[qemu.git] / libcacard / cac.c

/*
 * implement the applets for the CAC card.
 *
 * This code is licensed under the GNU LGPL, version 2.1 or later.
 * See the COPYING.LIB file in the top-level directory.
 */

#include "qemu-common.h"

#include "cac.h"
#include "vcard.h"
#include "vcard_emul.h"
#include "card_7816.h"

#define CAC_GET_PROPERTIES  0x56
#define CAC_GET_ACR         0x4c
#define CAC_READ_BUFFER     0x52
#define CAC_UPDATE_BUFFER   0x58
#define CAC_SIGN_DECRYPT    0x42
#define CAC_GET_CERTIFICATE 0x36

/* private data for PKI applets */
typedef struct CACPKIAppletDataStruct {
    unsigned char *cert;
    int cert_len;
    unsigned char *cert_buffer;
    int cert_buffer_len;
    unsigned char *sign_buffer;
    int sign_buffer_len;
    VCardKey *key;
} CACPKIAppletData;

/*
 * CAC applet private data
 */
struct VCardAppletPrivateStruct {
    union {
        CACPKIAppletData pki_data;
        void *reserved;
    } u;
};

/*
 * handle all the APDU's that are common to all CAC applets
 */
static VCardStatus
cac_common_process_apdu(VCard *card, VCardAPDU *apdu, VCardResponse **response)
{
    int ef;

    switch (apdu->a_ins) {
    case VCARD7816_INS_SELECT_FILE:
        if (apdu->a_p1 != 0x02) {
            /* let the 7816 code handle applet switches */
            return VCARD_NEXT;
        }
        /* handle file id setting */
        if (apdu->a_Lc != 2) {
            *response = vcard_make_response(
                VCARD7816_STATUS_ERROR_DATA_INVALID);
            return VCARD_DONE;
        }
        /* CAC 1.0 only supports ef = 0 */
        ef = apdu->a_body[0] | (apdu->a_body[1] << 8);
        if (ef != 0) {
            *response = vcard_make_response(
                VCARD7816_STATUS_ERROR_FILE_NOT_FOUND);
            return VCARD_DONE;
        }
        *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
        return VCARD_DONE;
    case VCARD7816_INS_GET_RESPONSE:
    case VCARD7816_INS_VERIFY:
        /* let the 7816 code handle these */
        return VCARD_NEXT;
    case CAC_GET_PROPERTIES:
    case CAC_GET_ACR:
        /* skip these for now, this will probably be needed */
        *response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
        return VCARD_DONE;
    }
    *response = vcard_make_response(
        VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
    return VCARD_DONE;
}

/*
 *  reset the inter call state between applet selects
 */
static VCardStatus
cac_applet_pki_reset(VCard *card, int channel)
{
    VCardAppletPrivate *applet_private = NULL;
    CACPKIAppletData *pki_applet = NULL;
    applet_private = vcard_get_current_applet_private(card, channel);
    assert(applet_private);
    pki_applet = &(applet_private->u.pki_data);

    pki_applet->cert_buffer = NULL;
    if (pki_applet->sign_buffer) {
        g_free(pki_applet->sign_buffer);
        pki_applet->sign_buffer = NULL;
    }
    pki_applet->cert_buffer_len = 0;
    pki_applet->sign_buffer_len = 0;
    return VCARD_DONE;
}

static VCardStatus
cac_applet_pki_process_apdu(VCard *card, VCardAPDU *apdu,
                            VCardResponse **response)
{
    CACPKIAppletData *pki_applet = NULL;
    VCardAppletPrivate *applet_private = NULL;
    int size, next;
    unsigned char *sign_buffer;
    vcard_7816_status_t status;

    applet_private = vcard_get_current_applet_private(card, apdu->a_channel);
    assert(applet_private);
    pki_applet = &(applet_private->u.pki_data);

    switch (apdu->a_ins) {
    case CAC_UPDATE_BUFFER:
        *response = vcard_make_response(
            VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
        return VCARD_DONE;
    case CAC_GET_CERTIFICATE:
        if ((apdu->a_p2 != 0) || (apdu->a_p1 != 0)) {
            *response = vcard_make_response(
                             VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
            break;
        }
        assert(pki_applet->cert != NULL);
        size = apdu->a_Le;
        if (pki_applet->cert_buffer == NULL) {
            pki_applet->cert_buffer = pki_applet->cert;
            pki_applet->cert_buffer_len = pki_applet->cert_len;
        }
        size = MIN(size, pki_applet->cert_buffer_len);
        next = MIN(255, pki_applet->cert_buffer_len - size);
        *response = vcard_response_new_bytes(
                        card, pki_applet->cert_buffer, size,
                        apdu->a_Le, next ?
                        VCARD7816_SW1_WARNING_CHANGE :
                        VCARD7816_SW1_SUCCESS,
                        next);
        pki_applet->cert_buffer += size;
        pki_applet->cert_buffer_len -= size;
        if ((*response == NULL) || (next == 0)) {
            pki_applet->cert_buffer = NULL;
        }
        if (*response == NULL) {
            *response = vcard_make_response(
                            VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
        }
        return VCARD_DONE;
    case CAC_SIGN_DECRYPT:
        if (apdu->a_p2 != 0) {
            *response = vcard_make_response(
                             VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
            break;
        }
        size = apdu->a_Lc;

        sign_buffer = realloc(pki_applet->sign_buffer,
                      pki_applet->sign_buffer_len+size);
        if (sign_buffer == NULL) {
            g_free(pki_applet->sign_buffer);
            pki_applet->sign_buffer = NULL;
            pki_applet->sign_buffer_len = 0;
            *response = vcard_make_response(
                            VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
            return VCARD_DONE;
        }
        memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size);
        size += pki_applet->sign_buffer_len;
        switch (apdu->a_p1) {
        case  0x80:
            /* p1 == 0x80 means we haven't yet sent the whole buffer, wait for
             * the rest */
            pki_applet->sign_buffer = sign_buffer;
            pki_applet->sign_buffer_len = size;
            *response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
            return VCARD_DONE;
        case 0x00:
            /* we now have the whole buffer, do the operation, result will be
             * in the sign_buffer */
            status = vcard_emul_rsa_op(card, pki_applet->key,
                                       sign_buffer, size);
            if (status != VCARD7816_STATUS_SUCCESS) {
                *response = vcard_make_response(status);
                break;
            }
            *response = vcard_response_new(card, sign_buffer, size, apdu->a_Le,
                                                     VCARD7816_STATUS_SUCCESS);
            if (*response == NULL) {
                *response = vcard_make_response(
                                VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
            }
            break;
        default:
           *response = vcard_make_response(
                                VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
            break;
        }
        g_free(sign_buffer);
        pki_applet->sign_buffer = NULL;
        pki_applet->sign_buffer_len = 0;
        return VCARD_DONE;
    case CAC_READ_BUFFER:
        /* new CAC call, go ahead and use the old version for now */
        /* TODO: implement */
        *response = vcard_make_response(
                                VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        return VCARD_DONE;
    }
    return cac_common_process_apdu(card, apdu, response);
}


static VCardStatus
cac_applet_id_process_apdu(VCard *card, VCardAPDU *apdu,
                           VCardResponse **response)
{
    switch (apdu->a_ins) {
    case CAC_UPDATE_BUFFER:
        *response = vcard_make_response(
                        VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
        return VCARD_DONE;
    case CAC_READ_BUFFER:
        /* new CAC call, go ahead and use the old version for now */
        /* TODO: implement */
        *response = vcard_make_response(
                        VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        return VCARD_DONE;
    }
    return cac_common_process_apdu(card, apdu, response);
}


/*
 * TODO: if we ever want to support general CAC middleware, we will need to
 * implement the various containers.
 */
static VCardStatus
cac_applet_container_process_apdu(VCard *card, VCardAPDU *apdu,
                                  VCardResponse **response)
{
    switch (apdu->a_ins) {
    case CAC_READ_BUFFER:
    case CAC_UPDATE_BUFFER:
        *response = vcard_make_response(
                        VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
        return VCARD_DONE;
    default:
        break;
    }
    return cac_common_process_apdu(card, apdu, response);
}

/*
 * utilities for creating and destroying the private applet data
 */
static void
cac_delete_pki_applet_private(VCardAppletPrivate *applet_private)
{
    CACPKIAppletData *pki_applet_data = NULL;
    if (pki_applet_data == NULL) {
        return;
    }
    pki_applet_data = &(applet_private->u.pki_data);
    if (pki_applet_data->cert != NULL) {
        g_free(pki_applet_data->cert);
    }
    if (pki_applet_data->sign_buffer != NULL) {
        g_free(pki_applet_data->sign_buffer);
    }
    if (pki_applet_data->key != NULL) {
        vcard_emul_delete_key(pki_applet_data->key);
    }
    g_free(applet_private);
}

static VCardAppletPrivate *
cac_new_pki_applet_private(const unsigned char *cert,
                           int cert_len, VCardKey *key)
{
    CACPKIAppletData *pki_applet_data = NULL;
    VCardAppletPrivate *applet_private = NULL;
    applet_private = (VCardAppletPrivate *)g_malloc(sizeof(VCardAppletPrivate));

    pki_applet_data = &(applet_private->u.pki_data);
    pki_applet_data->cert_buffer = NULL;
    pki_applet_data->cert_buffer_len = 0;
    pki_applet_data->sign_buffer = NULL;
    pki_applet_data->sign_buffer_len = 0;
    pki_applet_data->key = NULL;
    pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1);
    /*
     * if we want to support compression, then we simply change the 0 to a 1
     * and compress the cert data with libz
     */
    pki_applet_data->cert[0] = 0; /* not compressed */
    memcpy(&pki_applet_data->cert[1], cert, cert_len);
    pki_applet_data->cert_len = cert_len+1;

    pki_applet_data->key = key;
    return applet_private;
}


/*
 * create a new cac applet which links to a given cert
 */
static VCardApplet *
cac_new_pki_applet(int i, const unsigned char *cert,
                   int cert_len, VCardKey *key)
{
    VCardAppletPrivate *applet_private = NULL;
    VCardApplet *applet = NULL;
    unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 };
    int pki_aid_len = sizeof(pki_aid);

    pki_aid[pki_aid_len-1] = i;

    applet_private = cac_new_pki_applet_private(cert, cert_len, key);
    if (applet_private == NULL) {
        goto failure;
    }
    applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset,
                              pki_aid, pki_aid_len);
    if (applet == NULL) {
        goto failure;
    }
    vcard_set_applet_private(applet, applet_private,
                             cac_delete_pki_applet_private);
    applet_private = NULL;

    return applet;

failure:
    if (applet_private != NULL) {
        cac_delete_pki_applet_private(applet_private);
    }
    return NULL;
}


static unsigned char cac_default_container_aid[] = {
    0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 };
static unsigned char cac_id_aid[] = {
    0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 };
/*
 * Initialize the cac card. This is the only public function in this file. All
 * the rest are connected through function pointers.
 */
VCardStatus
cac_card_init(VReader *reader, VCard *card,
              const char *params,
              unsigned char * const *cert,
              int cert_len[],
              VCardKey *key[] /* adopt the keys*/,
              int cert_count)
{
    int i;
    VCardApplet *applet;

    /* CAC Cards are VM Cards */
    vcard_set_type(card, VCARD_VM);

    /* create one PKI applet for each cert */
    for (i = 0; i < cert_count; i++) {
        applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]);
        if (applet == NULL) {
            goto failure;
        }
        vcard_add_applet(card, applet);
    }

    /* create a default blank container applet */
    applet = vcard_new_applet(cac_applet_container_process_apdu,
                              NULL, cac_default_container_aid,
                              sizeof(cac_default_container_aid));
    if (applet == NULL) {
        goto failure;
    }
    vcard_add_applet(card, applet);

    /* create a default blank container applet */
    applet = vcard_new_applet(cac_applet_id_process_apdu,
                              NULL, cac_id_aid,
                              sizeof(cac_id_aid));
    if (applet == NULL) {
        goto failure;
    }
    vcard_add_applet(card, applet);
    return VCARD_DONE;

failure:
    return VCARD_FAIL;
}
Commit	Line	Data
111a38b0 RR	1	/*
	2	* implement the applets for the CAC card.
	3	*
	4	* This code is licensed under the GNU LGPL, version 2.1 or later.
	5	* See the COPYING.LIB file in the top-level directory.
	6	*/
	7
	8	#include "qemu-common.h"
	9
	10	#include "cac.h"
	11	#include "vcard.h"
	12	#include "vcard_emul.h"
	13	#include "card_7816.h"
	14
	15	#define CAC_GET_PROPERTIES 0x56
	16	#define CAC_GET_ACR 0x4c
	17	#define CAC_READ_BUFFER 0x52
	18	#define CAC_UPDATE_BUFFER 0x58
	19	#define CAC_SIGN_DECRYPT 0x42
	20	#define CAC_GET_CERTIFICATE 0x36
	21
	22	/* private data for PKI applets */
	23	typedef struct CACPKIAppletDataStruct {
	24	unsigned char *cert;
	25	int cert_len;
	26	unsigned char *cert_buffer;
	27	int cert_buffer_len;
	28	unsigned char *sign_buffer;
	29	int sign_buffer_len;
	30	VCardKey *key;
	31	} CACPKIAppletData;
	32
	33	/*
	34	* CAC applet private data
	35	*/
	36	struct VCardAppletPrivateStruct {
	37	union {
	38	CACPKIAppletData pki_data;
	39	void *reserved;
	40	} u;
	41	};
	42
	43	/*
	44	* handle all the APDU's that are common to all CAC applets
	45	*/
	46	static VCardStatus
	47	cac_common_process_apdu(VCard card, VCardAPDU apdu, VCardResponse **response)
	48	{
	49	int ef;
	50
	51	switch (apdu->a_ins) {
	52	case VCARD7816_INS_SELECT_FILE:
	53	if (apdu->a_p1 != 0x02) {
	54	/* let the 7816 code handle applet switches */
	55	return VCARD_NEXT;
	56	}
	57	/* handle file id setting */
	58	if (apdu->a_Lc != 2) {
	59	*response = vcard_make_response(
	60	VCARD7816_STATUS_ERROR_DATA_INVALID);
	61	return VCARD_DONE;
	62	}
	63	/* CAC 1.0 only supports ef = 0 */
	64	ef = apdu->a_body[0] \| (apdu->a_body[1] << 8);
65	if (ef != 0) {
66	*response = vcard_make_response(
67	VCARD7816_STATUS_ERROR_FILE_NOT_FOUND);
68	return VCARD_DONE;
69	}
70	*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
71	return VCARD_DONE;
72	case VCARD7816_INS_GET_RESPONSE:
73	case VCARD7816_INS_VERIFY:
74	/* let the 7816 code handle these */
75	return VCARD_NEXT;
76	case CAC_GET_PROPERTIES:
77	case CAC_GET_ACR:
78	/* skip these for now, this will probably be needed */
79	*response = vcard_make_response(VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
80	return VCARD_DONE;
81	}
82	*response = vcard_make_response(
83	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
84	return VCARD_DONE;
85	}
86
87	/*
88	* reset the inter call state between applet selects
89	*/
90	static VCardStatus
91	cac_applet_pki_reset(VCard *card, int channel)
92	{
93	VCardAppletPrivate *applet_private = NULL;
94	CACPKIAppletData *pki_applet = NULL;
95	applet_private = vcard_get_current_applet_private(card, channel);
96	assert(applet_private);
97	pki_applet = &(applet_private->u.pki_data);
98
99	pki_applet->cert_buffer = NULL;
100	if (pki_applet->sign_buffer) {
7267c094	101	g_free(pki_applet->sign_buffer);
111a38b0 RR	102	pki_applet->sign_buffer = NULL;
	103	}
	104	pki_applet->cert_buffer_len = 0;
	105	pki_applet->sign_buffer_len = 0;
	106	return VCARD_DONE;
	107	}
	108
	109	static VCardStatus
	110	cac_applet_pki_process_apdu(VCard card, VCardAPDU apdu,
	111	VCardResponse **response)
	112	{
	113	CACPKIAppletData *pki_applet = NULL;
	114	VCardAppletPrivate *applet_private = NULL;
	115	int size, next;
	116	unsigned char *sign_buffer;
	117	vcard_7816_status_t status;
	118
	119	applet_private = vcard_get_current_applet_private(card, apdu->a_channel);
	120	assert(applet_private);
	121	pki_applet = &(applet_private->u.pki_data);
	122
	123	switch (apdu->a_ins) {
	124	case CAC_UPDATE_BUFFER:
	125	*response = vcard_make_response(
	126	VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
	127	return VCARD_DONE;
	128	case CAC_GET_CERTIFICATE:
	129	if ((apdu->a_p2 != 0) \|\| (apdu->a_p1 != 0)) {
	130	*response = vcard_make_response(
	131	VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
	132	break;
	133	}
	134	assert(pki_applet->cert != NULL);
	135	size = apdu->a_Le;
	136	if (pki_applet->cert_buffer == NULL) {
	137	pki_applet->cert_buffer = pki_applet->cert;
	138	pki_applet->cert_buffer_len = pki_applet->cert_len;
	139	}
	140	size = MIN(size, pki_applet->cert_buffer_len);
	141	next = MIN(255, pki_applet->cert_buffer_len - size);
	142	*response = vcard_response_new_bytes(
	143	card, pki_applet->cert_buffer, size,
	144	apdu->a_Le, next ?
	145	VCARD7816_SW1_WARNING_CHANGE :
	146	VCARD7816_SW1_SUCCESS,
	147	next);
	148	pki_applet->cert_buffer += size;
	149	pki_applet->cert_buffer_len -= size;
	150	if ((*response == NULL) \|\| (next == 0)) {
	151	pki_applet->cert_buffer = NULL;
	152	}
	153	if (*response == NULL) {
	154	*response = vcard_make_response(
	155	VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
	156	}
	157	return VCARD_DONE;
	158	case CAC_SIGN_DECRYPT:
	159	if (apdu->a_p2 != 0) {
	160	*response = vcard_make_response(
	161	VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
	162	break;
	163	}
	164	size = apdu->a_Lc;
	165
166	sign_buffer = realloc(pki_applet->sign_buffer,
167	pki_applet->sign_buffer_len+size);
168	if (sign_buffer == NULL) {
7267c094	169	g_free(pki_applet->sign_buffer);
111a38b0 RR	170	pki_applet->sign_buffer = NULL;
	171	pki_applet->sign_buffer_len = 0;
	172	*response = vcard_make_response(
	173	VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
	174	return VCARD_DONE;
	175	}
	176	memcpy(sign_buffer+pki_applet->sign_buffer_len, apdu->a_body, size);
	177	size += pki_applet->sign_buffer_len;
	178	switch (apdu->a_p1) {
	179	case 0x80:
	180	/* p1 == 0x80 means we haven't yet sent the whole buffer, wait for
	181	* the rest */
	182	pki_applet->sign_buffer = sign_buffer;
	183	pki_applet->sign_buffer_len = size;
	184	*response = vcard_make_response(VCARD7816_STATUS_SUCCESS);
	185	return VCARD_DONE;
	186	case 0x00:
	187	/* we now have the whole buffer, do the operation, result will be
	188	* in the sign_buffer */
	189	status = vcard_emul_rsa_op(card, pki_applet->key,
	190	sign_buffer, size);
	191	if (status != VCARD7816_STATUS_SUCCESS) {
	192	*response = vcard_make_response(status);
	193	break;
	194	}
	195	*response = vcard_response_new(card, sign_buffer, size, apdu->a_Le,
	196	VCARD7816_STATUS_SUCCESS);
	197	if (*response == NULL) {
	198	*response = vcard_make_response(
	199	VCARD7816_STATUS_EXC_ERROR_MEMORY_FAILURE);
	200	}
	201	break;
	202	default:
	203	*response = vcard_make_response(
	204	VCARD7816_STATUS_ERROR_P1_P2_INCORRECT);
	205	break;
	206	}
7267c094	207	g_free(sign_buffer);
111a38b0 RR	208	pki_applet->sign_buffer = NULL;
	209	pki_applet->sign_buffer_len = 0;
	210	return VCARD_DONE;
	211	case CAC_READ_BUFFER:
	212	/* new CAC call, go ahead and use the old version for now */
	213	/* TODO: implement */
	214	*response = vcard_make_response(
	215	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
	216	return VCARD_DONE;
	217	}
	218	return cac_common_process_apdu(card, apdu, response);
	219	}
	220
	221
	222	static VCardStatus
	223	cac_applet_id_process_apdu(VCard card, VCardAPDU apdu,
	224	VCardResponse **response)
	225	{
	226	switch (apdu->a_ins) {
	227	case CAC_UPDATE_BUFFER:
	228	*response = vcard_make_response(
	229	VCARD7816_STATUS_ERROR_CONDITION_NOT_SATISFIED);
	230	return VCARD_DONE;
	231	case CAC_READ_BUFFER:
	232	/* new CAC call, go ahead and use the old version for now */
	233	/* TODO: implement */
	234	*response = vcard_make_response(
	235	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
	236	return VCARD_DONE;
	237	}
	238	return cac_common_process_apdu(card, apdu, response);
	239	}
	240
	241
	242	/*
	243	* TODO: if we ever want to support general CAC middleware, we will need to
	244	* implement the various containers.
	245	*/
	246	static VCardStatus
	247	cac_applet_container_process_apdu(VCard card, VCardAPDU apdu,
	248	VCardResponse **response)
	249	{
	250	switch (apdu->a_ins) {
	251	case CAC_READ_BUFFER:
	252	case CAC_UPDATE_BUFFER:
	253	*response = vcard_make_response(
	254	VCARD7816_STATUS_ERROR_COMMAND_NOT_SUPPORTED);
	255	return VCARD_DONE;
	256	default:
	257	break;
	258	}
	259	return cac_common_process_apdu(card, apdu, response);
	260	}
	261
	262	/*
	263	* utilities for creating and destroying the private applet data
	264	*/
	265	static void
	266	cac_delete_pki_applet_private(VCardAppletPrivate *applet_private)
	267	{
	268	CACPKIAppletData *pki_applet_data = NULL;
	269	if (pki_applet_data == NULL) {
	270	return;
	271	}
272	pki_applet_data = &(applet_private->u.pki_data);
273	if (pki_applet_data->cert != NULL) {
7267c094	274	g_free(pki_applet_data->cert);
111a38b0 RR	275	}
111a38b0 RR	276	if (pki_applet_data->sign_buffer != NULL) {
7267c094	277	g_free(pki_applet_data->sign_buffer);
111a38b0 RR	278	}
	279	if (pki_applet_data->key != NULL) {
	280	vcard_emul_delete_key(pki_applet_data->key);
	281	}
7267c094	282	g_free(applet_private);
111a38b0 RR	283	}
	284
	285	static VCardAppletPrivate *
	286	cac_new_pki_applet_private(const unsigned char *cert,
	287	int cert_len, VCardKey *key)
	288	{
	289	CACPKIAppletData *pki_applet_data = NULL;
	290	VCardAppletPrivate *applet_private = NULL;
7267c094	291	applet_private = (VCardAppletPrivate *)g_malloc(sizeof(VCardAppletPrivate));
111a38b0 RR	292
	293	pki_applet_data = &(applet_private->u.pki_data);
	294	pki_applet_data->cert_buffer = NULL;
	295	pki_applet_data->cert_buffer_len = 0;
	296	pki_applet_data->sign_buffer = NULL;
	297	pki_applet_data->sign_buffer_len = 0;
	298	pki_applet_data->key = NULL;
7267c094	299	pki_applet_data->cert = (unsigned char *)g_malloc(cert_len+1);
111a38b0 RR	300	/*
	301	* if we want to support compression, then we simply change the 0 to a 1
	302	* and compress the cert data with libz
	303	*/
	304	pki_applet_data->cert[0] = 0; /* not compressed */
	305	memcpy(&pki_applet_data->cert[1], cert, cert_len);
	306	pki_applet_data->cert_len = cert_len+1;
	307
	308	pki_applet_data->key = key;
	309	return applet_private;
	310	}
	311
	312
	313	/*
	314	* create a new cac applet which links to a given cert
	315	*/
	316	static VCardApplet *
	317	cac_new_pki_applet(int i, const unsigned char *cert,
	318	int cert_len, VCardKey *key)
	319	{
	320	VCardAppletPrivate *applet_private = NULL;
	321	VCardApplet *applet = NULL;
	322	unsigned char pki_aid[] = { 0xa0, 0x00, 0x00, 0x00, 0x79, 0x01, 0x00 };
	323	int pki_aid_len = sizeof(pki_aid);
	324
	325	pki_aid[pki_aid_len-1] = i;
	326
	327	applet_private = cac_new_pki_applet_private(cert, cert_len, key);
	328	if (applet_private == NULL) {
	329	goto failure;
	330	}
	331	applet = vcard_new_applet(cac_applet_pki_process_apdu, cac_applet_pki_reset,
	332	pki_aid, pki_aid_len);
	333	if (applet == NULL) {
	334	goto failure;
	335	}
	336	vcard_set_applet_private(applet, applet_private,
	337	cac_delete_pki_applet_private);
	338	applet_private = NULL;
	339
	340	return applet;
	341
	342	failure:
	343	if (applet_private != NULL) {
	344	cac_delete_pki_applet_private(applet_private);
	345	}
	346	return NULL;
	347	}
	348
	349
	350	static unsigned char cac_default_container_aid[] = {
	351	0xa0, 0x00, 0x00, 0x00, 0x30, 0x00, 0x00 };
	352	static unsigned char cac_id_aid[] = {
	353	0xa0, 0x00, 0x00, 0x00, 0x79, 0x03, 0x00 };
	354	/*
	355	* Initialize the cac card. This is the only public function in this file. All
	356	* the rest are connected through function pointers.
	357	*/
	358	VCardStatus
	359	cac_card_init(VReader reader, VCard card,
	360	const char *params,
	361	unsigned char * const *cert,
	362	int cert_len[],
	363	VCardKey key[] / adopt the keys*/,
364	int cert_count)
365	{
366	int i;
367	VCardApplet *applet;
368
369	/* CAC Cards are VM Cards */
370	vcard_set_type(card, VCARD_VM);
371
372	/* create one PKI applet for each cert */
373	for (i = 0; i < cert_count; i++) {
374	applet = cac_new_pki_applet(i, cert[i], cert_len[i], key[i]);
375	if (applet == NULL) {
376	goto failure;
377	}
378	vcard_add_applet(card, applet);
379	}
380
381	/* create a default blank container applet */
382	applet = vcard_new_applet(cac_applet_container_process_apdu,
383	NULL, cac_default_container_aid,
384	sizeof(cac_default_container_aid));
385	if (applet == NULL) {
386	goto failure;
387	}
388	vcard_add_applet(card, applet);
389
390	/* create a default blank container applet */
391	applet = vcard_new_applet(cac_applet_id_process_apdu,
392	NULL, cac_id_aid,
393	sizeof(cac_id_aid));
394	if (applet == NULL) {
395	goto failure;
396	}
397	vcard_add_applet(card, applet);
398	return VCARD_DONE;
399
400	failure:
401	return VCARD_FAIL;
402	}
403