CACKey: Diff

Differences From Artifact [3db9c71bd5]:

File cackey.c — part of check-in [a5af46b2b5] at 2012-07-30 05:06:18 on branch trunk — Updated to cache certificate information
Added a C_FindObject() speed test macro
Updated to reset slot less frequently (user: rkeene, size: 186158) [annotate] [blame] [check-ins using]

To Artifact [cdf2a50539]:

File cackey.c — part of check-in [ea4c430c50] at 2013-01-15 04:50:15 on branch piv — Corrected signature unpacking (user: rkeene, size: 195589) [annotate] [blame] [check-ins using]

︙
152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172	152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194	+ + + + + + + + + + + + + + + + + + + + + +	#define GSCIS_TAG_SERNO 0x51 #define GSCIS_TAG_ISSUE_DATE 0x52 #define GSCIS_TAG_EXPIRE_DATE 0x53 #define GSCIS_TAG_CARD_TYPE 0x54 #define GSCIS_TAG_SECURITY_CODE 0x57 #define GSCIS_TAG_CARDID_AID 0x58 /* PIV Codes / #define NISTSP800_73_3_INSTR_GET_DATA 0xCB #define NISTSP800_73_3_INSTR_GENAUTH 0x87 / PKI Information - EF 7000 / #define GSCIS_TAG_CERTIFICATE 0x70 #define GSCIS_TAG_CERT_ISSUE_DATE 0x71 #define GSCIS_TAG_CERT_EXPIRE_DATE 0x72 /* Applet IDs */ #define GSCIS_AID_CCC 0xA0, 0x00, 0x00, 0x01, 0x16, 0xDB, 0x00 #define NISTSP800_73_3_PIV_AID 0xA0, 0x00, 0x00, 0x03, 0x08, 0x00, 0x00, 0x10, 0x00, 0x01, 0x00 / PIV IDs / /* Key Identifiers (NIST SP 800-78-3, Table 6-1 / #define NISTSP800_78_3_KEY_PIVAUTH 0x9A #define NISTSP800_78_3_KEY_SIGNATURE 0x9C #define NISTSP800_78_3_KEY_KEYMGT 0x9D #define NISTSP800_78_3_KEY_CARDAUTH 0x9E / Algorithm Identifiers (NIST SP 800-78-3, Table 6-2 / #define NISTSP800_78_3_ALGO_RSA1024 0x06 #define NISTSP800_78_3_ALGO_RSA2048 0x07 / Object Identifiers (NIST SP 800-73-3 Part 1, Table 2) */ #define NISTSP800_73_3_OID_PIVAUTH 0x5F, 0xC1, 0x05 #define NISTSP800_73_3_OID_SIGNATURE 0x5F, 0xC1, 0x0A #define NISTSP800_73_3_OID_KEYMGT 0x5F, 0xC1, 0x0B #define NISTSP800_73_3_OID_CARDAUTH 0x5F, 0xC1, 0x01 / Maximum size of data portion of APDUs / /* Do not set this above 250 */ #define CACKEY_APDU_MTU 250 / ATR If not available */ #ifndef MAX_ATR_SIZE
︙
660 661 662 663 664 665 666 667 ~~668 669~~ 670 671 672 673 674 675 676 677 678 679 680 681	682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719	+ + + + + + - - + + + + + + + + + + + +	# define CACKEY_DEBUG_FUNC_TAG_TO_STR(x) "DEBUG_DISABLED" # define CACKEY_DEBUG_FUNC_SCARDERR_TO_STR(x) "DEBUG_DISABLED" # define CACKEY_DEBUG_FUNC_OBJID_TO_STR(x) "DEBUG_DISABLED" # define CACKEY_DEBUG_FUNC_APPTYPE_TO_STR(x) "DEBUG_DISABLED" # define CACKEY_DEBUG_FUNC_ATTRIBUTE_TO_STR(x) "DEBUG_DISABLED" #endif typedef enum { CACKEY_ID_TYPE_CAC, CACKEY_ID_TYPE_PIV, CACKEY_ID_TYPE_CERT_ONLY } cackey_pcsc_id_type; struct cackey_pcsc_identity { ~~~~unsigned char applet[7];~~ ui~~nt16~~_t ~~fil~~e;~~ cackey_pcsc_id_type id_type; size_t certificate_len; unsigned char certificate; ssize_t keysize; union { struct { unsigned char applet[7]; uint16_t file; } cac; struct { unsigned char key_id; } piv; } card; }; struct cackey_identity { struct cackey_pcsc_identity pcsc_identity; CK_ATTRIBUTE *attributes; CK_ULONG attributes_count;
︙
1355 1356 1357 1358 1359 1360 1361 ~~1362~~ 1363 1364 1365 1366 1367 1368 1369	1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407	- +	* cackey_pcsc_connect() if needed. * * It will connect to the card in the reader attached to the slot * specified. It will reconnect to the card if the connection * goes away. * / static cackey_ret cackey_send_apdu(struct cackey_slot slot, unsigned char class, unsigned char instruction, unsigned char p1, unsigned char p2, unsigned ~~char~~ lc, unsigned char data, unsigned ~~char~~ le, uint16_t respcode, unsigned char respdata, size_t respdata_len) { static cackey_ret cackey_send_apdu(struct cackey_slot slot, unsigned char class, unsigned char instruction, unsigned char p1, unsigned char p2, unsigned int lc, unsigned char data, unsigned int le, uint16_t respcode, unsigned char respdata, size_t *respdata_len) { uint8_t major_rc, minor_rc; size_t bytes_to_copy, tmp_respdata_len; LPCSCARD_IO_REQUEST pioSendPci; DWORD protocol; DWORD xmit_len, recv_len; LONG scard_xmit_ret, scard_reconn_ret; BYTE xmit_buf[1024], recv_buf[1024];
︙
1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 ~~1411~~ 1412 1413 1414 1415 1416 1417 ~~1418~~ 1419 1420 1421 1422 1423 ~~1424~~ 1425 1426 1427 1428 1429 1430 1431	1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491	+ + + + + + + + + + + - + + + + + + + + + + + - + + - +	return(CACKEY_PCSC_E_GENERIC); } /* Determine which protocol to send using / switch (slot->protocol) { case SCARD_PROTOCOL_T0: CACKEY_DEBUG_PRINTF("Protocol to send datagram is T=0"); pioSendPci = SCARD_PCI_T0; break; case SCARD_PROTOCOL_T1: CACKEY_DEBUG_PRINTF("Protocol to send datagram is T=1"); pioSendPci = SCARD_PCI_T1; break; default: CACKEY_DEBUG_PRINTF("Invalid protocol found, aborting."); return(CACKEY_PCSC_E_GENERIC); } / Transmit / xmit_len = 0; xmit_buf[xmit_len++] = class; xmit_buf[xmit_len++] = instruction; xmit_buf[xmit_len++] = p1; xmit_buf[xmit_len++] = p2; if (data) { if (lc > 255) { CACKEY_DEBUG_PRINTF("CAUTION! Using an Lc greater than 255 is untested. Lc = %u", lc); xmit_buf[xmit_len++] = 0x82; / XXX UNTESTED / xmit_buf[xmit_len++] = (lc & 0xff00) >> 8; xmit_buf[xmit_len++] = lc & 0xff; } else { ~~xmit_buf[xmit_len++] = lc;~~ xmit_buf[xmit_len++] = lc; } for (idx = 0; idx < lc; idx++) { xmit_buf[xmit_len++] = data[idx]; } } if (le != 0x00) { if (le > 256) { CACKEY_DEBUG_PRINTF("CAUTION! Using an Le greater than 256 is untested. Le = %u", le); xmit_buf[xmit_len++] = 0x82; / XXX UNTESTED / xmit_buf[xmit_len++] = (le & 0xff00) >> 8; xmit_buf[xmit_len++] = le & 0xff; } else if (le == 256) { xmit_buf[xmit_len++] = 0x00; } else { ~~xmit_buf[xmit_len++] = le;~~ xmit_buf[xmit_len++] = le; } } / Begin Smartcard Transaction */ cackey_begin_transaction(slot); ~~if (class == GSCIS_CLASS_ISO7816 && instruction == GSCIS_INSTR_VERIFY && p1 ~~== 0x00 && p2~~ == 0x00) {~~ if (class == GSCIS_CLASS_ISO7816 && instruction == GSCIS_INSTR_VERIFY && p1 == 0x00) { CACKEY_DEBUG_PRINTF("Sending APDU: <<censored>>"); } else { CACKEY_DEBUG_PRINTBUF("Sending APDU:", xmit_buf, xmit_len); } recv_len = sizeof(recv_buf); scard_xmit_ret = SCardTransmit(slot->pcsc_card, pioSendPci, xmit_buf, xmit_len, NULL, recv_buf, &recv_len);
︙
1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624	1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811	+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +	} CACKEY_DEBUG_PRINTF("APDU Returned an error, returning in failure"); return(CACKEY_PCSC_E_GENERIC); } /* * SYNPOSIS * ssize_t cackey_get_data(struct cackey_slot slot, unsigned char buffer, size_t count, unsigned char oid[3]); * * ARGUMENTS * struct cackey_slot slot Slot to send commands to * * unsigned char buffer [OUT] Buffer * * size_t count * Number of bytes to attempt to read * * unsigned char oid[3] * 3-byte OID to read * * * RETURN VALUE * This function returns the number of bytes actually read, or -1 on error. * * NOTES * None * / static ssize_t cackey_get_data(struct cackey_slot slot, unsigned char buffer, size_t count, unsigned char oid[3]) { unsigned char buffer_p; size_t init_count; size_t offset = 0, size; unsigned char cmd[] = {0x5C, 0x03, 0x00, 0x00, 0x00}; uint16_t respcode; int send_ret; int idx; CACKEY_DEBUG_PRINTF("Called."); init_count = count; cmd[2] = oid[0]; cmd[3] = oid[1]; cmd[4] = oid[2]; /* 256 to indicate the largest message size -- not clear if this will work with all messages / send_ret = cackey_send_apdu(slot, GSCIS_CLASS_ISO7816, NISTSP800_73_3_INSTR_GET_DATA, 0x3F, 0xFF, sizeof(cmd), cmd, 256, &respcode, buffer, &count); if (send_ret == CACKEY_PCSC_E_RETRY) { CACKEY_DEBUG_PRINTF("ADPU Sending failed, retrying read buffer"); return(cackey_get_data(slot, buffer, init_count, oid)); } if (send_ret != CACKEY_PCSC_S_OK) { if (respcode == 0x6A86) { / XXX TODO PIV / } CACKEY_DEBUG_PRINTF("cackey_send_apdu() failed, returning in failure"); return(-1); } offset += count; #ifdef CACKEY_PARANOID # ifdef _POSIX_SSIZE_MAX if (offset > _POSIX_SSIZE_MAX) { CACKEY_DEBUG_PRINTF("Offset exceeds maximum value, returning in failure. (max = %li, offset = %lu)", (long) _POSIX_SSIZE_MAX, (unsigned long) offset); return(-1); } # endif #endif if (offset < 2) { CACKEY_DEBUG_PRINTF("APDU GET DATA returned %lu bytes, which is too short for a BER-TLV response", (unsigned long) offset); return(-1); } buffer_p = buffer; if (buffer_p != 0x53) { CACKEY_DEBUG_PRINTF("APDU GET DATA did not return a BER-TLV with tag 53. Tag = %02x", (unsigned int) buffer_p); return(-1); } buffer_p++; if ((buffer_p & 0x80) == 0x80) { size = 0; idx = (buffer_p & 0x7f); if (((buffer_p - buffer) + idx) >= offset) { CACKEY_DEBUG_PRINTF("Malformed BER value -- not enough bytes available to read length"); return(-1); } for (; idx > 0; idx--) { buffer_p++; size <<= 8; size \|= buffer_p; } } else { size = buffer_p; } buffer_p++; if (((buffer_p - buffer) + size) != offset) { CACKEY_DEBUG_PRINTF("Entire buffer is not consumed!"); if (((buffer_p - buffer) + size) > offset) { CACKEY_DEBUG_PRINTF("Encoded size is greater than the amount of data read, dropping"); return(-1); } } memmove(buffer, buffer_p, size); CACKEY_DEBUG_PRINTBUF("GET DATA result", buffer, size); CACKEY_DEBUG_PRINTF("Returning in success, read %lu bytes", (unsigned long) size); return(size); } / * SYNPOSIS * ssize_t cackey_read_buffer(struct cackey_slot slot, unsigned char buffer, size_t count, unsigned char t_or_v, size_t initial_offset); * * ARGUMENTS * struct cackey_slot *slot
︙
2101 2102 2103 2104 2105 2106 2107 ~~2108 2109~~ 2110 2111 2112 2113 2114 2115 2116	2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307 2308 2309 2310 2311 2312	- - + + + + + + + + + + +	} if (dest == NULL) { dest = malloc(sizeof(dest) count); } for (idx = 0; idx < count; idx++) { ~~~~mem~~cpy(dest[idx].~~applet, start[~~id~~x].a~~p~~plet, sizeof(dest[idx].applet));~~ dest[idx].file = start[idx].file;~~ switch (dest[idx].id_type) { case CACKEY_ID_TYPE_CAC: memcpy(dest[idx].card.cac.applet, start[idx].card.cac.applet, sizeof(dest[idx].card.cac.applet)); dest[idx].card.cac.file = start[idx].card.cac.file; break; case CACKEY_ID_TYPE_PIV: dest[idx].card.piv.key_id = start[idx].card.piv.key_id; break; case CACKEY_ID_TYPE_CERT_ONLY: break; } dest[idx].certificate_len = start[idx].certificate_len; dest[idx].keysize = start[idx].keysize; dest[idx].certificate = malloc(dest[idx].certificate_len); memcpy(dest[idx].certificate, start[idx].certificate, dest[idx].certificate_len); }
︙
2130 2131 2132 2133 2134 2135 2136 ~~2137~~ 2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149	2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344 2345 2346 2347 2348 2349 2350	- + + + + + +	* NOTES * ... * / static struct cackey_pcsc_identity cackey_read_certs(struct cackey_slot slot, struct cackey_pcsc_identity certs, unsigned long count) { struct cackey_pcsc_identity curr_id; struct cackey_tlv_entity ccc_tlv, ccc_curr, app_tlv, app_curr; ~~unsigned char ccc_aid[] = {GSCIS_AID_CCC};~~ unsigned char ccc_aid[] = {GSCIS_AID_CCC}, piv_aid[] = {NISTSP800_73_3_PIV_AID}; unsigned char *piv_oid, piv_oid_pivauth[] = {NISTSP800_73_3_OID_PIVAUTH}, piv_oid_signature[] = {NISTSP800_73_3_OID_SIGNATURE}, piv_oid_keymgt[] = {NISTSP800_73_3_OID_KEYMGT}; unsigned char curr_aid[7]; unsigned char buffer[8192]; unsigned long outidx = 0; cackey_ret transaction_ret; ssize_t read_ret; int certs_resizable; int send_ret, select_ret; int piv_key, piv = 0; int idx; CACKEY_DEBUG_PRINTF("Called."); if (count == NULL) { CACKEY_DEBUG_PRINTF("count is NULL, returning in failure"); return(NULL);
︙
2196 2197 2198 2199 2200 2201 2202 ~~2203~~ 2204 ~~2205 2206~~ 2207 ~~2208 2209 2210~~ ~~2211 2212~~ 2213 ~~2214 2215 2216 2217~~ ~~2218 2219 2220 2221~~ ~~2222 2223~~ ~~2224 2225 2226 2227~~ ~~2228 2229~~ ~~2230 2231 2232 2233~~ ~~2234 2235 2236 2237~~ ~~2238 2239 2240 2241 2242 2243~~ ~~2244 2245~~ ~~2246 2247 2248 2249 2250 2251 2252~~ 2253 ~~2254 2255~~ 2256 ~~2257 2258 2259 2260 2261~~ 2262 2263 2264 2265 2266 2267 ~~2268 2269 2270~~ 2271 ~~2272 2273~~ 2274 ~~2275~~ 2276 ~~2277 2278~~ 2279 ~~2280 2281 2282 2283 2284 2285 2286 2287 2288~~ 2289 ~~2290~~ 2291 ~~2292 2293 2294 2295~~ 2296 ~~2297~~ 2298 2299 2300 2301 2302 2303 2304	2397 2398 2399 2400 2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442 2443 2444 2445 2446 2447 2448 2449 2450 2451 2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534 2535 2536 2537 2538 2539 2540 2541 2542 2543 2544 2545 2546 2547 2548 2549 2550 2551 2552	+ + + + + + + - + - - + + - - - + + + - - - - - - + - - - - + + + - - + - - - - + + - - + - - - - + - - - - + - - - - - - + + - - + - - - - - - - + + + - - + - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - + + + - - + + - + - - + + - - - - - - - - - + + + + + + + + + - + - - - - + + + + - + +	} else { certs_resizable = 0; } /* Select the CCC Applet / send_ret = cackey_select_applet(slot, ccc_aid, sizeof(ccc_aid)); if (send_ret != CACKEY_PCSC_S_OK) { / Try PIV application / send_ret = cackey_select_applet(slot, piv_aid, sizeof(piv_aid)); if (send_ret == CACKEY_PCSC_S_OK) { CACKEY_DEBUG_PRINTF("We have a PIV card -- not using the CCC, pulling pre-selected keys"); piv = 1; } else { ~~CACKEY_DEBUG_PRINTF("Unable to select CCC Applet, returning in failure");~~ CACKEY_DEBUG_PRINTF("Unable to select CCC Applet, returning in failure"); ~~/ Terminate SmartCard Transaction / cackey_end_transaction(slot);~~ / Terminate SmartCard Transaction / cackey_end_transaction(slot); ~~return(NULL); }~~ return(NULL); } } ~~/ Read all the applets from the CCC's TLV /~~ ~~ccc_tlv = cackey_read_tlv(slot);~~ ~~/ Look for CARDURLs that coorespond to PKI applets /~~ ~~for (ccc_curr = ccc_tlv; ccc_curr; ccc_curr = ccc_curr->_next) {~~ ~~CACKEY_DEBUG_PRINTF("Found tag: %s ... ", CACKEY_DEBUG_FUNC_TAG_TO_STR(ccc_curr->tag));~~ if (piv) { ~~~~if (ccc_curr->tag != GSCIS_TAG_CARDURL) {~~ ~~CACKEY_DEBUG_PRINTF(" ... skipping it (we only care about CARDURLs)");~~ c~~ontinu~~e;~~ for (idx = 0; idx < 3; idx++) { switch (idx) { case 0: } piv_oid = piv_oid_pivauth; ~~if ((ccc_curr->value_cardurl->apptype & CACKEY_TLV_APP_PKI) != CACKEY_TLV_APP_PKI) {~~ CACKEY_DEBUG_PRINTF(" ... skipping it (we only care about PKI applets, this applet supports: %s/%02x)", CACKEY_DEBUG_FUNC_APPTYPE_TO_STR(ccc_curr->value_cardurl->apptype), (unsigned int) ccc_curr->value_cardurl->apptype); ~~continu~~e; piv_key = NISTSP800_78_3_KEY_PIVAUTH; break; } case 1: ~~CACKEY_DEBUG_PRINTBUF("RID:", ccc_curr->value_cardurl->rid, sizeof(ccc_curr->value_cardurl->rid));~~ ~~CACKEY_DEBUG_PRINTF("AppID = %s/%04lx", CACKEY_DEBUG_FUNC_OBJID_TO_STR(ccc_curr->value_cardurl->appid), (unsigned long) ccc_curr->value_cardurl->appid);~~ ~~CACKEY_DEBUG_PRINTF("ObjectID = %s/%04lx", CACKEY_DEBUG_FUNC_OBJID_TO_STR(ccc_curr->value_cardurl->objectid), (unsigned long) ccc_curr->value_cardurl->objectid);~~ piv_oid = piv_oid_signature; ~~memcpy(curr_aid, ccc_curr->value_cardurl->rid, sizeof(ccc_curr->value_cardurl->rid));~~ ~~curr_aid[sizeof(curr_aid) - 2] = (ccc_curr->value_cardurl->appid >> 8) & 0xff;~~ ~~curr_aid[sizeof(curr_aid) - 1] = ccc_curr->value_cardurl->appid & 0xff;~~ piv_key = NISTSP800_78_3_KEY_SIGNATURE; ~~/ Select found applet ... /~~ ~~select_ret = cackey_select_applet(slot, curr_aid, sizeof(curr_aid));~~ ~~if (select_ret != CACKEY_PCSC_S_OK) {~~ ~~CACKEY_DEBUG_PRINTF("Failed to select applet, skipping processing of this object");~~ c~~ontinu~~e; break; case 2: } piv_oid = piv_oid_keymgt; ~~/ ... and object (file) /~~ ~~select_ret = cackey_select_file(slot, ccc_curr->value_cardurl->objectid);~~ ~~if (select_ret != CACKEY_PCSC_S_OK) {~~ ~~CACKEY_DEBUG_PRINTF("Failed to select file, skipping processing of this object");~~ ~~continu~~e; } piv_key = NISTSP800_78_3_KEY_KEYMGT; break; } ~~~~/ Process this file's TLV looking for certificates /~~ a~~pp_tlv~~ = cackey_rea~~d_tlv~~(slot);~~ read_ret = cackey_get_data(slot, buffer, sizeof(buffer), piv_oid); ~~for (app_curr = app_tlv; app_curr; app_curr = app_curr->_next) {~~ ~~CACKEY_DEBUG_PRINTF("Found tag: %s", CACKEY_DEBUG_FUNC_TAG_TO_STR(app_curr->tag));~~ ~~if (app_curr->tag != GSCIS_TAG_CERTIFICATE) {~~ ~~CACKEY_DEBUG_PRINTF(" ... skipping it (we only care about CERTIFICATEs)");~~ if (read_ret <= 0) { continue; } curr_id = &certs[outidx]; outidx++; curr_id->keysize = -1; curr_id->id_type = CACKEY_ID_TYPE_PIV; curr_id->card.piv.key_id = piv_key; curr_id->certificate_len = read_ret; curr_id->certificate = malloc(curr_id->certificate_len); memcpy(curr_id->certificate, buffer + 4, curr_id->certificate_len - 4); / XXX TODO PIV (-4 header, -5 trailer == why ?) / curr_id->certificate_len -= 4; curr_id->certificate_len -= 5; } } else { / Read all the applets from the CCC's TLV / ccc_tlv = cackey_read_tlv(slot); / Look for CARDURLs that coorespond to PKI applets / for (ccc_curr = ccc_tlv; ccc_curr; ccc_curr = ccc_curr->_next) { CACKEY_DEBUG_PRINTF("Found tag: %s ... ", CACKEY_DEBUG_FUNC_TAG_TO_STR(ccc_curr->tag)); if (ccc_curr->tag != GSCIS_TAG_CARDURL) { CACKEY_DEBUG_PRINTF(" ... skipping it (we only care about CARDURLs)"); continue; } if ((ccc_curr->value_cardurl->apptype & CACKEY_TLV_APP_PKI) != CACKEY_TLV_APP_PKI) { CACKEY_DEBUG_PRINTF(" ... skipping it (we only care about PKI applets, this applet supports: %s/%02x)", CACKEY_DEBUG_FUNC_APPTYPE_TO_STR(ccc_curr->value_cardurl->apptype), (unsigned int) ccc_curr->value_cardurl->apptype); continue; } CACKEY_DEBUG_PRINTBUF("RID:", ccc_curr->value_cardurl->rid, sizeof(ccc_curr->value_cardurl->rid)); CACKEY_DEBUG_PRINTF("AppID = %s/%04lx", CACKEY_DEBUG_FUNC_OBJID_TO_STR(ccc_curr->value_cardurl->appid), (unsigned long) ccc_curr->value_cardurl->appid); CACKEY_DEBUG_PRINTF("ObjectID = %s/%04lx", CACKEY_DEBUG_FUNC_OBJID_TO_STR(ccc_curr->value_cardurl->objectid), (unsigned long) ccc_curr->value_cardurl->objectid); memcpy(curr_aid, ccc_curr->value_cardurl->rid, sizeof(ccc_curr->value_cardurl->rid)); curr_aid[sizeof(curr_aid) - 2] = (ccc_curr->value_cardurl->appid >> 8) & 0xff; curr_aid[sizeof(curr_aid) - 1] = ccc_curr->value_cardurl->appid & 0xff; / Select found applet ... / select_ret = cackey_select_applet(slot, curr_aid, sizeof(curr_aid)); if (select_ret != CACKEY_PCSC_S_OK) { CACKEY_DEBUG_PRINTF("Failed to select applet, skipping processing of this object"); continue; } / ... and object (file) / select_ret = cackey_select_file(slot, ccc_curr->value_cardurl->objectid); if (select_ret != CACKEY_PCSC_S_OK) { CACKEY_DEBUG_PRINTF("Failed to select file, skipping processing of this object"); continue; } / Process this file's TLV looking for certificates / app_tlv = cackey_read_tlv(slot); for (app_curr = app_tlv; app_curr; app_curr = app_curr->_next) { CACKEY_DEBUG_PRINTF("Found tag: %s", CACKEY_DEBUG_FUNC_TAG_TO_STR(app_curr->tag)); if (app_curr->tag != GSCIS_TAG_CERTIFICATE) { CACKEY_DEBUG_PRINTF(" ... skipping it (we only care about CERTIFICATEs)"); continue; } curr_id = &certs[outidx]; outidx++; curr_id->id_type = CACKEY_ID_TYPE_CAC; ~~memcpy(curr_id->applet, curr_aid, sizeof(curr_id->applet)); curr_id->file = ccc_curr->value_cardurl->objectid; curr_id->keysize = -1;~~ memcpy(curr_id->card.cac.applet, curr_aid, sizeof(curr_id->card.cac.applet)); curr_id->card.cac.file = ccc_curr->value_cardurl->objectid; curr_id->keysize = -1; CACKEY_DEBUG_PRINTF("Filling curr_id->applet (%p) with %lu bytes:", curr_id->applet, (unsigned long) sizeof(curr_id->applet)); CACKEY_DEBUG_PRINTBUF("VAL:", curr_id->applet, sizeof(curr_id->applet)); CACKEY_DEBUG_PRINTF("Filling curr_id->card.cac.applet (%p) with %lu bytes:", curr_id->card.cac.applet, (unsigned long) sizeof(curr_id->card.cac.applet)); CACKEY_DEBUG_PRINTBUF("VAL:", curr_id->card.cac.applet, sizeof(curr_id->card.cac.applet)); ~~curr_id->certificate_len = app_curr->length;~~ curr_id->certificate_len = app_curr->length; ~~curr_id->certificate = malloc(curr_id->certificate_len); memcpy(curr_id->certificate, app_curr->value, curr_id->certificate_len);~~ curr_id->certificate = malloc(curr_id->certificate_len); memcpy(curr_id->certificate, app_curr->value, curr_id->certificate_len); ~~if (outidx >= count) { if (certs_resizable) { count = 2; certs = realloc(certs, sizeof(certs) (count)); } else { break; } } }~~ if (outidx >= count) { if (certs_resizable) { count = 2; certs = realloc(certs, sizeof(certs) (count)); } else { break; } } } ~~cackey_free_tlv(app_tlv);~~ cackey_free_tlv(app_tlv); ~~if (outidx >= count) { break; } }~~ if (outidx >= count) { break; } } ~~cackey_free_tlv(ccc_tlv);~~ cackey_free_tlv(ccc_tlv); } count = outidx; if (certs_resizable) { certs = realloc(certs, sizeof(certs) (*count)); }
︙
2322 2323 2324 2325 2326 2327 2328 2329 ~~2330~~ 2331 2332 2333 2334 2335 2336 2337	2570 2571 2572 2573 2574 2575 2576 2577 2578 2579 2580 2581 2582 2583 2584 2585 2586 2587	+ + - +	* ... * * NOTES * ... * / static ssize_t cackey_signdecrypt(struct cackey_slot slot, struct cackey_identity identity, unsigned char buf, size_t buflen, unsigned char outbuf, size_t outbuflen, int padInput, int unpadOutput) { cackey_pcsc_id_type id_type; unsigned char dyn_auth_template[10]; unsigned char tmpbuf, tmpbuf_s, outbuf_s; ~~unsigned char bytes_to_send, p1;~~ unsigned char bytes_to_send, p1, class; unsigned char blocktype; cackey_ret send_ret; uint16_t respcode; ssize_t retval = 0, unpadoffset; size_t tmpbuflen, padlen, tmpoutbuflen; int free_tmpbuf = 0; int le;
︙
2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373 2374 2375 2376	2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629 2630 2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641 2642 2643	+ + + + + + + + + + + + + + + + +	} if (identity->pcsc_identity == NULL) { CACKEY_DEBUG_PRINTF("Error. identity->pcsc_identity is NULL"); return(-1); } id_type = identity->pcsc_identity->id_type; if (id_type == CACKEY_ID_TYPE_CERT_ONLY) { CACKEY_DEBUG_PRINTF("Error. identity->pcsc_identity is CACKEY_ID_TYPE_CERT_ONLY, which cannot be used for sign/decrypt"); return(-1); } switch (id_type) { case CACKEY_ID_TYPE_PIV: case CACKEY_ID_TYPE_CAC: break; default: CACKEY_DEBUG_PRINTF("Error. identity->pcsc_identity is not a supported value."); return(-1); } /* Determine identity Key size / if (identity->pcsc_identity->keysize < 0) { identity->pcsc_identity->keysize = x509_to_keysize(identity->pcsc_identity->certificate, identity->pcsc_identity->certificate_len); } / Pad message to key size */
︙
2419 2420 2421 2422 2423 2424 2425 ~~2426 2427~~ 2428 ~~2429 2430~~ 2431 2432 2433 2434 ~~2435 2436 2437 2438 2439~~ ~~2440 2441 2442 2443~~ 2444 ~~2445 2446 2447~~ 2448 2449 2450 2451 2452 2453 2454	2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709 2710 2711 2712 2713 2714 2715 2716 2717 2718 2719 2720 2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755 2756 2757 2758 2759 2760 2761 2762 2763 2764	+ + - - + + - - + + + + + + + + + + + + + + + + + + + + + + - - - - - + + + + + + + + + + + + + - - - - + + + + + + + + + + + + + - - - + + + + + + +	padlen = 0; } /* Begin transaction / cackey_begin_transaction(slot); / Select correct applet / switch (id_type) { case CACKEY_ID_TYPE_CAC: ~~CACKEY_DEBUG_PRINTF("Selecting applet found at %p ...", identity->pcsc_identity->applet); cackey_select_applet(slot, identity->pcsc_identity->applet, sizeof(identity->pcsc_identity->applet));~~ CACKEY_DEBUG_PRINTF("Selecting applet found at %p ...", identity->pcsc_identity->card.cac.applet); cackey_select_applet(slot, identity->pcsc_identity->card.cac.applet, sizeof(identity->pcsc_identity->card.cac.applet)); ~~/ Select correct file / cackey_select_file(slot, identity->pcsc_identity->file);~~ / Select correct file */ cackey_select_file(slot, identity->pcsc_identity->card.cac.file); break; case CACKEY_ID_TYPE_PIV: dyn_auth_template[0] = 0x7C; dyn_auth_template[1] = 0x82; dyn_auth_template[2] = ((tmpbuflen + 6) & 0xff00) >> 8; dyn_auth_template[3] = (tmpbuflen + 6) & 0x00ff; dyn_auth_template[4] = 0x82; dyn_auth_template[5] = 0x00; dyn_auth_template[6] = 0x81; dyn_auth_template[7] = 0x82; dyn_auth_template[8] = (tmpbuflen & 0xff00) >> 8; dyn_auth_template[9] = tmpbuflen & 0x00ff; send_ret = cackey_send_apdu(slot, 0x10, NISTSP800_73_3_INSTR_GENAUTH, NISTSP800_78_3_ALGO_RSA2048, identity->pcsc_identity->card.piv.key_id, sizeof(dyn_auth_template), dyn_auth_template, 0x00, NULL, NULL, NULL); break; case CACKEY_ID_TYPE_CERT_ONLY: break; } tmpbuf_s = tmpbuf; outbuf_s = outbuf; while (tmpbuflen) { tmpoutbuflen = outbuflen; ~~if (tmpbuflen > ~~245~~) { bytes_to_send = ~~245~~; p1 = 0x80; le = 0x00; } else {~~ if (tmpbuflen > CACKEY_APDU_MTU) { bytes_to_send = CACKEY_APDU_MTU; } else { bytes_to_send = tmpbuflen; } send_ret = CACKEY_PCSC_E_GENERIC; switch (id_type) { case CACKEY_ID_TYPE_CAC: if (tmpbuflen > CACKEY_APDU_MTU) { p1 = 0x80; le = 0x00; } else { ~~~~bytes_to_send = tmpbuflen;~~ p1 = 0x00; le = 0x00; }~~ p1 = 0x00; le = 0x00; } send_ret = cackey_send_apdu(slot, GSCIS_CLASS_GLOBAL_PLATFORM, GSCIS_INSTR_SIGNDECRYPT, p1, 0x00, bytes_to_send, tmpbuf, le, &respcode, outbuf, &tmpoutbuflen); break; case CACKEY_ID_TYPE_PIV: if (tmpbuflen > CACKEY_APDU_MTU) { class = 0x10; le = 0x00; } else { class = GSCIS_CLASS_ISO7816; le = 256; } ~~tmpoutbuflen = outbuflen;~~ ~~send_ret = cackey_send_apdu(slot, GSCIS_CLASS_GLOBAL_PLATFORM, GSCIS_INSTR_SIGNDECRYPT, p1, 0x00, bytes_to_send, tmpbuf, le, &respcode, outbuf, &tmpoutbuflen);~~ send_ret = cackey_send_apdu(slot, class, NISTSP800_73_3_INSTR_GENAUTH, NISTSP800_78_3_ALGO_RSA2048, identity->pcsc_identity->card.piv.key_id, bytes_to_send, tmpbuf, le, &respcode, outbuf, &tmpoutbuflen); break; case CACKEY_ID_TYPE_CERT_ONLY: break; } if (send_ret != CACKEY_PCSC_S_OK) { CACKEY_DEBUG_PRINTF("ADPU Sending Failed -- returning in error."); if (free_tmpbuf) { if (tmpbuf_s) { free(tmpbuf_s); }
︙
2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514	2811 2812 2813 2814 2815 2816 2817 2818 2819 2820 2821 2822 2823 2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843	+ + + + + + + + + + + + + + + + + + +	if (outbuflen > _POSIX_SSIZE_MAX) { CACKEY_DEBUG_PRINTF("Outbuflen exceeds maximum value, returning in failure. (max = %li, outbuflen = %lu)", (long) _POSIX_SSIZE_MAX, (unsigned long) outbuflen); return(-1); } # endif #endif /* We must remove the "7C" tag to get to the signature / switch (id_type) { case CACKEY_ID_TYPE_PIV: if (outbuf[0] != 0x7C) { CACKEY_DEBUG_PRINTF("Response from PIV for GENERATE AUTHENTICATION was not a 0x7C tag, returning in failure"); return(-1); } / XXX TODO PIV / memmove(outbuf, outbuf + 8, retval - 8); retval -= 8; break; case CACKEY_ID_TYPE_CAC: case CACKEY_ID_TYPE_CERT_ONLY: break; } / Unpad reply */ if (unpadOutput) { if (retval < 3) { CACKEY_DEBUG_PRINTF("Reply is too small, we are not able to unpad -- passing back and hoping for the best!"); CACKEY_DEBUG_PRINTF("Returning in success, retval = %li (bytes)", (long) retval);
︙
2601 2602 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 ~~2622~~ 2623 2624 2625 2626 2627 2628 2629	2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965	+ - + + + + + + +	* / static cackey_ret cackey_login(struct cackey_slot slot, unsigned char pin, unsigned long pin_len, int tries_remaining_p) { unsigned char cac_pin[8] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; uint16_t response_code; int tries_remaining; int send_ret; int key_reference = 0x00; /* Indicate that we do not know about how many tries are remaining / if (tries_remaining_p) { tries_remaining_p = -1; } /* Apparently, CAC PINs are EXACTLY 8 bytes long -- pad with 0xFF if too short / if (pin_len >= 8) { memcpy(cac_pin, pin, 8); } else { memcpy(cac_pin, pin, pin_len); } / Issue PIN Verify */ ~~send_ret = cackey_send_apdu(slot, GSCIS_CLASS_ISO7816, GSCIS_INSTR_VERIFY, 0x00, ~~0x00~~, sizeof(cac_pin), cac_pin, 0x00, &response_code, NULL, NULL);~~ send_ret = cackey_send_apdu(slot, GSCIS_CLASS_ISO7816, GSCIS_INSTR_VERIFY, 0x00, key_reference, sizeof(cac_pin), cac_pin, 0x00, &response_code, NULL, NULL); if (send_ret != CACKEY_PCSC_S_OK && response_code == 0x6A88) { key_reference = 0x80; send_ret = cackey_send_apdu(slot, GSCIS_CLASS_ISO7816, GSCIS_INSTR_VERIFY, 0x00, key_reference, sizeof(cac_pin), cac_pin, 0x00, &response_code, NULL, NULL); } if (send_ret != CACKEY_PCSC_S_OK) { if ((response_code & 0x63C0) == 0x63C0) { tries_remaining = (response_code & 0xF); CACKEY_DEBUG_PRINTF("PIN Verification failed, %i tries remaining", tries_remaining); if (tries_remaining_p) {
︙
3566 3567 3568 3569 3570 3571 3572 ~~3573~~ 3574 3575 3576 3577 3578 3579 3580	3902 3903 3904 3905 3906 3907 3908 3909 3910 3911 3912 3913 3914 3915 3916	- +	memcpy(identities[id_idx].pcsc_identity->certificate, pcsc_identities[cert_idx].certificate, pcsc_identities[cert_idx].certificate_len); id_idx++; } } if (include_extra_certs) { ~~CACKEY_DEBUG_PRINTF("Including ~~DoD~~ Certificates on hardware slot");~~ CACKEY_DEBUG_PRINTF("Including US Government Certificates on hardware slot"); cackey_read_dod_identities(identities + id_idx, num_dod_certs); } cackey_free_certs(pcsc_identities, num_certs, 1); *ids_found = num_ids;
︙
3639 3640 3641 3642 3643 3644 3645 ~~3646~~ 3647 3648 3649 3650 3651 3652 3653	3975 3976 3977 3978 3979 3980 3981 3982 3983 3984 3985 3986 3987 3988 3989	- +	} else { highest_slot = (sizeof(cackey_slots) / sizeof(cackey_slots[0])) - 1; CACKEY_DEBUG_PRINTF("Including DoD certs in slot %lu", (unsigned long) highest_slot); cackey_slots[highest_slot].active = 1; cackey_slots[highest_slot].internal = 1; ~~cackey_slots[highest_slot].label = (unsigned char ) "~~DoD~~ Certificates";~~ cackey_slots[highest_slot].label = (unsigned char ) "US Government Certificates"; cackey_slots[highest_slot].pcsc_reader = "CACKey"; cackey_slots[highest_slot].token_flags = 0; } cackey_initialized = 1; if (!cackey_biglock_init) {
︙