1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-07-03 02:58:57 +02:00
Commit Graph

798 Commits

Author SHA1 Message Date
Werner Koch
91acbdc93c
scd:p15: Improve the displayed S/N for Technology Nexus cards.
* scd/app-p15.c (any_control_or_space_mem): New.
(get_dispserialno): Add new code.
--

This works with my test cards and now reflects what's printed on the
front matter of the card.
2022-05-06 11:37:47 +02:00
Werner Koch
8efe738c4a
scd:p15: Fix the the sanity check of the displayed S/N.
* scd/app-p15.c (any_control_or_space): Fix loop.
--

This check is only done to avoid printing wrongly encoded S/N for
human consumption.
e
2022-05-06 11:35:02 +02:00
Werner Koch
7f029eef6c
scd:p15: Fix reading certificates without length info.
* scd/app-p15.c (readcert_by_cdf): Do not use extended mode if the CDF
object has no length info.  Add debug output when reading a cert.
(read_p15_info): No more need to disable extended mode for GeNUA cards.
2022-05-05 14:12:50 +02:00
Werner Koch
d60f930d9b
scd: New debug flags "card".
* scd/scdaemon.c (debug_flags): Add "card".
* scd/scdaemon.h (DBG_CARD_VALUE, DBG_CARD): New.
--

Some information from parsing the card are often very helpful.
However, the card_io triggered APDU dumps are in most cases too heavy.
Thus this new debug flag.
2022-05-05 14:12:23 +02:00
Werner Koch
58532fe56c
scd: Minor code reorganization
* scd/ccid-driver.c: Move struct defines to the top.
(MAX_DEVICE): Rename to CCID_MAX_DEVICE.
2022-04-14 10:25:15 +02:00
Werner Koch
c4b14be48f
scd: Fix memory leak in ccid-driver.
* scd/ccid-driver.c (ccid_dev_scan): Use loop var and not the count.
--

Due to an assignment out of bounds this might lead to a crash if there
are more than 15 readers.  In any case it fixes a memory leak.
Kudos to the friendly auditor who found that bug.

Fixes-commit: 8a41e73c31
2022-04-14 10:17:28 +02:00
Werner Koch
e99670f944
scd:p15: Improve the PIN prompt for Genua cards.
* scd/app-p15.c (CARD_PRODUCT_GENUA): New.
(cardproduct2str): Add it.
(read_p15_info): Detect and set GENUA
(make_pin_prompt): Take holder string from the AODF.
2022-04-13 13:58:37 +02:00
Werner Koch
44ec383cde
scd:p15: Support for GeNUA cards.
* scd/app-p15.c (read_p15_info): Disable extended mode for Genua
cards.
2022-04-13 13:58:26 +02:00
Werner Koch
29fd805818
scd:p15: Prepare AODF parsing for other authentication types.
* scd/app-p15.c (auth_type_t): New.
(struct aodf_object_s): Add field auth_type.
(read_ef_aodf): Distinguish between pin and authkey types.  Include
the authtype in the verbose mode diags.
--

Note that the bulk of changes are just indentation changes.  There
should be no functional change.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit e387cc97c8)
2022-04-13 13:56:58 +02:00
Werner Koch
80cf64c651
scd:p15: Add basic support for AET JCOP cards.
* scd/app-p15.c (CARD_TYPE_AET): New.
(cardtype2str): Add string.
(card_atr_list): Add corresponding ATR.
(app_local_s): New flag no_extended_mode.  Turn two other flags into
bit flags.
(select_ef_by_path): Hack to handle the 3FFF thing.
(readcert_by_cdf): Do not use extended mode for AET.
(app_select_p15): Set no_extended_mode.
---
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 544ec7872a)
2022-04-13 13:32:09 +02:00
Werner Koch
a2db490de5
scd:p15: Used extended mode already for RSA 2048
* scd/app-p15.c (do_sign, do_decipher): Replace GT by GE.
--
2022-02-21 12:23:04 +01:00
NIIBE Yutaka
3c3765405d scd: Use lock_slot for apdu_send_direct.
* scd/apdu.c (apdu_send_direct): Use lock_slot.

--

Cherry-pick the master commit of:
	f808012ac2

With trylock_slot, it may return SW_HOST_BUSY.  This may occur when
apdu_get_status is called by scd_update_reader_status_file.

Simply using lock_slot is much easier for user of apdu_send_direct.

GnuPG-bug-id: 5831
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2022-02-17 14:05:01 +09:00
Werner Koch
38c666ec3f
scd: Also prefer Yubikeys if no reader port is given.
* scd/apdu.c (select_a_reader): Extend the white list.
2022-01-25 19:02:38 +01:00
Werner Koch
7f9791e167
scd: Re-group the options in the --help output.
--

This looks better and is also required for further simplifications of
gpgconf.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit daf5f4355d)
2021-12-29 21:24:42 +01:00
Werner Koch
5f890f417f
gpgconf: Support reading global options (part 2).
* tools/gpgconf-comp.c: Remove all regular option descriptions.  They
are now read in from the component.  Also remove a few meanwhile
obsolete options.
* agent/gpg-agent.c: Add option description which were only set in
gpgconf-comp.c.
* dirmngr/dirmngr.c: Ditto.
* scd/scdaemon.c: Ditto.
* sm/gpgsm.c: Ditto.
* g10/gpg.c: Ditto.
--

This second part removes all regular option descriptions because they
can be read from the components.  A few were missing in the components
and thus moved to there.

Signed-off-by: Werner Koch <wk@gnupg.org>

This is a backport from master (2.3).
2021-12-29 09:42:45 +01:00
NIIBE Yutaka
b6b735edab
scd:openpgp: Support longer data for INTERNAL_AUTHENTICATE.
* scd/app-openpgp.c (do_auth): Use extended Lc, when supported.

--

GnuPG-bug-id: 5682
Co-authored-by: Klas Lindfors
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-11-15 17:54:04 +01:00
NIIBE Yutaka
0982c6cb19 scd: More conservative selection of a card reader.
* scd/apdu.c (select_a_reader): Only SPRx32 is in the white list.

--

GnuPG-bug-id: 5644
Fixes-commit: 752422a792
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-11-10 11:58:16 +09:00
NIIBE Yutaka
752422a792 scd: Select a reader for PC/SC.
* scd/apdu.c (select_a_reader): New.
(open_pcsc_reader): Use select_a_reader.

--

GnuPG-bug-id: 5644
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-22 13:49:07 +09:00
Werner Koch
67e1834ad4
scd: Remove context reference counting from pc/sc
* scd/apdu.c (pcsc): Add flag context_valid, remove count.
(close_pcsc_reader): Use new flag instead of looking at magic context
value.
(pcsc_init): Set new flag.
(open_pcsc_reader): Use new flag.
(apdu_init): Clear new flag.

* scd/apdu.c: Remove assert.h.  Replace all assert by log_assert.
--

The previous fix 192113552f did not
help, thus the new hypothesis is that PC/SC might return a valid
context with the value -1.  We now use a dedicated flag to track the
validity of the context.

The reference counting seems to be superfluous and is a relict due to
backporting from 2.3.  Removed.
2021-09-14 13:41:05 +02:00
Werner Koch
f32994b0bf
scd: Support PC/SC for "getinfo reader_list".
* scd/apdu.c: Include membuf.h.
(pcsc): Add reader_list field.
(open_pcsc_reader): Fill that field.
(apdu_get_reader_list): New.
* scd/command.c: Remove header ccid-driver.h.
(pretty_assuan_send_data): New.
(cmd_getinfo): Print all reader names.
--

Note that depending on the card backend (ccid or PC/SC) it might be
necessary to first send a reset followed by SERIALNO to get an updated
list of reader.  Or well send KILLSCD.

The pretty printing of Assuan data lines does only work if you connect
direct to scdaemon because the wrapper in gpg-agent does not know
about this and combines the Assuan lines again.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-09-08 15:50:28 +02:00
Werner Koch
192113552f
scd: Fix possible assertion in close_pcsc_reader.
* scd/apdu.c (close_pcsc_reader): Don't ref-count if the context is
invalid.
(open_pcsc_reader): Compare the context against -1 which is our
indicator for an invalid context.
--

I got a crash report for Windows:

  DBG: chan_0x000000a4 <- RESTART
  DBG: chan_0x000000a4 -> OK
  DBG: chan_0x000000a4 <- SERIALNO
  DBG: open_pcsc_reader(portstr=(null))
  reader slot 0: not connected
  DBG: open_pcsc_reader => slot=0
  DBG: enter: apdu_connect: slot=0
  pcsc_connect failed: invalid PC/SC error code (0x6)
  reader slot 0: not connected
  DBG: leave: apdu_connect => sw=0x1000b
  DBG: enter: apdu_close_reader: slot=0
  DBG: enter: apdu_disconnect: slot=0
  DBG: leave: apdu_disconnect => sw=0x0
  Ohhhh jeeee: Assertion "pcsc.count > 0" in
    close_pcsc_reader failed (...2.2.28/scd/apdu.c:817)

no smartcard reader was connected but the box might sport a virtual
reader.  This patch should make it more robust.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-09-07 16:40:09 +02:00
Werner Koch
3283cf3a7a
Update OpenPGP card vendor list.
--
2021-07-04 15:49:50 +02:00
NIIBE Yutaka
b90c55fa66 scd:ccid: Handle LIBUSB_TRANSFER_OVERFLOW interrupt transfer.
* scd/ccid-driver.c (intr_cb): Ignore LIBUSB_TRANSFER_OVERFLOW.

--

Backport-master-commit: 25ae80b8eb
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-06-23 12:10:01 +09:00
NIIBE Yutaka
8e941e19b0 scd:ccid:spr532: Extend abort_cmd for initialization time.
* scd/ccid-driver.c (abort_cmd): Add INIT argument to support
synchronize until success, even ignoring timeout.
(bulk_in): Normal use case of abort_cmd.
(ccid_vendor_specific_init): Initial use case of abort_cmd.

--

Another backport to stabilize SCM SPR332/SPR532 card reader.

GnuPG-bug-id: 5297
Backport-master-commit: a9aa30ed2c
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-06-23 11:19:46 +09:00
NIIBE Yutaka
01a413d523 scd: Error code map fix for older Yubikey.
* scd/iso7816.c (map_sw): Recognize 6A86.

--

Yubikey NEO does not support the YK4_GET_CAPA command (001D000000),
and it will be screwed up with the command.

GnuPG-bug-id: 5487
Back-port-master-commit: 13bc0431ff
Fixes-commit: ec56996029
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-06-14 10:24:39 +09:00
Werner Koch
c2f02797cd
scd: Fix serial number detection for Yubikey 5.
* scd/app.c (app_new_register): Handle serial number correctly.

--

GnuPG-bug-id: 5442
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
Backported-from-master: c3a9ee0b65
2021-06-10 12:44:23 +02:00
NIIBE Yutaka
5be0d075b1 scd: Release memory for RDRNAME.
* scd/apdu.c (apdu_close_reader): Free RDRNAME field.

--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-05-21 10:00:28 +09:00
Jakub Jelen
678e1b20d3
scd: avoid memory leaks
* scd/app-p15.c (send_certinfo): free labelbuf
  (do_sign): goto leave instead of return
* scd/command.c (cmd_genkey): goto leave instead of return

--

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
GnuPG-bug-id: 5393

Modifified for this backport:

* scd/command.c (cmd_genkey): Make it easier to read by replacing
keyno with orig_line.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-05-20 15:19:19 +02:00
Werner Koch
b677e2ec98
Assorted memory leak fixes on the error code paths.
--

These are taken from these commits:

98c52ae * card: Intialize pointer to avoid double free
fc5fac8 * kbx: Avoid uninitialized read
fa0771f * g10: Avoid memory leaks
25aa353 * dirmgr: Avoid double free
33a2362 * agent: Fix memory leaks
e6132bc * sm: Avoid memory leaks and double double-free
2af7bb2 * g10: Fix memory leaks
0d2c1e9 * dirmgr: clean up memory on error code paths

GnuPG-bug-id: 5393
Signed-off-by: Werner Koch <wk@gnupg.org>
2021-05-20 14:51:42 +02:00
Ingo Klöcker
aa62881404
scd:p15: Fix logic for appending product name to MANUFACTURER.
* scd/app-p15.c (do_getattr): Append product name to MANUFACTURER if
manufacturer_id does not already contain a bracket and if we have a
product name.
2021-05-18 22:54:12 +02:00
NIIBE Yutaka
987b816860
scd,pcsc: Use a single context.
* scd/apdu.c (pcsc): New variable.
(struct reader_table_s): Remove pcsc.context from member.
(pcsc_get_status, connect_pcsc_card): Use pcsc.context.
(close_pcsc_reader): Release pcsc.context here with reference count.
(apdu_open_one_reader): Move API loading to ...
(pcsc_init): new.
(apdu_open_one_reader): Remove.
(apdu_open_reader): Call open_pcsc_reader instead of
apdu_open_one_reader.
(open_pcsc_reader): Call pcsc_init if needed.  Call close_pcsc_reader
instead of pcsc_release_context.  Make reader parsing more robust.
(apdu_init): Initialize pcsc.count and pcsc.context.
--
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
Backported-from-master: 1080e91efd)

The backport also adds some other chnages as described above.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-05-07 09:53:29 +02:00
Werner Koch
9d83bfb639
scd: Fix possible PC/SC removed card problem
* scd/apdu.c (pcsc_cancel): New.
(pcsc_init): Load new function.
(connect_pcsc_card): Use it after a removed card error.
--

Backported-from-master: 8d81fd7c01
2021-05-04 10:38:53 +02:00
Werner Koch
a475bb725b
scd: Add string for another PC/SC error code.
* scd/apdu.c (PCSC_E_NO_READERS_AVAILABLE): New.
(pcsc_error_string): Add a description for this.
* scd/scdaemon.c (scd_kick_the_loop): Fix diagnostic.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-05-04 10:33:30 +02:00
Kirill Elagin
6c4216094e
scd: Fix unblock PIN by a Reset Code with KDF.
* scd/app-openpgp.c (do_change_pin): Use correct CHVNO=1 for
pin2hash_if_kdf, for user's PIN.

--

GnuPG-bug-id: 5413
Signed-off-by: Kirill Elagin <kirelagin@gmail.com>
(cherry picked from commit f209d7d2db)
2021-05-04 10:27:32 +02:00
Werner Koch
b8df8321e1
scd: Add option --info to emit KEYPAIRINFO by readkey command.
* scd/command.c (do_readkey): Implement this.
* scd/app-help.c (app_help_get_keygrip_string_pk): Make HEXKEYGRIP
parm optional.  Add arg R_ALGOSTR.
--

This patch basically mimics what we do in 2.3.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-05-03 20:15:03 +02:00
Werner Koch
5eec40f3d8
scd: New option --pcsc-shared.
* scd/scdaemon.h (opt): Add field opcsc_shared.
* scd/scdaemon.c (opcscShared): New.
(opts): Add "--pcsc-shared".
(main): Set flag.
* scd/apdu.c (connect_pcsc_card): Use it.
(pcsc_get_status): Take flag in account.
* scd/app-openpgp.c (verify_chv2): Do not auto verify chv1 in shared
mode.
--

This option should in general not be used.  The patch tries to limit
bad effects but using shared mode is somewhat dangerous depending on
the other PC/SC users.

(cherry picked from commit 5732e7a8e9)
2021-04-29 19:43:23 +02:00
Werner Koch
96577e2e46
scd: Rewrite READKEY to allow for compressed points.
* scd/app-help.c (app_help_pubkey_from_cert): New.  Taken from 2.3.
* scd/command.c (cmd_readkey): Rewrite using new helper.
--

Actually the readkey functions needs to return the uncompressed points
but if there is no readkey function, like in app-p15.c, readcert is
used and here we need to extract and the key and uncompress the point.

Noet that the --advanced flag did not and still does not work if the
key is fetched via readcert.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-04-29 16:07:14 +02:00
Werner Koch
7637d39fe2
scd:p15: Update from current GnuPG 2.3
--

This reflects the state of
commit 1f846823b3
featuring these commits:

1f846823b scd:p15: Fix the name of a card.
cc5aa68b6 scd:p15: Fix last commit and improve D-TRUST detection.
21e3f750b scd:p15: Shorten the displayed s/n of RSCS cards
30f90fc85 scd:p15: Support attribute KEY-FPR.
ecb9265b8 scd:p15: Match private keys with certificates also by ...
e17d3f866 scd:p15: New flag APP_LEARN_FLAG_REREAD.
1c16878ef scd: Replace all assert macros by the log_assert macro.
7f9126363 scd:p15: Return labels for keys and certificates.
651c07a73 scd:p15: For CardOS make use of ISO7816_VERIFY_NOT_NEEDED.
de4d3c99a scd:p15: Return the creation time of the keys.
592f48011 scd:p15: Make RSA with SHA512 work with CardOS.
a494b29af scd:p15: Support ECDSA and ECDH for CardOS.
964363e78 scd:p15: Make $SIGNKEY et al determination more fault ...
85082a83c scd:p15: Allow to use an auth object label with cmd CHECKPIN.
ef29a960b scd:p15: New attribute CHV-LABEL.
bf1d7bc36 scd:p15: Implement CHV-STATUS attribute
0f191a070 scd:p15: Fix faulty removal of a test code change.
08b5ac492 scd:p15: Support special extended usage flags for OpenPGP ...
d51a5ca10 scd:p15: Read out the access flags.
cfdaf2bcc scd:p15: Get the label value of all objects for better diag...
33aaa37e5 scd:p15: Make it code work again for D-Trust cards.
488eaedc9 scd:p15: Extract extended usage flagsand act upon them.
0c080ed57 scd:p15: Read PuKDF and minor refactoring.
1e197c29e scd:p15: Make file selection more robust.
5bcbc8cee scd:p15: Factor the commonKeyAttributes parser out.
fb84674d6 scd:p15: Factor the commonObjectAttributes parser out.
fc287c055 scd:p15: First step towards real CardOS 5 support.
60499d989 scd:p15: Show the ATR as part of the TokenInfo diagnostics.
00037f499 scd:p15: Print the internal card type.
c7b9a4ee4 scd:p15: Improve support for some CardOS based cards.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-04-29 15:26:36 +02:00
Werner Koch
5b8593135f
common: Extend the openpgp_curve_to_oid function.
* common/openpgp-oid.c (openpgp_curve_to_oid): Add optional arg R_NBITS.
Change all callers.
--

In particular for ed25519 and cv25519 it is quite useful to have an
ability to get the required algorithm.

(cherry picked from commit 24095101a5)
2021-04-29 12:57:00 +02:00
Werner Koch
0eed0ced9b
scd: New function send_keyinfo to assist in backporting.
* scd/command.c (send_keyinfo): New.
2021-04-29 12:18:48 +02:00
Werner Koch
3db99b8861
scd: Minor changes to assist in backporting from 2.3
* scd/command.c (send_status_direct): Return an error code.
* scd/app-common.h (APP_LEARN_FLAG_REREAD): New.
2021-04-29 11:43:46 +02:00
Werner Koch
72a7d45a23
scd: Extend an internal function to also return the algo.
* scd/app-help.c (app_help_get_keygrip_string_pk): Add optional arg
r_algo.  Change all callers.
(app_help_get_keygrip_string): Ditto.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-04-29 10:52:43 +02:00
Werner Koch
91dd74f3d7
scd: New function for iso7816 PSO_CSV.
* scd/iso7816.c (iso7816_pso_csv): New.
2021-04-29 10:44:12 +02:00
Werner Koch
855d14d390
scd: Extend iso7816_select_path
* scd/iso7816.c (iso7816_select_path): Add arg top_fd.
* scd/app-nks.c (do_readkey): Adjust for this change
(select_ef_by_path: Ditto.

* common/tlv.h: Include membuf.h.
--

Including membuf.h is just for easier backporting.  In 2.3 it is
actually required in tlv.h but in 2.2 we right now only use it
indirect.
2021-04-29 10:38:29 +02:00
Werner Koch
3ce69d8387
scd: Add new status codes.
* scd/apdu.h (SW_SM_NOT_SUP, SW_CC_NOT_SUP, SW_FILE_STRUCT)
(SW_NO_CURRENT_EF): New.
* scd/apdu.c (apdu_strerror): Map them to strings.
* scd/iso7816.c (map_sw): ... and to gpg-error.
2021-04-29 10:14:53 +02:00
Werner Koch
ec9e8e0d6a
scd: Extend ISO binary and record reading functions.
* scd/iso7816.c (iso7816_read_binary_ext): Add optional arg r_sw and
change callers.
(iso7816_read_record): Factor all code out to ...
(iso7816_read_record_ext): New.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-04-29 10:03:12 +02:00
NIIBE Yutaka
f8ae51977c scd: Fix CCID driver for SCM SPR332/SPR532.
* scd/ccid-driver.c (ccid_vendor_specific_pinpad_setup): New.
(ccid_vendor_specific_setup): Only send CLEAR_HALT.
(ccid_transceive_secure): Each time, use send_escape_cmd.

--

Cherry-pick master commit of:
	ab66c43575

GnuPG-bug-id: 5297
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-04-08 13:45:38 +09:00
Werner Koch
41979ed730
scd: Change parameters of readkey fucntion pointer.
* scd/app-common.h (APP_READKEY_FLAG_ADVANCED): New.
(struct app_ctx_s): Replace param advanced by flags in readkey.
Change all users.
2021-02-19 10:10:28 +01:00
Werner Koch
669786cf64
scd: Pass ctrl parameter to more app functions.
* scd/app-common.h (struct app_ctx_s): Add parameter ctrl to function
pointers for readkey, setattr, sign, auth, decipher, and check_pin.
--

This is a yet another patch to allow for easier backporting.
2021-02-19 09:56:44 +01:00
Werner Koch
f8588369bc
scd: Detect Yubikey and provide nicer display-s/n.
* scd/app-common.h (struct app_ctx_s): Rename unused field
card_version to cardversion.
* scd/app.c (app_new_register): Add code rom 2.3 to detect the Yubikey
and set cardversion.
(app_get_dispserialno): New.
* scd/app-openpgp.c (do_getattr): Use app_get_dispserialno.
2021-02-19 09:20:29 +01:00
Werner Koch
43b3ec5aee
scd: Change the apptype from a string to an enum.
* scd/app-common.h (cardtype_t): New.
(apptype_t): New.
(struct app_ctx_s): Change type of field apptype.  Add fields
appversion and cardtype.  Adjust all app-*.c for the new type.
* scd/app.c (supported_app_list): New.
(strapptype): New.
(apptype_from_name): New.
(app_dump_state): Use strapptype.
(app_write_learn_status): Ditto.
(app_getattr): Ditto.
(check_conflict): Use apptype_from_name and integer comparison.
* scd/app-openpgp.c: Replace app->card_version by app->appversion.
--

This is another patch to make backporting from 2.3 easier.
2021-02-19 09:17:06 +01:00
Werner Koch
6380126b31
scd: Add some compatibility code for easier backporting.
* scd/app-common.h (APP_WRITEKEY_FLAG_FORCE): New.
(APP_READKEY_FLAG_INFO): New.
(APP_LEARN_FLAG_KEYPAIRINFO): New.
(APP_LEARN_FLAG_MULTI): New.
(struct app_ctx_s): New forward declaration.
(struct app_ctx_s): Add members prep_reselect, reselect, and
with_keygrip.
(KEYGRIP_ACTION_SEND_DATA): New.
(KEYGRIP_ACTION_WRITE_STATUS): New.
(KEYGRIP_ACTION_LOOKUP): New.
(APP_CARD): New macro.
* scd/scdaemon.h: Include app-common.h and remove from all other
files.
(app_t): Move typedef to ...
* scd/app-common.h: here.
--

These changes will make it easier to backport changes from 2.3 to 2.2.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-02-19 08:30:36 +01:00
Werner Koch
9e8d299e18
Merge branch 'wk/stable-2.2-global-options' into STABLE-BRANCH-2-2
--
2020-12-18 11:23:01 +01:00
NIIBE Yutaka
3c55e15cee scd:ccid: Call libusb_clear_halt in ccid_vendor_specific_setup.
* scd/ccid-driver.c (ccid_vendor_specific_setup): Only for SPR532,
call libusb_clear_halt.

--

Backport master commit of:
	f503730272

GnuPG-bug-id: 5167
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-12-16 10:15:43 +09:00
NIIBE Yutaka
585cfca0a6 scd:ccid: Revert the addition of libusb_clear_halt for EP_INTR.
* scd/ccid-driver.c (ccid_setup_intr): Don't call libusb_clear_halt.

--

Backport master commit of:

	ffabc29d5e

GnuPG-bug-id: 5167
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-12-16 10:15:11 +09:00
NIIBE Yutaka
5a03bf6130 scd:openpgp: Fix writing ECC key to card.
* scd/app-openpgp.c (build_privkey_template): Adding another argument
of ecc_d_fixed_len to handle variable-size MPI.

--

Backport from master commit of:
	a25c99b156

GnuPG-bug-id: 5163
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-12-07 10:06:52 +09:00
Werner Koch
a028f24136
Backport of the new option parser from 2.3
* configure.ac (GPGRT_ENABLE_ARGPARSE_MACROS): Define.
* common/argparse.c, common/argparse.h: Rewrite.
* tests/gpgscm/main.c: Switch to the new option parser.

* g10/gpg.c: Switch to the new option parser and enable a global conf
file.
* g10/gpgv.c: Ditto.
* agent/gpg-agent.c: Ditto.
* agent/preset-passphrase.c: Ditto.
* agent/protect-tool.c: Ditto.
* scd/scdaemon.c: Ditto.
* dirmngr/dirmngr.c: Ditto.
* dirmngr/dirmngr_ldap.c: Ditto
* dirmngr/dirmngr-client.c: Ditto.
* kbx/kbxutil.c: Ditto.
* tools/gpg-card.c: Ditto.
* tools/gpg-check-pattern.c: Ditto.
* tools/gpg-connect-agent.c: Ditto.
* tools/gpg-pair-tool.c: Ditto.
* tools/gpg-wks-client.c: Ditto.
* tools/gpg-wks-server.c: Ditto.
* tools/gpgconf.c: Ditto.
* tools/gpgsplit.c: Ditto.
* tools/gpgtar.c: Ditto.
* g13/g13.c: Ditto.
* g13/g13-syshelp.c: Ditto.  Do not force verbose mode.
* sm/gpgsm.c: Ditto. Add option --no-options.
--

This is backport from master

commit cdbe10b762
commit ba463128ce
commit 3bc004decd
commit 2c823bd878
commit 0e8f6e2aa9

but without changing all functions names to gpgrt.  Instead we use
wrapper functions which, when building against old Libgpg-error
versions, are implemented in argparse.c using code from the current
libgpg-error.  This allows to keep the dependency requirement at
libgpg-error 1.27 to support older distributions.  Tested builds
against 1.27 and 1.40-beta.

Note that g13-syshelp does not anymore default to --verbose because
that can now be enabled in /etc/gnupg/g13-syshelp.conf.

GnuPG-bug-id: 4788
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-12-04 12:12:20 +01:00
Gavin L. Rebeiro
563db31467
doc: Fix typos
--
GnuPG-bug-id: 5071

Also fixed one in keyformat.txt [wk].

(cherry picked from commit 572bcacc28)
2020-11-23 12:13:52 +01:00
NIIBE Yutaka
84020385be scd:openpgp: Public keys should be available for check_keyidstr.
* scd/app-openpgp.c (check_keyidstr): Call get_public_key.

--

GnuPG-bug-id: 5065
Fixes-commit: 1049f06c6d
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-11-19 13:49:08 +09:00
Werner Koch
3274eb4637
scd:openpgp: Drop support for GnuPG 1.
--

It does not make sense to keep support form GnuPG 1 here given that we
don't intend to ever backport any of the current stuff to the legacy
version.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-16 17:09:39 +01:00
Werner Koch
1049f06c6d
scd:openpgp: Allow keygrip to be used to reference a key
* scd/app-openpgp.c (struct app_local_s): Add keygrip_str.
(store_keygrip): New.
(read_public_key): Store the keygrip.
(get_public_key): Sitto.
(send_keypair_info): USe the stored keygrip.
(check_keyidstr): New.  Factored out from other functions and
extended.
(do_sign): Use check_keyidstr.
(do_auth): Ditto.
(do_decipher): Ditto.
(do_check_pin): Ditto.
--

This code is a backport of commits:

b0f0791e4a
cd: Factor out a function to check keyidstr.

4c4999b818
scd:openpgp: Allow PKSIGN with keygrip also for OPENPGP.3.

e769609cd3
scd: Allow KEYGRIP as KEYIDSTR.

Co-authored-by: NIIBE Yutaka <gniibe@fsij.org>
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-16 17:09:37 +01:00
Werner Koch
7076f6cafb
scd: Skip unknown options in command SERIALNO
* scd/command.c (cmd_serialno): Skip options.
--

SERIALNO --all
works only in 2.3 and thus naive use with 2.2 vesions would conserer
"--all" as the reqyested applications.  Fix is easy and should be done
anyway.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-12 12:44:57 +01:00
Werner Koch
bd3b698d8e
scd: Do not print reader status change with --debug cardio.
--

... but use --debug reader for this.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-11 14:50:49 +01:00
Werner Koch
163e4ff195
w32: Support Unicode also for config files etc.
* common/sysutils.c (gnupg_fopen) [W32]: Use _wfopen if needed.   Use
new function in most places where fopen is used.
--

The config files in 2.2 are still read using fopen - we need to change
this to allow Unicode directory names.  There is also one case where
files are written using the old fopen.  The new option parser in 2.3
does not have this problem but at some places fopen is also still used.

GnuPG-bug-id: 5098
Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-10 12:09:11 +01:00
NIIBE Yutaka
8e206c1721
scd: Internal CCID driver: Fix a race condition on close.
* scd/ccid-driver.c (ccid_require_get_status): For VENDOR_SCM reader,
return 0 only at the initial call.
(bulk_in): Don't detect an error for VENDOR_SCM reader, just kicking
the loop, to invoke scd_update_reader_status_file, which calls
ccid_slot_status again.
(ccid_slot_status): Move the call of ccid_vendor_specific_setup to...
(ccid_get_atr): ... here.

--

For readers with interrupt transfer support, it is only intr_cb which
sets handle->powered_off to 1.  Keeping this condition makes no race.
The function ccid_slot_status can also detect a communication error,
which causes apdu_close_reader (but not setting ->powered_off).

GnuPG-bug-id: 5121
Fixes-commit: 920f258eb6
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
(cherry picked from commit 484bafda4d)
2020-11-09 13:26:40 +01:00
Werner Koch
7f765a98fd
card: Run factory-reset in locked stated.
* scd/command.c (reset_notify): Add option --keep-lock.
(do_reset): Add arg keep_lock.
(cmd_lock): Send progress status.
* g10/call-agent.c (agent_scd_apdu): Add more pseudo APDUs.
* g10/card-util.c (send_apdu): Ditto.
(factory_reset): Use lock commands.
--

This is required so that for example Kleopatra does not detect the
RESET and issues a SERIALNO of its own, thus conflicting with our
SERIALNO undefined.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-11-09 13:04:38 +01:00
NIIBE Yutaka
38040ffee8
scd: Internal CCID driver thing only for SPR532.
* scd/ccid-driver.c (ccid_vendor_specific_setup): New.  Limit
only for SPR532, excluding other readers by SCM.
(ccid_slot_status): Use ccid_vendor_specific_setup.

--

We follow the setup procedure of libccid implementation, which sends
the escape command for SPR532 only.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-26 13:31:08 +01:00
NIIBE Yutaka
d1c9cc3ca0
scd: Internal CCID driver limiting only for SPR532.
* scd/ccid-driver.c (ccid_vendor_specific_init): Only do that for
SPR532.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-26 13:31:02 +01:00
Werner Koch
5c6e9b44cc
Replace most of the remaining stdio calls by estream calls.
--

We need to use es_fopen on Windows to cope with non-ascii file names.
This is quite a large but fortunately straightforward change.  At a
very few places we keep using stdio (for example due to the use of
popen).

GnuPG-bug-id: 5098
Signed-off-by: Werner Koch <wk@gnupg.org>
Backported-from-master: 390497ea11
2020-10-21 21:09:38 +02:00
NIIBE Yutaka
25bec16d0b scd: Add a workaround for Yubikey.
* scd/app-openpgp.c (get_public_key): Handle wrong code for Yubikey.

--

Backport master commit of:

	0db9c83555

Yubikey version 5 s/n 609074582 returns 0x6982, version 5.2.4 s/n
610616049 returns 0x6581, where 0x6a88 is expected.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 17:15:49 +09:00
NIIBE Yutaka
0f4c956a76 scd: Silence compiler warning.
* scd/app-openpgp.c (build_ecc_privkey_template): Fix allocation size.

--

Cherry-picked from master commit of:

	2a34a2afea

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 12:01:13 +09:00
NIIBE Yutaka
7c8823bf82 scd: Report any error for LEARN command.
* scd/app-openpgp.c (do_learn_status): Report any error.

--

Backport master commit of:

	862d9c6fac

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:52:24 +09:00
NIIBE Yutaka
1f1b68eef7 scd: Internal CCID driver: More fix for SPR532.
* scd/ccid-driver.c (bulk_in): Handle the case of missing intr_cb.

--

Backport master commit of:

	920f258eb6

GnuPG-bug-id: 5065
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:46:13 +09:00
NIIBE Yutaka
33a2d4bd7f scd: Internal CCID driver fix.
* scd/ccid-driver.c (intr_cb): More useful debug output.
(ccid_slot_status): Remove redundant condition.

--

Backport master commit of:

	1444203ca3

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:45:45 +09:00
NIIBE Yutaka
48565e7a08 scd: Internal CCID driver: Call libusb_clear_halt at ccid_setup_intr.
* scd/ccid-driver.c (ccid_setup_intr): Reset the endpoint.
(ccid_vendor_specific_init): Don't call libusb_clear_halt.

--

Backport master commit of:

	6af978713e

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:44:57 +09:00
NIIBE Yutaka
30693dfb6f scd: Internal CCID driver: Fix a failure path.
* scd/ccid-driver.c (ccid_open_usb_reader): On error, call
libusb_release_interface.

--

Backport master commit of:

	d561c936a2

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:44:21 +09:00
NIIBE Yutaka
498cd38019 scd: Internal CCID: Handle LIBUSB_ERROR_TIMEOUT at ccid_get_atr.
* scd/ccid-driver.c (ccid_slot_status): Handle LIBUSB_ERROR_TIMEOUT.

--

Backport master commit of:

	b1e8072320

With SPR532, at the first connection, it fails by
LIBUSB_ERROR_TIMEOUT, but no retry.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:43:48 +09:00
NIIBE Yutaka
7db836c0e9 scd: Change handling of SPR532 card reader.
* scd/ccid-driver.c (ccid_vendor_specific_init): Put some workaround
for SPR532 initialization.
(ccid_slot_status): Send ESCape command after GetSlotStatus.

--

Backport master commit of:

	684a52dffa

GnuPG-bug-id: 5065
Fixes-commit: 4fae55f8ee
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:43:13 +09:00
NIIBE Yutaka
11d8d1e050 scd: For SPR532, submit the ESCape command at initialization.
* scd/ccid-driver.c (ccid_vendor_specific_init): Submit the ESC
command for VENDOR_SCM.
(ccid_transceive_secure): Don't submit the ESC command every time.

--

Backport master commit of:

	4fae55f8ee

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:42:23 +09:00
NIIBE Yutaka
dd7cc24d5f scd: Fix CCID internal driver for interrupt transfer.
* scd/ccid-driver.c (intr_cb): Handle the case of multiple messages.

--

Backport master commit of:

	7cbb513a2d

SPR532 USB Smart Card Reader (also know as SPR332) may send two
messages at once for a single interrupt transfer.  An example transfer
observed was like: 50 03 50 02, which is considered valid, according
to the CCID specification.

GnuPG-bug-id: 5065
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:41:25 +09:00
NIIBE Yutaka
186d11896c scd: Better handling of timeout and time extension.
* scd/ccid-driver.c (CCID_CMD_TIMEOUT_LONGER): Remove.
(ccid_transceive): Don't use x4 blindly for bBWI, but use dynamically
determined value.  Use value from variable wait_more for bulk_in.
Set wait_more by the value of time extension request.

--

Backport master commit of:

	f1cf799a37

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:38:40 +09:00
NIIBE Yutaka
60af035c22 scd: Fix internal CCID driver, so that -DTEST works.
* scd/ccid-driver.c: Support a test program by ccid-driver.

--

Backport from master commit:

	b310604252

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:27:41 +09:00
NIIBE Yutaka
165312dca9 scd: ccid-driver: Initial getting ATR more robustly.
* scd/ccid-driver.c (send_power_off): New.
(do_close_reader): Use send_power_off.
(ccid_get_atr): Add error recovery.

--

Backport from master commit of:

	c51a568555

GnuPG-bug-id: 4616
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:21:42 +09:00
NIIBE Yutaka
1efc01ff98 scd: Clean up the structure for future fix of PC/SC.
* scd/apdu.c (struct dev_list): Rename from ccid_table, with void*.
(open_ccid_reader): Follow the change.
(apdu_dev_list_start, apdu_dev_list_finish): Likewise.
(apdu_open_reader): Likewise.
* scd/ccid-driver.c (ccid_dev_scan): Use void *.
(ccid_dev_scan_finish, ccid_get_BAI, ccid_open_usb_reader): Likewise.
* scd/ccid-driver.h: Change the APIs.

--

Backport from master commit of:

	f44aa290c1

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:17:58 +09:00
Werner Koch
5b985b0264 scd: Map some error codes from libusb to ccid-driver error codes.
* scd/ccid-driver.h (CCID_DRIVER_ERR_USB_*): New error codes.
* scd/apdu.h: New SW_HOST error codes.
* scd/apdu.c (host_sw_string): Print them
* scd/ccid-driver.c (map_libusb_error): New.
(ccid_open_usb_reader, bulk_in, abort_cmd): Map libusb error codes.
* scd/iso7816.c (map_sw): Map new codes to gpg-error.
--

Backport from master commit:

	9a8d7e41bb

This change will help to get low level error conditions from hipher
application code.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-10-06 11:14:59 +09:00
NIIBE Yutaka
cccdca61a8 scd: internal driver: Submit SET_INTERFACE control transfer.
* scd/ccid-driver.c (ccid_open_usb_reader): Alway submit SET_INTERFACE
control transfer.

--

Backport from master commit:

	611faf1579

This handling is not mondatory, but it's better to do so, because
there are card reader with pinpad and token with ack button, which
support user interaction.

User interaction status should be reset at open time.  The status
should be reset when the session is closed/stopped.  In practice,
since cleanup routine in a driver may not be called properly, it's
good to submit SET_INTERFACE at open time.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-10-06 11:14:29 +09:00
NIIBE Yutaka
e3a12b09dc scd: Internal CCID driver: Spelling cleanup.
--

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

Backport master commit of:
	0904b8ef34
2020-10-06 11:06:53 +09:00
NIIBE Yutaka
7b531fe580 scd: Internal CCID driver: Clean up backport from master.
* scd/ccid-driver.c (print_error) [TEST]: Add missing break.  Note
    that this is anyway an impossible case.

--

Backport master commit of:

	8fb14d3b3f

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-10-06 11:02:24 +09:00
Werner Koch
c81f02c959
w32: Add manifest files to most binaries
--

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-10-02 17:04:12 +02:00
Werner Koch
c10ba8e883
doc: Typo fixes
--
2020-10-02 12:32:37 +02:00
NIIBE Yutaka
61aea64b3c scd: Fix the use case of verify_chv2 by CHECKPIN.
* scd/app-openpgp.c (verify_chv2): Call verify_a_chv with chvno=1
when needed.

--

Backport of master commit of:
	6e51f2044a

Fixes-commit: d2f1a0a791
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-09-16 12:46:50 +09:00
NIIBE Yutaka
0a9665187a scd: Fix a regression for OpenPGP card.
* scd/app-openpgp.c (verify_chv2): Make sure loading keys.

--

Fixes-commit: d2f1a0a791
Reported-by: Michał Górny
GnuPG-bug-id: 5039
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-09-01 15:23:59 +09:00
NIIBE Yutaka
d2f1a0a791 scd: Add condition for VERIFY with 0x82.
* scd/app-openpgp.c (verify_chv2): Check availability of keys in
question.

--

Backport master commit of:
	af189be481

With buggy Gnuk (<= 1.2.15), when no encr/auth keys are available,
it fails decrementing the signature error counter.  This change
can avoid the issue.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-08-27 10:54:59 +09:00
NIIBE Yutaka
e285b1197b scd: Fix condition for C5 data object for newer Yubikey.
* scd/app-openpgp.c (compare_fingerprint): Relax the condition.

--

Cherry-picked from master commit of:
	f3df8dbb69

GnuPG-bug-id: 4957
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2020-05-29 11:21:01 +09:00
Werner Koch
c6324ee07a
common: Change argument order of log_printhex.
* common/logging.c (log_printhex): Chnage order of args.  Make it
printf alike.  Change all callers.
* configure.ac: Add -Wno-format-zero-length
--

This makes it consistent with modern libgpgrt logging and thus eases
back porting from newer GnuPG versions which use libgpgrt logging.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-05-12 18:51:47 +02:00
Werner Koch
39e2260d7e
scd:p15: Return a display S/N via Assuan.
* scd/app-p15.c (make_pin_prompt): Factor some code out to ...
(get_dispserialno): this.
(do_getattr): Use new fucntion for a $DISPSERIALNO.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-04-15 15:42:35 +02:00
Werner Koch
beaa2cbb7f
scd:p15: Show a pretty PIN prompt.
* scd/app-p15.c (struct prkdf_object_s): New fields common_name and
serial_number.
(release_prkdflist): Free them.
(keygrip_from_prkdf): Parse cert and set them.
(any_control_or_space): New.
(make_pin_prompt): New.
(verify_pin): Construct a pretty PIN prompt.
(do_sign): Remove debug output.
--

The D-Trust card has the SerialNumber part of the Subject printed on
the front matter, we assume this is also possible with other cards and
thus we show this as serial number.

The holder of the card is also extracted from the card's subject.

Signed-off-by: Werner Koch <wk@gnupg.org>

Backported from master.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-04-15 15:42:01 +02:00
Werner Koch
9e6a3290da
scd: Return GPG_ERR_BAD_PIN on 0x63Cn status word.
* scd/iso7816.c (map_sw): Detect 0x63Cn status code.
--

I really wonder when that got lost and we ended up with a simple card
error.

Signed-off-by: Werner Koch <wk@gnupg.org>
Backported from master.
2020-04-15 15:38:13 +02:00
Werner Koch
9497d25c56
scd: Factor common PIN status check out.
* scd/iso7816.h (ISO7816_VERIFY_ERROR): New.
(ISO7816_VERIFY_NO_PIN): New.
(ISO7816_VERIFY_BLOCKED): New.
(ISO7816_VERIFY_NULLPIN): New.
(ISO7816_VERIFY_NOT_NEEDED): New.
* scd/iso7816.c (iso7816_verify_status): New.
* scd/app-nks.c (get_chv_status): Use new function.
--

Signed-off-by: Werner Koch <wk@gnupg.org>

Backported from master:
- Removed the non-existant app-piv.c patches.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-04-15 15:35:55 +02:00
Werner Koch
471b06e91b
scd:p15: Fix decrypt followed by sign problem for D-Trust cards.
* scd/iso7816.c (iso7816_select_mf): New.
* scd/app-p15.c (card_product_t): New.
(struct app_local_s): Add field 'card_product'.
(read_ef_tokeninfo): Detect D-Trust card.
(prepare_verify_pin): Switch to D-Trust AID.
(do_decipher): Restore a SE for D-TRust cards.  Change the padding
indicator to 0x81.

* common/percent.c (percent_data_escape): new.  Taken from master.
--

Using what I learned from a USB trace running the Governikus Signer
Software on Windows this fixes the left over problem with the new
D-Trust card support.

Signed-off-by: Werner Koch <wk@gnupg.org>

Backported from master.  This required to add the percent_data_escape
function we introduced in master on 2018-07-02:

    commit 58baf40af6
    common: New function percent_data_escape.

Signed-off-by: Werner Koch <wk@gnupg.org>
2020-04-15 15:31:56 +02:00