root / libcacard / cac.c @ 7267c094
History | View | Annotate | Download (12.6 kB)
1 |
/*
|
---|---|
2 |
* implement the applets for the CAC card.
|
3 |
*
|
4 |
* This code is licensed under the GNU LGPL, version 2.1 or later.
|
5 |
* See the COPYING.LIB file in the top-level directory.
|
6 |
*/
|
7 |
|
8 |
#include "qemu-common.h" |
9 |
|
10 |
#include "cac.h" |
11 |
#include "vcard.h" |
12 |
#include "vcard_emul.h" |
13 |
#include "card_7816.h" |
14 |
|
15 |
#define CAC_GET_PROPERTIES 0x56 |
16 |
#define CAC_GET_ACR 0x4c |
17 |
#define CAC_READ_BUFFER 0x52 |
18 |
#define CAC_UPDATE_BUFFER 0x58 |
19 |
#define CAC_SIGN_DECRYPT 0x42 |
20 |
#define CAC_GET_CERTIFICATE 0x36 |
21 |
|
22 |
/* private data for PKI applets */
|
23 |
typedef struct CACPKIAppletDataStruct { |
24 |
unsigned char *cert; |
25 |
int cert_len;
|
26 |
unsigned char *cert_buffer; |
27 |
int cert_buffer_len;
|
28 |
unsigned char *sign_buffer; |
29 |
int sign_buffer_len;
|
30 |
VCardKey *key; |
31 |
} CACPKIAppletData; |
32 |
|
33 |
/*
|
34 |
* CAC applet private data
|
35 |
*/
|
36 |
struct VCardAppletPrivateStruct {
|
37 |
union {
|
38 |
CACPKIAppletData pki_data; |
39 |
void *reserved;
|
40 |
} u; |
41 |
}; |
42 |
|
43 |
/*
|
44 |
* handle all the APDU's that are common to all CAC applets
|
45 |
*/
|
46 |
static VCardStatus
|
47 |
cac_common_process_apdu(VCard *card, VCardAPDU *apdu, VCardResponse **response) |
48 |
{ |
49 |
int ef;
|
50 |
|
51 |
switch (apdu->a_ins) {
|
52 |
case VCARD7816_INS_SELECT_FILE:
|
53 |
if (apdu->a_p1 != 0x02) { |
54 |
/* let the 7816 code handle applet switches */
|
55 |
return VCARD_NEXT;
|
56 |
} |
57 |
/* handle file id setting */
|
58 |
if (apdu->a_Lc != 2) { |
59 |
*response = vcard_make_response( |
60 |
VCARD7816_STATUS_ERROR_DATA_INVALID); |
61 |
return VCARD_DONE;
|
62 |
} |
63 |
/* CAC 1.0 only supports ef = 0 */
|
64 |
ef = apdu->a_body[0] | (apdu->a_body[1] << 8); |
65 |
if (ef != 0) { |
66 |
*response = vcard_make_response( |
67 |
VCARD7816_STATUS_ERROR_FILE_NOT_FOUND); |
68 |
return VCARD_DONE;
|
69 |
} |
70 |
*response = vcard_make_response(VCARD7816_STATUS_SUCCESS); |
71 |
return VCARD_DONE;
|
72 |
case VCARD7816_INS_GET_RESPONSE:
|
73 |
case VCARD7816_INS_VERIFY:
|
74 |
/* let the 7816 code handle these */
|
75 |
return VCARD_NEXT;
|
76 |
case CAC_GET_PROPERTIES:
|
77 |
case CAC_GET_ACR:
|
78 |
/* skip these for now, this will probably be needed */
|
79 |
*response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT); |
80 |
return VCARD_DONE;
|
81 |
} |
82 |
*response = vcard_make_response( |
83 |
VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED); |
84 |
return VCARD_DONE;
|
85 |
} |
86 |
|
87 |
/*
|
88 |
* reset the inter call state between applet selects
|
89 |
*/
|
90 |
static VCardStatus
|
91 |
cac_applet_pki_reset(VCard *card, int channel)
|
92 |
{ |
93 |
VCardAppletPrivate *applet_private = NULL;
|
94 |
CACPKIAppletData *pki_applet = NULL;
|
95 |
applet_private = vcard_get_current_applet_private(card, channel); |
96 |
assert(applet_private); |
97 |
pki_applet = &(applet_private->u.pki_data); |
98 |
|
99 |
pki_applet->cert_buffer = NULL;
|
100 |
if (pki_applet->sign_buffer) {
|
101 |
g_free(pki_applet->sign_buffer); |
102 |
pki_applet->sign_buffer = NULL;
|
103 |
} |
104 |
pki_applet->cert_buffer_len = 0;
|
105 |
pki_applet->sign_buffer_len = 0;
|
106 |
return VCARD_DONE;
|
107 |
} |
108 |
|
109 |
static VCardStatus
|
110 |
cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu, |
111 |
VCardResponse **response) |
112 |
{ |
113 |
CACPKIAppletData *pki_applet = NULL;
|
114 |
VCardAppletPrivate *applet_private = NULL;
|
115 |
int size, next;
|
116 |
unsigned char *sign_buffer; |
117 |
vcard_7816_status_t status; |
118 |
|
119 |
applet_private = vcard_get_current_applet_private(card, apdu->a_channel); |
120 |
assert(applet_private); |
121 |
pki_applet = &(applet_private->u.pki_data); |
122 |
|
123 |
switch (apdu->a_ins) {
|
124 |
case CAC_UPDATE_BUFFER:
|
125 |
*response = vcard_make_response( |
126 |
VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED); |
127 |
return VCARD_DONE;
|
128 |
case CAC_GET_CERTIFICATE:
|
129 |
if ((apdu->a_p2 != 0) || (apdu->a_p1 != 0)) { |
130 |
*response = vcard_make_response( |
131 |
VCARD7816_STATUS_ERROR_P1_P2_INCORRECT); |
132 |
break;
|
133 |
} |
134 |
assert(pki_applet->cert != NULL);
|
135 |
size = apdu->a_Le; |
136 |
if (pki_applet->cert_buffer == NULL) { |
137 |
pki_applet->cert_buffer = pki_applet->cert; |
138 |
pki_applet->cert_buffer_len = pki_applet->cert_len; |
139 |
} |
140 |
size = MIN(size, pki_applet->cert_buffer_len); |
141 |
next = MIN(255, pki_applet->cert_buffer_len - size);
|
142 |
*response = vcard_response_new_bytes( |
143 |
card, pki_applet->cert_buffer, size, |
144 |
apdu->a_Le, next ? |
145 |
VCARD7816_SW1_WARNING_CHANGE : |
146 |
VCARD7816_SW1_SUCCESS, |
147 |
next); |
148 |
pki_applet->cert_buffer += size; |
149 |
pki_applet->cert_buffer_len -= size; |
150 |
if ((*response == NULL) || (next == 0)) { |
151 |
pki_applet->cert_buffer = NULL;
|
152 |
} |
153 |
if (*response == NULL) { |
154 |
*response = vcard_make_response( |
155 |
VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE); |
156 |
} |
157 |
return VCARD_DONE;
|
158 |
case CAC_SIGN_DECRYPT:
|
159 |
if (apdu->a_p2 != 0) { |
160 |
*response = vcard_make_response( |
161 |
VCARD7816_STATUS_ERROR_P1_P2_INCORRECT); |
162 |
break;
|
163 |
} |
164 |
size = apdu->a_Lc; |
165 |
|
166 |
sign_buffer = realloc(pki_applet->sign_buffer, |
167 |
pki_applet->sign_buffer_len+size); |
168 |
if (sign_buffer == NULL) { |
169 |
g_free(pki_applet->sign_buffer); |
170 |
pki_applet->sign_buffer = NULL;
|
171 |
pki_applet->sign_buffer_len = 0;
|
172 |
*response = vcard_make_response( |
173 |
VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE); |
174 |
return VCARD_DONE;
|
175 |
} |
176 |
memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size); |
177 |
size += pki_applet->sign_buffer_len; |
178 |
switch (apdu->a_p1) {
|
179 |
case 0x80: |
180 |
/* p1 == 0x80 means we haven't yet sent the whole buffer, wait for
|
181 |
* the rest */
|
182 |
pki_applet->sign_buffer = sign_buffer; |
183 |
pki_applet->sign_buffer_len = size; |
184 |
*response = vcard_make_response(VCARD7816_STATUS_SUCCESS); |
185 |
return VCARD_DONE;
|
186 |
case 0x00: |
187 |
/* we now have the whole buffer, do the operation, result will be
|
188 |
* in the sign_buffer */
|
189 |
status = vcard_emul_rsa_op(card, pki_applet->key, |
190 |
sign_buffer, size); |
191 |
if (status != VCARD7816_STATUS_SUCCESS) {
|
192 |
*response = vcard_make_response(status); |
193 |
break;
|
194 |
} |
195 |
*response = vcard_response_new(card, sign_buffer, size, apdu->a_Le, |
196 |
VCARD7816_STATUS_SUCCESS); |
197 |
if (*response == NULL) { |
198 |
*response = vcard_make_response( |
199 |
VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE); |
200 |
} |
201 |
break;
|
202 |
default:
|
203 |
*response = vcard_make_response( |
204 |
VCARD7816_STATUS_ERROR_P1_P2_INCORRECT); |
205 |
break;
|
206 |
} |
207 |
g_free(sign_buffer); |
208 |
pki_applet->sign_buffer = NULL;
|
209 |
pki_applet->sign_buffer_len = 0;
|
210 |
return VCARD_DONE;
|
211 |
case CAC_READ_BUFFER:
|
212 |
/* new CAC call, go ahead and use the old version for now */
|
213 |
/* TODO: implement */
|
214 |
*response = vcard_make_response( |
215 |
VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED); |
216 |
return VCARD_DONE;
|
217 |
} |
218 |
return cac_common_process_apdu(card, apdu, response);
|
219 |
} |
220 |
|
221 |
|
222 |
static VCardStatus
|
223 |
cac_applet_id_process_apdu(VCard *card, VCardAPDU *apdu, |
224 |
VCardResponse **response) |
225 |
{ |
226 |
switch (apdu->a_ins) {
|
227 |
case CAC_UPDATE_BUFFER:
|
228 |
*response = vcard_make_response( |
229 |
VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED); |
230 |
return VCARD_DONE;
|
231 |
case CAC_READ_BUFFER:
|
232 |
/* new CAC call, go ahead and use the old version for now */
|
233 |
/* TODO: implement */
|
234 |
*response = vcard_make_response( |
235 |
VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED); |
236 |
return VCARD_DONE;
|
237 |
} |
238 |
return cac_common_process_apdu(card, apdu, response);
|
239 |
} |
240 |
|
241 |
|
242 |
/*
|
243 |
* TODO: if we ever want to support general CAC middleware, we will need to
|
244 |
* implement the various containers.
|
245 |
*/
|
246 |
static VCardStatus
|
247 |
cac_applet_container_process_apdu(VCard *card, VCardAPDU *apdu, |
248 |
VCardResponse **response) |
249 |
{ |
250 |
switch (apdu->a_ins) {
|
251 |
case CAC_READ_BUFFER:
|
252 |
case CAC_UPDATE_BUFFER:
|
253 |
*response = vcard_make_response( |
254 |
VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED); |
255 |
return VCARD_DONE;
|
256 |
default:
|
257 |
break;
|
258 |
} |
259 |
return cac_common_process_apdu(card, apdu, response);
|
260 |
} |
261 |
|
262 |
/*
|
263 |
* utilities for creating and destroying the private applet data
|
264 |
*/
|
265 |
static void |
266 |
cac_delete_pki_applet_private(VCardAppletPrivate *applet_private) |
267 |
{ |
268 |
CACPKIAppletData *pki_applet_data = NULL;
|
269 |
if (pki_applet_data == NULL) { |
270 |
return;
|
271 |
} |
272 |
pki_applet_data = &(applet_private->u.pki_data); |
273 |
if (pki_applet_data->cert != NULL) { |
274 |
g_free(pki_applet_data->cert); |
275 |
} |
276 |
if (pki_applet_data->sign_buffer != NULL) { |
277 |
g_free(pki_applet_data->sign_buffer); |
278 |
} |
279 |
if (pki_applet_data->key != NULL) { |
280 |
vcard_emul_delete_key(pki_applet_data->key); |
281 |
} |
282 |
g_free(applet_private); |
283 |
} |
284 |
|
285 |
static VCardAppletPrivate *
|
286 |
cac_new_pki_applet_private(const unsigned char *cert, |
287 |
int cert_len, VCardKey *key)
|
288 |
{ |
289 |
CACPKIAppletData *pki_applet_data = NULL;
|
290 |
VCardAppletPrivate *applet_private = NULL;
|
291 |
applet_private = (VCardAppletPrivate *)g_malloc(sizeof(VCardAppletPrivate));
|
292 |
|
293 |
pki_applet_data = &(applet_private->u.pki_data); |
294 |
pki_applet_data->cert_buffer = NULL;
|
295 |
pki_applet_data->cert_buffer_len = 0;
|
296 |
pki_applet_data->sign_buffer = NULL;
|
297 |
pki_applet_data->sign_buffer_len = 0;
|
298 |
pki_applet_data->key = NULL;
|
299 |
pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1); |
300 |
/*
|
301 |
* if we want to support compression, then we simply change the 0 to a 1
|
302 |
* and compress the cert data with libz
|
303 |
*/
|
304 |
pki_applet_data->cert[0] = 0; /* not compressed */ |
305 |
memcpy(&pki_applet_data->cert[1], cert, cert_len);
|
306 |
pki_applet_data->cert_len = cert_len+1;
|
307 |
|
308 |
pki_applet_data->key = key; |
309 |
return applet_private;
|
310 |
} |
311 |
|
312 |
|
313 |
/*
|
314 |
* create a new cac applet which links to a given cert
|
315 |
*/
|
316 |
static VCardApplet *
|
317 |
cac_new_pki_applet(int i, const unsigned char *cert, |
318 |
int cert_len, VCardKey *key)
|
319 |
{ |
320 |
VCardAppletPrivate *applet_private = NULL;
|
321 |
VCardApplet *applet = NULL;
|
322 |
unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 }; |
323 |
int pki_aid_len = sizeof(pki_aid); |
324 |
|
325 |
pki_aid[pki_aid_len-1] = i;
|
326 |
|
327 |
applet_private = cac_new_pki_applet_private(cert, cert_len, key); |
328 |
if (applet_private == NULL) { |
329 |
goto failure;
|
330 |
} |
331 |
applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset, |
332 |
pki_aid, pki_aid_len); |
333 |
if (applet == NULL) { |
334 |
goto failure;
|
335 |
} |
336 |
vcard_set_applet_private(applet, applet_private, |
337 |
cac_delete_pki_applet_private); |
338 |
applet_private = NULL;
|
339 |
|
340 |
return applet;
|
341 |
|
342 |
failure:
|
343 |
if (applet_private != NULL) { |
344 |
cac_delete_pki_applet_private(applet_private); |
345 |
} |
346 |
return NULL; |
347 |
} |
348 |
|
349 |
|
350 |
static unsigned char cac_default_container_aid[] = { |
351 |
0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 }; |
352 |
static unsigned char cac_id_aid[] = { |
353 |
0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 }; |
354 |
/*
|
355 |
* Initialize the cac card. This is the only public function in this file. All
|
356 |
* the rest are connected through function pointers.
|
357 |
*/
|
358 |
VCardStatus |
359 |
cac_card_init(VReader *reader, VCard *card, |
360 |
const char *params, |
361 |
unsigned char * const *cert, |
362 |
int cert_len[],
|
363 |
VCardKey *key[] /* adopt the keys*/,
|
364 |
int cert_count)
|
365 |
{ |
366 |
int i;
|
367 |
VCardApplet *applet; |
368 |
|
369 |
/* CAC Cards are VM Cards */
|
370 |
vcard_set_type(card, VCARD_VM); |
371 |
|
372 |
/* create one PKI applet for each cert */
|
373 |
for (i = 0; i < cert_count; i++) { |
374 |
applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]); |
375 |
if (applet == NULL) { |
376 |
goto failure;
|
377 |
} |
378 |
vcard_add_applet(card, applet); |
379 |
} |
380 |
|
381 |
/* create a default blank container applet */
|
382 |
applet = vcard_new_applet(cac_applet_container_process_apdu, |
383 |
NULL, cac_default_container_aid,
|
384 |
sizeof(cac_default_container_aid));
|
385 |
if (applet == NULL) { |
386 |
goto failure;
|
387 |
} |
388 |
vcard_add_applet(card, applet); |
389 |
|
390 |
/* create a default blank container applet */
|
391 |
applet = vcard_new_applet(cac_applet_id_process_apdu, |
392 |
NULL, cac_id_aid,
|
393 |
sizeof(cac_id_aid));
|
394 |
if (applet == NULL) { |
395 |
goto failure;
|
396 |
} |
397 |
vcard_add_applet(card, applet); |
398 |
return VCARD_DONE;
|
399 |
|
400 |
failure:
|
401 |
return VCARD_FAIL;
|
402 |
} |
403 |
|