puck/xenid
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Support removing the card while waiting for a PIN

Browse source
This commit is contained in:
puck 2026-03-06 09:57:49 +00:00
parent 04127f60b0
commit 20fc4719f3
2 changed files with 143 additions and 113 deletions
Download patch file Download diff file Expand all files Collapse all files

238
src/main.rs
View file

@ -2,7 +2,7 @@ use std::{collections::HashMap, env::args, thread, time::Duration};
use der::{Any, Decode, asn1::SetOfVec, oid::ObjectIdentifier}; use der::{Any, Decode, asn1::SetOfVec, oid::ObjectIdentifier};
use openssl::{bn::BigNumContext, ec::PointConversionForm, pkey::PKey}; use openssl::{bn::BigNumContext, ec::PointConversionForm, pkey::PKey};
use tokio::runtime::Runtime; use tokio::{runtime::Runtime, select};
use url::Url; use url::Url;
use crate::{ use crate::{
@ -121,128 +121,144 @@ async fn run_auth(
}) })
.await; .await;
ctg_pipe.send(pipe::CardToGUI::WaitForCard).await;
let mut finder = PCSCCardFinder::new(); let mut finder = PCSCCardFinder::new();
let mut crad = loop { let (mut crad, creds) = 'outer: loop {
let mut crad = finder.find_valid().await; ctg_pipe.send(pipe::CardToGUI::WaitForCard).await;
let mut crad = loop {
let mut crad = finder.find_valid().await;
// Select MF // Select MF
iso7816::select( iso7816::select(
&mut crad, &mut crad,
0, 0,
iso7816::SelectFile::File(&[]), iso7816::SelectFile::File(&[]),
iso7816::SelectOccurrence::First, iso7816::SelectOccurrence::First,
) )
.await?; .await?;
iso7816::select( iso7816::select(
&mut crad, &mut crad,
0, 0,
iso7816::files::EF_DIR, iso7816::files::EF_DIR,
iso7816::SelectOccurrence::First, iso7816::SelectOccurrence::First,
) )
.await?; .await?;
let ef_dir = iso7816::read_binary(&mut crad, 0).await?; let ef_dir = iso7816::read_binary(&mut crad, 0).await?;
if ef_dir.is_none() if ef_dir.is_none()
|| !ef_dir.unwrap().windows(14).any(|w| { || !ef_dir.unwrap().windows(14).any(|w| {
w == [ w == [
0xA0, 0x00, 0x00, 0x07, 0x88, 0x50, 0x43, 0x41, 0x2D, 0x65, 0x4D, 0x52,
0x54, 0x44,
]
})
{
ctg_pipe
.send(pipe::CardToGUI::ProcessingMessage {
message: String::from("Card is not eID"),
})
.await;
ctg_pipe.send(pipe::CardToGUI::WaitForCard).await;
continue;
}
break crad;
};
let creds = loop {
// Select the PCA application
iso7816::select(
&mut crad,
0,
iso7816::SelectFile::DedicatedFileName(&[
0xA0, 0x00, 0x00, 0x07, 0x88, 0x50, 0x43, 0x41, 0x2D, 0x65, 0x4D, 0x52, 0x54, 0xA0, 0x00, 0x00, 0x07, 0x88, 0x50, 0x43, 0x41, 0x2D, 0x65, 0x4D, 0x52, 0x54,
0x44, 0x44,
] ]),
}) iso7816::SelectOccurrence::First,
{ )
ctg_pipe .await?;
.send(pipe::CardToGUI::ProcessingMessage {
message: String::from("Card is not eID"),
})
.await;
ctg_pipe.send(pipe::CardToGUI::WaitForCard).await;
continue;
}
break crad; // Select _its_ MF (what?)
}; iso7816::select(
&mut crad,
0,
iso7816::SelectFile::File(&[]),
iso7816::SelectOccurrence::First,
)
.await?;
let creds = loop { iso7816::select(
// Select the PCA application &mut crad,
iso7816::select( 0,
&mut crad, iso7816::files::EF_CARDACCESS,
0, iso7816::SelectOccurrence::First,
iso7816::SelectFile::DedicatedFileName(&[ )
0xA0, 0x00, 0x00, 0x07, 0x88, 0x50, 0x43, 0x41, 0x2D, 0x65, 0x4D, 0x52, 0x54, 0x44, .await?;
]), let ef_cardaccess_bytes = iso7816::read_binary(&mut crad, 0).await?.unwrap();
iso7816::SelectOccurrence::First, let ef_cardaccess = pace::SecurityInfos::from_der(&ef_cardaccess_bytes).unwrap();
)
.await?;
// Select _its_ MF (what?) let (msg, can_continue) = match pace::set_authentication_template(
iso7816::select( &mut crad,
&mut crad, ef_cardaccess.get(0).unwrap().protocol,
0, pace::PasswordType::PIN,
iso7816::SelectFile::File(&[]), )
iso7816::SelectOccurrence::First, .await
) {
.await?; Ok(()) => (None, true),
Err(pace::PACEStatus::CardError(e)) => return Err(e),
Err(pace::PACEStatus::TriesLeft(n)) => (Some(format!("{} tries left", n)), true),
Err(pace::PACEStatus::Error(unk)) => {
(Some(format!("Unknown error {:04x}", unk)), false)
}
Err(pace::PACEStatus::PasswordSuspended) => {
(Some("PIN suspended. Use app.".to_string()), false)
}
Err(pace::PACEStatus::PasswordBlocked) => {
(Some("PIN blocked. Use app.".to_string()), false)
}
};
iso7816::select( if can_continue {
&mut crad, ctg_pipe
0, .send(pipe::CardToGUI::ReadyForPIN { message: msg })
iso7816::files::EF_CARDACCESS, .await;
iso7816::SelectOccurrence::First, } else {
) ctg_pipe
.await?; .send(pipe::CardToGUI::ProcessingMessage {
let ef_cardaccess_bytes = iso7816::read_binary(&mut crad, 0).await?.unwrap(); message: msg.unwrap(),
let ef_cardaccess = pace::SecurityInfos::from_der(&ef_cardaccess_bytes).unwrap(); })
.await;
let (msg, can_continue) = match pace::set_authentication_template(
&mut crad,
ef_cardaccess.get(0).unwrap().protocol,
pace::PasswordType::PIN,
)
.await
{
Ok(()) => (None, true),
Err(pace::PACEStatus::CardError(e)) => return Err(e),
Err(pace::PACEStatus::TriesLeft(n)) => (Some(format!("{} tries left", n)), true),
Err(pace::PACEStatus::Error(unk)) => {
(Some(format!("Unknown error {:04x}", unk)), false)
} }
Err(pace::PACEStatus::PasswordSuspended) => {
(Some("PIN suspended. Use app.".to_string()), false) let wait_until_not_present = crad.wait_until_not_present();
} let next_command = gtc_pipe.recv();
Err(pace::PACEStatus::PasswordBlocked) => {
(Some("PIN blocked. Use app.".to_string()), false) select! {
_ = wait_until_not_present => {
continue 'outer;
}
val = next_command => {
let GUIToCard::PIN(pin) = val.unwrap();
ctg_pipe
.send(pipe::CardToGUI::ProcessingMessage {
message: String::from("Negotiating with the card..."),
})
.await;
match pace::authenticate_pin(
&mut crad,
pin.as_bytes(),
ef_cardaccess.get(0).unwrap().protocol,
)
.await
{
Ok(creds) => break creds,
Err(pace::PACEStatus::CardError(n)) => return Err(n),
_ => (),
}
}
} }
}; };
if can_continue { break (crad, creds);
ctg_pipe
.send(pipe::CardToGUI::ReadyForPIN { message: msg })
.await;
} else {
ctg_pipe
.send(pipe::CardToGUI::ProcessingMessage {
message: msg.unwrap(),
})
.await;
}
let GUIToCard::PIN(pin) = gtc_pipe.recv().await.unwrap();
ctg_pipe
.send(pipe::CardToGUI::ProcessingMessage {
message: String::from("Negotiating with the card..."),
})
.await;
match pace::authenticate_pin(
&mut crad,
pin.as_bytes(),
ef_cardaccess.get(0).unwrap().protocol,
)
.await
{
Ok(creds) => break creds,
Err(pace::PACEStatus::CardError(n)) => return Err(n),
_ => (),
}
}; };
let apdus; let apdus;

18
src/pcsc_card.rs
View file

@ -1,8 +1,10 @@
use std::{collections::HashMap, ffi::CString};
use std::sync::{Arc, Mutex}; use std::sync::{Arc, Mutex};
use std::time::Duration;
use std::{collections::HashMap, ffi::CString};
use pcsc::{PNP_NOTIFICATION, Protocols, ReaderState, State}; use pcsc::{PNP_NOTIFICATION, Protocols, ReaderState, State, Status};
use tokio::task::spawn_blocking; use tokio::task::spawn_blocking;
use tokio::time::sleep;
use crate::{Card, ResultAPDU}; use crate::{Card, ResultAPDU};
@ -81,6 +83,18 @@ impl PCSCCard {
} }
} }
} }
pub async fn wait_until_not_present(&self) {
loop {
sleep(Duration::from_millis(500)).await;
let Ok(status) = self.card.status2_owned() else {
break;
};
if !status.status().contains(Status::PRESENT) {
break;
}
}
}
} }
struct PCSCCardFinderInner { struct PCSCCardFinderInner {