[rs-commit] r48 - /redwax-signtext/trunk/src/linux/crypto.c

[rs-commit at redwax.eu]

Author: minfrin at redwax.eu
Date: Wed Sep 14 16:53:17 2022
New Revision: 48

Log:
Limit certs to those where key usage allows sign.

Make sure PIN is used correctly in non-pinpad case.

Modified:
    redwax-signtext/trunk/src/linux/crypto.c

Modified: redwax-signtext/trunk/src/linux/crypto.c
==============================================================================
--- redwax-signtext/trunk/src/linux/crypto.c	(original)
+++ redwax-signtext/trunk/src/linux/crypto.c	Wed Sep 14 16:53:17 2022
@@ -32,12 +32,62 @@
                     gpointer data)
 {
   GckAttributes *attrs;
+
+  ksba_cert_t cert;
+
+  const guint8 *der;
+  gsize der_len;
+
   gulong category;
   gboolean is_ca;
+  unsigned int usage;
+
+  gpg_error_t err;
 
   if (!GCR_IS_PKCS11_CERTIFICATE(obj)) {
     return FALSE;
   }
+
+
+  der = gcr_certificate_get_der_data(GCR_CERTIFICATE(obj), &der_len);
+  if (!der) {
+    return FALSE;
+  }
+
+  err = ksba_cert_new(&cert);
+  if (err) {
+    return FALSE;
+  }
+
+  err = ksba_cert_init_from_mem(cert, der, der_len);
+  if (err) {
+    ksba_cert_release(cert);
+    return FALSE;
+  }
+
+  /*
+   * Is the key usage section missing?
+   *
+   * If so, ignore this cert.
+   */
+  err = ksba_cert_get_key_usage(cert, &usage);
+  if (err) {
+    ksba_cert_release(cert);
+    return FALSE;
+  }
+
+  /*
+   * Does our certificate report a key usage of KSBA_KEYUSAGE_DIGITAL_SIGNATURE?
+   *
+   * If not, the cert needs to be ignored.
+   */
+  if (!(usage & KSBA_KEYUSAGE_DIGITAL_SIGNATURE)) {
+    ksba_cert_release(cert);
+    return FALSE;
+  }
+
+  ksba_cert_release(cert);
+
 
   attrs = gcr_pkcs11_certificate_get_attributes(GCR_PKCS11_CERTIFICATE(obj));
 
@@ -888,17 +938,20 @@
   instance->session = gck_session_open_finish(res, &gerror);
   if (instance->session) {
 
-    if (gtk_widget_get_sensitive(GTK_WIDGET(instance->pin))) {
+    GckSlot *slot = gck_session_get_slot (instance->session);
+    GckTokenInfo *token_info = gck_slot_get_token_info (slot);
+
+    if (token_info->flags & CKF_PROTECTED_AUTHENTICATION_PATH) {
+
+      gck_session_login_async(instance->session, CKU_USER, NULL, 0, instance->signtext->cancellable, crypto_find_key, instance);
+
+    }
+    else {
 
       const guchar *pin = (guchar *)gtk_entry_buffer_get_text(instance->pin_buffer);
       gsize n_pin = gtk_entry_buffer_get_bytes(instance->pin_buffer);
 
       gck_session_login_async(instance->session, CKU_USER, pin, n_pin, instance->signtext->cancellable, crypto_find_key, instance);
-
-    }
-    else {
-
-      gck_session_login_async(instance->session, CKU_USER, NULL, 0, instance->signtext->cancellable, crypto_find_key, instance);
 
     }