1 /* packet-iso7816.c
2 * Routines for packet dissection of generic ISO 7816 smart card messages
3 * Copyright 2012-2013 by Martin Kaiser <martin@kaiser.cx>
4 *
5 * Wireshark - Network traffic analyzer
6 * By Gerald Combs <gerald@wireshark.org>
7 * Copyright 1998 Gerald Combs
8 *
9 * SPDX-License-Identifier: GPL-2.0-or-later
10 */
11
12 /* This dissector supports the command and response apdu structure
13 * as defined in ISO 7816-4. Detailed dissection of the APDUs defined
14 * in the ISO 7816 specifications will be added in the future.
15 *
16 * The dissection of Answer To Reset (ATR) messages was made a separate
17 * protocol so that it can be shared easily.
18 */
19
20
21 #include "config.h"
22
23 #include <epan/packet.h>
24 #include <epan/expert.h>
25 #include <epan/decode_as.h>
26
27 void proto_register_iso7816(void);
28 void proto_reg_handoff_iso7816(void);
29
30 static int proto_iso7816 = -1;
31 static int proto_iso7816_atr = -1;
32
33 static dissector_handle_t iso7816_handle;
34 static dissector_handle_t iso7816_atr_handle;
35
36 static wmem_tree_t *transactions = NULL;
37
38 static dissector_table_t iso7816_apdu_pld_table;
39
40 static int ett_iso7816 = -1;
41 static int ett_iso7816_class = -1;
42 static int ett_iso7816_param = -1;
43 static int ett_iso7816_p1 = -1;
44 static int ett_iso7816_p2 = -1;
45 static int ett_iso7816_atr = -1;
46 static int ett_iso7816_atr_ta = -1;
47 static int ett_iso7816_atr_td = -1;
48
49 static int hf_iso7816_atr_init_char = -1;
50 static int hf_iso7816_atr_t0 = -1;
51 static int hf_iso7816_atr_ta = -1;
52 /* these two fields hold the converted values Fi and Di,
53 not the binary representations FI and DI */
54 static int hf_iso7816_atr_ta1_fi = -1;
55 static int hf_iso7816_atr_ta1_di = -1;
56 static int hf_iso7816_atr_tb = -1;
57 static int hf_iso7816_atr_tc = -1;
58 static int hf_iso7816_atr_td = -1;
59 static int hf_iso7816_atr_next_ta_present = -1;
60 static int hf_iso7816_atr_next_tb_present = -1;
61 static int hf_iso7816_atr_next_tc_present = -1;
62 static int hf_iso7816_atr_next_td_present = -1;
63 static int hf_iso7816_atr_k = -1;
64 static int hf_iso7816_atr_t = -1;
65 static int hf_iso7816_atr_hist_bytes = -1;
66 static int hf_iso7816_atr_tck = -1;
67
68 static int hf_iso7816_resp_in = -1;
69 static int hf_iso7816_resp_to = -1;
70 static int hf_iso7816_cla = -1;
71 static int hf_iso7816_cla_sm = -1;
72 static int hf_iso7816_cla_channel = -1;
73 static int hf_iso7816_ins = -1;
74 static int hf_iso7816_p1 = -1;
75 static int hf_iso7816_p2 = -1;
76 static int hf_iso7816_lc = -1;
77 static int hf_iso7816_le = -1;
78 static int hf_iso7816_body = -1;
79 static int hf_iso7816_sw1 = -1;
80 static int hf_iso7816_sw2 = -1;
81 static int hf_iso7816_sel_file_ctrl = -1;
82 static int hf_iso7816_sel_file_fci_req = -1;
83 static int hf_iso7816_sel_file_occ = -1;
84 static int hf_iso7816_read_rec_ef = -1;
85 static int hf_iso7816_read_rec_usage = -1;
86 static int hf_iso7816_get_resp = -1;
87 static int hf_iso7816_offset_first_byte = -1;
88 static int hf_iso7816_rfu = -1;
89 static int hf_iso7816_application_data = -1;
90
91 static expert_field ie_iso7816_atr_tck_not1 = EI_INIT;
92
93 #define ADDR_INTF "Interface"
94 #define ADDR_CARD "Card"
95
96 typedef struct _iso7816_transaction_t {
97 guint32 cmd_frame;
98 guint32 resp_frame;
99 guint8 cmd_ins; /* instruction byte in the command apdu */
100 /* no need to add the channel number,
101 the response contains no channel number to compare this to
102 and the spec explicitly prohibits interleaving of command-response
103 pairs, regardless of logical channels */
104 dissector_handle_t handle;
105 } iso7816_transaction_t;
106
107 static const value_string iso7816_atr_init_char[] = {
108 { 0x3B, "Direct convention (A==0, Z==1, MSB==m9)" },
109 { 0x3F, "Inverse convention (A==1, Z==0, MSB==m2)" },
110 { 0, NULL }
111 };
112
113 static const value_string iso7816_cla_sm[] = {
114 { 0x00, "No SM" },
115 { 0x01, "Proprietary SM" },
116 { 0x02, "SM, command header not authenticated" },
117 { 0x03, "SM, command header authenticated" },
118 { 0, NULL }
119 };
120
121 #define INS_ERASE_BIN 0x0E
122 #define INS_VRFY 0x20
123 #define INS_MANAGE_CHANNEL 0x70
124 #define INS_EXT_AUTH 0x82
125 #define INS_GET_CHALLENGE 0x84
126 #define INS_SELECT_FILE 0xA4
127 #define INS_READ_BIN 0xB0
128 #define INS_READ_REC 0xB2
129 #define INS_GET_RESP 0xC0
130 #define INS_ENVELOPE 0xC2
131 #define INS_GET_DATA 0xCA
132 #define INS_WRITE_BIN 0xD0
133 #define INS_WRITE_REC 0xD2
134 #define INS_UPDATE_BIN 0xD6
135 #define INS_PUT_DATA 0xDA
136 #define INS_UPDATE_REC 0xDC
137 #define INS_APPEND_REC 0xE2
138 /* for our transaction tracking, not defined in the specification */
139 #define INS_INVALID 0x00
140
141 static const value_string iso7816_ins[] = {
142 /* instructions defined in ISO 7816-4 */
143 { INS_ERASE_BIN, "Erase binary" },
144 { INS_VRFY, "Verify" },
145 { INS_MANAGE_CHANNEL, "Manage channel" },
146 { INS_EXT_AUTH, "External authenticate" },
147 { INS_GET_CHALLENGE, "Get challenge" },
148 { INS_SELECT_FILE, "Select file" },
149 { INS_READ_BIN, "Read binary" },
150 { INS_READ_REC, "Read record" },
151 { INS_GET_RESP, "Get response" },
152 { INS_ENVELOPE, "Envelope" },
153 { INS_GET_DATA, "Get data" },
154 { INS_WRITE_BIN, "Write binary" },
155 { INS_WRITE_REC, "Write record" },
156 { INS_UPDATE_BIN, "Update binary" },
157 { INS_PUT_DATA, "Put data" },
158 { INS_UPDATE_REC, "Update record" },
159 { INS_APPEND_REC, "Append record" },
160 { 0, NULL }
161 };
162 static value_string_ext iso7816_ins_ext = VALUE_STRING_EXT_INIT(iso7816_ins);
163
164 static const value_string iso7816_sel_file_ctrl[] = {
165 { 0x00, "Select MF, DF or EF" },
166 { 0x01, "Select child DF" },
167 { 0x02, "Select EF under current DF" },
168 { 0x03, "Select parent DF of the current DF" },
169 { 0x04, "Direct selection by DF name" },
170 { 0x08, "Selection by path from MF" },
171 { 0x09, "Selection by path from current DF" },
172 { 0, NULL }
173 };
174 static value_string_ext ext_iso7816_sel_file_ctrl =
175 VALUE_STRING_EXT_INIT(iso7816_sel_file_ctrl);
176
177 static const value_string iso7816_sel_file_fci_req[] = {
178 { 0x00, "Return FCI, optional template" },
179 { 0x01, "Return FCP template" },
180 { 0x02, "Return FMD template" },
181 { 0, NULL }
182 };
183 static value_string_ext ext_iso7816_sel_file_fci_req =
184 VALUE_STRING_EXT_INIT(iso7816_sel_file_fci_req);
185
186 static const value_string iso7816_sel_file_occ[] = {
187 { 0x00, "First or only occurrence" },
188 { 0x01, "Last occurrence" },
189 { 0x02, "Next occurrence" },
190 { 0x03, "Previous occurrence" },
191 { 0, NULL }
192 };
193 static value_string_ext ext_iso7816_sel_file_occ =
194 VALUE_STRING_EXT_INIT(iso7816_sel_file_occ);
195
196 #define READ_REC_USAGE_SINGLE 0x04
197 #define READ_REC_USAGE_START 0x05
198 static const value_string iso7816_read_rec_usage[] = {
199 { READ_REC_USAGE_SINGLE, "Read record P1" },
200 { READ_REC_USAGE_START, "Read all records from P1 up to the last" },
201 { 0, NULL }
202 };
203 static value_string_ext ext_iso7816_read_rec_usage =
204 VALUE_STRING_EXT_INIT(iso7816_read_rec_usage);
205
206 static const range_string iso7816_sw1[] = {
207 { 0x61, 0x61, "Normal processing" },
208 { 0x62, 0x63, "Warning processing" },
209 { 0x64, 0x65, "Execution error" },
210 { 0x67, 0x6F, "Checking error" },
211 { 0x90, 0x90, "Normal processing" },
212 { 0,0, NULL }
213 };
214
215 static const range_string iso7816_class_rvals[] = {
216 {0x00, 0x0F, "structure and coding according to ISO/IEC 7816" },
217 {0x10, 0x7F, "reserved for future use" },
218 {0x80, 0x9F, "structure according to ISO/IEC 7816, coding is proprietary" },
219 {0xA0, 0xAF, "structure and coding according to ISO/IEC 7816 unless specified otherwise by the application context" },
220 {0xB0, 0xCF, "structure according to ISO/IEC 7816" },
221 {0xD0, 0xFE, "proprietary structure and coding" },
222 {0xFF, 0xFF, "reserved for Protocol Type Selection" },
223 {0, 0, NULL}
224 };
225
226 static const value_string unique_or_unused[] = {
227 { 0, "or unused" },
228 { 0, NULL }
229 };
230
231 static const value_string unique_max_num_available_bytes[] = {
232 { 0, "maximum number of available bytes" },
233 { 0, NULL }
234 };
235
236 static inline
FI_to_Fi(guint8 FI)237 guint16 FI_to_Fi(guint8 FI)
238 {
239 if (FI<=1)
240 return 372;
241 else if (FI<=6)
242 return (FI-1) * 372;
243 else if (FI==9)
244 return 512;
245 else if (FI==10)
246 return 768;
247 else if (FI==11)
248 return 1024;
249 else if (FI==12)
250 return 1536;
251 else if (FI==13)
252 return 2048;
253
254 return 0; /* 0 means RFU (reserved for future use) here */
255 }
256
257 static inline
DI_to_Di(guint8 DI)258 guint8 DI_to_Di(guint8 DI)
259 {
260 if (DI>=1 && DI<=6)
261 return 1 << (DI-1);
262 else if (DI==8)
263 return 12;
264 else if (DI==9)
265 return 20;
266
267 return 0; /* 0 means RFU (reserved for future use) here */
268 }
269
270 /* dissect TA(ta_index) */
271 static void
dissect_iso7816_atr_ta(tvbuff_t * tvb,gint offset,guint ta_index,packet_info * pinfo _U_,proto_tree * tree)272 dissect_iso7816_atr_ta(tvbuff_t *tvb, gint offset, guint ta_index,
273 packet_info *pinfo _U_, proto_tree *tree)
274 {
275 guint8 ta, FI, DI;
276 guint16 Fi;
277 guint8 Di;
278 proto_item *ta_it;
279 proto_tree *ta_tree;
280
281 ta = tvb_get_guint8(tvb, offset);
282 ta_it = proto_tree_add_uint_format(tree, hf_iso7816_atr_ta,
283 tvb, offset, 1, ta,
284 "Interface character TA(%d): 0x%02x", ta_index, ta);
285 ta_tree = proto_item_add_subtree(ta_it, ett_iso7816_atr_ta);
286
287 if (ta_index==1) {
288 FI = (tvb_get_guint8(tvb, offset) & 0xF0) >> 4;
289 Fi = FI_to_Fi(FI);
290 if (Fi>0) {
291 proto_tree_add_uint_format(ta_tree, hf_iso7816_atr_ta1_fi,
292 tvb, offset, 1, Fi,
293 "Clock rate conversion factor Fi: %d (FI 0x%x)",
294 Fi, FI);
295 }
296
297 DI = tvb_get_guint8(tvb, offset) & 0x0F;
298 Di = DI_to_Di(DI);
299 if (Di>0) {
300 proto_tree_add_uint_format(ta_tree, hf_iso7816_atr_ta1_di,
301 tvb, offset, 1, Di,
302 "Baud rate adjustment factor Di: %d (DI 0x%x)",
303 Di, DI);
304 }
305 }
306 }
307
308 static int
dissect_iso7816_atr(tvbuff_t * tvb,packet_info * pinfo,proto_tree * tree,void * data _U_)309 dissect_iso7816_atr(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
310 {
311 gint offset=0;
312 guint8 init_char;
313 guint i=0; /* loop index for TA(i)...TD(i) */
314 proto_item *proto_it;
315 proto_tree *proto_tr;
316 guint8 tb, tc, td, k=0;
317 gint tck_len;
318
319 /* we need at least the initial char TS and the format char T0 */
320 if (tvb_captured_length(tvb) < 2)
321 return 0; /* no ATR sequence */
322
323 init_char = tvb_get_guint8(tvb, offset);
324 if (init_char!=0x3B && init_char!=0x3F)
325 return 0;
326
327 proto_it = proto_tree_add_protocol_format(tree, proto_iso7816_atr,
328 tvb, 0, -1, "ISO 7816 ATR");
329 proto_tr = proto_item_add_subtree(proto_it, ett_iso7816_atr);
330
331 col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, "ATR");
332
333 /* ISO 7816-4, section 4 indicates that concatenations are big endian */
334 proto_tree_add_item(proto_tr, hf_iso7816_atr_init_char,
335 tvb, offset, 1, ENC_BIG_ENDIAN);
336 offset++;
337
338 do {
339 proto_item *td_it;
340 proto_tree *td_tree;
341
342 /* for i==0, this is the T0 byte, otherwise it's the TD(i) byte
343 in each loop, we dissect T0/TD(i) and TA(i+1), TB(i+1), TC(i+1) */
344 td = tvb_get_guint8(tvb, offset);
345 if (i==0) {
346 td_it = proto_tree_add_item(proto_tr, hf_iso7816_atr_t0,
347 tvb, offset, 1, ENC_BIG_ENDIAN);
348 }
349 else {
350 td_it = proto_tree_add_uint_format(proto_tr, hf_iso7816_atr_td,
351 tvb, offset, 1, td,
352 "Interface character TD(%d): 0x%02x", i, td);
353 }
354 td_tree = proto_item_add_subtree(td_it, ett_iso7816_atr_td);
355
356 proto_tree_add_boolean_format(td_tree, hf_iso7816_atr_next_ta_present,
357 tvb, offset, 1, td&0x10,
358 "TA(%d) present: %s", i+1, td&0x10 ? "True" : "False");
359 proto_tree_add_boolean_format(td_tree, hf_iso7816_atr_next_tb_present,
360 tvb, offset, 1, td&0x20,
361 "TB(%d) present: %s", i+1, td&0x20 ? "True" : "False");
362 proto_tree_add_boolean_format(td_tree, hf_iso7816_atr_next_tc_present,
363 tvb, offset, 1, td&0x40,
364 "TC(%d) present: %s", i+1, td&0x40 ? "True" : "False");
365 proto_tree_add_boolean_format(td_tree, hf_iso7816_atr_next_td_present,
366 tvb, offset, 1, td&0x80,
367 "TD(%d) present: %s", i+1, td&0x80 ? "True" : "False");
368
369 col_append_sep_fstr(pinfo->cinfo, COL_INFO, NULL,
370 "TA(%d)=%s TB(%d)=%s TC(%d)=%s TD(%d)=%s",
371 i+1, td&0x10 ? "True" : "False",
372 i+1, td&0x20 ? "True" : "False",
373 i+1, td&0x40 ? "True" : "False",
374 i+1, td&0x80 ? "True" : "False");
375
376 if (i==0) {
377 k = td&0x0F; /* number of historical bytes */
378 proto_tree_add_item(td_tree, hf_iso7816_atr_k,
379 tvb, offset, 1, ENC_BIG_ENDIAN);
380 }
381 else {
382 proto_tree_add_item(td_tree, hf_iso7816_atr_t,
383 tvb, offset, 1, ENC_BIG_ENDIAN);
384 }
385 offset++;
386
387 if (td&0x10) {
388 /* we read TA(i+1), see comment above */
389 dissect_iso7816_atr_ta(tvb, offset, i+1, pinfo, proto_tr);
390 offset++;
391 }
392 if (td&0x20) {
393 tb = tvb_get_guint8(tvb, offset);
394 proto_tree_add_uint_format(proto_tr, hf_iso7816_atr_tb,
395 tvb, offset, 1, tb,
396 "Interface character TB(%d): 0x%02x", i+1, tb);
397 offset++;
398 }
399 if (td&0x40) {
400 tc = tvb_get_guint8(tvb, offset);
401 proto_tree_add_uint_format(proto_tr, hf_iso7816_atr_tc,
402 tvb, offset, 1, tc,
403 "Interface character TC(%d): 0x%02x", i+1, tc);
404 offset++;
405 }
406
407 i++;
408 } while (td&0x80);
409
410 if (k>0) {
411 proto_tree_add_item(proto_tr, hf_iso7816_atr_hist_bytes,
412 tvb, offset, k, ENC_NA);
413 offset += k;
414 }
415
416 tck_len = tvb_reported_length_remaining(tvb, offset);
417 /* tck is either absent or exactly one byte */
418 if (tck_len==1) {
419 proto_tree_add_item(proto_tr, hf_iso7816_atr_tck,
420 tvb, offset, 1, ENC_BIG_ENDIAN);
421 offset++;
422 }
423 else if (tck_len>1) {
424 proto_tree_add_expert(proto_tr, pinfo, &ie_iso7816_atr_tck_not1,
425 tvb, offset, tck_len);
426 }
427
428 proto_item_set_len(proto_it, offset);
429 return offset;
430 }
431
432 /* Dissect the class byte. Return 1 if the APDU's structure and coding
433 adhere to ISO 7816. In this case, we can dissect the rest of the
434 APDU. Otherwise, return -1. We may then pass the APDU to other
435 dissectors. */
436 static gint
dissect_iso7816_class(tvbuff_t * tvb,gint offset,packet_info * pinfo _U_,proto_tree * tree)437 dissect_iso7816_class(tvbuff_t *tvb, gint offset,
438 packet_info *pinfo _U_, proto_tree *tree)
439 {
440 proto_item *class_item;
441 proto_tree *class_tree;
442 guint8 dev_class;
443
444 class_item = proto_tree_add_item(tree, hf_iso7816_cla,
445 tvb, offset, 1, ENC_BIG_ENDIAN);
446 class_tree = proto_item_add_subtree(class_item, ett_iso7816_class);
447
448 dev_class = tvb_get_guint8(tvb, offset);
449
450 if (dev_class>=0x10 && dev_class<=0x7F) {
451 /* these values are RFU. */
452 return -1;
453 }
454
455 if (dev_class>=0xD0 && dev_class<=0xFE) {
456 /* proprietary structure and coding */
457 return -1;
458 }
459
460 if (dev_class==0xFF) {
461 /* reserved for Protocol Type Selection */
462 return -1;
463 }
464
465 /* If we made it this far, the structrue of the APDU is compliant
466 with ISO 7816. */
467
468 proto_tree_add_item(class_tree, hf_iso7816_cla_sm,
469 tvb, offset, 1, ENC_BIG_ENDIAN);
470
471 proto_tree_add_item(class_tree, hf_iso7816_cla_channel,
472 tvb, offset, 1, ENC_BIG_ENDIAN);
473
474 if (dev_class>=0x80 && dev_class<=0x9F) {
475 /* structure according to ISO 7816, coding is proprietary */
476 return -1;
477 }
478
479 if (dev_class>=0xB0 && dev_class<=0xCF) {
480 /* structure according to ISO 7816 */
481 return -1;
482 }
483
484 /* both structure and coding according to ISO 7816 */
485 return 1;
486 }
487
488 /* dissect the parameters p1 and p2
489 return number of dissected bytes or -1 for error */
490 static gint
dissect_iso7816_params(guint8 ins,tvbuff_t * tvb,gint offset,packet_info * pinfo _U_,proto_tree * tree)491 dissect_iso7816_params(guint8 ins, tvbuff_t *tvb, gint offset,
492 packet_info *pinfo _U_, proto_tree *tree)
493 {
494 gint offset_start, p1_offset, p2_offset;
495 proto_tree *params_tree;
496 guint8 p1, p2;
497 proto_item *p1_it = NULL, *p2_it = NULL;
498 proto_tree *p1_tree = NULL, *p2_tree = NULL;
499 proto_item *p1_p2_it = NULL;
500 guint16 P1P2;
501 guint32 ef, read_rec_usage;
502
503 offset_start = offset;
504
505 params_tree = proto_tree_add_subtree(tree, tvb, offset_start, 2,
506 ett_iso7816_param, NULL, "Parameters");
507
508 p1 = tvb_get_guint8(tvb,offset);
509 p1_it = proto_tree_add_item(params_tree, hf_iso7816_p1, tvb,
510 offset, 1, ENC_BIG_ENDIAN);
511 p1_offset = offset;
512 offset++;
513 p2 = tvb_get_guint8(tvb,offset);
514 p2_it = proto_tree_add_item(params_tree, hf_iso7816_p2,
515 tvb, offset, 1, ENC_BIG_ENDIAN);
516 p2_offset = offset;
517 offset++;
518 P1P2 = (p1<<8|p2);
519
520 switch (ins) {
521 case INS_EXT_AUTH:
522 if (p1>0) {
523 proto_item_append_text(p1_it,
524 " (reference of the algorithm on the card)");
525 }
526 proto_item_append_text(p2_it, " (reference of the secret)");
527 break;
528 case INS_SELECT_FILE:
529 proto_item_append_text(p1_it, " (selection control)");
530 p1_tree = proto_item_add_subtree(p1_it, ett_iso7816_p1);
531 proto_tree_add_item(p1_tree, hf_iso7816_sel_file_ctrl,
532 tvb, p1_offset, 1, ENC_BIG_ENDIAN);
533 proto_item_append_text(p2_it, " (selection options)");
534 p2_tree = proto_item_add_subtree(p2_it, ett_iso7816_p2);
535 proto_tree_add_item(p2_tree, hf_iso7816_sel_file_fci_req,
536 tvb, p2_offset, 1, ENC_BIG_ENDIAN);
537 proto_tree_add_item(p2_tree, hf_iso7816_sel_file_occ,
538 tvb, p2_offset, 1, ENC_BIG_ENDIAN);
539 break;
540 case INS_READ_BIN:
541 if (p1&0x80) {
542 /* XXX - b5-b1 of P1 == short ef identifier for the selected file */
543 /* XXX - P2 == offset for the read */
544 }
545 else {
546 p1_p2_it = proto_tree_add_uint(params_tree, hf_iso7816_offset_first_byte,
547 tvb, offset_start, offset-offset_start, P1P2);
548 col_append_sep_fstr(pinfo->cinfo, COL_INFO, NULL,
549 "offset %d", P1P2);
550 }
551 break;
552 case INS_READ_REC:
553 proto_item_append_text(p1_it, " (record number)");
554 proto_item_append_text(p2_it, " (reference control)");
555 p2_tree = proto_item_add_subtree(p2_it, ett_iso7816_p2);
556 proto_tree_add_item_ret_uint(p2_tree, hf_iso7816_read_rec_ef,
557 tvb, p2_offset, 1, ENC_BIG_ENDIAN, &ef);
558 col_append_sep_fstr(pinfo->cinfo, COL_INFO, NULL, "EF %d", ef);
559 proto_tree_add_item_ret_uint(p2_tree, hf_iso7816_read_rec_usage,
560 tvb, p2_offset, 1, ENC_BIG_ENDIAN, &read_rec_usage);
561 if (read_rec_usage == READ_REC_USAGE_SINGLE) {
562 col_append_sep_fstr(
563 pinfo->cinfo, COL_INFO, NULL, "record %d", p1);
564 }
565 break;
566 case INS_GET_RESP:
567 p1_p2_it = proto_tree_add_uint_format(params_tree, hf_iso7816_get_resp,
568 tvb, offset_start, offset-offset_start, P1P2,
569 "Both should be 0x00, other values are RFU");
570 break;
571 case INS_GET_DATA:
572 if (P1P2<=0x003F || (0x0300<=P1P2 && P1P2<=0x3FFF)) {
573 p1_p2_it = proto_tree_add_uint(params_tree, hf_iso7816_rfu,
574 tvb, offset_start, offset-offset_start, P1P2);
575 }
576 else if (0x0100<=P1P2 && P1P2<=0x01FF) {
577 p1_p2_it = proto_tree_add_uint(params_tree, hf_iso7816_application_data,
578 tvb, offset_start, offset-offset_start, P1P2);
579 }
580 break;
581 default:
582 break;
583 }
584
585 proto_item_set_generated(p1_p2_it);
586
587 return 2;
588 }
589
590 static gint
dissect_iso7816_le(tvbuff_t * tvb,gint offset,packet_info * pinfo _U_,proto_tree * tree)591 dissect_iso7816_le(
592 tvbuff_t *tvb, gint offset, packet_info *pinfo _U_, proto_tree *tree)
593 {
594 proto_tree_add_item(tree, hf_iso7816_le, tvb, offset, 1, ENC_BIG_ENDIAN);
595
596 return 1;
597 }
598
599
600 static gint
dissect_iso7816_cmd_apdu(tvbuff_t * tvb,packet_info * pinfo,proto_tree * tree)601 dissect_iso7816_cmd_apdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
602 {
603 iso7816_transaction_t *iso7816_trans = NULL;
604 proto_item *trans_ti = NULL;
605 gint ret;
606 gint offset = 0;
607 guint8 ins;
608 gint body_len;
609 guint8 lc;
610
611
612 if (PINFO_FD_VISITED(pinfo)) {
613 iso7816_trans = (iso7816_transaction_t *)wmem_tree_lookup32(
614 transactions, pinfo->num);
615 if (iso7816_trans && iso7816_trans->cmd_frame==pinfo->num &&
616 iso7816_trans->resp_frame!=0) {
617 trans_ti = proto_tree_add_uint_format(tree, hf_iso7816_resp_in,
618 NULL, 0, 0, iso7816_trans->resp_frame,
619 "Response in frame %d", iso7816_trans->resp_frame);
620 proto_item_set_generated(trans_ti);
621 }
622 }
623 else {
624 if (transactions) {
625 iso7816_trans = wmem_new(wmem_file_scope(), iso7816_transaction_t);
626 iso7816_trans->cmd_frame = pinfo->num;
627 iso7816_trans->resp_frame = 0;
628 iso7816_trans->cmd_ins = INS_INVALID;
629 iso7816_trans->handle = NULL;
630
631 wmem_tree_insert32(transactions,
632 iso7816_trans->cmd_frame, (void *)iso7816_trans);
633 }
634 }
635
636 ret = dissect_iso7816_class(tvb, offset, pinfo, tree);
637 if (ret==-1) {
638 /* the class byte says that the remaining APDU is not
639 in ISO7816 format */
640
641 iso7816_trans->handle =
642 dissector_get_payload_handle(iso7816_apdu_pld_table);
643 if (iso7816_trans->handle != NULL) {
644 ret = call_dissector(iso7816_trans->handle, tvb, pinfo, tree);
645 if (ret == 0) {
646 col_append_sep_str(pinfo->cinfo, COL_INFO, NULL,
647 "Command APDU using proprietary format");
648 return 1; /* we only dissected the class byte */
649 }
650 }
651
652 return ret;
653 }
654 offset += ret;
655
656 ins = tvb_get_guint8(tvb, offset);
657 proto_tree_add_item(tree, hf_iso7816_ins, tvb, offset, 1, ENC_BIG_ENDIAN);
658 col_append_sep_str(pinfo->cinfo, COL_INFO, NULL,
659 val_to_str_ext_const(ins, &iso7816_ins_ext, "Unknown instruction"));
660 offset++;
661 /* if we just created a new transaction, we can now fill in the cmd id */
662 if (iso7816_trans && iso7816_trans->cmd_ins==INS_INVALID)
663 iso7816_trans->cmd_ins = ins;
664
665 ret = dissect_iso7816_params(ins, tvb, offset, pinfo, tree);
666 if (ret>0)
667 offset += ret;
668
669 /* for now, we support only short length fields
670 based on infos from the ATR, we could support extended length fields too */
671 body_len = tvb_reported_length_remaining(tvb, offset);
672
673 /* nothing to do for body_len==0 */
674 if (body_len==1) {
675 offset += dissect_iso7816_le(tvb, offset, pinfo, tree);
676 }
677 else if (body_len>1) {
678 lc = tvb_get_guint8(tvb, offset);
679 proto_tree_add_item(
680 tree, hf_iso7816_lc, tvb, offset, 1, ENC_BIG_ENDIAN);
681 offset++;
682 if (lc>0) {
683 proto_tree_add_item(tree, hf_iso7816_body, tvb, offset, lc, ENC_NA);
684 offset += lc;
685 }
686 if (tvb_reported_length_remaining(tvb, offset)>0) {
687 offset += dissect_iso7816_le(tvb, offset, pinfo, tree);
688 }
689 }
690
691 return offset;
692 }
693
694 static gint
dissect_iso7816_resp_apdu(tvbuff_t * tvb,packet_info * pinfo,proto_tree * tree)695 dissect_iso7816_resp_apdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
696 {
697 iso7816_transaction_t *iso7816_trans;
698 proto_item *trans_ti = NULL;
699 const gchar *cmd_ins_str;
700 gint offset = 0;
701 gint body_len;
702
703 col_append_sep_str(pinfo->cinfo, COL_INFO, NULL, "Response APDU");
704
705 if (transactions) {
706 /* receive the largest key that is less than or equal to our frame
707 number */
708 iso7816_trans = (iso7816_transaction_t *)wmem_tree_lookup32_le(
709 transactions, pinfo->num);
710 if (iso7816_trans) {
711 if (iso7816_trans->resp_frame==0) {
712 /* there's a pending request, this packet is the response */
713 iso7816_trans->resp_frame = pinfo->num;
714 }
715
716 if (iso7816_trans->resp_frame== pinfo->num) {
717 /* we found the request that corresponds to our response */
718 cmd_ins_str = val_to_str_const(iso7816_trans->cmd_ins,
719 iso7816_ins, "Unknown instruction");
720 trans_ti = proto_tree_add_uint_format(tree, hf_iso7816_resp_to,
721 NULL, 0, 0, iso7816_trans->cmd_frame,
722 "Response to frame %d (%s)",
723 iso7816_trans->cmd_frame, cmd_ins_str);
724 proto_item_set_generated(trans_ti);
725
726 col_append_sep_fstr(pinfo->cinfo, COL_INFO, " ",
727 "(to %s)", cmd_ins_str);
728 }
729
730 if (iso7816_trans->handle != NULL)
731 call_dissector(iso7816_trans->handle, tvb, pinfo, tree);
732 }
733 }
734
735 /* - 2 bytes SW1, SW2 */
736 body_len = tvb_reported_length_remaining(tvb, offset) - 2;
737
738 if (body_len>0) {
739 proto_tree_add_item(tree, hf_iso7816_body,
740 tvb, offset, body_len, ENC_NA);
741 offset += body_len;
742 }
743
744 if (tvb_reported_length_remaining(tvb, offset) >= 2) {
745 proto_tree_add_item(tree, hf_iso7816_sw1,
746 tvb, offset, 1, ENC_BIG_ENDIAN);
747 offset++;
748 proto_tree_add_item(tree, hf_iso7816_sw2,
749 tvb, offset, 1, ENC_BIG_ENDIAN);
750 offset++;
751 }
752
753 return offset;
754 }
755
756 static int
dissect_iso7816(tvbuff_t * tvb,packet_info * pinfo,proto_tree * tree,void * data _U_)757 dissect_iso7816(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _U_)
758 {
759 gint offset = 0;
760 proto_item *tree_ti;
761 proto_tree *iso7816_tree;
762 gboolean is_atr = FALSE;
763
764 if (pinfo->p2p_dir!=P2P_DIR_SENT && pinfo->p2p_dir!=P2P_DIR_RECV)
765 return 0;
766
767 col_set_str(pinfo->cinfo, COL_PROTOCOL, "ISO 7816");
768 col_clear(pinfo->cinfo, COL_INFO);
769
770 tree_ti = proto_tree_add_protocol_format(tree, proto_iso7816,
771 tvb, 0, tvb_reported_length(tvb), "ISO 7816");
772 iso7816_tree = proto_item_add_subtree(tree_ti, ett_iso7816);
773
774 /* per our definition, sent/received is from the perspective of the interface
775 i.e sent is from interface to card, received is from card to interface */
776 if (pinfo->p2p_dir==P2P_DIR_SENT) {
777 set_address(&pinfo->src, AT_STRINGZ,
778 (int)strlen(ADDR_INTF)+1, ADDR_INTF);
779 set_address(&pinfo->dst, AT_STRINGZ,
780 (int)strlen(ADDR_CARD)+1, ADDR_CARD);
781 proto_item_append_text(tree_ti, " Command APDU");
782 offset = dissect_iso7816_cmd_apdu(tvb, pinfo, iso7816_tree);
783 }
784 else if (pinfo->p2p_dir==P2P_DIR_RECV) {
785 set_address(&pinfo->src, AT_STRINGZ,
786 (int)strlen(ADDR_CARD)+1, ADDR_CARD);
787 set_address(&pinfo->dst, AT_STRINGZ,
788 (int)strlen(ADDR_INTF)+1, ADDR_INTF);
789
790 if (iso7816_atr_handle) {
791 offset = call_dissector_only(iso7816_atr_handle,
792 tvb, pinfo, iso7816_tree, NULL);
793 if (offset > 0)
794 is_atr = TRUE;
795 }
796 if (!is_atr) {
797 proto_item_append_text(tree_ti, " Response APDU");
798 offset = dissect_iso7816_resp_apdu(tvb, pinfo, iso7816_tree);
799 }
800 }
801
802 return offset;
803 }
804
805 void
proto_register_iso7816(void)806 proto_register_iso7816(void)
807 {
808 static hf_register_info hf[] = {
809 { &hf_iso7816_atr_init_char,
810 { "Initial character", "iso7816.atr.init_char",
811 FT_UINT8, BASE_HEX, VALS(iso7816_atr_init_char), 0, NULL, HFILL }
812 },
813 { &hf_iso7816_atr_t0,
814 { "Format character T0", "iso7816.atr.t0",
815 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }
816 },
817 { &hf_iso7816_atr_ta,
818 { "Interface character TA(i)", "iso7816.atr.ta",
819 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }
820 },
821 { &hf_iso7816_atr_ta1_fi,
822 { "Fi", "iso7816.atr.ta1.fi",
823 FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }
824 },
825 { &hf_iso7816_atr_ta1_di,
826 { "Di", "iso7816.atr.ta1.di",
827 FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }
828 },
829 { &hf_iso7816_atr_tb,
830 { "Interface character TB(i)", "iso7816.atr.tb",
831 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }
832 },
833 { &hf_iso7816_atr_tc,
834 { "Interface character TC(i)", "iso7816.atr.tc",
835 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }
836 },
837 { &hf_iso7816_atr_td,
838 { "Interface character TD(i)", "iso7816.atr.td",
839 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }
840 },
841 { &hf_iso7816_atr_next_ta_present,
842 { "TA(i+1) present", "iso7816.atr.next_ta_present",
843 FT_BOOLEAN, 8, NULL, 0x10, NULL, HFILL }
844 },
845 { &hf_iso7816_atr_next_tb_present,
846 { "TB(i+1) present", "iso7816.atr.next_tb_present",
847 FT_BOOLEAN, 8, NULL, 0x20, NULL, HFILL }
848 },
849 { &hf_iso7816_atr_next_tc_present,
850 { "TC(i+1) present", "iso7816.atr.next_tc_present",
851 FT_BOOLEAN, 8, NULL, 0x40, NULL, HFILL }
852 },
853 { &hf_iso7816_atr_next_td_present,
854 { "TD(i+1) present", "iso7816.atr.next_td_present",
855 FT_BOOLEAN, 8, NULL, 0x80, NULL, HFILL }
856 },
857 { &hf_iso7816_atr_k,
858 { "Number K of historical bytes", "iso7816.atr.k",
859 FT_UINT8, BASE_DEC, NULL, 0x0F, NULL, HFILL }
860 },
861 { &hf_iso7816_atr_t,
862 { "Protocol reference T", "iso7816.atr.t",
863 FT_UINT8, BASE_HEX, NULL, 0x0F, NULL, HFILL }
864 },
865 { &hf_iso7816_atr_hist_bytes,
866 { "Historical bytes", "iso7816.atr.historical_bytes",
867 FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }
868 },
869 { &hf_iso7816_atr_tck,
870 { "Check character TCK", "iso7816.atr.tck",
871 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }
872 },
873 { &hf_iso7816_resp_in,
874 { "Response In", "iso7816.resp_in",
875 FT_FRAMENUM, BASE_NONE, NULL, 0x0,
876 "The response to this command is in this frame", HFILL }
877 },
878 { &hf_iso7816_resp_to,
879 { "Response To", "iso7816.resp_to",
880 FT_FRAMENUM, BASE_NONE, NULL, 0x0,
881 "This is the response to the command in this frame", HFILL }
882 },
883 { &hf_iso7816_cla,
884 { "Class", "iso7816.apdu.cla",
885 FT_UINT8, BASE_HEX|BASE_RANGE_STRING, RVALS(iso7816_class_rvals), 0, NULL , HFILL }
886 },
887 { &hf_iso7816_cla_sm,
888 { "Secure Messaging", "iso7816.apdu.cla.sm",
889 FT_UINT8, BASE_HEX, VALS(iso7816_cla_sm), 0x0C, NULL , HFILL }
890 },
891 { &hf_iso7816_cla_channel,
892 { "Logical channel number", "iso7816.apdu.cla.channel",
893 FT_UINT8, BASE_HEX|BASE_SPECIAL_VALS, VALS(unique_or_unused), 0x03, NULL , HFILL }
894 },
895 { &hf_iso7816_ins,
896 { "Instruction", "iso7816.apdu.ins",
897 FT_UINT8, BASE_HEX | BASE_EXT_STRING, &iso7816_ins_ext, 0, NULL, HFILL }
898 },
899 { &hf_iso7816_p1,
900 { "Parameter 1", "iso7816.apdu.p1",
901 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }
902 },
903 { &hf_iso7816_p2,
904 { "Parameter 2", "iso7816.apdu.p2",
905 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }
906 },
907 { &hf_iso7816_lc,
908 { "Length field Lc", "iso7816.apdu.lc",
909 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }
910 },
911 { &hf_iso7816_le,
912 { "Expected response length Le", "iso7816.apdu.le",
913 FT_UINT8, BASE_HEX|BASE_SPECIAL_VALS, VALS(unique_max_num_available_bytes), 0, NULL, HFILL }
914 },
915 { &hf_iso7816_body,
916 { "APDU Body", "iso7816.apdu.body",
917 FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }
918 },
919 { &hf_iso7816_sw1,
920 { "Status Word SW1", "iso7816.apdu.sw1", FT_UINT8,
921 BASE_RANGE_STRING|BASE_HEX, RVALS(iso7816_sw1), 0, NULL, HFILL }
922 },
923 { &hf_iso7816_sw2,
924 { "Status Word SW2", "iso7816.apdu.sw2",
925 FT_UINT8, BASE_HEX, NULL, 0, NULL, HFILL }
926 },
927 { &hf_iso7816_sel_file_ctrl,
928 { "Selection control", "iso7816.apdu.select_file.ctrl",
929 FT_UINT8, BASE_HEX | BASE_EXT_STRING,
930 &ext_iso7816_sel_file_ctrl, 0, NULL, HFILL }
931 },
932 { &hf_iso7816_sel_file_fci_req,
933 { "File control information request", "iso7816.apdu.select_file.fci_req",
934 FT_UINT8, BASE_HEX | BASE_EXT_STRING,
935 &ext_iso7816_sel_file_fci_req, 0x0C, NULL, HFILL }
936 },
937 { &hf_iso7816_sel_file_occ,
938 { "Occurrence", "iso7816.apdu.select_file.occurrence",
939 FT_UINT8, BASE_HEX | BASE_EXT_STRING,
940 &ext_iso7816_sel_file_occ, 0x03, NULL, HFILL }
941 },
942 { &hf_iso7816_read_rec_ef,
943 { "Short EF identifier", "iso7816.apdu.read_rec.ef",
944 FT_UINT8, BASE_HEX, NULL, 0xF8, NULL, HFILL }
945 },
946 { &hf_iso7816_read_rec_usage,
947 { "Usage", "iso7816.apdu.read_rec.usage",
948 FT_UINT8, BASE_HEX | BASE_EXT_STRING,
949 &ext_iso7816_read_rec_usage, 0x07, NULL, HFILL }
950 },
951 { &hf_iso7816_offset_first_byte,
952 { "Offset of the first byte to read", "iso7816.offset_first_byte",
953 FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }
954 },
955 { &hf_iso7816_get_resp,
956 { "GetResp", "iso7816.get_resp",
957 FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL }
958 },
959 { &hf_iso7816_rfu,
960 { "RFU", "iso7816.rfu",
961 FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL }
962 },
963 { &hf_iso7816_application_data,
964 { "Application data (proprietary coding)", "iso7816.application_data",
965 FT_UINT16, BASE_HEX, NULL, 0, NULL, HFILL }
966 },
967 };
968 static gint *ett[] = {
969 &ett_iso7816,
970 &ett_iso7816_class,
971 &ett_iso7816_param,
972 &ett_iso7816_p1,
973 &ett_iso7816_p2,
974 &ett_iso7816_atr,
975 &ett_iso7816_atr_ta,
976 &ett_iso7816_atr_td
977 };
978
979 static ei_register_info ei[] = {
980 { &ie_iso7816_atr_tck_not1, { "iso7816.atr.tck.not1", PI_PROTOCOL, PI_WARN, "TCK byte must either be absent or exactly one byte", EXPFILL }}
981 };
982
983 expert_module_t* expert_iso7816;
984
985 proto_iso7816 = proto_register_protocol(
986 "ISO/IEC 7816", "ISO 7816", "iso7816");
987 proto_register_field_array(proto_iso7816, hf, array_length(hf));
988 proto_register_subtree_array(ett, array_length(ett));
989 expert_iso7816 = expert_register_protocol(proto_iso7816);
990 expert_register_field_array(expert_iso7816, ei, array_length(ei));
991
992 iso7816_handle = register_dissector("iso7816", dissect_iso7816, proto_iso7816);
993
994 transactions = wmem_tree_new_autoreset(wmem_epan_scope(), wmem_file_scope());
995
996 proto_iso7816_atr = proto_register_protocol_in_name_only("ISO/IEC 7816-3", "ISO 7816-3", "iso7816.atr", proto_iso7816, FT_PROTOCOL);
997 iso7816_atr_handle = register_dissector("iso7816.atr", dissect_iso7816_atr, proto_iso7816_atr);
998
999 iso7816_apdu_pld_table =
1000 register_decode_as_next_proto(proto_iso7816,
1001 "iso7816.apdu_payload",
1002 "ISO7816 proprietary APDU dissector", NULL);
1003 }
1004
1005
proto_reg_handoff_iso7816(void)1006 void proto_reg_handoff_iso7816(void)
1007 {
1008 dissector_add_for_decode_as("usbccid.subdissector", iso7816_handle);
1009 dissector_add_for_decode_as("iso14443.subdissector", iso7816_handle);
1010 }
1011
1012
1013 /*
1014 * Editor modelines - https://www.wireshark.org/tools/modelines.html
1015 *
1016 * Local variables:
1017 * c-basic-offset: 4
1018 * tab-width: 8
1019 * indent-tabs-mode: nil
1020 * End:
1021 *
1022 * vi: set shiftwidth=4 tabstop=8 expandtab:
1023 * :indentSize=4:tabSize=8:noTabs=true:
1024 */
1025