CACKey: Changes On Branch cfa10c1ef86b7958

Changes In Branch piv Through [cfa10c1ef8] Excluding Merge-Ins

This is equivalent to a diff from 003e5de0f0 to cfa10c1ef8

2013-01-15
14:11		Updated debugging messages to be written in a single fprintf() call in an attempt to avoid having them intermingled when written from multiple threads check-in: 402217513a user: rkeene tags: trunk
2013-01-10
05:02		Added Makefile to generate certs for federal CA chain check-in: 69e6931bb8 user: rkeene tags: piv
05:00		Cleaned up debug messages check-in: cfa10c1ef8 user: rkeene tags: piv
04:59		Updated to provide basic (and buggy) PIV functionality check-in: b9b26ebc73 user: rkeene tags: piv
01:00		Began adding PIV support check-in: 1494008def user: rkeene tags: piv
2012-07-30
16:02		Updated email address in CACKey for OSX Build Script check-in: 003e5de0f0 user: kvanals tags: trunk
05:07		Moved copying in of automake/autoconf files to autogen from build check-in: 2086fbe318 user: rkeene tags: trunk

Modified cackey.c from [3db9c71bd5] to [04de0bb64d].

︙
152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172	152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194	+ + + + + + + + + + + + + + + + + + + + + +	#define GSCIS_TAG_SERNO 0x51 #define GSCIS_TAG_ISSUE_DATE 0x52 #define GSCIS_TAG_EXPIRE_DATE 0x53 #define GSCIS_TAG_CARD_TYPE 0x54 #define GSCIS_TAG_SECURITY_CODE 0x57 #define GSCIS_TAG_CARDID_AID 0x58 /* PIV Codes / #define NISTSP800_73_3_INSTR_GET_DATA 0xCB #define NISTSP800_73_3_INSTR_GENAUTH 0x87 / PKI Information - EF 7000 / #define GSCIS_TAG_CERTIFICATE 0x70 #define GSCIS_TAG_CERT_ISSUE_DATE 0x71 #define GSCIS_TAG_CERT_EXPIRE_DATE 0x72 /* Applet IDs */ #define GSCIS_AID_CCC 0xA0, 0x00, 0x00, 0x01, 0x16, 0xDB, 0x00 #define NISTSP800_73_3_PIV_AID 0xA0, 0x00, 0x00, 0x03, 0x08, 0x00, 0x00, 0x10, 0x00, 0x01, 0x00 / PIV IDs / /* Key Identifiers (NIST SP 800-78-3, Table 6-1 / #define NISTSP800_78_3_KEY_PIVAUTH 0x9A #define NISTSP800_78_3_KEY_SIGNATURE 0x9C #define NISTSP800_78_3_KEY_KEYMGT 0x9D #define NISTSP800_78_3_KEY_CARDAUTH 0x9E / Algorithm Identifiers (NIST SP 800-78-3, Table 6-2 / #define NISTSP800_78_3_ALGO_RSA1024 0x06 #define NISTSP800_78_3_ALGO_RSA2048 0x07 / Object Identifiers (NIST SP 800-73-3 Part 1, Table 2) */ #define NISTSP800_73_3_OID_PIVAUTH 0x5F, 0xC1, 0x05 #define NISTSP800_73_3_OID_SIGNATURE 0x5F, 0xC1, 0x0A #define NISTSP800_73_3_OID_KEYMGT 0x5F, 0xC1, 0x0B #define NISTSP800_73_3_OID_CARDAUTH 0x5F, 0xC1, 0x01 / Maximum size of data portion of APDUs / /* Do not set this above 250 */ #define CACKEY_APDU_MTU 250 / ATR If not available */ #ifndef MAX_ATR_SIZE
︙
1355 1356 1357 1358 1359 1360 1361 ~~1362~~ 1363 1364 1365 1366 1367 1368 1369	1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391	- +	* cackey_pcsc_connect() if needed. * * It will connect to the card in the reader attached to the slot * specified. It will reconnect to the card if the connection * goes away. * / static cackey_ret cackey_send_apdu(struct cackey_slot slot, unsigned char class, unsigned char instruction, unsigned char p1, unsigned char p2, unsigned ~~char~~ lc, unsigned char data, unsigned ~~char~~ le, uint16_t respcode, unsigned char respdata, size_t respdata_len) { static cackey_ret cackey_send_apdu(struct cackey_slot slot, unsigned char class, unsigned char instruction, unsigned char p1, unsigned char p2, unsigned int lc, unsigned char data, unsigned int le, uint16_t respcode, unsigned char respdata, size_t *respdata_len) { uint8_t major_rc, minor_rc; size_t bytes_to_copy, tmp_respdata_len; LPCSCARD_IO_REQUEST pioSendPci; DWORD protocol; DWORD xmit_len, recv_len; LONG scard_xmit_ret, scard_reconn_ret; BYTE xmit_buf[1024], recv_buf[1024];
︙
1404 1405 1406 1407 1408 1409 1410 ~~1411~~ 1412 1413 1414 1415 1416 1417 ~~1418~~ 1419 1420 1421 1422 1423 ~~1424~~ 1425 1426 1427 1428 1429 1430 1431	1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467	+ + + + + - + + + + + + + + + - + + - +	/* Transmit / xmit_len = 0; xmit_buf[xmit_len++] = class; xmit_buf[xmit_len++] = instruction; xmit_buf[xmit_len++] = p1; xmit_buf[xmit_len++] = p2; if (data) { if (lc > 256) { xmit_buf[xmit_len++] = 0x80; / XXX UNTESTED / xmit_buf[xmit_len++] = (lc & 0xff00) >> 8; xmit_buf[xmit_len++] = lc & 0xff; } else { ~~xmit_buf[xmit_len++] = lc;~~ xmit_buf[xmit_len++] = lc; } for (idx = 0; idx < lc; idx++) { xmit_buf[xmit_len++] = data[idx]; } } if (le != 0x00) { if (le > 256) { xmit_buf[xmit_len++] = 0x80; / XXX UNTESTED / xmit_buf[xmit_len++] = (le & 0xff00) >> 8; xmit_buf[xmit_len++] = le & 0xff; } else if (le == 256) { xmit_buf[xmit_len++] = 0x00; } else { ~~xmit_buf[xmit_len++] = le;~~ xmit_buf[xmit_len++] = le; } } / Begin Smartcard Transaction */ cackey_begin_transaction(slot); ~~if (class == GSCIS_CLASS_ISO7816 && instruction == GSCIS_INSTR_VERIFY && p1 ~~== 0x00 && p2~~ == 0x00) {~~ if (class == GSCIS_CLASS_ISO7816 && instruction == GSCIS_INSTR_VERIFY && p1 == 0x00) { CACKEY_DEBUG_PRINTF("Sending APDU: <<censored>>"); } else { CACKEY_DEBUG_PRINTBUF("Sending APDU:", xmit_buf, xmit_len); } recv_len = sizeof(recv_buf); scard_xmit_ret = SCardTransmit(slot->pcsc_card, pioSendPci, xmit_buf, xmit_len, NULL, recv_buf, &recv_len);
︙
1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624	1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789	+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +	} CACKEY_DEBUG_PRINTF("APDU Returned an error, returning in failure"); return(CACKEY_PCSC_E_GENERIC); } /* * SYNPOSIS * ssize_t cackey_get_data(struct cackey_slot slot, unsigned char buffer, size_t count, .... * * ARGUMENTS * struct cackey_slot slot Slot to send commands to * * unsigned char buffer [OUT] Buffer * * size_t count * Number of bytes to attempt to read * * size_t initial_offset * Specify the offset to begin the read from * * * RETURN VALUE * This function returns the number of bytes actually read, or -1 on error. * * NOTES * None * / static ssize_t cackey_get_data(struct cackey_slot slot, unsigned char buffer, size_t count, unsigned char oid[3]) { unsigned char buffer_p; size_t init_count; size_t offset = 0, max_offset, max_count, size; unsigned char cmd[] = {0x5C, 0x03, 0x00, 0x00, 0x00}; uint16_t respcode; int send_ret; int idx; CACKEY_DEBUG_PRINTF("Called."); init_count = count; max_offset = count; max_count = CACKEY_APDU_MTU; cmd[2] = oid[0]; cmd[3] = oid[1]; cmd[4] = oid[2]; send_ret = cackey_send_apdu(slot, GSCIS_CLASS_ISO7816, NISTSP800_73_3_INSTR_GET_DATA, 0x3F, 0xFF, sizeof(cmd), cmd, count, &respcode, buffer, &count); if (send_ret == CACKEY_PCSC_E_RETRY) { CACKEY_DEBUG_PRINTF("ADPU Sending failed, retrying read buffer"); return(cackey_get_data(slot, buffer, init_count, oid)); } if (send_ret != CACKEY_PCSC_S_OK) { if (respcode == 0x6A86) { /* XXX TODO PIV / } CACKEY_DEBUG_PRINTF("cackey_send_apdu() failed, returning in failure"); return(-1); } offset += count; #ifdef CACKEY_PARANOID # ifdef _POSIX_SSIZE_MAX if (offset > _POSIX_SSIZE_MAX) { CACKEY_DEBUG_PRINTF("Offset exceeds maximum value, returning in failure. (max = %li, offset = %lu)", (long) _POSIX_SSIZE_MAX, (unsigned long) offset); return(-1); } # endif #endif if (offset < 2) { CACKEY_DEBUG_PRINTF("APDU GET DATA returned %lu bytes, which is too short for a BER-TLV response", (unsigned long) offset); return(-1); } buffer_p = buffer; if (buffer_p != 0x53) { CACKEY_DEBUG_PRINTF("APDU GET DATA did not return a BER-TLV with tag 53. Tag = %02x", (unsigned int) buffer_p); return(-1); } buffer_p++; if ((buffer_p & 0x80) == 0x80) { size = 0; idx = (buffer_p & 0x7f); if (((buffer_p - buffer) + idx) >= offset) { CACKEY_DEBUG_PRINTF("Malformed BER value -- not enough bytes available to read length"); return(-1); } for (; idx > 0; idx--) { buffer_p++; size <<= 8; size \|= buffer_p; } } else { size = buffer_p; } buffer_p++; if (((buffer_p - buffer) + size) != offset) { CACKEY_DEBUG_PRINTF("Entire buffer is not consumed!"); if (((buffer_p - buffer) + size) > offset) { CACKEY_DEBUG_PRINTF("Encoded size is greater than the amount of data read, dropping"); return(-1); } } memmove(buffer, buffer_p, size); CACKEY_DEBUG_PRINTBUF("GET DATA result", buffer, size); CACKEY_DEBUG_PRINTF("Returning in success, read %lu bytes", (unsigned long) size); return(size); } / * SYNPOSIS * ssize_t cackey_read_buffer(struct cackey_slot slot, unsigned char buffer, size_t count, unsigned char t_or_v, size_t initial_offset); * * ARGUMENTS * struct cackey_slot *slot
︙
2130 2131 2132 2133 2134 2135 2136 ~~2137~~ 2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149	2295 2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 2318 2319	- + + + + + +	* NOTES * ... * / static struct cackey_pcsc_identity cackey_read_certs(struct cackey_slot slot, struct cackey_pcsc_identity certs, unsigned long count) { struct cackey_pcsc_identity curr_id; struct cackey_tlv_entity ccc_tlv, ccc_curr, app_tlv, app_curr; ~~unsigned char ccc_aid[] = {GSCIS_AID_CCC};~~ unsigned char ccc_aid[] = {GSCIS_AID_CCC}, piv_aid[] = {NISTSP800_73_3_PIV_AID}; unsigned char *piv_oid, piv_oid_pivauth[] = {NISTSP800_73_3_OID_PIVAUTH}, piv_oid_signature[] = {NISTSP800_73_3_OID_SIGNATURE}, piv_oid_keymgt[] = {NISTSP800_73_3_OID_KEYMGT}; unsigned char curr_aid[7]; unsigned char buffer[8192]; unsigned long outidx = 0; cackey_ret transaction_ret; ssize_t read_ret; int certs_resizable; int send_ret, select_ret; int piv_key, piv = 0; int idx; CACKEY_DEBUG_PRINTF("Called."); if (count == NULL) { CACKEY_DEBUG_PRINTF("count is NULL, returning in failure"); return(NULL);
︙
2196 2197 2198 2199 2200 2201 2202 ~~2203~~ 2204 ~~2205 2206~~ 2207 ~~2208 2209 2210~~ ~~2211 2212~~ 2213 ~~2214 2215 2216 2217~~ ~~2218 2219 2220 2221~~ ~~2222 2223~~ ~~2224 2225 2226 2227~~ ~~2228 2229~~ ~~2230 2231 2232 2233~~ ~~2234 2235 2236 2237~~ ~~2238 2239 2240 2241 2242 2243~~ ~~2244 2245~~ ~~2246 2247 2248 2249 2250 2251 2252~~ 2253 ~~2254 2255~~ 2256 ~~2257 2258 2259 2260 2261~~ 2262 2263 2264 2265 2266 2267 ~~2268 2269 2270~~ 2271 ~~2272 2273~~ 2274 ~~2275~~ 2276 ~~2277 2278~~ 2279 ~~2280 2281 2282 2283 2284 2285 2286 2287 2288~~ 2289 ~~2290~~ 2291 ~~2292 2293 2294 2295~~ 2296 ~~2297~~ 2298 2299 2300 2301 2302 2303 2304	2366 2367 2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385 2386 2387 2388 2389 2390 2391 2392 2393 2394 2395 2396 2397 2398 2399 2400 2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442 2443 2444 2445 2446 2447 2448 2449 2450 2451 2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521	+ + + + + + + + - + - - + + - - - + + + - - - - - - + - - - - + + + - - + - - - - + + - - + - - - - + - - - - + - - - - - - + + - - + - - - - - - - + + + - - + - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - + + + - - + + - + - - + + - - - - - - - - - + + + + + + + + + - + - - - - + + + + - + +	} else { certs_resizable = 0; } /* Select the CCC Applet / send_ret = cackey_select_applet(slot, ccc_aid, sizeof(ccc_aid)); if (send_ret != CACKEY_PCSC_S_OK) { / Try PIV application / send_ret = cackey_select_applet(slot, piv_aid, sizeof(piv_aid)); if (send_ret == CACKEY_PCSC_S_OK) { CACKEY_DEBUG_PRINTF("We have a PIV card -- not using the CCC, pulling pre-selected keys"); piv = 1; } else { ~~CACKEY_DEBUG_PRINTF("Unable to select CCC Applet, returning in failure");~~ CACKEY_DEBUG_PRINTF("Unable to select CCC Applet, returning in failure"); ~~/ Terminate SmartCard Transaction / cackey_end_transaction(slot);~~ / Terminate SmartCard Transaction / cackey_end_transaction(slot); ~~return(NULL); }~~ return(NULL); } } ~~/ Read all the applets from the CCC's TLV /~~ ~~ccc_tlv = cackey_read_tlv(slot);~~ ~~/ Look for CARDURLs that coorespond to PKI applets /~~ ~~for (ccc_curr = ccc_tlv; ccc_curr; ccc_curr = ccc_curr->_next) {~~ ~~CACKEY_DEBUG_PRINTF("Found tag: %s ... ", CACKEY_DEBUG_FUNC_TAG_TO_STR(ccc_curr->tag));~~ if (piv) { ~~~~if (ccc_curr->tag != GSCIS_TAG_CARDURL) {~~ ~~CACKEY_DEBUG_PRINTF(" ... skipping it (we only care about CARDURLs)");~~ c~~ontinu~~e;~~ for (idx = 0; idx < 3; idx++) { switch (idx) { case 0: } piv_oid = piv_oid_pivauth; ~~if ((ccc_curr->value_cardurl->apptype & CACKEY_TLV_APP_PKI) != CACKEY_TLV_APP_PKI) {~~ CACKEY_DEBUG_PRINTF(" ... skipping it (we only care about PKI applets, this applet supports: %s/%02x)", CACKEY_DEBUG_FUNC_APPTYPE_TO_STR(ccc_curr->value_cardurl->apptype), (unsigned int) ccc_curr->value_cardurl->apptype); ~~continu~~e; piv_key = NISTSP800_78_3_KEY_PIVAUTH; break; } case 1: ~~CACKEY_DEBUG_PRINTBUF("RID:", ccc_curr->value_cardurl->rid, sizeof(ccc_curr->value_cardurl->rid));~~ ~~CACKEY_DEBUG_PRINTF("AppID = %s/%04lx", CACKEY_DEBUG_FUNC_OBJID_TO_STR(ccc_curr->value_cardurl->appid), (unsigned long) ccc_curr->value_cardurl->appid);~~ ~~CACKEY_DEBUG_PRINTF("ObjectID = %s/%04lx", CACKEY_DEBUG_FUNC_OBJID_TO_STR(ccc_curr->value_cardurl->objectid), (unsigned long) ccc_curr->value_cardurl->objectid);~~ piv_oid = piv_oid_signature; ~~memcpy(curr_aid, ccc_curr->value_cardurl->rid, sizeof(ccc_curr->value_cardurl->rid));~~ ~~curr_aid[sizeof(curr_aid) - 2] = (ccc_curr->value_cardurl->appid >> 8) & 0xff;~~ ~~curr_aid[sizeof(curr_aid) - 1] = ccc_curr->value_cardurl->appid & 0xff;~~ piv_key = NISTSP800_78_3_KEY_SIGNATURE; ~~/ Select found applet ... /~~ ~~select_ret = cackey_select_applet(slot, curr_aid, sizeof(curr_aid));~~ ~~if (select_ret != CACKEY_PCSC_S_OK) {~~ ~~CACKEY_DEBUG_PRINTF("Failed to select applet, skipping processing of this object");~~ c~~ontinu~~e; break; case 2: } piv_oid = piv_oid_keymgt; ~~/ ... and object (file) /~~ ~~select_ret = cackey_select_file(slot, ccc_curr->value_cardurl->objectid);~~ ~~if (select_ret != CACKEY_PCSC_S_OK) {~~ ~~CACKEY_DEBUG_PRINTF("Failed to select file, skipping processing of this object");~~ ~~continu~~e; } piv_key = NISTSP800_78_3_KEY_KEYMGT; break; } ~~~~/ Process this file's TLV looking for certificates /~~ a~~pp_tlv~~ = cackey_rea~~d_tlv~~(slot);~~ read_ret = cackey_get_data(slot, buffer, sizeof(buffer), piv_oid); ~~for (app_curr = app_tlv; app_curr; app_curr = app_curr->_next) {~~ ~~CACKEY_DEBUG_PRINTF("Found tag: %s", CACKEY_DEBUG_FUNC_TAG_TO_STR(app_curr->tag));~~ ~~if (app_curr->tag != GSCIS_TAG_CERTIFICATE) {~~ ~~CACKEY_DEBUG_PRINTF(" ... skipping it (we only care about CERTIFICATEs)");~~ if (read_ret <= 0) { continue; } curr_id = &certs[outidx]; outidx++; curr_id->keysize = -1; curr_id->file = 0xFFFF; curr_id->applet[0] = piv_key; curr_id->certificate_len = read_ret; curr_id->certificate = malloc(curr_id->certificate_len); memcpy(curr_id->certificate, buffer + 4, curr_id->certificate_len - 4); / XXX TODO PIV (-4 header, -5 trailer == why ?) / curr_id->certificate_len -= 4; curr_id->certificate_len -= 5; } } else { / Read all the applets from the CCC's TLV / ccc_tlv = cackey_read_tlv(slot); / Look for CARDURLs that coorespond to PKI applets / for (ccc_curr = ccc_tlv; ccc_curr; ccc_curr = ccc_curr->_next) { CACKEY_DEBUG_PRINTF("Found tag: %s ... ", CACKEY_DEBUG_FUNC_TAG_TO_STR(ccc_curr->tag)); if (ccc_curr->tag != GSCIS_TAG_CARDURL) { CACKEY_DEBUG_PRINTF(" ... skipping it (we only care about CARDURLs)"); continue; } if ((ccc_curr->value_cardurl->apptype & CACKEY_TLV_APP_PKI) != CACKEY_TLV_APP_PKI) { CACKEY_DEBUG_PRINTF(" ... skipping it (we only care about PKI applets, this applet supports: %s/%02x)", CACKEY_DEBUG_FUNC_APPTYPE_TO_STR(ccc_curr->value_cardurl->apptype), (unsigned int) ccc_curr->value_cardurl->apptype); continue; } CACKEY_DEBUG_PRINTBUF("RID:", ccc_curr->value_cardurl->rid, sizeof(ccc_curr->value_cardurl->rid)); CACKEY_DEBUG_PRINTF("AppID = %s/%04lx", CACKEY_DEBUG_FUNC_OBJID_TO_STR(ccc_curr->value_cardurl->appid), (unsigned long) ccc_curr->value_cardurl->appid); CACKEY_DEBUG_PRINTF("ObjectID = %s/%04lx", CACKEY_DEBUG_FUNC_OBJID_TO_STR(ccc_curr->value_cardurl->objectid), (unsigned long) ccc_curr->value_cardurl->objectid); memcpy(curr_aid, ccc_curr->value_cardurl->rid, sizeof(ccc_curr->value_cardurl->rid)); curr_aid[sizeof(curr_aid) - 2] = (ccc_curr->value_cardurl->appid >> 8) & 0xff; curr_aid[sizeof(curr_aid) - 1] = ccc_curr->value_cardurl->appid & 0xff; / Select found applet ... / select_ret = cackey_select_applet(slot, curr_aid, sizeof(curr_aid)); if (select_ret != CACKEY_PCSC_S_OK) { CACKEY_DEBUG_PRINTF("Failed to select applet, skipping processing of this object"); continue; } / ... and object (file) / select_ret = cackey_select_file(slot, ccc_curr->value_cardurl->objectid); if (select_ret != CACKEY_PCSC_S_OK) { CACKEY_DEBUG_PRINTF("Failed to select file, skipping processing of this object"); continue; } / Process this file's TLV looking for certificates / app_tlv = cackey_read_tlv(slot); for (app_curr = app_tlv; app_curr; app_curr = app_curr->_next) { CACKEY_DEBUG_PRINTF("Found tag: %s", CACKEY_DEBUG_FUNC_TAG_TO_STR(app_curr->tag)); if (app_curr->tag != GSCIS_TAG_CERTIFICATE) { CACKEY_DEBUG_PRINTF(" ... skipping it (we only care about CERTIFICATEs)"); continue; } curr_id = &certs[outidx]; outidx++; ~~memcpy(curr_id->applet, curr_aid, sizeof(curr_id->applet)); curr_id->file = ccc_curr->value_cardurl->objectid; curr_id->keysize = -1;~~ memcpy(curr_id->applet, curr_aid, sizeof(curr_id->applet)); curr_id->file = ccc_curr->value_cardurl->objectid; curr_id->keysize = -1; CACKEY_DEBUG_PRINTF("Filling curr_id->applet (%p) with %lu bytes:", curr_id->applet, (unsigned long) sizeof(curr_id->applet)); CACKEY_DEBUG_PRINTBUF("VAL:", curr_id->applet, sizeof(curr_id->applet)); CACKEY_DEBUG_PRINTF("Filling curr_id->applet (%p) with %lu bytes:", curr_id->applet, (unsigned long) sizeof(curr_id->applet)); CACKEY_DEBUG_PRINTBUF("VAL:", curr_id->applet, sizeof(curr_id->applet)); ~~curr_id->certificate_len = app_curr->length;~~ curr_id->certificate_len = app_curr->length; ~~curr_id->certificate = malloc(curr_id->certificate_len); memcpy(curr_id->certificate, app_curr->value, curr_id->certificate_len);~~ curr_id->certificate = malloc(curr_id->certificate_len); memcpy(curr_id->certificate, app_curr->value, curr_id->certificate_len); ~~if (outidx >= count) { if (certs_resizable) { count = 2; certs = realloc(certs, sizeof(certs) (count)); } else { break; } } }~~ if (outidx >= count) { if (certs_resizable) { count = 2; certs = realloc(certs, sizeof(certs) (count)); } else { break; } } } ~~cackey_free_tlv(app_tlv);~~ cackey_free_tlv(app_tlv); ~~if (outidx >= count) { break; } }~~ if (outidx >= count) { break; } } ~~cackey_free_tlv(ccc_tlv);~~ cackey_free_tlv(ccc_tlv); } count = outidx; if (certs_resizable) { certs = realloc(certs, sizeof(certs) (*count)); }
︙
2322 2323 2324 2325 2326 2327 2328 2329 ~~2330~~ 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344	2539 2540 2541 2542 2543 2544 2545 2546 2547 2548 2549 2550 2551 2552 2553 2554 2555 2556 2557 2558 2559 2560 2561 2562 2563	+ - + +	* ... * * NOTES * ... * / static ssize_t cackey_signdecrypt(struct cackey_slot slot, struct cackey_identity identity, unsigned char buf, size_t buflen, unsigned char outbuf, size_t outbuflen, int padInput, int unpadOutput) { unsigned char dyn_auth_template[10]; unsigned char tmpbuf, tmpbuf_s, outbuf_s; ~~unsigned char bytes_to_send, p1;~~ unsigned char bytes_to_send, p1, class; unsigned char blocktype; cackey_ret send_ret; uint16_t respcode; ssize_t retval = 0, unpadoffset; size_t tmpbuflen, padlen, tmpoutbuflen; int free_tmpbuf = 0; int le; int piv; CACKEY_DEBUG_PRINTF("Called."); if (slot == NULL) { CACKEY_DEBUG_PRINTF("Error. slot is NULL"); return(-1);
︙
2417 2418 2419 2420 2421 2422 2423 2424 2425 ~~2426 2427~~ 2428 ~~2429 2430~~ 2431 2432 2433 2434 2435 2436 ~~2437 2438~~ 2439 2440 ~~2441 2442~~ 2443 2444 2445 2446 ~~2447~~ 2448 2449 2450 2451 2452 2453 2454	2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709	+ + + + + + + + - - + + - - + + + + + + + + + + + + + + + + + + + + - - + + + + + + + - - + + + + + + - + +	tmpbuflen = buflen; free_tmpbuf = 0; padlen = 0; } /* Begin transaction / cackey_begin_transaction(slot); / Determine type of transaction / if (identity->pcsc_identity->file == 0xFFFF) { piv = 1; } else { piv = 0; } / Select correct applet / if (!piv) { ~~CACKEY_DEBUG_PRINTF("Selecting applet found at %p ...", identity->pcsc_identity->applet); cackey_select_applet(slot, identity->pcsc_identity->applet, sizeof(identity->pcsc_identity->applet));~~ CACKEY_DEBUG_PRINTF("Selecting applet found at %p ...", identity->pcsc_identity->applet); cackey_select_applet(slot, identity->pcsc_identity->applet, sizeof(identity->pcsc_identity->applet)); ~~/ Select correct file / cackey_select_file(slot, identity->pcsc_identity->file);~~ / Select correct file */ cackey_select_file(slot, identity->pcsc_identity->file); } else { dyn_auth_template[0] = 0x7C; dyn_auth_template[1] = 0x82; dyn_auth_template[2] = ((tmpbuflen + 6) & 0xff00) >> 8; dyn_auth_template[3] = (tmpbuflen + 6) & 0x00ff; dyn_auth_template[4] = 0x82; dyn_auth_template[5] = 0x00; dyn_auth_template[6] = 0x81; dyn_auth_template[7] = 0x82; dyn_auth_template[8] = (tmpbuflen & 0xff00) >> 8; dyn_auth_template[9] = tmpbuflen & 0x00ff; send_ret = cackey_send_apdu(slot, 0x10, NISTSP800_73_3_INSTR_GENAUTH, NISTSP800_78_3_ALGO_RSA2048, identity->pcsc_identity->applet[0], sizeof(dyn_auth_template), dyn_auth_template, 0x00, NULL, NULL, NULL); } tmpbuf_s = tmpbuf; outbuf_s = outbuf; while (tmpbuflen) { if (tmpbuflen > 245) { bytes_to_send = 245; if (piv) { class = 0x10; le = 0x00; } else { ~~p1 = 0x80; le = 0x00;~~ p1 = 0x80; le = 0x00; } } else { bytes_to_send = tmpbuflen; if (piv) { class = GSCIS_CLASS_ISO7816; le = 256; } else { ~~p1 = 0x00; le = 0x00;~~ p1 = 0x00; le = 0x00; } } tmpoutbuflen = outbuflen; if (piv) { send_ret = cackey_send_apdu(slot, class, NISTSP800_73_3_INSTR_GENAUTH, NISTSP800_78_3_ALGO_RSA2048, identity->pcsc_identity->applet[0], bytes_to_send, tmpbuf, le, &respcode, outbuf, &tmpoutbuflen); } else { ~~send_ret = cackey_send_apdu(slot, GSCIS_CLASS_GLOBAL_PLATFORM, GSCIS_INSTR_SIGNDECRYPT, p1, 0x00, bytes_to_send, tmpbuf, le, &respcode, outbuf, &tmpoutbuflen);~~ send_ret = cackey_send_apdu(slot, GSCIS_CLASS_GLOBAL_PLATFORM, GSCIS_INSTR_SIGNDECRYPT, p1, 0x00, bytes_to_send, tmpbuf, le, &respcode, outbuf, &tmpoutbuflen); } if (send_ret != CACKEY_PCSC_S_OK) { CACKEY_DEBUG_PRINTF("ADPU Sending Failed -- returning in error."); if (free_tmpbuf) { if (tmpbuf_s) { free(tmpbuf_s); }
︙
2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514	2756 2757 2758 2759 2760 2761 2762 2763 2764 2765 2766 2767 2768 2769 2770 2771 2772 2773 2774 2775 2776 2777 2778 2779 2780 2781 2782 2783	+ + + + + + + + + + + + + +	if (outbuflen > _POSIX_SSIZE_MAX) { CACKEY_DEBUG_PRINTF("Outbuflen exceeds maximum value, returning in failure. (max = %li, outbuflen = %lu)", (long) _POSIX_SSIZE_MAX, (unsigned long) outbuflen); return(-1); } # endif #endif /* We must remove the "7C" tag to get to the signature / if (piv) { if (outbuf[0] != 0x7C) { CACKEY_DEBUG_PRINTF("Response from PIV for GENERATE AUTHENTICATION was not a 0x7C tag, returning in failure"); return(-1); } / XXX TODO PIV / memmove(outbuf, outbuf + 8, retval - 8); retval -= 8; } / Unpad reply */ if (unpadOutput) { if (retval < 3) { CACKEY_DEBUG_PRINTF("Reply is too small, we are not able to unpad -- passing back and hoping for the best!"); CACKEY_DEBUG_PRINTF("Returning in success, retval = %li (bytes)", (long) retval);
︙
2601 2602 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 ~~2622~~ 2623 2624 2625 2626 2627 2628 2629	2870 2871 2872 2873 2874 2875 2876 2877 2878 2879 2880 2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905	+ - + + + + + + +	* / static cackey_ret cackey_login(struct cackey_slot slot, unsigned char pin, unsigned long pin_len, int tries_remaining_p) { unsigned char cac_pin[8] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; uint16_t response_code; int tries_remaining; int send_ret; int key_reference = 0x00; /* Indicate that we do not know about how many tries are remaining / if (tries_remaining_p) { tries_remaining_p = -1; } /* Apparently, CAC PINs are EXACTLY 8 bytes long -- pad with 0xFF if too short / if (pin_len >= 8) { memcpy(cac_pin, pin, 8); } else { memcpy(cac_pin, pin, pin_len); } / Issue PIN Verify */ ~~send_ret = cackey_send_apdu(slot, GSCIS_CLASS_ISO7816, GSCIS_INSTR_VERIFY, 0x00, ~~0x00~~, sizeof(cac_pin), cac_pin, 0x00, &response_code, NULL, NULL);~~ send_ret = cackey_send_apdu(slot, GSCIS_CLASS_ISO7816, GSCIS_INSTR_VERIFY, 0x00, key_reference, sizeof(cac_pin), cac_pin, 0x00, &response_code, NULL, NULL); if (send_ret != CACKEY_PCSC_S_OK && response_code == 0x6A88) { key_reference = 0x80; send_ret = cackey_send_apdu(slot, GSCIS_CLASS_ISO7816, GSCIS_INSTR_VERIFY, 0x00, key_reference, sizeof(cac_pin), cac_pin, 0x00, &response_code, NULL, NULL); } if (send_ret != CACKEY_PCSC_S_OK) { if ((response_code & 0x63C0) == 0x63C0) { tries_remaining = (response_code & 0xF); CACKEY_DEBUG_PRINTF("PIN Verification failed, %i tries remaining", tries_remaining); if (tries_remaining_p) {
︙