Minidriver currently has basic support for unblocking card PIN by providing
PUK as an administrator password to CardUnblockPin() function.
However, this doesn't work for example when trying to unblock PIN via
system smartcard PIN unblock screen accessible after pressing Ctrl+Alt+Del
as it wants to use challenge / response authentication.
MS Smart Card Minidriver specification (version 7.07) explicitly says that
challenge / response is the only authentication mode that Windows uses to
authenticate an administrator.
Unfortunately, this way of unblocking PIN seems to not be widely supported
by cards.
However, we can simply treat the provided response to challenge as PUK.
Because (at least) Ctrl+Alt+Del PIN unblock screen accepts only hex string,
every PUK digit X has to be input as '3X' (without quotes) there.
Also the response string is not hidden behind asterisks on this screen as
it should been.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Minidriver contained a hack since commit 7ef766b785 in 2010 to print to
debug file directly under mingw (instead of using normal OpenSC logging
system), as there was problem with "%S" format specifier then.
However, on recent mingw versions "%S" format works fine so let's remove
this hack.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Some of existing code prints pointer differences, but without taking into
account that printf length modifier required for this differs between
systems.
Add SC_FORMAT_LEN_PTRDIFF_T macro for this, just as we have for size_t
variables.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Add "--reset" parameter with optional argument to opensc-tool which
resets a card in reader. Both cold or warm resets are possible
(cold is default).
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
C_OpenSession() creates a long int session handle from address of allocated
session struct, however it has to be taken into consideration that on Win64
long int is still 32-bit, so the address is going to be truncated and
because of that not guaranteed to be unique.
Add session handle uniqueness check to catch when there is already a
session with the same handle present.
This also fixes a warning when building on 64-bit mingw.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
SM test in configure.ac makes use of LIB_PRE and DYN_LIB_EXT variables so
let's move it further down in this file, just after these variables are
assigned.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
This commit fixes most of warnings shown by GCC on 64-bit Linux, 32-bit and
64-bit mingw builds (with SM and OpenSSL enabled).
These warnings were mostly caused by missing casts.
In minidriver there was also a bit of unused variables and dead code.
Remaining warnings on mingw are mostly caused by GCC not recognizing on
this platform "ll" size specifier (present at least since
Visual Studio 2005, also in mingw own CRT) and "z" size specifier (this one
will be fixed in next commits).
There is also a warning about pointer truncation on Win64 when making
PKCS#11 object handle from pointer to this object.
This is a legitimate warning, since it could result in the same handles
being generated from different pointers and so from different objects.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Currently, minidriver build is broken on mingw. Let's make it work again.
For this, include adapted cardmod-mingw-compat.h with few function argument
decorations from Alon Bar-Lev's old build repository to make mingw build
almost self-contained - still requires cardmod.h from CNG, however.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Minidriver installer custom action library needs WiX SDK to build.
Since installer is an optional component anyway let's detect whether WiX
SDK is present on build platform and then decide whether to build installer
custom action library or not.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
OpenSC used SUSv3 "z" printf length modifier for printing size_t variables,
however this modifier is not available on Windows ("I" must be used
instead), at least for now.
Introduce SC_FORMAT_LEN_SIZE_T define for that purpose and convert existing
code to use it when printing size_t variables.
This define can't go into libopensc/internal.h since tools use it, too.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
sc_pkcs15_unblock_pin() in libopensc/pkcs15-pin.c wants to associate PIN
to be unblocked with its PUK to check, for example, whether provided PUK
conforms to its policy.
When this function is not able to find a relevant PUK is uses policy for
PIN to be unblocked instead to check provided PUK which causes problems if
PIN and PUK policies differ.
Set PIN-PUK association for cards where it was unset and where this
association was either obvious, described in code or specs or provided
by the community.
Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
* pkcs11-tool: Add feature to get random data.
Getting random data is an essential part of the PKCS11 API.
This patch provides a new command line parameter to get
random data from the pkcs11-tool.
Tested with a Yubikey (PIV applet) and the following command line:
$ pkcs11-tool --slot=0 --generate-random=128 | hexdump -C
00000000 0c 35 85 2e 85 68 ab ce e8 56 b3 f6 f3 33 e6 37 |.5...h...V...3.7|
00000010 12 10 eb fd 8a 1e 75 b7 3f 4d fa 61 8f ab d8 bf |......u.?M.a....|
00000020 f7 2c 7d ba 07 a5 45 6e a7 85 1c 47 3b 46 01 2c |.,}...En...G;F.,|
00000030 79 18 6e 51 4d c4 ae 20 37 37 1d 7b 7e b0 d5 18 |y.nQM.. 77.{~...|
00000040 ef a4 3c 09 91 68 db dd 2a a8 fc b9 34 06 2a ee |..<..h..*...4.*.|
00000050 5a 86 55 54 11 1f ef 4e 07 73 79 27 0a e4 58 cf |Z.UT...N.sy'..X.|
00000060 f4 bd bc 2f ad 27 b1 a7 a4 fa c7 1a 7b 31 de a3 |.../.'......{1..|
00000070 e8 dc 85 28 18 82 00 45 3c f8 eb 48 a4 20 e4 3b |...(...E<..H. .;|
00000080
Signed-off-by: Christoph Müllner <christophm30@gmail.com>
* pkcs11-tool: Add documenation for --generate-random.
Signed-off-by: Christoph Müllner <christophm30@gmail.com>
As defined in BSI TR-03119 to issue SCardTransmit (with Uses
Pseudo-APDU) instead of SCardControl (with FEATURE_VERIFY_PIN_DIRECT).
It allows using a very basic PC/SC reader driver without special support
for PIN verification or modification (such as the default CCID driver on
Windows).
Also gets IFD vendor information via escape commands.
PC/SC's Get Uid command is now only triggered if enable_escape = true;
was set by the user to allow disabling wrapped commands on broken
readers (see https://github.com/OpenSC/OpenSC/issues/810)
(Imported libcardnpa from https://github.com/frankmorgner/vsmartcard)
- Added generic SM implementation of ISO/IEC 7816-8
- Added implementation of extended access control as defined by
- BSI TR-03110
- ICAO Doc 9303
- ISO/IEC 7501
- Added tool for German ID card (and other EAC tokens)
- renamed folder libsm to sm
The old code only support encrypted communication for ePass2003 USB PKI
Token, now add plaintext communication support, the code now can using
ePass2003 USB PKI Token and ePass2003 PKI applet with java card.
The last mask code has issue, cannot show the OEM ID and SN, not modify
it. the rule made by Feitian only.
* Includes adding support for parsing extensions from a certificate.
* Move lebytes2ushort() to related functions in internals.h
* Adds Simple TLV related functions
The test_signature routine reuses data array and fails to reset data[0] = 0
when creating a PKCS hash to be pased to OpenSSL.
Date: Mon Feb 13 11:48:00 2017 -0600
On branch pkcs11-tool-pkcs
Changes to be committed:
modified: tools/pkcs11-tool.c
* pteid: remove OID setting for data objects as they are not defined for this token
Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>
* pteid: order data objects code list by address and rename new objects
The ICAO MRTD specification defines the Security Object Document
abreviation as SOd and not SOD. This is a breaking change since
the labels are case sensitive, but this object was not yet available
on the last stable release.
Trace is also not a acronym or abreviation, so it should be defined with
normal casing. Also a breaking change and also acceptable because it is
unstable code only.
Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>
_validate_pin was not being called at all during a PIN verification.
After this tools report correctly when the PIN length is invalid, even on pkcs11 layer.
Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>
Authentication might not be required (from pkcs11 side) when
pin cache is used. This can't happen if a pinpad is used.
We were already checking for CKA_ALWAYS_AUTHENTICATE (user_consent),
now also check for CKF_PROTECTED_AUTHENTICATION_PATH (pinpad).
Also encapsulate logic in a function and provide additional checks for
redundant authentication attempts.
Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>
* Use cm_ctx instead of a custom cwa struct. Get rid of sc_reset.
* Use ifd.sn and icc.sn from sm_cwa_session struct too
* Minor typo with sizeof
closes https://github.com/OpenSC/OpenSC/issues/930
* pkcs15-init,pkcs15-tool: reword --no-prompt to --use-pinpad (close#944)
Wording was confusing for a novice user. Old option is mantained as an alias,
but will print to stderr a deprecation warning.
Deprecation related code is all marked with deprecated word to easy future removal.
Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>
* pkcs15-init,pkcs15-tool: document --use-pinpad
Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>