Hello!
Disclosure: This report and patch were developed by a ChatGPT AI agent. I
manually sanity-checked both and manually tested the patch’s effectiveness with
the reader.
On macOS, scdaemon resolves SCardControl with dlsym() but calls it through a
seven-argument function pointer. Apple’s PC/SC framework exports SCardControl
as the legacy five-argument function; its seven-argument function is named
SCardControl132. The header’s macro mapping of SCardControl to SCardControl132
does not affect a dlsym() lookup. OpenSC selects SCardControl132 explicitly on
macOS.
Test environment:
macOS 27.2 (build 26B5091g), arm64
GnuPG 2.5.22, tested both unpatched and patched against the same reader and
driver
Cherry ST-2000 (USB 046a:003e) with an OpenPGP card, accessed through macOS
PC/SC with CCID disabled in scdaemon
In a read-only SERIALNO openpgp test, unpatched GnuPG 2.5.22 reads the card but
logs:
pcsc_control failed: not transacted (0x80100016)
pcsc_vendor_specific_init: GET_FEATURE_REQUEST failed: 65547
With the proposed patch, the same GnuPG version and reader complete the feature
request and detect FEATURE_VERIFY_PIN_DIRECT. I then entered the PIN on the
ST-2000 keypad, created a test signature, and verified that signature
successfully. The original symptom—PIN entry on the Mac instead of the
reader—was also observed with MacGPG 2.2.44.
Proposed patch against GnuPG 2.5.22:
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -1182,7 +1182,13 @@
pcsc_end_transaction = dlsym (handle, "SCardEndTransaction");
pcsc_transmit = dlsym (handle, "SCardTransmit");
pcsc_set_timeout = dlsym (handle, "SCardSetTimeout");
+#ifdef __APPLE__
+ /* The 7-argument PC/SC API is exported under this name on macOS.
+ * SCardControl is the incompatible, older 5-argument API. */
+ pcsc_control = dlsym (handle, "SCardControl132");
+#else
pcsc_control = dlsym (handle, "SCardControl");
+#endif
if (!pcsc_establish_context
|| !pcsc_release_context
Could you review this macOS-specific lookup? I have tested it on the
environment above, but not on older macOS releases.
--
Best regards
Mario Hoberg
E-Mail: [email protected]
Internet: iserv.de
Zentrale: IServ GmbH, Vossenkamp 6, 38104 Braunschweig
Niederlassungen:
IServ GmbH, Girardetstr. 6, 45131 Essen
IServ GmbH, Fanningerstraße 13, 10365 Berlin
USt-IdNr. DE265149425 | Amtsgericht Braunschweig | HRB 201822
Geschäftsführer: Benjamin Heindl, Martin Hüppe, Jörg Ludwig
Grundsätze zum Datenschutz: iserv.de/privacy
IServ - aus der Schule für die Schule--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -1182,7 +1182,13 @@
pcsc_end_transaction = dlsym (handle, "SCardEndTransaction");
pcsc_transmit = dlsym (handle, "SCardTransmit");
pcsc_set_timeout = dlsym (handle, "SCardSetTimeout");
+#ifdef __APPLE__
+ /* The 7-argument PC/SC API is exported under this name on macOS.
+ * SCardControl is the incompatible, older 5-argument API. */
+ pcsc_control = dlsym (handle, "SCardControl132");
+#else
pcsc_control = dlsym (handle, "SCardControl");
+#endif
if (!pcsc_establish_context
|| !pcsc_release_context
_______________________________________________
Gnupg-users mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-users
