mirror of
git://git.gnupg.org/gnupg.git
synced 2025-07-02 22:46:30 +02:00
This commit was manufactured by cvs2svn to create branch
'GNUPG-1-9-BRANCH'.
This commit is contained in:
Repo Admin
parent
a3d4ac6f3e
commit
7250331472
77 changed files with 58548 additions and 0 deletions
287
scd/atr.c
Normal file
287
scd/atr.c
Normal file
|
|
@ -0,0 +1,287 @@
|
|||
/* atr.c - ISO 7816 ATR fucntions
|
||||
* Copyright (C) 2003 Free Software Foundation, Inc.
|
||||
*
|
||||
* This file is part of GnuPG.
|
||||
*
|
||||
* GnuPG is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* GnuPG is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
|
||||
*/
|
||||
|
||||
#include <config.h>
|
||||
#include <errno.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <dlfcn.h>
|
||||
#include <assert.h>
|
||||
|
||||
#include "scdaemon.h"
|
||||
#include "apdu.h"
|
||||
#include "atr.h"
|
||||
|
||||
static int const fi_table[16] = { 0, 372, 558, 744, 1116,1488, 1860, -1,
|
||||
-1, 512, 768, 1024, 1536, 2048, -1, -1 };
|
||||
static int const di_table[16] = { -1, 1, 2, 4, 8, 16, -1, -1,
|
||||
0, -1, -2, -4, -8, -16, -32, -64};
|
||||
|
||||
|
||||
/* Dump the ATR of the card at SLOT in a human readable format to
|
||||
stream FP. */
|
||||
int
|
||||
atr_dump (int slot, FILE *fp)
|
||||
{
|
||||
unsigned char *atrbuffer, *atr;
|
||||
size_t atrlen;
|
||||
int have_ta, have_tb, have_tc, have_td;
|
||||
int n_historical;
|
||||
int idx, val;
|
||||
unsigned char chksum;
|
||||
|
||||
atr = atrbuffer = apdu_get_atr (slot, &atrlen);
|
||||
if (!atr)
|
||||
return gpg_error (GPG_ERR_GENERAL);
|
||||
|
||||
fprintf (fp, "Info on ATR of length %u at slot %d\n",
|
||||
(unsigned int)atrlen, slot);
|
||||
if (!atrlen)
|
||||
{
|
||||
fprintf (fp, "error: empty ATR\n");
|
||||
goto bailout;
|
||||
}
|
||||
|
||||
|
||||
if (*atr == 0x3b)
|
||||
fputs ("direct convention\n", fp);
|
||||
else if (*atr == 0x3f)
|
||||
fputs ("inverse convention\n", fp);
|
||||
else
|
||||
fprintf (fp,"error: invalid TS character 0x%02x\n", *atr);
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
|
||||
chksum = *atr;
|
||||
for (idx=1; idx < atrlen-1; idx++)
|
||||
chksum ^= atr[idx];
|
||||
|
||||
have_ta = !!(*atr & 0x10);
|
||||
have_tb = !!(*atr & 0x20);
|
||||
have_tc = !!(*atr & 0x40);
|
||||
have_td = !!(*atr & 0x80);
|
||||
n_historical = (*atr & 0x0f);
|
||||
fprintf (fp, "%d historical characters indicated\n", n_historical);
|
||||
|
||||
if (have_ta + have_tb + have_tc + have_td + n_historical > atrlen)
|
||||
fputs ("error: ATR shorter than indicated by format character\n", fp);
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
|
||||
if (have_ta)
|
||||
{
|
||||
fputs ("TA1: F=", fp);
|
||||
val = fi_table[(*atr >> 4) & 0x0f];
|
||||
if (!val)
|
||||
fputs ("internal clock", fp);
|
||||
else if (val == -1)
|
||||
fputs ("RFU", fp);
|
||||
else
|
||||
fprintf (fp, "%d", val);
|
||||
fputs (" D=", fp);
|
||||
val = di_table[*atr & 0x0f];
|
||||
if (!val)
|
||||
fputs ("[impossible value]\n", fp);
|
||||
else if (val == -1)
|
||||
fputs ("RFU\n", fp);
|
||||
else if (val < 0 )
|
||||
fprintf (fp, "1/%d\n", val);
|
||||
else
|
||||
fprintf (fp, "%d\n", val);
|
||||
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
}
|
||||
|
||||
if (have_tb)
|
||||
{
|
||||
fprintf (fp, "TB1: II=%d PI1=%d%s\n", (*atr >> 5) & 3, *atr & 0x1f,
|
||||
(*atr & 0x80)? " [high bit not cleared]":"");
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
}
|
||||
|
||||
if (have_tc)
|
||||
{
|
||||
if (*atr == 255)
|
||||
fputs ("TC1: guard time shortened to 1 etu\n", fp);
|
||||
else
|
||||
fprintf (fp, "TC1: (extra guard time) N=%d\n", *atr);
|
||||
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
}
|
||||
|
||||
if (have_td)
|
||||
{
|
||||
have_ta = !!(*atr & 0x10);
|
||||
have_tb = !!(*atr & 0x20);
|
||||
have_tc = !!(*atr & 0x40);
|
||||
have_td = !!(*atr & 0x80);
|
||||
fprintf (fp, "TD1: protocol T%d supported\n", *atr & 0x0f);
|
||||
|
||||
if (have_ta + have_tb + have_tc + have_td + n_historical > atrlen)
|
||||
fputs ("error: ATR shorter than indicated by format character\n", fp);
|
||||
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
}
|
||||
else
|
||||
have_ta = have_tb = have_tc = have_td = 0;
|
||||
|
||||
if (have_ta)
|
||||
{
|
||||
fprintf (fp, "TA2: (PTS) %stoggle, %splicit, T=%02X\n",
|
||||
(*atr & 0x80)? "no-":"",
|
||||
(*atr & 0x10)? "im": "ex",
|
||||
(*atr & 0x0f));
|
||||
if ((*atr & 0x60))
|
||||
fprintf (fp, "note: reserved bits are set (TA2=0x%02X)\n", *atr);
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
}
|
||||
|
||||
if (have_tb)
|
||||
{
|
||||
fprintf (fp, "TB2: PI2=%d\n", *atr);
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
}
|
||||
|
||||
if (have_tc)
|
||||
{
|
||||
fprintf (fp, "TC2: PWI=%d\n", *atr);
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
}
|
||||
|
||||
if (have_td)
|
||||
{
|
||||
have_ta = !!(*atr & 0x10);
|
||||
have_tb = !!(*atr & 0x20);
|
||||
have_tc = !!(*atr & 0x40);
|
||||
have_td = !!(*atr & 0x80);
|
||||
fprintf (fp, "TD2: protocol T%d supported\n", *atr & 0x0f);
|
||||
|
||||
if (have_ta + have_tb + have_tc + have_td + n_historical > atrlen)
|
||||
fputs ("error: ATR shorter than indicated by format character\n", fp);
|
||||
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
}
|
||||
else
|
||||
have_ta = have_tb = have_tc = have_td = 0;
|
||||
|
||||
for (idx = 3; have_ta || have_tb || have_tc || have_td; idx++)
|
||||
{
|
||||
if (have_ta)
|
||||
{
|
||||
fprintf (fp, "TA%d: IFSC=%d\n", idx, *atr);
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
}
|
||||
|
||||
if (have_tb)
|
||||
{
|
||||
fprintf (fp, "TB%d: BWI=%d CWI=%d\n",
|
||||
idx, (*atr >> 4) & 0x0f, *atr & 0x0f);
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
}
|
||||
|
||||
if (have_tc)
|
||||
{
|
||||
fprintf (fp, "TC%d: 0x%02X\n", idx, *atr);
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
}
|
||||
|
||||
if (have_td)
|
||||
{
|
||||
have_ta = !!(*atr & 0x10);
|
||||
have_tb = !!(*atr & 0x20);
|
||||
have_tc = !!(*atr & 0x40);
|
||||
have_td = !!(*atr & 0x80);
|
||||
fprintf (fp, "TD%d: protocol T%d supported\n", idx, *atr & 0x0f);
|
||||
|
||||
if (have_ta + have_tb + have_tc + have_td + n_historical > atrlen)
|
||||
fputs ("error: ATR shorter than indicated by format character\n",
|
||||
fp);
|
||||
|
||||
if (!--atrlen)
|
||||
goto bailout;
|
||||
atr++;
|
||||
}
|
||||
else
|
||||
have_ta = have_tb = have_tc = have_td = 0;
|
||||
}
|
||||
|
||||
if (n_historical + 1 > atrlen)
|
||||
fputs ("error: ATR shorter than required for historical bytes "
|
||||
"and checksum\n", fp);
|
||||
|
||||
if (n_historical)
|
||||
{
|
||||
fputs ("Historical:", fp);
|
||||
for (; n_historical && atrlen ; n_historical--, atrlen--, atr++)
|
||||
fprintf (fp, " %02X", *atr);
|
||||
putchar ('\n');
|
||||
}
|
||||
|
||||
if (!atrlen)
|
||||
fputs ("error: checksum missing\n", fp);
|
||||
else if (*atr == chksum)
|
||||
fprintf (fp, "TCK: %02X (good)\n", *atr);
|
||||
else
|
||||
fprintf (fp, "TCK: %02X (bad; calculated %02X)\n", *atr, chksum);
|
||||
|
||||
atrlen--;
|
||||
if (atrlen)
|
||||
fprintf (fp, "error: %u bytes garbage at end of ATR\n",
|
||||
(unsigned int)atrlen );
|
||||
|
||||
bailout:
|
||||
xfree (atrbuffer);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
28
scd/atr.h
Normal file
28
scd/atr.h
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
/* atr.h - ISO 7816 ATR functions
|
||||
* Copyright (C) 2003 Free Software Foundation, Inc.
|
||||
*
|
||||
* This file is part of GnuPG.
|
||||
*
|
||||
* GnuPG is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* GnuPG is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
|
||||
*/
|
||||
|
||||
#ifndef ATR_H
|
||||
#define ATR_H
|
||||
|
||||
int atr_dump (int slot, FILE *fp);
|
||||
|
||||
|
||||
|
||||
#endif /*ATR_H*/
|
||||
260
scd/card-dinsig.c
Normal file
260
scd/card-dinsig.c
Normal file
|
|
@ -0,0 +1,260 @@
|
|||
/* card-dinsig.c - German signature law (DINSIG) functions
|
||||
* Copyright (C) 2002 Free Software Foundation, Inc.
|
||||
*
|
||||
* This file is part of GnuPG.
|
||||
*
|
||||
* GnuPG is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* GnuPG is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
|
||||
*/
|
||||
|
||||
/* The German signature law and its bylaw (SigG and SigV) is currently
|
||||
used with an interface specification described in DIN V 66291-1.
|
||||
The AID to be used is: 'D27600006601'.
|
||||
|
||||
The file IDs for certificates utilize the generic format:
|
||||
Cxyz
|
||||
C being the hex digit 'C' (12).
|
||||
x being the service indicator:
|
||||
'0' := SigG conform digital signature.
|
||||
'1' := entity authentication.
|
||||
'2' := key encipherment.
|
||||
'3' := data encipherment.
|
||||
'4' := key agreement.
|
||||
other values are reserved for future use.
|
||||
y being the security environment number using '0' for cards
|
||||
not supporting a SE number.
|
||||
z being the certificate type:
|
||||
'0' := C.CH (base certificate of ard holder) or C.ICC.
|
||||
'1' .. '7' := C.CH (business or professional certificate
|
||||
of card holder.
|
||||
'8' .. 'D' := C.CA (certificate of a CA issue by the Root-CA).
|
||||
'E' := C.RCA (self certified certificate of the Root-CA).
|
||||
'F' := reserved.
|
||||
|
||||
The file IDs used by default are:
|
||||
'1F00' EF.SSD (security service descriptor). [o,o]
|
||||
'2F02' EF.GDO (global data objects) [m,m]
|
||||
'A000' EF.PROT (signature log). Cyclic file with 20 records of 53 byte.
|
||||
Read and update after user authentication. [o,o]
|
||||
'B000' EF.PK.RCA.DS (public keys of Root-CA). Size is 512b or size
|
||||
of keys. [m (unless a 'C00E' is present),m]
|
||||
'B001' EF.PK.CA.DS (public keys of CAs). Size is 512b or size
|
||||
of keys. [o,o]
|
||||
'C00n' EF.C.CH.DS (digital signature certificate of card holder)
|
||||
with n := 0 .. 7. Size is 2k or size of cert. Read and
|
||||
update allowed after user authentication. [m,m]
|
||||
'C00m' EF.C.CA.DS (digital signature certificate of CA)
|
||||
with m := 8 .. E. Size is 1k or size of cert. Read always
|
||||
allowed, update after uder authentication. [o,o]
|
||||
'C100' EF.C.ICC.AUT (AUT certificate of ICC) [o,m]
|
||||
'C108' EF.C.CA.AUT (AUT certificate of CA) [o,m]
|
||||
'D000' EF.DM (display message) [-,m]
|
||||
|
||||
The letters in brackets indicate optional or mandatory files: The
|
||||
first for card terminals under full control and the second for
|
||||
"business" card terminals.
|
||||
|
||||
FIXME: Needs a lot more explanation.
|
||||
|
||||
*/
|
||||
|
||||
|
||||
#include <config.h>
|
||||
#include <errno.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include <time.h>
|
||||
|
||||
#ifdef HAVE_OPENSC
|
||||
#include <opensc/pkcs15.h>
|
||||
#include <ksba.h>
|
||||
|
||||
#include "scdaemon.h"
|
||||
#include "card-common.h"
|
||||
|
||||
static int dinsig_read_cert (CARD card, const char *certidstr,
|
||||
unsigned char **cert, size_t *ncert);
|
||||
|
||||
|
||||
|
||||
/* See card.c for interface description. Frankly we don't do any real
|
||||
enumeration but just check whether the well know files are
|
||||
available. */
|
||||
static int
|
||||
dinsig_enum_keypairs (CARD card, int idx,
|
||||
unsigned char *keygrip, char **keyid)
|
||||
{
|
||||
int rc;
|
||||
unsigned char *buf;
|
||||
size_t buflen;
|
||||
KsbaError krc;
|
||||
KsbaCert cert;
|
||||
|
||||
/* fixme: We should locate the application via the EF(DIR) and not
|
||||
assume a Netkey card */
|
||||
if (!idx)
|
||||
rc = dinsig_read_cert (card, "DINSIG-DF01.C000", &buf, &buflen);
|
||||
else if (idx == 1)
|
||||
rc = dinsig_read_cert (card, "DINSIG-DF01.C200", &buf, &buflen);
|
||||
else
|
||||
rc = -1;
|
||||
if (rc)
|
||||
return rc;
|
||||
|
||||
cert = ksba_cert_new ();
|
||||
if (!cert)
|
||||
{
|
||||
gpg_error_t tmperr = out_of_core ();
|
||||
xfree (buf);
|
||||
return tmperr;
|
||||
}
|
||||
|
||||
krc = ksba_cert_init_from_mem (cert, buf, buflen);
|
||||
xfree (buf);
|
||||
if (krc)
|
||||
{
|
||||
log_error ("failed to parse the certificate at idx %d: %s\n",
|
||||
idx, ksba_strerror (krc));
|
||||
ksba_cert_release (cert);
|
||||
return gpg_error (GPG_ERR_CARD);
|
||||
}
|
||||
if (card_help_get_keygrip (cert, keygrip))
|
||||
{
|
||||
log_error ("failed to calculate the keygrip at index %d\n", idx);
|
||||
ksba_cert_release (cert);
|
||||
return gpg_error (GPG_ERR_CARD);
|
||||
}
|
||||
ksba_cert_release (cert);
|
||||
|
||||
/* return the iD */
|
||||
if (keyid)
|
||||
{
|
||||
*keyid = xtrymalloc (17);
|
||||
if (!*keyid)
|
||||
return out_of_core ();
|
||||
if (!idx)
|
||||
strcpy (*keyid, "DINSIG-DF01.C000");
|
||||
else
|
||||
strcpy (*keyid, "DINSIG-DF01.C200");
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
|
||||
/* See card.c for interface description */
|
||||
static int
|
||||
dinsig_read_cert (CARD card, const char *certidstr,
|
||||
unsigned char **cert, size_t *ncert)
|
||||
{
|
||||
int rc;
|
||||
struct sc_path path;
|
||||
struct sc_file *file;
|
||||
unsigned char *buf;
|
||||
int buflen;
|
||||
|
||||
if (!strcmp (certidstr, "DINSIG-DF01.C000"))
|
||||
sc_format_path ("3F00DF01C000", &path);
|
||||
else if (!strcmp (certidstr, "DINSIG-DF01.C200"))
|
||||
sc_format_path ("3F00DF01C200", &path);
|
||||
else
|
||||
return gpg_error (GPG_ERR_INV_ID);
|
||||
|
||||
rc = sc_select_file (card->scard, &path, &file);
|
||||
if (rc)
|
||||
{
|
||||
log_error ("sc_select_file failed: %s\n", sc_strerror (rc));
|
||||
return map_sc_err (rc);
|
||||
}
|
||||
if (file->type != SC_FILE_TYPE_WORKING_EF
|
||||
|| file->ef_structure != SC_FILE_EF_TRANSPARENT)
|
||||
{
|
||||
log_error ("wrong type or structure of certificate EF\n");
|
||||
sc_file_free (file);
|
||||
return gpg_error (GPG_ERR_CARD);
|
||||
}
|
||||
if (file->size < 20) /* check against a somewhat arbitrary length */
|
||||
{
|
||||
log_error ("certificate EF too short\n");
|
||||
sc_file_free (file);
|
||||
return gpg_error (GPG_ERR_CARD);
|
||||
}
|
||||
buf = xtrymalloc (file->size);
|
||||
if (!buf)
|
||||
{
|
||||
gpg_error_t tmperr = out_of_core ();
|
||||
sc_file_free (file);
|
||||
return tmperr;
|
||||
}
|
||||
|
||||
rc = sc_read_binary (card->scard, 0, buf, file->size, 0);
|
||||
if (rc >= 0 && rc != file->size)
|
||||
{
|
||||
log_error ("short read on certificate EF\n");
|
||||
sc_file_free (file);
|
||||
xfree (buf);
|
||||
return gpg_error (GPG_ERR_CARD);
|
||||
}
|
||||
sc_file_free (file);
|
||||
if (rc < 0)
|
||||
{
|
||||
log_error ("error reading certificate EF: %s\n", sc_strerror (rc));
|
||||
xfree (buf);
|
||||
return map_sc_err (rc);
|
||||
}
|
||||
buflen = rc;
|
||||
|
||||
/* The object is not a plain certificate but wrapped into id-at
|
||||
userCertificate - fixme: we should check the specs and decided
|
||||
whether libksba should support it */
|
||||
if (buflen > 9 && buf[0] == 0x30 && buf[4] == 6 && buf[5] == 3
|
||||
&& buf[6] == 0x55 && buf[7] == 4 && buf[8] == 0x24)
|
||||
{
|
||||
/* We have to strip the padding. Although this is a good idea
|
||||
anyway, we have to do it due to a KSBA problem; KSBA does not
|
||||
work correct when the buffer is larger than the ASN.1
|
||||
structure and the certificates here are padded with FF. So
|
||||
as a workaround we look at the outer structure to get the
|
||||
size of the entire thing and adjust the buflen. We can only
|
||||
do this when there is a 2 byte length field */
|
||||
size_t seqlen;
|
||||
if (buf[1] == 0x82)
|
||||
{
|
||||
seqlen = ((buf[2] << 8) | buf[3]) + 4;
|
||||
if (seqlen < buflen)
|
||||
buflen = seqlen;
|
||||
}
|
||||
memmove (buf, buf+9, buflen-9);
|
||||
buflen -= 9;
|
||||
}
|
||||
|
||||
*cert = buf;
|
||||
*ncert = buflen;
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
/* Bind our operations to the card */
|
||||
void
|
||||
card_dinsig_bind (CARD card)
|
||||
{
|
||||
card->fnc.enum_keypairs = dinsig_enum_keypairs;
|
||||
card->fnc.read_cert = dinsig_read_cert;
|
||||
|
||||
}
|
||||
#endif /*HAVE_OPENSC*/
|
||||
Loading…
Add table
Add a link
Reference in a new issue