added sc_logout() functionality

git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@1153 c6295689-39f2-0310-b995-f0e70906c6a9

src/libopensc/card-flex.c

@@ -895,6 +895,24 @@ static int flex_pin_cmd(struct sc_card *card, struct sc_pin_cmd_data *data,
 	return r;
 }
 
+static int flex_logout(struct sc_card *card)
+{
+	struct	sc_apdu apdu;
+	int	r;
+
+	sc_format_apdu(card, &apdu, SC_APDU_CASE_1, 0x22, 0x07, 0x00);
+	apdu.cla = 0xF0;
+
+	r = sc_transmit_apdu(card, &apdu);
+	SC_TEST_RET(card->ctx, r, "APDU transmit failed");
+
+	r = sc_check_sw(card, apdu.sw1, apdu.sw2);
+	SC_TEST_RET(card->ctx, r, "Card returned error");
+
+	SC_FUNC_RETURN(card->ctx, 1, r);
+}
+
+
 static struct sc_card_driver * sc_get_driver(void)
 {
 	if (iso_ops == NULL)
@@ -914,6 +932,7 @@ static struct sc_card_driver * sc_get_driver(void)
 	flex_ops.compute_signature = flex_compute_signature;
 	flex_ops.decipher = flex_decipher;
 	flex_ops.pin_cmd = flex_pin_cmd;
+	flex_ops.logout = flex_logout;
         return &flex_drv;
 }
 

src/libopensc/card.c

@@ -458,14 +458,16 @@ int sc_unlock(struct sc_card *card)
 	assert(card != NULL);
 	SC_FUNC_CALLED(card->ctx, 2);
 	sc_mutex_lock(card->mutex);
-        card->lock_count--;
-	assert(card->lock_count >= 0);
-	if (card->lock_count == 0) {
+	assert(card->lock_count >= 1);
+	if (card->lock_count == 1) {
+		if (card->ops->logout != NULL)
+			card->ops->logout(card);
 		if (card->reader->ops->unlock != NULL)
 			r = card->reader->ops->unlock(card->reader, card->slot);
 		card->cache_valid = 0;
 		memset(&card->cache, 0, sizeof(card->cache));
         }
+        card->lock_count--;
         sc_mutex_unlock(card->mutex);
 	SC_FUNC_RETURN(card->ctx, 2, r);
 }

src/libopensc/iso7816.c

@@ -877,6 +877,20 @@ static int iso7816_pin_cmd(struct sc_card *card, struct sc_pin_cmd_data *data,
 	return sc_check_sw(card, apdu->sw1, apdu->sw2);
 }
 
+/* For some cards, selecting the MF clears all access rights gained */
+static int iso7816_logout(struct sc_card *card)
+{
+	struct sc_path in_path;
+	in_path.value[0] = 0x3F;
+	in_path.value[1] = 0x00;
+	in_path.len = 2;
+	in_path.index = 0;
+	in_path.count = 2;
+	in_path.type = SC_PATH_TYPE_PATH;
+
+	return iso7816_select_file(card, &in_path, NULL);
+}
+
 static struct sc_card_operations iso_ops = {
 	NULL,
 };
@@ -914,6 +928,7 @@ struct sc_card_driver * sc_get_iso7816_driver(void)
 		iso_ops.decipher		= iso7816_decipher;
 		iso_ops.check_sw      = iso7816_check_sw;
 		iso_ops.pin_cmd	      = iso7816_pin_cmd;
+		iso_ops.logout        = iso7816_logout;
 	}
 	return &iso_driver;
 }

src/libopensc/opensc.h

@@ -506,6 +506,9 @@ struct sc_card_operations {
 		      int ref_qualifier, const u8 *data, size_t data_len,
 		      int *tries_left);
 
+	/* logout: Resets all access rights that were gained. */
+	int (*logout)(struct sc_card *card);
+
 	/* restore_security_env:  Restores a previously saved security
 	 *   environment, and stores information about the environment to
 	 *   <env_out>, if not NULL. */
@@ -744,6 +747,7 @@ int sc_compute_signature(struct sc_card *card, const u8 * data,
 			 size_t data_len, u8 * out, size_t outlen);
 int sc_verify(struct sc_card *card, unsigned int type, int ref, const u8 *buf,
 	      size_t buflen, int *tries_left);
+int sc_logout(struct sc_card *card);
 int sc_pin_cmd(struct sc_card *card, struct sc_pin_cmd_data *, int *tries_left);
 int sc_change_reference_data(struct sc_card *card, unsigned int type,
 			     int ref, const u8 *old, size_t oldlen,

src/libopensc/sec.c

@@ -95,6 +95,16 @@ int sc_verify(struct sc_card *card, unsigned int type, int ref,
 	return sc_pin_cmd(card, &data, tries_left);
 }
 
+int sc_logout(struct sc_card *card)
+{
+	int r;
+	if (card->ops->logout == NULL)
+		/* Or should we return SC_ERROR_NOT_SUPPORTED? */
+		SC_FUNC_RETURN(card->ctx, 2, SC_NO_ERROR);
+	r = card->ops->logout(card);
+        SC_FUNC_RETURN(card->ctx, 2, r);
+}
+
 int sc_change_reference_data(struct sc_card *card, unsigned int type,
 			     int ref, const u8 *old, size_t oldlen,
 			     const u8 *newref, size_t newlen,

src/pkcs11/framework-pkcs15.c

@@ -709,6 +709,8 @@ static CK_RV pkcs15_logout(struct sc_pkcs11_card *p11card, void *fw_token)
 	cache_pin(fw_token, CKU_SO, NULL, 0);
 	cache_pin(fw_token, CKU_USER, NULL, 0);
 
+	sc_logout(fw_data->p15_card->card);
+
 	if (sc_pkcs11_conf.lock_login)
 		rc = sc_unlock(fw_data->p15_card->card);
 	return sc_to_cryptoki_error(rc, p11card->reader);