openwrt-packages-dist/utils/opensc/patches/0001-OpenPGP-Detect-and-support-Gnuk-Token.patch

From 471b40173b73f213ee72bf05735abf3357658197 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nguy=E1=BB=85n=20H=E1=BB=93ng=20Qu=C3=A2n?=
 <ng.hong.quan@gmail.com>
Date: Wed, 20 Feb 2013 11:54:30 +0700
Subject: [PATCH 01/26] OpenPGP: Detect and support Gnuk Token.

http://www.fsij.org/gnuk/
---
 src/libopensc/card-openpgp.c | 61 ++++++++++++++++++++++++++++++++++----------
 src/libopensc/cards.h        |  1 +
 src/tools/openpgp-tool.c     |  7 ++++-
 3 files changed, 55 insertions(+), 14 deletions(-)

diff --git a/src/libopensc/card-openpgp.c b/src/libopensc/card-openpgp.c
index 6774fe1..c785a55 100644
--- a/src/libopensc/card-openpgp.c
+++ b/src/libopensc/card-openpgp.c
@@ -43,6 +43,7 @@
 static struct sc_atr_table pgp_atrs[] = {
 	{ "3b:fa:13:00:ff:81:31:80:45:00:31:c1:73:c0:01:00:00:90:00:b1", NULL, "OpenPGP card v1.0/1.1", SC_CARD_TYPE_OPENPGP_V1, 0, NULL },
 	{ "3b:da:18:ff:81:b1:fe:75:1f:03:00:31:c5:73:c0:01:40:00:90:00:0c", NULL, "CryptoStick v1.2 (OpenPGP v2.0)", SC_CARD_TYPE_OPENPGP_V2, 0, NULL },
+	{ "3b:da:11:ff:81:b1:fe:55:1f:03:00:31:84:73:80:01:80:00:90:00:e4", NULL, "Gnuk v1.0.x (OpenPGP v2.0)", SC_CARD_TYPE_OPENPGP_GNUK, 0, NULL },
 	{ NULL, NULL, NULL, 0, 0, NULL }
 };
 
@@ -307,6 +308,8 @@ pgp_init(sc_card_t *card)
 	int		r;
 	struct blob 	*child = NULL;
 
+	LOG_FUNC_CALLED(card->ctx);
+
 	priv = calloc (1, sizeof *priv);
 	if (!priv)
 		return SC_ERROR_OUT_OF_MEMORY;
@@ -315,11 +318,11 @@ pgp_init(sc_card_t *card)
 	card->cla = 0x00;
 
 	/* set pointer to correct list of card objects */
-	priv->pgp_objects = (card->type == SC_CARD_TYPE_OPENPGP_V2)
+	priv->pgp_objects = (card->type == SC_CARD_TYPE_OPENPGP_V2 || card->type == SC_CARD_TYPE_OPENPGP_GNUK)
 				? pgp2_objects : pgp1_objects;
 
 	/* set detailed card version */
-	priv->bcd_version = (card->type == SC_CARD_TYPE_OPENPGP_V2)
+	priv->bcd_version = (card->type == SC_CARD_TYPE_OPENPGP_V2 || card->type == SC_CARD_TYPE_OPENPGP_GNUK)
 				? OPENPGP_CARD_2_0 : OPENPGP_CARD_1_1;
 
 	/* select application "OpenPGP" */
@@ -428,7 +431,8 @@ pgp_get_card_features(sc_card_t *card)
 		if ((pgp_get_blob(card, blob73, 0x00c0, &blob) >= 0) &&
 		    (blob->data != NULL) && (blob->len > 0)) {
 			/* in v2.0 bit 0x04 in first byte means "algorithm attributes changeable */
-			if ((blob->data[0] & 0x04) && (card->type == SC_CARD_TYPE_OPENPGP_V2))
+			if ((blob->data[0] & 0x04) &&
+			    (card->type == SC_CARD_TYPE_OPENPGP_V2 || card->type == SC_CARD_TYPE_OPENPGP_GNUK))
 				priv->ext_caps |= EXT_CAP_ALG_ATTR_CHANGEABLE;
 			/* bit 0x08 in first byte means "support for private use DOs" */
 			if (blob->data[0] & 0x08)
@@ -445,7 +449,8 @@ pgp_get_card_features(sc_card_t *card)
 				priv->ext_caps |= EXT_CAP_GET_CHALLENGE;
 			}
 			/* in v2.0 bit 0x80 in first byte means "support Secure Messaging" */
-			if ((blob->data[0] & 0x80) && (card->type == SC_CARD_TYPE_OPENPGP_V2))
+			if ((blob->data[0] & 0x80) &&
+			    (card->type == SC_CARD_TYPE_OPENPGP_V2 || card->type == SC_CARD_TYPE_OPENPGP_GNUK))
 				priv->ext_caps |= EXT_CAP_SM;
 
 			if ((priv->bcd_version >= OPENPGP_CARD_2_0) && (blob->len >= 10)) {
@@ -1057,12 +1062,18 @@ static int
 pgp_get_pubkey(sc_card_t *card, unsigned int tag, u8 *buf, size_t buf_len)
 {
 	sc_apdu_t	apdu;
+	u8 apdu_case = SC_APDU_CASE_4;
 	u8		idbuf[2];
 	int		r;
 
 	sc_log(card->ctx, "called, tag=%04x\n", tag);
 
-	sc_format_apdu(card, &apdu, SC_APDU_CASE_4, 0x47, 0x81, 0);
+	/* With Gnuk token, force to use short APDU */
+	if (card->type == SC_CARD_TYPE_OPENPGP_GNUK) {
+		apdu_case = SC_APDU_CASE_4_SHORT;
+	}
+
+	sc_format_apdu(card, &apdu, apdu_case, 0x47, 0x81, 0);
 	apdu.lc = 2;
 	apdu.data = ushort2bebytes(idbuf, tag);
 	apdu.datalen = 2;
@@ -1154,6 +1165,7 @@ pgp_put_data(sc_card_t *card, unsigned int tag, const u8 *buf, size_t buf_len)
 	u8 ins = 0xDA;
 	u8 p1 = tag >> 8;
 	u8 p2 = tag & 0xFF;
+	u8 apdu_case = SC_APDU_CASE_3;
 	int r;
 
 	LOG_FUNC_CALLED(card->ctx);
@@ -1195,13 +1207,17 @@ pgp_put_data(sc_card_t *card, unsigned int tag, const u8 *buf, size_t buf_len)
 
 	/* Build APDU */
 	if (buf != NULL && buf_len > 0) {
-		sc_format_apdu(card, &apdu, SC_APDU_CASE_3, ins, p1, p2);
+		/* Force short APDU for Gnuk */
+		if (card->type == SC_CARD_TYPE_OPENPGP_GNUK) {
+			apdu_case = SC_APDU_CASE_3_SHORT;
+		}
+		sc_format_apdu(card, &apdu, apdu_case, ins, p1, p2);
 
 		/* if card/reader does not support extended APDUs, but chaining, then set it */
 		if (((card->caps & SC_CARD_CAP_APDU_EXT) == 0) && (priv->ext_caps & EXT_CAP_CHAINING))
 			apdu.flags |= SC_APDU_FLAGS_CHAINING;
 
-		apdu.data = buf;
+		apdu.data = (u8 *)buf;
 		apdu.datalen = buf_len;
 		apdu.lc = buf_len;
 	}
@@ -1328,6 +1344,7 @@ pgp_compute_signature(sc_card_t *card, const u8 *data,
 	struct pgp_priv_data	*priv = DRVDATA(card);
 	sc_security_env_t	*env = &priv->sec_env;
 	sc_apdu_t		apdu;
+	u8 apdu_case = SC_APDU_CASE_4;
 	int			r;
 
 	LOG_FUNC_CALLED(card->ctx);
@@ -1336,14 +1353,19 @@ pgp_compute_signature(sc_card_t *card, const u8 *data,
 		LOG_TEST_RET(card->ctx, SC_ERROR_INVALID_ARGUMENTS,
 				"invalid operation");
 
+	/* Force short APDU for Gnuk Token */
+	if (card->type == SC_CARD_TYPE_OPENPGP_GNUK) {
+		apdu_case = SC_APDU_CASE_4_SHORT;
+	}
+
 	switch (env->key_ref[0]) {
 	case 0x00: /* signature key */
 		/* PSO SIGNATURE */
-		sc_format_apdu(card, &apdu, SC_APDU_CASE_4, 0x2A, 0x9E, 0x9A);
+		sc_format_apdu(card, &apdu, apdu_case, 0x2A, 0x9E, 0x9A);
 		break;
 	case 0x02: /* authentication key */
 		/* INTERNAL AUTHENTICATE */
-		sc_format_apdu(card, &apdu, SC_APDU_CASE_4, 0x88, 0, 0);
+		sc_format_apdu(card, &apdu, apdu_case, 0x88, 0, 0);
 		break;
 	case 0x01:
 	default:
@@ -1352,7 +1374,7 @@ pgp_compute_signature(sc_card_t *card, const u8 *data,
 	}
 
 	apdu.lc = data_len;
-	apdu.data = data;
+	apdu.data = (u8 *)data;
 	apdu.datalen = data_len;
 	apdu.le = ((outlen >= 256) && !(card->caps & SC_CARD_CAP_APDU_EXT)) ? 256 : outlen;
 	apdu.resp    = out;
@@ -1376,6 +1398,7 @@ pgp_decipher(sc_card_t *card, const u8 *in, size_t inlen,
 	struct pgp_priv_data	*priv = DRVDATA(card);
 	sc_security_env_t	*env = &priv->sec_env;
 	sc_apdu_t	apdu;
+	u8 apdu_case = SC_APDU_CASE_4;
 	u8		*temp = NULL;
 	int		r;
 
@@ -1400,7 +1423,7 @@ pgp_decipher(sc_card_t *card, const u8 *in, size_t inlen,
 	case 0x01: /* Decryption key */
 	case 0x02: /* authentication key */
 		/* PSO DECIPHER */
-		sc_format_apdu(card, &apdu, SC_APDU_CASE_4, 0x2A, 0x80, 0x86);
+		sc_format_apdu(card, &apdu, apdu_case, 0x2A, 0x80, 0x86);
 		break;
 	case 0x00: /* signature key */
 	default:
@@ -1409,8 +1432,13 @@ pgp_decipher(sc_card_t *card, const u8 *in, size_t inlen,
 				"invalid key reference");
 	}
 
+	/* Gnuk only supports short APDU, so we need to use command chaining */
+	if (card->type == SC_CARD_TYPE_OPENPGP_GNUK) {
+		apdu.flags |= SC_APDU_FLAGS_CHAINING;
+	}
+
 	apdu.lc = inlen;
-	apdu.data = in;
+	apdu.data = (u8 *)in;
 	apdu.datalen = inlen;
 	apdu.le = ((outlen >= 256) && !(card->caps & SC_CARD_CAP_APDU_EXT)) ? 256 : outlen;
 	apdu.resp = out;
@@ -1794,6 +1822,11 @@ static int pgp_gen_key(sc_card_t *card, sc_cardctl_openpgp_keygen_info_t *key_in
 		LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_ARGUMENTS);
 	}
 
+	if (card->type == SC_CARD_TYPE_OPENPGP_GNUK && key_info->modulus_len != 2048) {
+		sc_log(card->ctx, "Gnuk does not support other key length than 2048.");
+		LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_ARGUMENTS);
+	}
+
 	/* Set attributes for new-generated key */
 	r = pgp_update_new_algo_attr(card, key_info);
 	LOG_TEST_RET(card->ctx, r, "Cannot set attributes for new-generated key");
@@ -1801,7 +1834,9 @@ static int pgp_gen_key(sc_card_t *card, sc_cardctl_openpgp_keygen_info_t *key_in
 	/* Test whether we will need extended APDU. 1900 is an
 	 * arbitrary modulus length which for sure fits into a short APDU.
 	 * This idea is borrowed from GnuPG code.  */
-	if (card->caps & SC_CARD_CAP_APDU_EXT && key_info->modulus_len > 1900) {
+	if (card->caps & SC_CARD_CAP_APDU_EXT
+	    && key_info->modulus_len > 1900
+	    && card->type != SC_CARD_TYPE_OPENPGP_GNUK) {
 		/* We won't store to apdu variable yet, because it will be reset in
 		 * sc_format_apdu() */
 		apdu_le = card->max_recv_size;
diff --git a/src/libopensc/cards.h b/src/libopensc/cards.h
index 7be6667..a3f3634 100644
--- a/src/libopensc/cards.h
+++ b/src/libopensc/cards.h
@@ -105,6 +105,7 @@ enum {
 	SC_CARD_TYPE_OPENPGP_BASE = 9000,
 	SC_CARD_TYPE_OPENPGP_V1,
 	SC_CARD_TYPE_OPENPGP_V2,
+	SC_CARD_TYPE_OPENPGP_GNUK,
 
 	/* jcop driver */
 	SC_CARD_TYPE_JCOP_BASE = 10000,
diff --git a/src/tools/openpgp-tool.c b/src/tools/openpgp-tool.c
index f42e6d6..a24a395 100644
--- a/src/tools/openpgp-tool.c
+++ b/src/tools/openpgp-tool.c
@@ -33,6 +33,7 @@
 #include "libopensc/cards.h"
 #include "libopensc/cardctl.h"
 #include "libopensc/errors.h"
+#include "libopensc/log.h"
 #include "util.h"
 #include "libopensc/log.h"
 
@@ -396,6 +397,8 @@ int do_genkey(sc_card_t *card, u8 key_id, unsigned int key_len)
 	sc_path_t path;
 	sc_file_t *file;
 
+	LOG_FUNC_CALLED(card->ctx);
+
 	if (key_id < 1 || key_id > 3) {
 		printf("Unknown key ID %d.\n", key_id);
 		return 1;
@@ -487,8 +490,10 @@ int main(int argc, char **argv)
 
 	/* check card type */
 	if ((card->type != SC_CARD_TYPE_OPENPGP_V1) &&
-	    (card->type != SC_CARD_TYPE_OPENPGP_V2)) {
+	    (card->type != SC_CARD_TYPE_OPENPGP_V2) &&
+	    (card->type != SC_CARD_TYPE_OPENPGP_GNUK)) {
 		util_error("not an OpenPGP card");
+		sc_log(card->ctx, "Card type %X", card->type);
 		exit_status = EXIT_FAILURE;
 		goto out;
 	}
-- 
2.1.3