libcacard/cac.c

   1 /*
   2  * implement the applets for the CAC card.
   3  *
   4  * This code is licensed under the GNU LGPL, version 2.1 or later.
   5  * See the COPYING.LIB file in the top-level directory.
   6  */
   7
   8 #include "qemu-common.h"
   9
  10 #include "cac.h"
  11 #include "vcard.h"
  12 #include "vcard_emul.h"
  13 #include "card_7816.h"
  14
  15 /* private data for PKI applets */
  16 typedef struct CACPKIAppletDataStruct {
  17     unsigned char *cert;
  18     int cert_len;
  19     unsigned char *cert_buffer;
  20     int cert_buffer_len;
  21     unsigned char *sign_buffer;
  22     int sign_buffer_len;
  23     VCardKey *key;
  24 } CACPKIAppletData;
  25
  26 /*
  27  * CAC applet private data
  28  */
  29 struct VCardAppletPrivateStruct {
  30     union {
  31         CACPKIAppletData pki_data;
  32         void *reserved;
  33     } u;
  34 };
  35
  36 /*
  37  * handle all the APDU's that are common to all CAC applets
  38  */
  39 static VCardStatus
  40 cac_common_process_apdu(VCard *card, VCardAPDU *apdu, VCardResponse **response)
  41 {
  42     int ef;
  43     VCardStatus ret = VCARD_FAIL;
  44
  45     switch (apdu->a_ins) {
  46     case VCARD7816_INS_SELECT_FILE:
  47         if (apdu->a_p1 != 0x02) {
  48             /* let the 7816 code handle applet switches */
  49             ret = VCARD_NEXT;
  50             break;
  51         }
  52         /* handle file id setting */
  53         if (apdu->a_Lc != 2) {
  54             *response = vcard_make_response(
  55                 VCARD7816_STATUS_ERROR_DATA_INVALID);
  56             ret = VCARD_DONE;
  57             break;
  58         }
  59         /* CAC 1.0 only supports ef = 0 */
  60         ef = apdu->a_body[0] | (apdu->a_body[1] << 8);
  61         if (ef != 0) {
  62             *response = vcard_make_response(
  63                 VCARD7816_STATUS_ERROR_FILE_NOT_FOUND);
  64             ret = VCARD_DONE;
  65             break;
  66         }
  67         *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
  68         ret = VCARD_DONE;
  69         break;
  70     case VCARD7816_INS_GET_RESPONSE:
  71     case VCARD7816_INS_VERIFY:
  72         /* let the 7816 code handle these */
  73         ret = VCARD_NEXT;
  74         break;
  75     case CAC_GET_PROPERTIES:
  76     case CAC_GET_ACR:
  77         /* skip these for now, this will probably be needed */
  78         *response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
  79         ret = VCARD_DONE;
  80         break;
  81     default:
  82         *response = vcard_make_response(
  83             VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
  84         ret = VCARD_DONE;
  85         break;
  86     }
  87     return ret;
  88 }
  89
  90 /*
  91  *  reset the inter call state between applet selects
  92  */
  93 static VCardStatus
  94 cac_applet_pki_reset(VCard *card, int channel)
  95 {
  96     VCardAppletPrivate *applet_private = NULL;
  97     CACPKIAppletData *pki_applet = NULL;
  98     applet_private = vcard_get_current_applet_private(card, channel);
  99     assert(applet_private);
 100     pki_applet = &(applet_private->u.pki_data);
 101
 102     pki_applet->cert_buffer = NULL;
 103     if (pki_applet->sign_buffer) {
 104         g_free(pki_applet->sign_buffer);
 105         pki_applet->sign_buffer = NULL;
 106     }
 107     pki_applet->cert_buffer_len = 0;
 108     pki_applet->sign_buffer_len = 0;
 109     return VCARD_DONE;
 110 }
 111
 112 static VCardStatus
 113 cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
 114                             VCardResponse **response)
 115 {
 116     CACPKIAppletData *pki_applet = NULL;
 117     VCardAppletPrivate *applet_private = NULL;
 118     int size, next;
 119     unsigned char *sign_buffer;
 120     vcard_7816_status_t status;
 121     VCardStatus ret = VCARD_FAIL;
 122
 123     applet_private = vcard_get_current_applet_private(card, apdu->a_channel);
 124     assert(applet_private);
 125     pki_applet = &(applet_private->u.pki_data);
 126
 127     switch (apdu->a_ins) {
 128     case CAC_UPDATE_BUFFER:
 129         *response = vcard_make_response(
 130             VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
 131         ret = VCARD_DONE;
 132         break;
 133     case CAC_GET_CERTIFICATE:
 134         if ((apdu->a_p2 != 0) || (apdu->a_p1 != 0)) {
 135             *response = vcard_make_response(
 136                              VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
 137             break;
 138         }
 139         assert(pki_applet->cert != NULL);
 140         size = apdu->a_Le;
 141         if (pki_applet->cert_buffer == NULL) {
 142             pki_applet->cert_buffer = pki_applet->cert;
 143             pki_applet->cert_buffer_len = pki_applet->cert_len;
 144         }
 145         size = MIN(size, pki_applet->cert_buffer_len);
 146         next = MIN(255, pki_applet->cert_buffer_len - size);
 147         *response = vcard_response_new_bytes(
 148                         card, pki_applet->cert_buffer, size,
 149                         apdu->a_Le, next ?
 150                         VCARD7816_SW1_WARNING_CHANGE :
 151                         VCARD7816_SW1_SUCCESS,
 152                         next);
 153         pki_applet->cert_buffer += size;
 154         pki_applet->cert_buffer_len -= size;
 155         if ((*response == NULL) || (next == 0)) {
 156             pki_applet->cert_buffer = NULL;
 157         }
 158         if (*response == NULL) {
 159             *response = vcard_make_response(
 160                             VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
 161         }
 162         ret = VCARD_DONE;
 163         break;
 164     case CAC_SIGN_DECRYPT:
 165         if (apdu->a_p2 != 0) {
 166             *response = vcard_make_response(
 167                              VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
 168             break;
 169         }
 170         size = apdu->a_Lc;
 171
 172         sign_buffer = realloc(pki_applet->sign_buffer,
 173                       pki_applet->sign_buffer_len+size);
 174         if (sign_buffer == NULL) {
 175             g_free(pki_applet->sign_buffer);
 176             pki_applet->sign_buffer = NULL;
 177             pki_applet->sign_buffer_len = 0;
 178             *response = vcard_make_response(
 179                             VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
 180             ret = VCARD_DONE;
 181             break;
 182         }
 183         memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size);
 184         size += pki_applet->sign_buffer_len;
 185         switch (apdu->a_p1) {
 186         case  0x80:
 187             /* p1 == 0x80 means we haven't yet sent the whole buffer, wait for
 188              * the rest */
 189             pki_applet->sign_buffer = sign_buffer;
 190             pki_applet->sign_buffer_len = size;
 191             *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
 192             ret = VCARD_DONE;
 193             break;
 194         case 0x00:
 195             /* we now have the whole buffer, do the operation, result will be
 196              * in the sign_buffer */
 197             status = vcard_emul_rsa_op(card, pki_applet->key,
 198                                        sign_buffer, size);
 199             if (status != VCARD7816_STATUS_SUCCESS) {
 200                 *response = vcard_make_response(status);
 201                 break;
 202             }
 203             *response = vcard_response_new(card, sign_buffer, size, apdu->a_Le,
 204                                                      VCARD7816_STATUS_SUCCESS);
 205             if (*response == NULL) {
 206                 *response = vcard_make_response(
 207                                 VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
 208             }
 209             break;
 210         default:
 211            *response = vcard_make_response(
 212                                 VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
 213             break;
 214         }
 215         g_free(sign_buffer);
 216         pki_applet->sign_buffer = NULL;
 217         pki_applet->sign_buffer_len = 0;
 218         ret = VCARD_DONE;
 219         break;
 220     case CAC_READ_BUFFER:
 221         /* new CAC call, go ahead and use the old version for now */
 222         /* TODO: implement */
 223         *response = vcard_make_response(
 224                                 VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
 225         ret = VCARD_DONE;
 226         break;
 227     default:
 228         ret = cac_common_process_apdu(card, apdu, response);
 229         break;
 230     }
 231     return ret;
 232 }
 233
 234
 235 static VCardStatus
 236 cac_applet_id_process_apdu(VCard *card, VCardAPDU *apdu,
 237                            VCardResponse **response)
 238 {
 239     VCardStatus ret = VCARD_FAIL;
 240
 241     switch (apdu->a_ins) {
 242     case CAC_UPDATE_BUFFER:
 243         *response = vcard_make_response(
 244                         VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
 245         ret = VCARD_DONE;
 246         break;
 247     case CAC_READ_BUFFER:
 248         /* new CAC call, go ahead and use the old version for now */
 249         /* TODO: implement */
 250         *response = vcard_make_response(
 251                         VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
 252         ret = VCARD_DONE;
 253         break;
 254     default:
 255         ret = cac_common_process_apdu(card, apdu, response);
 256         break;
 257     }
 258     return ret;
 259 }
 260
 261
 262 /*
 263  * TODO: if we ever want to support general CAC middleware, we will need to
 264  * implement the various containers.
 265  */
 266 static VCardStatus
 267 cac_applet_container_process_apdu(VCard *card, VCardAPDU *apdu,
 268                                   VCardResponse **response)
 269 {
 270     VCardStatus ret = VCARD_FAIL;
 271
 272     switch (apdu->a_ins) {
 273     case CAC_READ_BUFFER:
 274     case CAC_UPDATE_BUFFER:
 275         *response = vcard_make_response(
 276                         VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
 277         ret = VCARD_DONE;
 278         break;
 279     default:
 280         ret = cac_common_process_apdu(card, apdu, response);
 281         break;
 282     }
 283     return ret;
 284 }
 285
 286 /*
 287  * utilities for creating and destroying the private applet data
 288  */
 289 static void
 290 cac_delete_pki_applet_private(VCardAppletPrivate *applet_private)
 291 {
 292     CACPKIAppletData *pki_applet_data = NULL;
 293
 294     if (applet_private == NULL) {
 295         return;
 296     }
 297     pki_applet_data = &(applet_private->u.pki_data);
 298     if (pki_applet_data->cert != NULL) {
 299         g_free(pki_applet_data->cert);
 300     }
 301     if (pki_applet_data->sign_buffer != NULL) {
 302         g_free(pki_applet_data->sign_buffer);
 303     }
 304     if (pki_applet_data->key != NULL) {
 305         vcard_emul_delete_key(pki_applet_data->key);
 306     }
 307     g_free(applet_private);
 308 }
 309
 310 static VCardAppletPrivate *
 311 cac_new_pki_applet_private(const unsigned char *cert,
 312                            int cert_len, VCardKey *key)
 313 {
 314     CACPKIAppletData *pki_applet_data = NULL;
 315     VCardAppletPrivate *applet_private = NULL;
 316     applet_private = (VCardAppletPrivate *)g_malloc(sizeof(VCardAppletPrivate));
 317
 318     pki_applet_data = &(applet_private->u.pki_data);
 319     pki_applet_data->cert_buffer = NULL;
 320     pki_applet_data->cert_buffer_len = 0;
 321     pki_applet_data->sign_buffer = NULL;
 322     pki_applet_data->sign_buffer_len = 0;
 323     pki_applet_data->key = NULL;
 324     pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1);
 325     /*
 326      * if we want to support compression, then we simply change the 0 to a 1
 327      * and compress the cert data with libz
 328      */
 329     pki_applet_data->cert[0] = 0; /* not compressed */
 330     memcpy(&pki_applet_data->cert[1], cert, cert_len);
 331     pki_applet_data->cert_len = cert_len+1;
 332
 333     pki_applet_data->key = key;
 334     return applet_private;
 335 }
 336
 337
 338 /*
 339  * create a new cac applet which links to a given cert
 340  */
 341 static VCardApplet *
 342 cac_new_pki_applet(int i, const unsigned char *cert,
 343                    int cert_len, VCardKey *key)
 344 {
 345     VCardAppletPrivate *applet_private = NULL;
 346     VCardApplet *applet = NULL;
 347     unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 };
 348     int pki_aid_len = sizeof(pki_aid);
 349
 350     pki_aid[pki_aid_len-1] = i;
 351
 352     applet_private = cac_new_pki_applet_private(cert, cert_len, key);
 353     if (applet_private == NULL) {
 354         goto failure;
 355     }
 356     applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset,
 357                               pki_aid, pki_aid_len);
 358     if (applet == NULL) {
 359         goto failure;
 360     }
 361     vcard_set_applet_private(applet, applet_private,
 362                              cac_delete_pki_applet_private);
 363     applet_private = NULL;
 364
 365     return applet;
 366
 367 failure:
 368     if (applet_private != NULL) {
 369         cac_delete_pki_applet_private(applet_private);
 370     }
 371     return NULL;
 372 }
 373
 374
 375 static unsigned char cac_default_container_aid[] = {
 376     0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 };
 377 static unsigned char cac_id_aid[] = {
 378     0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 };
 379 /*
 380  * Initialize the cac card. This is the only public function in this file. All
 381  * the rest are connected through function pointers.
 382  */
 383 VCardStatus
 384 cac_card_init(VReader *reader, VCard *card,
 385               const char *params,
 386               unsigned char * const *cert,
 387               int cert_len[],
 388               VCardKey *key[] /* adopt the keys*/,
 389               int cert_count)
 390 {
 391     int i;
 392     VCardApplet *applet;
 393
 394     /* CAC Cards are VM Cards */
 395     vcard_set_type(card, VCARD_VM);
 396
 397     /* create one PKI applet for each cert */
 398     for (i = 0; i < cert_count; i++) {
 399         applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]);
 400         if (applet == NULL) {
 401             goto failure;
 402         }
 403         vcard_add_applet(card, applet);
 404     }
 405
 406     /* create a default blank container applet */
 407     applet = vcard_new_applet(cac_applet_container_process_apdu,
 408                               NULL, cac_default_container_aid,
 409                               sizeof(cac_default_container_aid));
 410     if (applet == NULL) {
 411         goto failure;
 412     }
 413     vcard_add_applet(card, applet);
 414
 415     /* create a default blank container applet */
 416     applet = vcard_new_applet(cac_applet_id_process_apdu,
 417                               NULL, cac_id_aid,
 418                               sizeof(cac_id_aid));
 419     if (applet == NULL) {
 420         goto failure;
 421     }
 422     vcard_add_applet(card, applet);
 423     return VCARD_DONE;
 424
 425 failure:
 426     return VCARD_FAIL;
 427 }
 428