File:  [Qemu by Fabrice Bellard] / qemu / libcacard / vcard_emul_nss.c
Revision 1.1.1.2 (vendor branch): download - view: text, annotated - select for diffs
Tue Apr 24 19:31:39 2018 UTC (3 years, 3 months ago) by root
Branches: qemu, MAIN
CVS tags: qemu1001, HEAD
qemu 1.0.1

    1: /*
    2:  * This is the actual card emulator.
    3:  *
    4:  * These functions can be implemented in different ways on different platforms
    5:  * using the underlying system primitives. For Linux it uses NSS, though direct
    6:  * to PKCS #11, openssl+pkcs11, or even gnu crypto libraries+pkcs #11 could be
    7:  * used. On Windows CAPI could be used.
    8:  *
    9:  * This work is licensed under the terms of the GNU LGPL, version 2.1 or later.
   10:  * See the COPYING.LIB file in the top-level directory.
   11:  */
   12: 
   13: /*
   14:  * NSS headers
   15:  */
   16: 
   17: /* avoid including prototypes.h that redefines uint32 */
   18: #define NO_NSPR_10_SUPPORT
   19: 
   20: #include <nss.h>
   21: #include <pk11pub.h>
   22: #include <cert.h>
   23: #include <key.h>
   24: #include <secmod.h>
   25: #include <prthread.h>
   26: #include <secerr.h>
   27: 
   28: #include "qemu-common.h"
   29: 
   30: #include "vcard.h"
   31: #include "card_7816t.h"
   32: #include "vcard_emul.h"
   33: #include "vreader.h"
   34: #include "vevent.h"
   35: 
   36: typedef enum {
   37:     VCardEmulUnknown = -1,
   38:     VCardEmulFalse = 0,
   39:     VCardEmulTrue = 1
   40: } VCardEmulTriState;
   41: 
   42: struct VCardKeyStruct {
   43:     CERTCertificate *cert;
   44:     PK11SlotInfo *slot;
   45:     SECKEYPrivateKey *key;
   46:     VCardEmulTriState failedX509;
   47: };
   48: 
   49: 
   50: typedef struct VirtualReaderOptionsStruct VirtualReaderOptions;
   51: 
   52: struct VReaderEmulStruct {
   53:     PK11SlotInfo *slot;
   54:     VCardEmulType default_type;
   55:     char *type_params;
   56:     PRBool present;
   57:     int     series;
   58:     VCard *saved_vcard;
   59: };
   60: 
   61: /*
   62:  *  NSS Specific options
   63:  */
   64: struct VirtualReaderOptionsStruct {
   65:     char *name;
   66:     char *vname;
   67:     VCardEmulType card_type;
   68:     char *type_params;
   69:     char **cert_name;
   70:     int cert_count;
   71: };
   72: 
   73: struct VCardEmulOptionsStruct {
   74:     void *nss_db;
   75:     VirtualReaderOptions *vreader;
   76:     int vreader_count;
   77:     VCardEmulType hw_card_type;
   78:     const char *hw_type_params;
   79:     PRBool use_hw;
   80: };
   81: 
   82: static int nss_emul_init;
   83: 
   84: /* if we have more that just the slot, define
   85:  * VCardEmulStruct here */
   86: 
   87: /*
   88:  * allocate the set of arrays for certs, cert_len, key
   89:  */
   90: static PRBool
   91: vcard_emul_alloc_arrays(unsigned char ***certsp, int **cert_lenp,
   92:                         VCardKey ***keysp, int cert_count)
   93: {
   94:     *certsp = NULL;
   95:     *cert_lenp = NULL;
   96:     *keysp = NULL;
   97:     *certsp = (unsigned char **)g_malloc(sizeof(unsigned char *)*cert_count);
   98:     *cert_lenp = (int *)g_malloc(sizeof(int)*cert_count);
   99:     *keysp = (VCardKey **)g_malloc(sizeof(VCardKey *)*cert_count);
  100:     return PR_TRUE;
  101: }
  102: 
  103: /*
  104:  * Emulator specific card information
  105:  */
  106: typedef struct CardEmulCardStruct CardEmulPrivate;
  107: 
  108: static VCardEmul *
  109: vcard_emul_new_card(PK11SlotInfo *slot)
  110: {
  111:     PK11_ReferenceSlot(slot);
  112:     /* currently we don't need anything other than the slot */
  113:     return (VCardEmul *)slot;
  114: }
  115: 
  116: static void
  117: vcard_emul_delete_card(VCardEmul *vcard_emul)
  118: {
  119:     PK11SlotInfo *slot = (PK11SlotInfo *)vcard_emul;
  120:     if (slot == NULL) {
  121:         return;
  122:     }
  123:     PK11_FreeSlot(slot);
  124: }
  125: 
  126: static PK11SlotInfo *
  127: vcard_emul_card_get_slot(VCard *card)
  128: {
  129:     /* note, the card is holding the reference, no need to get another one */
  130:     return (PK11SlotInfo *)vcard_get_private(card);
  131: }
  132: 
  133: 
  134: /*
  135:  * key functions
  136:  */
  137: /* private constructure */
  138: static VCardKey *
  139: vcard_emul_make_key(PK11SlotInfo *slot, CERTCertificate *cert)
  140: {
  141:     VCardKey *key;
  142: 
  143:     key = (VCardKey *)g_malloc(sizeof(VCardKey));
  144:     key->slot = PK11_ReferenceSlot(slot);
  145:     key->cert = CERT_DupCertificate(cert);
  146:     /* NOTE: if we aren't logged into the token, this could return NULL */
  147:     /* NOTE: the cert is a temp cert, not necessarily the cert in the token,
  148:      * use the DER version of this function */
  149:     key->key = PK11_FindKeyByDERCert(slot, cert, NULL);
  150:     key->failedX509 = VCardEmulUnknown;
  151:     return key;
  152: }
  153: 
  154: /* destructor */
  155: void
  156: vcard_emul_delete_key(VCardKey *key)
  157: {
  158:     if (!nss_emul_init || (key == NULL)) {
  159:         return;
  160:     }
  161:     if (key->key) {
  162:         SECKEY_DestroyPrivateKey(key->key);
  163:         key->key = NULL;
  164:     }
  165:     if (key->cert) {
  166:         CERT_DestroyCertificate(key->cert);
  167:     }
  168:     if (key->slot) {
  169:         PK11_FreeSlot(key->slot);
  170:     }
  171:     return;
  172: }
  173: 
  174: /*
  175:  * grab the nss key from a VCardKey. If it doesn't exist, try to look it up
  176:  */
  177: static SECKEYPrivateKey *
  178: vcard_emul_get_nss_key(VCardKey *key)
  179: {
  180:     if (key->key) {
  181:         return key->key;
  182:     }
  183:     /* NOTE: if we aren't logged into the token, this could return NULL */
  184:     key->key = PK11_FindPrivateKeyFromCert(key->slot, key->cert, NULL);
  185:     return key->key;
  186: }
  187: 
  188: /*
  189:  * Map NSS errors to 7816 errors
  190:  */
  191: static vcard_7816_status_t
  192: vcard_emul_map_error(int error)
  193: {
  194:     switch (error) {
  195:     case SEC_ERROR_TOKEN_NOT_LOGGED_IN:
  196:         return VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED;
  197:     case SEC_ERROR_BAD_DATA:
  198:     case SEC_ERROR_OUTPUT_LEN:
  199:     case SEC_ERROR_INPUT_LEN:
  200:     case SEC_ERROR_INVALID_ARGS:
  201:     case SEC_ERROR_INVALID_ALGORITHM:
  202:     case SEC_ERROR_NO_KEY:
  203:     case SEC_ERROR_INVALID_KEY:
  204:     case SEC_ERROR_DECRYPTION_DISALLOWED:
  205:         return VCARD7816_STATUS_ERROR_DATA_INVALID;
  206:     case SEC_ERROR_NO_MEMORY:
  207:         return VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE;
  208:     }
  209:     return VCARD7816_STATUS_EXC_ERROR_CHANGE;
  210: }
  211: 
  212: /* RSA sign/decrypt with the key, signature happens 'in place' */
  213: vcard_7816_status_t
  214: vcard_emul_rsa_op(VCard *card, VCardKey *key,
  215:                   unsigned char *buffer, int buffer_size)
  216: {
  217:     SECKEYPrivateKey *priv_key;
  218:     unsigned signature_len;
  219:     PK11SlotInfo *slot;
  220:     SECStatus rv;
  221:     unsigned char buf[2048];
  222:     unsigned char *bp = NULL;
  223:     int pad_len;
  224:     vcard_7816_status_t ret = VCARD7816_STATUS_SUCCESS;
  225: 
  226:     if ((!nss_emul_init) || (key == NULL)) {
  227:         /* couldn't get the key, indicate that we aren't logged in */
  228:         return VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED;
  229:     }
  230:     priv_key = vcard_emul_get_nss_key(key);
  231:     if (priv_key == NULL) {
  232:         /* couldn't get the key, indicate that we aren't logged in */
  233:         return VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED;
  234:     }
  235:     slot = vcard_emul_card_get_slot(card);
  236: 
  237:     /*
  238:      * this is only true of the rsa signature
  239:      */
  240:     signature_len = PK11_SignatureLen(priv_key);
  241:     if (buffer_size != signature_len) {
  242:         return  VCARD7816_STATUS_ERROR_DATA_INVALID;
  243:     }
  244:     /* be able to handle larger keys if necessariy */
  245:     bp = &buf[0];
  246:     if (sizeof(buf) < signature_len) {
  247:         bp = g_malloc(signature_len);
  248:     }
  249: 
  250:     /*
  251:      * do the raw operations. Some tokens claim to do CKM_RSA_X_509, but then
  252:      * choke when they try to do the actual operations. Try to detect
  253:      * those cases and treat them as if the token didn't claim support for
  254:      * X_509.
  255:      */
  256:     if (key->failedX509 != VCardEmulTrue
  257:                               && PK11_DoesMechanism(slot, CKM_RSA_X_509)) {
  258:         rv = PK11_PrivDecryptRaw(priv_key, bp, &signature_len, signature_len,
  259:                                  buffer, buffer_size);
  260:         if (rv == SECSuccess) {
  261:             assert(buffer_size == signature_len);
  262:             memcpy(buffer, bp, signature_len);
  263:             key->failedX509 = VCardEmulFalse;
  264:             goto cleanup;
  265:         }
  266:         /*
  267:          * we've had a successful X509 operation, this failure must be
  268:          * somethine else
  269:          */
  270:         if (key->failedX509 == VCardEmulFalse) {
  271:             ret = vcard_emul_map_error(PORT_GetError());
  272:             goto cleanup;
  273:         }
  274:         /*
  275:          * key->failedX509 must be Unknown at this point, try the
  276:          * non-x_509 case
  277:          */
  278:     }
  279:     /* token does not support CKM_RSA_X509, emulate that with CKM_RSA_PKCS */
  280:     /* is this a PKCS #1 formatted signature? */
  281:     if ((buffer[0] == 0) && (buffer[1] == 1)) {
  282:         int i;
  283: 
  284:         for (i = 2; i < buffer_size; i++) {
  285:             /* rsa signature pad */
  286:             if (buffer[i] != 0xff) {
  287:                 break;
  288:             }
  289:         }
  290:         if ((i < buffer_size) && (buffer[i] == 0)) {
  291:             /* yes, we have a properly formated PKCS #1 signature */
  292:             /*
  293:              * NOTE: even if we accidentally got an encrypt buffer, which
  294:              * through shear luck started with 00, 01, ff, 00, it won't matter
  295:              * because the resulting Sign operation will effectively decrypt
  296:              * the real buffer.
  297:              */
  298:             SECItem signature;
  299:             SECItem hash;
  300: 
  301:             i++;
  302:             hash.data = &buffer[i];
  303:             hash.len = buffer_size - i;
  304:             signature.data = bp;
  305:             signature.len = signature_len;
  306:             rv = PK11_Sign(priv_key,  &signature, &hash);
  307:             if (rv != SECSuccess) {
  308:                 ret = vcard_emul_map_error(PORT_GetError());
  309:                 goto cleanup;
  310:             }
  311:             assert(buffer_size == signature.len);
  312:             memcpy(buffer, bp, signature.len);
  313:             /*
  314:              * we got here because either the X509 attempt failed, or the
  315:              * token couldn't do the X509 operation, in either case stay
  316:              * with the PKCS version for future operations on this key
  317:              */
  318:             key->failedX509 = VCardEmulTrue;
  319:             goto cleanup;
  320:         }
  321:     }
  322:     pad_len = buffer_size - signature_len;
  323:     assert(pad_len < 4);
  324:     /*
  325:      * OK now we've decrypted the payload, package it up in PKCS #1 for the
  326:      * upper layer.
  327:      */
  328:     buffer[0] = 0;
  329:     buffer[1] = 2; /* RSA_encrypt  */
  330:     pad_len -= 3; /* format is 0 || 2 || pad || 0 || data */
  331:     /*
  332:      * padding for PKCS #1 encrypted data is a string of random bytes. The
  333:      * random butes protect against potential decryption attacks against RSA.
  334:      * Since PrivDecrypt has already stripped those bytes, we can't reconstruct
  335:      * them. This shouldn't matter to the upper level code which should just
  336:      * strip this code out anyway, so We'll pad with a constant 3.
  337:      */
  338:     memset(&buffer[2], 0x03, pad_len);
  339:     pad_len += 2; /* index to the end of the pad */
  340:     buffer[pad_len] = 0;
  341:     pad_len++; /* index to the start of the data */
  342:     memcpy(&buffer[pad_len], bp, signature_len);
  343:     /*
  344:      * we got here because either the X509 attempt failed, or the
  345:      * token couldn't do the X509 operation, in either case stay
  346:      * with the PKCS version for future operations on this key
  347:      */
  348:     key->failedX509 = VCardEmulTrue;
  349: cleanup:
  350:     if (bp != buf) {
  351:         g_free(bp);
  352:     }
  353:     return ret;
  354: }
  355: 
  356: /*
  357:  * Login functions
  358:  */
  359: /* return the number of login attempts still possible on the card. if unknown,
  360:  * return -1 */
  361: int
  362: vcard_emul_get_login_count(VCard *card)
  363: {
  364:     return -1;
  365: }
  366: 
  367: /* login into the card, return the 7816 status word (sw2 || sw1) */
  368: vcard_7816_status_t
  369: vcard_emul_login(VCard *card, unsigned char *pin, int pin_len)
  370: {
  371:     PK11SlotInfo *slot;
  372:     unsigned char *pin_string = NULL;
  373:     int i;
  374:     SECStatus rv;
  375: 
  376:     if (!nss_emul_init) {
  377:         return VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED;
  378:     }
  379:     slot = vcard_emul_card_get_slot(card);
  380:      /* We depend on the PKCS #11 module internal login state here because we
  381:       * create a separate process to handle each guest instance. If we needed
  382:       * to handle multiple guests from one process, then we would need to keep
  383:       * a lot of extra state in our card structure
  384:       * */
  385:     pin_string = g_malloc(pin_len+1);
  386:     memcpy(pin_string, pin, pin_len);
  387:     pin_string[pin_len] = 0;
  388: 
  389:     /* handle CAC expanded pins correctly */
  390:     for (i = pin_len-1; i >= 0 && (pin_string[i] == 0xff); i--) {
  391:         pin_string[i] = 0;
  392:     }
  393: 
  394:     rv = PK11_Authenticate(slot, PR_FALSE, pin_string);
  395:     memset(pin_string, 0, pin_len);  /* don't let the pin hang around in memory
  396:                                         to be snooped */
  397:     g_free(pin_string);
  398:     if (rv == SECSuccess) {
  399:         return VCARD7816_STATUS_SUCCESS;
  400:     }
  401:     /* map the error from port get error */
  402:     return VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED;
  403: }
  404: 
  405: void
  406: vcard_emul_reset(VCard *card, VCardPower power)
  407: {
  408:     PK11SlotInfo *slot;
  409: 
  410:     if (!nss_emul_init) {
  411:         return;
  412:     }
  413: 
  414:     /*
  415:      * if we reset the card (either power on or power off), we lose our login
  416:      * state
  417:      */
  418:     /* TODO: we may also need to send insertion/removal events? */
  419:     slot = vcard_emul_card_get_slot(card);
  420:     PK11_Logout(slot); /* NOTE: ignoring SECStatus return value */
  421:     return;
  422: }
  423: 
  424: 
  425: static VReader *
  426: vcard_emul_find_vreader_from_slot(PK11SlotInfo *slot)
  427: {
  428:     VReaderList *reader_list = vreader_get_reader_list();
  429:     VReaderListEntry *current_entry = NULL;
  430: 
  431:     if (reader_list == NULL) {
  432:         return NULL;
  433:     }
  434:     for (current_entry = vreader_list_get_first(reader_list); current_entry;
  435:                         current_entry = vreader_list_get_next(current_entry)) {
  436:         VReader *reader = vreader_list_get_reader(current_entry);
  437:         VReaderEmul *reader_emul = vreader_get_private(reader);
  438:         if (reader_emul->slot == slot) {
  439:             return reader;
  440:         }
  441:         vreader_free(reader);
  442:     }
  443: 
  444:     return NULL;
  445: }
  446: 
  447: /*
  448:  * create a new reader emul
  449:  */
  450: static VReaderEmul *
  451: vreader_emul_new(PK11SlotInfo *slot, VCardEmulType type, const char *params)
  452: {
  453:     VReaderEmul *new_reader_emul;
  454: 
  455:     new_reader_emul = (VReaderEmul *)g_malloc(sizeof(VReaderEmul));
  456: 
  457:     new_reader_emul->slot = PK11_ReferenceSlot(slot);
  458:     new_reader_emul->default_type = type;
  459:     new_reader_emul->type_params = strdup(params);
  460:     new_reader_emul->present = PR_FALSE;
  461:     new_reader_emul->series = 0;
  462:     new_reader_emul->saved_vcard = NULL;
  463:     return new_reader_emul;
  464: }
  465: 
  466: static void
  467: vreader_emul_delete(VReaderEmul *vreader_emul)
  468: {
  469:     if (vreader_emul == NULL) {
  470:         return;
  471:     }
  472:     if (vreader_emul->slot) {
  473:         PK11_FreeSlot(vreader_emul->slot);
  474:     }
  475:     if (vreader_emul->type_params) {
  476:         g_free(vreader_emul->type_params);
  477:     }
  478:     g_free(vreader_emul);
  479: }
  480: 
  481: /*
  482:  *  TODO: move this to emulater non-specific file
  483:  */
  484: static VCardEmulType
  485: vcard_emul_get_type(VReader *vreader)
  486: {
  487:     VReaderEmul *vreader_emul;
  488: 
  489:     vreader_emul = vreader_get_private(vreader);
  490:     if (vreader_emul && vreader_emul->default_type != VCARD_EMUL_NONE) {
  491:         return vreader_emul->default_type;
  492:     }
  493: 
  494:     return vcard_emul_type_select(vreader);
  495: }
  496: /*
  497:  *  TODO: move this to emulater non-specific file
  498:  */
  499: static const char *
  500: vcard_emul_get_type_params(VReader *vreader)
  501: {
  502:     VReaderEmul *vreader_emul;
  503: 
  504:     vreader_emul = vreader_get_private(vreader);
  505:     if (vreader_emul && vreader_emul->type_params) {
  506:         return vreader_emul->type_params;
  507:     }
  508: 
  509:     return "";
  510: }
  511: 
  512: /* pull the slot out of the reader private data */
  513: static PK11SlotInfo *
  514: vcard_emul_reader_get_slot(VReader *vreader)
  515: {
  516:     VReaderEmul *vreader_emul = vreader_get_private(vreader);
  517:     if (vreader_emul == NULL) {
  518:         return NULL;
  519:     }
  520:     return vreader_emul->slot;
  521: }
  522: 
  523: /*
  524:  *  Card ATR's map to physical cards. VCARD_ATR_PREFIX will set appropriate
  525:  *  historical bytes for any software emulated card. The remaining bytes can be
  526:  *  used to indicate the actual emulator
  527:  */
  528: static const unsigned char nss_atr[] = { VCARD_ATR_PREFIX(3), 'N', 'S', 'S' };
  529: 
  530: void
  531: vcard_emul_get_atr(VCard *card, unsigned char *atr, int *atr_len)
  532: {
  533:     int len = MIN(sizeof(nss_atr), *atr_len);
  534:     assert(atr != NULL);
  535: 
  536:     memcpy(atr, nss_atr, len);
  537:     *atr_len = len;
  538:     return;
  539: }
  540: 
  541: /*
  542:  * create a new card from certs and keys
  543:  */
  544: static VCard *
  545: vcard_emul_make_card(VReader *reader,
  546:                      unsigned char * const *certs, int *cert_len,
  547:                      VCardKey *keys[], int cert_count)
  548: {
  549:     VCardEmul *vcard_emul;
  550:     VCard *vcard;
  551:     PK11SlotInfo *slot;
  552:     VCardEmulType type;
  553:     const char *params;
  554: 
  555:     type = vcard_emul_get_type(reader);
  556: 
  557:     /* ignore the inserted card */
  558:     if (type == VCARD_EMUL_NONE) {
  559:         return NULL;
  560:     }
  561:     slot = vcard_emul_reader_get_slot(reader);
  562:     if (slot == NULL) {
  563:         return NULL;
  564:     }
  565: 
  566:     params = vcard_emul_get_type_params(reader);
  567:     /* params these can be NULL */
  568: 
  569:     vcard_emul = vcard_emul_new_card(slot);
  570:     if (vcard_emul == NULL) {
  571:         return NULL;
  572:     }
  573:     vcard = vcard_new(vcard_emul, vcard_emul_delete_card);
  574:     if (vcard == NULL) {
  575:         vcard_emul_delete_card(vcard_emul);
  576:         return NULL;
  577:     }
  578:     vcard_init(reader, vcard, type, params, certs, cert_len, keys, cert_count);
  579:     return vcard;
  580: }
  581: 
  582: 
  583: /*
  584:  * 'clone' a physical card as a virtual card
  585:  */
  586: static VCard *
  587: vcard_emul_mirror_card(VReader *vreader)
  588: {
  589:     /*
  590:      * lookup certs using the C_FindObjects. The Stan Cert handle won't give
  591:      * us the real certs until we log in.
  592:      */
  593:     PK11GenericObject *firstObj, *thisObj;
  594:     int cert_count;
  595:     unsigned char **certs;
  596:     int *cert_len;
  597:     VCardKey **keys;
  598:     PK11SlotInfo *slot;
  599:     PRBool ret;
  600:     VCard *card;
  601: 
  602:     slot = vcard_emul_reader_get_slot(vreader);
  603:     if (slot == NULL) {
  604:         return NULL;
  605:     }
  606: 
  607:     firstObj = PK11_FindGenericObjects(slot, CKO_CERTIFICATE);
  608:     if (firstObj == NULL) {
  609:         return NULL;
  610:     }
  611: 
  612:     /* count the certs */
  613:     cert_count = 0;
  614:     for (thisObj = firstObj; thisObj;
  615:                              thisObj = PK11_GetNextGenericObject(thisObj)) {
  616:         cert_count++;
  617:     }
  618: 
  619:     if (cert_count == 0) {
  620:         PK11_DestroyGenericObjects(firstObj);
  621:         return NULL;
  622:     }
  623: 
  624:     /* allocate the arrays */
  625:     ret = vcard_emul_alloc_arrays(&certs, &cert_len, &keys, cert_count);
  626:     if (ret == PR_FALSE) {
  627:         return NULL;
  628:     }
  629: 
  630:     /* fill in the arrays */
  631:     cert_count = 0;
  632:     for (thisObj = firstObj; thisObj;
  633:                              thisObj = PK11_GetNextGenericObject(thisObj)) {
  634:         SECItem derCert;
  635:         CERTCertificate *cert;
  636:         SECStatus rv;
  637: 
  638:         rv = PK11_ReadRawAttribute(PK11_TypeGeneric, thisObj,
  639:                                    CKA_VALUE, &derCert);
  640:         if (rv != SECSuccess) {
  641:             continue;
  642:         }
  643:         /* create floating temp cert. This gives us a cert structure even if
  644:          * the token isn't logged in */
  645:         cert = CERT_NewTempCertificate(CERT_GetDefaultCertDB(), &derCert,
  646:                                        NULL, PR_FALSE, PR_TRUE);
  647:         SECITEM_FreeItem(&derCert, PR_FALSE);
  648:         if (cert == NULL) {
  649:             continue;
  650:         }
  651: 
  652:         certs[cert_count] = cert->derCert.data;
  653:         cert_len[cert_count] = cert->derCert.len;
  654:         keys[cert_count] = vcard_emul_make_key(slot, cert);
  655:         cert_count++;
  656:         CERT_DestroyCertificate(cert); /* key obj still has a reference */
  657:     }
  658: 
  659:     /* now create the card */
  660:     card = vcard_emul_make_card(vreader, certs, cert_len, keys, cert_count);
  661:     g_free(certs);
  662:     g_free(cert_len);
  663:     g_free(keys);
  664: 
  665:     return card;
  666: }
  667: 
  668: static VCardEmulType default_card_type = VCARD_EMUL_NONE;
  669: static const char *default_type_params = "";
  670: 
  671: /*
  672:  * This thread looks for card and reader insertions and puts events on the
  673:  * event queue
  674:  */
  675: static void
  676: vcard_emul_event_thread(void *arg)
  677: {
  678:     PK11SlotInfo *slot;
  679:     VReader *vreader;
  680:     VReaderEmul *vreader_emul;
  681:     VCard *vcard;
  682:     SECMODModule *module = (SECMODModule *)arg;
  683: 
  684:     do {
  685:         slot = SECMOD_WaitForAnyTokenEvent(module, 0, 500);
  686:         if (slot == NULL) {
  687:             break;
  688:         }
  689:         vreader = vcard_emul_find_vreader_from_slot(slot);
  690:         if (vreader == NULL) {
  691:             /* new vreader */
  692:             vreader_emul = vreader_emul_new(slot, default_card_type,
  693:                                             default_type_params);
  694:             vreader = vreader_new(PK11_GetSlotName(slot), vreader_emul,
  695:                                   vreader_emul_delete);
  696:             PK11_FreeSlot(slot);
  697:             slot = NULL;
  698:             vreader_add_reader(vreader);
  699:             vreader_free(vreader);
  700:             continue;
  701:         }
  702:         /* card remove/insert */
  703:         vreader_emul = vreader_get_private(vreader);
  704:         if (PK11_IsPresent(slot)) {
  705:             int series = PK11_GetSlotSeries(slot);
  706:             if (series != vreader_emul->series) {
  707:                 if (vreader_emul->present) {
  708:                     vreader_insert_card(vreader, NULL);
  709:                 }
  710:                 vcard = vcard_emul_mirror_card(vreader);
  711:                 vreader_insert_card(vreader, vcard);
  712:                 vcard_free(vcard);
  713:             }
  714:             vreader_emul->series = series;
  715:             vreader_emul->present = 1;
  716:             vreader_free(vreader);
  717:             PK11_FreeSlot(slot);
  718:             continue;
  719:         }
  720:         if (vreader_emul->present) {
  721:             vreader_insert_card(vreader, NULL);
  722:         }
  723:         vreader_emul->series = 0;
  724:         vreader_emul->present = 0;
  725:         PK11_FreeSlot(slot);
  726:         vreader_free(vreader);
  727:     } while (1);
  728: }
  729: 
  730: /* if the card is inserted when we start up, make sure our state is correct */
  731: static void
  732: vcard_emul_init_series(VReader *vreader, VCard *vcard)
  733: {
  734:     VReaderEmul *vreader_emul = vreader_get_private(vreader);
  735:     PK11SlotInfo *slot = vreader_emul->slot;
  736: 
  737:     vreader_emul->present = PK11_IsPresent(slot);
  738:     vreader_emul->series = PK11_GetSlotSeries(slot);
  739:     if (vreader_emul->present == 0) {
  740:         vreader_insert_card(vreader, NULL);
  741:     }
  742: }
  743: 
  744: /*
  745:  * each module has a separate wait call, create a thread for each module that
  746:  * we are using.
  747:  */
  748: static void
  749: vcard_emul_new_event_thread(SECMODModule *module)
  750: {
  751:     PR_CreateThread(PR_SYSTEM_THREAD, vcard_emul_event_thread,
  752:                      module, PR_PRIORITY_HIGH, PR_GLOBAL_THREAD,
  753:                      PR_UNJOINABLE_THREAD, 0);
  754: }
  755: 
  756: static const VCardEmulOptions default_options = {
  757:     .nss_db = NULL,
  758:     .vreader = NULL,
  759:     .vreader_count = 0,
  760:     .hw_card_type = VCARD_EMUL_CAC,
  761:     .hw_type_params = "",
  762:     .use_hw = PR_TRUE
  763: };
  764: 
  765: 
  766: /*
  767:  *  NSS needs the app to supply a password prompt. In our case the only time
  768:  *  the password is supplied is as part of the Login APDU. The actual password
  769:  *  is passed in the pw_arg in that case. In all other cases pw_arg should be
  770:  *  NULL.
  771:  */
  772: static char *
  773: vcard_emul_get_password(PK11SlotInfo *slot, PRBool retries, void *pw_arg)
  774: {
  775:     /* if it didn't work the first time, don't keep trying */
  776:     if (retries) {
  777:         return NULL;
  778:     }
  779:     /* we are looking up a password when we don't have one in hand */
  780:     if (pw_arg == NULL) {
  781:         return NULL;
  782:     }
  783:     /* TODO: we really should verify that were are using the right slot */
  784:     return PORT_Strdup(pw_arg);
  785: }
  786: 
  787: /* Force a card removal even if the card is not physically removed */
  788: VCardEmulError
  789: vcard_emul_force_card_remove(VReader *vreader)
  790: {
  791:     if (!nss_emul_init || (vreader_card_is_present(vreader) != VREADER_OK)) {
  792:         return VCARD_EMUL_FAIL; /* card is already removed */
  793:     }
  794: 
  795:     /* OK, remove it */
  796:     vreader_insert_card(vreader, NULL);
  797:     return VCARD_EMUL_OK;
  798: }
  799: 
  800: /* Re-insert of a card that has been removed by force removal */
  801: VCardEmulError
  802: vcard_emul_force_card_insert(VReader *vreader)
  803: {
  804:     VReaderEmul *vreader_emul;
  805:     VCard *vcard;
  806: 
  807:     if (!nss_emul_init || (vreader_card_is_present(vreader) == VREADER_OK)) {
  808:         return VCARD_EMUL_FAIL; /* card is already removed */
  809:     }
  810:     vreader_emul = vreader_get_private(vreader);
  811: 
  812:     /* if it's a softcard, get the saved vcard from the reader emul structure */
  813:     if (vreader_emul->saved_vcard) {
  814:         vcard = vcard_reference(vreader_emul->saved_vcard);
  815:     } else {
  816:         /* it must be a physical card, rebuild it */
  817:         if (!PK11_IsPresent(vreader_emul->slot)) {
  818:             /* physical card has been removed, not way to reinsert it */
  819:             return VCARD_EMUL_FAIL;
  820:         }
  821:         vcard = vcard_emul_mirror_card(vreader);
  822:     }
  823:     vreader_insert_card(vreader, vcard);
  824:     vcard_free(vcard);
  825: 
  826:     return VCARD_EMUL_OK;
  827: }
  828: 
  829: 
  830: static PRBool
  831: module_has_removable_hw_slots(SECMODModule *mod)
  832: {
  833:     int i;
  834:     PRBool ret = PR_FALSE;
  835:     SECMODListLock *moduleLock = SECMOD_GetDefaultModuleListLock();
  836: 
  837:     if (!moduleLock) {
  838:         PORT_SetError(SEC_ERROR_NOT_INITIALIZED);
  839:         return ret;
  840:     }
  841:     SECMOD_GetReadLock(moduleLock);
  842:     for (i = 0; i < mod->slotCount; i++) {
  843:         PK11SlotInfo *slot = mod->slots[i];
  844:         if (PK11_IsRemovable(slot) && PK11_IsHW(slot)) {
  845:             ret = PR_TRUE;
  846:             break;
  847:         }
  848:     }
  849:     SECMOD_ReleaseReadLock(moduleLock);
  850:     return ret;
  851: }
  852: 
  853: /* Previously we returned FAIL if no readers found. This makes
  854:  * no sense when using hardware, since there may be no readers connected
  855:  * at the time vcard_emul_init is called, but they will be properly
  856:  * recognized later. So Instead return FAIL only if no_hw==1 and no
  857:  * vcards can be created (indicates error with certificates provided
  858:  * or db), or if any other higher level error (NSS error, missing coolkey). */
  859: static int vcard_emul_init_called;
  860: 
  861: VCardEmulError
  862: vcard_emul_init(const VCardEmulOptions *options)
  863: {
  864:     SECStatus rv;
  865:     PRBool ret, has_readers = PR_FALSE, need_coolkey_module;
  866:     VReader *vreader;
  867:     VReaderEmul *vreader_emul;
  868:     SECMODListLock *module_lock;
  869:     SECMODModuleList *module_list;
  870:     SECMODModuleList *mlp;
  871:     int i;
  872: 
  873:     if (vcard_emul_init_called) {
  874:         return VCARD_EMUL_INIT_ALREADY_INITED;
  875:     }
  876:     vcard_emul_init_called = 1;
  877:     vreader_init();
  878:     vevent_queue_init();
  879: 
  880:     if (options == NULL) {
  881:         options = &default_options;
  882:     }
  883: 
  884:     /* first initialize NSS */
  885:     if (options->nss_db) {
  886:         rv = NSS_Init(options->nss_db);
  887:     } else {
  888:         rv = NSS_Init("sql:/etc/pki/nssdb");
  889:     }
  890:     if (rv != SECSuccess) {
  891:         return VCARD_EMUL_FAIL;
  892:     }
  893:     /* Set password callback function */
  894:     PK11_SetPasswordFunc(vcard_emul_get_password);
  895: 
  896:     /* set up soft cards emulated by software certs rather than physical cards
  897:      * */
  898:     for (i = 0; i < options->vreader_count; i++) {
  899:         int j;
  900:         int cert_count;
  901:         unsigned char **certs;
  902:         int *cert_len;
  903:         VCardKey **keys;
  904:         PK11SlotInfo *slot;
  905: 
  906:         slot = PK11_FindSlotByName(options->vreader[i].name);
  907:         if (slot == NULL) {
  908:             continue;
  909:         }
  910:         vreader_emul = vreader_emul_new(slot, options->vreader[i].card_type,
  911:                                         options->vreader[i].type_params);
  912:         vreader = vreader_new(options->vreader[i].vname, vreader_emul,
  913:                               vreader_emul_delete);
  914:         vreader_add_reader(vreader);
  915:         cert_count = options->vreader[i].cert_count;
  916: 
  917:         ret = vcard_emul_alloc_arrays(&certs, &cert_len, &keys,
  918:                                       options->vreader[i].cert_count);
  919:         if (ret == PR_FALSE) {
  920:             continue;
  921:         }
  922:         cert_count = 0;
  923:         for (j = 0; j < options->vreader[i].cert_count; j++) {
  924:             /* we should have a better way of identifying certs than by
  925:              * nickname here */
  926:             CERTCertificate *cert = PK11_FindCertFromNickname(
  927:                                         options->vreader[i].cert_name[j],
  928:                                         NULL);
  929:             if (cert == NULL) {
  930:                 continue;
  931:             }
  932:             certs[cert_count] = cert->derCert.data;
  933:             cert_len[cert_count] = cert->derCert.len;
  934:             keys[cert_count] = vcard_emul_make_key(slot, cert);
  935:             /* this is safe because the key is still holding a cert reference */
  936:             CERT_DestroyCertificate(cert);
  937:             cert_count++;
  938:         }
  939:         if (cert_count) {
  940:             VCard *vcard = vcard_emul_make_card(vreader, certs, cert_len,
  941:                                                 keys, cert_count);
  942:             vreader_insert_card(vreader, vcard);
  943:             vcard_emul_init_series(vreader, vcard);
  944:             /* allow insertion and removal of soft cards */
  945:             vreader_emul->saved_vcard = vcard_reference(vcard);
  946:             vcard_free(vcard);
  947:             vreader_free(vreader);
  948:             has_readers = PR_TRUE;
  949:         }
  950:         g_free(certs);
  951:         g_free(cert_len);
  952:         g_free(keys);
  953:     }
  954: 
  955:     /* if we aren't suppose to use hw, skip looking up hardware tokens */
  956:     if (!options->use_hw) {
  957:         nss_emul_init = has_readers;
  958:         return has_readers ? VCARD_EMUL_OK : VCARD_EMUL_FAIL;
  959:     }
  960: 
  961:     /* make sure we have some PKCS #11 module loaded */
  962:     module_lock = SECMOD_GetDefaultModuleListLock();
  963:     module_list = SECMOD_GetDefaultModuleList();
  964:     need_coolkey_module = !has_readers;
  965:     SECMOD_GetReadLock(module_lock);
  966:     for (mlp = module_list; mlp; mlp = mlp->next) {
  967:         SECMODModule *module = mlp->module;
  968:         if (module_has_removable_hw_slots(module)) {
  969:             need_coolkey_module = PR_FALSE;
  970:             break;
  971:         }
  972:     }
  973:     SECMOD_ReleaseReadLock(module_lock);
  974: 
  975:     if (need_coolkey_module) {
  976:         SECMODModule *module;
  977:         module = SECMOD_LoadUserModule(
  978:                     (char *)"library=libcoolkeypk11.so name=Coolkey",
  979:                     NULL, PR_FALSE);
  980:         if (module == NULL) {
  981:             return VCARD_EMUL_FAIL;
  982:         }
  983:         SECMOD_DestroyModule(module); /* free our reference, Module will still
  984:                                        * be on the list.
  985:                                        * until we destroy it */
  986:     }
  987: 
  988:     /* now examine all the slots, finding which should be readers */
  989:     /* We should control this with options. For now we mirror out any
  990:      * removable hardware slot */
  991:     default_card_type = options->hw_card_type;
  992:     default_type_params = strdup(options->hw_type_params);
  993: 
  994:     SECMOD_GetReadLock(module_lock);
  995:     for (mlp = module_list; mlp; mlp = mlp->next) {
  996:         SECMODModule *module = mlp->module;
  997:         PRBool has_emul_slots = PR_FALSE;
  998: 
  999:         if (module == NULL) {
 1000:                 continue;
 1001:         }
 1002: 
 1003:         for (i = 0; i < module->slotCount; i++) {
 1004:             PK11SlotInfo *slot = module->slots[i];
 1005: 
 1006:             /* only map removable HW slots */
 1007:             if (slot == NULL || !PK11_IsRemovable(slot) || !PK11_IsHW(slot)) {
 1008:                 continue;
 1009:             }
 1010:             vreader_emul = vreader_emul_new(slot, options->hw_card_type,
 1011:                                             options->hw_type_params);
 1012:             vreader = vreader_new(PK11_GetSlotName(slot), vreader_emul,
 1013:                                   vreader_emul_delete);
 1014:             vreader_add_reader(vreader);
 1015: 
 1016:             has_readers = PR_TRUE;
 1017:             has_emul_slots = PR_TRUE;
 1018: 
 1019:             if (PK11_IsPresent(slot)) {
 1020:                 VCard *vcard;
 1021:                 vcard = vcard_emul_mirror_card(vreader);
 1022:                 vreader_insert_card(vreader, vcard);
 1023:                 vcard_emul_init_series(vreader, vcard);
 1024:                 vcard_free(vcard);
 1025:             }
 1026:         }
 1027:         if (has_emul_slots) {
 1028:             vcard_emul_new_event_thread(module);
 1029:         }
 1030:     }
 1031:     SECMOD_ReleaseReadLock(module_lock);
 1032:     nss_emul_init = has_readers;
 1033: 
 1034:     return VCARD_EMUL_OK;
 1035: }
 1036: 
 1037: /* Recreate card insert events for all readers (user should
 1038:  * deduce implied reader insert. perhaps do a reader insert as well?)
 1039:  */
 1040: void
 1041: vcard_emul_replay_insertion_events(void)
 1042: {
 1043:     VReaderListEntry *current_entry;
 1044:     VReaderListEntry *next_entry = NULL;
 1045:     VReaderList *list = vreader_get_reader_list();
 1046: 
 1047:     for (current_entry = vreader_list_get_first(list); current_entry;
 1048:             current_entry = next_entry) {
 1049:         VReader *vreader = vreader_list_get_reader(current_entry);
 1050:         next_entry = vreader_list_get_next(current_entry);
 1051:         vreader_queue_card_event(vreader);
 1052:     }
 1053: }
 1054: 
 1055: /*
 1056:  *  Silly little functions to help parsing our argument string
 1057:  */
 1058: static int
 1059: count_tokens(const char *str, char token, char token_end)
 1060: {
 1061:     int count = 0;
 1062: 
 1063:     for (; *str; str++) {
 1064:         if (*str == token) {
 1065:             count++;
 1066:         }
 1067:         if (*str == token_end) {
 1068:             break;
 1069:         }
 1070:     }
 1071:     return count;
 1072: }
 1073: 
 1074: static const char *
 1075: strip(const char *str)
 1076: {
 1077:     for (; *str && isspace(*str); str++) {
 1078:     }
 1079:     return str;
 1080: }
 1081: 
 1082: static const char *
 1083: find_blank(const char *str)
 1084: {
 1085:     for (; *str && !isspace(*str); str++) {
 1086:     }
 1087:     return str;
 1088: }
 1089: 
 1090: 
 1091: /*
 1092:  *  We really want to use some existing argument parsing library here. That
 1093:  *  would give us a consistent look */
 1094: static VCardEmulOptions options;
 1095: #define READER_STEP 4
 1096: 
 1097: /* Expects "args" to be at the beginning of a token (ie right after the ','
 1098:  * ending the previous token), and puts the next token start in "token",
 1099:  * and its length in "token_length". "token" will not be nul-terminated.
 1100:  * After calling the macro, "args" will be advanced to the beginning of
 1101:  * the next token.
 1102:  * This macro may call continue or break.
 1103:  */
 1104: #define NEXT_TOKEN(token) \
 1105:             (token) = args; \
 1106:             args = strpbrk(args, ",)"); \
 1107:             if (*args == 0) { \
 1108:                 break; \
 1109:             } \
 1110:             if (*args == ')') { \
 1111:                 args++; \
 1112:                 continue; \
 1113:             } \
 1114:             (token##_length) = args - (token); \
 1115:             args = strip(args+1);
 1116: 
 1117: VCardEmulOptions *
 1118: vcard_emul_options(const char *args)
 1119: {
 1120:     int reader_count = 0;
 1121:     VCardEmulOptions *opts;
 1122: 
 1123:     /* Allow the future use of allocating the options structure on the fly */
 1124:     memcpy(&options, &default_options, sizeof(options));
 1125:     opts = &options;
 1126: 
 1127:     do {
 1128:         args = strip(args); /* strip off the leading spaces */
 1129:         if (*args == ',') {
 1130:             continue;
 1131:         }
 1132:         /* soft=(slot_name,virt_name,emul_type,emul_flags,cert_1, (no eol)
 1133:          *       cert_2,cert_3...) */
 1134:         if (strncmp(args, "soft=", 5) == 0) {
 1135:             const char *name;
 1136:             size_t name_length;
 1137:             const char *vname;
 1138:             size_t vname_length;
 1139:             const char *type_params;
 1140:             size_t type_params_length;
 1141:             char type_str[100];
 1142:             VCardEmulType type;
 1143:             int count, i;
 1144:             VirtualReaderOptions *vreaderOpt = NULL;
 1145: 
 1146:             args = strip(args + 5);
 1147:             if (*args != '(') {
 1148:                 continue;
 1149:             }
 1150:             args = strip(args+1);
 1151: 
 1152:             NEXT_TOKEN(name)
 1153:             NEXT_TOKEN(vname)
 1154:             NEXT_TOKEN(type_params)
 1155:             type_params_length = MIN(type_params_length, sizeof(type_str)-1);
 1156:             strncpy(type_str, type_params, type_params_length);
 1157:             type_str[type_params_length] = 0;
 1158:             type = vcard_emul_type_from_string(type_str);
 1159: 
 1160:             NEXT_TOKEN(type_params)
 1161: 
 1162:             if (*args == 0) {
 1163:                 break;
 1164:             }
 1165: 
 1166:             if (opts->vreader_count >= reader_count) {
 1167:                 reader_count += READER_STEP;
 1168:                 vreaderOpt = realloc(opts->vreader,
 1169:                                 reader_count * sizeof(*vreaderOpt));
 1170:                 if (vreaderOpt == NULL) {
 1171:                     return opts; /* we're done */
 1172:                 }
 1173:             }
 1174:             opts->vreader = vreaderOpt;
 1175:             vreaderOpt = &vreaderOpt[opts->vreader_count];
 1176:             vreaderOpt->name = g_strndup(name, name_length);
 1177:             vreaderOpt->vname = g_strndup(vname, vname_length);
 1178:             vreaderOpt->card_type = type;
 1179:             vreaderOpt->type_params =
 1180:                 g_strndup(type_params, type_params_length);
 1181:             count = count_tokens(args, ',', ')') + 1;
 1182:             vreaderOpt->cert_count = count;
 1183:             vreaderOpt->cert_name = (char **)g_malloc(count*sizeof(char *));
 1184:             for (i = 0; i < count; i++) {
 1185:                 const char *cert = args;
 1186:                 args = strpbrk(args, ",)");
 1187:                 vreaderOpt->cert_name[i] = g_strndup(cert, args - cert);
 1188:                 args = strip(args+1);
 1189:             }
 1190:             if (*args == ')') {
 1191:                 args++;
 1192:             }
 1193:             opts->vreader_count++;
 1194:         /* use_hw= */
 1195:         } else if (strncmp(args, "use_hw=", 7) == 0) {
 1196:             args = strip(args+7);
 1197:             if (*args == '0' || *args == 'N' || *args == 'n' || *args == 'F') {
 1198:                 opts->use_hw = PR_FALSE;
 1199:             } else {
 1200:                 opts->use_hw = PR_TRUE;
 1201:             }
 1202:             args = find_blank(args);
 1203:         /* hw_type= */
 1204:         } else if (strncmp(args, "hw_type=", 8) == 0) {
 1205:             args = strip(args+8);
 1206:             opts->hw_card_type = vcard_emul_type_from_string(args);
 1207:             args = find_blank(args);
 1208:         /* hw_params= */
 1209:         } else if (strncmp(args, "hw_params=", 10) == 0) {
 1210:             const char *params;
 1211:             args = strip(args+10);
 1212:             params = args;
 1213:             args = find_blank(args);
 1214:             opts->hw_type_params = g_strndup(params, args-params);
 1215:         /* db="/data/base/path" */
 1216:         } else if (strncmp(args, "db=", 3) == 0) {
 1217:             const char *db;
 1218:             args = strip(args+3);
 1219:             if (*args != '"') {
 1220:                 continue;
 1221:             }
 1222:             args++;
 1223:             db = args;
 1224:             args = strpbrk(args, "\"\n");
 1225:             opts->nss_db = g_strndup(db, args-db);
 1226:             if (*args != 0) {
 1227:                 args++;
 1228:             }
 1229:         } else {
 1230:             args = find_blank(args);
 1231:         }
 1232:     } while (*args != 0);
 1233: 
 1234:     return opts;
 1235: }
 1236: 
 1237: void
 1238: vcard_emul_usage(void)
 1239: {
 1240:    fprintf(stderr,
 1241: "emul args: comma separated list of the following arguments\n"
 1242: " db={nss_database}               (default sql:/etc/pki/nssdb)\n"
 1243: " use_hw=[yes|no]                 (default yes)\n"
 1244: " hw_type={card_type_to_emulate}  (default CAC)\n"
 1245: " hw_param={param_for_card}       (default \"\")\n"
 1246: " soft=({slot_name},{vreader_name},{card_type_to_emulate},{params_for_card},\n"
 1247: "       {cert1},{cert2},{cert3}    (default none)\n"
 1248: "\n"
 1249: "  {nss_database}          The location of the NSS cert & key database\n"
 1250: "  {card_type_to_emulate}  What card interface to present to the guest\n"
 1251: "  {param_for_card}        Card interface specific parameters\n"
 1252: "  {slot_name}             NSS slot that contains the certs\n"
 1253: "  {vreader_name}          Virutal reader name to present to the guest\n"
 1254: "  {certN}                 Nickname of the certificate n on the virtual card\n"
 1255: "\n"
 1256: "These parameters come as a single string separated by blanks or newlines."
 1257: "\n"
 1258: "Unless use_hw is set to no, all tokens that look like removable hardware\n"
 1259: "tokens will be presented to the guest using the emulator specified by\n"
 1260: "hw_type, and parameters of hw_param.\n"
 1261: "\n"
 1262: "If more one or more soft= parameters are specified, these readers will be\n"
 1263: "presented to the guest\n");
 1264: }

unix.superglobalmegacorp.com