[mirror_qemu.git] / libcacard / cac.c

/*
 * implement the applets for the CAC card.
 *
 * This code is licensed under the GNU LGPL, version 2.1 or later.
 * See the COPYING.LIB file in the top-level directory.
 */

#include "qemu-common.h"

#include "cac.h"
#include "vcard.h"
#include "vcard_emul.h"
#include "card_7816.h"

/* private data for PKI applets */
typedef struct CACPKIAppletDataStruct {
    unsigned char *cert;
    int cert_len;
    unsigned char *cert_buffer;
    int cert_buffer_len;
    unsigned char *sign_buffer;
    int sign_buffer_len;
    VCardKey *key;
} CACPKIAppletData;

/*
 * CAC applet private data
 */
struct VCardAppletPrivateStruct {
    union {
        CACPKIAppletData pki_data;
        void *reserved;
    } u;
};

/*
 * handle all the APDU's that are common to all CAC applets
 */
static VCardStatus
cac_common_process_apdu(VCard *card, VCardAPDU *apdu, VCardResponse **response)
{
    int ef;
    VCardStatus ret = VCARD_FAIL;

    switch (apdu->a_ins) {
    case VCARD7816_INS_SELECT_FILE:
        if (apdu->a_p1 != 0x02) {
            /* let the 7816 code handle applet switches */
            ret = VCARD_NEXT;
            break;
        }
        /* handle file id setting */
        if (apdu->a_Lc != 2) {
            *response = vcard_make_response(
                VCARD7816_STATUS_ERROR_DATA_INVALID);
            ret = VCARD_DONE;
            break;
        }
        /* CAC 1.0 only supports ef = 0 */
        ef = apdu->a_body[0] | (apdu->a_body[1] << 8);
        if (ef != 0) {
            *response = vcard_make_response(
                VCARD7816_STATUS_ERROR_FILE_NOT_FOUND);
            ret = VCARD_DONE;
            break;
        }
        *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
        ret = VCARD_DONE;
        break;
    case VCARD7816_INS_GET_RESPONSE:
    case VCARD7816_INS_VERIFY:
        /* let the 7816 code handle these */
        ret = VCARD_NEXT;
        break;
    case CAC_GET_PROPERTIES:
    case CAC_GET_ACR:
        /* skip these for now, this will probably be needed */
        *response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
        ret = VCARD_DONE;
        break;
    default:
        *response = vcard_make_response(
            VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        ret = VCARD_DONE;
        break;
    }
    return ret;
}

/*
 *  reset the inter call state between applet selects
 */
static VCardStatus
cac_applet_pki_reset(VCard *card, int channel)
{
    VCardAppletPrivate *applet_private;
    CACPKIAppletData *pki_applet;
    applet_private = vcard_get_current_applet_private(card, channel);
    assert(applet_private);
    pki_applet = &(applet_private->u.pki_data);

    pki_applet->cert_buffer = NULL;
    g_free(pki_applet->sign_buffer);
    pki_applet->sign_buffer = NULL;
    pki_applet->cert_buffer_len = 0;
    pki_applet->sign_buffer_len = 0;
    return VCARD_DONE;
}

static VCardStatus
cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
                            VCardResponse **response)
{
    CACPKIAppletData *pki_applet;
    VCardAppletPrivate *applet_private;
    int size, next;
    unsigned char *sign_buffer;
    bool retain_sign_buffer = FALSE;
    vcard_7816_status_t status;
    VCardStatus ret = VCARD_FAIL;

    applet_private = vcard_get_current_applet_private(card, apdu->a_channel);
    assert(applet_private);
    pki_applet = &(applet_private->u.pki_data);

    switch (apdu->a_ins) {
    case CAC_UPDATE_BUFFER:
        *response = vcard_make_response(
            VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
        ret = VCARD_DONE;
        break;
    case CAC_GET_CERTIFICATE:
        if ((apdu->a_p2 != 0) || (apdu->a_p1 != 0)) {
            *response = vcard_make_response(
                             VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
            break;
        }
        assert(pki_applet->cert != NULL);
        size = apdu->a_Le;
        if (pki_applet->cert_buffer == NULL) {
            pki_applet->cert_buffer = pki_applet->cert;
            pki_applet->cert_buffer_len = pki_applet->cert_len;
        }
        size = MIN(size, pki_applet->cert_buffer_len);
        next = MIN(255, pki_applet->cert_buffer_len - size);
        *response = vcard_response_new_bytes(
                        card, pki_applet->cert_buffer, size,
                        apdu->a_Le, next ?
                        VCARD7816_SW1_WARNING_CHANGE :
                        VCARD7816_SW1_SUCCESS,
                        next);
        pki_applet->cert_buffer += size;
        pki_applet->cert_buffer_len -= size;
        if ((*response == NULL) || (next == 0)) {
            pki_applet->cert_buffer = NULL;
        }
        if (*response == NULL) {
            *response = vcard_make_response(
                            VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
        }
        ret = VCARD_DONE;
        break;
    case CAC_SIGN_DECRYPT:
        if (apdu->a_p2 != 0) {
            *response = vcard_make_response(
                             VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
            break;
        }
        size = apdu->a_Lc;

        sign_buffer = g_realloc(pki_applet->sign_buffer,
                                pki_applet->sign_buffer_len + size);
        memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size);
        size += pki_applet->sign_buffer_len;
        switch (apdu->a_p1) {
        case  0x80:
            /* p1 == 0x80 means we haven't yet sent the whole buffer, wait for
             * the rest */
            pki_applet->sign_buffer = sign_buffer;
            pki_applet->sign_buffer_len = size;
            *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
            retain_sign_buffer = TRUE;
            break;
        case 0x00:
            /* we now have the whole buffer, do the operation, result will be
             * in the sign_buffer */
            status = vcard_emul_rsa_op(card, pki_applet->key,
                                       sign_buffer, size);
            if (status != VCARD7816_STATUS_SUCCESS) {
                *response = vcard_make_response(status);
                break;
            }
            *response = vcard_response_new(card, sign_buffer, size, apdu->a_Le,
                                                     VCARD7816_STATUS_SUCCESS);
            if (*response == NULL) {
                *response = vcard_make_response(
                                VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
            }
            break;
        default:
           *response = vcard_make_response(
                                VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
            break;
        }
        if (!retain_sign_buffer) {
            g_free(sign_buffer);
            pki_applet->sign_buffer = NULL;
            pki_applet->sign_buffer_len = 0;
        }
        ret = VCARD_DONE;
        break;
    case CAC_READ_BUFFER:
        /* new CAC call, go ahead and use the old version for now */
        /* TODO: implement */
        *response = vcard_make_response(
                                VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        ret = VCARD_DONE;
        break;
    default:
        ret = cac_common_process_apdu(card, apdu, response);
        break;
    }
    return ret;
}


static VCardStatus
cac_applet_id_process_apdu(VCard *card, VCardAPDU *apdu,
                           VCardResponse **response)
{
    VCardStatus ret = VCARD_FAIL;

    switch (apdu->a_ins) {
    case CAC_UPDATE_BUFFER:
        *response = vcard_make_response(
                        VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
        ret = VCARD_DONE;
        break;
    case CAC_READ_BUFFER:
        /* new CAC call, go ahead and use the old version for now */
        /* TODO: implement */
        *response = vcard_make_response(
                        VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        ret = VCARD_DONE;
        break;
    default:
        ret = cac_common_process_apdu(card, apdu, response);
        break;
    }
    return ret;
}


/*
 * TODO: if we ever want to support general CAC middleware, we will need to
 * implement the various containers.
 */
static VCardStatus
cac_applet_container_process_apdu(VCard *card, VCardAPDU *apdu,
                                  VCardResponse **response)
{
    VCardStatus ret = VCARD_FAIL;

    switch (apdu->a_ins) {
    case CAC_READ_BUFFER:
    case CAC_UPDATE_BUFFER:
        *response = vcard_make_response(
                        VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        ret = VCARD_DONE;
        break;
    default:
        ret = cac_common_process_apdu(card, apdu, response);
        break;
    }
    return ret;
}

/*
 * utilities for creating and destroying the private applet data
 */
static void
cac_delete_pki_applet_private(VCardAppletPrivate *applet_private)
{
    CACPKIAppletData *pki_applet_data;

    if (applet_private == NULL) {
        return;
    }
    pki_applet_data = &(applet_private->u.pki_data);
    g_free(pki_applet_data->cert);
    g_free(pki_applet_data->sign_buffer);
    if (pki_applet_data->key != NULL) {
        vcard_emul_delete_key(pki_applet_data->key);
    }
    g_free(applet_private);
}

static VCardAppletPrivate *
cac_new_pki_applet_private(const unsigned char *cert,
                           int cert_len, VCardKey *key)
{
    CACPKIAppletData *pki_applet_data;
    VCardAppletPrivate *applet_private;

    applet_private = g_new0(VCardAppletPrivate, 1);
    pki_applet_data = &(applet_private->u.pki_data);
    pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1);
    /*
     * if we want to support compression, then we simply change the 0 to a 1
     * and compress the cert data with libz
     */
    pki_applet_data->cert[0] = 0; /* not compressed */
    memcpy(&pki_applet_data->cert[1], cert, cert_len);
    pki_applet_data->cert_len = cert_len+1;

    pki_applet_data->key = key;
    return applet_private;
}


/*
 * create a new cac applet which links to a given cert
 */
static VCardApplet *
cac_new_pki_applet(int i, const unsigned char *cert,
                   int cert_len, VCardKey *key)
{
    VCardAppletPrivate *applet_private;
    VCardApplet *applet;
    unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 };
    int pki_aid_len = sizeof(pki_aid);

    pki_aid[pki_aid_len-1] = i;

    applet_private = cac_new_pki_applet_private(cert, cert_len, key);
    if (applet_private == NULL) {
        goto failure;
    }
    applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset,
                              pki_aid, pki_aid_len);
    if (applet == NULL) {
        goto failure;
    }
    vcard_set_applet_private(applet, applet_private,
                             cac_delete_pki_applet_private);
    applet_private = NULL;

    return applet;

failure:
    if (applet_private != NULL) {
        cac_delete_pki_applet_private(applet_private);
    }
    return NULL;
}


static unsigned char cac_default_container_aid[] = {
    0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 };
static unsigned char cac_id_aid[] = {
    0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 };
/*
 * Initialize the cac card. This is the only public function in this file. All
 * the rest are connected through function pointers.
 */
VCardStatus
cac_card_init(VReader *reader, VCard *card,
              const char *params,
              unsigned char * const *cert,
              int cert_len[],
              VCardKey *key[] /* adopt the keys*/,
              int cert_count)
{
    int i;
    VCardApplet *applet;

    /* CAC Cards are VM Cards */
    vcard_set_type(card, VCARD_VM);

    /* create one PKI applet for each cert */
    for (i = 0; i < cert_count; i++) {
        applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]);
        if (applet == NULL) {
            goto failure;
        }
        vcard_add_applet(card, applet);
    }

    /* create a default blank container applet */
    applet = vcard_new_applet(cac_applet_container_process_apdu,
                              NULL, cac_default_container_aid,
                              sizeof(cac_default_container_aid));
    if (applet == NULL) {
        goto failure;
    }
    vcard_add_applet(card, applet);

    /* create a default blank container applet */
    applet = vcard_new_applet(cac_applet_id_process_apdu,
                              NULL, cac_id_aid,
                              sizeof(cac_id_aid));
    if (applet == NULL) {
        goto failure;
    }
    vcard_add_applet(card, applet);
    return VCARD_DONE;

failure:
    return VCARD_FAIL;
}
Commit	Line	Data
111a38b0 RR	1	/*
	2	* implement the applets for the CAC card.
	3	*
	4	* This code is licensed under the GNU LGPL, version 2.1 or later.
	5	* See the COPYING.LIB file in the top-level directory.
	6	*/
	7
	8	#include "qemu-common.h"
	9
	10	#include "cac.h"
	11	#include "vcard.h"
	12	#include "vcard_emul.h"
	13	#include "card_7816.h"
	14
111a38b0 RR	15	/* private data for PKI applets */
	16	typedef struct CACPKIAppletDataStruct {
	17	unsigned char *cert;
	18	int cert_len;
	19	unsigned char *cert_buffer;
	20	int cert_buffer_len;
	21	unsigned char *sign_buffer;
	22	int sign_buffer_len;
	23	VCardKey *key;
	24	} CACPKIAppletData;
	25
	26	/*
	27	* CAC applet private data
	28	*/
	29	struct VCardAppletPrivateStruct {
	30	union {
	31	CACPKIAppletData pki_data;
	32	void *reserved;
	33	} u;
	34	};
	35
	36	/*
	37	* handle all the APDU's that are common to all CAC applets
	38	*/
	39	static VCardStatus
	40	cac_common_process_apdu(VCard card, VCardAPDU apdu, VCardResponse **response)
	41	{
	42	int ef;
57f97834	43	VCardStatus ret = VCARD_FAIL;
111a38b0 RR	44
	45	switch (apdu->a_ins) {
	46	case VCARD7816_INS_SELECT_FILE:
	47	if (apdu->a_p1 != 0x02) {
	48	/* let the 7816 code handle applet switches */
57f97834 AL	49	ret = VCARD_NEXT;
57f97834 AL	50	break;
111a38b0 RR	51	}
	52	/* handle file id setting */
	53	if (apdu->a_Lc != 2) {
	54	*response = vcard_make_response(
	55	VCARD7816_STATUS_ERROR_DATA_INVALID);
57f97834 AL	56	ret = VCARD_DONE;
57f97834 AL	57	break;
111a38b0 RR	58	}
	59	/* CAC 1.0 only supports ef = 0 */
	60	ef = apdu->a_body[0] \| (apdu->a_body[1] << 8);
	61	if (ef != 0) {
	62	*response = vcard_make_response(
	63	VCARD7816_STATUS_ERROR_FILE_NOT_FOUND);
57f97834 AL	64	ret = VCARD_DONE;
57f97834 AL	65	break;
111a38b0 RR	66	}
111a38b0 RR	67	*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
57f97834 AL	68	ret = VCARD_DONE;
57f97834 AL	69	break;
111a38b0 RR	70	case VCARD7816_INS_GET_RESPONSE:
	71	case VCARD7816_INS_VERIFY:
	72	/* let the 7816 code handle these */
57f97834 AL	73	ret = VCARD_NEXT;
57f97834 AL	74	break;
111a38b0 RR	75	case CAC_GET_PROPERTIES:
	76	case CAC_GET_ACR:
	77	/* skip these for now, this will probably be needed */
	78	*response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
57f97834 AL	79	ret = VCARD_DONE;
	80	break;
	81	default:
	82	*response = vcard_make_response(
	83	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
	84	ret = VCARD_DONE;
	85	break;
111a38b0	86	}
57f97834	87	return ret;
111a38b0 RR	88	}
	89
	90	/*
	91	* reset the inter call state between applet selects
	92	*/
	93	static VCardStatus
	94	cac_applet_pki_reset(VCard *card, int channel)
	95	{
1687a089 MT	96	VCardAppletPrivate *applet_private;
1687a089 MT	97	CACPKIAppletData *pki_applet;
111a38b0 RR	98	applet_private = vcard_get_current_applet_private(card, channel);
	99	assert(applet_private);
	100	pki_applet = &(applet_private->u.pki_data);
	101
	102	pki_applet->cert_buffer = NULL;
ec15993d MA	103	g_free(pki_applet->sign_buffer);
ec15993d MA	104	pki_applet->sign_buffer = NULL;
111a38b0 RR	105	pki_applet->cert_buffer_len = 0;
	106	pki_applet->sign_buffer_len = 0;
	107	return VCARD_DONE;
	108	}
	109
	110	static VCardStatus
	111	cac_applet_pki_process_apdu(VCard card, VCardAPDU apdu,
	112	VCardResponse **response)
	113	{
1687a089 MT	114	CACPKIAppletData *pki_applet;
1687a089 MT	115	VCardAppletPrivate *applet_private;
111a38b0 RR	116	int size, next;
111a38b0 RR	117	unsigned char *sign_buffer;
81b49e8f	118	bool retain_sign_buffer = FALSE;
111a38b0	119	vcard_7816_status_t status;
57f97834	120	VCardStatus ret = VCARD_FAIL;
111a38b0 RR	121
	122	applet_private = vcard_get_current_applet_private(card, apdu->a_channel);
	123	assert(applet_private);
	124	pki_applet = &(applet_private->u.pki_data);
	125
	126	switch (apdu->a_ins) {
	127	case CAC_UPDATE_BUFFER:
	128	*response = vcard_make_response(
	129	VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
57f97834 AL	130	ret = VCARD_DONE;
57f97834 AL	131	break;
111a38b0 RR	132	case CAC_GET_CERTIFICATE:
	133	if ((apdu->a_p2 != 0) \|\| (apdu->a_p1 != 0)) {
	134	*response = vcard_make_response(
	135	VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
	136	break;
	137	}
	138	assert(pki_applet->cert != NULL);
	139	size = apdu->a_Le;
	140	if (pki_applet->cert_buffer == NULL) {
	141	pki_applet->cert_buffer = pki_applet->cert;
	142	pki_applet->cert_buffer_len = pki_applet->cert_len;
	143	}
	144	size = MIN(size, pki_applet->cert_buffer_len);
	145	next = MIN(255, pki_applet->cert_buffer_len - size);
	146	*response = vcard_response_new_bytes(
	147	card, pki_applet->cert_buffer, size,
	148	apdu->a_Le, next ?
	149	VCARD7816_SW1_WARNING_CHANGE :
	150	VCARD7816_SW1_SUCCESS,
	151	next);
	152	pki_applet->cert_buffer += size;
	153	pki_applet->cert_buffer_len -= size;
	154	if ((*response == NULL) \|\| (next == 0)) {
	155	pki_applet->cert_buffer = NULL;
	156	}
	157	if (*response == NULL) {
	158	*response = vcard_make_response(
	159	VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
	160	}
57f97834 AL	161	ret = VCARD_DONE;
57f97834 AL	162	break;
111a38b0 RR	163	case CAC_SIGN_DECRYPT:
	164	if (apdu->a_p2 != 0) {
	165	*response = vcard_make_response(
	166	VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
	167	break;
	168	}
	169	size = apdu->a_Lc;
	170
26b78f4d MA	171	sign_buffer = g_realloc(pki_applet->sign_buffer,
26b78f4d MA	172	pki_applet->sign_buffer_len + size);
111a38b0 RR	173	memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size);
	174	size += pki_applet->sign_buffer_len;
	175	switch (apdu->a_p1) {
	176	case 0x80:
	177	/* p1 == 0x80 means we haven't yet sent the whole buffer, wait for
	178	* the rest */
	179	pki_applet->sign_buffer = sign_buffer;
	180	pki_applet->sign_buffer_len = size;
	181	*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
81b49e8f	182	retain_sign_buffer = TRUE;
57f97834	183	break;
111a38b0 RR	184	case 0x00:
	185	/* we now have the whole buffer, do the operation, result will be
	186	* in the sign_buffer */
	187	status = vcard_emul_rsa_op(card, pki_applet->key,
	188	sign_buffer, size);
	189	if (status != VCARD7816_STATUS_SUCCESS) {
	190	*response = vcard_make_response(status);
	191	break;
	192	}
	193	*response = vcard_response_new(card, sign_buffer, size, apdu->a_Le,
	194	VCARD7816_STATUS_SUCCESS);
	195	if (*response == NULL) {
	196	*response = vcard_make_response(
	197	VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
	198	}
	199	break;
	200	default:
	201	*response = vcard_make_response(
	202	VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
	203	break;
	204	}
81b49e8f RS	205	if (!retain_sign_buffer) {
	206	g_free(sign_buffer);
	207	pki_applet->sign_buffer = NULL;
	208	pki_applet->sign_buffer_len = 0;
	209	}
57f97834 AL	210	ret = VCARD_DONE;
57f97834 AL	211	break;
111a38b0 RR	212	case CAC_READ_BUFFER:
	213	/* new CAC call, go ahead and use the old version for now */
	214	/* TODO: implement */
	215	*response = vcard_make_response(
	216	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
57f97834 AL	217	ret = VCARD_DONE;
	218	break;
	219	default:
	220	ret = cac_common_process_apdu(card, apdu, response);
	221	break;
111a38b0	222	}
57f97834	223	return ret;
111a38b0 RR	224	}
	225
	226
	227	static VCardStatus
	228	cac_applet_id_process_apdu(VCard card, VCardAPDU apdu,
	229	VCardResponse **response)
	230	{
57f97834 AL	231	VCardStatus ret = VCARD_FAIL;
57f97834 AL	232
111a38b0 RR	233	switch (apdu->a_ins) {
	234	case CAC_UPDATE_BUFFER:
	235	*response = vcard_make_response(
	236	VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
57f97834 AL	237	ret = VCARD_DONE;
57f97834 AL	238	break;
111a38b0 RR	239	case CAC_READ_BUFFER:
	240	/* new CAC call, go ahead and use the old version for now */
	241	/* TODO: implement */
	242	*response = vcard_make_response(
	243	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
57f97834 AL	244	ret = VCARD_DONE;
	245	break;
	246	default:
	247	ret = cac_common_process_apdu(card, apdu, response);
	248	break;
111a38b0	249	}
57f97834	250	return ret;
111a38b0 RR	251	}
	252
	253
	254	/*
	255	* TODO: if we ever want to support general CAC middleware, we will need to
	256	* implement the various containers.
	257	*/
	258	static VCardStatus
	259	cac_applet_container_process_apdu(VCard card, VCardAPDU apdu,
	260	VCardResponse **response)
	261	{
57f97834 AL	262	VCardStatus ret = VCARD_FAIL;
57f97834 AL	263
111a38b0 RR	264	switch (apdu->a_ins) {
	265	case CAC_READ_BUFFER:
	266	case CAC_UPDATE_BUFFER:
	267	*response = vcard_make_response(
	268	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
57f97834 AL	269	ret = VCARD_DONE;
57f97834 AL	270	break;
111a38b0	271	default:
57f97834	272	ret = cac_common_process_apdu(card, apdu, response);
111a38b0 RR	273	break;
111a38b0 RR	274	}
57f97834	275	return ret;
111a38b0 RR	276	}
	277
	278	/*
	279	* utilities for creating and destroying the private applet data
	280	*/
	281	static void
	282	cac_delete_pki_applet_private(VCardAppletPrivate *applet_private)
	283	{
1687a089	284	CACPKIAppletData *pki_applet_data;
7fc7e584 AL	285
7fc7e584 AL	286	if (applet_private == NULL) {
111a38b0 RR	287	return;
	288	}
	289	pki_applet_data = &(applet_private->u.pki_data);
ec15993d MA	290	g_free(pki_applet_data->cert);
ec15993d MA	291	g_free(pki_applet_data->sign_buffer);
111a38b0 RR	292	if (pki_applet_data->key != NULL) {
	293	vcard_emul_delete_key(pki_applet_data->key);
	294	}
7267c094	295	g_free(applet_private);
111a38b0 RR	296	}
	297
	298	static VCardAppletPrivate *
	299	cac_new_pki_applet_private(const unsigned char *cert,
	300	int cert_len, VCardKey *key)
	301	{
78a4b8d2 MT	302	CACPKIAppletData *pki_applet_data;
78a4b8d2 MT	303	VCardAppletPrivate *applet_private;
111a38b0	304
78a4b8d2	305	applet_private = g_new0(VCardAppletPrivate, 1);
111a38b0	306	pki_applet_data = &(applet_private->u.pki_data);
7267c094	307	pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1);
111a38b0 RR	308	/*
	309	* if we want to support compression, then we simply change the 0 to a 1
	310	* and compress the cert data with libz
	311	*/
	312	pki_applet_data->cert[0] = 0; /* not compressed */
	313	memcpy(&pki_applet_data->cert[1], cert, cert_len);
	314	pki_applet_data->cert_len = cert_len+1;
	315
	316	pki_applet_data->key = key;
	317	return applet_private;
	318	}
	319
	320
	321	/*
	322	* create a new cac applet which links to a given cert
	323	*/
	324	static VCardApplet *
	325	cac_new_pki_applet(int i, const unsigned char *cert,
	326	int cert_len, VCardKey *key)
	327	{
1687a089 MT	328	VCardAppletPrivate *applet_private;
1687a089 MT	329	VCardApplet *applet;
111a38b0 RR	330	unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 };
	331	int pki_aid_len = sizeof(pki_aid);
	332
	333	pki_aid[pki_aid_len-1] = i;
	334
	335	applet_private = cac_new_pki_applet_private(cert, cert_len, key);
	336	if (applet_private == NULL) {
	337	goto failure;
	338	}
	339	applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset,
	340	pki_aid, pki_aid_len);
	341	if (applet == NULL) {
	342	goto failure;
	343	}
	344	vcard_set_applet_private(applet, applet_private,
	345	cac_delete_pki_applet_private);
	346	applet_private = NULL;
	347
	348	return applet;
	349
	350	failure:
	351	if (applet_private != NULL) {
	352	cac_delete_pki_applet_private(applet_private);
	353	}
	354	return NULL;
	355	}
	356
	357
	358	static unsigned char cac_default_container_aid[] = {
	359	0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 };
	360	static unsigned char cac_id_aid[] = {
	361	0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 };
	362	/*
	363	* Initialize the cac card. This is the only public function in this file. All
	364	* the rest are connected through function pointers.
	365	*/
	366	VCardStatus
	367	cac_card_init(VReader reader, VCard card,
	368	const char *params,
	369	unsigned char * const *cert,
	370	int cert_len[],
	371	VCardKey key[] / adopt the keys*/,
	372	int cert_count)
	373	{
	374	int i;
	375	VCardApplet *applet;
	376
	377	/* CAC Cards are VM Cards */
	378	vcard_set_type(card, VCARD_VM);
	379
	380	/* create one PKI applet for each cert */
	381	for (i = 0; i < cert_count; i++) {
	382	applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]);
	383	if (applet == NULL) {
	384	goto failure;
	385	}
	386	vcard_add_applet(card, applet);
	387	}
	388
	389	/* create a default blank container applet */
	390	applet = vcard_new_applet(cac_applet_container_process_apdu,
	391	NULL, cac_default_container_aid,
	392	sizeof(cac_default_container_aid));
	393	if (applet == NULL) {
394	goto failure;
395	}
396	vcard_add_applet(card, applet);
397
398	/* create a default blank container applet */
399	applet = vcard_new_applet(cac_applet_id_process_apdu,
400	NULL, cac_id_aid,
401	sizeof(cac_id_aid));
402	if (applet == NULL) {
403	goto failure;
404	}
405	vcard_add_applet(card, applet);
406	return VCARD_DONE;
407
408	failure:
409	return VCARD_FAIL;
410	}
411