security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-22 10:19:57 +01:00
Code Activity

scd: Detect external interference when PCSC_SHARED.

Browse Source 
* scd/app-common.h (check_aid): New method.
* scd/app-openpgp.c (do_check_aid): New.
* scd/app-piv.c (do_check_aid): New.
* scd/app.c (check_external_interference): New.
(maybe_switch_app): Check interference to determine switching is
needed.

--

GnuPG-bug-id: 5484
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
This commit is contained in:
NIIBE Yutaka 2021-07-06 14:52:29 +09:00
parent 5f78ae696c
commit 044e5a3c38
4 changed files with 72 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
scd/app-common.h
View File

@ -194,6 +194,8 @@ struct app_ctx_s {
void *pincb_arg);
gpg_error_t (*with_keygrip) (app_t app, ctrl_t ctrl, int action,
const char *keygrip_str, int capability);
gpg_error_t (*check_aid) (app_t app, ctrl_t ctrl,
const unsigned char *aid, size_t aidlen);
} fnc;
};

13
scd/app-openpgp.c
View File

@ -6134,6 +6134,18 @@ do_reselect (app_t app, ctrl_t ctrl)
}
/* Check if AID is the correct one. */
static gpg_error_t
do_check_aid (app_t app, ctrl_t ctrl, const unsigned char *aid, size_t aidlen)
{
if (aidlen >= sizeof openpgp_aid
&& memcmp (aid, openpgp_aid, sizeof openpgp_aid) == 0)
return 0;
return gpg_error (GPG_ERR_WRONG_CARD);
}
/* Select the OpenPGP application on the card in SLOT. This function
must be used before any other OpenPGP application functions. */
gpg_error_t
@ -6322,6 +6334,7 @@ app_select_openpgp (app_t app)
app->fnc.change_pin = do_change_pin;
app->fnc.check_pin = do_check_pin;
app->fnc.with_keygrip = do_with_keygrip;
app->fnc.check_aid = do_check_aid;
}
leave:

13
scd/app-piv.c
View File

@ -3609,6 +3609,18 @@ do_reselect (app_t app, ctrl_t ctrl)
}
/* Check if AID is the correct one. */
static gpg_error_t
do_check_aid (app_t app, ctrl_t ctrl, const unsigned char *aid, size_t aidlen)
{
if (aidlen >= sizeof piv_aid
&& memcmp (aid, piv_aid, sizeof piv_aid) == 0)
return 0;
return gpg_error (GPG_ERR_WRONG_CARD);
}
/* Select the PIV application on the card in SLOT. This function must
* be used before any other PIV application functions. */
gpg_error_t
@ -3713,6 +3725,7 @@ app_select_piv (app_t app)
app->fnc.change_pin = do_change_chv;
app->fnc.check_pin = do_check_chv;
app->fnc.with_keygrip = do_with_keygrip;
app->fnc.check_aid = do_check_aid;
leave:

42
scd/app.c
View File

@ -1435,6 +1435,46 @@ run_reselect (ctrl_t ctrl, card_t c, app_t a, app_t a_prev)
}
/*
* Check external interference before each use of the application on
* card. Returns -1 when detecting some external interference.
* Returns 0 if not.
*
* Note: This kind of detection can't be perfect. At most, it may be
* possibly useful kludge, in some limited situations.
*/
static int
check_external_interference (app_t app, ctrl_t ctrl)
{
/*
* Only when a user is using Yubikey with pcsc-shared configuration,
* we need this detection. Otherwise, the card/token is under full
* control of scdaemon, there's no problem at all.
*/
if (!opt.pcsc_shared || app->card->cardtype != CARDTYPE_YUBIKEY)
return 0;
if (app->fnc.check_aid)
{
unsigned char *aid;
size_t aidlen;
gpg_error_t err;
int slot = app_get_slot (app);
err = iso7816_get_data (slot, 0, 0x004F, &aid, &aidlen);
if (err)
return -1;
err = app->fnc.check_aid (app, ctrl, aid, aidlen);
xfree (aid);
if (err)
return -1;
}
return 0;
}
/* Check that the card has been initialized and whether we need to
* switch to another application on the same card. Switching means
* that the new active app will be moved to the head of the list at
@ -1490,6 +1530,7 @@ maybe_switch_app (ctrl_t ctrl, card_t card, const char *keyref)
if (app->apptype == apptype)
break;
if (!app_prev && ctrl->current_apptype == card->app->apptype)
if (check_external_interference (app, ctrl) == 0)
return 0; /* Already the first app - no need to switch. */
}
else if (strlen (keyref) == 40)
@ -1503,6 +1544,7 @@ maybe_switch_app (ctrl_t ctrl, card_t card, const char *keyref)
KEYGRIP_ACTION_LOOKUP, keyref, 0))
break;
if (!app_prev && ctrl->current_apptype == card->app->apptype)
if (check_external_interference (app, ctrl) == 0)
return 0; /* Already the first app - no need to switch. */
}
}