From e2f07e6a3307d9d44fe425cae702ca7a957e2d72 Mon Sep 17 00:00:00 2001 From: frankmorgner Date: Mon, 27 Sep 2010 05:18:32 +0000 Subject: [PATCH] working on support for certificate description git-svn-id: https://vsmartcard.svn.sourceforge.net/svnroot/vsmartcard@280 96b47cad-a561-4643-ad3b-153ac7d7599c --- ccid/src/Makefile.am | 8 ++++---- ccid/src/{cats-tool.c => cats-test.c} | 27 ++++++++++++++------------- ccid/src/pace.c | 15 +++++++++++++-- ccid/src/pace/pace.h | 3 +++ 4 files changed, 34 insertions(+), 19 deletions(-) rename ccid/src/{cats-tool.c => cats-test.c} (96%) diff --git a/ccid/src/Makefile.am b/ccid/src/Makefile.am index 5660601..d3f9498 100644 --- a/ccid/src/Makefile.am +++ b/ccid/src/Makefile.am @@ -8,9 +8,9 @@ ccid_emulator_SOURCES = ccid.c usbstring.c usb.c binutil.c ccid_emulator_LDADD = $(OPENSC_LIBS) $(OPENSSL_LIBS) $(PTHREAD_LIBS) ccid_emulator_CFLAGS = $(OPENSC_CFLAGS) $(OPENSSL_CFLAGS) $(PTHREAD_CFLAGS) -cats_tool_SOURCES = cats-tool.c -cats_tool_LDADD = $(PCSC_LIBS) -cats_tool_CFLAGS = $(PCSC_CFLAGS) +cats_test_SOURCES = cats-test.c +cats_test_LDADD = $(PCSC_LIBS) +cats_test_CFLAGS = $(PCSC_CFLAGS) pace_tool_SOURCES = pace-tool.c binutil.c pace_tool_LDADD = $(OPENSC_LIBS) $(OPENSSL_LIBS) libpace.la @@ -29,7 +29,7 @@ endif if WITH_CATS -bin_PROGRAMS += cats-tool +bin_PROGRAMS += cats-test endif diff --git a/ccid/src/cats-tool.c b/ccid/src/cats-test.c similarity index 96% rename from ccid/src/cats-tool.c rename to ccid/src/cats-test.c index ad8d03c..e252ab1 100644 --- a/ccid/src/cats-tool.c +++ b/ccid/src/cats-test.c @@ -257,7 +257,7 @@ main(int argc, char *argv[]) fprintf(stderr, "Could not reconnect to %s\n", reader); goto err; } - BYTE bufs[] = { + BYTE bufs0[] = { 0xFF, 0x9A, 0x01, 0x01, 0xFF, 0x9A, 0x01, 0x03, 0xFF, 0x9A, 0x01, 0x06, @@ -276,18 +276,18 @@ main(int argc, char *argv[]) 0x00, 0xA4, 0x00, 0x0C, 0x02, 0x3F, 0x00, 0x00, 0x22, 0xC1, 0xA4, 0x0F, 0x80, 0x0A, 0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x04, 0x02, 0x02, 0x83, 0x01, 0x03, }; - LPBYTE buf = bufs; - DWORD lens[] = {4, 4, 4, 4, 7, 14, 7, 20, 7, 7, 5, 5, 5, 5, 5, 7, 20}; + LPBYTE buf0 = bufs0; + DWORD lens0[] = {4, 4, 4, 4, 7, 14, 7, 20, 7, 7, 5, 5, 5, 5, 5, 7, 20}; SCARD_IO_REQUEST pioRecvPci; - for (l = 0; l < sizeof(lens)/sizeof(DWORD); l++) { + for (l = 0; l < sizeof(lens0)/sizeof(DWORD); l++) { recvlen = sizeof(recvbuf); - r = SCardTransmit(hCard, SCARD_PCI_T0, buf, lens[l], &pioRecvPci, + r = SCardTransmit(hCard, SCARD_PCI_T0, buf0, lens0[l], &pioRecvPci, recvbuf, &recvlen); if (r != SCARD_S_SUCCESS) { fprintf(stderr, "Simulation of Buergerclient failed\n"); goto err; } - buf += lens[l]; + buf0 += lens0[l]; } r = SCardReconnect(hCard, SCARD_SHARE_DIRECT, 0, SCARD_LEAVE_CARD, &ctl); if (r != SCARD_S_SUCCESS) { @@ -372,7 +372,7 @@ main(int argc, char *argv[]) fprintf(stderr, "Could not reconnect to %s\n", reader); goto err; } - BYTE ridbufs[] = { + BYTE bufs1[] = { 0x00, 0x22, 0x81, 0xB6, 0x0F, 0x83, 0x0D, 0x5A, 0x5A, 0x43, 0x56, 0x43, 0x41, 0x41, 0x54, 0x41, 0x30, 0x30, 0x30, 0x31, 0x00, 0x2A, 0x00, 0xBE, 0xE4, 0x7F, 0x4E, 0x81, 0x9D, 0x5F, 0x29, 0x01, 0x00, 0x42, 0x0D, 0x5A, 0x5A, 0x43, 0x56, 0x43, 0x41, 0x41, 0x54, 0x41, 0x30, 0x30, 0x30, 0x31, 0x7F, 0x49, 0x4F, 0x06, 0x0A, 0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x02, 0x02, 0x03, 0x86, 0x41, 0x04, 0x52, 0xDD, 0x32, 0xEA, 0xFE, 0x1F, 0xBB, 0xB4, 0x00, 0x0C, 0xD9, 0xCE, 0x75, 0xF6, 0x66, 0x36, 0xCF, 0xCF, 0x1E, 0xDD, 0x44, 0xF7, 0xB1, 0xED, 0xAE, 0x25, 0xB8, 0x41, 0x93, 0xDA, 0x04, 0xA9, 0x1C, 0x77, 0xEE, 0x87, 0xF5, 0xC8, 0xF9, 0x59, 0xED, 0x27, 0x62, 0x00, 0xDE, 0x33, 0xAB, 0x57, 0x4C, 0xE9, 0x80, 0x11, 0x35, 0xFF, 0x44, 0x97, 0xA3, 0x71, 0x62, 0xB7, 0xC8, 0x54, 0x8A, 0x0C, 0x5F, 0x20, 0x0E, 0x5A, 0x5A, 0x44, 0x56, 0x43, 0x41, 0x41, 0x54, 0x41, 0x30, 0x30, 0x30, 0x30, 0x35, 0x7F, 0x4C, 0x12, 0x06, 0x09, 0x04, 0x00, 0x7F, 0x00, 0x07, 0x03, 0x01, 0x02, 0x02, 0x53, 0x05, 0x70, 0x03, 0x01, 0xFF, 0xB7, 0x5F, 0x25, 0x06, 0x01, 0x00, 0x00, 0x06, 0x01, 0x01, 0x5F, 0x24, 0x06, 0x01, 0x00, 0x01, 0x00, 0x03, 0x01, 0x5F, 0x37, 0x40, 0x6F, 0x13, 0xAE, 0x9A, 0x6F, 0x4E, 0xDD, 0xB7, 0x83, 0x9F, 0xF3, 0xF0, 0x4D, 0x71, 0xE0, 0xDC, 0x37, 0x7B, 0xC4, 0xB0, 0x8F, 0xAD, 0x29, 0x5E, 0xED, 0x24, 0x1B, 0x52, 0x43, 0x28, 0xAD, 0x07, 0x30, 0xEB, 0x55, 0x34, 0x97, 0xB4, 0xFB, 0x66, 0xE9, 0xBB, 0x7A, 0xB9, 0x08, 0x15, 0xF0, 0x42, 0x73, 0xF0, 0x9E, 0x75, 0x1D, 0x7F, 0xD4, 0xB8, 0x61, 0x43, 0x9B, 0x4E, 0xE6, 0x53, 0x81, 0xC3, 0x00, 0x22, 0x81, 0xB6, 0x10, 0x83, 0x0E, 0x5A, 0x5A, 0x44, 0x56, 0x43, 0x41, 0x41, 0x54, 0x41, 0x30, 0x30, 0x30, 0x30, 0x35, @@ -401,19 +401,20 @@ main(int argc, char *argv[]) 0x00, 0x22, 0x41, 0xA4, 0x0C, 0x80, 0x0A, 0x04, 0x00, 0x7F, 0x00, 0x07, 0x02, 0x02, 0x03, 0x02, 0x02, 0x00, 0x86, 0x00, 0x00, 0x45, 0x7C, 0x43, 0x80, 0x41, 0x04, 0x23, 0x9E, 0x3D, 0x05, 0xEE, 0xB0, 0x59, 0x11, 0x7D, 0x30, 0xF8, 0x6A, 0xEB, 0x5A, 0xE7, 0xD1, 0x2E, 0x0E, 0xBF, 0x75, 0x88, 0x89, 0xC7, 0x91, 0x15, 0xF2, 0xA1, 0x3D, 0xC1, 0xBB, 0x57, 0x0A, 0x5C, 0xAD, 0x91, 0xA3, 0x84, 0x33, 0x7C, 0x09, 0xD1, 0xB7, 0x4B, 0xED, 0x1C, 0x0F, 0xF1, 0x95, 0xA7, 0xC3, 0xEA, 0x3A, 0x2C, 0xED, 0xF8, 0x6D, 0xDE, 0xF7, 0xB9, 0x5D, 0x1F, 0xD1, 0xB3, 0x5D, 0x00, }; - LPBYTE ridbuf = ridbufs; - DWORD ridlens[] = {20, 233, 21, 328, 88, 5, 69, 7, 7, 5, 5, 5, 5, 5, 5, 5, + LPBYTE buf1 = bufs1; + DWORD lens1[] = {20, 233, 21, 328, 88, 5, 69, 7, 7, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 17, 75}; SCARD_IO_REQUEST ridpioRecvPci; - for (l = 0; l < sizeof(ridlens)/sizeof(DWORD); l++) { + for (l = 0; l < sizeof(lens1)/sizeof(DWORD); l++) { recvlen = sizeof(recvbuf); - r = SCardTransmit(hCard, SCARD_PCI_T0, ridbuf, ridlens[l], &ridpioRecvPci, + r = SCardTransmit(hCard, SCARD_PCI_T0, buf1, lens1[l], &ridpioRecvPci, recvbuf, &recvlen); if (r != SCARD_S_SUCCESS) { - fprintf(stderr, "Simulation of Restricted Identification failed\n"); + fprintf(stderr, + "Simulation of Terminal and Chip Authentication failed\n"); goto err; } - ridbuf += ridlens[l]; + buf1 += lens1[l]; } r = SCardReconnect(hCard, SCARD_SHARE_DIRECT, 0, SCARD_LEAVE_CARD, &ctl); if (r != SCARD_S_SUCCESS) { diff --git a/ccid/src/pace.c b/ccid/src/pace.c index e5e7200..d992a32 100644 --- a/ccid/src/pace.c +++ b/ccid/src/pace.c @@ -964,6 +964,7 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card, *comp_pub = NULL, *comp_pub_opp = NULL; PACE_SEC *sec = NULL; PACE_CTX *pctx = NULL; + CVC_CERTIFICATE_DESCRIPTION *cert_desc = NULL; int r; if (!card) @@ -971,6 +972,18 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card, if (!pace_output || !sctx) return SC_ERROR_INVALID_ARGUMENTS; + /* show description in advance to give the user more time to read it... + * This behaviour differs from TR-03119 v1.1 p. 44. */ + if (pace_input.certificate_description_length && + pace_input.certificate_description) { + + cert_desc = d2i_CVC_CERTIFICATE_DESCRIPTION(NULL, &cert_desc_in, len); + + /* XXX get hash of certificate description */ + } + + /* XXX parse CHAT to check role of terminal */ + if (!pace_output->ef_cardaccess_length || !pace_output->ef_cardaccess) { r = get_ef_card_access(card, &pace_output->ef_cardaccess, &pace_output->ef_cardaccess_length); @@ -1139,8 +1152,6 @@ int EstablishPACEChannel(const struct sm_ctx *oldpacectx, sc_card_t *card, bin_log(card->ctx, "ID PCD", pace_output->id_pcd, pace_output->id_pcd_length); - /* XXX parse CHAT to check role of terminal */ - sctx->authentication_ctx = pace_sm_ctx_create(k_mac, k_enc, pctx); if (!sctx->authentication_ctx) { diff --git a/ccid/src/pace/pace.h b/ccid/src/pace/pace.h index 1aff525..29b48db 100644 --- a/ccid/src/pace/pace.h +++ b/ccid/src/pace/pace.h @@ -83,6 +83,9 @@ struct establish_pace_channel_output { size_t id_pcd_length; unsigned char *id_pcd; + + size_t hash_cert_desc_len; + unsigned char *hash_cert_desc; }; #ifdef BUERGERCLIENT_WORKAROUND