From 8bd6eafeb9635c380d5d32bb56a90f15699263db Mon Sep 17 00:00:00 2001
From: Subrahmanyaman <subrahmanyaman@google.com>
Date: Wed, 1 Jun 2022 04:04:47 +0000
Subject: [PATCH] CLA Validation moved to SEProvider.

---
 .../javacard/keymaster/KMAndroidSEProvider.java |  6 ++++++
 .../javacard/keymaster/KMJCardSimulator.java    | 17 +++++++++++++++++
 .../javacard/keymaster/KMKeymasterApplet.java   |  6 ++----
 .../javacard/keymaster/KMSEProvider.java        |  9 +++++++++
 4 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEProvider.java b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEProvider.java
index c348a009..23b4b701 100644
--- a/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEProvider.java
+++ b/Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEProvider.java
@@ -18,6 +18,7 @@
 import org.globalplatform.upgrade.Element;
 import org.globalplatform.upgrade.UpgradeManager;
 
+import javacard.framework.APDU;
 import javacard.framework.JCSystem;
 import javacard.framework.Util;
 import javacard.security.AESKey;
@@ -1540,5 +1541,10 @@ public boolean ecVerify256(byte[] keyBuf, short keyBufStart, short keyBufLen,
     }
   }
 
+  @Override
+  public boolean isValidCLA(APDU apdu) {
+    return apdu.isValidCLA();
+  }
+
     
 }
diff --git a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimulator.java b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimulator.java
index 7374ec09..c787a549 100644
--- a/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimulator.java
+++ b/Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimulator.java
@@ -27,6 +27,7 @@
 import java.security.spec.RSAPrivateKeySpec;
 import java.security.spec.RSAPublicKeySpec;
 
+import javacard.framework.APDU;
 import javacard.framework.ISO7816;
 import javacard.framework.ISOException;
 import javacard.framework.JCSystem;
@@ -1435,4 +1436,20 @@ public boolean ecVerify256(byte[] keyBuf, short keyBufStart, short keyBufLen, by
         signatureDataBuf, signatureDataStart, signatureDataLen);
   }
 
+  @Override
+  public boolean isValidCLA(APDU apdu) {
+    /**
+     * Returns whether the current APDU command CLA byte is valid. The CLA byte is invalid
+     * if the CLA bits (b8,b7,b6) is %b001, which is a CLA encoding reserved for future use(RFU),
+     * or if CLA is 0xFF which is an invalid value as defined in the ISO 7816-4:2013 specification.
+     */
+    byte[] apduBuffer = apdu.getBuffer();
+    short apduClass = (short) (apduBuffer[ISO7816.OFFSET_CLA] & 0x00FF);
+    if (((apduClass & 0x00E0) == 0x0020) ||
+        (apduClass == 0x00FF)) {
+      return false;
+    }
+    return true;
+  }
+
 }
diff --git a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java
index 0e67dc06..7801ef0d 100644
--- a/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java
+++ b/Applet/src/com/android/javacard/keymaster/KMKeymasterApplet.java
@@ -38,7 +38,6 @@ public class KMKeymasterApplet extends Applet implements AppletEvent, ExtendedLe
   public static final byte AES_BLOCK_SIZE = 16;
   public static final byte DES_BLOCK_SIZE = 8;
   public static final short MAX_LENGTH = (short) 0x2000;
-  private static final byte CLA_ISO7816_NO_SM_NO_CHAN = (byte) 0x80;
   private static final short KM_HAL_VERSION = (short) 0x4000;
   private static final short MAX_AUTH_DATA_SIZE = (short) 512;
   private static final short POWER_RESET_MASK_FLAG = (short) 0x4000;
@@ -354,11 +353,10 @@ private short mapCryptoErrorToKMError(short reason) {
   protected void validateApduHeader(APDU apdu) {
     // Read the apdu header and buffer.
     byte[] apduBuffer = apdu.getBuffer();
-    byte apduClass = apduBuffer[ISO7816.OFFSET_CLA];
     short P1P2 = Util.getShort(apduBuffer, ISO7816.OFFSET_P1);
 
-    // Validate APDU Header.
-    if ((apduClass != CLA_ISO7816_NO_SM_NO_CHAN)) {
+    // Validate CLA 
+    if (!seProvider.isValidCLA(apdu)) {
       ISOException.throwIt(ISO7816.SW_CLA_NOT_SUPPORTED);
     }
 
diff --git a/Applet/src/com/android/javacard/keymaster/KMSEProvider.java b/Applet/src/com/android/javacard/keymaster/KMSEProvider.java
index ed72cd8f..269fa130 100644
--- a/Applet/src/com/android/javacard/keymaster/KMSEProvider.java
+++ b/Applet/src/com/android/javacard/keymaster/KMSEProvider.java
@@ -15,6 +15,7 @@
  */
 package com.android.javacard.keymaster;
 
+import javacard.framework.APDU;
 import org.globalplatform.upgrade.Element;
 
 /**
@@ -658,4 +659,12 @@ boolean ecVerify256(
       byte[] signature,
       short signatureOff,
       short signatureLen);
+
+  /**
+   * Validates the CLA in the APDU.
+   *
+   * @param apdu instance of the APDU class.
+   * @return true if CLA is valid, false otherwise.
+   */
+  boolean isValidCLA(APDU apdu);
 }