[qemu.git] / libcacard / cac.c

/*
 * implement the applets for the CAC card.
 *
 * This code is licensed under the GNU LGPL, version 2.1 or later.
 * See the COPYING.LIB file in the top-level directory.
 */

#include "qemu-common.h"

#include "cac.h"
#include "vcard.h"
#include "vcard_emul.h"
#include "card_7816.h"

/* private data for PKI applets */
typedef struct CACPKIAppletDataStruct {
    unsigned char *cert;
    int cert_len;
    unsigned char *cert_buffer;
    int cert_buffer_len;
    unsigned char *sign_buffer;
    int sign_buffer_len;
    VCardKey *key;
} CACPKIAppletData;

/*
 * CAC applet private data
 */
struct VCardAppletPrivateStruct {
    union {
        CACPKIAppletData pki_data;
        void *reserved;
    } u;
};

/*
 * handle all the APDU's that are common to all CAC applets
 */
static VCardStatus
cac_common_process_apdu(VCard *card, VCardAPDU *apdu, VCardResponse **response)
{
    int ef;
    VCardStatus ret = VCARD_FAIL;

    switch (apdu->a_ins) {
    case VCARD7816_INS_SELECT_FILE:
        if (apdu->a_p1 != 0x02) {
            /* let the 7816 code handle applet switches */
            ret = VCARD_NEXT;
            break;
        }
        /* handle file id setting */
        if (apdu->a_Lc != 2) {
            *response = vcard_make_response(
                VCARD7816_STATUS_ERROR_DATA_INVALID);
            ret = VCARD_DONE;
            break;
        }
        /* CAC 1.0 only supports ef = 0 */
        ef = apdu->a_body[0] | (apdu->a_body[1] << 8);
        if (ef != 0) {
            *response = vcard_make_response(
                VCARD7816_STATUS_ERROR_FILE_NOT_FOUND);
            ret = VCARD_DONE;
            break;
        }
        *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
        ret = VCARD_DONE;
        break;
    case VCARD7816_INS_GET_RESPONSE:
    case VCARD7816_INS_VERIFY:
        /* let the 7816 code handle these */
        ret = VCARD_NEXT;
        break;
    case CAC_GET_PROPERTIES:
    case CAC_GET_ACR:
        /* skip these for now, this will probably be needed */
        *response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
        ret = VCARD_DONE;
        break;
    default:
        *response = vcard_make_response(
            VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        ret = VCARD_DONE;
        break;
    }
    return ret;
}

/*
 *  reset the inter call state between applet selects
 */
static VCardStatus
cac_applet_pki_reset(VCard *card, int channel)
{
    VCardAppletPrivate *applet_private;
    CACPKIAppletData *pki_applet;
    applet_private = vcard_get_current_applet_private(card, channel);
    assert(applet_private);
    pki_applet = &(applet_private->u.pki_data);

    pki_applet->cert_buffer = NULL;
    g_free(pki_applet->sign_buffer);
    pki_applet->sign_buffer = NULL;
    pki_applet->cert_buffer_len = 0;
    pki_applet->sign_buffer_len = 0;
    return VCARD_DONE;
}

static VCardStatus
cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
                            VCardResponse **response)
{
    CACPKIAppletData *pki_applet;
    VCardAppletPrivate *applet_private;
    int size, next;
    unsigned char *sign_buffer;
    vcard_7816_status_t status;
    VCardStatus ret = VCARD_FAIL;

    applet_private = vcard_get_current_applet_private(card, apdu->a_channel);
    assert(applet_private);
    pki_applet = &(applet_private->u.pki_data);

    switch (apdu->a_ins) {
    case CAC_UPDATE_BUFFER:
        *response = vcard_make_response(
            VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
        ret = VCARD_DONE;
        break;
    case CAC_GET_CERTIFICATE:
        if ((apdu->a_p2 != 0) || (apdu->a_p1 != 0)) {
            *response = vcard_make_response(
                             VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
            break;
        }
        assert(pki_applet->cert != NULL);
        size = apdu->a_Le;
        if (pki_applet->cert_buffer == NULL) {
            pki_applet->cert_buffer = pki_applet->cert;
            pki_applet->cert_buffer_len = pki_applet->cert_len;
        }
        size = MIN(size, pki_applet->cert_buffer_len);
        next = MIN(255, pki_applet->cert_buffer_len - size);
        *response = vcard_response_new_bytes(
                        card, pki_applet->cert_buffer, size,
                        apdu->a_Le, next ?
                        VCARD7816_SW1_WARNING_CHANGE :
                        VCARD7816_SW1_SUCCESS,
                        next);
        pki_applet->cert_buffer += size;
        pki_applet->cert_buffer_len -= size;
        if ((*response == NULL) || (next == 0)) {
            pki_applet->cert_buffer = NULL;
        }
        if (*response == NULL) {
            *response = vcard_make_response(
                            VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
        }
        ret = VCARD_DONE;
        break;
    case CAC_SIGN_DECRYPT:
        if (apdu->a_p2 != 0) {
            *response = vcard_make_response(
                             VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
            break;
        }
        size = apdu->a_Lc;

        sign_buffer = g_realloc(pki_applet->sign_buffer,
                                pki_applet->sign_buffer_len + size);
        memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size);
        size += pki_applet->sign_buffer_len;
        switch (apdu->a_p1) {
        case  0x80:
            /* p1 == 0x80 means we haven't yet sent the whole buffer, wait for
             * the rest */
            pki_applet->sign_buffer = sign_buffer;
            pki_applet->sign_buffer_len = size;
            *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
            break;
        case 0x00:
            /* we now have the whole buffer, do the operation, result will be
             * in the sign_buffer */
            status = vcard_emul_rsa_op(card, pki_applet->key,
                                       sign_buffer, size);
            if (status != VCARD7816_STATUS_SUCCESS) {
                *response = vcard_make_response(status);
                break;
            }
            *response = vcard_response_new(card, sign_buffer, size, apdu->a_Le,
                                                     VCARD7816_STATUS_SUCCESS);
            if (*response == NULL) {
                *response = vcard_make_response(
                                VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
            }
            break;
        default:
           *response = vcard_make_response(
                                VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
            break;
        }
        g_free(sign_buffer);
        pki_applet->sign_buffer = NULL;
        pki_applet->sign_buffer_len = 0;
        ret = VCARD_DONE;
        break;
    case CAC_READ_BUFFER:
        /* new CAC call, go ahead and use the old version for now */
        /* TODO: implement */
        *response = vcard_make_response(
                                VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        ret = VCARD_DONE;
        break;
    default:
        ret = cac_common_process_apdu(card, apdu, response);
        break;
    }
    return ret;
}


static VCardStatus
cac_applet_id_process_apdu(VCard *card, VCardAPDU *apdu,
                           VCardResponse **response)
{
    VCardStatus ret = VCARD_FAIL;

    switch (apdu->a_ins) {
    case CAC_UPDATE_BUFFER:
        *response = vcard_make_response(
                        VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
        ret = VCARD_DONE;
        break;
    case CAC_READ_BUFFER:
        /* new CAC call, go ahead and use the old version for now */
        /* TODO: implement */
        *response = vcard_make_response(
                        VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        ret = VCARD_DONE;
        break;
    default:
        ret = cac_common_process_apdu(card, apdu, response);
        break;
    }
    return ret;
}


/*
 * TODO: if we ever want to support general CAC middleware, we will need to
 * implement the various containers.
 */
static VCardStatus
cac_applet_container_process_apdu(VCard *card, VCardAPDU *apdu,
                                  VCardResponse **response)
{
    VCardStatus ret = VCARD_FAIL;

    switch (apdu->a_ins) {
    case CAC_READ_BUFFER:
    case CAC_UPDATE_BUFFER:
        *response = vcard_make_response(
                        VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        ret = VCARD_DONE;
        break;
    default:
        ret = cac_common_process_apdu(card, apdu, response);
        break;
    }
    return ret;
}

/*
 * utilities for creating and destroying the private applet data
 */
static void
cac_delete_pki_applet_private(VCardAppletPrivate *applet_private)
{
    CACPKIAppletData *pki_applet_data;

    if (applet_private == NULL) {
        return;
    }
    pki_applet_data = &(applet_private->u.pki_data);
    g_free(pki_applet_data->cert);
    g_free(pki_applet_data->sign_buffer);
    if (pki_applet_data->key != NULL) {
        vcard_emul_delete_key(pki_applet_data->key);
    }
    g_free(applet_private);
}

static VCardAppletPrivate *
cac_new_pki_applet_private(const unsigned char *cert,
                           int cert_len, VCardKey *key)
{
    CACPKIAppletData *pki_applet_data;
    VCardAppletPrivate *applet_private;

    applet_private = g_new0(VCardAppletPrivate, 1);
    pki_applet_data = &(applet_private->u.pki_data);
    pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1);
    /*
     * if we want to support compression, then we simply change the 0 to a 1
     * and compress the cert data with libz
     */
    pki_applet_data->cert[0] = 0; /* not compressed */
    memcpy(&pki_applet_data->cert[1], cert, cert_len);
    pki_applet_data->cert_len = cert_len+1;

    pki_applet_data->key = key;
    return applet_private;
}


/*
 * create a new cac applet which links to a given cert
 */
static VCardApplet *
cac_new_pki_applet(int i, const unsigned char *cert,
                   int cert_len, VCardKey *key)
{
    VCardAppletPrivate *applet_private;
    VCardApplet *applet;
    unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 };
    int pki_aid_len = sizeof(pki_aid);

    pki_aid[pki_aid_len-1] = i;

    applet_private = cac_new_pki_applet_private(cert, cert_len, key);
    if (applet_private == NULL) {
        goto failure;
    }
    applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset,
                              pki_aid, pki_aid_len);
    if (applet == NULL) {
        goto failure;
    }
    vcard_set_applet_private(applet, applet_private,
                             cac_delete_pki_applet_private);
    applet_private = NULL;

    return applet;

failure:
    if (applet_private != NULL) {
        cac_delete_pki_applet_private(applet_private);
    }
    return NULL;
}


static unsigned char cac_default_container_aid[] = {
    0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 };
static unsigned char cac_id_aid[] = {
    0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 };
/*
 * Initialize the cac card. This is the only public function in this file. All
 * the rest are connected through function pointers.
 */
VCardStatus
cac_card_init(VReader *reader, VCard *card,
              const char *params,
              unsigned char * const *cert,
              int cert_len[],
              VCardKey *key[] /* adopt the keys*/,
              int cert_count)
{
    int i;
    VCardApplet *applet;

    /* CAC Cards are VM Cards */
    vcard_set_type(card, VCARD_VM);

    /* create one PKI applet for each cert */
    for (i = 0; i < cert_count; i++) {
        applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]);
        if (applet == NULL) {
            goto failure;
        }
        vcard_add_applet(card, applet);
    }

    /* create a default blank container applet */
    applet = vcard_new_applet(cac_applet_container_process_apdu,
                              NULL, cac_default_container_aid,
                              sizeof(cac_default_container_aid));
    if (applet == NULL) {
        goto failure;
    }
    vcard_add_applet(card, applet);

    /* create a default blank container applet */
    applet = vcard_new_applet(cac_applet_id_process_apdu,
                              NULL, cac_id_aid,
                              sizeof(cac_id_aid));
    if (applet == NULL) {
        goto failure;
    }
    vcard_add_applet(card, applet);
    return VCARD_DONE;

failure:
    return VCARD_FAIL;
}
Commit	Line	Data
111a38b0 RR	1	/*
	2	* implement the applets for the CAC card.
	3	*
	4	* This code is licensed under the GNU LGPL, version 2.1 or later.
	5	* See the COPYING.LIB file in the top-level directory.
	6	*/
	7
	8	#include "qemu-common.h"
	9
	10	#include "cac.h"
	11	#include "vcard.h"
	12	#include "vcard_emul.h"
	13	#include "card_7816.h"
	14
111a38b0 RR	15	/* private data for PKI applets */
	16	typedef struct CACPKIAppletDataStruct {
	17	unsigned char *cert;
	18	int cert_len;
	19	unsigned char *cert_buffer;
	20	int cert_buffer_len;
	21	unsigned char *sign_buffer;
	22	int sign_buffer_len;
	23	VCardKey *key;
	24	} CACPKIAppletData;
	25
	26	/*
	27	* CAC applet private data
	28	*/
	29	struct VCardAppletPrivateStruct {
	30	union {
	31	CACPKIAppletData pki_data;
	32	void *reserved;
	33	} u;
	34	};
	35
	36	/*
	37	* handle all the APDU's that are common to all CAC applets
	38	*/
	39	static VCardStatus
	40	cac_common_process_apdu(VCard card, VCardAPDU apdu, VCardResponse **response)
	41	{
	42	int ef;
57f97834	43	VCardStatus ret = VCARD_FAIL;
111a38b0 RR	44
	45	switch (apdu->a_ins) {
	46	case VCARD7816_INS_SELECT_FILE:
	47	if (apdu->a_p1 != 0x02) {
	48	/* let the 7816 code handle applet switches */
57f97834 AL	49	ret = VCARD_NEXT;
57f97834 AL	50	break;
111a38b0 RR	51	}
	52	/* handle file id setting */
	53	if (apdu->a_Lc != 2) {
	54	*response = vcard_make_response(
	55	VCARD7816_STATUS_ERROR_DATA_INVALID);
57f97834 AL	56	ret = VCARD_DONE;
57f97834 AL	57	break;
111a38b0 RR	58	}
	59	/* CAC 1.0 only supports ef = 0 */
	60	ef = apdu->a_body[0] \| (apdu->a_body[1] << 8);
	61	if (ef != 0) {
	62	*response = vcard_make_response(
	63	VCARD7816_STATUS_ERROR_FILE_NOT_FOUND);
57f97834 AL	64	ret = VCARD_DONE;
57f97834 AL	65	break;
111a38b0 RR	66	}
111a38b0 RR	67	*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
57f97834 AL	68	ret = VCARD_DONE;
57f97834 AL	69	break;
111a38b0 RR	70	case VCARD7816_INS_GET_RESPONSE:
	71	case VCARD7816_INS_VERIFY:
	72	/* let the 7816 code handle these */
57f97834 AL	73	ret = VCARD_NEXT;
57f97834 AL	74	break;
111a38b0 RR	75	case CAC_GET_PROPERTIES:
	76	case CAC_GET_ACR:
	77	/* skip these for now, this will probably be needed */
	78	*response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
57f97834 AL	79	ret = VCARD_DONE;
	80	break;
	81	default:
	82	*response = vcard_make_response(
	83	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
	84	ret = VCARD_DONE;
	85	break;
111a38b0	86	}
57f97834	87	return ret;
111a38b0 RR	88	}
	89
	90	/*
	91	* reset the inter call state between applet selects
	92	*/
	93	static VCardStatus
	94	cac_applet_pki_reset(VCard *card, int channel)
	95	{
1687a089 MT	96	VCardAppletPrivate *applet_private;
1687a089 MT	97	CACPKIAppletData *pki_applet;
111a38b0 RR	98	applet_private = vcard_get_current_applet_private(card, channel);
	99	assert(applet_private);
	100	pki_applet = &(applet_private->u.pki_data);
	101
	102	pki_applet->cert_buffer = NULL;
ec15993d MA	103	g_free(pki_applet->sign_buffer);
ec15993d MA	104	pki_applet->sign_buffer = NULL;
111a38b0 RR	105	pki_applet->cert_buffer_len = 0;
	106	pki_applet->sign_buffer_len = 0;
	107	return VCARD_DONE;
	108	}
	109
	110	static VCardStatus
	111	cac_applet_pki_process_apdu(VCard card, VCardAPDU apdu,
	112	VCardResponse **response)
	113	{
1687a089 MT	114	CACPKIAppletData *pki_applet;
1687a089 MT	115	VCardAppletPrivate *applet_private;
111a38b0 RR	116	int size, next;
	117	unsigned char *sign_buffer;
	118	vcard_7816_status_t status;
57f97834	119	VCardStatus ret = VCARD_FAIL;
111a38b0 RR	120
	121	applet_private = vcard_get_current_applet_private(card, apdu->a_channel);
	122	assert(applet_private);
	123	pki_applet = &(applet_private->u.pki_data);
	124
	125	switch (apdu->a_ins) {
	126	case CAC_UPDATE_BUFFER:
	127	*response = vcard_make_response(
	128	VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
57f97834 AL	129	ret = VCARD_DONE;
57f97834 AL	130	break;
111a38b0 RR	131	case CAC_GET_CERTIFICATE:
	132	if ((apdu->a_p2 != 0) \|\| (apdu->a_p1 != 0)) {
	133	*response = vcard_make_response(
	134	VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
	135	break;
	136	}
	137	assert(pki_applet->cert != NULL);
	138	size = apdu->a_Le;
	139	if (pki_applet->cert_buffer == NULL) {
	140	pki_applet->cert_buffer = pki_applet->cert;
	141	pki_applet->cert_buffer_len = pki_applet->cert_len;
	142	}
	143	size = MIN(size, pki_applet->cert_buffer_len);
	144	next = MIN(255, pki_applet->cert_buffer_len - size);
	145	*response = vcard_response_new_bytes(
	146	card, pki_applet->cert_buffer, size,
	147	apdu->a_Le, next ?
	148	VCARD7816_SW1_WARNING_CHANGE :
	149	VCARD7816_SW1_SUCCESS,
	150	next);
	151	pki_applet->cert_buffer += size;
	152	pki_applet->cert_buffer_len -= size;
	153	if ((*response == NULL) \|\| (next == 0)) {
	154	pki_applet->cert_buffer = NULL;
	155	}
	156	if (*response == NULL) {
	157	*response = vcard_make_response(
	158	VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
	159	}
57f97834 AL	160	ret = VCARD_DONE;
57f97834 AL	161	break;
111a38b0 RR	162	case CAC_SIGN_DECRYPT:
	163	if (apdu->a_p2 != 0) {
	164	*response = vcard_make_response(
	165	VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
	166	break;
	167	}
	168	size = apdu->a_Lc;
	169
26b78f4d MA	170	sign_buffer = g_realloc(pki_applet->sign_buffer,
26b78f4d MA	171	pki_applet->sign_buffer_len + size);
111a38b0 RR	172	memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size);
	173	size += pki_applet->sign_buffer_len;
	174	switch (apdu->a_p1) {
	175	case 0x80:
	176	/* p1 == 0x80 means we haven't yet sent the whole buffer, wait for
	177	* the rest */
	178	pki_applet->sign_buffer = sign_buffer;
	179	pki_applet->sign_buffer_len = size;
	180	*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
57f97834	181	break;
111a38b0 RR	182	case 0x00:
	183	/* we now have the whole buffer, do the operation, result will be
	184	* in the sign_buffer */
	185	status = vcard_emul_rsa_op(card, pki_applet->key,
	186	sign_buffer, size);
	187	if (status != VCARD7816_STATUS_SUCCESS) {
	188	*response = vcard_make_response(status);
	189	break;
	190	}
	191	*response = vcard_response_new(card, sign_buffer, size, apdu->a_Le,
	192	VCARD7816_STATUS_SUCCESS);
	193	if (*response == NULL) {
	194	*response = vcard_make_response(
	195	VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
	196	}
	197	break;
	198	default:
	199	*response = vcard_make_response(
	200	VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
	201	break;
	202	}
7267c094	203	g_free(sign_buffer);
111a38b0 RR	204	pki_applet->sign_buffer = NULL;
111a38b0 RR	205	pki_applet->sign_buffer_len = 0;
57f97834 AL	206	ret = VCARD_DONE;
57f97834 AL	207	break;
111a38b0 RR	208	case CAC_READ_BUFFER:
	209	/* new CAC call, go ahead and use the old version for now */
	210	/* TODO: implement */
	211	*response = vcard_make_response(
	212	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
57f97834 AL	213	ret = VCARD_DONE;
	214	break;
	215	default:
	216	ret = cac_common_process_apdu(card, apdu, response);
	217	break;
111a38b0	218	}
57f97834	219	return ret;
111a38b0 RR	220	}
	221
	222
	223	static VCardStatus
	224	cac_applet_id_process_apdu(VCard card, VCardAPDU apdu,
	225	VCardResponse **response)
	226	{
57f97834 AL	227	VCardStatus ret = VCARD_FAIL;
57f97834 AL	228
111a38b0 RR	229	switch (apdu->a_ins) {
	230	case CAC_UPDATE_BUFFER:
	231	*response = vcard_make_response(
	232	VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
57f97834 AL	233	ret = VCARD_DONE;
57f97834 AL	234	break;
111a38b0 RR	235	case CAC_READ_BUFFER:
	236	/* new CAC call, go ahead and use the old version for now */
	237	/* TODO: implement */
	238	*response = vcard_make_response(
	239	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
57f97834 AL	240	ret = VCARD_DONE;
	241	break;
	242	default:
	243	ret = cac_common_process_apdu(card, apdu, response);
	244	break;
111a38b0	245	}
57f97834	246	return ret;
111a38b0 RR	247	}
	248
	249
	250	/*
	251	* TODO: if we ever want to support general CAC middleware, we will need to
	252	* implement the various containers.
	253	*/
	254	static VCardStatus
	255	cac_applet_container_process_apdu(VCard card, VCardAPDU apdu,
	256	VCardResponse **response)
	257	{
57f97834 AL	258	VCardStatus ret = VCARD_FAIL;
57f97834 AL	259
111a38b0 RR	260	switch (apdu->a_ins) {
	261	case CAC_READ_BUFFER:
	262	case CAC_UPDATE_BUFFER:
	263	*response = vcard_make_response(
	264	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
57f97834 AL	265	ret = VCARD_DONE;
57f97834 AL	266	break;
111a38b0	267	default:
57f97834	268	ret = cac_common_process_apdu(card, apdu, response);
111a38b0 RR	269	break;
111a38b0 RR	270	}
57f97834	271	return ret;
111a38b0 RR	272	}
	273
	274	/*
	275	* utilities for creating and destroying the private applet data
	276	*/
	277	static void
	278	cac_delete_pki_applet_private(VCardAppletPrivate *applet_private)
	279	{
1687a089	280	CACPKIAppletData *pki_applet_data;
7fc7e584 AL	281
7fc7e584 AL	282	if (applet_private == NULL) {
111a38b0 RR	283	return;
	284	}
	285	pki_applet_data = &(applet_private->u.pki_data);
ec15993d MA	286	g_free(pki_applet_data->cert);
ec15993d MA	287	g_free(pki_applet_data->sign_buffer);
111a38b0 RR	288	if (pki_applet_data->key != NULL) {
	289	vcard_emul_delete_key(pki_applet_data->key);
	290	}
7267c094	291	g_free(applet_private);
111a38b0 RR	292	}
	293
	294	static VCardAppletPrivate *
	295	cac_new_pki_applet_private(const unsigned char *cert,
	296	int cert_len, VCardKey *key)
	297	{
78a4b8d2 MT	298	CACPKIAppletData *pki_applet_data;
78a4b8d2 MT	299	VCardAppletPrivate *applet_private;
111a38b0	300
78a4b8d2	301	applet_private = g_new0(VCardAppletPrivate, 1);
111a38b0	302	pki_applet_data = &(applet_private->u.pki_data);
7267c094	303	pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1);
111a38b0 RR	304	/*
	305	* if we want to support compression, then we simply change the 0 to a 1
	306	* and compress the cert data with libz
	307	*/
	308	pki_applet_data->cert[0] = 0; /* not compressed */
	309	memcpy(&pki_applet_data->cert[1], cert, cert_len);
	310	pki_applet_data->cert_len = cert_len+1;
	311
	312	pki_applet_data->key = key;
	313	return applet_private;
	314	}
	315
	316
	317	/*
	318	* create a new cac applet which links to a given cert
	319	*/
	320	static VCardApplet *
	321	cac_new_pki_applet(int i, const unsigned char *cert,
	322	int cert_len, VCardKey *key)
	323	{
1687a089 MT	324	VCardAppletPrivate *applet_private;
1687a089 MT	325	VCardApplet *applet;
111a38b0 RR	326	unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 };
	327	int pki_aid_len = sizeof(pki_aid);
	328
	329	pki_aid[pki_aid_len-1] = i;
	330
	331	applet_private = cac_new_pki_applet_private(cert, cert_len, key);
	332	if (applet_private == NULL) {
	333	goto failure;
	334	}
	335	applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset,
	336	pki_aid, pki_aid_len);
	337	if (applet == NULL) {
	338	goto failure;
	339	}
	340	vcard_set_applet_private(applet, applet_private,
	341	cac_delete_pki_applet_private);
	342	applet_private = NULL;
	343
	344	return applet;
	345
	346	failure:
	347	if (applet_private != NULL) {
	348	cac_delete_pki_applet_private(applet_private);
	349	}
	350	return NULL;
	351	}
	352
	353
	354	static unsigned char cac_default_container_aid[] = {
	355	0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 };
	356	static unsigned char cac_id_aid[] = {
	357	0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 };
	358	/*
	359	* Initialize the cac card. This is the only public function in this file. All
	360	* the rest are connected through function pointers.
	361	*/
	362	VCardStatus
	363	cac_card_init(VReader reader, VCard card,
	364	const char *params,
	365	unsigned char * const *cert,
	366	int cert_len[],
	367	VCardKey key[] / adopt the keys*/,
	368	int cert_count)
	369	{
	370	int i;
	371	VCardApplet *applet;
	372
	373	/* CAC Cards are VM Cards */
	374	vcard_set_type(card, VCARD_VM);
	375
	376	/* create one PKI applet for each cert */
	377	for (i = 0; i < cert_count; i++) {
	378	applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]);
	379	if (applet == NULL) {
	380	goto failure;
	381	}
	382	vcard_add_applet(card, applet);
	383	}
	384
	385	/* create a default blank container applet */
	386	applet = vcard_new_applet(cac_applet_container_process_apdu,
	387	NULL, cac_default_container_aid,
	388	sizeof(cac_default_container_aid));
	389	if (applet == NULL) {
390	goto failure;
391	}
392	vcard_add_applet(card, applet);
393
394	/* create a default blank container applet */
395	applet = vcard_new_applet(cac_applet_id_process_apdu,
396	NULL, cac_id_aid,
397	sizeof(cac_id_aid));
398	if (applet == NULL) {
399	goto failure;
400	}
401	vcard_add_applet(card, applet);
402	return VCARD_DONE;
403
404	failure:
405	return VCARD_FAIL;
406	}
407