Basically checks that the memory allocation succeed.
The ctbcs.c change improve the readability
because count = 0 and len > 254 does not add any value.
VTA: added few coding style changes
For internal use allocate and copy the EC params data from the caller's template,
rather then use them directly as a pointer in internal public key data.
needed to store information about EC curve supported by card.
Primary usage is when importing/generating key to get know if particular curve is supported by card.
* Key usage required when calling C_CreateObject for public key are not used.
This adds the logic to convert from PKCS#11 attributes to PKCS#15 in the
structure that is sent to underlying _store_pubkey functions.
Pkcs15init data, used to import/generate key objects, includes twice the same EC parameters data:
- explicit 'params' data
- part of sc_pkcs15_pubkey/sc_pkcs15_prkey
Explicit 'ec-params' data is removed.
b94c163 - invalid, non-tested
11881a6 -- src/libopensc/card-iasecc.c -- return from select has to be ignored,
3a92bf7 -- src/pkcs11/slot.c -- SEGFAULT issue #3733a92bf7 -- src/tools/piv-tool.c -- confirmed by author
6759c04 -- src/pkcs15init/pkcs15-lib.c -- file instantiation error has to be ignored
C_Digest will now query for the buffer size using sc_pkcs15_md_final
before calling sc_pkcs15_md_update. This avoids doing a double update
when the user passes in a buffer to small, then gets the buffer and calls
C_Digest again.
Code to test for an auth_id for certs and pubkeys was removed.
See: PKCS#15 section 4.1.3 Access methods
This is conseritive change and all objects could be treaded the same.
The framework-pkcs15.c did not add hashes correctly if the card did not support RSA RAW.
This change fixes that and only adds hashes if the card did not specify a list of hashes.
It also will not add hashes done in software if ENABLE_OPENSSL is not specified.
Some error conditions are also tested for EC mechanisms.
See bug report #241 for more information.
framework-pkcs15: Duplicate public key related to private key rather than referencing the framework object
Referencing the related public key is required to return PKCS#11 attributes for a private key only available
in the public key object (i.e. CKA_MODULUS). This patch adds a copy of the public key to the private key object rather than
referencing the public key object in the framework. This prevents SEGV when the public key framework object
is deleted with C_DestroyObject, but the reference from the public key remains intact.
The bug leads to all kind of stability problems when keys are created and deleted in the same session.
The patch is in particular important if OpenSC is used with EJBCA or any other application using the
SUN PKCS#11 provider: When generating key pairs, then the public key object is eventually garbage collected
which removes the related object in the PKCS#11 module. Because there is no fixed time for this operation,
corruption occurs at random.
In a next step, the remaining related_xxx fields in sc_pkcs11_object should be revised and possibly removed.
framework: Added more error checking
card-asepcos: removed dead code
card-authentic: removed dead code
card-belpic: removed dead code
card-epass2003: removed dead code
card-flex: removed dead code
card-gpk: removed dead code
card-oberthur: removed dead code
card-piv: removed dead code
card-setcos: removed dead code
ctbcs: removed dead code
cwa14890: removed dead code
muscle: removed dead code
pkcs15-atrust-acos: removed dead code
pkcs15-gemsafeV1: removed dead code
pkcs15-skey: removed dead code
reader-ctapi: removed dead code
framework-pkcs15: removed dead code
pkcs11-object: removed dead code
pkcs15-asepcos: removed dead code
pkcs15-cardos: removed dead code
pkcs15-jcop: removed dead code
pkcs15-lib: removed dead code
pkcs15-oberthur: removed dead code
parse: removed dead code
sclex: removed dead code
sm-card-authentic: removed dead code
sm-card-iasecc: removed dead code
sm-cwa14890: removed dead code
sm-global-platform: removed dead code
sc-test: removed dead code
pkcs11-tool: removed dead code
pkcs15-tool: removed dead code
pkcs15: in pubkey-info data
* introduced new 'direct' 'raw' and 'spki' members
* removed 'encoded der data' member
* in 'read-public-key' try firstly SPKI direct value
pkcs11:
'direct' data used when getting CKA_VALUE attribute of public key
pkcs15init:
* initialize 'raw' and 'spki' direct public key value
In pkcs15-verify the value of PIN is not more validated for conformity with PIN policy,
value is only checked for maximal allowed length.
So that, no more need of 'ignore-pin-length' configuration option - now it's default behavior of common framework.
When doing C_Login default behavior is to ignore the applied PINs with lengths less
then value of PKCS#15 PIN attribure 'min-length'. Such a PINs are not
really verified by card.
With 'ignore-pin-length' option in 'true' all applied PINs are verified by card.
to prepare future enhancements and in the sake of uniformity
in 'struct sc_pkcs11_framework_ops'
the 'struct sc_pkcs11_card' argument of 'init_token' handler is changed for 'struct sc_pkcs11_slot'
coding style issues
C_Login returns CKR_USER_PIN_NOT_INITIALIZED error when token info flags do not
contains CKF_USER_PIN_INITIALIZED and CKU_USER login type is asked.
This flag is not consulted when CKU_SO or CKU_CONTEXT_SPECIFIC login type is needed
The original ECC code in OpenSC stored the ecpointQ as a DER encoded OCTET STRING.
Shortly before 0.13.0, code changes where made to store the ecpointQ as raw data
without the DER encoding.
Only some of the code was changed to support this but not all, and the comments
that said the ecpointQ was in DER where not changed either.
Some card drivers continued to work, using the original code in all place,
while some cards failed, as they where using a mixture of original code and
0.13.0 code.
This commit fixes these problems.
The ecpointQ is stored in raw format
A new structure type sc_pkcs15_u8 is defined.
The ecpointQ are changed to use the struct sc_pkcs15_u8. This was done to avoid
the confusion of using struct sc_pkcs15_der to hold non-DER encoded data.
(There may be other uses for this too...)
Comments are change is many places.
sc_pkcs15_decode_pubkey_ec was fixed to store the raw ecpointQ correctly.
sc_pkcs15_pubkey_from_spki was change to get the sc_ec_params from the alg_id
and fix up u.ec.params. Unfortunately the OpenSC code has two places EC parameters
are stored. They can get out of sync, or there may still be code
that looks in the wrng oplace. o(TODO get it to only only place.)
The u.ec.params.field_length is now set in a number of places, as this is need
in many of the PKCS#11 routines.
framework-pkcs15.c will now correctly return the DER encode ecpointQ,
for the CKA_EC_POINT attribute using pubkey->data which has the DER encoding
for the ecpointQ.
framework-pkcs15.c will look for the EC parameters in either the u.ec.params.der,
or in the alg_id->params. (TODO get it to only only place.)
pkcs15-myeid.c has some comments, as it looks like the code is storing a TLV
rather then a DER encoding of the ecpointQ. With the wrong encoding PKCS#11 will
return the wrong attribute for CKA_ECDSA_PARAMS.
pkcs15-piv.c is changed so emulation of a pubkey taken from a certificate will
work correctly.
In a supplement to f5d53ab01783b0c37802e35f063fdbe5814bdbc7.
Subject and Issuer, returned by pkcs#15 framework, are already encoded as ASN1 sequence.
No need to wrap them in a second ASN1 sequence frame.
CK_VERSION is included into PKCS#11 data but is not specified by PKCS#15.
CK_VERSION can be provided by card's pkcs15 emulator or by the card's driver,
including the cards with the native support of pkcs#15 (and thus without pkcs15 emulator).
That's why the more general solution is to have these data included into 'sc-card' data type.
Thanks to Andreas Schwier.
http://www.opensc-project.org/pipermail/opensc-devel/2012-September/018455.html
In PKCS#11 FW, the 'certificate' FW object is used to create corresponding 'public'key' FW object
or to get some of its attributes.
Seg.fault occured when, in the same session, the related certificate was destroyed and after that
there was the attempt to get such public key attributes.
To hold the raw certificate blob in 'sc_pkcs15_cert' data use the 'sc_pkcs15_der' data type.
also:
; in 'pkcs15-cert.c' use short call of the debug messages;
; in 'destroy-object' pkcs15 framework handler take into account the multi-application cards:
-- when binding card use the application info;
-- when finalizing profile use the application ID.
Fix autoreconf warnings:
$ autoreconf -vis -Wall
[...]
src/common/Makefile.am:12: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
src/libopensc/Makefile.am:19: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
src/minidriver/Makefile.am:15: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
src/pkcs11/Makefile.am:10: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
src/pkcs15init/Makefile.am:36: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
src/scconf/Makefile.am:12: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
src/sm/Makefile.am:8: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
src/tests/Makefile.am:9: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
src/tools/Makefile.am:15: warning: 'INCLUDES' is the old name for 'AM_CPPFLAGS' (or '*_CPPFLAGS')
Fixed issues in pkcs11-tool/test_signature is card has RSA and ECDSA keys
Fixed bug in sc_pkcs11_signature_size that returns the wrong ECDSA signature size
Limit the number of cases when applicated re-selection of application DF to strict minimum.
I.e. only when pkcs11 login session is not locked and private key PKCS#15 object do not
contain the 'path' attribute.
Thanks to 'crank'.
https://www.opensc-project.org/opensc/ticket/439
Some pkcs11 callers (i.e. netscape) will pass in the ASN.1 encoded SEQUENCE OF SET,
while OpenSC just keeps the SET in the issuer/subject field.
The the pInitArgs argument of C_Initialize() is not NULL it is a pointer
to a CK_C_INITIALIZE_ARGS structure.
This structure contains a flags bitfield with possible values:
- CKF_LIBRARY_CANT_CREATE_OS_THREADS
- CKF_OS_LOCKING_OK
This flags parameter is now parsed and displayed.
pkcs11-spy.c(168) : warning C4047: 'function' : 'DWORD' differs in levels of indirection from 'DWORD *'
pkcs11-spy.c(168) : warning C4024: 'ExpandEnvironmentStringsA' : different types for formal and actual parameter 3
pkcs11-spy.c(205) : warning C4047: 'function' : 'DWORD' differs in levels of indirection from 'DWORD *'
pkcs11-spy.c(205) : warning C4024: 'ExpandEnvironmentStringsA' : different types for formal and actual parameter 3
Add to the spy logs the timestamp with millisecond resolution.
Environment strings are accepted in the key registries paths related to spy module.
pkcs11-spy: code formatting
Add new argument 'application-info',
that will allow to select the on-card application to by binded with.
pkcs11: use sc_pkcs15init_bind with 'AID' argument
Prototype of sc_pkcs15init_bind() has been changed to add argument with
AID of the on-card application to be binded with.
In card detection procedure bind all present applications
and create tokens for them.
Treatement of the different 'create-slots' configuration cases,
joining the objects from different applications into one slot
are previewed for the next commits.
- simplify some of framework handles: remove from it's prototype the arguments that can be derived from the other arguments;
for exemple: foo(slot, slot->card) --> foo(slot)
- add the 'application' argument to the bind, unbind and similar handles;
- preview more then one framework data attached to the pkcs11card object.
- placehold for the future 'derive' and 'can_do' handles.
'OnePIN' version of opensc-pkcs11 module is not installed.
Instead, in the 'pkcs11' section of OpenSC configuration,
there is a possibility to define in a different manner
how to create slots for the present PINs and applications.
If the system libraries are set before the locally built libraries,
libtool will pick the system copy of OpenSC instead of the local one,
and that can make cross-builds fail badly.
This patch is already applied in Gentoo for proper building.
A change introduced in c0072d16dd made the
compilation fail:
pkcs11-display.c:738:1: error: conflicting types for 'lookup_enum_spec'
pkcs11-display.h:64:13: note: previous declaration of 'lookup_enum_spec' was here
The output format of a hex dump has changed from:
668C045A 1C3A4EF4 CF8550F3 20926525 1E8BF478
to:
00000000 66 8C 04 5A 1C 3A 4E F4 CF 85 50 F3 20 92 65 25 f..Z.:N...P. .e%
00000010 1E 8B F4 78 ...x
Is it now possible to find text strings inside a hex dump
openssl.c: In function 'sc_pkcs11_verify_data':
openssl.c:384:19: warning: 'pkey_ctx' may be used uninitialized in this function [-Wuninitialized]
openssl.c:325:16: note: 'pkey_ctx' was declared here
C_CloseSession() and C_CloseAllSessions() were calling sc_debug() before
any check on the validity of the context. So if C_Initialize() was not
previously called you get an assert:
log.c:76: sc_do_log_va: Assertion `ctx != ((void *)0)' failed.
In PKCS#11 there is no CKA_ attribute dedicated to the NON-REPUDIATION flag.
We need this flag in PKCS#15/libopensc to make dinstinction between 'signature' and 'qualified signature' key slots.
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@5567 c6295689-39f2-0310-b995-f0e70906c6a9
framework-pkcs15.c:1892: warning: comparison between signed and unsigned
framework-pkcs15.c:1902: warning: comparison between signed and unsigned
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@5529 c6295689-39f2-0310-b995-f0e70906c6a9
The list of slots returned by C_GetSlotList() contains:
- if present, virtual hotplug slot;
- any slot with token;
- without token(s), one empty slot per reader;
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@5421 c6295689-39f2-0310-b995-f0e70906c6a9
EC parameters can be presented in a three forms: namedCurve, OID and implicit data.
This new data type will facilitate manipulation of ec-parameters in the OpenSC tools and library.
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@5386 c6295689-39f2-0310-b995-f0e70906c6a9
* shift libpkcs11 from src/pkcs11 to src/common as it is not used to implement the OpenSC PKCS#11 module
* invent a "libscdl" mini library that implements either libltdl based dynamic loading or uses native interfaces
* drop hard requirement for libltl to build OpenSC
* native Windows build does not need libltdl any more
* specify CNGSDK include dir to find cardmod.h. CNGSDK only registers with a handful of compilers
Deals with #323
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@5201 c6295689-39f2-0310-b995-f0e70906c6a9
emulated cards. True PKCS#15 cards with EC
will need additional changes.
Main changes are in framework-pkcs15.c, mechanism.c,
padding.c, pkcs15-algo.c and pkcs15-sec.c
where switch statements for key type, and testing
of flags was modified to make it easier to add
additional key types in the future.
The code was tested using RSA and ECDSA using a PIV card
from pkcs11-tool, OpenSSL and Thunderbird with
modifications to NSS-3.12.7 to get ECDSA to sign e-mail.
Only named curves are supported for ECDSA, ECDH is still
needed. pkcs11-tool has only minimal changes need to work
with the -O option to list EC keys.
One additional line was added to pkcs15-sec.c which
should get GOSTR sign to work.
libp11 and engine do not yet have EC support.
--This line, and those below, will be ignored--
M src/tools/piv-tool.c
M src/tools/pkcs11-tool.c
M src/pkcs11/framework-pkcs15.c
M src/pkcs11/mechanism.c
M src/pkcs11/pkcs11-object.c
M src/libopensc/pkcs15-prkey.c
M src/libopensc/card-piv.c
M src/libopensc/padding.c
M src/libopensc/cardctl.h
M src/libopensc/pkcs15-algo.c
M src/libopensc/libopensc.exports
M src/libopensc/pkcs15-piv.c
M src/libopensc/pkcs15-sec.c
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4904 c6295689-39f2-0310-b995-f0e70906c6a9
support routines. Add definitions for EC keys,
parameters and extensions to structures.
Add the sc_card_find_ec_alg, sc_pkcs15_decode_pubkey_ec,
sc_pkcs15_encode_pubkey_ec, sc_pkcs15emu_add_ec_prkey,
sc_pkcs15emu_add_ec_pubkey routines.
Only EC named curves are currently supported.
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4902 c6295689-39f2-0310-b995-f0e70906c6a9
* check for out of memory conditions
* register SHA256 as well
* key generation depends on onboard key generation capabilities, not OpenSSL
Further adjustments are needed.
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4894 c6295689-39f2-0310-b995-f0e70906c6a9
* Detect different cards based on ATR-s and on card objects
* Set the card name from the ATR table
* Conditionally add support for 2048b keys
* Add workarounds for broken MULTOS and JavaCard cards.
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4893 c6295689-39f2-0310-b995-f0e70906c6a9
spy segfaulted if CKU_CONTEXT_SPECIFIC was used,
pkcs11-session was reseting the userType before calling
framework. Framework will now see CKU_CONTEXT_SPECIFIC
and use slot->login_user to determine which PIN was used
to create the original session, and will send the PIN
to the card. It does not treats CKU_CONTEXT_SPECIFIC
as a full login, only a reassertion of the PIN.
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4880 c6295689-39f2-0310-b995-f0e70906c6a9
pkcs15.c: object search continues with normal processing, even if enumeration of some files failed
pkcs15.h: obsolete prototype removed
pkcs15-syn.c: now obsolete function sc_pkcs15emu_postponed_load removed
fixes: #266
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4877 c6295689-39f2-0310-b995-f0e70906c6a9
sc_pkcs15_cert now has pointer to sc_pkcs15_pubkey, allowing it to
be removed and used separatly.
sc_pkcs15_pubkey now has pointer to sc_algorithm_id to faclitate
addition of other key algorithms and their parameters.
Various code changes to free these structures and references
to the structures have been changed.
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4805 c6295689-39f2-0310-b995-f0e70906c6a9
Assuming the driver has correctly set max_tries to 1 then PKCS#11 is very clear about it:
"""
True if supplying an incorrect user PIN will it to become locked.
"""
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4687 c6295689-39f2-0310-b995-f0e70906c6a9
Support for importing cleartext keys is left untouched, but all transparent key generation by either opensc-pkcs11.so or pkcs15-init is removed, to make the operation with cleartext keys visible to the user and his explicit wish.
OpenSC is a PKCS#11 library for accessing keys protected by a smart card. Key material in software is not protected by smart cards and can leave a false sense of security to the user.
http://www.opensc-project.org/pipermail/opensc-devel/2010-April/013877.html
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4646 c6295689-39f2-0310-b995-f0e70906c6a9
From http://en.wikipedia.org/wiki/Malloc#Casting_and_type_safety
" Casting and type safety
malloc returns a void pointer (void *), which indicates that it is a
pointer to a region of unknown data type. One may "cast" (see type
conversion) this pointer to a specific type, as in
int *ptr = (int*)malloc(10 * sizeof (int));
When using C, this is considered bad practice; it is redundant under the
C standard. Moreover, putting in a cast may mask failure to include the
header stdlib.h, in which the prototype for malloc is found. In the
absence of a prototype for malloc, the C compiler will assume that
malloc returns an int, and will issue a warning in a context such as the
above, provided the error is not masked by a cast. On certain
architectures and data models (such as LP64 on 64 bit systems, where
long and pointers are 64 bit and int is 32 bit), this error can actually
result in undefined behavior, as the implicitly declared malloc returns
a 32 bit value whereas the actually defined function returns a 64 bit
value. Depending on calling conventions and memory layout, this may
result in stack smashing.
The returned pointer need not be explicitly cast to a more specific
pointer type, since ANSI C defines an implicit conversion between the
void pointer type and other pointers to objects. An explicit cast of
malloc's return value is sometimes performed because malloc originally
returned a char *, but this cast is unnecessary in standard C
code.[4][5] Omitting the cast, however, creates an incompatibility with
C++, which does require it.
The lack of a specific pointer type returned from malloc is type-unsafe
behaviour: malloc allocates based on byte count but not on type. This
distinguishes it from the C++ new operator that returns a pointer whose
type relies on the operand. (see C Type Safety). "
See also
http://www.opensc-project.org/pipermail/opensc-devel/2010-August/014586.html
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4636 c6295689-39f2-0310-b995-f0e70906c6a9
==21111== 1,360 (120 direct, 1,240 indirect) bytes in 1 blocks are definitely lost in loss record 107 of 109
==21111== at 0x4C24F0D: realloc (vg_replace_malloc.c:476)
==21111== by 0x409D23: sc_pkcs11_register_mechanism (mechanism.c:44)
==21111== by 0x410595: pkcs15_bind (framework-pkcs15.c:3160)
==21111== by 0x4085DD: card_detect (slot.c:214)
==21111== by 0x408887: initialize_reader (slot.c:114)
==21111== by 0x404C50: C_Initialize (pkcs11-global.c:247)
==21111== by 0x4034C9: main
==21111==
==21111== LEAK SUMMARY:
==21111== definitely lost: 120 bytes in 1 blocks
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4388 c6295689-39f2-0310-b995-f0e70906c6a9
example:
int main()
{
C_Initialize(NULL);
C_Finalize(NULL);
return 0;
}
==4625== 592 (504 direct, 88 indirect) bytes in 1 blocks are definitely lost
in loss record 9 of 10
==4625== at 0x4C24137: calloc (vg_replace_malloc.c:418)
==4625== by 0x407FD9: create_slot (slot.c:80)
==4625== by 0x40452C: C_Initialize (pkcs11-global.c:243)
==4625== by 0x40342A: main
==4625==
==4625== 4,736 (4,032 direct, 704 indirect) bytes in 8 blocks are definitely
lost in loss record 10 of 10
==4625== at 0x4C24137: calloc (vg_replace_malloc.c:418)
==4625== by 0x407FD9: create_slot (slot.c:80)
==4625== by 0x408102: initialize_reader (slot.c:108)
==4625== by 0x4044E0: C_Initialize (pkcs11-global.c:247)
==4625== by 0x40342A: main
==4625==
==4625== LEAK SUMMARY:
==4625== definitely lost: 4,536 bytes in 9 blocks
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4386 c6295689-39f2-0310-b995-f0e70906c6a9
Fix a compilation error for src/tools/pkcs11-tool:
/usr/bin/ld: ../../src/pkcs11/.libs/libpkcs11.a(libpkcs11.o): in function C_UnloadModule:libpkcs11.c:78: error: undefined reference to `lt_dlclose'
/usr/bin/ld: ../../src/pkcs11/.libs/libpkcs11.a(libpkcs11.o): in function C_LoadModule:libpkcs11.c:36: error: undefined reference to `lt_dlinit'
/usr/bin/ld: ../../src/pkcs11/.libs/libpkcs11.a(libpkcs11.o): in function C_LoadModule:libpkcs11.c:43: error: undefined reference to `lt_dlopen'
/usr/bin/ld: ../../src/pkcs11/.libs/libpkcs11.a(libpkcs11.o): in function C_LoadModule:libpkcs11.c:52: error: undefined reference to `lt_dlsym'
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4182 c6295689-39f2-0310-b995-f0e70906c6a9
* reduce to a few, supported functions.
* change all functions to take the debug level as parameter.
* use symbolic names for the debug levels.
* fix tools to pass "verbose"/"opt_debug" as ctx->debug.
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4118 c6295689-39f2-0310-b995-f0e70906c6a9
In fact, the middleware of the manufacturer of the gemalto (axalto, gemplus) cards
reports the CKA_ID of CA certificates as '0'.
But it's not true for the others middlewares (Oberthur), NSS (afais) and PKCS#11 standard.
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4095 c6295689-39f2-0310-b995-f0e70906c6a9
*** glibc detected *** invalid pointer: 0x00007fff9e9f7670 ***
Program received signal SIGABRT, Aborted.
0x00007f971d0a8ea5 in raise () from /lib64/libc.so.6
(gdb) bt
#0 0x00007f971d0a8ea5 in raise () from /lib64/libc.so.6
#1 0x00007f971d0aaab3 in abort () from /lib64/libc.so.6
#2 0x00007f971d0e7d58 in __libc_message () from /lib64/libc.so.6
#3 0x00007f971d0ed7e8 in malloc_printerr () from /lib64/libc.so.6
#4 0x00007f971d0efda6 in free () from /lib64/libc.so.6
#5 0x0000000000410f5c in pkcs15_gen_keypair (p11card=0x72aec0, slot=<value optimized out>,
pMechanism=<value optimized out>, pPubTpl=<value optimized out>, ulPubCnt=<value optimized out>,
pPrivTpl=<value optimized out>, ulPrivCnt=6, phPubKey=0x7fff9e9f7e50, phPrivKey=0x7fff9e9f7e58)
at framework-pkcs15.c:1763 /* see opensc-0.11.13 */
#6 0x0000000000409a6e in C_GenerateKeyPair
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@4032 c6295689-39f2-0310-b995-f0e70906c6a9
The implementation was based on the previous MSC build, each tool had its own
description in version resource.
This change sets a single version resource to all files, and produces much
simpler build.
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@3980 c6295689-39f2-0310-b995-f0e70906c6a9
(In function 'pkcs15_add_object': warning: unused parameter 'pHandle')
Example (C_CreateObject):
Breakpoint 3, C_CreateObject (hSession=134587040, pTemplate=0x8049160, ulCount=5, phObject=0xbff55560)
at pkcs11-object.c:57
57 rv = sc_pkcs11_lock();
(gdb) x/x phObject
0xbff55560: 0xffffffff
(gdb) finish
0xb7f5c6c0 17:15:09.969 [opensc-pkcs11] framework-pkcs15.c:657:pkcs15_add_object: Setting object handle of 0x0 to 0x805ab80
Run till exit from #0 C_CreateObject (hSession=134587040, pTemplate=0x8049160, ulCount=5,
phObject=0xbff55560) at pkcs11-object.c:57
0x080487a4 in main ()
Value returned is $1 = 0
(gdb) x/x 0xbff55560
0xbff55560: 0xffffffff
(gdb) c
Continuing.
Breakpoint 4, C_DestroyObject (hSession=134587040, hObject=4294967295) at pkcs11-object.c:106
106 rv = sc_pkcs11_lock();
(gdb) p/x hObject
$2 = 0xffffffff
(gdb) finish
Run till exit from #0 C_DestroyObject (hSession=134587040, hObject=4294967295) at pkcs11-object.c:106
0xb7f5c6c0 17:15:56.581 [opensc-pkcs11] pkcs11-object.c:110:C_DestroyObject: C_DestroyObject(hSession=0x805a2a0, hObject=0xffffffff)
0x080487cb in main ()
Value returned is $3 = 130
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@3944 c6295689-39f2-0310-b995-f0e70906c6a9
- slots, sessions and objects are kept as lists.
- change the way slots, cards and readers are managed.
- re-implement C_WaitForSlotEvent(/C_Finalize) as written in PCKS#11 v2.20, canceling pending blocking calls.
- implement a "virtual hotplug slot" with a floating slot id to keep NSS working with C_WaitForSlotEvent with a new reader.
NSS does not call C_GetSlotList(NULL) to re-fetch the list of available slots if C_WaitForSlotEvent returns an event in an already known slot ID.
By changing the ID of a slot whenever a reader attached NSS/Firefox can be tricked into recognizing new readers when waiting for events with C_WaitForSlotEvent.
- change (possibly break something) sc_to_cryptoki_error() to not have side-effects
- Implement CKU_CONTEXT_SPECIFIC in C_Login to implement CKA_ALWAYS_AUTHENTICATE (keys with user consent)
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@3935 c6295689-39f2-0310-b995-f0e70906c6a9
When trying to import a too large keyfile as a data object, TrueCrypt received a CKR_GENERAL_ERROR before this.
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@3926 c6295689-39f2-0310-b995-f0e70906c6a9
One of the three unblock methods can be activated from the 'opensc-pkcs11' section of opensc.conf:
- C_SetPin() in the unlogged sesssion;
- C_SetPin() in the CKU_SPECIFIC_CONTEXT session;
- C_InitPin() in CKU_SO session (inspired by Pierre Ossman).
-- This last one works, for a while, only for the pkcs15 cards without SOPIN auth object.
For the pkcs15 cards with SOPIN, this method will be useful for the cards
that do not have then modes '00' and '01' of ISO command 'RESET RETRY COUNTER'.
Test commands:
# pkcs11-tool --module ./opensc-pkcs11.so --slot 0 --unlock-pin --puk "123456" --new-pin "9999"
# pkcs11-tool --module ./opensc-pkcs11.so --slot 0 --unlock-pin -l --login-type context-specific --puk "123456" --new-pin "9999"
# pkcs11-tool --module ./opensc-pkcs11.so --slot 0 --init-pin -l --new-pin "9999"
git-svn-id: https://www.opensc-project.org/svnp/opensc/trunk@3901 c6295689-39f2-0310-b995-f0e70906c6a9
Frank Morgner
vletoux
Viktor Tarasov
Thomas Calderon
Mathias Brossard
Doug Engert
Andreas Schwier
Emanuele Pucciarelli
Raul Metsma
Henrik Andersson
Doug Engert
Martin Paljak
Anthony Foiani
Ludovic Rousseau
Diego Elio Pettenò
Ludovic Rousseau
Alon Bar-Lev
vtarasov
andre
martin
dengert
s
ludovic.rousseau
viktor.tarasov
alonbl
aj