Attention is currently required from: dexter.
laforge has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/aram-applet/+/39615?usp=email )
Change subject: AccessRuleMaster: allow locking of STORE DATA commands
......................................................................
Patch Set 2:
(3 comments)
File aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java:
https://gerrit.osmocom.org/c/aram-applet/+/39615/comment/5b4aafbc_e2980fbd?… :
PS2, Line 106: ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED);
why is this exception not raised in the INSTALL FOR PERSO case? The only condition for raising it is aram_lock_status, AFAICT.
https://gerrit.osmocom.org/c/aram-applet/+/39615/comment/b1725e2d_8594b6a6?… :
PS2, Line 304: this.aram_lock_status = true;
mixing tab (new) and space (old) indentation
https://gerrit.osmocom.org/c/aram-applet/+/39615/comment/805d2682_1cf9cd99?… :
PS2, Line 307: this.aram_lock_status = false;
where is the check that this command is only issued via the INSTALL FOR PERSO ?
--
To view, visit https://gerrit.osmocom.org/c/aram-applet/+/39615?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: aram-applet
Gerrit-Branch: master
Gerrit-Change-Id: I86437844585c22fc4280cc48b99edbb56e3159db
Gerrit-Change-Number: 39615
Gerrit-PatchSet: 2
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: laforge <laforge(a)osmocom.org>
Gerrit-Attention: dexter <pmaier(a)sysmocom.de>
Gerrit-Comment-Date: Tue, 25 Feb 2025 17:23:11 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Attention is currently required from: dexter.
laforge has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/aram-applet/+/39614?usp=email )
Change subject: AccessRuleMaster: use constants for the command bytes
......................................................................
Patch Set 2: Code-Review+1
--
To view, visit https://gerrit.osmocom.org/c/aram-applet/+/39614?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: aram-applet
Gerrit-Branch: master
Gerrit-Change-Id: Ia3ccb511886b7da9a3a8e4ab7c89af3ab99c0abf
Gerrit-Change-Number: 39614
Gerrit-PatchSet: 2
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: dexter <pmaier(a)sysmocom.de>
Gerrit-Comment-Date: Tue, 25 Feb 2025 17:19:51 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Hello Jenkins Builder,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/aram-applet/+/39614?usp=email
to look at the new patch set (#2).
Change subject: AccessRuleMaster: use constants for the command bytes
......................................................................
AccessRuleMaster: use constants for the command bytes
The command bytes (0xF0, b0xF1, 0xF2) only appear as magic numbers
in the code. Let's use constants, so that it is clear what those
bytes mean and where they come from.
Related: SYS#7245
Change-Id: Ia3ccb511886b7da9a3a8e4ab7c89af3ab99c0abf
---
M aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java
1 file changed, 9 insertions(+), 7 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/aram-applet refs/changes/14/39614/2
--
To view, visit https://gerrit.osmocom.org/c/aram-applet/+/39614?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: aram-applet
Gerrit-Branch: master
Gerrit-Change-Id: Ia3ccb511886b7da9a3a8e4ab7c89af3ab99c0abf
Gerrit-Change-Number: 39614
Gerrit-PatchSet: 2
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/aram-applet/+/39615?usp=email )
Change subject: AccessRuleMaster: allow locking of STORE DATA commands
......................................................................
AccessRuleMaster: allow locking of STORE DATA commands
The ara-m applet has no security features whatsoever. The rules can
be edited by any user that has APDU access to the ARA-M application.
To add a bit of security for users who want to make sure that their
ARA-M rules are not edited by unauthorized partys, let's add a
propritary lock/unlock command that can be used to lock the access
to STORE DATA on the normal APDU interface of the application. Once
locked, the access to STORE DATA can only be unlocked via an INSTALL
for personalization command that is issued from the ISD on a secure
channel.
Related: SYS#7245
Change-Id: I86437844585c22fc4280cc48b99edbb56e3159db
---
M aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java
1 file changed, 16 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/aram-applet refs/changes/15/39615/1
diff --git a/aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java b/aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java
index bdce9c3..4e90f80 100644
--- a/aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java
+++ b/aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java
@@ -48,6 +48,9 @@
public final static byte COMMAND_DELETE = (byte) 0xF1;
public final static byte COMMAND_UPDATE_REFRESH_TAG = (byte) 0xF2;
+ public final static byte COMMAND_LOCK_ARAM = (byte) 0xA1;
+ public final static byte COMMAND_UNLOCK_ARAM = (byte) 0xA2;
+
/**
* APDU data size.
*/
@@ -70,6 +73,11 @@
* current chunk index to send for next GET NEXT command.
*/
private short currentNext;
+ /**
+ * lock status of the Access Rule Master. When set to true, it is no longer possible to issue
+ * STORE DATA commands to the applet through its process interface.
+ */
+ private boolean aram_lock_status;
private AccessRuleMaster() {
refreshTag = new byte[8];
@@ -94,7 +102,8 @@
case INS_STORE_DATA:
if (apdu.setIncomingAndReceive() != (short) (buffer[ISO7816.OFFSET_LC] & 0xFF))
ISOException.throwIt(ISO7816.SW_WRONG_LENGTH);
-
+ if (this.aram_lock_status)
+ ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED);
processCmdStoreData(APDU.getCurrentAPDUBuffer());
break;
case INS_GET_DATA:
@@ -291,6 +300,12 @@
deleteArDo(buf);
} else if (buf[ofs] == AccessRuleMaster.COMMAND_UPDATE_REFRESH_TAG) {
updateRefreshTag();
+ } else if (buf[ofs] == AccessRuleMaster.COMMAND_LOCK_ARAM) {
+ this.aram_lock_status = true;
+ return;
+ } else if (buf[ofs] == AccessRuleMaster.COMMAND_UNLOCK_ARAM) {
+ this.aram_lock_status = false;
+ return;
} else {
ISOException.throwIt(ISO7816.SW_DATA_INVALID);
}
--
To view, visit https://gerrit.osmocom.org/c/aram-applet/+/39615?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: aram-applet
Gerrit-Branch: master
Gerrit-Change-Id: I86437844585c22fc4280cc48b99edbb56e3159db
Gerrit-Change-Number: 39615
Gerrit-PatchSet: 1
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Attention is currently required from: pespin.
Hello Jenkins Builder,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/libosmo-sigtran/+/39613?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Verified-1 by Jenkins Builder
Change subject: vty: show cs7 route: display qos-class configured value
......................................................................
vty: show cs7 route: display qos-class configured value
Change-Id: I2d2a246c7fbdf495af94ac5da14d4a93ef837f81
---
M src/osmo_ss7_vty.c
M tests/vty/osmo_stp_route_prio.vty
2 files changed, 13 insertions(+), 6 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/13/39613/2
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/39613?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: I2d2a246c7fbdf495af94ac5da14d4a93ef837f81
Gerrit-Change-Number: 39613
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Attention: pespin <pespin(a)sysmocom.de>