aboutsummaryrefslogtreecommitdiffstats
path: root/scd (follow)
Commit message (Collapse)AuthorAgeFilesLines
* scd:openpgp: Send a KEY-TIME status with READKEYWerner Koch2020-02-112-1/+39
| | | | | | | | | | | * scd/app-openpgp.c (retrieve_fprtime_from_card): New. (do_readkey): Send a KEY_TIME status. -- It might be easier to fold this into KEYPAIRINFO but for backward compatibility using a separate status line is safer. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Optional allow for lowercase keyrefs.Werner Koch2020-02-111-10/+10
| | | | | | | | | * scd/app-openpgp.c (do_readkey): Use case insensitive match of the keyref. (do_writekey, do_sign, do_auth, do_decipher): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Allow auto-changing of the key attributes in genkey.Werner Koch2020-02-112-47/+181
| | | | | | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): Add field keyalgo. (parse_algorithm_attribute): Store the new keyalgo field. (change_keyattr): Change info message. (change_keyattr_from_string): Rewrite to also accept a keyref and a keyalgo string. (do_genkey): Change the keyattr if a keyalgo string is given. -- Having this feature makes it easier to use OpenPGP cards in a similar way to other cards. Note that the explicit changing via SETATTR is still supported. Signed-off-by: Werner Koch <[email protected]>
* common: Extend the openpgp_curve_to_oid function.Werner Koch2020-02-112-6/+7
| | | | | | | | | * common/openpgp-oid.c (openpgp_curve_to_oid): Add optional arg R_NBITS. Change all callers. -- In particular for ed25519 and cv25519 it is quite useful to have an ability to get the required algorithm.
* build: Always use EXTERN_UNLESS_MAIN_MODULE pattern.Werner Koch2020-02-102-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | * common/util.h (EXTERN_UNLESS_MAIN_MODULE): Add the definion only here but now without the Norcroft-C. Change all other places where it gets defined. * common/iobuf.h (iobuf_debug_mode): Declare unconditionally as extern. * common/iobuf.c (iobuf_debug_mode): Define it here. * agent/gpg-agent.c (INCLUDED_BY_MAIN_MODULE): Define here and also in all main modules of all other programs. * g10/main.h: Put util.h before the local header files. -- This change is required for use with gcc/ld's LTO feature which does not allow common blocks. Further gcc 10 will make -fno-common the default and thus this chnage is always needed. What a pitty. Co-authored-by: Tomáš Mráz GnuPG-bug-id: 4831 Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 21d9bd8b87a9f793a106095e3838eb71825189d7) - Applied respective chnages also to gpg-card and keyboxd. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Let the genkey function also accept a full keyref.Werner Koch2020-02-091-3/+12
| | | | | | | | | | | * scd/app-openpgp.c (send_key_attr): Use log_assert. (do_genkey): Allow prefix. -- It is more uniform to always use full keyref (e.g. "OPENPGP.1") instead of just the key number. Signed-off-by: Werner Koch <[email protected]>
* scd: New commands SWITCHCARD and SWITCHAPP.Werner Koch2020-01-163-13/+262
| | | | | | | | | | | | | | | | | | | | * scd/app.c: Include membuf.h. (app_switch_current_card): New. (send_card_and_app_list): Factor code out to ... (send_serialno_and_app_status): new. (app_send_card_list): New. (app_send_active_apps): New. (app_switch_active_app): New. * scd/command.c (cmd_switchcard): New. (cmd_switchapp): New. (register_commands): Register new commands. (cmd_getinfo): New sub-commands "active_apps" and "all_active_apps". -- These new commands allow to switch between known cards and are in particular useful for the gpg-card tool. Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Remove debug code from a recent commit.Werner Koch2020-01-161-2/+1
| | | | | | | | | | * scd/app-piv.c (ask_and_prepare_chv): here. -- The test code from the last PIV change was accidently kept enabled. Fixes-commit: 2dd6b4b998dd6e156e2e75ede0f40fb768c69f40 Signed-off-by: Werner Koch <[email protected]>
* scd: Make the PIN cache robust against wrongdoing of gpg-agent.Werner Koch2020-01-132-4/+81
| | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): New field pincache. (cache_pin): Set it. (pin_from_cache): Consult it. * scd/app-piv.c (struct app_local_s): New field pincache. (cache_pin): Set it. (pin_from_cache): Consult it. -- Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Implement PIN cache.Werner Koch2020-01-135-29/+100
| | | | | | | | | | | | | | | | | | | | | | * scd/command.c (pincache_put): Add arg pinlen and change all callers to provide it. * scd/app-piv.c (cache_pin): New. (pin_from_cache): New. (ask_and_prepare_chv): Add args no_cache and r_unpaddedpinlen. Take PIN from the cache. Return the unpadded length. (verify_chv): Add arg ctrl. Cache the PIN. (do_change_chv): Clear PIN cache. -- The PIV pins are padded but we want to store the unpadded PIN. Thus the changes to the function. Code has has been tested by commenting the no_cache parameter because we the current test certificate was created for PIV.9C which requires a verification for each use. More testing is required. GnuPG-bug-id: 4791 Signed-off-by: Werner Koch <[email protected]>
* scd: Fix memory leak in command READKEY.Werner Koch2020-01-132-3/+9
| | | | | | | * scd/command.c (cmd_readcert): Replace xstrdup by xtrystrdup. (cmd_readkey): Ditto. Fix memory leak. Signed-off-by: Werner Koch <[email protected]>
* scd: Make SERIALNO --all work correctly and use it.Werner Koch2020-01-133-54/+91
| | | | | | | | | | | | | | * scd/app.c (maybe_switch_app): Factor reselect code out to ... (run_reselect): new. (app_write_learn_status): Tweak diagnostics. (app_do_with_keygrip): Run reselect if a card has more than one switchable application. * agent/call-scd.c (agent_card_serialno): Ditto. * tools/card-call-scd.c (start_agent): Use option --all with SERIALNO. (scd_serialno): Ditto. Signed-off-by: Werner Koch <[email protected]>
* scd: Implement direct access by KEYGRIP for GETATTR and READKEY.NIIBE Yutaka2020-01-102-50/+119
| | | | | | | | | * scd/app-openpgp.c (do_readkey): Handle KEYGRIP access. * scd/command.c (do_readkey): New. (cmd_readkey): Use do_readkey supporting KEYGRIP access. (cmd_getattr): Supporting KEYGRIP access. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:openpgp: Implement PIN cache.Werner Koch2020-01-091-104/+229
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (wipe_and_free, wipe_and_free_string): Use them everywere where we do a wipememory followed by a free. (pin2hash_if_kdf): Change interface. The input PIN is not anymore changed. Further there are no more assumptions about the length of the provided buffer. (cache_pin): Restructure. (chvno_to_keyref): New. (pin_from_cache): New. (verify_a_chv): Add arg CTRL. Adjust for changed pin2hash_if_kdf. Chache and retrieve the PIN here. (verify_chv2): Do not cache the PIN here. (build_enter_admin_pin_prompt): Add arg 'r_remaining'. (verify_chv3): Adjust for changed pin2hash_if_kdf. Implement the PIN cache. (do_change_pin): Clear the PIN cache. Do not change the PIN here. Lots of adjustments to cope with the chnaged pin2hash_if_kdf. (do_sign): Do not cache the PIN here. -- Note that some of the changes are required because we can't rely that the PIN is always cached in secure memory. Thus it is better to do an explicit wipe. Testing the PIN cache can currently only be done my modifying the code to do a verification for each operation. Only some basic testing has been done. Clearing the PIN cache is also not fully implemented. With the forthcoming changes to app-piv we should be enter able to test the PIN cache. Missing stuff: - The agent should be able to selectively clear the cache on a per slot base. - We should replace AESWRAP by OCB. Signed-off-by: Werner Koch <[email protected]>
* scd: Use a scdaemon internal key to protect the PIN cache IPC.Werner Koch2020-01-091-46/+98
| | | | | | | | | | | | | | | | | | | * agent/call-scd.c (handle_pincache_put): Do not decrypt. (handle_pincache_get): New. (inq_needpin): Call it. * scd/command.c (set_key_for_pincache): New. (pincache_put): Restructure and set key. (pincache_get): Ditto. -- This change does away with encrypting and decrypting the cached PIN in the agent. There is no need for this we can simply cache the cryptogram and let scdaemon decrypt after retrieving it from the agent. This way we do not need to share a key between gpg-agent and scdaemon and further the cached content is invalid after the scdaemon process has been replaced. Signed-off-by: Werner Koch <[email protected]>
* scd: First changes to implement a PIN cache.Werner Koch2020-01-0711-85/+418
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/command.c (pincache_put): New. Uses a dummy key for now. (pincache_get): New. * scd/app.c (select_application): Flush the PIN cache. (scd_update_reader_status_file): Ditto. (maybe_switch_app): Call the new prep_reselect function. (app_write_learn_status): Ditto. * scd/app-openpgp.c (cache_pin): New helper to cache a PIN. (verify_chv2): Call it. (verify_chv3): Call it. (clear_chv_status): Call it. (do_change_pin): Call it. * scd/app-common.h (struct app_ctx_s): Add function 'prep_select'. * scd/app-openpgp.c (do_prep_reselect): New stub function. (app_select_openpgp): Set new stub function. * scd/app-piv.c (do_prep_reselect): New stub function. (app_select_piv): Set new stub function. * scd/app-common.h (struct app_ctx_s): Add parameter ctrl to setattr, sign, auth, decipher, and check_pin. Change all implementations and callers to pass such a parameter. -- This is work in progress. Signed-off-by: Werner Koch <[email protected]>
* scd: Minor fix for readibility.Werner Koch2020-01-032-2/+2
| | | | | | | | | | | | * scd/command.c (open_card_with_request): Use NULL instead of APPTYPE_NULL. -- Using the enum is wrong because a string is expected. However it did harm anything because the value of the enum is 0 and thus equivalent to NULL. Signed-off-by: Werner Koch <[email protected]>
* scd: Enhance KEYINFO command to limit listing with capability.NIIBE Yutaka2019-12-195-35/+79
| | | | | | | | | | | | | | | | | | * scd/app-common.h: Add CAPABILITY argument to the WITH_KEYGRIP. (app_do_with_keygrip): Likewise. * scd/app-openpgp.c (send_keyinfo_if_available): New. (do_with_keygrip): Support listing with CAPABILITY. * scd/app-piv.c (do_with_keygrip): Likewise. * scd/app.c (maybe_switch_app): Supply the argument. (app_do_with_keygrip): Add CAPABILITY argument. * scd/command.c (cmd_pksign, cmd_pkauth): Supply the argument. (cmd_pkdecrypt): Likewise. (cmd_keyinfo): Support listing with CAPABILITY. -- GnuPG-bug-id: 4784 Signed-off-by: NIIBE Yutaka <[email protected]>
* doc: Fixed variable naming.Werner Koch2019-11-261-1/+1
| | | | | | | | * kbx/keybox.h: Fix naming of arguments. * scd/ccid-driver.c (print_error) [TEST]: Add missing break. Note that this is anyway an impossible case. Signed-off-by: Werner Koch <[email protected]>
* scd,ccid: Fix detection of supported readers with pinpad.NIIBE Yutaka2019-11-151-3/+4
| | | | | | | * scd/ccid-driver.c (ccid_transceive_secure): When not supported, return CCID_DRIVER_ERR_NOT_SUPPORTED. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd,ccid: Fix GEMPC_EZIO handling.NIIBE Yutaka2019-10-281-5/+5
| | | | | | | | * scd/ccid-driver.c (ccid_transceive_secure): Fix for 08e6:34c2. Fixes-commit: c933c15d587a1c0df3f4b3bf37d8d15164dd318f GnuPG-bug-id: 4654 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd,ccid: Add 08e6:34c2 (GEMPC_EZIO).NIIBE Yutaka2019-10-152-7/+22
| | | | | | | * scd/ccid-driver.c (ccid_transceive_secure): Add pinpad support for 08e6:34c2 which supports extended APDU exchange. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd,pcsc: Use HANDLE for context and card.NIIBE Yutaka2019-09-171-28/+34
| | | | | | * scd/apdu.c (HANDLE): New. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Remove old fallback logic from CCID to PC/SC.gniibe/T4620NIIBE Yutaka2019-09-121-12/+5
| | | | | | * scd/apdu.c (apdu_dev_list_start): Return an error on failure. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd,pcsc: Support "reader-port" option for PC/SC reader.NIIBE Yutaka2019-09-121-29/+34
| | | | | | | * scd/apdu.c (apdu_open_reader): Skip use of a reader if it's not the one specified when it is specified. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd,pcsc: Remove the restriction of no-scanning in PC/SC.NIIBE Yutaka2019-09-113-12/+3
| | | | | | | | * scd/apdu.h (app_open_reader): Remove the last argument. * scd/apdu.c (app_open_reader): Ditto. * scd/app.c (select_application): Don't supply APP_EMPTY. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd,pcsc: Fix examining the list of readers.NIIBE Yutaka2019-09-111-5/+13
| | | | | | * scd/apdu.c (apdu_dev_list_start): Traverse the string+NUL carefully. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd,pcsc: Fix for initializing PC/SC.NIIBE Yutaka2019-09-111-9/+13
| | | | | | | * scd/apdu.c (pcsc_init): Load it at first. (apdu_open_reader): Check for the CCID internal driver. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd,pcsc: Support multiple card readers.NIIBE Yutaka2019-09-111-180/+217
| | | | | | | | | | | * scd/apdu.c (close_pcsc_reader, apdu_init): Clear pcsc.rdrname. (pcsc_init): Load of PC/SC module moved from ... (open_pcsc_reader): ... here. (apdu_dev_list_start): Add support for PC/SC. (apdu_dev_list_finish): Likewise. (apdu_open_reader): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd,pcsc: Use a single context.NIIBE Yutaka2019-09-111-26/+46
| | | | | | | | | | | | | | * scd/apdu.c (pcsc): New variable. (struct reader_table_s): Remove pcsc.context from member. (pcsc_get_status, connect_pcsc_card): Use pcsc.context. (close_pcsc_reader): Release pcsc.context here with reference count. (pcsc_init): New. (open_pcsc_reader): Don't call pcsc_establish_context here. Call close_pcsc_reader instead of pcsc_release_context. (apdu_open_reader): Call pcsc_init if needed. (apdu_init): Initialize pcsc.count and pcsc.context. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Clean up the structure for future fix of PC/SC.NIIBE Yutaka2019-09-113-18/+23
| | | | | | | | | | | | * scd/apdu.c (struct dev_list): Rename from ccid_table, with void*. (open_ccid_reader): Follow the change. (apdu_dev_list_start, apdu_dev_list_finish): Likewise. (apdu_open_reader): Likewise. * scd/ccid-driver.c (ccid_dev_scan): Use void *. (ccid_dev_scan_finish, ccid_get_BAI, ccid_open_usb_reader): Likewise. * scd/ccid-driver.h: Change the APIs. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Implement auto-switching between Yubikey apps.Werner Koch2019-09-051-34/+105
| | | | | | | | | | | | | * scd/app.c (apptype_from_keyref): New. (maybe_switch_app): Add arg 'keyref' and use this also for switching. Change all callers to pass a keyref if needed. -- A drawback of this auto-switching is that the PIN cache of the cards are cleared. That could be mitigated by having our own cache but we always tried to avoid that. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Avoid PIN caching issues after re-select.Werner Koch2019-09-051-0/+6
| | | | | | | | | | | * scd/app-openpgp.c (do_reselect): Clear PIN cache flags. -- It seems that the verification status of the OpenPGP app on a Yubikey is reset on a select. We need to reflect this in our cache to avoid a "Bad PIN" error on computing a signature. Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Allow the keygrip as alternative to a keyref.Werner Koch2019-09-051-2/+22
| | | | | | * scd/app-piv.c (find_dobj_by_keyref): Allow the keygrip as input. Signed-off-by: Werner Koch <[email protected]>
* scd: Improve locking of app_do_with_keygrip.Werner Koch2019-09-051-10/+24
| | | | | | * scd/app.c (app_do_with_keygrip): Lock once per card. Signed-off-by: Werner Koch <[email protected]>
* scd: New debug flag "app".Werner Koch2019-09-053-27/+97
| | | | | | | | | | | | * scd/scdaemon.h (DBG_APP_VALUE, DBG_APP): New. * scd/scdaemon.c (debug_flags): Add "app". * scd/app.c (xstrapptype): New. (app_readcert, app_readkey, app_getattr): Add debug output. (app_setattr, app_sign, app_auth): Ditto. (app_writecert, app_writekey, app_change_pin): Ditto. (app_check_pin): Ditto. Signed-off-by: Werner Koch <[email protected]>
* scd: New sub-command cmd_has_option for GETINFO.Werner Koch2019-09-041-1/+55
| | | | | | * scd/command.c (cmd_getinfo): Add cmd_has_option sub-command. Signed-off-by: Werner Koch <[email protected]>
* scd: Add option --all to the SERIALNO command.Werner Koch2019-09-042-11/+105
| | | | | | | | | | | | | | | | | | | | * scd/command.c (cmd_serialno): Add option --all. (open_card_with_request): Implement that option. * scd/app.c (select_all_additional_applications_internal): New. (select_additional_application): Add mode to call new function. -- This option is currently only useful for Yubikeys and basically ignored with other cards. Its use is SERIALNO --all LEARN --force --multi which will then print keypairinfo and other stuff for the OpenPGP and PIV application of a Yubikey. Scute is going to use this to allow using certificates from OpenPGP and PIV at the same time. Signed-off-by: Werner Koch <[email protected]>
* scd: Fix Error checking in additioal app selection.Werner Koch2019-09-041-2/+3
| | | | | | | | | | * scd/app.c (select_additional_application): Return error for unknown NAME. -- ERR was only set but not used. Signed-off-by: Werner Koch <[email protected]>
* scd: Add option --multi to the LEARN command.Werner Koch2019-09-043-19/+61
| | | | | | | | | | | | | | | | * scd/app-common.h (APP_LEARN_FLAG_MULTI): New. * scd/command.c (cmd_learn): Add option --multi. * scd/app.c (app_write_learn_status): Factor some code out to ... (write_learn_status_core): new. (app_write_learn_status): Implement flag --multi. -- This new option is intended to return information about all active applications of the current card. Thus if a "SERIALNO openpgp" and a "SERIALNO piv" has been done in a session the command "LEARN --force --multi" returns information about both applications. Signed-off-by: Werner Koch <[email protected]>
* scd: Use a macro for the flag parameter of learn_status.Werner Koch2019-09-047-7/+12
| | | | | | | | | | | | * scd/app-common.h (APP_LEARN_FLAG_KEYPAIRINFO): New flag macro.. * scd/command.c (cmd_learn): Pass that flag instead of a plain number. * scd/app-nks.c (do_learn_status_core): Use new flag. * scd/app-p15.c (do_learn_status): Ditto. * scd/app-piv.c (do_learn_status): Ditto. * scd/app-sc-hsm.c (do_learn_status): Ditto. * scd/app.c (app_write_learn_status): Ditto. Signed-off-by: Werner Koch <[email protected]>
* scd:nks: Extend keypairinfo with usage flags.Werner Koch2019-08-211-0/+11
| | | | | | | * scd/app-nks.c (do_learn_status_core): Return usage. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 0a9053eff0406c6799ee201013194200c0ed3487)
* scd:nks: Support attributes $ENCRKEYID and $SIGNKEYID.Werner Koch2019-08-211-4/+20
| | | | | | | | | | * scd/app-nks.c (do_getattr): Add new attributes. -- Note that these were already added to 2.2 as part of commit 23784f8bf0ac6d6c52cb2de2f99f46017a92c11a Signed-off-by: Werner Koch <[email protected]>
* scd: Fix check_application_conflict.NIIBE Yutaka2019-08-211-0/+6
| | | | | | | * scd/scd/app.c (check_application_conflict): Compare APPTYPE. Fixes-commit: 5a5288d051a551a1a8f169225e62572f6ee8cb10 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Fix selecting additional APP.NIIBE Yutaka2019-08-211-28/+59
| | | | | | | | | | * scd/app.c (select_additional_application_internal): Factor out. (select_additional_application): Getting the lock and call select_additional_application_internal, set current_apptype, then. (select_application): Call select_additional_application_internal for Yubikey. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Fix how select_additional_application is called.NIIBE Yutaka2019-08-211-10/+3
| | | | | | | * scd/app.c (check_application_conflict): Check against current APP. (select_additional_application): Update current_apptype of CTRL. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Fix resetting CARD_CTX.NIIBE Yutaka2019-08-213-17/+4
| | | | | | | | | | | | | | | * scd/app.c (deallocate_card): Don't call scd_clear_current_app. (card_reset): Reset ctrl->current_apptype. * scd/command.c (open_card_with_request): Likewise. (send_client_notifications): Likewise. (scd_clear_current_app): Remove. -- It's too late to call scd_clear_current_app from deallocate_card, because CARD_CTX is already reset. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Fix switching to another APP.NIIBE Yutaka2019-08-211-4/+9
| | | | | | | | * scd/app.c (select_additional_application): Initialize card of APP. Break after the selection. Don't free APP if success. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Remove fallback mechanism to PC/SC.NIIBE Yutaka2019-08-061-8/+2
| | | | | | | * scd/apdu.c [HAVE_LIBUSB] (apdu_open_reader): Simply let it fail. GnuPG-bug-id: 4673 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Handle CCID bwi of time extension.NIIBE Yutaka2019-07-251-1/+6
| | | | | | | | | | | | | * scd/ccid-driver.c (bulk_in): Increase timeout by the multiplier value as defined section 6.2.6 in CCID specification. -- For TPDU level transfer, it was handled. This is fix for APDU level transfer. GnuPG-bug-id: 4646 Signed-off-by: NIIBE Yutaka <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-18 20:33:58 +0000