Wednesday, June 8, 2016

UEFI Smart Card Reader Protocol implementation

Last year (May 2015) I presented the new UEFI (Unified Extensible Firmware Interface Specification) protocol called "Smart Card Reader Protocol" in the article "UEFI Smart Card Reader Protocol".

I also presented a sample Hello World application in "PCSC sample in C for UEFI".

Source code

The source code of my implementation of the protocol is available in my github edk2 project. Be sure to use the SmartCard branch.

The source code of the Hello World application and some other test/debug tools is available in my github UEFI-SmartCardReader-Samples project.

Integration in TianoCore

My "Smart Card Reader Protocol" implementation is a port of my CCID driver. So the core of the driver uses the same GNU LGPL v2+ license.
I proposed my implementation on the edk2-devel mailing list in "[edk2] [PATCH 0/4] Add an implementation of EFI_SMART_CARD_READER_PROTOCOL".

Unfortunately the copyleft license GNU LGPL v2+ is a problem for some TianoCore members. So my code was not integrated in TianoCore (a reference implementation of UEFI) and I moved to something else.

Conclusion

You can use my implementation of the "Smart Card Reader Protocol". Be careful the GNU LGPL v2+ license is fine with your project.

Sunday, May 29, 2016

New version of pcsc-lite: 1.8.17

I just released a new version of pcsc-lite 1.8.17.
pcsc-lite is a Free Software implementation of the PC/SC (or WinSCard) API for Unix systems.

Changes:
1.8.17: Ludovic Rousseau
29 May 2016
  • Fix SCardEndTransaction() issue with a SCARD_SHARE_EXCLUSIVE connection
  • Fix an issue when used with systemd (problem in signal handler)
  • SCardGetAttrib(): set pcbAttrLen when buffer is too small
  • Doxygen: SCardGetAttrib() pbAttr can be NULL
  • Doxygen: SCardGetAttrib() *pcbAttrLen contains the buffer size
  • fix compilation warnings and link errors on SunOS
  • Some other minor improvements

Friday, May 27, 2016

PySCard 1.9.4 released

I just released a new official version 1.9.4 of pyscard. PySCard is a python module adding smart cards support (PC/SC) to Python.

The PySCard project is available at:

Changes

1.9.4 (May 2016)
  • Fix installation using pip and easy_install
  • Avoid El Capitan SCardGetAttrib bug
  • CardConnection: Add context management
  • PCSCCardConnection: raise NoCardException if SCARD_E_NO_SMARTCARD
  • Stop CardMonitor monitor thread after traceback print.
  • minor improvements

1.9.3 (March 2016)
  • Fix SCardControl() on Windows 7
  • Fix installation using pip and easy_install

Monday, May 23, 2016

OS X El Capitan 10.11.5 and CCID driver fix

As explained in my previous article "OS X El Capitan 10.11.5 and CCID driver still broken" the upgrade to 10.11.5 did not fix the CCID driver issue.

To fix the issue you have to download and install the "OS X El Capitan 10.11.5 Combo Update".

The file size is 1.5 GB. You can install it even if you already upgraded your system to 10.11.5.

Fixed CCID driver

Now I have:
$ pwd
/usr/libexec/SmartCardServices/drivers
$ ls -lR ifd-ccid.bundle/
total 0
drwxr-xr-x  5 root  wheel  170 23 mai 18:54 Contents

ifd-ccid.bundle//Contents:
total 24
-rw-r--r--  1 root  wheel  36860 21 déc 06:05 Info.plist
drwxr-xr-x  6 root  wheel    204 23 mai 18:54 MacOS
-rw-r--r--  1 root  wheel    470 21 déc 06:05 version.plist

ifd-ccid.bundle//Contents/MacOS:
total 512
lrwxr-xr-x  1 root  wheel      20 23 mai 18:52 libccid.dylib -> libccid.dylib.1.4.21
-rwxr-xr-x  1 root  wheel  165888 17 sep  2015 libccid.dylib.1.4.14
-rwxr-xr-x  1 root  wheel  166096  3 déc 07:33 libccid.dylib.1.4.20
-rwxr-xr-x  1 root  wheel  166096  5 mai 08:02 libccid.dylib.1.4.21

Note that the symbolic link libccid.dylib now points to the latest driver version.

The files libccid.dylib.1.4.14 and libccid.dylib.1.4.20 are now useless and could be removed. But because of System Integrity Protection it is not easy and I think I will not remove them.

Conclusion

The problem should now be fixed.

If you installed a copy of the CCID driver in /usr/local/libexec/SmartCardServices/drivers/ as suggested by some people you may want to remove it now to avoid conflicts with the Apple provided CCID driver.

Sunday, May 22, 2016

New version of libccid: 1.4.24

I just released a version 1.4.24 of libccid the Free Software CCID class smart card reader driver.

Changes:
1.4.24 - 22 May 2016, Ludovic Rousseau
  • Add support of
    • Generic USB Smart Card Reader
    • Giesecke & Devrient GmbH StarSign CUT S
    • HID AVIATOR Generic
  • better support of Elatec TWN4 SmartCard NFC
  • better support of SCM SCL011
  • betetr support of HID Aviator generic
  • fix SCARD_ATTR_VENDOR_IFD_SERIAL_NO attribute size
  • fix a race condition on card events with multiple readers
  • Some minor improvements

Friday, May 20, 2016

OS X El Capitan 10.11.5 and CCID driver still broken

Mac OS X El Capitan version 10.11.5 is now available. The Apple documentation "About the OS X El Capitan v10.11.5 Update" does not mention the CCID driver. But I am not surprised since many bugs have been fixed but are not listed in the upgrade message.

Unfortunately the problem reported in "OS X El Capitan and CCID driver upgrades" is still not fixed.

OS X 10.11.5

On Mac OS X 10.11.5 I have:

$ pwd
/usr/libexec/SmartCardServices/drivers

$ ls -lR ifd-ccid.bundle/
total 0
drwxr-xr-x  5 root  wheel  170 23 mar 09:30 Contents

ifd-ccid.bundle//Contents:
total 24
-rw-r--r--  1 root  wheel  36860 21 déc 06:05 Info.plist
drwxr-xr-x  6 root  wheel    204 23 mar 09:30 MacOS
-rw-r--r--  1 root  wheel    470 21 déc 06:05 version.plist

ifd-ccid.bundle//Contents/MacOS:
total 512
lrwxr-xr-x  1 root  wheel      20  4 nov  2015 libccid.dylib -> libccid.dylib.1.4.14
-rwxr-xr-x  1 root  wheel  165888 17 sep  2015 libccid.dylib.1.4.14
-rwxr-xr-x  1 root  wheel  166096  3 déc 07:33 libccid.dylib.1.4.20
-rwxr-xr-x  1 root  wheel  166096 12 mar 09:30 libccid.dylib.1.4.21

In my case the CCID driver is working but the driver binary is still wrong. I still have an half upgrade with the Info.plist file from CCID version 1.4.21 but the libccid.dylib binary is from CCID version 1.4.14.

Broken upgrade

If you had a broken upgrade with a file libccid.dylib either missing or pointing to a non existing file you may still have the same problem.

Proposed solution

The solution I proposed is still valid. See "OS X El Capitan and CCID driver upgrades".

I don't like the idea to install another CCID driver in /usr/local/ since that will/may create new problems when Apple fixes the original problem.

Conclusion

I reported a new bug at Apple as bug #26396810 "CCID smart card reader driver update not fixed in 10.11.5".

Update

On 24th May 2016, Apple closed my bug report as a duplicate:
Engineering has determined that your bug report (26396810) is a duplicate of another issue (26328490) and will be closed.

Friday, April 22, 2016

OS X El Capitan and CCID driver upgrades

Silent upgrade of the CCID driver

This is part of the series: "OS X El Capitan and smart cards: known bugs".

The first version of El Capitan 10.11 in September, 2015 was provided with the CCID driver version 1.4.14. See "OS X El Capitan and smart cards status" for more details.

I recently discovered that Apple upgraded the CCID driver in the minor upgrades (also thanks to Martin P. for the notice):
  • Mac OS X 10.11.3 provides the CCID driver version 1.4.20 (driver released 5 August 2015)
  • Mac OS X 10.11.4 provides the CCID driver version 1.4.21 (driver released 21 October 2015)

OS X 10.11

On Mac OS X 10.11 (or 10.11.0) I have:
$ ls -lR /usr/libexec/SmartCardServices/drivers
total 0
drwxr-xr-x  3 root  wheel  102 23 aoû  2015 ifd-ccid.bundle

/usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle:
total 0
drwxr-xr-x  5 root  wheel  170  5 oct  2015 Contents

/usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle/Contents:
total 56
-rw-r--r--  1 root  wheel  27616  5 oct  2015 Info.plist
drwxr-xr-x  4 root  wheel    136  2 oct  2015 MacOS
-rw-r--r--  1 root  wheel    471 23 aoû  2015 version.plist

/usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle/Contents/MacOS:
total 176
lrwxr-xr-x  1 root  wheel      20  2 oct  2015 libccid.dylib -> libccid.dylib.1.4.14
-rwxr-xr-x  1 root  wheel  165888 17 sep  2015 libccid.dylib.1.4.14

OS X 10.11.3

On Mac OS X 10.11.3 I have:

$ ls -lR /usr/libexec/SmartCardServices/drivers
total 0
drwxr-xr-x  3 root  wheel  102 Aug 23  2015 ifd-ccid.bundle

/usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle:
total 0
drwxr-xr-x  5 root  wheel  170 Jan 28 10:05 Contents

/usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle/Contents:
total 24
-rw-r--r--  1 root  wheel  33873 Sep 23  2015 Info.plist
drwxr-xr-x  5 root  wheel    170 Jan 28 10:05 MacOS
-rw-r--r--  1 root  wheel    469 Sep 23  2015 version.plist

/usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle/Contents/MacOS:
total 344
lrwxr-xr-x  1 root  wheel      20 Dec  9 15:06 libccid.dylib -> libccid.dylib.1.4.14
-rwxr-xr-x  1 root  wheel  165888 Oct 18  2015 libccid.dylib.1.4.14
-rwxr-xr-x  1 root  wheel  166096 Jan 14 03:06 libccid.dylib.1.4.20


OS X 10.11.4

On Mac OS X 10.11.4 I have:

$ pwd
/Volumes/ElCapitan/usr/libexec/SmartCardServices/drivers

$ ls -lR ifd-ccid.bundle/
total 0
drwxr-xr-x  5 root  wheel  170 Mar 22 13:23 Contents

ifd-ccid.bundle//Contents:
total 24
-rw-r--r--  1 root  wheel  36860 Dec 21 06:05 Info.plist
drwxr-xr-x  5 root  wheel    170 Mar 22 13:23 MacOS
-rw-r--r--  1 root  wheel    470 Dec 21 06:05 version.plist

ifd-ccid.bundle//Contents/MacOS:
total 344
lrwxr-xr-x  1 root  wheel      20 Sep 16  2015 libccid.dylib -> libccid.dylib.1.4.14
-rwxr-xr-x  1 root  wheel  165888 Sep  3  2015 libccid.dylib.1.4.14
-rwxr-xr-x  1 root  wheel  166096 Mar 12 09:30 libccid.dylib.1.4.21

Half upgrade

What is strange is that only the driver Info.plist file has been updated. A new binary driver is installed (libccid.dylib.1.4.20 or libccid.dylib.1.4.21) but not used.

The driver Info.plist file contains:

<key>CFBundleExecutable</key>
 <string>libccid.dylib</string>

So the driver binary is always the file libccid.dylib. And, as you can see from the previous commands libccid.dylib is just a symbolic link to the same libccid.dylib.1.4.14 file.

It looks like the upgrade is not complete:
  • New readers present in the driver Info.plist file will be recognized
  • Bugs fixes and new code from versions 1.4.15 to 1.4.21 are not used since the driver binary used is still at version 1.4.14.

Broken upgrade

Some/many people reported that the CCID driver was not working any more after the 10.11.4 upgrade. I have not (yet) reproduce this problem myself.

The driver configuration looks like this:

/usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle/Contents/MacOS:
lrwxr-xr-x 1 root wheel         20    3 déc 08:37   libccid.dylib -> libccid.dylib.1.4.20
-rwxr-xr-x 1 root wheel     166096   12 mar 09:30   libccid.dylib.1.4.21

The symbolic link points to a non-existent libccid.dylib.1.4.20 file. So, of course, the driver is not loaded and the support of CCID readers is broken.

Error message in the system log file:
com.apple.ifdreader[219]: Failed to load IFD bundle executable:
'file:///usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle/' with error: Error Domain=NSCocoaErrorDomain Code=4 "The bundle “CCIDCLASSDRIVER” couldn’t be loaded because its executable couldn’t be located." UserInfo={NSLocalizedFailureReason=The bundle’s executable couldn’t be located., NSLocalizedRecoverySuggestion=Try reinstalling the bundle., NSBundlePath=/usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle, NSLocalizedDescription=The bundle “CCIDCLASSDRIVER” couldn’t be loaded because its executable couldn’t be located.}

Proposed solution

Because of System Integrity Protection [or wikipedia], it is forbidden to change/remove/add files in the /usr/ directory.

My proposal to fix the issue, until Apple provides a fix, is to:
  1. disable SIP
  2. fix the symbolic link using some think like
    cd /usr/libexec/SmartCardServices/drivers/ifd-ccid.bundle/Contents/MacOS
    ln -sf libccid.dylib.1.4.21 libccid.dylib
  3. enable SIP

Another solution

In the Apple developer forums "gtall" reported the same problem in "el capitan 10.11.4 unable to see smartcard" and "Metsma" posted a different workaround.

Maybe Apple will publish a Technical Note to give a better solution or, better, provide a version 10.11.5 with a fix for the CCID driver.

Conclusion

I reported the problem to Apple as bug #25873806 "CCID smart card reader driver update failed in 10.11.4".

That is the first time that Apple updates a smart card component (instead of just fixing bugs) with minor revisions of Mac OS X. Maybe it is a sign that Apple cares about smart cards?

My list of El Capitan known smart card bugs contains 7 unfixed bugs and 3 wanted features. There is still Apple work to do for the next (minor or major) release of Mac OS X.

Update

On 26th April 2016, Apple closed my bug report as a duplicate:
"Engineering has determined that your bug report (25873806) is a duplicate of another issue (25416818) and will be closed."