[Qemu-devel] [PATCH 2/3] libcacard: Lock NSS cert db when selecting an applet on an emulated card

[Ray Strode]

From: Ray Strode <address@hidden>

When a process in a guest uses an emulated smartcard, libcacard running
on the host passes the PIN from the guest to the PK11_Authenticate NSS
function. The first time PK11_Authenticate is called the passed in PIN
is used to unlock the certificate database. Subsequent calls to
PK11_Authenticate will transparently succeed, regardless of the passed in
PIN. This is a convenience for applications provided by NSS.

Of course, the guest may have many applications using the one emulated
smart card all driven from the same host QEMU process.  That means if a
user enters the right PIN in one program in the guest, and then enters the
wrong PIN in another program in the guest, the wrong PIN will still
successfully unlock the virtual smartcard.

This commit forces the NSS certificate database to be locked anytime an
applet is selected on an emulated smartcard by calling vcard_emul_logout.

Signed-off-by: Ray Strode <address@hidden>
Reviewed-By: Robert Relyea <address@hidden>
Reviewed-By: Alon Levy <address@hidden>
---
 libcacard/vcard.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libcacard/vcard.c b/libcacard/vcard.c
index 87ad516..d140a8e 100644
--- a/libcacard/vcard.c
+++ b/libcacard/vcard.c
@@ -223,60 +223,65 @@ vcard_find_applet(VCard *card, unsigned char *aid, int 
aid_len)
 {
     VCardApplet *current_applet;
 
     for (current_applet = card->applet_list; current_applet;
                                         current_applet = current_applet->next) 
{
         if (current_applet->aid_len != aid_len) {
             continue;
         }
         if (memcmp(current_applet->aid, aid, aid_len) == 0) {
             break;
         }
     }
     return current_applet;
 }
 
 unsigned char *
 vcard_applet_get_aid(VCardApplet *applet, int *aid_len)
 {
     if (applet == NULL) {
         return NULL;
     }
     *aid_len = applet->aid_len;
     return applet->aid;
 }
 
 
 void
 vcard_select_applet(VCard *card, int channel, VCardApplet *applet)
 {
     assert(channel < MAX_CHANNEL);
+
+    /* If using an emulated card, make sure to log out of any already logged in
+     * session. */
+    vcard_emul_logout(card);
+
     card->current_applet[channel] = applet;
     /* reset the applet */
     if (applet && applet->reset_applet) {
         applet->reset_applet(card, channel);
     }
 }
 
 VCardAppletPrivate *
 vcard_get_current_applet_private(VCard *card, int channel)
 {
     VCardApplet *applet = card->current_applet[channel];
 
     if (applet == NULL) {
         return NULL;
     }
     return applet->applet_private;
 }
 
 VCardStatus
 vcard_process_applet_apdu(VCard *card, VCardAPDU *apdu,
                           VCardResponse **response)
 {
     if (card->current_applet[apdu->a_channel]) {
         return card->current_applet[apdu->a_channel]->process_apdu(
                                                         card, apdu, response);
     }
     return VCARD_NEXT;
 }
 
 /*
-- 
2.1.0