trap signals for "-serial mon:stdio"
[qemu.git] / libcacard / cac.c
1 /*
2 * implement the applets for the CAC card.
3 *
4 * This code is licensed under the GNU LGPL, version 2.1 or later.
5 * See the COPYING.LIB file in the top-level directory.
6 */
7
8 #include "qemu-common.h"
9
10 #include "cac.h"
11 #include "vcard.h"
12 #include "vcard_emul.h"
13 #include "card_7816.h"
14
15 /* private data for PKI applets */
16 typedef struct CACPKIAppletDataStruct {
17 unsigned char *cert;
18 int cert_len;
19 unsigned char *cert_buffer;
20 int cert_buffer_len;
21 unsigned char *sign_buffer;
22 int sign_buffer_len;
23 VCardKey *key;
24 } CACPKIAppletData;
25
26 /*
27 * CAC applet private data
28 */
29 struct VCardAppletPrivateStruct {
30 union {
31 CACPKIAppletData pki_data;
32 void *reserved;
33 } u;
34 };
35
36 /*
37 * handle all the APDU's that are common to all CAC applets
38 */
39 static VCardStatus
40 cac_common_process_apdu(VCard *card, VCardAPDU *apdu, VCardResponse **response)
41 {
42 int ef;
43 VCardStatus ret = VCARD_FAIL;
44
45 switch (apdu->a_ins) {
46 case VCARD7816_INS_SELECT_FILE:
47 if (apdu->a_p1 != 0x02) {
48 /* let the 7816 code handle applet switches */
49 ret = VCARD_NEXT;
50 break;
51 }
52 /* handle file id setting */
53 if (apdu->a_Lc != 2) {
54 *response = vcard_make_response(
55 VCARD7816_STATUS_ERROR_DATA_INVALID);
56 ret = VCARD_DONE;
57 break;
58 }
59 /* CAC 1.0 only supports ef = 0 */
60 ef = apdu->a_body[0] | (apdu->a_body[1] << 8);
61 if (ef != 0) {
62 *response = vcard_make_response(
63 VCARD7816_STATUS_ERROR_FILE_NOT_FOUND);
64 ret = VCARD_DONE;
65 break;
66 }
67 *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
68 ret = VCARD_DONE;
69 break;
70 case VCARD7816_INS_GET_RESPONSE:
71 case VCARD7816_INS_VERIFY:
72 /* let the 7816 code handle these */
73 ret = VCARD_NEXT;
74 break;
75 case CAC_GET_PROPERTIES:
76 case CAC_GET_ACR:
77 /* skip these for now, this will probably be needed */
78 *response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
79 ret = VCARD_DONE;
80 break;
81 default:
82 *response = vcard_make_response(
83 VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
84 ret = VCARD_DONE;
85 break;
86 }
87 return ret;
88 }
89
90 /*
91 * reset the inter call state between applet selects
92 */
93 static VCardStatus
94 cac_applet_pki_reset(VCard *card, int channel)
95 {
96 VCardAppletPrivate *applet_private = NULL;
97 CACPKIAppletData *pki_applet = NULL;
98 applet_private = vcard_get_current_applet_private(card, channel);
99 assert(applet_private);
100 pki_applet = &(applet_private->u.pki_data);
101
102 pki_applet->cert_buffer = NULL;
103 if (pki_applet->sign_buffer) {
104 g_free(pki_applet->sign_buffer);
105 pki_applet->sign_buffer = NULL;
106 }
107 pki_applet->cert_buffer_len = 0;
108 pki_applet->sign_buffer_len = 0;
109 return VCARD_DONE;
110 }
111
112 static VCardStatus
113 cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
114 VCardResponse **response)
115 {
116 CACPKIAppletData *pki_applet = NULL;
117 VCardAppletPrivate *applet_private = NULL;
118 int size, next;
119 unsigned char *sign_buffer;
120 vcard_7816_status_t status;
121 VCardStatus ret = VCARD_FAIL;
122
123 applet_private = vcard_get_current_applet_private(card, apdu->a_channel);
124 assert(applet_private);
125 pki_applet = &(applet_private->u.pki_data);
126
127 switch (apdu->a_ins) {
128 case CAC_UPDATE_BUFFER:
129 *response = vcard_make_response(
130 VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
131 ret = VCARD_DONE;
132 break;
133 case CAC_GET_CERTIFICATE:
134 if ((apdu->a_p2 != 0) || (apdu->a_p1 != 0)) {
135 *response = vcard_make_response(
136 VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
137 break;
138 }
139 assert(pki_applet->cert != NULL);
140 size = apdu->a_Le;
141 if (pki_applet->cert_buffer == NULL) {
142 pki_applet->cert_buffer = pki_applet->cert;
143 pki_applet->cert_buffer_len = pki_applet->cert_len;
144 }
145 size = MIN(size, pki_applet->cert_buffer_len);
146 next = MIN(255, pki_applet->cert_buffer_len - size);
147 *response = vcard_response_new_bytes(
148 card, pki_applet->cert_buffer, size,
149 apdu->a_Le, next ?
150 VCARD7816_SW1_WARNING_CHANGE :
151 VCARD7816_SW1_SUCCESS,
152 next);
153 pki_applet->cert_buffer += size;
154 pki_applet->cert_buffer_len -= size;
155 if ((*response == NULL) || (next == 0)) {
156 pki_applet->cert_buffer = NULL;
157 }
158 if (*response == NULL) {
159 *response = vcard_make_response(
160 VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
161 }
162 ret = VCARD_DONE;
163 break;
164 case CAC_SIGN_DECRYPT:
165 if (apdu->a_p2 != 0) {
166 *response = vcard_make_response(
167 VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
168 break;
169 }
170 size = apdu->a_Lc;
171
172 sign_buffer = realloc(pki_applet->sign_buffer,
173 pki_applet->sign_buffer_len+size);
174 if (sign_buffer == NULL) {
175 g_free(pki_applet->sign_buffer);
176 pki_applet->sign_buffer = NULL;
177 pki_applet->sign_buffer_len = 0;
178 *response = vcard_make_response(
179 VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
180 ret = VCARD_DONE;
181 break;
182 }
183 memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size);
184 size += pki_applet->sign_buffer_len;
185 switch (apdu->a_p1) {
186 case 0x80:
187 /* p1 == 0x80 means we haven't yet sent the whole buffer, wait for
188 * the rest */
189 pki_applet->sign_buffer = sign_buffer;
190 pki_applet->sign_buffer_len = size;
191 *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
192 ret = VCARD_DONE;
193 break;
194 case 0x00:
195 /* we now have the whole buffer, do the operation, result will be
196 * in the sign_buffer */
197 status = vcard_emul_rsa_op(card, pki_applet->key,
198 sign_buffer, size);
199 if (status != VCARD7816_STATUS_SUCCESS) {
200 *response = vcard_make_response(status);
201 break;
202 }
203 *response = vcard_response_new(card, sign_buffer, size, apdu->a_Le,
204 VCARD7816_STATUS_SUCCESS);
205 if (*response == NULL) {
206 *response = vcard_make_response(
207 VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
208 }
209 break;
210 default:
211 *response = vcard_make_response(
212 VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
213 break;
214 }
215 g_free(sign_buffer);
216 pki_applet->sign_buffer = NULL;
217 pki_applet->sign_buffer_len = 0;
218 ret = VCARD_DONE;
219 break;
220 case CAC_READ_BUFFER:
221 /* new CAC call, go ahead and use the old version for now */
222 /* TODO: implement */
223 *response = vcard_make_response(
224 VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
225 ret = VCARD_DONE;
226 break;
227 default:
228 ret = cac_common_process_apdu(card, apdu, response);
229 break;
230 }
231 return ret;
232 }
233
234
235 static VCardStatus
236 cac_applet_id_process_apdu(VCard *card, VCardAPDU *apdu,
237 VCardResponse **response)
238 {
239 VCardStatus ret = VCARD_FAIL;
240
241 switch (apdu->a_ins) {
242 case CAC_UPDATE_BUFFER:
243 *response = vcard_make_response(
244 VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
245 ret = VCARD_DONE;
246 break;
247 case CAC_READ_BUFFER:
248 /* new CAC call, go ahead and use the old version for now */
249 /* TODO: implement */
250 *response = vcard_make_response(
251 VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
252 ret = VCARD_DONE;
253 break;
254 default:
255 ret = cac_common_process_apdu(card, apdu, response);
256 break;
257 }
258 return ret;
259 }
260
261
262 /*
263 * TODO: if we ever want to support general CAC middleware, we will need to
264 * implement the various containers.
265 */
266 static VCardStatus
267 cac_applet_container_process_apdu(VCard *card, VCardAPDU *apdu,
268 VCardResponse **response)
269 {
270 VCardStatus ret = VCARD_FAIL;
271
272 switch (apdu->a_ins) {
273 case CAC_READ_BUFFER:
274 case CAC_UPDATE_BUFFER:
275 *response = vcard_make_response(
276 VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
277 ret = VCARD_DONE;
278 break;
279 default:
280 ret = cac_common_process_apdu(card, apdu, response);
281 break;
282 }
283 return ret;
284 }
285
286 /*
287 * utilities for creating and destroying the private applet data
288 */
289 static void
290 cac_delete_pki_applet_private(VCardAppletPrivate *applet_private)
291 {
292 CACPKIAppletData *pki_applet_data = NULL;
293
294 if (applet_private == NULL) {
295 return;
296 }
297 pki_applet_data = &(applet_private->u.pki_data);
298 if (pki_applet_data->cert != NULL) {
299 g_free(pki_applet_data->cert);
300 }
301 if (pki_applet_data->sign_buffer != NULL) {
302 g_free(pki_applet_data->sign_buffer);
303 }
304 if (pki_applet_data->key != NULL) {
305 vcard_emul_delete_key(pki_applet_data->key);
306 }
307 g_free(applet_private);
308 }
309
310 static VCardAppletPrivate *
311 cac_new_pki_applet_private(const unsigned char *cert,
312 int cert_len, VCardKey *key)
313 {
314 CACPKIAppletData *pki_applet_data = NULL;
315 VCardAppletPrivate *applet_private = NULL;
316 applet_private = (VCardAppletPrivate *)g_malloc(sizeof(VCardAppletPrivate));
317
318 pki_applet_data = &(applet_private->u.pki_data);
319 pki_applet_data->cert_buffer = NULL;
320 pki_applet_data->cert_buffer_len = 0;
321 pki_applet_data->sign_buffer = NULL;
322 pki_applet_data->sign_buffer_len = 0;
323 pki_applet_data->key = NULL;
324 pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1);
325 /*
326 * if we want to support compression, then we simply change the 0 to a 1
327 * and compress the cert data with libz
328 */
329 pki_applet_data->cert[0] = 0; /* not compressed */
330 memcpy(&pki_applet_data->cert[1], cert, cert_len);
331 pki_applet_data->cert_len = cert_len+1;
332
333 pki_applet_data->key = key;
334 return applet_private;
335 }
336
337
338 /*
339 * create a new cac applet which links to a given cert
340 */
341 static VCardApplet *
342 cac_new_pki_applet(int i, const unsigned char *cert,
343 int cert_len, VCardKey *key)
344 {
345 VCardAppletPrivate *applet_private = NULL;
346 VCardApplet *applet = NULL;
347 unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 };
348 int pki_aid_len = sizeof(pki_aid);
349
350 pki_aid[pki_aid_len-1] = i;
351
352 applet_private = cac_new_pki_applet_private(cert, cert_len, key);
353 if (applet_private == NULL) {
354 goto failure;
355 }
356 applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset,
357 pki_aid, pki_aid_len);
358 if (applet == NULL) {
359 goto failure;
360 }
361 vcard_set_applet_private(applet, applet_private,
362 cac_delete_pki_applet_private);
363 applet_private = NULL;
364
365 return applet;
366
367 failure:
368 if (applet_private != NULL) {
369 cac_delete_pki_applet_private(applet_private);
370 }
371 return NULL;
372 }
373
374
375 static unsigned char cac_default_container_aid[] = {
376 0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 };
377 static unsigned char cac_id_aid[] = {
378 0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 };
379 /*
380 * Initialize the cac card. This is the only public function in this file. All
381 * the rest are connected through function pointers.
382 */
383 VCardStatus
384 cac_card_init(VReader *reader, VCard *card,
385 const char *params,
386 unsigned char * const *cert,
387 int cert_len[],
388 VCardKey *key[] /* adopt the keys*/,
389 int cert_count)
390 {
391 int i;
392 VCardApplet *applet;
393
394 /* CAC Cards are VM Cards */
395 vcard_set_type(card, VCARD_VM);
396
397 /* create one PKI applet for each cert */
398 for (i = 0; i < cert_count; i++) {
399 applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]);
400 if (applet == NULL) {
401 goto failure;
402 }
403 vcard_add_applet(card, applet);
404 }
405
406 /* create a default blank container applet */
407 applet = vcard_new_applet(cac_applet_container_process_apdu,
408 NULL, cac_default_container_aid,
409 sizeof(cac_default_container_aid));
410 if (applet == NULL) {
411 goto failure;
412 }
413 vcard_add_applet(card, applet);
414
415 /* create a default blank container applet */
416 applet = vcard_new_applet(cac_applet_id_process_apdu,
417 NULL, cac_id_aid,
418 sizeof(cac_id_aid));
419 if (applet == NULL) {
420 goto failure;
421 }
422 vcard_add_applet(card, applet);
423 return VCARD_DONE;
424
425 failure:
426 return VCARD_FAIL;
427 }
428