fix Send Remaining command

canokeys · Oct 26, 2023 · a973f7d · a973f7d
1 parent 8e3705e
commit a973f7d
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 5 deletions.
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -468,6 +468,16 @@ jobs:
           PIVGenKeyCert $s "/CN=CertAtSlot$s/" RSA2048
           yubico-piv-tool -r "$RDID" -a import-certificate -s $s -i test-via-pcsc/long-cert.pem
         done
+
+    - name: Test the ckman Utility
+      run: |
+        pip3 install ckman
+        ckman --log-level DEBUG info
+        ckman oath accounts add steam1 HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ -i Steam
+        ckman oath accounts code
+        ckman openpgp info
+        ckman piv info
+        ckman fido credentials list --pin 123456
     
     - name: Prepare the Test Coverage Report
       run: |

diff --git a/applets/oath/oath.c b/applets/oath/oath.c
@@ -14,7 +14,8 @@
 
 static enum {
   REMAINING_NONE,
-  REMAINING_CALC,
+  REMAINING_CALC_FULL,
+  REMAINING_CALC_TRUNC,
   REMAINING_LIST,
 } oath_remaining_type;
 
@@ -529,7 +530,7 @@ static int oath_calculate_all(const CAPDU *capdu, RAPDU *rapdu) {
 
   if (P2 != 0x00 && P2 != 0x01) EXCEPT(SW_WRONG_P1P2);
 
-  oath_remaining_type = REMAINING_CALC;
+  oath_remaining_type = P2 ? REMAINING_CALC_TRUNC : REMAINING_CALC_FULL;
   int size = get_file_size(OATH_FILE);
   if (size < 0) return -1;
 
@@ -558,7 +559,7 @@ static int oath_calculate_all(const CAPDU *capdu, RAPDU *rapdu) {
     }
     size_t file_offset = record_idx * sizeof(OATH_RECORD);
     if (read_file(OATH_FILE, &record, file_offset, sizeof(OATH_RECORD)) < 0) return -1;
-    size_t estimated_len = 2 + record.name_len + 2 + 1 + (P2 ? 4 : SHA512_DIGEST_LENGTH);
+    size_t estimated_len = 2 + record.name_len + 2 + 1 + (oath_remaining_type == REMAINING_CALC_TRUNC ? 4 : SHA512_DIGEST_LENGTH);
     if (estimated_len + off_out > LE) {
       // shouldn't increase the record_idx in this case
       SW = 0x61FF; // more data available
@@ -587,7 +588,7 @@ static int oath_calculate_all(const CAPDU *capdu, RAPDU *rapdu) {
 
     if (oath_enforce_increasing(&record, file_offset, challenge_len, challenge) < 0) EXCEPT(SW_SECURITY_STATUS_NOT_SATISFIED);
 
-    if (P2) {
+    if (oath_remaining_type == REMAINING_CALC_TRUNC) {
       RDATA[off_out++] = OATH_TAG_RESPONSE;
       RDATA[off_out++] = 5;
       RDATA[off_out++] = record.key[1];
@@ -610,7 +611,7 @@ static int oath_calculate_all(const CAPDU *capdu, RAPDU *rapdu) {
 
 static int oath_send_remaining(const CAPDU *capdu, RAPDU *rapdu) {
   if (oath_remaining_type == REMAINING_LIST) return oath_list(capdu, rapdu);
-  if (oath_remaining_type == REMAINING_CALC) return oath_calculate_all(capdu, rapdu);
+  if (oath_remaining_type == REMAINING_CALC_FULL || oath_remaining_type == REMAINING_CALC_TRUNC) return oath_calculate_all(capdu, rapdu);
   EXCEPT(SW_CONDITIONS_NOT_SATISFIED);
 }
 

diff --git a/test/test_oath.c b/test/test_oath.c
@@ -19,6 +19,7 @@ static void test_helper_resp(uint8_t *data, size_t data_len, uint8_t ins, uint16
   RAPDU *rapdu = &R;
 
   capdu->ins = ins;
+  if (ins == OATH_INS_CALCULATE || ins == OATH_INS_SELECT) capdu->p2 = 1;
   capdu->lc = data_len;
   if (data_len > 0) {
     // re alloc to help asan find overflow error
@@ -275,6 +276,7 @@ static void test_calc_all(void **state) {
 
   capdu->ins = OATH_INS_SELECT;
   capdu->data = data;
+  capdu->p2 = 1;
   capdu->lc = sizeof(data);
   capdu->le = 64;
 
@@ -283,6 +285,7 @@ static void test_calc_all(void **state) {
   print_hex(RDATA, LL);
 
   capdu->ins = OATH_INS_SEND_REMAINING;
+  capdu->p2 = 0;
   capdu->le = 0xFF;
   oath_process_apdu(capdu, rapdu);
   assert_int_equal(rapdu->sw, SW_NO_ERROR);