July 2024 - gerrit-log - lists.osmocom.org

[L] Change in ...osmo-s1gw[master]: {sctp,s1ap}_proxy: employ E-RAB FSMs

by fixeria

Attention is currently required from: fixeria. Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/37463?usp=email to look at the new patch set (#3). The following approvals got outdated and were removed: Verified-1 by Jenkins Builder Change subject: {sctp,s1ap}_proxy: employ E-RAB FSMs ...................................................................... {sctp,s1ap}_proxy: employ E-RAB FSMs Change-Id: Ibb7e25ab3adbadd7fd85e9cb22e0136c6ca133cf --- M src/s1ap_proxy.erl M src/sctp_proxy.erl M test/s1ap_proxy_test.erl 3 files changed, 168 insertions(+), 93 deletions(-) git pull ssh://gerrit.osmocom.org:29418/erlang/osmo-s1gw refs/changes/63/37463/3 -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/37463?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: erlang/osmo-s1gw Gerrit-Branch: master Gerrit-Change-Id: Ibb7e25ab3adbadd7fd85e9cb22e0136c6ca133cf Gerrit-Change-Number: 37463 Gerrit-PatchSet: 3 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-MessageType: newpatchset

11 months, 2 weeks

1
0
0 0

[S] Change in osmo-ci[master]: obs: add package strongswan-epdg

by lynxis lazus

lynxis lazus has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-ci/+/37392?usp=email ) Change subject: obs: add package strongswan-epdg ...................................................................... Patch Set 2: (1 comment) Patchset: PS2: Thanks to hwelte, the strongswan repo is now named strongswan-epdg -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/37392?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I3c8ec3e04010c419e5be1bd0ac35b74888eb3cc6 Gerrit-Change-Number: 37392 Gerrit-PatchSet: 2 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Mon, 15 Jul 2024 17:18:29 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

11 months, 2 weeks

1
0
0 0

[S] Change in pysim[master]: pySim.cat: More spec references + explanations in comments

by laforge

laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/37488?usp=email ) Change subject: pySim.cat: More spec references + explanations in comments ...................................................................... pySim.cat: More spec references + explanations in comments Change-Id: I4a89156075ae225594740451b33c3dec8983cf04 --- M pySim/cat.py 1 file changed, 11 insertions(+), 1 deletion(-) Approvals: laforge: Looks good to me, approved Jenkins Builder: Verified diff --git a/pySim/cat.py b/pySim/cat.py index d2f39f7..d2a3a66 100644 --- a/pySim/cat.py +++ b/pySim/cat.py @@ -499,9 +499,10 @@ class BufferSize(COMPR_TLV_IE, tag = 0xB9): _construct = Int16ub -# TS 31.111 Section 8.56 +# TS 102 223 Section 8.56 + TS 31.111 Section 8.56 class ChannelStatus(COMPR_TLV_IE, tag = 0xB8): # complex decoding, depends on out-of-band context/knowledge :( + # for default / TCP Client mode: bit 8 of first byte indicates connected, 3 LSB indicate channel nr _construct = HexAdapter(GreedyBytes) # TS 102 223 Section 8.58 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/37488?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I4a89156075ae225594740451b33c3dec8983cf04 Gerrit-Change-Number: 37488 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-MessageType: merged

11 months, 2 weeks

1
0
0 0

[S] Change in pysim[master]: pySim.cat: More spec references + explanations in comments

by laforge

laforge has posted comments on this change. ( https://gerrit.osmocom.org/c/pysim/+/37488?usp=email ) Change subject: pySim.cat: More spec references + explanations in comments ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/37488?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I4a89156075ae225594740451b33c3dec8983cf04 Gerrit-Change-Number: 37488 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Mon, 15 Jul 2024 15:08:37 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

11 months, 2 weeks

1
0
0 0

[S] Change in pysim[master]: transport: Implement treatment of 62xx and 63xx warning/error responses

by laforge

laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/37452?usp=email ) Change subject: transport: Implement treatment of 62xx and 63xx warning/error responses ...................................................................... transport: Implement treatment of 62xx and 63xx warning/error responses TS 102 221 specifies that (in case of a class 4 command) and as SW 62xx or 63xx, we should send a GET RESPONSE just like in the 61xx case in order to get the respective response. As we don't really know if it's a case1/2/3/4 command in the pySim.transport, let's always send the GET RESPONSE in case SW 62xx or 63xx are received. It shouldn't hurt - in the worst case there's no response available... Change-Id: Ibb1398194a16fc1f1f9bc46af6c66fb6575240cd --- M pySim/transport/__init__.py 1 file changed, 23 insertions(+), 2 deletions(-) Approvals: osmith: Looks good to me, but someone else must approve fixeria: Looks good to me, but someone else must approve laforge: Looks good to me, approved Jenkins Builder: Verified diff --git a/pySim/transport/__init__.py b/pySim/transport/__init__.py index 5ae9428..59067b3 100644 --- a/pySim/transport/__init__.py +++ b/pySim/transport/__init__.py @@ -130,6 +130,7 @@ data : string (in hex) of returned data (ex. "074F4EFFFF") sw : string (in hex) of status word (ex. "9000") """ + prev_pdu = pdu data, sw = self.send_apdu_raw(pdu) # When we have sent the first APDU, the SW may indicate that there are response bytes @@ -137,15 +138,17 @@ # xx is the number of response bytes available. # See also: if sw is not None: - while ((sw[0:2] == '9f') or (sw[0:2] == '61')): + while (sw[0:2] in ['9f', '61', '62', '63']): # SW1=9F: 3GPP TS 51.011 9.4.1, Responses to commands which are correctly executed # SW1=61: ISO/IEC 7816-4, Table 5 — General meaning of the interindustry values of SW1-SW2 + # SW1=62: ETSI TS 102 221 7.3.1.1.4 Clause 4b): 62xx, 63xx, 9xxx != 9000 pdu_gr = pdu[0:2] + 'c00000' + sw[2:4] + prev_pdu = pdu_gr d, sw = self.send_apdu_raw(pdu_gr) data += d if sw[0:2] == '6c': # SW1=6C: ETSI TS 102 221 Table 7.1: Procedure byte coding - pdu_gr = pdu[0:8] + sw[2:4] + pdu_gr = prev_pdu[0:8] + sw[2:4] data, sw = self.send_apdu_raw(pdu_gr) return data, sw -- To view, visit https://gerrit.osmocom.org/c/pysim/+/37452?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ibb1398194a16fc1f1f9bc46af6c66fb6575240cd Gerrit-Change-Number: 37452 Gerrit-PatchSet: 2 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-MessageType: merged

11 months, 2 weeks

1
0
0 0

[S] Change in pysim[master]: transport: Implement treatment of 62xx and 63xx warning/error responses

by laforge

Attention is currently required from: dexter. laforge has posted comments on this change. ( https://gerrit.osmocom.org/c/pysim/+/37452?usp=email ) Change subject: transport: Implement treatment of 62xx and 63xx warning/error responses ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/37452?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ibb1398194a16fc1f1f9bc46af6c66fb6575240cd Gerrit-Change-Number: 37452 Gerrit-PatchSet: 2 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Mon, 15 Jul 2024 15:08:11 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

11 months, 2 weeks

1
0
0 0

[S] Change in pysim[master]: pySim.esim.http_json_api: 'header' is not always present in response

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/37496?usp=email ) Change subject: pySim.esim.http_json_api: 'header' is not always present in response ...................................................................... pySim.esim.http_json_api: 'header' is not always present in response For example, the ES9+ handleNotification function is defined with an empty response body, so we cannot unconditionally assume that every HTTP response will contain a JSON "header" value. Change-Id: Ia3c5703b746c1eba91f85f8545f849a3f2d56e0b --- M pySim/esim/http_json_api.py 1 file changed, 25 insertions(+), 9 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/96/37496/1 diff --git a/pySim/esim/http_json_api.py b/pySim/esim/http_json_api.py index 377faea..9c9349d 100644 --- a/pySim/esim/http_json_api.py +++ b/pySim/esim/http_json_api.py @@ -204,16 +204,17 @@ return output def decode(self, data: dict) -> dict: - """[further] Decode and validate the JSON-Dict of the respnse body.""" + """[further] Decode and validate the JSON-Dict of the response body.""" output = {} - # let's first do the header, it's special - if not 'header' in data: - raise ValueError('Mandatory output parameter "header" missing') - hdr_class = self.output_params.get('header') - output['header'] = hdr_class.decode(data['header']) + if 'header' in self.output_params: + # let's first do the header, it's special + if not 'header' in data: + raise ValueError('Mandatory output parameter "header" missing') + hdr_class = self.output_params.get('header') + output['header'] = hdr_class.decode(data['header']) - if output['header']['functionExecutionStatus']['status'] not in ['Executed-Success','Executed-WithWarning']: - raise ApiError(output['header']['functionExecutionStatus']) + if output['header']['functionExecutionStatus']['status'] not in ['Executed-Success','Executed-WithWarning']: + raise ApiError(output['header']['functionExecutionStatus']) # we can only expect mandatory parameters to be present in case of successful execution for p in self.output_mandatory: if p == 'header': @@ -253,4 +254,6 @@ if not response.headers.get('X-Admin-Protocol', 'gsma/rsp/v2.unknown').startswith('gsma/rsp/v2.'): raise HttpHeaderError(response) - return self.decode(response.json()) + if response.content: + return self.decode(response.json()) + return None -- To view, visit https://gerrit.osmocom.org/c/pysim/+/37496?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ia3c5703b746c1eba91f85f8545f849a3f2d56e0b Gerrit-Change-Number: 37496 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

11 months, 2 weeks

1
0
0 0

[S] Change in pysim[master]: osmo-smdpp: Make sure to return empty HTTP response in handleNotifica...

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/37497?usp=email ) Change subject: osmo-smdpp: Make sure to return empty HTTP response in handleNotification ...................................................................... osmo-smdpp: Make sure to return empty HTTP response in handleNotification SGP.22 is quite clear in that handleNotification shall return an empty HTTP response body. Let's make sure we comply to that and don't report a JSON response. Change-Id: I1cad539accbc3e7222bfd4780955b3b1ff694c5b --- M osmo-smdpp.py 1 file changed, 16 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/97/37497/1 diff --git a/osmo-smdpp.py b/osmo-smdpp.py index 6c275ac..390db18 100755 --- a/osmo-smdpp.py +++ b/osmo-smdpp.py @@ -186,7 +186,9 @@ print("Rx JSON: %s" % json.dumps(content)) set_headers(request) - output = func(self, request, content) or {} + output = func(self, request, content) + if output == None: + return '' build_resp_header(output) print("Tx JSON: %s" % json.dumps(output)) -- To view, visit https://gerrit.osmocom.org/c/pysim/+/37497?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I1cad539accbc3e7222bfd4780955b3b1ff694c5b Gerrit-Change-Number: 37497 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

11 months, 2 weeks

1
0
0 0

[L] Change in pysim[master]: es9p_client: Move code into a class; do common steps in constructor

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/37498?usp=email ) Change subject: es9p_client: Move code into a class; do common steps in constructor ...................................................................... es9p_client: Move code into a class; do common steps in constructor This is in preparation of supporting more than just 'download' Change-Id: I5a165efcb97d9264369a9c6571cd92022cbcdfb0 --- M contrib/es9p_client.py 1 file changed, 175 insertions(+), 157 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/98/37498/1 diff --git a/contrib/es9p_client.py b/contrib/es9p_client.py index 987b85e..5e72e7b 100755 --- a/contrib/es9p_client.py +++ b/contrib/es9p_client.py @@ -41,19 +41,21 @@ parser.add_argument('--url', required=True, help='Base URL of ES9+ API endpoint') parser.add_argument('--server-ca-cert', help="""X.509 CA certificates acceptable for the server side. In production use cases, this would be the GSMA Root CA (CI) certificate.""") +parser.add_argument('--certificate-path', default='.', + help="Path in which to look for certificate and key files.") +parser.add_argument('--euicc-certificate', default='CERT_EUICC_ECDSA_NIST.der', + help="File name of DER-encoded eUICC certificate file.") +parser.add_argument('--euicc-private-key', default='SK_EUICC_ECDSA_NIST.pem', + help="File name of PEM-format eUICC secret key file.") +parser.add_argument('--eum-certificate', default='CERT_EUM_ECDSA_NIST.der', + help="File name of DER-encoded EUM certificate file.") +parser.add_argument('--ci-certificate', default='CERT_CI_ECDSA_NIST.der', + help="File name of DER-encoded CI certificate file.") + subparsers = parser.add_subparsers(dest='command',help="The command (API function) to call", required=True) +# download parser_dl = subparsers.add_parser('download', help="ES9+ download") -parser_dl.add_argument('--certificate-path', default='.', - help="Path in which to look for certificate and key files.") -parser_dl.add_argument('--euicc-certificate', default='CERT_EUICC_ECDSA_NIST.der', - help="File name of DER-encoded eUICC certificate file.") -parser_dl.add_argument('--euicc-private-key', default='SK_EUICC_ECDSA_NIST.pem', - help="File name of PEM-format eUICC secret key file.") -parser_dl.add_argument('--eum-certificate', default='CERT_EUM_ECDSA_NIST.der', - help="File name of DER-encoded EUM certificate file.") -parser_dl.add_argument('--ci-certificate', default='CERT_CI_ECDSA_NIST.der', - help="File name of DER-encoded CI certificate file.") parser_dl.add_argument('--matchingId', required=True, help='MatchingID that shall be used by profile download') parser_dl.add_argument('--output-path', default='.', @@ -61,178 +63,183 @@ parser_dl.add_argument('--confirmation-code', help="Confirmation Code for the eSIM download") +class Es9pClient: + def __init__(self, opts): + self.opts = opts + self.cert_and_key = CertAndPrivkey() + self.cert_and_key.cert_from_der_file(os.path.join(opts.certificate_path, opts.euicc_certificate)) + self.cert_and_key.privkey_from_pem_file(os.path.join(opts.certificate_path, opts.euicc_private_key)) -def do_download(opts): + with open(os.path.join(opts.certificate_path, opts.eum_certificate), 'rb') as f: + self.eum_cert = x509.load_der_x509_certificate(f.read()) - cert_and_key = CertAndPrivkey() - cert_and_key.cert_from_der_file(os.path.join(opts.certificate_path, opts.euicc_certificate)) - cert_and_key.privkey_from_pem_file(os.path.join(opts.certificate_path, opts.euicc_private_key)) + with open(os.path.join(opts.certificate_path, opts.ci_certificate), 'rb') as f: + self.ci_cert = x509.load_der_x509_certificate(f.read()) + subject_exts = list(filter(lambda x: isinstance(x.value, x509.SubjectKeyIdentifier), self.ci_cert.extensions)) + subject_pkid = subject_exts[0].value + self.ci_pkid = subject_pkid.key_identifier - with open(os.path.join(opts.certificate_path, opts.eum_certificate), 'rb') as f: - eum_cert = x509.load_der_x509_certificate(f.read()) + print("EUICC: %s" % self.cert_and_key.cert.subject) + print("EUM: %s" % self.eum_cert.subject) + print("CI: %s" % self.ci_cert.subject) - with open(os.path.join(opts.certificate_path, opts.ci_certificate), 'rb') as f: - ci_cert = x509.load_der_x509_certificate(f.read()) - subject_exts = list(filter(lambda x: isinstance(x.value, x509.SubjectKeyIdentifier), ci_cert.extensions)) - subject_pkid = subject_exts[0].value - ci_pkid = subject_pkid.key_identifier + self.eid = self.cert_and_key.cert.subject.get_attributes_for_oid(x509.oid.NameOID.SERIAL_NUMBER)[0].value + print("EID: %s" % self.eid) + print("CI PKID: %s" % b2h(self.ci_pkid)) + print() - print("EUICC: %s" % cert_and_key.cert.subject) - print("EUM: %s" % eum_cert.subject) - print("CI: %s" % ci_cert.subject) + self.peer = es9p.Es9pApiClient(opts.url, server_cert_verify=opts.server_ca_cert) - eid = cert_and_key.cert.subject.get_attributes_for_oid(x509.oid.NameOID.SERIAL_NUMBER)[0].value - print("EID: %s" % eid) - print("CI PKID: %s" % b2h(ci_pkid)) - print() - peer = es9p.Es9pApiClient(opts.url, server_cert_verify=opts.server_ca_cert) + def do_download(self): - print("Step 1: InitiateAuthentication...") + print("Step 1: InitiateAuthentication...") - euiccInfo1 = { - 'svn': b'\x02\x04\x00', - 'euiccCiPKIdListForVerification': [ - ci_pkid, - ], - 'euiccCiPKIdListForSigning': [ - ci_pkid, - ], - } + euiccInfo1 = { + 'svn': b'\x02\x04\x00', + 'euiccCiPKIdListForVerification': [ + self.ci_pkid, + ], + 'euiccCiPKIdListForSigning': [ + self.ci_pkid, + ], + } - data = { - 'euiccChallenge': os.urandom(16), - 'euiccInfo1': euiccInfo1, - 'smdpAddress': urlparse(opts.url).netloc, - } - init_auth_res = peer.call_initiateAuthentication(data) - print(init_auth_res) + data = { + 'euiccChallenge': os.urandom(16), + 'euiccInfo1': euiccInfo1, + 'smdpAddress': urlparse(self.opts.url).netloc, + } + init_auth_res = self.peer.call_initiateAuthentication(data) + print(init_auth_res) - print("Step 2: AuthenticateClient...") + print("Step 2: AuthenticateClient...") - #res['serverSigned1'] - #res['serverSignature1'] - print("TODO: verify serverSignature1 over serverSigned1") - #res['transactionId'] - print("TODO: verify transactionId matches the signed one in serverSigned1") - #res['euiccCiPKIdToBeUsed'] - # TODO: select eUICC certificate based on CI - #res['serverCertificate'] - # TODO: verify server certificate against CI + #res['serverSigned1'] + #res['serverSignature1'] + print("TODO: verify serverSignature1 over serverSigned1") + #res['transactionId'] + print("TODO: verify transactionId matches the signed one in serverSigned1") + #res['euiccCiPKIdToBeUsed'] + # TODO: select eUICC certificate based on CI + #res['serverCertificate'] + # TODO: verify server certificate against CI - euiccInfo2 = { - 'profileVersion': b'\x02\x03\x01', - 'svn': euiccInfo1['svn'], - 'euiccFirmwareVer': b'\x23\x42\x00', - 'extCardResource': b'\x81\x01\x00\x82\x04\x00\x04\x9ch\x83\x02"#', - 'uiccCapability': (b'k6\xd3\xc3', 32), - 'javacardVersion': b'\x11\x02\x00', - 'globalplatformVersion': b'\x02\x03\x00', - 'rspCapability': (b'\x9c', 6), - 'euiccCiPKIdListForVerification': euiccInfo1['euiccCiPKIdListForVerification'], - 'euiccCiPKIdListForSigning': euiccInfo1['euiccCiPKIdListForSigning'], - #'euiccCategory': - #'forbiddenProfilePolicyRules': - 'ppVersion': b'\x01\x00\x00', - 'sasAcreditationNumber': 'OSMOCOM-TEST-1', #TODO: make configurable - #'certificationDataObject': - } + euiccInfo2 = { + 'profileVersion': b'\x02\x03\x01', + 'svn': euiccInfo1['svn'], + 'euiccFirmwareVer': b'\x23\x42\x00', + 'extCardResource': b'\x81\x01\x00\x82\x04\x00\x04\x9ch\x83\x02"#', + 'uiccCapability': (b'k6\xd3\xc3', 32), + 'javacardVersion': b'\x11\x02\x00', + 'globalplatformVersion': b'\x02\x03\x00', + 'rspCapability': (b'\x9c', 6), + 'euiccCiPKIdListForVerification': euiccInfo1['euiccCiPKIdListForVerification'], + 'euiccCiPKIdListForSigning': euiccInfo1['euiccCiPKIdListForSigning'], + #'euiccCategory': + #'forbiddenProfilePolicyRules': + 'ppVersion': b'\x01\x00\x00', + 'sasAcreditationNumber': 'OSMOCOM-TEST-1', #TODO: make configurable + #'certificationDataObject': + } - euiccSigned1 = { - 'transactionId': h2b(init_auth_res['transactionId']), - 'serverAddress': init_auth_res['serverSigned1']['serverAddress'], - 'serverChallenge': init_auth_res['serverSigned1']['serverChallenge'], - 'euiccInfo2': euiccInfo2, - 'ctxParams1': - ('ctxParamsForCommonAuthentication', { - 'matchingId': opts.matchingId, - 'deviceInfo': { - 'tac': b'\x35\x23\x01\x45', # same as lpac - 'deviceCapabilities': {}, - #imei: - } - }), - } - euiccSigned1_bin = rsp.asn1.encode('EuiccSigned1', euiccSigned1) - euiccSignature1 = cert_and_key.ecdsa_sign(euiccSigned1_bin) - auth_clnt_req = { - 'transactionId': init_auth_res['transactionId'], - 'authenticateServerResponse': - ('authenticateResponseOk', { - 'euiccSigned1': euiccSigned1, - 'euiccSignature1': euiccSignature1, - 'euiccCertificate': rsp.asn1.decode('Certificate', cert_and_key.get_cert_as_der()), - 'eumCertificate': rsp.asn1.decode('Certificate', eum_cert.public_bytes(Encoding.DER)) - }) - } - auth_clnt_res = peer.call_authenticateClient(auth_clnt_req) - print(auth_clnt_res) - #auth_clnt_res['transactionId'] - print("TODO: verify transactionId matches previous ones") - #auth_clnt_res['profileMetadata'] - # TODO: what's in here? - #auth_clnt_res['smdpSigned2']['bppEuiccOtpk'] - #auth_clnt_res['smdpSignature2'] - print("TODO: verify serverSignature2 over smdpSigned2") + euiccSigned1 = { + 'transactionId': h2b(init_auth_res['transactionId']), + 'serverAddress': init_auth_res['serverSigned1']['serverAddress'], + 'serverChallenge': init_auth_res['serverSigned1']['serverChallenge'], + 'euiccInfo2': euiccInfo2, + 'ctxParams1': + ('ctxParamsForCommonAuthentication', { + 'matchingId': self.opts.matchingId, + 'deviceInfo': { + 'tac': b'\x35\x23\x01\x45', # same as lpac + 'deviceCapabilities': {}, + #imei: + } + }), + } + euiccSigned1_bin = rsp.asn1.encode('EuiccSigned1', euiccSigned1) + euiccSignature1 = self.cert_and_key.ecdsa_sign(euiccSigned1_bin) + auth_clnt_req = { + 'transactionId': init_auth_res['transactionId'], + 'authenticateServerResponse': + ('authenticateResponseOk', { + 'euiccSigned1': euiccSigned1, + 'euiccSignature1': euiccSignature1, + 'euiccCertificate': rsp.asn1.decode('Certificate', self.cert_and_key.get_cert_as_der()), + 'eumCertificate': rsp.asn1.decode('Certificate', self.eum_cert.public_bytes(Encoding.DER)) + }) + } + auth_clnt_res = self.peer.call_authenticateClient(auth_clnt_req) + print(auth_clnt_res) + #auth_clnt_res['transactionId'] + print("TODO: verify transactionId matches previous ones") + #auth_clnt_res['profileMetadata'] + # TODO: what's in here? + #auth_clnt_res['smdpSigned2']['bppEuiccOtpk'] + #auth_clnt_res['smdpSignature2'] + print("TODO: verify serverSignature2 over smdpSigned2") - smdp_cert = x509.load_der_x509_certificate(auth_clnt_res['smdpCertificate']) + smdp_cert = x509.load_der_x509_certificate(auth_clnt_res['smdpCertificate']) - print("Step 3: GetBoundProfilePackage...") - # Generate a one-time ECKA key pair (ot{PK,SK}.DP.ECKA) using the curve indicated by the Key Parameter - # Reference value of CERT.DPpb.ECDSA - euicc_ot = ec.generate_private_key(smdp_cert.public_key().public_numbers().curve) + print("Step 3: GetBoundProfilePackage...") + # Generate a one-time ECKA key pair (ot{PK,SK}.DP.ECKA) using the curve indicated by the Key Parameter + # Reference value of CERT.DPpb.ECDSA + euicc_ot = ec.generate_private_key(smdp_cert.public_key().public_numbers().curve) - # extract the public key in (hopefully) the right format for the ES8+ interface - euicc_otpk = euicc_ot.public_key().public_bytes(Encoding.X962, PublicFormat.UncompressedPoint) + # extract the public key in (hopefully) the right format for the ES8+ interface + euicc_otpk = euicc_ot.public_key().public_bytes(Encoding.X962, PublicFormat.UncompressedPoint) - euiccSigned2 = { - 'transactionId': h2b(auth_clnt_res['transactionId']), - 'euiccOtpk': euicc_otpk, - #hashCC - } - # check for smdpSigned2 ccRequiredFlag, and send it in PrepareDownloadRequest hashCc - if auth_clnt_res['smdpSigned2']['ccRequiredFlag']: - if not opts.confirmation_code: - raise ValueError('Confirmation Code required but not provided') - cc_hash = hashlib.sha256(opts.confirmation_code.encode('ascii')).digest() - euiccSigned2['hashCc'] = hashlib.sha256(cc_hash + euiccSigned2['transactionId']).digest() - euiccSigned2_bin = rsp.asn1.encode('EUICCSigned2', euiccSigned2) - euiccSignature2 = cert_and_key.ecdsa_sign(euiccSigned2_bin + auth_clnt_res['smdpSignature2']) - gbp_req = { - 'transactionId': auth_clnt_res['transactionId'], - 'prepareDownloadResponse': - ('downloadResponseOk', { - 'euiccSigned2': euiccSigned2, - 'euiccSignature2': euiccSignature2, - }) - } - gbp_res = peer.call_getBoundProfilePackage(gbp_req) - print(gbp_res) - #gbp_res['transactionId'] - # TODO: verify transactionId - print("TODO: verify transactionId matches previous ones") - bpp_bin = gbp_res['boundProfilePackage'] - print("TODO: verify boundProfilePackage smdpSignature") + euiccSigned2 = { + 'transactionId': h2b(auth_clnt_res['transactionId']), + 'euiccOtpk': euicc_otpk, + #hashCC + } + # check for smdpSigned2 ccRequiredFlag, and send it in PrepareDownloadRequest hashCc + if auth_clnt_res['smdpSigned2']['ccRequiredFlag']: + if not self.opts.confirmation_code: + raise ValueError('Confirmation Code required but not provided') + cc_hash = hashlib.sha256(self.opts.confirmation_code.encode('ascii')).digest() + euiccSigned2['hashCc'] = hashlib.sha256(cc_hash + euiccSigned2['transactionId']).digest() + euiccSigned2_bin = rsp.asn1.encode('EUICCSigned2', euiccSigned2) + euiccSignature2 = self.cert_and_key.ecdsa_sign(euiccSigned2_bin + auth_clnt_res['smdpSignature2']) + gbp_req = { + 'transactionId': auth_clnt_res['transactionId'], + 'prepareDownloadResponse': + ('downloadResponseOk', { + 'euiccSigned2': euiccSigned2, + 'euiccSignature2': euiccSignature2, + }) + } + gbp_res = self.peer.call_getBoundProfilePackage(gbp_req) + print(gbp_res) + #gbp_res['transactionId'] + # TODO: verify transactionId + print("TODO: verify transactionId matches previous ones") + bpp_bin = gbp_res['boundProfilePackage'] + print("TODO: verify boundProfilePackage smdpSignature") - bpp = BoundProfilePackage() - upp_bin = bpp.decode(euicc_ot, eid, bpp_bin) + bpp = BoundProfilePackage() + upp_bin = bpp.decode(euicc_ot, self.eid, bpp_bin) - iccid = swap_nibbles(b2h(bpp.storeMetadataRequest['iccid'])) - base_name = os.path.join(opts.output_path, '%s' % iccid) + iccid = swap_nibbles(b2h(bpp.storeMetadataRequest['iccid'])) + base_name = os.path.join(self.opts.output_path, '%s' % iccid) - print("SUCCESS: Storing files as %s.*.der" % base_name) + print("SUCCESS: Storing files as %s.*.der" % base_name) - # write various output files - with open(base_name+'.upp.der', 'wb') as f: - f.write(bpp.upp) - with open(base_name+'.isdp.der', 'wb') as f: - f.write(bpp.encoded_configureISDPRequest) - with open(base_name+'.smr.der', 'wb') as f: - f.write(bpp.encoded_storeMetadataRequest) + # write various output files + with open(base_name+'.upp.der', 'wb') as f: + f.write(bpp.upp) + with open(base_name+'.isdp.der', 'wb') as f: + f.write(bpp.encoded_configureISDPRequest) + with open(base_name+'.smr.der', 'wb') as f: + f.write(bpp.encoded_storeMetadataRequest) if __name__ == '__main__': opts = parser.parse_args() + c = Es9pClient(opts) + if opts.command == 'download': - do_download(opts) + c.do_download() -- To view, visit https://gerrit.osmocom.org/c/pysim/+/37498?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I5a165efcb97d9264369a9c6571cd92022cbcdfb0 Gerrit-Change-Number: 37498 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

11 months, 2 weeks

1
0
0 0

[M] Change in pysim[master]: contrib/es9p_client: Add support for reporting notifications to SM-DP+

by laforge

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/37499?usp=email ) Change subject: contrib/es9p_client: Add support for reporting notifications to SM-DP+ ...................................................................... contrib/es9p_client: Add support for reporting notifications to SM-DP+ The ES9+ interface is not only used for downloading eSIM profiles, but it is also used to report back the installation result as well as profile management operations like enable/disable/delete. Change-Id: Iefba7fa0471b34eae30700ed43531a515af0eb93 --- M contrib/es9p_client.py 1 file changed, 89 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/99/37499/1 diff --git a/contrib/es9p_client.py b/contrib/es9p_client.py index 5e72e7b..7e763a3 100755 --- a/contrib/es9p_client.py +++ b/contrib/es9p_client.py @@ -30,7 +30,8 @@ import pySim.esim.rsp as rsp from pySim.esim import es9p -from pySim.utils import h2b, b2h, swap_nibbles, bertlv_parse_one_rawtag, bertlv_return_one_rawtlv +from pySim.utils import h2b, b2h, swap_nibbles, is_hexstr +from pySim.utils import bertlv_parse_one_rawtag, bertlv_return_one_rawtlv from pySim.esim.x509_cert import CertAndPrivkey from pySim.esim.es8p import BoundProfilePackage @@ -63,6 +64,27 @@ parser_dl.add_argument('--confirmation-code', help="Confirmation Code for the eSIM download") +# notification +parser_ntf = subparsers.add_parser('notification', help='ES9+ (other) notification') +parser_ntf.add_argument('operation', choices=['enable','disable','delete'], + help='Profile Management Opreation whoise occurrence shall be notififed') +parser_ntf.add_argument('--sequence-nr', type=int, required=True, + help='eUICC global notification sequence number') +parser_ntf.add_argument('--notification-address', help='notificationAddress, if different from URL') + +# notification-install +parser_ntfi = subparsers.add_parser('notification-install', help='ES9+ installation notification') +parser_ntfi.add_argument('--sequence-nr', type=int, required=True, + help='eUICC global notification sequence number') +parser_ntfi.add_argument('--transaction-id', required=True, + help='transactionId of previous ES9+ download') +parser_ntfi.add_argument('--notification-address', help='notificationAddress, if different from URL') +parser_ntfi.add_argument('--smdpp-oid', required=True, help='SM-DP+ OID (as in CERT.DPpb.ECDSA)') +parser_ntfi.add_argument('--isdp-aid', type=is_hexstr, required=True, + help='AID of the ISD-P of the installed profile') +parser_ntfi.add_argument('--sima-response', type=is_hexstr, required=True, + help='hex digits of BER-encoded SAIP EUICCResponse') + class Es9pClient: def __init__(self, opts): self.opts = opts @@ -91,6 +113,54 @@ self.peer = es9p.Es9pApiClient(opts.url, server_cert_verify=opts.server_ca_cert) + def do_notification(self): + + pmo4operation = { + 'install': 0x80, + 'enable': 0x40, + 'disable': 0x20, + 'delete': 0x10, + } + + ntf_metadata = { + 'seqNumber': self.opts.sequence_nr, + 'profileManagementOperation': (bytes([pmo4operation[self.opts.operation]]), 1), + 'notificationAddress': self.opts.notification_address or urlparse(self.opts.url).netloc, + } + + if self.opts.operation == 'download': + pird = { + 'transactionId': self.opts.transaction_id, + 'notificationMetadata': ntf_metadata, + 'smdpOid': self.opts.smdpp_oid, + 'finalResult': ('successResult', { + 'aid': self.opts.isdp_aid, + 'simaResponse': self.opts.sima_response, + }), + } + pird_bin = rsp.asn1.encode('ProfileInstallationResultData', pird) + signature = self.cert_and_key.ecdsa_sign(pird_bin) + pn_dict = ('profileInstallationResult', { + 'profileInstallationResultData': pird, + 'euiccSignPIR': signature, + }) + else: + ntf_bin = rsp.asn1.encode('NotificationMetadata', ntf_metadata) + signature = self.cert_and_key.ecdsa_sign(ntf_bin) + pn_dict = ('otherSignedNotification', { + 'tbsOtherNotification': ntf_metadata, + 'euiccNotificationSignature': signature, + 'euiccCertificate': rsp.asn1.decode('Certificate', self.cert_and_key.get_cert_as_der()), + 'eumCertificate': rsp.asn1.decode('Certificate', self.eum_cert.public_bytes(Encoding.DER)), + }) + + data = { + 'pendingNotification': pn_dict, + } + #print(data) + res = self.peer.call_handleNotification(data) + + def do_download(self): print("Step 1: InitiateAuthentication...") @@ -243,3 +313,8 @@ if opts.command == 'download': c.do_download() + elif opts.command == 'notification': + c.do_notification() + elif opts.command == 'notification-install': + opts.operation = 'install' + c.do_notification() -- To view, visit https://gerrit.osmocom.org/c/pysim/+/37499?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Iefba7fa0471b34eae30700ed43531a515af0eb93 Gerrit-Change-Number: 37499 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

11 months, 2 weeks

1
0
0 0

2025

2024

2023

2022

gerrit-log July 2024