Attention is currently required from: dexter.
fixeria has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/42874?usp=email )
Change subject: es9p_client: section 6.3.2.1, rename euiccCiPKIdToBeused to match SGP.32 V.1.2
......................................................................
Patch Set 1: Code-Review+1
--
To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/42874?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: onomondo-eim
Gerrit-Branch: master
Gerrit-Change-Id: I44c60a2f0d1129093ea67908d2eed167643a4a87
Gerrit-Change-Number: 42874
Gerrit-PatchSet: 1
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Attention: dexter <pmaier(a)sysmocom.de>
Gerrit-Comment-Date: Wed, 24 Jun 2026 14:24:17 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Attention is currently required from: dexter, jolly.
fixeria has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/42869?usp=email )
Change subject: asn1/SGP32Definitions: upgrade ASN.1 spec to V.1.2
......................................................................
Patch Set 2:
(1 comment)
Patchset:
PS1:
> The trailing white-spaces are part of the specification
Feel free to create `.checkpatch.conf` with `--exclude ^asn1/.*\.asn1$`.
--
To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/42869?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: onomondo-eim
Gerrit-Branch: master
Gerrit-Change-Id: Id4d217296f43846aa39f5dc7076465e2dab72a7c
Gerrit-Change-Number: 42869
Gerrit-PatchSet: 2
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: jolly <andreas(a)eversberg.eu>
Gerrit-CC: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Attention: jolly <andreas(a)eversberg.eu>
Gerrit-Attention: dexter <pmaier(a)sysmocom.de>
Gerrit-Comment-Date: Wed, 24 Jun 2026 14:16:40 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>
fixeria has submitted this change. ( https://gerrit.osmocom.org/c/osmo-pcap/+/42849?usp=email )
Change subject: tls: fix broken certificate hostname verification
......................................................................
tls: fix broken certificate hostname verification
verify_cert_cb() retrieved the gnutls session pointer and passed it to
gnutls_certificate_verify_peers3() as the expected hostname. But the
session pointer is set to the osmo_tls_session struct (it is needed by
cert_callback()), not a hostname string. Hostname matching was
therefore performed against raw struct bytes, rendering verification
meaningless and potentially reading out of bounds, even when
"tls verify-cert" was enabled.
Store the configured hostname in struct osmo_tls_session and have
verify_cert_cb() read it from there. Also drop the stray
gnutls_certificate_verify_peers3() call in the client setup: it ran
before any handshake (so there were no peer certificates yet) and its
result was ignored; the real verification happens via the registered
callback during the handshake.
Change-Id: If64950a698bfcfbf556a37ef1be3e68abc124384
AI-Assisted: yes (Claude)
---
M include/osmo-pcap/osmo_tls.h
M src/osmo_tls.c
2 files changed, 18 insertions(+), 4 deletions(-)
Approvals:
pespin: Looks good to me, but someone else must approve
fixeria: Looks good to me, approved
Jenkins Builder: Verified
laforge: Looks good to me, but someone else must approve
diff --git a/include/osmo-pcap/osmo_tls.h b/include/osmo-pcap/osmo_tls.h
index 716604e..6afbe71 100644
--- a/include/osmo-pcap/osmo_tls.h
+++ b/include/osmo-pcap/osmo_tls.h
@@ -38,6 +38,9 @@
bool need_resend;
gnutls_session_t session;
+ /* expected peer hostname for certificate verification (may be NULL) */
+ const char *tls_hostname;
+
/* any credentials */
bool anon_alloc;
gnutls_anon_client_credentials_t anon_cred;
diff --git a/src/osmo_tls.c b/src/osmo_tls.c
index f06f50e..d3ed45e 100644
--- a/src/osmo_tls.c
+++ b/src/osmo_tls.c
@@ -139,11 +139,15 @@
static int verify_cert_cb(gnutls_session_t session)
{
+ const struct osmo_tls_session *sess;
const char *hostname;
unsigned int status;
int ret;
- hostname = gnutls_session_get_ptr(session);
+ /* The session ptr is the osmo_tls_session (see gnutls_session_set_ptr());
+ * the expected hostname is stored inside it. */
+ sess = gnutls_session_get_ptr(session);
+ hostname = sess ? sess->tls_hostname : NULL;
ret = gnutls_certificate_verify_peers3(session,
hostname, &status);
if (ret != 0)
@@ -448,7 +452,6 @@
{
struct osmo_tls_session *sess = &client->tls_session;
struct osmo_wqueue *wq = &client->wqueue;
- unsigned int status;
int rc;
gnutls_global_set_log_level(client->tls_log_level);
@@ -518,14 +521,19 @@
gnutls_certificate_set_retrieve_function2(sess->cert_cred, cert_callback);
/* set the hostname if we have one */
- if (client->tls_hostname)
+ if (client->tls_hostname) {
gnutls_server_name_set(sess->session, GNUTLS_NAME_DNS,
client->tls_hostname, strlen(client->tls_hostname));
+ /* Remember it so verify_cert_cb() can match it against the peer
+ * certificate during the handshake. */
+ sess->tls_hostname = talloc_strdup(client, client->tls_hostname);
+ }
/* do the verification */
if (client->tls_verify) {
+ /* The actual verification happens during the handshake via the
+ * registered callback; there are no peer certificates yet here. */
gnutls_certificate_set_verify_function(sess->cert_cred, verify_cert_cb);
- gnutls_certificate_verify_peers3(sess->session, client->tls_hostname, &status);
} else
LOGP(DTLS, LOGL_NOTICE, "Not going to validate certs as configured\n");
@@ -545,6 +553,9 @@
gnutls_deinit(session->session);
+ talloc_free((void *)session->tls_hostname);
+ session->tls_hostname = NULL;
+
release_keys(session);
if (session->anon_alloc)
--
To view, visit https://gerrit.osmocom.org/c/osmo-pcap/+/42849?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-pcap
Gerrit-Branch: master
Gerrit-Change-Id: If64950a698bfcfbf556a37ef1be3e68abc124384
Gerrit-Change-Number: 42849
Gerrit-PatchSet: 4
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/onomondo-eim/+/42877?usp=email )
Change subject: esipa_asn1_handler: re-align to SGP.32 section Section 2.11.2 and Section 5.14.6
......................................................................
esipa_asn1_handler: re-align to SGP.32 section Section 2.11.2 and Section 5.14.6
Section 2.11.2: eIM package result (EuiccPackageResult case) is now concatenated with PendingNotificationList instead of RetrieveNotificationsListResponse
Section 5.14.6: ESipa.ProvideEimPackageResult: Significant change in parameters
Change-Id: Ic0872edefc1844166943c60528557c6b7a6602ce
Related: SYS#8100
---
M src/esipa_asn1_handler.erl
1 file changed, 9 insertions(+), 24 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/77/42877/1
diff --git a/src/esipa_asn1_handler.erl b/src/esipa_asn1_handler.erl
index ae9bfa9..63afdb2 100644
--- a/src/esipa_asn1_handler.erl
+++ b/src/esipa_asn1_handler.erl
@@ -363,7 +363,8 @@
{getEimPackageResponse, EsipaResp};
%GSMA SGP.32, section 6.3.2.7
handle_asn1(Pid, {provideEimPackageResult, EsipaReq}) ->
- case EsipaReq of
+ EimPackageResult = maps:get(eimPackageResult, EsipaReq),
+ case EimPackageResult of
{euiccPackageResult, EuiccPackageResult} ->
ok = esipa_asn1_handler_utils:handle_euiccPackageResult(
Pid, EuiccPackageResult, EsipaReq
@@ -375,25 +376,8 @@
Pid, EuiccPackageResult, EsipaReq
),
% then forward the notifications in the included notification list
- RetrieveNotificationsListResponse = maps:get(notificationList, EPRAndNotifications),
- case RetrieveNotificationsListResponse of
- {notificationList, NotificationList} ->
- handle_asn1_notificationList(Pid, NotificationList);
- {notificationsListResultError, NotificationsListResultError} ->
- logger:notice(
- "Ipad is reporting a problem to retrieve notifications,~nNotificationsListResultError=~p,~nPid=~p~n",
- [NotificationsListResultError, Pid]
- );
- UnhandledObject ->
- % TODO: The RetrieveNotificationsListResponse may also contain other objects, in particular
- % euiccPackageResultList and notificationAndEprList, which again includes either a
- % notificationList or an euiccPackageResultList The spec is a bit unclear on how exactly and when
- % those data objects shall be used, so we ignore them for now and display a notice in the log
- logger:notice(
- "RetrieveNotificationsListResponse with unhandled object,~UnhandledObject=~p,~nPid=~p~n",
- [UnhandledObject, Pid]
- )
- end;
+ NotificationList = maps:get(notificationList, EPRAndNotifications),
+ handle_asn1_notificationList(Pid, NotificationList);
{ipaEuiccDataResponse, IpaEuiccDataResponse} ->
% drive-by store the eUICC public key so that we can use it later to sign PSMOs or eCOs
{EidValue, _, _} = mnesia_db:work_pickup(Pid, none),
@@ -401,17 +385,18 @@
IpaEuiccDataResponse, EidValue
),
Outcome = esipa_rest_utils:ipaEuiccDataResponse_to_outcome(IpaEuiccDataResponse),
- mnesia_db:work_finish(Pid, Outcome, EsipaReq);
+ ok = mnesia_db:work_finish(Pid, Outcome, EsipaReq);
{profileDownloadTriggerResult, _} ->
% The profileDownloadTriggerResult is sent by the IPAd in case a profile was downloaded directly from an
% RSP server, bypassing the eIM (see also SGP.32, section 3.2.3.1). This is a feature that this eIM does
% not support.
throw("unsuppported message type \"profileDownloadTriggerResult\"");
- {eimPackageError, EimPackageError} ->
- Outcome = [{[{eimPackageError, EimPackageError}]}],
+ {eimPackageResultResponseError, EimPackageResultResponseError} ->
+ EimPackageResultErrorCode = maps:get(eimPackageResultErrorCode, EimPackageResultResponseError),
+ Outcome = [{[{eimPackageError, EimPackageResultErrorCode}]}],
ok = mnesia_db:work_finish(Pid, Outcome, EsipaReq)
end,
- {provideEimPackageResultResponse, undefined};
+ {provideEimPackageResultResponse, {emptyResponse, #{}}};
%Unsupported request
handle_asn1(Pid, Request) ->
mnesia_db:work_finish(Pid, [{[{procedureError, abortedOrder}]}], unsupported),
--
To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/42877?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: onomondo-eim
Gerrit-Branch: master
Gerrit-Change-Id: Ic0872edefc1844166943c60528557c6b7a6602ce
Gerrit-Change-Number: 42877
Gerrit-PatchSet: 1
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>