- djm@cvs.openbsd.org 2004/05/08 00:21:31

[openssh.git] / scard.c

diff --git a/scard.c b/scard.c
index 779106f851e5056d9658e76ec30150c5959b564b..b3d25058ae18d8ea856b14af2f9189d9f7576eb3 100644 (file)
--- a/scard.c
+++ b/scard.c
@@ -23,8 +23,8 @@
  */
 
 #include "includes.h"
-#ifdef SMARTCARD
-RCSID("$OpenBSD: scard.c,v 1.24 2002/03/25 17:34:27 markus Exp $");
+#if defined(SMARTCARD) && defined(USE_SECTOK)
+RCSID("$OpenBSD: scard.c,v 1.29 2004/05/08 00:21:31 djm Exp $");
 
 #include <openssl/evp.h>
 #include <sectok.h>
@@ -32,7 +32,7 @@ RCSID("$OpenBSD: scard.c,v 1.24 2002/03/25 17:34:27 markus Exp $");
 #include "key.h"
 #include "log.h"
 #include "xmalloc.h"
-#include "readpass.h"
+#include "misc.h"
 #include "scard.h"
 
 #if OPENSSL_VERSION_NUMBER < 0x00907000L
@@ -65,6 +65,7 @@ static int cla = 0x00;        /* class */
 
 static void sc_mk_digest(const char *pin, u_char *digest);
 static int get_AUT0(u_char *aut0);
+static int try_AUT0(void);
 
 /* interface to libsectok */
 
@@ -164,6 +165,12 @@ sc_read_pubkey(Key * k)
        n = xmalloc(len);
        /* get n */
        sectok_apdu(sc_fd, CLA_SSH, INS_GET_PUBKEY, 0, 0, 0, NULL, len, n, &sw);
+
+       if (sw == 0x6982) {
+               if (try_AUT0() < 0)
+                       goto err;
+               sectok_apdu(sc_fd, CLA_SSH, INS_GET_PUBKEY, 0, 0, 0, NULL, len, n, &sw);
+       }
        if (!sectok_swOK(sw)) {
                error("could not obtain public key: %s", sectok_get_sw(sw));
                goto err;
@@ -184,7 +191,7 @@ sc_read_pubkey(Key * k)
 
        status = 0;
        p = key_fingerprint(k, SSH_FP_MD5, SSH_FP_HEX);
-       debug("fingerprint %d %s", key_size(k), p);
+       debug("fingerprint %u %s", key_size(k), p);
        xfree(p);
 
 err:
@@ -194,32 +201,6 @@ err:
        return status;
 }
 
-static int
-try_AUT0(void)
-{
-       u_char aut0[EVP_MAX_MD_SIZE];
-
-       /* permission denied; try PIN if provided */
-       if (sc_pin && strlen(sc_pin) > 0) {
-               sc_mk_digest(sc_pin, aut0);
-               if (cyberflex_verify_AUT0(sc_fd, cla, aut0, 8) < 0) {
-                       error("smartcard passphrase incorrect");
-                       return (-1);
-               }
-       } else {
-               /* try default AUT0 key */
-               if (cyberflex_verify_AUT0(sc_fd, cla, DEFAUT0, 8) < 0) {
-                       /* default AUT0 key failed; prompt for passphrase */
-                       if (get_AUT0(aut0) < 0 ||
-                           cyberflex_verify_AUT0(sc_fd, cla, aut0, 8) < 0) {
-                               error("smartcard passphrase incorrect");
-                               return (-1);
-                       }
-               }
-       }
-       return (0);
-}
-
 /* private key operations */
 
 static int
@@ -463,6 +444,32 @@ get_AUT0(u_char *aut0)
        return 0;
 }
 
+static int
+try_AUT0(void)
+{
+       u_char aut0[EVP_MAX_MD_SIZE];
+
+       /* permission denied; try PIN if provided */
+       if (sc_pin && strlen(sc_pin) > 0) {
+               sc_mk_digest(sc_pin, aut0);
+               if (cyberflex_verify_AUT0(sc_fd, cla, aut0, 8) < 0) {
+                       error("smartcard passphrase incorrect");
+                       return (-1);
+               }
+       } else {
+               /* try default AUT0 key */
+               if (cyberflex_verify_AUT0(sc_fd, cla, DEFAUT0, 8) < 0) {
+                       /* default AUT0 key failed; prompt for passphrase */
+                       if (get_AUT0(aut0) < 0 ||
+                           cyberflex_verify_AUT0(sc_fd, cla, aut0, 8) < 0) {
+                               error("smartcard passphrase incorrect");
+                               return (-1);
+                       }
+               }
+       }
+       return (0);
+}
+
 int
 sc_put_key(Key *prv, const char *id)
 {
@@ -519,7 +526,7 @@ sc_put_key(Key *prv, const char *id)
        }
        if (!sectok_swOK(sw))
                goto done;
-       log("cyberflex_load_rsa_priv done");
+       logit("cyberflex_load_rsa_priv done");
        key_fid[0] = 0x73;
        key_fid[1] = 0x68;
        if (cyberflex_load_rsa_pub(fd, cla, key_fid, len, elements[5],
@@ -529,7 +536,7 @@ sc_put_key(Key *prv, const char *id)
        }
        if (!sectok_swOK(sw))
                goto done;
-       log("cyberflex_load_rsa_pub done");
+       logit("cyberflex_load_rsa_pub done");
        status = 0;
 
 done:
@@ -547,4 +554,11 @@ done:
                sectok_close(fd);
        return (status);
 }
-#endif /* SMARTCARD */
+
+char *
+sc_get_key_label(Key *key)
+{
+       return xstrdup("smartcard key");
+}
+
+#endif /* SMARTCARD && USE_SECTOK */