Changes:

2.2.2: Ludovic Rousseau

20 May 2024

• Serial support is ENABLED by default

Changes:

2.2.1: Ludovic Rousseau

8 May 2024

• fix meson related issues

• Some code cleanup

Problems with autoconf/automake

The change was motivated by the effects of the xz utils backdoor in March 2024.

Meson

Meson (and ninja used by meson) is used by a lot of software, like GNOME libraries and applications. See the list of adopters in the Wikipedia Meson page.

It is also an opportunity to learn new tools.

Meson for pcsc-lite

A typical use case is:

meson setup builddir
cd builddir
meson compile
meson install

If you need/want to disable some pcsc-lite options then change the first command to use something like:

meson setup builddir -Dlibudev=false -Dipcdir=/var/run/pcscd

The available options are (file meson.options):

embedded

for embedded systems [limit RAM and CPU resources by disabling features (log)] (disabled by default)

filter_names

reader filtering using PCSCLITE_FILTER_IGNORE_READER_NAMES and PCSCLITE_FILTER_EXTEND_READER_NAMES environment variables

ipcdir

Direcrory for pcsc-lite internal communication socket (/run/pcscd by default)

libsystemd

Use systemd for daemon auto start

libudev

Use libudev (preferred) for USB hotplug

libusb

Use libusb for USB hotplug (disabled by default)

polkit

Use polkit to enforce access control

serial

Support serial readers (disabled by default)

serialconfdir

Path for serial configuration files (/etc/reader.conf.d by default)

systemdunit

Systemd unit directory to use ("user" by default)

usb

Support USB readers

usbdropdir

Path for USB drivers (/usr/lib/pcsc/drivers by default)

Peformances

Another reason to use meson is that the configuration + compilation times should be much shorter.

Computer I used for the tests: MacBook Pro from 2009, MacBookPro5,3, 4 GB of RAM, CPU Core 2 Duo at 2.66 GHz. I just replaced the hard drive by an SSD and installed Debian GNU/Linux (to replace macOS).

I use an old (15 year-old) computer on purpose. The goal is to be able measure times.

Drop unused features

The move to meson is also an occasion to do some cleanup in the code and features supported by pcsc-lite.

meson setup builddir -Dserial=true

In the case of regression

If you need a special configuration that is not possible using meson it is still possible to generate and run the configure script and build pcsc-lite as before:

./bootstrap
./configure your_arguments

You can also create a patch and submit it to https://salsa.debian.org/rousseau/PCSC/ or https://github.com/LudovicRousseau/PCSC.

I already fixed Meson issues. So be sure to use the current master branch of the pcsc-lite git repository.

Conclusion

It is funny to note that we have now much faster computers than 20 years ago when the pcsc-lite project was started. But faster tools are developed now to replace the slower ones. How could we be happy to use slower tools on our slower computers?

The erooM principle is a nice idea. I hope to see more examples.

[UPDATE May 2024]

pcsc-lite version 2.2.1 added the meson option filter_names.

Changes:

2.2.0: Ludovic Rousseau

3 May 2024

• provide files for meson build tool (replaces autoconf/auoomake)

• fix a missing symbol in libpcscspy (bug introduced by the previous version)

• fix shutdown issues with hotplug_libusb

• update pcsc-spy manpage

• update copyright date

• Some other minor improvements

The problem

GnuPG2 (or in fact its scdaemon component) tries to directly access smart card readers using GnuPG2 own implementation of the USB CCID protocol.

This access conflicts with pcsc-lite also accessing the smart card readers.

The Solution

As already seen in GnuPG and PC/SC conflicts from 2019 the solution is to disable the CCID driver provided by GnuPG.

From scdaemon documentation https://www.gnupg.org/documentation/manuals/gnupg/Scdaemon-Options.html#index-disable_002dccid

--disable-ccid

The integrated CCID driver for CCID compliant devices can be available when libusb was detected at build time, and it is used to access the smartcard reader. If access via PC/SC driver is needed, please configure this option to disable CCID driver support (if any). In GnuPG 2.2, there was a fallback mechanism from CCID driver to PC/SC driver. The fallback mechanism worked, because scdaemon in GnuPG 2.2 only supported a single token/reader. To support of multiple tokens/readers at the same time, fallback mechanism was removed.

Since GnuPG v2.4 removed the fallback mechanism to use PC/SC it is even more important to use the disable-ccid configuration.

To be safe, edit your file ~/.gnupg/scdaemon.conf and add the line:

disable-ccid

Conclusion

If you use GnuPG and also one (or more) PC/SC application then you need this change.

Changes:

1.5.15 - April 2024, Ludovic Rousseau

• fix problems when PYKCS11LIB has incorrect values

• fix a problem with swig and "pip install ..."

• minor improvements

Changes

Compared to the previous version documented in PCSC API spy, update:

• no need to play with LD_PRELOAD any more

• no need to install/uninstall a spy library

Demo

Run your program (here pcsc_scan) with LIBPCSCLITE_DELEGATE defined.

$ LIBPCSCLITE_DELEGATE=libpcscspy.so.0 pcsc_scan
PC/SC device scanner
V 1.7.1 (c) 2001-2022, Ludovic Rousseau <ludovic.rousseau@free.fr>
Using reader plug'n play mechanism
Scanning present readers...
Waiting for the first reader...
^C
SCardGetStatusChange: Command cancelled.

I used Control-C to abort the program because pcsc_scan never ends.

$ pcsc-spy
SCardEstablishContext
 i dwScope: SCARD_SCOPE_SYSTEM (0x00000002)
 o hContext: 0x72EC0CEF
 => SCARD_S_SUCCESS [0x00000000]  [0.046759]
SCardGetStatusChange
 i hContext: 0x72EC0CEF
 i dwTimeout: 0x00000000 (0)
 i cReaders: 1
 i szReader: \\?PnP?\Notification
 i  dwCurrentState:  (0x00000000)
 i  dwEventState: SCARD_STATE_IGNORE, SCARD_STATE_CHANGED, SCARD_STATE_UNKNOWN, SCARD_STATE_UNAVAILABLE, SCARD_STATE_PRESENT, SCARD_STATE_EXCLUSIVE, SCARD_STATE_INUSE, SCARD_STATE_MUTE (0x55A373FA63AF)
 i  Atr length: 0x55A373FA63BE (94160513819582)
 i  Atr: NULL
 o szReader: \\?PnP?\Notification
 o  dwCurrentState:  (0x00000000)
 o  dwEventState:  (0x00000000)
 o  Atr length: 0x55A373FA63BE (94160513819582)
 o  Atr: NULL
 => SCARD_E_TIMEOUT [0x8010000A]  [0.002514]
SCardListReaders
 i hContext: 0x72EC0CEF
 i mszGroups: (null)
 o pcchReaders: 0x00000001
 o mszReaders: NULL
 => SCARD_E_NO_READERS_AVAILABLE [0x8010002E]  [0.000045]
SCardListReaders
 i hContext: 0x72EC0CEF
 i mszGroups: (null)
 o pcchReaders: 0x00000001
 o mszReaders: NULL
 => SCARD_E_NO_READERS_AVAILABLE [0x8010002E]  [0.000434]
SCardGetStatusChange
 i hContext: 0x72EC0CEF
 i dwTimeout: 0x0036EE80 (3600000)
 i cReaders: 1
 i szReader: \\?PnP?\Notification
 i  dwCurrentState:  (0x00000000)
 i  dwEventState:  (0x00000000)
 i  Atr length: 0x55A373FA63BE (94160513819582)
 i  Atr: NULL
   SCardCancel
    i hCard: 0x72EC0CEF
    => SCARD_S_SUCCESS [0x00000000]  [0.000741]
 o szReader: \\?PnP?\Notification
 o  dwCurrentState:  (0x00000000)
 o  dwEventState:  (0x00000000)
 o  Atr length: 0x55A373FA63BE (94160513819582)
 o  Atr: NULL
 => SCARD_E_CANCELLED [0x80100002]  [1.015056]
SCardReleaseContext
 i hContext: 0x72EC0CEF
 => SCARD_S_SUCCESS [0x00000000]  [0.000632]

Thread 1/2
Results sorted by total execution time
total time: 1.065758 sec
1.017570 sec (  2 calls) 95.48% SCardGetStatusChange
0.046759 sec (  1 calls)  4.39% SCardEstablishContext
0.000632 sec (  1 calls)  0.06% SCardReleaseContext
0.000479 sec (  2 calls)  0.04% SCardListReaders

Thread 2/2
Results sorted by total execution time
total time: 1.065758 sec
0.000741 sec (  1 calls)  0.07% SCardCancel

Absolute filename

If you want to use a specific spy library or if the library is installed in a directory not handled by the GNU/Linux dynamic loader ld.so you can use an absolute filename.

The script setup_spy.sh is provided by pcsc-lite. It is also included in the Debian libpcsclite-dev package.

$ sh /usr/share/doc/libpcsclite-dev/setup_spy.sh
export LIBPCSCLITE_DELEGATE=/lib/x86_64-linux-gnu/libpcscspy.so.0

If you want to have LIBPCSCLITE_DELEGATE defined and used for all the future executions (maybe not recommanded) you can execute the export command using:

$ source /usr/share/doc/libpcsclite-dev/setup_spy.sh
export LIBPCSCLITE_DELEGATE=/lib/x86_64-linux-gnu/libpcscspy.so.0

Conclusion

It should now be a bit simpler to generate PC/SC call traces.

Remote session

Redirecting PC/SC calls is needed if you use a remote desktop and you want to use your local smart card reader in an application running in a distant GNU/Linux server.

On the server side the RDP server component will define LIBPCSCLITE_DELEGATE to use its own RDP library instead of the default libpcsclite library. The RDP PC/SC library will be in charge of communicating with the RDP client side.

You can use RDP (Remote Desktop Protocol) defined by Microsoft or another protocol.

The use of LIBPCSCLITE_DELEGATE should allow xrdp (an open-source Remote Desktop Protocol server) to redirect smart card accesses to RDP clients (from GNU/Linux or Windows clients).

This solution has been discussed in Delegate WinSCard calls to another library (for a RDP server for example) #161 and XRDP smartcard passthrough via windows RDP client #2625.

Spy the remote session

LIBPCSCLITE_DELEGATE can also be used to trace all the PC/SC calls (see PCSC API spy using LIBPCSCLITE_DELEGATE).

To do that you define LIBPCSCLITE_DELEGATE to use libpcscspy.so.0 and you define LIBPCSCLITE_SPY_DELEGATE (used by libpcscspy.so.0) to use your xrdp library instead of the default libpcsclite library.

libpcsclite.so.1 will call libpcscspy.so.0 which will call your xrdp library.

Security

Is it a new security issue?

No. It was already easy to intercept libpcsclite.so.1 functions using the dynamic linker LD_PRELOAD mechanism. This was the mechanism documented to spy PC/SC calls. See PCSC API spy, third try or PCSC API spy, update.

Conclusion

If you find new/innovative ways to use LIBPCSCLITE_DELEGATE please tell me.

Changes:

2.1.0: Ludovic Rousseau

12 April 2024

• LIBPCSCLITE_DELEGATE is used to redirect to another libpcsclite library

• setup_spy.sh displays the LIBPCSCLITE_DELEGATE value to use for spying

• provides libfake.c as a sample source code

• Some other minor improvements

Changes:

2.0.9 (April 2024)

• fix a bug with CardRequestTimeoutException introduced in 2.0.8

• Minor changes