apdu.py 3.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147
  1. # Copyright 2016 Google Inc. All Rights Reserved.
  2. #
  3. # Licensed under the Apache License, Version 2.0 (the "License");
  4. # you may not use this file except in compliance with the License.
  5. # You may obtain a copy of the License at
  6. #
  7. # http://www.apache.org/licenses/LICENSE-2.0
  8. #
  9. # Unless required by applicable law or agreed to in writing, software
  10. # distributed under the License is distributed on an "AS IS" BASIS,
  11. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  12. # See the License for the specific language governing permissions and
  13. # limitations under the License.
  14. """Implement the U2F variant of ISO 7816 extended APDU.
  15. This module implements a subset ISO 7816 APDU encoding. In particular,
  16. it only supports extended length encoding, it only supports commands
  17. that expect a reply, and it does not support explicitly specifying
  18. the length of the expected reply.
  19. It also implements the U2F variant of ISO 7816 where the Lc field
  20. is always specified, even if there is no data.
  21. """
  22. import struct
  23. from pyu2f import errors
  24. CMD_REGISTER = 0x01
  25. CMD_AUTH = 0x02
  26. CMD_VERSION = 0x03
  27. class CommandApdu(object):
  28. """Represents a Command APDU.
  29. Represents a Command APDU sent to the security key. Encoding
  30. is specified in FIDO U2F standards.
  31. """
  32. cla = None
  33. ins = None
  34. p1 = None
  35. p2 = None
  36. data = None
  37. def __init__(self, cla, ins, p1, p2, data=None):
  38. self.cla = cla
  39. self.ins = ins
  40. self.p1 = p1
  41. self.p2 = p2
  42. if data and len(data) > 65535:
  43. raise errors.InvalidCommandError()
  44. if data:
  45. self.data = data
  46. def ToByteArray(self):
  47. """Serialize the command.
  48. Encodes the command as per the U2F specs, using the standard
  49. ISO 7816-4 extended encoding. All Commands expect data, so
  50. Le is always present.
  51. Returns:
  52. Python bytearray of the encoded command.
  53. """
  54. lc = self.InternalEncodeLc()
  55. out = bytearray(4) # will extend
  56. out[0] = self.cla
  57. out[1] = self.ins
  58. out[2] = self.p1
  59. out[3] = self.p2
  60. if self.data:
  61. out.extend(lc)
  62. out.extend(self.data)
  63. out.extend([0x00, 0x00]) # Le
  64. else:
  65. out.extend([0x00, 0x00, 0x00]) # Le
  66. return out
  67. def ToLegacyU2FByteArray(self):
  68. """Serialize the command in the legacy format.
  69. Encodes the command as per the U2F specs, using the legacy
  70. encoding in which LC is always present.
  71. Returns:
  72. Python bytearray of the encoded command.
  73. """
  74. lc = self.InternalEncodeLc()
  75. out = bytearray(4) # will extend
  76. out[0] = self.cla
  77. out[1] = self.ins
  78. out[2] = self.p1
  79. out[3] = self.p2
  80. out.extend(lc)
  81. if self.data:
  82. out.extend(self.data)
  83. out.extend([0x00, 0x00]) # Le
  84. return out
  85. def InternalEncodeLc(self):
  86. dl = 0
  87. if self.data:
  88. dl = len(self.data)
  89. # The top two bytes are guaranteed to be 0 by the assertion
  90. # in the constructor.
  91. fourbyte = struct.pack('>I', dl)
  92. return bytearray(fourbyte[1:])
  93. class ResponseApdu(object):
  94. """Represents a Response APDU.
  95. Represents a Response APU sent by the security key. Encoding
  96. is specified in FIDO U2F standards.
  97. """
  98. body = None
  99. sw1 = None
  100. sw2 = None
  101. def __init__(self, data):
  102. self.dbg_full_packet = data
  103. if not data or len(data) < 2:
  104. raise errors.InvalidResponseError()
  105. if len(data) > 2:
  106. self.body = data[:-2]
  107. self.sw1 = data[-2]
  108. self.sw2 = data[-1]
  109. def IsSuccess(self):
  110. return self.sw1 == 0x90 and self.sw2 == 0x00
  111. def CheckSuccessOrRaise(self):
  112. if self.sw1 == 0x69 and self.sw2 == 0x85:
  113. raise errors.TUPRequiredError()
  114. elif self.sw1 == 0x6a and self.sw2 == 0x80:
  115. raise errors.InvalidKeyHandleError()
  116. elif self.sw1 == 0x69 and self.sw2 == 0x84:
  117. raise errors.InvalidKeyHandleError()
  118. elif not self.IsSuccess():
  119. raise errors.ApduError(self.sw1, self.sw2)