Changeset 438cf4b in OpenSC

Timestamp:

06/02/11 19:06:43 (12 months ago)

Author:

vtarasov <vtarasov@…>

Branches:

master, staging

Children:

a479c36

Parents:

da0a77b

git-author:

vtarasov <vtarasov@…> (06/02/11 19:06:43)

git-committer:

vtarasov <vtarasov@…> (06/02/11 19:06:43)

Message:

RuToken?-ECP: profile option to allow the reset of User PIN with SoPIN

 http://www.opensc-project.org/pipermail/opensc-devel/2011-May/016716.html

git-svn-id:  https://www.opensc-project.org/svnp/opensc/trunk@5542 c6295689-39f2-0310-b995-f0e70906c6a9

Location:

src

Files:

• libopensc/card-rtecp.c (modified) (1 diff)
• pkcs15init/pkcs15-rtecp.c (modified) (4 diffs)
• pkcs15init/rutoken_ecp.profile (modified) (3 diffs)

src/libopensc/card-rtecp.c

@@ -487 +487 @@
         int r;
 
-        (void)type, (void)puk, (void)puklen, (void)newref, (void)newlen; /* no warning */
+        (void)type, (void)puk, (void)puklen; /* no warning */
         assert(card && card->ctx);
+
         sc_format_apdu(card, &apdu, SC_APDU_CASE_1, 0x2C, 0x03, ref_qualifier);
         r = sc_transmit_apdu(card, &apdu);
         SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, r, "APDU transmit failed");
         r = sc_check_sw(card, apdu.sw1, apdu.sw2);
+        SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, r, "Unblock card failed");
+        
+        if (newref && newlen)   {
+                u8 tmp[2], buf[SC_MAX_APDU_BUFFER_SIZE];
+                u8 *p = buf;
+
+                tmp[0] = (newlen >> 8) & 0xFF;
+                tmp[1] = newlen & 0xFF;
+                sc_asn1_put_tag(0x80, tmp, sizeof(tmp), p, sizeof(buf) - (p - buf), &p);
+                r = sc_asn1_put_tag(0xA5, newref, newlen, p, sizeof(buf) - (p - buf), &p);
+                SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, r, "Invalid new PIN length");
+
+                sc_format_apdu(card, &apdu, SC_APDU_CASE_3_SHORT, 0x24, 0x01, ref_qualifier);
+                apdu.lc = p - buf;
+                apdu.data = buf;
+                apdu.datalen = p - buf;
+
+                r = sc_transmit_apdu(card, &apdu);
+                SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, r, "APDU transmit failed");
+                r = sc_check_sw(card, apdu.sw1, apdu.sw2);
+                SC_TEST_RET(card->ctx, SC_LOG_DEBUG_NORMAL, r, "Set PIN failed");
+        }
+
         SC_FUNC_RETURN(card->ctx, SC_LOG_DEBUG_VERBOSE, r);
 }

src/pkcs15init/pkcs15-rtecp.c

@@ -169 +169 @@
         sc_context_t *ctx;
         sc_pkcs15_pin_info_t *pin_info;
-        sc_file_t *file;
+        sc_file_t *file = NULL;
         /*                        GCHV min-length Flags Attempts  Reserve */
         unsigned char prop[]  = { 0x01,       '?', 0x01,     '?', 0, 0 };
         /*                  AccessMode Unblock Change             Delete */
         unsigned char sec[15] = { 0x43,    '?',   '?', 0, 0, 0, 0,  0xFF };
-        int r;
+        char pin_sname[0x10];
+        int r, reset_by_sopin = 0;
 
         (void)puk; /* no warning */
@@ -183 +184 @@
         ctx = p15card->card->ctx;
         SC_FUNC_CALLED(ctx, SC_LOG_DEBUG_VERBOSE);
+
         if (puk_len != 0)
         {
@@ -197 +199 @@
                 return SC_ERROR_NOT_SUPPORTED;
         }
+
+        snprintf(pin_sname, sizeof(pin_sname), "CHV%i", pin_info->reference);
+        if (pin_info->reference == RTECP_USER_PIN_REF)   {
+                r = sc_profile_get_file(profile, pin_sname, &file);
+                if (!r)   {
+                        const struct sc_acl_entry *acl = NULL;
+
+                        r = sc_pkcs15init_fixup_file(profile, p15card, file);
+                        SC_TEST_RET(p15card->card->ctx, SC_LOG_DEBUG_NORMAL, r, "Cannot fixup the ACLs of PIN file");
+
+                        acl = sc_file_get_acl_entry(file, SC_AC_OP_PIN_RESET);
+                        if (acl && acl->method == SC_AC_CHV && acl->key_ref == RTECP_SO_PIN_REF)   {
+                                sc_debug(ctx, SC_LOG_DEBUG_NORMAL, "Allow reset of User PIN with SoPIN\n");
+                                reset_by_sopin = 1;
+                        }
+                        sc_file_free(file);
+                }
+        }
+
         file = sc_file_new();
         if (!file)
@@ -204 +225 @@
         assert(sizeof(sec)/sizeof(sec[0]) > 2);
         sec[1] = (pin_info->reference == RTECP_SO_PIN_REF) ? 0xFF : RTECP_SO_PIN_REF;
-        sec[2] = (unsigned char)pin_info->reference;
+        sec[2] = (unsigned char)pin_info->reference | (reset_by_sopin ? RTECP_SO_PIN_REF : 0);
         r = sc_file_set_sec_attr(file, sec, sizeof(sec));
         if (r == SC_SUCCESS)

src/pkcs15init/rutoken_ecp.profile

@@ -24 +24 @@
     # Have a lastUpdate field in the EF(TokenInfo)?
     do-last-update      = yes;
+
+    pkcs15-id-style     = mozilla;
 }
 
@@ -46 +48 @@
     auth-id     = 2;
     reference   = 2;
-    attempts    = 10;
-    min-length  = 8;
+    attempts    = 5;
+    min-length  = 4;
     max-length  = 32;
     flags       = case-sensitive, initialized;
@@ -70 +72 @@
 
 filesystem {
+    EF CHV2 {
+        file-id = 0002;
+        ACL     = *=NEVER, UPDATE=$SOPIN, PIN-RESET=$SOPIN;
+    }
 
     DF MF {