[mirror_qemu.git] / libcacard / cac.c

/*
 * implement the applets for the CAC card.
 *
 * This code is licensed under the GNU LGPL, version 2.1 or later.
 * See the COPYING.LIB file in the top-level directory.
 */

#include "qemu-common.h"

#include "cac.h"
#include "vcard.h"
#include "vcard_emul.h"
#include "card_7816.h"

/* private data for PKI applets */
typedef struct CACPKIAppletDataStruct {
    unsigned char *cert;
    int cert_len;
    unsigned char *cert_buffer;
    int cert_buffer_len;
    unsigned char *sign_buffer;
    int sign_buffer_len;
    VCardKey *key;
} CACPKIAppletData;

/*
 * CAC applet private data
 */
struct VCardAppletPrivateStruct {
    union {
        CACPKIAppletData pki_data;
        void *reserved;
    } u;
};

/*
 * handle all the APDU's that are common to all CAC applets
 */
static VCardStatus
cac_common_process_apdu(VCard *card, VCardAPDU *apdu, VCardResponse **response)
{
    int ef;
    VCardStatus ret = VCARD_FAIL;

    switch (apdu->a_ins) {
    case VCARD7816_INS_SELECT_FILE:
        if (apdu->a_p1 != 0x02) {
            /* let the 7816 code handle applet switches */
            ret = VCARD_NEXT;
            break;
        }
        /* handle file id setting */
        if (apdu->a_Lc != 2) {
            *response = vcard_make_response(
                VCARD7816_STATUS_ERROR_DATA_INVALID);
            ret = VCARD_DONE;
            break;
        }
        /* CAC 1.0 only supports ef = 0 */
        ef = apdu->a_body[0] | (apdu->a_body[1] << 8);
        if (ef != 0) {
            *response = vcard_make_response(
                VCARD7816_STATUS_ERROR_FILE_NOT_FOUND);
            ret = VCARD_DONE;
            break;
        }
        *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
        ret = VCARD_DONE;
        break;
    case VCARD7816_INS_GET_RESPONSE:
    case VCARD7816_INS_VERIFY:
        /* let the 7816 code handle these */
        ret = VCARD_NEXT;
        break;
    case CAC_GET_PROPERTIES:
    case CAC_GET_ACR:
        /* skip these for now, this will probably be needed */
        *response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
        ret = VCARD_DONE;
        break;
    default:
        *response = vcard_make_response(
            VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        ret = VCARD_DONE;
        break;
    }
    return ret;
}

/*
 *  reset the inter call state between applet selects
 */
static VCardStatus
cac_applet_pki_reset(VCard *card, int channel)
{
    VCardAppletPrivate *applet_private = NULL;
    CACPKIAppletData *pki_applet = NULL;
    applet_private = vcard_get_current_applet_private(card, channel);
    assert(applet_private);
    pki_applet = &(applet_private->u.pki_data);

    pki_applet->cert_buffer = NULL;
    if (pki_applet->sign_buffer) {
        g_free(pki_applet->sign_buffer);
        pki_applet->sign_buffer = NULL;
    }
    pki_applet->cert_buffer_len = 0;
    pki_applet->sign_buffer_len = 0;
    return VCARD_DONE;
}

static VCardStatus
cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
                            VCardResponse **response)
{
    CACPKIAppletData *pki_applet = NULL;
    VCardAppletPrivate *applet_private = NULL;
    int size, next;
    unsigned char *sign_buffer;
    vcard_7816_status_t status;
    VCardStatus ret = VCARD_FAIL;

    applet_private = vcard_get_current_applet_private(card, apdu->a_channel);
    assert(applet_private);
    pki_applet = &(applet_private->u.pki_data);

    switch (apdu->a_ins) {
    case CAC_UPDATE_BUFFER:
        *response = vcard_make_response(
            VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
        ret = VCARD_DONE;
        break;
    case CAC_GET_CERTIFICATE:
        if ((apdu->a_p2 != 0) || (apdu->a_p1 != 0)) {
            *response = vcard_make_response(
                             VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
            break;
        }
        assert(pki_applet->cert != NULL);
        size = apdu->a_Le;
        if (pki_applet->cert_buffer == NULL) {
            pki_applet->cert_buffer = pki_applet->cert;
            pki_applet->cert_buffer_len = pki_applet->cert_len;
        }
        size = MIN(size, pki_applet->cert_buffer_len);
        next = MIN(255, pki_applet->cert_buffer_len - size);
        *response = vcard_response_new_bytes(
                        card, pki_applet->cert_buffer, size,
                        apdu->a_Le, next ?
                        VCARD7816_SW1_WARNING_CHANGE :
                        VCARD7816_SW1_SUCCESS,
                        next);
        pki_applet->cert_buffer += size;
        pki_applet->cert_buffer_len -= size;
        if ((*response == NULL) || (next == 0)) {
            pki_applet->cert_buffer = NULL;
        }
        if (*response == NULL) {
            *response = vcard_make_response(
                            VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
        }
        ret = VCARD_DONE;
        break;
    case CAC_SIGN_DECRYPT:
        if (apdu->a_p2 != 0) {
            *response = vcard_make_response(
                             VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
            break;
        }
        size = apdu->a_Lc;

        sign_buffer = realloc(pki_applet->sign_buffer,
                      pki_applet->sign_buffer_len+size);
        if (sign_buffer == NULL) {
            g_free(pki_applet->sign_buffer);
            pki_applet->sign_buffer = NULL;
            pki_applet->sign_buffer_len = 0;
            *response = vcard_make_response(
                            VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
            ret = VCARD_DONE;
            break;
        }
        memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size);
        size += pki_applet->sign_buffer_len;
        switch (apdu->a_p1) {
        case  0x80:
            /* p1 == 0x80 means we haven't yet sent the whole buffer, wait for
             * the rest */
            pki_applet->sign_buffer = sign_buffer;
            pki_applet->sign_buffer_len = size;
            *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
            break;
        case 0x00:
            /* we now have the whole buffer, do the operation, result will be
             * in the sign_buffer */
            status = vcard_emul_rsa_op(card, pki_applet->key,
                                       sign_buffer, size);
            if (status != VCARD7816_STATUS_SUCCESS) {
                *response = vcard_make_response(status);
                break;
            }
            *response = vcard_response_new(card, sign_buffer, size, apdu->a_Le,
                                                     VCARD7816_STATUS_SUCCESS);
            if (*response == NULL) {
                *response = vcard_make_response(
                                VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
            }
            break;
        default:
           *response = vcard_make_response(
                                VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
            break;
        }
        g_free(sign_buffer);
        pki_applet->sign_buffer = NULL;
        pki_applet->sign_buffer_len = 0;
        ret = VCARD_DONE;
        break;
    case CAC_READ_BUFFER:
        /* new CAC call, go ahead and use the old version for now */
        /* TODO: implement */
        *response = vcard_make_response(
                                VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        ret = VCARD_DONE;
        break;
    default:
        ret = cac_common_process_apdu(card, apdu, response);
        break;
    }
    return ret;
}


static VCardStatus
cac_applet_id_process_apdu(VCard *card, VCardAPDU *apdu,
                           VCardResponse **response)
{
    VCardStatus ret = VCARD_FAIL;

    switch (apdu->a_ins) {
    case CAC_UPDATE_BUFFER:
        *response = vcard_make_response(
                        VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
        ret = VCARD_DONE;
        break;
    case CAC_READ_BUFFER:
        /* new CAC call, go ahead and use the old version for now */
        /* TODO: implement */
        *response = vcard_make_response(
                        VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        ret = VCARD_DONE;
        break;
    default:
        ret = cac_common_process_apdu(card, apdu, response);
        break;
    }
    return ret;
}


/*
 * TODO: if we ever want to support general CAC middleware, we will need to
 * implement the various containers.
 */
static VCardStatus
cac_applet_container_process_apdu(VCard *card, VCardAPDU *apdu,
                                  VCardResponse **response)
{
    VCardStatus ret = VCARD_FAIL;

    switch (apdu->a_ins) {
    case CAC_READ_BUFFER:
    case CAC_UPDATE_BUFFER:
        *response = vcard_make_response(
                        VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        ret = VCARD_DONE;
        break;
    default:
        ret = cac_common_process_apdu(card, apdu, response);
        break;
    }
    return ret;
}

/*
 * utilities for creating and destroying the private applet data
 */
static void
cac_delete_pki_applet_private(VCardAppletPrivate *applet_private)
{
    CACPKIAppletData *pki_applet_data = NULL;

    if (applet_private == NULL) {
        return;
    }
    pki_applet_data = &(applet_private->u.pki_data);
    if (pki_applet_data->cert != NULL) {
        g_free(pki_applet_data->cert);
    }
    if (pki_applet_data->sign_buffer != NULL) {
        g_free(pki_applet_data->sign_buffer);
    }
    if (pki_applet_data->key != NULL) {
        vcard_emul_delete_key(pki_applet_data->key);
    }
    g_free(applet_private);
}

static VCardAppletPrivate *
cac_new_pki_applet_private(const unsigned char *cert,
                           int cert_len, VCardKey *key)
{
    CACPKIAppletData *pki_applet_data = NULL;
    VCardAppletPrivate *applet_private = NULL;
    applet_private = (VCardAppletPrivate *)g_malloc(sizeof(VCardAppletPrivate));

    pki_applet_data = &(applet_private->u.pki_data);
    pki_applet_data->cert_buffer = NULL;
    pki_applet_data->cert_buffer_len = 0;
    pki_applet_data->sign_buffer = NULL;
    pki_applet_data->sign_buffer_len = 0;
    pki_applet_data->key = NULL;
    pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1);
    /*
     * if we want to support compression, then we simply change the 0 to a 1
     * and compress the cert data with libz
     */
    pki_applet_data->cert[0] = 0; /* not compressed */
    memcpy(&pki_applet_data->cert[1], cert, cert_len);
    pki_applet_data->cert_len = cert_len+1;

    pki_applet_data->key = key;
    return applet_private;
}


/*
 * create a new cac applet which links to a given cert
 */
static VCardApplet *
cac_new_pki_applet(int i, const unsigned char *cert,
                   int cert_len, VCardKey *key)
{
    VCardAppletPrivate *applet_private = NULL;
    VCardApplet *applet = NULL;
    unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 };
    int pki_aid_len = sizeof(pki_aid);

    pki_aid[pki_aid_len-1] = i;

    applet_private = cac_new_pki_applet_private(cert, cert_len, key);
    if (applet_private == NULL) {
        goto failure;
    }
    applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset,
                              pki_aid, pki_aid_len);
    if (applet == NULL) {
        goto failure;
    }
    vcard_set_applet_private(applet, applet_private,
                             cac_delete_pki_applet_private);
    applet_private = NULL;

    return applet;

failure:
    if (applet_private != NULL) {
        cac_delete_pki_applet_private(applet_private);
    }
    return NULL;
}


static unsigned char cac_default_container_aid[] = {
    0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 };
static unsigned char cac_id_aid[] = {
    0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 };
/*
 * Initialize the cac card. This is the only public function in this file. All
 * the rest are connected through function pointers.
 */
VCardStatus
cac_card_init(VReader *reader, VCard *card,
              const char *params,
              unsigned char * const *cert,
              int cert_len[],
              VCardKey *key[] /* adopt the keys*/,
              int cert_count)
{
    int i;
    VCardApplet *applet;

    /* CAC Cards are VM Cards */
    vcard_set_type(card, VCARD_VM);

    /* create one PKI applet for each cert */
    for (i = 0; i < cert_count; i++) {
        applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]);
        if (applet == NULL) {
            goto failure;
        }
        vcard_add_applet(card, applet);
    }

    /* create a default blank container applet */
    applet = vcard_new_applet(cac_applet_container_process_apdu,
                              NULL, cac_default_container_aid,
                              sizeof(cac_default_container_aid));
    if (applet == NULL) {
        goto failure;
    }
    vcard_add_applet(card, applet);

    /* create a default blank container applet */
    applet = vcard_new_applet(cac_applet_id_process_apdu,
                              NULL, cac_id_aid,
                              sizeof(cac_id_aid));
    if (applet == NULL) {
        goto failure;
    }
    vcard_add_applet(card, applet);
    return VCARD_DONE;

failure:
    return VCARD_FAIL;
}
Commit	Line	Data
111a38b0 RR	1	/*
	2	* implement the applets for the CAC card.
	3	*
	4	* This code is licensed under the GNU LGPL, version 2.1 or later.
	5	* See the COPYING.LIB file in the top-level directory.
	6	*/
	7
	8	#include "qemu-common.h"
	9
	10	#include "cac.h"
	11	#include "vcard.h"
	12	#include "vcard_emul.h"
	13	#include "card_7816.h"
	14
111a38b0 RR	15	/* private data for PKI applets */
	16	typedef struct CACPKIAppletDataStruct {
	17	unsigned char *cert;
	18	int cert_len;
	19	unsigned char *cert_buffer;
	20	int cert_buffer_len;
	21	unsigned char *sign_buffer;
	22	int sign_buffer_len;
	23	VCardKey *key;
	24	} CACPKIAppletData;
	25
	26	/*
	27	* CAC applet private data
	28	*/
	29	struct VCardAppletPrivateStruct {
	30	union {
	31	CACPKIAppletData pki_data;
	32	void *reserved;
	33	} u;
	34	};
	35
	36	/*
	37	* handle all the APDU's that are common to all CAC applets
	38	*/
	39	static VCardStatus
	40	cac_common_process_apdu(VCard card, VCardAPDU apdu, VCardResponse **response)
	41	{
	42	int ef;
57f97834	43	VCardStatus ret = VCARD_FAIL;
111a38b0 RR	44
	45	switch (apdu->a_ins) {
	46	case VCARD7816_INS_SELECT_FILE:
	47	if (apdu->a_p1 != 0x02) {
	48	/* let the 7816 code handle applet switches */
57f97834 AL	49	ret = VCARD_NEXT;
57f97834 AL	50	break;
111a38b0 RR	51	}
	52	/* handle file id setting */
	53	if (apdu->a_Lc != 2) {
	54	*response = vcard_make_response(
	55	VCARD7816_STATUS_ERROR_DATA_INVALID);
57f97834 AL	56	ret = VCARD_DONE;
57f97834 AL	57	break;
111a38b0 RR	58	}
	59	/* CAC 1.0 only supports ef = 0 */
	60	ef = apdu->a_body[0] \| (apdu->a_body[1] << 8);
	61	if (ef != 0) {
	62	*response = vcard_make_response(
	63	VCARD7816_STATUS_ERROR_FILE_NOT_FOUND);
57f97834 AL	64	ret = VCARD_DONE;
57f97834 AL	65	break;
111a38b0 RR	66	}
111a38b0 RR	67	*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
57f97834 AL	68	ret = VCARD_DONE;
57f97834 AL	69	break;
111a38b0 RR	70	case VCARD7816_INS_GET_RESPONSE:
	71	case VCARD7816_INS_VERIFY:
	72	/* let the 7816 code handle these */
57f97834 AL	73	ret = VCARD_NEXT;
57f97834 AL	74	break;
111a38b0 RR	75	case CAC_GET_PROPERTIES:
	76	case CAC_GET_ACR:
	77	/* skip these for now, this will probably be needed */
	78	*response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
57f97834 AL	79	ret = VCARD_DONE;
	80	break;
	81	default:
	82	*response = vcard_make_response(
	83	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
	84	ret = VCARD_DONE;
	85	break;
111a38b0	86	}
57f97834	87	return ret;
111a38b0 RR	88	}
	89
	90	/*
	91	* reset the inter call state between applet selects
	92	*/
	93	static VCardStatus
	94	cac_applet_pki_reset(VCard *card, int channel)
	95	{
	96	VCardAppletPrivate *applet_private = NULL;
	97	CACPKIAppletData *pki_applet = NULL;
	98	applet_private = vcard_get_current_applet_private(card, channel);
	99	assert(applet_private);
	100	pki_applet = &(applet_private->u.pki_data);
	101
	102	pki_applet->cert_buffer = NULL;
	103	if (pki_applet->sign_buffer) {
7267c094	104	g_free(pki_applet->sign_buffer);
111a38b0 RR	105	pki_applet->sign_buffer = NULL;
	106	}
	107	pki_applet->cert_buffer_len = 0;
	108	pki_applet->sign_buffer_len = 0;
	109	return VCARD_DONE;
	110	}
	111
	112	static VCardStatus
	113	cac_applet_pki_process_apdu(VCard card, VCardAPDU apdu,
	114	VCardResponse **response)
	115	{
	116	CACPKIAppletData *pki_applet = NULL;
	117	VCardAppletPrivate *applet_private = NULL;
	118	int size, next;
	119	unsigned char *sign_buffer;
	120	vcard_7816_status_t status;
57f97834	121	VCardStatus ret = VCARD_FAIL;
111a38b0 RR	122
	123	applet_private = vcard_get_current_applet_private(card, apdu->a_channel);
	124	assert(applet_private);
	125	pki_applet = &(applet_private->u.pki_data);
	126
	127	switch (apdu->a_ins) {
	128	case CAC_UPDATE_BUFFER:
	129	*response = vcard_make_response(
	130	VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
57f97834 AL	131	ret = VCARD_DONE;
57f97834 AL	132	break;
111a38b0 RR	133	case CAC_GET_CERTIFICATE:
	134	if ((apdu->a_p2 != 0) \|\| (apdu->a_p1 != 0)) {
	135	*response = vcard_make_response(
	136	VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
	137	break;
	138	}
	139	assert(pki_applet->cert != NULL);
	140	size = apdu->a_Le;
	141	if (pki_applet->cert_buffer == NULL) {
	142	pki_applet->cert_buffer = pki_applet->cert;
	143	pki_applet->cert_buffer_len = pki_applet->cert_len;
	144	}
	145	size = MIN(size, pki_applet->cert_buffer_len);
	146	next = MIN(255, pki_applet->cert_buffer_len - size);
	147	*response = vcard_response_new_bytes(
	148	card, pki_applet->cert_buffer, size,
	149	apdu->a_Le, next ?
	150	VCARD7816_SW1_WARNING_CHANGE :
	151	VCARD7816_SW1_SUCCESS,
	152	next);
	153	pki_applet->cert_buffer += size;
	154	pki_applet->cert_buffer_len -= size;
	155	if ((*response == NULL) \|\| (next == 0)) {
	156	pki_applet->cert_buffer = NULL;
	157	}
	158	if (*response == NULL) {
	159	*response = vcard_make_response(
	160	VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
	161	}
57f97834 AL	162	ret = VCARD_DONE;
57f97834 AL	163	break;
111a38b0 RR	164	case CAC_SIGN_DECRYPT:
	165	if (apdu->a_p2 != 0) {
	166	*response = vcard_make_response(
	167	VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
	168	break;
	169	}
	170	size = apdu->a_Lc;
	171
	172	sign_buffer = realloc(pki_applet->sign_buffer,
	173	pki_applet->sign_buffer_len+size);
	174	if (sign_buffer == NULL) {
7267c094	175	g_free(pki_applet->sign_buffer);
111a38b0 RR	176	pki_applet->sign_buffer = NULL;
	177	pki_applet->sign_buffer_len = 0;
	178	*response = vcard_make_response(
	179	VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
57f97834 AL	180	ret = VCARD_DONE;
57f97834 AL	181	break;
111a38b0 RR	182	}
	183	memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size);
	184	size += pki_applet->sign_buffer_len;
	185	switch (apdu->a_p1) {
	186	case 0x80:
	187	/* p1 == 0x80 means we haven't yet sent the whole buffer, wait for
	188	* the rest */
	189	pki_applet->sign_buffer = sign_buffer;
	190	pki_applet->sign_buffer_len = size;
	191	*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
57f97834	192	break;
111a38b0 RR	193	case 0x00:
	194	/* we now have the whole buffer, do the operation, result will be
	195	* in the sign_buffer */
	196	status = vcard_emul_rsa_op(card, pki_applet->key,
	197	sign_buffer, size);
	198	if (status != VCARD7816_STATUS_SUCCESS) {
	199	*response = vcard_make_response(status);
	200	break;
	201	}
	202	*response = vcard_response_new(card, sign_buffer, size, apdu->a_Le,
	203	VCARD7816_STATUS_SUCCESS);
	204	if (*response == NULL) {
	205	*response = vcard_make_response(
	206	VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
	207	}
	208	break;
	209	default:
	210	*response = vcard_make_response(
	211	VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
	212	break;
	213	}
7267c094	214	g_free(sign_buffer);
111a38b0 RR	215	pki_applet->sign_buffer = NULL;
111a38b0 RR	216	pki_applet->sign_buffer_len = 0;
57f97834 AL	217	ret = VCARD_DONE;
57f97834 AL	218	break;
111a38b0 RR	219	case CAC_READ_BUFFER:
	220	/* new CAC call, go ahead and use the old version for now */
	221	/* TODO: implement */
	222	*response = vcard_make_response(
	223	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
57f97834 AL	224	ret = VCARD_DONE;
	225	break;
	226	default:
	227	ret = cac_common_process_apdu(card, apdu, response);
	228	break;
111a38b0	229	}
57f97834	230	return ret;
111a38b0 RR	231	}
	232
	233
	234	static VCardStatus
	235	cac_applet_id_process_apdu(VCard card, VCardAPDU apdu,
	236	VCardResponse **response)
	237	{
57f97834 AL	238	VCardStatus ret = VCARD_FAIL;
57f97834 AL	239
111a38b0 RR	240	switch (apdu->a_ins) {
	241	case CAC_UPDATE_BUFFER:
	242	*response = vcard_make_response(
	243	VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
57f97834 AL	244	ret = VCARD_DONE;
57f97834 AL	245	break;
111a38b0 RR	246	case CAC_READ_BUFFER:
	247	/* new CAC call, go ahead and use the old version for now */
	248	/* TODO: implement */
	249	*response = vcard_make_response(
	250	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
57f97834 AL	251	ret = VCARD_DONE;
	252	break;
	253	default:
	254	ret = cac_common_process_apdu(card, apdu, response);
	255	break;
111a38b0	256	}
57f97834	257	return ret;
111a38b0 RR	258	}
	259
	260
	261	/*
	262	* TODO: if we ever want to support general CAC middleware, we will need to
	263	* implement the various containers.
	264	*/
	265	static VCardStatus
	266	cac_applet_container_process_apdu(VCard card, VCardAPDU apdu,
	267	VCardResponse **response)
	268	{
57f97834 AL	269	VCardStatus ret = VCARD_FAIL;
57f97834 AL	270
111a38b0 RR	271	switch (apdu->a_ins) {
	272	case CAC_READ_BUFFER:
	273	case CAC_UPDATE_BUFFER:
	274	*response = vcard_make_response(
	275	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
57f97834 AL	276	ret = VCARD_DONE;
57f97834 AL	277	break;
111a38b0	278	default:
57f97834	279	ret = cac_common_process_apdu(card, apdu, response);
111a38b0 RR	280	break;
111a38b0 RR	281	}
57f97834	282	return ret;
111a38b0 RR	283	}
	284
	285	/*
	286	* utilities for creating and destroying the private applet data
	287	*/
	288	static void
	289	cac_delete_pki_applet_private(VCardAppletPrivate *applet_private)
	290	{
	291	CACPKIAppletData *pki_applet_data = NULL;
7fc7e584 AL	292
7fc7e584 AL	293	if (applet_private == NULL) {
111a38b0 RR	294	return;
	295	}
	296	pki_applet_data = &(applet_private->u.pki_data);
	297	if (pki_applet_data->cert != NULL) {
7267c094	298	g_free(pki_applet_data->cert);
111a38b0 RR	299	}
111a38b0 RR	300	if (pki_applet_data->sign_buffer != NULL) {
7267c094	301	g_free(pki_applet_data->sign_buffer);
111a38b0 RR	302	}
	303	if (pki_applet_data->key != NULL) {
	304	vcard_emul_delete_key(pki_applet_data->key);
	305	}
7267c094	306	g_free(applet_private);
111a38b0 RR	307	}
	308
	309	static VCardAppletPrivate *
	310	cac_new_pki_applet_private(const unsigned char *cert,
	311	int cert_len, VCardKey *key)
	312	{
	313	CACPKIAppletData *pki_applet_data = NULL;
	314	VCardAppletPrivate *applet_private = NULL;
7267c094	315	applet_private = (VCardAppletPrivate *)g_malloc(sizeof(VCardAppletPrivate));
111a38b0 RR	316
	317	pki_applet_data = &(applet_private->u.pki_data);
	318	pki_applet_data->cert_buffer = NULL;
	319	pki_applet_data->cert_buffer_len = 0;
	320	pki_applet_data->sign_buffer = NULL;
	321	pki_applet_data->sign_buffer_len = 0;
	322	pki_applet_data->key = NULL;
7267c094	323	pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1);
111a38b0 RR	324	/*
	325	* if we want to support compression, then we simply change the 0 to a 1
	326	* and compress the cert data with libz
	327	*/
	328	pki_applet_data->cert[0] = 0; /* not compressed */
	329	memcpy(&pki_applet_data->cert[1], cert, cert_len);
	330	pki_applet_data->cert_len = cert_len+1;
	331
	332	pki_applet_data->key = key;
	333	return applet_private;
	334	}
	335
	336
	337	/*
	338	* create a new cac applet which links to a given cert
	339	*/
	340	static VCardApplet *
	341	cac_new_pki_applet(int i, const unsigned char *cert,
	342	int cert_len, VCardKey *key)
	343	{
	344	VCardAppletPrivate *applet_private = NULL;
	345	VCardApplet *applet = NULL;
	346	unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 };
	347	int pki_aid_len = sizeof(pki_aid);
	348
	349	pki_aid[pki_aid_len-1] = i;
	350
	351	applet_private = cac_new_pki_applet_private(cert, cert_len, key);
	352	if (applet_private == NULL) {
	353	goto failure;
	354	}
	355	applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset,
	356	pki_aid, pki_aid_len);
	357	if (applet == NULL) {
	358	goto failure;
	359	}
	360	vcard_set_applet_private(applet, applet_private,
	361	cac_delete_pki_applet_private);
	362	applet_private = NULL;
	363
	364	return applet;
	365
	366	failure:
	367	if (applet_private != NULL) {
	368	cac_delete_pki_applet_private(applet_private);
	369	}
	370	return NULL;
	371	}
	372
	373
	374	static unsigned char cac_default_container_aid[] = {
	375	0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 };
	376	static unsigned char cac_id_aid[] = {
	377	0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 };
	378	/*
	379	* Initialize the cac card. This is the only public function in this file. All
	380	* the rest are connected through function pointers.
	381	*/
	382	VCardStatus
	383	cac_card_init(VReader reader, VCard card,
	384	const char *params,
	385	unsigned char * const *cert,
	386	int cert_len[],
	387	VCardKey key[] / adopt the keys*/,
388	int cert_count)
389	{
390	int i;
391	VCardApplet *applet;
392
393	/* CAC Cards are VM Cards */
394	vcard_set_type(card, VCARD_VM);
395
396	/* create one PKI applet for each cert */
397	for (i = 0; i < cert_count; i++) {
398	applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]);
399	if (applet == NULL) {
400	goto failure;
401	}
402	vcard_add_applet(card, applet);
403	}
404
405	/* create a default blank container applet */
406	applet = vcard_new_applet(cac_applet_container_process_apdu,
407	NULL, cac_default_container_aid,
408	sizeof(cac_default_container_aid));
409	if (applet == NULL) {
410	goto failure;
411	}
412	vcard_add_applet(card, applet);
413
414	/* create a default blank container applet */
415	applet = vcard_new_applet(cac_applet_id_process_apdu,
416	NULL, cac_id_aid,
417	sizeof(cac_id_aid));
418	if (applet == NULL) {
419	goto failure;
420	}
421	vcard_add_applet(card, applet);
422	return VCARD_DONE;
423
424	failure:
425	return VCARD_FAIL;
426	}
427