Attention is currently required from: laforge.
fixeria has posted comments on this change by laforge. ( https://gerrit.osmocom.org/c/pysim/+/41454?usp=email )
Change subject: pySim.esim.es8p: Support non-operational ProfileMetadata
......................................................................
Patch Set 1: Code-Review+1
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/41454?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: Id55537ed03e2690c1fc9545bb3c49cfc76d8e331
Gerrit-Change-Number: 41454
Gerrit-PatchSet: 1
Gerrit-Owner: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Comment-Date: Tue, 18 Nov 2025 07:29:29 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/41455?usp=email )
Change subject: contrib: Add a small command line script to generate StoreMetadataRequest
......................................................................
contrib: Add a small command line script to generate StoreMetadataRequest
It's occasionally useful to be able to manually generate a
SGP.22 StoreMetadataRequest (tag BF25), so let's add a small utility
program doing exactly that.
Change-Id: I56ebd040f09dcd167b0b22148c2f1af56240b3b5
---
A contrib/esim_gen_metadata.py
1 file changed, 40 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/55/41455/1
diff --git a/contrib/esim_gen_metadata.py b/contrib/esim_gen_metadata.py
new file mode 100755
index 0000000..1f09274
--- /dev/null
+++ b/contrib/esim_gen_metadata.py
@@ -0,0 +1,40 @@
+#!/usr/bin/env python3
+
+# (C) 2025 by Harald Welte <laforge(a)osmocom.org>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+
+import argparse
+from osmocom.utils import h2b, swap_nibbles
+from pySim.esim.es8p import ProfileMetadata
+
+parser = argparse.ArgumentParser(description="""Utility program to generate profile metadata in the
+StoreMetadataRequest format based on input values from the command line.""")
+parser.add_argument('--iccid', required=True, help="ICCID of eSIM profile");
+parser.add_argument('--spn', required=True, help="Service Provider Name");
+parser.add_argument('--profile-name', required=True, help="eSIM Profile Name");
+parser.add_argument('--profile-class', choices=['test', 'operational', 'provisioning'],
+ default='operational', help="Profile Class");
+parser.add_argument('--outfile', required=True, help="Output File Name");
+
+if __name__ == '__main__':
+ opts = parser.parse_args()
+
+ iccid_bin = h2b(swap_nibbles(opts.iccid))
+ pmd = ProfileMetadata(iccid_bin, spn=opts.spn, profile_name=opts.profile_name,
+ profile_class=opts.profile_class)
+
+ with open(opts.outfile, 'wb') as f:
+ f.write(pmd.gen_store_metadata_request())
+ print("Written StoreMetadataRequest to '%s'" % opts.outfile)
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/41455?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: I56ebd040f09dcd167b0b22148c2f1af56240b3b5
Gerrit-Change-Number: 41455
Gerrit-PatchSet: 1
Gerrit-Owner: laforge <laforge(a)osmocom.org>
Attention is currently required from: dexter.
Hello Jenkins Builder,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/pysim/+/41450?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Verified-1 by Jenkins Builder
Change subject: card_key_provider: separate column decryption
......................................................................
card_key_provider: separate column decryption
The concrete class CardKeyProviderCsv supports the decryption of
encrypted CSV columns (fields). However, this kind of mechanmism
may also be useful in with other data formats we may implement in
the future, so let' slplit the encryption part into a seperate
class from which we may inherit.
Related: SYS#7725
Change-Id: I180457d4938f526d227c81020e4e03c6b3a57dab
---
M pySim/card_key_provider.py
1 file changed, 45 insertions(+), 18 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/50/41450/2
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/41450?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: I180457d4938f526d227c81020e4e03c6b3a57dab
Gerrit-Change-Number: 41450
Gerrit-PatchSet: 2
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Attention: dexter <pmaier(a)sysmocom.de>
pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-hnbgw/+/41451?usp=email )
Change subject: vty: Drop SS7 route info in 'show cnlink'
......................................................................
vty: Drop SS7 route info in 'show cnlink'
Route information is nowadays a complex topic which is mostly handled by
libosmo-sigtran, and it can be configured and better queried using VTY
commands also provided by libosmo-sigtran.
This SS7 route information here is not relevant and moreover the API it
uses is deprecated. Drop it.
Change-Id: I2b029e99da45408f9fed41f9f280d19eb646d548
---
M src/osmo-hnbgw/hnbgw_vty.c
1 file changed, 0 insertions(+), 3 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-hnbgw refs/changes/51/41451/1
diff --git a/src/osmo-hnbgw/hnbgw_vty.c b/src/osmo-hnbgw/hnbgw_vty.c
index f463522..f1b128c 100644
--- a/src/osmo-hnbgw/hnbgw_vty.c
+++ b/src/osmo-hnbgw/hnbgw_vty.c
@@ -125,7 +125,6 @@
static void _show_cnlink(struct vty *vty, struct hnbgw_cnlink *cnlink)
{
- struct osmo_ss7_route *rt;
struct osmo_ss7_instance *ss7;
if (!cnlink) {
@@ -158,8 +157,6 @@
hnbgw_cnlink_sccp_addr_to_str(cnlink, &cnlink->remote_addr),
VTY_NEWLINE);
- rt = osmo_ss7_route_lookup(ss7, cnlink->remote_addr.pc);
- vty_out(vty, " SS7 route: %s%s", osmo_ss7_route_name(rt, true), VTY_NEWLINE);
vty_out(vty, " RANAP state: %s%s", osmo_fsm_inst_state_name(cnlink->fi), VTY_NEWLINE);
}
--
To view, visit https://gerrit.osmocom.org/c/osmo-hnbgw/+/41451?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: osmo-hnbgw
Gerrit-Branch: master
Gerrit-Change-Id: I2b029e99da45408f9fed41f9f280d19eb646d548
Gerrit-Change-Number: 41451
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/41450?usp=email )
Change subject: card_key_provider: separate column decryption
......................................................................
card_key_provider: separate column decryption
The concrete class CardKeyProviderCsv supports the decryption of
encrypted CSV columns (fields). However, this kind of mechanmism
may also be useful in with other data formats we may implement in
the future, so let' slplit the encryption part into a seperate
class from which we may inherit.
Related: SYS#7725
Change-Id: I180457d4938f526d227c81020e4e03c6b3a57dab
---
M pySim/card_key_provider.py
1 file changed, 46 insertions(+), 20 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/50/41450/1
diff --git a/pySim/card_key_provider.py b/pySim/card_key_provider.py
index d5541b0..e1fa49e 100644
--- a/pySim/card_key_provider.py
+++ b/pySim/card_key_provider.py
@@ -10,7 +10,7 @@
operation with pySim-shell.
"""
-# (C) 2021-2024 by Sysmocom s.f.m.c. GmbH
+# (C) 2021-2025 by Sysmocom s.f.m.c. GmbH
# All Rights Reserved
#
# Author: Philipp Maier, Harald Welte
@@ -89,33 +89,30 @@
dictionary of {field, value} strings for each requested field from 'fields'
"""
+class CardKeyFieldDecrypter(abc.ABC):
+ """
+ A Card key field decryptor class that may be used by Card key provider implementations to add support for
+ a column-based encryption to protect sensitive material (cryptographic key material, ADM keys, etc.).
+ The sensitive material is encrypted using a "key-encryption key", occasionally also known as "transport key"
+ before it is stored into a file or database (see also GSMA FS.28). The "transport key" is then used to decrypt
+ the key material on demand using this class.
+ """
-class CardKeyProviderCsv(CardKeyProvider):
- """Card key provider implementation that allows to query against a specified CSV file.
- Supports column-based encryption as it is generally a bad idea to store cryptographic key material in
- plaintext. Instead, the key material should be encrypted by a "key-encryption key", occasionally also
- known as "transport key" (see GSMA FS.28)."""
- IV = b'\x23' * 16
- csv_file = None
- filename = None
-
- def __init__(self, filename: str, transport_keys: dict):
+ def _set_transport_keys(self, transport_keys: dict):
"""
+ Set transport keys, usually one for each column. In some cases it is also possible to use a single key for multiple
+ columns (see also CRYPT_GROUPS)
+
Args:
- filename : file name (path) of CSV file containing card-individual key/data
transport_keys : a dict indexed by field name, whose values are hex-encoded AES keys for the
- respective field (column) of the CSV. This is done so that different fields
+ respective field (column) of the CSV. This is done so that different fields
(columns) can use different transport keys, which is strongly recommended by
GSMA FS.28
"""
- self.csv_file = open(filename, 'r')
- if not self.csv_file:
- raise RuntimeError("Could not open CSV file '%s'" % filename)
- self.filename = filename
- self.transport_keys = self.process_transport_keys(transport_keys)
+ self.transport_keys = self.__process_transport_keys(transport_keys)
@staticmethod
- def process_transport_keys(transport_keys: dict):
+ def __process_transport_keys(transport_keys: dict):
"""Apply a single transport key to multiple fields/columns, if the name is a group."""
new_dict = {}
for name, key in transport_keys.items():
@@ -127,12 +124,41 @@
return new_dict
def _decrypt_field(self, field_name: str, encrypted_val: str) -> str:
- """decrypt a single field, if we have a transport key for the field of that name."""
+ """
+ Decrypt a single field. The decryption is only applied if we have a transport key is known under the provided
+ field name, otherwise the field is treated as plaintext and passed through as it is.
+
+ Args:
+ field_name : name of the field to decrypt (used to identify which key to use)
+ encrypted_val : encrypted field value
+
+ Returns:
+ plaintext field value
+ """
if not field_name in self.transport_keys:
return encrypted_val
cipher = AES.new(h2b(self.transport_keys[field_name]), AES.MODE_CBC, self.IV)
return b2h(cipher.decrypt(h2b(encrypted_val)))
+class CardKeyProviderCsv(CardKeyFieldDecrypter, CardKeyProvider):
+ """Card key provider implementation that allows to query against a specified CSV file."""
+
+ IV = b'\x23' * 16
+ csv_file = None
+ filename = None
+
+ def __init__(self, filename: str, transport_keys: dict):
+ """
+ Args:
+ filename : file name (path) of CSV file containing card-individual key/data
+ transport_keys : (see class CardKeyFieldDecrypter)
+ """
+ self.csv_file = open(filename, 'r')
+ if not self.csv_file:
+ raise RuntimeError("Could not open CSV file '%s'" % filename)
+ self.filename = filename
+ self._set_transport_keys(transport_keys)
+
def get(self, fields: List[str], key: str, value: str) -> Dict[str, str]:
super()._verify_get_data(fields, key, value)
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/41450?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: I180457d4938f526d227c81020e4e03c6b3a57dab
Gerrit-Change-Number: 41450
Gerrit-PatchSet: 1
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>