Draft
Conversation
Signed-off-by: Ludovic Rousseau <ludovic.rousseau@free.fr>
SYS_GetEnv() uses secure_getenv() if available. Thanks to matt335672 for the report.
Define LIBPCSCLITE_DELEGATE to load another library than the normal libpcsclite_real.so.1.
We do no need to play with a "_nospy" version since we use a redirector library. The real pcsclite library is now always "libpcsclite_real.so.1".
The script set and display the correct value to use for LIBPCSCLITE_DELEGATE.
No need to declare g_rgSCardT0Pci, g_rgSCardT1Pci and g_rgSCardRawPci also in delagated libraries.
No need to declare the function in delegated libraries. They then only need to declare WinSCard standard functions.
This can be used as a starting point when writting a new libpcsclite replacement.
DYN_LoadLibrary() is now:
void * DYN_LoadLibrary(const char *);
to fix a warning:
libredirect.c: In function 'load_lib':
libredirect.c:155:38: error: passing argument 1 of 'DYN_LoadLibrary' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
155 | Lib_handle = DYN_LoadLibrary(lib);
| ^~~
It is now possible to specfy the libpcsclite to use. The default value is "libpcsclite_real.so.1" but you can specify something else like a XRDP pcsc library.
If a process is run as root (either suid, sudo, etc.) then we do NOT honor the value of LIBPCSCLITE_DELEGATE to avoid an attacker to redirect the functions.
Same reason as for LIBPCSCLITE_DELEGATE.
Log2() is not available in the redirection lib. /usr/bin/ld: ./.libs/libpcsclite.so: undefined reference to `log_msg' Log2() is used in SYS_RandomInt() that is not called by the redirection library so no problem here.
CFLAGS is already included in the compilation rule.
We do not have to provide TODO, INSTALL and other files anymore. https://www.gnu.org/software/automake/manual/automake.html foreign Automake will check for only those things that are absolutely required for proper operation. For instance, whereas GNU standards dictate the existence of a NEWS file, it will not be required in this mode. This strictness will also turn off some warnings by default (among them, portability warnings).
src/spy/Makefile.am:7: warning: source file '../sys_unix.c' is in a subdirectory, src/spy/Makefile.am:7: but option 'subdir-objects' is disabled automake: warning: possible forward-incompatibility. automake: At least one source file is in a subdirectory, but the 'subdir-objects' automake: automake option hasn't been enabled. For now, the corresponding output automake: object file(s) will be placed in the top-level directory. However, this automake: behavior may change in a future Automake major version, with object automake: files being placed in the same subdirectory as the corresponding sources. automake: You are advised to start using 'subdir-objects' option throughout your automake: project, to avoid future incompatibilities.
By default /usr/sbin is not in user PATH. So ldconfig(8) was not found.
The "libpcscspy.so" file may not be installed. For example that is the case on Debian.
log_msg() function is not available for libpcsclite.so or libpcscspy.so.
The test if now using PCSCD.
Signed-off-by: Ludovic Rousseau <ludovic.rousseau@free.fr>
Fix the library loading by dlopen(), for example with OpenSC. $ LIBPCSCLITE_DELEGATE=/lib/x86_64-linux-gnu/libpcscspy.so.0 opensc-tool -a loading "/lib/x86_64-linux-gnu/libpcscspy.so.0" failed: /lib/x86_64-linux-gnu/libpcscspy.so.0: undefined symbol: pcsc_stringify_error No smart card readers found. Failed to connect to reader: No readers found
The field from pcsc_stringify_error() is no more present in the trace file.
If IFD_GENERATE_HOTPLUG is defined by all USB drivers:
<key>ifdCapabilities</key>
<string>0x00000001</string>
<!-- Possible values for ifdCapabilities bits
1: IFD_GENERATE_HOTPLUG
plugging the reader calls pcscd \-\-hotplug
Default value is 0x00000000
-->
then the hotplug mechanism does not use polling to rescan the USB bus
but waits for pcscd to be called with "--hotplug" to rescan the USB bus
and serial configurations.
This case was not handled correctly on pcscd exit and the
HPEstablishUSBNotifications thread was not terminated.
Make sure the hotplug_libusb cleanup code is executed on all exit branches from the thread. This prevents memory and resource leaks on these codepaths. Before the commit, it was possible that the cleanup code in HPRescanUsbBus() would be skipped if the caller (HPEstablishUSBNotifications()) decides to exit on its own. Also libusb_exit() was skipped in some branches. The commit moves the cleanup code to the end of HPEstablishUSBNotifications() and removes pthread_exit() from HPRescanUsbBus(), so that cleanup isn't skipped.
Fix the possibility that the hotplug_libusb rescan thread remains read()'ing from the rescan pipe throughout the daemon shutdown process. This is possible because the |rescan_pipe| is created with some delay after the hotplug mechanism is initialized: HPEstablishUSBNotifications() first notifies about the initialization via writing to |pipefd|, and only then creates |rescan_pipe|. So if HPStopHotPluggables() is called in between, it'll end up doing nothing, letting the hotplug thread sit infinitely long on the read() call meanwhile the main daemon thread is shutting down. The proposed fix is to create |rescan_pipe| in advance, so that the shutdown logic is guaranteed to be able to write a byte to it, notifying the background thread about the shutdown regardless of when it happens.
Remove a call to pthread_mutex_unlock() to have only 1 unlock() call per lock() call.
Signed-off-by: Ludovic Rousseau <ludovic.rousseau@free.fr>
My host is installed with a Rocky Linux 9.x
It should be the same with other distros.
When PCSC is started, I can observe the following in /var/log/messages:
```
...
Dec 05 16:22:43 Host-9A38CE systemd[1]: /usr/lib/systemd/system/pcscd.service:32: Failed to parse boolean value, ignoring: identity
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...
```
This comes from the following line, in pcscd.service:
```
RuntimeDirectoryPreserve=true
```
When `true` is replaced by `yes`, the error is no more seen.
By the way, the rest of pcscd.service is already using `yes`.
systemd Fails to parse boolean value.
Check we can use SCardListReaders() while SCardGetStatusChange() is running.
meson: Add force_systemdunit option
PCSCLITE_CSOCK_NAME is used by the client side ilibpcsclite only. It has not impact on the daemon pcscd.
PCSCLITE_NO_BLOCKING is used by the client side ilibpcsclite only. It has not impact on the daemon pcscd.
The generic hotplug does nothing and, maybe, should not be used.
The client side (libpcsclite) now supports protocol version 4:5 (as before) and also 4:4. Protocol 4:5 was introduced with pcsc-lite 2.3.0 in Aug 2024. Protocol 4:4 was introduced with pcsc-lite 1.8.24 in Oct 2018. So now libpcsclite can work with a pcscd as old as 2018.
This happens when the server and the client do not share the same communication protocol version.
The server now also supports clients using the previous communication protocol 4:4 in addition to 4:5. Protocol 4:5 was introduced with pcsc-lite 2.3.0 in Aug 2024. Protocol 4:4 was introduced with pcsc-lite 1.8.24 in Oct 2018. Protocol 4:5 adds the command CMD_GET_READER_EVENTS. This command will not be used by older clients. They will just work as if the server was also using protocol version 4:4.
This should be used only when no udevd daemon is running. For example when pcscd is used in a minimal initramfs. This has side effects: - Device unplug will not be notified so do not remove the device until pcscd is terminated. - The libusb used by the libccid driver will not rescan the USB bus so it is a one shot only. You can add reader(s) only once. Fixes: LudovicRousseau/PCSC#244 " PCSCD not responding to SIGUSR1 when run with --disable-polkit #244 " Thanks to Cyber Link for the bug report.
Signed-off-by: Ludovic Rousseau <ludovic.rousseau@free.fr>
SCARD_SHARE_DIRECT & SCARD_LEAVE_CARD are not in PCSCPart10.
The pcsc_demo.c file header have been change in: commit b01f19f Author: Ludovic Rousseau <ludovic.rousseau@free.fr> Date: Sun Mar 7 14:29:02 2021 +0100 pcsc_demo: change licence from GPLv3 to BSD Use the same licence as the main code of pcsc-lite so the sample can be used by people who can't use GPL v3 code. Thanks to Fulup Ar Foll for the notice. But this change had not be reflected in the COPYING file. Thanks to Sébastien Dinot for the bug report Fixes: LudovicRousseau/PCSC#251 "Information raising doubts about the license #251"
If no PC/SC driver directory is present is not an error. The pcscd daemon will not find any driver but should not exit.
This is a correction of 2cf20c9 from 2012.
Thanks to Alexander for the bug report "src/simclist.c:397 NULL Pointer Dereference in list_append #182" Closes: LudovicRousseau/CCID#182
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sync with upstream 6667870
This bumps the fork to v2.4.1, which adds backwards compatibility support that we are currently lacking in Teleport.
I've also removed some remaining GPL-related non-code artifacts 373ea8b.
TODO: update tag for
2.4.1-teleportrelease