]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * implement the applets for the CAC card. | |
3 | * | |
4 | * This code is licensed under the GNU LGPL, version 2.1 or later. | |
5 | * See the COPYING.LIB file in the top-level directory. | |
6 | */ | |
7 | ||
8 | #include "qemu-common.h" | |
9 | ||
10 | #include "cac.h" | |
11 | #include "vcard.h" | |
12 | #include "vcard_emul.h" | |
13 | #include "card_7816.h" | |
14 | ||
15 | /* private data for PKI applets */ | |
16 | typedef struct CACPKIAppletDataStruct { | |
17 | unsigned char *cert; | |
18 | int cert_len; | |
19 | unsigned char *cert_buffer; | |
20 | int cert_buffer_len; | |
21 | unsigned char *sign_buffer; | |
22 | int sign_buffer_len; | |
23 | VCardKey *key; | |
24 | } CACPKIAppletData; | |
25 | ||
26 | /* | |
27 | * CAC applet private data | |
28 | */ | |
29 | struct VCardAppletPrivateStruct { | |
30 | union { | |
31 | CACPKIAppletData pki_data; | |
32 | void *reserved; | |
33 | } u; | |
34 | }; | |
35 | ||
36 | /* | |
37 | * handle all the APDU's that are common to all CAC applets | |
38 | */ | |
39 | static VCardStatus | |
40 | cac_common_process_apdu(VCard *card, VCardAPDU *apdu, VCardResponse **response) | |
41 | { | |
42 | int ef; | |
43 | VCardStatus ret = VCARD_FAIL; | |
44 | ||
45 | switch (apdu->a_ins) { | |
46 | case VCARD7816_INS_SELECT_FILE: | |
47 | if (apdu->a_p1 != 0x02) { | |
48 | /* let the 7816 code handle applet switches */ | |
49 | ret = VCARD_NEXT; | |
50 | break; | |
51 | } | |
52 | /* handle file id setting */ | |
53 | if (apdu->a_Lc != 2) { | |
54 | *response = vcard_make_response( | |
55 | VCARD7816_STATUS_ERROR_DATA_INVALID); | |
56 | ret = VCARD_DONE; | |
57 | break; | |
58 | } | |
59 | /* CAC 1.0 only supports ef = 0 */ | |
60 | ef = apdu->a_body[0] | (apdu->a_body[1] << 8); | |
61 | if (ef != 0) { | |
62 | *response = vcard_make_response( | |
63 | VCARD7816_STATUS_ERROR_FILE_NOT_FOUND); | |
64 | ret = VCARD_DONE; | |
65 | break; | |
66 | } | |
67 | *response = vcard_make_response(VCARD7816_STATUS_SUCCESS); | |
68 | ret = VCARD_DONE; | |
69 | break; | |
70 | case VCARD7816_INS_GET_RESPONSE: | |
71 | case VCARD7816_INS_VERIFY: | |
72 | /* let the 7816 code handle these */ | |
73 | ret = VCARD_NEXT; | |
74 | break; | |
75 | case CAC_GET_PROPERTIES: | |
76 | case CAC_GET_ACR: | |
77 | /* skip these for now, this will probably be needed */ | |
78 | *response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT); | |
79 | ret = VCARD_DONE; | |
80 | break; | |
81 | default: | |
82 | *response = vcard_make_response( | |
83 | VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED); | |
84 | ret = VCARD_DONE; | |
85 | break; | |
86 | } | |
87 | return ret; | |
88 | } | |
89 | ||
90 | /* | |
91 | * reset the inter call state between applet selects | |
92 | */ | |
93 | static VCardStatus | |
94 | cac_applet_pki_reset(VCard *card, int channel) | |
95 | { | |
96 | VCardAppletPrivate *applet_private = NULL; | |
97 | CACPKIAppletData *pki_applet = NULL; | |
98 | applet_private = vcard_get_current_applet_private(card, channel); | |
99 | assert(applet_private); | |
100 | pki_applet = &(applet_private->u.pki_data); | |
101 | ||
102 | pki_applet->cert_buffer = NULL; | |
103 | if (pki_applet->sign_buffer) { | |
104 | g_free(pki_applet->sign_buffer); | |
105 | pki_applet->sign_buffer = NULL; | |
106 | } | |
107 | pki_applet->cert_buffer_len = 0; | |
108 | pki_applet->sign_buffer_len = 0; | |
109 | return VCARD_DONE; | |
110 | } | |
111 | ||
112 | static VCardStatus | |
113 | cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu, | |
114 | VCardResponse **response) | |
115 | { | |
116 | CACPKIAppletData *pki_applet = NULL; | |
117 | VCardAppletPrivate *applet_private = NULL; | |
118 | int size, next; | |
119 | unsigned char *sign_buffer; | |
120 | vcard_7816_status_t status; | |
121 | VCardStatus ret = VCARD_FAIL; | |
122 | ||
123 | applet_private = vcard_get_current_applet_private(card, apdu->a_channel); | |
124 | assert(applet_private); | |
125 | pki_applet = &(applet_private->u.pki_data); | |
126 | ||
127 | switch (apdu->a_ins) { | |
128 | case CAC_UPDATE_BUFFER: | |
129 | *response = vcard_make_response( | |
130 | VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED); | |
131 | ret = VCARD_DONE; | |
132 | break; | |
133 | case CAC_GET_CERTIFICATE: | |
134 | if ((apdu->a_p2 != 0) || (apdu->a_p1 != 0)) { | |
135 | *response = vcard_make_response( | |
136 | VCARD7816_STATUS_ERROR_P1_P2_INCORRECT); | |
137 | break; | |
138 | } | |
139 | assert(pki_applet->cert != NULL); | |
140 | size = apdu->a_Le; | |
141 | if (pki_applet->cert_buffer == NULL) { | |
142 | pki_applet->cert_buffer = pki_applet->cert; | |
143 | pki_applet->cert_buffer_len = pki_applet->cert_len; | |
144 | } | |
145 | size = MIN(size, pki_applet->cert_buffer_len); | |
146 | next = MIN(255, pki_applet->cert_buffer_len - size); | |
147 | *response = vcard_response_new_bytes( | |
148 | card, pki_applet->cert_buffer, size, | |
149 | apdu->a_Le, next ? | |
150 | VCARD7816_SW1_WARNING_CHANGE : | |
151 | VCARD7816_SW1_SUCCESS, | |
152 | next); | |
153 | pki_applet->cert_buffer += size; | |
154 | pki_applet->cert_buffer_len -= size; | |
155 | if ((*response == NULL) || (next == 0)) { | |
156 | pki_applet->cert_buffer = NULL; | |
157 | } | |
158 | if (*response == NULL) { | |
159 | *response = vcard_make_response( | |
160 | VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE); | |
161 | } | |
162 | ret = VCARD_DONE; | |
163 | break; | |
164 | case CAC_SIGN_DECRYPT: | |
165 | if (apdu->a_p2 != 0) { | |
166 | *response = vcard_make_response( | |
167 | VCARD7816_STATUS_ERROR_P1_P2_INCORRECT); | |
168 | break; | |
169 | } | |
170 | size = apdu->a_Lc; | |
171 | ||
172 | sign_buffer = realloc(pki_applet->sign_buffer, | |
173 | pki_applet->sign_buffer_len+size); | |
174 | if (sign_buffer == NULL) { | |
175 | g_free(pki_applet->sign_buffer); | |
176 | pki_applet->sign_buffer = NULL; | |
177 | pki_applet->sign_buffer_len = 0; | |
178 | *response = vcard_make_response( | |
179 | VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE); | |
180 | ret = VCARD_DONE; | |
181 | break; | |
182 | } | |
183 | memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size); | |
184 | size += pki_applet->sign_buffer_len; | |
185 | switch (apdu->a_p1) { | |
186 | case 0x80: | |
187 | /* p1 == 0x80 means we haven't yet sent the whole buffer, wait for | |
188 | * the rest */ | |
189 | pki_applet->sign_buffer = sign_buffer; | |
190 | pki_applet->sign_buffer_len = size; | |
191 | *response = vcard_make_response(VCARD7816_STATUS_SUCCESS); | |
192 | ret = VCARD_DONE; | |
193 | break; | |
194 | case 0x00: | |
195 | /* we now have the whole buffer, do the operation, result will be | |
196 | * in the sign_buffer */ | |
197 | status = vcard_emul_rsa_op(card, pki_applet->key, | |
198 | sign_buffer, size); | |
199 | if (status != VCARD7816_STATUS_SUCCESS) { | |
200 | *response = vcard_make_response(status); | |
201 | break; | |
202 | } | |
203 | *response = vcard_response_new(card, sign_buffer, size, apdu->a_Le, | |
204 | VCARD7816_STATUS_SUCCESS); | |
205 | if (*response == NULL) { | |
206 | *response = vcard_make_response( | |
207 | VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE); | |
208 | } | |
209 | break; | |
210 | default: | |
211 | *response = vcard_make_response( | |
212 | VCARD7816_STATUS_ERROR_P1_P2_INCORRECT); | |
213 | break; | |
214 | } | |
215 | g_free(sign_buffer); | |
216 | pki_applet->sign_buffer = NULL; | |
217 | pki_applet->sign_buffer_len = 0; | |
218 | ret = VCARD_DONE; | |
219 | break; | |
220 | case CAC_READ_BUFFER: | |
221 | /* new CAC call, go ahead and use the old version for now */ | |
222 | /* TODO: implement */ | |
223 | *response = vcard_make_response( | |
224 | VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED); | |
225 | ret = VCARD_DONE; | |
226 | break; | |
227 | default: | |
228 | ret = cac_common_process_apdu(card, apdu, response); | |
229 | break; | |
230 | } | |
231 | return ret; | |
232 | } | |
233 | ||
234 | ||
235 | static VCardStatus | |
236 | cac_applet_id_process_apdu(VCard *card, VCardAPDU *apdu, | |
237 | VCardResponse **response) | |
238 | { | |
239 | VCardStatus ret = VCARD_FAIL; | |
240 | ||
241 | switch (apdu->a_ins) { | |
242 | case CAC_UPDATE_BUFFER: | |
243 | *response = vcard_make_response( | |
244 | VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED); | |
245 | ret = VCARD_DONE; | |
246 | break; | |
247 | case CAC_READ_BUFFER: | |
248 | /* new CAC call, go ahead and use the old version for now */ | |
249 | /* TODO: implement */ | |
250 | *response = vcard_make_response( | |
251 | VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED); | |
252 | ret = VCARD_DONE; | |
253 | break; | |
254 | default: | |
255 | ret = cac_common_process_apdu(card, apdu, response); | |
256 | break; | |
257 | } | |
258 | return ret; | |
259 | } | |
260 | ||
261 | ||
262 | /* | |
263 | * TODO: if we ever want to support general CAC middleware, we will need to | |
264 | * implement the various containers. | |
265 | */ | |
266 | static VCardStatus | |
267 | cac_applet_container_process_apdu(VCard *card, VCardAPDU *apdu, | |
268 | VCardResponse **response) | |
269 | { | |
270 | VCardStatus ret = VCARD_FAIL; | |
271 | ||
272 | switch (apdu->a_ins) { | |
273 | case CAC_READ_BUFFER: | |
274 | case CAC_UPDATE_BUFFER: | |
275 | *response = vcard_make_response( | |
276 | VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED); | |
277 | ret = VCARD_DONE; | |
278 | break; | |
279 | default: | |
280 | ret = cac_common_process_apdu(card, apdu, response); | |
281 | break; | |
282 | } | |
283 | return ret; | |
284 | } | |
285 | ||
286 | /* | |
287 | * utilities for creating and destroying the private applet data | |
288 | */ | |
289 | static void | |
290 | cac_delete_pki_applet_private(VCardAppletPrivate *applet_private) | |
291 | { | |
292 | CACPKIAppletData *pki_applet_data = NULL; | |
293 | ||
294 | if (applet_private == NULL) { | |
295 | return; | |
296 | } | |
297 | pki_applet_data = &(applet_private->u.pki_data); | |
298 | if (pki_applet_data->cert != NULL) { | |
299 | g_free(pki_applet_data->cert); | |
300 | } | |
301 | if (pki_applet_data->sign_buffer != NULL) { | |
302 | g_free(pki_applet_data->sign_buffer); | |
303 | } | |
304 | if (pki_applet_data->key != NULL) { | |
305 | vcard_emul_delete_key(pki_applet_data->key); | |
306 | } | |
307 | g_free(applet_private); | |
308 | } | |
309 | ||
310 | static VCardAppletPrivate * | |
311 | cac_new_pki_applet_private(const unsigned char *cert, | |
312 | int cert_len, VCardKey *key) | |
313 | { | |
314 | CACPKIAppletData *pki_applet_data = NULL; | |
315 | VCardAppletPrivate *applet_private = NULL; | |
316 | applet_private = (VCardAppletPrivate *)g_malloc(sizeof(VCardAppletPrivate)); | |
317 | ||
318 | pki_applet_data = &(applet_private->u.pki_data); | |
319 | pki_applet_data->cert_buffer = NULL; | |
320 | pki_applet_data->cert_buffer_len = 0; | |
321 | pki_applet_data->sign_buffer = NULL; | |
322 | pki_applet_data->sign_buffer_len = 0; | |
323 | pki_applet_data->key = NULL; | |
324 | pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1); | |
325 | /* | |
326 | * if we want to support compression, then we simply change the 0 to a 1 | |
327 | * and compress the cert data with libz | |
328 | */ | |
329 | pki_applet_data->cert[0] = 0; /* not compressed */ | |
330 | memcpy(&pki_applet_data->cert[1], cert, cert_len); | |
331 | pki_applet_data->cert_len = cert_len+1; | |
332 | ||
333 | pki_applet_data->key = key; | |
334 | return applet_private; | |
335 | } | |
336 | ||
337 | ||
338 | /* | |
339 | * create a new cac applet which links to a given cert | |
340 | */ | |
341 | static VCardApplet * | |
342 | cac_new_pki_applet(int i, const unsigned char *cert, | |
343 | int cert_len, VCardKey *key) | |
344 | { | |
345 | VCardAppletPrivate *applet_private = NULL; | |
346 | VCardApplet *applet = NULL; | |
347 | unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 }; | |
348 | int pki_aid_len = sizeof(pki_aid); | |
349 | ||
350 | pki_aid[pki_aid_len-1] = i; | |
351 | ||
352 | applet_private = cac_new_pki_applet_private(cert, cert_len, key); | |
353 | if (applet_private == NULL) { | |
354 | goto failure; | |
355 | } | |
356 | applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset, | |
357 | pki_aid, pki_aid_len); | |
358 | if (applet == NULL) { | |
359 | goto failure; | |
360 | } | |
361 | vcard_set_applet_private(applet, applet_private, | |
362 | cac_delete_pki_applet_private); | |
363 | applet_private = NULL; | |
364 | ||
365 | return applet; | |
366 | ||
367 | failure: | |
368 | if (applet_private != NULL) { | |
369 | cac_delete_pki_applet_private(applet_private); | |
370 | } | |
371 | return NULL; | |
372 | } | |
373 | ||
374 | ||
375 | static unsigned char cac_default_container_aid[] = { | |
376 | 0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 }; | |
377 | static unsigned char cac_id_aid[] = { | |
378 | 0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 }; | |
379 | /* | |
380 | * Initialize the cac card. This is the only public function in this file. All | |
381 | * the rest are connected through function pointers. | |
382 | */ | |
383 | VCardStatus | |
384 | cac_card_init(VReader *reader, VCard *card, | |
385 | const char *params, | |
386 | unsigned char * const *cert, | |
387 | int cert_len[], | |
388 | VCardKey *key[] /* adopt the keys*/, | |
389 | int cert_count) | |
390 | { | |
391 | int i; | |
392 | VCardApplet *applet; | |
393 | ||
394 | /* CAC Cards are VM Cards */ | |
395 | vcard_set_type(card, VCARD_VM); | |
396 | ||
397 | /* create one PKI applet for each cert */ | |
398 | for (i = 0; i < cert_count; i++) { | |
399 | applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]); | |
400 | if (applet == NULL) { | |
401 | goto failure; | |
402 | } | |
403 | vcard_add_applet(card, applet); | |
404 | } | |
405 | ||
406 | /* create a default blank container applet */ | |
407 | applet = vcard_new_applet(cac_applet_container_process_apdu, | |
408 | NULL, cac_default_container_aid, | |
409 | sizeof(cac_default_container_aid)); | |
410 | if (applet == NULL) { | |
411 | goto failure; | |
412 | } | |
413 | vcard_add_applet(card, applet); | |
414 | ||
415 | /* create a default blank container applet */ | |
416 | applet = vcard_new_applet(cac_applet_id_process_apdu, | |
417 | NULL, cac_id_aid, | |
418 | sizeof(cac_id_aid)); | |
419 | if (applet == NULL) { | |
420 | goto failure; | |
421 | } | |
422 | vcard_add_applet(card, applet); | |
423 | return VCARD_DONE; | |
424 | ||
425 | failure: | |
426 | return VCARD_FAIL; | |
427 | } | |
428 |