diff options
Diffstat (limited to 'scd/ccid-driver.c')
| -rw-r--r-- | scd/ccid-driver.c | 838 |
1 files changed, 611 insertions, 227 deletions
diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c index 8c362d7..6e0bc55 100644 --- a/scd/ccid-driver.c +++ b/scd/ccid-driver.c @@ -1,6 +1,6 @@ /* ccid-driver.c - USB ChipCardInterfaceDevices driver * Copyright (C) 2003, 2004, 2005, 2006, 2007 - * 2008, 2009 Free Software Foundation, Inc. + * 2008, 2009, 2013 Free Software Foundation, Inc. * Written by Werner Koch. * * This file is part of GnuPG. @@ -57,7 +57,7 @@ /* CCID (ChipCardInterfaceDevices) is a specification for accessing - smartcard via a reader connected to the USB. + smartcard via a reader connected to the USB. This is a limited driver allowing to use some CCID drivers directly without any other specila drivers. This is a fallback driver to be @@ -91,6 +91,8 @@ #include <usb.h> +#include "scdaemon.h" +#include "iso7816.h" #include "ccid-driver.h" #define DRVNAME "ccid-driver: " @@ -209,9 +211,26 @@ enum { VENDOR_SCM = 0x04e6, VENDOR_OMNIKEY= 0x076b, VENDOR_GEMPC = 0x08e6, - VENDOR_KAAN = 0x0d46 + VENDOR_VEGA = 0x0982, + VENDOR_REINER = 0x0c4b, + VENDOR_KAAN = 0x0d46, + VENDOR_VASCO = 0x1a44, + VENDOR_FSIJ = 0x234b, }; +/* Some product ids. */ +#define SCM_SCR331 0xe001 +#define SCM_SCR331DI 0x5111 +#define SCM_SCR335 0x5115 +#define SCM_SCR3320 0x5117 +#define SCM_SPR532 0xe003 +#define CHERRY_ST2000 0x003e +#define VASCO_920 0x0920 +#define GEMPC_PINPAD 0x3478 +#define GEMPC_CT30 0x3437 +#define VEGA_ALPHA 0x0008 +#define CYBERJACK_GO 0x0504 + /* A list and a table with special transport descriptions. */ enum { TRANSPORT_USB = 0, /* Standard USB transport. */ @@ -219,20 +238,20 @@ enum { }; static struct -{ +{ char *name; /* Device name. */ int type; } transports[] = { - { "/dev/cmx0", TRANSPORT_CM4040 }, - { "/dev/cmx1", TRANSPORT_CM4040 }, + { "/dev/cmx0", TRANSPORT_CM4040 }, + { "/dev/cmx1", TRANSPORT_CM4040 }, { NULL }, }; /* Store information on the driver's state. A pointer to such a structure is used as handle for most functions. */ -struct ccid_driver_s +struct ccid_driver_s { usb_dev_handle *idev; char *rid; @@ -255,6 +274,9 @@ struct ccid_driver_s unsigned char apdu_level:2; /* Reader supports short APDU level exchange. With a value of 2 short and extended level is supported.*/ + unsigned int auto_voltage:1; + unsigned int auto_param:1; + unsigned int auto_pps:1; unsigned int auto_ifsd:1; unsigned int powered_off:1; unsigned int has_pinpad:2; @@ -270,7 +292,7 @@ struct ccid_driver_s static int initialized_usb; /* Tracks whether USB has been initialized. */ -static int debug_level; /* Flag to control the debug output. +static int debug_level; /* Flag to control the debug output. 0 = No debugging 1 = USB I/O info 2 = Level 1 + T=1 protocol tracing @@ -286,22 +308,25 @@ static int bulk_in (ccid_driver_t handle, unsigned char *buffer, size_t length, size_t *nread, int expected_type, int seqno, int timeout, int no_debug); static int abort_cmd (ccid_driver_t handle, int seqno); +static int send_escape_cmd (ccid_driver_t handle, const unsigned char *data, + size_t datalen, unsigned char *result, + size_t resultmax, size_t *resultlen); /* Convert a little endian stored 4 byte value into an unsigned integer. */ -static unsigned int +static unsigned int convert_le_u32 (const unsigned char *buf) { - return buf[0] | (buf[1] << 8) | (buf[2] << 16) | (buf[3] << 24); + return buf[0] | (buf[1] << 8) | (buf[2] << 16) | (buf[3] << 24); } /* Convert a little endian stored 2 byte value into an unsigned integer. */ -static unsigned int +static unsigned int convert_le_u16 (const unsigned char *buf) { - return buf[0] | (buf[1] << 8); + return buf[0] | (buf[1] << 8); } static void @@ -322,7 +347,7 @@ my_sleep (int seconds) may give up its timeslot. */ if (!seconds) { -# ifdef HAVE_W32_SYSTEM +# ifdef HAVE_W32_SYSTEM Sleep (0); # else sleep (0); @@ -330,7 +355,7 @@ my_sleep (int seconds) } pth_sleep (seconds); #else -# ifdef HAVE_W32_SYSTEM +# ifdef HAVE_W32_SYSTEM Sleep (seconds*1000); # else sleep (seconds); @@ -371,7 +396,7 @@ print_command_failed (const unsigned char *msg) switch (ec) { case 0x00: t = "Command not supported"; break; - + case 0xE0: t = "Slot busy"; break; case 0xEF: t = "PIN cancelled"; break; case 0xF0: t = "PIN timeout"; break; @@ -422,7 +447,7 @@ print_pr_data (const unsigned char *data, size_t datalen, size_t off) DEBUGOUT_LF (); } - + static void print_p2r_header (const char *name, const unsigned char *msg, size_t msglen) { @@ -646,7 +671,7 @@ print_r2p_slotstatus (const unsigned char *msg, size_t msglen) msg[9] == 3? " (stopped)":""); print_pr_data (msg, msglen, 10); } - + static void print_r2p_parameters (const unsigned char *msg, size_t msglen) @@ -749,7 +774,7 @@ parse_ccid_descriptor (ccid_driver_t handle, { unsigned int i; unsigned int us; - int have_t1 = 0, have_tpdu=0, have_auto_conf = 0; + int have_t1 = 0, have_tpdu=0; handle->nonnull_nad = 0; @@ -758,6 +783,9 @@ parse_ccid_descriptor (ccid_driver_t handle, handle->ifsd = 0; handle->has_pinpad = 0; handle->apdu_level = 0; + handle->auto_voltage = 0; + handle->auto_param = 0; + handle->auto_pps = 0; DEBUGOUT_3 ("idVendor: %04X idProduct: %04X bcdDevice: %04X\n", handle->id_vendor, handle->id_product, handle->bcd_device); if (buflen < 54 || buf[0] < 54) @@ -770,7 +798,7 @@ parse_ccid_descriptor (ccid_driver_t handle, DEBUGOUT_1 (" bLength %5u\n", buf[0]); DEBUGOUT_1 (" bDescriptorType %5u\n", buf[1]); DEBUGOUT_2 (" bcdCCID %2x.%02x", buf[3], buf[2]); - if (buf[3] != 1 || buf[2] != 0) + if (buf[3] != 1 || buf[2] != 0) DEBUGOUT_CONT(" (Warning: Only accurate for version 1.0)"); DEBUGOUT_LF (); @@ -802,7 +830,7 @@ parse_ccid_descriptor (ccid_driver_t handle, us = convert_le_u32(buf+23); DEBUGOUT_1 (" dwMaxDataRate %7u bps\n", us); DEBUGOUT_1 (" bNumDataRatesSupp. %5u\n", buf[27]); - + us = convert_le_u32(buf+28); DEBUGOUT_1 (" dwMaxIFSD %5u\n", us); handle->max_ifsd = us; @@ -833,22 +861,31 @@ parse_ccid_descriptor (ccid_driver_t handle, DEBUGOUT_1 (" dwFeatures %08X\n", us); if ((us & 0x0002)) { - DEBUGOUT (" Auto configuration based on ATR\n"); - have_auto_conf = 1; + DEBUGOUT (" Auto configuration based on ATR (assumes auto voltage)\n"); + handle->auto_voltage = 1; } if ((us & 0x0004)) DEBUGOUT (" Auto activation on insert\n"); if ((us & 0x0008)) - DEBUGOUT (" Auto voltage selection\n"); + { + DEBUGOUT (" Auto voltage selection\n"); + handle->auto_voltage = 1; + } if ((us & 0x0010)) DEBUGOUT (" Auto clock change\n"); if ((us & 0x0020)) DEBUGOUT (" Auto baud rate change\n"); if ((us & 0x0040)) - DEBUGOUT (" Auto parameter negotiation made by CCID\n"); + { + DEBUGOUT (" Auto parameter negotiation made by CCID\n"); + handle->auto_param = 1; + } else if ((us & 0x0080)) - DEBUGOUT (" Auto PPS made by CCID\n"); - else if ((us & (0x0040 | 0x0080))) + { + DEBUGOUT (" Auto PPS made by CCID\n"); + handle->auto_pps = 1; + } + if ((us & (0x0040 | 0x0080)) == (0x0040 | 0x0080)) DEBUGOUT (" WARNING: conflicting negotiation features\n"); if ((us & 0x0100)) @@ -868,7 +905,7 @@ parse_ccid_descriptor (ccid_driver_t handle, { DEBUGOUT (" TPDU level exchange\n"); have_tpdu = 1; - } + } else if ((us & 0x00020000)) { DEBUGOUT (" Short APDU level exchange\n"); @@ -902,7 +939,7 @@ parse_ccid_descriptor (ccid_driver_t handle, DEBUGOUT_CONT ("none\n"); else DEBUGOUT_CONT_2 ("%u cols %u lines\n", buf[50], buf[51]); - + DEBUGOUT_1 (" bPINSupport %5u ", buf[52]); if ((buf[52] & 1)) { @@ -915,7 +952,7 @@ parse_ccid_descriptor (ccid_driver_t handle, handle->has_pinpad |= 2; } DEBUGOUT_LF (); - + DEBUGOUT_1 (" bMaxCCIDBusySlots %5u\n", buf[53]); if (buf[0] > 54) { @@ -925,11 +962,10 @@ parse_ccid_descriptor (ccid_driver_t handle, DEBUGOUT_LF (); } - if (!have_t1 || !(have_tpdu || handle->apdu_level) || !have_auto_conf) + if (!have_t1 || !(have_tpdu || handle->apdu_level)) { DEBUGOUT ("this drivers requires that the reader supports T=1, " - "TPDU or APDU level exchange and auto configuration - " - "this is not available\n"); + "TPDU or APDU level exchange - this is not available\n"); return -1; } @@ -940,29 +976,34 @@ parse_ccid_descriptor (ccid_driver_t handle, lower than that: 64 - 10 CCID header - 4 T1frame - 2 reserved = 48 Product Ids: - 0xe001 - SCR 331 - 0x5111 - SCR 331-DI - 0x5115 - SCR 335 - 0xe003 - SPR 532 - The + 0xe001 - SCR 331 + 0x5111 - SCR 331-DI + 0x5115 - SCR 335 + 0xe003 - SPR 532 + The 0x5117 - SCR 3320 USB ID-000 reader seems to be very slow but enabling this workaround boosts the - performance to a a more or less acceptable level (tested by David). - + performance to a a more or less acceptable level (tested by David). + */ if (handle->id_vendor == VENDOR_SCM - && handle->max_ifsd > 48 - && ( (handle->id_product == 0xe001 && handle->bcd_device < 0x0516) - ||(handle->id_product == 0x5111 && handle->bcd_device < 0x0620) - ||(handle->id_product == 0x5115 && handle->bcd_device < 0x0514) - ||(handle->id_product == 0xe003 && handle->bcd_device < 0x0504) - ||(handle->id_product == 0x5117 && handle->bcd_device < 0x0522) + && handle->max_ifsd > 48 + && ( (handle->id_product == SCM_SCR331 && handle->bcd_device < 0x0516) + ||(handle->id_product == SCM_SCR331DI && handle->bcd_device < 0x0620) + ||(handle->id_product == SCM_SCR335 && handle->bcd_device < 0x0514) + ||(handle->id_product == SCM_SPR532 && handle->bcd_device < 0x0504) + ||(handle->id_product == SCM_SCR3320 && handle->bcd_device < 0x0522) )) { DEBUGOUT ("enabling workaround for buggy SCM readers\n"); handle->max_ifsd = 48; } + if (handle->id_vendor == VENDOR_GEMPC && handle->id_product == GEMPC_CT30) + { + DEBUGOUT ("enabling product quirk: disable non-null NAD\n"); + handle->nonnull_nad = 0; + } return 0; } @@ -990,7 +1031,7 @@ get_escaped_usb_string (usb_dev_handle *idev, int idx, If we do don't find it we try to use English. Note that this is all in a 2 bute Unicode encoding using little endian. */ rc = usb_control_msg (idev, USB_ENDPOINT_IN, USB_REQ_GET_DESCRIPTOR, - (USB_DT_STRING << 8), 0, + (USB_DT_STRING << 8), 0, (char*)buf, sizeof buf, 1000 /* ms timeout */); if (rc < 4) langid = 0x0409; /* English. */ @@ -1012,7 +1053,7 @@ get_escaped_usb_string (usb_dev_handle *idev, int idx, n++; /* High byte set. */ else if (*s <= 0x20 || *s >= 0x7f || *s == '%' || *s == ':') n += 3 ; - else + else n++; } @@ -1031,7 +1072,7 @@ get_escaped_usb_string (usb_dev_handle *idev, int idx, sprintf (result+n, "%%%02X", *s); n += 3; } - else + else result[n++] = *s; } strcpy (result+n, suffix); @@ -1113,7 +1154,7 @@ scan_or_find_usb_device (int scan_mode, int ifc_no; int set_no; struct usb_config_descriptor *config; - struct usb_interface *interface; + struct usb_interface *interface; struct usb_interface_descriptor *ifcdesc; char *rid; usb_dev_handle *idev; @@ -1131,21 +1172,25 @@ scan_or_find_usb_device (int scan_mode, interface = config->interface + ifc_no; if (!interface) continue; - + for (set_no=0; set_no < interface->num_altsetting; set_no++) { ifcdesc = (interface->altsetting + set_no); /* The second condition is for older SCM SPR 532 who did - not know about the assigned CCID class. Instead of - trying to interpret the strings we simply check the - product ID. */ + not know about the assigned CCID class. The third + condition does the same for a Cherry SmartTerminal + ST-2000. Instead of trying to interpret the strings + we simply check the product ID. */ if (ifcdesc && ifcdesc->extra && ((ifcdesc->bInterfaceClass == 11 && ifcdesc->bInterfaceSubClass == 0 && ifcdesc->bInterfaceProtocol == 0) || (ifcdesc->bInterfaceClass == 255 && dev->descriptor.idVendor == VENDOR_SCM - && dev->descriptor.idProduct == 0xe003))) + && dev->descriptor.idProduct == SCM_SPR532) + || (ifcdesc->bInterfaceClass == 255 + && dev->descriptor.idVendor == VENDOR_CHERRY + && dev->descriptor.idProduct == CHERRY_ST2000))) { idev = usb_open (dev); if (!idev) @@ -1154,7 +1199,7 @@ scan_or_find_usb_device (int scan_mode, strerror (errno)); continue; /* with next setting. */ } - + rid = make_reader_id (idev, dev->descriptor.idVendor, dev->descriptor.idProduct, @@ -1164,7 +1209,7 @@ scan_or_find_usb_device (int scan_mode, if (scan_mode) { char *p; - + /* We are collecting infos about all available CCID readers. Store them and continue. */ @@ -1186,7 +1231,7 @@ scan_or_find_usb_device (int scan_mode, } else /* Out of memory. */ free (rid); - + rid = NULL; ++*count; } @@ -1230,7 +1275,7 @@ scan_or_find_usb_device (int scan_mode, } else free (rid); - + *r_idev = idev; return 1; /* Found requested device. */ } @@ -1244,7 +1289,7 @@ scan_or_find_usb_device (int scan_mode, } free (rid); } - + usb_close (idev); idev = NULL; return 0; @@ -1257,7 +1302,7 @@ scan_or_find_usb_device (int scan_mode, } /* Combination function to either scan all CCID devices or to find and - open one specific device. + open one specific device. The function returns 0 if a reader has been found or when a scan returned without error. @@ -1316,7 +1361,7 @@ scan_or_find_devices (int readerno, const char *readerid, if (r_rid) *r_rid = NULL; if (r_dev) - *r_dev = NULL; + *r_dev = NULL; if (ifcdesc_extra) *ifcdesc_extra = NULL; if (ifcdesc_extra_len) @@ -1329,7 +1374,7 @@ scan_or_find_devices (int readerno, const char *readerid, *r_fd = -1; /* See whether we want scan or find mode. */ - if (scan_mode) + if (scan_mode) { assert (r_rid); } @@ -1343,7 +1388,7 @@ scan_or_find_devices (int readerno, const char *readerid, busses = usb_busses; #endif - for (bus = busses; bus; bus = bus->next) + for (bus = busses; bus; bus = bus->next) { for (dev = bus->devices; dev; dev = dev->next) { @@ -1365,7 +1410,7 @@ scan_or_find_devices (int readerno, const char *readerid, return -1; /* error */ } *r_idev = idev; - return 0; + return 0; } } } @@ -1492,9 +1537,36 @@ ccid_get_reader_list (void) } -/* Open the reader with the internal number READERNO and return a +/* Vendor specific custom initialization. */ +static int +ccid_vendor_specific_init (ccid_driver_t handle) +{ + if (handle->id_vendor == VENDOR_VEGA && handle->id_product == VEGA_ALPHA) + { + int r; + /* + * Vega alpha has a feature to show retry counter on the pinpad + * display. But it assumes that the card returns the value of + * retry counter by VERIFY with empty data (return code of + * 63Cx). Unfortunately, existing OpenPGP cards don't support + * VERIFY command with empty data. This vendor specific command + * sequence is to disable the feature. + */ + const unsigned char cmd[] = { '\xb5', '\x01', '\x00', '\x03', '\x00' }; + + r = send_escape_cmd (handle, cmd, sizeof (cmd), NULL, 0, NULL); + if (r != 0 && r != CCID_DRIVER_ERR_CARD_INACTIVE + && r != CCID_DRIVER_ERR_NO_CARD) + return r; + } + + return 0; +} + + +/* Open the reader with the internal number READERNO and return a pointer to be used as handle in HANDLE. Returns 0 on success. */ -int +int ccid_open_reader (ccid_driver_t *handle, const char *readerid) { int rc = 0; @@ -1590,7 +1662,7 @@ ccid_open_reader (ccid_driver_t *handle, const char *readerid) rc = CCID_DRIVER_ERR_NO_READER; goto leave; } - + rc = usb_claim_interface (idev, ifc_no); if (rc) { @@ -1600,6 +1672,8 @@ ccid_open_reader (ccid_driver_t *handle, const char *readerid) } } + rc = ccid_vendor_specific_init (*handle); + leave: free (ifcdesc_extra); if (rc) @@ -1624,7 +1698,7 @@ do_close_reader (ccid_driver_t handle) unsigned char msg[100]; size_t msglen; unsigned char seqno; - + if (!handle->powered_off) { msg[0] = PC_to_RDR_IccPowerOff; @@ -1635,7 +1709,7 @@ do_close_reader (ccid_driver_t handle) msg[9] = 0; /* RFU */ set_msg_len (msg, 0); msglen = 10; - + rc = bulk_out (handle, msg, msglen, 0); if (!rc) bulk_in (handle, msg, sizeof msg, &msglen, RDR_to_PC_SlotStatus, @@ -1659,12 +1733,12 @@ do_close_reader (ccid_driver_t handle) /* Reset a reader on HANDLE. This is useful in case a reader has been plugged of and inserted at a different port. By resetting the handle, the same reader will be get used. Note, that on error the - handle won't get released. + handle won't get released. This does not return an ATR, so ccid_get_atr should be called right after this one. */ -int +int ccid_shutdown_reader (ccid_driver_t handle) { int rc = 0; @@ -1702,7 +1776,7 @@ ccid_shutdown_reader (ccid_driver_t handle) rc = CCID_DRIVER_ERR_NO_READER; goto leave; } - + rc = usb_claim_interface (idev, ifc_no); if (rc) { @@ -1729,8 +1803,8 @@ ccid_shutdown_reader (ccid_driver_t handle) } -int -ccid_set_progress_cb (ccid_driver_t handle, +int +ccid_set_progress_cb (ccid_driver_t handle, void (*cb)(void *, const char *, int, int, int), void *cb_arg) { @@ -1744,7 +1818,7 @@ ccid_set_progress_cb (ccid_driver_t handle, /* Close the reader HANDLE. */ -int +int ccid_close_reader (ccid_driver_t handle) { if (!handle || (!handle->idev && handle->dev_fd == -1)) @@ -1772,7 +1846,7 @@ writen (int fd, const void *buf, size_t nbytes) { size_t nleft = nbytes; int nwritten; - + while (nleft > 0) { nwritten = write (fd, buf, nleft); @@ -1786,7 +1860,7 @@ writen (int fd, const void *buf, size_t nbytes) nleft -= nwritten; buf = (const char*)buf + nwritten; } - + return 0; } @@ -1855,10 +1929,10 @@ bulk_out (ccid_driver_t handle, unsigned char *msg, size_t msglen, break; } } - + if (handle->idev) { - rc = usb_bulk_write (handle->idev, + rc = usb_bulk_write (handle->idev, handle->ep_bulk_out, (char*)msg, msglen, 5000 /* ms timeout */); @@ -1895,7 +1969,7 @@ bulk_out (ccid_driver_t handle, unsigned char *msg, size_t msglen, return 0; DEBUGOUT_2 ("writen to %d failed: %s\n", handle->dev_fd, strerror (errno)); - + } return CCID_DRIVER_ERR_CARD_IO_ERROR; } @@ -1923,7 +1997,7 @@ bulk_in (ccid_driver_t handle, unsigned char *buffer, size_t length, retry: if (handle->idev) { - rc = usb_bulk_read (handle->idev, + rc = usb_bulk_read (handle->idev, handle->ep_bulk_in, (char*)buffer, length, timeout); @@ -1965,12 +2039,12 @@ bulk_in (ccid_driver_t handle, unsigned char *buffer, size_t length, abort_cmd (handle, seqno); return CCID_DRIVER_ERR_INV_VALUE; } - if (buffer[5] != 0) + if (buffer[5] != 0) { DEBUGOUT_1 ("unexpected bulk-in slot (%d)\n", buffer[5]); return CCID_DRIVER_ERR_INV_VALUE; } - if (buffer[6] != seqno) + if (buffer[6] != seqno) { DEBUGOUT_2 ("bulk-in seqno does not match (%d/%d)\n", seqno, buffer[6]); @@ -1983,7 +2057,7 @@ bulk_in (ccid_driver_t handle, unsigned char *buffer, size_t length, for the Cherry keyboard which sends a time extension request for each key hit. */ if ( !(buffer[7] & 0x03) && (buffer[7] & 0xC0) == 0x80) - { + { /* Card present and active, time extension requested. */ DEBUGOUT_2 ("time extension requested (%02X,%02X)\n", buffer[7], buffer[8]); @@ -2053,13 +2127,13 @@ abort_cmd (ccid_driver_t handle, int seqno) /* I don't know how to send an abort to non-USB devices. */ rc = CCID_DRIVER_ERR_NOT_SUPPORTED; } - + seqno &= 0xff; DEBUGOUT_1 ("sending abort sequence for seqno %d\n", seqno); /* Send the abort command to the control pipe. Note that we don't need to keep track of sent abort commands because there should never be another thread using the same slot concurrently. */ - rc = usb_control_msg (handle->idev, + rc = usb_control_msg (handle->idev, 0x21,/* bmRequestType: host-to-device, class specific, to interface. */ 1, /* ABORT */ @@ -2079,7 +2153,7 @@ abort_cmd (ccid_driver_t handle, int seqno) seqno--; /* Adjust for next increment. */ do { - seqno++; + seqno++; msg[0] = PC_to_RDR_Abort; msg[5] = 0; /* slot */ msg[6] = seqno; @@ -2089,24 +2163,24 @@ abort_cmd (ccid_driver_t handle, int seqno) msglen = 10; set_msg_len (msg, 0); - rc = usb_bulk_write (handle->idev, + rc = usb_bulk_write (handle->idev, handle->ep_bulk_out, (char*)msg, msglen, 5000 /* ms timeout */); if (rc == msglen) rc = 0; else if (rc == -1) - DEBUGOUT_1 ("usb_bulk_write error in abort_cmd: %s\n", + DEBUGOUT_1 ("usb_bulk_write error in abort_cmd: %s\n", strerror (errno)); else DEBUGOUT_1 ("usb_bulk_write failed in abort_cmd: %d\n", rc); if (rc) return rc; - - rc = usb_bulk_read (handle->idev, + + rc = usb_bulk_read (handle->idev, handle->ep_bulk_in, - (char*)msg, sizeof msg, + (char*)msg, sizeof msg, 5000 /*ms timeout*/); if (rc < 0) { @@ -2122,7 +2196,7 @@ abort_cmd (ccid_driver_t handle, int seqno) (unsigned int)msglen); return CCID_DRIVER_ERR_INV_VALUE; } - if (msg[5] != 0) + if (msg[5] != 0) { DEBUGOUT_1 ("unexpected bulk-in slot (%d) in abort_cmd\n", msg[5]); return CCID_DRIVER_ERR_INV_VALUE; @@ -2147,7 +2221,7 @@ abort_cmd (ccid_driver_t handle, int seqno) operation will get returned in RESULT and its length in RESULTLEN. If the response is larger than RESULTMAX, an error is returned and the required buffer length returned in RESULTLEN. */ -static int +static int send_escape_cmd (ccid_driver_t handle, const unsigned char *data, size_t datalen, unsigned char *result, size_t resultmax, size_t *resultlen) @@ -2199,7 +2273,7 @@ send_escape_cmd (ccid_driver_t handle, default: break; } - + return rc; } @@ -2225,14 +2299,14 @@ ccid_poll (ccid_driver_t handle) if (handle->idev) { - rc = usb_bulk_read (handle->idev, + rc = usb_bulk_read (handle->idev, handle->ep_intr, (char*)msg, sizeof msg, 0 /* ms timeout */ ); if (rc < 0 && errno == ETIMEDOUT) return 0; } - else + else return 0; if (rc < 0) @@ -2256,12 +2330,12 @@ ccid_poll (ccid_driver_t handle) for (i=1; i < msglen; i++) for (j=0; j < 4; j++) DEBUGOUT_CONT_3 (" %d:%c%c", - (i-1)*4+j, + (i-1)*4+j, (msg[i] & (1<<(j*2)))? 'p':'-', (msg[i] & (2<<(j*2)))? '*':' '); DEBUGOUT_LF (); } - else if (msg[0] == RDR_to_PC_HardwareError) + else if (msg[0] == RDR_to_PC_HardwareError) { DEBUGOUT ("hardware error occured\n"); } @@ -2276,7 +2350,7 @@ ccid_poll (ccid_driver_t handle) /* Note that this function won't return the error codes NO_CARD or CARD_INACTIVE */ -int +int ccid_slot_status (ccid_driver_t handle, int *statusbits) { int rc; @@ -2324,9 +2398,154 @@ ccid_slot_status (ccid_driver_t handle, int *statusbits) } +/* Parse ATR string (of ATRLEN) and update parameters at PARAM. + Calling this routine, it should prepare default values at PARAM + beforehand. This routine assumes that card is accessed by T=1 + protocol. It doesn't analyze historical bytes at all. + + Returns < 0 value on error: + -1 for parse error or integrity check error + -2 for card doesn't support T=1 protocol + -3 for parameters are nod explicitly defined by ATR + -4 for this driver doesn't support CRC + + Returns >= 0 on success: + 0 for card is negotiable mode + 1 for card is specific mode (and not negotiable) + */ +static int +update_param_by_atr (unsigned char *param, unsigned char *atr, size_t atrlen) +{ + int i = -1; + int t, y, chk; + int historical_bytes_num, negotiable = 1; + +#define NEXTBYTE() do { i++; if (atrlen <= i) return -1; } while (0) + + NEXTBYTE (); + + if (atr[i] == 0x3F) + param[1] |= 0x02; /* Convention is inverse. */ + NEXTBYTE (); + + y = (atr[i] >> 4); + historical_bytes_num = atr[i] & 0x0f; + NEXTBYTE (); + + if ((y & 1)) + { + param[0] = atr[i]; /* TA1 - Fi & Di */ + NEXTBYTE (); + } + + if ((y & 2)) + NEXTBYTE (); /* TB1 - ignore */ + + if ((y & 4)) + { + param[2] = atr[i]; /* TC1 - Guard Time */ + NEXTBYTE (); + } + + if ((y & 8)) + { + y = (atr[i] >> 4); /* TD1 */ + t = atr[i] & 0x0f; + NEXTBYTE (); + + if ((y & 1)) + { /* TA2 - PPS mode */ + if ((atr[i] & 0x0f) != 1) + return -2; /* Wrong card protocol (!= 1). */ + + if ((atr[i] & 0x10) != 0x10) + return -3; /* Transmission parameters are implicitly defined. */ + + negotiable = 0; /* TA2 means specific mode. */ + NEXTBYTE (); + } + + if ((y & 2)) + NEXTBYTE (); /* TB2 - ignore */ + + if ((y & 4)) + NEXTBYTE (); /* TC2 - ignore */ + + if ((y & 8)) + { + y = (atr[i] >> 4); /* TD2 */ + t = atr[i] & 0x0f; + NEXTBYTE (); + } + else + y = 0; + + while (y) + { + if ((y & 1)) + { /* TAx */ + if (t == 1) + param[5] = atr[i]; /* IFSC */ + else if (t == 15) + /* XXX: check voltage? */ + param[4] = (atr[i] >> 6); /* ClockStop */ + + NEXTBYTE (); + } + + if ((y & 2)) + { + if (t == 1) + param[3] = atr[i]; /* TBx - BWI & CWI */ + NEXTBYTE (); + } + + if ((y & 4)) + { + if (t == 1) + param[1] |= (atr[i] & 0x01); /* TCx - LRC/CRC */ + NEXTBYTE (); + + if (param[1] & 0x01) + return -4; /* CRC not supported yet. */ + } + + if ((y & 8)) + { + y = (atr[i] >> 4); /* TDx */ + t = atr[i] & 0x0f; + NEXTBYTE (); + } + else + y = 0; + } + } + + i += historical_bytes_num - 1; + NEXTBYTE (); + if (atrlen != i+1) + return -1; + +#undef NEXTBYTE + + chk = 0; + do + { + chk ^= atr[i]; + i--; + } + while (i > 0); + + if (chk != 0) + return -1; + + return negotiable; +} + + /* Return the ATR of the card. This is not a cached value and thus an actual reset is done. */ -int +int ccid_get_atr (ccid_driver_t handle, unsigned char *atr, size_t maxatrlen, size_t *atrlen) { @@ -2340,6 +2559,15 @@ ccid_get_atr (ccid_driver_t handle, unsigned int edc; int tried_iso = 0; int got_param; + unsigned char param[7] = { /* For Protocol T=1 */ + 0x11, /* bmFindexDindex */ + 0x10, /* bmTCCKST1 */ + 0x00, /* bGuardTimeT1 */ + 0x4d, /* bmWaitingIntegersT1 */ + 0x00, /* bClockStop */ + 0x20, /* bIFSC */ + 0x00 /* bNadValue */ + }; /* First check whether a card is available. */ rc = ccid_slot_status (handle, &statusbits); @@ -2354,7 +2582,8 @@ ccid_get_atr (ccid_driver_t handle, msg[0] = PC_to_RDR_IccPowerOn; msg[5] = 0; /* slot */ msg[6] = seqno = handle->seqno++; - msg[7] = 0; /* power select (0=auto, 1=5V, 2=3V, 3=1.8V) */ + /* power select (0=auto, 1=5V, 2=3V, 3=1.8V) */ + msg[7] = handle->auto_voltage ? 0 : 1; msg[8] = 0; /* RFU */ msg[9] = 0; /* RFU */ set_msg_len (msg, 0); @@ -2385,7 +2614,7 @@ ccid_get_atr (ccid_driver_t handle, handle->powered_off = 0; - + if (atr) { size_t n = msglen - 10; @@ -2396,23 +2625,73 @@ ccid_get_atr (ccid_driver_t handle, *atrlen = n; } + param[6] = handle->nonnull_nad? ((1 << 4) | 0): 0; + rc = update_param_by_atr (param, msg+10, msglen - 10); + if (rc < 0) + { + DEBUGOUT_1 ("update_param_by_atr failed: %d\n", rc); + return CCID_DRIVER_ERR_CARD_IO_ERROR; + } + got_param = 0; - msg[0] = PC_to_RDR_GetParameters; - msg[5] = 0; /* slot */ - msg[6] = seqno = handle->seqno++; - msg[7] = 0; /* RFU */ - msg[8] = 0; /* RFU */ - msg[9] = 0; /* RFU */ - set_msg_len (msg, 0); - msglen = 10; - rc = bulk_out (handle, msg, msglen, 0); - if (!rc) - rc = bulk_in (handle, msg, sizeof msg, &msglen, RDR_to_PC_Parameters, - seqno, 2000, 0); - if (rc) - DEBUGOUT ("GetParameters failed\n"); - else if (msglen == 17 && msg[9] == 1) - got_param = 1; + + if (handle->auto_param) + { + msg[0] = PC_to_RDR_GetParameters; + msg[5] = 0; /* slot */ + msg[6] = seqno = handle->seqno++; + msg[7] = 0; /* RFU */ + msg[8] = 0; /* RFU */ + msg[9] = 0; /* RFU */ + set_msg_len (msg, 0); + msglen = 10; + rc = bulk_out (handle, msg, msglen, 0); + if (!rc) + rc = bulk_in (handle, msg, sizeof msg, &msglen, RDR_to_PC_Parameters, + seqno, 2000, 0); + if (rc) + DEBUGOUT ("GetParameters failed\n"); + else if (msglen == 17 && msg[9] == 1) + got_param = 1; + } + else if (handle->auto_pps) + ; + else if (rc == 1) /* It's negotiable, send PPS. */ + { + msg[0] = PC_to_RDR_XfrBlock; + msg[5] = 0; /* slot */ + msg[6] = seqno = handle->seqno++; + msg[7] = 0; + msg[8] = 0; + msg[9] = 0; + msg[10] = 0xff; /* PPSS */ + msg[11] = 0x11; /* PPS0: PPS1, Protocol T=1 */ + msg[12] = param[0]; /* PPS1: Fi / Di */ + msg[13] = 0xff ^ 0x11 ^ param[0]; /* PCK */ + set_msg_len (msg, 4); + msglen = 10 + 4; + + rc = bulk_out (handle, msg, msglen, 0); + if (rc) + return rc; + + rc = bulk_in (handle, msg, sizeof msg, &msglen, RDR_to_PC_DataBlock, + seqno, 5000, 0); + if (rc) + return rc; + + if (msglen != 10 + 4) + { + DEBUGOUT_1 ("Setting PPS failed: %d\n", (int)msglen); + return CCID_DRIVER_ERR_CARD_IO_ERROR; + } + + if (msg[10] != 0xff || msg[11] != 0x11 || msg[12] != param[0]) + { + DEBUGOUT_1 ("Setting PPS failed: 0x%02x\n", param[0]); + return CCID_DRIVER_ERR_CARD_IO_ERROR; + } + } /* Setup parameters to select T=1. */ msg[0] = PC_to_RDR_SetParameters; @@ -2423,16 +2702,7 @@ ccid_get_atr (ccid_driver_t handle, msg[9] = 0; /* RFU */ if (!got_param) - { - /* FIXME: Get those values from the ATR. */ - msg[10]= 0x01; /* Fi/Di */ - msg[11]= 0x10; /* LRC, direct convention. */ - msg[12]= 0; /* Extra guardtime. */ - msg[13]= 0x41; /* BWI/CWI */ - msg[14]= 0; /* No clock stoppping. */ - msg[15]= 254; /* IFSC */ - msg[16]= 0; /* Does not support non default NAD values. */ - } + memcpy (&msg[10], param, 7); set_msg_len (msg, 7); msglen = 10 + 7; @@ -2449,6 +2719,12 @@ ccid_get_atr (ccid_driver_t handle, else handle->ifsc = 128; /* Something went wrong, assume 128 bytes. */ + if (handle->nonnull_nad && msglen > 16 && msg[16] == 0) + { + DEBUGOUT ("Use Null-NAD, clearing handle->nonnull_nad.\n"); + handle->nonnull_nad = 0; + } + handle->t1_ns = 0; handle->t1_nr = 0; @@ -2460,7 +2736,7 @@ ccid_get_atr (ccid_driver_t handle, tpdu[0] = handle->nonnull_nad? ((1 << 4) | 0): 0; tpdu[1] = (0xc0 | 0 | 1); /* S-block request: change IFSD */ tpdu[2] = 1; - tpdu[3] = handle->max_ifsd? handle->max_ifsd : 32; + tpdu[3] = handle->max_ifsd? handle->max_ifsd : 32; tpdulen = 4; edc = compute_edc (tpdu, tpdulen, use_crc); if (use_crc) @@ -2470,7 +2746,7 @@ ccid_get_atr (ccid_driver_t handle, msg[0] = PC_to_RDR_XfrBlock; msg[5] = 0; /* slot */ msg[6] = seqno = handle->seqno++; - msg[7] = 0; + msg[7] = 0; msg[8] = 0; /* RFU */ msg[9] = 0; /* RFU */ set_msg_len (msg, tpdulen); @@ -2493,12 +2769,12 @@ ccid_get_atr (ccid_driver_t handle, RDR_to_PC_DataBlock, seqno, 5000, 0); if (rc) return rc; - + tpdu = msg + 10; tpdulen = msglen - 10; - - if (tpdulen < 4) - return CCID_DRIVER_ERR_ABORTED; + + if (tpdulen < 4) + return CCID_DRIVER_ERR_ABORTED; if (debug_level > 1) DEBUGOUT_4 ("T=1: got %c-block seq=%d err=%d%s\n", @@ -2523,7 +2799,7 @@ ccid_get_atr (ccid_driver_t handle, -static unsigned int +static unsigned int compute_edc (const unsigned char *data, size_t datalen, int use_crc) { if (use_crc) @@ -2533,7 +2809,7 @@ compute_edc (const unsigned char *data, size_t datalen, int use_crc) else { unsigned char crc = 0; - + for (; datalen; datalen--) crc ^= *data++; return crc; @@ -2575,10 +2851,10 @@ ccid_transceive_apdu_level (ccid_driver_t handle, /* The maximum length for a short APDU T=1 block is 261. For an extended APDU T=1 block the maximum length 65544; however - extended APDU exchange level is not yet supported. */ - if (apdulen > 261) + extended APDU exchange level is not fully supported yet. */ + if (apdulen > sizeof (send_buffer) - 10) return CCID_DRIVER_ERR_INV_VALUE; /* Invalid length. */ - + msg[0] = PC_to_RDR_XfrBlock; msg[5] = 0; /* slot */ msg[6] = seqno = handle->seqno++; @@ -2598,10 +2874,53 @@ ccid_transceive_apdu_level (ccid_driver_t handle, RDR_to_PC_DataBlock, seqno, 5000, 0); if (rc) return rc; - - apdu = msg + 10; - apdulen = msglen - 10; - + + if (msg[9] == 1) + { + size_t total_msglen = msglen; + + while (1) + { + unsigned char status; + + msg = recv_buffer + total_msglen; + + msg[0] = PC_to_RDR_XfrBlock; + msg[5] = 0; /* slot */ + msg[6] = seqno = handle->seqno++; + msg[7] = bwi; /* bBWI */ + msg[8] = 0x10; /* Request next data block */ + msg[9] = 0; + set_msg_len (msg, 0); + msglen = 10; + + rc = bulk_out (handle, msg, msglen, 0); + if (rc) + return rc; + + rc = bulk_in (handle, msg, sizeof recv_buffer - total_msglen, &msglen, + RDR_to_PC_DataBlock, seqno, 5000, 0); + if (rc) + return rc; + status = msg[9]; + memmove (msg, msg+10, msglen - 10); + total_msglen += msglen - 10; + if (total_msglen >= sizeof recv_buffer) + return CCID_DRIVER_ERR_OUT_OF_CORE; + + if (status == 0x02) + break; + } + + apdu = recv_buffer + 10; + apdulen = total_msglen - 10; + } + else + { + apdu = msg + 10; + apdulen = msglen - 10; + } + if (resp) { if (apdulen > maxresplen) @@ -2611,11 +2930,11 @@ ccid_transceive_apdu_level (ccid_driver_t handle, (unsigned int)apdulen, (unsigned int)maxresplen); return CCID_DRIVER_ERR_INV_VALUE; } - - memcpy (resp, apdu, apdulen); + + memcpy (resp, apdu, apdulen); *nresp = apdulen; } - + return 0; } @@ -2626,15 +2945,15 @@ ccid_transceive_apdu_level (ccid_driver_t handle, Block Structure: Prologue Field: - 1 byte Node Address (NAD) + 1 byte Node Address (NAD) 1 byte Protocol Control Byte (PCB) - 1 byte Length (LEN) + 1 byte Length (LEN) Information Field: 0-254 byte APDU or Control Information (INF) Epilogue Field: 1 byte Error Detection Code (EDC) - NAD: + NAD: bit 7 unused bit 4..6 Destination Node Address (DAD) bit 3 unused @@ -2649,7 +2968,7 @@ ccid_transceive_apdu_level (ccid_driver_t handle, Information Block (I-Block): bit 7 0 bit 6 Sequence number (yep, that is modulo 2) - bit 5 Chaining flag + bit 5 Chaining flag bit 4..0 reserved Received-Ready Block (R-Block): bit 7 1 @@ -2752,7 +3071,7 @@ ccid_transceive (ccid_driver_t handle, if (apdulen > handle->ifsc ) { apdulen = handle->ifsc; - apdu_buf += handle->ifsc; + apdu_buf += handle->ifsc; apdu_buflen -= handle->ifsc; tpdu[1] |= (1 << 5); /* Set more bit. */ } @@ -2799,14 +3118,14 @@ ccid_transceive (ccid_driver_t handle, : !!(msg[pcboff] & 0x40)), (!(msg[pcboff] & 0x80) && (msg[pcboff] & 0x20)? " [more]":"")); - + rc = bulk_out (handle, msg, msglen, 0); if (rc) return rc; msg = recv_buffer; rc = bulk_in (handle, msg, sizeof recv_buffer, &msglen, - via_escape? RDR_to_PC_Escape : RDR_to_PC_DataBlock, + via_escape? RDR_to_PC_Escape : RDR_to_PC_DataBlock, seqno, 5000, 0); if (rc) return rc; @@ -2814,11 +3133,11 @@ ccid_transceive (ccid_driver_t handle, tpdu = msg + hdrlen; tpdulen = msglen - hdrlen; resyncing = 0; - - if (tpdulen < 4) + + if (tpdulen < 4) { usb_clear_halt (handle->idev, handle->ep_bulk_in); - return CCID_DRIVER_ERR_ABORTED; + return CCID_DRIVER_ERR_ABORTED; } if (debug_level > 1) @@ -2870,16 +3189,16 @@ ccid_transceive (ccid_driver_t handle, (unsigned int)n, (unsigned int)maxresplen); return CCID_DRIVER_ERR_INV_VALUE; } - - memcpy (resp, p, n); + + memcpy (resp, p, n); resp += n; *nresp += n; maxresplen -= n; } - + if (!(tpdu[1] & 0x20)) return 0; /* No chaining requested - ready. */ - + msg = send_buffer; tpdu = msg + hdrlen; tpdu[0] = nad_byte; @@ -2893,8 +3212,8 @@ ccid_transceive (ccid_driver_t handle, } else if ((tpdu[1] & 0xc0) == 0x80) { /* This is a R-block. */ - if ( (tpdu[1] & 0x0f)) - { + if ( (tpdu[1] & 0x0f)) + { retries++; if (via_escape && retries == 1 && (msg[pcboff] & 0x0f)) { @@ -2944,7 +3263,7 @@ ccid_transceive (ccid_driver_t handle, return CCID_DRIVER_ERR_CARD_IO_ERROR; } } - else + else { /* This is a S-block. */ retries = 0; DEBUGOUT_2 ("T=1: S-block %s received cmd=%d\n", @@ -3008,22 +3327,21 @@ ccid_transceive (ccid_driver_t handle, /* Send the CCID Secure command to the reader. APDU_BUF should contain the APDU template. PIN_MODE defines how the pin gets formatted: - + 1 := The PIN is ASCII encoded and of variable length. The length of the PIN entered will be put into Lc by the reader. The APDU should me made up of 4 bytes without Lc. PINLEN_MIN and PINLEN_MAX define the limits for the pin length. 0 - may be used t enable reasonable defaults. PIN_PADLEN should be 0. - + may be used t enable reasonable defaults. + When called with RESP and NRESP set to NULL, the function will merely check whether the reader supports the secure command for the given APDU and PIN_MODE. */ int ccid_transceive_secure (ccid_driver_t handle, const unsigned char *apdu_buf, size_t apdu_buflen, - int pin_mode, int pinlen_min, int pinlen_max, - int pin_padlen, + pininfo_t *pininfo, unsigned char *resp, size_t maxresplen, size_t *nresp) { int rc; @@ -3034,6 +3352,7 @@ ccid_transceive_secure (ccid_driver_t handle, size_t dummy_nresp; int testmode; int cherry_mode = 0; + int enable_varlen = 0; testmode = !resp && !nresp; @@ -3044,25 +3363,19 @@ ccid_transceive_secure (ccid_driver_t handle, if (apdu_buflen >= 4 && apdu_buf[1] == 0x20 && (handle->has_pinpad & 1)) ; else if (apdu_buflen >= 4 && apdu_buf[1] == 0x24 && (handle->has_pinpad & 2)) - return CCID_DRIVER_ERR_NOT_SUPPORTED; /* Not yet by our code. */ + ; else - return CCID_DRIVER_ERR_NO_KEYPAD; - - if (pin_mode != 1) - return CCID_DRIVER_ERR_NOT_SUPPORTED; + return CCID_DRIVER_ERR_NO_PINPAD; - if (pin_padlen != 0) - return CCID_DRIVER_ERR_NOT_SUPPORTED; - - if (!pinlen_min) - pinlen_min = 1; - if (!pinlen_max) - pinlen_max = 25; + if (!pininfo->minlen) + pininfo->minlen = 1; + if (!pininfo->maxlen) + pininfo->maxlen = 15; /* Note that the 25 is the maximum value the SPR532 allows. */ - if (pinlen_min < 1 || pinlen_min > 25 - || pinlen_max < 1 || pinlen_max > 25 - || pinlen_min > pinlen_max) + if (pininfo->minlen < 1 || pininfo->minlen > 25 + || pininfo->maxlen < 1 || pininfo->maxlen > 25 + || pininfo->minlen > pininfo->maxlen) return CCID_DRIVER_ERR_INV_VALUE; /* We have only tested a few readers so better don't risk anything @@ -3071,8 +3384,17 @@ ccid_transceive_secure (ccid_driver_t handle, { case VENDOR_SCM: /* Tested with SPR 532. */ case VENDOR_KAAN: /* Tested with KAAN Advanced (1.02). */ + case VENDOR_FSIJ: /* Tested with Gnuk (0.21). */ + pininfo->maxlen = 25; + enable_varlen = 1; + break; + case VENDOR_REINER: /* Tested with cyberJack go */ + case VENDOR_VASCO: /* Tested with DIGIPASS 920 */ + enable_varlen = 1; break; case VENDOR_CHERRY: + pininfo->maxlen = 25; + enable_varlen = 1; /* The CHERRY XX44 keyboard echos an asterisk for each entered character on the keyboard channel. We use a special variant of PC_to_RDR_Secure which directs these characters to the @@ -3080,15 +3402,32 @@ ccid_transceive_secure (ccid_driver_t handle, Lc byte to the APDU. It seems that it will be replaced with the actual length instead of being appended before the APDU is send to the card. */ - cherry_mode = 1; + if (handle->id_product != CHERRY_ST2000) + cherry_mode = 1; break; default: + if ((handle->id_vendor == VENDOR_GEMPC && + handle->id_product == GEMPC_PINPAD) + || (handle->id_vendor == VENDOR_VEGA && + handle->id_product == VEGA_ALPHA)) + { + enable_varlen = 0; + pininfo->minlen = 4; + pininfo->maxlen = 8; + break; + } return CCID_DRIVER_ERR_NOT_SUPPORTED; } + if (enable_varlen) + pininfo->fixedlen = 0; + if (testmode) return 0; /* Success */ - + + if (pininfo->fixedlen < 0 || pininfo->fixedlen >= 16) + return CCID_DRIVER_ERR_NOT_SUPPORTED; + msg = send_buffer; if (handle->id_vendor == VENDOR_SCM) { @@ -3105,7 +3444,8 @@ ccid_transceive_secure (ccid_driver_t handle, msg[7] = 0; /* bBWI */ msg[8] = 0; /* RFU */ msg[9] = 0; /* RFU */ - msg[10] = 0; /* Perform PIN verification. */ + msg[10] = apdu_buf[1] == 0x20 ? 0 : 1; + /* Perform PIN verification or PIN modification. */ msg[11] = 0; /* Timeout in seconds. */ msg[12] = 0x82; /* bmFormatString: Byte, pos=0, left, ASCII. */ if (handle->id_vendor == VENDOR_SCM) @@ -3117,50 +3457,94 @@ ccid_transceive_secure (ccid_driver_t handle, } else { - msg[13] = 0x00; /* bmPINBlockString: - 0 bits of pin length to insert. - 0 bytes of PIN block size. */ + msg[13] = pininfo->fixedlen; /* bmPINBlockString: + 0 bits of pin length to insert. + PIN block size by fixedlen. */ msg[14] = 0x00; /* bmPINLengthFormat: Units are bytes, position is 0. */ } + msglen = 15; + if (apdu_buf[1] == 0x24) + { + msg[msglen++] = 0; /* bInsertionOffsetOld */ + msg[msglen++] = pininfo->fixedlen; /* bInsertionOffsetNew */ + } + /* The following is a little endian word. */ - msg[15] = pinlen_max; /* wPINMaxExtraDigit-Maximum. */ - msg[16] = pinlen_min; /* wPINMaxExtraDigit-Minimum. */ - - msg[17] = 0x02; /* bEntryValidationCondition: - Validation key pressed */ - if (pinlen_min && pinlen_max && pinlen_min == pinlen_max) - msg[17] |= 0x01; /* Max size reached. */ - msg[18] = 0xff; /* bNumberMessage: Default. */ - msg[19] = 0x04; /* wLangId-High. */ - msg[20] = 0x09; /* wLangId-Low: English FIXME: use the first entry. */ - msg[21] = 0; /* bMsgIndex. */ + msg[msglen++] = pininfo->maxlen; /* wPINMaxExtraDigit-Maximum. */ + msg[msglen++] = pininfo->minlen; /* wPINMaxExtraDigit-Minimum. */ + + if (apdu_buf[1] == 0x24) + msg[msglen++] = apdu_buf[2] == 0 ? 0x03 : 0x01; + /* bConfirmPIN + * 0x00: new PIN once + * 0x01: new PIN twice (confirmation) + * 0x02: old PIN and new PIN once + * 0x03: old PIN and new PIN twice (confirmation) + */ + + msg[msglen] = 0x02; /* bEntryValidationCondition: + Validation key pressed */ + if (pininfo->minlen && pininfo->maxlen && pininfo->minlen == pininfo->maxlen) + msg[msglen] |= 0x01; /* Max size reached. */ + msglen++; + + if (apdu_buf[1] == 0x20) + msg[msglen++] = 0x01; /* bNumberMessage. */ + else + msg[msglen++] = 0x03; /* bNumberMessage. */ + + msg[msglen++] = 0x09; /* wLangId-Low: English FIXME: use the first entry. */ + msg[msglen++] = 0x04; /* wLangId-High. */ + + if (apdu_buf[1] == 0x20) + msg[msglen++] = 0; /* bMsgIndex. */ + else + { + msg[msglen++] = 0; /* bMsgIndex1. */ + msg[msglen++] = 1; /* bMsgIndex2. */ + msg[msglen++] = 2; /* bMsgIndex3. */ + } + + /* Calculate Lc. */ + n = pininfo->fixedlen; + if (apdu_buf[1] == 0x24) + n += pininfo->fixedlen; + /* bTeoProlog follows: */ - msg[22] = handle->nonnull_nad? ((1 << 4) | 0): 0; - msg[23] = ((handle->t1_ns & 1) << 6); /* I-block */ - msg[24] = 0; /* The apdulen will be filled in by the reader. */ + msg[msglen++] = handle->nonnull_nad? ((1 << 4) | 0): 0; + msg[msglen++] = ((handle->t1_ns & 1) << 6); /* I-block */ + if (n) + msg[msglen++] = n + 5; /* apdulen should be filled for fixed length. */ + else + msg[msglen++] = 0; /* The apdulen will be filled in by the reader. */ /* APDU follows: */ - msg[25] = apdu_buf[0]; /* CLA */ - msg[26] = apdu_buf[1]; /* INS */ - msg[27] = apdu_buf[2]; /* P1 */ - msg[28] = apdu_buf[3]; /* P2 */ - msglen = 29; + msg[msglen++] = apdu_buf[0]; /* CLA */ + msg[msglen++] = apdu_buf[1]; /* INS */ + msg[msglen++] = apdu_buf[2]; /* P1 */ + msg[msglen++] = apdu_buf[3]; /* P2 */ if (cherry_mode) msg[msglen++] = 0; + else if (pininfo->fixedlen != 0) + { + msg[msglen++] = n; + memset (&msg[msglen], 0xff, n); + msglen += n; + } /* An EDC is not required. */ set_msg_len (msg, msglen - 10); rc = bulk_out (handle, msg, msglen, 0); if (rc) return rc; - + msg = recv_buffer; rc = bulk_in (handle, msg, sizeof recv_buffer, &msglen, RDR_to_PC_DataBlock, seqno, 30000, 0); if (rc) return rc; - + tpdu = msg + 10; tpdulen = msglen - 10; @@ -3175,17 +3559,17 @@ ccid_transceive_secure (ccid_driver_t handle, (unsigned int)tpdulen, (unsigned int)maxresplen); return CCID_DRIVER_ERR_INV_VALUE; } - - memcpy (resp, tpdu, tpdulen); + + memcpy (resp, tpdu, tpdulen); *nresp = tpdulen; } return 0; } - - if (tpdulen < 4) + + if (tpdulen < 4) { usb_clear_halt (handle->idev, handle->ep_bulk_in); - return CCID_DRIVER_ERR_ABORTED; + return CCID_DRIVER_ERR_ABORTED; } if (debug_level > 1) DEBUGOUT_4 ("T=1: got %c-block seq=%d err=%d%s\n", @@ -3220,22 +3604,22 @@ ccid_transceive_secure (ccid_driver_t handle, (unsigned int)n, (unsigned int)maxresplen); return CCID_DRIVER_ERR_INV_VALUE; } - - memcpy (resp, p, n); + + memcpy (resp, p, n); resp += n; *nresp += n; maxresplen -= n; } - + if (!(tpdu[1] & 0x20)) return 0; /* No chaining requested - ready. */ - + DEBUGOUT ("chaining requested but not supported for Secure operation\n"); return CCID_DRIVER_ERR_CARD_IO_ERROR; } else if ((tpdu[1] & 0xc0) == 0x80) { /* This is a R-block. */ - if ( (tpdu[1] & 0x0f)) + if ( (tpdu[1] & 0x0f)) { /* Error: repeat last block */ DEBUGOUT ("No retries supported for Secure operation\n"); return CCID_DRIVER_ERR_CARD_IO_ERROR; @@ -3251,13 +3635,13 @@ ccid_transceive_secure (ccid_driver_t handle, return CCID_DRIVER_ERR_CARD_IO_ERROR; } } - else + else { /* This is a S-block. */ DEBUGOUT_2 ("T=1: S-block %s received cmd=%d for Secure operation\n", (tpdu[1] & 0x20)? "response": "request", (tpdu[1] & 0x1f)); return CCID_DRIVER_ERR_CARD_IO_ERROR; - } + } return 0; } @@ -3413,7 +3797,7 @@ main (int argc, char **argv) result, sizeof result, &resultlen); print_result (rc, result, resultlen); } - + if (!no_poll) ccid_poll (ccid); @@ -3434,7 +3818,7 @@ main (int argc, char **argv) { static unsigned char apdu[] = { 0, 0x20, 0, 0x81 }; - + if (ccid_transceive_secure (ccid, apdu, sizeof apdu, 1, 0, 0, 0, @@ -3443,7 +3827,7 @@ main (int argc, char **argv) else { fputs ("verifying CHV1 using the PINPad ....\n", stderr); - + rc = ccid_transceive_secure (ccid, apdu, sizeof apdu, 1, 0, 0, 0, @@ -3452,7 +3836,7 @@ main (int argc, char **argv) did_verify = 1; } } - + if (verify_123456 && !did_verify) { fputs ("verifying that CHV1 is 123456....\n", stderr); |