1 /* 2 * CCID Card Device. Emulated card. 3 * 4 * Copyright (c) 2011 Red Hat. 5 * Written by Alon Levy. 6 * 7 * This code is licensed under the GNU LGPL, version 2 or later. 8 */ 9 10 /* 11 * It can be used to provide access to the local hardware in a non exclusive 12 * way, or it can use certificates. It requires the usb-ccid bus. 13 * 14 * Usage 1: standard, mirror hardware reader+card: 15 * qemu .. -usb -device usb-ccid -device ccid-card-emulated 16 * 17 * Usage 2: use certificates, no hardware required 18 * one time: create the certificates: 19 * for i in 1 2 3; do 20 * certutil -d /etc/pki/nssdb -x -t "CT,CT,CT" -S -s "CN=user$i" -n user$i 21 * done 22 * qemu .. -usb -device usb-ccid \ 23 * -device ccid-card-emulated,cert1=user1,cert2=user2,cert3=user3 24 * 25 * If you use a non default db for the certificates you can specify it using 26 * the db parameter. 27 */ 28 29 #include "qemu/osdep.h" 30 #include <eventt.h> 31 #include <vevent.h> 32 #include <vreader.h> 33 #include <vcard_emul.h> 34 35 #include "qemu/thread.h" 36 #include "qemu/main-loop.h" 37 #include "ccid.h" 38 #include "qapi/error.h" 39 40 #define DPRINTF(card, lvl, fmt, ...) \ 41 do {\ 42 if (lvl <= card->debug) {\ 43 printf("ccid-card-emul: %s: " fmt , __func__, ## __VA_ARGS__);\ 44 } \ 45 } while (0) 46 47 48 #define TYPE_EMULATED_CCID "ccid-card-emulated" 49 #define EMULATED_CCID_CARD(obj) \ 50 OBJECT_CHECK(EmulatedState, (obj), TYPE_EMULATED_CCID) 51 52 #define BACKEND_NSS_EMULATED_NAME "nss-emulated" 53 #define BACKEND_CERTIFICATES_NAME "certificates" 54 55 enum { 56 BACKEND_NSS_EMULATED = 1, 57 BACKEND_CERTIFICATES 58 }; 59 60 #define DEFAULT_BACKEND BACKEND_NSS_EMULATED 61 62 typedef struct EmulatedState EmulatedState; 63 64 enum { 65 EMUL_READER_INSERT = 0, 66 EMUL_READER_REMOVE, 67 EMUL_CARD_INSERT, 68 EMUL_CARD_REMOVE, 69 EMUL_GUEST_APDU, 70 EMUL_RESPONSE_APDU, 71 EMUL_ERROR, 72 }; 73 74 static const char *emul_event_to_string(uint32_t emul_event) 75 { 76 switch (emul_event) { 77 case EMUL_READER_INSERT: 78 return "EMUL_READER_INSERT"; 79 case EMUL_READER_REMOVE: 80 return "EMUL_READER_REMOVE"; 81 case EMUL_CARD_INSERT: 82 return "EMUL_CARD_INSERT"; 83 case EMUL_CARD_REMOVE: 84 return "EMUL_CARD_REMOVE"; 85 case EMUL_GUEST_APDU: 86 return "EMUL_GUEST_APDU"; 87 case EMUL_RESPONSE_APDU: 88 return "EMUL_RESPONSE_APDU"; 89 case EMUL_ERROR: 90 return "EMUL_ERROR"; 91 } 92 return "UNKNOWN"; 93 } 94 95 typedef struct EmulEvent { 96 QSIMPLEQ_ENTRY(EmulEvent) entry; 97 union { 98 struct { 99 uint32_t type; 100 } gen; 101 struct { 102 uint32_t type; 103 uint64_t code; 104 } error; 105 struct { 106 uint32_t type; 107 uint32_t len; 108 uint8_t data[]; 109 } data; 110 } p; 111 } EmulEvent; 112 113 #define MAX_ATR_SIZE 40 114 struct EmulatedState { 115 CCIDCardState base; 116 uint8_t debug; 117 char *backend_str; 118 uint32_t backend; 119 char *cert1; 120 char *cert2; 121 char *cert3; 122 char *db; 123 uint8_t atr[MAX_ATR_SIZE]; 124 uint8_t atr_length; 125 QSIMPLEQ_HEAD(event_list, EmulEvent) event_list; 126 QemuMutex event_list_mutex; 127 QemuThread event_thread_id; 128 VReader *reader; 129 QSIMPLEQ_HEAD(guest_apdu_list, EmulEvent) guest_apdu_list; 130 QemuMutex vreader_mutex; /* and guest_apdu_list mutex */ 131 QemuMutex handle_apdu_mutex; 132 QemuCond handle_apdu_cond; 133 EventNotifier notifier; 134 int quit_apdu_thread; 135 QemuThread apdu_thread_id; 136 }; 137 138 static void emulated_apdu_from_guest(CCIDCardState *base, 139 const uint8_t *apdu, uint32_t len) 140 { 141 EmulatedState *card = EMULATED_CCID_CARD(base); 142 EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent) + len); 143 144 assert(event); 145 event->p.data.type = EMUL_GUEST_APDU; 146 event->p.data.len = len; 147 memcpy(event->p.data.data, apdu, len); 148 qemu_mutex_lock(&card->vreader_mutex); 149 QSIMPLEQ_INSERT_TAIL(&card->guest_apdu_list, event, entry); 150 qemu_mutex_unlock(&card->vreader_mutex); 151 qemu_mutex_lock(&card->handle_apdu_mutex); 152 qemu_cond_signal(&card->handle_apdu_cond); 153 qemu_mutex_unlock(&card->handle_apdu_mutex); 154 } 155 156 static const uint8_t *emulated_get_atr(CCIDCardState *base, uint32_t *len) 157 { 158 EmulatedState *card = EMULATED_CCID_CARD(base); 159 160 *len = card->atr_length; 161 return card->atr; 162 } 163 164 static void emulated_push_event(EmulatedState *card, EmulEvent *event) 165 { 166 qemu_mutex_lock(&card->event_list_mutex); 167 QSIMPLEQ_INSERT_TAIL(&(card->event_list), event, entry); 168 qemu_mutex_unlock(&card->event_list_mutex); 169 event_notifier_set(&card->notifier); 170 } 171 172 static void emulated_push_type(EmulatedState *card, uint32_t type) 173 { 174 EmulEvent *event = g_new(EmulEvent, 1); 175 176 assert(event); 177 event->p.gen.type = type; 178 emulated_push_event(card, event); 179 } 180 181 static void emulated_push_error(EmulatedState *card, uint64_t code) 182 { 183 EmulEvent *event = g_new(EmulEvent, 1); 184 185 assert(event); 186 event->p.error.type = EMUL_ERROR; 187 event->p.error.code = code; 188 emulated_push_event(card, event); 189 } 190 191 static void emulated_push_data_type(EmulatedState *card, uint32_t type, 192 const uint8_t *data, uint32_t len) 193 { 194 EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent) + len); 195 196 assert(event); 197 event->p.data.type = type; 198 event->p.data.len = len; 199 memcpy(event->p.data.data, data, len); 200 emulated_push_event(card, event); 201 } 202 203 static void emulated_push_reader_insert(EmulatedState *card) 204 { 205 emulated_push_type(card, EMUL_READER_INSERT); 206 } 207 208 static void emulated_push_reader_remove(EmulatedState *card) 209 { 210 emulated_push_type(card, EMUL_READER_REMOVE); 211 } 212 213 static void emulated_push_card_insert(EmulatedState *card, 214 const uint8_t *atr, uint32_t len) 215 { 216 emulated_push_data_type(card, EMUL_CARD_INSERT, atr, len); 217 } 218 219 static void emulated_push_card_remove(EmulatedState *card) 220 { 221 emulated_push_type(card, EMUL_CARD_REMOVE); 222 } 223 224 static void emulated_push_response_apdu(EmulatedState *card, 225 const uint8_t *apdu, uint32_t len) 226 { 227 emulated_push_data_type(card, EMUL_RESPONSE_APDU, apdu, len); 228 } 229 230 #define APDU_BUF_SIZE 270 231 static void *handle_apdu_thread(void* arg) 232 { 233 EmulatedState *card = arg; 234 uint8_t recv_data[APDU_BUF_SIZE]; 235 int recv_len; 236 VReaderStatus reader_status; 237 EmulEvent *event; 238 239 while (1) { 240 qemu_mutex_lock(&card->handle_apdu_mutex); 241 qemu_cond_wait(&card->handle_apdu_cond, &card->handle_apdu_mutex); 242 qemu_mutex_unlock(&card->handle_apdu_mutex); 243 if (card->quit_apdu_thread) { 244 card->quit_apdu_thread = 0; /* debugging */ 245 break; 246 } 247 qemu_mutex_lock(&card->vreader_mutex); 248 while (!QSIMPLEQ_EMPTY(&card->guest_apdu_list)) { 249 event = QSIMPLEQ_FIRST(&card->guest_apdu_list); 250 assert((unsigned long)event > 1000); 251 QSIMPLEQ_REMOVE_HEAD(&card->guest_apdu_list, entry); 252 if (event->p.data.type != EMUL_GUEST_APDU) { 253 DPRINTF(card, 1, "unexpected message in handle_apdu_thread\n"); 254 g_free(event); 255 continue; 256 } 257 if (card->reader == NULL) { 258 DPRINTF(card, 1, "reader is NULL\n"); 259 g_free(event); 260 continue; 261 } 262 recv_len = sizeof(recv_data); 263 reader_status = vreader_xfr_bytes(card->reader, 264 event->p.data.data, event->p.data.len, 265 recv_data, &recv_len); 266 DPRINTF(card, 2, "got back apdu of length %d\n", recv_len); 267 if (reader_status == VREADER_OK) { 268 emulated_push_response_apdu(card, recv_data, recv_len); 269 } else { 270 emulated_push_error(card, reader_status); 271 } 272 g_free(event); 273 } 274 qemu_mutex_unlock(&card->vreader_mutex); 275 } 276 return NULL; 277 } 278 279 static void *event_thread(void *arg) 280 { 281 int atr_len = MAX_ATR_SIZE; 282 uint8_t atr[MAX_ATR_SIZE]; 283 VEvent *event = NULL; 284 EmulatedState *card = arg; 285 286 while (1) { 287 const char *reader_name; 288 289 event = vevent_wait_next_vevent(); 290 if (event == NULL || event->type == VEVENT_LAST) { 291 break; 292 } 293 if (event->type != VEVENT_READER_INSERT) { 294 if (card->reader == NULL && event->reader != NULL) { 295 /* Happens after device_add followed by card remove or insert. 296 * XXX: create synthetic add_reader events if vcard_emul_init 297 * already called, which happens if device_del and device_add 298 * are called */ 299 card->reader = vreader_reference(event->reader); 300 } else { 301 if (event->reader != card->reader) { 302 fprintf(stderr, 303 "ERROR: wrong reader: quiting event_thread\n"); 304 break; 305 } 306 } 307 } 308 switch (event->type) { 309 case VEVENT_READER_INSERT: 310 /* TODO: take a specific reader. i.e. track which reader 311 * we are seeing here, check it is the one we want (the first, 312 * or by a particular name), and ignore if we don't want it. 313 */ 314 reader_name = vreader_get_name(event->reader); 315 if (card->reader != NULL) { 316 DPRINTF(card, 2, "READER INSERT - replacing %s with %s\n", 317 vreader_get_name(card->reader), reader_name); 318 qemu_mutex_lock(&card->vreader_mutex); 319 vreader_free(card->reader); 320 qemu_mutex_unlock(&card->vreader_mutex); 321 emulated_push_reader_remove(card); 322 } 323 qemu_mutex_lock(&card->vreader_mutex); 324 DPRINTF(card, 2, "READER INSERT %s\n", reader_name); 325 card->reader = vreader_reference(event->reader); 326 qemu_mutex_unlock(&card->vreader_mutex); 327 emulated_push_reader_insert(card); 328 break; 329 case VEVENT_READER_REMOVE: 330 DPRINTF(card, 2, " READER REMOVE: %s\n", 331 vreader_get_name(event->reader)); 332 qemu_mutex_lock(&card->vreader_mutex); 333 vreader_free(card->reader); 334 card->reader = NULL; 335 qemu_mutex_unlock(&card->vreader_mutex); 336 emulated_push_reader_remove(card); 337 break; 338 case VEVENT_CARD_INSERT: 339 /* get the ATR (intended as a response to a power on from the 340 * reader */ 341 atr_len = MAX_ATR_SIZE; 342 vreader_power_on(event->reader, atr, &atr_len); 343 card->atr_length = (uint8_t)atr_len; 344 DPRINTF(card, 2, " CARD INSERT\n"); 345 emulated_push_card_insert(card, atr, atr_len); 346 break; 347 case VEVENT_CARD_REMOVE: 348 DPRINTF(card, 2, " CARD REMOVE\n"); 349 emulated_push_card_remove(card); 350 break; 351 case VEVENT_LAST: /* quit */ 352 vevent_delete(event); 353 return NULL; 354 break; 355 default: 356 break; 357 } 358 vevent_delete(event); 359 } 360 return NULL; 361 } 362 363 static void card_event_handler(EventNotifier *notifier) 364 { 365 EmulatedState *card = container_of(notifier, EmulatedState, notifier); 366 EmulEvent *event, *next; 367 368 event_notifier_test_and_clear(&card->notifier); 369 qemu_mutex_lock(&card->event_list_mutex); 370 QSIMPLEQ_FOREACH_SAFE(event, &card->event_list, entry, next) { 371 DPRINTF(card, 2, "event %s\n", emul_event_to_string(event->p.gen.type)); 372 switch (event->p.gen.type) { 373 case EMUL_RESPONSE_APDU: 374 ccid_card_send_apdu_to_guest(&card->base, event->p.data.data, 375 event->p.data.len); 376 break; 377 case EMUL_READER_INSERT: 378 ccid_card_ccid_attach(&card->base); 379 break; 380 case EMUL_READER_REMOVE: 381 ccid_card_ccid_detach(&card->base); 382 break; 383 case EMUL_CARD_INSERT: 384 assert(event->p.data.len <= MAX_ATR_SIZE); 385 card->atr_length = event->p.data.len; 386 memcpy(card->atr, event->p.data.data, card->atr_length); 387 ccid_card_card_inserted(&card->base); 388 break; 389 case EMUL_CARD_REMOVE: 390 ccid_card_card_removed(&card->base); 391 break; 392 case EMUL_ERROR: 393 ccid_card_card_error(&card->base, event->p.error.code); 394 break; 395 default: 396 DPRINTF(card, 2, "unexpected event\n"); 397 break; 398 } 399 g_free(event); 400 } 401 QSIMPLEQ_INIT(&card->event_list); 402 qemu_mutex_unlock(&card->event_list_mutex); 403 } 404 405 static int init_event_notifier(EmulatedState *card, Error **errp) 406 { 407 if (event_notifier_init(&card->notifier, false) < 0) { 408 error_setg(errp, "ccid-card-emul: event notifier creation failed"); 409 return -1; 410 } 411 event_notifier_set_handler(&card->notifier, card_event_handler); 412 return 0; 413 } 414 415 #define CERTIFICATES_DEFAULT_DB "/etc/pki/nssdb" 416 #define CERTIFICATES_ARGS_TEMPLATE\ 417 "db=\"%s\" use_hw=no soft=(,Virtual Reader,CAC,,%s,%s,%s)" 418 419 static int wrap_vcard_emul_init(VCardEmulOptions *options) 420 { 421 static int called; 422 static int options_was_null; 423 424 if (called) { 425 if ((options == NULL) != options_was_null) { 426 printf("%s: warning: running emulated with certificates" 427 " and emulated side by side is not supported\n", 428 __func__); 429 return VCARD_EMUL_FAIL; 430 } 431 vcard_emul_replay_insertion_events(); 432 return VCARD_EMUL_OK; 433 } 434 options_was_null = (options == NULL); 435 called = 1; 436 return vcard_emul_init(options); 437 } 438 439 static int emulated_initialize_vcard_from_certificates(EmulatedState *card) 440 { 441 char emul_args[200]; 442 VCardEmulOptions *options = NULL; 443 444 snprintf(emul_args, sizeof(emul_args) - 1, CERTIFICATES_ARGS_TEMPLATE, 445 card->db ? card->db : CERTIFICATES_DEFAULT_DB, 446 card->cert1, card->cert2, card->cert3); 447 options = vcard_emul_options(emul_args); 448 if (options == NULL) { 449 printf("%s: warning: not using certificates due to" 450 " initialization error\n", __func__); 451 } 452 return wrap_vcard_emul_init(options); 453 } 454 455 typedef struct EnumTable { 456 const char *name; 457 uint32_t value; 458 } EnumTable; 459 460 static const EnumTable backend_enum_table[] = { 461 {BACKEND_NSS_EMULATED_NAME, BACKEND_NSS_EMULATED}, 462 {BACKEND_CERTIFICATES_NAME, BACKEND_CERTIFICATES}, 463 {NULL, 0}, 464 }; 465 466 static uint32_t parse_enumeration(char *str, 467 const EnumTable *table, uint32_t not_found_value) 468 { 469 uint32_t ret = not_found_value; 470 471 if (str == NULL) 472 return 0; 473 474 while (table->name != NULL) { 475 if (strcmp(table->name, str) == 0) { 476 ret = table->value; 477 break; 478 } 479 table++; 480 } 481 return ret; 482 } 483 484 static void emulated_realize(CCIDCardState *base, Error **errp) 485 { 486 EmulatedState *card = EMULATED_CCID_CARD(base); 487 VCardEmulError ret; 488 const EnumTable *ptable; 489 490 QSIMPLEQ_INIT(&card->event_list); 491 QSIMPLEQ_INIT(&card->guest_apdu_list); 492 qemu_mutex_init(&card->event_list_mutex); 493 qemu_mutex_init(&card->vreader_mutex); 494 qemu_mutex_init(&card->handle_apdu_mutex); 495 qemu_cond_init(&card->handle_apdu_cond); 496 card->reader = NULL; 497 card->quit_apdu_thread = 0; 498 if (init_event_notifier(card, errp) < 0) { 499 return; 500 } 501 502 card->backend = 0; 503 if (card->backend_str) { 504 card->backend = parse_enumeration(card->backend_str, 505 backend_enum_table, 0); 506 } 507 508 if (card->backend == 0) { 509 error_setg(errp, "backend must be one of:"); 510 for (ptable = backend_enum_table; ptable->name != NULL; ++ptable) { 511 error_append_hint(errp, "%s\n", ptable->name); 512 } 513 return; 514 } 515 516 /* TODO: a passthru backened that works on local machine. third card type?*/ 517 if (card->backend == BACKEND_CERTIFICATES) { 518 if (card->cert1 != NULL && card->cert2 != NULL && card->cert3 != NULL) { 519 ret = emulated_initialize_vcard_from_certificates(card); 520 } else { 521 error_setg(errp, "%s: you must provide all three certs for" 522 " certificates backend", TYPE_EMULATED_CCID); 523 return; 524 } 525 } else { 526 if (card->backend != BACKEND_NSS_EMULATED) { 527 error_setg(errp, "%s: bad backend specified. The options are:%s" 528 " (default), %s.", TYPE_EMULATED_CCID, 529 BACKEND_NSS_EMULATED_NAME, BACKEND_CERTIFICATES_NAME); 530 return; 531 } 532 if (card->cert1 != NULL || card->cert2 != NULL || card->cert3 != NULL) { 533 error_setg(errp, "%s: unexpected cert parameters to nss emulated " 534 "backend", TYPE_EMULATED_CCID); 535 return; 536 } 537 /* default to mirroring the local hardware readers */ 538 ret = wrap_vcard_emul_init(NULL); 539 } 540 if (ret != VCARD_EMUL_OK) { 541 error_setg(errp, "%s: failed to initialize vcard", TYPE_EMULATED_CCID); 542 return; 543 } 544 qemu_thread_create(&card->event_thread_id, "ccid/event", event_thread, 545 card, QEMU_THREAD_JOINABLE); 546 qemu_thread_create(&card->apdu_thread_id, "ccid/apdu", handle_apdu_thread, 547 card, QEMU_THREAD_JOINABLE); 548 } 549 550 static void emulated_unrealize(CCIDCardState *base, Error **errp) 551 { 552 EmulatedState *card = EMULATED_CCID_CARD(base); 553 VEvent *vevent = vevent_new(VEVENT_LAST, NULL, NULL); 554 555 vevent_queue_vevent(vevent); /* stop vevent thread */ 556 qemu_thread_join(&card->event_thread_id); 557 558 card->quit_apdu_thread = 1; /* stop handle_apdu thread */ 559 qemu_cond_signal(&card->handle_apdu_cond); 560 qemu_thread_join(&card->apdu_thread_id); 561 562 /* threads exited, can destroy all condvars/mutexes */ 563 qemu_cond_destroy(&card->handle_apdu_cond); 564 qemu_mutex_destroy(&card->handle_apdu_mutex); 565 qemu_mutex_destroy(&card->vreader_mutex); 566 qemu_mutex_destroy(&card->event_list_mutex); 567 } 568 569 static Property emulated_card_properties[] = { 570 DEFINE_PROP_STRING("backend", EmulatedState, backend_str), 571 DEFINE_PROP_STRING("cert1", EmulatedState, cert1), 572 DEFINE_PROP_STRING("cert2", EmulatedState, cert2), 573 DEFINE_PROP_STRING("cert3", EmulatedState, cert3), 574 DEFINE_PROP_STRING("db", EmulatedState, db), 575 DEFINE_PROP_UINT8("debug", EmulatedState, debug, 0), 576 DEFINE_PROP_END_OF_LIST(), 577 }; 578 579 static void emulated_class_initfn(ObjectClass *klass, void *data) 580 { 581 DeviceClass *dc = DEVICE_CLASS(klass); 582 CCIDCardClass *cc = CCID_CARD_CLASS(klass); 583 584 cc->realize = emulated_realize; 585 cc->unrealize = emulated_unrealize; 586 cc->get_atr = emulated_get_atr; 587 cc->apdu_from_guest = emulated_apdu_from_guest; 588 set_bit(DEVICE_CATEGORY_INPUT, dc->categories); 589 dc->desc = "emulated smartcard"; 590 dc->props = emulated_card_properties; 591 } 592 593 static const TypeInfo emulated_card_info = { 594 .name = TYPE_EMULATED_CCID, 595 .parent = TYPE_CCID_CARD, 596 .instance_size = sizeof(EmulatedState), 597 .class_init = emulated_class_initfn, 598 }; 599 600 static void ccid_card_emulated_register_types(void) 601 { 602 type_register_static(&emulated_card_info); 603 } 604 605 type_init(ccid_card_emulated_register_types) 606