August 2026 - gerrit-log - lists.osmocom.org

[M] Change in pysim[master]: osmo-smdpp: derive the Profile Metadata from the Profile
by Johannes Waigel 12 Aug '26

12 Aug '26

Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/43205?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder Change subject: osmo-smdpp: derive the Profile Metadata from the Profile ...................................................................... osmo-smdpp: derive the Profile Metadata from the Profile Only the ICCID came from the Profile. The SPN was hardcoded, the profileName was the MatchingID, and the profileClass was always 'operational'. SGP.22 section 2.4.5.3 does not allow that class for a Profile that uses the USIM test algorithm. Add ProfileMetadata.from_pes() to read these fields from the Profile. If the Profile has no EF.SPN, the SPN is now empty. An LPA shows a Profile that is marked 'test' only in Device Test Mode. The code also tested the MatchingID twice. Remove the second test. Change-Id: Ie24dd5ac0ef541c1899dd923a9db568209bbfa62 --- M osmo-smdpp.py M pySim/esim/es8p.py M tests/unittests/test_esim_saip.py 3 files changed, 72 insertions(+), 16 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/05/43205/2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43205?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ie24dd5ac0ef541c1899dd923a9db568209bbfa62 Gerrit-Change-Number: 43205 Gerrit-PatchSet: 2 Gerrit-Owner: Johannes Waigel <johannes(a)waigel.me> Gerrit-Reviewer: Jenkins Builder

1 0

[S] Change in pysim[master]: osmo-smdpp: derive the Profile Metadata from the Profile
by Johannes Waigel 11 Aug '26

11 Aug '26

Johannes Waigel has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/43205?usp=email ) Change subject: osmo-smdpp: derive the Profile Metadata from the Profile ...................................................................... osmo-smdpp: derive the Profile Metadata from the Profile The metadata was invented: a hardcoded SPN, the MatchingID as profileName, and always 'operational' as profileClass. Test Profiles were therefore sent as operational ones, which SGP.22 section 2.4.5.3 forbids. Add ProfileMetadata.from_pes() to read these fields from the Profile. An LPA now shows Test Profiles only in Device Test Mode. Change-Id: Ie24dd5ac0ef541c1899dd923a9db568209bbfa62 --- M osmo-smdpp.py M pySim/esim/es8p.py 2 files changed, 35 insertions(+), 5 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/05/43205/1 diff --git a/osmo-smdpp.py b/osmo-smdpp.py index 2a8e478..0346afc 100755 --- a/osmo-smdpp.py +++ b/osmo-smdpp.py @@ -629,7 +629,7 @@ # If ctxParams1 contains a ctxParamsForCommonAuthentication data object, the SM-DP+ Shall [...] # TODO: We really do a very simplistic job here, this needs to be properly implemented later, # considering all the various cases, profile state, etc. - iccid_str = None + pes = None if euiccSigned1['ctxParams1'][0] == 'ctxParamsForCommonAuthentication': cpca = euiccSigned1['ctxParams1'][1] matchingId = cpca.get('matchingId', None) @@ -647,15 +647,14 @@ ss.matchingId = matchingId with open(path, 'rb') as f: pes = saip.ProfileElementSequence.from_der(f.read()) - iccid_str = b2h(pes.get_pe_for_type('header').decoded['iccid']) else: # there's currently no other option in the ctxParams1 choice, so this cannot happen raise ApiError('1.3.1', '2.2', 'ctxParams1 missing mandatory ctxParamsForCommonAuthentication') - # FIXME: we actually want to perform the profile binding herr, and read the profile metadata from the profile + # FIXME: we actually want to perform the profile binding here # Put together profileMetadata + _bin - ss.profileMetadata = ProfileMetadata(iccid_bin=h2b(swap_nibbles(iccid_str)), spn="OsmocomSPN", profile_name=matchingId) + ss.profileMetadata = ProfileMetadata.from_pes(pes, profile_name=matchingId) # enable notifications for all operations for event in ['enable', 'disable', 'delete']: ss.profileMetadata.add_notification(event, self.server_hostname) diff --git a/pySim/esim/es8p.py b/pySim/esim/es8p.py index 6926cae..48ecfdd 100644 --- a/pySim/esim/es8p.py +++ b/pySim/esim/es8p.py @@ -17,13 +17,14 @@ from typing import Dict, List, Optional from cryptography.hazmat.primitives.asymmetric import ec -from osmocom.utils import b2h, h2b +from osmocom.utils import b2h, h2b, swap_nibbles from osmocom.tlv import bertlv_encode_tag, bertlv_encode_len, bertlv_parse_one_rawtag from osmocom.tlv import bertlv_return_one_rawtlv import pySim.esim.rsp as rsp from pySim.esim.bsp import BspInstance from pySim.esim import PMO +from pySim.ts_51_011 import EF_SPN import logging logger = logging.getLogger(__name__) @@ -73,6 +74,18 @@ return rsp.asn1.encode('ReplaceSessionKeysRequest', rsk) +def spn_from_pes(pes) -> Optional[str]: + """Read the Service Provider Name from EF.SPN of the given Profile, or None if it has none.""" + for pe_type in ['usim', 'gsm-access']: + pe = pes.get_pe_for_type(pe_type) + if not pe or 'ef-spn' not in getattr(pe, 'files', {}): + continue + content = pe.files['ef-spn'].file_content_from_tuples(pe.decoded['ef-spn']) + if content: + return EF_SPN().decode_hex(b2h(content))['spn'] + return None + + class ProfileMetadata: """Representation of Profile metadata. Right now only the mandatory bits are supported, but in general this should follow the StoreMetadataRequest of SGP.22 5.5.3""" @@ -85,6 +98,24 @@ self.icon_type = None self.notifications = [] + @classmethod + def from_pes(cls, pes, profile_name: Optional[str] = None) -> 'ProfileMetadata': + """Derive Profile metadata from the Profile itself, rather than from a separate source that + can disagree with it. profile_name is only used if the Profile header has no profileType.""" + header = pes.get_pe_for_type('header').decoded + + # SGP.22 Section 2.4.5.3: a Test Profile SHALL have its Profile Class set to 'test'. A + # Profile requiring the USIM test algorithm is one; that is condition 3 of that section. + if 'usim-test-algorithm' in header.get('eUICC-Mandatory-services', {}): + profile_class = 'test' + else: + profile_class = 'operational' + + return cls(iccid_bin=h2b(swap_nibbles(b2h(header['iccid']))), + spn=spn_from_pes(pes) or '', + profile_name=header.get('profileType', profile_name) or '', + profile_class=profile_class) + def set_icon(self, is_png: bool, icon_data: bytes): """Set the icon that is part of the metadata.""" if len(icon_data) > 1024: -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43205?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ie24dd5ac0ef541c1899dd923a9db568209bbfa62 Gerrit-Change-Number: 43205 Gerrit-PatchSet: 1 Gerrit-Owner: Johannes Waigel <johannes(a)waigel.me>

1 0

[XS] Change in simtrace2[master]: cosmetic: fix typo in comment
by lynxis lazus 11 Aug '26

11 Aug '26

lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/simtrace2/+/43204?usp=email ) Change subject: cosmetic: fix typo in comment ...................................................................... cosmetic: fix typo in comment Change-Id: I7df27ebf9137ca60d6d7cd45dcf1be2d766c4f44 --- M firmware/libcommon/include/simtrace_prot.h 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/simtrace2 refs/changes/04/43204/1 diff --git a/firmware/libcommon/include/simtrace_prot.h b/firmware/libcommon/include/simtrace_prot.h index 50042a0..ffcd061 100644 --- a/firmware/libcommon/include/simtrace_prot.h +++ b/firmware/libcommon/include/simtrace_prot.h @@ -54,7 +54,7 @@ SIMTRACE_MSGT_BD_CEMU_STATUS, /* Request / Confirm emulated card insert */ SIMTRACE_MSGT_DT_CEMU_CARDINSERT, - /* TPDU Data received from phomne */ + /* TPDU Data received from phone */ SIMTRACE_MSGT_DO_CEMU_RX_DATA, /* Indicate PTS request from phone */ SIMTRACE_MSGT_DO_CEMU_PTS, -- To view, visit https://gerrit.osmocom.org/c/simtrace2/+/43204?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: simtrace2 Gerrit-Branch: master Gerrit-Change-Id: I7df27ebf9137ca60d6d7cd45dcf1be2d766c4f44 Gerrit-Change-Number: 43204 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>

1 0

[M] Change in libosmo-sigtran[master]: TCAP: implement fallback routing when no TCAP ASP can be found.
by lynxis lazus 11 Aug '26

11 Aug '26

Attention is currently required from: daniel, laforge, lynxis lazus. Hello Jenkins Builder, daniel, laforge, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43008?usp=email to look at the new patch set (#8). The following approvals got outdated and were removed: Verified-1 by Jenkins Builder Change subject: TCAP: implement fallback routing when no TCAP ASP can be found. ...................................................................... TCAP: implement fallback routing when no TCAP ASP can be found. If a TCAP message from an ongoing session can't be routed by either the TCAP session cache or by the destination TID to a known ASP, allow to route the packet to a different destination. Change-Id: I3e4e634b38a1845c2ce62a3805ff91a530520d88 --- M src/ss7_as.c M src/ss7_as.h M src/ss7_as_vty.c M src/tcap_as_loadshare.c M tests/vty/osmo_stp_test_tcap.vty 5 files changed, 78 insertions(+), 12 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/08/43008/8 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43008?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I3e4e634b38a1845c2ce62a3805ff91a530520d88 Gerrit-Change-Number: 43008 Gerrit-PatchSet: 8 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: daniel <dwillmann(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>

1 0

[L] Change in pysim[master]: GP: LOAD/STORE DATA chunk size from SCP overhead
by laforge 11 Aug '26

11 Aug '26

Attention is currently required from: Hoernchen, dexter. laforge has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/pysim/+/43172?usp=email ) Change subject: GP: LOAD/STORE DATA chunk size from SCP overhead ...................................................................... Patch Set 7: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43172?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 Gerrit-Change-Number: 43172 Gerrit-PatchSet: 7 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Tue, 11 Aug 2026 19:27:37 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmocore[master]: gsm29205: fix out-of-bounds read in osmo_dec_gcr()
by fixeria 11 Aug '26

11 Aug '26

fixeria has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43190?usp=email ) Change subject: gsm29205: fix out-of-bounds read in osmo_dec_gcr() ...................................................................... gsm29205: fix out-of-bounds read in osmo_dec_gcr() The length check at the top of the function only verified that the input buffer was at least 13 bytes, which is the minimum needed for .net_len == 3. For .net_len == 4 or 5 (also valid per the length check further down), the actual minimum required length is 10 + net_len, i.e. 14 or 15 bytes. With a shorter buffer, the subsequent osmo_load16be(), elem[] access and memcpy() read past the end of the caller-supplied buffer. elem/len are taken directly from a received BSSMAP Global Call Reference IE (gsm0808_utils.c), so this is reachable with network-supplied input. Add a length check depending on the actual .net_len, and a test. Change-Id: I6855d6c810c2b4274ccfd7bc861405f9b4e09343 Fixes: OS#7044 --- M src/gsm/gsm29205.c M tests/gsm29205/gsm29205_test.c M tests/gsm29205/gsm29205_test.ok 3 files changed, 35 insertions(+), 0 deletions(-) Approvals: Jenkins Builder: Verified fixeria: Looks good to me, approved laforge: Looks good to me, but someone else must approve diff --git a/src/gsm/gsm29205.c b/src/gsm/gsm29205.c index 8fed020..8fe91f7 100644 --- a/src/gsm/gsm29205.c +++ b/src/gsm/gsm29205.c @@ -73,6 +73,8 @@ gcr->net_len = elem[0]; if (gcr->net_len < 3 || gcr->net_len > 5) return -EINVAL; + if (len < 10 + gcr->net_len) + return -EBADMSG; memcpy(gcr->net, elem + parsed, gcr->net_len); /* +1 for ignored Node ID length field */ diff --git a/tests/gsm29205/gsm29205_test.c b/tests/gsm29205/gsm29205_test.c index 6598f89..f020aee 100644 --- a/tests/gsm29205/gsm29205_test.c +++ b/tests/gsm29205/gsm29205_test.c @@ -95,6 +95,34 @@ msgb_free(msg); } +/* osmo_dec_gcr() must reject buffers that are too short for the announced + * .net_len (3..5), not just shorter than the 13-byte minimum for + * .net_len == 3. Otherwise it reads past the end of 'elem'. */ +static void test_gcr_dec_short_buf(void) +{ + static const uint8_t res[] = { + 0x05, /* .net_len */ + 0x51, 0x52, 0x53, 0x54, 0x55, /* .net */ + 0x02, /* .node length */ + 0xde, 0xad, /* .node */ + 0x05, /* length of Call. Ref. */ + 0x41, 0x42, 0x43, 0x44, 0x45 /* .cr - Call. Ref. */ + }; + struct osmo_gcr_parsed p; + uint8_t len; + int rc; + + printf("Testing Global Call Reference decoder against short buffers...\n"); + + /* net_len == 5 requires 15 bytes, feed it 13 and 14 + * the full buffer must still decode successfully */ + for (len = 13; len <= ARRAY_SIZE(res); len++) { + rc = osmo_dec_gcr(&p, res, len); + printf("\tosmo_dec_gcr(len=%u) -> %s\n", + len, rc == len ? "OK" : "FAIL"); + } +} + int main(int argc, char **argv) { osmo_init_logging2(talloc_named_const(NULL, 0, "gsm29205 test"), NULL); @@ -102,6 +130,7 @@ printf("Testing 3GPP TS 29.205 routines...\n"); test_gcr(); + test_gcr_dec_short_buf(); printf("Done.\n"); diff --git a/tests/gsm29205/gsm29205_test.ok b/tests/gsm29205/gsm29205_test.ok index bddd88a..cc9b7d2 100644 --- a/tests/gsm29205/gsm29205_test.ok +++ b/tests/gsm29205/gsm29205_test.ok @@ -2,4 +2,8 @@ Testing Global Call Reference encoder... 13 bytes added: OK decoded 13 bytes: OK +Testing Global Call Reference decoder against short buffers... + osmo_dec_gcr(len=13) -> FAIL + osmo_dec_gcr(len=14) -> FAIL + osmo_dec_gcr(len=15) -> OK Done. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43190?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I6855d6c810c2b4274ccfd7bc861405f9b4e09343 Gerrit-Change-Number: 43190 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: gsm29205: fix out-of-bounds read in osmo_dec_gcr()
by fixeria 11 Aug '26

11 Aug '26

Attention is currently required from: pespin. fixeria has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43190?usp=email ) Change subject: gsm29205: fix out-of-bounds read in osmo_dec_gcr() ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43190?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I6855d6c810c2b4274ccfd7bc861405f9b4e09343 Gerrit-Change-Number: 43190 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Tue, 11 Aug 2026 19:20:49 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[L] Change in pysim[master]: GP: mixed PSK TLS PUT KEY (Amendment B Table 3-13)
by Hoernchen 11 Aug '26

11 Aug '26

Attention is currently required from: Hoernchen, dexter, fixeria, laforge, lynxis lazus. Hello Jenkins Builder, dexter, fixeria, laforge, lynxis lazus, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/43136?usp=email to look at the new patch set (#6). The following approvals got outdated and were removed: Code-Review+1 by fixeria, Verified+1 by Jenkins Builder Change subject: GP: mixed PSK TLS PUT KEY (Amendment B Table 3-13) ...................................................................... GP: mixed PSK TLS PUT KEY (Amendment B Table 3-13) AES PSK + DES DEK for scp81, tested with sysmoEUICC1 C2T Change-Id: I480a9d049a052aa5ae54fe6e2771dba44e89434d --- M pySim/global_platform/__init__.py M tests/unittests/test_globalplatform.py 2 files changed, 237 insertions(+), 19 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/36/43136/6 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43136?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I480a9d049a052aa5ae54fe6e2771dba44e89434d Gerrit-Change-Number: 43136 Gerrit-PatchSet: 6 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: dexter <pmaier(a)sysmocom.de>

1 0

[M] Change in pysim[master]: GP: mixed PSK TLS PUT KEY (Amendment B Table 3-13)
by fixeria 11 Aug '26

11 Aug '26

Attention is currently required from: Hoernchen, dexter, laforge, lynxis lazus. fixeria has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/pysim/+/43136?usp=email ) Change subject: GP: mixed PSK TLS PUT KEY (Amendment B Table 3-13) ...................................................................... Patch Set 5: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43136?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I480a9d049a052aa5ae54fe6e2771dba44e89434d Gerrit-Change-Number: 43136 Gerrit-PatchSet: 5 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Tue, 11 Aug 2026 18:32:07 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[L] Change in pysim[master]: GP: LOAD/STORE DATA chunk size from SCP overhead
by Hoernchen 11 Aug '26

11 Aug '26

Attention is currently required from: Hoernchen, dexter, laforge. Hello Jenkins Builder, dexter, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/43172?usp=email to look at the new patch set (#6). The following approvals got outdated and were removed: Code-Review+1 by laforge, Verified-1 by Jenkins Builder Change subject: GP: LOAD/STORE DATA chunk size from SCP overhead ...................................................................... GP: LOAD/STORE DATA chunk size from SCP overhead SCP.overhead was so far set at construction time (SCP02: 8, SCP03: s_mode), so the C-MAC length only. Unfortunately sec lvl >= 3 pads the data field to the cipher block size before encryption, so the real worst-case overhead is larger, scc.max_cmd_len (255 - overhead) was too big, and ADF_SD.load() used a hardcoded chunk_len=240. Real world issue with a 286 byte CAP + SCP02 + sec lvl 3: - 240-byte LOAD block is padded to 248, - encrypted - gets 8 byte C-MAC appended -> Lc = 256 That dies with a weird "ValueError: bytes must be in range(0, 256)". The only "fix" for that was to downgrade the seclevel. STORE DATA has the same overflow with large max_cmd_len (247 + padding + MAC = 256 as well). Therefore the overhead must be properly calculated from the sec level. While at it adjust the error in case I missed something to get a more useful ValueError. Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 --- M pySim/global_platform/__init__.py M pySim/global_platform/scp.py M tests/unittests/test_globalplatform.py 3 files changed, 290 insertions(+), 12 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/72/43172/6 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43172?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 Gerrit-Change-Number: 43172 Gerrit-PatchSet: 6 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de>

1 0