September 2026 - gerrit-log - lists.osmocom.org

[S] Change in onomondo-eim[master]: esipa_asn1_handler: Add TODOs to address missing checks
by Jenkins Builder 02 Sep '26

02 Sep '26

Jenkins Builder has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43506?usp=email ) Change subject: esipa_asn1_handler: Add TODOs to address missing checks ...................................................................... Patch Set 1: (1 comment) File src/esipa_asn1_handler.erl: Robot Comment from checkpatch (run ID ): https://gerrit.osmocom.org/c/onomondo-eim/+/43506/comment/54c79254_904a2678… : PS1, Line 122: % so that we the info withing reach when we need it (similar to how we cache signPubKey, see also 'withing' may be misspelled - perhaps 'within'? -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43506?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I6174fba0760a0192d59db68a430b10ab7726bcb3 Gerrit-Change-Number: 43506 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Comment-Date: Wed, 02 Sep 2026 11:32:06 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[M] Change in libosmo-sigtran[master]: xUA: Validate multiple Routing Context in SNM messages
by osmith 02 Sep '26

02 Sep '26

Attention is currently required from: fixeria, laforge, pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43500?usp=email ) Change subject: xUA: Validate multiple Routing Context in SNM messages ...................................................................... Patch Set 1: (1 comment) Commit Message: https://gerrit.osmocom.org/c/libosmo-sigtran/+/43500/comment/70cad85f_bf03c… : PS1, Line 14: work. > It's being tracked in a ticket, and it now becomes obvious in the code that only the first one is be […] Acknowledged -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43500?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ic3a9dc13d128a0c5777981616923ee1856210b21 Gerrit-Change-Number: 43500 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Wed, 02 Sep 2026 11:30:18 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: osmith <osmith(a)sysmocom.de> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in onomondo-eim[master]: crypto_utils: remove already fixed TODO
by dexter 02 Sep '26

02 Sep '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43501?usp=email ) Change subject: crypto_utils: remove already fixed TODO ...................................................................... crypto_utils: remove already fixed TODO The signature check has been fixed some time ago and is in place. For real IoT eUICCs the signature of eUICC packages is checked. Related: SYS#8100 Change-Id: I214cfd5f77c497d421525a91c06b1d99e0b7d6af --- M src/crypto_utils.erl 1 file changed, 0 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/01/43501/1 diff --git a/src/crypto_utils.erl b/src/crypto_utils.erl index 7d051a1..cb50415 100644 --- a/src/crypto_utils.erl +++ b/src/crypto_utils.erl @@ -4,9 +4,6 @@ % % Author: Philipp Maier <pmaier(a)sysmocom.de> / sysmocom - s.f.m.c. GmbH -%TODO: This code still lacks the verification of signatures, the reason for this is that it was still not possible to -%verify a signature in practice. - -module(crypto_utils). -export([ -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43501?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I214cfd5f77c497d421525a91c06b1d99e0b7d6af Gerrit-Change-Number: 43501 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in onomondo-eim[master]: crypto_utils: extend TODO for better understanding
by dexter 02 Sep '26

02 Sep '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43502?usp=email ) Change subject: crypto_utils: extend TODO for better understanding ...................................................................... crypto_utils: extend TODO for better understanding Related: SYS#8100 Change-Id: I411a3b4216b3c0d707d571b7a0c178e001931139 --- M src/crypto_utils.erl 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/02/43502/1 diff --git a/src/crypto_utils.erl b/src/crypto_utils.erl index cb50415..c3cd1b1 100644 --- a/src/crypto_utils.erl +++ b/src/crypto_utils.erl @@ -31,7 +31,7 @@ %Encode the association token as BER TLV IE enc_association_token(AssociationToken) -> - %TODO: replace this with a proper ASN.1 encoding function. + %TODO: Define an ASN.1 type for the AssociationToken and use it to get rid of this half-baked encder function. AssociationTokenBinary = utils:integer_to_bytes(AssociationToken), AssociationTokenLength = utils:integer_to_bytes(byte_size(AssociationTokenBinary)), utils:join_binary_list([<<132>>, AssociationTokenLength, AssociationTokenBinary]). -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43502?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I411a3b4216b3c0d707d571b7a0c178e001931139 Gerrit-Change-Number: 43502 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in onomondo-eim[master]: onomondo_eim_app: add TODO to improve logger
by dexter 02 Sep '26

02 Sep '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43503?usp=email ) Change subject: onomondo_eim_app: add TODO to improve logger ...................................................................... onomondo_eim_app: add TODO to improve logger Related: SYS#8100 Change-Id: Ia3b35f81d2a1eb0732d55678d553902bb562fd6d --- M src/onomondo_eim_app.erl 1 file changed, 4 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/03/43503/1 diff --git a/src/onomondo_eim_app.erl b/src/onomondo_eim_app.erl index 1d8c73f..07a2ed6 100644 --- a/src/onomondo_eim_app.erl +++ b/src/onomondo_eim_app.erl @@ -98,6 +98,10 @@ start(_Type, _Args) -> {ok, Vsn} = application:get_key(onomondo_eim, vsn), + + % TODO: Improve logging: The current use of log messages and format-strings is very bulky to handle. We should find + % something more effective here. A short explanatory text with the context attached as a map would be much more + % effective than fumbling with string format arguments. logger:notice("eIM! version: ~s~n", [Vsn]), % Startup database -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43503?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: Ia3b35f81d2a1eb0732d55678d553902bb562fd6d Gerrit-Change-Number: 43503 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in onomondo-eim[master]: es9p_client: remove unused function
by dexter 02 Sep '26

02 Sep '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43504?usp=email ) Change subject: es9p_client: remove unused function ...................................................................... es9p_client: remove unused function The tryme function was used during development to try out the es9p_client in isolation. We have a proper TTCN3 test harness now, so we no longer need such testcode. It can be removed. Related: SYS#8100 Change-Id: I1dbdec39a60f59a693c241847272a2094672728f --- M src/es9p_client.erl 1 file changed, 0 insertions(+), 27 deletions(-) git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/04/43504/1 diff --git a/src/es9p_client.erl b/src/es9p_client.erl index 8a901e8..7a7fefc 100644 --- a/src/es9p_client.erl +++ b/src/es9p_client.erl @@ -358,30 +358,3 @@ % In any case, this function is currently place holder, since this eIM currently only supports ES9+ JSON bindings % (esipa_asn1_handler currently only calls request_json). Asn1Resp. - -tryme() -> - Req = - {initiateAuthenticationRequest, #{ - euiccChallenge => - <<98, 247, 104, 103, 113, 183, 83, 201, 207, 31, 83, 25, 64, 67, 206, 171>>, - euiccInfo1 => - #{ - euiccCiPKIdListForSigning => - [ - <<245, 65, 114, 189, 249, 138, 149, 214, 92, 190, 184, 138, 56, 161, - 193, 29, 128, 10, 133, 195>>, - <<192, 188, 112, 186, 54, 146, 157, 67, 180, 103, 255, 87, 87, 5, 48, - 229, 122, 184, 252, 216>> - ], - euiccCiPKIdListForVerification => - [ - <<245, 65, 114, 189, 249, 138, 149, 214, 92, 190, 184, 138, 56, 161, - 193, 29, 128, 10, 133, 195>>, - <<192, 188, 112, 186, 54, 146, 157, 67, 180, 103, 255, 87, 87, 5, 48, - 229, 122, 184, 252, 216>> - ], - svn => <<2, 3, 0>> - }, - smdpAddress => <<"127.0.0.1">> - }}, - request_json(Req, <<"127.0.0.1:4430">>). -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43504?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I1dbdec39a60f59a693c241847272a2094672728f Gerrit-Change-Number: 43504 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in onomondo-eim[master]: es9p_client: rephrase TODOs for better understanding
by dexter 02 Sep '26

02 Sep '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43505?usp=email ) Change subject: es9p_client: rephrase TODOs for better understanding ...................................................................... es9p_client: rephrase TODOs for better understanding Related: SYS#8100 Change-Id: I5ac1f84129e3848ab37a806b3408e38e22810a3e --- M src/es9p_client.erl 1 file changed, 4 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/05/43505/1 diff --git a/src/es9p_client.erl b/src/es9p_client.erl index 7a7fefc..6ab1d58 100644 --- a/src/es9p_client.erl +++ b/src/es9p_client.erl @@ -54,7 +54,8 @@ }, % construct body from encoded json ReqBody = jiffy:encode(JsonBodyWithHdr, [force_utf8]), - % TODO: actually verify the certificate by providing custom root CA Cert + % TODO: Pass proper CA certificate to hackney, so that the eIM can be sure that the identity of the SM-DP+ is + % properly verfied. At the moment we do not verify anything, which is risky. SslOptions = [{verify, verify_none}], Options = [{ssl_options, SslOptions}, with_body], logger:debug( @@ -109,7 +110,8 @@ ], % construct body from encoded ASN.1 {ok, ReqBody} = 'RSPDefinitions':encode('RemoteProfileProvisioningRequest', Asn1Body), - % TODO: actually verify the certificate by providing custom root CA Cert + % TODO: Pass proper CA certificate to hackney, so that the eIM can be sure that the identity of the SM-DP+ is + % properly verfied. At the moment we do not verify anything, which is risky. SslOptions = [{verify, verify_none}], Options = [{ssl_options, SslOptions}, with_body], logger:debug( -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43505?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I5ac1f84129e3848ab37a806b3408e38e22810a3e Gerrit-Change-Number: 43505 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in onomondo-eim[master]: esipa_asn1_handler: Add TODOs to address missing checks
by dexter 02 Sep '26

02 Sep '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43506?usp=email ) Change subject: esipa_asn1_handler: Add TODOs to address missing checks ...................................................................... esipa_asn1_handler: Add TODOs to address missing checks The ASN.1 handler code lacks several checks that are required by SGP.32. Profile downloads will work fine, but we won't catch errors early. Related: SYS#8100 Change-Id: I6174fba0760a0192d59db68a430b10ab7726bcb3 --- M src/esipa_asn1_handler.erl 1 file changed, 28 insertions(+), 4 deletions(-) git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/06/43506/1 diff --git a/src/esipa_asn1_handler.erl b/src/esipa_asn1_handler.erl index f1be50a..0fc72e7 100644 --- a/src/esipa_asn1_handler.erl +++ b/src/esipa_asn1_handler.erl @@ -21,6 +21,10 @@ % initiateAuthenticationRequest. However the field is only missing in case the IPA capability minimizeEsipaBytes is % used. This is an optional feature that this eIM does not support, so we can expect euiccInfo1 to be always present. + % TODO: Popluate smdpAddress from Activation Code if missing: smdpAddress is declared as anan optional field in + % InitiateAuthenticationRequestEsipa. If the field is missing, we can retrieve it from the Activation Code that is + % stored in the download Order (see also SGP.32, section 3.2.3.2, step 8). + % setup ES9+ request message Es9Req = {initiateAuthenticationRequest, EsipaReq}, @@ -31,16 +35,20 @@ EsipaResp = case Es9Resp of {initiateAuthenticationOk, InitAuthOk} -> + % TODO: Verify serverAddress in serverSigned1: In case we ad to extract the smdpAddress from the + % Activation Code we should make sure that smdpAddress and serverAddress are equal. + % TODO: Verify SM-DP+ OID. An Activation Code may contain an SM-DP+ OID. Make sure that this OID + % matches the OID from the serverCertificate (see also SGP.32, section 3.2.3.2, step 10). TransactionId = maps:get(transactionId, InitAuthOk), mnesia_db_work:bind(Pid, TransactionId), % TODO: matchingId and ctxParams1 are not defined in the ES9+ InitiateAuthenticationResponse message. % However in ESipa those fields are optional fields and either one of it should be populated in case an % AC is used (which we do). This means we should populate those fields. The matchingId can be extracted % from the AC, which we have in the Order. If the IPAd supports eimCtxParams1Generation then it should - % be find if we would just add the matchingId field like so: maps:merge(InitAuthOk, #{matchingId => - % FIXME). Otherwise we would have to add a ctxParams1 field and populate it with the matchingId and the - % deviceInfo. The deviceInfo can be retrieved via an eUICC data request. - % (see GSMA SGP.32, section 3.1.2.3). + % be fine if we would just add the matchingId field like so: maps:merge(InitAuthOk, #{matchingId => + % MatchingId}). Otherwise we would have to add a ctxParams1 field and populate it with the matchingId + % and the deviceInfo. The deviceInfo can be retrieved via an eUICC data request. (see also GSMA SGP.32, + % section 3.2.3.2, step 11). InitAuthOkEsipa = #{ transactionId => maps:get(transactionId, InitAuthOk), serverSigned1 => maps:get(serverSigned1, InitAuthOk), @@ -102,6 +110,17 @@ fallbackAllowed => FallbackAllowed } ), + % TODO: Verify profileMetaData in case the IPAd is not able to verify the profileMetaData: At the + % moment we assume that the IPAd is able to verify the profileMetaData, but there may be IPAd + % implementations which cannot verify the profileMetaData (eimProfileMetadataVerification). In those + % cases the eIM is responsible to verify the profileMetaData, which is not implemnted yet (see also + % SGP.32, section 3.2.3.2, step 15 and 19). + % TODO: Implement compatibility Check: At the moment it is the responsibility of the REST API user to + % ensure that eIM and IPAd are compatible. Currently the REST API user must request the IpaCapabilities + % via an eUICC Data Request and know for himself what capability combinations will work with this eIM. + % To simplify this we should automate this process by requesting and caching the IpaCapabilities once, + % so that we the info withing reach when we need it (similar to how we cache signPubKey, see also + % mnesia_db_euicc.hrl). AuthenticateClientOkDPEsipa = AuthClntRespEs9#{ profileMetaData => StoreMetadataRequest }, @@ -296,6 +315,11 @@ % an activationCode (option a) It still lacks download triggers via SM-DS (option b) and downloads from % the default SM-DP+ (option c). See also GSMA SGP.32, section 3.2.3.2 ActivationCode = proplists:get_value(<<"activationCode">>, Download), + % TODO: Check the contents of ActivationCode. The eIM should check the provided Activation Code and stop + % the procedure in case the Activation Code is invalid. However, it should also be mentioned that The + % missing check only has a minor impact since an invalid Activation Code will be detected on the IPAd + % side, which will cause the procedure to stop as well. (see also SGP.32, section 3.2.3.2, step 1 and + % step 4). {profileDownloadTriggerRequest, #{ profileDownloadData => {activationCode, ActivationCode}, eimTransactionId => EimTransactionId -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43506?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I6174fba0760a0192d59db68a430b10ab7726bcb3 Gerrit-Change-Number: 43506 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in onomondo-eim[master]: esipa_rest_utils: add spec reference to existing TODO
by dexter 02 Sep '26

02 Sep '26

Attention is currently required from: dexter. Hello Jenkins Builder, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/onomondo-eim/+/43450?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder The change is no longer submittable: Verified is unsatisfied now. Change subject: esipa_rest_utils: add spec reference to existing TODO ...................................................................... esipa_rest_utils: add spec reference to existing TODO Related: SYS#8100 Change-Id: I33a1b1a03c67632b4a10a043928e0a265730b7e2 --- M src/esipa_rest_utils.erl 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/50/43450/2 -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43450?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I33a1b1a03c67632b4a10a043928e0a265730b7e2 Gerrit-Change-Number: 43450 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in onomondo-eim[master]: esipa_asn_handler: add TODO about missing TLS / SNI support
by dexter 02 Sep '26

02 Sep '26

Attention is currently required from: dexter, laforge. Hello Jenkins Builder, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/onomondo-eim/+/43451?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Code-Review+2 by laforge, Verified+1 by Jenkins Builder The change is no longer submittable: Code-Review and Verified are unsatisfied now. Change subject: esipa_asn_handler: add TODO about missing TLS / SNI support ...................................................................... esipa_asn_handler: add TODO about missing TLS / SNI support SGP.32 requires an eIM to support SNI, however since this eIM has no multi tenant support at all, it may not benefit much from this feature at the moment. However, according to the cowboy documentation SNI is supported and the effort to integrate it is manageable. Let's postpone this until we add multi tenant support. Related: SYS#8100 Change-Id: Iaebe29563259ae5fabeb9825839a03062d7fc24d --- M src/onomondo_eim_app.erl 1 file changed, 3 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/51/43451/2 -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43451?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: Iaebe29563259ae5fabeb9825839a03062d7fc24d Gerrit-Change-Number: 43451 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log September 2026