Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: support for Belgian eID cards #104

Open
wants to merge 19 commits into
base: master
Choose a base branch
from
Open

Commits on Jun 15, 2017

  1. Start work on adding a belpic implementation

    BELPIC (BELgian Personal Identity Card) is the official electronic ID
    card of Belgium.
    
    Start adding a virtual implementation of this card to vsmartcard.
    
    Not remotely there yet, but at least this runs without error already,
    and sends the correct ATR when asked. Beyond that... much TODO.
    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    99ff2a4 View commit details
    Browse the repository at this point in the history
  2. Do not allow creation of files

    The BeID card does not allow the user to create extra files, so disallow when
    it is tried
    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    793a305 View commit details
    Browse the repository at this point in the history
  3. Upon initialisation, read the XML file

    Current BeID development tools work with XML files to represent the data
    on the card. Reuse that format, so that existing developers don't have
    to regenerate their cards (and so that a certain level of
    interoperability between those tools exists)
    
    We may add another option in the future, but that's not for now.
    
    Also, add the Belpic applet's AID as the DF name for the MF
    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    5c6c522 View commit details
    Browse the repository at this point in the history
  4. Configuration menu
    Copy the full SHA
    8e6266a View commit details
    Browse the repository at this point in the history
  5. Update TODO note

    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    0751076 View commit details
    Browse the repository at this point in the history
  6. Add an example XML file

    Generated by
    <https://github.com/Fedict/eid-test-cards/tree/master/gen_virtual_cards>.
    TODO: generate it here, rather than there. Not for now.
    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    6bba615 View commit details
    Browse the repository at this point in the history
  7. Clarify this here, too

    (and trigger a travis build while we're at it)
    
    Signed-off-by: Wouter Verhelst <[email protected]>
    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    cdbe8fc View commit details
    Browse the repository at this point in the history
  8. Disable coverity for fork...

    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    9dc0f73 View commit details
    Browse the repository at this point in the history
  9. Make the Relay card still parse and log the APDU

    The basic VirtualSmartcard implementation parses and logs the APDU sent
    to the card in the execute instance method, and logs the received APDU
    after calling that method.
    
    The Relay implementation, however, overrides the execute method, but
    does not log it. The result, when running at the info log level, is that
    you see the reply from the card, but not the request from the
    application. This is confusing.
    
    Additionally, if the relay implementation shows the request APDU, then
    it can be used as a method to analyze what an application is trying to
    do.
    
    To remedy all that, parse the APDU and log that parsed value, but don't
    do anything further with it.
    
    Signed-off-by: Wouter Verhelst <[email protected]>
    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    a8ca1d3 View commit details
    Browse the repository at this point in the history
  10. Allow for unparsed logging

    Some unknown cards, which the Relay card may need to deal with, may not
    use the APDU format. Trying to parse commands sent to those cards as
    though they were in the APDU format is obviously wrong. However, most
    cards do support APDU, so default to logging parsed APDUs, still.
    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    e3a1aac View commit details
    Browse the repository at this point in the history
  11. Only respond to the commands that this card actually implements

    Also, implement a stub version of the "GET CARD DATA" and "LOG OFF"
    commands that are proprietary to the Belpic applet.
    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    efb57b0 View commit details
    Browse the repository at this point in the history
  12. Configuration menu
    Copy the full SHA
    ddc0df1 View commit details
    Browse the repository at this point in the history
  13. Drop unneeded function

    Now that we have a correct ins2handler dict, drop the unneeded create
    method
    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    a53b172 View commit details
    Browse the repository at this point in the history
  14. Add note of what we're doing here

    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    fb7ec85 View commit details
    Browse the repository at this point in the history
  15. Filter the SELECT FILE command

    The spec for the Belgian electronic ID card interprets the ISO 7816
    "SELECT FILE" command in a somewhat simplified way. First, the MF (3F00)
    can be selected from anywhere when P1 = 0x02; second, child DFs are
    selected also with P1 = 0x02. The applet does not interpret or treat
    specially cases where P1 = 0x00 or P1 = 0x01.
    
    In order to not to have to rewrite the "select file" logic that already
    exists in the Iso7816OS class, filter those two commands so that they
    contain the P1 value which the Iso7816OS class would search for.
    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    5fc6018 View commit details
    Browse the repository at this point in the history
  16. Filter out warnings

    The belpic applet does not deal with file sizes. It just returns less
    data than was requested, and the remote is supposed to figure out that
    the file was smaller than it assumed before based on that. It still
    returns SW12 0x9000 in that case, however.
    
    Add a "formatResult" method which filters out the SW12 = 0x6282 case, so
    that applications don't see values they don't expect.
    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    5eb000d View commit details
    Browse the repository at this point in the history
  17. Add one more TODO item

    yoe committed Jun 15, 2017
    Configuration menu
    Copy the full SHA
    03a1136 View commit details
    Browse the repository at this point in the history

Commits on Jun 20, 2017

  1. Make sure these files actually have some content

    Otherwise the file is unavailable and the eid-mw PKCS#11 module
    complains that the card is broken.
    yoe committed Jun 20, 2017
    Configuration menu
    Copy the full SHA
    75f5b49 View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    e65e13a View commit details
    Browse the repository at this point in the history