[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-devel] [PATCH 2/2] libcacard: Lock NSS cert db when selecting an a

From: Ray Strode
Subject: [Qemu-devel] [PATCH 2/2] libcacard: Lock NSS cert db when selecting an applet on an emulated card
Date: Sun, 8 Sep 2013 01:08:39 -0400

From: Ray Strode <address@hidden>

When a process in a guest uses an emulated smartcard, libcacard passes
the PIN from the guest to the PK11_Authenticate NSS function. The first
time PK11_Authenticate is called the passed in PIN is used to unlock the
certificate database. Subsequent calls to PK11_Authenticate within the
next 60 seconds will transparently succeed, regardless of the passed in
PIN. This is a convenience for applications provided by NSS.

Of course, the guest may have many applications using the one emulated
smart card all driven from the same host qemu process.  That means if a
user enters the right PIN in one program in the guest, and then enters the
wrong PIN in another program in the guest, the wrong PIN will still
succeed (as long as it's within 60 seconds of the right PIN being entered).

This commit forces the NSS certificate database to be locked anytime an
applet is selected on an emulated smartcard by calling vcard_emul_logout.

Signed-off-by: Ray Strode <address@hidden>
 libcacard/vcard.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libcacard/vcard.c b/libcacard/vcard.c
index 539177b..cf02a25 100644
--- a/libcacard/vcard.c
+++ b/libcacard/vcard.c
@@ -243,60 +243,65 @@ vcard_find_applet(VCard *card, unsigned char *aid, int 
     VCardApplet *current_applet;
     for (current_applet = card->applet_list; current_applet;
                                         current_applet = current_applet->next) 
         if (current_applet->aid_len != aid_len) {
         if (memcmp(current_applet->aid, aid, aid_len) == 0) {
     return current_applet;
 unsigned char *
 vcard_applet_get_aid(VCardApplet *applet, int *aid_len)
     if (applet == NULL) {
         return NULL;
     *aid_len = applet->aid_len;
     return applet->aid;
 vcard_select_applet(VCard *card, int channel, VCardApplet *applet)
     assert(channel < MAX_CHANNEL);
+    /* If using an emulated card, make sure to log out of any already logged in
+     * session. */
+    vcard_emul_logout(card);
     card->current_applet[channel] = applet;
     /* reset the applet */
     if (applet && applet->reset_applet) {
         applet->reset_applet(card, channel);
 VCardAppletPrivate *
 vcard_get_current_applet_private(VCard *card, int channel)
     VCardApplet *applet = card->current_applet[channel];
     if (applet == NULL) {
         return NULL;
     return applet->applet_private;
 vcard_process_applet_apdu(VCard *card, VCardAPDU *apdu,
                           VCardResponse **response)
     if (card->current_applet[apdu->a_channel]) {
         return card->current_applet[apdu->a_channel]->process_apdu(
                                                         card, apdu, response);
     return VCARD_NEXT;

reply via email to

[Prev in Thread] Current Thread [Next in Thread]