September 2026 - gerrit-log - lists.osmocom.org

[XS] Change in onomondo-eim[master]: crypto_utils: remove already fixed TODO
by laforge 09 Sep '26

09 Sep '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43501?usp=email ) Change subject: crypto_utils: remove already fixed TODO ...................................................................... crypto_utils: remove already fixed TODO The signature check has been fixed some time ago and is in place. For real IoT eUICCs the signature of eUICC packages is checked. Related: SYS#8100 Change-Id: I214cfd5f77c497d421525a91c06b1d99e0b7d6af --- M src/crypto_utils.erl 1 file changed, 0 insertions(+), 3 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved diff --git a/src/crypto_utils.erl b/src/crypto_utils.erl index 7d051a1..cb50415 100644 --- a/src/crypto_utils.erl +++ b/src/crypto_utils.erl @@ -4,9 +4,6 @@ % % Author: Philipp Maier <pmaier(a)sysmocom.de> / sysmocom - s.f.m.c. GmbH -%TODO: This code still lacks the verification of signatures, the reason for this is that it was still not possible to -%verify a signature in practice. - -module(crypto_utils). -export([ -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43501?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I214cfd5f77c497d421525a91c06b1d99e0b7d6af Gerrit-Change-Number: 43501 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[XS] Change in onomondo-eim[master]: onomondo_eim_app: add TODO to improve logger
by laforge 09 Sep '26

09 Sep '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43503?usp=email ) Change subject: onomondo_eim_app: add TODO to improve logger ...................................................................... onomondo_eim_app: add TODO to improve logger Related: SYS#8100 Change-Id: Ia3b35f81d2a1eb0732d55678d553902bb562fd6d --- M src/onomondo_eim_app.erl 1 file changed, 4 insertions(+), 0 deletions(-) Approvals: laforge: Looks good to me, approved Jenkins Builder: Verified diff --git a/src/onomondo_eim_app.erl b/src/onomondo_eim_app.erl index 1d8c73f..07a2ed6 100644 --- a/src/onomondo_eim_app.erl +++ b/src/onomondo_eim_app.erl @@ -98,6 +98,10 @@ start(_Type, _Args) -> {ok, Vsn} = application:get_key(onomondo_eim, vsn), + + % TODO: Improve logging: The current use of log messages and format-strings is very bulky to handle. We should find + % something more effective here. A short explanatory text with the context attached as a map would be much more + % effective than fumbling with string format arguments. logger:notice("eIM! version: ~s~n", [Vsn]), % Startup database -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43503?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: Ia3b35f81d2a1eb0732d55678d553902bb562fd6d Gerrit-Change-Number: 43503 Gerrit-PatchSet: 3 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[S] Change in onomondo-eim[master]: es9p_client: remove unused function
by laforge 09 Sep '26

09 Sep '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43504?usp=email ) Change subject: es9p_client: remove unused function ...................................................................... es9p_client: remove unused function The tryme function was used during development to try out the es9p_client in isolation. We have a proper TTCN3 test harness now, so we no longer need such testcode. It can be removed. Related: SYS#8100 Change-Id: I1dbdec39a60f59a693c241847272a2094672728f --- M src/es9p_client.erl 1 file changed, 1 insertion(+), 28 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved diff --git a/src/es9p_client.erl b/src/es9p_client.erl index 8a901e8..712ee9d 100644 --- a/src/es9p_client.erl +++ b/src/es9p_client.erl @@ -12,7 +12,7 @@ -module(es9p_client). --export([request_json/2, request_asn1/2, tryme/0]). +-export([request_json/2, request_asn1/2]). % Depending on whether SSL is enabled or disabled we get a different HTTP prefix. make_http_prefix() -> @@ -358,30 +358,3 @@ % In any case, this function is currently place holder, since this eIM currently only supports ES9+ JSON bindings % (esipa_asn1_handler currently only calls request_json). Asn1Resp. - -tryme() -> - Req = - {initiateAuthenticationRequest, #{ - euiccChallenge => - <<98, 247, 104, 103, 113, 183, 83, 201, 207, 31, 83, 25, 64, 67, 206, 171>>, - euiccInfo1 => - #{ - euiccCiPKIdListForSigning => - [ - <<245, 65, 114, 189, 249, 138, 149, 214, 92, 190, 184, 138, 56, 161, - 193, 29, 128, 10, 133, 195>>, - <<192, 188, 112, 186, 54, 146, 157, 67, 180, 103, 255, 87, 87, 5, 48, - 229, 122, 184, 252, 216>> - ], - euiccCiPKIdListForVerification => - [ - <<245, 65, 114, 189, 249, 138, 149, 214, 92, 190, 184, 138, 56, 161, - 193, 29, 128, 10, 133, 195>>, - <<192, 188, 112, 186, 54, 146, 157, 67, 180, 103, 255, 87, 87, 5, 48, - 229, 122, 184, 252, 216>> - ], - svn => <<2, 3, 0>> - }, - smdpAddress => <<"127.0.0.1">> - }}, - request_json(Req, <<"127.0.0.1:4430">>). -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43504?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I1dbdec39a60f59a693c241847272a2094672728f Gerrit-Change-Number: 43504 Gerrit-PatchSet: 3 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[XS] Change in onomondo-eim[master]: es9p_client: rephrase TODOs for better understanding
by laforge 09 Sep '26

09 Sep '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43505?usp=email ) Change subject: es9p_client: rephrase TODOs for better understanding ...................................................................... es9p_client: rephrase TODOs for better understanding Related: SYS#8100 Change-Id: I5ac1f84129e3848ab37a806b3408e38e22810a3e --- M src/es9p_client.erl 1 file changed, 4 insertions(+), 2 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved diff --git a/src/es9p_client.erl b/src/es9p_client.erl index 712ee9d..4f79110 100644 --- a/src/es9p_client.erl +++ b/src/es9p_client.erl @@ -54,7 +54,8 @@ }, % construct body from encoded json ReqBody = jiffy:encode(JsonBodyWithHdr, [force_utf8]), - % TODO: actually verify the certificate by providing custom root CA Cert + % TODO: Pass proper CA certificate to hackney, so that the eIM can be sure that the identity of the SM-DP+ is + % properly verfied. At the moment we do not verify anything, which is risky. SslOptions = [{verify, verify_none}], Options = [{ssl_options, SslOptions}, with_body], logger:debug( @@ -109,7 +110,8 @@ ], % construct body from encoded ASN.1 {ok, ReqBody} = 'RSPDefinitions':encode('RemoteProfileProvisioningRequest', Asn1Body), - % TODO: actually verify the certificate by providing custom root CA Cert + % TODO: Pass proper CA certificate to hackney, so that the eIM can be sure that the identity of the SM-DP+ is + % properly verfied. At the moment we do not verify anything, which is risky. SslOptions = [{verify, verify_none}], Options = [{ssl_options, SslOptions}, with_body], logger:debug( -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43505?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I5ac1f84129e3848ab37a806b3408e38e22810a3e Gerrit-Change-Number: 43505 Gerrit-PatchSet: 3 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[S] Change in onomondo-eim[master]: esipa_asn1_handler: Add TODOs to address missing checks
by laforge 09 Sep '26

09 Sep '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43506?usp=email ) Change subject: esipa_asn1_handler: Add TODOs to address missing checks ...................................................................... esipa_asn1_handler: Add TODOs to address missing checks The ASN.1 handler code lacks several checks that are required by SGP.32. Profile downloads will work fine, but we won't catch errors early. Related: SYS#8100 Change-Id: I6174fba0760a0192d59db68a430b10ab7726bcb3 --- M src/esipa_asn1_handler.erl 1 file changed, 28 insertions(+), 4 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved diff --git a/src/esipa_asn1_handler.erl b/src/esipa_asn1_handler.erl index f1be50a..2fe7603 100644 --- a/src/esipa_asn1_handler.erl +++ b/src/esipa_asn1_handler.erl @@ -21,6 +21,10 @@ % initiateAuthenticationRequest. However the field is only missing in case the IPA capability minimizeEsipaBytes is % used. This is an optional feature that this eIM does not support, so we can expect euiccInfo1 to be always present. + % TODO: Popluate smdpAddress from Activation Code if missing: smdpAddress is declared as anan optional field in + % InitiateAuthenticationRequestEsipa. If the field is missing, we can retrieve it from the Activation Code that is + % stored in the download Order (see also SGP.32, section 3.2.3.2, step 8). + % setup ES9+ request message Es9Req = {initiateAuthenticationRequest, EsipaReq}, @@ -31,16 +35,20 @@ EsipaResp = case Es9Resp of {initiateAuthenticationOk, InitAuthOk} -> + % TODO: Verify serverAddress in serverSigned1: In case we ad to extract the smdpAddress from the + % Activation Code we should make sure that smdpAddress and serverAddress are equal. + % TODO: Verify SM-DP+ OID. An Activation Code may contain an SM-DP+ OID. Make sure that this OID + % matches the OID from the serverCertificate (see also SGP.32, section 3.2.3.2, step 10). TransactionId = maps:get(transactionId, InitAuthOk), mnesia_db_work:bind(Pid, TransactionId), % TODO: matchingId and ctxParams1 are not defined in the ES9+ InitiateAuthenticationResponse message. % However in ESipa those fields are optional fields and either one of it should be populated in case an % AC is used (which we do). This means we should populate those fields. The matchingId can be extracted % from the AC, which we have in the Order. If the IPAd supports eimCtxParams1Generation then it should - % be find if we would just add the matchingId field like so: maps:merge(InitAuthOk, #{matchingId => - % FIXME). Otherwise we would have to add a ctxParams1 field and populate it with the matchingId and the - % deviceInfo. The deviceInfo can be retrieved via an eUICC data request. - % (see GSMA SGP.32, section 3.1.2.3). + % be fine if we would just add the matchingId field like so: maps:merge(InitAuthOk, #{matchingId => + % MatchingId}). Otherwise we would have to add a ctxParams1 field and populate it with the matchingId + % and the deviceInfo. The deviceInfo can be retrieved via an eUICC data request. (see also GSMA SGP.32, + % section 3.2.3.2, step 11). InitAuthOkEsipa = #{ transactionId => maps:get(transactionId, InitAuthOk), serverSigned1 => maps:get(serverSigned1, InitAuthOk), @@ -102,6 +110,17 @@ fallbackAllowed => FallbackAllowed } ), + % TODO: Verify profileMetaData in case the IPAd is not able to verify the profileMetaData: At the + % moment we assume that the IPAd is able to verify the profileMetaData, but there may be IPAd + % implementations which cannot verify the profileMetaData (eimProfileMetadataVerification). In those + % cases the eIM is responsible to verify the profileMetaData, which is not implemnted yet (see also + % SGP.32, section 3.2.3.2, step 15 and 19). + % TODO: Implement compatibility Check: At the moment it is the responsibility of the REST API user to + % ensure that eIM and IPAd are compatible. Currently the REST API user must request the IpaCapabilities + % via an eUICC Data Request and know for himself what capability combinations will work with this eIM. + % To simplify this we should automate this process by requesting and caching the IpaCapabilities once, + % so that we the info within reach when we need it (similar to how we cache signPubKey, see also + % mnesia_db_euicc.hrl). AuthenticateClientOkDPEsipa = AuthClntRespEs9#{ profileMetaData => StoreMetadataRequest }, @@ -296,6 +315,11 @@ % an activationCode (option a) It still lacks download triggers via SM-DS (option b) and downloads from % the default SM-DP+ (option c). See also GSMA SGP.32, section 3.2.3.2 ActivationCode = proplists:get_value(<<"activationCode">>, Download), + % TODO: Check the contents of ActivationCode. The eIM should check the provided Activation Code and stop + % the procedure in case the Activation Code is invalid. However, it should also be mentioned that The + % missing check only has a minor impact since an invalid Activation Code will be detected on the IPAd + % side, which will cause the procedure to stop as well. (see also SGP.32, section 3.2.3.2, step 1 and + % step 4). {profileDownloadTriggerRequest, #{ profileDownloadData => {activationCode, ActivationCode}, eimTransactionId => EimTransactionId -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43506?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I6174fba0760a0192d59db68a430b10ab7726bcb3 Gerrit-Change-Number: 43506 Gerrit-PatchSet: 3 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[M] Change in onomondo-eim[master]: es9p_client: make asn.1 encoder/decoder functions more flexible
by laforge 09 Sep '26

09 Sep '26

Attention is currently required from: dexter. laforge has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43428?usp=email ) Change subject: es9p_client: make asn.1 encoder/decoder functions more flexible ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43428?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: Idfb280d3863998dd0387c65c478d9c765eadf106 Gerrit-Change-Number: 43428 Gerrit-PatchSet: 3 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Wed, 09 Sep 2026 10:21:15 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in onomondo-eim[master]: es9p_client: use SGP.32 specific AuthenticateServerResponse type
by laforge 09 Sep '26

09 Sep '26

Attention is currently required from: dexter. laforge has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43429?usp=email ) Change subject: es9p_client: use SGP.32 specific AuthenticateServerResponse type ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43429?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: Ia550804d1d73f9704aa3135819926c7615379d1a Gerrit-Change-Number: 43429 Gerrit-PatchSet: 3 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Wed, 09 Sep 2026 10:21:14 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in onomondo-eim[master]: esipa_asn1_handler: set ecallIndication and fallbackAllowed
by laforge 09 Sep '26

09 Sep '26

Attention is currently required from: dexter. laforge has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43430?usp=email ) Change subject: esipa_asn1_handler: set ecallIndication and fallbackAllowed ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43430?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I4b7673007018d32d062e238d811f655d332f7195 Gerrit-Change-Number: 43430 Gerrit-PatchSet: 3 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Wed, 09 Sep 2026 10:21:12 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in pysim[master]: tests: stop test_log from leaking the print callback
by laforge 09 Sep '26

09 Sep '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/43539?usp=email ) Change subject: tests: stop test_log from leaking the print callback ...................................................................... tests: stop test_log from leaking the print callback PySimLogger.setup() installs a process-global print callback. PySimLogger_Test sets one, a helper that asserts the message equals a global expected_message, and never removes it, so from the moment test_log runs, every PySimLogger message emitted anywhere in the process is checked against whatever string that global happens to hold. Fortunately unittest discovery runs modules in sorted order, and today the PySimLogger users that log during tests all sort before test_log, so this only breaks as soon as I try to add tests, just like anything else breaks as soon as I try to use it. Change-Id: I481e2c443fe0f412380b0f1acf6da5971ffca147 --- M tests/unittests/test_log.py 1 file changed, 11 insertions(+), 0 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved dexter: Looks good to me, but someone else must approve diff --git a/tests/unittests/test_log.py b/tests/unittests/test_log.py index a8e38dd..ac651ae 100755 --- a/tests/unittests/test_log.py +++ b/tests/unittests/test_log.py @@ -37,6 +37,17 @@ class PySimLogger_Test(unittest.TestCase): + def setUp(self): + # PySimLogger.setup() is global, so a print callback left installed here fires for + # every PySimLogger message emitted by any test module that runs later in the same process + # ... where it asserts against a stale 'expected_message' and fails a test that has nothing + # to do with logging. Great fun! + # Restore before each test. + saved = (PySimLogger.print_callback, PySimLogger.verbose) + def _restore(): + PySimLogger.print_callback, PySimLogger.verbose = saved + self.addCleanup(_restore) + def __test_01_safe_defaults_one(self, callback, message:str): # When log messages are sent to an unconfigured PySimLogger class, we expect the unmodified message being # logged to stdout, just as if it were printed via a normal print() statement. -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43539?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I481e2c443fe0f412380b0f1acf6da5971ffca147 Gerrit-Change-Number: 43539 Gerrit-PatchSet: 1 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[S] Change in pysim[master]: tests: stop test_log from leaking the print callback
by laforge 09 Sep '26

09 Sep '26

Attention is currently required from: Hoernchen. laforge has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/pysim/+/43539?usp=email ) Change subject: tests: stop test_log from leaking the print callback ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43539?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I481e2c443fe0f412380b0f1acf6da5971ffca147 Gerrit-Change-Number: 43539 Gerrit-PatchSet: 1 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Comment-Date: Wed, 09 Sep 2026 10:20:22 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

2026

2025

2024

2023

2022

gerrit-log September 2026