EAC: Fix compatiility with OpenSSL 3.0 and remove "APDU firewall" #2674
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
I can confirm this fixes the problem mentioned in #2646. I hope it gets accepted soon, so I can then rebase the eOI support. |
The content of the APDUs is still verified by the card. In OpenSC, checking the certificate validity, and the signatures matching some portions of the content was implemented, but never enabled. Since this is only useful in few corner cases, we now remove this functionality.
certificate description has no long term use anymore
opensc is now patched with all necessities in order to avoid this hack
4 tasks
5 tasks
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In #2646 the EAC implementation has been tested with OpenSSL 3.0 and it was found that the APDU encoding doesn't work for OpenSSL 3+ anymore (see this discussion). In order to fix this problem, the encoding/decoding has now been rewritten with OpenSC's ASN.1 parser.
Additionally this PR removes some sanity checks when transmitting encrypted APDUs. This is only useful when OpenSC is used as "transport layer" for communicating with a card, e.g. in ccid-emulator. Since this is a niche use case, sanity checks are removed from OpenSC and should now be done in the calling application if needed.
Also, note the small fixes to the build system.
Checklist