405 lines
13 KiB
C
405 lines
13 KiB
C
/*
|
|
* implement the applets for the CAC card.
|
|
*
|
|
* This code is licensed under the GNU LGPL, version 2.1 or later.
|
|
* See the COPYING.LIB file in the top-level directory.
|
|
*/
|
|
|
|
#include "qemu-common.h"
|
|
|
|
#include "cac.h"
|
|
#include "vcard.h"
|
|
#include "vcard_emul.h"
|
|
#include "card_7816.h"
|
|
|
|
#define CAC_GET_PROPERTIES 0x56
|
|
#define CAC_GET_ACR 0x4c
|
|
#define CAC_READ_BUFFER 0x52
|
|
#define CAC_UPDATE_BUFFER 0x58
|
|
#define CAC_SIGN_DECRYPT 0x42
|
|
#define CAC_GET_CERTIFICATE 0x36
|
|
|
|
/* private data for PKI applets */
|
|
typedef struct CACPKIAppletDataStruct {
|
|
unsigned char *cert;
|
|
int cert_len;
|
|
unsigned char *cert_buffer;
|
|
int cert_buffer_len;
|
|
unsigned char *sign_buffer;
|
|
int sign_buffer_len;
|
|
VCardKey *key;
|
|
} CACPKIAppletData;
|
|
|
|
/*
|
|
* CAC applet private data
|
|
*/
|
|
struct VCardAppletPrivateStruct {
|
|
union {
|
|
CACPKIAppletData pki_data;
|
|
void *reserved;
|
|
} u;
|
|
};
|
|
|
|
/*
|
|
* handle all the APDU's that are common to all CAC applets
|
|
*/
|
|
static VCardStatus
|
|
cac_common_process_apdu(VCard *card, VCardAPDU *apdu, VCardResponse **response)
|
|
{
|
|
int ef;
|
|
|
|
switch (apdu->a_ins) {
|
|
case VCARD7816_INS_SELECT_FILE:
|
|
if (apdu->a_p1 != 0x02) {
|
|
/* let the 7816 code handle applet switches */
|
|
return VCARD_NEXT;
|
|
}
|
|
/* handle file id setting */
|
|
if (apdu->a_Lc != 2) {
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_ERROR_DATA_INVALID);
|
|
return VCARD_DONE;
|
|
}
|
|
/* CAC 1.0 only supports ef = 0 */
|
|
ef = apdu->a_body[0] | (apdu->a_body[1] << 8);
|
|
if (ef != 0) {
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_ERROR_FILE_NOT_FOUND);
|
|
return VCARD_DONE;
|
|
}
|
|
*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
|
|
return VCARD_DONE;
|
|
case VCARD7816_INS_GET_RESPONSE:
|
|
case VCARD7816_INS_VERIFY:
|
|
/* let the 7816 code handle these */
|
|
return VCARD_NEXT;
|
|
case CAC_GET_PROPERTIES:
|
|
case CAC_GET_ACR:
|
|
/* skip these for now, this will probably be needed */
|
|
*response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
|
|
return VCARD_DONE;
|
|
}
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
|
|
return VCARD_DONE;
|
|
}
|
|
|
|
/*
|
|
* reset the inter call state between applet selects
|
|
*/
|
|
static VCardStatus
|
|
cac_applet_pki_reset(VCard *card, int channel)
|
|
{
|
|
VCardAppletPrivate *applet_private = NULL;
|
|
CACPKIAppletData *pki_applet = NULL;
|
|
applet_private = vcard_get_current_applet_private(card, channel);
|
|
assert(applet_private);
|
|
pki_applet = &(applet_private->u.pki_data);
|
|
|
|
pki_applet->cert_buffer = NULL;
|
|
if (pki_applet->sign_buffer) {
|
|
g_free(pki_applet->sign_buffer);
|
|
pki_applet->sign_buffer = NULL;
|
|
}
|
|
pki_applet->cert_buffer_len = 0;
|
|
pki_applet->sign_buffer_len = 0;
|
|
return VCARD_DONE;
|
|
}
|
|
|
|
static VCardStatus
|
|
cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
|
|
VCardResponse **response)
|
|
{
|
|
CACPKIAppletData *pki_applet = NULL;
|
|
VCardAppletPrivate *applet_private = NULL;
|
|
int size, next;
|
|
unsigned char *sign_buffer;
|
|
vcard_7816_status_t status;
|
|
|
|
applet_private = vcard_get_current_applet_private(card, apdu->a_channel);
|
|
assert(applet_private);
|
|
pki_applet = &(applet_private->u.pki_data);
|
|
|
|
switch (apdu->a_ins) {
|
|
case CAC_UPDATE_BUFFER:
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
|
|
return VCARD_DONE;
|
|
case CAC_GET_CERTIFICATE:
|
|
if ((apdu->a_p2 != 0) || (apdu->a_p1 != 0)) {
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
|
|
break;
|
|
}
|
|
assert(pki_applet->cert != NULL);
|
|
size = apdu->a_Le;
|
|
if (pki_applet->cert_buffer == NULL) {
|
|
pki_applet->cert_buffer = pki_applet->cert;
|
|
pki_applet->cert_buffer_len = pki_applet->cert_len;
|
|
}
|
|
size = MIN(size, pki_applet->cert_buffer_len);
|
|
next = MIN(255, pki_applet->cert_buffer_len - size);
|
|
*response = vcard_response_new_bytes(
|
|
card, pki_applet->cert_buffer, size,
|
|
apdu->a_Le, next ?
|
|
VCARD7816_SW1_WARNING_CHANGE :
|
|
VCARD7816_SW1_SUCCESS,
|
|
next);
|
|
pki_applet->cert_buffer += size;
|
|
pki_applet->cert_buffer_len -= size;
|
|
if ((*response == NULL) || (next == 0)) {
|
|
pki_applet->cert_buffer = NULL;
|
|
}
|
|
if (*response == NULL) {
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
|
|
}
|
|
return VCARD_DONE;
|
|
case CAC_SIGN_DECRYPT:
|
|
if (apdu->a_p2 != 0) {
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
|
|
break;
|
|
}
|
|
size = apdu->a_Lc;
|
|
|
|
sign_buffer = realloc(pki_applet->sign_buffer,
|
|
pki_applet->sign_buffer_len+size);
|
|
if (sign_buffer == NULL) {
|
|
g_free(pki_applet->sign_buffer);
|
|
pki_applet->sign_buffer = NULL;
|
|
pki_applet->sign_buffer_len = 0;
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
|
|
return VCARD_DONE;
|
|
}
|
|
memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size);
|
|
size += pki_applet->sign_buffer_len;
|
|
switch (apdu->a_p1) {
|
|
case 0x80:
|
|
/* p1 == 0x80 means we haven't yet sent the whole buffer, wait for
|
|
* the rest */
|
|
pki_applet->sign_buffer = sign_buffer;
|
|
pki_applet->sign_buffer_len = size;
|
|
*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
|
|
return VCARD_DONE;
|
|
case 0x00:
|
|
/* we now have the whole buffer, do the operation, result will be
|
|
* in the sign_buffer */
|
|
status = vcard_emul_rsa_op(card, pki_applet->key,
|
|
sign_buffer, size);
|
|
if (status != VCARD7816_STATUS_SUCCESS) {
|
|
*response = vcard_make_response(status);
|
|
break;
|
|
}
|
|
*response = vcard_response_new(card, sign_buffer, size, apdu->a_Le,
|
|
VCARD7816_STATUS_SUCCESS);
|
|
if (*response == NULL) {
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
|
|
}
|
|
break;
|
|
default:
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
|
|
break;
|
|
}
|
|
g_free(sign_buffer);
|
|
pki_applet->sign_buffer = NULL;
|
|
pki_applet->sign_buffer_len = 0;
|
|
return VCARD_DONE;
|
|
case CAC_READ_BUFFER:
|
|
/* new CAC call, go ahead and use the old version for now */
|
|
/* TODO: implement */
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
|
|
return VCARD_DONE;
|
|
}
|
|
return cac_common_process_apdu(card, apdu, response);
|
|
}
|
|
|
|
|
|
static VCardStatus
|
|
cac_applet_id_process_apdu(VCard *card, VCardAPDU *apdu,
|
|
VCardResponse **response)
|
|
{
|
|
switch (apdu->a_ins) {
|
|
case CAC_UPDATE_BUFFER:
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
|
|
return VCARD_DONE;
|
|
case CAC_READ_BUFFER:
|
|
/* new CAC call, go ahead and use the old version for now */
|
|
/* TODO: implement */
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
|
|
return VCARD_DONE;
|
|
}
|
|
return cac_common_process_apdu(card, apdu, response);
|
|
}
|
|
|
|
|
|
/*
|
|
* TODO: if we ever want to support general CAC middleware, we will need to
|
|
* implement the various containers.
|
|
*/
|
|
static VCardStatus
|
|
cac_applet_container_process_apdu(VCard *card, VCardAPDU *apdu,
|
|
VCardResponse **response)
|
|
{
|
|
switch (apdu->a_ins) {
|
|
case CAC_READ_BUFFER:
|
|
case CAC_UPDATE_BUFFER:
|
|
*response = vcard_make_response(
|
|
VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
|
|
return VCARD_DONE;
|
|
default:
|
|
break;
|
|
}
|
|
return cac_common_process_apdu(card, apdu, response);
|
|
}
|
|
|
|
/*
|
|
* utilities for creating and destroying the private applet data
|
|
*/
|
|
static void
|
|
cac_delete_pki_applet_private(VCardAppletPrivate *applet_private)
|
|
{
|
|
CACPKIAppletData *pki_applet_data = NULL;
|
|
|
|
if (applet_private == NULL) {
|
|
return;
|
|
}
|
|
pki_applet_data = &(applet_private->u.pki_data);
|
|
if (pki_applet_data->cert != NULL) {
|
|
g_free(pki_applet_data->cert);
|
|
}
|
|
if (pki_applet_data->sign_buffer != NULL) {
|
|
g_free(pki_applet_data->sign_buffer);
|
|
}
|
|
if (pki_applet_data->key != NULL) {
|
|
vcard_emul_delete_key(pki_applet_data->key);
|
|
}
|
|
g_free(applet_private);
|
|
}
|
|
|
|
static VCardAppletPrivate *
|
|
cac_new_pki_applet_private(const unsigned char *cert,
|
|
int cert_len, VCardKey *key)
|
|
{
|
|
CACPKIAppletData *pki_applet_data = NULL;
|
|
VCardAppletPrivate *applet_private = NULL;
|
|
applet_private = (VCardAppletPrivate *)g_malloc(sizeof(VCardAppletPrivate));
|
|
|
|
pki_applet_data = &(applet_private->u.pki_data);
|
|
pki_applet_data->cert_buffer = NULL;
|
|
pki_applet_data->cert_buffer_len = 0;
|
|
pki_applet_data->sign_buffer = NULL;
|
|
pki_applet_data->sign_buffer_len = 0;
|
|
pki_applet_data->key = NULL;
|
|
pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1);
|
|
/*
|
|
* if we want to support compression, then we simply change the 0 to a 1
|
|
* and compress the cert data with libz
|
|
*/
|
|
pki_applet_data->cert[0] = 0; /* not compressed */
|
|
memcpy(&pki_applet_data->cert[1], cert, cert_len);
|
|
pki_applet_data->cert_len = cert_len+1;
|
|
|
|
pki_applet_data->key = key;
|
|
return applet_private;
|
|
}
|
|
|
|
|
|
/*
|
|
* create a new cac applet which links to a given cert
|
|
*/
|
|
static VCardApplet *
|
|
cac_new_pki_applet(int i, const unsigned char *cert,
|
|
int cert_len, VCardKey *key)
|
|
{
|
|
VCardAppletPrivate *applet_private = NULL;
|
|
VCardApplet *applet = NULL;
|
|
unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 };
|
|
int pki_aid_len = sizeof(pki_aid);
|
|
|
|
pki_aid[pki_aid_len-1] = i;
|
|
|
|
applet_private = cac_new_pki_applet_private(cert, cert_len, key);
|
|
if (applet_private == NULL) {
|
|
goto failure;
|
|
}
|
|
applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset,
|
|
pki_aid, pki_aid_len);
|
|
if (applet == NULL) {
|
|
goto failure;
|
|
}
|
|
vcard_set_applet_private(applet, applet_private,
|
|
cac_delete_pki_applet_private);
|
|
applet_private = NULL;
|
|
|
|
return applet;
|
|
|
|
failure:
|
|
if (applet_private != NULL) {
|
|
cac_delete_pki_applet_private(applet_private);
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
|
|
static unsigned char cac_default_container_aid[] = {
|
|
0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 };
|
|
static unsigned char cac_id_aid[] = {
|
|
0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 };
|
|
/*
|
|
* Initialize the cac card. This is the only public function in this file. All
|
|
* the rest are connected through function pointers.
|
|
*/
|
|
VCardStatus
|
|
cac_card_init(VReader *reader, VCard *card,
|
|
const char *params,
|
|
unsigned char * const *cert,
|
|
int cert_len[],
|
|
VCardKey *key[] /* adopt the keys*/,
|
|
int cert_count)
|
|
{
|
|
int i;
|
|
VCardApplet *applet;
|
|
|
|
/* CAC Cards are VM Cards */
|
|
vcard_set_type(card, VCARD_VM);
|
|
|
|
/* create one PKI applet for each cert */
|
|
for (i = 0; i < cert_count; i++) {
|
|
applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]);
|
|
if (applet == NULL) {
|
|
goto failure;
|
|
}
|
|
vcard_add_applet(card, applet);
|
|
}
|
|
|
|
/* create a default blank container applet */
|
|
applet = vcard_new_applet(cac_applet_container_process_apdu,
|
|
NULL, cac_default_container_aid,
|
|
sizeof(cac_default_container_aid));
|
|
if (applet == NULL) {
|
|
goto failure;
|
|
}
|
|
vcard_add_applet(card, applet);
|
|
|
|
/* create a default blank container applet */
|
|
applet = vcard_new_applet(cac_applet_id_process_apdu,
|
|
NULL, cac_id_aid,
|
|
sizeof(cac_id_aid));
|
|
if (applet == NULL) {
|
|
goto failure;
|
|
}
|
|
vcard_add_applet(card, applet);
|
|
return VCARD_DONE;
|
|
|
|
failure:
|
|
return VCARD_FAIL;
|
|
}
|
|
|