Archipelago » qemu

/*

 * implement the applets for the CAC card.

 *

 * This code is licensed under the GNU LGPL, version 2.1 or later.

 * See the COPYING.LIB file in the top-level directory.

 */

#include "qemu-common.h"

#include "cac.h"

#include "vcard.h"

#include "vcard_emul.h"

#include "card_7816.h"

#define CAC_GET_PROPERTIES  0x56

#define CAC_GET_ACR         0x4c

#define CAC_READ_BUFFER     0x52

#define CAC_UPDATE_BUFFER   0x58

#define CAC_SIGN_DECRYPT    0x42

#define CAC_GET_CERTIFICATE 0x36

/* private data for PKI applets */

typedef struct CACPKIAppletDataStruct {

    unsigned char *cert;

    int cert_len;

    unsigned char *cert_buffer;

    int cert_buffer_len;

    unsigned char *sign_buffer;

    int sign_buffer_len;

    VCardKey *key;

} CACPKIAppletData;

/*

 * CAC applet private data

 */

struct VCardAppletPrivateStruct {

    union {

        CACPKIAppletData pki_data;

        void *reserved;

    } u;

};

/*

 * handle all the APDU's that are common to all CAC applets

 */

static VCardStatus

cac_common_process_apdu(VCard *card, VCardAPDU *apdu, VCardResponse **response)

{

    int ef;

    switch (apdu->a_ins) {

    case VCARD7816_INS_SELECT_FILE:

        if (apdu->a_p1 != 0x02) {

            /* let the 7816 code handle applet switches */

            return VCARD_NEXT;

        }

        /* handle file id setting */

        if (apdu->a_Lc != 2) {

            *response = vcard_make_response(

                VCARD7816_STATUS_ERROR_DATA_INVALID);

            return VCARD_DONE;

        }

        /* CAC 1.0 only supports ef = 0 */

        ef = apdu->a_body[0] | (apdu->a_body[1] << 8);

        if (ef != 0) {

            *response = vcard_make_response(

                VCARD7816_STATUS_ERROR_FILE_NOT_FOUND);

            return VCARD_DONE;

        }

        *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);

        return VCARD_DONE;

    case VCARD7816_INS_GET_RESPONSE:

    case VCARD7816_INS_VERIFY:

        /* let the 7816 code handle these */

        return VCARD_NEXT;

    case CAC_GET_PROPERTIES:

    case CAC_GET_ACR:

        /* skip these for now, this will probably be needed */

        *response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);

        return VCARD_DONE;

    }

    *response = vcard_make_response(

        VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);

    return VCARD_DONE;

}

/*

 *  reset the inter call state between applet selects

 */

static VCardStatus

cac_applet_pki_reset(VCard *card, int channel)

{

    VCardAppletPrivate *applet_private = NULL;

    CACPKIAppletData *pki_applet = NULL;

    applet_private = vcard_get_current_applet_private(card, channel);

    assert(applet_private);

    pki_applet = &(applet_private->u.pki_data);

    pki_applet->cert_buffer = NULL;

    if (pki_applet->sign_buffer) {

        qemu_free(pki_applet->sign_buffer);

        pki_applet->sign_buffer = NULL;

    }

    pki_applet->cert_buffer_len = 0;

    pki_applet->sign_buffer_len = 0;

    return VCARD_DONE;

}

static VCardStatus

cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,

                            VCardResponse **response)

{

    CACPKIAppletData *pki_applet = NULL;

    VCardAppletPrivate *applet_private = NULL;

    int size, next;

    unsigned char *sign_buffer;

    vcard_7816_status_t status;

    applet_private = vcard_get_current_applet_private(card, apdu->a_channel);

    assert(applet_private);

    pki_applet = &(applet_private->u.pki_data);

    switch (apdu->a_ins) {

    case CAC_UPDATE_BUFFER:

        *response = vcard_make_response(

            VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);

        return VCARD_DONE;

    case CAC_GET_CERTIFICATE:

        if ((apdu->a_p2 != 0) || (apdu->a_p1 != 0)) {

            *response = vcard_make_response(

                             VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);

            break;

        }

        assert(pki_applet->cert != NULL);

        size = apdu->a_Le;

        if (pki_applet->cert_buffer == NULL) {

            pki_applet->cert_buffer = pki_applet->cert;

            pki_applet->cert_buffer_len = pki_applet->cert_len;

        }

        size = MIN(size, pki_applet->cert_buffer_len);

        next = MIN(255, pki_applet->cert_buffer_len - size);

        *response = vcard_response_new_bytes(

                        card, pki_applet->cert_buffer, size,

                        apdu->a_Le, next ?

                        VCARD7816_SW1_WARNING_CHANGE :

                        VCARD7816_SW1_SUCCESS,

                        next);

        pki_applet->cert_buffer += size;

        pki_applet->cert_buffer_len -= size;

        if ((*response == NULL) || (next == 0)) {

            pki_applet->cert_buffer = NULL;

        }

        if (*response == NULL) {

            *response = vcard_make_response(

                            VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);

        }

        return VCARD_DONE;

    case CAC_SIGN_DECRYPT:

        if (apdu->a_p2 != 0) {

            *response = vcard_make_response(

                             VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);

            break;

        }

        size = apdu->a_Lc;

        sign_buffer = realloc(pki_applet->sign_buffer,

                      pki_applet->sign_buffer_len+size);

        if (sign_buffer == NULL) {

            qemu_free(pki_applet->sign_buffer);

            pki_applet->sign_buffer = NULL;

            pki_applet->sign_buffer_len = 0;

            *response = vcard_make_response(

                            VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);

            return VCARD_DONE;

        }

        memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size);

        size += pki_applet->sign_buffer_len;

        switch (apdu->a_p1) {

        case  0x80:

            /* p1 == 0x80 means we haven't yet sent the whole buffer, wait for

             * the rest */

            pki_applet->sign_buffer = sign_buffer;

            pki_applet->sign_buffer_len = size;

            *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);

            return VCARD_DONE;

        case 0x00:

            /* we now have the whole buffer, do the operation, result will be

             * in the sign_buffer */

            status = vcard_emul_rsa_op(card, pki_applet->key,

                                       sign_buffer, size);

            if (status != VCARD7816_STATUS_SUCCESS) {

                *response = vcard_make_response(status);

                break;

            }

            *response = vcard_response_new(card, sign_buffer, size, apdu->a_Le,

                                                     VCARD7816_STATUS_SUCCESS);

            if (*response == NULL) {

                *response = vcard_make_response(

                                VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);

            }

            break;

        default:

           *response = vcard_make_response(

                                VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);

            break;

        }

        qemu_free(sign_buffer);

        pki_applet->sign_buffer = NULL;

        pki_applet->sign_buffer_len = 0;

        return VCARD_DONE;

    case CAC_READ_BUFFER:

        /* new CAC call, go ahead and use the old version for now */

        /* TODO: implement */

        *response = vcard_make_response(

                                VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);

        return VCARD_DONE;

    }

    return cac_common_process_apdu(card, apdu, response);

}

static VCardStatus

cac_applet_id_process_apdu(VCard *card, VCardAPDU *apdu,

                           VCardResponse **response)

{

    switch (apdu->a_ins) {

    case CAC_UPDATE_BUFFER:

        *response = vcard_make_response(

                        VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);

        return VCARD_DONE;

    case CAC_READ_BUFFER:

        /* new CAC call, go ahead and use the old version for now */

        /* TODO: implement */

        *response = vcard_make_response(

                        VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);

        return VCARD_DONE;

    }

    return cac_common_process_apdu(card, apdu, response);

}

/*

 * TODO: if we ever want to support general CAC middleware, we will need to

 * implement the various containers.

 */

static VCardStatus

cac_applet_container_process_apdu(VCard *card, VCardAPDU *apdu,

                                  VCardResponse **response)

{

    switch (apdu->a_ins) {

    case CAC_READ_BUFFER:

    case CAC_UPDATE_BUFFER:

        *response = vcard_make_response(

                        VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);

        return VCARD_DONE;

    default:

        break;

    }

    return cac_common_process_apdu(card, apdu, response);

}

/*

 * utilities for creating and destroying the private applet data

 */

static void

cac_delete_pki_applet_private(VCardAppletPrivate *applet_private)

{

    CACPKIAppletData *pki_applet_data = NULL;

    if (pki_applet_data == NULL) {

        return;

    }

    pki_applet_data = &(applet_private->u.pki_data);

    if (pki_applet_data->cert != NULL) {

        qemu_free(pki_applet_data->cert);

    }

    if (pki_applet_data->sign_buffer != NULL) {

        qemu_free(pki_applet_data->sign_buffer);

    }

    if (pki_applet_data->key != NULL) {

        vcard_emul_delete_key(pki_applet_data->key);

    }

    qemu_free(applet_private);

}

static VCardAppletPrivate *

cac_new_pki_applet_private(const unsigned char *cert,

                           int cert_len, VCardKey *key)

{

    CACPKIAppletData *pki_applet_data = NULL;

    VCardAppletPrivate *applet_private = NULL;

    applet_private = (VCardAppletPrivate *)qemu_malloc(sizeof(VCardAppletPrivate));

    pki_applet_data = &(applet_private->u.pki_data);

    pki_applet_data->cert_buffer = NULL;

    pki_applet_data->cert_buffer_len = 0;

    pki_applet_data->sign_buffer = NULL;

    pki_applet_data->sign_buffer_len = 0;

    pki_applet_data->key = NULL;

    pki_applet_data->cert = (unsigned char *)qemu_malloc(cert_len+1);

    /*

     * if we want to support compression, then we simply change the 0 to a 1

     * and compress the cert data with libz

     */

    pki_applet_data->cert[0] = 0; /* not compressed */

    memcpy(&pki_applet_data->cert[1], cert, cert_len);

    pki_applet_data->cert_len = cert_len+1;

    pki_applet_data->key = key;

    return applet_private;

}

/*

 * create a new cac applet which links to a given cert

 */

static VCardApplet *

cac_new_pki_applet(int i, const unsigned char *cert,

                   int cert_len, VCardKey *key)

{

    VCardAppletPrivate *applet_private = NULL;

    VCardApplet *applet = NULL;

    unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 };

    int pki_aid_len = sizeof(pki_aid);

    pki_aid[pki_aid_len-1] = i;

    applet_private = cac_new_pki_applet_private(cert, cert_len, key);

    if (applet_private == NULL) {

        goto failure;

    }

    applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset,

                              pki_aid, pki_aid_len);

    if (applet == NULL) {

        goto failure;

    }

    vcard_set_applet_private(applet, applet_private,

                             cac_delete_pki_applet_private);

    applet_private = NULL;

    return applet;

failure:

    if (applet_private != NULL) {

        cac_delete_pki_applet_private(applet_private);

    }

    return NULL;

}

static unsigned char cac_default_container_aid[] = {

    0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 };

static unsigned char cac_id_aid[] = {

    0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 };

/*

 * Initialize the cac card. This is the only public function in this file. All

 * the rest are connected through function pointers.

 */

VCardStatus

cac_card_init(VReader *reader, VCard *card,

              const char *params,

              unsigned char * const *cert,

              int cert_len[],

              VCardKey *key[] /* adopt the keys*/,

              int cert_count)

{

    int i;

    VCardApplet *applet;

    /* CAC Cards are VM Cards */

    vcard_set_type(card, VCARD_VM);

    /* create one PKI applet for each cert */

    for (i = 0; i < cert_count; i++) {

        applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]);

        if (applet == NULL) {

            goto failure;

        }

        vcard_add_applet(card, applet);

    }

    /* create a default blank container applet */

    applet = vcard_new_applet(cac_applet_container_process_apdu,

                              NULL, cac_default_container_aid,

                              sizeof(cac_default_container_aid));

    if (applet == NULL) {

        goto failure;

    }

    vcard_add_applet(card, applet);

    /* create a default blank container applet */

    applet = vcard_new_applet(cac_applet_id_process_apdu,

                              NULL, cac_id_aid,

                              sizeof(cac_id_aid));

    if (applet == NULL) {

        goto failure;

    }

    vcard_add_applet(card, applet);

    return VCARD_DONE;

failure:

    return VCARD_FAIL;

}