Attention is currently required from: dexter.
laforge has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-bsc/+/38957?usp=email )
Change subject: pcu_sock: do not receive a TXT ind. with PCU_VERSION for a specific BTS
......................................................................
Patch Set 3: Code-Review+1
--
To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/38957?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-bsc
Gerrit-Branch: master
Gerrit-Change-Id: I3fbf5430db8b8ea29efb147bd162706990453fc5
Gerrit-Change-Number: 38957
Gerrit-PatchSet: 3
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: dexter <pmaier(a)sysmocom.de>
Gerrit-Comment-Date: Wed, 27 Nov 2024 07:13:31 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-pcu/+/38954?usp=email )
Change subject: pcuif: add comment on TXT_IND/PCU_VERSION BTS initialization behavior
......................................................................
pcuif: add comment on TXT_IND/PCU_VERSION BTS initialization behavior
The PCU sends a TXT_IND with the PCU_VERSION as the first message
after the socket connection is established. The BTS/BSC uses those
messages to trigger some initialization (allocate BTS object inside
the PCU, send SI to the PCU).
Unfortunately the PCU will send the TXT_IND with the PCU_VERSION
always with to BTS 0. The 0 in this case is a hardcoded fake BTS
number (There is no BTS object allocated under this number in the
PCU at this point). However, the BTS/BSC will then do the
initialization process for BTS 0, which works by chance for the
BTS where the BTS number is always 0, in the case of the BSC there
may be multiple BTS configured, so there may be arbitrary BTS
numbers.
Let's fix this design error by agreeing that a TXT_IND that has the
type PCU_VERSION is always addressing the receiving process as a whole
and therefore the BTS number in the indication must be ignored.
Related: OS#6507
Change-Id: Ib3f340ae9450151549ce61d34b28253d499ae04a
---
M src/pcu_l1_if.cpp
1 file changed, 7 insertions(+), 0 deletions(-)
Approvals:
fixeria: Looks good to me, but someone else must approve
Jenkins Builder: Verified
laforge: Looks good to me, approved
diff --git a/src/pcu_l1_if.cpp b/src/pcu_l1_if.cpp
index fb44bd8..630c244 100644
--- a/src/pcu_l1_if.cpp
+++ b/src/pcu_l1_if.cpp
@@ -124,6 +124,13 @@
struct gsm_pcu_if_txt_ind *txt;
va_list ap;
char *rep;
+
+ /* In case the caller sends a TXT indication of type PCU_VERSION, the bts_nr will always be 0. Also the receiver
+ * is expected to ignore the bts_nr when receiving a TXT indication of type PCU_VERSION. The rationale is that
+ * the information about the PCU version number is only useful to the receiving process as a whole (be it osmo-bsc
+ * or osmo-bts). */
+ /* TODO: add support for sending other TXT indication types than PCU_VERSION */
+ OSMO_ASSERT(t == PCU_VERSION);
struct msgb *msg = pcu_msgb_alloc(PCU_IF_MSG_TXT_IND, 0);
if (!msg)
return -ENOMEM;
--
To view, visit https://gerrit.osmocom.org/c/osmo-pcu/+/38954?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-pcu
Gerrit-Branch: master
Gerrit-Change-Id: Ib3f340ae9450151549ce61d34b28253d499ae04a
Gerrit-Change-Number: 38954
Gerrit-PatchSet: 1
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/38943?usp=email )
Change subject: contrib/esim-qrcode.py: Small command line tool to encode eSIM QR codes
......................................................................
contrib/esim-qrcode.py: Small command line tool to encode eSIM QR codes
Change-Id: I7983de79937124cc258efd459c51f812f5fa79cb
---
A contrib/esim-qrcode-gen.py
1 file changed, 48 insertions(+), 0 deletions(-)
Approvals:
Jenkins Builder: Verified
fixeria: Looks good to me, but someone else must approve
laforge: Looks good to me, approved
diff --git a/contrib/esim-qrcode-gen.py b/contrib/esim-qrcode-gen.py
new file mode 100755
index 0000000..b680252
--- /dev/null
+++ b/contrib/esim-qrcode-gen.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+
+# Small command line utility program to encode eSIM QR-Codes
+
+# (C) 2024 by Harald Welte <laforge(a)osmocom.org>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import sys
+import argparse
+
+from pySim.esim import ActivationCode
+
+
+option_parser = argparse.ArgumentParser(description="""
+eSIM QR code generator. Will encode the given hostname + activation code
+into the eSIM RSP String format as specified in SGP.22 Section 4.1. If
+a PNG output file is specified, it will also generate a QR code.""")
+option_parser.add_argument('hostname', help='FQDN of SM-DP+')
+option_parser.add_argument('token', help='MatchingID / Token')
+option_parser.add_argument('--oid', help='SM-DP+ OID in CERT.DPauth.ECDSA')
+option_parser.add_argument('--confirmation-code-required', action='store_true',
+ help='Whether a Confirmation Code is required')
+option_parser.add_argument('--png', help='Output PNG file name (no PNG is written if omitted)')
+
+
+
+if __name__ == '__main__':
+ opts = option_parser.parse_args()
+
+ ac = ActivationCode(opts.hostname, opts.token, opts.oid, opts.confirmation_code_required)
+ print(ac.to_string())
+ if opts.png:
+ with open(opts.png, 'wb') as f:
+ img = ac.to_qrcode()
+ img.save(f)
+ print("# generated QR code stored to '%s'" % (opts.png))
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/38943?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: I7983de79937124cc258efd459c51f812f5fa79cb
Gerrit-Change-Number: 38943
Gerrit-PatchSet: 1
Gerrit-Owner: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/38959?usp=email )
Change subject: contrib/suci-keytool.py: Convenience tool for SUCI key generation
......................................................................
contrib/suci-keytool.py: Convenience tool for SUCI key generation
This adds a small utility program that can be used for generating
keys used for SUCI in 5G SA networks, as well as for dumping them
in a format that's compatible with what is needed on the USIM.
Change-Id: I9e92bbba7f700e160ea9c58da5f23fa4c31d40c6
---
A contrib/suci-keytool.py
M docs/index.rst
A docs/suci-keytool.rst
3 files changed, 111 insertions(+), 0 deletions(-)
Approvals:
laforge: Looks good to me, approved
Jenkins Builder: Verified
diff --git a/contrib/suci-keytool.py b/contrib/suci-keytool.py
new file mode 100755
index 0000000..6abd489
--- /dev/null
+++ b/contrib/suci-keytool.py
@@ -0,0 +1,52 @@
+#!/usr/bin/env python3
+
+# small utility program to deal with 5G SUCI key material, at least for the ECIES Protection Scheme
+# Profile A (curve25519) and B (secp256r1)
+
+# (C) 2024 by Harald Welte <laforge(a)osmocom.org>
+# SPDX-License-Identifier: GPL-2.0+
+
+import argparse
+
+from osmocom.utils import b2h
+from Cryptodome.PublicKey import ECC
+# if used with pycryptodome < v3.21.0 you will get the following error when using curve25519:
+# "Cryptodome.PublicKey.ECC.UnsupportedEccFeature: Unsupported ECC purpose (OID: 1.3.101.110)"
+
+def gen_key(opts):
+ # FIXME: avoid overwriting key files
+ mykey = ECC.generate(curve=opts.curve)
+ data = mykey.export_key(format='PEM')
+ with open(opts.key_file, "wt") as f:
+ f.write(data)
+
+def dump_pkey(opts):
+
+ #with open("curve25519-1.key", "r") as f:
+
+ with open(opts.key_file, "r") as f:
+ data = f.read()
+ mykey = ECC.import_key(data)
+
+ der = mykey.public_key().export_key(format='raw', compress=opts.compressed)
+ print(b2h(der))
+
+arg_parser = argparse.ArgumentParser(description="""Generate or export SUCI keys for 5G SA networks""")
+arg_parser.add_argument('--key-file', help='The key file to use', required=True)
+
+subparsers = arg_parser.add_subparsers(dest='command', help="The command to perform", required=True)
+
+parser_genkey = subparsers.add_parser('generate-key', help='Generate a new key pair')
+parser_genkey.add_argument('--curve', help='The ECC curve to use', choices=['secp256r1','curve25519'], required=True)
+
+parser_dump_pkey = subparsers.add_parser('dump-pub-key', help='Dump the public key')
+parser_dump_pkey.add_argument('--compressed', help='Use point compression', action='store_true')
+
+if __name__ == '__main__':
+
+ opts = arg_parser.parse_args()
+
+ if opts.command == 'generate-key':
+ gen_key(opts)
+ elif opts.command == 'dump-pub-key':
+ dump_pkey(opts)
diff --git a/docs/index.rst b/docs/index.rst
index 228fb79..1dfa624 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -44,6 +44,7 @@
library
osmo-smdpp
sim-rest
+ suci-keytool
Indices and tables
diff --git a/docs/suci-keytool.rst b/docs/suci-keytool.rst
new file mode 100644
index 0000000..88e3a24
--- /dev/null
+++ b/docs/suci-keytool.rst
@@ -0,0 +1,58 @@
+suci-keytool
+============
+
+Subscriber concealment is an important feature of the 5G SA architecture: It avoids the many privacy
+issues associated with having a permanent identifier (SUPI, traditionally the IMSI) transmitted in plain text
+over the air interface. Using SUCI solves this issue not just for the air interface; it even ensures the SUPI/IMSI
+is not known to the visited network (VPLMN) at all.
+
+In principle, the SUCI mechanism works by encrypting the SUPI by asymmetric (public key) cryptography:
+Only the HPLMN is in possession of the private key and hence can decrypt the SUCI to the SUPI, while
+each subscriber has the public key in order to encrypt their SUPI into the SUCI. In reality, the
+details are more complex, as there are ephemeral keys and cryptographic MAC involved.
+
+In any case, in order to operate a SUCI-enabled 5G SA network, you will have to
+
+#. generate a ECC key pair of public + private key
+#. deploy the public key on your USIMs
+#. deploy the private key on your 5GC, specifically the UDM function
+
+pysim contains (int its `contrib` directory) a small utility program that can make it easy to generate
+such keys: `suci-keytool.py`
+
+Generating keys
+~~~~~~~~~~~~~~~
+
+Example: Generating a *secp256r1* ECC public key pair and storing it to `/tmp/suci.key`:
+::
+
+ $ ./contrib/suci-keytool.py --key-file /tmp/suci.key generate-key --curve secp256r1
+
+Dumping public keys
+~~~~~~~~~~~~~~~~~~~
+
+In order to store the key to SIM cards as part of `ADF.USIM/DF.5GS/EF.SUCI_Calc_Info`, you will need
+a hexadecimal representation of the public key. You can achieve that using the `dump-pub-key` operation
+of suci-keytool:
+
+Example: Dumping the public key part from a previously generated key file:
+::
+
+ $ ./contrib/suci-keytool.py --key-file /tmp/suci.key dump-pub-key
+ 0473152f32523725f5175d255da2bd909de97b1d06449a9277bc629fe42112f8643e6b69aa6dce6c86714ccbe6f2e0f4f4898d102e2b3f0c18ce26626f052539bb
+
+If you want the point-compressed representation, you can use the `--compressed` option:
+::
+
+ $ ./contrib/suci-keytool.py --key-file /tmp/suci.key dump-pub-key --compressed
+ 0373152f32523725f5175d255da2bd909de97b1d06449a9277bc629fe42112f864
+
+
+
+suci-keytool syntax
+~~~~~~~~~~~~~~~~~~~
+
+.. argparse::
+ :module: contrib.suci-keytool
+ :func: arg_parser
+ :prog: contrib/suci-keytool.py
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/38959?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: I9e92bbba7f700e160ea9c58da5f23fa4c31d40c6
Gerrit-Change-Number: 38959
Gerrit-PatchSet: 1
Gerrit-Owner: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
laforge has posted comments on this change by laforge. ( https://gerrit.osmocom.org/c/pysim/+/38961?usp=email )
Change subject: docs/shell: Fix documentation for eUICC ISD-R specific commands
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/38961?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: I1d7e2d1a5dfbdcc11b1fdb3e89845787f7cddbfc
Gerrit-Change-Number: 38961
Gerrit-PatchSet: 1
Gerrit-Owner: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Comment-Date: Wed, 27 Nov 2024 07:12:34 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
laforge has posted comments on this change by laforge. ( https://gerrit.osmocom.org/c/pysim/+/38960?usp=email )
Change subject: es2p_client: Print the activation code after confirmOrder success
......................................................................
Patch Set 1: Code-Review+2
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/38960?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: I92608ff0cdc35b184edff0c656221644ba36f257
Gerrit-Change-Number: 38960
Gerrit-PatchSet: 1
Gerrit-Owner: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Comment-Date: Wed, 27 Nov 2024 07:12:31 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes