February 2024 - gerrit-log - lists.osmocom.org

[M] Change in pysim[master]: SCP02: Only C-MAC/C-ENCRYPT APDUs whose CLA byte indicates GlobalPlat...

by laforge

Attention is currently required from: laforge. Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/35769?usp=email to look at the new patch set (#4). The following approvals got outdated and were removed: Verified-1 by Jenkins Builder Change subject: SCP02: Only C-MAC/C-ENCRYPT APDUs whose CLA byte indicates GlobalPlatform ...................................................................... SCP02: Only C-MAC/C-ENCRYPT APDUs whose CLA byte indicates GlobalPlatform I'm not entirely sure if this is the right thing to do. For sure I do have cards which don't like SELECT with C-MAC appended... and GlobalPlatform clearly states SELECT is coded with CLA value that has the MSB not set (i.e. not a GlobalPlatform command). Change-Id: Ieda75c865a6ff2725fc3c8772bb274d96b8a5a43 --- M pySim/global_platform/scp02.py 1 file changed, 37 insertions(+), 15 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/69/35769/4 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35769?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ieda75c865a6ff2725fc3c8772bb274d96b8a5a43 Gerrit-Change-Number: 35769 Gerrit-PatchSet: 4 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newpatchset

1 year, 5 months

1
0
0 0

[L] Change in pysim[master]: Introduce GlobalPlatform SCP02 implementation

by laforge

Attention is currently required from: dexter, fixeria, laforge. Hello Jenkins Builder, dexter, fixeria, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/35462?usp=email to look at the new patch set (#7). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder Change subject: Introduce GlobalPlatform SCP02 implementation ...................................................................... Introduce GlobalPlatform SCP02 implementation This implementation of GlobalPlatform SCP02 currently only supports C-MAC and C-ENC, but no R-MAC or R-ENC yet. The patch also introduces the notion of having a SCP instance associated with a SimCardCommands instance. No code is using this yet, it will be introduced in a separate patch. Change-Id: I56020382b9dfe8ba0f7c1c9f71eb1a9746bc5a27 --- M pySim/commands.py M pySim/global_platform/__init__.py A pySim/global_platform/scp02.py A pySim/secure_channel.py A tests/test_globalplatform.py 5 files changed, 345 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/62/35462/7 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35462?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I56020382b9dfe8ba0f7c1c9f71eb1a9746bc5a27 Gerrit-Change-Number: 35462 Gerrit-PatchSet: 7 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-MessageType: newpatchset

1 year, 5 months

1
0
0 0

[M] Change in pysim[master]: global_platform: add set_status command

by laforge

Attention is currently required from: laforge. Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/35772?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified-1 by Jenkins Builder Change subject: global_platform: add set_status command ...................................................................... global_platform: add set_status command Using this command, one can change the life cycle status of on-card applications, specifically one can LOCK (disable) them and re-enable them as needed. Change-Id: Ie14297a119d01cad1284f315a2508aa92cb4633b --- M docs/shell.rst M pySim/global_platform/__init__.py 2 files changed, 49 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/72/35772/2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35772?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ie14297a119d01cad1284f315a2508aa92cb4633b Gerrit-Change-Number: 35772 Gerrit-PatchSet: 2 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newpatchset

1 year, 5 months

1
0
0 0

[L] Change in pysim[master]: WIP: Implement Global Platform SCP03

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/35793?usp=email ) Change subject: WIP: Implement Global Platform SCP03 ...................................................................... WIP: Implement Global Platform SCP03 Change-Id: Ibc35af5474923aed2e3bcb29c8d713b4127a160d --- M pySim/global_platform/__init__.py M pySim/global_platform/scp02.py M tests/test_globalplatform.py 3 files changed, 323 insertions(+), 25 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/93/35793/1 diff --git a/pySim/global_platform/__init__.py b/pySim/global_platform/__init__.py index 48e3fe0..7d3ecbb 100644 --- a/pySim/global_platform/__init__.py +++ b/pySim/global_platform/__init__.py @@ -20,9 +20,10 @@ from typing import Optional, List, Dict, Tuple from construct import Optional as COptional from construct import * +from copy import deepcopy from bidict import bidict from Cryptodome.Random import get_random_bytes -from pySim.global_platform.scp02 import SCP02 +from pySim.global_platform.scp02 import SCP02, SCP03 from pySim.construct import * from pySim.utils import * from pySim.filesystem import * @@ -650,16 +651,37 @@ host_challenge = h2b(opts.host_challenge) if opts.host_challenge else get_random_bytes(8) kset = GpCardKeyset(opts.key_ver, h2b(opts.key_enc), h2b(opts.key_mac), h2b(opts.key_dek)) scp02 = SCP02(card_keys=kset) - init_update_apdu = scp02.gen_init_update_apdu(host_challenge=host_challenge) + self._establish_scp(scp02, host_challenge, opts.security_level) + + est_scp03_parser = deepcopy(est_scp02_parser) + est_scp03_parser.add_argument('--s8-mode', action='store_true', help='S8 mode (legacy mode)') + + @cmd2.with_argparser(est_scp03_parser) + def do_establish_scp03(self, opts): + """Establish a secure channel using the GlobalPlatform SCP03 protocol. It can be released + again by using `release_scp`.""" + if self._cmd.lchan.scc.scp: + self._cmd.poutput("Cannot establish SCP03 as this lchan already has a SCP instance!") + return + s_mode = 8 if opts.s8_mode else 16 + host_challenge = h2b(opts.host_challenge) if opts.host_challenge else get_random_bytes(s_mode) + kset = GpCardKeyset(opts.key_ver, h2b(opts.key_enc), h2b(opts.key_mac), h2b(opts.key_dek)) + scp03 = SCP03(card_keys=kset, s_mode = s_mode) + self._establish_scp(scp03, host_challenge, opts.security_level) + + def _establish_scp(self, scp, host_challenge, security_level): + # perform the common functionality shared by SCP02 and SCP03 establishment + init_update_apdu = scp.gen_init_update_apdu(host_challenge=host_challenge) init_update_resp, sw = self._cmd.lchan.scc.send_apdu_checksw(b2h(init_update_apdu)) - scp02.parse_init_update_resp(h2b(init_update_resp)) - ext_auth_apdu = scp02.gen_ext_auth_apdu(opts.security_level) + scp.parse_init_update_resp(h2b(init_update_resp)) + ext_auth_apdu = scp.gen_ext_auth_apdu(security_level) ext_auth_resp, sw = self._cmd.lchan.scc.send_apdu_checksw(b2h(ext_auth_apdu)) - self._cmd.poutput("Successfully established a SCP02 secure channel") + self._cmd.poutput("Successfully established a %s secure channel" % str(scp)) # store a reference to the SCP instance - self._cmd.lchan.scc.scp = scp02 + self._cmd.lchan.scc.scp = scp self._cmd.update_prompt() + def do_release_scp(self, opts): """Release a previously establiehed secure channel.""" if not self._cmd.lchan.scc.scp: diff --git a/pySim/global_platform/scp02.py b/pySim/global_platform/scp02.py index 3f34407..cc3f0ed 100644 --- a/pySim/global_platform/scp02.py +++ b/pySim/global_platform/scp02.py @@ -17,13 +17,16 @@ import abc import logging +from typing import Optional from Cryptodome.Cipher import DES3, DES from Cryptodome.Util.strxor import strxor -from construct import * +from construct import Struct, Bytes, Int8ub, Int16ub, Const +from construct import Optional as COptional from pySim.utils import b2h from pySim.secure_channel import SecureChannel logger = logging.getLogger(__name__) +logger.setLevel(logging.DEBUG) def scp02_key_derivation(constant: bytes, counter: int, base_key: bytes) -> bytes: assert(len(constant) == 2) @@ -34,11 +37,21 @@ cipher = DES3.new(base_key, DES.MODE_CBC, b'\x00' * 8) return cipher.encrypt(derivation_data) +# FIXME: BspAlgoCryptAES128 def pad80(s: bytes, BS=8) -> bytes: """ Pad bytestring s: add '\x80' and '\0'* so the result to be multiple of BS.""" l = BS-1 - len(s) % BS return s + b'\x80' + b'\0'*l +# FIXME: BspAlgoCryptAES128 +def unpad80(padded: bytes) -> bytes: + """Remove the customary 80 00 00 ... padding used for AES.""" + # first remove any trailing zero bytes + stripped = padded.rstrip(b'\0') + # then remove the final 80 + assert stripped[-1] == 0x80 + return stripped[:-1] + class Scp02SessionKeys: """A single set of GlobalPlatform session keys.""" DERIV_CONST_CMAC = b'\x01\x01' @@ -102,6 +115,27 @@ self.mac_on_unmodified = False self.security_level = 0x00 + @property + def do_cmac(self) -> bool: + """Should we perform C-MAC?""" + return self.security_level & 0x01 + + @property + def do_rmac(self) -> bool: + """Should we perform R-MAC?""" + return self.security_level & 0x10 + + @property + def do_cenc(self) -> bool: + """Should we perform C-ENC?""" + return self.security_level & 0x02 + + @property + def do_renc(self) -> bool: + """Should we perform R-ENC?""" + return self.security_level & 0x20 + + def __str__(self) -> str: return "%s[%02x]" % (self.__class__.__name__, self.security_level) @@ -111,10 +145,10 @@ ret = ret | CLA_SM return ret + self.lchan_nr - def wrap_cmd_apdu(self, apdu: bytes) -> bytes: + def wrap_cmd_apdu(self, apdu: bytes, *args, **kwargs) -> bytes: # only protect those APDUs that actually are global platform commands if apdu[0] & 0x80: - return self._wrap_cmd_apdu(apdu) + return self._wrap_cmd_apdu(apdu, *args, **kwargs) else: return apdu @@ -150,21 +184,6 @@ if self.card_cryptogram != resp['card_cryptogram']: raise ValueError("card cryptogram doesn't match") - @property - def do_cmac(self) -> bool: - """Should we perform C-MAC?""" - return self.security_level & 0x01 - - @property - def do_rmac(self) -> bool: - """Should we perform R-MAC?""" - return self.security_level & 0x10 - - @property - def do_cenc(self) -> bool: - """Should we perform C-ENC?""" - return self.security_level & 0x02 - def gen_ext_auth_apdu(self, security_level: int =0x01) -> bytes: """Generate EXTERNAL AUTHENTICATE APDU.""" self.security_level = security_level @@ -211,3 +230,224 @@ def unwrap_rsp_apdu(self, sw: bytes, apdu: bytes) -> bytes: # TODO: Implement R-MAC / R-ENC return apdu + + + +from Cryptodome.Cipher import AES +from Cryptodome.Hash import CMAC + +def scp03_key_derivation(constant: bytes, context: bytes, base_key: bytes, l: Optional[int] = None) -> bytes: + """SCP03 Key Derivation Function as specified in Annex D 4.1.5.""" + # Data derivation shall use KDF in counter mode as specified in NIST SP 800-108 ([NIST 800-108]). The PRF + # used in the KDF shall be CMAC as specified in [NIST 800-38B], used with full 16-byte output length. + def prf(key: bytes, data:bytes): + return CMAC.new(key, data, AES).digest() + + if l == None: + l = len(base_key) * 8 + + logger.warn("scp03_kdf(constant=%s, context=%s, base_key=%s, l=%u", b2h(constant), b2h(context), b2h(base_key), l) + + output_len = l // 8 + + # SCP03 Section 4.1.5 defines a different parameter order than NIST SP 800-108, so we cannot use the + # existing Cryptodome.Protocol.KDF.SP800_108_Counter function :( + # A 12-byte “label” consisting of 11 bytes with value '00' followed by a 1-byte derivation constant + assert len(constant) == 1 + label = b'\x00' *11 + constant + i = 1 + dk = b'' + while len(dk) < output_len: + # 12B label, 1B separation, 2B L, 1B i, Context + info = label + b'\x00' + l.to_bytes(2, 'big') + bytes([i]) + context + logger.warn('info=%s', b2h(info)) + dk += prf(base_key, info) + i += 1 + if i > 0xffff: + raise ValueError("Overflow in SP800 108 counter") + + print("DK: %s" % b2h(dk)) + return dk[:output_len] + + +class Scp03SessionKeys: + # GPC 2.3 Amendment D v1.2 Section 4.1.5 Table 4-1 + DERIV_CONST_AUTH_CGRAM_CARD = b'\x00' + DERIV_CONST_AUTH_CGRAM_HOST = b'\x01' + DERIV_CONST_CARD_CHLG_GEN = b'\x02' + DERIV_CONST_KDERIV_S_ENC = b'\x04' + DERIV_CONST_KDERIV_S_MAC = b'\x06' + DERIV_CONST_KDERIV_S_RMAC = b'\x07' + blocksize = 16 + + def __init__(self, card_keys: 'GpCardKeyset', host_challenge: bytes, card_challenge: bytes): + # GPC 2.3 Amendment D v1.2 Section 6.2.1 + context = host_challenge + card_challenge + self.s_enc = scp03_key_derivation(self.DERIV_CONST_KDERIV_S_ENC, context, card_keys.enc) + self.s_mac = scp03_key_derivation(self.DERIV_CONST_KDERIV_S_MAC, context, card_keys.mac) + self.s_rmac = scp03_key_derivation(self.DERIV_CONST_KDERIV_S_RMAC, context, card_keys.mac) + + + # The first MAC chaining value is set to 16 bytes '00' + self.mac_chaining_value = b'\x00' * 16 + # The encryption counter’s start value shall be set to 1 (we set it immediately before generating ICV) + self.block_nr = 0 + + def calc_cmac(self, apdu: bytes): + """Compute C-MAC for given to-be-transmitted APDU.""" + cmac_input = self.mac_chaining_value + apdu + cmac_val = CMAC.new(self.s_mac, cmac_input, ciphermod=AES).digest() + self.mac_chaining_value = cmac_val + return cmac_val + + def calc_rmac(self, rdata_and_sw: bytes): + """Compute R-MAC for given received R-APDU data section.""" + rmac_input = self.mac_chaining_value + rdata_and_sw + return CMAC.new(self.s_rmac, rmac_input, ciphermod=AES).digest() + + def _get_icv(self, is_response: bool = False): + """Obtain the ICV value computed as described in 6.2.6.""" + if not is_response: + self.block_nr += 1 + # The binary value of this number SHALL be left padded with zeroes to form a full block. + data = self.block_nr.to_bytes(self.blocksize, "big") + if is_response: + # Section 6.2.7: additional intermediate step: Before encryption, the most significant byte of + # this block shall be set to '80'. + data = b'\x80' + data[1:] + iv = bytes([0] * self.blocksize) + # This block SHALL be encrypted with S-ENC to produce the ICV for command encryption. + cipher = AES.new(self.s_enc, AES.MODE_CBC, iv) + icv = cipher.encrypt(data) + logger.debug("_get_icv(data=%s, is_resp=%s) -> icv=%s", b2h(data), is_response, b2h(icv)) + return icv + + def _encrypt(self, data: bytes, is_response: bool = False) -> bytes: + cipher = AES.new(self.s_enc, AES.MODE_CBC, self._get_icv(is_response)) + return cipher.encrypt(data) + + def _decrypt(self, data: bytes, is_response: bool = True) -> bytes: + cipher = AES.new(self.s_enc, AES.MODE_CBC, self._get_icv(is_response)) + return cipher.decrypt(data) + + +class SCP03(SCP): + """Secure Channel Protocol (SCP) 03 as specified in GlobalPlatform v2.3 Amendment D.""" + + # Section 7.1.1.6 / Table 7-3 + constr_iur = Struct('key_div_data'/Bytes(10), 'key_ver'/Int8ub, Const(b'\x03'), 'i_param'/Int8ub, + 'card_challenge'/Bytes(lambda ctx: ctx._.s_mode), + 'card_cryptogram'/Bytes(lambda ctx: ctx._.s_mode), + 'sequence_counter'/COptional(Bytes(3))) + + def __init__(self, *args, **kwargs): + self.s_mode = kwargs.pop('s_mode', 8) + super().__init__(*args, **kwargs) + + def _compute_cryptograms(self): + logger.debug("host_challenge(%s), card_challenge(%s)", b2h(self.host_challenge), b2h(self.card_challenge)) + # Card + Host Authentication Cryptogram: Section 6.2.2.2 + 6.2.2.3 + context = self.host_challenge + self.card_challenge + self.card_cryptogram = scp03_key_derivation(self.sk.DERIV_CONST_AUTH_CGRAM_CARD, context, self.sk.s_mac, l=self.s_mode*8) + self.host_cryptogram = scp03_key_derivation(self.sk.DERIV_CONST_AUTH_CGRAM_HOST, context, self.sk.s_mac, l=self.s_mode*8) + logger.debug("host_cryptogram(%s), card_cryptogram(%s)", b2h(self.host_cryptogram), b2h(self.card_cryptogram)) + + def gen_init_update_apdu(self, host_challenge: Optional[bytes] = None) -> bytes: + """Generate INITIALIZE UPDATE APDU.""" + if host_challenge == None: + host_challenge = b'\x00' * self.s_mode + if len(host_challenge) != self.s_mode: + raise ValueError('Host Challenge must be %u bytes long' % self.s_mode) + self.host_challenge = host_challenge + return bytes([self._cla(), INS_INIT_UPDATE, self.card_keys.kvn, 0, len(host_challenge)]) + host_challenge + + def parse_init_update_resp(self, resp_bin: bytes): + """Parse response to INITIALIZE UPDATE.""" + if len(resp_bin) not in [10+3+8+8, 10+3+16+16, 10+3+8+8+3, 10+3+16+16+3]: + raise ValueError('Invalid length of Initialize Update Response') + resp = self.constr_iur.parse(resp_bin, s_mode=self.s_mode) + self.card_challenge = resp['card_challenge'] + self.i_param = resp['i_param'] + # derive session keys and compute cryptograms + self.sk = Scp03SessionKeys(self.card_keys, self.host_challenge, self.card_challenge) + logger.debug(self.sk) + self._compute_cryptograms() + # verify computed cryptogram matches received cryptogram + if self.card_cryptogram != resp['card_cryptogram']: + raise ValueError("card cryptogram doesn't match") + + def gen_ext_auth_apdu(self, security_level: int = 0x01) -> bytes: + """Generate EXTERNAL AUTHENTICATE APDU.""" + self.security_level = security_level + header = bytes([self._cla(), INS_EXT_AUTH, self.security_level, 0, self.s_mode]) + # bypass encryption for EXTERNAL AUTHENTICATE + return self.wrap_cmd_apdu(header + self.host_cryptogram, skip_cenc=True) + + def _wrap_cmd_apdu(self, apdu: bytes, skip_cenc: bool = False) -> bytes: + """Wrap Command APDU for SCP02: calculate MAC and encrypt.""" + cla = apdu[0] + ins = apdu[1] + p1 = apdu[2] + p2 = apdu[3] + lc = apdu[4] + assert lc == len(apdu) - 5 + cmd_data = apdu[5:] + + if self.do_cenc and not skip_cenc: + assert self.do_cmac + if lc == 0: + # No encryption shall be applied to a command where there is no command data field. In this + # case, the encryption counter shall still be incremented + self.sk.block_nr += 1 + else: + # data shall be padded as defined in [GPCS] section B.2.3 + padded_data = pad80(cmd_data, 16) + lc = len(padded_data) + if lc >= 256: + raise ValueError('Modified Lc (%u) would exceed maximum when appending padding' % (lc, self.s_mode)) + # perform AES-CBC with ICV + S_ENC + cmd_data = self.sk._encrypt(padded_data) + + if self.do_cmac: + # The length of the command message (Lc) shall be incremented by 8 (in S8 mode) or 16 (in S16 + # mode) to indicate the inclusion of the C-MAC in the data field of the command message. + mlc = lc + self.s_mode + if mlc >= 256: + raise ValueError('Modified Lc (%u) would exceed maximum when appending %u bytes of mac' % (mlc, self.s_mode)) + # The class byte shall be modified for the generation or verification of the C-MAC: The logical + # channel number shall be set to zero, bit 4 shall be set to 0 and bit 3 shall be set to 1 to indicate + # GlobalPlatform proprietary secure messaging. + mcla = (cla & 0xF0) | CLA_SM + mapdu = bytes([mcla, ins, p1, p2, mlc]) + cmd_data + cmac = self.sk.calc_cmac(mapdu) + mapdu += cmac[:self.s_mode] + + return mapdu + + def unwrap_rsp_apdu(self, sw: bytes, apdu: bytes) -> bytes: + # No R-MAC shall be generated and no protection shall be applied to a response that includes an error + # status word: in this case only the status word shall be returned in the response. All status words + # except '9000' and warning status words (i.e. '62xx' and '63xx') shall be interpreted as error status + # words. + print("unwrap_rsp_apdu(sw=%s, apdu=%s)" % (sw, apdu)) + if not self.do_rmac: + assert not self.do_renc + return apdu + + if sw != b'\x90\x00' and sw[0] not in [0x62, 0x63]: + return apdu + response_data = apdu[:-self.s_mode] + rmac = apdu[-self.s_mode:] + rmac_exp = self.sk.calc_rmac(response_data + sw)[:self.s_mode] + if rmac != rmac_exp: + raise ValueError("R-MAC value not matching: received: %s, computed: %s" % (rmac, rmac_exp)) + + if self.do_renc: + # decrypt response data + decrypted = self.sk._decrypt(response_data) + print("decrypted: %s" % b2h(decrypted)) + # remove padding + response_data = unpad80(decrypted) + print("response_data: %s" % b2h(response_data)) + + return response_data diff --git a/tests/test_globalplatform.py b/tests/test_globalplatform.py index 2c5e4d4..ade3224 100644 --- a/tests/test_globalplatform.py +++ b/tests/test_globalplatform.py @@ -19,7 +19,7 @@ import logging from pySim.global_platform import * -from pySim.global_platform.scp02 import SCP02 +from pySim.global_platform.scp02 import * from pySim.utils import b2h, h2b KIC = h2b('100102030405060708090a0b0c0d0e0f') # enc @@ -64,5 +64,32 @@ wrapped = self.scp02.wrap_cmd_apdu(h2b('80f28002024f00')) self.assertEqual(b2h(wrapped).upper(), '84F280020A4F00B21AAFA3EB2D1672') +class SCP03_Test_KDF(unittest.TestCase): + host_challenge = h2b('73EAE173050D0459') + # 00000000000000000000 300370 EE29D4C614C2DE31 CD5153A4F5758F91 00000F + card_challenge = h2b('EE29D4C614C2DE31') + + def test_kdf_enc(self): + k_enc = h2b('000102030405060708090a0b0c0d0e0f') + s_enc = scp03_key_derivation(Scp03SessionKeys.DERIV_CONST_KDERIV_S_ENC, self.host_challenge + self.card_challenge, k_enc) + self.assertEqual(b2h(s_enc), 'D948BCF4878524EBC76EA403DC5A2116'.lower()) + + def test_kdf_mac(self): + k_mac = h2b('101112131415161718191A1B1C1D1E1F') + s_mac = scp03_key_derivation(Scp03SessionKeys.DERIV_CONST_KDERIV_S_MAC, self.host_challenge + self.card_challenge, k_mac) + self.assertEqual(b2h(s_mac), 'C27EB5E7827A833CA00BD3F436F7B4E5'.lower()) + + def test_kdf_rmac(self): + k_mac = h2b('101112131415161718191A1B1C1D1E1F') + s_rmac = scp03_key_derivation(Scp03SessionKeys.DERIV_CONST_KDERIV_S_RMAC, self.host_challenge + self.card_challenge, k_mac) + self.assertEqual(b2h(s_rmac), 'B4797059FD825F2BC824F6EC92052948'.lower()) + + def test_cardchallenge(self): + k_enc = h2b('000102030405060708090a0b0c0d0e0f') + aid = h2b('a0000005591010ffffffff8900000100') + counter = h2b('00000f') + ch_comp = scp03_key_derivation(Scp03SessionKeys.DERIV_CONST_AUTH_CGRAM_CARD, counter + aid, k_enc, 8*8) + self.assertEqual(b2h(ch_comp), b2h(self.card_challenge)) + if __name__ == "__main__": unittest.main() -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35793?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ibc35af5474923aed2e3bcb29c8d713b4127a160d Gerrit-Change-Number: 35793 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 year, 5 months

1
0
0 0

[S] Change in osmo-bsc[master]: Add support for M3UA-over-TCP, clarify default SCTP

by fixeria

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-bsc/+/35792?usp=email ) Change subject: Add support for M3UA-over-TCP, clarify default SCTP ...................................................................... Add support for M3UA-over-TCP, clarify default SCTP Change-Id: I078da51abc3511a4854f9c8fbca8eafd2bed78da Depends: libosmo-sccp.git Ife0ae7a4956980da40ee045b0b7eb5cd0ccd1aef Depends: libosmo-sccp.git I8c76d271472befacbeb998a93bbdc9e8660d9b5d Related: SYS#5424 --- M doc/examples/osmo-bsc/osmo-bsc_custom-sccp.cfg M doc/manuals/chapters/running.adoc M include/osmocom/bsc/bsc_msc_data.h M src/osmo-bsc/bsc_vty.c M src/osmo-bsc/lb.c M src/osmo-bsc/osmo_bsc_msc.c 6 files changed, 35 insertions(+), 9 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/92/35792/1 diff --git a/doc/examples/osmo-bsc/osmo-bsc_custom-sccp.cfg b/doc/examples/osmo-bsc/osmo-bsc_custom-sccp.cfg index f10221e..434b996 100644 --- a/doc/examples/osmo-bsc/osmo-bsc_custom-sccp.cfg +++ b/doc/examples/osmo-bsc/osmo-bsc_custom-sccp.cfg @@ -80,7 +80,7 @@ hopping enabled 0 cs7 instance 0 point-code 0.42.1 - !asp asp-clnt-OsmoBSC 2905 0 m3ua + !asp asp-clnt-OsmoBSC 2905 0 m3ua-sctp ! remote-ip 10.23.24.1 ! where to reach the STP ! role asp ! sctp-role client diff --git a/doc/manuals/chapters/running.adoc b/doc/manuals/chapters/running.adoc index 0c6d4fb..2bcffdd 100644 --- a/doc/manuals/chapters/running.adoc +++ b/doc/manuals/chapters/running.adoc @@ -98,12 +98,12 @@ An example configuration of OsmoBSC's AoIP SCCP link, assuming the BSC at point-code 1.23.3 and the MSC reachable at point-code 0.23.1 via an SG -listening for M3UA at 127.0.0.1:2905: +listening for M3UA (SCTP) at 127.0.0.1:2905: ---- cs7 instance 0 point-code 1.23.3 - asp asp-clnt-msc-0 2905 0 m3ua + asp asp-clnt-msc-0 2905 0 m3ua-sctp remote-ip 127.0.0.1 role asp sctp-role client diff --git a/include/osmocom/bsc/bsc_msc_data.h b/include/osmocom/bsc/bsc_msc_data.h index ae29725..b762695 100644 --- a/include/osmocom/bsc/bsc_msc_data.h +++ b/include/osmocom/bsc/bsc_msc_data.h @@ -255,7 +255,8 @@ { switch (msc->a.asp_proto) { case OSMO_SS7_ASP_PROT_SUA: - case OSMO_SS7_ASP_PROT_M3UA: + case OSMO_SS7_ASP_PROT_M3UA_SCTP: + case OSMO_SS7_ASP_PROT_M3UA_TCP: return true; default: return false; diff --git a/src/osmo-bsc/bsc_vty.c b/src/osmo-bsc/bsc_vty.c index 8690a47..8a9b1d7 100644 --- a/src/osmo-bsc/bsc_vty.c +++ b/src/osmo-bsc/bsc_vty.c @@ -3031,18 +3031,30 @@ DEFUN(cfg_msc_cs7_asp_proto, cfg_msc_cs7_asp_proto_cmd, - "asp-protocol (m3ua|sua|ipa)", + "asp-protocol (m3ua-sctp|m3ua-tcp|sua|ipa)", "A interface protocol to use for this MSC)\n" - "MTP3 User Adaptation\n" + "MTP3 User Adaptation (over SCTP)\n" + "MTP3 User Adaptation (over TCP)\n" "SCCP User Adaptation\n" "IPA Multiplex (SCCP Lite)\n") { struct bsc_msc_data *msc = bsc_msc_data(vty); + int val; - msc->a.asp_proto = get_string_value(osmo_ss7_asp_protocol_vals, argv[0]); + val = get_string_value(osmo_ss7_asp_protocol_vals, argv[0]); + if (val < 0) + return CMD_WARNING; + msc->a.asp_proto = (enum osmo_ss7_asp_protocol)val; + return CMD_SUCCESS; } +ALIAS_DEPRECATED(cfg_msc_cs7_asp_proto, + cfg_msc_cs7_asp_proto_m3ua_cmd, + "asp-protocol m3ua", + "A interface protocol to use for this MSC)\n" + "MTP3 User Adaptation (over SCTP)\n"); + DEFUN_USRATTR(cfg_net_msc_lcls_mode, cfg_net_msc_lcls_mode_cmd, X(BSC_VTY_ATTR_NEW_LCHAN), @@ -3764,6 +3776,7 @@ install_element(MSC_NODE, &cfg_msc_cs7_bsc_addr_cmd); install_element(MSC_NODE, &cfg_msc_cs7_msc_addr_cmd); install_element(MSC_NODE, &cfg_msc_cs7_asp_proto_cmd); + install_element(MSC_NODE, &cfg_msc_cs7_asp_proto_m3ua_cmd); install_element(MSC_NODE, &cfg_msc_nri_add_cmd); install_element(MSC_NODE, &cfg_msc_nri_del_cmd); install_element(MSC_NODE, &cfg_msc_show_nri_cmd); diff --git a/src/osmo-bsc/lb.c b/src/osmo-bsc/lb.c index 72905b8..7bc35fa 100644 --- a/src/osmo-bsc/lb.c +++ b/src/osmo-bsc/lb.c @@ -425,7 +425,7 @@ uint32_t default_pc; struct osmo_ss7_instance *cs7_inst = NULL; struct osmo_sccp_instance *sccp; - enum osmo_ss7_asp_protocol used_proto = OSMO_SS7_ASP_PROT_M3UA; + enum osmo_ss7_asp_protocol used_proto = OSMO_SS7_ASP_PROT_M3UA_SCTP; char inst_name[32]; const char *smlc_name = "smlc"; struct bsc_sccp_inst *bsc_sccp; diff --git a/src/osmo-bsc/osmo_bsc_msc.c b/src/osmo-bsc/osmo_bsc_msc.c index 2425592..ed37bf9 100644 --- a/src/osmo-bsc/osmo_bsc_msc.c +++ b/src/osmo-bsc/osmo_bsc_msc.c @@ -444,7 +444,7 @@ msc_data->nr = nr; msc_data->allow_emerg = 1; - msc_data->a.asp_proto = OSMO_SS7_ASP_PROT_M3UA; + msc_data->a.asp_proto = OSMO_SS7_ASP_PROT_M3UA_SCTP; /* Defaults for the audio setup */ msc_data->amr_conf.m5_90 = 1; -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/35792?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I078da51abc3511a4854f9c8fbca8eafd2bed78da Gerrit-Change-Number: 35792 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-MessageType: newchange

1 year, 5 months

1
0
0 0

[S] Change in osmo-bsc[master]: abis_nm: fix -Wunused-but-set-variable (bug)

by fixeria

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-bsc/+/35791?usp=email ) Change subject: abis_nm: fix -Wunused-but-set-variable (bug) ...................................................................... abis_nm: fix -Wunused-but-set-variable (bug) clang warns us about 'len' being set, but not used: And this is abis_nm.c:2172:10: warning: variable 'len' set but not used [-Wunused-but-set-variable] uint8_t len = att_len; ^ This is actually a bug, because in the case of NACK we append 2 more bytes {NM_ATT_NACK_CAUSES, NM_NACK_OBJCLASS_NOTSUPP}, and we need to pass the final length to fill_om_fom_hdr(), including those optional two bytes. Passing 'att_len' (length of 'attr') is wrong. Change-Id: I3ca8e761fdf99dd498a979ccc9d53c6c3e03e2cc --- M include/osmocom/bsc/abis_nm.h M src/osmo-bsc/abis_nm.c 2 files changed, 32 insertions(+), 8 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/91/35791/1 diff --git a/include/osmocom/bsc/abis_nm.h b/include/osmocom/bsc/abis_nm.h index 7f1ec74..59a6dc9 100644 --- a/include/osmocom/bsc/abis_nm.h +++ b/include/osmocom/bsc/abis_nm.h @@ -86,7 +86,8 @@ int abis_nm_set_radio_attr(struct gsm_bts_trx *trx, uint8_t *attr, int attr_len); int abis_nm_set_channel_attr(struct gsm_bts_trx_ts *ts, uint8_t chan_comb); int abis_nm_sw_act_req_ack(struct gsm_bts *bts, uint8_t obj_class, uint8_t i1, - uint8_t i2, uint8_t i3, int nack, uint8_t *attr, int att_len); + uint8_t i2, uint8_t i3, int nack, + const uint8_t *attr, int attr_len); int abis_nm_raw_msg(struct gsm_bts *bts, int len, uint8_t *msg); int abis_nm_event_reports(struct gsm_bts *bts, int on); int abis_nm_reset_resource(struct gsm_bts *bts); diff --git a/src/osmo-bsc/abis_nm.c b/src/osmo-bsc/abis_nm.c index 81a0272..120701b 100644 --- a/src/osmo-bsc/abis_nm.c +++ b/src/osmo-bsc/abis_nm.c @@ -2164,12 +2164,17 @@ } int abis_nm_sw_act_req_ack(struct gsm_bts *bts, uint8_t obj_class, uint8_t i1, - uint8_t i2, uint8_t i3, int nack, uint8_t *attr, int att_len) + uint8_t i2, uint8_t i3, int nack, + const uint8_t *attr, int attr_len) { struct abis_om_hdr *oh; struct msgb *msg = nm_msgb_alloc(); uint8_t msgtype = NM_MT_SW_ACT_REQ_ACK; - uint8_t len = att_len; + uint8_t len; + + if (attr_len < 0) + return -EINVAL; + len = attr_len; if (nack) { len += 2; @@ -2177,12 +2182,10 @@ } oh = (struct abis_om_hdr *) msgb_put(msg, ABIS_OM_FOM_HDR_SIZE); - fill_om_fom_hdr(oh, att_len, msgtype, obj_class, i1, i2, i3); + fill_om_fom_hdr(oh, len, msgtype, obj_class, i1, i2, i3); - if (attr) { - uint8_t *ptr = msgb_put(msg, att_len); - memcpy(ptr, attr, att_len); - } + if (attr != NULL && attr_len > 0) + memcpy(msgb_put(msg, attr_len), attr, attr_len); if (nack) msgb_tv_put(msg, NM_ATT_NACK_CAUSES, NM_NACK_OBJCLASS_NOTSUPP); -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/35791?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I3ca8e761fdf99dd498a979ccc9d53c6c3e03e2cc Gerrit-Change-Number: 35791 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-MessageType: newchange

1 year, 5 months

1
0
0 0

[S] Change in osmo-bsc[master]: bsc_ctrl: do not overwrite rc in bsc_base_ctrl_cmds_install()

by fixeria

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-bsc/+/35789?usp=email ) Change subject: bsc_ctrl: do not overwrite rc in bsc_base_ctrl_cmds_install() ...................................................................... bsc_ctrl: do not overwrite rc in bsc_base_ctrl_cmds_install() Change-Id: Ie4242be1d3e58d7e37938d9ccbeffcb2b442632f --- M src/osmo-bsc/bsc_ctrl.c 1 file changed, 10 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/89/35789/1 diff --git a/src/osmo-bsc/bsc_ctrl.c b/src/osmo-bsc/bsc_ctrl.c index 38698e7..cfba3e2 100644 --- a/src/osmo-bsc/bsc_ctrl.c +++ b/src/osmo-bsc/bsc_ctrl.c @@ -838,7 +838,7 @@ rc |= ctrl_cmd_install(CTRL_NODE_ROOT, &cmd_net_notification); rc |= ctrl_cmd_install(CTRL_NODE_ROOT, &cmd_net_inform_msc); - rc = ctrl_cmd_install(CTRL_NODE_MSC, &cmd_msc_connection_status); + rc |= ctrl_cmd_install(CTRL_NODE_MSC, &cmd_msc_connection_status); rc |= osmo_signal_register_handler(SS_L_INPUT, &bts_connection_status_trap_cb, net); rc |= osmo_signal_register_handler(SS_MSC, &msc_connection_status_trap_cb, net); -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/35789?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: Ie4242be1d3e58d7e37938d9ccbeffcb2b442632f Gerrit-Change-Number: 35789 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-MessageType: newchange

1 year, 5 months

1
0
0 0

[S] Change in osmo-bsc[master]: lchan_fsm: fix -Wgnu-designator warnings printed by clang

by fixeria

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-bsc/+/35790?usp=email ) Change subject: lchan_fsm: fix -Wgnu-designator warnings printed by clang ...................................................................... lchan_fsm: fix -Wgnu-designator warnings printed by clang Change-Id: I48baef2e2b31f639281a455b2c3b07fd4f7af591 --- M src/osmo-bsc/lchan_fsm.c 1 file changed, 11 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/90/35790/1 diff --git a/src/osmo-bsc/lchan_fsm.c b/src/osmo-bsc/lchan_fsm.c index a663326..55875f0 100644 --- a/src/osmo-bsc/lchan_fsm.c +++ b/src/osmo-bsc/lchan_fsm.c @@ -1893,7 +1893,7 @@ | S(LCHAN_ST_RECOVER_WAIT_ACTIV_ACK) , }, - [LCHAN_ST_RECOVER_WAIT_ACTIV_ACK] { + [LCHAN_ST_RECOVER_WAIT_ACTIV_ACK] = { .name = "RECOVER_WAIT_ACTIV_ACK", .onenter = lchan_fsm_recover_wait_activ_ack_onenter, .action = lchan_fsm_recover_wait_activ_ack, @@ -1906,7 +1906,7 @@ | S(LCHAN_ST_RECOVER_WAIT_RF_RELEASE_ACK) , }, - [LCHAN_ST_RECOVER_WAIT_RF_RELEASE_ACK] { + [LCHAN_ST_RECOVER_WAIT_RF_RELEASE_ACK] = { .name = "RECOVER_WAIT_RF_RELEASE_ACK", .onenter = lchan_fsm_recover_wait_rf_release_ack_onenter, .action = lchan_fsm_recover_wait_rf_release_ack, -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/35790?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I48baef2e2b31f639281a455b2c3b07fd4f7af591 Gerrit-Change-Number: 35790 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-MessageType: newchange

1 year, 5 months

1
0
0 0

[M] Change in libosmo-gprs[master]: rlcmac: ul_tbf: Register UL ACK/NACK poll inside FSM

by fixeria

Attention is currently required from: pespin. fixeria has posted comments on this change. ( https://gerrit.osmocom.org/c/libosmo-gprs/+/35783?usp=email ) Change subject: rlcmac: ul_tbf: Register UL ACK/NACK poll inside FSM ...................................................................... Patch Set 1: Code-Review+1 (1 comment) File src/rlcmac/tbf_ul.c: https://gerrit.osmocom.org/c/libosmo-gprs/+/35783/comment/7b450df9_511341cf PS1, Line 338: ev_ack why not passing `struct gprs_rlcmac_dl_block_ind *` directly? are you planning to add more fields to `struct tbf_ul_ass_ev_rx_ul_ack_nack`? -- To view, visit https://gerrit.osmocom.org/c/libosmo-gprs/+/35783?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmo-gprs Gerrit-Branch: master Gerrit-Change-Id: Iaa8ad8052b9f3b52b05af2b7fc9cb8172f1b6bb7 Gerrit-Change-Number: 35783 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 02 Feb 2024 20:32:52 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 year, 5 months

1
0
0 0

[M] Change in libosmo-gprs[master]: rlcmac: Add new structure to allow passing FN+TN to TBF handling func...

by fixeria

Attention is currently required from: pespin. fixeria has posted comments on this change. ( https://gerrit.osmocom.org/c/libosmo-gprs/+/35782?usp=email ) Change subject: rlcmac: Add new structure to allow passing FN+TN to TBF handling functions ...................................................................... Patch Set 1: (2 comments) File src/rlcmac/rlcmac.c: https://gerrit.osmocom.org/c/libosmo-gprs/+/35782/comment/6f0b963a_aa4eda39 PS1, Line 775: (struct gprs_rlcmac_dl_block_ind *) `talloc_zero` is a macro, which does pointer cast for you, so this is not needed ``` #define talloc_zero(ctx, type) (type *)_talloc_zero(ctx, sizeof(type), #type) ``` https://gerrit.osmocom.org/c/libosmo-gprs/+/35782/comment/937d91e4_ce30bc9c PS1, Line 778: OSMO_ASSERT(dlbi); You already dereferenced `dlbi` above, so assert()ing makes no sense. Move above? -- To view, visit https://gerrit.osmocom.org/c/libosmo-gprs/+/35782?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmo-gprs Gerrit-Branch: master Gerrit-Change-Id: Ifa09cd70c915aa3a2b799412cb02315aaebc0503 Gerrit-Change-Number: 35782 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 02 Feb 2024 20:26:09 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 year, 5 months

1
0
0 0

2025

2024

2023

2022

gerrit-log February 2024