gerrit-log September 2025

gerrit-log@lists.osmocom.org

1 participants
1000 discussions

[S] Change in osmo-ttcn3-hacks[master]: s1gw: test S1GW originated PFCP Heartbeat

by fixeria

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41126?usp=email ) Change subject: s1gw: test S1GW originated PFCP Heartbeat ...................................................................... s1gw: test S1GW originated PFCP Heartbeat Extend the existing TC_pfcp_heartbeat to send a Heartbeat Request in the opposite direction (S1GW -> UPF) using the REST interface. Change-Id: I28fb46be037a488e225d20a16b83d0479c6e067d Related: SYS#7066 --- M s1gw/S1GW_Tests.ttcn 1 file changed, 12 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/26/41126/1 diff --git a/s1gw/S1GW_Tests.ttcn b/s1gw/S1GW_Tests.ttcn index 466e377..862f507 100644 --- a/s1gw/S1GW_Tests.ttcn +++ b/s1gw/S1GW_Tests.ttcn @@ -1003,13 +1003,23 @@ var integer rts := f_PFCPEM_get_recovery_timestamp(); var PDU_PFCP pfcp_pdu; - /* Tx Heartbeat Request */ + /* [S1GW <- UPF] Heartbeat Request */ PFCP.send(ts_PFCP_Heartbeat_Req(rts)); - /* Expect Heartbeat Response + /* [S1GW -> UPF] Heartbeat Response * TODO: validate the indicated Recovery Time Stamp against * the one that we received in the PFCP Association Setup. */ pfcp_pdu := f_ConnHdlr_pfcp_expect(tr_PFCP_Heartbeat_Resp); + + /* [S1GW -> UPF] Heartbeat Request (triggered via the REST interface) + * [S1GW <- UPF] Heartbeat Response (sent by the PFCP_ConnHdlr) */ + if (mp_rest_enable) { + var OperationResult res := f_REST_PfcpHeartbeat(); + if (not res.success) { + setverdict(fail, "PFCP Heartbeat (S1GW -> UPF) failed"); + } + } + setverdict(pass); } testcase TC_pfcp_heartbeat() runs on test_CT { -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41126?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I28fb46be037a488e225d20a16b83d0479c6e067d Gerrit-Change-Number: 41126 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

4 days, 19 hours

[S] Change in osmo-ttcn3-hacks[master]: library/HTTP_Adapter: do not hard-code 'Content-Type'

by fixeria

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41124?usp=email ) Change subject: library/HTTP_Adapter: do not hard-code 'Content-Type' ...................................................................... library/HTTP_Adapter: do not hard-code 'Content-Type' * Do not send `Content-Type` when request contains no body. ** This is wrong and some servers would reject such a request. * Allow passing custom `Content-Type` to ** `f_http_tx_request()` and ** `f_http_transact()`. * Use `application/json` by default. Change-Id: Ie35ffc56b4fedc0b4d8c4a689a2232b515b7b326 --- M library/HTTP_Adapter.ttcn 1 file changed, 14 insertions(+), 6 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/24/41124/1 diff --git a/library/HTTP_Adapter.ttcn b/library/HTTP_Adapter.ttcn index ab5e6b1..8f15958 100644 --- a/library/HTTP_Adapter.ttcn +++ b/library/HTTP_Adapter.ttcn @@ -73,6 +73,7 @@ function f_ts_HTTP_Header(template (omit) charstring body := omit, template (omit) octetstring binary_body := omit, + template (omit) charstring content_type := omit, template (omit) charstring host := omit, HeaderLines custom_hdr := { }) return template (value) HeaderLines { @@ -87,7 +88,9 @@ if (not istemplatekind(host, "omit")) { hdr := hdr & {valueof(ts_HeaderLine("Host", valueof(host)))}; } - hdr := hdr & {{ header_name := "Content-Type", header_value := "application/json" }}; + if (not istemplatekind(content_type, "omit")) { + hdr := hdr & {valueof(ts_HeaderLine("Content-Type", valueof(content_type)))}; + } if (not istemplatekind(body, "omit")) { hdr := hdr & {valueof(ts_HeaderLine("Content-Length", int2str(lengthof(body))))}; } @@ -108,6 +111,7 @@ template (value) HTTPMessage ts_HTTP_Req(charstring url, charstring method := "GET", template (omit) charstring body := omit, + template (omit) charstring content_type := omit, integer v_maj := 1, integer v_min := 1, charstring host, HeaderLines custom_hdr := { }, @@ -118,7 +122,7 @@ uri := url, version_major := v_maj, version_minor := v_min, - header := f_ts_HTTP_Header(body, omit, host, custom_hdr), + header := f_ts_HTTP_Header(body, omit, content_type, host, custom_hdr), body := f_ts_body_or_empty(body) } } @@ -133,6 +137,7 @@ template (value) HTTPMessage ts_HTTP_Req_Bin(charstring url, charstring method := "GET", template (omit) octetstring body := omit, + template (omit) charstring content_type := omit, integer v_maj := 1, integer v_min := 1, charstring host, HeaderLines custom_hdr := { }, @@ -143,7 +148,7 @@ uri := url, version_major := v_maj, version_minor := v_min, - header := f_ts_HTTP_Header(omit, body, host, custom_hdr), + header := f_ts_HTTP_Header(omit, body, content_type, host, custom_hdr), body := f_ts_body_or_empty_bin(body) } } @@ -177,6 +182,7 @@ function f_http_tx_request(charstring url, charstring method := "GET", template (omit) charstring body := omit, template (omit) octetstring binary_body := omit, + charstring content_type := "application/json", HeaderLines custom_hdr := { }, float tout := 2.0, template (omit) integer client_id := omit, @@ -223,11 +229,12 @@ if (not istemplatekind(body, "omit") and istemplatekind(binary_body, "omit")) { /* HTTP message with ASCII content */ - HTTP.send(ts_HTTP_Req(url, method, body, host := use_http_pars.http_host & ":" & int2str(use_http_pars.http_port), + HTTP.send(ts_HTTP_Req(url, method, body, content_type, + host := use_http_pars.http_host & ":" & int2str(use_http_pars.http_port), custom_hdr := custom_hdr, client_id := use_client_id)); } else if (not istemplatekind(binary_body, "omit") and istemplatekind(body, "omit")) { /* HTTP message with binary content */ - HTTP.send(ts_HTTP_Req_Bin(url, method, binary_body, + HTTP.send(ts_HTTP_Req_Bin(url, method, binary_body, content_type, host := use_http_pars.http_host & ":" & int2str(use_http_pars.http_port), custom_hdr := custom_hdr, client_id := use_client_id)); } else if (istemplatekind(binary_body, "omit") and istemplatekind(body, "omit")) { @@ -274,13 +281,14 @@ function f_http_transact(charstring url, charstring method := "GET", template (omit) charstring body := omit, template (omit) octetstring binary_body := omit, + charstring content_type := "application/json", template HTTPMessage exp := tr_HTTP_Resp2xx, float tout := 2.0, HeaderLines custom_hdr := { }, template (omit) integer client_id := omit, boolean keep_connection := false, template (omit) HTTP_Adapter_Params http_pars := omit) runs on http_CT return HTTPMessage { - f_http_tx_request(url, method, body, binary_body, custom_hdr, tout, client_id, http_pars); + f_http_tx_request(url, method, body, binary_body, content_type, custom_hdr, tout, client_id, http_pars); return f_http_rx_response(exp, tout, client_id, keep_connection); } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41124?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ie35ffc56b4fedc0b4d8c4a689a2232b515b7b326 Gerrit-Change-Number: 41124 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

4 days, 19 hours

[M] Change in osmo-ttcn3-hacks[master]: tcap: Add initial templates

by pespin

Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41123?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder Change subject: tcap: Add initial templates ...................................................................... tcap: Add initial templates Change-Id: Ibc471733554c75b7c494b2bd4126232dd8c0553c --- A library/tcap/TCAP_Templates.ttcn 1 file changed, 53 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/23/41123/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41123?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ibc471733554c75b7c494b2bd4126232dd8c0553c Gerrit-Change-Number: 41123 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder

5 days, 1 hour

[M] Change in osmo-ttcn3-hacks[master]: tcap: Add initial templates

by pespin

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41123?usp=email ) Change subject: tcap: Add initial templates ...................................................................... tcap: Add initial templates "continue" message name in asn1 file needs to be modified, since titan doesn't allow "continue" keyword as union option, and it doesn't find it as "Continue" (with cap in first character). I also tried adding "_" at the end, ie. "continue_", but it says the udnerscore is not permitted inside ASN.1. Change-Id: Ibc471733554c75b7c494b2bd4126232dd8c0553c --- M library/tcap/TCAPMessages.asn A library/tcap/TCAP_Templates.ttcn 2 files changed, 54 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/23/41123/1 diff --git a/library/tcap/TCAPMessages.asn b/library/tcap/TCAPMessages.asn index 84a3532..b995d7a 100644 --- a/library/tcap/TCAPMessages.asn +++ b/library/tcap/TCAPMessages.asn @@ -22,7 +22,7 @@ unidirectional [APPLICATION 1] IMPLICIT Unidirectional, begin [APPLICATION 2] IMPLICIT Begin, end [APPLICATION 4] IMPLICIT End, - continue [APPLICATION 5] IMPLICIT Continue, + continu [APPLICATION 5] IMPLICIT Continue, abort [APPLICATION 7] IMPLICIT Abort } diff --git a/library/tcap/TCAP_Templates.ttcn b/library/tcap/TCAP_Templates.ttcn new file mode 100644 index 0000000..aa12653 --- /dev/null +++ b/library/tcap/TCAP_Templates.ttcn @@ -0,0 +1,53 @@ +module TCAP_Templates { + +import from General_Types all; +import from Misc_Helpers all; +import from Native_Functions all; + +import from TCAPMessages language "ASN.1:1997" all; +import from TCAP_Types all; + + +template (value) TCMessage +ts_TCAP_Begin(template (value) OCT4 otid) := { + begin := { + otid := otid, + dialoguePortion := omit, + components := omit + } +} + +template (value) TCMessage +ts_TCAP_Continue(template (value) OCT4 otid, + template (value) OCT4 dtid) := { + continu := { + otid := otid, + dtid := dtid, + dialoguePortion := omit, + components := omit + } +} + +template (value) TCMessage +ts_TCAP_End(template (value) OCT4 dtid) := { + end := { + dtid := dtid, + dialoguePortion := omit, + components := omit + } +} + +template (value) TCMessage +ts_TCAP_Abort(template (value) OCT4 dtid, template (omit) Reason reason := omit) := { + abort := { + dtid := dtid, + reason := reason + } +} + +template (value) Reason +ts_TCAP_Reason_p_AbortCause(template (value) P_AbortCause p_abortCause := 0 /*unrecognizedMessageType*/) := { + p_abortCause := p_abortCause +} + +} -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41123?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ibc471733554c75b7c494b2bd4126232dd8c0553c Gerrit-Change-Number: 41123 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

5 days, 2 hours

[L] Change in osmo-ttcn3-hacks[master]: Introduce TCAP asn enc/dec

by osmith

Attention is currently required from: daniel, fixeria, pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41118?usp=email ) Change subject: Introduce TCAP asn enc/dec ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41118?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Iae7f92cde02e5da966966bc95f9b74feec51958d Gerrit-Change-Number: 41118 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: daniel <dwillmann(a)sysmocom.de> Gerrit-Comment-Date: Tue, 16 Sep 2025 15:15:23 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

5 days, 2 hours

[XS] Change in osmo-ttcn3-hacks[master]: cosmetic: RANAP_CodecPort.ttcn: Fix trailing whitespace

by osmith

Attention is currently required from: pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41116?usp=email ) Change subject: cosmetic: RANAP_CodecPort.ttcn: Fix trailing whitespace ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41116?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ibad0a23cfc15dd9d9a03e78ca64eb26b4ecee6d8 Gerrit-Change-Number: 41116 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Tue, 16 Sep 2025 15:11:31 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

5 days, 2 hours

[M] Change in osmo-ttcn3-hacks[master]: stp: define PC for IPA ASP peers

by osmith

Attention is currently required from: daniel, fixeria, laforge, pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41114?usp=email ) Change subject: stp: define PC for IPA ASP peers ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41114?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I9cca2f4dd38e03ab1d259ffafd904b8890778883 Gerrit-Change-Number: 41114 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: daniel <dwillmann(a)sysmocom.de> Gerrit-Comment-Date: Tue, 16 Sep 2025 15:11:24 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

5 days, 2 hours

[XL] Change in osmo-ttcn3-hacks[master]: smdpp: proper headers for native code

by Hoernchen

Hoernchen has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41122?usp=email ) Change subject: smdpp: proper headers for native code ...................................................................... smdpp: proper headers for native code Change-Id: I9dcb3249fc712e2ddb2c7cf48d4fc54425848bc6 --- R smdpp/bsp_crypto.cc M smdpp/helpers.h A smdpp/http_client.h M smdpp/logger.h M smdpp/regen_makefile.sh A smdpp/rsp_client.cc D smdpp/rsp_client.cpp A smdpp/rsp_client.h M smdpp/smdpp_Tests_Functions.cc 9 files changed, 1,925 insertions(+), 1,747 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/22/41122/1 diff --git a/smdpp/bsp_crypto.cpp b/smdpp/bsp_crypto.cc similarity index 100% rename from smdpp/bsp_crypto.cpp rename to smdpp/bsp_crypto.cc diff --git a/smdpp/helpers.h b/smdpp/helpers.h index afc20ae..d706926 100644 --- a/smdpp/helpers.h +++ b/smdpp/helpers.h @@ -1,3 +1,23 @@ +#ifndef HELPERS_H +#define HELPERS_H + +#include <iostream> +#include <vector> +#include <string> +#include <sstream> +#include <iterator> +#include <iomanip> +#include <stdexcept> + +// Include OpenSSL headers we need +extern "C" { +#include <openssl/bio.h> +#include <openssl/buffer.h> +#include <openssl/evp.h> +#include <openssl/x509.h> +#include <openssl/x509_vfy.h> +} + std::ostream& operator<<(std::ostream& os, const std::vector<std::string>& v) { using namespace std; copy(v.begin(), v.end(), std::ostream_iterator<std::string>(os, "\n")); @@ -32,6 +52,12 @@ } }; +struct EVP_PKEY_Deleter { + void operator()(EVP_PKEY* key) const { + EVP_PKEY_free(key); + } +}; + struct X509_STORE_Deleter { void operator()(X509_STORE* store) const { X509_STORE_free(store); @@ -44,12 +70,6 @@ } }; -struct EVP_PKEY_Deleter { - void operator()(EVP_PKEY* key) const { - EVP_PKEY_free(key); - } -}; - struct EVP_MD_CTX_Deleter { void operator()(EVP_MD_CTX* ctx) const { EVP_MD_CTX_free(ctx); @@ -146,4 +166,6 @@ } }; -} // namespace RspCrypto \ No newline at end of file +} // namespace RspCrypto + +#endif // HELPERS_H \ No newline at end of file diff --git a/smdpp/http_client.h b/smdpp/http_client.h new file mode 100644 index 0000000..6b9c6aa --- /dev/null +++ b/smdpp/http_client.h @@ -0,0 +1,60 @@ +/* HTTP Client Internal Header + * + * Author: Eric Wild <ewild(a)sysmocom.de> / sysmocom - s.f.m.c. GmbH + * + * Released under the terms of GNU General Public License, Version 2 or + * (at your option) any later version. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef HTTP_CLIENT_H +#define HTTP_CLIENT_H + +#include <string> +#include <vector> +#include <openssl/x509.h> + +namespace RspCrypto { + +class HttpClient { + public: + HttpClient(); + ~HttpClient(); + + struct ResponseData { + std::string body; + long statusCode; + std::string headers; + }; + + struct PostConfig { + bool useMutualTLS = false; + std::string clientCertPath; + std::string clientKeyPath; + bool includeAdminProtocolHeader = false; + bool verboseOutput = false; + std::string contentType = "application/json"; + }; + + ResponseData postJson(const std::string& url, unsigned int port, const std::string& jsonData, X509_STORE* store, std::vector<X509*>& certPool, + const PostConfig& config); + + private: + static size_t writeCallback(void* contents, size_t size, size_t nmemb, void* userp); + static size_t headerCallback(void* contents, size_t size, size_t nmemb, void* userp); + + struct SslCtxData { + X509_STORE* store; + std::vector<X509*>* certPool; + bool verifyResult; + std::string errorMessage; + }; + + static std::string get_cn_name(X509_NAME* const name); + static CURLcode sslCtxFunction(CURL* curl, SSL_CTX* sslCtx, void* arg); +}; + +} // namespace RspCrypto + +#endif // HTTP_CLIENT_H \ No newline at end of file diff --git a/smdpp/logger.h b/smdpp/logger.h index f885d7d..d567947 100644 --- a/smdpp/logger.h +++ b/smdpp/logger.h @@ -1,4 +1,7 @@ +#ifndef LOGGER_H +#define LOGGER_H + #include <cstddef> #include <filesystem> #include <iterator> @@ -248,4 +251,6 @@ } }; -} // namespace RspCrypto \ No newline at end of file +} // namespace RspCrypto + +#endif // LOGGER_H \ No newline at end of file diff --git a/smdpp/regen_makefile.sh b/smdpp/regen_makefile.sh index 9a61161..f09ee56 100755 --- a/smdpp/regen_makefile.sh +++ b/smdpp/regen_makefile.sh @@ -13,6 +13,8 @@ TCCInterface.cc PIPEasp_PT.cc smdpp_Tests_Functions.cc + rsp_client.cc + bsp_crypto.cc " ../regen-makefile.sh smdpp_Tests.ttcn $FILES diff --git a/smdpp/rsp_client.cc b/smdpp/rsp_client.cc new file mode 100644 index 0000000..7d52e39 --- /dev/null +++ b/smdpp/rsp_client.cc @@ -0,0 +1,1666 @@ +/* RSP Cryptographic Operations Implementation + * + * Author: Eric Wild <ewild(a)sysmocom.de> / sysmocom - s.f.m.c. GmbH + * + * Released under the terms of GNU General Public License, Version 2 or + * (at your option) any later version. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include <algorithm> +#include <cstddef> +#include <ctime> +#include <filesystem> +#include <fstream> +#include <iostream> +#include <iterator> +#include <memory> +#include <stdexcept> +#include <string> +#include <vector> + +extern "C" { +#include <dirent.h> +#include <sys/stat.h> +#include <sys/types.h> + +#include <openssl/asn1.h> +#include <openssl/asn1t.h> +#include <openssl/bio.h> +#include <openssl/buffer.h> +#include <openssl/core_names.h> +#include <openssl/crypto.h> +#include <openssl/err.h> +#include <openssl/evp.h> +#include <openssl/param_build.h> +#include <openssl/pem.h> +#include <openssl/rand.h> +#include <openssl/types.h> + +#include <openssl/cmac.h> +#include <openssl/ec.h> +#include <openssl/sha.h> +#include <openssl/ssl.h> + +#include <openssl/safestack.h> +#include <openssl/stack.h> +#include <openssl/x509.h> +#include <openssl/x509_vfy.h> +#include <openssl/x509v3.h> + +#include <curl/curl.h> +} + +#include "rsp_client.h" +#include "http_client.h" +#include "logger.h" + +namespace RspCrypto { + +// Private helper functions for CertificateUtil +static std::unique_ptr<BIO, BIODeleter> readFileToBIO(const std::string& filePath) { + std::ifstream file(filePath); + if (!file) { + throw std::runtime_error("Failed to open file: " + filePath); + } + + std::string content((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>()); + std::unique_ptr<BIO, BIODeleter> bio(BIO_new_mem_buf(content.c_str(), -1)); + if (!bio) { + throw OpenSSLError("Failed to create BIO from file content"); + } + + return bio; +} + +static std::vector<uint8_t> extractPublicKeyData(EVP_PKEY* key) { + size_t pub_len = 0; + if (EVP_PKEY_get_octet_string_param(key, OSSL_PKEY_PARAM_PUB_KEY, nullptr, 0, &pub_len) != 1) { + throw OpenSSLError("Failed to get public key size"); + } + + std::vector<uint8_t> publicKeyData(pub_len); + if (EVP_PKEY_get_octet_string_param(key, OSSL_PKEY_PARAM_PUB_KEY, publicKeyData.data(), pub_len, &pub_len) != 1) { + throw OpenSSLError("Failed to extract public key"); + } + + return publicKeyData; +} + +static std::vector<uint8_t> getCertificateExtension(X509* cert, int nid) { + int loc = X509_get_ext_by_NID(cert, nid, -1); + if (loc < 0) { + return std::vector<uint8_t>(); + } + + X509_EXTENSION* ext = X509_get_ext(cert, loc); + if (!ext) { + return std::vector<uint8_t>(); + } + + ASN1_OCTET_STRING* ext_data = X509_EXTENSION_get_data(ext); + if (!ext_data) { + return std::vector<uint8_t>(); + } + + return std::vector<uint8_t>(ASN1_STRING_get0_data(ext_data), ASN1_STRING_get0_data(ext_data) + ASN1_STRING_length(ext_data)); +} + +// CertificateUtil implementations +std::string CertificateUtil::getEID(X509* cert) { + X509_NAME* subject = X509_get_subject_name(cert); + if (!subject) { + return ""; + } + + // EID is stored in serialNumber field + int index = X509_NAME_get_index_by_NID(subject, NID_serialNumber, -1); + if (index < 0) { + return ""; + } + + X509_NAME_ENTRY* entry = X509_NAME_get_entry(subject, index); + if (!entry) { + return ""; + } + + ASN1_STRING* asn1_str = X509_NAME_ENTRY_get_data(entry); + if (!asn1_str) { + return ""; + } + + const unsigned char* str_data = ASN1_STRING_get0_data(asn1_str); + int str_len = ASN1_STRING_length(asn1_str); + + return std::string(reinterpret_cast<const char*>(str_data), str_len); +} + +std::string CertificateUtil::getSubjectName(X509* cert) { + char subjectName[256]; + X509_NAME_oneline(X509_get_subject_name(cert), subjectName, sizeof(subjectName)); + return std::string(subjectName); +} + +std::vector<uint8_t> CertificateUtil::getSubjectKeyIdentifier(X509* cert) { + auto ext_data = getCertificateExtension(cert, NID_subject_key_identifier); + if (ext_data.empty()) { + return std::vector<uint8_t>(); + } + + const unsigned char* p = ext_data.data(); + long xlen = ext_data.size(); + int tag, xclass; + + ASN1_get_object(&p, &xlen, &tag, &xclass, ext_data.size()); + + return std::vector<uint8_t>(p, p + xlen); +} + +std::vector<uint8_t> CertificateUtil::getAuthorityKeyIdentifier(X509* cert) { + auto ext_data = getCertificateExtension(cert, NID_authority_key_identifier); + if (ext_data.empty()) { + return std::vector<uint8_t>(); + } + + // AKI is more complex, need to extract keyid + const unsigned char* p = ext_data.data(); + AUTHORITY_KEYID* akid = d2i_AUTHORITY_KEYID(NULL, &p, ext_data.size()); + + std::vector<uint8_t> aki; + if (akid && akid->keyid) { + aki.assign(akid->keyid->data, akid->keyid->data + akid->keyid->length); + AUTHORITY_KEYID_free(akid); + } + + return aki; +} + +std::unique_ptr<X509, X509Deleter> CertificateUtil::loadCertFromDER(const std::vector<uint8_t>& derData) { + const unsigned char* p = derData.data(); + X509* cert = d2i_X509(nullptr, &p, derData.size()); + + if (!cert) { + throw OpenSSLError("Failed to parse DER certificate"); + } + + return std::unique_ptr<X509, X509Deleter>(cert); +} + +std::vector<std::unique_ptr<X509, X509Deleter>> CertificateUtil::loadCertificateChain(const std::string& filename) { + std::vector<std::unique_ptr<X509, X509Deleter>> chain; + + if (std::filesystem::path(filename).extension() == ".der") { + FILE* file = fopen(filename.c_str(), "rb"); + if (!file) { + throw std::runtime_error("No certificates found in file: " + filename); + } + + X509* cert = d2i_X509_fp(file, nullptr); + chain.push_back(std::unique_ptr<X509, X509Deleter>(cert)); + fclose(file); + + } else { + BIO* bio = BIO_new_file(filename.c_str(), "r"); + if (!bio) { + throw OpenSSLError("Failed to open certificate file: " + filename); + } + X509* cert = nullptr; + while ((cert = PEM_read_bio_X509(bio, nullptr, nullptr, nullptr)) != nullptr) { + chain.push_back(std::unique_ptr<X509, X509Deleter>(cert)); + } + + BIO_free(bio); + } + + if (chain.empty()) { + throw std::runtime_error("No certificates found in file: " + filename); + } + + return chain; +} + +static std::vector<uint8_t> certToDER(X509* cert) { + BIO* bio = BIO_new(BIO_s_mem()); + if (!bio) { + throw OpenSSLError("Failed to create BIO for certificate conversion"); + } + + i2d_X509_bio(bio, cert); + BUF_MEM* bufferPtr; + BIO_get_mem_ptr(bio, &bufferPtr); + + std::vector<uint8_t> der; + der.assign(bufferPtr->data, bufferPtr->data + bufferPtr->length); + BIO_free(bio); + + return der; +} + +bool CertificateUtil::verifyCertificateChainDynamic(X509* cert, const std::vector<X509*>& certPool, X509* rootCA, bool verbose) { + LOG_INFO("Verifying certificate chain..."); + LOG_INFO("Target certificate: " + getSubjectName(cert)); + + // certificate store for trusted roots only + std::unique_ptr<X509_STORE, X509_STORE_Deleter> store(X509_STORE_new()); + if (!store) { + throw OpenSSLError("Failed to create X509_STORE"); + } + + // Only add the explicitly provided root CA to the trust store + if (rootCA) { + if (verbose) { + LOG_INFO("Adding trusted root CA: " + getSubjectName(rootCA)); + } + if (X509_STORE_add_cert(store.get(), rootCA) != 1) { + throw OpenSSLError("Failed to add root CA to store"); + } + } else { + // If no root CA provided, find self-signed certificates in the pool + LOG_WARNING("No explicit root CA provided - searching for self-signed " + "certificates"); + for (auto candidate : certPool) { + if (X509_check_issued(candidate, candidate) == X509_V_OK) { + if (verbose) { + LOG_INFO("Adding self-signed certificate as trusted root: " + getSubjectName(candidate)); + } + if (X509_STORE_add_cert(store.get(), candidate) != 1) { + unsigned long err = ERR_peek_last_error(); + // Ignore duplicate certificate errors + if (ERR_GET_REASON(err) != X509_R_CERT_ALREADY_IN_HASH_TABLE) { + throw OpenSSLError("Failed to add root CA to store"); + } + ERR_clear_error(); + } + } + } + } + + // Build untrusted chain from cert pool (excluding the root if it's in + // there) IMPORTANT: custom deleter that only frees the stack, not the + // certificates + auto stack_only_deleter = [](STACK_OF(X509) * stack) { + if (stack) { + sk_X509_free(stack); // This only frees the stack structure, not the contents + } + }; + std::unique_ptr<STACK_OF(X509), decltype(stack_only_deleter)> untrusted_chain(sk_X509_new_null(), stack_only_deleter); + if (!untrusted_chain) { + throw OpenSSLError("Failed to create untrusted chain"); + } + + // Add all certificates from the pool as untrusted intermediates + for (auto poolCert : certPool) { + // Skip if this is the target certificate + if (X509_cmp(poolCert, cert) == 0) { + continue; + } + // Skip if this is the root CA (already in trust store) + if (rootCA && X509_cmp(poolCert, rootCA) == 0) { + continue; + } + // Add to untrusted chain + if (sk_X509_push(untrusted_chain.get(), poolCert) == 0) { + throw OpenSSLError("Failed to add certificate to untrusted chain"); + } + } + + if (verbose) { + LOG_INFO("Untrusted chain contains " + std::to_string(sk_X509_num(untrusted_chain.get())) + " certificates"); + } + + std::unique_ptr<X509_STORE_CTX, X509_STORE_CTX_Deleter> ctx(X509_STORE_CTX_new()); + if (!ctx) { + throw OpenSSLError("Failed to create X509_STORE_CTX"); + } + + if (X509_STORE_CTX_init(ctx.get(), store.get(), cert, untrusted_chain.get()) != 1) { + throw OpenSSLError("Failed to initialize X509_STORE_CTX"); + } + + unsigned long flags = X509_V_FLAG_CHECK_SS_SIGNATURE; + X509_STORE_CTX_set_flags(ctx.get(), flags); + + X509_STORE_CTX_set_verify_cb(ctx.get(), [](int ok, X509_STORE_CTX* ctx) -> int { + if (!ok) { + int error = X509_STORE_CTX_get_error(ctx); + // SGP.22 EUM certificates use name constraints in a specific way + if (error == X509_V_ERR_PERMITTED_VIOLATION || error == X509_V_ERR_EXCLUDED_VIOLATION || error == X509_V_ERR_SUBTREE_MINMAX) { + // Get the certificate that triggered this + X509* cert = X509_STORE_CTX_get_current_cert(ctx); + if (cert) { + char subject_buf[256]; + X509_NAME_oneline(X509_get_subject_name(cert), subject_buf, sizeof(subject_buf)); + LOG_INFO("Processing certificate with name constraint abuse: " + std::string(subject_buf)); + } + + return 1; + } + } + return ok; // Use default behavior for other errors + }); + + int result = X509_verify_cert(ctx.get()); + + if (result != 1) { + int error = X509_STORE_CTX_get_error(ctx.get()); + int depth = X509_STORE_CTX_get_error_depth(ctx.get()); + X509* errorCert = X509_STORE_CTX_get_current_cert(ctx.get()); + + LOG_ERROR("Certificate verification failed:"); + LOG_ERROR(" Error: " + std::string(X509_verify_cert_error_string(error))); + LOG_ERROR(" Depth: " + std::to_string(depth)); + + if (errorCert) { + LOG_ERROR(" Cert: " + getSubjectName(errorCert)); + } + + return false; + } + + LOG_INFO("Certificate verification successful"); + + if (verbose) { + STACK_OF(X509)* verified_chain = X509_STORE_CTX_get1_chain(ctx.get()); + if (verified_chain) { + LOG_INFO("Verified certificate chain:"); + for (int i = 0; i < sk_X509_num(verified_chain); i++) { + X509* chainCert = sk_X509_value(verified_chain, i); + LOG_INFO(" " + std::to_string(i + 1) + ". " + getSubjectName(chainCert)); + } + sk_X509_pop_free(verified_chain, X509_free); + } + } + + return true; +} + +static std::vector<std::filesystem::path> find_cert_files(const std::filesystem::path& root_path, const std::vector<std::string>& name_filters = {}) { + std::vector<std::filesystem::path> result; + + if (!std::filesystem::exists(root_path)) { + std::cerr << "Path does not exist: " << root_path << std::endl; + return result; + } + + auto file_matches = [&name_filters](const std::filesystem::path& path) { + std::string ext = path.extension().string(); + if (!(ext == ".pem" || ext == ".der" || ext == ".crt")) { + return false; + } + + // If no filters specified, accept all matching extensions + if (name_filters.empty()) { + return true; + } + + // Check if filename contains any of the filters + std::string filename = path.filename().string(); + return std::any_of(name_filters.begin(), name_filters.end(), + [&filename](const std::string& filter) { return filename.find(filter) != std::string::npos; }); + }; + + if (std::filesystem::is_regular_file(root_path)) { + if (file_matches(root_path)) { + result.push_back(root_path); + } + } else if (std::filesystem::is_directory(root_path)) { + for (const auto& entry : std::filesystem::recursive_directory_iterator(root_path)) { + if (entry.is_regular_file() && file_matches(entry.path())) { + result.push_back(entry.path()); + } + } + } + + return result; +} + +std::vector<std::unique_ptr<X509, X509Deleter>> CertificateUtil::loadCertificatesFromDirectory(const std::string& directory, + const std::vector<std::string>& name_filters) { + std::vector<std::unique_ptr<X509, X509Deleter>> certificates; + + auto files_in_dir = find_cert_files(directory, name_filters); + + for (const auto& entry : files_in_dir) { + std::string ext = entry.extension().string(); + auto fpath = entry.string(); + + try { + if (ext == ".pem" || ext == ".crt") { + auto fileCerts = loadCertificateChain(entry); + for (auto& cert : fileCerts) { + certificates.push_back(std::move(cert)); + } + } else if (ext == ".der") { + FILE* file = fopen(fpath.c_str(), "rb"); + if (!file) { + LOG_WARNING("Failed to open certificate file: " + fpath); + continue; + } + + fseek(file, 0, SEEK_END); + long file_size = ftell(file); + rewind(file); + + std::vector<unsigned char> data(file_size); + if (fread(data.data(), 1, file_size, file) != static_cast<size_t>(file_size)) { + fclose(file); + LOG_WARNING("Failed to read certificate file: " + fpath); + continue; + } + + fclose(file); + + const unsigned char* p = data.data(); + X509* cert = d2i_X509(nullptr, &p, file_size); + + if (cert) { + certificates.push_back(std::unique_ptr<X509, X509Deleter>(cert)); + LOG_INFO("Loaded certificate: " + getSubjectName(cert) + " from " + fpath); + } + } + } catch (const std::exception& e) { + // already logged in called functions + } + } + + return certificates; +} + +static void xx_loadCertificate(const std::string& certPath, const std::string& typeName, std::unique_ptr<X509, X509Deleter>& certStorage) { + try { + auto certs = CertificateUtil::loadCertificateChain(certPath); + if (certs.empty()) { + throw std::runtime_error("No " + typeName + " certificate found in file: " + certPath); + } + + certStorage = std::move(certs[0]); + LOG_DEBUG("Loaded " + typeName + " certificate: " + CertificateUtil::getSubjectName(certStorage.get())); + + } catch (const std::exception& e) { + LOG_ERROR("Failed to load " + typeName + " certificate: " + std::string(e.what())); + throw; + } +} + +static void xx_loadPrivateKey(const std::string& keyPath, const std::string& typeName, std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter>& keyStorage) { + try { + if (!std::filesystem::exists(keyPath)) { + throw std::runtime_error(typeName + " private key file not found: " + keyPath); + } + + auto keyBio = readFileToBIO(keyPath); + + keyStorage.reset(PEM_read_bio_PrivateKey(keyBio.get(), nullptr, nullptr, nullptr)); + if (!keyStorage) { + throw OpenSSLError("Failed to read " + typeName + " private key"); + } + + LOG_DEBUG("Loaded " + typeName + " private key from: " + keyPath); + + } catch (const std::exception& e) { + LOG_ERROR("Failed to load " + typeName + " private key: " + std::string(e.what())); + throw; + } +} + +static bool xx_loadPublicKey(const std::string& pubKeyPath, const std::string& typeName, std::vector<uint8_t>& publicKeyStorage) { + try { + if (!std::filesystem::exists(pubKeyPath)) { + LOG_INFO(typeName + " public key file not found: " + pubKeyPath + " (will generate from private key)"); + return false; + } + + auto keyBio = readFileToBIO(pubKeyPath); + + std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> pubKey(PEM_read_bio_PUBKEY(keyBio.get(), nullptr, nullptr, nullptr)); + if (!pubKey) { + LOG_WARNING("Failed to read " + typeName + " public key from file (will generate from private key)"); + return false; + } + + publicKeyStorage = extractPublicKeyData(pubKey.get()); + + LOG_INFO("Loaded " + typeName + " public key from file (" + std::to_string(publicKeyStorage.size()) + " bytes)"); + return true; + + } catch (const std::exception& e) { + LOG_WARNING("Failed to load " + typeName + " public key from file: " + std::string(e.what()) + " (will generate from private key)"); + return false; + } +} + +static void xx_generatePublicKeyFromPrivate(const std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter>& privateKey, const std::string& typeName, + std::vector<uint8_t>& publicKeyStorage) { + if (!privateKey) { + throw std::runtime_error("No " + typeName + " private key available for public key generation"); + } + + publicKeyStorage = extractPublicKeyData(privateKey.get()); + + LOG_DEBUG("Generated " + typeName + " public key from private key (" + std::to_string(publicKeyStorage.size()) + " bytes)"); +} + +static std::vector<std::string> parse_permitted_eins_from_cert(X509* cert) { + std::vector<std::string> permitted_iins; + + bool is_old_variant = false; + int pos = X509_get_ext_by_NID(cert, NID_certificate_policies, -1); + if (pos >= 0) { + X509_EXTENSION* ext = X509_get_ext(cert, pos); + CERTIFICATEPOLICIES* policies = (CERTIFICATEPOLICIES*)X509V3_EXT_d2i(ext); + if (policies) { + for (int i = 0; i < sk_POLICYINFO_num(policies); i++) { + POLICYINFO* policy = sk_POLICYINFO_value(policies, i); + char oid_str[128]; + OBJ_obj2txt(oid_str, sizeof(oid_str), policy->policyid, 1); + if (std::string(oid_str) == "2.23.146.1.2.1.2") { + is_old_variant = true; + break; + } + } + CERTIFICATEPOLICIES_free(policies); + } + } + + if (is_old_variant) { + // Parse from nameConstraints + pos = X509_get_ext_by_NID(cert, NID_name_constraints, -1); + if (pos >= 0) { + X509_EXTENSION* ext = X509_get_ext(cert, pos); + NAME_CONSTRAINTS* nc = (NAME_CONSTRAINTS*)X509V3_EXT_d2i(ext); + if (nc && nc->permittedSubtrees) { + for (int i = 0; i < sk_GENERAL_SUBTREE_num(nc->permittedSubtrees); i++) { + GENERAL_SUBTREE* subtree = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, i); + if (subtree->base->type == GEN_DIRNAME) { + X509_NAME* name = subtree->base->d.directoryName; + int idx = X509_NAME_get_index_by_NID(name, NID_serialNumber, -1); + if (idx >= 0) { + X509_NAME_ENTRY* entry = X509_NAME_get_entry(name, idx); + ASN1_STRING* asn1_str = X509_NAME_ENTRY_get_data(entry); + std::string iin(reinterpret_cast<const char*>(ASN1_STRING_get0_data(asn1_str)), + ASN1_STRING_length(asn1_str)); + permitted_iins.push_back(iin); + } + } + } + } + if (nc) + NAME_CONSTRAINTS_free(nc); + } + } else { + // Parse from GSMA permittedEins extension + ASN1_OBJECT* obj = OBJ_txt2obj("2.23.146.1.2.2.0", 1); + pos = X509_get_ext_by_OBJ(cert, obj, -1); + ASN1_OBJECT_free(obj); + + if (pos >= 0) { + X509_EXTENSION* ext = X509_get_ext(cert, pos); + ASN1_OCTET_STRING* ext_data = X509_EXTENSION_get_data(ext); + const unsigned char* p = ext_data->data; + long remaining = ext_data->length; + + // SEQUENCE OF PrintableString + int tag, xclass; + long xlen; + + // SEQUENCE tag + ASN1_get_object(&p, &xlen, &tag, &xclass, remaining); + if (tag == V_ASN1_SEQUENCE) { + remaining = xlen; + + while (remaining > 0) { + const unsigned char* elem_start = p; + ASN1_get_object(&p, &xlen, &tag, &xclass, remaining); + + if (tag == V_ASN1_PRINTABLESTRING) { + std::string iin(reinterpret_cast<const char*>(p), xlen); + permitted_iins.push_back(iin); + } + + p += xlen; + remaining -= (p - elem_start); + } + } + } + } + + return permitted_iins; +} + +std::string CertificateUtil::getPermittedEINs(const std::vector<uint8_t>& eumCertData) { + try { + auto cert = loadCertFromDER(eumCertData); + auto eins = parse_permitted_eins_from_cert(cert.get()); + + // Join EINs with comma + std::string result; + for (size_t i = 0; i < eins.size(); i++) { + if (i > 0) + result += ","; + result += eins[i]; + } + + return result; + } catch (const std::exception& e) { + LOG_ERROR("getPermittedEINs failed: " + std::string(e.what())); + return ""; + } +} + +bool CertificateUtil::validateEIDRange(const std::string& eid, const std::vector<uint8_t>& eumCertData) { + try { + auto eumCert = loadCertFromDER(eumCertData); + std::vector<std::string> permittedEins = parse_permitted_eins_from_cert(eumCert.get()); + + if (permittedEins.empty()) { + LOG_WARNING("No permitted EINs found in EUM certificate"); + return false; + } + + // Check if EID starts with any permitted EIN + std::string eidNormalized = eid; + std::transform(eidNormalized.begin(), eidNormalized.end(), eidNormalized.begin(), ::toupper); + + for (const auto& ein : permittedEins) { + if (eidNormalized.find(ein) == 0) { + LOG_INFO("EID " + eidNormalized + " matches permitted EIN " + ein); + return true; + } + } + + LOG_ERROR("EID " + eidNormalized + " is not in any permitted EIN list"); + return false; + } catch (const std::exception& e) { + LOG_ERROR("validateEIDRange failed: " + std::string(e.what())); + return false; + } +} + +bool CertificateUtil::hasRSPRole(const std::vector<uint8_t>& certData, const std::string& roleOid) { + try { + auto cert = loadCertFromDER(certData); + + int pos = X509_get_ext_by_NID(cert.get(), NID_certificate_policies, -1); + if (pos < 0) + return false; + + X509_EXTENSION* ext = X509_get_ext(cert.get(), pos); + CERTIFICATEPOLICIES* policies = (CERTIFICATEPOLICIES*)X509V3_EXT_d2i(ext); + + if (!policies) + return false; + + for (int i = 0; i < sk_POLICYINFO_num(policies); i++) { + POLICYINFO* policy = sk_POLICYINFO_value(policies, i); + char oid_str[128]; + OBJ_obj2txt(oid_str, sizeof(oid_str), policy->policyid, 1); + + if (std::string(oid_str) == roleOid) { + CERTIFICATEPOLICIES_free(policies); + return true; + } + } + + CERTIFICATEPOLICIES_free(policies); + return false; + } catch (const std::exception& e) { + LOG_ERROR("hasRSPRole failed: " + std::string(e.what())); + return false; + } +} + +std::string CertificateUtil::getCurveOID(const std::vector<uint8_t>& certData) { + try { + auto cert = loadCertFromDER(certData); + + EVP_PKEY* pkey = X509_get0_pubkey(cert.get()); + if (!pkey) { + LOG_ERROR("Failed to get public key from certificate"); + return ""; + } + + if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) { + LOG_ERROR("Certificate does not contain EC key"); + return ""; + } + + char curve_name[256] = { 0 }; + size_t curve_name_len = sizeof(curve_name); + + if (EVP_PKEY_get_utf8_string_param(pkey, "group", curve_name, sizeof(curve_name), &curve_name_len) != 1) { + LOG_ERROR("Failed to get curve name from EC key"); + return ""; + } + + std::string curve_str(curve_name); + + if (curve_str == "prime256v1") { + return "prime256v1"; + } else if (curve_str == "secp384r1") { + return "secp384r1"; + } else if (curve_str == "brainpoolP256r1") { + return "brainpoolP256r1"; + } else if (curve_str == "brainpoolP384r1") { + return "brainpoolP384r1"; + } + + return "unknown"; + } catch (const std::exception& e) { + LOG_ERROR("getCurveOID failed: " + std::string(e.what())); + return ""; + } +} + +// ECDH compatible (same curve) +bool CertificateUtil::verifyECDHCompatible(const std::vector<uint8_t>& pubKey1, const std::vector<uint8_t>& pubKey2) { + try { + // Both should be uncompressed EC points starting with 0x04 + if (pubKey1.empty() || pubKey2.empty() || pubKey1[0] != 0x04 || pubKey2[0] != 0x04) { + LOG_ERROR("Invalid EC public key format"); + return false; + } + + // For P-256, size should be 65 bytes (1 + 32 + 32) + if (pubKey1.size() == 65 && pubKey2.size() == 65) { + LOG_INFO("Both keys are P-256 format, ECDH compatible"); + return true; + } + + // For P-384, size should be 97 bytes (1 + 48 + 48) + if (pubKey1.size() == 97 && pubKey2.size() == 97) { + LOG_INFO("Both keys are P-384 format, ECDH compatible"); + return true; + } + + LOG_ERROR("Key sizes don't match or unsupported curve"); + return false; + } catch (const std::exception& e) { + LOG_ERROR("verifyECDHCompatible failed: " + std::string(e.what())); + return false; + } +} + +static std::vector<uint8_t> convertBSI_TR03111_to_DER(const std::vector<uint8_t>& bsi_signature) { + if (bsi_signature.size() != 64) { + std::cerr << "Invalid BSI TR-03111 signature size: " << bsi_signature.size() << std::endl; + return {}; + } + + BIGNUM* r = BN_new(); + BIGNUM* s = BN_new(); + + if (!r || !s) { + if (r) + BN_free(r); + if (s) + BN_free(s); + return {}; + } + + BN_bin2bn(bsi_signature.data(), 32, r); + BN_bin2bn(bsi_signature.data() + 32, 32, s); + + ECDSA_SIG* ecdsa_sig = ECDSA_SIG_new(); + if (!ecdsa_sig) { + BN_free(r); + BN_free(s); + return {}; + } + + ECDSA_SIG_set0(ecdsa_sig, r, s); + + int der_len = i2d_ECDSA_SIG(ecdsa_sig, nullptr); + if (der_len <= 0) { + ECDSA_SIG_free(ecdsa_sig); + return {}; + } + + std::vector<uint8_t> der_signature(der_len); + unsigned char* der_ptr = der_signature.data(); + i2d_ECDSA_SIG(ecdsa_sig, &der_ptr); + + ECDSA_SIG_free(ecdsa_sig); + + return der_signature; +} + +static std::vector<uint8_t> convertDER_to_BSI_TR03111(const std::vector<uint8_t>& der_signature) { + if (der_signature.empty()) { + std::cerr << "Empty DER signature" << std::endl; + return {}; + } + + const unsigned char* der_ptr = der_signature.data(); + ECDSA_SIG* ecdsa_sig = d2i_ECDSA_SIG(nullptr, &der_ptr, der_signature.size()); + + if (!ecdsa_sig) { + std::cerr << "Failed to parse DER signature" << std::endl; + return {}; + } + + const BIGNUM *r, *s; + ECDSA_SIG_get0(ecdsa_sig, &r, &s); + + if (!r || !s) { + ECDSA_SIG_free(ecdsa_sig); + return {}; + } + + std::vector<uint8_t> bsi_signature(64, 0); + + int r_len = BN_num_bytes(r); + int s_len = BN_num_bytes(s); + + if (r_len > 32 || s_len > 32) { + std::cerr << "BIGNUM values too large for BSI TR-03111 format" << std::endl; + ECDSA_SIG_free(ecdsa_sig); + return {}; + } + + // Convert r to bytes (with leading zeros padding) + int r_offset = 32 - r_len; + BN_bn2bin(r, bsi_signature.data() + r_offset); + + // Convert s to bytes (with leading zeros padding) + int s_offset = 64 - s_len; + BN_bn2bin(s, bsi_signature.data() + s_offset); + + ECDSA_SIG_free(ecdsa_sig); + + return bsi_signature; +} + +static bool verify_TR031111(const std::vector<uint8_t>& message, const std::vector<uint8_t>& bsi_signature, EVP_PKEY* publicKey) { + std::vector<uint8_t> der_signature = convertBSI_TR03111_to_DER(bsi_signature); + if (der_signature.empty()) { + std::cerr << "Failed to convert signature to DER format" << std::endl; + return false; + } + + std::unique_ptr<EVP_MD_CTX, EVP_MD_CTX_Deleter> mdctx(EVP_MD_CTX_new()); + if (!mdctx.get()) { + std::cerr << "Failed to create MD context" << std::endl; + return false; + } + + if (EVP_DigestVerifyInit(mdctx.get(), nullptr, EVP_sha256(), nullptr, publicKey) != 1) { + std::cerr << "Failed to initialize digest verify" << std::endl; + return false; + } + + if (EVP_DigestVerifyUpdate(mdctx.get(), message.data(), message.size()) != 1) { + std::cerr << "Failed to update digest verify" << std::endl; + return false; + } + + int result = EVP_DigestVerifyFinal(mdctx.get(), der_signature.data(), der_signature.size()); + + return result == 1; +} + +// HttpClient implementations +HttpClient::HttpClient() { + // should be called once per application + curl_global_init(CURL_GLOBAL_DEFAULT); +} + +HttpClient::~HttpClient() { + curl_global_cleanup(); +} + +// Private helper functions for HttpClient +size_t HttpClient::writeCallback(void* contents, size_t size, size_t nmemb, void* userp) { + size_t realSize = size * nmemb; + auto* response = static_cast<std::string*>(userp); + response->append(static_cast<char*>(contents), realSize); + return realSize; +} + +size_t HttpClient::headerCallback(void* contents, size_t size, size_t nmemb, void* userp) { + size_t realSize = size * nmemb; + auto* headers = static_cast<std::string*>(userp); + headers->append(static_cast<char*>(contents), realSize); + return realSize; +} + +std::string HttpClient::get_cn_name(X509_NAME* const name) { + int idx = -1; + unsigned char* utf8 = NULL; + X509_NAME_ENTRY* entry; + ASN1_STRING* data; + + if (!name) + return {}; + + idx = X509_NAME_get_index_by_NID(name, NID_commonName, -1); + if (idx < 0) + return {}; + + entry = X509_NAME_get_entry(name, idx); + if (!entry) + return {}; + + data = X509_NAME_ENTRY_get_data(entry); + if (!data) + return {}; + + if (!ASN1_STRING_to_UTF8(&utf8, data) || !utf8) + return {}; + + std::string retstr((char*)utf8); + OPENSSL_free(utf8); + return retstr; +} + +CURLcode HttpClient::sslCtxFunction(CURL* curl, SSL_CTX* sslCtx, void* arg) { + SslCtxData* ctxData = static_cast<SslCtxData*>(arg); + SSL_CTX* ctx = (SSL_CTX*)sslCtx; + X509_STORE* store = SSL_CTX_get_cert_store(ctx); + + for (auto cert : *ctxData->certPool) { + LOG_DEBUG("ADDED Issuer: " + get_cn_name(X509_get_issuer_name(cert)) + " Subject: " + get_cn_name(X509_get_subject_name(cert)) + + " SKI: " + HexUtil::bytesToHex(CertificateUtil::getSubjectKeyIdentifier(cert)) + + " AKI: " + HexUtil::bytesToHex(CertificateUtil::getAuthorityKeyIdentifier(cert))); + + auto result = X509_STORE_add_cert(store, cert); + if (result != 1) { + printf("Warning: Could not add certificate\n"); + + unsigned long err = ERR_get_error(); + if (ERR_GET_REASON(err) != X509_R_CERT_ALREADY_IN_HASH_TABLE) { + ERR_print_errors_fp(stderr); + } + } + } + + SSL_CTX_set_verify(sslCtx, SSL_VERIFY_PEER, nullptr); + + return CURLE_OK; +} + +HttpClient::ResponseData HttpClient::postJson(const std::string& url, unsigned int port, const std::string& jsonData, X509_STORE* store, + std::vector<X509*>& certPool, const PostConfig& config) { + ResponseData response; + CURL* curl = curl_easy_init(); + + if (!curl) { + throw std::runtime_error("Failed to initialize CURL"); + } + + struct curl_slist* headers = nullptr; + std::string contentTypeHeader = "Content-Type: " + config.contentType; + if (config.useMutualTLS) { + if (config.contentType == "application/json") { + contentTypeHeader += ";charset=UTF-8"; + } + headers = curl_slist_append(headers, contentTypeHeader.c_str()); + headers = curl_slist_append(headers, "Accept: application/json"); + if (config.includeAdminProtocolHeader) { + headers = curl_slist_append(headers, "X-Admin-Protocol: gsma/rsp/v2.5.0"); + } + } else { + headers = curl_slist_append(headers, contentTypeHeader.c_str()); + // For ASN.1, accept the same content type + std::string acceptHeader = "Accept: " + (config.contentType == "application/x-gsma-rsp-asn1" ? config.contentType : "application/json"); + headers = curl_slist_append(headers, acceptHeader.c_str()); + // Always add X-Admin-Protocol for ES9+ regardless of content type + headers = curl_slist_append(headers, "X-Admin-Protocol: gsma/rsp/v2.5.0"); + } + + SslCtxData ctxData = { .store = store, .certPool = &certPool, .verifyResult = false, .errorMessage = "" }; + + try { + // Basic CURL setup + curl_easy_setopt(curl, CURLOPT_URL, url.c_str()); + curl_easy_setopt(curl, CURLOPT_PORT, port); + curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); + curl_easy_setopt(curl, CURLOPT_POSTFIELDS, jsonData.c_str()); + curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, jsonData.size()); // Important for binary data + curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writeCallback); + curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response.body); + curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, headerCallback); + curl_easy_setopt(curl, CURLOPT_HEADERDATA, &response.headers); + + // Enable SSL verification + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L); + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L); + + // Set reasonable timeouts + curl_easy_setopt(curl, CURLOPT_TIMEOUT, 30L); + curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 10L); + + if (config.useMutualTLS) { + if (!config.clientCertPath.empty()) { + curl_easy_setopt(curl, CURLOPT_SSLCERT, config.clientCertPath.c_str()); + + std::string certType = "PEM"; + if (config.clientCertPath.find(".der") != std::string::npos || config.clientCertPath.find(".DER") != std::string::npos) { + certType = "DER"; + } + curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, certType.c_str()); + LOG_DEBUG("Set client certificate: " + config.clientCertPath + " (type: " + certType + ")"); + } + + if (!config.clientKeyPath.empty()) { + curl_easy_setopt(curl, CURLOPT_SSLKEY, config.clientKeyPath.c_str()); + curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM"); + LOG_DEBUG("Set client private key: " + config.clientKeyPath); + } + } + + // Use our custom SSL context function for server cert verification + curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, sslCtxFunction); + curl_easy_setopt(curl, CURLOPT_SSL_CTX_DATA, &ctxData); + + curl_easy_setopt(curl, CURLOPT_VERBOSE, config.verboseOutput ? 1L : 0L); + + CURLcode res = curl_easy_perform(curl); + + if (res != CURLE_OK) { + throw std::runtime_error(std::string("CURL request failed: ") + curl_easy_strerror(res)); + } + + curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response.statusCode); + + curl_slist_free_all(headers); + curl_easy_cleanup(curl); + + return response; + } catch (...) { + curl_slist_free_all(headers); + curl_easy_cleanup(curl); + throw; + } +} + +// Hashed Confirmation Code = SHA256(SHA256(Confirmation Code) | TransactionID) +static std::vector<uint8_t> computeConfirmationCodeHash(const std::string& confirmationCode, const std::vector<uint8_t>& transactionId) { + // Convert confirmation code from hex string to bytes (like EID handling) + std::vector<uint8_t> ccBytes; + for (size_t i = 0; i < confirmationCode.length(); i += 2) { + if (i + 1 < confirmationCode.length()) { + std::string byteString = confirmationCode.substr(i, 2); + uint8_t byte = static_cast<uint8_t>(std::stoi(byteString, nullptr, 16)); + ccBytes.push_back(byte); + } + } + + unsigned char firstHash[SHA256_DIGEST_LENGTH]; + SHA256(ccBytes.data(), ccBytes.size(), firstHash); + + std::vector<uint8_t> concatenated; + concatenated.insert(concatenated.end(), firstHash, firstHash + SHA256_DIGEST_LENGTH); + concatenated.insert(concatenated.end(), transactionId.begin(), transactionId.end()); + + unsigned char finalHash[SHA256_DIGEST_LENGTH]; + SHA256(concatenated.data(), concatenated.size(), finalHash); + + return std::vector<uint8_t>(finalHash, finalHash + SHA256_DIGEST_LENGTH); +} + +// RSPClient implementations +RSPClient::RSPClient(const std::string& serverUrl, const unsigned int serverPort, const std::vector<std::string>& certPath, + const std::vector<std::string>& name_filters) + : m_serverUrl(serverUrl) { + // OpenSSL 3.0+ initializes automatically + + for (auto cpath : certPath) { + bool isDirectory = std::filesystem::is_directory(cpath); + try { + if (isDirectory) { + LOG_DEBUG("Loading certificates from directory: " + cpath); + + auto certs = CertificateUtil::loadCertificatesFromDirectory(cpath, name_filters); + LOG_DEBUG("Loaded " + std::to_string(certs.size()) + " certificates"); + + // Separate root CAs and intermediates + for (auto& cert : certs) { + // Identify root certificates (self-signed) + if (X509_check_issued(cert.get(), cert.get()) == X509_V_OK) { + LOG_DEBUG("Found root CA: " + CertificateUtil::getSubjectName(cert.get())); + + // Store the first root CA as our primary root + if (!m_rootCA) { + m_rootCA = std::move(cert); + } else { + // Store additional roots for chain verification + m_certPool.push_back(std::move(cert)); + } + } else { + // Store intermediate certificates + m_certPool.push_back(std::move(cert)); + } + } + + if (!m_rootCA) { + LOG_WARNING("No root CA found in directory"); + } + } else { + // load certificate chain from single file + LOG_INFO("Loading certificates from file: " + cpath); + auto caChain = CertificateUtil::loadCertificateChain(cpath); + + if (!caChain.empty()) { + m_rootCA = std::move(caChain[0]); + + for (size_t i = 1; i < caChain.size(); ++i) { + m_intermediateCA.push_back(std::move(caChain[i])); + } + + LOG_INFO("Loaded root CA: " + CertificateUtil::getSubjectName(m_rootCA.get())); + + for (const auto& cert : m_intermediateCA) { + LOG_INFO("Loaded intermediate CA: " + CertificateUtil::getSubjectName(cert.get())); + + // add intermediates to certificate pool for compatibility + m_certPool.push_back(std::unique_ptr<X509, X509Deleter>(X509_dup(cert.get()))); + } + } + } + } catch (const std::exception& e) { + LOG_ERROR("Failed to load certificates: " + std::string(e.what())); + throw; + } + } +} + +RSPClient::~RSPClient() { + // OpenSSL 3.0+ handles cleanup automatically +} + +void RSPClient::setCACertPath(const std::string& path) { + m_caCertPath = path; +} + +void RSPClient::loadEUICCCertificate(const std::string& euiccCertPath) { + loadCertificate(euiccCertPath, "eUICC", m_euiccCert); + + try { + m_EID = CertificateUtil::getEID(m_euiccCert.get()); + LOG_DEBUG("Using EID from certificate: " + m_EID); + + auto ski = CertificateUtil::getSubjectKeyIdentifier(m_euiccCert.get()); + m_euiccSKI = ski; + LOG_DEBUG("Using eUICC SKI as PKID: " + HexUtil::bytesToHex(m_euiccSKI)); + } catch (const std::exception& e) { + LOG_ERROR("Failed to extract EUICC-specific data: " + std::string(e.what())); + throw; + } +} + +void RSPClient::loadEUICCKeyPair(const std::string& euiccPrivateKeyPath, const std::string& euiccPublicKeyPath) { + loadKeyPair(euiccPrivateKeyPath, euiccPublicKeyPath, "eUICC", m_euiccPrivateKey, m_euiccPublicKeyData); +} + +void RSPClient::loadEUMCertificate(const std::string& eumCertPath) { + loadCertificate(eumCertPath, "EUM", m_eumCert); +} + +void RSPClient::loadEUMKeyPair(const std::string& eumPrivateKeyPath, const std::string& eumPublicKeyPath) { + loadKeyPair(eumPrivateKeyPath, eumPublicKeyPath, "EUM", m_eumPrivateKey, m_eumPublicKeyData); +} + +std::vector<uint8_t> RSPClient::generateChallenge() { + std::vector<uint8_t> challenge(16); + if (RAND_bytes(challenge.data(), challenge.size()) != 1) { + throw OpenSSLError("Failed to generate random challenge"); + } + return challenge; +} + +int getCertificateCurveNID(X509* cert) { + if (!cert) { + throw std::runtime_error("Certificate is null"); + } + + std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> pubkey(X509_get_pubkey(cert)); + if (!pubkey) { + throw OpenSSLError("Failed to extract public key from certificate"); + } + + char curve_name[80]; + size_t curve_name_len = sizeof(curve_name); + if (EVP_PKEY_get_utf8_string_param(pubkey.get(), OSSL_PKEY_PARAM_GROUP_NAME, curve_name, sizeof(curve_name), &curve_name_len) != 1) { + throw OpenSSLError("Failed to get curve name from certificate"); + } + + std::string curve_str(curve_name); + int curve_nid; + + if (curve_str == "prime256v1" || curve_str == "P-256") { + curve_nid = NID_X9_62_prime256v1; + } else if (curve_str == "brainpoolP256r1") { + curve_nid = NID_brainpoolP256r1; + } else { + throw std::runtime_error("Unsupported curve in certificate: " + curve_str); + } + + return curve_nid; +} + +int RSPClient::getEUICCCurveNID() { + if (!m_euiccCert) { + throw std::runtime_error("eUICC certificate not loaded"); + } + + int curve_nid = getCertificateCurveNID(m_euiccCert.get()); + + if (curve_nid == NID_X9_62_prime256v1) { + LOG_INFO("eUICC certificate uses P-256 curve"); + } else if (curve_nid == NID_brainpoolP256r1) { + LOG_INFO("eUICC certificate uses brainpoolP256r1 curve"); + } + + return curve_nid; +} + +void RSPClient::generateEUICCOtpk() { + int curve_nid = getEUICCCurveNID(); + std::string curve_name = (curve_nid == NID_X9_62_prime256v1) ? "P-256" : "brainpoolP256r1"; + + std::unique_ptr<EVP_PKEY_CTX, decltype(&EVP_PKEY_CTX_free)> pctx(EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr), EVP_PKEY_CTX_free); + if (!pctx) { + throw OpenSSLError("Failed to create EVP_PKEY_CTX"); + } + + if (EVP_PKEY_keygen_init(pctx.get()) <= 0) { + throw OpenSSLError("Failed to initialize key generation"); + } + + if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx.get(), curve_nid) <= 0) { + throw OpenSSLError("Failed to set " + curve_name + " curve"); + } + + EVP_PKEY* pkey_raw = nullptr; + if (EVP_PKEY_keygen(pctx.get(), &pkey_raw) <= 0) { + throw OpenSSLError("Failed to generate EC key pair"); + } + + m_euicc_ot_PrivateKey.reset(pkey_raw); + + size_t pub_len = 0; + + if (EVP_PKEY_get_octet_string_param(m_euicc_ot_PrivateKey.get(), OSSL_PKEY_PARAM_PUB_KEY, nullptr, 0, &pub_len) != 1) { + throw OpenSSLError("Failed to get public key size"); + } + + // Both P-256 and brainpoolP256r1 have 256-bit (32 byte) coordinates + // Uncompressed format: 0x04 + 32 bytes X + 32 bytes Y = 65 bytes + if (pub_len != 65) { + throw OpenSSLError("Unexpected public key size for " + curve_name); + } + + m_euiccOtpk.resize(pub_len); + if (EVP_PKEY_get_octet_string_param(m_euicc_ot_PrivateKey.get(), OSSL_PKEY_PARAM_PUB_KEY, m_euiccOtpk.data(), pub_len, &pub_len) != 1) { + throw OpenSSLError("Failed to extract public key"); + } + + LOG_INFO("Generated eUICC OtPK (" + curve_name + "): " + HexUtil::bytesToHex(m_euiccOtpk)); + + if (m_euiccOtpk[0] != 0x04) { + throw std::runtime_error("Invalid public key format - expected uncompressed point"); + } + + LOG_DEBUG("Public key format verified - uncompressed EC point"); +} + +std::vector<uint8_t> RSPClient::computeECDHSharedSecret(const std::vector<uint8_t>& otherPublicKey) { + if (!m_euicc_ot_PrivateKey) { + throw std::runtime_error("eUICC ephemeral private key not available"); + } + + int curve_nid = getEUICCCurveNID(); + const char* curve_param_name = (curve_nid == NID_X9_62_prime256v1) ? "P-256" : "brainpoolP256r1"; + + std::unique_ptr<EVP_PKEY_CTX, decltype(&EVP_PKEY_CTX_free)> pctx(EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr), EVP_PKEY_CTX_free); + if (!pctx) { + throw OpenSSLError("Failed to create EVP_PKEY_CTX"); + } + + if (EVP_PKEY_fromdata_init(pctx.get()) <= 0) { + throw OpenSSLError("Failed to initialize fromdata"); + } + + OSSL_PARAM_BLD* param_bld = OSSL_PARAM_BLD_new(); + if (!param_bld) { + throw OpenSSLError("Failed to create OSSL_PARAM_BLD"); + } + + if (!OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_PKEY_PARAM_GROUP_NAME, curve_param_name, 0)) { + OSSL_PARAM_BLD_free(param_bld); + throw OpenSSLError("Failed to set curve name"); + } + + if (!OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_PKEY_PARAM_PUB_KEY, otherPublicKey.data(), otherPublicKey.size())) { + OSSL_PARAM_BLD_free(param_bld); + throw OpenSSLError("Failed to set public key"); + } + + OSSL_PARAM* params = OSSL_PARAM_BLD_to_param(param_bld); + if (!params) { + OSSL_PARAM_BLD_free(param_bld); + throw OpenSSLError("Failed to build params"); + } + + EVP_PKEY* other_pkey_raw = nullptr; + if (EVP_PKEY_fromdata(pctx.get(), &other_pkey_raw, EVP_PKEY_PUBLIC_KEY, params) <= 0) { + OSSL_PARAM_free(params); + OSSL_PARAM_BLD_free(param_bld); + throw OpenSSLError("Failed to create public key from data"); + } + + OSSL_PARAM_free(params); + OSSL_PARAM_BLD_free(param_bld); + + std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> other_pkey(other_pkey_raw); + + std::unique_ptr<EVP_PKEY_CTX, decltype(&EVP_PKEY_CTX_free)> derive_ctx(EVP_PKEY_CTX_new(m_euicc_ot_PrivateKey.get(), nullptr), EVP_PKEY_CTX_free); + if (!derive_ctx) { + throw OpenSSLError("Failed to create derive context"); + } + + if (EVP_PKEY_derive_init(derive_ctx.get()) <= 0) { + throw OpenSSLError("Failed to initialize key derivation"); + } + + if (EVP_PKEY_derive_set_peer(derive_ctx.get(), other_pkey.get()) <= 0) { + throw OpenSSLError("Failed to set peer key"); + } + + size_t secret_len = 0; + if (EVP_PKEY_derive(derive_ctx.get(), nullptr, &secret_len) <= 0) { + throw OpenSSLError("Failed to get shared secret length"); + } + + std::vector<uint8_t> shared_secret(secret_len); + if (EVP_PKEY_derive(derive_ctx.get(), shared_secret.data(), &secret_len) <= 0) { + throw OpenSSLError("ECDH computation failed"); + } + + shared_secret.resize(secret_len); + + LOG_INFO("Computed ECDH shared secret: " + HexUtil::bytesToHex(shared_secret)); + return shared_secret; +} + +std::vector<uint8_t> RSPClient::signDataWithEUICC(const std::vector<uint8_t>& dataToSign) { + if (!m_euiccPrivateKey) { + throw std::runtime_error("eUICC private key not available for signing"); + } + auto rv = signDataWithKey(dataToSign, m_euiccPrivateKey.get()); + return convertDER_to_BSI_TR03111(rv); +} + +bool RSPClient::verifyServerSignature(const std::vector<uint8_t>& serverSigned1, const std::vector<uint8_t>& serverSignature1, + const std::vector<uint8_t>& derDataServerCert) { + auto serverCert = CertificateUtil::loadCertFromDER(derDataServerCert); + return verifyServerSignature(serverSigned1, serverSignature1, serverCert.get()); +} + +void RSPClient::setConfirmationCode(const std::string& confirmationCode) { + m_confirmationCode = confirmationCode; + if (!m_transactionId.empty()) { + m_confirmationCodeHash = computeConfirmationCodeHash(m_confirmationCode, m_transactionId); + LOG_INFO("Set confirmation code, computed hash: " + HexUtil::bytesToHex(m_confirmationCodeHash)); + } else { + LOG_ERROR("Cannot compute confirmation code hash - transaction ID not set"); + } +} + +void RSPClient::setTransactionId(const std::vector<uint8_t>& transactionId) { + m_transactionId = transactionId; + LOG_INFO("Set transaction ID: " + HexUtil::bytesToHex(transactionId)); + // If confirmation code was already set, recalculate hash + if (!m_confirmationCode.empty()) { + m_confirmationCodeHash = computeConfirmationCodeHash(m_confirmationCode, m_transactionId); + LOG_INFO("Recalculated confirmation code hash: " + HexUtil::bytesToHex(m_confirmationCodeHash)); + } +} + +std::vector<uint8_t> RSPClient::getConfirmationCodeHash() const { + return m_confirmationCodeHash; +} + +void RSPClient::setConfirmationCodeHash(const std::vector<uint8_t>& hash) { + m_confirmationCodeHash = hash; + LOG_INFO("Set confirmation code hash directly: " + HexUtil::bytesToHex(hash)); +} + +std::vector<uint8_t> RSPClient::getEUMCertificate() { + return certToDER(m_eumCert.get()); +} + +std::vector<uint8_t> RSPClient::getEUICCCertificate() { + return certToDER(m_euiccCert.get()); +} + +std::vector<uint8_t> RSPClient::getCICertificate() { + // If no eUICC certificate is loaded, return the primary root CA + if (!m_euiccCert) { + if (m_rootCA) { + return certToDER(m_rootCA.get()); + } + return std::vector<uint8_t>(); + } + + int euicc_curve_nid = getEUICCCurveNID(); + + if (m_rootCA) { + try { + int root_curve_nid = getCertificateCurveNID(m_rootCA.get()); + if (root_curve_nid == euicc_curve_nid) { + LOG_DEBUG("Primary root CA matches eUICC curve type"); + return certToDER(m_rootCA.get()); + } + } catch (const std::exception& e) { + LOG_WARNING("Failed to get curve type from primary root CA: " + std::string(e.what())); + } + } + + // Search for a matching root CA in the certificate pool + for (const auto& cert : m_certPool) { + // Check if this is a self-signed certificate (root CA) + if (X509_check_issued(cert.get(), cert.get()) == X509_V_OK) { + try { + int cert_curve_nid = getCertificateCurveNID(cert.get()); + if (cert_curve_nid == euicc_curve_nid) { + LOG_DEBUG("Found matching root CA in certificate pool for curve type"); + return certToDER(cert.get()); + } + } catch (const std::exception& e) { + LOG_WARNING("Failed to get curve type from certificate: " + std::string(e.what())); + } + } + } + + // If no matching root CA found, return the primary root CA as fallback + LOG_WARNING("No root CA found matching eUICC curve type, returning primary " + "root CA"); + if (m_rootCA) { + return certToDER(m_rootCA.get()); + } + return std::vector<uint8_t>(); +} + +std::vector<uint8_t> RSPClient::getEUICCOtpk() { + return m_euiccOtpk; +} + +// Private RSPClient methods +void RSPClient::loadCertificate(const std::string& certPath, const std::string& certType, std::unique_ptr<X509, X509Deleter>& certStorage) { + xx_loadCertificate(certPath, certType, certStorage); +} + +void RSPClient::loadKeyPair(const std::string& privateKeyPath, const std::string& publicKeyPath, const std::string& keyType, + std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter>& privateKeyStorage, std::vector<uint8_t>& publicKeyStorage) { + xx_loadPrivateKey(privateKeyPath, keyType, privateKeyStorage); + + if (!publicKeyPath.empty() && xx_loadPublicKey(publicKeyPath, keyType, publicKeyStorage)) { + return; + } + + xx_generatePublicKeyFromPrivate(privateKeyStorage, keyType, publicKeyStorage); +} + +std::vector<uint8_t> RSPClient::signDataWithKey(const std::vector<uint8_t>& dataToSign, EVP_PKEY* pkey) { + if (dataToSign.empty()) { + throw std::runtime_error("Data to sign is empty"); + } + + std::unique_ptr<EVP_MD_CTX, EVP_MD_CTX_Deleter> mdctx(EVP_MD_CTX_new()); + if (!mdctx) { + throw OpenSSLError("Failed to create signature context"); + } + + if (EVP_DigestSignInit(mdctx.get(), nullptr, EVP_sha256(), nullptr, pkey) != 1) { + throw OpenSSLError("Failed to initialize signature operation"); + } + + if (EVP_DigestSignUpdate(mdctx.get(), dataToSign.data(), dataToSign.size()) != 1) { + throw OpenSSLError("Failed to update signature"); + } + + size_t sigLen; + if (EVP_DigestSignFinal(mdctx.get(), nullptr, &sigLen) != 1) { + throw OpenSSLError("Failed to determine signature length"); + } + + if (sigLen == 0) { + throw std::runtime_error("signature length is zero"); + } + + std::vector<uint8_t> signature(sigLen); + if (EVP_DigestSignFinal(mdctx.get(), signature.data(), &sigLen) != 1) { + throw OpenSSLError("Failed to create signature"); + } + + signature.resize(sigLen); + LOG_DEBUG("Created signature (" + std::to_string(sigLen) + " bytes) over " + std::to_string(dataToSign.size()) + " bytes of data"); + + return signature; +} + +bool RSPClient::verifyServerSignature(const std::vector<uint8_t>& signedData, const std::vector<uint8_t>& signature, X509* scertdata) { + try { + // Handle prefix in serverSignature1 based on SGP.22 spec + const unsigned char* signatureData = signature.data(); + size_t signatureLen = signature.size(); + + if (signatureLen >= 3 && signatureData[0] == 0x5f && signatureData[1] == 0x37 && signatureData[2] == 0x40) { + LOG_DEBUG("Detected 5F3740 prefix in serverSignature1, skipping for " + "verification"); + signatureData += 3; + signatureLen -= 3; + } + + std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> pubkey(X509_get_pubkey(scertdata)); + if (!pubkey) { + throw OpenSSLError("Failed to extract public key from certificate"); + } + + auto ski = CertificateUtil::getSubjectKeyIdentifier(scertdata); + LOG_DEBUG(" using cert with this SKI to verify sig: " + HexUtil::bytesToHex(ski)); + + auto verifyResult = verify_TR031111(signedData, std::vector<unsigned char>(signatureData, signatureData + signatureLen), pubkey.get()); + + if (verifyResult) { + LOG_INFO("Signature verification successful!"); + return true; + } else { + LOG_ERROR("Signature verification failed - invalid signature"); + return false; + } + } catch (const std::exception& e) { + LOG_ERROR("Error verifying signature: " + std::string(e.what())); + return false; + } +} + +bool RSPClient::verifyServerSignature(const std::vector<uint8_t>& serverSigned1, const std::vector<uint8_t>& serverSignature1) { + return verifyServerSignature(serverSigned1, serverSignature1, m_serverCert.get()); +} + +void RSPClient::configureHttpClient(bool useCustomTlsCert, const std::string& customTlsCertPath) { + m_useCustomTlsCert = useCustomTlsCert; + m_customTlsCertPath = customTlsCertPath; +} + +// Set authentication parameters for mutual TLS auth +void RSPClient::setAuthParams(bool useMutualTLS, const std::string& clientCertPath, const std::string& clientKeyPath) { + m_useMutualTLS = useMutualTLS; + m_clientCertPath = clientCertPath; + m_clientKeyPath = clientKeyPath; + LOG_DEBUG("Auth params set: mutualTLS=" + std::to_string(useMutualTLS) + ", cert=" + clientCertPath + ", key=" + clientKeyPath); +} + +// Send HTTPS POST without client authentication (for ES9+) +std::string RSPClient::sendHttpsPost(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride) { + return sendHttpsPostUnified(endpoint, body, httpStatusCode, portOverride); +} + +// Send HTTPS POST with pre-configured client authentication (for ES2+) +std::string RSPClient::sendHttpsPostWithAuth(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride) { + if (!m_useMutualTLS) { + LOG_WARNING("sendHttpsPostWithAuth called but mutual TLS not configured"); + } + return sendHttpsPostUnified(endpoint, body, httpStatusCode, portOverride, m_useMutualTLS, m_clientCertPath, m_clientKeyPath); +} + +std::string RSPClient::sendHttpsPostWithContentType(const std::string& endpoint, const std::string& body, const std::string& contentType, int& httpStatusCode, + unsigned int portOverride) { + LOG_DEBUG("sendHttpsPostWithContentType: endpoint=" + endpoint + ", contentType=" + contentType + ", bodySize=" + std::to_string(body.size()) + + ", port=" + std::to_string(portOverride)); + return sendHttpsPostUnified(endpoint, body, httpStatusCode, portOverride, false, "", "", contentType); +} + +std::string RSPClient::sendHttpsPostUnified(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride, + bool useMutualTLS, const std::string& clientCertPath, const std::string& clientKeyPath, + const std::string& contentType) { + if (!m_httpClient) { + m_httpClient = std::make_unique<HttpClient>(); + } + + // full URL without port (port set via CURLOPT_PORT) + std::string url = "https://" + m_serverUrl + endpoint; + + // Build certificate pool for server verification + std::vector<X509*> rawCertPool; + for (const auto& cert : m_certPool) { + rawCertPool.push_back(cert.get()); + } + + // Add custom TLS server certificate if configured globally + if (m_useCustomTlsCert && !m_customTlsCertPath.empty()) { + try { + auto tlsCerts = CertificateUtil::loadCertificateChain(m_customTlsCertPath); + for (auto& cert : tlsCerts) { + rawCertPool.push_back(cert.get()); + } + LOG_DEBUG("Added custom TLS server certificate from: " + m_customTlsCertPath); + } catch (const std::exception& e) { + LOG_WARNING("Failed to load custom TLS server certificate: " + std::string(e.what())); + } + } + + HttpClient::PostConfig config; + config.useMutualTLS = useMutualTLS; + config.clientCertPath = clientCertPath; + config.clientKeyPath = clientKeyPath; + config.includeAdminProtocolHeader = useMutualTLS; // ES2+ requires this header + config.verboseOutput = false; + config.contentType = contentType; + + LOG_DEBUG("Sending " + std::string(useMutualTLS ? "ES2+ request with mutual TLS" : "HTTPS request") + " to: " + endpoint + + " (port: " + std::to_string(portOverride) + ")"); + + HttpClient::ResponseData response = m_httpClient->postJson(url, portOverride, body, nullptr, rawCertPool, config); + + httpStatusCode = response.statusCode; + + LOG_DEBUG("HTTP " + std::to_string(httpStatusCode) + " response, body length: " + std::to_string(response.body.length())); + + return response.body; +} + +} // namespace RspCrypto \ No newline at end of file diff --git a/smdpp/rsp_client.cpp b/smdpp/rsp_client.cpp deleted file mode 100644 index 97f5a5a..0000000 --- a/smdpp/rsp_client.cpp +++ /dev/null @@ -1,1737 +0,0 @@ -/* RSP Cryptographic Operations Implementation - * - * Author: Eric Wild <ewild(a)sysmocom.de> / sysmocom - s.f.m.c. GmbH - * - * Released under the terms of GNU General Public License, Version 2 or - * (at your option) any later version. - * - * SPDX-License-Identifier: GPL-2.0-or-later - */ - -#include <algorithm> -#include <chrono> -#include <cstddef> -#include <ctime> -#include <filesystem> -#include <fstream> -#include <iomanip> -#include <iostream> -#include <iterator> -#include <map> -#include <memory> -#include <mutex> -#include <set> -#include <sstream> -#include <stdexcept> -#include <string> -#include <vector> - -extern "C" { -#include <dirent.h> -#include <sys/stat.h> -#include <sys/types.h> - -#include <openssl/asn1.h> -#include <openssl/asn1t.h> -#include <openssl/bio.h> -#include <openssl/buffer.h> -#include <openssl/core_names.h> -#include <openssl/crypto.h> -#include <openssl/err.h> -#include <openssl/evp.h> -#include <openssl/param_build.h> -#include <openssl/pem.h> -#include <openssl/rand.h> -#include <openssl/types.h> - -#include <openssl/cmac.h> -#include <openssl/ec.h> -#include <openssl/sha.h> -#include <openssl/ssl.h> - -#include <openssl/safestack.h> -#include <openssl/stack.h> -#include <openssl/x509.h> -#include <openssl/x509_vfy.h> -#include <openssl/x509v3.h> - -#include <curl/curl.h> -} - -#include "helpers.h" -#include "logger.h" -namespace RspCrypto { - -class CertificateUtil { - private: - static std::unique_ptr<BIO, BIODeleter> readFileToBIO(const std::string& filePath) { - std::ifstream file(filePath); - if (!file) { - throw std::runtime_error("Failed to open file: " + filePath); - } - - std::string content((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>()); - std::unique_ptr<BIO, BIODeleter> bio(BIO_new_mem_buf(content.c_str(), -1)); - if (!bio) { - throw OpenSSLError("Failed to create BIO from file content"); - } - - return bio; - } - - static std::vector<uint8_t> extractPublicKeyData(EVP_PKEY* key) { - size_t pub_len = 0; - if (EVP_PKEY_get_octet_string_param(key, OSSL_PKEY_PARAM_PUB_KEY, nullptr, 0, &pub_len) != 1) { - throw OpenSSLError("Failed to get public key size"); - } - - std::vector<uint8_t> publicKeyData(pub_len); - if (EVP_PKEY_get_octet_string_param(key, OSSL_PKEY_PARAM_PUB_KEY, publicKeyData.data(), pub_len, &pub_len) != 1) { - throw OpenSSLError("Failed to extract public key"); - } - - return publicKeyData; - } - - static std::vector<uint8_t> getCertificateExtension(X509* cert, int nid) { - int loc = X509_get_ext_by_NID(cert, nid, -1); - if (loc < 0) { - return std::vector<uint8_t>(); - } - - X509_EXTENSION* ext = X509_get_ext(cert, loc); - if (!ext) { - return std::vector<uint8_t>(); - } - - ASN1_OCTET_STRING* ext_data = X509_EXTENSION_get_data(ext); - if (!ext_data) { - return std::vector<uint8_t>(); - } - - return std::vector<uint8_t>(ASN1_STRING_get0_data(ext_data), ASN1_STRING_get0_data(ext_data) + ASN1_STRING_length(ext_data)); - } - - public: - static std::string getEID(X509* cert) { - X509_NAME* subject = X509_get_subject_name(cert); - if (!subject) { - return ""; - } - - // EID is stored in serialNumber field - int index = X509_NAME_get_index_by_NID(subject, NID_serialNumber, -1); - if (index < 0) { - return ""; - } - - X509_NAME_ENTRY* entry = X509_NAME_get_entry(subject, index); - if (!entry) { - return ""; - } - - ASN1_STRING* asn1_str = X509_NAME_ENTRY_get_data(entry); - if (!asn1_str) { - return ""; - } - - const unsigned char* str_data = ASN1_STRING_get0_data(asn1_str); - int str_len = ASN1_STRING_length(asn1_str); - - return std::string(reinterpret_cast<const char*>(str_data), str_len); - } - - static std::string getSubjectName(X509* cert) { - char subjectName[256]; - X509_NAME_oneline(X509_get_subject_name(cert), subjectName, sizeof(subjectName)); - return std::string(subjectName); - } - - static std::vector<uint8_t> getSubjectKeyIdentifier(X509* cert) { - auto ext_data = getCertificateExtension(cert, NID_subject_key_identifier); - if (ext_data.empty()) { - return std::vector<uint8_t>(); - } - - const unsigned char* p = ext_data.data(); - long xlen = ext_data.size(); - int tag, xclass; - - ASN1_get_object(&p, &xlen, &tag, &xclass, ext_data.size()); - - return std::vector<uint8_t>(p, p + xlen); - } - - static std::vector<uint8_t> getAuthorityKeyIdentifier(X509* cert) { - auto ext_data = getCertificateExtension(cert, NID_authority_key_identifier); - if (ext_data.empty()) { - return std::vector<uint8_t>(); - } - - // AKI is more complex, need to extract keyid - const unsigned char* p = ext_data.data(); - AUTHORITY_KEYID* akid = d2i_AUTHORITY_KEYID(NULL, &p, ext_data.size()); - - std::vector<uint8_t> aki; - if (akid && akid->keyid) { - aki.assign(akid->keyid->data, akid->keyid->data + akid->keyid->length); - AUTHORITY_KEYID_free(akid); - } - - return aki; - } - - static std::unique_ptr<X509, X509Deleter> loadCertFromDER(const std::vector<uint8_t>& derData) { - const unsigned char* p = derData.data(); - X509* cert = d2i_X509(nullptr, &p, derData.size()); - - if (!cert) { - throw OpenSSLError("Failed to parse DER certificate"); - } - - return std::unique_ptr<X509, X509Deleter>(cert); - } - - static std::vector<std::unique_ptr<X509, X509Deleter>> loadCertificateChain(const std::string& filename) { - std::vector<std::unique_ptr<X509, X509Deleter>> chain; - - if (std::filesystem::path(filename).extension() == ".der") { - FILE* file = fopen(filename.c_str(), "rb"); - if (!file) { - throw std::runtime_error("No certificates found in file: " + filename); - } - - X509* cert = d2i_X509_fp(file, nullptr); - chain.push_back(std::unique_ptr<X509, X509Deleter>(cert)); - fclose(file); - - } else { - BIO* bio = BIO_new_file(filename.c_str(), "r"); - if (!bio) { - throw OpenSSLError("Failed to open certificate file: " + filename); - } - X509* cert = nullptr; - while ((cert = PEM_read_bio_X509(bio, nullptr, nullptr, nullptr)) != nullptr) { - chain.push_back(std::unique_ptr<X509, X509Deleter>(cert)); - } - - BIO_free(bio); - } - - if (chain.empty()) { - throw std::runtime_error("No certificates found in file: " + filename); - } - - return chain; - } - - static std::vector<uint8_t> certToDER(X509* cert) { - BIO* bio = BIO_new(BIO_s_mem()); - if (!bio) { - throw OpenSSLError("Failed to create BIO for certificate conversion"); - } - - i2d_X509_bio(bio, cert); - BUF_MEM* bufferPtr; - BIO_get_mem_ptr(bio, &bufferPtr); - - std::vector<uint8_t> der; - der.assign(bufferPtr->data, bufferPtr->data + bufferPtr->length); - BIO_free(bio); - - return der; - } - - static bool verifyCertificateChainDynamic(X509* cert, const std::vector<X509*>& certPool, X509* rootCA = nullptr, bool verbose = false) { - LOG_INFO("Verifying certificate chain..."); - LOG_INFO("Target certificate: " + getSubjectName(cert)); - - // certificate store for trusted roots only - std::unique_ptr<X509_STORE, X509_STORE_Deleter> store(X509_STORE_new()); - if (!store) { - throw OpenSSLError("Failed to create X509_STORE"); - } - - // Only add the explicitly provided root CA to the trust store - if (rootCA) { - if (verbose) { - LOG_INFO("Adding trusted root CA: " + getSubjectName(rootCA)); - } - if (X509_STORE_add_cert(store.get(), rootCA) != 1) { - throw OpenSSLError("Failed to add root CA to store"); - } - } else { - // If no root CA provided, find self-signed certificates in the pool - LOG_WARNING("No explicit root CA provided - searching for self-signed " - "certificates"); - for (auto candidate : certPool) { - if (X509_check_issued(candidate, candidate) == X509_V_OK) { - if (verbose) { - LOG_INFO("Adding self-signed certificate as trusted root: " + getSubjectName(candidate)); - } - if (X509_STORE_add_cert(store.get(), candidate) != 1) { - unsigned long err = ERR_peek_last_error(); - // Ignore duplicate certificate errors - if (ERR_GET_REASON(err) != X509_R_CERT_ALREADY_IN_HASH_TABLE) { - throw OpenSSLError("Failed to add root CA to store"); - } - ERR_clear_error(); - } - } - } - } - - // Build untrusted chain from cert pool (excluding the root if it's in - // there) IMPORTANT: custom deleter that only frees the stack, not the - // certificates - auto stack_only_deleter = [](STACK_OF(X509) * stack) { - if (stack) { - sk_X509_free(stack); // This only frees the stack structure, not the contents - } - }; - std::unique_ptr<STACK_OF(X509), decltype(stack_only_deleter)> untrusted_chain(sk_X509_new_null(), stack_only_deleter); - if (!untrusted_chain) { - throw OpenSSLError("Failed to create untrusted chain"); - } - - // Add all certificates from the pool as untrusted intermediates - for (auto poolCert : certPool) { - // Skip if this is the target certificate - if (X509_cmp(poolCert, cert) == 0) { - continue; - } - // Skip if this is the root CA (already in trust store) - if (rootCA && X509_cmp(poolCert, rootCA) == 0) { - continue; - } - // Add to untrusted chain - if (sk_X509_push(untrusted_chain.get(), poolCert) == 0) { - throw OpenSSLError("Failed to add certificate to untrusted chain"); - } - } - - if (verbose) { - LOG_INFO("Untrusted chain contains " + std::to_string(sk_X509_num(untrusted_chain.get())) + " certificates"); - } - - std::unique_ptr<X509_STORE_CTX, X509_STORE_CTX_Deleter> ctx(X509_STORE_CTX_new()); - if (!ctx) { - throw OpenSSLError("Failed to create X509_STORE_CTX"); - } - - if (X509_STORE_CTX_init(ctx.get(), store.get(), cert, untrusted_chain.get()) != 1) { - throw OpenSSLError("Failed to initialize X509_STORE_CTX"); - } - - unsigned long flags = X509_V_FLAG_CHECK_SS_SIGNATURE; - X509_STORE_CTX_set_flags(ctx.get(), flags); - - X509_STORE_CTX_set_verify_cb(ctx.get(), [](int ok, X509_STORE_CTX* ctx) -> int { - if (!ok) { - int error = X509_STORE_CTX_get_error(ctx); - // SGP.22 EUM certificates use name constraints in a specific way - if (error == X509_V_ERR_PERMITTED_VIOLATION || error == X509_V_ERR_EXCLUDED_VIOLATION || error == X509_V_ERR_SUBTREE_MINMAX) { - // Get the certificate that triggered this - X509* cert = X509_STORE_CTX_get_current_cert(ctx); - if (cert) { - char subject_buf[256]; - X509_NAME_oneline(X509_get_subject_name(cert), subject_buf, sizeof(subject_buf)); - LOG_INFO("Processing certificate with name constraint abuse: " + std::string(subject_buf)); - } - - return 1; - } - } - return ok; // Use default behavior for other errors - }); - - int result = X509_verify_cert(ctx.get()); - - if (result != 1) { - int error = X509_STORE_CTX_get_error(ctx.get()); - int depth = X509_STORE_CTX_get_error_depth(ctx.get()); - X509* errorCert = X509_STORE_CTX_get_current_cert(ctx.get()); - - LOG_ERROR("Certificate verification failed:"); - LOG_ERROR(" Error: " + std::string(X509_verify_cert_error_string(error))); - LOG_ERROR(" Depth: " + std::to_string(depth)); - - if (errorCert) { - LOG_ERROR(" Cert: " + getSubjectName(errorCert)); - } - - return false; - } - - LOG_INFO("Certificate verification successful"); - - if (verbose) { - STACK_OF(X509)* verified_chain = X509_STORE_CTX_get1_chain(ctx.get()); - if (verified_chain) { - LOG_INFO("Verified certificate chain:"); - for (int i = 0; i < sk_X509_num(verified_chain); i++) { - X509* chainCert = sk_X509_value(verified_chain, i); - LOG_INFO(" " + std::to_string(i + 1) + ". " + getSubjectName(chainCert)); - } - sk_X509_pop_free(verified_chain, X509_free); - } - } - - return true; - } - - static std::vector<std::filesystem::path> find_cert_files(const std::filesystem::path& root_path, const std::vector<std::string>& name_filters = {}) { - std::vector<std::filesystem::path> result; - - if (!std::filesystem::exists(root_path)) { - std::cerr << "Path does not exist: " << root_path << std::endl; - return result; - } - - auto file_matches = [&name_filters](const std::filesystem::path& path) { - std::string ext = path.extension().string(); - if (!(ext == ".pem" || ext == ".der" || ext == ".crt")) { - return false; - } - - // If no filters specified, accept all matching extensions - if (name_filters.empty()) { - return true; - } - - // Check if filename contains any of the filters - std::string filename = path.filename().string(); - return std::any_of(name_filters.begin(), name_filters.end(), - [&filename](const std::string& filter) { return filename.find(filter) != std::string::npos; }); - }; - - if (std::filesystem::is_regular_file(root_path)) { - if (file_matches(root_path)) { - result.push_back(root_path); - } - } else if (std::filesystem::is_directory(root_path)) { - for (const auto& entry : std::filesystem::recursive_directory_iterator(root_path)) { - if (entry.is_regular_file() && file_matches(entry.path())) { - result.push_back(entry.path()); - } - } - } - - return result; - } - - static std::vector<std::unique_ptr<X509, X509Deleter>> loadCertificatesFromDirectory(const std::string& directory, - const std::vector<std::string>& name_filters) { - std::vector<std::unique_ptr<X509, X509Deleter>> certificates; - - auto files_in_dir = find_cert_files(directory, name_filters); - - for (const auto& entry : files_in_dir) { - std::string ext = entry.extension().string(); - auto fpath = entry.string(); - - try { - if (ext == ".pem" || ext == ".crt") { - auto fileCerts = loadCertificateChain(entry); - for (auto& cert : fileCerts) { - certificates.push_back(std::move(cert)); - } - } else if (ext == ".der") { - FILE* file = fopen(fpath.c_str(), "rb"); - if (!file) { - LOG_WARNING("Failed to open certificate file: " + fpath); - continue; - } - - fseek(file, 0, SEEK_END); - long file_size = ftell(file); - rewind(file); - - std::vector<unsigned char> data(file_size); - if (fread(data.data(), 1, file_size, file) != static_cast<size_t>(file_size)) { - fclose(file); - LOG_WARNING("Failed to read certificate file: " + fpath); - continue; - } - - fclose(file); - - const unsigned char* p = data.data(); - X509* cert = d2i_X509(nullptr, &p, file_size); - - if (cert) { - certificates.push_back(std::unique_ptr<X509, X509Deleter>(cert)); - LOG_INFO("Loaded certificate: " + getSubjectName(cert) + " from " + fpath); - } - } - } catch (const std::exception& e) { - // already logged in called functions - } - } - - return certificates; - } - - static void xx_loadCertificate(const std::string& certPath, const std::string& typeName, std::unique_ptr<X509, X509Deleter>& certStorage) { - try { - auto certs = loadCertificateChain(certPath); - if (certs.empty()) { - throw std::runtime_error("No " + typeName + " certificate found in file: " + certPath); - } - - certStorage = std::move(certs[0]); - LOG_DEBUG("Loaded " + typeName + " certificate: " + getSubjectName(certStorage.get())); - - } catch (const std::exception& e) { - LOG_ERROR("Failed to load " + typeName + " certificate: " + std::string(e.what())); - throw; - } - } - - static void xx_loadPrivateKey(const std::string& keyPath, const std::string& typeName, std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter>& keyStorage) { - try { - if (!std::filesystem::exists(keyPath)) { - throw std::runtime_error(typeName + " private key file not found: " + keyPath); - } - - auto keyBio = readFileToBIO(keyPath); - - keyStorage.reset(PEM_read_bio_PrivateKey(keyBio.get(), nullptr, nullptr, nullptr)); - if (!keyStorage) { - throw OpenSSLError("Failed to read " + typeName + " private key"); - } - - LOG_DEBUG("Loaded " + typeName + " private key from: " + keyPath); - - } catch (const std::exception& e) { - LOG_ERROR("Failed to load " + typeName + " private key: " + std::string(e.what())); - throw; - } - } - - static bool xx_loadPublicKey(const std::string& pubKeyPath, const std::string& typeName, std::vector<uint8_t>& publicKeyStorage) { - try { - if (!std::filesystem::exists(pubKeyPath)) { - LOG_INFO(typeName + " public key file not found: " + pubKeyPath + " (will generate from private key)"); - return false; - } - - auto keyBio = readFileToBIO(pubKeyPath); - - std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> pubKey(PEM_read_bio_PUBKEY(keyBio.get(), nullptr, nullptr, nullptr)); - if (!pubKey) { - LOG_WARNING("Failed to read " + typeName + " public key from file (will generate from private key)"); - return false; - } - - publicKeyStorage = extractPublicKeyData(pubKey.get()); - - LOG_INFO("Loaded " + typeName + " public key from file (" + std::to_string(publicKeyStorage.size()) + " bytes)"); - return true; - - } catch (const std::exception& e) { - LOG_WARNING("Failed to load " + typeName + " public key from file: " + std::string(e.what()) + " (will generate from private key)"); - return false; - } - } - - static void xx_generatePublicKeyFromPrivate(const std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter>& privateKey, const std::string& typeName, - std::vector<uint8_t>& publicKeyStorage) { - if (!privateKey) { - throw std::runtime_error("No " + typeName + " private key available for public key generation"); - } - - publicKeyStorage = extractPublicKeyData(privateKey.get()); - - LOG_DEBUG("Generated " + typeName + " public key from private key (" + std::to_string(publicKeyStorage.size()) + " bytes)"); - } - - static std::vector<std::string> parse_permitted_eins_from_cert(X509* cert) { - std::vector<std::string> permitted_iins; - - bool is_old_variant = false; - int pos = X509_get_ext_by_NID(cert, NID_certificate_policies, -1); - if (pos >= 0) { - X509_EXTENSION* ext = X509_get_ext(cert, pos); - CERTIFICATEPOLICIES* policies = (CERTIFICATEPOLICIES*)X509V3_EXT_d2i(ext); - if (policies) { - for (int i = 0; i < sk_POLICYINFO_num(policies); i++) { - POLICYINFO* policy = sk_POLICYINFO_value(policies, i); - char oid_str[128]; - OBJ_obj2txt(oid_str, sizeof(oid_str), policy->policyid, 1); - if (std::string(oid_str) == "2.23.146.1.2.1.2") { - is_old_variant = true; - break; - } - } - CERTIFICATEPOLICIES_free(policies); - } - } - - if (is_old_variant) { - // Parse from nameConstraints - pos = X509_get_ext_by_NID(cert, NID_name_constraints, -1); - if (pos >= 0) { - X509_EXTENSION* ext = X509_get_ext(cert, pos); - NAME_CONSTRAINTS* nc = (NAME_CONSTRAINTS*)X509V3_EXT_d2i(ext); - if (nc && nc->permittedSubtrees) { - for (int i = 0; i < sk_GENERAL_SUBTREE_num(nc->permittedSubtrees); i++) { - GENERAL_SUBTREE* subtree = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, i); - if (subtree->base->type == GEN_DIRNAME) { - X509_NAME* name = subtree->base->d.directoryName; - int idx = X509_NAME_get_index_by_NID(name, NID_serialNumber, -1); - if (idx >= 0) { - X509_NAME_ENTRY* entry = X509_NAME_get_entry(name, idx); - ASN1_STRING* asn1_str = X509_NAME_ENTRY_get_data(entry); - std::string iin(reinterpret_cast<const char*>(ASN1_STRING_get0_data(asn1_str)), - ASN1_STRING_length(asn1_str)); - permitted_iins.push_back(iin); - } - } - } - } - if (nc) - NAME_CONSTRAINTS_free(nc); - } - } else { - // Parse from GSMA permittedEins extension - ASN1_OBJECT* obj = OBJ_txt2obj("2.23.146.1.2.2.0", 1); - pos = X509_get_ext_by_OBJ(cert, obj, -1); - ASN1_OBJECT_free(obj); - - if (pos >= 0) { - X509_EXTENSION* ext = X509_get_ext(cert, pos); - ASN1_OCTET_STRING* ext_data = X509_EXTENSION_get_data(ext); - const unsigned char* p = ext_data->data; - long remaining = ext_data->length; - - // SEQUENCE OF PrintableString - int tag, xclass; - long xlen; - - // SEQUENCE tag - ASN1_get_object(&p, &xlen, &tag, &xclass, remaining); - if (tag == V_ASN1_SEQUENCE) { - remaining = xlen; - - while (remaining > 0) { - const unsigned char* elem_start = p; - ASN1_get_object(&p, &xlen, &tag, &xclass, remaining); - - if (tag == V_ASN1_PRINTABLESTRING) { - std::string iin(reinterpret_cast<const char*>(p), xlen); - permitted_iins.push_back(iin); - } - - p += xlen; - remaining -= (p - elem_start); - } - } - } - } - - return permitted_iins; - } - - static std::string getPermittedEINs(const std::vector<uint8_t>& eumCertData) { - try { - auto cert = loadCertFromDER(eumCertData); - auto eins = parse_permitted_eins_from_cert(cert.get()); - - // Join EINs with comma - std::string result; - for (size_t i = 0; i < eins.size(); i++) { - if (i > 0) - result += ","; - result += eins[i]; - } - - return result; - } catch (const std::exception& e) { - LOG_ERROR("getPermittedEINs failed: " + std::string(e.what())); - return ""; - } - } - - static bool validateEIDRange(const std::string& eid, const std::vector<uint8_t>& eumCertData) { - try { - auto eumCert = loadCertFromDER(eumCertData); - std::vector<std::string> permittedEins = parse_permitted_eins_from_cert(eumCert.get()); - - if (permittedEins.empty()) { - LOG_WARNING("No permitted EINs found in EUM certificate"); - return false; - } - - // Check if EID starts with any permitted EIN - std::string eidNormalized = eid; - std::transform(eidNormalized.begin(), eidNormalized.end(), eidNormalized.begin(), ::toupper); - - for (const auto& ein : permittedEins) { - if (eidNormalized.find(ein) == 0) { - LOG_INFO("EID " + eidNormalized + " matches permitted EIN " + ein); - return true; - } - } - - LOG_ERROR("EID " + eidNormalized + " is not in any permitted EIN list"); - return false; - } catch (const std::exception& e) { - LOG_ERROR("validateEIDRange failed: " + std::string(e.what())); - return false; - } - } - - static bool hasRSPRole(const std::vector<uint8_t>& certData, const std::string& roleOid) { - try { - auto cert = loadCertFromDER(certData); - - int pos = X509_get_ext_by_NID(cert.get(), NID_certificate_policies, -1); - if (pos < 0) - return false; - - X509_EXTENSION* ext = X509_get_ext(cert.get(), pos); - CERTIFICATEPOLICIES* policies = (CERTIFICATEPOLICIES*)X509V3_EXT_d2i(ext); - - if (!policies) - return false; - - for (int i = 0; i < sk_POLICYINFO_num(policies); i++) { - POLICYINFO* policy = sk_POLICYINFO_value(policies, i); - char oid_str[128]; - OBJ_obj2txt(oid_str, sizeof(oid_str), policy->policyid, 1); - - if (std::string(oid_str) == roleOid) { - CERTIFICATEPOLICIES_free(policies); - return true; - } - } - - CERTIFICATEPOLICIES_free(policies); - return false; - } catch (const std::exception& e) { - LOG_ERROR("hasRSPRole failed: " + std::string(e.what())); - return false; - } - } - - static std::string getCurveOID(const std::vector<uint8_t>& certData) { - try { - auto cert = loadCertFromDER(certData); - - EVP_PKEY* pkey = X509_get0_pubkey(cert.get()); - if (!pkey) { - LOG_ERROR("Failed to get public key from certificate"); - return ""; - } - - if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) { - LOG_ERROR("Certificate does not contain EC key"); - return ""; - } - - char curve_name[256] = { 0 }; - size_t curve_name_len = sizeof(curve_name); - - if (EVP_PKEY_get_utf8_string_param(pkey, "group", curve_name, sizeof(curve_name), &curve_name_len) != 1) { - LOG_ERROR("Failed to get curve name from EC key"); - return ""; - } - - std::string curve_str(curve_name); - - if (curve_str == "prime256v1") { - return "prime256v1"; - } else if (curve_str == "secp384r1") { - return "secp384r1"; - } else if (curve_str == "brainpoolP256r1") { - return "brainpoolP256r1"; - } else if (curve_str == "brainpoolP384r1") { - return "brainpoolP384r1"; - } - - return "unknown"; - } catch (const std::exception& e) { - LOG_ERROR("getCurveOID failed: " + std::string(e.what())); - return ""; - } - } - - // ECDH compatible (same curve) - static bool verifyECDHCompatible(const std::vector<uint8_t>& pubKey1, const std::vector<uint8_t>& pubKey2) { - try { - // Both should be uncompressed EC points starting with 0x04 - if (pubKey1.empty() || pubKey2.empty() || pubKey1[0] != 0x04 || pubKey2[0] != 0x04) { - LOG_ERROR("Invalid EC public key format"); - return false; - } - - // For P-256, size should be 65 bytes (1 + 32 + 32) - if (pubKey1.size() == 65 && pubKey2.size() == 65) { - LOG_INFO("Both keys are P-256 format, ECDH compatible"); - return true; - } - - // For P-384, size should be 97 bytes (1 + 48 + 48) - if (pubKey1.size() == 97 && pubKey2.size() == 97) { - LOG_INFO("Both keys are P-384 format, ECDH compatible"); - return true; - } - - LOG_ERROR("Key sizes don't match or unsupported curve"); - return false; - } catch (const std::exception& e) { - LOG_ERROR("verifyECDHCompatible failed: " + std::string(e.what())); - return false; - } - } - - static std::vector<uint8_t> convertBSI_TR03111_to_DER(const std::vector<uint8_t>& bsi_signature) { - if (bsi_signature.size() != 64) { - std::cerr << "Invalid BSI TR-03111 signature size: " << bsi_signature.size() << std::endl; - return {}; - } - - BIGNUM* r = BN_new(); - BIGNUM* s = BN_new(); - - if (!r || !s) { - if (r) - BN_free(r); - if (s) - BN_free(s); - return {}; - } - - BN_bin2bn(bsi_signature.data(), 32, r); - BN_bin2bn(bsi_signature.data() + 32, 32, s); - - ECDSA_SIG* ecdsa_sig = ECDSA_SIG_new(); - if (!ecdsa_sig) { - BN_free(r); - BN_free(s); - return {}; - } - - ECDSA_SIG_set0(ecdsa_sig, r, s); - - int der_len = i2d_ECDSA_SIG(ecdsa_sig, nullptr); - if (der_len <= 0) { - ECDSA_SIG_free(ecdsa_sig); - return {}; - } - - std::vector<uint8_t> der_signature(der_len); - unsigned char* der_ptr = der_signature.data(); - i2d_ECDSA_SIG(ecdsa_sig, &der_ptr); - - ECDSA_SIG_free(ecdsa_sig); - - return der_signature; - } - - static std::vector<uint8_t> convertDER_to_BSI_TR03111(const std::vector<uint8_t>& der_signature) { - if (der_signature.empty()) { - std::cerr << "Empty DER signature" << std::endl; - return {}; - } - - const unsigned char* der_ptr = der_signature.data(); - ECDSA_SIG* ecdsa_sig = d2i_ECDSA_SIG(nullptr, &der_ptr, der_signature.size()); - - if (!ecdsa_sig) { - std::cerr << "Failed to parse DER signature" << std::endl; - return {}; - } - - const BIGNUM *r, *s; - ECDSA_SIG_get0(ecdsa_sig, &r, &s); - - if (!r || !s) { - ECDSA_SIG_free(ecdsa_sig); - return {}; - } - - std::vector<uint8_t> bsi_signature(64, 0); - - int r_len = BN_num_bytes(r); - int s_len = BN_num_bytes(s); - - if (r_len > 32 || s_len > 32) { - std::cerr << "BIGNUM values too large for BSI TR-03111 format" << std::endl; - ECDSA_SIG_free(ecdsa_sig); - return {}; - } - - // Convert r to bytes (with leading zeros padding) - int r_offset = 32 - r_len; - BN_bn2bin(r, bsi_signature.data() + r_offset); - - // Convert s to bytes (with leading zeros padding) - int s_offset = 64 - s_len; - BN_bn2bin(s, bsi_signature.data() + s_offset); - - ECDSA_SIG_free(ecdsa_sig); - - return bsi_signature; - } - - static bool verify_TR031111(const std::vector<uint8_t>& message, const std::vector<uint8_t>& bsi_signature, EVP_PKEY* publicKey) { - std::vector<uint8_t> der_signature = convertBSI_TR03111_to_DER(bsi_signature); - if (der_signature.empty()) { - std::cerr << "Failed to convert signature to DER format" << std::endl; - return false; - } - - std::unique_ptr<EVP_MD_CTX, EVP_MD_CTX_Deleter> mdctx(EVP_MD_CTX_new()); - if (!mdctx.get()) { - std::cerr << "Failed to create MD context" << std::endl; - return false; - } - - if (EVP_DigestVerifyInit(mdctx.get(), nullptr, EVP_sha256(), nullptr, publicKey) != 1) { - std::cerr << "Failed to initialize digest verify" << std::endl; - return false; - } - - if (EVP_DigestVerifyUpdate(mdctx.get(), message.data(), message.size()) != 1) { - std::cerr << "Failed to update digest verify" << std::endl; - return false; - } - - int result = EVP_DigestVerifyFinal(mdctx.get(), der_signature.data(), der_signature.size()); - - return result == 1; - } -}; - -class HttpClient { - public: - HttpClient() { - // should be called once per application - curl_global_init(CURL_GLOBAL_DEFAULT); - } - - ~HttpClient() { - curl_global_cleanup(); - } - - struct ResponseData { - std::string body; - long statusCode; - std::string headers; - }; - - struct PostConfig { - bool useMutualTLS = false; - std::string clientCertPath; - std::string clientKeyPath; - bool includeAdminProtocolHeader = false; - bool verboseOutput = false; - std::string contentType = "application/json"; - }; - - ResponseData postJson(const std::string& url, unsigned int port, const std::string& jsonData, X509_STORE* store, std::vector<X509*>& certPool, - const PostConfig& config); - - private: - static size_t writeCallback(void* contents, size_t size, size_t nmemb, void* userp) { - size_t realSize = size * nmemb; - auto* response = static_cast<std::string*>(userp); - response->append(static_cast<char*>(contents), realSize); - return realSize; - } - - static size_t headerCallback(void* contents, size_t size, size_t nmemb, void* userp) { - size_t realSize = size * nmemb; - auto* headers = static_cast<std::string*>(userp); - headers->append(static_cast<char*>(contents), realSize); - return realSize; - } - - struct SslCtxData { - X509_STORE* store; - std::vector<X509*>* certPool; - bool verifyResult; - std::string errorMessage; - }; - - static std::string get_cn_name(X509_NAME* const name) { - int idx = -1; - unsigned char* utf8 = NULL; - X509_NAME_ENTRY* entry; - ASN1_STRING* data; - - if (!name) - return {}; - - idx = X509_NAME_get_index_by_NID(name, NID_commonName, -1); - if (idx < 0) - return {}; - - entry = X509_NAME_get_entry(name, idx); - if (!entry) - return {}; - - data = X509_NAME_ENTRY_get_data(entry); - if (!data) - return {}; - - if (!ASN1_STRING_to_UTF8(&utf8, data) || !utf8) - return {}; - - std::string retstr((char*)utf8); - OPENSSL_free(utf8); - return retstr; - } - - static CURLcode sslCtxFunction(CURL* curl, SSL_CTX* sslCtx, void* arg) { - SslCtxData* ctxData = static_cast<SslCtxData*>(arg); - SSL_CTX* ctx = (SSL_CTX*)sslCtx; - X509_STORE* store = SSL_CTX_get_cert_store(ctx); - - for (auto cert : *ctxData->certPool) { - LOG_DEBUG("ADDED Issuer: " + get_cn_name(X509_get_issuer_name(cert)) + " Subject: " + get_cn_name(X509_get_subject_name(cert)) + - " SKI: " + HexUtil::bytesToHex(CertificateUtil::getSubjectKeyIdentifier(cert)) + - " AKI: " + HexUtil::bytesToHex(CertificateUtil::getAuthorityKeyIdentifier(cert))); - - auto result = X509_STORE_add_cert(store, cert); - if (result != 1) { - printf("Warning: Could not add certificate\n"); - - unsigned long err = ERR_get_error(); - if (ERR_GET_REASON(err) != X509_R_CERT_ALREADY_IN_HASH_TABLE) { - ERR_print_errors_fp(stderr); - } - } - } - - SSL_CTX_set_verify(sslCtx, SSL_VERIFY_PEER, nullptr); - - return CURLE_OK; - } -}; - -inline HttpClient::ResponseData HttpClient::postJson(const std::string& url, unsigned int port, const std::string& jsonData, X509_STORE* store, - std::vector<X509*>& certPool, const PostConfig& config) { - ResponseData response; - CURL* curl = curl_easy_init(); - - if (!curl) { - throw std::runtime_error("Failed to initialize CURL"); - } - - struct curl_slist* headers = nullptr; - std::string contentTypeHeader = "Content-Type: " + config.contentType; - if (config.useMutualTLS) { - if (config.contentType == "application/json") { - contentTypeHeader += ";charset=UTF-8"; - } - headers = curl_slist_append(headers, contentTypeHeader.c_str()); - headers = curl_slist_append(headers, "Accept: application/json"); - if (config.includeAdminProtocolHeader) { - headers = curl_slist_append(headers, "X-Admin-Protocol: gsma/rsp/v2.5.0"); - } - } else { - headers = curl_slist_append(headers, contentTypeHeader.c_str()); - // For ASN.1, accept the same content type - std::string acceptHeader = "Accept: " + (config.contentType == "application/x-gsma-rsp-asn1" ? config.contentType : "application/json"); - headers = curl_slist_append(headers, acceptHeader.c_str()); - // Always add X-Admin-Protocol for ES9+ regardless of content type - headers = curl_slist_append(headers, "X-Admin-Protocol: gsma/rsp/v2.5.0"); - } - - SslCtxData ctxData = { .store = store, .certPool = &certPool, .verifyResult = false, .errorMessage = "" }; - - try { - // Basic CURL setup - curl_easy_setopt(curl, CURLOPT_URL, url.c_str()); - curl_easy_setopt(curl, CURLOPT_PORT, port); - curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); - curl_easy_setopt(curl, CURLOPT_POSTFIELDS, jsonData.c_str()); - curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, jsonData.size()); // Important for binary data - curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writeCallback); - curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response.body); - curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, headerCallback); - curl_easy_setopt(curl, CURLOPT_HEADERDATA, &response.headers); - - // Enable SSL verification - curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L); - curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L); - - // Set reasonable timeouts - curl_easy_setopt(curl, CURLOPT_TIMEOUT, 30L); - curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 10L); - - if (config.useMutualTLS) { - if (!config.clientCertPath.empty()) { - curl_easy_setopt(curl, CURLOPT_SSLCERT, config.clientCertPath.c_str()); - - std::string certType = "PEM"; - if (config.clientCertPath.find(".der") != std::string::npos || config.clientCertPath.find(".DER") != std::string::npos) { - certType = "DER"; - } - curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, certType.c_str()); - LOG_DEBUG("Set client certificate: " + config.clientCertPath + " (type: " + certType + ")"); - } - - if (!config.clientKeyPath.empty()) { - curl_easy_setopt(curl, CURLOPT_SSLKEY, config.clientKeyPath.c_str()); - curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM"); - LOG_DEBUG("Set client private key: " + config.clientKeyPath); - } - } - - // Use our custom SSL context function for server cert verification - curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, sslCtxFunction); - curl_easy_setopt(curl, CURLOPT_SSL_CTX_DATA, &ctxData); - - curl_easy_setopt(curl, CURLOPT_VERBOSE, config.verboseOutput ? 1L : 0L); - - CURLcode res = curl_easy_perform(curl); - - if (res != CURLE_OK) { - throw std::runtime_error(std::string("CURL request failed: ") + curl_easy_strerror(res)); - } - - curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response.statusCode); - - curl_slist_free_all(headers); - curl_easy_cleanup(curl); - - return response; - } catch (...) { - curl_slist_free_all(headers); - curl_easy_cleanup(curl); - throw; - } -} - -// Hashed Confirmation Code = SHA256(SHA256(Confirmation Code) | TransactionID) -static std::vector<uint8_t> computeConfirmationCodeHash(const std::string& confirmationCode, const std::vector<uint8_t>& transactionId) { - // Convert confirmation code from hex string to bytes (like EID handling) - std::vector<uint8_t> ccBytes; - for (size_t i = 0; i < confirmationCode.length(); i += 2) { - if (i + 1 < confirmationCode.length()) { - std::string byteString = confirmationCode.substr(i, 2); - uint8_t byte = static_cast<uint8_t>(std::stoi(byteString, nullptr, 16)); - ccBytes.push_back(byte); - } - } - - unsigned char firstHash[SHA256_DIGEST_LENGTH]; - SHA256(ccBytes.data(), ccBytes.size(), firstHash); - - std::vector<uint8_t> concatenated; - concatenated.insert(concatenated.end(), firstHash, firstHash + SHA256_DIGEST_LENGTH); - concatenated.insert(concatenated.end(), transactionId.begin(), transactionId.end()); - - unsigned char finalHash[SHA256_DIGEST_LENGTH]; - SHA256(concatenated.data(), concatenated.size(), finalHash); - - return std::vector<uint8_t>(finalHash, finalHash + SHA256_DIGEST_LENGTH); -} - -class RSPClient { - public: - RSPClient(const std::string& serverUrl, const unsigned int serverPort, const std::vector<std::string>& certPath, - const std::vector<std::string>& name_filters = {}) - : m_serverUrl(serverUrl) { - // OpenSSL 3.0+ initializes automatically - - for (auto cpath : certPath) { - bool isDirectory = std::filesystem::is_directory(cpath); - try { - if (isDirectory) { - LOG_DEBUG("Loading certificates from directory: " + cpath); - - auto certs = CertificateUtil::loadCertificatesFromDirectory(cpath, name_filters); - LOG_DEBUG("Loaded " + std::to_string(certs.size()) + " certificates"); - - // Separate root CAs and intermediates - for (auto& cert : certs) { - // Identify root certificates (self-signed) - if (X509_check_issued(cert.get(), cert.get()) == X509_V_OK) { - LOG_DEBUG("Found root CA: " + CertificateUtil::getSubjectName(cert.get())); - - // Store the first root CA as our primary root - if (!m_rootCA) { - m_rootCA = std::move(cert); - } else { - // Store additional roots for chain verification - m_certPool.push_back(std::move(cert)); - } - } else { - // Store intermediate certificates - m_certPool.push_back(std::move(cert)); - } - } - - if (!m_rootCA) { - LOG_WARNING("No root CA found in directory"); - } - } else { - // load certificate chain from single file - LOG_INFO("Loading certificates from file: " + cpath); - auto caChain = CertificateUtil::loadCertificateChain(cpath); - - if (!caChain.empty()) { - m_rootCA = std::move(caChain[0]); - - for (size_t i = 1; i < caChain.size(); ++i) { - m_intermediateCA.push_back(std::move(caChain[i])); - } - - LOG_INFO("Loaded root CA: " + CertificateUtil::getSubjectName(m_rootCA.get())); - - for (const auto& cert : m_intermediateCA) { - LOG_INFO("Loaded intermediate CA: " + CertificateUtil::getSubjectName(cert.get())); - - // add intermediates to certificate pool for compatibility - m_certPool.push_back(std::unique_ptr<X509, X509Deleter>(X509_dup(cert.get()))); - } - } - } - } catch (const std::exception& e) { - LOG_ERROR("Failed to load certificates: " + std::string(e.what())); - throw; - } - } - } - - ~RSPClient() { - // OpenSSL 3.0+ handles cleanup automatically - } - - void setCACertPath(const std::string& path) { - m_caCertPath = path; - } - - void loadEUICCCertificate(const std::string& euiccCertPath) { - loadCertificate(euiccCertPath, "eUICC", m_euiccCert); - - try { - m_EID = CertificateUtil::getEID(m_euiccCert.get()); - LOG_DEBUG("Using EID from certificate: " + m_EID); - - auto ski = CertificateUtil::getSubjectKeyIdentifier(m_euiccCert.get()); - m_euiccSKI = ski; - LOG_DEBUG("Using eUICC SKI as PKID: " + HexUtil::bytesToHex(m_euiccSKI)); - } catch (const std::exception& e) { - LOG_ERROR("Failed to extract EUICC-specific data: " + std::string(e.what())); - throw; - } - } - - void loadEUICCKeyPair(const std::string& euiccPrivateKeyPath, const std::string& euiccPublicKeyPath = "") { - loadKeyPair(euiccPrivateKeyPath, euiccPublicKeyPath, "eUICC", m_euiccPrivateKey, m_euiccPublicKeyData); - } - - void loadEUMCertificate(const std::string& eumCertPath) { - loadCertificate(eumCertPath, "EUM", m_eumCert); - } - - void loadEUMKeyPair(const std::string& eumPrivateKeyPath, const std::string& eumPublicKeyPath = "") { - loadKeyPair(eumPrivateKeyPath, eumPublicKeyPath, "EUM", m_eumPrivateKey, m_eumPublicKeyData); - } - - std::vector<uint8_t> generateChallenge() { - std::vector<uint8_t> challenge(16); - if (RAND_bytes(challenge.data(), challenge.size()) != 1) { - throw OpenSSLError("Failed to generate random challenge"); - } - return challenge; - } - - int getCertificateCurveNID(X509* cert) { - if (!cert) { - throw std::runtime_error("Certificate is null"); - } - - std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> pubkey(X509_get_pubkey(cert)); - if (!pubkey) { - throw OpenSSLError("Failed to extract public key from certificate"); - } - - char curve_name[80]; - size_t curve_name_len = sizeof(curve_name); - if (EVP_PKEY_get_utf8_string_param(pubkey.get(), OSSL_PKEY_PARAM_GROUP_NAME, curve_name, sizeof(curve_name), &curve_name_len) != 1) { - throw OpenSSLError("Failed to get curve name from certificate"); - } - - std::string curve_str(curve_name); - int curve_nid; - - if (curve_str == "prime256v1" || curve_str == "P-256") { - curve_nid = NID_X9_62_prime256v1; - } else if (curve_str == "brainpoolP256r1") { - curve_nid = NID_brainpoolP256r1; - } else { - throw std::runtime_error("Unsupported curve in certificate: " + curve_str); - } - - return curve_nid; - } - - int getEUICCCurveNID() { - if (!m_euiccCert) { - throw std::runtime_error("eUICC certificate not loaded"); - } - - int curve_nid = getCertificateCurveNID(m_euiccCert.get()); - - if (curve_nid == NID_X9_62_prime256v1) { - LOG_INFO("eUICC certificate uses P-256 curve"); - } else if (curve_nid == NID_brainpoolP256r1) { - LOG_INFO("eUICC certificate uses brainpoolP256r1 curve"); - } - - return curve_nid; - } - - void generateEUICCOtpk() { - int curve_nid = getEUICCCurveNID(); - std::string curve_name = (curve_nid == NID_X9_62_prime256v1) ? "P-256" : "brainpoolP256r1"; - - std::unique_ptr<EVP_PKEY_CTX, decltype(&EVP_PKEY_CTX_free)> pctx(EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr), EVP_PKEY_CTX_free); - if (!pctx) { - throw OpenSSLError("Failed to create EVP_PKEY_CTX"); - } - - if (EVP_PKEY_keygen_init(pctx.get()) <= 0) { - throw OpenSSLError("Failed to initialize key generation"); - } - - if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(pctx.get(), curve_nid) <= 0) { - throw OpenSSLError("Failed to set " + curve_name + " curve"); - } - - EVP_PKEY* pkey_raw = nullptr; - if (EVP_PKEY_keygen(pctx.get(), &pkey_raw) <= 0) { - throw OpenSSLError("Failed to generate EC key pair"); - } - - m_euicc_ot_PrivateKey.reset(pkey_raw); - - size_t pub_len = 0; - - if (EVP_PKEY_get_octet_string_param(m_euicc_ot_PrivateKey.get(), OSSL_PKEY_PARAM_PUB_KEY, nullptr, 0, &pub_len) != 1) { - throw OpenSSLError("Failed to get public key size"); - } - - // Both P-256 and brainpoolP256r1 have 256-bit (32 byte) coordinates - // Uncompressed format: 0x04 + 32 bytes X + 32 bytes Y = 65 bytes - if (pub_len != 65) { - throw OpenSSLError("Unexpected public key size for " + curve_name); - } - - m_euiccOtpk.resize(pub_len); - if (EVP_PKEY_get_octet_string_param(m_euicc_ot_PrivateKey.get(), OSSL_PKEY_PARAM_PUB_KEY, m_euiccOtpk.data(), pub_len, &pub_len) != 1) { - throw OpenSSLError("Failed to extract public key"); - } - - LOG_INFO("Generated eUICC OtPK (" + curve_name + "): " + HexUtil::bytesToHex(m_euiccOtpk)); - - if (m_euiccOtpk[0] != 0x04) { - throw std::runtime_error("Invalid public key format - expected uncompressed point"); - } - - LOG_DEBUG("Public key format verified - uncompressed EC point"); - } - - std::vector<uint8_t> computeECDHSharedSecret(const std::vector<uint8_t>& otherPublicKey) { - if (!m_euicc_ot_PrivateKey) { - throw std::runtime_error("eUICC ephemeral private key not available"); - } - - int curve_nid = getEUICCCurveNID(); - const char* curve_param_name = (curve_nid == NID_X9_62_prime256v1) ? "P-256" : "brainpoolP256r1"; - - std::unique_ptr<EVP_PKEY_CTX, decltype(&EVP_PKEY_CTX_free)> pctx(EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr), EVP_PKEY_CTX_free); - if (!pctx) { - throw OpenSSLError("Failed to create EVP_PKEY_CTX"); - } - - if (EVP_PKEY_fromdata_init(pctx.get()) <= 0) { - throw OpenSSLError("Failed to initialize fromdata"); - } - - OSSL_PARAM_BLD* param_bld = OSSL_PARAM_BLD_new(); - if (!param_bld) { - throw OpenSSLError("Failed to create OSSL_PARAM_BLD"); - } - - if (!OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_PKEY_PARAM_GROUP_NAME, curve_param_name, 0)) { - OSSL_PARAM_BLD_free(param_bld); - throw OpenSSLError("Failed to set curve name"); - } - - if (!OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_PKEY_PARAM_PUB_KEY, otherPublicKey.data(), otherPublicKey.size())) { - OSSL_PARAM_BLD_free(param_bld); - throw OpenSSLError("Failed to set public key"); - } - - OSSL_PARAM* params = OSSL_PARAM_BLD_to_param(param_bld); - if (!params) { - OSSL_PARAM_BLD_free(param_bld); - throw OpenSSLError("Failed to build params"); - } - - EVP_PKEY* other_pkey_raw = nullptr; - if (EVP_PKEY_fromdata(pctx.get(), &other_pkey_raw, EVP_PKEY_PUBLIC_KEY, params) <= 0) { - OSSL_PARAM_free(params); - OSSL_PARAM_BLD_free(param_bld); - throw OpenSSLError("Failed to create public key from data"); - } - - OSSL_PARAM_free(params); - OSSL_PARAM_BLD_free(param_bld); - - std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> other_pkey(other_pkey_raw); - - std::unique_ptr<EVP_PKEY_CTX, decltype(&EVP_PKEY_CTX_free)> derive_ctx(EVP_PKEY_CTX_new(m_euicc_ot_PrivateKey.get(), nullptr), - EVP_PKEY_CTX_free); - if (!derive_ctx) { - throw OpenSSLError("Failed to create derive context"); - } - - if (EVP_PKEY_derive_init(derive_ctx.get()) <= 0) { - throw OpenSSLError("Failed to initialize key derivation"); - } - - if (EVP_PKEY_derive_set_peer(derive_ctx.get(), other_pkey.get()) <= 0) { - throw OpenSSLError("Failed to set peer key"); - } - - size_t secret_len = 0; - if (EVP_PKEY_derive(derive_ctx.get(), nullptr, &secret_len) <= 0) { - throw OpenSSLError("Failed to get shared secret length"); - } - - std::vector<uint8_t> shared_secret(secret_len); - if (EVP_PKEY_derive(derive_ctx.get(), shared_secret.data(), &secret_len) <= 0) { - throw OpenSSLError("ECDH computation failed"); - } - - shared_secret.resize(secret_len); - - LOG_INFO("Computed ECDH shared secret: " + HexUtil::bytesToHex(shared_secret)); - return shared_secret; - } - - std::vector<uint8_t> signDataWithEUICC(const std::vector<uint8_t>& dataToSign) { - if (!m_euiccPrivateKey) { - throw std::runtime_error("eUICC private key not available for signing"); - } - auto rv = signDataWithKey(dataToSign, m_euiccPrivateKey.get()); - return CertificateUtil::convertDER_to_BSI_TR03111(rv); - } - - bool verifyServerSignature(const std::vector<uint8_t>& serverSigned1, const std::vector<uint8_t>& serverSignature1, - const std::vector<uint8_t>& derDataServerCert) { - auto serverCert = CertificateUtil::loadCertFromDER(derDataServerCert); - return verifyServerSignature(serverSigned1, serverSignature1, serverCert.get()); - } - - void setConfirmationCode(const std::string& confirmationCode) { - m_confirmationCode = confirmationCode; - if (!m_transactionId.empty()) { - m_confirmationCodeHash = computeConfirmationCodeHash(m_confirmationCode, m_transactionId); - LOG_INFO("Set confirmation code, computed hash: " + HexUtil::bytesToHex(m_confirmationCodeHash)); - } else { - LOG_ERROR("Cannot compute confirmation code hash - transaction ID not set"); - } - } - - void setTransactionId(const std::vector<uint8_t>& transactionId) { - m_transactionId = transactionId; - LOG_INFO("Set transaction ID: " + HexUtil::bytesToHex(transactionId)); - // If confirmation code was already set, recalculate hash - if (!m_confirmationCode.empty()) { - m_confirmationCodeHash = computeConfirmationCodeHash(m_confirmationCode, m_transactionId); - LOG_INFO("Recalculated confirmation code hash: " + HexUtil::bytesToHex(m_confirmationCodeHash)); - } - } - - std::vector<uint8_t> getConfirmationCodeHash() const { - return m_confirmationCodeHash; - } - - void setConfirmationCodeHash(const std::vector<uint8_t>& hash) { - m_confirmationCodeHash = hash; - LOG_INFO("Set confirmation code hash directly: " + HexUtil::bytesToHex(hash)); - } - - std::vector<uint8_t> getEUMCertificate() { - return CertificateUtil::certToDER(m_eumCert.get()); - } - - std::vector<uint8_t> getEUICCCertificate() { - return CertificateUtil::certToDER(m_euiccCert.get()); - } - - std::vector<uint8_t> getCICertificate() { - // If no eUICC certificate is loaded, return the primary root CA - if (!m_euiccCert) { - if (m_rootCA) { - return CertificateUtil::certToDER(m_rootCA.get()); - } - return std::vector<uint8_t>(); - } - - int euicc_curve_nid = getEUICCCurveNID(); - - if (m_rootCA) { - try { - int root_curve_nid = getCertificateCurveNID(m_rootCA.get()); - if (root_curve_nid == euicc_curve_nid) { - LOG_DEBUG("Primary root CA matches eUICC curve type"); - return CertificateUtil::certToDER(m_rootCA.get()); - } - } catch (const std::exception& e) { - LOG_WARNING("Failed to get curve type from primary root CA: " + std::string(e.what())); - } - } - - // Search for a matching root CA in the certificate pool - for (const auto& cert : m_certPool) { - // Check if this is a self-signed certificate (root CA) - if (X509_check_issued(cert.get(), cert.get()) == X509_V_OK) { - try { - int cert_curve_nid = getCertificateCurveNID(cert.get()); - if (cert_curve_nid == euicc_curve_nid) { - LOG_DEBUG("Found matching root CA in certificate pool for curve type"); - return CertificateUtil::certToDER(cert.get()); - } - } catch (const std::exception& e) { - LOG_WARNING("Failed to get curve type from certificate: " + std::string(e.what())); - } - } - } - - // If no matching root CA found, return the primary root CA as fallback - LOG_WARNING("No root CA found matching eUICC curve type, returning primary " - "root CA"); - if (m_rootCA) { - return CertificateUtil::certToDER(m_rootCA.get()); - } - return std::vector<uint8_t>(); - } - - std::vector<uint8_t> getEUICCOtpk() { - return m_euiccOtpk; - } - - private: - void loadCertificate(const std::string& certPath, const std::string& certType, std::unique_ptr<X509, X509Deleter>& certStorage) { - CertificateUtil::xx_loadCertificate(certPath, certType, certStorage); - } - - void loadKeyPair(const std::string& privateKeyPath, const std::string& publicKeyPath, const std::string& keyType, - std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter>& privateKeyStorage, std::vector<uint8_t>& publicKeyStorage) { - CertificateUtil::xx_loadPrivateKey(privateKeyPath, keyType, privateKeyStorage); - - if (!publicKeyPath.empty() && CertificateUtil::xx_loadPublicKey(publicKeyPath, keyType, publicKeyStorage)) { - return; - } - - CertificateUtil::xx_generatePublicKeyFromPrivate(privateKeyStorage, keyType, publicKeyStorage); - } - - std::vector<uint8_t> signDataWithKey(const std::vector<uint8_t>& dataToSign, EVP_PKEY* pkey) { - if (dataToSign.empty()) { - throw std::runtime_error("Data to sign is empty"); - } - - std::unique_ptr<EVP_MD_CTX, EVP_MD_CTX_Deleter> mdctx(EVP_MD_CTX_new()); - if (!mdctx) { - throw OpenSSLError("Failed to create signature context"); - } - - if (EVP_DigestSignInit(mdctx.get(), nullptr, EVP_sha256(), nullptr, pkey) != 1) { - throw OpenSSLError("Failed to initialize signature operation"); - } - - if (EVP_DigestSignUpdate(mdctx.get(), dataToSign.data(), dataToSign.size()) != 1) { - throw OpenSSLError("Failed to update signature"); - } - - size_t sigLen; - if (EVP_DigestSignFinal(mdctx.get(), nullptr, &sigLen) != 1) { - throw OpenSSLError("Failed to determine signature length"); - } - - if (sigLen == 0) { - throw std::runtime_error("signature length is zero"); - } - - std::vector<uint8_t> signature(sigLen); - if (EVP_DigestSignFinal(mdctx.get(), signature.data(), &sigLen) != 1) { - throw OpenSSLError("Failed to create signature"); - } - - signature.resize(sigLen); - LOG_DEBUG("Created signature (" + std::to_string(sigLen) + " bytes) over " + std::to_string(dataToSign.size()) + " bytes of data"); - - return signature; - } - - bool verifyServerSignature(const std::vector<uint8_t>& signedData, const std::vector<uint8_t>& signature, X509* scertdata) { - try { - // Handle prefix in serverSignature1 based on SGP.22 spec - const unsigned char* signatureData = signature.data(); - size_t signatureLen = signature.size(); - - if (signatureLen >= 3 && signatureData[0] == 0x5f && signatureData[1] == 0x37 && signatureData[2] == 0x40) { - LOG_DEBUG("Detected 5F3740 prefix in serverSignature1, skipping for " - "verification"); - signatureData += 3; - signatureLen -= 3; - } - - std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> pubkey(X509_get_pubkey(scertdata)); - if (!pubkey) { - throw OpenSSLError("Failed to extract public key from certificate"); - } - - auto ski = CertificateUtil::getSubjectKeyIdentifier(scertdata); - LOG_DEBUG(" using cert with this SKI to verify sig: " + HexUtil::bytesToHex(ski)); - - auto verifyResult = CertificateUtil::verify_TR031111( - signedData, std::vector<unsigned char>(signatureData, signatureData + signatureLen), pubkey.get()); - - if (verifyResult) { - LOG_INFO("Signature verification successful!"); - return true; - } else { - LOG_ERROR("Signature verification failed - invalid signature"); - return false; - } - } catch (const std::exception& e) { - LOG_ERROR("Error verifying signature: " + std::string(e.what())); - return false; - } - } - - bool verifyServerSignature(const std::vector<uint8_t>& serverSigned1, const std::vector<uint8_t>& serverSignature1) { - return verifyServerSignature(serverSigned1, serverSignature1, m_serverCert.get()); - } - - public: - void configureHttpClient(bool useCustomTlsCert, const std::string& customTlsCertPath = "") { - m_useCustomTlsCert = useCustomTlsCert; - m_customTlsCertPath = customTlsCertPath; - } - - // Set authentication parameters for mutual TLS auth - void setAuthParams(bool useMutualTLS, const std::string& clientCertPath, const std::string& clientKeyPath) { - m_useMutualTLS = useMutualTLS; - m_clientCertPath = clientCertPath; - m_clientKeyPath = clientKeyPath; - LOG_DEBUG("Auth params set: mutualTLS=" + std::to_string(useMutualTLS) + ", cert=" + clientCertPath + ", key=" + clientKeyPath); - } - - // Send HTTPS POST without client authentication (for ES9+) - std::string sendHttpsPost(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride) { - return sendHttpsPostUnified(endpoint, body, httpStatusCode, portOverride); - } - - // Send HTTPS POST with pre-configured client authentication (for ES2+) - std::string sendHttpsPostWithAuth(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride) { - if (!m_useMutualTLS) { - LOG_WARNING("sendHttpsPostWithAuth called but mutual TLS not configured"); - } - return sendHttpsPostUnified(endpoint, body, httpStatusCode, portOverride, m_useMutualTLS, m_clientCertPath, m_clientKeyPath); - } - - std::string sendHttpsPostWithContentType(const std::string& endpoint, const std::string& body, const std::string& contentType, int& httpStatusCode, - unsigned int portOverride) { - LOG_DEBUG("sendHttpsPostWithContentType: endpoint=" + endpoint + ", contentType=" + contentType + ", bodySize=" + std::to_string(body.size()) + - ", port=" + std::to_string(portOverride)); - return sendHttpsPostUnified(endpoint, body, httpStatusCode, portOverride, false, "", "", contentType); - } - - std::string sendHttpsPostUnified(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride, - bool useMutualTLS = false, const std::string& clientCertPath = "", const std::string& clientKeyPath = "", - const std::string& contentType = "application/json") { - if (!m_httpClient) { - m_httpClient = std::make_unique<HttpClient>(); - } - - // full URL without port (port set via CURLOPT_PORT) - std::string url = "https://" + m_serverUrl + endpoint; - - // Build certificate pool for server verification - std::vector<X509*> rawCertPool; - for (const auto& cert : m_certPool) { - rawCertPool.push_back(cert.get()); - } - - // Add custom TLS server certificate if configured globally - if (m_useCustomTlsCert && !m_customTlsCertPath.empty()) { - try { - auto tlsCerts = CertificateUtil::loadCertificateChain(m_customTlsCertPath); - for (auto& cert : tlsCerts) { - rawCertPool.push_back(cert.get()); - } - LOG_DEBUG("Added custom TLS server certificate from: " + m_customTlsCertPath); - } catch (const std::exception& e) { - LOG_WARNING("Failed to load custom TLS server certificate: " + std::string(e.what())); - } - } - - HttpClient::PostConfig config; - config.useMutualTLS = useMutualTLS; - config.clientCertPath = clientCertPath; - config.clientKeyPath = clientKeyPath; - config.includeAdminProtocolHeader = useMutualTLS; // ES2+ requires this header - config.verboseOutput = false; - config.contentType = contentType; - - LOG_DEBUG("Sending " + std::string(useMutualTLS ? "ES2+ request with mutual TLS" : "HTTPS request") + " to: " + endpoint + - " (port: " + std::to_string(portOverride) + ")"); - - HttpClient::ResponseData response = m_httpClient->postJson(url, portOverride, body, nullptr, rawCertPool, config); - - httpStatusCode = response.statusCode; - - LOG_DEBUG("HTTP " + std::to_string(httpStatusCode) + " response, body length: " + std::to_string(response.body.length())); - - return response.body; - } - - std::string m_serverUrl; - - std::unique_ptr<X509, X509Deleter> m_rootCA; - std::vector<std::unique_ptr<X509, X509Deleter>> m_intermediateCA; - std::unique_ptr<X509, X509Deleter> m_serverCert; - std::vector<std::unique_ptr<X509, X509Deleter>> m_certPool; - - std::vector<uint8_t> m_euiccSKI; // eUICC SKI for PKIDs - std::string m_EID; // eUICC ID - std::unique_ptr<X509, X509Deleter> m_euiccCert; // eUICC certificate - std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> m_euiccPrivateKey; // eUICC private key for signing - std::vector<uint8_t> m_euiccPublicKeyData; // eUICC public key data - std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> m_euicc_ot_PrivateKey; // One-time private key - std::vector<uint8_t> m_euiccOtpk; // One-time public key from eUICC - - std::unique_ptr<X509, X509Deleter> m_eumCert; // EUM certificate - std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> m_eumPrivateKey; // EUM private key for signing - std::vector<uint8_t> m_eumPublicKeyData; // EUM public key data - - std::string m_confirmationCode; // Confirmation code (PIN) - std::vector<uint8_t> m_confirmationCodeHash; // Computed confirmation code hash - std::vector<uint8_t> m_transactionId; // Transaction ID for hash computation - std::string m_caCertPath = ""; // Path to system CA certificates - - std::unique_ptr<HttpClient> m_httpClient; - bool m_useCustomTlsCert = true; // Flag for custom vs public CA - std::string m_customTlsCertPath; // Path to custom TLS certificate - - // Authentication parameters for mutual TLS auth - bool m_useMutualTLS = false; - std::string m_clientCertPath = ""; - std::string m_clientKeyPath = ""; -}; - -} // namespace RspCrypto \ No newline at end of file diff --git a/smdpp/rsp_client.h b/smdpp/rsp_client.h new file mode 100644 index 0000000..0154986 --- /dev/null +++ b/smdpp/rsp_client.h @@ -0,0 +1,159 @@ +/* RSP Cryptographic Operations Header + * + * Author: Eric Wild <ewild(a)sysmocom.de> / sysmocom - s.f.m.c. GmbH + * + * Released under the terms of GNU General Public License, Version 2 or + * (at your option) any later version. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#ifndef RSP_CLIENT_H +#define RSP_CLIENT_H + +#include <memory> +#include <string> +#include <vector> +#include "helpers.h" // For deleter functors + +// Forward declarations for OpenSSL types +typedef struct x509_st X509; +typedef struct evp_pkey_st EVP_PKEY; +typedef struct x509_store_st X509_STORE; + +namespace RspCrypto { + +// Forward declarations for internal types +class HttpClient; + +/** + * RSPClient - Remote SIM Provisioning Client + * + * This class implements the cryptographic operations and certificate management + * required for RSP (Remote SIM Provisioning) protocol operations. + */ +class RSPClient { + public: + /** + * Constructor + * @param serverUrl The server URL + * @param serverPort The server port + * @param certPath Vector of certificate paths (files or directories) + * @param name_filters Vector of name filters for certificate selection + */ + RSPClient(const std::string& serverUrl, const unsigned int serverPort, const std::vector<std::string>& certPath, + const std::vector<std::string>& name_filters = {}); + + /** + * Destructor + */ + ~RSPClient(); + + // Certificate and key management + void setCACertPath(const std::string& path); + void loadEUICCCertificate(const std::string& euiccCertPath); + void loadEUICCKeyPair(const std::string& euiccPrivateKeyPath, const std::string& euiccPublicKeyPath = ""); + void loadEUMCertificate(const std::string& eumCertPath); + void loadEUMKeyPair(const std::string& eumPrivateKeyPath, const std::string& eumPublicKeyPath = ""); + + // Certificate retrieval + std::vector<uint8_t> getEUMCertificate(); + std::vector<uint8_t> getEUICCCertificate(); + std::vector<uint8_t> getCICertificate(); + + // Cryptographic operations + std::vector<uint8_t> generateChallenge(); + void generateEUICCOtpk(); + std::vector<uint8_t> getEUICCOtpk(); + std::vector<uint8_t> signDataWithEUICC(const std::vector<uint8_t>& dataToSign); + bool verifyServerSignature(const std::vector<uint8_t>& serverSigned1, const std::vector<uint8_t>& signature); + bool verifyServerSignature(const std::vector<uint8_t>& serverSigned1, const std::vector<uint8_t>& serverSignature1, + const std::vector<uint8_t>& derDataServerCert); + std::vector<uint8_t> computeECDHSharedSecret(const std::vector<uint8_t>& otherPublicKey); + + // Confirmation code and transaction handling + void setConfirmationCode(const std::string& confirmationCode); + void setTransactionId(const std::vector<uint8_t>& transactionId); + std::vector<uint8_t> getConfirmationCodeHash() const; + void setConfirmationCodeHash(const std::vector<uint8_t>& hash); + + // HTTP client configuration + void configureHttpClient(bool useCustomTlsCert, const std::string& customTlsCertPath = ""); + void setAuthParams(bool useMutualTLS, const std::string& clientCertPath, const std::string& clientKeyPath); + + // HTTP operations + std::string sendHttpsPost(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride); + std::string sendHttpsPostWithAuth(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride); + std::string sendHttpsPostWithContentType(const std::string& endpoint, const std::string& body, const std::string& contentType, int& httpStatusCode, + unsigned int portOverride); + std::string sendHttpsPostUnified(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride, + bool useMutualTLS = false, const std::string& clientCertPath = "", const std::string& clientKeyPath = "", + const std::string& contentType = "application/json"); + + private: + // Private helper methods + void loadCertificate(const std::string& certPath, const std::string& certType, std::unique_ptr<X509, X509Deleter>& certStorage); + void loadKeyPair(const std::string& privateKeyPath, const std::string& publicKeyPath, const std::string& keyType, + std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter>& privateKeyStorage, std::vector<uint8_t>& publicKeyStorage); + std::vector<uint8_t> signDataWithKey(const std::vector<uint8_t>& dataToSign, EVP_PKEY* pkey); + bool verifyServerSignature(const std::vector<uint8_t>& signedData, const std::vector<uint8_t>& signature, X509* serverCert); + bool verifyServerSignature(const std::vector<uint8_t>& serverSigned1, const std::vector<uint8_t>& signature, X509* serverCert, + const std::string& certSource); + int getEUICCCurveNID(); + + // Member variables + std::string m_serverUrl; + + std::unique_ptr<X509, X509Deleter> m_rootCA; + std::vector<std::unique_ptr<X509, X509Deleter>> m_intermediateCA; + std::unique_ptr<X509, X509Deleter> m_serverCert; + std::vector<std::unique_ptr<X509, X509Deleter>> m_certPool; + + std::vector<uint8_t> m_euiccSKI; + std::string m_EID; + std::unique_ptr<X509, X509Deleter> m_euiccCert; + std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> m_euiccPrivateKey; + std::vector<uint8_t> m_euiccPublicKeyData; + std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> m_euicc_ot_PrivateKey; + std::vector<uint8_t> m_euiccOtpk; + + std::unique_ptr<X509, X509Deleter> m_eumCert; + std::unique_ptr<EVP_PKEY, EVP_PKEY_Deleter> m_eumPrivateKey; + std::vector<uint8_t> m_eumPublicKeyData; + + std::string m_confirmationCode; + std::vector<uint8_t> m_confirmationCodeHash; + std::vector<uint8_t> m_transactionId; + std::string m_caCertPath; + + std::unique_ptr<HttpClient> m_httpClient; + bool m_useCustomTlsCert; + std::string m_customTlsCertPath; + + bool m_useMutualTLS; + std::string m_clientCertPath; + std::string m_clientKeyPath; +}; + +// Utility classes used by RSPClient (exposed for use in external functions) +class CertificateUtil { + public: + static std::unique_ptr<X509, X509Deleter> loadCertFromDER(const std::vector<uint8_t>& derData); + static std::vector<std::unique_ptr<X509, X509Deleter>> loadCertificateChain(const std::string& filename); + static std::vector<std::unique_ptr<X509, X509Deleter>> loadCertificatesFromDirectory(const std::string& directory, + const std::vector<std::string>& name_filters); + static std::string getEID(X509* cert); + static std::string getSubjectName(X509* cert); + static std::vector<uint8_t> getSubjectKeyIdentifier(X509* cert); + static std::vector<uint8_t> getAuthorityKeyIdentifier(X509* cert); + static bool validateEIDRange(const std::string& eid, const std::vector<uint8_t>& eumCertData); + static bool hasRSPRole(const std::vector<uint8_t>& certData, const std::string& roleOid); + static std::string getPermittedEINs(const std::vector<uint8_t>& eumCertData); + static bool verifyECDHCompatible(const std::vector<uint8_t>& pubKey1, const std::vector<uint8_t>& pubKey2); + static std::string getCurveOID(const std::vector<uint8_t>& certData); + static bool verifyCertificateChainDynamic(X509* cert, const std::vector<X509*>& certPool, X509* rootCA, bool verbose); +}; + +} // namespace RspCrypto + +#endif // RSP_CLIENT_H \ No newline at end of file diff --git a/smdpp/smdpp_Tests_Functions.cc b/smdpp/smdpp_Tests_Functions.cc index fb9b504..0fac22e 100644 --- a/smdpp/smdpp_Tests_Functions.cc +++ b/smdpp/smdpp_Tests_Functions.cc @@ -13,8 +13,9 @@ #include <TTCN3.hh> #include "smdpp_Tests.hh" -#include "rsp_client.cpp" -#include "bsp_crypto.cpp" +#include "rsp_client.h" +#include "bsp_crypto.h" +#include "logger.h" using namespace RspCrypto; -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41122?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I9dcb3249fc712e2ddb2c7cf48d4fc54425848bc6 Gerrit-Change-Number: 41122 Gerrit-PatchSet: 1 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de>

5 days, 4 hours

[XL] Change in osmo-ttcn3-hacks[master]: smdpp: add es2p test suite

by Hoernchen

Hoernchen has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41120?usp=email ) Change subject: smdpp: add es2p test suite ...................................................................... smdpp: add es2p test suite Integrated with es9p Change-Id: I2865e016974d7d7a03e00a7795a42f573b147a4b --- A smdpp/ES2Plus_Tests.cfg A smdpp/ES2Plus_Tests.ttcn M smdpp/rsp_client.cpp M smdpp/smdpp_Tests.ttcn M smdpp/smdpp_Tests_Functions.cc A smdpp/test_certs/CERT_MNO_ECDSA_NIST.pem A smdpp/test_certs/SK_MNO_ECDSA_NIST.pem 7 files changed, 1,695 insertions(+), 128 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/20/41120/1 diff --git a/smdpp/ES2Plus_Tests.cfg b/smdpp/ES2Plus_Tests.cfg new file mode 100644 index 0000000..f98a65d --- /dev/null +++ b/smdpp/ES2Plus_Tests.cfg @@ -0,0 +1,17 @@ +[LOGGING] +FileMask := LOG_ALL | TTCN_DEBUG | TTCN_MATCHING | DEBUG_ENCDEC; +SourceInfoFormat := Single; +LogFile := "ES2Plus_Tests.%e.%h.%r.%s" +LogSourceInfo := Stack + +[MODULE_PARAMETERS] +# ES2+ specific parameters +ES2Plus_Tests.mp_es2plus_server_host := "127.0.0.1" +ES2Plus_Tests.mp_es2plus_server_port := 8000 # NIST tests use port 8000 +ES2Plus_Tests.mp_operator_id := "test.operator.com" + +[TESTPORT_PARAMETERS] + +[EXECUTE] +# Execute all ES2+ tests +ES2Plus_Tests.control \ No newline at end of file diff --git a/smdpp/ES2Plus_Tests.ttcn b/smdpp/ES2Plus_Tests.ttcn new file mode 100644 index 0000000..c6e84cd --- /dev/null +++ b/smdpp/ES2Plus_Tests.ttcn @@ -0,0 +1,1031 @@ +module ES2Plus_Tests { + +/* ES2+ Interface Test Suite + * Based on SGP.22 v2.5 Section 5.3 and SGP.23 v1.5 Section 4.3.1-4.3.5 + */ + +import from General_Types all; +import from Osmocom_Types all; +import from Native_Functions all; +import from es2p_Types_JSON all; +import from esx_header_Types_JSON all; +import from TCCConversion_Functions all; +import from smdpp_Tests all; // For RSPClient functions and types + +// ES2+ specific constants +const charstring c_es2plus_base_path := "/gsma/rsp2/es2plus"; +const charstring c_path_download_order := c_es2plus_base_path & "/downloadOrder"; +const charstring c_path_confirm_order := c_es2plus_base_path & "/confirmOrder"; +const charstring c_path_cancel_order := c_es2plus_base_path & "/cancelOrder"; +const charstring c_path_release_profile := c_es2plus_base_path & "/releaseProfile"; + +// Test ICCIDs that exist in Python server test mode +const charstring c_iccid_test_1 := "89000000000000001010"; +const charstring c_iccid_test_2 := "89000000000000001028"; +const charstring c_iccid_test_3 := "89000000000000001036"; +const charstring c_iccid_test_4 := "89000000000000001044"; +const charstring c_iccid_test_5 := "89000000000000001051"; + +// Test EIDs from test specification +const charstring c_eid1 := "89049032123451234512345678901235"; +const charstring c_eid2 := "89049032123451234512345678901236"; + +// Client certificate paths +const charstring c_cert_path := "./test_certs/CERT_MNO_ECDSA_NIST.pem"; +const charstring c_key_path := "./test_certs/SK_MNO_ECDSA_NIST.pem"; + +// Wrong certificate for testing +const charstring c_wrong_cert_path := "./sgp26/eUICC/CERT_EUICC_ECDSA_NIST.der"; +const charstring c_wrong_key_path := "./sgp26/eUICC/SK_EUICC_ECDSA_NIST.pem"; + +// Module parameters +modulepar { + charstring mp_es2plus_server_host := "testsmdpplus1.example.com"; + integer mp_es9_server_port := 8000; + integer mp_es2plus_server_port := 8000; // NIST tests use port 8000 + charstring mp_operator_id := "test.operator.com"; + charstring mp_nist_rsp_cert_path := "./sgp26/"; + boolean mp_use_ssl := true; // SSL with mutual TLS authentication enabled +} + +// Test component - extend smdpp_ConnHdlr to reuse RSPClient functionality +type component ES2Plus_ConnHdlr extends smdpp_ConnHdlr { + // Inherits g_rsp_client_handle from smdpp_ConnHdlr +} + +// Parameter structures for test cases +type record DownloadOrderTestParams { + charstring testName, + charstring eid optional, + charstring iccid optional, + charstring profileType optional, + boolean expectError, + charstring expectedSubjectCode optional, + charstring expectedReasonCode optional +} + +type record ConfirmOrderTestParams { + charstring testName, + charstring iccid, + charstring eid optional, + charstring matchingId optional, + charstring confirmationCode optional, + charstring smdsAddress optional, + boolean releaseFlag, + boolean expectError, + charstring expectedSubjectCode optional, + charstring expectedReasonCode optional +} + +type record CancelOrderTestParams { + charstring testName, + charstring iccid, + charstring eid optional, + charstring matchingId optional, + charstring finalProfileStatusIndicator, + boolean expectError, + charstring expectedSubjectCode optional, + charstring expectedReasonCode optional +} + +// Helper function to generate unique function call identifier +function f_gen_es2plus_uuid() return charstring { + // Simple UUID based on random octets + var octetstring rnd_oct := f_rnd_octstring(4); + return "TTCN3-" & oct2str(rnd_oct); +} + +// Helper function to build ES2+ request header +function f_es2plus_request_header() return JSON_ESx_RequestHeader { + return { + functionRequesterIdentifier := mp_operator_id, + functionCallIdentifier := f_gen_es2plus_uuid() + }; +} + +// Helper function for ES2+ HTTP requests +function f_es2plus_http_request(charstring path, charstring functionName, JSON_ES2p_Request request) runs on ES2Plus_ConnHdlr return JSON_ES2p_Response { + + var integer status_code; + var charstring response; + + // Encode request + var octetstring req_enc := enc_JSON_ES2p_Request(request); + + // Build full URL + var charstring url := path; // URL without host/port - the C++ function will add it + + // Send request using pre-configured authentication + response := smdpp_Tests.ext_RSPClient_sendHttpsPostWithAuth( + g_rsp_client_handle, + url, + oct2char(req_enc), + mp_es2plus_server_port, + status_code + ); + + if (status_code != 200) { + setverdict(fail, "HTTP request failed with status ", status_code); + mtc.stop; + } + + // Decode response based on function name + return dec_JSON_ES2p_Response(char2oct(response), functionName); +} + +// Check if response indicates success +function f_es2plus_check_success(JSON_ESx_ResponseHeader header) return boolean { + if (header.functionExecutionStatus.status == "Executed-Success") { + return true; + } + return false; +} + +// Helper function to verify error response +function f_es2plus_check_error(JSON_ESx_ResponseHeader header, charstring expected_subject_code, charstring expected_reason_code) return boolean { + if (header.functionExecutionStatus.status != "Failed") { + log("Expected Failed status, got: ", header.functionExecutionStatus.status); + return false; + } + + if (not ispresent(header.functionExecutionStatus.statusCodeData)) { + log("Missing statusCodeData in error response"); + return false; + } + + var JSON_ESx_FunctionExecutionStatusCodeData statusData := header.functionExecutionStatus.statusCodeData; + + if (statusData.subjectCode != expected_subject_code) { + log("Expected subject code ", expected_subject_code, ", got: ", statusData.subjectCode); + return false; + } + + if (statusData.reasonCode != expected_reason_code) { + log("Expected reason code ", expected_reason_code, ", got: ", statusData.reasonCode); + return false; + } + + log("Got expected error: ", expected_subject_code, "/", expected_reason_code); + return true; +} + +// Initialize RSP client for ES2+ +function f_init_es2plus() runs on ES2Plus_ConnHdlr { + // Initialize RSP client using imported function from smdpp_Tests + g_rsp_client_handle := smdpp_Tests.ext_RSPClient_create( + mp_es2plus_server_host, + mp_es2plus_server_port, + mp_nist_rsp_cert_path, + "NIST" + ); + + if (g_rsp_client_handle < 0) { + setverdict(fail, "Failed to initialize RSP client"); + mtc.stop; + } + + // Set authentication parameters once for all ES2+ operations + var integer result := smdpp_Tests.ext_RSPClient_setAuthParams( + g_rsp_client_handle, + true, // useMutualTLS + c_cert_path, + c_key_path + ); + + if (result != 0) { + setverdict(fail, "Failed to set authentication parameters"); + mtc.stop; + } +} + +/*********************************************************************** + * Generic Test Functions + ***********************************************************************/ + +// Generic DownloadOrder test function +private function f_TC_DownloadOrder_Generic( + DownloadOrderTestParams params +) runs on ES2Plus_ConnHdlr { + + log("=== Test Case: ", params.testName, " ==="); + + // Initialize + f_init_es2plus(); + + // Build request + var JSON_ES2p_Request req := { + downloadOrderRequest := { + header := f_es2plus_request_header(), + eid := params.eid, + iccid := params.iccid, + profileType := params.profileType + } + }; + + // Send and receive + var JSON_ES2p_Response resp := f_es2plus_http_request(c_path_download_order, "downloadOrder", req); + + // Check result + if (params.expectError) { + if (not f_es2plus_check_error(resp.downloadOrderResponse.header, + params.expectedSubjectCode, + params.expectedReasonCode)) { + setverdict(fail, "Expected error ", params.expectedSubjectCode, "/", + params.expectedReasonCode, " not received"); + mtc.stop; + } + } else { + if (not f_es2plus_check_success(resp.downloadOrderResponse.header)) { + setverdict(fail, "DownloadOrder failed unexpectedly"); + mtc.stop; + } + + // Verify ICCID returned + if (not ispresent(resp.downloadOrderResponse.iccid)) { + setverdict(fail, "No ICCID in response"); + mtc.stop; + } + + log("Reserved ICCID: ", resp.downloadOrderResponse.iccid); + } + + setverdict(pass); +} + +// Generic ConfirmOrder test function +private function f_TC_ConfirmOrder_Generic( + ConfirmOrderTestParams params +) runs on ES2Plus_ConnHdlr { + + log("=== Test Case: ", params.testName, " ==="); + + // Initialize + f_init_es2plus(); + + // Build request + var JSON_ES2p_Request req := { + confirmOrderRequest := { + header := f_es2plus_request_header(), + iccid := params.iccid, + eid := params.eid, + matchingId := params.matchingId, + confirmationCode := params.confirmationCode, + smdsAddress := params.smdsAddress, + releaseFlag := params.releaseFlag + } + }; + + // Send and receive + var JSON_ES2p_Response resp := f_es2plus_http_request(c_path_confirm_order, "confirmOrder", req); + + // Check result + if (params.expectError) { + if (not f_es2plus_check_error(resp.confirmOrderResponse.header, + params.expectedSubjectCode, + params.expectedReasonCode)) { + setverdict(fail, "Expected error ", params.expectedSubjectCode, "/", + params.expectedReasonCode, " not received"); + mtc.stop; + } + } else { + if (not f_es2plus_check_success(resp.confirmOrderResponse.header)) { + setverdict(fail, "ConfirmOrder failed unexpectedly"); + mtc.stop; + } + + // Verify matchingId returned + if (not ispresent(resp.confirmOrderResponse.matchingId)) { + setverdict(fail, "No matchingId in response"); + mtc.stop; + } + + log("Got matchingId: ", resp.confirmOrderResponse.matchingId); + } + + setverdict(pass); +} + +// Generic CancelOrder test function +private function f_TC_CancelOrder_Generic( + CancelOrderTestParams params +) runs on ES2Plus_ConnHdlr { + + log("=== Test Case: ", params.testName, " ==="); + + // Initialize + f_init_es2plus(); + + // Build request + var JSON_ES2p_Request req := { + cancelOrderRequest := { + header := f_es2plus_request_header(), + iccid := params.iccid, + eid := params.eid, + matchingId := params.matchingId, + finalProfileStatusIndicator := params.finalProfileStatusIndicator + } + }; + + // Send and receive + var JSON_ES2p_Response resp := f_es2plus_http_request(c_path_cancel_order, "cancelOrder", req); + + // Check result + if (params.expectError) { + if (not f_es2plus_check_error(resp.cancelOrderResponse.header, + params.expectedSubjectCode, + params.expectedReasonCode)) { + setverdict(fail, "Expected error ", params.expectedSubjectCode, "/", + params.expectedReasonCode, " not received"); + mtc.stop; + } + } else { + if (not f_es2plus_check_success(resp.cancelOrderResponse.header)) { + setverdict(fail, "CancelOrder failed unexpectedly"); + mtc.stop; + } + } + + setverdict(pass); +} + +/*********************************************************************** + * DownloadOrder Test Cases + ***********************************************************************/ + +// Test: DownloadOrder with available ICCID (nominal) +testcase TC_ES2Plus_DownloadOrder_01_Nominal_ICCID() runs on ES2Plus_ConnHdlr { + f_TC_DownloadOrder_Generic({ + testName := "DownloadOrder - Nominal with ICCID", + eid := omit, + iccid := c_iccid_test_1, + profileType := omit, + expectError := false + }); +} + +// Test: DownloadOrder with profileType (nominal) +testcase TC_ES2Plus_DownloadOrder_02_Nominal_ProfileType() runs on ES2Plus_ConnHdlr { + f_TC_DownloadOrder_Generic({ + testName := "DownloadOrder - Nominal with ProfileType", + eid := c_eid1, + iccid := omit, + profileType := "Test", + expectError := false + }); +} + +// Test: DownloadOrder Error - ICCID already in use +testcase TC_ES2Plus_DownloadOrder_Error_01_ICCID_AlreadyInUse() runs on ES2Plus_ConnHdlr { + // This test requires two operations - first reserve, then try again + log("=== Test Case: DownloadOrder - Error: ICCID Already in Use ==="); + + // Initialize + f_init_es2plus(); + + // First reserve an ICCID and tie this ICCID to an EID immediately. + var JSON_ES2p_Request req := { + downloadOrderRequest := { + header := f_es2plus_request_header(), + eid := c_eid1, + iccid := c_iccid_test_3, + profileType := omit + } + }; + + var JSON_ES2p_Response resp := f_es2plus_http_request(c_path_download_order, "downloadOrder", req); + + // Verify first request succeeds + if (not f_es2plus_check_success(resp.downloadOrderResponse.header)) { + setverdict(fail, "Initial DownloadOrder failed"); + mtc.stop; + } + + // Now try to reserve the same ICCID again, but withot an EID. Since the EID is missing, the SM-DP+ will now + // recognize this request as a new request and reject with the expeced error. (Two requests with the same + // input parameters will be interpreted as a resent function call as long as the outcome is the same) + var JSON_ES2p_Request req2 := { + downloadOrderRequest := { + header := f_es2plus_request_header(), + eid := omit, + iccid := c_iccid_test_3, + profileType := omit + } + }; + resp := f_es2plus_http_request(c_path_download_order, "downloadOrder", req2); + + // Should get error 8.2.1/3.3 + if (not f_es2plus_check_error(resp.downloadOrderResponse.header, "8.2.1", "3.3")) { + setverdict(fail, "Expected error 8.2.1/3.3 for ICCID already in use"); + mtc.stop; + } + + setverdict(pass); +} + +// Test: DownloadOrder Error - Unknown ICCID +testcase TC_ES2Plus_DownloadOrder_Error_02_Unknown_ICCID() runs on ES2Plus_ConnHdlr { + f_TC_DownloadOrder_Generic({ + testName := "DownloadOrder - Error: Unknown ICCID", + eid := omit, + iccid := "8900000000000099999", + profileType := omit, + expectError := true, + expectedSubjectCode := "8.2.1", + expectedReasonCode := "3.9" + }); +} + +/*********************************************************************** + * ConfirmOrder Test Cases + ***********************************************************************/ + +// Test: ConfirmOrder nominal case +testcase TC_ES2Plus_ConfirmOrder_01_Nominal() runs on ES2Plus_ConnHdlr { + log("=== Test Case: ConfirmOrder - Nominal ==="); + + // Initialize + f_init_es2plus(); + + // First, do a DownloadOrder to get an ICCID + var JSON_ES2p_Request dl_req := { + downloadOrderRequest := { + header := f_es2plus_request_header(), + eid := omit, + iccid := omit, + profileType := "Test" + } + }; + + var JSON_ES2p_Response dl_resp := f_es2plus_http_request(c_path_download_order, "downloadOrder", dl_req); + + if (not f_es2plus_check_success(dl_resp.downloadOrderResponse.header)) { + setverdict(fail, "DownloadOrder failed"); + mtc.stop; + } + + var charstring reserved_iccid := dl_resp.downloadOrderResponse.iccid; + log("Got ICCID from DownloadOrder: ", reserved_iccid); + + // Now confirm the order + f_TC_ConfirmOrder_Generic({ + testName := "ConfirmOrder - Nominal", + iccid := reserved_iccid, + eid := omit, + matchingId := omit, + confirmationCode := omit, + smdsAddress := omit, + releaseFlag := true, + expectError := false + }); +} + +// Test: ConfirmOrder Error - Unknown Profile +testcase TC_ES2Plus_ConfirmOrder_Error_01_Unknown_Profile() runs on ES2Plus_ConnHdlr { + f_TC_ConfirmOrder_Generic({ + testName := "ConfirmOrder - Error: Unknown Profile", + iccid := "8900000000000099999", + eid := omit, + matchingId := omit, + confirmationCode := omit, + smdsAddress := omit, + releaseFlag := true, + expectError := true, + expectedSubjectCode := "8.2.1", + expectedReasonCode := "3.9" + }); +} + +// Test: ConfirmOrder Error - Profile in Available state +testcase TC_ES2Plus_ConfirmOrder_Error_02_Profile_Available() runs on ES2Plus_ConnHdlr { + log("=== Test Case: ConfirmOrder - Error: Profile in Available State ==="); + + // Initialize + f_init_es2plus(); + + // Try to confirm an ICCID that hasn't been ordered + var JSON_ES2p_Request req := { + confirmOrderRequest := { + header := f_es2plus_request_header(), + iccid := c_iccid_test_4, + eid := omit, + matchingId := omit, + confirmationCode := omit, + smdsAddress := omit, + releaseFlag := true + } + }; + + var JSON_ES2p_Response resp := f_es2plus_http_request(c_path_confirm_order, "confirmOrder", req); + + // Should get an error (exact code may vary) + if (resp.confirmOrderResponse.header.functionExecutionStatus.status != "Failed") { + setverdict(fail, "Expected error for profile in Available state"); + mtc.stop; + } + + setverdict(pass); +} + +// Test: ConfirmOrder Error - Conflicting matchingID +testcase TC_ES2Plus_ConfirmOrder_Error_03_Conflicting_MatchingID() runs on ES2Plus_ConnHdlr { + log("=== Test Case: ConfirmOrder - Error: Conflicting MatchingID ==="); + + // Initialize + f_init_es2plus(); + + // First, create a profile with a specific matchingID + var JSON_ES2p_Request dl_req := { + downloadOrderRequest := { + header := f_es2plus_request_header(), + eid := omit, + iccid := omit, + profileType := "Test" + } + }; + + var JSON_ES2p_Response dl_resp := f_es2plus_http_request(c_path_download_order, "downloadOrder", dl_req); + + if (not f_es2plus_check_success(dl_resp.downloadOrderResponse.header)) { + setverdict(fail, "Setup DownloadOrder failed"); + mtc.stop; + } + + var charstring iccid1 := dl_resp.downloadOrderResponse.iccid; + + // Confirm with a specific matchingID + var JSON_ES2p_Request conf_req := { + confirmOrderRequest := { + header := f_es2plus_request_header(), + iccid := iccid1, + eid := omit, + matchingId := "MATCHING_ID_CONFLICT_TEST", + confirmationCode := omit, + smdsAddress := omit, + releaseFlag := true + } + }; + + var JSON_ES2p_Response conf_resp := f_es2plus_http_request(c_path_confirm_order, "confirmOrder", conf_req); + + if (not f_es2plus_check_success(conf_resp.confirmOrderResponse.header)) { + setverdict(fail, "First ConfirmOrder failed"); + mtc.stop; + } + + // Now create another profile and try to use the same matchingID + dl_req.downloadOrderRequest.header := f_es2plus_request_header(); + dl_resp := f_es2plus_http_request(c_path_download_order, "downloadOrder", dl_req); + + if (not f_es2plus_check_success(dl_resp.downloadOrderResponse.header)) { + setverdict(fail, "Second DownloadOrder failed"); + mtc.stop; + } + + var charstring iccid2 := dl_resp.downloadOrderResponse.iccid; + + // Try to confirm with the same matchingID + f_TC_ConfirmOrder_Generic({ + testName := "ConfirmOrder - Error: Conflicting MatchingID", + iccid := iccid2, + eid := omit, + matchingId := "MATCHING_ID_CONFLICT_TEST", + confirmationCode := omit, + smdsAddress := omit, + releaseFlag := true, + expectError := true, + expectedSubjectCode := "8.2.6", + expectedReasonCode := "3.3" + }); +} + +// Test: ConfirmOrder Error - Incorrect smdsAddress +testcase TC_ES2Plus_ConfirmOrder_Error_04_Incorrect_SmdsAddress() runs on ES2Plus_ConnHdlr { + log("=== Test Case: ConfirmOrder - Error: Incorrect smdsAddress ==="); + + // Initialize + f_init_es2plus(); + + // First create a profile + var JSON_ES2p_Request dl_req := { + downloadOrderRequest := { + header := f_es2plus_request_header(), + eid := omit, + iccid := omit, + profileType := "Test" + } + }; + + var JSON_ES2p_Response dl_resp := f_es2plus_http_request(c_path_download_order, "downloadOrder", dl_req); + + if (not f_es2plus_check_success(dl_resp.downloadOrderResponse.header)) { + setverdict(fail, "DownloadOrder failed"); + mtc.stop; + } + + var charstring iccid := dl_resp.downloadOrderResponse.iccid; + + // Try to confirm with invalid smdsAddress + f_TC_ConfirmOrder_Generic({ + testName := "ConfirmOrder - Error: Incorrect smdsAddress", + iccid := iccid, + eid := c_eid1, + matchingId := omit, + confirmationCode := omit, + smdsAddress := "invalid.smds.address", + releaseFlag := true, + expectError := true, + expectedSubjectCode := "8.9", + expectedReasonCode := "5.1" + }); +} + +// Test: ConfirmOrder Error - Missing EID with empty matchingID +testcase TC_ES2Plus_ConfirmOrder_Error_05_Missing_EID_Empty_MatchingID() runs on ES2Plus_ConnHdlr { + log("=== Test Case: ConfirmOrder - Error: Missing EID with Empty MatchingID ==="); + + // Initialize + f_init_es2plus(); + + // First create a profile + var JSON_ES2p_Request dl_req := { + downloadOrderRequest := { + header := f_es2plus_request_header(), + eid := omit, + iccid := omit, + profileType := "Test" + } + }; + + var JSON_ES2p_Response dl_resp := f_es2plus_http_request(c_path_download_order, "downloadOrder", dl_req); + + if (not f_es2plus_check_success(dl_resp.downloadOrderResponse.header)) { + setverdict(fail, "DownloadOrder failed"); + mtc.stop; + } + + var charstring iccid := dl_resp.downloadOrderResponse.iccid; + + // Try to confirm without EID and with empty matchingID + f_TC_ConfirmOrder_Generic({ + testName := "ConfirmOrder - Error: Missing EID with Empty MatchingID", + iccid := iccid, + eid := omit, + matchingId := "", + confirmationCode := omit, + smdsAddress := omit, + releaseFlag := true, + expectError := true, + expectedSubjectCode := "8.1.1", + expectedReasonCode := "2.2" + }); +} + +// Test: ConfirmOrder Error - Different EID +testcase TC_ES2Plus_ConfirmOrder_Error_06_Different_EID() runs on ES2Plus_ConnHdlr { + log("=== Test Case: ConfirmOrder - Error: Different EID ==="); + + // Initialize + f_init_es2plus(); + + // Create a profile linked to a specific EID + var JSON_ES2p_Request dl_req := { + downloadOrderRequest := { + header := f_es2plus_request_header(), + eid := c_eid1, + iccid := omit, + profileType := "Test" + } + }; + + var JSON_ES2p_Response dl_resp := f_es2plus_http_request(c_path_download_order, "downloadOrder", dl_req); + + if (not f_es2plus_check_success(dl_resp.downloadOrderResponse.header)) { + setverdict(fail, "DownloadOrder failed"); + mtc.stop; + } + + var charstring iccid := dl_resp.downloadOrderResponse.iccid; + + // Try to confirm with a different EID + f_TC_ConfirmOrder_Generic({ + testName := "ConfirmOrder - Error: Different EID", + iccid := iccid, + eid := c_eid2, + matchingId := omit, + confirmationCode := omit, + smdsAddress := omit, + releaseFlag := true, + expectError := true, + expectedSubjectCode := "8.1.1", + expectedReasonCode := "3.10" + }); +} + +/*********************************************************************** + * CancelOrder Test Cases + ***********************************************************************/ + +// Test: CancelOrder nominal case +testcase TC_ES2Plus_CancelOrder_01_Nominal() runs on ES2Plus_ConnHdlr { + log("=== Test Case: CancelOrder - Nominal ==="); + + // Initialize + f_init_es2plus(); + + // First, create and confirm a profile + var JSON_ES2p_Request dl_req := { + downloadOrderRequest := { + header := f_es2plus_request_header(), + eid := c_eid1, + iccid := omit, + profileType := "Test" + } + }; + + var JSON_ES2p_Response dl_resp := f_es2plus_http_request(c_path_download_order, "downloadOrder", dl_req); + + if (not f_es2plus_check_success(dl_resp.downloadOrderResponse.header)) { + setverdict(fail, "DownloadOrder failed"); + mtc.stop; + } + + var charstring iccid := dl_resp.downloadOrderResponse.iccid; + log("Reserved ICCID: ", iccid); + + // Confirm the order + var JSON_ES2p_Request conf_req := { + confirmOrderRequest := { + header := f_es2plus_request_header(), + iccid := iccid, + eid := omit, + matchingId := omit, + confirmationCode := omit, + smdsAddress := omit, + releaseFlag := false // Don't release yet + } + }; + + var JSON_ES2p_Response conf_resp := f_es2plus_http_request(c_path_confirm_order, "confirmOrder", conf_req); + + if (not f_es2plus_check_success(conf_resp.confirmOrderResponse.header)) { + setverdict(fail, "ConfirmOrder failed"); + mtc.stop; + } + + var charstring matching_id := conf_resp.confirmOrderResponse.matchingId; + log("Got matchingId: ", matching_id); + + // Now cancel the order + f_TC_CancelOrder_Generic({ + testName := "CancelOrder - Nominal", + iccid := iccid, + eid := c_eid1, + matchingId := matching_id, + finalProfileStatusIndicator := "Available", + expectError := false + }); +} + +// Test: CancelOrder Error - Unknown ICCID +testcase TC_ES2Plus_CancelOrder_Error_01_Unknown_ICCID() runs on ES2Plus_ConnHdlr { + f_TC_CancelOrder_Generic({ + testName := "CancelOrder - Error: Unknown ICCID", + iccid := "8900000000000099999", + eid := omit, + matchingId := omit, + finalProfileStatusIndicator := "Available", + expectError := true, + expectedSubjectCode := "8.2.1", + expectedReasonCode := "3.9" + }); +} + +// Test: CancelOrder Error - Missing EID +testcase TC_ES2Plus_CancelOrder_Error_02_Missing_EID() runs on ES2Plus_ConnHdlr { + log("=== Test Case: CancelOrder - Error: Missing EID ==="); + + // Initialize + f_init_es2plus(); + + // First create a profile linked to an EID + var JSON_ES2p_Request dl_req := { + downloadOrderRequest := { + header := f_es2plus_request_header(), + eid := c_eid1, + iccid := omit, + profileType := "Test" + } + }; + + var JSON_ES2p_Response dl_resp := f_es2plus_http_request(c_path_download_order, "downloadOrder", dl_req); + + if (not f_es2plus_check_success(dl_resp.downloadOrderResponse.header)) { + setverdict(fail, "Setup DownloadOrder failed"); + mtc.stop; + } + + var charstring iccid := dl_resp.downloadOrderResponse.iccid; + + // Try to cancel without providing the EID + var JSON_ES2p_Request req := { + cancelOrderRequest := { + header := f_es2plus_request_header(), + iccid := iccid, + eid := omit, // Missing required EID + matchingId := omit, + finalProfileStatusIndicator := "Available" + } + }; + + var JSON_ES2p_Response resp := f_es2plus_http_request(c_path_cancel_order, "cancelOrder", req); + + // Should get an error + if (resp.cancelOrderResponse.header.functionExecutionStatus.status != "Failed") { + setverdict(fail, "Expected error for missing EID"); + mtc.stop; + } + + setverdict(pass); +} + +// Test: CancelOrder Error - Incorrect matchingID +testcase TC_ES2Plus_CancelOrder_Error_03_Incorrect_MatchingID() runs on ES2Plus_ConnHdlr { + log("=== Test Case: CancelOrder - Error: Incorrect MatchingID ==="); + + // Initialize + f_init_es2plus(); + + // Create and confirm a profile + var JSON_ES2p_Request dl_req := { + downloadOrderRequest := { + header := f_es2plus_request_header(), + eid := c_eid1, + iccid := omit, + profileType := "Test" + } + }; + + var JSON_ES2p_Response dl_resp := f_es2plus_http_request(c_path_download_order, "downloadOrder", dl_req); + + if (not f_es2plus_check_success(dl_resp.downloadOrderResponse.header)) { + setverdict(fail, "DownloadOrder failed"); + mtc.stop; + } + + var charstring iccid := dl_resp.downloadOrderResponse.iccid; + + // Confirm to get a matchingID + var JSON_ES2p_Request conf_req := { + confirmOrderRequest := { + header := f_es2plus_request_header(), + iccid := iccid, + eid := omit, + matchingId := omit, + confirmationCode := omit, + smdsAddress := omit, + releaseFlag := false + } + }; + + var JSON_ES2p_Response conf_resp := f_es2plus_http_request(c_path_confirm_order, "confirmOrder", conf_req); + + if (not f_es2plus_check_success(conf_resp.confirmOrderResponse.header)) { + setverdict(fail, "ConfirmOrder failed"); + mtc.stop; + } + + // Try to cancel with wrong matchingID + f_TC_CancelOrder_Generic({ + testName := "CancelOrder - Error: Incorrect MatchingID", + iccid := iccid, + eid := c_eid1, + matchingId := "WRONG_MATCHING_ID", + finalProfileStatusIndicator := "Available", + expectError := true, + expectedSubjectCode := "8.2.6", + expectedReasonCode := "3.10" + }); +} + +// Test: CancelOrder Error - Profile in Available state +testcase TC_ES2Plus_CancelOrder_Error_04_Profile_Available() runs on ES2Plus_ConnHdlr { + log("=== Test Case: CancelOrder - Error: Profile in Available State ==="); + + // Initialize + f_init_es2plus(); + + // Try to cancel an ICCID that hasn't been ordered + var JSON_ES2p_Request req := { + cancelOrderRequest := { + header := f_es2plus_request_header(), + iccid := c_iccid_test_5, + eid := omit, + matchingId := omit, + finalProfileStatusIndicator := "Available" + } + }; + + var JSON_ES2p_Response resp := f_es2plus_http_request(c_path_cancel_order, "cancelOrder", req); + + // Should get an error + if (resp.cancelOrderResponse.header.functionExecutionStatus.status != "Failed") { + setverdict(fail, "Expected error for profile in Available state"); + mtc.stop; + } + + setverdict(pass); +} + +/*********************************************************************** + * Special Test Cases + ***********************************************************************/ + +// Test with wrong client certificate - should fail +testcase TC_ES2Plus_Wrong_Client_Cert() runs on ES2Plus_ConnHdlr { + // Initialize + f_init_es2plus(); + + // Build request + var JSON_ES2p_DownloadOrderRequest req := { + header := f_es2plus_request_header(), + iccid := c_iccid_test_1 + }; + + var JSON_ES2p_Request es2p_req := { + downloadOrderRequest := req + }; + + var integer status_code; + var charstring response; + + // Temporarily set wrong authentication parameters + var integer result := smdpp_Tests.ext_RSPClient_setAuthParams( + g_rsp_client_handle, + true, // useMutualTLS + c_wrong_cert_path, // Using wrong certificate + c_wrong_key_path // Using wrong key + ); + + if (result != 0) { + setverdict(fail, "Failed to set wrong auth parameters"); + mtc.stop; + } + + // Send request using WRONG client certificate + var octetstring req_enc := enc_JSON_ES2p_Request(es2p_req); + var charstring url := c_path_download_order; + + log("ES2+ Request with WRONG certificate to ", url); + response := smdpp_Tests.ext_RSPClient_sendHttpsPostWithAuth( + g_rsp_client_handle, + url, + oct2char(req_enc), + mp_es2plus_server_port, + status_code + ); + + // Should get 401 Unauthorized or error + if (status_code == 401 or status_code == 403 or status_code == 0) { + setverdict(pass, "Server correctly rejected wrong client certificate"); + } else { + setverdict(fail, "Server accepted wrong client certificate! Status: ", status_code); + } + + // Restore correct auth params for cleanup + smdpp_Tests.ext_RSPClient_setAuthParams( + g_rsp_client_handle, + true, + c_cert_path, + c_key_path + ); +} + +// Test control section +control { + // Wrong certificate test + execute(TC_ES2Plus_Wrong_Client_Cert()); + + // DownloadOrder tests + execute(TC_ES2Plus_DownloadOrder_01_Nominal_ICCID()); + execute(TC_ES2Plus_DownloadOrder_02_Nominal_ProfileType()); + execute(TC_ES2Plus_DownloadOrder_Error_01_ICCID_AlreadyInUse()); + execute(TC_ES2Plus_DownloadOrder_Error_02_Unknown_ICCID()); + + // ConfirmOrder tests + execute(TC_ES2Plus_ConfirmOrder_01_Nominal()); + execute(TC_ES2Plus_ConfirmOrder_Error_01_Unknown_Profile()); + execute(TC_ES2Plus_ConfirmOrder_Error_02_Profile_Available()); + execute(TC_ES2Plus_ConfirmOrder_Error_03_Conflicting_MatchingID()); + execute(TC_ES2Plus_ConfirmOrder_Error_04_Incorrect_SmdsAddress()); + execute(TC_ES2Plus_ConfirmOrder_Error_05_Missing_EID_Empty_MatchingID()); + execute(TC_ES2Plus_ConfirmOrder_Error_06_Different_EID()); + + // CancelOrder tests + execute(TC_ES2Plus_CancelOrder_01_Nominal()); + execute(TC_ES2Plus_CancelOrder_Error_01_Unknown_ICCID()); + execute(TC_ES2Plus_CancelOrder_Error_02_Missing_EID()); + execute(TC_ES2Plus_CancelOrder_Error_03_Incorrect_MatchingID()); + execute(TC_ES2Plus_CancelOrder_Error_04_Profile_Available()); +} + +} \ No newline at end of file diff --git a/smdpp/rsp_client.cpp b/smdpp/rsp_client.cpp index fc4f223..d03a64e 100644 --- a/smdpp/rsp_client.cpp +++ b/smdpp/rsp_client.cpp @@ -922,6 +922,17 @@ std::string headers; }; + struct PostConfig { + bool useMutualTLS = false; + std::string clientCertPath; + std::string clientKeyPath; + bool includeAdminProtocolHeader = false; + bool verboseOutput = false; + }; + + ResponseData postJson(const std::string& url, unsigned int port, const std::string& jsonData, X509_STORE* store, std::vector<X509*>& certPool, + const PostConfig& config); + private: static size_t writeCallback(void* contents, size_t size, size_t nmemb, void* userp) { size_t realSize = size * nmemb; @@ -998,67 +1009,89 @@ return CURLE_OK; } +}; - public: - ResponseData postJsonWithCustomVerification(const std::string& url, unsigned int port, const std::string& jsonData, X509_STORE* store, - std::vector<X509*>& certPool) { - ResponseData response; - CURL* curl = curl_easy_init(); +inline HttpClient::ResponseData HttpClient::postJson(const std::string& url, unsigned int port, const std::string& jsonData, X509_STORE* store, + std::vector<X509*>& certPool, const PostConfig& config) { + ResponseData response; + CURL* curl = curl_easy_init(); - if (!curl) { - throw std::runtime_error("Failed to initialize CURL"); + if (!curl) { + throw std::runtime_error("Failed to initialize CURL"); + } + + struct curl_slist* headers = nullptr; + if (config.useMutualTLS) { + headers = curl_slist_append(headers, "Content-Type: application/json;charset=UTF-8"); + headers = curl_slist_append(headers, "Accept: application/json"); + if (config.includeAdminProtocolHeader) { + headers = curl_slist_append(headers, "X-Admin-Protocol: gsma/rsp/v2.5.0"); } - - struct curl_slist* headers = nullptr; + } else { headers = curl_slist_append(headers, "Content-Type: application/json"); headers = curl_slist_append(headers, "Accept: application/json"); + } - SslCtxData ctxData = { .store = store, .certPool = &certPool, .verifyResult = false, .errorMessage = "" }; + SslCtxData ctxData = { .store = store, .certPool = &certPool, .verifyResult = false, .errorMessage = "" }; - try { - // Basic CURL setup - curl_easy_setopt(curl, CURLOPT_URL, url.c_str()); - curl_easy_setopt(curl, CURLOPT_PORT, port); - curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); - curl_easy_setopt(curl, CURLOPT_POSTFIELDS, jsonData.c_str()); - curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writeCallback); - curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response.body); - curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, headerCallback); - curl_easy_setopt(curl, CURLOPT_HEADERDATA, &response.headers); + try { + // Basic CURL setup + curl_easy_setopt(curl, CURLOPT_URL, url.c_str()); + curl_easy_setopt(curl, CURLOPT_PORT, port); + curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); + curl_easy_setopt(curl, CURLOPT_POSTFIELDS, jsonData.c_str()); + curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writeCallback); + curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response.body); + curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, headerCallback); + curl_easy_setopt(curl, CURLOPT_HEADERDATA, &response.headers); - // Enable SSL verification - curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L); - curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L); + // Enable SSL verification + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L); + curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L); - // Use our custom SSL context function and data - curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, sslCtxFunction); - curl_easy_setopt(curl, CURLOPT_SSL_CTX_DATA, &ctxData); + if (config.useMutualTLS) { + if (!config.clientCertPath.empty()) { + curl_easy_setopt(curl, CURLOPT_SSLCERT, config.clientCertPath.c_str()); - // Don't disable the default CA bundle - custom certs will be added to it - // This allows both system CAs and custom test certificates to work - // together - - // curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); - - CURLcode res = curl_easy_perform(curl); - - if (res != CURLE_OK) { - throw std::runtime_error(std::string("CURL request failed: ") + curl_easy_strerror(res)); + std::string certType = "PEM"; + if (config.clientCertPath.find(".der") != std::string::npos || config.clientCertPath.find(".DER") != std::string::npos) { + certType = "DER"; + } + curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, certType.c_str()); + LOG_DEBUG("Set client certificate: " + config.clientCertPath + " (type: " + certType + ")"); } - curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response.statusCode); - - curl_slist_free_all(headers); - curl_easy_cleanup(curl); - - return response; - } catch (...) { - curl_slist_free_all(headers); - curl_easy_cleanup(curl); - throw; + if (!config.clientKeyPath.empty()) { + curl_easy_setopt(curl, CURLOPT_SSLKEY, config.clientKeyPath.c_str()); + curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM"); + LOG_DEBUG("Set client private key: " + config.clientKeyPath); + } } + + // Use our custom SSL context function for server cert verification + curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, sslCtxFunction); + curl_easy_setopt(curl, CURLOPT_SSL_CTX_DATA, &ctxData); + + curl_easy_setopt(curl, CURLOPT_VERBOSE, config.verboseOutput ? 1L : 0L); + + CURLcode res = curl_easy_perform(curl); + + if (res != CURLE_OK) { + throw std::runtime_error(std::string("CURL request failed: ") + curl_easy_strerror(res)); + } + + curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response.statusCode); + + curl_slist_free_all(headers); + curl_easy_cleanup(curl); + + return response; + } catch (...) { + curl_slist_free_all(headers); + curl_easy_cleanup(curl); + throw; } -}; +} // Hashed Confirmation Code = SHA256(SHA256(Confirmation Code) | TransactionID) static std::vector<uint8_t> computeConfirmationCodeHash(const std::string& confirmationCode, const std::vector<uint8_t>& transactionId) { @@ -1089,7 +1122,7 @@ public: RSPClient(const std::string& serverUrl, const unsigned int serverPort, const std::vector<std::string>& certPath, const std::vector<std::string>& name_filters = {}) - : m_serverUrl(serverUrl), m_serverPort(serverPort) { + : m_serverUrl(serverUrl) { // OpenSSL 3.0+ initializes automatically for (auto cpath : certPath) { @@ -1165,11 +1198,11 @@ try { m_EID = CertificateUtil::getEID(m_euiccCert.get()); - LOG_INFO("Using EID from certificate: " + m_EID); + LOG_DEBUG("Using EID from certificate: " + m_EID); auto ski = CertificateUtil::getSubjectKeyIdentifier(m_euiccCert.get()); m_euiccSKI = ski; - LOG_INFO("Using eUICC SKI as PKID: " + HexUtil::bytesToHex(m_euiccSKI)); + LOG_DEBUG("Using eUICC SKI as PKID: " + HexUtil::bytesToHex(m_euiccSKI)); } catch (const std::exception& e) { LOG_ERROR("Failed to extract EUICC-specific data: " + std::string(e.what())); throw; @@ -1576,7 +1609,29 @@ m_customTlsCertPath = customTlsCertPath; } - std::string sendHttpsPost(const std::string& endpoint, const std::string& body, int& httpStatusCode) { + // Set authentication parameters for mutual TLS auth + void setAuthParams(bool useMutualTLS, const std::string& clientCertPath, const std::string& clientKeyPath) { + m_useMutualTLS = useMutualTLS; + m_clientCertPath = clientCertPath; + m_clientKeyPath = clientKeyPath; + LOG_DEBUG("Auth params set: mutualTLS=" + std::to_string(useMutualTLS) + ", cert=" + clientCertPath + ", key=" + clientKeyPath); + } + + // Send HTTPS POST without client authentication (for ES9+) + std::string sendHttpsPost(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride) { + return sendHttpsPostUnified(endpoint, body, httpStatusCode, portOverride); + } + + // Send HTTPS POST with pre-configured client authentication (for ES2+) + std::string sendHttpsPostWithAuth(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride) { + if (!m_useMutualTLS) { + LOG_WARNING("sendHttpsPostWithAuth called but mutual TLS not configured"); + } + return sendHttpsPostUnified(endpoint, body, httpStatusCode, portOverride, m_useMutualTLS, m_clientCertPath, m_clientKeyPath); + } + + std::string sendHttpsPostUnified(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride, + bool useMutualTLS = false, const std::string& clientCertPath = "", const std::string& clientKeyPath = "") { if (!m_httpClient) { m_httpClient = std::make_unique<HttpClient>(); } @@ -1584,33 +1639,37 @@ // full URL without port (port set via CURLOPT_PORT) std::string url = "https://" + m_serverUrl + endpoint; - HttpClient::ResponseData response; - - if (m_useCustomTlsCert) { - if (!m_customTlsCertPath.empty()) { - try { - auto tlsCerts = CertificateUtil::loadCertificateChain(m_customTlsCertPath); - for (auto& cert : tlsCerts) { - m_certPool.push_back(std::move(cert)); - } - LOG_DEBUG("Loaded custom TLS certificate from: " + m_customTlsCertPath); - } catch (const std::exception& e) { - LOG_WARNING("Failed to load custom TLS certificate: " + std::string(e.what())); - } - } - - std::vector<X509*> rawCertPool; - for (const auto& cert : m_certPool) { - rawCertPool.push_back(cert.get()); - } - - response = m_httpClient->postJsonWithCustomVerification(url, m_serverPort, body, nullptr, rawCertPool); - } else { - std::vector<X509*> emptyCertPool; - response = m_httpClient->postJsonWithCustomVerification(url, m_serverPort, body, nullptr, emptyCertPool); - LOG_INFO("Using standard CA bundle for TLS verification"); + // Build certificate pool for server verification + std::vector<X509*> rawCertPool; + for (const auto& cert : m_certPool) { + rawCertPool.push_back(cert.get()); } + // Add custom TLS server certificate if configured globally + if (m_useCustomTlsCert && !m_customTlsCertPath.empty()) { + try { + auto tlsCerts = CertificateUtil::loadCertificateChain(m_customTlsCertPath); + for (auto& cert : tlsCerts) { + rawCertPool.push_back(cert.get()); + } + LOG_DEBUG("Added custom TLS server certificate from: " + m_customTlsCertPath); + } catch (const std::exception& e) { + LOG_WARNING("Failed to load custom TLS server certificate: " + std::string(e.what())); + } + } + + HttpClient::PostConfig config; + config.useMutualTLS = useMutualTLS; + config.clientCertPath = clientCertPath; + config.clientKeyPath = clientKeyPath; + config.includeAdminProtocolHeader = useMutualTLS; // ES2+ requires this header + config.verboseOutput = false; + + LOG_DEBUG("Sending " + std::string(useMutualTLS ? "ES2+ request with mutual TLS" : "HTTPS request") + " to: " + endpoint + + " (port: " + std::to_string(portOverride) + ")"); + + HttpClient::ResponseData response = m_httpClient->postJson(url, portOverride, body, nullptr, rawCertPool, config); + httpStatusCode = response.statusCode; LOG_DEBUG("HTTP " + std::to_string(httpStatusCode) + " response, body length: " + std::to_string(response.body.length())); @@ -1619,7 +1678,6 @@ } std::string m_serverUrl; - unsigned int m_serverPort; std::unique_ptr<X509, X509Deleter> m_rootCA; std::vector<std::unique_ptr<X509, X509Deleter>> m_intermediateCA; @@ -1646,6 +1704,11 @@ std::unique_ptr<HttpClient> m_httpClient; bool m_useCustomTlsCert = true; // Flag for custom vs public CA std::string m_customTlsCertPath; // Path to custom TLS certificate + + // Authentication parameters for mutual TLS auth + bool m_useMutualTLS = false; + std::string m_clientCertPath = ""; + std::string m_clientKeyPath = ""; }; } // namespace RspCrypto \ No newline at end of file diff --git a/smdpp/smdpp_Tests.ttcn b/smdpp/smdpp_Tests.ttcn index 91797d4..bca2261 100644 --- a/smdpp/smdpp_Tests.ttcn +++ b/smdpp/smdpp_Tests.ttcn @@ -32,6 +32,7 @@ import from es9p_Types_JSON all; import from es2p_Types_JSON all; import from esx_header_Types_JSON all; +import from ES2Plus_Tests all; /* C++ handles only crypto, TTCN-3 handles ASN.1 encoding/decoding most of the time */ @@ -207,6 +208,7 @@ integer clientHandle, charstring endpoint, charstring body, + integer dport, out integer statusCode ) return charstring; @@ -216,6 +218,21 @@ charstring customTlsCertPath ) return integer; +external function ext_RSPClient_setAuthParams( + integer clientHandle, + boolean useMutualTLS, + charstring clientCertPath, + charstring clientKeyPath +) return integer; + +external function ext_RSPClient_sendHttpsPostWithAuth( + integer clientHandle, + charstring endpoint, + charstring body, + integer dport, + out integer statusCode +) return charstring; + /* RSP Protocol Constants */ const charstring c_oid_rspRole_dp_auth := "2.23.146.1.2.1.4"; const charstring c_oid_rspRole_dp_pb := "2.23.146.1.2.1.5"; @@ -233,6 +250,12 @@ const integer c_hostId_max_length := 16; const integer c_min_segment_length := 2; +// ensure canonical DER encoding, using a width 4 bitstring here leads to violations +const NotificationEvent c_notificationInstall := '1'B; // Bit 0 +const NotificationEvent c_notificationEnable := '10'B; // Bit 1 +const NotificationEvent c_notificationDisable := '100'B; // Bit 2 +const NotificationEvent c_notificationDelete := '1000'B; // Bit 3 + /* Error injection types for AuthenticateClient testing */ type union AuthClientErrorInjection { CertificateError cert_error, @@ -315,7 +338,8 @@ type record smdpp_ConnHdlrPars { charstring smdp_server_url, - integer smdp_server_port, + integer smdp_es9p_server_port, + integer smdp_es2p_server_port, charstring cert_path, charstring cert_name_filter, charstring euicc_cert_path, @@ -334,7 +358,8 @@ private function f_init_pars() runs on MTC_CT return smdpp_ConnHdlrPars { var smdpp_ConnHdlrPars pars := { smdp_server_url := "testsmdpplus1.example.com", - smdp_server_port := 8000, + smdp_es9p_server_port := 8000, + smdp_es2p_server_port := 8000, cert_path := "./sgp26/CertificateIssuer", cert_name_filter := "", // Load all certificates (both NIST and BRP) or "NIST" or "BRP" euicc_cert_path := "./sgp26/eUICC/CERT_EUICC_ECDSA_NIST.der", @@ -395,7 +420,7 @@ g_rsp_client_handle := ext_RSPClient_create( g_pars_smdpp.smdp_server_url, - g_pars_smdpp.smdp_server_port, + g_pars_smdpp.smdp_es9p_server_port, g_pars_smdpp.cert_path, g_pars_smdpp.cert_name_filter ); @@ -447,6 +472,137 @@ } } +/* HELPER FUNCTIONS FOR ES2+ DYNAMIC PROFILE PROVISIONING */ + +// Main ES2+ provisioning function - provisions a profile dynamically via ES2+ +private function f_provision_profile_via_es2plus( + charstring eid := "89049032123451234512345678901235", + boolean with_confirmation_code := false, + charstring profile_type := "Test", + boolean release_flag := true +) runs on smdpp_ConnHdlr return charstring { + + // ES2+ constants + const charstring c_es2plus_base_path := "/gsma/rsp2/es2plus"; + const charstring c_path_download_order := c_es2plus_base_path & "/downloadOrder"; + const charstring c_path_confirm_order := c_es2plus_base_path & "/confirmOrder"; + const charstring c_cert_path := "./test_certs/CERT_MNO_ECDSA_NIST.pem"; + const charstring c_key_path := "./test_certs/SK_MNO_ECDSA_NIST.pem"; + + // Generate unique function call identifier + var octetstring rnd_oct := f_rnd_octstring(4); + var charstring func_call_id := "TTCN3-" & oct2str(rnd_oct); + + var integer result := smdpp_Tests.ext_RSPClient_setAuthParams( + g_rsp_client_handle, + true, // useMutualTLS + c_cert_path, + c_key_path + ); + + if (result != 0) { + setverdict(fail, "Failed to set authentication parameters"); + mtc.stop; + } + + // Step 1: DownloadOrder to reserve ICCID + var JSON_ES2p_Request dl_req := { + downloadOrderRequest := { + header := { + functionRequesterIdentifier := "test.operator.com", + functionCallIdentifier := func_call_id & "-DL" + }, + eid := eid, + iccid := omit, + profileType := profile_type + } + }; + + var octetstring req_enc := enc_JSON_ES2p_Request(dl_req); + var integer status_code; + var charstring response := ext_RSPClient_sendHttpsPostWithAuth( + g_rsp_client_handle, + c_path_download_order, + oct2char(req_enc), + g_pars_smdpp.smdp_es2p_server_port, + status_code + ); + + if (status_code != 200) { + ext_logError("ES2+ DownloadOrder failed with status: " & int2str(status_code)); + return ""; + } + + var JSON_ES2p_Response dl_resp := dec_JSON_ES2p_Response(char2oct(response), "downloadOrder"); + if (dl_resp.downloadOrderResponse.header.functionExecutionStatus.status != "Executed-Success") { + ext_logError("ES2+ DownloadOrder returned error"); + return ""; + } + + var charstring new_iccid := dl_resp.downloadOrderResponse.iccid; + ext_logInfo("ES2+ provisioned ICCID: " & new_iccid); + + // Step 2: ConfirmOrder to create profile with matchingId + var JSON_ES2p_Request conf_req := { + confirmOrderRequest := { + header := { + functionRequesterIdentifier := "test.operator.com", + functionCallIdentifier := func_call_id & "-CF" + }, + iccid := new_iccid, + eid := omit, + matchingId := omit, // Let server generate + confirmationCode := omit, + smdsAddress := omit, + releaseFlag := release_flag + } + }; + + if (with_confirmation_code) { + conf_req.confirmOrderRequest.confirmationCode := "12345678"; + } + + req_enc := enc_JSON_ES2p_Request(conf_req); + response := ext_RSPClient_sendHttpsPostWithAuth( + g_rsp_client_handle, + c_path_confirm_order, + oct2char(req_enc), + g_pars_smdpp.smdp_es2p_server_port, + status_code + ); + + if (status_code != 200) { + ext_logError("ES2+ ConfirmOrder failed with status: " & int2str(status_code)); + return ""; + } + + var JSON_ES2p_Response conf_resp := dec_JSON_ES2p_Response(char2oct(response), "confirmOrder"); + if (conf_resp.confirmOrderResponse.header.functionExecutionStatus.status != "Executed-Success") { + ext_logError("ES2+ ConfirmOrder returned error"); + return ""; + } + + var charstring matching_id := conf_resp.confirmOrderResponse.matchingId; + ext_logInfo("ES2+ provisioned profile with matchingId: " & matching_id); + + // Store confirmation code if requested + if (with_confirmation_code) { + ext_logInfo("Profile provisioned with confirmation code required"); + } + + return matching_id; +} + +// Simplified variant for basic profile provisioning +private function f_provision_simple_profile() runs on smdpp_ConnHdlr return charstring { + return f_provision_profile_via_es2plus(); +} + +// Variant for profile with confirmation code +private function f_provision_profile_with_cc(charstring eid := "89049032123451234512345678901235") runs on smdpp_ConnHdlr return charstring { + return f_provision_profile_via_es2plus(eid, true); +} + /* HELPER FUNCTIONS FOR CERTIFICATE PKID MANAGEMENT */ private function f_get_ci_pkids_list() runs on smdpp_ConnHdlr return RSPDefinitions.EUICCInfo2.euiccCiPKIdListForVerification { if (g_pars_smdpp.cert_name_filter == "BRP") { @@ -721,6 +877,7 @@ g_rsp_client_handle, g_last_es9p_endpoint, g_last_es9p_request, + g_pars_smdpp.smdp_es9p_server_port, http_status ); @@ -770,6 +927,7 @@ g_rsp_client_handle, g_last_es9p_endpoint, g_last_es9p_request, + g_pars_smdpp.smdp_es9p_server_port, http_status ); @@ -903,8 +1061,13 @@ } private function f_perform_authenticate_client_standard( - charstring matchingId := "TS48v4_SAIP2.3_BERTLV" + charstring matchingId := "" /* Empty string will trigger dynamic provisioning */ ) runs on smdpp_ConnHdlr return AuthenticateClientOk { + /* Provision profile dynamically if matchingId not provided */ + if (matchingId == "") { + matchingId := f_provision_simple_profile(); + } + var EUICCInfo2 euiccInfo2 := valueof(ts_EUICCInfo2); f_set_euicc_pkids(euiccInfo2); @@ -939,6 +1102,11 @@ ) return octetstring with { extension "prototype(convert) encode(BER:BER_ENCODE_DER)" }; +external function encode_DER_profileInstallationResultData( + in ProfileInstallationResultData pdu +) return octetstring +with { extension "prototype(convert) encode(BER:BER_ENCODE_DER)" }; + /* VALIDATION HELPERS */ private function f_validate_initialise_secure_channel_request(InitialiseSecureChannelRequest iscReq) @@ -1109,6 +1277,7 @@ g_rsp_client_handle, g_last_es9p_endpoint, g_last_es9p_request, + g_pars_smdpp.smdp_es9p_server_port, http_status ); @@ -1181,7 +1350,7 @@ runs on smdpp_ConnHdlr return ProfileInstallationResult { var NotificationMetadata notifMeta := { seqNumber := 1, - profileManagementOperation := '00000001'B, /* notificationInstall - bit 0 set */ + profileManagementOperation := c_notificationInstall, notificationAddress := g_pars_smdpp.smdp_server_url, iccid := omit }; @@ -1213,11 +1382,7 @@ }; } - var ProfileInstallationResult temp_pir := { - profileInstallationResultData := pirData, - euiccSignPIR := ''O /* Empty signature for encoding */ - }; - var octetstring full_encoded := enc_ProfileInstallationResult(temp_pir); + var octetstring full_encoded := encode_DER_profileInstallationResultData(pirData); var octetstring euiccSignPIR := ext_RSPClient_signDataWithEUICC(g_rsp_client_handle, full_encoded); var ProfileInstallationResult pir := { @@ -1243,7 +1408,7 @@ private function f_buildAuthenticateClientRequest_unified( octetstring serverChallenge, - charstring matchingId := "TS48v4_SAIP2.3_BERTLV", + charstring matchingId := "", /* Empty string will trigger dynamic provisioning */ template (omit) EUICCInfo2 euiccInfo2 := omit, // omit = create default template (omit) DeviceInfo deviceInfo := omit, // omit = no device info template (omit) octetstring transactionIdOverride := omit, // omit = use correct ID @@ -1264,12 +1429,16 @@ var CtxParams1 ctxParams := valueof(ts_ctxParams1); /* matchingId: * - "OMIT" -> field omitted from ASN.1 structure - * - "" -> field is present but empty + * - "" -> triggers dynamic provisioning and uses the result * - any other value -> field contains that value */ if (matchingId == "OMIT") { ctxParams.ctxParamsForCommonAuthentication.matchingId := omit; } else { + /* Provision profile dynamically if matchingId empty */ + if (matchingId == "") { + matchingId := f_provision_simple_profile(); + } ctxParams.ctxParamsForCommonAuthentication.matchingId := matchingId; } @@ -1313,7 +1482,7 @@ private function f_buildAuthenticateClientRequest( octetstring serverChallenge, - charstring matchingId := "TS48v4_SAIP2.3_BERTLV", + charstring matchingId := "", /* Empty string will trigger dynamic provisioning */ template (omit) octetstring transactionIdOverride := omit // error injection - omit means correct ID ) runs on smdpp_ConnHdlr return RemoteProfileProvisioningRequest { return f_buildAuthenticateClientRequest_unified( @@ -1499,7 +1668,12 @@ } } -private function f_create_authenticate_client_request(charstring matchingId := "TS48v4_SAIP2.3_BERTLV") runs on smdpp_ConnHdlr return RemoteProfileProvisioningRequest { +private function f_create_authenticate_client_request(charstring matchingId := "") runs on smdpp_ConnHdlr return RemoteProfileProvisioningRequest { + /* Provision profile dynamically if matchingId not provided */ + if (matchingId == "") { + matchingId := f_provision_simple_profile(); + } + var EUICCInfo2 euiccInfo2 := valueof(ts_EUICCInfo2); f_set_euicc_pkids(euiccInfo2); @@ -1612,7 +1786,10 @@ /* Build CtxParams */ var CtxParams1 ctxParams := valueof(ts_ctxParams1); - ctxParams.ctxParamsForCommonAuthentication.matchingId := "TS48v4_SAIP2.3_BERTLV"; + + /* Provision profile dynamically unless error injection overrides it */ + var charstring provisionedMatchingId := f_provision_simple_profile(); + ctxParams.ctxParamsForCommonAuthentication.matchingId := provisionedMatchingId; /* Apply context parameter errors if specified */ if (ischosen(err_injection.ctx_error)) { @@ -2059,7 +2236,7 @@ var AuthClientErrorTestParams params := { testName := "AuthenticateClient - Mismatched Transaction ID", stepDescription := "AuthenticateClient with wrong transaction ID in signed data", - matchingId := "TS48v4_SAIP2.3_BERTLV", + matchingId := omit, /* Will be provisioned dynamically */ transactionIdOverride := wrongTransactionId, expectedSubjectCode := "8.10.1", expectedReasonCode := "3.9", @@ -2102,8 +2279,11 @@ var EUICCInfo2 euiccInfo2 := valueof(ts_EUICCInfo2); f_set_euicc_pkids(euiccInfo2); + /* Provision profile dynamically */ + var charstring provisionedMatchingId := f_provision_simple_profile(); + var CtxParams1 ctxParams := valueof(ts_ctxParams1); - ctxParams.ctxParamsForCommonAuthentication.matchingId := "TS48v4_SAIP2.3_BERTLV"; + ctxParams.ctxParamsForCommonAuthentication.matchingId := provisionedMatchingId; var EuiccSigned1 euiccSigned1 := f_create_euicc_signed1(euiccInfo2, ctxParams); var octetstring euiccSigned1_raw := enc_EuiccSigned1(euiccSigned1); @@ -2507,11 +2687,16 @@ } private function f_perform_session_through_getBoundProfilePackage( - charstring matchingId := "TS48v4_SAIP2.3_BERTLV" + charstring matchingId := "" /* Empty string will trigger dynamic provisioning */ ) runs on smdpp_ConnHdlr return GetBoundProfilePackageOk { + /* Provision profile dynamically if matchingId not provided */ + if (matchingId == "") { + matchingId := f_provision_simple_profile(); + } + var InitiateAuthenticationOkEs9 authOk := f_initiate_authentication_and_validate(); - var RemoteProfileProvisioningRequest authClientReq := f_create_authenticate_client_request(); + var RemoteProfileProvisioningRequest authClientReq := f_create_authenticate_client_request(matchingId); var RemoteProfileProvisioningResponse authClientResp := f_es9p_transceive_success(authClientReq); var AuthenticateClientOk authClientOk := authClientResp.authenticateClientResponseEs9.authenticateClientOk; @@ -3348,8 +3533,11 @@ euic2.euiccCiPKIdListForVerification := f_get_ci_pkids_for_verification(); euic2.euiccCiPKIdListForSigning := f_get_ci_pkids_for_signing(); + /* Provision profile dynamically */ + var charstring provisionedMatchingId := f_provision_simple_profile(); + var CtxParams1 ctxpar := valueof(ts_ctxParams1); - ctxpar.ctxParamsForCommonAuthentication.matchingId := "TS48v4_SAIP2.3_BERTLV"; + ctxpar.ctxParamsForCommonAuthentication.matchingId := provisionedMatchingId; var EuiccSigned1 euiccSig := { transactionId := g_transactionId, @@ -3717,7 +3905,7 @@ var NotificationMetadata notifMeta := { seqNumber := 2, /* Different sequence number from PIR */ - profileManagementOperation := '00000010'B, /* notificationEnable */ + profileManagementOperation := c_notificationEnable, notificationAddress := g_pars_smdpp.smdp_server_url, iccid := omit /* No specific ICCID for this test */ }; @@ -4446,14 +4634,40 @@ /* Test Case: TC_SM-DP+_ES9+.AuthenticateClientNIST - Error Test Sequence #15 // SGP.23 v1.15 section 4.3.14.2.2 Test Sequence #15 */ private function f_TC_AuthenticateClient_Error_15_NoEligibleProfile(charstring id) runs on smdpp_ConnHdlr { - f_test_authenticateClient_error({ - testName := "AuthenticateClient - Error: No Eligible Profile", - stepDescription := "AuthenticateClient when no profile matches device capabilities", - matchingId := "AC_NO_ELIGIBLE", /* Profile with incompatible requirements */ - expectedSubjectCode := "8.2.5", - expectedReasonCode := "4.3", - errorDescription := "No Eligible Profile test" - }, id); + /* SGP.23 Section 4.3.14.2.2 Test Sequence #15 + * The profile has PPR1 set (disabling not allowed) but the eUICC reports PPR1 as forbidden + * because an operational profile is already installed */ + + if (not f_rsp_client_init()) { + setverdict(fail, "RSP client initialization failed"); + return; + } + + var InitiateAuthenticationOkEs9 authOk := f_initiate_authentication_and_validate(); + + ext_logInfo("Step 2: AuthenticateClient with eUICC reporting forbidden PPR1"); + + var EUICCInfo2 euiccInfo2 := valueof(ts_EUICCInfo2); + f_set_euicc_pkids(euiccInfo2); + /* Set forbiddenProfilePolicyRules to indicate PPR1 is forbidden + * PPR1 (bit 1) = "Disabling of this Profile is not allowed" + * This is forbidden when an operational profile is already installed */ + euiccInfo2.forbiddenProfilePolicyRules := '0100'B; /* PPR1 is bit 1 */ + + var CtxParams1 ctxParams := valueof(ts_ctxParams1); + /* Use AC_PPR1 which has PPR1 set in the profile */ + ctxParams.ctxParamsForCommonAuthentication.matchingId := "AC_PPR1"; + + var EuiccSigned1 euiccSigned1 := f_create_euicc_signed1(euiccInfo2, ctxParams); + var octetstring euiccSignature1 := f_sign_euicc_signed1(euiccSigned1); + + var RemoteProfileProvisioningRequest authReq := f_build_authenticate_client_request(euiccSigned1, euiccSignature1); + var JSON_ESx_FunctionExecutionStatusCodeData err := f_es9p_transceive_error(authReq); + + f_validate_error_response(err, "8.2.5", "4.3", "No eligible Profile for this eUICC/Device"); + setverdict(pass); + + f_rsp_client_cleanup(); } /* Test Case: TC_SM-DP+_ES9+.AuthenticateClientNIST - Error Test Sequence #16 // SGP.23 v1.15 section 4.3.14.2.2 Test Sequence #16 */ @@ -5156,7 +5370,7 @@ testcase TC_SM_DP_ES9_InitiateAuthenticationBRP_01_Nominal() runs on MTC_CT { var smdpp_ConnHdlrPars pars := f_init_pars(); - pars.smdp_server_port := 8001; /* BRP server port */ + pars.smdp_es9p_server_port := 8001; /* BRP server port */ pars.cert_name_filter := "BRP"; /* Use Brainpool certificates */ pars.euicc_cert_path := "./sgp26/eUICC/CERT_EUICC_ECDSA_BRP.der"; pars.euicc_key_path := "./sgp26/eUICC/SK_EUICC_ECDSA_BRP.pem"; @@ -5169,7 +5383,7 @@ testcase TC_SM_DP_ES9_AuthenticateClientBRP_01_Nominal() runs on MTC_CT { var smdpp_ConnHdlrPars pars := f_init_pars(); - pars.smdp_server_port := 8001; /* BRP server port */ + pars.smdp_es9p_server_port := 8001; /* BRP server port */ pars.cert_name_filter := "BRP"; /* Use Brainpool certificates */ pars.euicc_cert_path := "./sgp26/eUICC/CERT_EUICC_ECDSA_BRP.der"; pars.euicc_key_path := "./sgp26/eUICC/SK_EUICC_ECDSA_BRP.pem"; @@ -5182,7 +5396,7 @@ testcase TC_SM_DP_ES9_GetBoundProfilePackageBRP_01_Nominal() runs on MTC_CT { var smdpp_ConnHdlrPars pars := f_init_pars(); - pars.smdp_server_port := 8001; /* BRP server port */ + pars.smdp_es9p_server_port := 8001; /* BRP server port */ pars.cert_name_filter := "BRP"; /* Use Brainpool certificates */ pars.euicc_cert_path := "./sgp26/eUICC/CERT_EUICC_ECDSA_BRP.der"; pars.euicc_key_path := "./sgp26/eUICC/SK_EUICC_ECDSA_BRP.pem"; @@ -5195,7 +5409,7 @@ testcase TC_rsp_complete_flow_BRP() runs on MTC_CT { var smdpp_ConnHdlrPars pars := f_init_pars(); - pars.smdp_server_port := 8001; /* BRP server port */ + pars.smdp_es9p_server_port := 8001; /* BRP server port */ pars.cert_name_filter := "BRP"; /* Use Brainpool certificates */ pars.euicc_cert_path := "./sgp26/eUICC/CERT_EUICC_ECDSA_BRP.der"; pars.euicc_key_path := "./sgp26/eUICC/SK_EUICC_ECDSA_BRP.pem"; @@ -5208,7 +5422,7 @@ testcase TC_SM_DP_ES9_HandleNotificationBRP() runs on MTC_CT { var smdpp_ConnHdlrPars pars := f_init_pars(); - pars.smdp_server_port := 8001; /* BRP server port */ + pars.smdp_es9p_server_port := 8001; /* BRP server port */ pars.cert_name_filter := "BRP"; /* Use Brainpool certificates */ pars.euicc_cert_path := "./sgp26/eUICC/CERT_EUICC_ECDSA_BRP.der"; pars.euicc_key_path := "./sgp26/eUICC/SK_EUICC_ECDSA_BRP.pem"; @@ -5221,7 +5435,7 @@ testcase TC_SM_DP_ES9_CancelSession_After_AuthenticateClientBRP() runs on MTC_CT { var smdpp_ConnHdlrPars pars := f_init_pars(); - pars.smdp_server_port := 8001; /* BRP server port */ + pars.smdp_es9p_server_port := 8001; /* BRP server port */ pars.cert_name_filter := "BRP"; /* Use Brainpool certificates */ pars.euicc_cert_path := "./sgp26/eUICC/CERT_EUICC_ECDSA_BRP.der"; pars.euicc_key_path := "./sgp26/eUICC/SK_EUICC_ECDSA_BRP.pem"; @@ -5234,7 +5448,7 @@ testcase TC_SM_DP_ES9_CancelSession_After_GetBoundProfilePackageBRP() runs on MTC_CT { var smdpp_ConnHdlrPars pars := f_init_pars(); - pars.smdp_server_port := 8001; /* BRP server port */ + pars.smdp_es9p_server_port := 8001; /* BRP server port */ pars.cert_name_filter := "BRP"; /* Use Brainpool certificates */ pars.euicc_cert_path := "./sgp26/eUICC/CERT_EUICC_ECDSA_BRP.der"; pars.euicc_key_path := "./sgp26/eUICC/SK_EUICC_ECDSA_BRP.pem"; @@ -5245,6 +5459,185 @@ setverdict(pass); } +/* ES2+/ES9+ Integration Test Case */ +testcase TC_ES2Plus_ES9Plus_FullFlow() runs on MTC_CT { + var smdpp_ConnHdlrPars pars := f_init_pars(); + var smdpp_ConnHdlr vc_conn; + f_init(testcasename()); + vc_conn := f_start_handler(refers(f_TC_ES2Plus_ES9Plus_FullFlow), pars); + vc_conn.done; + setverdict(pass); +} + +/* ES2+/ES9+ Integration Test Implementation */ +private function f_TC_ES2Plus_ES9Plus_FullFlow(charstring id) runs on smdpp_ConnHdlr { + // ES2+ constants + const charstring c_es2plus_base_path := "/gsma/rsp2/es2plus"; + const charstring c_path_download_order := c_es2plus_base_path & "/downloadOrder"; + const charstring c_path_confirm_order := c_es2plus_base_path & "/confirmOrder"; + const charstring c_eid1 := "89049032123451234512345678901235"; + const charstring c_cert_path := "./test_certs/CERT_MNO_ECDSA_NIST.pem"; + const charstring c_key_path := "./test_certs/SK_MNO_ECDSA_NIST.pem"; + + if (not f_rsp_client_init()) { + setverdict(fail, "RSP client initialization failed"); + return; + } + + var integer result := smdpp_Tests.ext_RSPClient_setAuthParams( + g_rsp_client_handle, + true, // useMutualTLS + c_cert_path, + c_key_path + ); + + if (result != 0) { + setverdict(fail, "Failed to set authentication parameters"); + mtc.stop; + } + + // Step 1: Order profile via ES2+ + + // 1.1: dl req + var JSON_ES2p_Request dl_req := { + downloadOrderRequest := { + header := { + functionRequesterIdentifier := "test.operator.com", + functionCallIdentifier := "01234567890123456789012345678901" + }, + eid := c_eid1, + iccid := omit, + profileType := "Test" + } + }; + + var octetstring req_enc := enc_JSON_ES2p_Request(dl_req); + var integer status_code; + var charstring response := ext_RSPClient_sendHttpsPostWithAuth( + g_rsp_client_handle, + c_path_download_order, + oct2char(req_enc), + g_pars_smdpp.smdp_es2p_server_port, + status_code + ); + + if (status_code != 200) { + setverdict(fail, "DownloadOrder failed with status: ", status_code); + f_rsp_client_cleanup(); + return; + } + + var JSON_ES2p_Response dl_resp := dec_JSON_ES2p_Response(char2oct(response), "downloadOrder"); + if (dl_resp.downloadOrderResponse.header.functionExecutionStatus.status != "Executed-Success") { + setverdict(fail, "DownloadOrder returned error"); + f_rsp_client_cleanup(); + return; + } + + var charstring new_iccid := dl_resp.downloadOrderResponse.iccid; + + // 1.2: confirm + var JSON_ES2p_Request conf_req := { + confirmOrderRequest := { + header := { + functionRequesterIdentifier := "test.operator.com", + functionCallIdentifier := "02234567890123456789012345678901" + }, + iccid := new_iccid, + eid := omit, + matchingId := omit, + confirmationCode := omit, + smdsAddress := omit, + releaseFlag := true + } + }; + + req_enc := enc_JSON_ES2p_Request(conf_req); + response := ext_RSPClient_sendHttpsPostWithAuth( + g_rsp_client_handle, + c_path_confirm_order, + oct2char(req_enc), + g_pars_smdpp.smdp_es2p_server_port, + status_code + ); + + if (status_code != 200) { + setverdict(fail, "ConfirmOrder failed with status: ", status_code); + f_rsp_client_cleanup(); + return; + } + + var JSON_ES2p_Response conf_resp := dec_JSON_ES2p_Response(char2oct(response), "confirmOrder"); + if (conf_resp.confirmOrderResponse.header.functionExecutionStatus.status != "Executed-Success") { + setverdict(fail, "ConfirmOrder returned error"); + f_rsp_client_cleanup(); + return; + } + + var charstring matching_id := conf_resp.confirmOrderResponse.matchingId; + + // Step 2: Download profile via ES9+ + + // Step 2.1: InitiateAuthentication + var RemoteProfileProvisioningRequest initAuthReq := f_create_initiate_authentication_request(); + var RemoteProfileProvisioningResponse initAuthResp := f_es9p_transceive_success(initAuthReq); + + if (not f_validate_initiate_authentication_response(initAuthResp)) { + setverdict(fail, "InitiateAuthentication validation failed"); + f_rsp_client_cleanup(); + return; + } + + var InitiateAuthenticationOkEs9 initAuthOk := initAuthResp.initiateAuthenticationResponse.initiateAuthenticationOk; + + // Step 2.2: AuthenticateClient with ES2+ matchingId + + var RemoteProfileProvisioningRequest authClientReq := f_buildAuthenticateClientRequest( + initAuthOk.serverSigned1.serverChallenge, + matching_id // Using the matchingId from ES2+ ConfirmOrder + ); + + var RemoteProfileProvisioningResponse authClientResp := f_es9p_transceive_success(authClientReq); + var AuthenticateClientOk authClientOk := authClientResp.authenticateClientResponseEs9.authenticateClientOk; + + f_validateAuthenticateClientResponse(authClientOk); + + // Handle confirmation code if required + if (authClientOk.smdpSigned2.ccRequiredFlag == true) { + log("Confirmation code is required for this profile"); + result := ext_RSPClient_setTransactionId(g_rsp_client_handle, authClientOk.transactionId); + if (result != 0) { + setverdict(fail, "Failed to set transaction ID"); + f_rsp_client_cleanup(); + return; + } + + var charstring confirmationCode := "12345678"; // Default test code + result := ext_RSPClient_setConfirmationCode(g_rsp_client_handle, confirmationCode); + if (result != 0) { + setverdict(fail, "Failed to set confirmation code"); + f_rsp_client_cleanup(); + return; + } + log("Set confirmation code: ", confirmationCode); + } + + // Step 2.3: GetBoundProfilePackage + + var RemoteProfileProvisioningRequest packageReq := f_create_get_bound_profile_package_request( + authClientOk.smdpSignature2 + ); + + var RemoteProfileProvisioningResponse packageResp := f_es9p_transceive_success(packageReq); + var GetBoundProfilePackageOk packageOk := packageResp.getBoundProfilePackageResponse.getBoundProfilePackageOk; + + f_validate_get_bound_profile_package_response(packageResp); + + f_rsp_client_cleanup(); + + setverdict(pass); +} + control { execute(TC_rsp_complete_flow()); @@ -5524,6 +5917,9 @@ execute(TC_SM_DP_ES9_CancelSession_After_GetBoundProfilePackageBRP()); /* Complete flow with BRP certificates */ execute(TC_rsp_complete_flow_BRP()); + + /* ES2+/ES9+ Integration Test */ + execute(TC_ES2Plus_ES9Plus_FullFlow()); } } \ No newline at end of file diff --git a/smdpp/smdpp_Tests_Functions.cc b/smdpp/smdpp_Tests_Functions.cc index 52b6c6b..7bd08e3 100644 --- a/smdpp/smdpp_Tests_Functions.cc +++ b/smdpp/smdpp_Tests_Functions.cc @@ -534,12 +534,12 @@ // Derive BSP session keys using X9.63 KDF (from_kdf) LOG_DEBUG("BSP KDF inputs:"); LOG_DEBUG(" Shared secret: " + HexUtil::bytesToHex(sharedSecretVec)); - LOG_DEBUG(" Key type: " + std::to_string(keyType.get_long_long_val()) + + LOG_DEBUG(" Key type: " + std::to_string(keyType.get_long_long_val()) + " (0x" + HexUtil::bytesToHex({static_cast<uint8_t>(keyType.get_long_long_val())}) + ")"); LOG_DEBUG(" Key length: " + std::to_string(keyLength.get_long_long_val())); LOG_DEBUG(" Host ID: " + HexUtil::bytesToHex(hostIdVec)); LOG_DEBUG(" EID: " + HexUtil::bytesToHex(eidVec)); - + auto bsp = BspCryptoNS::BspCrypto::from_kdf(sharedSecretVec, static_cast<uint8_t>(keyType.get_long_long_val()), static_cast<uint8_t>(keyLength.get_long_long_val()), @@ -574,19 +574,6 @@ }); } -CHARSTRING ext__RSPClient__sendHttpsPost(const INTEGER& clientHandle, const CHARSTRING& endpoint, - const CHARSTRING& body, INTEGER& statusCode) { - statusCode = INTEGER(0); - - return with_client(clientHandle, "ext__RSPClient__sendHttpsPost", CHARSTRING(""), [&](RSPClient* client) { - int httpStatus = 0; - std::string response = - client->sendHttpsPost(charstring_to_string(endpoint), charstring_to_string(body), httpStatus); - statusCode = INTEGER(httpStatus); - return string_to_charstring(response); - }); -} - INTEGER ext__RSPClient__configureHttpClient(const INTEGER& clientHandle, const BOOLEAN& useCustomTlsCert, const CHARSTRING& customTlsCertPath) { return with_client(clientHandle, "ext__RSPClient__configureHttpClient", INTEGER(-1), [&](RSPClient* client) { @@ -599,4 +586,58 @@ }); } +INTEGER ext__RSPClient__setAuthParams(const INTEGER& clientHandle, const BOOLEAN& useMutualTLS, + const CHARSTRING& clientCertPath, const CHARSTRING& clientKeyPath) { + return with_client(clientHandle, "ext__RSPClient__setAuthParams", INTEGER(-1), [&](RSPClient* client) { + bool useMutual = static_cast<bool>(useMutualTLS); + std::string certPath = charstring_to_string(clientCertPath); + std::string keyPath = charstring_to_string(clientKeyPath); + + client->setAuthParams(useMutual, certPath, keyPath); + LOG_DEBUG("Set auth params - mutual TLS: " + std::string(useMutual ? "true" : "false") + + ", cert: " + certPath + ", key: " + keyPath); + return INTEGER(0); + }); +} + +CHARSTRING ext__RSPClient__sendHttpsPost(const INTEGER& clientHandle, const CHARSTRING& endpoint, + const CHARSTRING& body, const INTEGER& port, INTEGER& statusCode) { + statusCode = INTEGER(0); + + return with_client(clientHandle, "ext__RSPClient__sendHttpsPostSimple", CHARSTRING(""), [&](RSPClient* client) { + int httpStatus = 0; + int dstport = static_cast<int>(port); + + std::string response = client->sendHttpsPost( + charstring_to_string(endpoint), + charstring_to_string(body), + httpStatus, + dstport + ); + + statusCode = INTEGER(httpStatus); + return string_to_charstring(response); + }); +} + +CHARSTRING ext__RSPClient__sendHttpsPostWithAuth(const INTEGER& clientHandle, const CHARSTRING& endpoint, + const CHARSTRING& body, const INTEGER& port, INTEGER& statusCode) { + statusCode = INTEGER(0); + + return with_client(clientHandle, "ext__RSPClient__sendHttpsPostWithAuth", CHARSTRING(""), [&](RSPClient* client) { + int httpStatus = 0; + int dstport = static_cast<int>(port); + + std::string response = client->sendHttpsPostWithAuth( + charstring_to_string(endpoint), + charstring_to_string(body), + httpStatus, + dstport + ); + + statusCode = INTEGER(httpStatus); + return string_to_charstring(response); + }); +} + } // namespace smdpp__Tests \ No newline at end of file diff --git a/smdpp/test_certs/CERT_MNO_ECDSA_NIST.pem b/smdpp/test_certs/CERT_MNO_ECDSA_NIST.pem new file mode 100644 index 0000000..f626b2e --- /dev/null +++ b/smdpp/test_certs/CERT_MNO_ECDSA_NIST.pem @@ -0,0 +1,11 @@ +-----BEGIN CERTIFICATE----- +MIIBpDCCAUugAwIBAgIUSeaTfsRONLZXImVBtISYmkx2cuYwCgYIKoZIzj0EAwIw +QTELMAkGA1UEBhMCVVMxFjAUBgNVBAoMDVRlc3QgT3BlcmF0b3IxGjAYBgNVBAMM +EXRlc3Qub3BlcmF0b3IuY29tMB4XDTI1MDgwNDE0MzU1OFoXDTI2MDgwNDE0MzU1 +OFowQTELMAkGA1UEBhMCVVMxFjAUBgNVBAoMDVRlc3QgT3BlcmF0b3IxGjAYBgNV +BAMMEXRlc3Qub3BlcmF0b3IuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE +ml9gJuY6zXQS+lAjVTcRfCQpjfHqwFozg3NeyXjjf1DzKV7z+1OxI4wyjVEWDbXR +y3LuqA0IJn9G4OlpPsQx9qMhMB8wHQYDVR0OBBYEFPrtOcEs4Pqf0ehIWfOwEnqD +Z82OMAoGCCqGSM49BAMCA0cAMEQCIGGr25Njje34dwlkmRO1fEI1DfjzstTmBBCr +WruTnbbkAiBsMnKf7EZ937+WIz4Re+lyEtQjEERuT9AUd/yTHqEY0Q== +-----END CERTIFICATE----- diff --git a/smdpp/test_certs/SK_MNO_ECDSA_NIST.pem b/smdpp/test_certs/SK_MNO_ECDSA_NIST.pem new file mode 100644 index 0000000..3c5e5b8 --- /dev/null +++ b/smdpp/test_certs/SK_MNO_ECDSA_NIST.pem @@ -0,0 +1,8 @@ +-----BEGIN EC PARAMETERS----- +BggqhkjOPQMBBw== +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIJKEROO3uDeVP5/iKmGuLK56kIdksG8PISUiCfq58HDfoAoGCCqGSM49 +AwEHoUQDQgAEml9gJuY6zXQS+lAjVTcRfCQpjfHqwFozg3NeyXjjf1DzKV7z+1Ox +I4wyjVEWDbXRy3LuqA0IJn9G4OlpPsQx9g== +-----END EC PRIVATE KEY----- -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41120?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I2865e016974d7d7a03e00a7795a42f573b147a4b Gerrit-Change-Number: 41120 Gerrit-PatchSet: 1 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de>

5 days, 4 hours

[L] Change in osmo-ttcn3-hacks[master]: smdpp: es9p pure asn1 support

by Hoernchen

Hoernchen has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41121?usp=email ) Change subject: smdpp: es9p pure asn1 support ...................................................................... smdpp: es9p pure asn1 support Can be used instead of the json layer. Change-Id: I1d824931bd6513d2320ba30df0f8193cd8352863 --- M smdpp/rsp_client.cpp M smdpp/smdpp_Tests.ttcn M smdpp/smdpp_Tests_Functions.cc 3 files changed, 377 insertions(+), 15 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/21/41121/1 diff --git a/smdpp/rsp_client.cpp b/smdpp/rsp_client.cpp index d03a64e..97f5a5a 100644 --- a/smdpp/rsp_client.cpp +++ b/smdpp/rsp_client.cpp @@ -928,6 +928,7 @@ std::string clientKeyPath; bool includeAdminProtocolHeader = false; bool verboseOutput = false; + std::string contentType = "application/json"; }; ResponseData postJson(const std::string& url, unsigned int port, const std::string& jsonData, X509_STORE* store, std::vector<X509*>& certPool, @@ -1021,15 +1022,23 @@ } struct curl_slist* headers = nullptr; + std::string contentTypeHeader = "Content-Type: " + config.contentType; if (config.useMutualTLS) { - headers = curl_slist_append(headers, "Content-Type: application/json;charset=UTF-8"); + if (config.contentType == "application/json") { + contentTypeHeader += ";charset=UTF-8"; + } + headers = curl_slist_append(headers, contentTypeHeader.c_str()); headers = curl_slist_append(headers, "Accept: application/json"); if (config.includeAdminProtocolHeader) { headers = curl_slist_append(headers, "X-Admin-Protocol: gsma/rsp/v2.5.0"); } } else { - headers = curl_slist_append(headers, "Content-Type: application/json"); - headers = curl_slist_append(headers, "Accept: application/json"); + headers = curl_slist_append(headers, contentTypeHeader.c_str()); + // For ASN.1, accept the same content type + std::string acceptHeader = "Accept: " + (config.contentType == "application/x-gsma-rsp-asn1" ? config.contentType : "application/json"); + headers = curl_slist_append(headers, acceptHeader.c_str()); + // Always add X-Admin-Protocol for ES9+ regardless of content type + headers = curl_slist_append(headers, "X-Admin-Protocol: gsma/rsp/v2.5.0"); } SslCtxData ctxData = { .store = store, .certPool = &certPool, .verifyResult = false, .errorMessage = "" }; @@ -1040,6 +1049,7 @@ curl_easy_setopt(curl, CURLOPT_PORT, port); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); curl_easy_setopt(curl, CURLOPT_POSTFIELDS, jsonData.c_str()); + curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, jsonData.size()); // Important for binary data curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, writeCallback); curl_easy_setopt(curl, CURLOPT_WRITEDATA, &response.body); curl_easy_setopt(curl, CURLOPT_HEADERFUNCTION, headerCallback); @@ -1049,6 +1059,10 @@ curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2L); + // Set reasonable timeouts + curl_easy_setopt(curl, CURLOPT_TIMEOUT, 30L); + curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 10L); + if (config.useMutualTLS) { if (!config.clientCertPath.empty()) { curl_easy_setopt(curl, CURLOPT_SSLCERT, config.clientCertPath.c_str()); @@ -1630,8 +1644,16 @@ return sendHttpsPostUnified(endpoint, body, httpStatusCode, portOverride, m_useMutualTLS, m_clientCertPath, m_clientKeyPath); } + std::string sendHttpsPostWithContentType(const std::string& endpoint, const std::string& body, const std::string& contentType, int& httpStatusCode, + unsigned int portOverride) { + LOG_DEBUG("sendHttpsPostWithContentType: endpoint=" + endpoint + ", contentType=" + contentType + ", bodySize=" + std::to_string(body.size()) + + ", port=" + std::to_string(portOverride)); + return sendHttpsPostUnified(endpoint, body, httpStatusCode, portOverride, false, "", "", contentType); + } + std::string sendHttpsPostUnified(const std::string& endpoint, const std::string& body, int& httpStatusCode, unsigned int portOverride, - bool useMutualTLS = false, const std::string& clientCertPath = "", const std::string& clientKeyPath = "") { + bool useMutualTLS = false, const std::string& clientCertPath = "", const std::string& clientKeyPath = "", + const std::string& contentType = "application/json") { if (!m_httpClient) { m_httpClient = std::make_unique<HttpClient>(); } @@ -1664,6 +1686,7 @@ config.clientKeyPath = clientKeyPath; config.includeAdminProtocolHeader = useMutualTLS; // ES2+ requires this header config.verboseOutput = false; + config.contentType = contentType; LOG_DEBUG("Sending " + std::string(useMutualTLS ? "ES2+ request with mutual TLS" : "HTTPS request") + " to: " + endpoint + " (port: " + std::to_string(portOverride) + ")"); diff --git a/smdpp/smdpp_Tests.ttcn b/smdpp/smdpp_Tests.ttcn index bca2261..0d1eab9 100644 --- a/smdpp/smdpp_Tests.ttcn +++ b/smdpp/smdpp_Tests.ttcn @@ -233,6 +233,24 @@ out integer statusCode ) return charstring; +external function ext_RSPClient_sendHttpsPostWithContentType( + integer clientHandle, + charstring endpoint, + charstring body, + integer dport, + charstring contentType, + out integer statusCode +) return charstring; + +external function ext_RSPClient_sendHttpsPostBinary( + integer clientHandle, + charstring endpoint, + octetstring body, + integer dport, + charstring contentType, + out integer statusCode +) return octetstring; + /* RSP Protocol Constants */ const charstring c_oid_rspRole_dp_auth := "2.23.146.1.2.1.4"; const charstring c_oid_rspRole_dp_pb := "2.23.146.1.2.1.5"; @@ -336,6 +354,11 @@ var charstring g_last_es9p_request := ""; }; +type enumerated ES9EncodingMode { + ES9_JSON, + ES9_ASN1 +} + type record smdpp_ConnHdlrPars { charstring smdp_server_url, integer smdp_es9p_server_port, @@ -352,7 +375,8 @@ GetBppErrorInjection gbpp_err_injection optional, boolean cc_required optional, boolean use_ppk optional, - integer metadata_segments optional + integer metadata_segments optional, + ES9EncodingMode es9_encoding_mode optional }; private function f_init_pars() runs on MTC_CT return smdpp_ConnHdlrPars { @@ -372,7 +396,8 @@ gbpp_err_injection := omit, cc_required := false, use_ppk := false, - metadata_segments := 1 + metadata_segments := 1, + es9_encoding_mode := omit /* Default to JSON mode */ }; return pars; } @@ -920,16 +945,62 @@ private function f_es9p_transceive_wrap(RemoteProfileProvisioningRequest request) runs on smdpp_ConnHdlr return DecodedRPPReponse_Wrap { - f_es9p_send_new(request); + + var ES9EncodingMode encoding_mode := ES9_JSON; + if (ispresent(g_pars_smdpp.es9_encoding_mode)) { + encoding_mode := g_pars_smdpp.es9_encoding_mode; + } + + if (encoding_mode == ES9_ASN1) { + return f_es9p_transceive_wrap_asn1(request); + } else { + f_es9p_send_new(request); + + var integer http_status; + var charstring response_body := ext_RSPClient_sendHttpsPost( + g_rsp_client_handle, + g_last_es9p_endpoint, + g_last_es9p_request, + g_pars_smdpp.smdp_es9p_server_port, + http_status + ); + + if (http_status != 200) { + setverdict(fail, "HTTP error response: " & int2str(http_status)); + var DecodedRPPReponse_Wrap empty_response; + return empty_response; + } + + // Decode to wrapper type that handles both success and error + var DecodedRPPReponse_Wrap response := {omit, omit}; + dec_RemoteProfileProvisioningResponse_from_JSON(response_body, response); + + return response; + } +} + +/* Pure ASN.1 mode transceive function */ +private function f_es9p_transceive_wrap_asn1(RemoteProfileProvisioningRequest request) +runs on smdpp_ConnHdlr +return DecodedRPPReponse_Wrap { + /* Encode the request as pure ASN.1 (already includes A2 tag) */ + var octetstring asn1_request := enc_RemoteProfileProvisioningRequest(request); + + ext_logInfo("ASN.1 request size: " & int2str(lengthof(asn1_request)) & " bytes"); + ext_logInfo("ASN.1 request first 50 bytes: " & oct2str(substr(asn1_request, 0, 50))); + ext_logInfo("ASN.1 request full: " & oct2str(asn1_request)); var integer http_status; - var charstring response_body := ext_RSPClient_sendHttpsPost( + ext_logInfo("Sending ASN.1 request to /gsma/rsp2/asn1 on port " & int2str(g_pars_smdpp.smdp_es9p_server_port)); + var octetstring response_body := ext_RSPClient_sendHttpsPostBinary( g_rsp_client_handle, - g_last_es9p_endpoint, - g_last_es9p_request, - g_pars_smdpp.smdp_es9p_server_port, + "/gsma/rsp2/asn1", + asn1_request, + g_pars_smdpp.smdp_es9p_server_port, + "application/x-gsma-rsp-asn1", http_status ); + ext_logInfo("Received HTTP status: " & int2str(http_status)); if (http_status != 200) { setverdict(fail, "HTTP error response: " & int2str(http_status)); @@ -937,11 +1008,129 @@ return empty_response; } - // Decode to wrapper type that handles both success and error - var DecodedRPPReponse_Wrap response := {omit, omit}; - dec_RemoteProfileProvisioningResponse_from_JSON(response_body, response); + /* Decode pure ASN.1 response (already includes A3 tag) */ + var RemoteProfileProvisioningResponse asn1_response := dec_RemoteProfileProvisioningResponse(response_body); - return response; + /* Convert to DecodedRPPReponse_Wrap format for compatibility */ + var DecodedRPPReponse_Wrap wrap := {omit, omit}; + + /* ASN.1 errors are encoded as specific CHOICE values */ + if (f_is_asn1_error_response(asn1_response)) { + ext_logInfo("ASN.1 response detected as error, converting..."); + wrap.err := f_convert_asn1_error_to_json(asn1_response); + ext_logInfo("Converted error: subject=" & wrap.err.subjectCode & ", reason=" & wrap.err.reasonCode); + } else { + /* Success response */ + wrap.asn1_pdu := asn1_response; + } + + return wrap; +} + +/* Helper to check if ASN.1 response is an error */ +private function f_is_asn1_error_response(RemoteProfileProvisioningResponse resp) return boolean { + if (ischosen(resp.authenticateClientResponseEs9)) { + ext_logInfo("Response has authenticateClientResponseEs9"); + /* AuthenticateClientResponseEs9 is a CHOICE between authenticateClientOk and authenticateClientError */ + if (ischosen(resp.authenticateClientResponseEs9.authenticateClientError)) { + return true; + } + } else if (ischosen(resp.getBoundProfilePackageResponse)) { + /* GetBoundProfilePackageResponse is a CHOICE between getBoundProfilePackageOk and getBoundProfilePackageError */ + if (ischosen(resp.getBoundProfilePackageResponse.getBoundProfilePackageError)) { + return true; + } + } else if (ischosen(resp.initiateAuthenticationResponse)) { + /* InitiateAuthenticationResponse is a CHOICE between initiateAuthenticationOk and initiateAuthenticationError */ + if (ischosen(resp.initiateAuthenticationResponse.initiateAuthenticationError)) { + return true; + } + } else if (ischosen(resp.cancelSessionResponseEs9)) { + /* CancelSessionResponseEs9 is a CHOICE between cancelSessionOk and cancelSessionError */ + if (ischosen(resp.cancelSessionResponseEs9.cancelSessionError)) { + return true; + } + } + return false; +} + +/* Helper to convert ASN.1 error to JSON error format */ +private function f_convert_asn1_error_to_json(RemoteProfileProvisioningResponse resp) +return JSON_ESx_FunctionExecutionStatusCodeData { + var JSON_ESx_FunctionExecutionStatusCodeData err := { + subjectCode := "", + reasonCode := "", + subjectIdentifier := omit, + message_ := "" + }; + + if (ischosen(resp.authenticateClientResponseEs9)) { + if (ischosen(resp.authenticateClientResponseEs9.authenticateClientError)) { + var integer errorCode := resp.authenticateClientResponseEs9.authenticateClientError; + /* Map AuthenticateClient error codes per SGP.22 */ + if (errorCode == 1) { /* eumCertificateInvalid */ + err.subjectCode := "8.1.1"; + err.reasonCode := "3.1"; + err.message_ := "EUM Certificate Invalid"; + } else if (errorCode == 2) { /* eumCertificateExpired */ + err.subjectCode := "8.1.1"; + err.reasonCode := "3.2"; + err.message_ := "EUM Certificate Expired"; + } else if (errorCode == 3) { /* euiccCertificateInvalid */ + err.subjectCode := "8.1.2"; + err.reasonCode := "3.1"; + err.message_ := "eUICC Certificate Invalid"; + } else if (errorCode == 4) { /* euiccCertificateExpired */ + err.subjectCode := "8.1.2"; + err.reasonCode := "3.2"; + err.message_ := "eUICC Certificate Expired"; + } else if (errorCode == 5) { /* euiccSignatureInvalid */ + err.subjectCode := "8.1.3"; + err.reasonCode := "3.1"; + err.message_ := "eUICC Signature Invalid"; + } else if (errorCode == 8) { /* matchingIdRefused */ + err.subjectCode := "8.2.6"; + err.reasonCode := "3.1"; + err.message_ := "Matching ID Refused"; + } else if (errorCode == 127) { /* undefinedError */ + err.subjectCode := "8.8.1"; + err.reasonCode := "5"; + err.message_ := "Undefined Error"; + } + } + } else if (ischosen(resp.getBoundProfilePackageResponse)) { + if (ischosen(resp.getBoundProfilePackageResponse.getBoundProfilePackageError)) { + var integer errorCode := resp.getBoundProfilePackageResponse.getBoundProfilePackageError; + /* Map GetBoundProfilePackage error codes */ + if (errorCode == 1) { /* euiccSignatureInvalid */ + err.subjectCode := "8.1.3"; + err.reasonCode := "3.1"; + err.message_ := "eUICC Signature Invalid"; + } else if (errorCode == 2) { /* confirmationCodeMissing */ + err.subjectCode := "8.2.7"; + err.reasonCode := "3.7"; + err.message_ := "Confirmation Code Missing"; + } else if (errorCode == 3) { /* confirmationCodeRefused */ + err.subjectCode := "8.2.7"; + err.reasonCode := "3.8"; + err.message_ := "Confirmation Code Refused"; + } else if (errorCode == 127) { /* undefinedError */ + err.subjectCode := "8.8.1"; + err.reasonCode := "5"; + err.message_ := "Undefined Error"; + } + } + } + + /* Fallback for undefined or empty errors, tbd */ + if (err.subjectCode == "" or err.reasonCode == "") { + err.subjectCode := "8.8.1"; + err.reasonCode := "5"; + err.message_ := "Undefined Error (Server Internal Error)"; + ext_logInfo("Using fallback error codes for undefined error"); + } + + return err; } private function f_es9p_transceive_success(RemoteProfileProvisioningRequest request) @@ -3055,6 +3244,12 @@ ext_logInfo("=== Step 2: AuthenticateClient ==="); var RemoteProfileProvisioningRequest authClientReq := f_create_authenticate_client_request(); var RemoteProfileProvisioningResponse authClientResp := f_es9p_transceive_success(authClientReq); + + if (not ischosen(authClientResp.authenticateClientResponseEs9.authenticateClientOk)) { + setverdict(fail, "AuthenticateClient did not return success response"); + f_rsp_client_cleanup(); + return; + } var AuthenticateClientOk authClientOk := authClientResp.authenticateClientResponseEs9.authenticateClientOk; ext_logInfo("=== Step 3: CancelSession - " & reason_name & " ==="); @@ -5638,6 +5833,81 @@ setverdict(pass); } +/* ======================================================================== + * ASN.1 Mode Test Variants + * These tests run the same logic as the NIST tests but use pure ASN.1 + * encoding instead of JSON for the ES9+ interface + * ======================================================================== */ + +testcase TC_SM_DP_ES9_InitiateAuthenticationASN1_01_Nominal() runs on MTC_CT { + var smdpp_ConnHdlrPars pars := f_init_pars(); + pars.es9_encoding_mode := ES9_ASN1; + var smdpp_ConnHdlr vc_conn; + f_init(testcasename()); + vc_conn := f_start_handler(refers(f_TC_InitiateAuth_01_Nominal), pars); + vc_conn.done; + setverdict(pass); +} + +testcase TC_SM_DP_ES9_AuthenticateClientASN1_01_Nominal() runs on MTC_CT { + var smdpp_ConnHdlrPars pars := f_init_pars(); + pars.es9_encoding_mode := ES9_ASN1; + var smdpp_ConnHdlr vc_conn; + f_init(testcasename()); + vc_conn := f_start_handler(refers(f_TC_AuthenticateClient_01_Nominal), pars); + vc_conn.done; + setverdict(pass); +} + +testcase TC_SM_DP_ES9_GetBoundProfilePackageASN1_01_Nominal() runs on MTC_CT { + var smdpp_ConnHdlrPars pars := f_init_pars(); + pars.es9_encoding_mode := ES9_ASN1; + var smdpp_ConnHdlr vc_conn; + f_init(testcasename()); + vc_conn := f_start_handler(refers(f_TC_GetBoundProfilePackage_01_Nominal), pars); + vc_conn.done; + setverdict(pass); +} + +testcase TC_SM_DP_ES9_CancelSession_After_AuthenticateClientASN1_01_Nominal() runs on MTC_CT { + var smdpp_ConnHdlrPars pars := f_init_pars(); + pars.es9_encoding_mode := ES9_ASN1; + var smdpp_ConnHdlr vc_conn; + f_init(testcasename()); + vc_conn := f_start_handler(refers(f_TC_CancelSession_After_AuthenticateClient_01_End_User_Rejection), pars); + vc_conn.done; + setverdict(pass); +} + +testcase TC_SM_DP_ES9_HandleNotificationASN1_01_Nominal() runs on MTC_CT { + var smdpp_ConnHdlrPars pars := f_init_pars(); + pars.es9_encoding_mode := ES9_ASN1; + var smdpp_ConnHdlr vc_conn; + f_init(testcasename()); + vc_conn := f_start_handler(refers(f_TC_HandleNotification_01_Nominal), pars); + vc_conn.done; + setverdict(pass); +} + +/* quick comparison */ +testcase TC_ES9_Mode_Comparison() runs on MTC_CT { + var smdpp_ConnHdlrPars pars_json := f_init_pars(); + pars_json.es9_encoding_mode := ES9_JSON; + var smdpp_ConnHdlr vc_json; + f_init(testcasename() & "_JSON"); + vc_json := f_start_handler(refers(f_TC_InitiateAuth_01_Nominal), pars_json); + vc_json.done; + + var smdpp_ConnHdlrPars pars_asn1 := f_init_pars(); + pars_asn1.es9_encoding_mode := ES9_ASN1; + var smdpp_ConnHdlr vc_asn1; + f_init(testcasename() & "_ASN1"); + vc_asn1 := f_start_handler(refers(f_TC_InitiateAuth_01_Nominal), pars_asn1); + vc_asn1.done; + + setverdict(pass); +} + control { execute(TC_rsp_complete_flow()); diff --git a/smdpp/smdpp_Tests_Functions.cc b/smdpp/smdpp_Tests_Functions.cc index 7bd08e3..fb9b504 100644 --- a/smdpp/smdpp_Tests_Functions.cc +++ b/smdpp/smdpp_Tests_Functions.cc @@ -640,4 +640,73 @@ }); } +CHARSTRING ext__RSPClient__sendHttpsPostWithContentType(const INTEGER& clientHandle, const CHARSTRING& endpoint, + const CHARSTRING& body, const INTEGER& port, const CHARSTRING& contentType, INTEGER& statusCode) { + statusCode = INTEGER(0); + + return with_client(clientHandle, "ext__RSPClient__sendHttpsPostWithContentType", CHARSTRING(""), [&](RSPClient* client) { + int httpStatus = 0; + int dstport = static_cast<int>(port); + + std::string response = client->sendHttpsPostWithContentType( + charstring_to_string(endpoint), + charstring_to_string(body), + charstring_to_string(contentType), + httpStatus, + dstport + ); + + statusCode = INTEGER(httpStatus); + return string_to_charstring(response); + }); +} + +OCTETSTRING ext__RSPClient__sendHttpsPostBinary(const INTEGER& clientHandle, const CHARSTRING& endpoint, + const OCTETSTRING& body, const INTEGER& port, const CHARSTRING& contentType, INTEGER& statusCode) { + statusCode = INTEGER(0); + + std::string endpointStr = charstring_to_string(endpoint); + std::string contentTypeStr = charstring_to_string(contentType); + int dstport = static_cast<int>(port); + + LOG_INFO("ext__RSPClient__sendHttpsPostBinary: endpoint=" + endpointStr + + ", port=" + std::to_string(dstport) + + ", contentType=" + contentTypeStr + + ", bodySize=" + std::to_string(body.lengthof())); + + return with_client(clientHandle, "ext__RSPClient__sendHttpsPostBinary", OCTETSTRING(), [&](RSPClient* client) { + int httpStatus = 0; + + std::string binaryBody; + binaryBody.reserve(body.lengthof()); + for (int i = 0; i < body.lengthof(); i++) { + binaryBody.push_back(static_cast<char>(body[i].get_octet())); + } + + LOG_INFO("Calling sendHttpsPostWithContentType..."); + + std::string response = client->sendHttpsPostWithContentType( + endpointStr, + binaryBody, + contentTypeStr, + httpStatus, + dstport + ); + + LOG_INFO("sendHttpsPostWithContentType returned, status=" + std::to_string(httpStatus) + + ", responseSize=" + std::to_string(response.size())); + + if (httpStatus == 0 || response.empty()) { + LOG_ERROR("HTTP request failed with status " + std::to_string(httpStatus)); + statusCode = INTEGER(0); + return OCTETSTRING(); // Return empty octetstring on failure + } + + OCTETSTRING result(response.size(), (const unsigned char*)response.data()); + + statusCode = INTEGER(httpStatus); + return result; + }); +} + } // namespace smdpp__Tests \ No newline at end of file -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/41121?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I1d824931bd6513d2320ba30df0f8193cd8352863 Gerrit-Change-Number: 41121 Gerrit-PatchSet: 1 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de>

5 days, 4 hours

Jump to page:

2025

2024

2023

2022

gerrit-log September 2025