RfidResearchGroup/proxmark3
1
1
Fork 0
mirror of https://github.com/RfidResearchGroup/proxmark3.git synced 2024-11-11 01:55:38 +08:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #55 from merlokk/der_print

Browse source 
add DER certificate print in TLV mode
This commit is contained in:
RFID Research Group 2018-11-15 18:03:26 +01:00 committed by GitHub
commit 16d84a4eaa
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 2768 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
client/Makefile
View file

@ -108,6 +108,7 @@ CMDSRCS = crapto1/crapto1.c \
mfkey.c \
tea.c \
fido/additional_ca.c \
crypto/asn1dump.c \
crypto/libpcrypto.c\
crypto/asn1utils.c\
cliparser/argtable3.c\

23
client/cmdhffido.c
View file

@ -209,6 +209,7 @@ int CmdHFFidoRegister(const char *cmd) {
arg_lit0("aA", "apdu", "show APDU reqests and responses"),
arg_litn("vV", "verbose", 0, 2, "show technical data. vv - show full certificates data"),
arg_lit0("pP", "plain", "send plain ASCII to challenge and application parameters instead of HEX"),
arg_lit0("tT", "tlv", "Show DER certificate contents in TLV representation"),
arg_str0("jJ", "json", "fido.json", "JSON input / output file name for parameters."),
arg_str0(NULL, NULL, "<HEX/ASCII challenge parameter (32b HEX/1..16 chars)>", NULL),
arg_str0(NULL, NULL, "<HEX/ASCII application parameter (32b HEX/1..16 chars)>", NULL),
@ -220,10 +221,11 @@ int CmdHFFidoRegister(const char *cmd) {
bool verbose = arg_get_lit(2);
bool verbose2 = arg_get_lit(2) > 1;
bool paramsPlain = arg_get_lit(3);
bool showDERTLV = arg_get_lit(4);
char fname[250] = {0};
bool err;
root = OpenJson(4, fname, argtable, &err);
root = OpenJson(5, fname, argtable, &err);
if(err)
return 1;
if (root) {
@ -234,13 +236,13 @@ int CmdHFFidoRegister(const char *cmd) {
if (paramsPlain) {
memset(cdata, 0x00, 32);
CLIGetStrWithReturn(5, cdata, &chlen);
CLIGetStrWithReturn(6, cdata, &chlen);
if (chlen && chlen > 16) {
PrintAndLog("ERROR: challenge parameter length in ASCII mode must be less than 16 chars instead of: %d", chlen);
return 1;
}
} else {
CLIGetHexWithReturn(5, cdata, &chlen);
CLIGetHexWithReturn(6, cdata, &chlen);
if (chlen && chlen != 32) {
PrintAndLog("ERROR: challenge parameter length must be 32 bytes only.");
return 1;
@ -252,13 +254,13 @@ int CmdHFFidoRegister(const char *cmd) {
if (paramsPlain) {
memset(adata, 0x00, 32);
CLIGetStrWithReturn(6, adata, &applen);
CLIGetStrWithReturn(7, adata, &applen);
if (applen && applen > 16) {
PrintAndLog("ERROR: application parameter length in ASCII mode must be less than 16 chars instead of: %d", applen);
return 1;
}
} else {
CLIGetHexWithReturn(6, adata, &applen);
CLIGetHexWithReturn(7, adata, &applen);
if (applen && applen != 32) {
PrintAndLog("ERROR: application parameter length must be 32 bytes only.");
return 1;
@ -328,7 +330,7 @@ int CmdHFFidoRegister(const char *cmd) {
int derLen = (buf[derp + 2] << 8) + buf[derp + 3] + 4;
if (verbose2) {
PrintAndLog("DER certificate[%d]:\n------------------DER-------------------", derLen);
dump_buffer_simple((const unsigned char *)&buf[67 + keyHandleLen], derLen, NULL);
dump_buffer_simple((const unsigned char *)&buf[derp], derLen, NULL);
PrintAndLog("\n----------------DER---------------------");
} else {
if (verbose)
@ -339,7 +341,12 @@ int CmdHFFidoRegister(const char *cmd) {
// check and print DER certificate
uint8_t public_key[65] = {0};
// TODO: print DER certificate in DER view
// print DER certificate in TLV view
if (showDERTLV) {
PrintAndLog("----------------DER TLV-----------------");
asn1_print(&buf[derp], derLen, " ");
PrintAndLog("----------------DER TLV-----------------");
}
// load CA's
mbedtls_x509_crt cacert;
@ -354,7 +361,7 @@ int CmdHFFidoRegister(const char *cmd) {
// load DER certificate from authenticator's data
mbedtls_x509_crt cert;
mbedtls_x509_crt_init(&cert);
res = mbedtls_x509_crt_parse_der(&cert, &buf[67 + keyHandleLen], derLen);
res = mbedtls_x509_crt_parse_der(&cert, &buf[derp], derLen);
if (res) {
PrintAndLog("ERROR: DER parse returned 0x%x - %s", (res<0)?-res:res, ecdsa_get_error(res));
}

353
client/crypto/asn1dump.c Normal file
View file

@ -0,0 +1,353 @@
//-----------------------------------------------------------------------------
// Copyright (C) 2018 Merlok
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// asn.1 dumping
//-----------------------------------------------------------------------------
#include "asn1dump.h"
#include <ctype.h>
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <jansson.h>
#include <mbedtls/asn1.h>
#include <mbedtls/oid.h>
#include "emv/emv_tags.h"
#include "emv/dump.h"
#include "emv/emvjson.h"
#include "util.h"
#include "proxmark3.h"
#define PRINT_INDENT(level) {for (int i = 0; i < (level); i++) fprintf(f, " ");}
enum asn1_tag_t {
ASN1_TAG_GENERIC,
ASN1_TAG_BOOLEAN,
ASN1_TAG_INTEGER,
ASN1_TAG_STRING,
ASN1_TAG_OCTET_STRING,
ASN1_TAG_UTC_TIME,
ASN1_TAG_STR_TIME,
ASN1_TAG_OBJECT_ID,
};
struct asn1_tag {
tlv_tag_t tag;
char *name;
enum asn1_tag_t type;
const void *data;
};
static const struct asn1_tag asn1_tags[] = {
// internal
{ 0x00 , "Unknown ???" },
// ASN.1
{ 0x01, "BOOLEAN", ASN1_TAG_BOOLEAN },
{ 0x02, "INTEGER", ASN1_TAG_INTEGER },
{ 0x03, "BIT STRING" },
{ 0x04, "OCTET STRING", ASN1_TAG_OCTET_STRING},
{ 0x05, "NULL" },
{ 0x06, "OBJECT IDENTIFIER", ASN1_TAG_OBJECT_ID },
{ 0x07, "OBJECT DESCRIPTOR" },
{ 0x08, "EXTERNAL" },
{ 0x09, "REAL" },
{ 0x0A, "ENUMERATED" },
{ 0x0B, "EMBEDDED_PDV" },
{ 0x0C, "UTF8String", ASN1_TAG_STRING },
{ 0x10, "SEQUENCE" },
{ 0x11, "SET" },
{ 0x12, "NumericString", ASN1_TAG_STRING },
{ 0x13, "PrintableString", ASN1_TAG_STRING },
{ 0x14, "T61String" },
{ 0x15, "VideotexString" },
{ 0x16, "IA5String" },
{ 0x17, "UTCTime", ASN1_TAG_UTC_TIME },
{ 0x18, "GeneralizedTime", ASN1_TAG_STR_TIME },
{ 0x19, "GraphicString" },
{ 0x1A, "VisibleString", ASN1_TAG_STRING },
{ 0x1B, "GeneralString", ASN1_TAG_STRING },
{ 0x1C, "UniversalString", ASN1_TAG_STRING },
{ 0x1E, "BMPString" },
{ 0x30, "SEQUENCE" },
{ 0x31, "SET" },
{ 0xa0, "[0]" },
{ 0xa1, "[1]" },
{ 0xa2, "[2]" },
{ 0xa3, "[3]" },
{ 0xa4, "[4]" },
{ 0xa5, "[5]" },
};
static int asn1_sort_tag(tlv_tag_t tag) {
return (int)(tag >= 0x100 ? tag : tag << 8);
}
static int asn1_tlv_compare(const void *a, const void *b) {
const struct tlv *tlv = a;
const struct asn1_tag *tag = b;
return asn1_sort_tag(tlv->tag) - (asn1_sort_tag(tag->tag));
}
static const struct asn1_tag *asn1_get_tag(const struct tlv *tlv) {
struct asn1_tag *tag = bsearch(tlv, asn1_tags, sizeof(asn1_tags) / sizeof(asn1_tags[0]),
sizeof(asn1_tags[0]), asn1_tlv_compare);
return tag ? tag : &asn1_tags[0];
}
static void asn1_tag_dump_str_time(const struct tlv *tlv, const struct asn1_tag *tag, FILE *f, int level, bool longyear, bool *needdump){
int len = tlv->len;
*needdump = false;
int startindx = longyear ? 4 : 2;
if (len > 4) {
fprintf(f, "\tvalue: '");
while (true) {
// year
if (!longyear)
fprintf(f, "20");
fwrite(tlv->value, 1, longyear ? 4 : 2, f);
fprintf(f, "-");
if (len < startindx + 2)
break;
// month
fwrite(&tlv->value[startindx], 1, 2, f);
fprintf(f, "-");
if (len < startindx + 4)
break;
// day
fwrite(&tlv->value[startindx + 2], 1, 2, f);
fprintf(f, " ");
if (len < startindx + 6)
break;
// hour
fwrite(&tlv->value[startindx + 4], 1, 2, f);
fprintf(f, ":");
if (len < startindx + 8)
break;
// min
fwrite(&tlv->value[startindx + 6], 1, 2, f);
fprintf(f, ":");
if (len < startindx + 10)
break;
// sec
fwrite(&tlv->value[startindx + 8], 1, 2, f);
if (len < startindx + 11)
break;
// time zone
fprintf(f, " zone: %.*s", len - 10 - (longyear ? 4 : 2), &tlv->value[startindx + 10]);
break;
}
fprintf(f, "'\n");
} else {
fprintf(f, "\n");
*needdump = true;
}
}
static void asn1_tag_dump_string(const struct tlv *tlv, const struct asn1_tag *tag, FILE *f, int level){
fprintf(f, "\tvalue: '");
fwrite(tlv->value, 1, tlv->len, f);
fprintf(f, "'\n");
}
static void asn1_tag_dump_octet_string(const struct tlv *tlv, const struct asn1_tag *tag, FILE *f, int level, bool *needdump){
*needdump = false;
for (int i = 0; i < tlv->len; i++)
if (!isspace(tlv->value[i]) && !isprint(tlv->value[i])){
*needdump = true;
break;
}
if (*needdump) {
fprintf(f, "'\n");
} else {
fprintf(f, "\t\t");
asn1_tag_dump_string(tlv, tag, f, level);
}
}
static unsigned long asn1_value_integer(const struct tlv *tlv, unsigned start, unsigned end) {
unsigned long ret = 0;
int i;
if (end > tlv->len * 2)
return ret;
if (start >= end)
return ret;
if (start & 1) {
ret += tlv->value[start/2] & 0xf;
i = start + 1;
} else
i = start;
for (; i < end - 1; i += 2) {
ret *= 10;
ret += tlv->value[i/2] >> 4;
ret *= 10;
ret += tlv->value[i/2] & 0xf;
}
if (end & 1) {
ret *= 10;
ret += tlv->value[end/2] >> 4;
}
return ret;
}
static void asn1_tag_dump_boolean(const struct tlv *tlv, const struct asn1_tag *tag, FILE *f, int level) {
PRINT_INDENT(level);
if (tlv->len > 0) {
fprintf(f, "\tvalue: %s\n", tlv->value[0]?"true":"false");
} else {
fprintf(f, "n/a\n");
}
}
static void asn1_tag_dump_integer(const struct tlv *tlv, const struct asn1_tag *tag, FILE *f, int level) {
PRINT_INDENT(level);
if (tlv->len == 4) {
int32_t val = 0;
for (int i = 0; i < tlv->len; i++)
val = (val << 8) + tlv->value[i];
fprintf(f, "\tvalue4b: %d\n", val);
return;
}
fprintf(f, "\tvalue: %lu\n", asn1_value_integer(tlv, 0, tlv->len * 2));
}
static char *asn1_oid_description(const char *oid, bool with_group_desc) {
json_error_t error;
json_t *root = NULL;
char fname[300] = {0};
static char res[300];
memset(res, 0x00, sizeof(res));
strcpy(fname, get_my_executable_directory());
strcat(fname, "crypto/oids.json");
if (access(fname, F_OK) < 0) {
strcpy(fname, get_my_executable_directory());
strcat(fname, "oids.json");
if (access(fname, F_OK) < 0) {
goto error; // file not found
}
}
// load `oids.json`
root = json_load_file(fname, 0, &error);
if (!root || !json_is_object(root)) {
goto error;
}
json_t *elm = json_object_get(root, oid);
if (!elm) {
goto error;
}
if (JsonLoadStr(elm, "$.d", res))
goto error;
char strext[300] = {0};
if (!JsonLoadStr(elm, "$.c", strext)) {
strcat(res, " (");
strcat(res, strext);
strcat(res, ")");
}
json_decref(root);
return res;
error:
if (root)
json_decref(root);
return NULL;
}
static void asn1_tag_dump_object_id(const struct tlv *tlv, const struct asn1_tag *tag, FILE *f, int level) {
PRINT_INDENT(level);
mbedtls_asn1_buf asn1_buf;
asn1_buf.len = tlv->len;
asn1_buf.p = (uint8_t *)tlv->value;
char pstr[300];
mbedtls_oid_get_numeric_string(pstr, sizeof(pstr), &asn1_buf);
fprintf(f, " %s", pstr);
char *jsondesc = asn1_oid_description(pstr, true);
if (jsondesc) {
fprintf(f, " - %s", jsondesc);
} else {
const char *ppstr;
mbedtls_oid_get_attr_short_name(&asn1_buf, &ppstr);
if (ppstr && strnlen(ppstr, 1)) {
fprintf(f, " (%s)\n", ppstr);
return;
}
mbedtls_oid_get_sig_alg_desc(&asn1_buf, &ppstr);
if (ppstr && strnlen(ppstr, 1)) {
fprintf(f, " (%s)\n", ppstr);
return;
}
mbedtls_oid_get_extended_key_usage(&asn1_buf, &ppstr);
if (ppstr && strnlen(ppstr, 1)) {
fprintf(f, " (%s)\n", ppstr);
return;
}
}
fprintf(f, "\n");
}
bool asn1_tag_dump(const struct tlv *tlv, FILE *f, int level, bool *candump) {
if (!tlv) {
fprintf(f, "NULL\n");
return false;
}
const struct asn1_tag *tag = asn1_get_tag(tlv);
PRINT_INDENT(level);
fprintf(f, "--%2hx[%02zx] '%s':", tlv->tag, tlv->len, tag->name);
switch (tag->type) {
case ASN1_TAG_GENERIC:
fprintf(f, "\n");
break;
case ASN1_TAG_STRING:
asn1_tag_dump_string(tlv, tag, f, level);
*candump = false;
break;
case ASN1_TAG_OCTET_STRING:
asn1_tag_dump_octet_string(tlv, tag, f, level, candump);
break;
case ASN1_TAG_BOOLEAN:
asn1_tag_dump_boolean(tlv, tag, f, level);
*candump = false;
break;
case ASN1_TAG_INTEGER:
asn1_tag_dump_integer(tlv, tag, f, level);
*candump = false;
break;
case ASN1_TAG_UTC_TIME:
asn1_tag_dump_str_time(tlv, tag, f, level, false, candump);
break;
case ASN1_TAG_STR_TIME:
asn1_tag_dump_str_time(tlv, tag, f, level, true, candump);
break;
case ASN1_TAG_OBJECT_ID:
asn1_tag_dump_object_id(tlv, tag, f, level);
*candump = false;
break;
};
return true;
}

21
client/crypto/asn1dump.h Normal file
View file

@ -0,0 +1,21 @@
//-----------------------------------------------------------------------------
// Copyright (C) 2018 Merlok
//
// This code is licensed to you under the terms of the GNU GPL, version 2 or,
// at your option, any later version. See the LICENSE.txt file for the text of
// the license.
//-----------------------------------------------------------------------------
// asn.1 dumping
//-----------------------------------------------------------------------------
#ifndef ASN1DUMP_H
#define ASN1DUMP_H
#include <stdint.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdio.h>
#include "emv/tlv.h"
extern bool asn1_tag_dump(const struct tlv *tlv, FILE *f, int level, bool *candump);
#endif /* asn1utils.h */

28
client/crypto/asn1utils.c
View file

@ -9,7 +9,13 @@
//-----------------------------------------------------------------------------
#include "asn1utils.h"
#include <ctype.h>
#include <stdlib.h>
#include <mbedtls/asn1.h>
#include "emv/tlv.h"
#include "emv/dump.h"
#include "asn1dump.h"
#include "util.h"
int ecdsa_asn1_get_signature(uint8_t *signature, size_t signaturelen, uint8_t *rval, uint8_t *sval) {
if (!signature || !signaturelen || !rval || !sval)
@ -55,7 +61,27 @@ exit:
return res;
}
int asn1_print(uint8_t *asn1buf, int level) {
static bool print_cb(void *data, const struct tlv *tlv, int level, bool is_leaf) {
bool candump = true;
asn1_tag_dump(tlv, stdout, level, &candump);
if (is_leaf && candump) {
dump_buffer(tlv->value, tlv->len, stdout, level);
}
return true;
}
int asn1_print(uint8_t *asn1buf, size_t asn1buflen, char *indent) {
struct tlvdb *t = NULL;
t = tlvdb_parse_multi(asn1buf, asn1buflen);
if (t) {
tlvdb_visit(t, print_cb, NULL, 0);
tlvdb_free(t);
} else {
PrintAndLogEx(ERR, "Can't parse data as TLV tree.");
return 1;
}
return 0;
}

2
client/crypto/asn1utils.h
View file

@ -15,7 +15,7 @@
#include <stdbool.h>
#include <stddef.h>
extern int asn1_print(uint8_t *asn1buf, int level);
extern int asn1_print(uint8_t *asn1buf, size_t asn1buflen, char *indent);
extern int ecdsa_asn1_get_signature(uint8_t *signature, size_t signaturelen, uint8_t *rval, uint8_t *sval);
#endif /* asn1utils.h */

2325
client/crypto/oids.json Normal file
View file

File diff suppressed because it is too large Load diff

17
client/emv/emvjson.c
View file

@ -264,6 +264,23 @@ bool HexToBuffer(const char *errormsg, const char *hexvalue, uint8_t * buffer, s
return true;
}
int JsonLoadStr(json_t *root, char *path, char *value) {
if (!value)
return 1;
json_t *jelm = json_path_get((const json_t *)root, path);
if (!jelm || !json_is_string(jelm))
return 2;
const char * strval = json_string_value(jelm);
if (!strval)
return 1;
memcpy(value, strval, strlen(strval));
return 0;
}
int JsonLoadBufAsHex(json_t *elm, char *path, uint8_t *data, size_t maxbufferlen, size_t *datalen) {
if (datalen)
*datalen = 0;

1
client/emv/emvjson.h
View file

@ -33,6 +33,7 @@ extern int JsonSaveTLVTreeElm(json_t *elm, char *path, struct tlvdb *tlvdbelm, b
extern int JsonSaveTLVTree(json_t *root, json_t *elm, char *path, struct tlvdb *tlvdbelm);
extern int JsonLoadStr(json_t *root, char *path, char *value);
extern int JsonLoadBufAsHex(json_t *elm, char *path, uint8_t *data, size_t maxbufferlen, size_t *datalen);
extern bool ParamLoadFromJson(struct tlvdb *tlv);

15
client/emv/tlv.c
View file

@ -92,16 +92,15 @@ static size_t tlv_parse_len(const unsigned char **buf, size_t *len)
return l;
size_t ll = l &~ TLV_LEN_LONG;
if (*len < ll)
if (ll > 5)
return TLV_LEN_INVALID;
/* FIXME */
if (ll != 1)
return TLV_LEN_INVALID;
l = **buf;
--*len;
++*buf;
l = 0;
for (int i = 1; i <= ll; i++) {
l = (l << 8) + **buf;
--*len;
++*buf;
}
return l;
}