Attention is currently required from: pespin.
osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ci/+/38632?usp=email )
Change subject: osmo-depcheck: Remove libosmo-sccp-legacy dep libosmo-xua
......................................................................
Patch Set 2: Code-Review+2
--
To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/38632?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-ci
Gerrit-Branch: master
Gerrit-Change-Id: I83ef3576507cc615090afd5d80d985551c7aa5a7
Gerrit-Change-Number: 38632
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Comment-Date: Tue, 05 Nov 2024 11:05:59 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/38635?usp=email )
Change subject: global_platform/scp: refactor _wrap_cmd_apdu
......................................................................
global_platform/scp: refactor _wrap_cmd_apdu
The _wrap_cmd_apdu methods for SCP02 and SCP03 are a bit hard to read. Let's
refactor them so that it is easier to understand what happens. In particular
that one can not have encryption (cenc) without signing (cmac)
Related: OS#6367
Change-Id: I4c5650337779a4bd1f98673650c6c3cb526d518b
---
M pySim/global_platform/scp.py
1 file changed, 38 insertions(+), 35 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/35/38635/1
diff --git a/pySim/global_platform/scp.py b/pySim/global_platform/scp.py
index 0b1f6a9..ebdd880 100644
--- a/pySim/global_platform/scp.py
+++ b/pySim/global_platform/scp.py
@@ -275,23 +275,24 @@
def _wrap_cmd_apdu(self, apdu: bytes, *args, **kwargs) -> bytes:
"""Wrap Command APDU for SCP02: calculate MAC and encrypt."""
- lc = len(apdu) - 5
- assert len(apdu) >= 5, "Wrong APDU length: %d" % len(apdu)
- assert len(apdu) == 5 or apdu[4] == lc, "Lc differs from length of data: %d vs %d" % (apdu[4], lc)
-
logger.debug("wrap_cmd_apdu(%s)", b2h(apdu))
-
- cla = apdu[0]
- b8 = cla & 0x80
- if cla & 0x03 or cla & CLA_SM:
- # nonzero logical channel in APDU, check that are the same
- assert cla == self._cla(False, b8), "CLA mismatch"
- # CLA without log. channel can be 80 or 00 only
if self.do_cmac:
+ lc = len(apdu) - 5
+ assert len(apdu) >= 5, "Wrong APDU length: %d" % len(apdu)
+ assert len(apdu) == 5 or apdu[4] == lc, "Lc differs from length of data: %d vs %d" % (apdu[4], lc)
+
+ # CLA without log. channel can be 80 or 00 only
+ cla = apdu[0]
+ b8 = cla & 0x80
+ if cla & 0x03 or cla & CLA_SM:
+ # nonzero logical channel in APDU, check that are the same
+ assert cla == self._cla(False, b8), "CLA mismatch"
+
if self.mac_on_unmodified:
mlc = lc
clac = cla
- else: # CMAC on modified APDU
+ else:
+ # CMAC on modified APDU
mlc = lc + 8
clac = cla | CLA_SM
mac = self.sk.calc_mac_1des(bytes([clac]) + apdu[1:4] + bytes([mlc]) + apdu[5:])
@@ -301,8 +302,10 @@
lc = len(data)
else:
data = apdu[5:]
+
lc += 8
apdu = bytes([self._cla(True, b8)]) + apdu[1:4] + bytes([lc]) + data + mac
+
return apdu
def unwrap_rsp_apdu(self, sw: bytes, rsp_apdu: bytes) -> bytes:
@@ -475,30 +478,30 @@
def _wrap_cmd_apdu(self, apdu: bytes, skip_cenc: bool = False) -> bytes:
"""Wrap Command APDU for SCP03: calculate MAC and encrypt."""
- cla = apdu[0]
- ins = apdu[1]
- p1 = apdu[2]
- p2 = apdu[3]
- lc = apdu[4]
- assert lc == len(apdu) - 5
- cmd_data = apdu[5:]
-
- if self.do_cenc and not skip_cenc:
- assert self.do_cmac
- if lc == 0:
- # No encryption shall be applied to a command where there is no command data field. In this
- # case, the encryption counter shall still be incremented
- self.sk.block_nr += 1
- else:
- # data shall be padded as defined in [GPCS] section B.2.3
- padded_data = pad80(cmd_data, 16)
- lc = len(padded_data)
- if lc >= 256:
- raise ValueError('Modified Lc (%u) would exceed maximum when appending padding' % (lc))
- # perform AES-CBC with ICV + S_ENC
- cmd_data = self.sk._encrypt(padded_data)
-
+ logger.debug("wrap_cmd_apdu(%s)", b2h(apdu))
if self.do_cmac:
+ cla = apdu[0]
+ ins = apdu[1]
+ p1 = apdu[2]
+ p2 = apdu[3]
+ lc = apdu[4]
+ assert lc == len(apdu) - 5
+ cmd_data = apdu[5:]
+
+ if self.do_cenc and not skip_cenc:
+ if lc == 0:
+ # No encryption shall be applied to a command where there is no command data field. In this
+ # case, the encryption counter shall still be incremented
+ self.sk.block_nr += 1
+ else:
+ # data shall be padded as defined in [GPCS] section B.2.3
+ padded_data = pad80(cmd_data, 16)
+ lc = len(padded_data)
+ if lc >= 256:
+ raise ValueError('Modified Lc (%u) would exceed maximum when appending padding' % (lc))
+ # perform AES-CBC with ICV + S_ENC
+ cmd_data = self.sk._encrypt(padded_data)
+
# The length of the command message (Lc) shall be incremented by 8 (in S8 mode) or 16 (in S16
# mode) to indicate the inclusion of the C-MAC in the data field of the command message.
mlc = lc + self.s_mode
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/38635?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: I4c5650337779a4bd1f98673650c6c3cb526d518b
Gerrit-Change-Number: 38635
Gerrit-PatchSet: 1
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
dexter has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/38607?usp=email )
Change subject: pySim-shell: fix reset command for no-profile mode
......................................................................
pySim-shell: fix reset command for no-profile mode
There are situations where no card profile can be determined. In this case no
RuntimeState will be present. This is in particular the case when pySim-shell
is used on a card that is not provisioned/initialized yet. In those cases we
have to go the direct route and reset the card directly.
Related: OS#6367
Change-Id: I27bf9fdb131d8bdeba07f4dfd2b76b38f9bfdd17
---
M pySim-shell.py
1 file changed, 6 insertions(+), 1 deletion(-)
Approvals:
fixeria: Looks good to me, approved
Jenkins Builder: Verified
laforge: Looks good to me, but someone else must approve
diff --git a/pySim-shell.py b/pySim-shell.py
index f53efd3..413d3f7 100755
--- a/pySim-shell.py
+++ b/pySim-shell.py
@@ -274,7 +274,12 @@
@cmd2.with_category(CUSTOM_CATEGORY)
def do_reset(self, opts):
"""Reset the Card."""
- atr = self.rs.reset(self)
+ if self.rs is None:
+ # In case no runtime state is available we go the direct route
+ self.card._scc.reset_card()
+ atr = b2h(self.card._scc.get_atr())
+ else:
+ atr = self.rs.reset(self)
self.poutput('Card ATR: %s' % atr)
self.update_prompt()
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/38607?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: I27bf9fdb131d8bdeba07f4dfd2b76b38f9bfdd17
Gerrit-Change-Number: 38607
Gerrit-PatchSet: 2
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
dexter has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/38606?usp=email )
Change subject: pySim-shell: allow checking of APDU responses
......................................................................
pySim-shell: allow checking of APDU responses
The "apdu" command allows us to send custom APDUs to a card. This command is
often used in low level initialization scripts or tests. To stop the script
execution in case of an error, the command allows us to specify a status word
that must match the status word of the response. But we have no such mechanism
for the response itself. Let's add another parameter where we can pass a regex
that the response must match.
Related: OS#6367
Change-Id: I97bbcdf37bdcf00ad50a875b96940c211de7073d
---
M pySim-shell.py
1 file changed, 6 insertions(+), 0 deletions(-)
Approvals:
laforge: Looks good to me, but someone else must approve
fixeria: Looks good to me, approved
Jenkins Builder: Verified
diff --git a/pySim-shell.py b/pySim-shell.py
index 37d58ae..f53efd3 100755
--- a/pySim-shell.py
+++ b/pySim-shell.py
@@ -21,6 +21,7 @@
import json
import traceback
+import re
import cmd2
from packaging import version
@@ -239,6 +240,7 @@
apdu_cmd_parser = argparse.ArgumentParser()
apdu_cmd_parser.add_argument('--expect-sw', help='expect a specified status word', type=str, default=None)
+ apdu_cmd_parser.add_argument('--expect-response-regex', help='match response against regex', type=str, default=None)
apdu_cmd_parser.add_argument('--raw', help='Bypass the logical channel (and secure channel)', action='store_true')
apdu_cmd_parser.add_argument('APDU', type=is_hexstr, help='APDU as hex string')
@@ -264,6 +266,10 @@
if opts.expect_sw:
if not sw_match(sw, opts.expect_sw):
raise SwMatchError(sw, opts.expect_sw)
+ if opts.expect_response_regex:
+ response_regex_compiled = re.compile(opts.expect_response_regex)
+ if re.match(response_regex_compiled, data) is None:
+ raise ValueError("RESP does not match regex \'%s\'" % opts.expect_response_regex)
@cmd2.with_category(CUSTOM_CATEGORY)
def do_reset(self, opts):
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/38606?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: I97bbcdf37bdcf00ad50a875b96940c211de7073d
Gerrit-Change-Number: 38606
Gerrit-PatchSet: 2
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
dexter has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/38603?usp=email )
Change subject: pySim-shell_test/utils: print logfile on all types of errors
......................................................................
pySim-shell_test/utils: print logfile on all types of errors
When pySim-shell has problems starting up, it exits with an error
code. This is detected by the testsuite, but it also causes an
early exit, so that the log file content are not printed.
Change-Id: Ic0f34eda32a7c557810abcb05a84e343741fdb8a
---
M tests/pySim-shell_test/utils.py
1 file changed, 8 insertions(+), 4 deletions(-)
Approvals:
Jenkins Builder: Verified
fixeria: Looks good to me, approved
laforge: Looks good to me, but someone else must approve
diff --git a/tests/pySim-shell_test/utils.py b/tests/pySim-shell_test/utils.py
index 348c9b1..c3cf7a2 100644
--- a/tests/pySim-shell_test/utils.py
+++ b/tests/pySim-shell_test/utils.py
@@ -265,11 +265,9 @@
# Execute commandline
cmdline += " > " + logfile_name + " 2>&1"
print("Executing: " + cmdline)
- rc = os.system(cmdline)
- if rc:
- raise RuntimeError("pySim-shell exits with error code %u" % rc)
+ py_sim_shell_rc = os.system(cmdline)
- # Check for exceptions
+ # Read logfile
logfile = open(logfile_name)
logfile_content = logfile.read()
if self.print_content:
@@ -278,6 +276,12 @@
print(logfile_content)
print("-----------------------8<-----------------------")
logfile.close()
+
+ # Exit early in case pySim-shell ran into a fundamental error
+ if py_sim_shell_rc:
+ raise RuntimeError("pySim-shell exits with error code %u" % py_sim_shell_rc)
+
+ # Check log for exceptions
exception_regex_compiled = re.compile('.*EXCEPTION.*')
exceptions_strings = re.findall(exception_regex_compiled, logfile_content)
if exceptions_strings != []:
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/38603?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: Ic0f34eda32a7c557810abcb05a84e343741fdb8a
Gerrit-Change-Number: 38603
Gerrit-PatchSet: 4
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>