From ludovic.rousseau at gmail.com  Sun Mar  3 06:08:26 2024
From: ludovic.rousseau at gmail.com (Ludovic Rousseau)
Date: Sun, 3 Mar 2024 15:08:26 +0100
Subject: [Pcsclite-muscle] New version of pcsc-lite: 2.0.2
Message-ID: <CAGstE8DNO67d4xKQOuqg1Oh1P4YcUDvRxp8ozCqqhy0L0Y9Ysw@mail.gmail.com>

Hello,

I just released a new version of pcsc-lite 2.0.2

This version fixes issues with the protocol negotiation algorithm.

We should not try to use a protocol that is not in the preferred ones
from the application. If the application requests to use T=1 only but
the card does support T=0 & T=1, and the reader does support T=0 only
we should NOT try to use T=0 but fail instead.

SCardConnect() & SCardReconnect() will now return SCARD_E_PROTO_MISMATCH.

This should match the Windows behaviour.

Changes:
2.0.2: Ludovic Rousseau
3 March 2024
- SCardConnect() & SCardReconnect(): restrict the protocol used
- negotiate PTS also for the backup protocol
- pcscd.8:
  . document --disable-polkit
  . add "CONFIGURATION FILE" section
- Some other minor improvements

https://blog.apdu.fr/posts/2024/03/new-version-of-pcsc-lite-202/
https://pcsclite.apdu.fr/
https://github.com/LudovicRousseau/PCSC
https://salsa.debian.org/rousseau/PCSC

-- 
 Dr. Ludovic Rousseau


From ludovic.rousseau at gmail.com  Sun Mar  3 13:02:55 2024
From: ludovic.rousseau at gmail.com (Ludovic Rousseau)
Date: Sun, 3 Mar 2024 22:02:55 +0100
Subject: [Pcsclite-muscle] New version of pcsc-lite: 2.0.2
In-Reply-To: <CAGstE8DNO67d4xKQOuqg1Oh1P4YcUDvRxp8ozCqqhy0L0Y9Ysw@mail.gmail.com>
References: <CAGstE8DNO67d4xKQOuqg1Oh1P4YcUDvRxp8ozCqqhy0L0Y9Ysw@mail.gmail.com>
Message-ID: <CAGstE8CMXUEDfn_nHJ7Ck56GE-=wjKs2c=0RRBwUn_R_N8c1CA@mail.gmail.com>

And now a version 2.0.3
https://blog.apdu.fr/posts/2024/03/new-version-of-pcsc-lite-203/

Le dim. 3 mars 2024 ? 15:08, Ludovic Rousseau
<ludovic.rousseau at gmail.com> a ?crit :
>
> Hello,
>
> I just released a new version of pcsc-lite 2.0.2
>
> This version fixes issues with the protocol negotiation algorithm.
>
> We should not try to use a protocol that is not in the preferred ones
> from the application. If the application requests to use T=1 only but
> the card does support T=0 & T=1, and the reader does support T=0 only
> we should NOT try to use T=0 but fail instead.
>
> SCardConnect() & SCardReconnect() will now return SCARD_E_PROTO_MISMATCH.
>
> This should match the Windows behaviour.
>
> Changes:
> 2.0.2: Ludovic Rousseau
> 3 March 2024
> - SCardConnect() & SCardReconnect(): restrict the protocol used
> - negotiate PTS also for the backup protocol
> - pcscd.8:
>   . document --disable-polkit
>   . add "CONFIGURATION FILE" section
> - Some other minor improvements
>
> https://blog.apdu.fr/posts/2024/03/new-version-of-pcsc-lite-202/
> https://pcsclite.apdu.fr/
> https://github.com/LudovicRousseau/PCSC
> https://salsa.debian.org/rousseau/PCSC
>
> --
>  Dr. Ludovic Rousseau



-- 
 Dr. Ludovic Rousseau


From ludovic.rousseau at gmail.com  Fri Mar 15 14:59:03 2024
From: ludovic.rousseau at gmail.com (Ludovic Rousseau)
Date: Fri, 15 Mar 2024 22:59:03 +0100
Subject: [Pcsclite-muscle] Delegate WinSCard calls to another library (for a
 RDP server for example)
Message-ID: <CAGstE8Ad7N5uBpNNG4=nhF1EXO+hrR+R=z+w6op+P32y9ovzkg@mail.gmail.com>

Hello,

I am working on a new idea for pcsc-lite: Delegate WinSCard calls to
another library

The application will call SCardEstablishContext() (for example) as
before but the call is not directly sent to libpcsclite.so.1. Instead
we have a intermediate library that can redirect the call somewhere
else.

Use cases:
- the other library can be libpcscspy.0.dylib to generate a debug
trace (simpler use for
https://blog.apdu.fr/posts/2022/06/pcsc-api-spy-update/)
- the other library can be libpcsclite-xrdp.so.0 to redirect the PC/SC
calls to the RDP server and then to the RDP client
- something else. I am interested in reading your other ideas

The redirection is done by defining the environment variable
LIBPCSCLITE_DELEGATE before running the PC/SC application.

To avoid security problems the variable LIBPCSCLITE_DELEGATE is
ignored if the process is run as root. The default library (real
libpcsclite) is used instead.

You can have more details and a discussion in
https://github.com/LudovicRousseau/PCSC/issues/161

What do you think?
Should I change something?
Ideas? comments?

Thanks

-- 
 Dr. Ludovic Rousseau


From saper at saper.info  Fri Mar 15 18:35:33 2024
From: saper at saper.info (Marcin Cieslak)
Date: Sat, 16 Mar 2024 01:35:33 +0000
Subject: [Pcsclite-muscle] Delegate WinSCard calls to another library
 (for a RDP server for example)
In-Reply-To: <CAGstE8Ad7N5uBpNNG4=nhF1EXO+hrR+R=z+w6op+P32y9ovzkg@mail.gmail.com>
References: <CAGstE8Ad7N5uBpNNG4=nhF1EXO+hrR+R=z+w6op+P32y9ovzkg@mail.gmail.com>
Message-ID: <8o3n3127-p34q-7ns4-2rr7-1s223o2sop05@fncre.vasb>

On Fri, 15 Mar 2024, Ludovic Rousseau wrote:

> Hello,
>
> I am working on a new idea for pcsc-lite: Delegate WinSCard calls to
> another library
>
> The application will call SCardEstablishContext() (for example) as
> before but the call is not directly sent to libpcsclite.so.1. Instead
> we have a intermediate library that can redirect the call somewhere
> else.

I think the same effect could be achieved with the runtime linker
filter feature, see https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter4-4.html
"Shared Objects as Filters".

I don't know for macOS, but FreeBSD has moved its system calls
out of the libc using this feature. I guess it is available
to other systems, not only BSD and Solaris.

Marcin


From ludovic.rousseau at gmail.com  Sat Mar 16 03:54:06 2024
From: ludovic.rousseau at gmail.com (Ludovic Rousseau)
Date: Sat, 16 Mar 2024 11:54:06 +0100
Subject: [Pcsclite-muscle] Delegate WinSCard calls to another library
 (for a RDP server for example)
In-Reply-To: <8o3n3127-p34q-7ns4-2rr7-1s223o2sop05@fncre.vasb>
References: <CAGstE8Ad7N5uBpNNG4=nhF1EXO+hrR+R=z+w6op+P32y9ovzkg@mail.gmail.com>
 <8o3n3127-p34q-7ns4-2rr7-1s223o2sop05@fncre.vasb>
Message-ID: <CAGstE8C4oFGaPW_pMh8Mx_CrWkMZ+r1SJGzt11R5X6rQEDG5uw@mail.gmail.com>

Hello Marcin,

Le sam. 16 mars 2024 ? 02:35, Marcin Cieslak <saper at saper.info> a ?crit :
>
> On Fri, 15 Mar 2024, Ludovic Rousseau wrote:
>
> > Hello,
> >
> > I am working on a new idea for pcsc-lite: Delegate WinSCard calls to
> > another library
> >
> > The application will call SCardEstablishContext() (for example) as
> > before but the call is not directly sent to libpcsclite.so.1. Instead
> > we have a intermediate library that can redirect the call somewhere
> > else.
>
> I think the same effect could be achieved with the runtime linker
> filter feature, see https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter4-4.html
> "Shared Objects as Filters".

This looks very interesting.

> I don't know for macOS, but FreeBSD has moved its system calls
> out of the libc using this feature. I guess it is available
> to other systems, not only BSD and Solaris.

I could not find the GNU GCC documentation for this "Shared Objects as
Filters" feature.

And it looks like gcc or clang do not support it:
gcc -o filtee.so.1 -G -K pic filtee.c
gcc: error: unrecognized command-line option ?-G?
gcc: error: unrecognized command-line option ?-K?

clang -o filtee.so.1 -G -K pic filtee.c
clang: error: no such file or directory: 'pic'

If I remove "pic" argument:
clang -o filtee.so.1 -G -K filtee.c
clang: warning: argument unused during compilation: '-G -K'
[-Wunused-command-line-argument]
/usr/bin/ld: /lib/x86_64-linux-gnu/Scrt1.o: in function `_start':
(.text+0x17): undefined reference to `main'
clang: error: linker command failed with exit code 1 (use -v to see invocation)

Shared Objects as Filters looks to be a *BSD and Solaris specific feature.
Maybe GNU/Linux has a similar mechanism but I have not yet found it.

Regards,

--
 Dr. Ludovic Rousseau


From Ralf.Jahns at de.bosch.com  Tue Mar 19 07:35:04 2024
From: Ralf.Jahns at de.bosch.com (Jahns Ralf (XC-CP/ECP3))
Date: Tue, 19 Mar 2024 14:35:04 +0000
Subject: [Pcsclite-muscle] CCID problem, request for help
Message-ID: <GV1PR10MB62185A472BC252956C43707CA62C2@GV1PR10MB6218.EURPRD10.PROD.OUTLOOK.COM>

Hello,


thank you for reading this and thank you for your time in advance.

I try to set up a microchip SEC1210 reader by UART interface on my Ubuntu 20.04 standard desktop PC.

I have downloaded, built and (as far as I can see) installed version 1.5.5 of CCID.

Pcsc lite version:
/usr/sbin/pcscd --version
pcsc-lite version 1.8.26.

The output of
sudo LIBCCID_ifdLogLevel=0x000F pcscd --foreground --debug --apdu --color | tee -i log.txt
is attached.

There are two error messages in the log:
ifdhandler.c:194:CreateChannelByNameOrChannel() failed
readerfactory.c:1105:RFInitializeReader() Open Port 0x0 Failed (/dev/ttyUSB0)

No cardreader can be found:
$ sudo pcsc_scan
Using reader plug'n play mechanism
Scanning present readers...
Waiting for the first reader... \   
$ sudo opensc-tool -l 
No smart card readers found.
$ sudo pkcs15-tool -D
No smart card readers found.

Any help would be highly appreciated.


Mit freundlichen Gr??en / Best regards

Ralf Jahns

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: log.txt
URL: <http://lists.infradead.org/pipermail/pcsclite-muscle/attachments/20240319/1b0496dd/attachment-0001.txt>

From Ralf.Jahns at de.bosch.com  Wed Mar 20 07:15:18 2024
From: Ralf.Jahns at de.bosch.com (Jahns Ralf (XC-CP/ECP3))
Date: Wed, 20 Mar 2024 14:15:18 +0000
Subject: [Pcsclite-muscle] CCID problem, request for help
Message-ID: <GV1PR10MB6218490205DACBE840F4801DA6332@GV1PR10MB6218.EURPRD10.PROD.OUTLOOK.COM>

Hello,


sorry, I'm new to this whole SmartCard topic.

The Reader doesn't answer the call to CmdGetSlotStatus (timeout) for SlotIndex 01.


Mit freundlichen Gr??en / Best regards

Ralf Jahns


From ludovic.rousseau at gmail.com  Wed Mar 20 15:13:43 2024
From: ludovic.rousseau at gmail.com (Ludovic Rousseau)
Date: Wed, 20 Mar 2024 23:13:43 +0100
Subject: [Pcsclite-muscle] CCID problem, request for help
In-Reply-To: <GV1PR10MB62185A472BC252956C43707CA62C2@GV1PR10MB6218.EURPRD10.PROD.OUTLOOK.COM>
References: <GV1PR10MB62185A472BC252956C43707CA62C2@GV1PR10MB6218.EURPRD10.PROD.OUTLOOK.COM>
Message-ID: <CAGstE8B8hvxom87K+9wEAVf3Zb9+=hEMjkOwf-VogN38_9Ce5w@mail.gmail.com>

Le mar. 19 mars 2024 ? 15:36, Jahns Ralf (XC-CP/ECP3)
<Ralf.Jahns at de.bosch.com> a ?crit :
>
> Hello,

Hello Jahns,

> thank you for reading this and thank you for your time in advance.
>
> I try to set up a microchip SEC1210 reader by UART interface on my Ubuntu 20.04 standard desktop PC.
>
> I have downloaded, built and (as far as I can see) installed version 1.5.5 of CCID.
>
> Pcsc lite version:
> /usr/sbin/pcscd --version
> pcsc-lite version 1.8.26.
>
> The output of
> sudo LIBCCID_ifdLogLevel=0x000F pcscd --foreground --debug --apdu --color | tee -i log.txt
> is attached.
>
> There are two error messages in the log:
> ifdhandler.c:194:CreateChannelByNameOrChannel() failed
> readerfactory.c:1105:RFInitializeReader() Open Port 0x0 Failed (/dev/ttyUSB0)
>
> No cardreader can be found:
> $ sudo pcsc_scan
> Using reader plug'n play mechanism
> Scanning present readers...
> Waiting for the first reader... \
> $ sudo opensc-tool -l
> No smart card readers found.
> $ sudo pkcs15-tool -D
> No smart card readers found.
>
> Any help would be highly appreciated.

First thing is to detail your configuration and generate a correct log file.
https://ccid.apdu.fr/#support

Bye

-- 
 Dr. Ludovic Rousseau


From ludovic.rousseau at gmail.com  Fri Mar 22 15:17:16 2024
From: ludovic.rousseau at gmail.com (Ludovic Rousseau)
Date: Fri, 22 Mar 2024 23:17:16 +0100
Subject: [Pcsclite-muscle] Delegate WinSCard calls to another library
 (for a RDP server for example)
In-Reply-To: <CAGstE8Ad7N5uBpNNG4=nhF1EXO+hrR+R=z+w6op+P32y9ovzkg@mail.gmail.com>
References: <CAGstE8Ad7N5uBpNNG4=nhF1EXO+hrR+R=z+w6op+P32y9ovzkg@mail.gmail.com>
Message-ID: <CAGstE8C+mypp2RSE=2aOG_LWaavidXJ518YSAZdWhRAtNq-2aQ@mail.gmail.com>

Hello,

I have not received many contributions.

Some people added comments in https://github.com/LudovicRousseau/PCSC/issues/161
Thank you for that.

If you think that adding support of LIBPCSCLITE_DELEGATE is a bad idea
then please explain.
I have not yet added the code in the official pcsc-lite.
I think it will help the support of smart cards by RDP servers running
on Unix. And that is not a (new) security issue.
But you may think differently.

Bye

Le ven. 15 mars 2024 ? 22:59, Ludovic Rousseau
<ludovic.rousseau at gmail.com> a ?crit :
>
> Hello,
>
> I am working on a new idea for pcsc-lite: Delegate WinSCard calls to
> another library
>
> The application will call SCardEstablishContext() (for example) as
> before but the call is not directly sent to libpcsclite.so.1. Instead
> we have a intermediate library that can redirect the call somewhere
> else.
>
> Use cases:
> - the other library can be libpcscspy.0.dylib to generate a debug
> trace (simpler use for
> https://blog.apdu.fr/posts/2022/06/pcsc-api-spy-update/)
> - the other library can be libpcsclite-xrdp.so.0 to redirect the PC/SC
> calls to the RDP server and then to the RDP client
> - something else. I am interested in reading your other ideas
>
> The redirection is done by defining the environment variable
> LIBPCSCLITE_DELEGATE before running the PC/SC application.
>
> To avoid security problems the variable LIBPCSCLITE_DELEGATE is
> ignored if the process is run as root. The default library (real
> libpcsclite) is used instead.
>
> You can have more details and a discussion in
> https://github.com/LudovicRousseau/PCSC/issues/161
>
> What do you think?
> Should I change something?
> Ideas? comments?
>
> Thanks
>
> --
>  Dr. Ludovic Rousseau



-- 
 Dr. Ludovic Rousseau


From godfreyhkchung at gmail.com  Wed Mar 27 21:39:55 2024
From: godfreyhkchung at gmail.com (Godfrey Chung)
Date: Thu, 28 Mar 2024 12:39:55 +0800
Subject: [Pcsclite-muscle] acsccid 1.1.11 Released
Message-ID: <CAF8LfwK8BQM0nOixvKXHHKEajPJ1LR1uU25SgFG7W_StYSUKLg@mail.gmail.com>

Dear All

I would like to inform you that acsccid 1.1.11 had been released.

v1.1.11 (25/3/2024)
- Add the following readers support:
  WalletMate II 1S CL Reader
  WalletMate II V2 Upgrade
  ACR1555 1S CL Reader
  ACR1555 USB FW_Upgrade
- Enable WalletMate II (composite device) as multi-slot reader.
- Enable the 2nd interface of WalletMate II as SAM slot.
- Enable ACR1555U (composite device) as multi-slot reader.
- Enable the 2nd interface of ACR1555U as SAM slot.

Please download it from http://acsccid.sourceforge.net/.

Regards

Godfrey


From suffsuccotash at gmail.com  Sun Mar 31 15:41:27 2024
From: suffsuccotash at gmail.com (Daffy Duck)
Date: Sun, 31 Mar 2024 17:41:27 -0500
Subject: [Pcsclite-muscle] chrome flatpak and pcscd
Message-ID: <8677b0adcfae0a0f77c4a0fec516af438fb801b4.camel@gmail.com>

Hello,

I'm on Fedora 39 and have been having continuous issues with Google
chrome rpm.

It was recommended I switch to chrome from flatpak, but now I can't
access my smart card from inside flatpak chrome.

The CAC Module is added here:

~/.pki/nssdb

library=/usr/lib/p11-kit-proxy.so
name=CAC Module

in pkcs11.txt

but the browser doesn't see it. ?Is there something else I need to do
to get smart card working from chrome flatpak?

Thanks!



From saper at saper.info  Sun Mar 31 15:53:27 2024
From: saper at saper.info (Marcin Cieslak)
Date: Sun, 31 Mar 2024 22:53:27 +0000
Subject: [Pcsclite-muscle] chrome flatpak and pcscd
In-Reply-To: <8677b0adcfae0a0f77c4a0fec516af438fb801b4.camel@gmail.com>
References: <8677b0adcfae0a0f77c4a0fec516af438fb801b4.camel@gmail.com>
Message-ID: <30rp4s17-2225-0067-0sq6-rnprnq6s3p32@fncre.vasb>

On Sun, 31 Mar 2024, Daffy Duck wrote:

> but the browser doesn't see it. ?Is there something else I need to do
> to get smart card working from chrome flatpak?

I think the whole idea of flatpak is to isolate the browser from the environment?

https://github.com/flatpak/flatpak/issues/4066
https://github.com/flatpak/flatpak/issues/4723
https://github.com/LudovicRousseau/PCSC/issues/118

There are workarounds:

https://blog.apdu.fr/posts/2022/02/accessing-smart-cards-from-inside/

Not easy, but apparently possible. (I use pcscd with Firefox and chromium
on FreeBSD without major issues, no clue about Fedora).

Marcin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3706 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.infradead.org/pipermail/pcsclite-muscle/attachments/20240331/ad050af4/attachment.p7s>

From suffsuccotash at gmail.com  Sun Mar 31 16:35:42 2024
From: suffsuccotash at gmail.com (Daffy Duck)
Date: Sun, 31 Mar 2024 18:35:42 -0500
Subject: [Pcsclite-muscle] chrome flatpak and pcscd
In-Reply-To: <30rp4s17-2225-0067-0sq6-rnprnq6s3p32@fncre.vasb>
References: <8677b0adcfae0a0f77c4a0fec516af438fb801b4.camel@gmail.com>
	 <30rp4s17-2225-0067-0sq6-rnprnq6s3p32@fncre.vasb>
Message-ID: <ccf12774e1b1daaebf55e4cbd0d0182cc1b5c3ff.camel@gmail.com>

Ok, I have followed the instructions on there and now I run:

flatpak run fr.apdu.pcsc_scan 
PC/SC device scanner
V 1.7.1 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau at free.fr>
Using reader plug'n play mechanism
Scanning present readers...
0: SCM Microsystems Inc. SCR 331 [CCID Interface] (604026F5) 00 00
 
Sun Mar 31 18:31:36 2024
 Reader 0: SCM Microsystems Inc. SCR 331 [CCID Interface] (604026F5) 00
00
  Event number: 0
  Card state: Card inserted, Shared Mode, 
  ATR: 3B F9 18 00 00 00 53 43 45 37 20 03 00 20 46
 / 


---

But how do I now get chrome to recognize the CAC reader again? ?I used
flatseal and added ~/.pki/nssdb

Do I need to do anything else?



On Sun, 2024-03-31 at 22:53 +0000, Marcin Cieslak wrote:
> On Sun, 31 Mar 2024, Daffy Duck wrote:
> 
> > but the browser doesn't see it. ?Is there something else I need to do
> > to get smart card working from chrome flatpak?
> 
> I think the whole idea of flatpak is to isolate the browser from the environment?
> 
> https://github.com/flatpak/flatpak/issues/4066
> https://github.com/flatpak/flatpak/issues/4723
> https://github.com/LudovicRousseau/PCSC/issues/118
> 
> There are workarounds:
> 
> https://blog.apdu.fr/posts/2022/02/accessing-smart-cards-from-inside/
> 
> Not easy, but apparently possible. (I use pcscd with Firefox and chromium
> on FreeBSD without major issues, no clue about Fedora).
> 
> Marcin


