Differences From Artifact [80414011fe]:
- File
cackey.c
— part of check-in
[06e07b8f0d]
at
2010-05-12 21:52:55
on branch trunk
— Added routines for reading certificates
Updated OpenSession to use PC/SC certificates
Comment and debugging update
Updated to read in larger chunks to improve speed (user: rkeene, size: 121225) [annotate] [blame] [check-ins using]
To Artifact [cd6ed6e22a]:
- File
cackey.c
— part of check-in
[0c536f15c1]
at
2010-05-12 23:58:50
on branch trunk
— Moved certificate examination to occur during search initialization
Added support for logging in via PC/SC in C_Login() (user: rkeene, size: 122757) [annotate] [blame] [check-ins using]
| ︙ | ︙ | |||
504 505 506 507 508 509 510 511 512 513 514 515 516 517 |
CACKEY_TLV_OBJID_CAC_PERSON = 0x0200,
CACKEY_TLV_OBJID_CAC_BENEFITS = 0x0202,
CACKEY_TLV_OBJID_CAC_OTHERBENEFITS = 0x0203,
CACKEY_TLV_OBJID_CAC_PERSONNEL = 0x0201,
CACKEY_TLV_OBJID_CAC_PKICERT = 0x02FE
} cackey_tlv_objectid;
struct cackey_tlv_cardurl {
unsigned char rid[5];
cackey_tlv_apptype apptype;
cackey_tlv_objectid objectid;
cackey_tlv_objectid appid;
unsigned char pinid;
};
| > > > > > > | 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 |
CACKEY_TLV_OBJID_CAC_PERSON = 0x0200,
CACKEY_TLV_OBJID_CAC_BENEFITS = 0x0202,
CACKEY_TLV_OBJID_CAC_OTHERBENEFITS = 0x0203,
CACKEY_TLV_OBJID_CAC_PERSONNEL = 0x0201,
CACKEY_TLV_OBJID_CAC_PKICERT = 0x02FE
} cackey_tlv_objectid;
typedef enum {
CACKEY_LOGIN_OK = 0,
CACKEY_LOGIN_BADPIN = -1,
CACKEY_LOGIN_LOCKED = -2
} cackey_login_ret;
struct cackey_tlv_cardurl {
unsigned char rid[5];
cackey_tlv_apptype apptype;
cackey_tlv_objectid objectid;
cackey_tlv_objectid appid;
unsigned char pinid;
};
|
| ︙ | ︙ | |||
1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 |
if (certs_resizable) {
certs = realloc(certs, sizeof(*certs) * (*count));
}
return(certs);
}
/* Returns 1 if a token is in the specified slot, 0 otherwise */
static int cackey_token_present(struct cackey_slot *slot) {
unsigned char ccc_aid[] = {GSCIS_AID_CCC};
int send_ret;
/* Select the CCC Applet */
| > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > | 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 |
if (certs_resizable) {
certs = realloc(certs, sizeof(*certs) * (*count));
}
return(certs);
}
static int cackey_login(struct cackey_slot *slot, unsigned char *pin, unsigned long pin_len, int *tries_remaining_p) {
uint16_t response_code;
int tries_remaining;
int send_ret;
/* Indicate that we do not know about how many tries are remaining */
if (tries_remaining_p) {
*tries_remaining_p = -1;
}
/* Issue PIN Verify */
send_ret = cackey_send_apdu(slot, GSCIS_CLASS_ISO7816, GSCIS_INSTR_VERIFY, 0x00, 0x00, pin_len, pin, 0x00, &response_code, NULL, NULL);
if (send_ret < 0) {
if ((response_code & 0x63C0) == 0x63C0) {
tries_remaining = (response_code & 0xF);
CACKEY_DEBUG_PRINTF("PIN Verification failed, %i tries remaining", tries_remaining);
if (tries_remaining_p) {
*tries_remaining_p = tries_remaining;
}
}
if (response_code == 0x6983) {
return(CACKEY_LOGIN_LOCKED);
} else {
return(CACKEY_LOGIN_BADPIN);
}
}
return(CACKEY_LOGIN_OK);
}
/* Returns 1 if a token is in the specified slot, 0 otherwise */
static int cackey_token_present(struct cackey_slot *slot) {
unsigned char ccc_aid[] = {GSCIS_AID_CCC};
int send_ret;
/* Select the CCC Applet */
|
| ︙ | ︙ | |||
2112 2113 2114 2115 2116 2117 2118 | pInfo->hardwareVersion.major = (cackey_getversion() >> 16) & 0xff; pInfo->hardwareVersion.minor = (cackey_getversion() >> 8) & 0xff; pInfo->firmwareVersion.major = 0x00; pInfo->firmwareVersion.minor = 0x00; | | | 2151 2152 2153 2154 2155 2156 2157 2158 2159 2160 2161 2162 2163 2164 2165 | pInfo->hardwareVersion.major = (cackey_getversion() >> 16) & 0xff; pInfo->hardwareVersion.minor = (cackey_getversion() >> 8) & 0xff; pInfo->firmwareVersion.major = 0x00; pInfo->firmwareVersion.minor = 0x00; pInfo->flags = CKF_WRITE_PROTECTED | CKF_USER_PIN_INITIALIZED | CKF_TOKEN_INITIALIZED | CKF_LOGIN_REQUIRED; pInfo->ulMaxSessionCount = (sizeof(cackey_sessions) / sizeof(cackey_sessions[0])) - 1; pInfo->ulSessionCount = CK_UNAVAILABLE_INFORMATION; pInfo->ulMaxRwSessionCount = 0; pInfo->ulRwSessionCount = CK_UNAVAILABLE_INFORMATION; pInfo->ulMaxPinLen = 128; pInfo->ulMinPinLen = 0; |
| ︙ | ︙ | |||
2285 2286 2287 2288 2289 2290 2291 |
CACKEY_DEBUG_PRINTF("Returning CKR_FUNCTION_NOT_SUPPORTED (%i)", CKR_FUNCTION_NOT_SUPPORTED);
return(CKR_FUNCTION_NOT_SUPPORTED);
}
CK_DEFINE_FUNCTION(CK_RV, C_OpenSession)(CK_SLOT_ID slotID, CK_FLAGS flags, CK_VOID_PTR pApplication, CK_NOTIFY notify, CK_SESSION_HANDLE_PTR phSession) {
| < < < | | 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 |
CACKEY_DEBUG_PRINTF("Returning CKR_FUNCTION_NOT_SUPPORTED (%i)", CKR_FUNCTION_NOT_SUPPORTED);
return(CKR_FUNCTION_NOT_SUPPORTED);
}
CK_DEFINE_FUNCTION(CK_RV, C_OpenSession)(CK_SLOT_ID slotID, CK_FLAGS flags, CK_VOID_PTR pApplication, CK_NOTIFY notify, CK_SESSION_HANDLE_PTR phSession) {
unsigned long idx;
int mutex_retval;
int found_session = 0;
CACKEY_DEBUG_PRINTF("Called.");
if (slotID < 0 || slotID >= (sizeof(cackey_slots) / sizeof(cackey_slots[0]))) {
CACKEY_DEBUG_PRINTF("Error. Invalid slot requested (%lu), outside of valid range", slotID);
|
| ︙ | ︙ | |||
2347 2348 2349 2350 2351 2352 2353 | cackey_sessions[idx].ulDeviceError = 0; cackey_sessions[idx].pApplication = pApplication; cackey_sessions[idx].Notify = notify; cackey_sessions[idx].identities = NULL; cackey_sessions[idx].identities_count = 0; | < < < < < < < < < < < < < < < < < < < < < < < < < < | 2383 2384 2385 2386 2387 2388 2389 2390 2391 2392 2393 2394 2395 2396 | cackey_sessions[idx].ulDeviceError = 0; cackey_sessions[idx].pApplication = pApplication; cackey_sessions[idx].Notify = notify; cackey_sessions[idx].identities = NULL; cackey_sessions[idx].identities_count = 0; cackey_sessions[idx].search_active = 0; cackey_sessions[idx].sign_active = 0; cackey_sessions[idx].decrypt_active = 0; break; |
| ︙ | ︙ | |||
2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 |
CACKEY_DEBUG_PRINTF("Returning CKR_FUNCTION_NOT_SUPPORTED (%i)", CKR_FUNCTION_NOT_SUPPORTED);
return(CKR_FUNCTION_NOT_SUPPORTED);
}
CK_DEFINE_FUNCTION(CK_RV, C_Login)(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen) {
int mutex_retval;
CACKEY_DEBUG_PRINTF("Called.");
if (!cackey_initialized) {
CACKEY_DEBUG_PRINTF("Error. Not initialized.");
return(CKR_CRYPTOKI_NOT_INITIALIZED);
| > | 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629 2630 |
CACKEY_DEBUG_PRINTF("Returning CKR_FUNCTION_NOT_SUPPORTED (%i)", CKR_FUNCTION_NOT_SUPPORTED);
return(CKR_FUNCTION_NOT_SUPPORTED);
}
CK_DEFINE_FUNCTION(CK_RV, C_Login)(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen) {
int mutex_retval;
int login_ret;
CACKEY_DEBUG_PRINTF("Called.");
if (!cackey_initialized) {
CACKEY_DEBUG_PRINTF("Error. Not initialized.");
return(CKR_CRYPTOKI_NOT_INITIALIZED);
|
| ︙ | ︙ | |||
2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 |
if (!cackey_sessions[hSession].active) {
cackey_mutex_unlock(cackey_biglock);
CACKEY_DEBUG_PRINTF("Error. Session not active.");
return(CKR_SESSION_HANDLE_INVALID);
}
cackey_sessions[hSession].state = CKS_RO_USER_FUNCTIONS;
mutex_retval = cackey_mutex_unlock(cackey_biglock);
if (mutex_retval != 0) {
CACKEY_DEBUG_PRINTF("Error. Unlocking failed.");
| > > > > > > > > > > > > > > > | 2652 2653 2654 2655 2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 |
if (!cackey_sessions[hSession].active) {
cackey_mutex_unlock(cackey_biglock);
CACKEY_DEBUG_PRINTF("Error. Session not active.");
return(CKR_SESSION_HANDLE_INVALID);
}
login_ret = cackey_login(&cackey_slots[cackey_sessions[hSession].slotID], pPin, ulPinLen, NULL);
if (login_ret != CACKEY_LOGIN_OK) {
cackey_mutex_unlock(cackey_biglock);
if (login_ret == CACKEY_LOGIN_LOCKED) {
CACKEY_DEBUG_PRINTF("Error. Token is locked.");
return(CKR_PIN_LOCKED);
} else {
CACKEY_DEBUG_PRINTF("Error. Invalid PIN.");
return(CKR_PIN_INCORRECT);
}
}
cackey_sessions[hSession].state = CKS_RO_USER_FUNCTIONS;
mutex_retval = cackey_mutex_unlock(cackey_biglock);
if (mutex_retval != 0) {
CACKEY_DEBUG_PRINTF("Error. Unlocking failed.");
|
| ︙ | ︙ | |||
2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 |
CACKEY_DEBUG_PRINTF("Returning CKR_FUNCTION_NOT_SUPPORTED (%i)", CKR_FUNCTION_NOT_SUPPORTED);
return(CKR_FUNCTION_NOT_SUPPORTED);
}
CK_DEFINE_FUNCTION(CK_RV, C_FindObjectsInit)(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount) {
int mutex_retval;
CACKEY_DEBUG_PRINTF("Called.");
if (!cackey_initialized) {
CACKEY_DEBUG_PRINTF("Error. Not initialized.");
| > > > > | 2920 2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 |
CACKEY_DEBUG_PRINTF("Returning CKR_FUNCTION_NOT_SUPPORTED (%i)", CKR_FUNCTION_NOT_SUPPORTED);
return(CKR_FUNCTION_NOT_SUPPORTED);
}
CK_DEFINE_FUNCTION(CK_RV, C_FindObjectsInit)(CK_SESSION_HANDLE hSession, CK_ATTRIBUTE_PTR pTemplate, CK_ULONG ulCount) {
struct cackey_pcsc_identity *pcsc_identities;
struct cackey_identity *identities;
unsigned long num_ids, id_idx, curr_id_type;
unsigned long num_certs, cert_idx;
int mutex_retval;
CACKEY_DEBUG_PRINTF("Called.");
if (!cackey_initialized) {
CACKEY_DEBUG_PRINTF("Error. Not initialized.");
|
| ︙ | ︙ | |||
2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942 2943 2944 2945 |
if (cackey_sessions[hSession].search_active) {
cackey_mutex_unlock(cackey_biglock);
CACKEY_DEBUG_PRINTF("Error. Search already active.");
return(CKR_OPERATION_ACTIVE);
}
if (pTemplate != NULL) {
if (ulCount != 0) {
cackey_sessions[hSession].search_query_count = ulCount;
cackey_sessions[hSession].search_query = malloc(ulCount * sizeof(*pTemplate));
memcpy(cackey_sessions[hSession].search_query, pTemplate, ulCount * sizeof(*pTemplate));
| > > > > > > > > > > > > > > > > > > > > > > > > > > > > | 2962 2963 2964 2965 2966 2967 2968 2969 2970 2971 2972 2973 2974 2975 2976 2977 2978 2979 2980 2981 2982 2983 2984 2985 2986 2987 2988 2989 2990 2991 2992 2993 2994 2995 2996 2997 2998 2999 3000 3001 3002 3003 |
if (cackey_sessions[hSession].search_active) {
cackey_mutex_unlock(cackey_biglock);
CACKEY_DEBUG_PRINTF("Error. Search already active.");
return(CKR_OPERATION_ACTIVE);
}
if (cackey_sessions[hSession].identities == NULL) {
pcsc_identities = cackey_read_certs(&cackey_slots[cackey_sessions[hSession].slotID], NULL, &num_certs);
if (pcsc_identities != NULL) {
/* Convert number of Certs to number of objects */
num_ids = (CKO_PRIVATE_KEY - CKO_CERTIFICATE + 1) * num_certs;
identities = malloc(num_ids * sizeof(*identities));
id_idx = 0;
for (cert_idx = 0; cert_idx < num_certs; cert_idx++) {
for (curr_id_type = CKO_CERTIFICATE; curr_id_type <= CKO_PRIVATE_KEY; curr_id_type++) {
identities[id_idx].attributes = cackey_get_attributes(curr_id_type, &pcsc_identities[cert_idx], -1, &identities[id_idx].attributes_count);
if (identities[id_idx].attributes == NULL) {
identities[id_idx].attributes_count = 0;
}
id_idx++;
}
}
cackey_sessions[hSession].identities = identities;
cackey_sessions[hSession].identities_count = num_ids;
cackey_free_certs(pcsc_identities, num_certs, 1);
}
}
if (pTemplate != NULL) {
if (ulCount != 0) {
cackey_sessions[hSession].search_query_count = ulCount;
cackey_sessions[hSession].search_query = malloc(ulCount * sizeof(*pTemplate));
memcpy(cackey_sessions[hSession].search_query, pTemplate, ulCount * sizeof(*pTemplate));
|
| ︙ | ︙ |