ourdir="$(dirname "$(which "$0")")"
cd "${outdir}" || exit 1

make -C certs/dod distclean all
make -C certs/federal distclean all







./certs-to-c certs/*/*.crt > ../cackey_builtin_certs.h

ourdir="$(dirname "$(which "$0")")"
cd "${outdir}" || exit 1

make -C certs/dod distclean all
make -C certs/federal distclean all

if [ "$1" = '--commercial' ]; then
	commercial='commercial'
else
	commercial='SKIP'
fi

./certs-to-c certs/{dod,federal,$commercial}/*.crt > ../cackey_builtin_certs.h

	<config>
		<identifier>mil.army.usace.cackeyForMacOsX@@OSXVERSION@@.cackey.pkg</identifier>
		<version>1</version>
		<description></description>
		<post-install type="none"/>
		<requireAuthorization/>
		<installFrom relative="true" mod="true">cackey.dylib</installFrom>
		<installTo mod="true" relocatable="true">/usr/lib/pkcs11</installTo>
		<flags></flags>
		<packageStore type="internal"></packageStore>
		<mod>parent</mod>
		<mod>scripts.postinstall.path</mod>
		<mod>scripts.scriptsDirectoryPath.isRelativeType</mod>
		<mod>scripts.scriptsDirectoryPath.path</mod>
		<mod>installTo.isAbsoluteType</mod>

	<config>
		<identifier>mil.army.usace.cackeyForMacOsX@@OSXVERSION@@.cackey.pkg</identifier>
		<version>1</version>
		<description></description>
		<post-install type="none"/>
		<requireAuthorization/>
		<installFrom relative="true" mod="true">cackey.dylib</installFrom>
		<installTo mod="true" relocatable="true">/usr/local/lib/pkcs11</installTo>
		<flags></flags>
		<packageStore type="internal"></packageStore>
		<mod>parent</mod>
		<mod>scripts.postinstall.path</mod>
		<mod>scripts.scriptsDirectoryPath.isRelativeType</mod>
		<mod>scripts.scriptsDirectoryPath.path</mod>
		<mod>installTo.isAbsoluteType</mod>

	<config>
		<identifier>mil.army.usace.cackeyForMacOsX@@OSXVERSION@@.PKCS11.pkg</identifier>
		<version>1</version>
		<description></description>
		<post-install type="none"/>
		<requireAuthorization/>
		<installFrom relative="true" mod="true">PKCS11.tokend</installFrom>
		<installTo mod="true" relocatable="true">/System/Library/Security/tokend/PKCS11.tokend</installTo>
		<flags></flags>
		<packageStore type="internal"></packageStore>
		<mod>parent</mod>
		<mod>scripts.postinstall.path</mod>
		<mod>scripts.scriptsDirectoryPath.isRelativeType</mod>
		<mod>scripts.scriptsDirectoryPath.path</mod>
		<mod>installTo.isAbsoluteType</mod>

	<config>
		<identifier>mil.army.usace.cackeyForMacOsX@@OSXVERSION@@.PKCS11.pkg</identifier>
		<version>1</version>
		<description></description>
		<post-install type="none"/>
		<requireAuthorization/>
		<installFrom relative="true" mod="true">PKCS11.tokend</installFrom>
		<installTo mod="true" relocatable="true">/Library/Security/tokend/PKCS11.tokend</installTo>
		<flags></flags>
		<packageStore type="internal"></packageStore>
		<mod>parent</mod>
		<mod>scripts.postinstall.path</mod>
		<mod>scripts.scriptsDirectoryPath.isRelativeType</mod>
		<mod>scripts.scriptsDirectoryPath.path</mod>
		<mod>installTo.isAbsoluteType</mod>

{\fonttbl\f0\fnil\fcharset0 LucidaGrande;}
{\colortbl;\red255\green255\blue255;}
\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\ql\qnatural\pardirnatural

\f0\fs26 \cf0 Thank you for choosing to install CACKey.\
\
To use CACKey, install /Library/CACKey/libcackey.dylib or\
/usr/lib/pkcs11/cackey.dylib as a security module into any application that can use a PKCS#11 provider.\
\
A PKCS11 Connector for Tokend (Keychain Access) will be installed in /System/Library/Security/tokend.\
To use, be sure to import the certificate authorities into Keychain Access.\
\
A debug version, /Library/CACKey/libcackey_g.dylib is provided if debug output is necessary.}]]>
			</resource>
		</locale>
	</resources>
	<requirements>

{\fonttbl\f0\fnil\fcharset0 LucidaGrande;}
{\colortbl;\red255\green255\blue255;}
\pard\tx560\tx1120\tx1680\tx2240\tx2800\tx3360\tx3920\tx4480\tx5040\tx5600\tx6160\tx6720\ql\qnatural\pardirnatural

\f0\fs26 \cf0 Thank you for choosing to install CACKey.\
\
To use CACKey, install /Library/CACKey/libcackey.dylib or\
/usr/local/lib/pkcs11/cackey.dylib as a security module into any application that can use a PKCS#11 provider.\
\
A PKCS11 Connector for Tokend (Keychain Access) will be installed in /Library/Security/tokend.\
To use, be sure to import the certificate authorities into Keychain Access.\
\
A debug version, /Library/CACKey/libcackey_g.dylib is provided if debug output is necessary.}]]>
			</resource>
		</locale>
	</resources>
	<requirements>

#!/bin/bash
chmod 755 /usr/lib/pkcs11
chown root:wheel /usr/lib/pkcs11

#!/bin/bash
chmod 755 /usr/local/lib/pkcs11
chown root:wheel /usr/local/lib/pkcs11

#!/bin/bash
chmod -R go+rX /System/Library/Security/tokend/PKCS11.tokend
chown -R root:wheel /System/Library/Security/tokend/PKCS11.tokend

#!/bin/bash
chmod -R go+rX /Library/Security/tokend/PKCS11.tokend
chown -R root:wheel /Library/Security/tokend/PKCS11.tokend

fi

# Usage function
usage() {
	echo "Usage: build_osx.sh <target>"
	echo Where target is one of:
	echo "    leopard  - (Builds Universal 10.5 Library for PPCG4/i386)"
	echo "    sltoyos - (Builds Universal 10.6/10.7/10.8/10.9/10.10 Library for i386/x86_64)"
	echo "    all - (Builds for all supported targets)"
	echo "    clean - (Cleans up)"
	echo "Run from CACKey Build Root."
	echo ""
	echo "NOTE:  Leopard build requires legacy XCode 3 components in"
	echo "       /Developer because of PowerPC support."
	echo "       All builds require gnutar, automake, and autoconf."
................................................................................
		LIBTOOLDIR=/Developer/usr/share/libtool
	else
		LIBTOOLDIR=/Developer/usr/share/libtool/config
	fi
	if [ ! -d macbuild ]; then
		mkdir macbuild
		mkdir macbuild/Leopard
		mkdir macbuild/Sltoyos
		mkdir macbuild/pkg
	fi
	if [ ! -f config.guess ]; then
		cp ${LIBTOOLDIR}/config.guess .
	fi
	if [ ! -f config.sub ]; then
		cp ${LIBTOOLDIR}/config.sub .
................................................................................
		genbuild
	done
	libbuild
	pkgbuild
}

# Build function for Snow Leopard/Lion/Mountain Lion/Mavericks/Yosemite
sltoyos() {
	makedir
	HEADERS=/Developer/SDKs/MacOSX10.6.sdk/System/Library/Frameworks/PCSC.framework/Versions/A/Headers/
	LIBRARY=/Developer/SDKs/MacOSX10.6.sdk/System/Library/Frameworks/PCSC.framework/PCSC
	LIB=""
	ARCHLIST=""
	DLIB=""
	DARCHLIST=""
	OSX=Sltoyos
	PKTARGETOS=3
	CUROSXVER=10.6
	for HOST in i386-apple-darwin10 x86_64-apple-darwin10; do
		genbuild
	done
	libbuild
	pkgbuild
................................................................................
		sed "s|@@TARGETOS@@|${PKTARGETOS}|g" build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC} > build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}.1
		sed "s|@@CUROSXVER@@|${CUROSXVER}|g" build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC} > build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}.1
		sed "s|@@LIBCACKEYG@@|${LIBCACKEYG}|g" build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}.1 > build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}
		cp build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC} build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}.1
		mv build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}.1 build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}
	done
	EXT=pkg
	if [ ${OSX} == "Sltoyos" ]; then
		cat build/cackey_osx_build/${OSX}_pmbuild.pmdoc/index.xml | sed 's|for Mac OS X Sltoyos|for Mac OS X SLtoYos|g' > build/cackey_osx_build/${OSX}_pmbuild.pmdoc/index.xml.new
		mv build/cackey_osx_build/${OSX}_pmbuild.pmdoc/index.xml.new build/cackey_osx_build/${OSX}_pmbuild.pmdoc/index.xml
	fi
	/Developer/Applications/Utilities/PackageMaker.app/Contents/MacOS/PackageMaker -d build/cackey_osx_build/${OSX}_pmbuild.pmdoc -o macbuild/pkg/CACKey_${CACKEY_VERSION}_${OSX}.${EXT}
	tar --create --directory macbuild/pkg/ --file macbuild/pkg/CACKey_${CACKEY_VERSION}_${OSX}.${EXT}.tar CACKey_${CACKEY_VERSION}_${OSX}.${EXT}
	gzip -9 macbuild/pkg/CACKey_${CACKEY_VERSION}_${OSX}.${EXT}.tar
	rm -rf macbuild/pkg/CACKey_${CACKEY_VERSION}_${OSX}.${EXT}
	rm -f build/cackey_osx_build/cackey.dylib
................................................................................

	"leopard")
		./autogen.sh
		leopard
		exit $?
	;;

	"sltoyos")
		./autogen.sh
		sltoyos
		exit $?
	;;

	"all")
		./autogen.sh
		leopard
		sltoyos
		echo ""
		echo "All builds complete."
		exit $?
	;;

	"clean")
		clean

fi

# Usage function
usage() {
	echo "Usage: build_osx.sh <target>"
	echo Where target is one of:
	echo "    leopard  - (Builds Universal 10.5 Library for PPCG4/i386)"
	echo "    slandup - (Builds Universal 10.6 and Up Library for i386/x86_64)"
	echo "    all - (Builds for all supported targets)"
	echo "    clean - (Cleans up)"
	echo "Run from CACKey Build Root."
	echo ""
	echo "NOTE:  Leopard build requires legacy XCode 3 components in"
	echo "       /Developer because of PowerPC support."
	echo "       All builds require gnutar, automake, and autoconf."
................................................................................
		LIBTOOLDIR=/Developer/usr/share/libtool
	else
		LIBTOOLDIR=/Developer/usr/share/libtool/config
	fi
	if [ ! -d macbuild ]; then
		mkdir macbuild
		mkdir macbuild/Leopard
		mkdir macbuild/Slandup
		mkdir macbuild/pkg
	fi
	if [ ! -f config.guess ]; then
		cp ${LIBTOOLDIR}/config.guess .
	fi
	if [ ! -f config.sub ]; then
		cp ${LIBTOOLDIR}/config.sub .
................................................................................
		genbuild
	done
	libbuild
	pkgbuild
}

# Build function for Snow Leopard/Lion/Mountain Lion/Mavericks/Yosemite
slandup() {
	makedir
	HEADERS=/Developer/SDKs/MacOSX10.6.sdk/System/Library/Frameworks/PCSC.framework/Versions/A/Headers/
	LIBRARY=/Developer/SDKs/MacOSX10.6.sdk/System/Library/Frameworks/PCSC.framework/PCSC
	LIB=""
	ARCHLIST=""
	DLIB=""
	DARCHLIST=""
	OSX=Slandup
	PKTARGETOS=3
	CUROSXVER=10.6
	for HOST in i386-apple-darwin10 x86_64-apple-darwin10; do
		genbuild
	done
	libbuild
	pkgbuild
................................................................................
		sed "s|@@TARGETOS@@|${PKTARGETOS}|g" build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC} > build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}.1
		sed "s|@@CUROSXVER@@|${CUROSXVER}|g" build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC} > build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}.1
		sed "s|@@LIBCACKEYG@@|${LIBCACKEYG}|g" build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}.1 > build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}
		cp build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC} build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}.1
		mv build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}.1 build/cackey_osx_build/${OSX}_pmbuild.pmdoc/${PMDOC}
	done
	EXT=pkg
	if [ ${OSX} == "Slandup" ]; then
		cat build/cackey_osx_build/${OSX}_pmbuild.pmdoc/index.xml | sed 's|for Mac OS X Slandup|for Mac OS X SLandUp|g' > build/cackey_osx_build/${OSX}_pmbuild.pmdoc/index.xml.new
		mv build/cackey_osx_build/${OSX}_pmbuild.pmdoc/index.xml.new build/cackey_osx_build/${OSX}_pmbuild.pmdoc/index.xml
	fi
	/Developer/Applications/Utilities/PackageMaker.app/Contents/MacOS/PackageMaker -d build/cackey_osx_build/${OSX}_pmbuild.pmdoc -o macbuild/pkg/CACKey_${CACKEY_VERSION}_${OSX}.${EXT}
	tar --create --directory macbuild/pkg/ --file macbuild/pkg/CACKey_${CACKEY_VERSION}_${OSX}.${EXT}.tar CACKey_${CACKEY_VERSION}_${OSX}.${EXT}
	gzip -9 macbuild/pkg/CACKey_${CACKEY_VERSION}_${OSX}.${EXT}.tar
	rm -rf macbuild/pkg/CACKey_${CACKEY_VERSION}_${OSX}.${EXT}
	rm -f build/cackey_osx_build/cackey.dylib
................................................................................

	"leopard")
		./autogen.sh
		leopard
		exit $?
	;;

	"slandup")
		./autogen.sh
		slandup
		exit $?
	;;

	"all")
		./autogen.sh
		leopard
		slandup
		echo ""
		echo "All builds complete."
		exit $?
	;;

	"clean")
		clean

#! /bin/bash

for file in "$@"; do




	rm -f tmpfile.x509
	if ! openssl x509 -in "${file}" -inform pem -noout -checkend 0 >/dev/null 2>/dev/null; then
		echo "warning: Skipping \"${file}\" as it is invalid or expired." >&2

		continue
	fi

	openssl x509 -in "${file}" -out tmpfile.x509 -inform pem -outform der

	pubkeylen="$(openssl x509 -in tmpfile.x509 -inform der -text -noout | grep 'RSA Public Key:' | sed 's@^.*(\([0-9][0-9]*\) bit).*$@\1@')"
	certlen="$(cat tmpfile.x509 | wc -c)"
	cert="$(( cat tmpfile.x509 | od -t x1 | cut -c 9- | tr "\n" ' '; echo ) | sed 's@ @@g;s@..@\\x&@g')"

	cat << _EOF_

	{
		CACKEY_ID_TYPE_CERT_ONLY, /* id_type */
		${certlen}, /* certificate_len */
		(unsigned char *) "${cert}", /* certificate */
		${pubkeylen} /* keysize */
	},
_EOF_
done

rm -f tmpfile.x509

#! /bin/bash

for file in "$@"; do
	if [ ! -f "${file}" ]; then
		continue
	fi

	rm -f tmpfile.x509
	if ! openssl x509 -in "${file}" -inform pem -noout -checkend 0 >/dev/null 2>/dev/null; then
		echo "warning: Skipping \"${file}\" as it is invalid or expired." >&2

		continue
	fi

	openssl x509 -in "${file}" -out tmpfile.x509 -inform pem -outform der

	pubkeylen="$(openssl x509 -in tmpfile.x509 -inform der -text -noout | grep 'Public[- ]Key:' | sed 's@^.*(\([0-9][0-9]*\) bit).*$@\1@')"
	certlen="$(cat tmpfile.x509 | wc -c | awk '{ print $1 }')"
	cert="$(( cat tmpfile.x509 | od -t x1 | cut -c 9- | tr "\n" ' '; echo ) | sed 's@ @@g;s@..@\\x&@g')"

	cat << _EOF_
	/* ${file} */
	{
		CACKEY_ID_TYPE_CERT_ONLY, /* id_type */
		${certlen}, /* certificate_len */
		(unsigned char *) "${cert}", /* certificate */
		${pubkeylen} /* keysize */
	},
_EOF_
done

rm -f tmpfile.x509

-----BEGIN CERTIFICATE-----
MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQsFADCBrDELMAkGA1UEBhMCVVMx
ETAPBgNVBAgTCFZpcmdpbmlhMQ8wDQYDVQQHEwZSZXN0b24xIDAeBgNVBAoTF0tu
aWdodFBvaW50IFN5c3RlbXMgTExDMRcwFQYDVQQLEw5LbmlnaHRQb2ludCBJVDEY
MBYGA1UECxMPS25pZ2h0UG9pbnQgUEtJMSQwIgYDVQQDExtLbmlnaHRQb2ludCBT
eXN0ZW1zIFJvb3QgQ0EwHhcNMTUwMTAxMDAwMDAwWhcNMTcwMTAxMDAwMDAwWjCB
qTELMAkGA1UEBhMCVVMxETAPBgNVBAgTCFZpcmdpbmlhMQ8wDQYDVQQHEwZSZXN0
b24xIDAeBgNVBAoTF0tuaWdodFBvaW50IFN5c3RlbXMgTExDMRcwFQYDVQQLEw5L
bmlnaHRQb2ludCBJVDEYMBYGA1UECxMPS25pZ2h0UG9pbnQgUEtJMSEwHwYDVQQD
ExhLbmlnaHRQb2ludCBTeXN0ZW1zIENBIDEwggEiMA0GCSqGSIb3DQEBAQUAA4IB


DwAwggEKAoIBAQDFB0hZlCwZFIUn/fHk/Ubeia8/pnpC/yuWs+oicBs9SvhrZNMI
8aYmnUhyaMfE+bxJrZSCYdGffm9VJxWv/suJ+Cr+9gdxWBWpqncw78agCNa5Oo2l
tqjFIE6mTCd9QE6CnNJJUc1ysZaz9WmWuA1i9EQ4ybV+l7baOmvE7MNUf6sPew+W
42QjiWjri9xzpXTl3fhcYxNp/Dx5GXzJIpV+Eg5FlxKn+P75HUJpV2qpHzAzR5gM
Xiee1O1PogqS1ylWQsY60fS9eIiYx08R6JeN6SISr8MOsatWsepHa8lch+NSIVeW
4QhD9NOH3JUDgTGR8aB2StmuQFEO+9daMWMfAgMBAAGjYDBeMBIGA1UdEwEB/wQI
MAYBAf8CAQEwNwYDVR0fAQEABC0wKzApoCegJYYjaHR0cDovL3BraS5rbmlnaHRw
b2ludC5jb20vY3JsL3Jvb3QwDwYDVR0PAQH/BAUDAweGADANBgkqhkiG9w0BAQsF
AAOCAQEAFu5CYJqLuq3Ey/RBsP0tVF9s7HGDprLyhaOWSn558e4it6kLrionX+Qg
5szXlqx8LoQBj/Zq0ObGguns7C6EfwqyNXl2G+DdFNqOn491fFijvWmwl2Wotkgw
CieuVGaN8JCOmLtzPM1HOr2GSAWGz59uDB+axJVIvqSJLT5UAz5OzA5ECnND5qnQ
lk1FZvST8b8HZaetAFf4jZBY/2WQVyam45yNNIM5jAtr6CtUEDiWq+ReAFDHEN3p
J/QfPiavPnBjBAC1xJu6HtKXNGiEMWirc6MyT3QPlCj632PcC+/MpqDSFYV+qYRK
5te0SbUIziVyglsN5+oGeEDPyiyheQ==


-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIEfTCCA2WgAwIBAgICJxAwDQYJKoZIhvcNAQELBQAwgawxCzAJBgNVBAYTAlVT
MREwDwYDVQQIEwhWaXJnaW5pYTEPMA0GA1UEBxMGUmVzdG9uMSAwHgYDVQQKExdL
bmlnaHRQb2ludCBTeXN0ZW1zIExMQzEXMBUGA1UECxMOS25pZ2h0UG9pbnQgSVQx
GDAWBgNVBAsTD0tuaWdodFBvaW50IFBLSTEkMCIGA1UEAxMbS25pZ2h0UG9pbnQg
U3lzdGVtcyBSb290IENBMB4XDTE1MDEwMTAwMDAwMFoXDTIwMDEwMTAwMDAwMFow
gakxCzAJBgNVBAYTAlVTMREwDwYDVQQIEwhWaXJnaW5pYTEPMA0GA1UEBxMGUmVz


dG9uMSAwHgYDVQQKExdLbmlnaHRQb2ludCBTeXN0ZW1zIExMQzEXMBUGA1UECxMO
S25pZ2h0UG9pbnQgSVQxGDAWBgNVBAsTD0tuaWdodFBvaW50IFBLSTEhMB8GA1UE
AxMYS25pZ2h0UG9pbnQgU3lzdGVtcyBDQSAxMIIBIjANBgkqhkiG9w0BAQEFAAOC
AQ8AMIIBCgKCAQEAxQdIWZQsGRSFJ/3x5P1G3omvP6Z6Qv8rlrPqInAbPUr4a2TT
CPGmJp1IcmjHxPm8Sa2UgmHRn35vVScVr/7Lifgq/vYHcVgVqap3MO/GoAjWuTqN
pbaoxSBOpkwnfUBOgpzSSVHNcrGWs/VplrgNYvREOMm1fpe22jprxOzDVH+rD3sP
luNkI4lo64vcc6V05d34XGMTafw8eRl8ySKVfhIORZcSp/j++R1CaVdqqR8wM0eY
DF4nntTtT6IKktcpVkLGOtH0vXiImMdPEeiXjekiEq/DDrGrVrHqR2vJXIfjUiFX
luEIQ/TTh9yVA4ExkfGgdkrZrkBRDvvXWjFjHwIDAQABo4GpMIGmMCAGA1UdDgEB
AAQWBBQ4LgWOLupZrGEOIQCvWkCBLwOTcDASBgNVHRMBAf8ECDAGAQH/AgEBMDcG
A1UdHwEBAAQtMCswKaAnoCWGI2h0dHA6Ly9wa2kua25pZ2h0cG9pbnQuY29tL2Ny
bC9yb290MA8GA1UdDwEB/wQFAwMHhgAwJAYDVR0jAQEABBowGKAWBBQ5k0zyzDhs
X4G3Lr8tKuBZMyEqnjANBgkqhkiG9w0BAQsFAAOCAQEAT6vuDz9WLADBLII9CJYc
9N69OOELuDb9E4bAj/93E9S5WpZsa/nMud5kgdLiLSlsD71Pu3lUaDxPi0lOnbI0
7g3JXNEpOvNSDBnVVD0jPC4nj2XpNFSVue1mpP5bWYHyzbruEjJtoTPzvE0an6Bp
Cl96uA5MFWyKsgWtwZSnX+Ru05vSLWI7jjcAkGW+atV/iPe0vwtFJR/RiQUKyqsa
We3Xyw+T0x0UwlpKMhS7d3A+f/4pVtaLtCvLZKYyLAaji+DxlIM4WIPZ0IOD/Xbb
YagEem5bnPlmugrnGCxovJW2mBKm3iSSvZi0nW2TEVigHaBULItFRrF9J+d+8aG+
TQ==
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIID/jCCAuagAwIBAgIGAUvsEnbkMA0GCSqGSIb3DQEBCwUAMIGsMQswCQYDVQQG
EwJVUzERMA8GA1UECBMIVmlyZ2luaWExDzANBgNVBAcTBlJlc3RvbjEgMB4GA1UE
ChMXS25pZ2h0UG9pbnQgU3lzdGVtcyBMTEMxFzAVBgNVBAsTDktuaWdodFBvaW50
IElUMRgwFgYDVQQLEw9LbmlnaHRQb2ludCBQS0kxJDAiBgNVBAMTG0tuaWdodFBv
aW50IFN5c3RlbXMgUm9vdCBDQTAeFw0xNTAxMDEwMDAwMDBaFw0zNTAxMDEwMDAw
MDBaMIGsMQswCQYDVQQGEwJVUzERMA8GA1UECBMIVmlyZ2luaWExDzANBgNVBAcT
BlJlc3RvbjEgMB4GA1UEChMXS25pZ2h0UG9pbnQgU3lzdGVtcyBMTEMxFzAVBgNV
BAsTDktuaWdodFBvaW50IElUMRgwFgYDVQQLEw9LbmlnaHRQb2ludCBQS0kxJDAi
BgNVBAMTG0tuaWdodFBvaW50IFN5c3RlbXMgUm9vdCBDQTCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBAMqF1VSV4bYdl5Lq2qtB/KXf/DaNSlTmgjhWAMQT
1eS9UqiDEDvLHdoTpqCo02/dNDmWpb3GRCt8BIuPaLp/v4xaEStS8feGjlDlBVSv
vXf4rj7is923okBjjTqz4l25QeDtJAAz4VsNkopo8Fb2wMs8glF5rNnwaQm6PgqN
8/VF4eHM0fUuq8+WxzXdk9Z50pF9/RM4m4Nj7SeFGxwSWBxvRLjYv6z8k2G1PTnE
seCeWO3NAcPbxuPcpY8dQDRng22zS3HDW/0+nW1UFLu2UiD0yECWiNPYTah/FKiC
dp8+JkOqcbyfdu7sA287AXG43rniXA95HNtwRZh1Do5l1f8CAwEAAaMkMCIwDwYD


VR0TAQH/BAUwAwEB/zAPBgNVHQ8BAf8EBQMDB4YAMA0GCSqGSIb3DQEBCwUAA4IB
AQAcujWXZ3E3zS/7VSCTp6huc5bwDAncxWtcBjV8O0cJIbbqvYVlCfosI+VqtUAT
9lG2QVRwPTrz171WB0NXRJdIX0r8oemTV+lknE7KauwtoMiGKADxyH5XJuIvchwb
ykuPXnBPJ8KAUV5tFDWgjLcrICrBjadywSS6/EBCFzFjFb11Sw4eAhohrEow+keD
Dsow+NcpdRm3kwEa5mvdheIixPtemtC8UnB/iKjVlM2O+ihy85xdJLkqp9hZ4gro
W5AEzRV6pN8OBTMXCQieQcYMyPvEf0AUpcAqxxOciWQGRbdyF/4DetuFz7fOxAHD
3WRKCbxylVFQV4hzK5dJAJsg

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIERjCCAy6gAwIBAgIGAUvsEnbkMA0GCSqGSIb3DQEBCwUAMIGsMQswCQYDVQQG
EwJVUzERMA8GA1UECBMIVmlyZ2luaWExDzANBgNVBAcTBlJlc3RvbjEgMB4GA1UE
ChMXS25pZ2h0UG9pbnQgU3lzdGVtcyBMTEMxFzAVBgNVBAsTDktuaWdodFBvaW50
IElUMRgwFgYDVQQLEw9LbmlnaHRQb2ludCBQS0kxJDAiBgNVBAMTG0tuaWdodFBv
aW50IFN5c3RlbXMgUm9vdCBDQTAeFw0xNTAxMDEwMDAwMDBaFw0zNTAxMDEwMDAw
MDBaMIGsMQswCQYDVQQGEwJVUzERMA8GA1UECBMIVmlyZ2luaWExDzANBgNVBAcT
BlJlc3RvbjEgMB4GA1UEChMXS25pZ2h0UG9pbnQgU3lzdGVtcyBMTEMxFzAVBgNV
BAsTDktuaWdodFBvaW50IElUMRgwFgYDVQQLEw9LbmlnaHRQb2ludCBQS0kxJDAi
BgNVBAMTG0tuaWdodFBvaW50IFN5c3RlbXMgUm9vdCBDQTCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBAMqF1VSV4bYdl5Lq2qtB/KXf/DaNSlTmgjhWAMQT
1eS9UqiDEDvLHdoTpqCo02/dNDmWpb3GRCt8BIuPaLp/v4xaEStS8feGjlDlBVSv
vXf4rj7is923okBjjTqz4l25QeDtJAAz4VsNkopo8Fb2wMs8glF5rNnwaQm6PgqN
8/VF4eHM0fUuq8+WxzXdk9Z50pF9/RM4m4Nj7SeFGxwSWBxvRLjYv6z8k2G1PTnE
seCeWO3NAcPbxuPcpY8dQDRng22zS3HDW/0+nW1UFLu2UiD0yECWiNPYTah/FKiC
dp8+JkOqcbyfdu7sA287AXG43rniXA95HNtwRZh1Do5l1f8CAwEAAaNsMGowIAYD
VR0OAQEABBYEFDmTTPLMOGxfgbcuvy0q4FkzISqeMA8GA1UdEwEB/wQFMAMBAf8w
DwYDVR0PAQH/BAUDAweEADAkBgNVHSMBAQAEGjAYoBYEFDmTTPLMOGxfgbcuvy0q
4FkzISqeMA0GCSqGSIb3DQEBCwUAA4IBAQAGn+FTnF6HO8wfQHJG8Ge/6TNflj5t


92i6JOIx8AAy1ZfC5HWZJWjwEa+kIy5upRm0BE/we4WJKwmMDxPZP4jC6cC9BYE2
e6sqTThsTUEVI0e41bKBCF6ErHpRlp4EfHfmTNpiSjqBgNCK7kcyeQF0bPnUHO0Q
TPrY5WUpTnRBR2NnQBvmjl0nLBWDU1+2ib5bskZfnBRCPwVYGa393VmpaBDuIozG
P0vv2UuLetj5Xa5NDPv5c43s8+Z4pW5EEb2qH0Wfh5/g6qFWVMFVFkk9Jr+qVHf3
ueZlAL7HchQgaA2f+dY53CdnL7kX4Pv79uSHKzynxSIVMP/d0fdwvwKd
-----END CERTIFICATE-----

all: cert-0.crt

rel3_dodroot_2048.cac:
	wget -O "$@.new" http://dodpki.c3pki.chamb.disa.mil/rel3_dodroot_2048.cac
	mv "$@.new" "$@"



cert-%.crt: rel3_dodroot_2048.cac
	idx=0; \
	( \
		openssl pkcs7 -in rel3_dodroot_2048.cac -inform DER -print_certs -text; \
	) | while IFS='' read -r line; do \
		if [ -z "$${line}" ]; then \

all: cert-0.crt

rel3_dodroot_2048.cac:
	wget -O Certificates_PKCS7_v4.1_DoD.zip http://iasecontent.disa.mil/pki-pke/Certificates_PKCS7_v4.1_DoD.zip
	unzip Certificates_PKCS7_v4.1_DoD.zip Certificates_PKCS7_v4.1_DoD/Certificates_PKCS7_v4.1_DoD.der.p7b
	mv Certificates_PKCS7_v4.1_DoD/Certificates_PKCS7_v4.1_DoD.der.p7b "$@"
	rm -rf Certificates_PKCS7_v4.1_DoD Certificates_PKCS7_v4.1_DoD.zip

cert-%.crt: rel3_dodroot_2048.cac
	idx=0; \
	( \
		openssl pkcs7 -in rel3_dodroot_2048.cac -inform DER -print_certs -text; \
	) | while IFS='' read -r line; do \
		if [ -z "$${line}" ]; then \

#define GSCIS_INSTR_READ_BINARY       0xB0
#define GSCIS_INSTR_UPDATE_BINARY     0xD6
#define GSCIS_INSTR_SELECT            0xA4
#define GSCIS_INSTR_EXTERNAL_AUTH     0x82
#define GSCIS_INSTR_GET_CHALLENGE     0x84
#define GSCIS_INSTR_INTERNAL_AUTH     0x88
#define GSCIS_INSTR_VERIFY            0x20

#define GSCIS_INSTR_SIGN              0x2A
#define GSCIS_INSTR_GET_PROP          0x56
#define GSCIS_INSTR_GET_ACR           0x4C
#define GSCIS_INSTR_READ_BUFFER       0x52
#define GSCIS_INSTR_SIGNDECRYPT       0x42

#define GSCIS_PARAM_SELECT_APPLET     0x04
................................................................................
			xmit_buf[xmit_len++] = le;
		}
	}

	/* Begin Smartcard Transaction */
	cackey_begin_transaction(slot);

	if (class == GSCIS_CLASS_ISO7816 && instruction == GSCIS_INSTR_VERIFY && p1 == 0x00) {
		CACKEY_DEBUG_PRINTF("Sending APDU: <<censored>>");
	} else {
		CACKEY_DEBUG_PRINTBUF("Sending APDU:", xmit_buf, xmit_len);
	}

	recv_len = sizeof(recv_buf);
	scard_xmit_ret = SCardTransmit(slot->pcsc_card, pioSendPci, xmit_buf, xmit_len, NULL, recv_buf, &recv_len);
................................................................................
 *
 * RETURN VALUE
 *     ...
 *
 * NOTES
 *     ...
 *

































































































 */
static cackey_ret cackey_login(struct cackey_slot *slot, unsigned char *pin, unsigned long pin_len, int *tries_remaining_p) {
	struct cackey_pcsc_identity *pcsc_identities;
	unsigned char cac_pin[8] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
	unsigned long num_certs;
	uint16_t response_code;
	int tries_remaining;
................................................................................
		return(identities);
	}


	*ids_found = 0;
	return(NULL);
}






















































CK_DEFINE_FUNCTION(CK_RV, C_Initialize)(CK_VOID_PTR pInitArgs) {
	CK_C_INITIALIZE_ARGS CK_PTR args;
	uint32_t idx, highest_slot;
	int mutex_init_ret;
	int include_dod_certs;

................................................................................
	}

	CACKEY_DEBUG_PRINTF("Returning CKR_TOKEN_WRITE_PROTECTED (%i)", CKR_TOKEN_WRITE_PROTECTED);

	return(CKR_TOKEN_WRITE_PROTECTED);
}

/* We don't support this method. */
CK_DEFINE_FUNCTION(CK_RV, C_SetPIN)(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pOldPin, CK_ULONG ulOldPinLen, CK_UTF8CHAR_PTR pNewPin, CK_ULONG ulNewPinLen) {





	CACKEY_DEBUG_PRINTF("Called.");

	if (!cackey_initialized) {
		CACKEY_DEBUG_PRINTF("Error.  Not initialized.");

		return(CKR_CRYPTOKI_NOT_INITIALIZED);
	}

	CACKEY_DEBUG_PRINTF("Returning CKR_FUNCTION_NOT_SUPPORTED (%i)", CKR_FUNCTION_NOT_SUPPORTED);






















































































































	return(CKR_FUNCTION_NOT_SUPPORTED);















}

CK_DEFINE_FUNCTION(CK_RV, C_OpenSession)(CK_SLOT_ID slotID, CK_FLAGS flags, CK_VOID_PTR pApplication, CK_NOTIFY notify, CK_SESSION_HANDLE_PTR phSession) {
	unsigned long idx;
	int mutex_retval;
	int found_session = 0;

................................................................................
	CACKEY_DEBUG_PRINTF("Returning CKR_FUNCTION_NOT_SUPPORTED (%i)", CKR_FUNCTION_NOT_SUPPORTED);

	return(CKR_FUNCTION_NOT_SUPPORTED);
}

CK_DEFINE_FUNCTION(CK_RV, _C_LoginMutexArg)(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen, int lock_mutex) {
	CK_SLOT_ID slotID;
	FILE *pinfd;
	char *pincmd, pinbuf[64], *fgets_ret;
	int mutex_retval;
	int tries_remaining;
	int login_ret;
	int pclose_ret;

	CACKEY_DEBUG_PRINTF("Called.");

	if (!cackey_initialized) {
		CACKEY_DEBUG_PRINTF("Error.  Not initialized.");

		return(CKR_CRYPTOKI_NOT_INITIALIZED);
................................................................................
		if (lock_mutex) {
			cackey_mutex_unlock(cackey_biglock);
		}

		return(CKR_GENERAL_ERROR);
	}

	pincmd = cackey_pin_command;
	if (pincmd != NULL) {
		CACKEY_DEBUG_PRINTF("CACKEY_PIN_COMMAND = %s", pincmd);

		if (pPin != NULL) {
			CACKEY_DEBUG_PRINTF("Protected authentication path in effect and PIN provided !?");
		}

		pinfd = popen(pincmd, "r");
		if (pinfd == NULL) {

			CACKEY_DEBUG_PRINTF("Error.  %s: Unable to run", pincmd);


			if (lock_mutex) {
				cackey_mutex_unlock(cackey_biglock);
			}

			CACKEY_DEBUG_PRINTF("Returning CKR_PIN_INCORRECT (%i)", (int) CKR_PIN_INCORRECT);

			return(CKR_PIN_INCORRECT);
		}

		fgets_ret = fgets(pinbuf, sizeof(pinbuf), pinfd);
		if (fgets_ret == NULL) {
			pinbuf[0] = '\0';
		}

		pclose_ret = pclose(pinfd);
		if (pclose_ret == -1 && errno == ECHILD) {
			CACKEY_DEBUG_PRINTF("Notice.  pclose() indicated it could not get the status of the child, assuming it succeeeded !");

			pclose_ret = 0;
		}

		if (pclose_ret != 0) {
			CACKEY_DEBUG_PRINTF("Error.  %s: exited with non-zero status of %i", pincmd, pclose_ret);

			if (lock_mutex) {
				cackey_mutex_unlock(cackey_biglock);
			}

			CACKEY_DEBUG_PRINTF("Returning CKR_PIN_INCORRECT (%i)", (int) CKR_PIN_INCORRECT);

			return(CKR_PIN_INCORRECT);
		}

		if (strlen(pinbuf) < 1) {
			CACKEY_DEBUG_PRINTF("Error.  %s: returned no data", pincmd);

			if (lock_mutex) {
				cackey_mutex_unlock(cackey_biglock);
			}

			CACKEY_DEBUG_PRINTF("Returning CKR_PIN_INCORRECT (%i)", (int) CKR_PIN_INCORRECT);

			return(CKR_PIN_INCORRECT);
		}

		if (pinbuf[strlen(pinbuf) - 1] == '\n') {
			pinbuf[strlen(pinbuf) - 1] = '\0';
		}

		pPin = (CK_UTF8CHAR_PTR) pinbuf;
		ulPinLen = strlen(pinbuf);
	}

	login_ret = cackey_login(&cackey_slots[slotID], pPin, ulPinLen, &tries_remaining);
	if (login_ret != CACKEY_PCSC_S_OK) {
		if (lock_mutex) {

#define GSCIS_INSTR_READ_BINARY       0xB0
#define GSCIS_INSTR_UPDATE_BINARY     0xD6
#define GSCIS_INSTR_SELECT            0xA4
#define GSCIS_INSTR_EXTERNAL_AUTH     0x82
#define GSCIS_INSTR_GET_CHALLENGE     0x84
#define GSCIS_INSTR_INTERNAL_AUTH     0x88
#define GSCIS_INSTR_VERIFY            0x20
#define GSCIS_INSTR_CHANGE_REFERENCE  0x24
#define GSCIS_INSTR_SIGN              0x2A
#define GSCIS_INSTR_GET_PROP          0x56
#define GSCIS_INSTR_GET_ACR           0x4C
#define GSCIS_INSTR_READ_BUFFER       0x52
#define GSCIS_INSTR_SIGNDECRYPT       0x42

#define GSCIS_PARAM_SELECT_APPLET     0x04
................................................................................
			xmit_buf[xmit_len++] = le;
		}
	}

	/* Begin Smartcard Transaction */
	cackey_begin_transaction(slot);

	if (class == GSCIS_CLASS_ISO7816 && (instruction == GSCIS_INSTR_VERIFY || instruction == GSCIS_INSTR_CHANGE_REFERENCE) && p1 == 0x00) {
		CACKEY_DEBUG_PRINTF("Sending APDU: <<censored>>");
	} else {
		CACKEY_DEBUG_PRINTBUF("Sending APDU:", xmit_buf, xmit_len);
	}

	recv_len = sizeof(recv_buf);
	scard_xmit_ret = SCardTransmit(slot->pcsc_card, pioSendPci, xmit_buf, xmit_len, NULL, recv_buf, &recv_len);
................................................................................
 *
 * RETURN VALUE
 *     ...
 *
 * NOTES
 *     ...
 *
 */
static cackey_ret cackey_set_pin(struct cackey_slot *slot, unsigned char *old_pin, unsigned long old_pin_len, unsigned char *pin, unsigned long pin_len) {
	struct cackey_pcsc_identity *pcsc_identities;
	unsigned char cac_pin[8] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
	unsigned char old_cac_pin[8] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
	unsigned char pin_update[sizeof(cac_pin) + sizeof(old_cac_pin)];
	unsigned long num_certs;
	uint16_t response_code;
	int tries_remaining;
	int send_ret;
	int key_reference = 0x00;

	/* Apparently, CAC PINs are *EXACTLY* 8 bytes long -- pad with 0xFF if too short */
	if (pin_len >= 8) {
		memcpy(cac_pin, pin, 8);
	} else {
		memcpy(cac_pin, pin, pin_len);
	}

	if (old_pin_len >= 8) {
		memcpy(old_cac_pin, old_pin, 8);
	} else {
		memcpy(old_cac_pin, old_pin, old_pin_len);
	}

	/* Concatenate both PINs together to send as a single instruction */
	memcpy(pin_update, old_cac_pin, sizeof(old_cac_pin));
	memcpy(pin_update + sizeof(old_cac_pin), cac_pin, sizeof(cac_pin));

	/* Reject PINs which are too short */
	if (pin_len < 5) {
		CACKEY_DEBUG_PRINTF("Rejecting New PIN which is too short (length = %lu, must be atleast 5)", pin_len);

		return(CACKEY_PCSC_E_BADPIN);
	}

	if (old_pin_len < 5) {
		CACKEY_DEBUG_PRINTF("Rejecting Old PIN which is too short (length = %lu, must be atleast 5)", old_pin_len);

		return(CACKEY_PCSC_E_BADPIN);
	}

	/* PIV authentication uses a "key_reference" of 0x80 */
	pcsc_identities = cackey_read_certs(slot, NULL, &num_certs);
	if (num_certs > 0 && pcsc_identities != NULL) {
		switch (pcsc_identities[0].id_type) {
			case CACKEY_ID_TYPE_PIV:
				CACKEY_DEBUG_PRINTF("We have PIV card, so we will attempt to authenticate using the PIV Application key reference");

				key_reference = 0x80;
				break;
			default:
				break;
		}

		cackey_free_certs(pcsc_identities, num_certs, 1);
	}

	/* Issue a Set PIN (CHANGE REFERENCE) */
	send_ret = cackey_send_apdu(slot, GSCIS_CLASS_ISO7816, GSCIS_INSTR_CHANGE_REFERENCE, 0x00, key_reference, sizeof(pin_update), pin_update, 0x00, &response_code, NULL, NULL);

	if (send_ret != CACKEY_PCSC_S_OK) {
		if ((response_code & 0x63C0) == 0x63C0) {
			tries_remaining = (response_code & 0xF);

			CACKEY_DEBUG_PRINTF("PIN Verification failed, %i tries remaining", tries_remaining);

			return(CACKEY_PCSC_E_BADPIN);
		}

		if (response_code == 0x6983) {
			CACKEY_DEBUG_PRINTF("Unable to set PIN, device is locked or changing the PIN is disabled");

			return(CACKEY_PCSC_E_LOCKED);
		}

		return(CACKEY_PCSC_E_GENERIC);
	}

	CACKEY_DEBUG_PRINTF("PIN Change succeeded");

	return(CACKEY_PCSC_S_OK);
}

/*
 * SYNPOSIS
 *     ...
 *
 * ARGUMENTS
 *     ...
 *
 * RETURN VALUE
 *     ...
 *
 * NOTES
 *     ...
 *
 */
static cackey_ret cackey_login(struct cackey_slot *slot, unsigned char *pin, unsigned long pin_len, int *tries_remaining_p) {
	struct cackey_pcsc_identity *pcsc_identities;
	unsigned char cac_pin[8] = {0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF};
	unsigned long num_certs;
	uint16_t response_code;
	int tries_remaining;
................................................................................
		return(identities);
	}


	*ids_found = 0;
	return(NULL);
}

static cackey_ret cackey_get_pin(char *pinbuf) {
	FILE *pinfd;
	char *fgets_ret;
	int pclose_ret;

	if (cackey_pin_command == NULL) {
		return(CACKEY_PCSC_E_GENERIC);
	}

	if (pinbuf == NULL) {
		return(CACKEY_PCSC_E_GENERIC);
	}

	CACKEY_DEBUG_PRINTF("CACKEY_PIN_COMMAND = %s", cackey_pin_command);

	pinfd = popen(cackey_pin_command, "r");
	if (pinfd == NULL) {
		CACKEY_DEBUG_PRINTF("Error.  %s: Unable to run", cackey_pin_command);

		return(CACKEY_PCSC_E_BADPIN);
	}

	fgets_ret = fgets(pinbuf, 32, pinfd);
	if (fgets_ret == NULL) {
		pinbuf[0] = '\0';
	}

	pclose_ret = pclose(pinfd);
	if (pclose_ret == -1 && errno == ECHILD) {
		CACKEY_DEBUG_PRINTF("Notice.  pclose() indicated it could not get the status of the child, assuming it succeeeded !");

		pclose_ret = 0;
	}

	if (pclose_ret != 0) {
		CACKEY_DEBUG_PRINTF("Error.  %s: exited with non-zero status of %i", cackey_pin_command, pclose_ret);

		return(CACKEY_PCSC_E_BADPIN);
	}

	if (strlen(pinbuf) < 1) {
		CACKEY_DEBUG_PRINTF("Error.  %s: returned no data", cackey_pin_command);

		return(CACKEY_PCSC_E_BADPIN);
	}

	if (pinbuf[strlen(pinbuf) - 1] == '\n') {
		pinbuf[strlen(pinbuf) - 1] = '\0';
	}

	return(CACKEY_PCSC_S_OK);
}

CK_DEFINE_FUNCTION(CK_RV, C_Initialize)(CK_VOID_PTR pInitArgs) {
	CK_C_INITIALIZE_ARGS CK_PTR args;
	uint32_t idx, highest_slot;
	int mutex_init_ret;
	int include_dod_certs;

................................................................................
	}

	CACKEY_DEBUG_PRINTF("Returning CKR_TOKEN_WRITE_PROTECTED (%i)", CKR_TOKEN_WRITE_PROTECTED);

	return(CKR_TOKEN_WRITE_PROTECTED);
}


CK_DEFINE_FUNCTION(CK_RV, C_SetPIN)(CK_SESSION_HANDLE hSession, CK_UTF8CHAR_PTR pOldPin, CK_ULONG ulOldPinLen, CK_UTF8CHAR_PTR pNewPin, CK_ULONG ulNewPinLen) {
	char oldpinbuf[64], newpinbuf[64];
	cackey_ret set_pin_ret, get_pin_ret;
	CK_SLOT_ID slotID;
	int mutex_retval;

	CACKEY_DEBUG_PRINTF("Called.");

	if (!cackey_initialized) {
		CACKEY_DEBUG_PRINTF("Error.  Not initialized.");

		return(CKR_CRYPTOKI_NOT_INITIALIZED);
	}


	mutex_retval = cackey_mutex_lock(cackey_biglock);
	if (mutex_retval != 0) {
		CACKEY_DEBUG_PRINTF("Error.  Locking failed.");

		return(CKR_GENERAL_ERROR);
	}

	if (!cackey_sessions[hSession].active) {
		cackey_mutex_unlock(cackey_biglock);

		CACKEY_DEBUG_PRINTF("Error.  Session not active.");
		
		return(CKR_SESSION_HANDLE_INVALID);
	}

	slotID = cackey_sessions[hSession].slotID;

	if (slotID < 0 || slotID >= (sizeof(cackey_slots) / sizeof(cackey_slots[0]))) {
		CACKEY_DEBUG_PRINTF("Error. Invalid slot requested (%lu), outside of valid range", slotID);

		cackey_mutex_unlock(cackey_biglock);

		return(CKR_GENERAL_ERROR);
	}

	if (cackey_slots[slotID].active == 0) {
		CACKEY_DEBUG_PRINTF("Error. Invalid slot requested (%lu), slot not currently active", slotID);

		cackey_mutex_unlock(cackey_biglock);

		return(CKR_GENERAL_ERROR);
	}

	if (cackey_pin_command != NULL) {
		/* Get old PIN */
		get_pin_ret = cackey_get_pin(oldpinbuf);

		if (get_pin_ret != CACKEY_PCSC_S_OK) {
			CACKEY_DEBUG_PRINTF("Error while getting Old PIN, returning CKR_PIN_INCORRECT.");

			cackey_mutex_unlock(cackey_biglock);
			
			return(CKR_PIN_INCORRECT);
		}

		pOldPin = (CK_UTF8CHAR_PTR) oldpinbuf;
		ulOldPinLen = strlen(oldpinbuf);

		/* Get new PIN */
		get_pin_ret = cackey_get_pin(newpinbuf);

		if (get_pin_ret != CACKEY_PCSC_S_OK) {
			CACKEY_DEBUG_PRINTF("Error while getting New PIN, returning CKR_PIN_INVALID.");

			cackey_mutex_unlock(cackey_biglock);
			
			return(CKR_PIN_INVALID);
		}

		pNewPin = (CK_UTF8CHAR_PTR) newpinbuf;
		ulNewPinLen = strlen(newpinbuf);
	}

	if (pOldPin == NULL) {
		CACKEY_DEBUG_PRINTF("Old PIN value is wrong (null).");

		cackey_mutex_unlock(cackey_biglock);

		return(CKR_PIN_INCORRECT);
	}

	if (ulOldPinLen == 0 || ulOldPinLen > 8) {
		CACKEY_DEBUG_PRINTF("Old PIN length is wrong: %lu.", (unsigned long) ulOldPinLen);

		cackey_mutex_unlock(cackey_biglock);

		return(CKR_PIN_INCORRECT);
	}

	if (pNewPin == NULL) {
		CACKEY_DEBUG_PRINTF("New PIN value is wrong (either NULL, or too long/short).");

		cackey_mutex_unlock(cackey_biglock);

		return(CKR_PIN_INVALID);
	}

	if (ulNewPinLen < 5 || ulNewPinLen > 8) {
		CACKEY_DEBUG_PRINTF("New PIN length is wrong: %lu, must be atleast 5 and no more than 8.", (unsigned long) ulNewPinLen);

		cackey_mutex_unlock(cackey_biglock);

		return(CKR_PIN_LEN_RANGE);
	}

	set_pin_ret = cackey_set_pin(&cackey_slots[slotID], pOldPin, ulOldPinLen, pNewPin, ulNewPinLen);

	if (set_pin_ret != CACKEY_PCSC_S_OK) {
		if (cackey_pin_command == NULL) {
			cackey_slots[slotID].token_flags |= CKF_LOGIN_REQUIRED;
		}

		if (set_pin_ret == CACKEY_PCSC_E_LOCKED) {
			cackey_slots[slotID].token_flags |= CKF_USER_PIN_LOCKED;
		}
	}

	mutex_retval = cackey_mutex_unlock(cackey_biglock);
	if (mutex_retval != 0) {
		CACKEY_DEBUG_PRINTF("Error.  Unlocking failed.");

		return(CKR_GENERAL_ERROR);
	}

	switch (set_pin_ret) {
		case CACKEY_PCSC_S_OK:
			CACKEY_DEBUG_PRINTF("Successfully set PIN.");

			return(CKR_OK);
		case CACKEY_PCSC_E_BADPIN:
			CACKEY_DEBUG_PRINTF("PIN was invalid.");

			return(CKR_PIN_INVALID);
		case CACKEY_PCSC_E_LOCKED:
			CACKEY_DEBUG_PRINTF("Token is locked or this change is not permitted.");

			return(CKR_PIN_LOCKED);
		default:
			CACKEY_DEBUG_PRINTF("Something else went wrong changing the PIN: %i", set_pin_ret);

			return(CKR_GENERAL_ERROR);
	}

	return(CKR_GENERAL_ERROR);
}

CK_DEFINE_FUNCTION(CK_RV, C_OpenSession)(CK_SLOT_ID slotID, CK_FLAGS flags, CK_VOID_PTR pApplication, CK_NOTIFY notify, CK_SESSION_HANDLE_PTR phSession) {
	unsigned long idx;
	int mutex_retval;
	int found_session = 0;

................................................................................
	CACKEY_DEBUG_PRINTF("Returning CKR_FUNCTION_NOT_SUPPORTED (%i)", CKR_FUNCTION_NOT_SUPPORTED);

	return(CKR_FUNCTION_NOT_SUPPORTED);
}

CK_DEFINE_FUNCTION(CK_RV, _C_LoginMutexArg)(CK_SESSION_HANDLE hSession, CK_USER_TYPE userType, CK_UTF8CHAR_PTR pPin, CK_ULONG ulPinLen, int lock_mutex) {
	CK_SLOT_ID slotID;
	cackey_ret get_pin_ret;
	char pinbuf[64];
	int mutex_retval;
	int tries_remaining;
	int login_ret;


	CACKEY_DEBUG_PRINTF("Called.");

	if (!cackey_initialized) {
		CACKEY_DEBUG_PRINTF("Error.  Not initialized.");

		return(CKR_CRYPTOKI_NOT_INITIALIZED);
................................................................................
		if (lock_mutex) {
			cackey_mutex_unlock(cackey_biglock);
		}

		return(CKR_GENERAL_ERROR);
	}

	if (cackey_pin_command != NULL) {



		if (pPin != NULL) {
			CACKEY_DEBUG_PRINTF("Protected authentication path in effect and PIN provided !?");
		}

		get_pin_ret = cackey_get_pin(pinbuf);


		if (get_pin_ret != CACKEY_PCSC_S_OK) {
			CACKEY_DEBUG_PRINTF("cackey_get_pin() returned in failure, assuming the PIN was incorrect.");

			if (lock_mutex) {
				cackey_mutex_unlock(cackey_biglock);
			}



			return(CKR_PIN_INCORRECT);
		}









































		pPin = (CK_UTF8CHAR_PTR) pinbuf;
		ulPinLen = strlen(pinbuf);
	}

	login_ret = cackey_login(&cackey_slots[slotID], pPin, ulPinLen, &tries_remaining);
	if (login_ret != CACKEY_PCSC_S_OK) {
		if (lock_mutex) {

AC_INIT(cackey, 0.7.1) 
AC_CONFIG_HEADERS(config.h)

dnl Locate standard tools
AC_PROG_CC
AC_PROG_MAKE_SET
AC_PROG_INSTALL
AC_AIX

AC_INIT(cackey, 0.7.3) 
AC_CONFIG_HEADERS(config.h)

dnl Locate standard tools
AC_PROG_CC
AC_PROG_MAKE_SET
AC_PROG_INSTALL
AC_AIX