Changeset 40cb1c9e in OpenSC

Timestamp:

06/14/11 12:00:18 (11 months ago)

Author:

Ludovic Rousseau <ludovic.rousseau+github@…>

Branches:

master, staging

Children:

ce2d3c0, 3b63bf3

Parents:

8936901 (diff), a6b7743 (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

git-author:

Ludovic Rousseau <ludovic.rousseau+github@…> (06/14/11 12:00:18)

git-committer:

Ludovic Rousseau <ludovic.rousseau+github@…> (06/14/11 12:00:18)

Message:

Merge remote branch 'upstream/master'

Location:

src

Files:

• libopensc/pkcs15.h (modified) (4 diffs)
• pkcs11/framework-pkcs15.c (modified) (2 diffs)
• pkcs11/pkcs11-opensc.h (modified) (1 diff)
• pkcs15init/pkcs15-cardos.c (modified) (4 diffs)
• libopensc/reader-pcsc.c (modified) (2 diffs)
• pkcs15init/pkcs15-lib.c (modified) (1 diff)

src/libopensc/pkcs15.h

@@ -71 +71 @@
 
 #define SC_PKCS15_PIN_AUTH_TYPE_PIN                     0
-#define SC_PKCS15_PIN_AUTH_TYPE_AUTH_KEY                1
-#define SC_PKCS15_PIN_AUTH_TYPE_SM_KEY                  2
-
+#define SC_PKCS15_PIN_AUTH_TYPE_BIOMETRIC               1
+#define SC_PKCS15_PIN_AUTH_TYPE_AUTH_KEY                2
+#define SC_PKCS15_PIN_AUTH_TYPE_SM_KEY                  3
+
+/* PinAttributes as they defined in PKCS#15 v1.1 for PIN authentication object */
 struct sc_pkcs15_pin_attributes {
         unsigned int  flags, type;
@@ -80 +82 @@
         u8  pad_char;
 };
+/* AuthKeyAttributes of the authKey authentication object */
 struct sc_pkcs15_authkey_attributes {
         int derived;
         struct sc_pkcs15_id skey_id;
 };
+/* BiometricAttributes of the biometricTemplate authentication object */
 struct sc_pkcs15_biometric_attributes {
         unsigned int flags;
@@ -90 +94 @@
 };
 struct sc_pkcs15_auth_info {
+        /* CommonAuthenticationObjectAttributes */
         struct sc_pkcs15_id  auth_id;
+
+        /* AuthObjectAttributes */
         struct sc_path  path;
         unsigned auth_type;
@@ -98 +105 @@
                 struct sc_pkcs15_authkey_attributes authkey;
         } attrs;
+
+        /* authentication method: CHV, SEN, SYMBOLIC, ... */
         unsigned int  auth_method;
+
         int  tries_left, max_tries;
  };

src/pkcs11/framework-pkcs15.c

@@ -1410 +1410 @@
         auth_info = (sc_pkcs15_auth_info_t *) auth_obj->data;
         return CKR_OK;
+}
+
+static unsigned long
+pkcs15_check_bool_cka(CK_ATTRIBUTE_PTR attr, unsigned long flag)
+{
+        if (attr->ulValueLen != sizeof(CK_BBOOL) || !attr->pValue)
+                return 0;
+
+        if (*((CK_BBOOL *)attr->pValue))
+                return flag;
+
+        return 0;
 }
 
@@ -1494 +1506 @@
                                 bn = &gost->d; 
                         break;
-
+                case CKA_SIGN:
+                        args.usage |= pkcs15_check_bool_cka(attr, SC_PKCS15_PRKEY_USAGE_SIGN);
+                        break;  
+                case CKA_SIGN_RECOVER:
+                        args.usage |= pkcs15_check_bool_cka(attr, SC_PKCS15_PRKEY_USAGE_SIGNRECOVER);
+                        break;  
+                case CKA_DECRYPT:
+                        args.usage |= pkcs15_check_bool_cka(attr, SC_PKCS15_PRKEY_USAGE_DECRYPT);
+                        break;  
+                case CKA_UNWRAP:
+                        args.usage |= pkcs15_check_bool_cka(attr, SC_PKCS15_PRKEY_USAGE_UNWRAP);
+                        break;
+                case OPENSC_CKA_NON_REPUDIATION:
+                        args.usage |= pkcs15_check_bool_cka(attr, SC_PKCS15_PRKEY_USAGE_NONREPUDIATION);
+                        break;  
                 default:
                         /* ignore unknown attrs, or flag error? */

src/pkcs11/pkcs11-opensc.h

@@ -3 +3 @@
 
 /* OpenSC specific extensions */
+/*
+ * In PKCS#11 there is no CKA_ attribute dedicated to the NON-REPUDIATION flag.
+ * We need this flag in PKCS#15/libopensc to make dinstinction between 
+ * 'signature' and 'qualified signature' key slots.
+ */
+#define OPENSC_CKA_NON_REPUDIATION      (CKA_VENDOR_DEFINED | 1UL)
 
 #endif

src/pkcs15init/pkcs15-cardos.c

@@ -63 +63 @@
 static int      do_cardos_extract_pubkey(sc_card_t *card, int nr, u8 tag,
                         sc_pkcs15_bignum_t *bn);
+static int      cardos_have_verifyrc_package(sc_card_t *card);
 
 /* Object IDs for PIN objects.
@@ -414 +415 @@
         struct tlv      tlv;
         unsigned int    attempts, minlen, maxlen;
-        int             r;
+        int             r, hasverifyrc;
 
         if (auth_info->auth_type != SC_PKCS15_PIN_AUTH_TYPE_PIN)
@@ -446 +447 @@
         tlv_next(&tlv, 0x85);
         tlv_add(&tlv, 0x02);            /* options byte */
+        hasverifyrc = cardos_have_verifyrc_package(card);
+        if (hasverifyrc == 1)
+                /* Use 9 byte OCI parameters to be able to set VerifyRC bit     */
+                tlv_add(&tlv, 0x04);    /* options_2 byte with bit 2 set to return CurrentErrorCounter  */
         tlv_add(&tlv, attempts & 0xf);  /* flags byte */
         tlv_add(&tlv, CARDOS_ALGO_PIN); /* algorithm = pin-test */
@@ -787 +792 @@
 }
 
+static int cardos_have_verifyrc_package(sc_card_t *card)
+{
+        sc_apdu_t apdu;
+        u8        rbuf[SC_MAX_APDU_BUFFER_SIZE];
+        int       r;
+        const u8  *p = rbuf, *q;
+        size_t    len, tlen = 0, ilen = 0;
+
+        sc_format_apdu(card, &apdu, SC_APDU_CASE_2_SHORT, 0xca, 0x01, 0x88);
+        apdu.resp    = rbuf;
+        apdu.resplen = sizeof(rbuf);
+        apdu.lc = 0;
+        apdu.le = 256;
+        r = sc_transmit_apdu(card, &apdu);
+        SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, r, "APDU transmit failed");
+
+        if ((len = apdu.resplen) == 0)
+                /* looks like no package has been installed  */
+                return 0;
+
+        while (len != 0) {
+                p = sc_asn1_find_tag(card->ctx, p, len, 0xe1, &tlen);
+                if (p == NULL)
+                        return 0;
+                if (card->type == SC_CARD_TYPE_CARDOS_M4_3)     {
+                        /* the verifyRC package on CardOS 4.3B use Manufacturer ID 0x01 */
+                        /* and Package Number 0x07                                      */
+                        q = sc_asn1_find_tag(card->ctx, p, tlen, 0x01, &ilen);
+                        if (q == NULL || ilen != 4)
+                                return 0;
+                        if (q[0] == 0x07)
+                                return 1;
+                } else if (card->type == SC_CARD_TYPE_CARDOS_M4_4)      {
+                        /* the verifyRC package on CardOS 4.4 use Manufacturer ID 0x03  */
+                        /* and Package Number 0x02                                      */
+                        q = sc_asn1_find_tag(card->ctx, p, tlen, 0x03, &ilen);
+                        if (q == NULL || ilen != 4)
+                                return 0;
+                        if (q[0] == 0x02)
+                                return 1;
+                } else  {
+                        return 0;
+                }
+                p   += tlen;
+                len -= tlen + 2;
+        }
+
+        return 0;
+}
+
 static struct sc_pkcs15init_operations sc_pkcs15init_cardos_operations = {
         cardos_erase,

src/libopensc/reader-pcsc.c

@@ -1030 +1030 @@
         unsigned int num_watch;
         int r = SC_ERROR_INTERNAL;
+        DWORD dwtimeout;
 
         SC_FUNC_CALLED(ctx, SC_LOG_DEBUG_NORMAL);
@@ -1168 +1169 @@
                 /* Set the timeout if caller wants to time out */
                 if (timeout == -1) {
-                        timeout = INFINITE;
-                }
-
-                rv = gpriv->SCardGetStatusChange(gpriv->pcsc_wait_ctx, timeout, rgReaderStates, num_watch);
+                        dwtimeout = INFINITE;
+                }
+                else
+                        dwtimeout = timeout;
+
+                rv = gpriv->SCardGetStatusChange(gpriv->pcsc_wait_ctx, dwtimeout, rgReaderStates, num_watch);
 
                 if (rv == (LONG) SCARD_E_CANCELLED) {

src/pkcs15init/pkcs15-lib.c

@@ -1066 +1066 @@
 }
 
-int
+static int
 sc_pkcs15init_encode_prvkey_content(struct sc_pkcs15_card *p15card, struct sc_pkcs15_prkey *prvkey,
                 struct sc_pkcs15_object *object)