pkcs15-tool.c:1201:5: warning: no previous prototype for ‘unlink_cb’ [-Wmissing-prototypes]
int unlink_cb(const char *fpath, const struct stat *sb, int typeflag, struct FTW *ftwbuf)
^~~~~~~~~
If --jobs=... argument is used for make (or the equivalent MAKEFLAGS is
defined) then the command "make clean update depend" fails because the 3
actions must be done in sequence and not in parallel.
OpenSSL header files are used indirectly by the binaries.
Fix the compilation error:
CC base64.o
In file included from base64.c:6:
In file included from ../../src/libopensc/asn1.h:29:
In file included from ../../src/libopensc/pkcs15.h:29:
In file included from ../../src/libopensc/aux-data.h:31:
In file included from ../../src/libopensc/internal.h:44:
../../src/libopensc/sc-ossl-compat.h:30:10: fatal error: 'openssl/opensslv.h'
file not found
^
1 error generated.
OpenSSL is configured to be installed in $PREFIX so the files should be
checked in $BUILDPATH/openssl_bin/$PREFIX/lib/pkgconfig and not
$BUILDPATH/openssl_bin/lib/pkgconfig
1. Solved multiple epss2003
2. check expats point to prevent memory leak
3. Add new ATR for entersafe PKI card
4. declare all variables at the beginning of block
5. Solved Incorrect PIN raise wrong CKR error, no token flags change
Closes https://github.com/OpenSC/OpenSC/pull/879
This commit is based on input from https://github.com/lbschenkel
LibreSSL is based on OpenSSL 1.0.1. API.
Changes to be committed:
modified: libopensc/sc-ossl-compat.h
modified: tools/pkcs11-tool.c
modified: tools/pkcs15-init.c
modified: tools/sc-hsm-tool.c
OpenSSL-1.1.0 was released 8/25/2016
OpenSSL-1.1.0a was released 9/22/2016
https://www.openssl.org/news/openssl-1.1.0-notes.html
Changes to allow the OpenSC code base to work with OpenSSL versions from
0.9.7 to 1.1.0 with few changes.
This is an update and rebased version of my prep-openssl-1.1.0-pre6 branch.
No attempt was made to back port any OpenSSL features. These changes
just allow an updated OpenSC code base to use what is in the various OpenSSL
releases.
A new header libopensc/sc-ossl-compat.h contains extra defines
to reduce the need for so many #if OPENSSL_VERSION_NUMBER statements
in the source code.
The OpenSC source can now use the OpenSSL 1.1 API. The libopensc/sc-ossl-compat.h
has defines for the new API for use with older versions of OpenSSL.
sc-ossl-compat.h is included by libopensc/internal.h so all OpenSC
library routines can take advantage of it. For the tools, which do not use
libopensc/internal.h, libopensc/sc-ossl-compat.h is included by the tools.
The OpenSC source has been modified to use OpenSSL functions to access
hidden structures, such X509, BIGNUM, EVP_CIPHER_CTX, and use XXX_new
functions to allocate structures which must use pointer such as
BIGNUM and EVP_CIPHER_CTX.
For backward compatability sc-ossl-compat.h now defines inline routines
to emulate the RSA and DSA access routines in OpenSSL-1.1.0. Thus
the same OpenSC source code can be used with openSSL versions from
0.9.7 to 1.1.0.
Inline routines were chosen, because using macros does not work on all platforms.
Having OpenSC versions of these routines in libopensc would be a posibility,
but they are only used for older version of OpenSSL, and could be removed in
the future.
Changes to be committed:
modified: src/libopensc/card-entersafe.c
modified: src/libopensc/card-epass2003.c
modified: src/libopensc/card-gids.c
modified: src/libopensc/card-gpk.c
modified: src/libopensc/card-oberthur.c
modified: src/libopensc/card-piv.c
modified: src/libopensc/card-westcos.c
modified: src/libopensc/cwa-dnie.c
modified: src/libopensc/cwa14890.c
modified: src/libopensc/internal.h
modified: src/libopensc/p15card-helper.c
modified: src/libopensc/pkcs15-itacns.c
modified: src/libopensc/pkcs15-prkey.c
modified: src/libopensc/pkcs15-pubkey.c
new file: src/libopensc/sc-ossl-compat.h
modified: src/pkcs11/openssl.c
modified: src/pkcs15init/pkcs15-lib.c
modified: src/pkcs15init/pkcs15-oberthur-awp.c
modified: src/pkcs15init/pkcs15-oberthur.c
modified: src/pkcs15init/pkcs15-oberthur.h
modified: src/pkcs15init/pkcs15-westcos.c
modified: src/tools/cryptoflex-tool.c
modified: src/tools/gids-tool.c
modified: src/tools/netkey-tool.c
modified: src/tools/piv-tool.c
modified: src/tools/pkcs11-tool.c
modified: src/tools/pkcs15-init.c
modified: src/tools/sc-hsm-tool.c
modified: src/tools/westcos-tool.c
Due to bugs in Travis CI:
$ ./bootstrap
autoreconf: Entering directory `.'
autoreconf: configure.ac: not using Gettext
autoreconf: running: aclocal --force -I m4
autoreconf: configure.ac: tracing
autoreconf: running: glibtoolize --copy --force
/usr/local/bin/glibtoolize: line 401: /usr/local/Library/ENV/4.3/sed: No such file or directory
/usr/local/bin/glibtoolize: line 401: /usr/local/Library/ENV/4.3/sed: No such file or directory
/usr/local/bin/glibtoolize: line 401: /usr/local/Library/ENV/4.3/sed: No such file or directory
Apply solution from https://github.com/mkrufky/libdvbtee/issues/22 .
Fixes#881
Commit 2f10de4f5c ("use sc_pkcs15_get_pin_info in C_GetTokenInfo")
introduced dependency of logged in state returned for session
by C_GetTokenInfo() on logged_in field of that session slot PIN.
This field is updated by sending pin_cmd of type SC_PIN_CMD_GET_INFO to
card.
However, not all cards support such pin_cmd type (in fact, majority of
them don't). In this case logged_in field is usually left zero-initialized
which means SC_PIN_STATE_LOGGED_OUT.
With such logged_in field value C_GetTokenInfo() always returns
CKS_R{O,W}_PUBLIC_SESSION, instead of CKS_R{O,W}_USER_FUNCTIONS when
logged in.
At least Firefox (and probably other NSS-based software, too) is confused
by such value and keeps repeating PIN prompts a few times until it
ultimately considers that logging in to this slot has failed.
Fix this by initializing PIN logged_in field to SC_PIN_STATE_UNKNOWN for
cards that do not support SC_PIN_CMD_GET_INFO pin_cmd.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
"CHANGE REFERENCE DATA" (PIN change) and "RESET RETRY COUNTER"
(PIN unblock) commands in OpenPGP card have various limitations.
These also depend on whether the card is version 1.x or 2.x.
Provide helpful debug messages for user in case he is trying to do
a PIN command in a way that isn't supported by the card.
Also, take into account that version 2.x cards don't support references to
PW1-mode 2 (82) in these commands - change them to PW1 (81).
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
According to descriptions of commands "PSO: COMPUTE DIGITAL SIGNATURE",
"PSO: DECIPHER" and "INTERNAL AUTHENTICATE" in OpenPGP card spec (versions
1.1 and 2.1.1) the card adds / strips and checks PKCS#1 padding
automatically.
There is no documented way to perform raw RSA operations on this card so
SC_ALGORITHM_RSA_RAW flag shouldn't be set.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
_get_auth_object_by_name() in pkcs11/framework-pkcs15.c needs user PIN
to be the first one and then next one can be signature PIN, but OpenPGP
card had it reversed.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
The code attempted to handle extensions assuming extensions were ordered. The
only extension it handled was crl's, but the handling was wrong and I didn't
find any actual use of the crl code. I've changed it to cache all the extensions
and then provided accessors functions to read a specific extension. I needed this
to read the key Usage, but the extension fetching code can work with any extension
(though the caller will need to parse the result. I also added code that parses DN
and returns a specifically requested DN component. I needed this to get the Common
Name for the certificate Subject. This gives the token a 'unique' name rather than
some generic name (like CAC-I or CAC-II). Both of these can be used to enhance the
piv support as well.
rebased by VTA
Closes#852
When sc_lock obtains a reader lock this function is called
If the card was reset the PIV AID is seletcted and logged_in is reset.
This is need for some PIV cards where the default AID is not the PIV AID
and some other process has reset the card.
closes#842
Add card_reader_lock_obtained function to sc_card_operations
During sc_lock, if card->reader->ops->lock is called, card->ops->card_reader_lock_obtained will be called.
If PCSC is being used as the reader driver, this occures just after pcsc_lock has done a SCardBeginTransaction
and our process has exclusive control over the card. The card driver can then determine if the state of the
card has changed, and take action to get the card into an acceptable state.
If card->reader->ops->lock returns SC_ERROR_CARD_RESET, indicating some other process has interefered
with the state of the card. was_reset=1 is passed to card->ops->card_reader_lock_obtained.
Some examples of actions that could be done by the card driver is to select the AID and reset logged_in.
Currently the card driver is not notified. So no default card_reader_lock_obtained is defined in iso7816.c
After card reset detected, run SM open under new transaction
Before trying to reestablish SM session or onte code that may
need to use a transaction, get the transaction that will be
used by the caller od sc_lock.
closes#837
Ludovic Rousseau
Ludovic Rousseau
Feitian Technologies
Jakuje
Doug Engert
Frank Morgner
Viktor Tarasov
Leonardo Brondani Schenkel
Remy
Nikos Mavrogiannopoulos
CardContact Systems GmbH
Ian Young
Raul Metsma
Maciej S. Szmigiero
Jakub Jelen
Sid-Ali TEIR
Hannu Honkanen
Nuno Goncalves