When getting string configuration parameter,
ignore non 'auto-configurated' in configuration file value
(ex. @SOME_VALUE_IN_OPENSC_CONF@) and return it's default value.
- Create/delete the PKCS#15 'DATA' objects destinated to supply support of minidriver. For a while only 'Gemalto' style of such support is implemented.
- Declare epass2003 pkcs15init operations.
- include into OpenSC configuration the SM related sections
With loadable secure-messaging module the SM wrapping of APDUs is performed
by entity external to the running application.
So that the SM keysets
TODO: amend detailed description
Replace the "one-trick-pony" pgp_do_iswritable() with a more generic
function returning the blob matching the passed tag.
This way we can get rid of the one-line function pgp_blob_iswritable() too.
comparisons like these can be done in the caller.
Set pin references to 0x01 - 0x03 instead of 0x81 - 0x83.
The PINs are referenced as PIN1- PIN3 (resp. PW1 - PW3) in the OpenPGP
card specification.
Technically the APDUs to verify/change the PINs contain the values OR-ed
with 0x80, but this is just a technical detail of the implementation
which the emulated file system can hide in pgp_pin_cmd().
Pros & Cons:
+ consistent PIN naming
+ no trouble entering the correct PIN names in opensc-explorer et.al.
("verify CHV1" is way better than "verify CHV129")
- manually entering the correct APDU for VERIFY is a bit more complex.
(who does this anyway, when there are better functions)
While at it, change if .. elsif ... cascade to switch statement.
The the pInitArgs argument of C_Initialize() is not NULL it is a pointer
to a CK_C_INITIALIZE_ARGS structure.
This structure contains a flags bitfield with possible values:
- CKF_LIBRARY_CANT_CREATE_OS_THREADS
- CKF_OS_LOCKING_OK
This flags parameter is now parsed and displayed.
New operations:
- 'erase-application' -- erase on-card application indicated by it's AID;
- 'update-lastupdate' -- parse tokenInfo, set 'lastUpdate' value to the current date and write back tokenInfo content;
- 'ignore-ca-certificates' -- when importing PKCS#12 ignore all CA certificates;
When reading and printing file content, do not read it by small chunks,
but read an entire file.
It allows to verify how card driver reads the data of maximal size
that is allowed for one transaction ('max_recv_size').
call sc_profile_finish() with application info data as an argument;
in delete-by-path procedure, when getting authorization to delete file, make distinction between 'DELETE' and 'DELETE-SELF';
call card specific 'store' handler updating PrKDF and PubKDF files;
deduce the private key pkcs#15 attributes (like subject) from the friend certificate;
ignore SM authentication type when getting authorisation for operation;
copy GUID from the object create data to the pkcs#15 object attributes.
Decode/encode 'subjectName' attribute from the 'CommonPubkeyAttributes'
Use macros for the size of the asn1_entry tables.
Use short call form for debug messages.
Procedure to convert the pkcs15 public key to EVP_PKEY type key.
Coding style issues.
Decoding/encoding of the 'algReference' attribute from the 'CommonKeyAttributes'.
Use macros for the size of the asn1_entry tables.
Use short call form for debug messages.
Procedure to deduce from certificate the attributes of private key PKCS#15 object.
Procedure to convert the pkcs15 private key to EVP_PKEY type key.
Coding style issues.
pkcs11-spy.c(168) : warning C4047: 'function' : 'DWORD' differs in levels of indirection from 'DWORD *'
pkcs11-spy.c(168) : warning C4024: 'ExpandEnvironmentStringsA' : different types for formal and actual parameter 3
pkcs11-spy.c(205) : warning C4047: 'function' : 'DWORD' differs in levels of indirection from 'DWORD *'
pkcs11-spy.c(205) : warning C4024: 'ExpandEnvironmentStringsA' : different types for formal and actual parameter 3
* parse more extened capabilities & features into a private enum
* for v2.0 cards, always parse the "historical bytes" DO
reason: ATR may be static and thus cannot reflect the state
PKCS#15 spec v1.1 says:
TokenInfo.version: This field contains the number of the particular version
of this specification the application is based upon. For this version of this
document, the value of version shall be 0 (v1).
Thanks to Martin Paljak for the finding.
* change order of long & short option names: letters first, then the long names
Effect: nicely aligned short and long option names in the help text
* more space between option names and explanation
Effect: better readability on long options
* print "Options:" header only if there is at least one non-hidden options
Effect: nicer output when all options are hidden
* only show printable, non-space short options letters
Effect: no control codes printed to terminal
* get rid of a temporary variable
To be used in windows:
"In Windows, file handles can not be shared between DLL-s, each DLL has a separate file handle table.
For that reason reopen debug file before every debug message."
sc_context_repair() procedure from Hunter William
"Workaround some threading and data lifetime issues when card handle changes and need to re-associate card"
http://www.opensc-project.org/pipermail/opensc-devel/2011-December/017445.html
Introduce some usefull define macros, error code 'inconsistent configuration'.
Introduce procedure to calculate CRC32 digest,
to be used in minidriver to calculate the 'freshness' values.
Add to the spy logs the timestamp with millisecond resolution.
Environment strings are accepted in the key registries paths related to spy module.
pkcs11-spy: code formatting
improvements to opensc-explorer & new tool openpgp-tool
Usefull improvement: probably could be used in automated tests.
I follow Ludovic and attract your attention onto the necessity, in the nearest future,
to supply the doc/man for the tool newly introduced.
Without it the build of OpenSC package will simply not be possible.
The on-card support of minidriver could need some MD specific pkcs#15 (DATA) objects.
There is no standard for these objects.
New option will allow to choose one of the possible implementations.
Add new argument 'application-info',
that will allow to select the on-card application to by binded with.
pkcs11: use sc_pkcs15init_bind with 'AID' argument
Prototype of sc_pkcs15init_bind() has been changed to add argument with
AID of the on-card application to be binded with.
In card detection procedure bind all present applications
and create tokens for them.
Treatement of the different 'create-slots' configuration cases,
joining the objects from different applications into one slot
are previewed for the next commits.
At the moment symbolic names for the on-card applications are 'generic', 'protected'.
This distinction used by pkcs11 and minidriver module to select the
'master' application in the cases when only reduced number of slots (one)
can be exposed by module (minidriver) or particular configuration (pkcs11).
- simplify some of framework handles: remove from it's prototype the arguments that can be derived from the other arguments;
for exemple: foo(slot, slot->card) --> foo(slot)
- add the 'application' argument to the bind, unbind and similar handles;
- preview more then one framework data attached to the pkcs11card object.
- placehold for the future 'derive' and 'can_do' handles.
'OnePIN' version of opensc-pkcs11 module is not installed.
Instead, in the 'pkcs11' section of OpenSC configuration,
there is a possibility to define in a different manner
how to create slots for the present PINs and applications.
Add 'echo' command that simply displays its arguments.
With the recently committed script interpreter feature and this echo command,
nice litte scripts can be written, like e.g.
$ cat opengpg-userinfo
#!/usr/bin/opensc-explorer
cd 0065
echo Name:
cat 005B
echo Language:
cat 5F2D
echo Gender:
cat 5F35
quit
If the system libraries are set before the locally built libraries,
libtool will pick the system copy of OpenSC instead of the local one,
and that can make cross-builds fail badly.
This patch is already applied in Gentoo for proper building.
Determine data for sc_pkcs15_card's tokeninfo structure
from sc_pkcs15_card's card structure.
This makes sure the two stay consistent as much as possible.
new commands for opensc-explorer and bugfix for iso7816 driver
- opensc-explorer: new find command:
tested; nice, useful feature.
- opensc-explorer: pace:
no means to test -- accepted.
- iso driver:
really bug, thanks.
Implements PC/SC interface to PACE-enabled readers defined in PC/SC
pt. 10 AMD 1 and BSI TR-03119.
PACE can be started using `sc_perform_pace`. This function currently
calls the new `perform_pace` from `struct sc_reader_operations`, if the
reader has the needed capabilities. `sc_perform_pace` could also be
extended with a stand-alone implementation of PACE (code could be
imported from here http://vsmartcard.sourceforge.net/npa/README.html).
Note that the reader's PACE capabilities are correctly determined by
calling GetReaderPACECapabilities.
OpenSC's new PACE capabilities can be tested using the `npa-tool` from
the Virtual Smart Card Architecture (see link above).
A change introduced in c0072d16dd made the
compilation fail:
pkcs11-display.c:738:1: error: conflicting types for 'lookup_enum_spec'
pkcs11-display.h:64:13: note: previous declaration of 'lookup_enum_spec' was here
* Print out warning when mlock fails, and continue.
* The warning required a ctx to be passed in, so that means
changing a few function signatures.
https://www.opensc-project.org/opensc/ticket/389
This seems the right thing to do, when you look at the initial commit which added the flags in do_generate_key and the ticket
http://www.opensc-project.org/opensc/ticket/198
Currently when storing a key, the accessflags are not set
The output format of a hex dump has changed from:
668C045A 1C3A4EF4 CF8550F3 20926525 1E8BF478
to:
00000000 66 8C 04 5A 1C 3A 4E F4 CF 85 50 F3 20 92 65 25 f..Z.:N...P. .e%
00000010 1E 8B F4 78 ...x
Is it now possible to find text strings inside a hex dump
openssl.c: In function 'sc_pkcs11_verify_data':
openssl.c:384:19: warning: 'pkey_ctx' may be used uninitialized in this function [-Wuninitialized]
openssl.c:325:16: note: 'pkey_ctx' was declared here
Specify the path of the Address PIN for IAS-based cards in order to properly
read the Citizen Address Data object. Remove the "Citizen Data" object
association with the Address PIN, as it incorrectly describes the card layout.
http://www.opensc-project.org/opensc/ticket/400.
Change-Id: I7ca81d6d15c5e2b137ff3c9a40b7471eb2fad55c
C_CloseSession() and C_CloseAllSessions() were calling sc_debug() before
any check on the validity of the context. So if C_Initialize() was not
previously called you get an assert:
log.c:76: sc_do_log_va: Assertion `ctx != ((void *)0)' failed.
../../src/libopensc/cardctl.h:231:30: warning: comma at end of enumerator list
../../src/libopensc/cardctl.h:629:13: warning: comma at end of enumerator list
The code that treated a timeout as success was never reached, because the
surrounding if eliminated the possibility of entering the block when the return code
from SCardGetStatusChange was SCARD_E_TIMEOUT.
Issue found by Coverity Scan.
Some pinpads do not support PIN size less than 4 or greater than 8.
PC/SC v2 part 10 allows to ask the driver/reader for the supported
values. This avoids to have the SECURE PIN CCID command rejected by the
reader.
This should fix OpenSC ticket #361 "card-entersafe should ask the pinpad
reader for the maximum pin size"
The timeout parameter of SCardGetStatusChange() is a DWORD (unsigned
int). An int timeout parameter was used instead.
The problem happens on 64-bits architectures where DWORD is 64-bits long
and int is only 32-bits long. The sign extension C mechanism transforms
the PC/SC value INFINITE into -1 instead of 4294967295.
See http://www.opensc-project.org/pipermail/opensc-devel/2011-June/016831.html
"Kobil KAAN Advanced Reader, "waiting for card" timeout"
* add new function path_to_filename() that converts a path into
filename, and returns a static buffer to it
* convert all occurrences where file names get generated
to using this function
Signed-off-by: Peter Marschall <peter@adpm.de>
Use the easier to read & shorter expression
path->type = (is_id) ? SC_PATH_TYPE_FILE_ID : SC_PATH_TYPE_PATH;
nstead of the longer, but equivalent if () .. else construction.
Signed-off-by: Peter Marschall <peter@adpm.de>
* allow double-quoted strings besides hexdata in ADPU generation
* detect errors in parameter parsing
* use utility function to print bytes sent,
fixing an error that only showed parts of the APDU wheni
it was generated from multiple arguments
Signed-off-by: Peter Marschall <peter@adpm.de>
Simplify argument handling in do_change() and do_unblock(),
making the functions shorter and deasier to understand.,
Signed-off-by: Peter Marschall <peter@adpm.de>
The variables "in_str" in do_update_binary() & do_update_record()
do not serve a purpose: use argv[x] directly & remove them.
Signed-off-by: Peter Marschall <peter@adpm.de>
Convert arg_to_path() to using the standard sc_hex_to_binary() instead of
the local hex2binary().
While at it, return erros on failed conversions.
Signed-off-by: Peter Marschall <peter@adpm.de>
Update do_update_record() to use parse_string_or_hexdata() instead of the old
hex2binary().
This change allows to use double-quoted strings in the "update_record" command.
Signed-off-by: Peter Marschall <peter@adpm.de>
do_update_binary() and do_update_record() expect a fixed number of parameters
each: adapt the checks for argc so that they do the right thing.
Signed-off-by: Peter Marschall <peter@adpm.de>
* add new function parse_string_or_hexdata() that parses
a double-quoted string or a hex-data string (e.g: AA:BB:CC)
into a buffer
* use parse_string_or_hexdata() wherever strings or hexdata
gets parsed into a buffer
Signed-off-by: Peter Marschall <peter@adpm.de>
* extend cmds struct by a new element args for a description of the arguments
* use args in help texts
* new function usage() for centralited dispaly of usage info
* harmonize argument strings for usage / help texts
* re-sort cmd list shown in help texts
* add function "help" to cwallow asking for for help
* space-police
Signed-off-by: Peter Marschall <peter@adpm.de>
* use ID<->name tables instead of arrays of strings where
the index was treated like some "magic" constant.
With the new mapping tables, the meaning is obvious.
* fix a bug with ac_ops_df[]: before the conversion, it was a list
of pointers to strings but was in one case treated like it was a mapping table.
With the conversion to a mapping table, and the adaption of other code parts
this bug got fixed "automagically" ;-)
* use common code to cleanly print ACLs for DFs & EFs
* harmonize EF structure names to the ones used in ISO 7816-4
Signed-off-by: Peter Marschall <peter@adpm.de>
Remove links pointing to the blob to be deleted from other blobs in the
blob tree structure, so that removing a subordinate blob does not hurt
its parent or siblings.
Signed-off-by: Peter Marschall <peter@adpm.de>
* get file as parameter & fail if it is NULL
* allow parent to be NULL
* do not rely on DO info to be passed as parameter,
search it yourself using the global DO info list for the card.
* infer file type automatically from DO info matching the file ID.
Signed-off-by: Peter Marschall <peter@adpm.de>
DO FF is a "catch-all" DO that returns all the infos contained in the other
DOs in one hierarchy.
It is hence duplicate and not necessary.
Signed-off-by: Peter Marschall <peter@adpm.de>
Also include forgotten DO C3 in keylength calculation.
It contains the parameters for the authentication key.
Signed-off-by: Peter Marschall <peter@adpm.de>
In PKCS#11 there is no CKA_ attribute dedicated to the NON-REPUDIATION flag.
We need this flag in PKCS#15/libopensc to make dinstinction between 'signature' and 'qualified signature' key slots.
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@5567 c6295689-39f2-0310-b995-f0e70906c6a9
can be loaded at ADMINISTRATION life cycle phase to change
the behavior of the VERIFY command in regard to return codes.
When that package is loaded, the return code of the VERIFY
will be ISO7816-4 compliant (63Cx with x being the value of
the remaining retry counter when required verification has failed).
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@5565 c6295689-39f2-0310-b995-f0e70906c6a9
Nguyễn Hồng Quân
Peter Marschall
Viktor Tarasov
Nguyễn Hồng Quân
Ludovic Rousseau
Diego Elio Pettenò
Martin Paljak
Frank Morgner
Alon Bar-Lev
Ludovic Rousseau
Stef Walter
Robbert Müller
Doug Engert
João Poupino
Ludovic Rousseau
vtarasov
jps
andre