From 82b2898d1d012fb779a2aaa78c9727361a4ff5cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sosth=C3=A8ne=20Gu=C3=A9don?= <sosthene@nitrokey.com>
Date: Fri, 4 Nov 2022 12:23:05 +0100
Subject: [PATCH] Remove the iso command from yubico handler

---
 src/commands.rs  | 12 ++++++------
 src/container.rs |  7 +++++++
 src/lib.rs       | 34 +++++++++-------------------------
 3 files changed, 22 insertions(+), 31 deletions(-)

diff --git a/src/commands.rs b/src/commands.rs
index a8a7976..5fbbec6 100644
--- a/src/commands.rs
+++ b/src/commands.rs
@@ -11,8 +11,8 @@ use iso7816::{Instruction, Status};
 use crate::state::TouchPolicy;
 pub use crate::{
     container::{
-        self as containers, AuthenticateKeyReference, ChangeReferenceKeyReference,
-        GenerateAsymmetricKeyReference, VerifyKeyReference,
+        self as containers, AttestKeyReference, AuthenticateKeyReference,
+        ChangeReferenceKeyReference, GenerateAsymmetricKeyReference, VerifyKeyReference,
     },
     piv_types, Pin, Puk,
 };
@@ -25,7 +25,7 @@ pub enum YubicoPivExtension {
     GetVersion,
     Reset,
     SetPinRetries,
-    Attest,
+    Attest(AttestKeyReference),
     GetSerial, // also used via 0x01
     GetMetadata,
 }
@@ -371,9 +371,9 @@ impl<'l, const C: usize> TryFrom<&'l iso7816::Command<C>> for Command<'l> {
                 Self::YkExtension(YubicoPivExtension::SetPinRetries)
             }
             // (0x00, 0xf9, 0x9a, 0x00)
-            (0x00, Instruction::Unknown(0xf9), _, _) => {
-                Self::YkExtension(YubicoPivExtension::Attest)
-            }
+            (0x00, Instruction::Unknown(0xf9), _, 0x00) => Self::YkExtension(
+                YubicoPivExtension::Attest(AttestKeyReference::try_from(p1)?),
+            ),
             // (0x00, 0xf8, 0x00, 0x00)
             (0x00, Instruction::Unknown(0xf8), _, _) => {
                 Self::YkExtension(YubicoPivExtension::GetSerial)
diff --git a/src/container.rs b/src/container.rs
index cf98266..269f5c4 100644
--- a/src/container.rs
+++ b/src/container.rs
@@ -107,6 +107,13 @@ crate::enum_u8! {
     }
 }
 
+enum_subset! {
+    #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+    pub enum AttestKeyReference: KeyReference {
+        PivAuthentication,
+    }
+}
+
 enum_subset! {
     #[derive(Clone, Copy, Debug, Eq, PartialEq)]
     pub enum GenerateAsymmetricKeyReference: KeyReference {
diff --git a/src/lib.rs b/src/lib.rs
index 0087cb5..7f2ce0c 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -12,6 +12,7 @@ use commands::GeneralAuthenticate;
 pub use commands::{Command, YubicoPivExtension};
 pub mod constants;
 pub mod container;
+use container::AttestKeyReference;
 pub mod derp;
 #[cfg(feature = "apdu-dispatch")]
 mod dispatch;
@@ -105,7 +106,7 @@ where
                 self.general_authenticate(authenticate, command.data(), reply)
             }
             Command::YkExtension(yk_command) => {
-                self.yubico_piv_extension(command, yk_command, reply)
+                self.yubico_piv_extension(command.data(), yk_command, reply)
             }
             _ => todo!(),
         }
@@ -627,9 +628,9 @@ where
         Ok(())
     }
 
-    pub fn yubico_piv_extension<const R: usize, const C: usize>(
+    pub fn yubico_piv_extension<const R: usize>(
         &mut self,
-        command: &iso7816::Command<C>,
+        data: &[u8],
         instruction: YubicoPivExtension,
         reply: &mut Data<R>,
     ) -> Result {
@@ -645,27 +646,15 @@ where
                 reply.extend_from_slice(&[0x06, 0x06, 0x06]).ok();
             }
 
-            YubicoPivExtension::Attest => {
-                if command.p2 != 0x00 {
-                    return Err(Status::IncorrectP1OrP2Parameter);
-                }
-
-                let slot = command.p1;
-
-                if slot == 0x9a {
-                    reply
+            YubicoPivExtension::Attest(slot) => {
+                match slot {
+                    AttestKeyReference::PivAuthentication => reply
                         .extend_from_slice(YUBICO_ATTESTATION_CERTIFICATE_FOR_9A)
-                        .ok();
-                } else {
-                    return Err(Status::FunctionNotSupported);
-                }
+                        .ok(),
+                };
             }
 
             YubicoPivExtension::Reset => {
-                if command.p1 != 0x00 || command.p2 != 0x00 {
-                    return Err(Status::IncorrectP1OrP2Parameter);
-                }
-
                 let persistent_state = self.state.persistent(&mut self.trussed)?;
 
                 // TODO: find out what all needs resetting :)
@@ -699,11 +688,6 @@ where
                 //     }, key[:]...),
                 // }
                 // TODO check we are authenticated with old management key
-                if command.p1 != 0xff || (command.p2 != 0xff && command.p2 != 0xfe) {
-                    return Err(Status::IncorrectP1OrP2Parameter);
-                }
-
-                let data = &command.data();
 
                 // example:  03 9B 18
                 //      B0 20 7A 20 DC 39 0B 1B A5 56 CC EB 8D CE 7A 8A C8 23 E6 F5 0D 89 17 AA