c SC_SUCCESS or error code if an error occurred - */ -int iso_free_sm_apdu(struct sc_card *card, struct sc_apdu *apdu, struct sc_apdu **sm_apdu); - -/** - * @brief Cleans up allocated ressources of the ISO SM driver - * - * \c iso_sm_close() is designed as SM card operation. However, have in mind - * that this card operation is not called automatically for \c - * sc_disconnect_card() . - * - * @param[in] card - * - * @return \c SC_SUCCESS or error code if an error occurred - */ -int iso_sm_close(struct sc_card *card); - -#ifdef __cplusplus -} -#endif -#endif -/* @} */ diff --git a/npa/src/iso-sm.c b/npa/src/iso-sm.c deleted file mode 100644 index b3a4d0d..0000000 --- a/npa/src/iso-sm.c +++ /dev/null @@ -1,749 +0,0 @@ -/* - * Copyright (C) 2010 Frank Morgner - * - * This file is part of libnpa. - * - * libnpa is free software: you can redistribute it and/or modify it under the - * terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * libnpa is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. - * - * You should have received a copy of the GNU General Public License along with - * libnpa. If not, see . - */ -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#ifdef ENABLE_SM - -#include "iso-sm-internal.h" -#include -#include -#include -#include -#include -#include - -static const struct sc_asn1_entry c_sm_capdu[] = { - { "Padding-content indicator followed by cryptogram", - SC_ASN1_OCTET_STRING, SC_ASN1_CTX|0x07, SC_ASN1_OPTIONAL, NULL, NULL }, - { "Protected Le", - SC_ASN1_OCTET_STRING, SC_ASN1_CTX|0x17, SC_ASN1_OPTIONAL, NULL, NULL }, - { "Cryptographic Checksum", - SC_ASN1_OCTET_STRING, SC_ASN1_CTX|0x0E, SC_ASN1_OPTIONAL, NULL, NULL }, - { NULL , 0 , 0 , 0 , NULL , NULL } -}; - -static const struct sc_asn1_entry c_sm_rapdu[] = { - { "Padding-content indicator followed by cryptogram" , - SC_ASN1_OCTET_STRING, SC_ASN1_CTX|0x07, SC_ASN1_OPTIONAL, NULL, NULL }, - { "Processing Status", - SC_ASN1_OCTET_STRING, SC_ASN1_CTX|0x19, 0 , NULL, NULL }, - { "Cryptographic Checksum", - SC_ASN1_OCTET_STRING, SC_ASN1_CTX|0x0E, SC_ASN1_OPTIONAL, NULL, NULL }, - { NULL, 0, 0, 0, NULL, NULL } -}; - -static int -add_iso_pad(const u8 *data, size_t datalen, int block_size, u8 **padded) -{ - u8 *p; - size_t p_len; - - if (!padded) - return SC_ERROR_INVALID_ARGUMENTS; - - /* calculate length of padded message */ - p_len = (datalen / block_size) * block_size + block_size; - - p = realloc(*padded, p_len); - if (!p) - return SC_ERROR_OUT_OF_MEMORY; - - if (*padded != data) - /* Flawfinder: ignore */ - memcpy(p, data, datalen); - - *padded = p; - - /* now add iso padding */ - memset(p + datalen, 0x80, 1); - memset(p + datalen + 1, 0, p_len - datalen - 1); - - return p_len; -} - -static int -add_padding(const struct iso_sm_ctx *ctx, const u8 *data, size_t datalen, - u8 **padded) -{ - u8 *p; - - switch (ctx->padding_indicator) { - case SM_NO_PADDING: - if (*padded != data) { - p = realloc(*padded, datalen); - if (!p) - return SC_ERROR_OUT_OF_MEMORY; - *padded = p; - /* Flawfinder: ignore */ - memcpy(*padded, data, datalen); - } - return datalen; - case SM_ISO_PADDING: - return add_iso_pad(data, datalen, ctx->block_length, padded); - default: - return SC_ERROR_INVALID_ARGUMENTS; - } -} - -static int -rm_padding(u8 padding_indicator, const u8 *data, size_t datalen) -{ - if (!datalen || !data) - return SC_ERROR_INVALID_ARGUMENTS; - - size_t len; - - switch (padding_indicator) { - case SM_NO_PADDING: - len = datalen; - break; - - case SM_ISO_PADDING: - len = datalen; - - while (len) { - len--; - if (data[len]) - break; - } - - if (data[len] != 0x80) - return SC_ERROR_INVALID_DATA; - - break; - - default: - return SC_ERROR_NOT_SUPPORTED; - } - - return len; -} - -static int format_le(size_t le, struct sc_asn1_entry *le_entry, - u8 **lebuf, size_t *le_len) -{ - u8 *p; - - if (!lebuf || !le_len) - return SC_ERROR_INVALID_ARGUMENTS; - - p = realloc(*lebuf, *le_len); - if (!p) - return SC_ERROR_OUT_OF_MEMORY; - *lebuf = p; - - switch (*le_len) { - case 1: - p[0] = le; - break; - case 2: - p[0] = le >> 8; - p[1] = le & 0xff; - break; - case 3: - p[0] = 0x00; - p[1] = le >> 8; - p[2] = le & 0xff; - break; - default: - return SC_ERROR_INVALID_ARGUMENTS; - } - - sc_format_asn1_entry(le_entry, *lebuf, le_len, SC_ASN1_PRESENT); - - return SC_SUCCESS; -} - -static int prefix_buf(u8 prefix, u8 *buf, size_t buflen, u8 **cat) -{ - u8 *p; - - p = realloc(*cat, buflen + 1); - if (!p) - return SC_ERROR_OUT_OF_MEMORY; - - if (*cat == buf) { - memmove(p + 1, p, buflen); - } else { - /* Flawfinder: ignore */ - memcpy(p + 1, buf, buflen); - } - p[0] = prefix; - - *cat = p; - - return buflen + 1; -} - -static int format_data(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *data, size_t datalen, - struct sc_asn1_entry *formatted_encrypted_data_entry, - u8 **formatted_data, size_t *formatted_data_len) -{ - int r; - u8 *pad_data = NULL; - size_t pad_data_len = 0; - - if (!ctx || !formatted_data || !formatted_data_len) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - r = add_padding(ctx, data, datalen, &pad_data); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not add padding to data: %s", - sc_strerror(r)); - goto err; - } - pad_data_len = r; - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Data to encrypt", pad_data, pad_data_len); - r = ctx->encrypt(card, ctx, pad_data, pad_data_len, formatted_data); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not encrypt the data"); - goto err; - } - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Cryptogram", *formatted_data, r); - - r = prefix_buf(ctx->padding_indicator, *formatted_data, r, formatted_data); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not prepend padding indicator to formatted " - "data: %s", sc_strerror(r)); - goto err; - } - - *formatted_data_len = r; - sc_format_asn1_entry(formatted_encrypted_data_entry, - *formatted_data, formatted_data_len, SC_ASN1_PRESENT); - - r = SC_SUCCESS; - -err: - if (pad_data) { - sc_mem_clear(pad_data, pad_data_len); - free(pad_data); - } - - return r; -} - -static int format_head(const struct iso_sm_ctx *ctx, const sc_apdu_t *apdu, - u8 **formatted_head) -{ - if (!apdu || !formatted_head) - return SC_ERROR_INVALID_ARGUMENTS; - - u8 *p = realloc(*formatted_head, 4); - if (!p) - return SC_ERROR_OUT_OF_MEMORY; - - p[0] = apdu->cla; - p[1] = apdu->ins; - p[2] = apdu->p1; - p[3] = apdu->p2; - *formatted_head = p; - - return add_padding(ctx, *formatted_head, 4, formatted_head); -} - -static int sm_encrypt(const struct iso_sm_ctx *ctx, sc_card_t *card, - const sc_apdu_t *apdu, sc_apdu_t **psm_apdu) -{ - struct sc_asn1_entry sm_capdu[4]; - u8 *p, *le = NULL, *sm_data = NULL, *fdata = NULL, *mac_data = NULL, - *asn1 = NULL, *mac = NULL, *resp_data = NULL; - size_t sm_data_len, fdata_len, mac_data_len, asn1_len, mac_len, le_len; - int r, cse; - sc_apdu_t *sm_apdu = NULL; - - if (!apdu || !ctx || !card || !card->reader || !psm_apdu) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - if ((apdu->cla & 0x0C) == 0x0C) { - r = SC_ERROR_INVALID_ARGUMENTS; - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Given APDU is already protected with some secure messaging"); - goto err; - } - - sc_copy_asn1_entry(c_sm_capdu, sm_capdu); - - sm_apdu = malloc(sizeof(sc_apdu_t)); - if (!sm_apdu) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - sm_apdu->control = apdu->control; - sm_apdu->flags = apdu->flags; - sm_apdu->cla = apdu->cla|0x0C; - sm_apdu->ins = apdu->ins; - sm_apdu->p1 = apdu->p1; - sm_apdu->p2 = apdu->p2; - r = format_head(ctx, sm_apdu, &mac_data); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format header of SM apdu"); - goto err; - } - mac_data_len = r; - - /* get le and data depending on the case of the insecure command */ - cse = apdu->cse; - if ((apdu->le/ctx->block_length + 1)*ctx->block_length + 18 > 0xff+1) - /* for encrypted APDUs we usually get authenticated status bytes (4B), - * a MAC (11B) and a cryptogram with padding indicator (3B without - * data). The cryptogram is always padded to the block size. */ - cse |= SC_APDU_EXT; - - switch (cse) { - case SC_APDU_CASE_1: - break; - case SC_APDU_CASE_2_SHORT: - le_len = 1; - r = format_le(apdu->le, sm_capdu + 1, &le, &le_len); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format Le of SM apdu"); - goto err; - } - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Protected Le (plain)", le, le_len); - break; - case SC_APDU_CASE_2_EXT: - if (card->reader->active_protocol == SC_PROTO_T0) { - /* T0 extended APDUs look just like short APDUs */ - le_len = 1; - r = format_le(apdu->le, sm_capdu + 1, &le, &le_len); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format Le of SM apdu"); - goto err; - } - } else { - /* in case of T1 always use 2 bytes for length */ - le_len = 2; - r = format_le(apdu->le, sm_capdu + 1, &le, &le_len); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format Le of SM apdu"); - goto err; - } - } - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Protected Le (plain)", le, le_len); - break; - case SC_APDU_CASE_3_SHORT: - case SC_APDU_CASE_3_EXT: - r = format_data(card, ctx, apdu->data, apdu->datalen, - sm_capdu + 0, &fdata, &fdata_len); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format data of SM apdu"); - goto err; - } - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Padding-content indicator followed by cryptogram (plain)", - fdata, fdata_len); - break; - case SC_APDU_CASE_4_SHORT: - /* in case of T0 no Le byte is added */ - if (card->reader->active_protocol != SC_PROTO_T0) { - le_len = 1; - r = format_le(apdu->le, sm_capdu + 1, &le, &le_len); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format Le of SM apdu"); - goto err; - } - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Protected Le (plain)", le, le_len); - } - - r = format_data(card, ctx, apdu->data, apdu->datalen, - sm_capdu + 0, &fdata, &fdata_len); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format data of SM apdu"); - goto err; - } - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Padding-content indicator followed by cryptogram (plain)", - fdata, fdata_len); - break; - case SC_APDU_CASE_4_EXT: - if (card->reader->active_protocol == SC_PROTO_T0) { - /* again a T0 extended case 4 APDU looks just - * like a short APDU, the additional data is - * transferred using ENVELOPE and GET RESPONSE */ - } else { - /* only 2 bytes are use to specify the length of the - * expected data */ - le_len = 2; - r = format_le(apdu->le, sm_capdu + 1, &le, &le_len); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format Le of SM apdu"); - goto err; - } - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Protected Le (plain)", le, le_len); - } - - r = format_data(card, ctx, apdu->data, apdu->datalen, - sm_capdu + 0, &fdata, &fdata_len); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not format data of SM apdu"); - goto err; - } - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Padding-content indicator followed by cryptogram (plain)", - fdata, fdata_len); - break; - default: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Unhandled apdu case"); - r = SC_ERROR_INVALID_DATA; - goto err; - } - - - r = sc_asn1_encode(card->ctx, sm_capdu, (u8 **) &asn1, &asn1_len); - if (r < 0) { - goto err; - } - if (asn1_len) { - p = realloc(mac_data, mac_data_len + asn1_len); - if (!p) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - mac_data = p; - /* Flawfinder: ignore */ - memcpy(mac_data + mac_data_len, asn1, asn1_len); - mac_data_len += asn1_len; - r = add_padding(ctx, mac_data, mac_data_len, &mac_data); - if (r < 0) { - goto err; - } - mac_data_len = r; - } - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Data to authenticate", mac_data, mac_data_len); - - r = ctx->authenticate(card, ctx, mac_data, mac_data_len, - &mac); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get authentication code"); - goto err; - } - mac_len = r; - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Cryptographic Checksum (plain)", mac, mac_len); - - - /* format SM apdu */ - sc_format_asn1_entry(sm_capdu + 2, mac, &mac_len, SC_ASN1_PRESENT); - r = sc_asn1_encode(card->ctx, sm_capdu, (u8 **) &sm_data, &sm_data_len); - if (r < 0) - goto err; - sm_apdu->data = sm_data; - sm_apdu->datalen = sm_data_len; - sm_apdu->lc = sm_data_len; - sm_apdu->le = 0; - if (cse & SC_APDU_EXT) { - sm_apdu->cse = SC_APDU_CASE_4_EXT; -#if OPENSC_NOT_BOGUS_ANYMORE - sm_apdu->resplen = 0xffff+1; -#else - sm_apdu->resplen = SC_MAX_EXT_APDU_BUFFER_SIZE; -#endif - } else { - sm_apdu->cse = SC_APDU_CASE_4_SHORT; -#if OPENSC_NOT_BOGUS_ANYMORE - sm_apdu->resplen = 0xff+1; -#else - sm_apdu->resplen = SC_MAX_APDU_BUFFER_SIZE; -#endif - } - resp_data = malloc(sm_apdu->resplen); - if (!resp_data) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - sm_apdu->resp = resp_data; - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "ASN.1 encoded encrypted APDU data", sm_apdu->data, sm_apdu->datalen); - - *psm_apdu = sm_apdu; - -err: - free(fdata); - free(asn1); - free(mac_data); - free(mac); - free(le); - if (r < 0) { - free(resp_data); - free(sm_apdu); - free(sm_data); - } - - return r; -} - -static int sm_decrypt(const struct iso_sm_ctx *ctx, sc_card_t *card, - const sc_apdu_t *sm_apdu, sc_apdu_t *apdu) -{ - int r; - struct sc_asn1_entry sm_rapdu[4]; - struct sc_asn1_entry my_sm_rapdu[4]; - u8 sw[2], mac[8], fdata[SC_MAX_EXT_APDU_BUFFER_SIZE]; - size_t sw_len = sizeof sw, mac_len = sizeof mac, fdata_len = sizeof fdata, - buf_len, asn1_len; - const u8 *buf; - u8 *data = NULL, *mac_data = NULL, *asn1 = NULL; - - sc_copy_asn1_entry(c_sm_rapdu, sm_rapdu); - sc_format_asn1_entry(sm_rapdu + 0, fdata, &fdata_len, 0); - sc_format_asn1_entry(sm_rapdu + 1, sw, &sw_len, 0); - sc_format_asn1_entry(sm_rapdu + 2, mac, &mac_len, 0); - - r = sc_asn1_decode(card->ctx, sm_rapdu, sm_apdu->resp, sm_apdu->resplen, - &buf, &buf_len); - if (r < 0) - goto err; - if (buf_len > 0) { - r = SC_ERROR_UNKNOWN_DATA_RECEIVED; - goto err; - } - - - if (sm_rapdu[2].flags & SC_ASN1_PRESENT) { - /* copy from sm_apdu to my_sm_apdu, but leave mac at default */ - sc_copy_asn1_entry(sm_rapdu, my_sm_rapdu); - sc_copy_asn1_entry(&c_sm_rapdu[2], &my_sm_rapdu[2]); - - r = sc_asn1_encode(card->ctx, my_sm_rapdu, &asn1, &asn1_len); - if (r < 0) - goto err; - r = add_padding(ctx, asn1, asn1_len, &mac_data); - if (r < 0) { - goto err; - } - - r = ctx->verify_authentication(card, ctx, mac, mac_len, - mac_data, r); - if (r < 0) - goto err; - } else { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Cryptographic Checksum missing"); - r = SC_ERROR_ASN1_OBJECT_NOT_FOUND; - goto err; - } - - - if (sm_rapdu[0].flags & SC_ASN1_PRESENT) { - if (ctx->padding_indicator != fdata[0]) { - r = SC_ERROR_UNKNOWN_DATA_RECEIVED; - goto err; - } - r = ctx->decrypt(card, ctx, fdata + 1, fdata_len - 1, &data); - if (r < 0) - goto err; - buf_len = r; - - r = rm_padding(ctx->padding_indicator, data, buf_len); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not remove padding"); - goto err; - } - - if (apdu->resplen < r || (r && !apdu->resp)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, - "Response of SM APDU %u byte%s too long", r-apdu->resplen, - r-apdu->resplen < 2 ? "" : "s"); - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - /* Flawfinder: ignore */ - memcpy(apdu->resp, data, r); - apdu->resplen = r; - } else { - apdu->resplen = 0; - } - - if (sm_rapdu[1].flags & SC_ASN1_PRESENT) { - if (sw_len != 2) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Length of processing status bytes must be 2"); - r = SC_ERROR_ASN1_END_OF_CONTENTS; - goto err; - } - apdu->sw1 = sw[0]; - apdu->sw2 = sw[1]; - } else { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Authenticated status bytes are missing"); - r = SC_ERROR_ASN1_OBJECT_NOT_FOUND; - goto err; - } - - sc_debug(card->ctx, SC_LOG_DEBUG_NORMAL, "Decrypted APDU sw1=%02x sw2=%02x", - apdu->sw1, apdu->sw2); - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Decrypted APDU response data", - apdu->resp, apdu->resplen); - - r = SC_SUCCESS; - -err: - free(asn1); - free(mac_data); - if (data) { - sc_mem_clear(data, buf_len); - free(data); - } - - return r; -} - -static int iso_add_sm(struct iso_sm_ctx *sctx, sc_card_t *card, - sc_apdu_t *apdu, sc_apdu_t **sm_apdu) -{ - if (!card || !sctx) - return SC_ERROR_INVALID_ARGUMENTS; - - if ((apdu->cla & 0x0C) == 0x0C) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Given APDU is already protected with some secure messaging. Closing own SM context."); - SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, sc_sm_stop(card), - "Could not close ISO SM session"); - return SC_ERROR_SM_NOT_APPLIED; - } - - if (sctx->pre_transmit) - SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, sctx->pre_transmit(card, sctx, apdu), - "Could not complete SM specific pre transmit routine"); - SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, sm_encrypt(sctx, card, apdu, sm_apdu), - "Could not encrypt APDU"); - - return SC_SUCCESS; -} - -static int iso_rm_sm(struct iso_sm_ctx *sctx, sc_card_t *card, - sc_apdu_t *sm_apdu, sc_apdu_t *apdu) -{ - if (sctx->post_transmit) - SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, sctx->post_transmit(card, sctx, sm_apdu), - "Could not complete SM specific post transmit routine"); - SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, sm_decrypt(sctx, card, sm_apdu, apdu), - "Could not decrypt APDU"); - if (sctx->finish) - SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, sctx->finish(card, sctx, apdu), - "Could not complete SM specific post transmit routine"); - - return SC_SUCCESS; -} - -int iso_sm_close(struct sc_card *card) -{ - if (card) { - iso_sm_ctx_clear_free(card->sm_ctx.info.cmd_data); - card->sm_ctx.info.cmd_data = NULL; - } - - return SC_SUCCESS; -} - -int iso_get_sm_apdu(struct sc_card *card, struct sc_apdu *apdu, struct sc_apdu **sm_apdu) -{ - return iso_add_sm(card->sm_ctx.info.cmd_data, card, apdu, sm_apdu); -} - -int iso_free_sm_apdu(struct sc_card *card, struct sc_apdu *apdu, struct sc_apdu **sm_apdu) -{ - if (!sm_apdu) - return SC_ERROR_INVALID_ARGUMENTS; - - struct sc_apdu *p = *sm_apdu; - - int r = iso_rm_sm(card->sm_ctx.info.cmd_data, card, p, apdu); - - if (p) { - free((unsigned char *) p->data); - free((unsigned char *) p->resp); - } - free(*sm_apdu); - *sm_apdu = NULL; - - return r; -} - -struct iso_sm_ctx *iso_sm_ctx_create(void) -{ - struct iso_sm_ctx *sctx = malloc(sizeof *sctx); - if (!sctx) - return NULL; - - sctx->priv_data = NULL; - sctx->padding_indicator = SM_ISO_PADDING; - sctx->block_length = 0; - sctx->authenticate = NULL; - sctx->verify_authentication = NULL; - sctx->encrypt = NULL; - sctx->decrypt = NULL; - sctx->pre_transmit = NULL; - sctx->post_transmit = NULL; - sctx->finish = NULL; - sctx->clear_free = NULL; - - return sctx; -} - -void iso_sm_ctx_clear_free(struct iso_sm_ctx *sctx) -{ - if (sctx && sctx->clear_free) - sctx->clear_free(sctx); - free(sctx); -} - -int iso_sm_start(struct sc_card *card, struct iso_sm_ctx *sctx) -{ - if (!card) - return SC_ERROR_INVALID_ARGUMENTS; - - if (card->sm_ctx.ops.close) - card->sm_ctx.ops.close(card); - - card->sm_ctx.info.cmd_data = sctx; - card->sm_ctx.ops.close = iso_sm_close; - card->sm_ctx.ops.free_sm_apdu = iso_free_sm_apdu; - card->sm_ctx.ops.get_sm_apdu = iso_get_sm_apdu; - card->sm_ctx.sm_mode = SM_MODE_TRANSMIT; - - return SC_SUCCESS; -} - -#else - -int iso_sm_close(struct sc_card *card) -{ - return SC_ERROR_NOT_SUPPORTED; -} - -int iso_get_sm_apdu(struct sc_card *card, struct sc_apdu *apdu, struct sc_apdu **sm_apdu) -{ - return SC_ERROR_NOT_SUPPORTED; -} - -struct iso_sm_ctx *iso_sm_ctx_create(void) -{ - return NULL; -} - -void iso_sm_ctx_clear_free(struct iso_sm_ctx *sctx) -{ -} - -int iso_sm_start(struct sc_card *card, struct iso_sm_ctx *sctx) -{ - return SC_ERROR_NOT_SUPPORTED; -} - -#endif diff --git a/npa/src/npa-tool.c b/npa/src/npa-tool.c deleted file mode 100644 index 55305fe..0000000 --- a/npa/src/npa-tool.c +++ /dev/null @@ -1,804 +0,0 @@ -/* - * Copyright (C) 2010-2012 Frank Morgner - * - * This file is part of libnpa. - * - * libnpa is free software: you can redistribute it and/or modify it under the - * terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * libnpa is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. - * - * You should have received a copy of the GNU General Public License along with - * libnpa. If not, see . - */ -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "cmdline.h" -#include "sslutil.h" -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#ifndef HAVE_GETLINE -static ssize_t getline(char **lineptr, size_t *n, FILE *stream) -{ - if (!lineptr) - return -1; - - char *p = realloc(*lineptr, SC_MAX_EXT_APDU_BUFFER_SIZE*3); - if (!p) - return -1; - *lineptr = p; - - if (fgets(p, SC_MAX_EXT_APDU_BUFFER_SIZE*3, stream) == NULL) - return -1; - - return strlen(p); -} -#endif - -static void read_dg(sc_card_t *card, unsigned char sfid, const char *dg_str, - unsigned char **dg, size_t *dg_len) -{ - int r = read_binary_rec(card, sfid, dg, dg_len); - if (r < 0) - fprintf(stderr, "Coult not read DG %02u %s (%s)\n", - sfid, dg_str, sc_strerror(r)); - else { - fprintf(stdout, "Read "); - bin_print(stdout, dg_str, *dg, *dg_len); - } -} - -static void write_dg(sc_card_t *card, unsigned char sfid, const char *dg_str, - const char *dg_hex) -{ - unsigned char dg[0xff]; - size_t dg_len = sizeof dg; - int r; - - r = sc_hex_to_bin(dg_hex, dg, &dg_len); - if (r < 0) { - fprintf(stderr, "Could not parse DG %02u %s (%s)\n", - sfid, dg_str, sc_strerror(r)); - } else { - r = write_binary_rec(card, sfid, dg, dg_len); - if (r < 0) - fprintf(stderr, "Could not write DG %02u %s (%s)\n", - sfid, dg_str, sc_strerror(r)); - else - printf("Wrote DG %02u %s\n", sfid, dg_str); - } -} - -#define ISO_VERIFY 0x20 -static void verify(sc_card_t *card, const char *verify_str, - unsigned char *data, size_t data_len) -{ - sc_apdu_t apdu; - int r; - - sc_format_apdu(card, &apdu, SC_APDU_CASE_3_SHORT, ISO_VERIFY, 0x80, 0); - apdu.cla = 0x80; - apdu.data = data; - apdu.datalen = data_len; - apdu.lc = data_len; - - r = sc_transmit_apdu(card, &apdu); - if (r < 0) - fprintf(stderr, "Coult not verify %s (%s)\n", - verify_str, sc_strerror(r)); - else - printf("Verified %s\n", verify_str); -} - -int npa_translate_apdus(sc_card_t *card, FILE *input) -{ - u8 buf[4 + 3 + 0xffff + 3]; - char *read = NULL; - size_t readlen = 0, apdulen; - sc_apdu_t apdu; - ssize_t linelen; - int r; - - memset(&apdu, 0, sizeof apdu); - - while (1) { - if (input == stdin) - printf("Enter unencrypted C-APDU (empty line to exit)\n"); - - linelen = getline(&read, &readlen, input); - if (linelen <= 1) { - if (linelen < 0) { - r = SC_ERROR_INTERNAL; - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE_TOOL, - "Could not read line"); - } else { - r = SC_SUCCESS; - printf("Thanks for flying with ccid\n"); - } - break; - } - read[linelen - 1] = 0; - - apdulen = sizeof buf; - if (sc_hex_to_bin(read, buf, &apdulen) < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE_TOOL, - "Could not format binary string"); - continue; - } - if (input != stdin) - bin_print(stdout, "Unencrypted C-APDU", buf, apdulen); - - r = sc_bytes2apdu(card->ctx, buf, apdulen, &apdu); - if (r < 0) { - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Invalid C-APDU", buf, apdulen); - continue; - } - - apdu.resp = buf; - apdu.resplen = sizeof buf; - - r = sc_transmit_apdu(card, &apdu); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE_TOOL, - "Could not send C-APDU: %s", sc_strerror(r)); - continue; - } - - printf("Decrypted R-APDU sw1=%02x sw2=%02x\n", apdu.sw1, apdu.sw2); - bin_print(stdout, "Decrypted R-APDU response data", apdu.resp, apdu.resplen); - printf("======================================================================\n"); - } - - if (read) - free(read); - - return r; -} - -static int add_to_ASN1_AUXILIARY_DATA( - ASN1_AUXILIARY_DATA **auxiliary_data, - int nid, const unsigned char *data, size_t data_len) -{ - int r; - CVC_DISCRETIONARY_DATA_TEMPLATE *template = NULL; - - if (!auxiliary_data) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - if (!*auxiliary_data) { - *auxiliary_data = ASN1_AUXILIARY_DATA_new(); - if (!*auxiliary_data) { - r = SC_ERROR_INTERNAL; - goto err; - } - } - - template = CVC_DISCRETIONARY_DATA_TEMPLATE_new(); - if (!template) { - r = SC_ERROR_INTERNAL; - goto err; - } - - template->type = OBJ_nid2obj(nid); - if (!template->type) { - r = SC_ERROR_INTERNAL; - goto err; - } - - if (data && data_len) { - template->discretionary_data3 = ASN1_OCTET_STRING_new(); - if (!template->discretionary_data3 - || !M_ASN1_OCTET_STRING_set( - template->discretionary_data3, data, data_len)) { - r = SC_ERROR_INTERNAL; - goto err; - } - } - - if (!sk_push((_STACK*) (*auxiliary_data), template)) { - r = SC_ERROR_INTERNAL; - goto err; - } - - r = SC_SUCCESS; - -err: - return r; -} - -int -main (int argc, char **argv) -{ - const char *newpin = NULL; - const char *pin = NULL; - const char *puk = NULL; - const char *can = NULL; - const char *mrz = NULL; - - unsigned char chat[0xff]; - unsigned char desc[0xffff]; - unsigned char **certs = NULL; - size_t *certs_lens = NULL; - unsigned char *privkey = NULL; - size_t privkey_len = 0; - unsigned char auxiliary_data[0xff]; - size_t auxiliary_data_len = 0; - unsigned char community_id[0xf]; - size_t community_id_len = 0; - - sc_context_t *ctx = NULL; - sc_card_t *card = NULL; - sc_reader_t *reader; - - int r, tr_version = EAC_TR_VERSION_2_02; - struct establish_pace_channel_input pace_input; - struct establish_pace_channel_output pace_output; - struct timeval tv; - size_t i; - FILE *input = NULL; - CVC_CERT *cvc_cert = NULL; - unsigned char *certs_chat = NULL; - unsigned char *dg = NULL; - size_t dg_len = 0; - ASN1_AUXILIARY_DATA *templates = NULL; - unsigned char *ef_cardsecurity = NULL; - size_t ef_cardsecurity_len = 0; - - struct gengetopt_args_info cmdline; - - memset(&pace_input, 0, sizeof pace_input); - memset(&pace_output, 0, sizeof pace_output); - - - /* Parse command line */ - if (cmdline_parser (argc, argv, &cmdline) != 0) - exit(1); - if (cmdline.env_flag) { - can = getenv("CAN"); - mrz = getenv("MRZ"); - pin = getenv("PIN"); - puk = getenv("PUK"); - newpin = getenv("NEWPIN"); - } - can = cmdline.can_arg; - mrz = cmdline.mrz_arg; - pin = cmdline.pin_arg; - puk = cmdline.puk_arg; - newpin = cmdline.new_pin_arg; - if (cmdline.chat_given) { - pace_input.chat = chat; - pace_input.chat_length = sizeof chat; - if (sc_hex_to_bin(cmdline.chat_arg, (u8 *) pace_input.chat, - &pace_input.chat_length) < 0) { - fprintf(stderr, "Could not parse CHAT.\n"); - exit(2); - } - } - if (cmdline.cert_desc_given) { - pace_input.certificate_description = desc; - pace_input.certificate_description_length = sizeof desc; - if (sc_hex_to_bin(cmdline.cert_desc_arg, - (u8 *) pace_input.certificate_description, - &pace_input.certificate_description_length) < 0) { - fprintf(stderr, "Could not parse certificate description.\n"); - exit(2); - } - } - if (cmdline.tr_03110v201_flag) - tr_version = EAC_TR_VERSION_2_01; - if (cmdline.disable_all_checks_flag) - npa_default_flags |= NPA_FLAG_DISABLE_CHECK_ALL; - if (cmdline.disable_ta_checks_flag) - npa_default_flags |= NPA_FLAG_DISABLE_CHECK_TA; - if (cmdline.disable_ca_checks_flag) - npa_default_flags |= NPA_FLAG_DISABLE_CHECK_CA; - - - if (cmdline.info_flag) - return print_avail(cmdline.verbose_given); - - - r = initialize(cmdline.reader_arg, cmdline.verbose_given, &ctx, &reader); - if (r < 0) { - fprintf(stderr, "Can't initialize reader\n"); - exit(1); - } - - if (sc_connect_card(reader, &card) < 0) { - fprintf(stderr, "Could not connect to card\n"); - sc_release_context(ctx); - exit(1); - } - -#ifdef DISABLE_GLOBAL_BOXING_INITIALIZATION - sc_detect_boxing_cmds(card->reader); -#else - sc_initialize_boxing_cmds(ctx); -#endif - - EAC_init(); - if (cmdline.cvc_dir_given) - EAC_set_cvc_default_dir(cmdline.cvc_dir_arg); - if (cmdline.x509_dir_given) - EAC_set_x509_default_dir(cmdline.cvc_dir_arg); - - if (cmdline.break_flag) { - /* The biggest buffer sprintf could write with "%llu" */ - char secretbuf[strlen("18446744073709551615")+1]; - unsigned long long secret = 0; - unsigned long long maxsecret = 0; - - if (cmdline.pin_given) { - pace_input.pin_id = PACE_PIN; - pace_input.pin_length = 6; - maxsecret = 999999; - if (pin) { - if (sscanf(pin, "%llu", &secret) != 1) { - fprintf(stderr, "%s is not an unsigned long long.\n", - npa_secret_name(pace_input.pin_id)); - exit(2); - } - if (strlen(pin) > pace_input.pin_length) { - fprintf(stderr, "%s too big, only %u digits allowed.\n", - npa_secret_name(pace_input.pin_id), - (unsigned int) pace_input.pin_length); - exit(2); - } - } - } else if (cmdline.can_given) { - pace_input.pin_id = PACE_CAN; - pace_input.pin_length = 6; - maxsecret = 999999; - if (can) { - if (sscanf(can, "%llu", &secret) != 1) { - fprintf(stderr, "%s is not an unsigned long long.\n", - npa_secret_name(pace_input.pin_id)); - exit(2); - } - if (strlen(can) > pace_input.pin_length) { - fprintf(stderr, "%s too big, only %u digits allowed.\n", - npa_secret_name(pace_input.pin_id), - (unsigned int) pace_input.pin_length); - exit(2); - } - } - } else if (cmdline.puk_given) { - pace_input.pin_id = PACE_PUK; - pace_input.pin_length = 10; - maxsecret = 9999999999LLU; - if (puk) { - if (sscanf(puk, "%llu", &secret) != 1) { - fprintf(stderr, "%s is not an unsigned long long.\n", - npa_secret_name(pace_input.pin_id)); - exit(2); - } - if (strlen(puk) > pace_input.pin_length) { - fprintf(stderr, "%s too big, only %u digits allowed.\n", - npa_secret_name(pace_input.pin_id), - (unsigned int) pace_input.pin_length); - exit(2); - } - } - } else { - fprintf(stderr, "Please specify whether to do PACE with " - "PIN, CAN or PUK.\n"); - exit(1); - } - - pace_input.pin = (unsigned char *) secretbuf; - - do { - sprintf(secretbuf, "%0*llu", (unsigned int) pace_input.pin_length, secret); - - gettimeofday(&tv, NULL); - printf("%u,%06u: Trying %s=%s\n", - (unsigned int) tv.tv_sec, (unsigned int) tv.tv_usec, - npa_secret_name(pace_input.pin_id), pace_input.pin); - - r = perform_pace(card, pace_input, &pace_output, tr_version); - - secret++; - } while (0 > r && secret <= maxsecret); - - gettimeofday(&tv, NULL); - if (0 > r) { - printf("%u,%06u: Tried breaking %s without success.\n", - (unsigned int) tv.tv_sec, (unsigned int) tv.tv_usec, - npa_secret_name(pace_input.pin_id)); - goto err; - } else { - printf("%u,%06u: Tried breaking %s with success (=%s).\n", - (unsigned int) tv.tv_sec, (unsigned int) tv.tv_usec, - npa_secret_name(pace_input.pin_id), - pace_input.pin); - } - } - - if (cmdline.resume_flag) { - pace_input.pin_id = PACE_CAN; - if (can) { - pace_input.pin = (unsigned char *) can; - pace_input.pin_length = strlen(can); - } else { - pace_input.pin = NULL; - pace_input.pin_length = 0; - } - r = perform_pace(card, pace_input, &pace_output, tr_version); - if (r < 0) - goto err; - printf("Established PACE channel with CAN.\n"); - - pace_input.pin_id = PACE_PIN; - if (pin) { - pace_input.pin = (unsigned char *) pin; - pace_input.pin_length = strlen(pin); - } else { - pace_input.pin = NULL; - pace_input.pin_length = 0; - } - r = perform_pace(card, pace_input, &pace_output, tr_version); - if (r < 0) - goto err; - printf("Established PACE channel with PIN. PIN resumed.\n"); - } - - if (cmdline.unblock_flag) { - pace_input.pin_id = PACE_PUK; - if (puk) { - pace_input.pin = (unsigned char *) puk; - pace_input.pin_length = strlen(puk); - } else { - pace_input.pin = NULL; - pace_input.pin_length = 0; - } - r = perform_pace(card, pace_input, &pace_output, tr_version); - if (r < 0) - goto err; - printf("Established PACE channel with PUK.\n"); - - r = npa_unblock_pin(card); - if (r < 0) - goto err; - printf("Unblocked PIN.\n"); - } - - if (cmdline.new_pin_given) { - pace_input.pin_id = PACE_PIN; - if (pin) { - pace_input.pin = (unsigned char *) pin; - pace_input.pin_length = strlen(pin); - } else { - pace_input.pin = NULL; - pace_input.pin_length = 0; - } - r = perform_pace(card, pace_input, &pace_output, tr_version); - if (r < 0) - goto err; - printf("Established PACE channel with PIN.\n"); - - r = npa_change_pin(card, newpin, newpin ? strlen(newpin) : 0); - if (r < 0) - goto err; - printf("Changed PIN.\n"); - } - - if (cmdline.translate_given - || (!cmdline.resume_flag && !cmdline.new_pin_given - && !cmdline.unblock_flag && !cmdline.break_given)) { - - if (cmdline.cv_certificate_given || cmdline.private_key_given - || cmdline.auxiliary_data_given) { - if (!cmdline.cv_certificate_given || !cmdline.private_key_given) { - fprintf(stderr, "Need at least the terminal's certificate " - "and its private key to perform terminal authentication.\n"); - exit(1); - } - - certs = calloc(sizeof *certs, cmdline.cv_certificate_given + 1); - certs_lens = calloc(sizeof *certs_lens, - cmdline.cv_certificate_given + 1); - if (!certs || !certs_lens) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - for (i = 0; i < cmdline.cv_certificate_given; i++) { - if (!fread_to_eof(cmdline.cv_certificate_arg[i], - (unsigned char **) &certs[i], &certs_lens[i])) { - fprintf(stderr, "Could not read certificate.\n"); - r = SC_ERROR_INVALID_DATA; - goto err; - } - } - - if (!pace_input.chat_length) { - const unsigned char *p = certs[cmdline.cv_certificate_given-1]; - if (!CVC_d2i_CVC_CERT(&cvc_cert, &p, certs_lens[cmdline.cv_certificate_given-1]) - || !cvc_cert || !cvc_cert->body - || !cvc_cert->body->certificate_authority_reference - || !cvc_cert->body->chat) { - fprintf(stderr, "Could not parse certificate.\n"); - ssl_error(ctx); - r = SC_ERROR_INVALID_DATA; - goto err; - } - pace_input.chat_length = i2d_CVC_CHAT(cvc_cert->body->chat, &certs_chat); - if (0 >= (int) pace_input.chat_length) { - fprintf(stderr, "Could not parse CHAT.\n"); - r = SC_ERROR_INVALID_DATA; - ssl_error(ctx); - goto err; - } - pace_input.chat = certs_chat; - } - - if (!fread_to_eof(cmdline.private_key_arg, - &privkey, &privkey_len)) { - fprintf(stderr, "Could not parse private key.\n"); - r = SC_ERROR_INVALID_DATA; - goto err; - } - - if (cmdline.auxiliary_data_given) { - auxiliary_data_len = sizeof auxiliary_data; - if (sc_hex_to_bin(cmdline.auxiliary_data_arg, auxiliary_data, - &auxiliary_data_len) < 0) { - fprintf(stderr, "Could not parse auxiliary data.\n"); - r = SC_ERROR_INVALID_DATA; - goto err; - } - } else { - if (cmdline.older_than_given) { - r = add_to_ASN1_AUXILIARY_DATA(&templates, - NID_id_DateOfBirth, - (unsigned char *) cmdline.older_than_arg, - strlen(cmdline.older_than_arg)); - if (r < 0) - goto err; - } - if (cmdline.verify_validity_given) { - r = add_to_ASN1_AUXILIARY_DATA(&templates, - NID_id_DateOfExpiry, - (unsigned char *) cmdline.verify_validity_arg, - strlen(cmdline.verify_validity_arg)); - if (r < 0) - goto err; - } - if (cmdline.verify_community_given) { - community_id_len = sizeof community_id; - if (sc_hex_to_bin(cmdline.verify_community_arg, community_id, - &community_id_len) < 0) { - fprintf(stderr, "Could not parse community ID.\n"); - exit(2); - } - r = add_to_ASN1_AUXILIARY_DATA(&templates, - NID_id_CommunityID, - community_id, community_id_len); - if (r < 0) - goto err; - } - if (templates) { - unsigned char *p = NULL; - auxiliary_data_len = i2d_ASN1_AUXILIARY_DATA( - templates, &p); - if (0 > (int) auxiliary_data_len - || auxiliary_data_len > sizeof auxiliary_data) { - free(p); - fprintf(stderr, "Auxiliary data too big.\n"); - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - memcpy(auxiliary_data, p, auxiliary_data_len); - free(p); - } - } - } - - pace_input.pin = NULL; - pace_input.pin_length = 0; - if (cmdline.pin_given) { - pace_input.pin_id = PACE_PIN; - if (pin) { - pace_input.pin = (unsigned char *) pin; - pace_input.pin_length = strlen(pin); - } - } else if (cmdline.can_given) { - pace_input.pin_id = PACE_CAN; - if (can) { - pace_input.pin = (unsigned char *) can; - pace_input.pin_length = strlen(can); - } - } else if (cmdline.mrz_given) { - pace_input.pin_id = PACE_MRZ; - if (mrz) { - pace_input.pin = (unsigned char *) mrz; - pace_input.pin_length = strlen(mrz); - } - } else if (cmdline.puk_given) { - pace_input.pin_id = PACE_PUK; - if (puk) { - pace_input.pin = (unsigned char *) puk; - pace_input.pin_length = strlen(puk); - } - } else { - fprintf(stderr, "Skipping PIN verification\n"); - goto nopace; - } - - r = perform_pace(card, pace_input, &pace_output, tr_version); - if (r < 0) - goto err; - printf("Established PACE channel with %s.\n", - npa_secret_name(pace_input.pin_id)); - -nopace: - if (cmdline.cv_certificate_given || cmdline.private_key_given) { - r = perform_terminal_authentication(card, - (const unsigned char **) certs, certs_lens, - privkey, privkey_len, auxiliary_data, auxiliary_data_len); - if (r < 0) - goto err; - printf("Performed Terminal Authentication.\n"); - - r = perform_chip_authentication(card, &ef_cardsecurity, &ef_cardsecurity_len); - if (r < 0) - goto err; - printf("Performed Chip Authentication.\n"); - - unsigned char eid_aid[] = { 0xE8, 0x07, 0x04, 0x00, 0x7f, 0x00, 0x07, 0x03, 0x02}; - sc_path_t path; - sc_path_set(&path, SC_PATH_TYPE_DF_NAME, eid_aid, sizeof eid_aid, 0, 0); - r = sc_select_file(card, &path, NULL); - if (r < 0) - goto err; - printf("Selected eID application.\n"); - } - - if (cmdline.read_dg1_flag) - read_dg(card, 1, "Document Type", &dg, &dg_len); - if (cmdline.read_dg2_flag) - read_dg(card, 2, "Issuing State", &dg, &dg_len); - if (cmdline.read_dg3_flag) - read_dg(card, 3, "Date of Expiry", &dg, &dg_len); - if (cmdline.read_dg4_flag) - read_dg(card, 4, "Given Names", &dg, &dg_len); - if (cmdline.read_dg5_flag) - read_dg(card, 5, "Family Names", &dg, &dg_len); - if (cmdline.read_dg6_flag) - read_dg(card, 6, "Religious/Artistic Name", &dg, &dg_len); - if (cmdline.read_dg7_flag) - read_dg(card, 7, "Academic Title", &dg, &dg_len); - if (cmdline.read_dg8_flag) - read_dg(card, 8, "Date of Birth", &dg, &dg_len); - if (cmdline.read_dg9_flag) - read_dg(card, 9, "Place of Birth", &dg, &dg_len); - if (cmdline.read_dg10_flag) - read_dg(card, 10, "Nationality", &dg, &dg_len); - if (cmdline.read_dg11_flag) - read_dg(card, 11, "Sex", &dg, &dg_len); - if (cmdline.read_dg12_flag) - read_dg(card, 12, "Optional Data", &dg, &dg_len); - if (cmdline.read_dg13_flag) - read_dg(card, 13, "Birth Name", &dg, &dg_len); - if (cmdline.read_dg14_flag) - read_dg(card, 14, "DG 14", &dg, &dg_len); - if (cmdline.read_dg15_flag) - read_dg(card, 15, "DG 15", &dg, &dg_len); - if (cmdline.read_dg16_flag) - read_dg(card, 16, "DG 16", &dg, &dg_len); - if (cmdline.read_dg17_flag) - read_dg(card, 17, "Normal Place of Residence", &dg, &dg_len); - if (cmdline.read_dg18_flag) - read_dg(card, 18, "Community ID", &dg, &dg_len); - if (cmdline.read_dg19_flag) - read_dg(card, 19, "Residence Permit I", &dg, &dg_len); - if (cmdline.read_dg20_flag) - read_dg(card, 20, "Residence Permit II", &dg, &dg_len); - if (cmdline.read_dg21_flag) - read_dg(card, 21, "Optional Data", &dg, &dg_len); - - if (cmdline.write_dg17_given) - write_dg(card, 17, "Normal Place of Residence", cmdline.write_dg17_arg); - if (cmdline.write_dg18_given) - write_dg(card, 18, "Community ID", cmdline.write_dg18_arg); - if (cmdline.write_dg19_given) - write_dg(card, 19, "Residence Permit I", cmdline.write_dg19_arg); - if (cmdline.write_dg20_given) - write_dg(card, 20, "Residence Permit II", cmdline.write_dg20_arg); - if (cmdline.write_dg21_given) - write_dg(card, 21, "Optional Data", cmdline.write_dg21_arg); - - if (cmdline.older_than_given) { - unsigned char id_DateOfBirth[] = {6, 9, 4, 0, 127, 0, 7, 3, 1, 4, 1}; - verify(card, "age", id_DateOfBirth, sizeof id_DateOfBirth); - } - if (cmdline.verify_validity_given) { - unsigned char id_DateOfExpiry[] = {6, 9, 4, 0, 127, 0, 7, 3, 1, 4, 2}; - verify(card, "validity", id_DateOfExpiry, sizeof id_DateOfExpiry); - } - if (cmdline.verify_community_given) { - unsigned char id_CommunityID[] = {6, 9, 4, 0, 127, 0, 7, 3, 1, 4, 3}; - verify(card, "community ID", id_CommunityID, sizeof id_CommunityID); - } - - if (cmdline.translate_given) { - if (strncmp(cmdline.translate_arg, "stdin", strlen("stdin")) == 0) - input = stdin; - else { - input = fopen(cmdline.translate_arg, "r"); - if (!input) { - perror("Opening file with APDUs"); - r = SC_ERROR_INVALID_DATA; - goto err; - } - } - - r = npa_translate_apdus(card, input); - if (r < 0) - goto err; - fclose(input); - input = NULL; - } - } - -err: - cmdline_parser_free(&cmdline); - free(pace_output.ef_cardaccess); - free(pace_output.recent_car); - free(pace_output.previous_car); - free(pace_output.id_icc); - free(pace_output.id_pcd); - if (ef_cardsecurity) { - OPENSSL_cleanse(ef_cardsecurity, ef_cardsecurity_len); - free(ef_cardsecurity); - } - if (input) - fclose(input); - if (certs) { - i = 0; - while (certs[i]) { - free((unsigned char *) certs[i]); - i++; - } - free(certs); - } - free(certs_lens); - free(certs_chat); - if (cvc_cert) - CVC_CERT_free(cvc_cert); - free(privkey); - free(dg); - if (templates) - ASN1_AUXILIARY_DATA_free(templates); - - sc_sm_stop(card); - sc_reset(card, 1); - sc_disconnect_card(card); - sc_release_context(ctx); - EAC_cleanup(); - - if (r < 0) - fprintf(stderr, "Error: %s\n", sc_strerror(r)); - - return -r; -} diff --git a/npa/src/npa-tool.ggo.in b/npa/src/npa-tool.ggo.in deleted file mode 100644 index 674c27b..0000000 --- a/npa/src/npa-tool.ggo.in +++ /dev/null @@ -1,228 +0,0 @@ -package "npa-tool" -purpose "@PACKAGE_SUMMARY@" - -option "info" i - "Print available readers and drivers." - flag off -option "reader" r - "Number of the PC/SC reader to use (-1 for autodetect)" - int - default="-1" - optional -option "verbose" v - "Use (several times) to be more verbose" - multiple - optional - -section "Password Authenticated Connection Establishment (PACE)" -option "pin" p - "Run PACE with (transport) eID-PIN" - string - argoptional - optional -option "puk" u - "Run PACE with PUK" - string - argoptional - optional -option "can" c - "Run PACE with CAN" - string - argoptional - optional -option "mrz" m - "Run PACE with MRZ (insert MRZ without newlines)" - string - argoptional - optional -option "env" - - "Whether to use environment variables PIN, PUK, CAN, MRZ and NEWPIN. You may want to clean your environment before enabling this." - flag off - -section "PIN management" -option "new-pin" N - "Install a new PIN" - string - argoptional - optional -option "resume" R - "Resume eID-PIN (uses CAN to activate last retry)" - flag off -option "unblock" U - "Unblock PIN (uses PUK to activate three more retries)" - flag off - -section "Terminal Authentication (TA) and Chip Authentication (CA)" -option "cv-certificate" C - "Card Verifiable Certificate to create a certificate chain. Can be used multiple times (order is important)." - string - typestr="FILENAME" - optional - multiple -option "cert-desc" - - "Certificate description to show for Terminal Authentication" - string - typestr="HEX_STRING" - optional -option "chat" - - "Card holder authorization template to use (default is terminal's CHAT). Use 7F4C0E060904007F000703010203530103 to trigger EAC on the CAT-C (Komfortleser)." - string - typestr="HEX_STRING" - optional -option "auxiliary-data" A - "Terminal's auxiliary data (default is determined by verification of validity, age and community ID)." - string - typestr="HEX_STRING" - optional -option "private-key" P - "Terminal's private key" - string - typestr="FILENAME" - optional -option "cvc-dir" - - "Where to look for the CVCA's certificate" - string - typestr="DIRECTORY" - default="@CVCDIR@" - optional -option "x509-dir" - - "Where to look for the CSCA's certificate" - string - typestr="DIRECTORY" - default="@X509DIR@" - optional -option "disable-ta-checks" - - "Disable checking the validity period of CV certifcates" - flag off -option "disable-ca-checks" - - "Disable passive authentication" - flag off - -section "Read and write data groups" -option "read-dg1" - - "Read DG 1 (Document Type)" - flag off -option "read-dg2" - - "Read DG 2 (Issuing State)" - flag off -option "read-dg3" - - "Read DG 3 (Date of Expiry)" - flag off -option "read-dg4" - - "Read DG 4 (Given Names)" - flag off -option "read-dg5" - - "Read DG 5 (Family Names)" - flag off -option "read-dg6" - - "Read DG 6 (Religious/Artistic Name)" - flag off -option "read-dg7" - - "Read DG 7 (Academic Title)" - flag off -option "read-dg8" - - "Read DG 8 (Date of Birth)" - flag off -option "read-dg9" - - "Read DG 9 (Place of Birth)" - flag off -option "read-dg10" - - "Read DG 10 (Nationality)" - flag off -option "read-dg11" - - "Read DG 11 (Sex)" - flag off -option "read-dg12" - - "Read DG 12 (Optional Data)" - flag off -option "read-dg13" - - "Read DG 13 (Birth Name)" - flag off -option "read-dg14" - - "Read DG 14" - flag off -option "read-dg15" - - "Read DG 15" - flag off -option "read-dg16" - - "Read DG 16" - flag off -option "read-dg17" - - "Read DG 17 (Normal Place of Residence)" - flag off -option "read-dg18" - - "Read DG 18 (Community ID)" - flag off -option "read-dg19" - - "Read DG 19 (Residence Permit I)" - flag off -option "read-dg20" - - "Read DG 20 (Residence Permit II)" - flag off -option "read-dg21" - - "Read DG 21 (Optional Data)" - flag off -option "write-dg17" - - "Write DG 17 (Normal Place of Residence)" - string - typestr="HEX_STRING" - optional -option "write-dg18" - - "Write DG 18 (Community ID)" - string - typestr="HEX_STRING" - optional -option "write-dg19" - - "Write DG 19 (Residence Permit I)" - string - typestr="HEX_STRING" - optional -option "write-dg20" - - "Write DG 20 (Residence Permit II)" - string - typestr="HEX_STRING" - optional -option "write-dg21" - - "Write DG 21 (Optional Data)" - string - typestr="HEX_STRING" - optional - -section "Verification of validity, age and community ID" -option "verify-validity" - - "Verify chip's validity with a reference date" - string - typestr="YYYYMMDD" - optional -option "older-than" - - "Verify age with a reference date" - string - typestr="YYYYMMDD" - optional -option "verify-community" - - "Verify community ID with a reference ID" - string - typestr="HEX_STRING" - optional - -section "Special options, not always useful" -option "break" b - "Brute force PIN, CAN or PUK. Use together with -p, -a or -u" - flag off -option "translate" t - "File with APDUs of HEX_STRINGs to send through the secure channel" - string - typestr="FILENAME" - default="stdin" - optional -option "tr-03110v201" - - "Force compliance to BSI TR-03110 version 2.01" - flag off -option "disable-all-checks" - - "Disable all checking of fly-by-data" - flag off - -text " -Report bugs to @PACKAGE_BUGREPORT@ - -Written by Frank Morgner " diff --git a/npa/src/npa.c b/npa/src/npa.c deleted file mode 100644 index 51fb393..0000000 --- a/npa/src/npa.c +++ /dev/null @@ -1,2438 +0,0 @@ -/* - * Copyright (C) 2011 Frank Morgner - * - * This file is part of libnpa. - * - * libnpa is free software: you can redistribute it and/or modify it under the - * terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * libnpa is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. - * - * You should have received a copy of the GNU General Public License along with - * libnpa. If not, see . - */ -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "sslutil.h" -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - - -#define ASN1_APP_IMP_OPT(stname, field, type, tag) ASN1_EX_TYPE(ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION|ASN1_TFLG_OPTIONAL, tag, stname, field, type) -#define ASN1_APP_IMP(stname, field, type, tag) ASN1_EX_TYPE(ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION, tag, stname, field, type) - -/* 0x67 - * Auxiliary authenticated data */ -ASN1_ITEM_TEMPLATE(ASN1_AUXILIARY_DATA) = - ASN1_EX_TEMPLATE_TYPE( - ASN1_TFLG_SEQUENCE_OF|ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION, - 7, AuxiliaryAuthenticatedData, CVC_DISCRETIONARY_DATA_TEMPLATE) -ASN1_ITEM_TEMPLATE_END(ASN1_AUXILIARY_DATA) -IMPLEMENT_ASN1_FUNCTIONS(ASN1_AUXILIARY_DATA) - - -/* - * MSE:Set AT - */ - -typedef struct npa_mse_cd_st { - ASN1_OBJECT *cryptographic_mechanism_reference; - ASN1_OCTET_STRING *key_reference1; - ASN1_OCTET_STRING *key_reference2; - ASN1_OCTET_STRING *eph_pub_key; - ASN1_AUXILIARY_DATA *auxiliary_data; - CVC_CHAT *chat; -} NPA_MSE_C; -/* Note that we can not use ASN1_AUXILIARY_DATA for the auxiliary_data element - * here. Due to limitations of OpenSSL it is not possible to *encode* an - * optional item template (such as auxiliary_data) in an other item template - * (such as ASN1_AUXILIARY_DATA). However, we can do - * - * NPA_MSE_C->auxiliary_data = d2i_ASN1_AUXILIARY_DATA(...) - * - * because they both use the same underlying struct. - * - * See also openssl/crypto/asn1/tasn_dec.c:183 - */ -ASN1_SEQUENCE(NPA_MSE_C) = { - /* 0x80 - * Cryptographic mechanism reference */ - ASN1_IMP_OPT(NPA_MSE_C, cryptographic_mechanism_reference, ASN1_OBJECT, 0), - /* 0x83 - * Reference of a public key / secret key */ - ASN1_IMP_OPT(NPA_MSE_C, key_reference1, ASN1_OCTET_STRING, 3), - /* 0x84 - * Reference of a private key / Reference for computing a session key */ - ASN1_IMP_OPT(NPA_MSE_C, key_reference2, ASN1_OCTET_STRING, 4), - /* 0x91 - * Ephemeral Public Key */ - ASN1_IMP_OPT(NPA_MSE_C, eph_pub_key, ASN1_OCTET_STRING, 0x11), - /* 0x67 - * Auxiliary authenticated data. See note above. */ - ASN1_APP_IMP_SEQUENCE_OF_OPT(NPA_MSE_C, auxiliary_data, CVC_DISCRETIONARY_DATA_TEMPLATE, 7), - /* Certificate Holder Authorization Template */ - ASN1_OPT(NPA_MSE_C, chat, CVC_CHAT), -} ASN1_SEQUENCE_END(NPA_MSE_C) -DECLARE_ASN1_FUNCTIONS(NPA_MSE_C) -IMPLEMENT_ASN1_FUNCTIONS(NPA_MSE_C) - - -/* - * General Authenticate for PACE - */ - -/* Protocol Command Data */ -typedef struct npa_gen_auth_pace_cd_st { - ASN1_OCTET_STRING *mapping_data; - ASN1_OCTET_STRING *eph_pub_key; - ASN1_OCTET_STRING *auth_token; -} NPA_GEN_AUTH_PACE_C_BODY; -ASN1_SEQUENCE(NPA_GEN_AUTH_PACE_C_BODY) = { - /* 0x81 - * Mapping Data */ - ASN1_IMP_OPT(NPA_GEN_AUTH_PACE_C_BODY, mapping_data, ASN1_OCTET_STRING, 1), - /* 0x83 - * Ephemeral Public Key */ - ASN1_IMP_OPT(NPA_GEN_AUTH_PACE_C_BODY, eph_pub_key, ASN1_OCTET_STRING, 3), - /* 0x85 - * Authentication Token */ - ASN1_IMP_OPT(NPA_GEN_AUTH_PACE_C_BODY, auth_token, ASN1_OCTET_STRING, 5), -} ASN1_SEQUENCE_END(NPA_GEN_AUTH_PACE_C_BODY) -DECLARE_ASN1_FUNCTIONS(NPA_GEN_AUTH_PACE_C_BODY) -IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_PACE_C_BODY) - -typedef NPA_GEN_AUTH_PACE_C_BODY NPA_GEN_AUTH_PACE_C; -/* 0x7C - * Dynamic Authentication Data */ -ASN1_ITEM_TEMPLATE(NPA_GEN_AUTH_PACE_C) = - ASN1_EX_TEMPLATE_TYPE( - ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION, - 0x1c, NPA_GEN_AUTH_PACE_C, NPA_GEN_AUTH_PACE_C_BODY) -ASN1_ITEM_TEMPLATE_END(NPA_GEN_AUTH_PACE_C) -DECLARE_ASN1_FUNCTIONS(NPA_GEN_AUTH_PACE_C) -IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_PACE_C) - -/* Protocol Response Data */ -typedef struct npa_gen_auth_pace_rapdu_body_st { - ASN1_OCTET_STRING *enc_nonce; - ASN1_OCTET_STRING *mapping_data; - ASN1_OCTET_STRING *eph_pub_key; - ASN1_OCTET_STRING *auth_token; - ASN1_OCTET_STRING *cur_car; - ASN1_OCTET_STRING *prev_car; -} NPA_GEN_AUTH_PACE_R_BODY; -ASN1_SEQUENCE(NPA_GEN_AUTH_PACE_R_BODY) = { - /* 0x80 - * Encrypted Nonce */ - ASN1_IMP_OPT(NPA_GEN_AUTH_PACE_R_BODY, enc_nonce, ASN1_OCTET_STRING, 0), - /* 0x82 - * Mapping Data */ - ASN1_IMP_OPT(NPA_GEN_AUTH_PACE_R_BODY, mapping_data, ASN1_OCTET_STRING, 2), - /* 0x84 - * Ephemeral Public Key */ - ASN1_IMP_OPT(NPA_GEN_AUTH_PACE_R_BODY, eph_pub_key, ASN1_OCTET_STRING, 4), - /* 0x86 - * Authentication Token */ - ASN1_IMP_OPT(NPA_GEN_AUTH_PACE_R_BODY, auth_token, ASN1_OCTET_STRING, 6), - /* 0x87 - * Most recent Certification Authority Reference */ - ASN1_IMP_OPT(NPA_GEN_AUTH_PACE_R_BODY, cur_car, ASN1_OCTET_STRING, 7), - /* 0x88 - * Previous Certification Authority Reference */ - ASN1_IMP_OPT(NPA_GEN_AUTH_PACE_R_BODY, prev_car, ASN1_OCTET_STRING, 8), -} ASN1_SEQUENCE_END(NPA_GEN_AUTH_PACE_R_BODY) -DECLARE_ASN1_FUNCTIONS(NPA_GEN_AUTH_PACE_R_BODY) -IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_PACE_R_BODY) - -typedef NPA_GEN_AUTH_PACE_R_BODY NPA_GEN_AUTH_PACE_R; -/* 0x7C - * Dynamic Authentication Data */ -ASN1_ITEM_TEMPLATE(NPA_GEN_AUTH_PACE_R) = - ASN1_EX_TEMPLATE_TYPE( - ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION, - 0x1c, NPA_GEN_AUTH_PACE_R, NPA_GEN_AUTH_PACE_R_BODY) -ASN1_ITEM_TEMPLATE_END(NPA_GEN_AUTH_PACE_R) -DECLARE_ASN1_FUNCTIONS(NPA_GEN_AUTH_PACE_R) -IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_PACE_R) - - -/* - * General Authenticate for CA - */ - -/* Protocol Command Data */ -typedef struct npa_gen_auth_ca_cd_st { - ASN1_OCTET_STRING *eph_pub_key; -} NPA_GEN_AUTH_CA_C_BODY; -ASN1_SEQUENCE(NPA_GEN_AUTH_CA_C_BODY) = { - /* 0x80 - * Ephemeral Public Key */ - ASN1_IMP_OPT(NPA_GEN_AUTH_CA_C_BODY, eph_pub_key, ASN1_OCTET_STRING, 0), -} ASN1_SEQUENCE_END(NPA_GEN_AUTH_CA_C_BODY) -DECLARE_ASN1_FUNCTIONS(NPA_GEN_AUTH_CA_C_BODY) -IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_CA_C_BODY) - -typedef NPA_GEN_AUTH_CA_C_BODY NPA_GEN_AUTH_CA_C; -/* 0x7C - * Dynamic Authentication Data */ -ASN1_ITEM_TEMPLATE(NPA_GEN_AUTH_CA_C) = - ASN1_EX_TEMPLATE_TYPE( - ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION, - 0x1c, NPA_GEN_AUTH_CA_C, NPA_GEN_AUTH_CA_C_BODY) -ASN1_ITEM_TEMPLATE_END(NPA_GEN_AUTH_CA_C) -DECLARE_ASN1_FUNCTIONS(NPA_GEN_AUTH_CA_C) -IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_CA_C) - -/* Protocol Response Data */ -typedef struct npa_gen_auth_ca_rapdu_body_st { - ASN1_OCTET_STRING *nonce; - ASN1_OCTET_STRING *auth_token; -} NPA_GEN_AUTH_CA_R_BODY; -ASN1_SEQUENCE(NPA_GEN_AUTH_CA_R_BODY) = { - /* 0x81 - * Nonce */ - ASN1_IMP_OPT(NPA_GEN_AUTH_CA_R_BODY, nonce, ASN1_OCTET_STRING, 1), - /* 0x82 - * Authentication Token */ - ASN1_IMP_OPT(NPA_GEN_AUTH_CA_R_BODY, auth_token, ASN1_OCTET_STRING, 2), -} ASN1_SEQUENCE_END(NPA_GEN_AUTH_CA_R_BODY) -DECLARE_ASN1_FUNCTIONS(NPA_GEN_AUTH_CA_R_BODY) -IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_CA_R_BODY) - -typedef NPA_GEN_AUTH_CA_R_BODY NPA_GEN_AUTH_CA_R; -/* 0x7C - * Dynamic Authentication Data */ -ASN1_ITEM_TEMPLATE(NPA_GEN_AUTH_CA_R) = - ASN1_EX_TEMPLATE_TYPE( - ASN1_TFLG_IMPTAG|ASN1_TFLG_APPLICATION, - 0x1c, NPA_GEN_AUTH_CA_R, NPA_GEN_AUTH_CA_R_BODY) -ASN1_ITEM_TEMPLATE_END(NPA_GEN_AUTH_CA_R) -DECLARE_ASN1_FUNCTIONS(NPA_GEN_AUTH_CA_R) -IMPLEMENT_ASN1_FUNCTIONS(NPA_GEN_AUTH_CA_R) - - - -#define maxresp SC_MAX_APDU_BUFFER_SIZE - 2 - -/** @brief NPA secure messaging context */ -struct npa_sm_ctx { - /** @brief EAC context */ - EAC_CTX *ctx; - /** @brief Certificate Description given on initialization of PACE */ - BUF_MEM *certificate_description; - /** @brief picc's compressed ephemeral public key of PACE */ - BUF_MEM *id_icc; - /** @brief PCD's compressed ephemeral public key of CA */ - BUF_MEM *eph_pub_key; - /** @brief Auxiliary Data */ - BUF_MEM *auxiliary_data; - char flags; -}; - - -/* included in OpenPACE, but not propagated */ -extern BUF_MEM *BUF_MEM_create(size_t len); -extern BUF_MEM *BUF_MEM_create_init(const void *buf, size_t len); - - -static int npa_sm_encrypt(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *data, size_t datalen, u8 **enc); -static int npa_sm_decrypt(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *enc, size_t enclen, u8 **data); -static int npa_sm_authenticate(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *data, size_t datalen, u8 **outdata); -static int npa_sm_verify_authentication(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *mac, size_t maclen, - const u8 *macdata, size_t macdatalen); -static int npa_sm_pre_transmit(sc_card_t *card, const struct iso_sm_ctx *ctx, - sc_apdu_t *apdu); -static int npa_sm_post_transmit(sc_card_t *card, const struct iso_sm_ctx *ctx, - sc_apdu_t *sm_apdu); -static int npa_sm_finish(sc_card_t *card, const struct iso_sm_ctx *ctx, - sc_apdu_t *apdu); -static void npa_sm_clear_free(const struct iso_sm_ctx *ctx); - - -char npa_default_flags = 0; - - -static struct npa_sm_ctx * -npa_sm_ctx_create(EAC_CTX *ctx, const unsigned char *certificate_description, - size_t certificate_description_length, - const unsigned char *id_icc, size_t id_icc_length) -{ - struct npa_sm_ctx *out = malloc(sizeof *out); - if (!out) - goto err; - - out->ctx = ctx; - - if (certificate_description && certificate_description_length) { - out->certificate_description = - BUF_MEM_create_init(certificate_description, - certificate_description_length); - if (!out->certificate_description) - goto err; - } else - out->certificate_description = NULL; - - if (id_icc && id_icc_length) { - out->id_icc = BUF_MEM_create_init(id_icc, id_icc_length); - if (!out->id_icc) - goto err; - } else - out->id_icc = NULL; - - out->eph_pub_key = NULL; - out->auxiliary_data = NULL; - - out->flags = npa_default_flags; - if (out->flags & NPA_FLAG_DISABLE_CHECK_TA) - TA_disable_checks(out->ctx); - if (out->flags & NPA_FLAG_DISABLE_CHECK_CA) - CA_disable_passive_authentication(out->ctx); - - return out; - -err: - free(out); - return NULL; -} - -static int -npa_sm_start(sc_card_t *card, EAC_CTX *eac_ctx, - const unsigned char *certificate_description, - size_t certificate_description_length, - const unsigned char *id_icc, size_t id_icc_length) -{ - int r; - struct iso_sm_ctx *sctx = NULL; - - if (!eac_ctx || !eac_ctx->key_ctx) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - sctx = iso_sm_ctx_create(); - if (!sctx) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - - sctx->priv_data = npa_sm_ctx_create(eac_ctx, - certificate_description, certificate_description_length, - id_icc, id_icc_length); - if (!sctx->priv_data) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - - sctx->authenticate = npa_sm_authenticate; - sctx->encrypt = npa_sm_encrypt; - sctx->decrypt = npa_sm_decrypt; - sctx->verify_authentication = npa_sm_verify_authentication; - sctx->pre_transmit = npa_sm_pre_transmit; - sctx->post_transmit = npa_sm_post_transmit; - sctx->finish = npa_sm_finish; - sctx->clear_free = npa_sm_clear_free; - sctx->padding_indicator = SM_ISO_PADDING; - sctx->block_length = EVP_CIPHER_block_size(eac_ctx->key_ctx->cipher); - - r = iso_sm_start(card, sctx); - -err: - if (r < 0) - iso_sm_ctx_clear_free(sctx); - - return r; -} - - -int get_pace_capabilities(u8 *bitmap) -{ - if (!bitmap) - return SC_ERROR_INVALID_ARGUMENTS; - - /* BitMap */ - *bitmap = NPA_BITMAP_PACE|NPA_BITMAP_EID|NPA_BITMAP_ESIGN; - - return SC_SUCCESS; -} - -static int get_ef_card_access(sc_card_t *card, - u8 **ef_cardaccess, size_t *length_ef_cardaccess) -{ - return read_binary_rec(card, SFID_EF_CARDACCESS, ef_cardaccess, length_ef_cardaccess); -} - -static int format_mse_cdata(struct sc_context *ctx, int protocol, - const unsigned char *key_reference1, size_t key_reference1_len, - const unsigned char *key_reference2, size_t key_reference2_len, - const unsigned char *eph_pub_key, size_t eph_pub_key_len, - const unsigned char *auxiliary_data, size_t auxiliary_data_len, - const CVC_CHAT *chat, unsigned char **cdata) -{ - NPA_MSE_C *data = NULL; - unsigned char *data_sequence = NULL; - const unsigned char *data_no_sequence; - unsigned char *p; - long length; - int r, class, tag; - - if (!cdata) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - data = NPA_MSE_C_new(); - if (!data) { - ssl_error(ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - if (protocol) { - data->cryptographic_mechanism_reference = OBJ_nid2obj(protocol); - if (!data->cryptographic_mechanism_reference) { - sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Error setting Cryptographic mechanism reference of MSE:Set AT data"); - r = SC_ERROR_INTERNAL; - goto err; - } - } - - if (key_reference1 && key_reference1_len) { - data->key_reference1 = ASN1_OCTET_STRING_new(); - if (!data->key_reference1 - || !M_ASN1_OCTET_STRING_set( - data->key_reference1, key_reference1, key_reference1_len)) { - sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Error setting key reference 1 of MSE:Set AT data"); - r = SC_ERROR_INTERNAL; - goto err; - } - } - - if (key_reference2 && key_reference2_len) { - data->key_reference2 = ASN1_OCTET_STRING_new(); - if (!data->key_reference2 - || !M_ASN1_OCTET_STRING_set( - data->key_reference2, key_reference2, key_reference2_len)) { - sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Error setting key reference 2 of MSE:Set AT data"); - r = SC_ERROR_INTERNAL; - goto err; - } - } - - if (eph_pub_key && eph_pub_key_len) { - data->eph_pub_key = ASN1_OCTET_STRING_new(); - if (!data->eph_pub_key - || !M_ASN1_OCTET_STRING_set( - data->eph_pub_key, eph_pub_key, eph_pub_key_len)) { - sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Error setting ephemeral Public Key of MSE:Set AT data"); - r = SC_ERROR_INTERNAL; - goto err; - } - } - - if (auxiliary_data && auxiliary_data_len) { - if (!d2i_ASN1_AUXILIARY_DATA(&data->auxiliary_data, &auxiliary_data, auxiliary_data_len)) { - sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Error setting authenticated auxiliary data of MSE:Set AT data"); - ssl_error(ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - } - - data->chat = (CVC_CHAT *) chat; - - - length = i2d_NPA_MSE_C(data, &data_sequence); - data_no_sequence = data_sequence; - if (length < 0 - || (0x80 & ASN1_get_object(&data_no_sequence, &length, &tag, &class, length))) { - sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, "Error encoding MSE:Set AT APDU data"); - ssl_error(ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - if (length < 0) { - r = SC_ERROR_INTERNAL; - goto err; - } - bin_log(ctx, SC_LOG_DEBUG_NORMAL, "MSE command data", data_no_sequence, length); - - - p = realloc(*cdata, length); - if (!p) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - memcpy(p, data_no_sequence, length); - *cdata = p; - r = length; - -err: - if (data) { - /* do not free the functions parameter chat */ - data->chat = NULL; - NPA_MSE_C_free(data); - } - free(data_sequence); - - return r; -} - -#define ISO_MSE 0x22 -static int npa_mse(sc_card_t *card, - unsigned char p1, unsigned char p2, int protocol, - const unsigned char *key_reference1, size_t key_reference1_len, - const unsigned char *key_reference2, size_t key_reference2_len, - const unsigned char *eph_pub_key, size_t eph_pub_key_len, - const unsigned char *auxiliary_data, size_t auxiliary_data_len, - const CVC_CHAT *chat, u8 *sw1, u8 *sw2) -{ - sc_apdu_t apdu; - unsigned char *d = NULL; - int r; - - if (!card) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - sc_format_apdu(card, &apdu, SC_APDU_CASE_3_SHORT, ISO_MSE, p1, p2); - - r = format_mse_cdata(card->ctx, protocol, key_reference1, - key_reference1_len, key_reference2, key_reference2_len, - eph_pub_key, eph_pub_key_len, auxiliary_data, auxiliary_data_len, - chat, &d); - if (r < 0) - goto err; - apdu.data = d; - apdu.datalen = r; - apdu.lc = r; - - - r = sc_transmit_apdu(card, &apdu); - if (r < 0) - goto err; - - if (apdu.resplen) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "MSE:Set AT response data should be empty " - "(contains %u bytes)", apdu.resplen); - r = SC_ERROR_UNKNOWN_DATA_RECEIVED; - goto err; - } - - if (sw1) - *sw1 = apdu.sw1; - if (sw2) - *sw2 = apdu.sw2; - -err: - free(d); - - return r; -} - -static int npa_mse_set_at(sc_card_t *card, unsigned char p1, int protocol, - const unsigned char *key_reference1, size_t key_reference1_len, - const unsigned char *key_reference2, size_t key_reference2_len, - const unsigned char *eph_pub_key, size_t eph_pub_key_len, - const unsigned char *auxiliary_data, size_t auxiliary_data_len, - const CVC_CHAT *chat, u8 *sw1, u8 *sw2) -{ - return npa_mse(card, p1, 0xa4, protocol, key_reference1, - key_reference1_len, key_reference2, key_reference2_len, - eph_pub_key, eph_pub_key_len, auxiliary_data, auxiliary_data_len, - chat, sw1, sw2); -} - -static int npa_mse_set_at_pace(sc_card_t *card, int protocol, - enum s_type secret_key, const CVC_CHAT *chat, u8 *sw1, u8 *sw2) -{ - int r, tries; - unsigned char key = secret_key; - - r = npa_mse_set_at(card, 0xC1, protocol, &key, sizeof key, NULL, - 0, NULL, 0, NULL, 0, chat, sw1, sw2); - - if (*sw1 == 0x63) { - if ((*sw2 & 0xc0) == 0xc0) { - tries = *sw2 & 0x0f; - if (tries <= 1) { - /* this is only a warning... */ - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Remaining tries: %d (%s must be %s)\n", - tries, npa_secret_name(secret_key), - tries ? "resumed" : "unblocked"); - } - r = SC_SUCCESS; - } else { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Unknown status bytes: SW1=%02X, SW2=%02X\n", - *sw1, *sw2); - r = SC_ERROR_CARD_CMD_FAILED; - } - } else if (*sw1 == 0x62 && *sw2 == 0x83) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Password is deactivated\n"); - r = SC_ERROR_AUTH_METHOD_BLOCKED; - } else { - r = sc_check_sw(card, *sw1, *sw2); - } - - return r; -} - -int npa_pace_get_tries_left(sc_card_t *card, - enum s_type pin_id, int *tries_left) -{ - int r; - u8 sw1, sw2; - - if (tries_left) { - r = npa_mse_set_at_pace(card, 0, pin_id, 0, &sw1, &sw2); - - if (r > 0 && (sw1 == 0x63) && ((sw2 & 0xc0) == 0xc0)) { - *tries_left = sw2 & 0x0f; - } else { - *tries_left = -1; - } - } else { - r = SC_ERROR_INVALID_ARGUMENTS; - } - - return r; -} - - -#define ISO_GENERAL_AUTHENTICATE 0x86 -#define ISO_COMMAND_CHAINING 0x10 -static int npa_gen_auth_1_encrypted_nonce(sc_card_t *card, - u8 **enc_nonce, size_t *enc_nonce_len) -{ - sc_apdu_t apdu; - NPA_GEN_AUTH_PACE_C *c_data = NULL; - NPA_GEN_AUTH_PACE_R *r_data = NULL; - unsigned char *d = NULL, *p; - int r, l; - unsigned char resp[maxresp]; - - sc_format_apdu(card, &apdu, SC_APDU_CASE_4_SHORT, ISO_GENERAL_AUTHENTICATE, - 0x00, 0x00); - apdu.cla = ISO_COMMAND_CHAINING; - - c_data = NPA_GEN_AUTH_PACE_C_new(); - if (!c_data) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - r = i2d_NPA_GEN_AUTH_PACE_C(c_data, &d); - if (r < 0) { - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - apdu.data = d; - apdu.datalen = r; - apdu.lc = r; - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Encrypted Nonce) command data", apdu.data, apdu.datalen); - - apdu.resplen = sizeof resp; - apdu.resp = resp; - r = sc_transmit_apdu(card, &apdu); - if (r < 0) - goto err; - - r = sc_check_sw(card, apdu.sw1, apdu.sw2); - if (r < 0) - goto err; - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Encrypted Nonce) response data", apdu.resp, apdu.resplen); - - if (!d2i_NPA_GEN_AUTH_PACE_R(&r_data, - (const unsigned char **) &apdu.resp, apdu.resplen)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - if (!r_data->enc_nonce - || r_data->mapping_data - || r_data->eph_pub_key - || r_data->auth_token - || r_data->cur_car - || r_data->prev_car) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Response data of general authenticate for " - "step 1 should (only) contain the encrypted nonce."); - r = SC_ERROR_UNKNOWN_DATA_RECEIVED; - goto err; - } - p = r_data->enc_nonce->data; - l = r_data->enc_nonce->length; - - *enc_nonce = malloc(l); - if (!*enc_nonce) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - /* Flawfinder: ignore */ - memcpy(*enc_nonce, p, l); - *enc_nonce_len = l; - -err: - if (c_data) - NPA_GEN_AUTH_PACE_C_free(c_data); - free(d); - if (r_data) - NPA_GEN_AUTH_PACE_R_free(r_data); - - return r; -} -static int npa_gen_auth_2_map_nonce(sc_card_t *card, - const u8 *in, size_t in_len, - u8 **map_data_out, size_t *map_data_out_len) -{ - sc_apdu_t apdu; - NPA_GEN_AUTH_PACE_C *c_data = NULL; - NPA_GEN_AUTH_PACE_R *r_data = NULL; - unsigned char *d = NULL, *p; - int r, l; - unsigned char resp[maxresp]; - - sc_format_apdu(card, &apdu, SC_APDU_CASE_4_SHORT, ISO_GENERAL_AUTHENTICATE, - 0x00, 0x00); - apdu.cla = ISO_COMMAND_CHAINING; - - c_data = NPA_GEN_AUTH_PACE_C_new(); - if (!c_data) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - c_data->mapping_data = ASN1_OCTET_STRING_new(); - if (!c_data->mapping_data - || !M_ASN1_OCTET_STRING_set( - c_data->mapping_data, in, in_len)) { - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - r = i2d_NPA_GEN_AUTH_PACE_C(c_data, &d); - if (r < 0) { - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - apdu.data = d; - apdu.datalen = r; - apdu.lc = r; - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Map Nonce) command data", apdu.data, apdu.datalen); - - apdu.resplen = sizeof resp; - apdu.resp = resp; - r = sc_transmit_apdu(card, &apdu); - if (r < 0) - goto err; - - r = sc_check_sw(card, apdu.sw1, apdu.sw2); - if (r < 0) - goto err; - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Map Nonce) response data", apdu.resp, apdu.resplen); - - if (!d2i_NPA_GEN_AUTH_PACE_R(&r_data, - (const unsigned char **) &apdu.resp, apdu.resplen)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - if (r_data->enc_nonce - || !r_data->mapping_data - || r_data->eph_pub_key - || r_data->auth_token - || r_data->cur_car - || r_data->prev_car) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Response data of general authenticate for " - "step 2 should (only) contain the mapping data."); - r = SC_ERROR_UNKNOWN_DATA_RECEIVED; - goto err; - } - p = r_data->mapping_data->data; - l = r_data->mapping_data->length; - - *map_data_out = malloc(l); - if (!*map_data_out) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - /* Flawfinder: ignore */ - memcpy(*map_data_out, p, l); - *map_data_out_len = l; - -err: - if (c_data) - NPA_GEN_AUTH_PACE_C_free(c_data); - free(d); - if (r_data) - NPA_GEN_AUTH_PACE_R_free(r_data); - - return r; -} -static int npa_gen_auth_3_perform_key_agreement(sc_card_t *card, - const u8 *in, size_t in_len, - u8 **eph_pub_key_out, size_t *eph_pub_key_out_len) -{ - sc_apdu_t apdu; - NPA_GEN_AUTH_PACE_C *c_data = NULL; - NPA_GEN_AUTH_PACE_R *r_data = NULL; - unsigned char *d = NULL, *p; - int r, l; - unsigned char resp[maxresp]; - - sc_format_apdu(card, &apdu, SC_APDU_CASE_4_SHORT, ISO_GENERAL_AUTHENTICATE, - 0x00, 0x00); - apdu.cla = ISO_COMMAND_CHAINING; - - c_data = NPA_GEN_AUTH_PACE_C_new(); - if (!c_data) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - c_data->eph_pub_key = ASN1_OCTET_STRING_new(); - if (!c_data->eph_pub_key - || !M_ASN1_OCTET_STRING_set( - c_data->eph_pub_key, in, in_len)) { - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - r = i2d_NPA_GEN_AUTH_PACE_C(c_data, &d); - if (r < 0) { - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - apdu.data = d; - apdu.datalen = r; - apdu.lc = r; - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) command data", apdu.data, apdu.datalen); - - apdu.resplen = sizeof resp; - apdu.resp = resp; - r = sc_transmit_apdu(card, &apdu); - if (r < 0) - goto err; - - r = sc_check_sw(card, apdu.sw1, apdu.sw2); - if (r < 0) - goto err; - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen); - - if (!d2i_NPA_GEN_AUTH_PACE_R(&r_data, - (const unsigned char **) &apdu.resp, apdu.resplen)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - if (r_data->enc_nonce - || r_data->mapping_data - || !r_data->eph_pub_key - || r_data->auth_token - || r_data->cur_car - || r_data->prev_car) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Response data of general authenticate for " - "step 3 should (only) contain the ephemeral public key."); - r = SC_ERROR_UNKNOWN_DATA_RECEIVED; - goto err; - } - p = r_data->eph_pub_key->data; - l = r_data->eph_pub_key->length; - - *eph_pub_key_out = malloc(l); - if (!*eph_pub_key_out) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - /* Flawfinder: ignore */ - memcpy(*eph_pub_key_out, p, l); - *eph_pub_key_out_len = l; - -err: - if (c_data) - NPA_GEN_AUTH_PACE_C_free(c_data); - free(d); - if (r_data) - NPA_GEN_AUTH_PACE_R_free(r_data); - - return r; -} -static int npa_gen_auth_4_mutual_authentication(sc_card_t *card, - const u8 *in, size_t in_len, - u8 **auth_token_out, size_t *auth_token_out_len, - u8 **recent_car, size_t *recent_car_len, - u8 **prev_car, size_t *prev_car_len) -{ - sc_apdu_t apdu; - NPA_GEN_AUTH_PACE_C *c_data = NULL; - NPA_GEN_AUTH_PACE_R *r_data = NULL; - unsigned char *d = NULL, *p; - int r, l; - unsigned char resp[maxresp]; - - sc_format_apdu(card, &apdu, SC_APDU_CASE_4_SHORT, ISO_GENERAL_AUTHENTICATE, - 0x00, 0x00); - - c_data = NPA_GEN_AUTH_PACE_C_new(); - if (!c_data) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - c_data->auth_token = ASN1_OCTET_STRING_new(); - if (!c_data->auth_token - || !M_ASN1_OCTET_STRING_set( - c_data->auth_token, in, in_len)) { - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - r = i2d_NPA_GEN_AUTH_PACE_C(c_data, &d); - if (r < 0) { - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - apdu.data = d; - apdu.datalen = r; - apdu.lc = r; - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) command data", apdu.data, apdu.datalen); - - apdu.resplen = sizeof resp; - apdu.resp = resp; - r = sc_transmit_apdu(card, &apdu); - if (r < 0) - goto err; - - r = sc_check_sw(card, apdu.sw1, apdu.sw2); - if (r < 0) - goto err; - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen); - - if (!d2i_NPA_GEN_AUTH_PACE_R(&r_data, - (const unsigned char **) &apdu.resp, apdu.resplen)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - if (r_data->enc_nonce - || r_data->mapping_data - || r_data->eph_pub_key - || !r_data->auth_token) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Response data of general authenticate for " - "step 4 should (only) contain the authentication token."); - r = SC_ERROR_UNKNOWN_DATA_RECEIVED; - goto err; - } - p = r_data->auth_token->data; - l = r_data->auth_token->length; - if (r_data->cur_car) { - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Most recent Certificate Authority Reference", - r_data->cur_car->data, r_data->cur_car->length); - *recent_car = malloc(r_data->cur_car->length); - if (!*recent_car) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - /* Flawfinder: ignore */ - memcpy(*recent_car, r_data->cur_car->data, r_data->cur_car->length); - *recent_car_len = r_data->cur_car->length; - } else - *recent_car_len = 0; - if (r_data->prev_car) { - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Previous Certificate Authority Reference", - r_data->prev_car->data, r_data->prev_car->length); - *prev_car = malloc(r_data->prev_car->length); - if (!*prev_car) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - /* Flawfinder: ignore */ - memcpy(*prev_car, r_data->prev_car->data, r_data->prev_car->length); - *prev_car_len = r_data->prev_car->length; - } else - *prev_car_len = 0; - - *auth_token_out = malloc(l); - if (!*auth_token_out) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - /* Flawfinder: ignore */ - memcpy(*auth_token_out, p, l); - *auth_token_out_len = l; - -err: - if (c_data) - NPA_GEN_AUTH_PACE_C_free(c_data); - free(d); - if (r_data) - NPA_GEN_AUTH_PACE_R_free(r_data); - - return r; -} - -int -npa_reset_retry_counter(sc_card_t *card, enum s_type pin_id, - int ask_for_secret, const char *new, size_t new_len) -{ - sc_apdu_t apdu; - char *p = NULL; - int r; - - if (ask_for_secret && (!new || !new_len)) { - if (!(SC_READER_CAP_PIN_PAD & card->reader->capabilities)) { - p = malloc(MAX_PIN_LEN+1); - if (!p) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for new PIN.\n"); - return SC_ERROR_OUT_OF_MEMORY; - } - if (0 > EVP_read_pw_string_min(p, - MIN_PIN_LEN, MAX_PIN_LEN+1, - "Please enter your new PIN: ", 0)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not read new PIN.\n"); - free(p); - return SC_ERROR_INTERNAL; - } - new_len = strlen(p); - if (new_len > MAX_PIN_LEN) - return SC_ERROR_INVALID_PIN_LENGTH; - new = p; - } - } - - sc_format_apdu(card, &apdu, 0, 0x2C, 0, pin_id); - apdu.data = (u8 *) new; - apdu.datalen = new_len; - apdu.lc = apdu.datalen; - - if (new_len || ask_for_secret) { - apdu.p1 = 0x02; - apdu.cse = SC_APDU_CASE_3_SHORT; - } else { - apdu.p1 = 0x03; - apdu.cse = SC_APDU_CASE_1; - } - - if (ask_for_secret && !new_len) { - struct sc_pin_cmd_data data; - data.apdu = &apdu; - data.cmd = SC_PIN_CMD_CHANGE; - data.flags = SC_PIN_CMD_IMPLICIT_CHANGE; - data.pin2.encoding = SC_PIN_ENCODING_ASCII; - data.pin2.length_offset = 0; - data.pin2.offset = 5; - data.pin2.max_length = MAX_PIN_LEN; - data.pin2.min_length = MIN_PIN_LEN; - data.pin2.pad_length = 0; - r = card->reader->ops->perform_verify(card->reader, &data); - } else - r = sc_transmit_apdu(card, &apdu); - - if (p) { - OPENSSL_cleanse(p, new_len); - free(p); - } - - return r; -} - -static PACE_SEC * -get_psec(sc_card_t *card, const char *pin, size_t length_pin, enum s_type pin_id) -{ - char *p = NULL; - PACE_SEC *r; - /* Flawfinder: ignore */ - char buf[MAX_MRZ_LEN > 32 ? MAX_MRZ_LEN : 32]; - - if (!length_pin || !pin) { - if (0 > snprintf(buf, sizeof buf, "Please enter your %s: ", - npa_secret_name(pin_id))) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not create password prompt.\n"); - return NULL; - } - p = malloc(MAX_MRZ_LEN+1); - if (!p) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for %s.\n", - npa_secret_name(pin_id)); - return NULL; - } - if (0 > EVP_read_pw_string_min(p, 0, MAX_MRZ_LEN, buf, 0)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not read %s.\n", - npa_secret_name(pin_id)); - return NULL; - } - length_pin = strlen(p); - if (length_pin > MAX_MRZ_LEN) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "MRZ too long"); - return NULL; - } - pin = p; - } - - r = PACE_SEC_new(pin, length_pin, pin_id); - - if (p) { - OPENSSL_cleanse(p, length_pin); - free(p); - } - - return r; -} - - -int perform_pace(sc_card_t *card, - struct establish_pace_channel_input pace_input, - struct establish_pace_channel_output *pace_output, - enum eac_tr_version tr_version) -{ - u8 *p = NULL; - EAC_CTX *eac_ctx = NULL; - BUF_MEM *enc_nonce = NULL, *mdata = NULL, *mdata_opp = NULL, - *token_opp = NULL, *token = NULL, *pub = NULL, *pub_opp = NULL, - *comp_pub = NULL, *comp_pub_opp = NULL; - PACE_SEC *sec = NULL; - CVC_CHAT *chat = NULL; - BIO *bio_stdout = NULL; - CVC_CERTIFICATE_DESCRIPTION *desc = NULL; - int r; - const unsigned char *pp; - - if (!card || !pace_output) - return SC_ERROR_INVALID_ARGUMENTS; - - /* show description in advance to give the user more time to read it... - * This behaviour differs from TR-03119 v1.1 p. 44. */ - if (pace_input.certificate_description_length && - pace_input.certificate_description) { - - pp = pace_input.certificate_description; - if (!d2i_CVC_CERTIFICATE_DESCRIPTION(&desc, - &pp, pace_input.certificate_description_length)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse certificate description."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - if (!bio_stdout) { - bio_stdout = BIO_new_fp(stdout, BIO_NOCLOSE); - if (!bio_stdout) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not create output buffer."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - } - - printf("Certificate Description\n"); - switch(certificate_description_print(bio_stdout, desc, 8)) { - case 0: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not print certificate description."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - break; - case 1: - /* text format */ - break; - case 2: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Certificate description in " - "HTML format can not (yet) be handled."); - r = SC_ERROR_NOT_SUPPORTED; - goto err; - break; - case 3: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Certificate description in " - "PDF format can not (yet) be handled."); - r = SC_ERROR_NOT_SUPPORTED; - goto err; - break; - default: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Certificate description in " - "unknown format can not be handled."); - r = SC_ERROR_NOT_SUPPORTED; - goto err; - break; - } - } - - /* show chat in advance to give the user more time to read it... - * This behaviour differs from TR-03119 v1.1 p. 44. */ - if (pace_input.chat_length && pace_input.chat) { - - if (!bio_stdout) { - bio_stdout = BIO_new_fp(stdout, BIO_NOCLOSE); - if (!bio_stdout) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not create output buffer."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - } - - pp = pace_input.chat; - if (!d2i_CVC_CHAT(&chat, &pp, pace_input.chat_length)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse card holder authorization template (CHAT)."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - printf("Card holder authorization template (CHAT)\n"); - if (!cvc_chat_print(bio_stdout, chat, 8)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not print card holder authorization template (CHAT)."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - } - - if (card->reader->capabilities & SC_READER_CAP_PACE_GENERIC - && card->reader->ops->perform_pace) { - r = card->reader->ops->perform_pace(card->reader, &pace_input, pace_output); - if (r < 0) - goto err; - } else { - if (!pace_output->ef_cardaccess_length || !pace_output->ef_cardaccess) { - r = get_ef_card_access(card, &pace_output->ef_cardaccess, - &pace_output->ef_cardaccess_length); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get EF.CardAccess."); - goto err; - } - } - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "EF.CardAccess", pace_output->ef_cardaccess, - pace_output->ef_cardaccess_length); - - /* XXX Card capabilities should be determined by the OpenSC card driver. We - * set it here to be able to use the nPA without patching OpenSC. By - * now we have read the EF.CardAccess so the assumption to have an nPA - * seems valid. */ - card->caps |= SC_CARD_CAP_APDU_EXT; - - eac_ctx = EAC_CTX_new(); - if (!eac_ctx - || !EAC_CTX_init_ef_cardaccess(pace_output->ef_cardaccess, - pace_output->ef_cardaccess_length, eac_ctx) - || !eac_ctx->pace_ctx) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse EF.CardAccess."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - eac_ctx->tr_version = tr_version; - - r = npa_mse_set_at_pace(card, eac_ctx->pace_ctx->protocol, - pace_input.pin_id, chat, &pace_output->mse_set_at_sw1, - &pace_output->mse_set_at_sw2); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not select protocol proberties " - "(MSE: Set AT failed)."); - goto err; - } - - enc_nonce = BUF_MEM_new(); - if (!enc_nonce) { - ssl_error(card->ctx); - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - r = npa_gen_auth_1_encrypted_nonce(card, (u8 **) &enc_nonce->data, - &enc_nonce->length); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get encrypted nonce from card " - "(General Authenticate step 1 failed)."); - goto err; - } - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Encrypted nonce from MRTD", (u8 *)enc_nonce->data, enc_nonce->length); - enc_nonce->max = enc_nonce->length; - - sec = get_psec(card, (char *) pace_input.pin, pace_input.pin_length, - pace_input.pin_id); - if (!sec) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not encode PACE secret."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - if (!PACE_STEP2_dec_nonce(eac_ctx, sec, enc_nonce)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not decrypt MRTD's nonce."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - mdata_opp = BUF_MEM_new(); - mdata = PACE_STEP3A_generate_mapping_data(eac_ctx); - if (!mdata || !mdata_opp) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not generate mapping data."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - r = npa_gen_auth_2_map_nonce(card, (u8 *) mdata->data, mdata->length, - (u8 **) &mdata_opp->data, &mdata_opp->length); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange mapping data with card " - "(General Authenticate step 2 failed)."); - goto err; - } - mdata_opp->max = mdata_opp->length; - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Mapping data from MRTD", (u8 *) mdata_opp->data, mdata_opp->length); - - if (!PACE_STEP3A_map_generator(eac_ctx, mdata_opp)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not map generator."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - pub = PACE_STEP3B_generate_ephemeral_key(eac_ctx); - pub_opp = BUF_MEM_new(); - if (!pub || !pub_opp) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not generate ephemeral domain parameter or " - "ephemeral key pair."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - r = npa_gen_auth_3_perform_key_agreement(card, (u8 *) pub->data, pub->length, - (u8 **) &pub_opp->data, &pub_opp->length); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange ephemeral public key with card " - "(General Authenticate step 3 failed)."); - goto err; - } - pub_opp->max = pub_opp->length; - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "Ephemeral public key from MRTD", (u8 *) pub_opp->data, pub_opp->length); - - - if (!PACE_STEP3B_compute_shared_secret(eac_ctx, pub_opp) - || !PACE_STEP3C_derive_keys(eac_ctx)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not compute ephemeral shared secret or " - "derive keys for encryption and authentication."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - token = PACE_STEP3D_compute_authentication_token(eac_ctx, pub_opp); - token_opp = BUF_MEM_new(); - if (!token || !token_opp) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not compute authentication token."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - r = npa_gen_auth_4_mutual_authentication(card, (u8 *) token->data, token->length, - (u8 **) &token_opp->data, &token_opp->length, - &pace_output->recent_car, &pace_output->recent_car_length, - &pace_output->previous_car, &pace_output->previous_car_length); - - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not exchange authentication token with card " - "(General Authenticate step 4 failed)."); - goto err; - } - token_opp->max = token_opp->length; - - if (!PACE_STEP3D_verify_authentication_token(eac_ctx, token_opp)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not verify authentication token."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - /* Initialize secure channel */ - if (!EAC_CTX_set_encryption_ctx(eac_ctx, EAC_ID_PACE)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not initialize encryption."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - /* Identifier for ICC and PCD */ - comp_pub = EAC_Comp(eac_ctx, EAC_ID_PACE, pub); - comp_pub_opp = EAC_Comp(eac_ctx, EAC_ID_PACE, pub_opp); - if (!comp_pub || !comp_pub_opp) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not compress public keys for identification."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - p = realloc(pace_output->id_icc, comp_pub_opp->length); - if (!p) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for ID ICC.\n"); - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - pace_output->id_icc = p; - pace_output->id_icc_length = comp_pub_opp->length; - /* Flawfinder: ignore */ - memcpy(pace_output->id_icc, comp_pub_opp->data, comp_pub_opp->length); - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "ID ICC", pace_output->id_icc, - pace_output->id_icc_length); - p = realloc(pace_output->id_pcd, comp_pub->length); - if (!p) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Not enough memory for ID PCD.\n"); - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - pace_output->id_pcd = p; - pace_output->id_pcd_length = comp_pub->length; - /* Flawfinder: ignore */ - memcpy(pace_output->id_pcd, comp_pub->data, comp_pub->length); - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "ID PCD", pace_output->id_pcd, - pace_output->id_pcd_length); - - r = npa_sm_start(card, eac_ctx, pace_input.certificate_description, - pace_input.certificate_description_length, pace_output->id_icc, - pace_output->id_icc_length); - } - -err: - if (enc_nonce) - BUF_MEM_free(enc_nonce); - if (mdata) - BUF_MEM_free(mdata); - if (mdata_opp) - BUF_MEM_free(mdata_opp); - if (token_opp) - BUF_MEM_free(token_opp); - if (token) - BUF_MEM_free(token); - if (pub) - BUF_MEM_free(pub); - if (pub_opp) - BUF_MEM_free(pub_opp); - if (comp_pub_opp) - BUF_MEM_free(comp_pub_opp); - if (comp_pub) - BUF_MEM_free(comp_pub); - PACE_SEC_clear_free(sec); - if (bio_stdout) - BIO_free_all(bio_stdout); - if (desc) - CVC_CERTIFICATE_DESCRIPTION_free(desc); - if (chat) - CVC_CHAT_free(chat); - - if (r < 0) - EAC_CTX_clear_free(eac_ctx); - - SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, r); -} - -static int npa_mse_set_at_ta(sc_card_t *card, int protocol, - const unsigned char *chr, size_t chr_len, - const unsigned char *eph_pub_key, size_t eph_pub_key_len, - const unsigned char *auxiliary_data, size_t auxiliary_data_len) -{ - return npa_mse_set_at(card, 0x81, protocol, chr, chr_len, NULL, 0, - eph_pub_key, eph_pub_key_len, auxiliary_data, auxiliary_data_len, - NULL, NULL, NULL); -} - -static int npa_mse_set_dst(sc_card_t *card, - const unsigned char *chr, size_t chr_len) -{ - return npa_mse(card, 0x81, 0xb6, 0, chr, chr_len, NULL, 0, NULL, 0, NULL, - 0, NULL, NULL, NULL); -} - -static int npa_get_challenge(sc_card_t *card, - unsigned char *challenge, size_t len) -{ - sc_apdu_t apdu; - int r; - - if (!card) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - sc_format_apdu(card, &apdu, SC_APDU_CASE_2_SHORT, 0x84, 0x00, 0x00); - apdu.le = len; - apdu.resplen = len; - apdu.resp = challenge; - - r = sc_transmit_apdu(card, &apdu); - if (r < 0) - goto err; - - r = sc_check_sw(card, apdu.sw1, apdu.sw2); - -err: - return r; -} - -static int npa_verify(sc_card_t *card, - const unsigned char *cert, size_t cert_len) -{ - sc_apdu_t apdu; - int r, class, tag; - long int length; - - memset(&apdu, 0, sizeof apdu); - - if (!card) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - sc_format_apdu(card, &apdu, SC_APDU_CASE_3_EXT, 0x2A, 0x00, 0xbe); - - apdu.data = cert; - if (0x80 & ASN1_get_object(&apdu.data, &length, &tag, &class, cert_len)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Error decoding Certificate"); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - apdu.datalen = length; - apdu.lc = length; - - r = sc_transmit_apdu(card, &apdu); - if (r < 0) - goto err; - - r = sc_check_sw(card, apdu.sw1, apdu.sw2); - -err: - return r; -} - -static int npa_external_authenticate(sc_card_t *card, - unsigned char *signature, size_t signature_len) -{ - int r; - sc_apdu_t apdu; - memset(&apdu, 0, sizeof apdu); - - if (!card) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - - sc_format_apdu(card, &apdu, SC_APDU_CASE_3_SHORT, 0x82, 0x00, 0x00); - - apdu.data = signature; - apdu.datalen = signature_len; - apdu.lc = signature_len; - - r = sc_transmit_apdu(card, &apdu); - if (r < 0) - goto err; - - r = sc_check_sw(card, apdu.sw1, apdu.sw2); - -err: - return r; -} - -#define TA_NONCE_LENGTH 8 -int perform_terminal_authentication(sc_card_t *card, - const unsigned char **certs, const size_t *certs_lens, - const unsigned char *privkey, size_t privkey_len, - const unsigned char *auxiliary_data, size_t auxiliary_data_len) -{ - int r; - const unsigned char *cert = NULL; - size_t cert_len = 0, ef_cardaccess_length = 0; - CVC_CERT *cvc_cert = NULL; - BUF_MEM *nonce = NULL, *signature = NULL; - struct iso_sm_ctx *isosmctx = NULL; - struct npa_sm_ctx *eacsmctx = NULL; - unsigned char *ef_cardaccess = NULL; - EAC_CTX *eac_ctx = NULL; - - if (!card || !certs_lens || !certs) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - if (!card->sm_ctx.info.cmd_data) { - card->sm_ctx.info.cmd_data = iso_sm_ctx_create(); - } - if (!card->sm_ctx.info.cmd_data) { - r = SC_ERROR_INTERNAL; - goto err; - } - - isosmctx = card->sm_ctx.info.cmd_data; - if (!isosmctx->priv_data) { - r = get_ef_card_access(card, &ef_cardaccess, &ef_cardaccess_length); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get EF.CardAccess."); - goto err; - } - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "EF.CardAccess", ef_cardaccess, - ef_cardaccess_length); - - /* XXX Card capabilities should be determined by the OpenSC card driver. We - * set it here to be able to use the nPA without patching OpenSC. By - * now we have read the EF.CardAccess so the assumption to have an nPA - * seems valid. */ - card->caps |= SC_CARD_CAP_APDU_EXT; - - eac_ctx = EAC_CTX_new(); - if (!eac_ctx - || !EAC_CTX_init_ef_cardaccess(ef_cardaccess, - ef_cardaccess_length, eac_ctx)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse EF.CardAccess."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - isosmctx->priv_data = npa_sm_ctx_create(eac_ctx, NULL, 0, NULL, 0); - if (!isosmctx->priv_data) { - r = SC_ERROR_INTERNAL; - goto err; - } - eac_ctx = NULL; - } - eacsmctx = isosmctx->priv_data; - - - while (*certs && *certs_lens) { - cert = *certs; - cert_len = *certs_lens; - if (!CVC_d2i_CVC_CERT(&cvc_cert, &cert, cert_len) || !cvc_cert - || !cvc_cert->body || !cvc_cert->body->certificate_authority_reference - || !cvc_cert->body->certificate_holder_reference) { - ssl_error(card->ctx); - r = SC_ERROR_INVALID_DATA; - goto err; - } - cert = *certs; - - r = npa_mse_set_dst(card, - cvc_cert->body->certificate_authority_reference->data, - cvc_cert->body->certificate_authority_reference->length); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not select protocol proberties " - "(MSE: Set AT failed)."); - goto err; - } - - r = npa_verify(card, cert, cert_len); - if (r < 0) - goto err; - - certs++; - certs_lens++; - } - - - if (!EAC_CTX_init_ta(eacsmctx->ctx, privkey, privkey_len, cert, cert_len)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not initialize TA."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - - if (eacsmctx->eph_pub_key) - BUF_MEM_free(eacsmctx->eph_pub_key); - eacsmctx->eph_pub_key = TA_STEP3_generate_ephemeral_key(eacsmctx->ctx); - if (!eacsmctx->eph_pub_key) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not generate CA ephemeral key."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - - r = npa_mse_set_at_ta(card, eacsmctx->ctx->ta_ctx->protocol, - cvc_cert->body->certificate_holder_reference->data, - cvc_cert->body->certificate_holder_reference->length, - (unsigned char *) eacsmctx->eph_pub_key->data, eacsmctx->eph_pub_key->length, - auxiliary_data, auxiliary_data_len); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not select protocol proberties " - "(MSE: Set AT failed)."); - goto err; - } - - nonce = BUF_MEM_create(TA_NONCE_LENGTH); - if (!nonce) { - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - r = npa_get_challenge(card, (unsigned char *) nonce->data, nonce->length); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get nonce for TA."); - goto err; - } - if (!TA_STEP4_set_nonce(eacsmctx->ctx, nonce)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not set nonce for TA."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - if (eacsmctx->auxiliary_data) - BUF_MEM_free(eacsmctx->auxiliary_data); - eacsmctx->auxiliary_data = BUF_MEM_create_init(auxiliary_data, - auxiliary_data_len); - signature = TA_STEP5_sign(eacsmctx->ctx, eacsmctx->eph_pub_key, - eacsmctx->id_icc, eacsmctx->auxiliary_data); - if (!signature) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not generate signature."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - r = npa_external_authenticate(card, (unsigned char *) signature->data, - signature->length); - -err: - if (cvc_cert) - CVC_CERT_free(cvc_cert); - free(ef_cardaccess); - EAC_CTX_clear_free(eac_ctx); - BUF_MEM_clear_free(nonce); - BUF_MEM_clear_free(signature); - - if (card) - SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, r); - else - return r; -} - -static int npa_mse_set_at_ca(sc_card_t *card, int protocol) -{ - return npa_mse_set_at(card, 0x41, protocol, NULL, 0, NULL, 0, NULL, 0, - NULL, 0, NULL, NULL, NULL); -} - -static int npa_gen_auth_ca(sc_card_t *card, const BUF_MEM *eph_pub_key, - BUF_MEM **nonce, BUF_MEM **token) -{ - sc_apdu_t apdu; - NPA_GEN_AUTH_CA_C *c_data = NULL; - NPA_GEN_AUTH_CA_R *r_data = NULL; - unsigned char *d = NULL; - int r; - unsigned char resp[maxresp]; - - sc_format_apdu(card, &apdu, SC_APDU_CASE_4_SHORT, ISO_GENERAL_AUTHENTICATE, - 0, 0); - - c_data = NPA_GEN_AUTH_CA_C_new(); - if (!c_data) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - c_data->eph_pub_key = ASN1_OCTET_STRING_new(); - if (!c_data->eph_pub_key - || !M_ASN1_OCTET_STRING_set( c_data->eph_pub_key, - eph_pub_key->data, eph_pub_key->length)) { - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - r = i2d_NPA_GEN_AUTH_CA_C(c_data, &d); - if (r < 0) { - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - apdu.data = d; - apdu.datalen = r; - apdu.lc = r; - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) command data", apdu.data, apdu.datalen); - - apdu.resplen = sizeof resp; - apdu.resp = resp; - r = sc_transmit_apdu(card, &apdu); - if (r < 0) - goto err; - - r = sc_check_sw(card, apdu.sw1, apdu.sw2); - if (r < 0) - goto err; - - bin_log(card->ctx, SC_LOG_DEBUG_NORMAL, "General authenticate (Perform Key Agreement) response data", apdu.resp, apdu.resplen); - - if (!d2i_NPA_GEN_AUTH_CA_R(&r_data, - (const unsigned char **) &apdu.resp, apdu.resplen)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse general authenticate response data."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - if (!r_data->nonce || !r_data->auth_token) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Response data of general authenticate for CA" - "should contain the nonce and the authentication token."); - r = SC_ERROR_UNKNOWN_DATA_RECEIVED; - goto err; - } - - if (*nonce) - BUF_MEM_free(*nonce); - *nonce = BUF_MEM_create_init(r_data->nonce->data, - r_data->nonce->length); - if (*token) - BUF_MEM_free(*token); - *token = BUF_MEM_create_init(r_data->auth_token->data, - r_data->auth_token->length); - if (!*nonce || !*token) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - -err: - if (c_data) - NPA_GEN_AUTH_CA_C_free(c_data); - if (r_data) - NPA_GEN_AUTH_CA_R_free(r_data); - free(d); - - return r; -} - -static int get_ef_card_security(sc_card_t *card, - u8 **ef_security, size_t *length_ef_security) -{ - return read_binary_rec(card, SFID_EF_CARDSECURITY, ef_security, length_ef_security); -} - -int perform_chip_authentication(sc_card_t *card, - unsigned char **ef_cardsecurity, size_t *ef_cardsecurity_len) -{ - int r; - BUF_MEM *picc_pubkey = NULL, *nonce = NULL, *token = NULL, - *eph_pub_key = NULL; - - if (!card || !card->sm_ctx.info.cmd_data - || !ef_cardsecurity || !ef_cardsecurity_len) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - struct iso_sm_ctx *isosmctx = card->sm_ctx.info.cmd_data; - if (!isosmctx->priv_data) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - struct npa_sm_ctx *eacsmctx = isosmctx->priv_data; - - - /* Passive Authentication */ - if (!*ef_cardsecurity && !*ef_cardsecurity_len) { - r = get_ef_card_security(card, ef_cardsecurity, ef_cardsecurity_len); - if (r < 0 || !ef_cardsecurity || !ef_cardsecurity_len) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not get EF.CardSecurity."); - goto err; - } - } - picc_pubkey = CA_get_pubkey(eacsmctx->ctx, *ef_cardsecurity, *ef_cardsecurity_len); - if (!picc_pubkey) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not verify EF.CardSecurity."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - - r = npa_mse_set_at_ca(card, eacsmctx->ctx->ca_ctx->protocol); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not select protocol proberties " - "(MSE: Set AT failed)."); - goto err; - } - - - eph_pub_key = CA_STEP2_get_eph_pubkey(eacsmctx->ctx); - if (!eph_pub_key) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not derive keys."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - r = npa_gen_auth_ca(card, eph_pub_key, &nonce, &token); - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "(General Authenticate failed)."); - goto err; - } - - - if (!CA_STEP4_compute_shared_secret(eacsmctx->ctx, picc_pubkey)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not compute shared secret."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - - if (!CA_STEP6_derive_keys(eacsmctx->ctx, nonce, token)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not derive keys."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - - /* Initialize secure channel */ - if (!EAC_CTX_set_encryption_ctx(eacsmctx->ctx, EAC_ID_CA)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not initialize encryption."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - -err: - BUF_MEM_clear_free(picc_pubkey); - BUF_MEM_clear_free(nonce); - BUF_MEM_clear_free(token); - BUF_MEM_clear_free(eph_pub_key); - - if (card) - SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, r); - else - return r; -} - -static const char *MRZ_name = "MRZ"; -static const char *PIN_name = "eID PIN"; -static const char *PUK_name = "PUK"; -static const char *CAN_name = "CAN"; -static const char *UNDEF_name = "UNDEF"; -const char *npa_secret_name(enum s_type pin_id) { - switch (pin_id) { - case PACE_MRZ: - return MRZ_name; - case PACE_PUK: - return PUK_name; - case PACE_PIN: - return PIN_name; - case PACE_CAN: - return CAN_name; - default: - return UNDEF_name; - } -} - -static int -increment_ssc(struct npa_sm_ctx *eacsmctx) -{ - if (!eacsmctx) - return SC_ERROR_INVALID_ARGUMENTS; - - if (!EAC_increment_ssc(eacsmctx->ctx)) - return SC_ERROR_INTERNAL; - - return SC_SUCCESS; -} - -static int -npa_sm_encrypt(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *data, size_t datalen, u8 **enc) -{ - BUF_MEM *encbuf = NULL, *databuf = NULL; - u8 *p = NULL; - int r; - - if (!card || !ctx || !enc || !ctx->priv_data) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - struct npa_sm_ctx *eacsmctx = ctx->priv_data; - - databuf = BUF_MEM_create_init(data, datalen); - encbuf = EAC_encrypt(eacsmctx->ctx, databuf); - if (!databuf || !encbuf) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not encrypt data."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - p = realloc(*enc, encbuf->length); - if (!p) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - *enc = p; - /* Flawfinder: ignore */ - memcpy(*enc, encbuf->data, encbuf->length); - r = encbuf->length; - -err: - BUF_MEM_clear_free(databuf); - if (encbuf) - BUF_MEM_free(encbuf); - - return r; -} - -static int -npa_sm_decrypt(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *enc, size_t enclen, u8 **data) -{ - BUF_MEM *encbuf = NULL, *databuf = NULL; - u8 *p = NULL; - int r; - - if (!card || !ctx || !enc || !ctx->priv_data || !data) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - struct npa_sm_ctx *eacsmctx = ctx->priv_data; - - encbuf = BUF_MEM_create_init(enc, enclen); - databuf = EAC_decrypt(eacsmctx->ctx, encbuf); - if (!encbuf || !databuf) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not decrypt data."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - p = realloc(*data, databuf->length); - if (!p) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - *data = p; - /* Flawfinder: ignore */ - memcpy(*data, databuf->data, databuf->length); - r = databuf->length; - -err: - BUF_MEM_clear_free(databuf); - if (encbuf) - BUF_MEM_free(encbuf); - - return r; -} - -static int -npa_sm_authenticate(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *data, size_t datalen, u8 **macdata) -{ - BUF_MEM *inbuf = NULL, *macbuf = NULL; - u8 *p = NULL; - int r; - - if (!card || !ctx || !ctx->priv_data || !macdata) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - struct npa_sm_ctx *eacsmctx = ctx->priv_data; - - inbuf = BUF_MEM_create_init(data, datalen); - if (!inbuf) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - - macbuf = EAC_authenticate(eacsmctx->ctx, inbuf); - if (!macbuf) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, - "Could not compute message authentication code (MAC)."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - p = realloc(*macdata, macbuf->length); - if (!p) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - *macdata = p; - /* Flawfinder: ignore */ - memcpy(*macdata, macbuf->data, macbuf->length); - r = macbuf->length; - -err: - if (inbuf) - BUF_MEM_free(inbuf); - if (macbuf) - BUF_MEM_free(macbuf); - - return r; -} - -static int -npa_sm_verify_authentication(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *mac, size_t maclen, - const u8 *macdata, size_t macdatalen) -{ - int r; - BUF_MEM *inbuf = NULL, *my_mac = NULL; - - if (!card || !ctx || !ctx->priv_data) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - struct npa_sm_ctx *eacsmctx = ctx->priv_data; - - inbuf = BUF_MEM_create_init(macdata, macdatalen); - if (!inbuf) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - - my_mac = EAC_authenticate(eacsmctx->ctx, inbuf); - if (!my_mac) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, - "Could not compute message authentication code (MAC) for verification."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - if (my_mac->length != maclen || - memcmp(my_mac->data, mac, maclen) != 0) { - r = SC_ERROR_OBJECT_NOT_VALID; - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, - "Authentication data not verified"); - goto err; - } - - sc_debug(card->ctx, SC_LOG_DEBUG_NORMAL, "Authentication data verified"); - - r = SC_SUCCESS; - -err: - if (inbuf) - BUF_MEM_free(inbuf); - if (my_mac) - BUF_MEM_free(my_mac); - - return r; -} - -static int -add_tag(unsigned char **asn1new, int constructed, int tag, - int xclass, const unsigned char *data, size_t len) -{ - unsigned char *p; - int newlen; - - if (!asn1new || !data) - return -1; - - newlen = ASN1_object_size(constructed, len, tag); - if (newlen < 0) - return newlen; - - p = OPENSSL_realloc(*asn1new, newlen); - if (!p) - return -1; - *asn1new = p; - - ASN1_put_object(&p, constructed, len, tag, xclass); - memcpy(p, data, len); - - return newlen; -} -static int -npa_sm_pre_transmit(sc_card_t *card, const struct iso_sm_ctx *ctx, - sc_apdu_t *apdu) -{ - int r; - CVC_CERT *cvc_cert = NULL; - unsigned char *cert = NULL; - int len; - BUF_MEM *signature = NULL; - unsigned char *sequence = NULL, *templates = NULL; - NPA_MSE_C *msesetat = NULL; - const unsigned char *p; - - if (!card) - return SC_ERROR_INVALID_ARGUMENTS; - if(!ctx || !apdu || !ctx->priv_data) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - struct npa_sm_ctx *eacsmctx = ctx->priv_data; - - if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECK_ALL)) { - if (apdu->ins == 0x2a && apdu->p1 == 0x00 && apdu->p2 == 0xbe) { - /* PSO:Verify Certificate - * check certificate description to match given certificate */ - - len = add_tag(&cert, 1, 0x21, V_ASN1_APPLICATION, apdu->data, apdu->datalen); - p = cert; - if (len < 0 || !CVC_d2i_CVC_CERT(&cvc_cert, &p, len) - || !cvc_cert || !cvc_cert->body) { - r = SC_ERROR_INVALID_DATA; - goto err; - } - - switch (CVC_get_role(cvc_cert->body->chat)) { - case CVC_CVCA: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Processing CVCA certificate"); - break; - - case CVC_DV: - case CVC_DocVer: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Processing DV certificate"); - break; - - case CVC_Terminal: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Processing Terminal certificate"); - - if (eacsmctx->certificate_description) { - switch (CVC_check_description(cvc_cert, - (unsigned char *) eacsmctx->certificate_description->data, - eacsmctx->certificate_description->length)) { - case 1: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, - "Certificate Description matches Certificate"); - break; - case 0: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, - "Certificate Description doesn't match Certificate"); - r = SC_ERROR_INVALID_DATA; - goto err; - break; - default: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, - "Error verifying Certificate Description"); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - break; - } - } else { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, - "Warning: Certificate Description missing"); - } - break; - - default: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Unknown type of certificate"); - r = SC_ERROR_INVALID_DATA; - goto err; - break; - } - - if (!TA_STEP2_import_certificate(eacsmctx->ctx, cert, len)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, - "Error importing certificate"); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - } else if (apdu->ins == ISO_MSE && apdu->p2 == 0xa4) { - /* MSE:Set AT */ - - len = add_tag(&sequence, 1, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL, apdu->data, apdu->datalen); - p = sequence; - if (len < 0 || !d2i_NPA_MSE_C(&msesetat, &p, len)) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not parse MSE:Set AT."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - - if (apdu->p1 == 0x81) { - /* CA: fetch auxiliary data and terminal's compressed ephemeral - * public key */ - - if (msesetat->auxiliary_data) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Saving terminal's auxiliary data"); - if (eacsmctx->auxiliary_data) - BUF_MEM_free(eacsmctx->auxiliary_data); - eacsmctx->auxiliary_data = BUF_MEM_new(); - if (!eacsmctx->auxiliary_data) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - eacsmctx->auxiliary_data->length = i2d_ASN1_AUXILIARY_DATA( - msesetat->auxiliary_data, - (unsigned char **) &eacsmctx->auxiliary_data->data); - if ((int) eacsmctx->auxiliary_data->length < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Error encoding auxiliary data."); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - } - eacsmctx->auxiliary_data->max = eacsmctx->auxiliary_data->length; - } - if (msesetat->eph_pub_key) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Saving terminal's compressed ephemeral public key"); - if (eacsmctx->eph_pub_key) - BUF_MEM_free(eacsmctx->eph_pub_key); - eacsmctx->eph_pub_key = - BUF_MEM_create_init(msesetat->eph_pub_key->data, - msesetat->eph_pub_key->length); - if (!eacsmctx->eph_pub_key) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - } - } else if (apdu->p1 == 0x41) { - /* TA: Set CAR */ - - if (msesetat->key_reference1 && msesetat->key_reference1->data && - msesetat->key_reference1->length) { - /* do nothing. The trust anchor matching this CAR will be - * looked up when the certificate chain is imported */ - } - } - } else if (apdu->ins == 0x82 && apdu->p1 == 0x00 && apdu->p2 == 0x00) { - /* External Authenticate - * check terminal's signature */ - - signature = BUF_MEM_create_init(apdu->data, apdu->datalen); - if (!signature) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - switch (TA_STEP6_verify(eacsmctx->ctx, eacsmctx->eph_pub_key, - eacsmctx->id_icc, eacsmctx->auxiliary_data, signature)) { - case 1: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, - "Verified Terminal's signature"); - break; - case 0: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, - "Terminal's signature not verified"); - r = SC_ERROR_INVALID_DATA; - goto err; - break; - default: - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, - "Error verifying terminal's signature"); - ssl_error(card->ctx); - r = SC_ERROR_INTERNAL; - goto err; - break; - } - } - } - - r = increment_ssc(ctx->priv_data); - -err: - if (cvc_cert) - CVC_CERT_free(cvc_cert); - if (signature) - BUF_MEM_free(signature); - if (cert) - OPENSSL_free(cert); - free(sequence); - if (templates) - OPENSSL_free(templates); - if (msesetat) - NPA_MSE_C_free(msesetat); - - SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, r); -} - -static int -npa_sm_post_transmit(sc_card_t *card, const struct iso_sm_ctx *ctx, - sc_apdu_t *sm_apdu) -{ - SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, - increment_ssc(ctx->priv_data)); -} - -static int -npa_sm_finish(sc_card_t *card, const struct iso_sm_ctx *ctx, - sc_apdu_t *apdu) -{ - if (!card) - return SC_ERROR_INVALID_ARGUMENTS; - if(!ctx || !ctx->priv_data || !apdu) - SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, - SC_ERROR_INVALID_ARGUMENTS); - struct npa_sm_ctx *eacsmctx = ctx->priv_data; - - if (!(eacsmctx->flags & NPA_FLAG_DISABLE_CHECK_ALL)) { - if (apdu->sw1 == 0x90 && apdu->sw2 == 0x00) { - if (apdu->ins == 0x84 && apdu->p1 == 0x00 && apdu->p2 == 0x00 - && apdu->le == 8 && apdu->resplen == 8) { - /* Get Challenge - * copy challenge to EAC context */ - - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Saving MRTD's nonce to later verify Terminal's signature"); - - BUF_MEM *nonce = BUF_MEM_create_init(apdu->resp, apdu->resplen); - int r = TA_STEP4_set_nonce(eacsmctx->ctx, nonce); - if (nonce) - BUF_MEM_free(nonce); - - if (!r) { - ssl_error(card->ctx); - SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, SC_ERROR_INTERNAL); - } - } - } - } - - SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_NORMAL, SC_SUCCESS); -} - -static void -npa_sm_clear_free(const struct iso_sm_ctx *ctx) -{ - if (ctx) { - struct npa_sm_ctx *eacsmctx = ctx->priv_data; - EAC_CTX_clear_free(eacsmctx->ctx); - if (eacsmctx->certificate_description) - BUF_MEM_free(eacsmctx->certificate_description); - if (eacsmctx->id_icc) - BUF_MEM_free(eacsmctx->id_icc); - if (eacsmctx->eph_pub_key) - BUF_MEM_free(eacsmctx->eph_pub_key); - if (eacsmctx->auxiliary_data) - BUF_MEM_free(eacsmctx->auxiliary_data); - free(eacsmctx); - } -} diff --git a/npa/src/npa/boxing.h b/npa/src/npa/boxing.h deleted file mode 100644 index 09dddb5..0000000 --- a/npa/src/npa/boxing.h +++ /dev/null @@ -1,67 +0,0 @@ -/* - * boxing.c: interface related to boxing commands with pseudo APDUs - * - * Copyright (C) 2013 Frank Morgner - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - */ - -#ifndef _BOXING_CMDS_H -#define _BOXING_CMDS_H - -#include "libopensc/opensc.h" -#include "libopensc/pace.h" - -#ifdef __cplusplus -extern "C" { -#endif - -#define DISABLE_GLOBAL_BOXING_INITIALIZATION -#ifndef DISABLE_GLOBAL_BOXING_INITIALIZATION - /** initialize boxing for all available readers once on the application - * layer */ - /* The OpenSC PC/SC reader implementation allows a transmit only when a - * card is connected. So testing for boxing commands will yield an error - * then. */ -void sc_initialize_boxing_cmds(sc_context_t *ctx); -#else -void sc_detect_boxing_cmds(sc_reader_t *reader); -#endif - -int boxing_pace_input_to_buf(sc_context_t *ctx, - const struct establish_pace_channel_input *input, - unsigned char **asn1, size_t *asn1_len); -int boxing_buf_to_pace_input(sc_context_t *ctx, - const unsigned char *asn1, size_t asn1_len, - struct establish_pace_channel_input *input); -int boxing_pace_output_to_buf(sc_context_t *ctx, - const struct establish_pace_channel_output *output, - unsigned char **asn1, size_t *asn1_len); -int boxing_buf_to_pace_output(sc_context_t *ctx, - const unsigned char *asn1, size_t asn1_len, - struct establish_pace_channel_output *output); -int boxing_pace_capabilities_to_buf(sc_context_t *ctx, - const unsigned long sc_reader_t_capabilities, - unsigned char **asn1, size_t *asn1_len); -int boxing_buf_to_pace_capabilities(sc_context_t *ctx, - const unsigned char *asn1, size_t asn1_len, - unsigned long *sc_reader_t_capabilities); - -#ifdef __cplusplus -} -#endif - -#endif - diff --git a/npa/src/npa/iso-sm.h b/npa/src/npa/iso-sm.h deleted file mode 100644 index 60b10a9..0000000 --- a/npa/src/npa/iso-sm.h +++ /dev/null @@ -1,125 +0,0 @@ -/* - * Copyright (C) 2010 Frank Morgner - * - * This file is part of npa. - * - * npa is free software: you can redistribute it and/or modify it under the - * terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * npa is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. - * - * You should have received a copy of the GNU General Public License along with - * npa. If not, see . - */ -/** - * @file - * @defgroup sm Interface to Secure Messaging (SM) defined in ISO 7816 - * @{ - */ -#ifndef _CCID_SM_H -#define _CCID_SM_H - -#include - -#ifdef __cplusplus -extern "C" { -#endif - -/** @brief maximum length of response when targeting a SM RAPDU - * - * Using SM with authenticated data+le and encrypted data this is the biggest - * amount of the unencrypted response data we can receive. We assume AES block - * length for padding and MAC. */ -#define MAX_SM_APDU_RESP_SIZE 223 - -/** @brief maximum length of data when targeting a SM APDU - * - * Using SM with authenticated data+header and encrypted data this is the - * biggest amount of the unencrypted data we can send. We assume AES block - * length for padding and MAC. */ -#define MAX_SM_APDU_DATA_SIZE 239 - -/** @brief Padding indicator: use ISO/IEC 9797-1 padding method 2 */ -#define SM_ISO_PADDING 0x01 -/** @brief Padding indicator: use no padding */ -#define SM_NO_PADDING 0x02 - -/** @brief Secure messaging context */ -struct iso_sm_ctx { - /** @brief data of the specific crypto implementation */ - void *priv_data; - - /** @brief Padding-content indicator byte (ISO 7816-4 Table 30) */ - u8 padding_indicator; - /** @brief Pad to this block length */ - size_t block_length; - - /** @brief Call back function for authentication of data */ - int (*authenticate)(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *data, size_t datalen, u8 **outdata); - /** @brief Call back function for verifying authentication data */ - int (*verify_authentication)(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *mac, size_t maclen, - const u8 *macdata, size_t macdatalen); - - /** @brief Call back function for encryption of data */ - int (*encrypt)(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *data, size_t datalen, u8 **enc); - /** @brief Call back function for decryption of data */ - int (*decrypt)(sc_card_t *card, const struct iso_sm_ctx *ctx, - const u8 *enc, size_t enclen, u8 **data); - - /** @brief Call back function for actions before encoding and encryption of \a apdu */ - int (*pre_transmit)(sc_card_t *card, const struct iso_sm_ctx *ctx, - sc_apdu_t *apdu); - /** @brief Call back function for actions before decryption and decoding of \a sm_apdu */ - int (*post_transmit)(sc_card_t *card, const struct iso_sm_ctx *ctx, - sc_apdu_t *sm_apdu); - /** @brief Call back function for actions after decrypting SM protected APDU */ - int (*finish)(sc_card_t *card, const struct iso_sm_ctx *ctx, - sc_apdu_t *apdu); - - /** @brief Clears and frees private data */ - void (*clear_free)(const struct iso_sm_ctx *ctx); -}; - -/** - * @brief Clears and frees the SM context including private data - * - * Calls \a sctx->clear_free() if available - * - * @param[in] sctx (optional) - */ -void iso_sm_ctx_clear_free(struct iso_sm_ctx *sctx); - -/** - * @brief Creates a SM context - * - * @return SM context or NULL if an error occurred - */ -struct iso_sm_ctx *iso_sm_ctx_create(void); - -/** - * @brief Initializes a card for usage of the ISO SM driver - * - * If a SM module has been assigned previously to the card, it will be cleaned - * up. - * - * @param[in] card - * @param[in] sctx will NOT be freed automatically. \a sctx should be present - * for the time of the SM session. - * - * @return \c SC_SUCCESS or error code if an error occurred - */ -int iso_sm_start(struct sc_card *card, struct iso_sm_ctx *sctx); - -#ifdef __cplusplus -} -#endif -#endif -/* @} */ diff --git a/npa/src/npa/npa.h b/npa/src/npa/npa.h deleted file mode 100644 index aa8510e..0000000 --- a/npa/src/npa/npa.h +++ /dev/null @@ -1,257 +0,0 @@ -/* - * Copyright (C) 2010 Frank Morgner - * - * This file is part of npa. - * - * npa is free software: you can redistribute it and/or modify it under the - * terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * npa is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. - * - * You should have received a copy of the GNU General Public License along with - * npa. If not, see . - */ -/* -*/ -/** - * @file - * @defgroup npa Interface to German identity card (neuer Personalausweis, nPA) - * @{ - */ -#ifndef _CCID_NPA_H -#define _CCID_NPA_H - -#include -#include -#include -#include -#include -#include - -#ifdef __cplusplus -extern "C" { -#endif - -/** @brief NPA capabilities (TR-03119): PACE */ -#define NPA_BITMAP_PACE 0x40 -/** @brief NPA capabilities (TR-03119): EPA: eID */ -#define NPA_BITMAP_EID 0x20 -/** @brief NPA capabilities (TR-03119): EPA: eSign */ -#define NPA_BITMAP_ESIGN 0x10 - -/** @brief NPA result (TR-03119): Kein Fehler */ -#define NPA_SUCCESS 0x00000000 -/** @brief NPA result (TR-03119): Längen im Input sind inkonsistent */ -#define NPA_ERROR_LENGTH_INCONSISTENT 0xD0000001 -/** @brief NPA result (TR-03119): Unerwartete Daten im Input */ -#define NPA_ERROR_UNEXPECTED_DATA 0xD0000002 -/** @brief NPA result (TR-03119): Unerwartete Kombination von Daten im Input */ -#define NPA_ERROR_UNEXPECTED_DATA_COMBINATION 0xD0000003 -/** @brief NPA result (TR-03119): Die Karte unterstützt das PACE – Verfahren nicht. (Unerwartete Struktur in Antwortdaten der Karte) */ -#define NPA_ERROR_CARD_NOT_SUPPORTED 0xE0000001 -/** @brief NPA result (TR-03119): Der Kartenleser unterstützt den angeforderten bzw. den ermittelten Algorithmus nicht. */ -#define NPA_ERROR_ALGORITH_NOT_SUPPORTED 0xE0000002 -/** @brief NPA result (TR-03119): Der Kartenleser kennt die PIN – ID nicht. */ -#define NPA_ERROR_PINID_NOT_SUPPORTED 0xE0000003 -/** @brief NPA result (TR-03119): Negative Antwort der Karte auf Select EF_CardAccess (needs to be OR-ed with SW1|SW2) */ -#define NPA_ERROR_SELECT_EF_CARDACCESS 0xF0000000 -/** @brief NPA result (TR-03119): Negative Antwort der Karte auf Read Binary (needs to be OR-ed with SW1|SW2) */ -#define NPA_ERROR_READ_BINARY 0xF0010000 -/** @brief NPA result (TR-03119): Negative Antwort der Karte auf MSE: Set AT (needs to be OR-ed with SW1|SW2) */ -#define NPA_ERROR_MSE_SET_AT 0xF0020000 -/** @brief NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 1 (needs to be OR-ed with SW1|SW2) */ -#define NPA_ERROR_GENERAL_AUTHENTICATE_1 0xF0030000 -/** @brief NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 2 (needs to be OR-ed with SW1|SW2) */ -#define NPA_ERROR_GENERAL_AUTHENTICATE_2 0xF0040000 -/** @brief NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 3 (needs to be OR-ed with SW1|SW2) */ -#define NPA_ERROR_GENERAL_AUTHENTICATE_3 0xF0050000 -/** @brief NPA result (TR-03119): Negative Antwort der Karte auf General Authenticate Step 4 (needs to be OR-ed with SW1|SW2) */ -#define NPA_ERROR_GENERAL_AUTHENTICATE_4 0xF0060000 -/** @brief NPA result (TR-03119): Kommunikationsabbruch mit Karte. */ -#define NPA_ERROR_COMMUNICATION 0xF0100001 -/** @brief NPA result (TR-03119): Keine Karte im Feld. */ -#define NPA_ERROR_NO_CARD 0xF0100002 -/** @brief NPA result (TR-03119): Benutzerabbruch. */ -#define NPA_ERROR_ABORTED 0xF0200001 -/** @brief NPA result (TR-03119): Benutzer – Timeout */ -#define NPA_ERROR_TIMEOUT 0xF0200002 - -/** @brief File identifier of EF.CardAccess */ -#define FID_EF_CARDACCESS 0x011C -/** @brief Short file identifier of EF.CardAccess */ -#define SFID_EF_CARDACCESS 0x1C -/** @brief File identifier of EF.CardSecurity */ -#define FID_EF_CARDSECURITY 0x011D -/** @brief Short file identifier of EF.CardAccess */ -#define SFID_EF_CARDSECURITY 0x1D - -/** @brief Maximum length of PIN */ -#define MAX_PIN_LEN 6 -/** @brief Minimum length of PIN */ -#define MIN_PIN_LEN 6 -/** @brief Length of CAN */ -#define CAN_LEN 6 -/** @brief Minimum length of MRZ */ -#define MAX_MRZ_LEN 128 -/** @brief Number of retries for PIN */ -#define MAX_PIN_TRIES 3 -/** @brief Usage counter of PIN in suspended state */ -#define UC_PIN_SUSPENDED 1 - - -/** - * @brief Names the type of the PACE secret - * - * @param pin_id type of the PACE secret - * - * @return Printable string containing the name - */ -const char *npa_secret_name(enum s_type pin_id); - - -/** - * @brief Get the PACE capabilities - * - * @param[in,out] bitmap where to store capabilities bitmap - * @note Since this code offers no support for terminal certificate, the bitmap is always \c PACE_BITMAP_PACE|PACE_BITMAP_EID - * - * @return \c SC_SUCCESS or error code if an error occurred - */ -int get_pace_capabilities(u8 *bitmap); - -/** - * @brief Establish secure messaging using PACE - * - * Modifies \a card to use the ISO SM driver and initializes the data - * structures to use the established SM channel. - * - * Prints certificate description and card holder authorization template if - * given in a human readable form to stdout. If no secret is given, the user is - * asked for it. Only \a pace_input.pin_id is mandatory, the other members of - * \a pace_input can be set to \c 0 or \c NULL respectively. - * - * The buffers in \a pace_output are allocated using \c realloc() and should be - * set to NULL, if empty. If an EF.CardAccess is already present, this file is - * reused and not fetched from the card. - * - * @param[in,out] card - * @param[in] pace_input - * @param[in,out] pace_output - * @param[in] tr_version Version of TR-03110 to use with PACE - * - * @return \c SC_SUCCESS or error code if an error occurred - */ -int perform_pace(sc_card_t *card, - struct establish_pace_channel_input pace_input, - struct establish_pace_channel_output *pace_output, - enum eac_tr_version tr_version); - -/** - * @brief Terminal Authentication version 2 - * - * @param[in] card - * @param[in] certs chain of cv certificates, the last certificate - * is the terminal's certificate, array should be - * terminated with \c NULL - * @param[in] certs_lens length of each element in \c certs, should be - * terminated with \c 0 - * @param[in] privkey The terminal's private key - * @param[in] privkey_len length of \a privkey - * @param[in] auxiliary_data auxiliary data for age/validity/community ID - * verification. Should be an ASN1 object tagged - * with \c 0x67 - * @param[in] auxiliary_data_len length of \a auxiliary_data - * - * @return \c SC_SUCCESS or error code if an error occurred - */ -int perform_terminal_authentication(sc_card_t *card, - const unsigned char **certs, const size_t *certs_lens, - const unsigned char *privkey, size_t privkey_len, - const unsigned char *auxiliary_data, size_t auxiliary_data_len); - -/** - * @brief Establish secure messaging using Chip Authentication version 2 - * - * Switches the SM context of \c card to the new established keys. - * - * @param[in] card - * @param[in,out] ef_cardsecurity - * @param[in,out] ef_cardsecurity_len - * - * @return \c SC_SUCCESS or error code if an error occurred - */ -int perform_chip_authentication(sc_card_t *card, - unsigned char **ef_cardsecurity, size_t *ef_cardsecurity_len); - -/** - * @brief Sends a reset retry counter APDU - * - * According to TR-03110 the reset retry counter APDU is used to set a new PIN - * or to reset the retry counter of the PIN. The standard requires this - * operation to be authorized either by an established PACE channel or by the - * effective authorization of the terminal's certificate. - * - * @param[in] card - * @param[in] pin_id Type of secret (usually PIN or CAN). You may use enum s_type from \c . - * @param[in] ask_for_secret whether to ask the user for the secret (\c 1) or not (\c 0) - * @param[in] new (optional) new secret - * @param[in] new_len (optional) length of \a new - * - * @return \c SC_SUCCESS or error code if an error occurred - */ -int npa_reset_retry_counter(sc_card_t *card, - enum s_type pin_id, int ask_for_secret, - const char *new, size_t new_len); - -/** - * @brief Sends an MSE:Set AT to determine the number of remaining tries - * - * @param[in] card - * @param[in] pin_id Type of secret (usually PIN or CAN). You may use enum s_type from \c . - * @param[in,out] tries_left Tries left or -1 if no specific number has been returned by the card (e.g. when there is no limit in retries). - * - * @return \c SC_SUCCESS or error code if an error occurred - */ -int npa_pace_get_tries_left(sc_card_t *card, - enum s_type pin_id, int *tries_left); -/** - * @brief Send APDU to unblock the PIN - * - * @param[in] card - */ -#define npa_unblock_pin(card) \ - npa_reset_retry_counter(card, PACE_PIN, 0, NULL, 0) -/** - * @brief Send APDU to set a new PIN - * - * @param[in] card - * @param[in] newp (optional) new PIN - * @param[in] newplen (optional) length of \a new - */ -#define npa_change_pin(card, newp, newplen) \ - npa_reset_retry_counter(card, PACE_PIN, 1, newp, newplen) - -/** @brief Disable all sanity checks done by libnpa */ -#define NPA_FLAG_DISABLE_CHECK_ALL 1 -/** @brief Disable checking validity period of CV certificates */ -#define NPA_FLAG_DISABLE_CHECK_TA 2 -/** @brief Disable checking passive authentication during CA */ -#define NPA_FLAG_DISABLE_CHECK_CA 4 - -/** @brief Use \c npa_default_flags to disable checks for EAC/SM */ -extern char npa_default_flags; - -/** @brief ASN.1 type for authenticated auxiliary data for terminal authentication */ -typedef STACK_OF(CVC_DISCRETIONARY_DATA_TEMPLATE) ASN1_AUXILIARY_DATA; -DECLARE_ASN1_FUNCTIONS(ASN1_AUXILIARY_DATA) - -#ifdef __cplusplus -} -#endif -#endif -/* @} */ diff --git a/npa/src/opensc b/npa/src/opensc deleted file mode 160000 index 6de3f93..0000000 --- a/npa/src/opensc +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 6de3f93e9b8bb5ec20d57e7d2943fbcdd791df35 diff --git a/npa/src/scutil.c b/npa/src/scutil.c deleted file mode 100644 index b69528a..0000000 --- a/npa/src/scutil.c +++ /dev/null @@ -1,345 +0,0 @@ -/* - * Copyright (C) 2010 Frank Morgner - * - * This file is part of libnpa. - * - * libnpa is free software: you can redistribute it and/or modify it under the - * terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * libnpa is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. - * - * You should have received a copy of the GNU General Public License along with - * libnpa. If not, see . - */ -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "libopensc/internal.h" - -#ifndef HAVE__SC_MATCH_ATR -int sc_dlclose(void *handle) {} -const char *sc_dlerror() {} -void *sc_dlsym(void *handle, const char *symbol) {} -size_t strlcpy(char *dst, const char *src, size_t siz) {} -int sc_mutex_create(const sc_context_t *ctx, void **mutex) {} -int sc_mutex_destroy(const sc_context_t *ctx, void *mutex) {} -int _sc_parse_atr(sc_reader_t *reader) {} -void *sc_dlopen(const char *filename) {} -int sc_mutex_lock(const sc_context_t *ctx, void *mutex) {} -int sc_mutex_unlock(const sc_context_t *ctx, void *mutex) {} -#include "libopensc/card.c" -#endif - -#if !defined(HAVE_SC_APDU_GET_OCTETS) || !defined(HAVE_SC_APDU_SET_RESP) -#ifdef HAVE__SC_MATCH_ATR -size_t sc_get_max_send_size(const sc_card_t *card) {} -#endif -#include "libopensc/apdu.c" -#endif - -#include -#include -#include -#include -#include -#include - -int initialize(int reader_id, int verbose, - sc_context_t **ctx, sc_reader_t **reader) -{ - unsigned int i, reader_count; - - if (!ctx || !reader) - return SC_ERROR_INVALID_ARGUMENTS; - - int r = sc_establish_context(ctx, ""); - if (r < 0 || !*ctx) { - fprintf(stderr, "Failed to create initial context: %s", sc_strerror(r)); - return r; - } - - (*ctx)->debug = verbose; - (*ctx)->flags |= SC_CTX_FLAG_ENABLE_DEFAULT_DRIVER; - - reader_count = sc_ctx_get_reader_count(*ctx); - - if (reader_count == 0) { - sc_debug(*ctx, SC_LOG_DEBUG_NORMAL, "No reader not found.\n"); - return SC_ERROR_NO_READERS_FOUND; - } - - if (reader_id < 0) { - /* Automatically try to skip to a reader with a card if reader not specified */ - for (i = 0; i < reader_count; i++) { - *reader = sc_ctx_get_reader(*ctx, i); - if (sc_detect_card_presence(*reader) & SC_READER_CARD_PRESENT) { - reader_id = i; - sc_debug(*ctx, SC_LOG_DEBUG_NORMAL, "Using the first reader" - " with a card: %s", (*reader)->name); - break; - } - } - if (reader_id >= reader_count) { - sc_debug(*ctx, SC_LOG_DEBUG_NORMAL, "No card found, using the first reader."); - reader_id = 0; - } - } - - if (reader_id >= reader_count) { - sc_debug(*ctx, SC_LOG_DEBUG_NORMAL, "Invalid reader number " - "(%d), only %d available.\n", reader_id, reader_count); - return SC_ERROR_NO_READERS_FOUND; - } - - *reader = sc_ctx_get_reader(*ctx, reader_id); - - return SC_SUCCESS; -} - -void _bin_log(sc_context_t *ctx, int type, const char *file, int line, - const char *func, const char *label, const u8 *data, size_t len, - FILE *f) -{ - if (!f) { - char buf[1800]; - if (data) - sc_hex_dump(ctx, SC_LOG_DEBUG_NORMAL, data, len, buf, sizeof buf); - else - buf[0] = 0; - sc_do_log(ctx, type, file, line, func, - "\n%s (%u byte%s)%s%s", - label, (unsigned int) len, len==1?"":"s", len==0?"":":\n", buf); - } else { - fprintf(f, "%s (%u byte%s)%s%s\n", - label, (unsigned int) len, len==1?"":"s", len==0?"":":\n", sc_dump_hex(data, len)); - } -} - -static int list_readers(sc_context_t *ctx) -{ - char card_atr[0x3e]; - sc_card_t *card; - sc_reader_t *reader; - size_t i, rcount = sc_ctx_get_reader_count(ctx); - - if (rcount == 0) { - printf("No smart card readers found.\n"); - return 0; - } - printf("%-4s %-7s %s\n", "Nr.", "Driver", "Smart Card Reader"); - for (i = 0; i < rcount; i++) { - reader = sc_ctx_get_reader(ctx, i); - memset(card_atr, '\0', sizeof card_atr); - if (sc_detect_card_presence(reader) & SC_READER_CARD_PRESENT) { - if (sc_connect_card(reader, &card) == SC_SUCCESS) { - sc_bin_to_hex(card->atr.value, card->atr.len, - card_atr, sizeof card_atr, ':'); - } - sc_disconnect_card(card); - } else { - strncpy(card_atr, "[no card present]", sizeof card_atr); - } - printf("%-4zu %-7s %s\n", i, reader->driver->short_name, reader->name); - printf(" ATR: %s\n", card_atr); - } - - return 0; -} - -int print_avail(int verbose) -{ - sc_context_t *ctx = NULL; - - int r; - r = sc_establish_context(&ctx, ""); - if (r) { - fprintf(stderr, "Failed to establish context: %s\n", sc_strerror(r)); - return 1; - } - ctx->debug = verbose; - ctx->flags |= SC_CTX_FLAG_ENABLE_DEFAULT_DRIVER; - - r = list_readers(ctx); - - sc_release_context(ctx); - - return r; -} - -#define ISO_READ_BINARY 0xB0 -#define ISO_P1_FLAG_SFID 0x80 -int read_binary_rec(sc_card_t *card, unsigned char sfid, - u8 **ef, size_t *ef_len) -{ - int r; - size_t read = MAX_SM_APDU_RESP_SIZE; - sc_apdu_t apdu; - u8 *p; - - if (!card || !ef || !ef_len) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - *ef_len = 0; - - if (read > 0xff+1) - sc_format_apdu(card, &apdu, SC_APDU_CASE_2_EXT, - ISO_READ_BINARY, ISO_P1_FLAG_SFID|sfid, 0); - else - sc_format_apdu(card, &apdu, SC_APDU_CASE_2_SHORT, - ISO_READ_BINARY, ISO_P1_FLAG_SFID|sfid, 0); - - p = realloc(*ef, read); - if (!p) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - *ef = p; - apdu.resp = *ef; - apdu.resplen = read; - apdu.le = read; - - r = sc_transmit_apdu(card, &apdu); - /* emulate the behaviour of sc_read_binary */ - if (r >= 0) - r = apdu.resplen; - - while(1) { - if (r >= 0 && r != read) { - *ef_len += r; - break; - } - if (r < 0) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not read EF."); - goto err; - } - *ef_len += r; - - p = realloc(*ef, *ef_len + read); - if (!p) { - r = SC_ERROR_OUT_OF_MEMORY; - goto err; - } - *ef = p; - - r = sc_read_binary(card, *ef_len, - *ef + *ef_len, read, 0); - } - - r = SC_SUCCESS; - -err: - return r; -} - -#define ISO_WRITE_BINARY 0xD0 -int write_binary_rec(sc_card_t *card, unsigned char sfid, - u8 *ef, size_t ef_len) -{ - int r; - size_t write = MAX_SM_APDU_DATA_SIZE, wrote = 0; - sc_apdu_t apdu; -#ifdef ENABLE_SM - struct iso_sm_ctx *iso_sm_ctx; -#endif - - if (!card) { - r = SC_ERROR_INVALID_ARGUMENTS; - goto err; - } - -#ifdef ENABLE_SM - iso_sm_ctx = card->sm_ctx.info.cmd_data; - if (write > SC_MAX_APDU_BUFFER_SIZE-2 - || (card->sm_ctx.sm_mode == SM_MODE_TRANSMIT - && write > (((SC_MAX_APDU_BUFFER_SIZE-2 - /* for encrypted APDUs we usually get authenticated status - * bytes (4B), a MAC (11B) and a cryptogram with padding - * indicator (3B without data). The cryptogram is always - * padded to the block size. */ - -18) / iso_sm_ctx->block_length) - * iso_sm_ctx->block_length - 1))) - sc_format_apdu(card, &apdu, SC_APDU_CASE_3_EXT, - ISO_WRITE_BINARY, ISO_P1_FLAG_SFID|sfid, 0); - else -#endif - sc_format_apdu(card, &apdu, SC_APDU_CASE_3_SHORT, - ISO_WRITE_BINARY, ISO_P1_FLAG_SFID|sfid, 0); - - if (write > ef_len) { - apdu.datalen = ef_len; - apdu.lc = ef_len; - } else { - apdu.datalen = write; - apdu.lc = write; - } - apdu.data = ef; - - - r = sc_transmit_apdu(card, &apdu); - /* emulate the behaviour of sc_write_binary */ - if (r >= 0) - r = apdu.datalen; - - while (1) { - if (r < 0 || r > ef_len) { - sc_debug(card->ctx, SC_LOG_DEBUG_VERBOSE, "Could not write EF."); - goto err; - } - wrote += r; - apdu.data += r; - if (wrote >= ef_len) - break; - - r = sc_write_binary(card, wrote, ef, write, 0); - } - - r = SC_SUCCESS; - -err: - return r; -} - -int fread_to_eof(const char *file, unsigned char **buf, size_t *buflen) -{ - FILE *input = NULL; - int r = 0; - unsigned char *p; - - if (!buflen || !buf || !file) - goto err; - -#define MAX_READ_LEN 0xfff - p = realloc(*buf, MAX_READ_LEN); - if (!p) - goto err; - *buf = p; - - input = fopen(file, "rb"); - if (!input) { - fprintf(stderr, "Could not open %s.\n", file); - goto err; - } - - *buflen = 0; - while (feof(input) == 0 && *buflen < MAX_READ_LEN) { - *buflen += fread(*buf+*buflen, 1, MAX_READ_LEN-*buflen, input); - if (ferror(input)) { - fprintf(stderr, "Could not read %s.\n", file); - goto err; - } - } - - r = 1; -err: - if (input) - fclose(input); - - return r; -} diff --git a/npa/src/sslutil.h b/npa/src/sslutil.h deleted file mode 100644 index 46a01a4..0000000 --- a/npa/src/sslutil.h +++ /dev/null @@ -1,35 +0,0 @@ -/* - * Copyright (C) 2011 Frank Morgner - * - * This file is part of libnpa. - * - * libnpa is free software: you can redistribute it and/or modify it under the - * terms of the GNU General Public License as published by the Free Software - * Foundation, either version 3 of the License, or (at your option) any later - * version. - * - * libnpa is distributed in the hope that it will be useful, but WITHOUT ANY - * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS - * FOR A PARTICULAR PURPOSE. See the GNU General Public License for more - * details. - * - * You should have received a copy of the GNU General Public License along with - * libnpa. If not, see . - */ -#ifndef _CCID_SSLUTIL_H -#define _CCID_SSLUTIL_H - -#include -#include -#include - -#define ssl_error(ctx) { \ - unsigned long _r; \ - ERR_load_crypto_strings(); \ - for (_r = ERR_get_error(); _r; _r = ERR_get_error()) { \ - sc_debug(ctx, SC_LOG_DEBUG_VERBOSE, ERR_error_string(_r, NULL)); \ - } \ - ERR_free_strings(); \ -} - -#endif diff --git a/npa/test_vicc_with_npa-tool.sh b/npa/test_vicc_with_npa-tool.sh deleted file mode 100755 index 6573045..0000000 --- a/npa/test_vicc_with_npa-tool.sh +++ /dev/null @@ -1,86 +0,0 @@ -#! /bin/sh - -CVCA=cvca.cvcert -DVCA=dvca.cvcert -TERMINAL=at.cvcert -TERM_KEY=at_key.pkcs8 - -ACCESS=ef_cardaccess -SECURITY=ef_cardsecurity -NPA_KEY=npa_key - -if test -z "$DATA" -then - DATA=../virtualsmartcard/npa-example-data -fi - -if test -z "$VICC" -then - if test -r ../virtualsmartcard/src/vpicc/vicc.in -a -n "`which python`" - then - VICC="python ../virtualsmartcard/src/vpicc/vicc.in" - elif test -x ../virtualsmartcard/src/vpicc/vicc - then - VICC=../virtualsmartcard/src/vpicc/vicc - elif test -n "`which vicc`" - then - VICC=vicc - else - echo "vicc not found" - exit 1 - fi -fi - -if test -z "$NPA_TOOL" -then - if test -x ../npa/src/npa-tool - then - NPA_TOOL=../npa/src/npa-tool - elif test -n "`which npa-tool`" - then - NPA_TOOL=npa-tool - else - echo "npa-tool not found" - exit 1 - fi -fi - -for KA in ecdh dh -do - echo "$VICC --type nPA --ef-cardsecurity=$DATA/$KA/$SECURITY \ - --ef-cardaccess=$DATA/$KA/$ACCESS --ca-key=$DATA/$KA/$NPA_KEY \ - --cvca=$DATA/$KA/$CVCA --disable-ta-checks >/dev/null 2>&1 &" - $VICC --type nPA --ef-cardsecurity=$DATA/$KA/$SECURITY \ - --ef-cardaccess=$DATA/$KA/$ACCESS --ca-key=$DATA/$KA/$NPA_KEY \ - --cvca=$DATA/$KA/$CVCA --disable-ta-checks >/dev/null 2>&1 & - VICC_PID=$! - if test $? -ne 0 - then - echo "could not start vicc" - exit 1 - fi - - sleep 1 - - echo "$NPA_TOOL --pin=111111 --private-key=$DATA/$KA/$TERM_KEY \ - --cv-certificate=$DATA/$KA/$DVCA,$DATA/$KA/$TERMINAL \ - --older-than=19991231 --verify-validity=20201020 \ - --read-dg1 --read-dg2 --read-dg3 --read-dg4 --read-dg5 --read-dg6 --read-dg7 --read-dg8 --read-dg9 --read-dg10 --read-dg11 --read-dg12 --read-dg13 --read-dg14 --read-dg15 --read-dg16 --read-dg17 --read-dg18 --read-dg19 --read-dg20 --read-dg21 \ - --write-dg17=0107 --write-dg18=0108 --write-dg19=0109 --write-dg20=0200 --write-dg21=0201 \ - --cvc-dir=$DATA/$KA --disable-ta-checks --disable-ca-checks" - $NPA_TOOL --pin=111111 --private-key=$DATA/$KA/$TERM_KEY \ - --cv-certificate=$DATA/$KA/$DVCA,$DATA/$KA/$TERMINAL \ - --older-than=19991231 --verify-validity=20201020 \ - --read-dg1 --read-dg2 --read-dg3 --read-dg4 --read-dg5 --read-dg6 --read-dg7 --read-dg8 --read-dg9 --read-dg10 --read-dg11 --read-dg12 --read-dg13 --read-dg14 --read-dg15 --read-dg16 --read-dg17 --read-dg18 --read-dg19 --read-dg20 --read-dg21 \ - --write-dg17=0107 --write-dg18=0108 --write-dg19=0109 --write-dg20=0200 --write-dg21=0201 \ - --cvc-dir=$DATA/$KA --disable-ta-checks --disable-ca-checks - NPA_RESULT=$? - - kill $VICC_PID 2>/dev/null - - if test $NPA_RESULT -ne 0 - then - echo "could not perform EAC" - exit 1 - fi -done diff --git a/virtualsmartcard/doc/README.txt.in b/virtualsmartcard/doc/README.txt.in index 4725f5d..8fc339f 100644 --- a/virtualsmartcard/doc/README.txt.in +++ b/virtualsmartcard/doc/README.txt.in @@ -306,7 +306,7 @@ switches: When |vpcd| and |vpicc| are connected you should be able to access the card through the PC/SC API. You can use the :command:`opensc-explorer` or :command:`pcsc_scan` for testing. In @PACKAGE_NAME@'s root directory we also -provide scripts for testing with :ref:`libnpa` and PCSC-Lite's smart card +provide scripts for testing with npa-tool_ and PCSC-Lite's smart card reader driver tester. @@ -338,3 +338,4 @@ Notes and References .. _`DevCon's source code`: https://github.com/Microsoft/Windows-driver-samples/tree/master/setup/devcon .. _`Microsoft's Kernel-Mode Code Signing Walkthrough`: http://msdn.microsoft.com/en-us/library/windows/hardware/dn653569%28v=vs.85%29.aspx .. _`Windows binaries`: https://github.com/frankmorgner/vsmartcard/releases/download/virtualsmartcard-0.7/virtualsmartcard-0.7_win32.zip +.. _npa-tool: https://github.com/frankmorgner/OpenSC diff --git a/virtualsmartcard/test_vicc_with_npa-tool.sh b/virtualsmartcard/test_vicc_with_npa-tool.sh deleted file mode 120000 index 8d11cfa..0000000 --- a/virtualsmartcard/test_vicc_with_npa-tool.sh +++ /dev/null @@ -1 +0,0 @@ -../npa/test_vicc_with_npa-tool.sh \ No newline at end of file diff --git a/virtualsmartcard/test_vicc_with_npa-tool.sh b/virtualsmartcard/test_vicc_with_npa-tool.sh new file mode 100755 index 0000000..6573045 --- /dev/null +++ b/virtualsmartcard/test_vicc_with_npa-tool.sh @@ -0,0 +1,86 @@ +#! /bin/sh + +CVCA=cvca.cvcert +DVCA=dvca.cvcert +TERMINAL=at.cvcert +TERM_KEY=at_key.pkcs8 + +ACCESS=ef_cardaccess +SECURITY=ef_cardsecurity +NPA_KEY=npa_key + +if test -z "$DATA" +then + DATA=../virtualsmartcard/npa-example-data +fi + +if test -z "$VICC" +then + if test -r ../virtualsmartcard/src/vpicc/vicc.in -a -n "`which python`" + then + VICC="python ../virtualsmartcard/src/vpicc/vicc.in" + elif test -x ../virtualsmartcard/src/vpicc/vicc + then + VICC=../virtualsmartcard/src/vpicc/vicc + elif test -n "`which vicc`" + then + VICC=vicc + else + echo "vicc not found" + exit 1 + fi +fi + +if test -z "$NPA_TOOL" +then + if test -x ../npa/src/npa-tool + then + NPA_TOOL=../npa/src/npa-tool + elif test -n "`which npa-tool`" + then + NPA_TOOL=npa-tool + else + echo "npa-tool not found" + exit 1 + fi +fi + +for KA in ecdh dh +do + echo "$VICC --type nPA --ef-cardsecurity=$DATA/$KA/$SECURITY \ + --ef-cardaccess=$DATA/$KA/$ACCESS --ca-key=$DATA/$KA/$NPA_KEY \ + --cvca=$DATA/$KA/$CVCA --disable-ta-checks >/dev/null 2>&1 &" + $VICC --type nPA --ef-cardsecurity=$DATA/$KA/$SECURITY \ + --ef-cardaccess=$DATA/$KA/$ACCESS --ca-key=$DATA/$KA/$NPA_KEY \ + --cvca=$DATA/$KA/$CVCA --disable-ta-checks >/dev/null 2>&1 & + VICC_PID=$! + if test $? -ne 0 + then + echo "could not start vicc" + exit 1 + fi + + sleep 1 + + echo "$NPA_TOOL --pin=111111 --private-key=$DATA/$KA/$TERM_KEY \ + --cv-certificate=$DATA/$KA/$DVCA,$DATA/$KA/$TERMINAL \ + --older-than=19991231 --verify-validity=20201020 \ + --read-dg1 --read-dg2 --read-dg3 --read-dg4 --read-dg5 --read-dg6 --read-dg7 --read-dg8 --read-dg9 --read-dg10 --read-dg11 --read-dg12 --read-dg13 --read-dg14 --read-dg15 --read-dg16 --read-dg17 --read-dg18 --read-dg19 --read-dg20 --read-dg21 \ + --write-dg17=0107 --write-dg18=0108 --write-dg19=0109 --write-dg20=0200 --write-dg21=0201 \ + --cvc-dir=$DATA/$KA --disable-ta-checks --disable-ca-checks" + $NPA_TOOL --pin=111111 --private-key=$DATA/$KA/$TERM_KEY \ + --cv-certificate=$DATA/$KA/$DVCA,$DATA/$KA/$TERMINAL \ + --older-than=19991231 --verify-validity=20201020 \ + --read-dg1 --read-dg2 --read-dg3 --read-dg4 --read-dg5 --read-dg6 --read-dg7 --read-dg8 --read-dg9 --read-dg10 --read-dg11 --read-dg12 --read-dg13 --read-dg14 --read-dg15 --read-dg16 --read-dg17 --read-dg18 --read-dg19 --read-dg20 --read-dg21 \ + --write-dg17=0107 --write-dg18=0108 --write-dg19=0109 --write-dg20=0200 --write-dg21=0201 \ + --cvc-dir=$DATA/$KA --disable-ta-checks --disable-ca-checks + NPA_RESULT=$? + + kill $VICC_PID 2>/dev/null + + if test $NPA_RESULT -ne 0 + then + echo "could not perform EAC" + exit 1 + fi +done