September 2026 - gerrit-log - lists.osmocom.org

[M] Change in pysim[master]: GP: fix kcb for non block aligned keys
by laforge 09 Sep '26

09 Sep '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/43200?usp=email ) Change subject: GP: fix kcb for non block aligned keys ...................................................................... GP: fix kcb for non block aligned keys how encrypt_key() pads a kcv: len(key) % blocksize bytes what it should do to actually do it right: blocksize - len(key) % blocksize so the plaintext handed to the cipher was only block aligned by luck as long as the key length happened to be a multiple of half the block size. And of course decrypt_key() did not invert encrypt_key() at all, the clear text length of GP CardSpec v2.3 Table 11-70 precedes the ENCRYPTED kcv, but it was parsed out of the DECRYPTED data, and the length byte itself was fed to the cipher along with the cryptogram. Fix this up with a helper and tests so it is actually usable. Change-Id: I02b4f2ed948c31e1741e40f0226fb49757fa2570 --- M pySim/global_platform/scp.py M tests/unittests/test_globalplatform.py 2 files changed, 49 insertions(+), 6 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, but someone else must approve dexter: Looks good to me, approved diff --git a/pySim/global_platform/scp.py b/pySim/global_platform/scp.py index a5fcf51..fd56113 100644 --- a/pySim/global_platform/scp.py +++ b/pySim/global_platform/scp.py @@ -215,11 +215,20 @@ def gen_ext_auth_apdu(self, security_level: int = 0x01) -> bytes: pass + def pad_to_blocksize(self, data: bytes) -> bytes: + """Right pad the data with zero bytes to a multiple of the DEK cipher block size.""" + if len(data) % self.sk.blocksize: + # not '+=' which would mutate the callers bytearray in place.. + data = data + b'\x00' * (self.sk.blocksize - len(data) % self.sk.blocksize) + return data + def encrypt_key(self, key: bytes) -> bytes: """Encrypt a key with the DEK.""" - num_pad = len(key) % self.sk.blocksize - if num_pad: - return bertlv_encode_len(len(key)) + self.dek_encrypt(key + b'\x00'*num_pad) + if len(key) % self.sk.blocksize: + # The kcv is right padded before encryption and the kcb + # is formatted as described in Table 11-70: preceded by the actual length of the + # clear text kcv. + return bertlv_encode_len(len(key)) + self.dek_encrypt(self.pad_to_blocksize(key)) return self.dek_encrypt(key) def decrypt_key(self, encrypted_key:bytes) -> bytes: @@ -232,9 +241,8 @@ # Block provides the actual length of the key component value, which allows recovering the # clear-text key component value after decryption of the encrypted key component value and removal # of padding bytes. - decrypted = self.dek_decrypt(encrypted_key) - key_len, remainder = bertlv_parse_len(decrypted) - return remainder[:key_len] + key_len, remainder = bertlv_parse_len(encrypted_key) + return self.dek_decrypt(remainder)[:key_len] else: # If the length of the Key Component Block is a multiple of the block size of the encryption # algorithm (i.e. 8 bytes for DES, 16 bytes for AES), then it shall be assumed that no padding diff --git a/tests/unittests/test_globalplatform.py b/tests/unittests/test_globalplatform.py index 8698470..576407d 100644 --- a/tests/unittests/test_globalplatform.py +++ b/tests/unittests/test_globalplatform.py @@ -283,6 +283,41 @@ # FIXME: test auth with random (0x60) vs pseudo-random (0x70) challenge +class KeyComponentBlock_Test(unittest.TestCase): + """Tests for the kcb of GP CardSpec v2.3 + - Table 11-70 kcv that required padding, preceded by its clear-text length + - Table 11-71 no padding required""" + + def setUp(self): + # SCP02 (3DES DEK, 8 byte blocks), same vectors as SCP02_Test + self.scp02 = SCP02(card_keys=ck_3des_70) + self.scp02.gen_init_update_apdu(host_challenge=h2b('40A62C37FA6304F8')) + self.scp02.parse_init_update_resp(h2b('00000000000000000000700200016B4524ABEE7CF32EA3838BC148F3')) + self.scp02.gen_ext_auth_apdu() + # SCP03 (AES DEK, 16 byte blocks), same vectors as SCP03_Test_AES128_11 + self.scp03 = SCP03(card_keys=KEYSET_AES128) + self.scp03.gen_init_update_apdu(h2b('b13e5f938fc108c4')) + self.scp03.parse_init_update_resp(h2b('000000000000000000003003703eb51047495b249f66c484c1d2ef1948000002')) + self.scp03.gen_ext_auth_apdu(0x11) + + def test_encrypt_decrypt_key(self): + for scp in (self.scp02, self.scp03): + bs = scp.sk.blocksize + for keylen in range(1, 3 * bs + 1): + with self.subTest(scp=type(scp).__name__, keylen=keylen): + key = bytes(range(keylen)) + kcb = scp.encrypt_key(key) + if keylen % bs: + # Table 11-70: <length of clear key component> || <encrypted padded value> + self.assertEqual(kcb[0], keylen) + self.assertEqual((len(kcb) - 1) % bs, 0) + self.assertEqual(len(kcb) - 1, keylen + (bs - keylen % bs)) + else: + # Table 11-71: only the encrypted key component value + self.assertEqual(len(kcb), keylen) + self.assertEqual(scp.decrypt_key(kcb), key) + + class SCP03_KCV_Test(unittest.TestCase): def test_kcv(self): self.assertEqual(compute_kcv('aes', KEYSET_AES128.enc), h2b('C35280')) -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43200?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I02b4f2ed948c31e1741e40f0226fb49757fa2570 Gerrit-Change-Number: 43200 Gerrit-PatchSet: 6 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[L] Change in pysim[master]: GP: LOAD/STORE DATA chunk size from SCP overhead
by laforge 09 Sep '26

09 Sep '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/43172?usp=email ) ( 7 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: GP: LOAD/STORE DATA chunk size from SCP overhead ...................................................................... GP: LOAD/STORE DATA chunk size from SCP overhead SCP.overhead was so far set at construction time (SCP02: 8, SCP03: s_mode), so the C-MAC length only. Unfortunately sec lvl >= 3 pads the data field to the cipher block size before encryption, so the real worst-case overhead is larger, scc.max_cmd_len (255 - overhead) was too big, and ADF_SD.load() used a hardcoded chunk_len=240. Real world issue with a 286 byte CAP + SCP02 + sec lvl 3: - 240-byte LOAD block is padded to 248, - encrypted - gets 8 byte C-MAC appended -> Lc = 256 That dies with a weird "ValueError: bytes must be in range(0, 256)". The only "fix" for that was to downgrade the seclevel. STORE DATA has the same overflow with large max_cmd_len (247 + padding + MAC = 256 as well). Therefore the overhead must be properly calculated from the sec level. While at it adjust the error in case I missed something to get a more useful ValueError. Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 --- M pySim/global_platform/__init__.py M pySim/global_platform/scp.py M tests/unittests/test_globalplatform.py 3 files changed, 290 insertions(+), 12 deletions(-) Approvals: dexter: Looks good to me, approved Jenkins Builder: Verified laforge: Looks good to me, but someone else must approve diff --git a/pySim/global_platform/__init__.py b/pySim/global_platform/__init__.py index 7e2e97e..a450561 100644 --- a/pySim/global_platform/__init__.py +++ b/pySim/global_platform/__init__.py @@ -707,6 +707,14 @@ """Perform the GlobalPlatform PUT KEY command in order to store a new key on the card. See GlobalPlatform CardSpecification v2.3 Section 11.8 for details.""" key_data = self.build_put_key_data(kvn, keys, self._cmd.lchan.scc.scp) + # Lc of Table 11-64 is a single byte, while LOAD or STORE DATA splits we can't: + # 11.8.2.3.3 splits a key at component boundaries -> not helping here + max_cmd_len = self._cmd.lchan.scc.max_cmd_len + if len(key_data) > max_cmd_len: + raise ValueError('key data field of %u bytes exceeds the maximum command length of %u ' + '(limited by the overhead of the current secure channel); use fewer ' + 'keys per command, a single key component that large needs STORE DATA' % + (len(key_data), max_cmd_len)) hdr = "80D8%02x%02x%02x" % (old_kvn, kid, len(key_data)) data, _sw = self._cmd.lchan.scc.send_apdu_checksw(hdr + b2h(key_data) + "00") return data @@ -886,23 +894,32 @@ load_parser_from_grp.add_argument('--from-hex', type=is_hexstr, help='load from hex string') load_parser_from_grp.add_argument('--from-file', type=argparse.FileType('rb', 0), help='load from binary file') load_parser_from_grp.add_argument('--from-cap-file', type=argparse.FileType('rb', 0), help='load from JAVA-card CAP file') + load_parser.add_argument('--chunk-len', type=auto_uint8, default=None, + help='Block size for the LOAD command; default: as large as the current secure channel overhead permits, at most 240') @cmd2.with_argparser(load_parser) def do_load(self, opts): """Perform a GlobalPlatform LOAD command. (We currently only support loading without DAP and without ciphering.)""" if opts.from_hex is not None: - self.load(h2b(opts.from_hex)) + self.load(h2b(opts.from_hex), opts.chunk_len) elif opts.from_file is not None: - self.load(opts.from_file.read()) + self.load(opts.from_file.read(), opts.chunk_len) elif opts.from_cap_file is not None: cap = CapFile(opts.from_cap_file) - self.load(cap.get_loadfile()) + self.load(cap.get_loadfile(), opts.chunk_len) else: raise ValueError('load source not specified!') - def load(self, contents:bytes, chunk_len:int = 240): - # TODO:tune chunk_len based on the overhead of the used SCP? + def load(self, contents:bytes, chunk_len:Optional[int] = None): + # scc.max_cmd_len knows the overhead the currently active SCP + # 240 is the old default, keep it for now. + max_chunk_len = self._cmd.lchan.scc.max_cmd_len + if chunk_len is None: + chunk_len = min(240, max_chunk_len) + elif not 1 <= chunk_len <= max_chunk_len: + raise ValueError('chunk_len must be in range 1..%u (limited by the overhead of the current secure channel)' % + max_chunk_len) # build TLV according to GPC_SPE_034 section 11.6.2.3 / Table 11-58 for unencrypted case remainder = b'\xC4' + bertlv_encode_len(len(contents)) + contents # transfer this in various chunks to the card @@ -941,6 +958,8 @@ install_cap_parser_inst_prm_grp.add_argument('--install-parameters-stk', type=is_hexstr, default=None, help='Load Parameters (ETSI TS 102 226, section 8.2.1.3.2.1)') + install_cap_parser.add_argument('--chunk-len', type=auto_uint8, default=None, + help='Block size for the LOAD command; default: as large as the current secure channel overhead permits, at most 240') @cmd2.with_argparser(install_cap_parser) def do_install_cap(self, opts): @@ -979,7 +998,7 @@ self._cmd.poutput("step #1: install for load...") self.do_install_for_load("--load-file-aid %s --security-domain-aid %s" % (load_file_aid, security_domain_aid)) self._cmd.poutput("step #2: load...") - self.load(load_file) + self.load(load_file, opts.chunk_len) self._cmd.poutput("step #3: install_for_install (and make selectable)...") self.do_install_for_install("--load-file-aid %s --module-aid %s --application-aid %s --install-parameters %s --make-selectable" % (load_file_aid, module_aid, application_aid, install_parameters)) diff --git a/pySim/global_platform/scp.py b/pySim/global_platform/scp.py index fd56113..9a64c53 100644 --- a/pySim/global_platform/scp.py +++ b/pySim/global_platform/scp.py @@ -182,6 +182,29 @@ """Should we perform R-ENC?""" return self.security_level & 0x20 + @property + @abc.abstractmethod + def mac_len(self) -> int: + """Length of the appended C-MAC, to be provided by derived class.""" + + @property + def overhead(self) -> int: + """Worst-case len that wrapping a command APDU adds to its data field at the + current sec level is (255 - overhead), C-MAC + C-DECRYPTION encryption padding.""" + if not self.do_cmac: + return 0 + if not self.do_cenc: + return self.mac_len + # see Secure Channel Protocol '03' Card Specification v2.3 - Amendment D v1.1.2 + # which defers to GPCS v2.3 Section B.2 which then defers to + # NIST SP 800-38B for encryption and points out that + # the padding is, as expected, just the usual padding from NIST SP 800-38A + # C-DECRYPTION pads with ('80'+['00'...] at least 1 byte) up to + # the cipher block size + C-MAC on top -> largest usable data field + # is one byte less than the largest block-size multiple within 255 - mac_len. + bs = self.sk.blocksize + return 255 - ((255 - self.mac_len) // bs * bs - 1) + def __str__(self) -> str: return "%s[%02x]" % (self.__class__.__name__, self.security_level) @@ -268,10 +291,8 @@ # Key Version Number 0x70 is a non-spec special-case of sysmoISIM-SJA2/SJA5 and possibly more sysmocom products # Key Version Number 0x01 is a non-spec special-case of sysmoUSIM-SJS1 kvn_ranges = [[0x01, 0x01], [0x20, 0x2f], [0x70, 0x70]] - - def __init__(self, *args, **kwargs): - self.overhead = 8 - super().__init__(*args, **kwargs) + # C-MAC (Single DES + final 3DES, B.1.2.2) is always one full DES block + mac_len = 8 def dek_encrypt(self, plaintext:bytes) -> bytes: # See also GPC section B.1.1.2, E.4.7, and E.4.1 @@ -346,10 +367,16 @@ # CMAC on modified APDU mlc = lc + 8 clac = cla | CLA_SM + if mlc >= 256: + raise ValueError('Modified Lc (%u) would exceed maximum when appending 8 bytes of mac' % mlc) mac = self.sk.calc_mac_1des(bytes([clac]) + apdu[1:4] + bytes([mlc]) + data) if self.do_cenc: + padded_data = pad80(data, 8) + if len(padded_data) + 8 >= 256: + raise ValueError('Modified Lc (%u) would exceed maximum when appending padding and mac' % + (len(padded_data) + 8)) k = DES3.new(self.sk.enc, DES.MODE_CBC, b'\x00'*8) - data = k.encrypt(pad80(data, 8)) + data = k.encrypt(padded_data) lc = len(data) lc += 8 @@ -485,9 +512,13 @@ def __init__(self, *args, **kwargs): self.s_mode = kwargs.pop('s_mode', 8) - self.overhead = self.s_mode super().__init__(*args, **kwargs) + @property + def mac_len(self) -> int: + # C-MAC truncated to 8 in S8 or 16 bytes in S16 mode + return self.s_mode + def dek_encrypt(self, plaintext:bytes) -> bytes: cipher = AES.new(self.card_keys.dek, AES.MODE_CBC, b'\x00'*16) return cipher.encrypt(plaintext) diff --git a/tests/unittests/test_globalplatform.py b/tests/unittests/test_globalplatform.py index 1c98dab..78a195e 100644 --- a/tests/unittests/test_globalplatform.py +++ b/tests/unittests/test_globalplatform.py @@ -18,6 +18,7 @@ import unittest import logging import hashlib +from types import SimpleNamespace from osmocom.utils import b2h, h2b from osmocom.tlv import bertlv_encode_len @@ -477,6 +478,58 @@ self.assertEqual(b2h(field), '8511' '10' + b2h(self.PSK_CLEAR) + '03' + b2h(self.PSK_KCV)) +class PutKey_Length_Test(unittest.TestCase): + """Tests for the length of the PUT KEY command APDU. Lc of GP CardSpec v2.3 Table 11-64 is a + single byte, so an oversized key data field cannot be sent.""" + + class PutKeyOnly(ADF_SD.AddlShellCommands): + """ADF_SD.AddlShellCommands with a canned scc to drive put_key()""" + def __init__(self, scp=None, max_cmd_len=255): + super().__init__() + self.sent = [] + self.scc = SimpleNamespace(scp=scp, max_cmd_len=max_cmd_len, + send_apdu_checksw=lambda pdu: (self.sent.append(pdu), ('', '9000'))[1]) + + @property + def _cmd(self): + return SimpleNamespace(lchan=SimpleNamespace(scc=self.scc)) + + # KVN, key type, two byte BER length of the key component block, KCV length; KCV suppressed + FRAMING = 1 + 1 + 2 + 1 + + @staticmethod + def key(nbytes: int): + return [{'key_type': 'rsa_modulus_n', 'clear_key': bytes(nbytes), 'kcv': b''}] + + def test_lc_matches_data_field(self): + # largest key component block that still fits without a secure channel + sd = self.PutKeyOnly() + sd.put_key(0, 0x40, 1, self.key(255 - self.FRAMING)) + apdu = sd.sent[0] + self.assertEqual(apdu[:8], '80D80001') + lc = int(apdu[8:10], 16) + self.assertEqual(lc, 255) # Lc ... + self.assertEqual(len(apdu[10:-2]) // 2, lc) # ... and it matches the actual data field + + def test_oversized_key_data_raises(self): + # real world fat example: RSA-2048 modulus does not fit, led to 3 nibble Lc 106, + # which silently shifted and broke the whole APDU by half a byte. + sd = self.PutKeyOnly() + with self.assertRaises(ValueError) as ctx: + sd.put_key(0, 0x40, 1, self.key(256)) + self.assertIn('262', str(ctx.exception)) + self.assertIn('255', str(ctx.exception)) + self.assertEqual(sd.sent, []) # nothing was sent to the card + + def test_secure_channel_overhead_lowers_the_limit(self): + # scc.max_cmd_len shrinks by the C-MAC + encryption padding of active SCP + sd = self.PutKeyOnly(max_cmd_len=239) + sd.put_key(0, 0x40, 1, self.key(239 - self.FRAMING)) + self.assertEqual(int(sd.sent[0][8:10], 16), 239) + with self.assertRaises(ValueError): + sd.put_key(0, 0x40, 1, self.key(239 - self.FRAMING + 1)) + + class Install_param_Test(unittest.TestCase): def test_gen_install_parameters(self): load_parameters = gen_install_parameters(256, 256, '010001001505000000000000000000000000') @@ -485,5 +538,180 @@ load_parameters = gen_install_parameters() self.assertEqual(load_parameters, 'c900') +class SCP_Overhead_Test(unittest.TestCase): + """SCP.overhead varies according to the current security level: + C-MAC + at level >= 3 the worst-case padding! + """ + + def _scp02(self, security_level): + scp = SCP02(card_keys=ck_3des_70) + scp.sk = Scp02SessionKeys(0x0001, ck_3des_70) + scp.security_level = security_level + return scp + + def _scp03(self, security_level, s_mode=8): + scp = SCP03(card_keys=KEYSET_AES128, s_mode=s_mode) + scp.sk = Scp03SessionKeys(KEYSET_AES128, b'\x00' * s_mode, b'\x11' * s_mode) + scp.security_level = security_level + return scp + + def test_scp02(self): + self.assertEqual(self._scp02(0x00).overhead, 0) # no wrapping at all + self.assertEqual(self._scp02(0x01).overhead, 8) # C-MAC + self.assertEqual(self._scp02(0x03).overhead, 16) # C-MAC + C-DEC: pad80 to 8, largest fit 239 + + def test_scp03_s8(self): + self.assertEqual(self._scp03(0x00).overhead, 0) + self.assertEqual(self._scp03(0x01).overhead, 8) + self.assertEqual(self._scp03(0x03).overhead, 16) # pad80 to 16 within 247 -> 240, minus pad byte + self.assertEqual(self._scp03(0x33).overhead, 16) # R-MAC/R-ENC add no *command* overhead + + def test_scp03_s16(self): + self.assertEqual(self._scp03(0x01, s_mode=16).overhead, 16) + self.assertEqual(self._scp03(0x03, s_mode=16).overhead, 32) # pad80 to 16 within 239 -> 224, minus pad byte + + +class SCP_Lc_Limit_Test_Base(unittest.TestCase): + """Test wrap_cmd_apdu() boundary handling: data of (255 - overhead) must produce Lc <= 255 else ValueError""" + + def _load_apdu(self, data_len): + return h2b('80E80000') + bytes([data_len]) + b'\xa5' * data_len + + def _check_boundary(self, scp): + fits = 255 - scp.overhead + wrapped = scp.wrap_cmd_apdu(self._load_apdu(fits)) + self.assertLessEqual(wrapped[4], 255) + self.assertEqual(len(wrapped), 5 + wrapped[4]) # case #3: header + Lc bytes, no Le + with self.assertRaises(ValueError) as ctx: + scp.wrap_cmd_apdu(self._load_apdu(fits + 1)) + self.assertIn('Lc', str(ctx.exception)) + + +class SCP02_Lc_Limit_Test(SCP_Lc_Limit_Test_Base): + """Same session vectors as SCP02_Auth_Test""" + + def setUp(self): + self.scp02 = SCP02(card_keys=ck_3des_70) + self.scp02.gen_init_update_apdu(host_challenge=h2b('40A62C37FA6304F8')) + self.scp02.parse_init_update_resp(h2b('00000000000000000000700200016B4524ABEE7CF32EA3838BC148F3')) + self.scp02.gen_ext_auth_apdu() + + def test_cmac_only(self): + self.scp02.security_level = 0x01 + self._check_boundary(self.scp02) # 247 fits, 248 raises + + def test_cmac_cdec(self): + self.scp02.security_level = 0x03 + self._check_boundary(self.scp02) # 239 fits (-> Lc 248), 240 raises (would be 256) + + def test_cmac_cdec_wrapped_lc(self): + # my actual failing case: 240 bytes at level 3 + self.scp02.security_level = 0x03 + wrapped = self.scp02.wrap_cmd_apdu(self._load_apdu(239)) + self.assertEqual(wrapped[4], 248) # 239 -> pad80 -> 240 ciphertext + 8 mac + + +class SCP03_Lc_Limit_Test(SCP_Lc_Limit_Test_Base): + """Session keys derived directly""" + + def _scp03(self, security_level, s_mode): + scp = SCP03(card_keys=KEYSET_AES128, s_mode=s_mode) + scp.sk = Scp03SessionKeys(KEYSET_AES128, b'\x00' * s_mode, b'\x11' * s_mode) + scp.security_level = security_level + return scp + + def test_s8_cmac_only(self): + self._check_boundary(self._scp03(0x01, 8)) # 247 fits, 248 raises + + def test_s8_cmac_cdec(self): + self._check_boundary(self._scp03(0x03, 8)) # 239 fits, 240 raises + + def test_s16_cmac_only(self): + self._check_boundary(self._scp03(0x01, 16)) # 239 fits, 240 raises + + def test_s16_cmac_cdec(self): + self._check_boundary(self._scp03(0x03, 16)) # 223 fits, 224 raises + + +class _FakeSccForLoad: + """mock lchan.scc: records LOAD APDUs, optionally wrapping them through a real SCP + instance first where the Lc overflow used to blow up""" + + def __init__(self, max_cmd_len=255, scp=None): + self.max_cmd_len = max_cmd_len + self.scp = scp + self.sent = [] + self.wrapped = [] + + def send_apdu_checksw(self, apdu, sw='9000'): + self.sent.append(apdu.lower()) + if self.scp: + self.wrapped.append(self.scp.wrap_cmd_apdu(h2b(apdu))) + return ('', '9000') + + +class Load_ChunkLen_Test(unittest.TestCase): + """ADF_SD.load() chunking: block size must use scc.max_cmd_len""" + + payload = b'\xaa' * 500 # actual real world case LOAD TLV: C4 + 8201f4 + 500 = 504 total + + def _sd(self, scc): + cmd = type('_Cmd', (), {'lchan': type('_Lchan', (), {'scc': scc})(), + 'poutput': lambda self, *args: None})() + # cmd2 CommandSet has a r/o _cmd property -> shadow it + _SD = type('_SD', (ADF_SD.AddlShellCommands,), {'_cmd': cmd}) + return _SD.__new__(_SD) + + def _blocks(self, scc): + """Get (p1, p2, lc) from LOAD APDU""" + for apdu in scc.sent: + self.assertEqual(apdu[0:4], '80e8') + yield int(apdu[4:6], 16), int(apdu[6:8], 16), int(apdu[8:10], 16) + + def test_default_no_scp(self): + """Without SCP the old 240 byte block size is kept, no idea what else might rely on this number""" + scc = _FakeSccForLoad(max_cmd_len=255) + self._sd(scc).load(self.payload) + blocks = list(self._blocks(scc)) + self.assertEqual([b[2] for b in blocks], [240, 240, 24]) + self.assertEqual([b[0] for b in blocks], [0x00, 0x00, 0x80]) # P1: last block flagged + self.assertEqual([b[1] for b in blocks], [0, 1, 2]) # P2: block num + + def test_default_scp02_level3(self): + """max_cmd_len 239 (SCP02 lvl 3) squeezes the blocks""" + scc = _FakeSccForLoad(max_cmd_len=239) + self._sd(scc).load(self.payload) + self.assertEqual([b[2] for b in list(self._blocks(scc))], [239, 239, 26]) + + def test_explicit_chunk_len(self): + scc = _FakeSccForLoad(max_cmd_len=255) + self._sd(scc).load(self.payload, chunk_len=100) + self.assertEqual([b[2] for b in list(self._blocks(scc))], [100] * 5 + [4]) + + def test_explicit_chunk_len_too_large(self): + scc = _FakeSccForLoad(max_cmd_len=239) + with self.assertRaises(ValueError): + self._sd(scc).load(self.payload, chunk_len=240) + self.assertEqual(scc.sent, []) # nothing sent! + + def test_explicit_chunk_len_zero(self): + scc = _FakeSccForLoad(max_cmd_len=255) + with self.assertRaises(ValueError): + self._sd(scc).load(self.payload, chunk_len=0) + + def test_end_to_end_scp02_level3(self): + """original failure: 286 byte CAP + SCP02 lvl 3""" + scp02 = SCP02(card_keys=ck_3des_70) + scp02.gen_init_update_apdu(host_challenge=h2b('40A62C37FA6304F8')) + scp02.parse_init_update_resp(h2b('00000000000000000000700200016B4524ABEE7CF32EA3838BC148F3')) + scp02.gen_ext_auth_apdu() + scp02.security_level = 0x03 + scc = _FakeSccForLoad(max_cmd_len=255 - scp02.overhead, scp=scp02) + self._sd(scc).load(b'\x5a' * 286) + self.assertEqual(len(scc.sent), 2) # 289 byte TLV in blocks of 239 + for wrapped in scc.wrapped: + self.assertLessEqual(wrapped[4], 255) + + if __name__ == "__main__": unittest.main() -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43172?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 Gerrit-Change-Number: 43172 Gerrit-PatchSet: 8 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[L] Change in pysim[master]: GP: mixed PSK TLS PUT KEY (Amendment B Table 3-13)
by laforge 09 Sep '26

09 Sep '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/43136?usp=email ) ( 6 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: GP: mixed PSK TLS PUT KEY (Amendment B Table 3-13) ...................................................................... GP: mixed PSK TLS PUT KEY (Amendment B Table 3-13) AES PSK + DES DEK for scp81, tested with sysmoEUICC1 C2T Change-Id: I480a9d049a052aa5ae54fe6e2771dba44e89434d --- M pySim/global_platform/__init__.py M tests/unittests/test_globalplatform.py 2 files changed, 237 insertions(+), 19 deletions(-) Approvals: Jenkins Builder: Verified dexter: Looks good to me, approved laforge: Looks good to me, but someone else must approve diff --git a/pySim/global_platform/__init__.py b/pySim/global_platform/__init__.py index 6ff4b28..7e2e97e 100644 --- a/pySim/global_platform/__init__.py +++ b/pySim/global_platform/__init__.py @@ -18,10 +18,12 @@ """ import io +import hashlib from copy import deepcopy from typing import Optional, List, Dict, Tuple from construct import Optional as COptional from construct import Struct, GreedyRange, FlagsEnum, Int16ub, Int24ub, Padding, Bit, Const +from construct import Construct, stream_read, stream_write from Cryptodome.Random import get_random_bytes from Cryptodome.Cipher import DES, DES3, AES from osmocom.utils import * @@ -148,6 +150,24 @@ }, } +class PutKeyLength(Construct): + """A length field of a PUT KEY data field, GP CardSpec v2.3.1 11.8.2.3.1 + - all lengths ASN.1 BER-TLV (ITU-T X.690 Section 8.1.3) + - except that the length 128 may also be coded on one byte as '80' for backwards compatibility + 80 does not introduce the indefinite form here which is unused in GP as far as i know. + That legacy form is accepted when parsing, but never generated, which agrees with the spec""" + def _parse(self, stream, context, path): + first = stream_read(stream, 1, path)[0] + if first <= 0x80: + return first + return int.from_bytes(stream_read(stream, first & 0x7f, path), 'big') + + def _build(self, obj, stream, context, path): + data = bertlv_encode_len(obj) + stream_write(stream, data, len(data), path) + return obj + + # GlobalPlatform 2.1.1 Section 9.1.6 KeyType = Enum(Byte, des=0x80, tls_psk=0x85, # v2.3.1 Section 11.1.8 @@ -602,8 +622,8 @@ See GlobalPlatform CardSpecification v2.3 Section 11.8 for details. The KCV (Key Check Values) can either be explicitly specified using `--key-check`, or will - otherwise be automatically generated for DES and AES keys. You can suppress the latter using - `--suppress-key-check`. + otherwise be automatically generated for DES, AES and TLS-PSK keys. You can suppress the + latter using `--suppress-key-check`. Example (SCP80 KIC/KID/KIK): put_key --key-version-nr 1 --key-id 0x01 --key-type aes --key-data 000102030405060708090a0b0c0d0e0f @@ -620,33 +640,73 @@ kdb = [] for i in range(0, len(opts.key_type)): if opts.key_check and len(opts.key_check) > i: - kcv = opts.key_check[i] + kcv = h2b(opts.key_check[i]) elif opts.suppress_key_check: - kcv = '' + kcv = b'' else: - kcv_bin = compute_kcv(opts.key_type[i], h2b(opts.key_data[i])) or b'' - kcv = b2h(kcv_bin) - if self._cmd.lchan.scc.scp: - # encrypted key data with DEK of current SCP - kcb = b2h(self._cmd.lchan.scc.scp.encrypt_key(h2b(opts.key_data[i]))) - else: - # (for example) during personalization, DEK might not be required) - kcb = opts.key_data[i] - kdb.append({'key_type': opts.key_type[i], 'kcb': kcb, 'kcv': kcv}) + kcv = compute_kcv(opts.key_type[i], h2b(opts.key_data[i])) or b'' + kdb.append({'key_type': opts.key_type[i], 'clear_key': h2b(opts.key_data[i]), 'kcv': kcv}) p2 = opts.key_id if len(opts.key_type) > 1: p2 |= 0x80 self.put_key(opts.old_key_version_nr, opts.key_version_nr, p2, kdb) - # Table 11-68: Key Data Field - Format 1 (Basic Format) - KeyDataBasic = GreedyRange(Struct('key_type'/KeyType, - 'kcb'/Prefixed(Int8ub, GreedyBytes), - 'kcv'/Prefixed(Int8ub, GreedyBytes))) + # Table 11-68: Key Data Field - Format 1 (Basic Format). The key component block length is + # BER-TLV coded (Section 11.8.2.3.1), the key check value length is always '00' - '7F'. + KeyDataBasic = Struct('key_type'/KeyType, + 'kcb'/Prefixed(PutKeyLength(), GreedyBytes), + 'kcv'/Prefixed(Int8ub, GreedyBytes)) - def put_key(self, old_kvn:int, kvn: int, kid: int, key_dict: dict) -> bytes: + @classmethod + def encode_key_data_basic(cls, key_type: str, kcb: bytes, kcv: bytes) -> bytes: + """Generic Basic key data field, GP CardSpec v2.3 Table 11-68): + tag || L1 || <maybe L2> KCB || <1-byte length> KCV""" + return cls.KeyDataBasic.build({'key_type': key_type, 'kcb': kcb, 'kcv': kcv}) + + @classmethod + def encode_key_data_psk(cls, clear_key: bytes, ciphered_key: bytes, kcv: bytes) -> bytes: + """Single PSK TLS '85' key data field per GP Amendment B 1.2, 3.9.1 / Table 3-13: + 85 | L1 | <L2> <ciphered PSK key> | <KCV length> | <KCV> + - framing is like Basic Format, but the kcb is always GP CardSpec Table 11-70 + so always with the length of the clear text key value, even without padding! + - 'ciphered_key' is DEK(block-padded clear key), no additional length prefix.""" + kcb = bertlv_encode_len(len(clear_key)) + ciphered_key + return cls.encode_key_data_basic('tls_psk', kcb, kcv) + + @classmethod + def build_put_key_data(cls, kvn: int, keys: List[dict], scp) -> bytes: + """Assemble the PUT KEY data field, mixed PSK + DES DEK is supported: + - new KVN followed by one key data field per key. + - tls_psk keys per GP Amendment B + - other key types generic Basic format + Param 'keys' is a dict: + - 'key_type' (str) + - 'clear_key' (bytes) + - 'kcv' (bytes / empty). + 'scp' may be None (e.g. during personalization, when the DEK may not be required).""" + key_data = kvn.to_bytes(1, 'big') + for k in keys: + clear = k['clear_key'] + if k['key_type'] == 'tls_psk': + # len always part of the data see CardSpec Table 11-70 vs Table 11-71 + if scp: + ciphered = scp.dek_encrypt(scp.pad_to_blocksize(clear)) + else: + ciphered = clear + key_data += cls.encode_key_data_psk(clear, ciphered, k['kcv']) + else: + if scp: + ciphered = scp.encrypt_key(clear) + else: + # (for example) during personalization, DEK might not be required + ciphered = clear + key_data += cls.encode_key_data_basic(k['key_type'], ciphered, k['kcv']) + return key_data + + def put_key(self, old_kvn:int, kvn: int, kid: int, keys: List[dict]) -> bytes: """Perform the GlobalPlatform PUT KEY command in order to store a new key on the card. See GlobalPlatform CardSpecification v2.3 Section 11.8 for details.""" - key_data = kvn.to_bytes(1, 'big') + build_construct(ADF_SD.AddlShellCommands.KeyDataBasic, key_dict) + key_data = self.build_put_key_data(kvn, keys, self._cmd.lchan.scc.scp) hdr = "80D8%02x%02x%02x" % (old_kvn, kid, len(key_data)) data, _sw = self._cmd.lchan.scc.send_apdu_checksw(hdr + b2h(key_data) + "00") return data @@ -1065,10 +1125,16 @@ cipher = AES.new(key, AES.MODE_ECB) return cipher.encrypt(plaintext) +def compute_kcv_psk(key:bytes) -> bytes: + # GP Amendment B v1.2, 3.9.1 / Table 3-13 + # KCV of a PSK TLS key is the 3 highest-order bytes of the SHA-1 digest of the clear key value. + return hashlib.sha1(key).digest() + # dict is keyed by the string name of the KeyType enum above in this file KCV_CALCULATOR = { 'aes': compute_kcv_aes, 'des': compute_kcv_des, + 'tls_psk': compute_kcv_psk, } def compute_kcv(key_type: str, key: bytes) -> Optional[bytes]: diff --git a/tests/unittests/test_globalplatform.py b/tests/unittests/test_globalplatform.py index 576407d..1c98dab 100644 --- a/tests/unittests/test_globalplatform.py +++ b/tests/unittests/test_globalplatform.py @@ -17,7 +17,9 @@ import unittest import logging +import hashlib from osmocom.utils import b2h, h2b +from osmocom.tlv import bertlv_encode_len from pySim.global_platform import * from pySim.global_platform.scp import * @@ -325,6 +327,156 @@ self.assertEqual(compute_kcv('aes', KEYSET_AES128.dek), h2b('840DE5')) +class PutKey_PSK_Test(unittest.TestCase): + """Tests for the PUT KEY command data field encoding, in particular the PSK TLS ('85') key data + field defined by GlobalPlatform Amendment B (Remote Application Management over HTTP) Table 3-13.""" + + # the PUT KEY encoder we exercise + C = ADF_SD.AddlShellCommands + + # SCP80 TLS-PSK example key from the do_put_key docstring (16 bytes) + PSK_CLEAR = h2b('303132333435363738393a3b3c3d3e3f') + # its DEK ciphertext + Table 3-13 KCV with SCP02 session set up below + PSK_CIPHERED = h2b('15abf1fe16ccc5aa13743394442942cd') + PSK_KCV = h2b('06125d') # = SHA-1(PSK_CLEAR)[:3] + + def setUp(self): + # SCP02 with the same vectors as SCP02_Test, so that the whole PUT KEY data field is reproducible. + self.scp02 = SCP02(card_keys=ck_3des_70) + self.scp02.gen_init_update_apdu(host_challenge=h2b('40A62C37FA6304F8')) + self.scp02.parse_init_update_resp(h2b('00000000000000000000700200016B4524ABEE7CF32EA3838BC148F3')) + self.scp02.gen_ext_auth_apdu() + + def test_psk_kcv_is_sha1(self): + # GP Amendment B Table 3-13: KCV = 3 most significant bytes of SHA-1(clear key) + self.assertEqual(compute_kcv('tls_psk', self.PSK_CLEAR), hashlib.sha1(self.PSK_CLEAR).digest()[:3]) + self.assertEqual(compute_kcv('tls_psk', self.PSK_CLEAR), self.PSK_KCV) + + def test_encode_psk_framing_golden(self): + # assert the exact Table 3-13 layout + # 85 | L1 | L2 | <ciphered> | 03 | <SHA-1(clear)[:3]> + clear = self.PSK_CLEAR + ciphered = h2b('aabbccddeeff00112233445566778899') # arbitrary 16-byte ciphertext + kcv = hashlib.sha1(clear).digest()[:3] + field = self.C.encode_key_data_psk(clear, ciphered, kcv) + # 85 L1 L2 <---------- ciphered -----------> 03 <-kcv-> + self.assertEqual(b2h(field),'85' '11' '10' 'aabbccddeeff00112233445566778899' '03' + b2h(kcv)) + self.assertEqual(b2h(field),'851110aabbccddeeff0011223344556677889903' + '06125d') + + def test_psk_golden_over_scp02(self): + # Full PUT KEY data field (KVN 0x40 + single PSK key) enciphered with the SCP02 DEK. + keys = [{'key_type': 'tls_psk', 'clear_key': self.PSK_CLEAR, + 'kcv': compute_kcv('tls_psk', self.PSK_CLEAR)}] + data = self.C.build_put_key_data(0x40, keys, self.scp02) + self.assertEqual(b2h(data), + '40' '85' '11' '10' + b2h(self.PSK_CIPHERED) + '03' + b2h(self.PSK_KCV)) + + def test_wrong_basic_format_differs(self): + # regression test, the generic "Basic format" does NOT match Table 3-13 for a PSK key + # rejected by card with with 6a88 + wrong_basic = self.C.encode_key_data_basic('tls_psk', self.PSK_CIPHERED, b'') + right_psk = self.C.encode_key_data_psk(self.PSK_CLEAR, self.PSK_CIPHERED, self.PSK_KCV) + self.assertEqual(b2h(wrong_basic), '8510' + b2h(self.PSK_CIPHERED) + '00') + self.assertEqual(b2h(right_psk), '8511' '10' + b2h(self.PSK_CIPHERED) + '03' + b2h(self.PSK_KCV)) + self.assertNotEqual(wrong_basic, right_psk) + + def test_key_component_block_length_is_bertlv(self): + # GP CardSpec v2.3.1 Section 11.8.2.3.1: all lengths ofPUT KEY are always BER TLV coded + for kcb_len, exp_len_field in [(127, '7f'), (128, '8180'), (129, '8181'), (256, '820100')]: + with self.subTest(kcb_len=kcb_len): + kcb = bytes(kcb_len) + field = self.C.encode_key_data_basic('rsa_modulus_n', kcb, b'') + self.assertEqual(b2h(field), 'a2' + exp_len_field + b2h(kcb) + '00') + # 85 field of Amendment B Table 3-13 uses the same coding + # single byte inner length (clear key < 128) == block kcb_len bytes long + psk = self.C.encode_key_data_psk(bytes(120), bytes(kcb_len - 1), b'') + self.assertEqual(b2h(psk)[:2 + len(exp_len_field)], '85' + exp_len_field) + + def test_basic_format_unchanged(self): + # as before + for kt, clear in [('des', h2b('404142434445464748494a4b4c4d4e4f')), + ('aes', h2b('000102030405060708090a0b0c0d0e0f'))]: + ciph = self.scp02.encrypt_key(clear) + kcv = compute_kcv(kt, clear) + via_construct = build_construct(self.C.KeyDataBasic, {'key_type': kt, 'kcb': b2h(ciph), 'kcv': b2h(kcv)}) + via_helper = self.C.encode_key_data_basic(kt, ciph, kcv) + self.assertEqual(via_helper, via_construct) + + def test_psk_padding_no_double_length(self): + # A PSK key whose length is not a multiple of the DEK block size (DES: 8) is right-padded before + # ciphering. Table 3-13 states the clear key length (L2) in the '85' DO itself, so the ciphered + # key field is the bare cryptogram: + # - ciphered field == padded ciphertext (no duplicated length prefix), + # - clear key == first L2 bytes. + for keylen in (18, 20): + with self.subTest(keylen=keylen): + clear = bytes(range(keylen)) + padded_len = keylen + (-keylen % 8) + field = self.C.build_put_key_data(0x40, [{'key_type': 'tls_psk', 'clear_key': clear, + 'kcv': compute_kcv('tls_psk', clear)}], self.scp02)[1:] + self.assertEqual(field[0], 0x85) + l1 = field[1] + l2 = field[2] + self.assertEqual(l2, keylen) # single-byte BER length of clear key + ciphered = field[3:3 + (l1 - 1)] # value = L2 (1 byte) || ciphered key + self.assertEqual(len(ciphered), padded_len) # padded to the 8-byte DES block size + self.assertEqual(l1, 1 + padded_len) # no duplicated length prefix + self.assertEqual(self.scp02.dek_decrypt(ciphered)[:keylen], clear) + + def test_psk_clear_key_is_not_padded_in_place(self): + # padding the bytearray in place would make L2 the padded length, + # then stored as key material and rejected thanks to the KCV + clear = h2b('000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d') # 30, not %8 + kcv = compute_kcv('tls_psk', clear) + field = self.C.build_put_key_data(0x40, [{'key_type': 'tls_psk', 'clear_key': clear, + 'kcv': kcv}], self.scp02)[1:] + self.assertEqual(len(clear), 30) + self.assertEqual(field[2], 30) # L2 == clear key length, not 32 + self.assertEqual(self.scp02.dek_decrypt(field[3:3 + field[1] - 1])[:30], clear) + + def test_kcv_suppressed(self): + # --suppress-key-check -> KCV length 00 and no KCV bytes + field = self.C.build_put_key_data(0x40, [{'key_type': 'tls_psk', 'clear_key': self.PSK_CLEAR, + 'kcv': b''}], self.scp02)[1:] + self.assertEqual(b2h(field), '8511' '10' + b2h(self.PSK_CIPHERED) + '00') + + def test_multikey_psk_plus_des_dek(self): + # load a PSK TLS key (KID 1, Amendment B format) together with its DES DEK + # (KID 2, Basic format) in one PUT KEY. + # Verify the concatenated data field parses back into the two components with proper type formats. + dek = h2b('404142434445464748494a4b4c4d4e4f') + keys = [{'key_type': 'tls_psk', 'clear_key': self.PSK_CLEAR, 'kcv': compute_kcv('tls_psk', self.PSK_CLEAR)}, + {'key_type': 'des', 'clear_key': dek, 'kcv': compute_kcv('des', dek)}] + data = self.C.build_put_key_data(0x40, keys, self.scp02) + + b = data + self.assertEqual(b[0], 0x40) # KVN + b = b[1:] + # component 1: PSK TLS (Table 3-13) + self.assertEqual(b[0], 0x85) + self.assertEqual(b[1], 0x11) # L1 = 17 + self.assertEqual(b[2], 0x10) # L2 = 16 (clear key length) + self.assertEqual(b[3:3 + 16], self.PSK_CIPHERED) + self.assertEqual(b[3 + 16], 0x03) # KCV length + self.assertEqual(b[3 + 16 + 1:3 + 16 + 1 + 3], self.PSK_KCV) + b = b[3 + 16 + 1 + 3:] + # component 2: DES DEK (Basic format) + self.assertEqual(b[0], 0x80) # key type des + kcb_len = b[1] + self.assertEqual(kcb_len, 16) + self.assertEqual(b[2:2 + kcb_len], self.scp02.encrypt_key(dek)) + b = b[2 + kcb_len:] + self.assertEqual(b[0], 0x03) # KCV length + self.assertEqual(b[1:1 + 3], compute_kcv('des', dek)) + self.assertEqual(b[1 + 3:], b'') # no trailing bytes + + def test_no_scp_leaves_key_clear(self): + # During personalization (no SCP) the key is not enciphered, framing still follows Table 3-13. + field = self.C.build_put_key_data(0x40, [{'key_type': 'tls_psk', 'clear_key': self.PSK_CLEAR, + 'kcv': self.PSK_KCV}], None)[1:] + self.assertEqual(b2h(field), '8511' '10' + b2h(self.PSK_CLEAR) + '03' + b2h(self.PSK_KCV)) + + class Install_param_Test(unittest.TestCase): def test_gen_install_parameters(self): load_parameters = gen_install_parameters(256, 256, '010001001505000000000000000000000000') -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43136?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I480a9d049a052aa5ae54fe6e2771dba44e89434d Gerrit-Change-Number: 43136 Gerrit-PatchSet: 7 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu>

1 0

[XS] Change in osmo-trx[master]: build: pass FFTWF_CFLAGS to arch/common
by laforge 09 Sep '26

09 Sep '26

laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-trx/+/43581?usp=email ) Change subject: build: pass FFTWF_CFLAGS to arch/common ...................................................................... build: pass FFTWF_CFLAGS to arch/common configure looks up fftw3f with pkg-config for the multi-ARFCN build and puts FFTWF_LIBS on the link line of the transceiver, but Transceiver52M/arch/common/Makefile.am, where fft.c lives, never uses FFTWF_CFLAGS. The compile of fft.c therefore only works where fftw3.h is in a default include directory. With fftw from Homebrew on macOS ARM64 the header is in /opt/homebrew/include, which clang does not search by default: arch/common/fft.c:26:10: fatal error: 'fftw3.h' file not found Add FFTWF_CFLAGS to AM_CFLAGS in that directory. No change where the header was already found. Change-Id: I3243ce00bd42a22ff0fbbdd5ff3d00c7441662d0 Signed-off-by: Andrei Gosman <andrei.gosman(a)gmail.com> --- M Transceiver52M/arch/common/Makefile.am 1 file changed, 1 insertion(+), 1 deletion(-) Approvals: pespin: Looks good to me, but someone else must approve fixeria: Looks good to me, approved Jenkins Builder: Verified diff --git a/Transceiver52M/arch/common/Makefile.am b/Transceiver52M/arch/common/Makefile.am index a27174d..c23d3b4 100644 --- a/Transceiver52M/arch/common/Makefile.am +++ b/Transceiver52M/arch/common/Makefile.am @@ -1,4 +1,4 @@ -AM_CFLAGS = -Wall -std=gnu99 +AM_CFLAGS = -Wall -std=gnu99 $(FFTWF_CFLAGS) noinst_LTLIBRARIES = libarch_common.la -- To view, visit https://gerrit.osmocom.org/c/osmo-trx/+/43581?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-trx Gerrit-Branch: master Gerrit-Change-Id: I3243ce00bd42a22ff0fbbdd5ff3d00c7441662d0 Gerrit-Change-Number: 43581 Gerrit-PatchSet: 1 Gerrit-Owner: Andrei G <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-hlr[master]: gsupclient: add LIBOSMOGSM_LIBS to LIBADD
by osmith 09 Sep '26

09 Sep '26

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-hlr/+/43578?usp=email ) Change subject: gsupclient: add LIBOSMOGSM_LIBS to LIBADD ...................................................................... gsupclient: add LIBOSMOGSM_LIBS to LIBADD libosmo-gsup-client calls osmo_gsup_*, osmo_oap_client_* and osmo_imsi_str_valid(), all exported by libosmogsm, but libosmo_gsup_client_la_LIBADD in src/gsupclient/Makefile.am lists only talloc, libosmocore and libosmoabis. GNU ld accepts undefined symbols in a shared library and defers them to whatever the executable happens to pull in, so the missing dependency is invisible on Linux. Darwin's ld64 refuses at link time and the library fails to build with "symbol(s) not found for architecture arm64". The same Makefile.am already passes -no-undefined in LDFLAGS, which is the promise that the library resolves its own symbols. Adding LIBOSMOGSM_LIBS is what makes that promise true. With the fix, otool -L on the resulting libosmo-gsup-client.dylib lists libosmogsm among its dependencies, and the osmo_gsup_* references resolve through it. Change-Id: I413ff47aa1e8034ea86c61134d3d6784942b0e3b Signed-off-by: Andrei Gosman <andrei.gosman(a)gmail.com> --- M src/gsupclient/Makefile.am 1 file changed, 1 insertion(+), 1 deletion(-) Approvals: osmith: Looks good to me, approved pespin: Looks good to me, but someone else must approve laforge: Looks good to me, but someone else must approve Jenkins Builder: Verified diff --git a/src/gsupclient/Makefile.am b/src/gsupclient/Makefile.am index 7611f6e..89533f4 100644 --- a/src/gsupclient/Makefile.am +++ b/src/gsupclient/Makefile.am @@ -16,7 +16,7 @@ $(NULL) libosmo_gsup_client_la_LDFLAGS = -version-info $(LIBVERSION) -no-undefined -libosmo_gsup_client_la_LIBADD = $(TALLOC_LIBS) $(LIBOSMOCORE_LIBS) $(LIBOSMOABIS_LIBS) +libosmo_gsup_client_la_LIBADD = $(TALLOC_LIBS) $(LIBOSMOCORE_LIBS) $(LIBOSMOGSM_LIBS) $(LIBOSMOABIS_LIBS) noinst_PROGRAMS = gsup-test-client -- To view, visit https://gerrit.osmocom.org/c/osmo-hlr/+/43578?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-hlr Gerrit-Branch: master Gerrit-Change-Id: I413ff47aa1e8034ea86c61134d3d6784942b0e3b Gerrit-Change-Number: 43578 Gerrit-PatchSet: 1 Gerrit-Owner: Andrei G <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-hlr[master]: gsupclient: add LIBOSMOGSM_LIBS to LIBADD
by osmith 09 Sep '26

09 Sep '26

Attention is currently required from: Andrei G. osmith has posted comments on this change by Andrei G. ( https://gerrit.osmocom.org/c/osmo-hlr/+/43578?usp=email ) Change subject: gsupclient: add LIBOSMOGSM_LIBS to LIBADD ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-hlr/+/43578?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-hlr Gerrit-Branch: master Gerrit-Change-Id: I413ff47aa1e8034ea86c61134d3d6784942b0e3b Gerrit-Change-Number: 43578 Gerrit-PatchSet: 1 Gerrit-Owner: Andrei G <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: Andrei G <andrei.gosman(a)gmail.com> Gerrit-Comment-Date: Wed, 09 Sep 2026 08:20:35 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[L] Change in onomondo-eim[master]: rest_api_response_schema: re-structure REST API responses
by dexter 09 Sep '26

09 Sep '26

dexter has submitted this change. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43402?usp=email ) Change subject: rest_api_response_schema: re-structure REST API responses ...................................................................... rest_api_response_schema: re-structure REST API responses The REST API responses are in parts inconsistent and the schema file lacks proper spec references in the description fields. Also in some places we mix proprietary error codes with return codes from SGP.32, which may lead to unexpected effects in case the SGP.32 ASN.1 spec changes. With this patch we clean up those remaining shortcomings, in particular the following: - Add a spec reference to each non-proprietary field - No longer mix SGP.32 error codes with proprietary error codes - Rename procedureError to eimProcedureError and make sure all possible error codes appear in the JSON schema properly. - Add dedicated error fields for each SGP.32 error code, so that the REST API user gets more detailed information in the error case - Restructure profileInstallationResult also return AID and SimaResponse, also add an profileInstallationError field which returns BppCommandId, ErrorReason and SimaResponse so that a REST API user has a chance to debug profile installation issues. - Orient the layout of result and error responses closer to the SGP.32 ASN.1 specification. - Do not specify the error codes in the JSON schema file to avoid unexpected problems when SGP.32 adds new error code. A spec reference in the field description should be sufficient. Change-Id: I16cc063c185727e1b30f26d656bd15154504b087 Related: SYS#8100 --- M doc/build.md M doc/database.md M priv/rest_api_response_schema.json M src/esipa_asn1_handler.erl M src/esipa_asn1_handler_utils.erl M src/esipa_asn1_http_handler.erl M src/esipa_json_handler.erl M src/esipa_json_http_handler.erl M src/esipa_rest_utils.erl M src/mnesia_db.erl M src/mnesia_db_euicc.erl M src/mnesia_db_rest.erl M src/mnesia_db_work.erl 13 files changed, 388 insertions(+), 456 deletions(-) Approvals: laforge: Looks good to me, but someone else must approve Jenkins Builder: Verified dexter: Looks good to me, approved diff --git a/doc/build.md b/doc/build.md index 5bb08af..cab53a6 100644 --- a/doc/build.md +++ b/doc/build.md @@ -222,16 +222,16 @@ done. * The timeout `rest_timeout_stuck` guards against stuck orders. Orders may get stuck due to communication errors between - SMDP+ or IPAd. When a procedure is stuck for too long it gets marked as done and an appropriate `procedureError` code - is communicated to the REST API user. Since a procedure usually won't take more than a few minutes (usually below one - minute) 300 sec. would be a good compromise here. + SMDP+ or IPAd. When a procedure is stuck for too long it gets marked as done and an appropriate `eimProcedureError` + code is communicated to the REST API user. Since a procedure usually won't take more than a few minutes (usually + below one minute) 300 sec. would be a good compromise here. * The timeout `rest_timeout_noshow` guards against IPAd/eUICCs that fail to show up. When an order is placed the IPAd is expected to poll the eIM within a reasonable amount of time. When the IPAd fails to poll for some reason, the - order gets marked as done and an appropriate 'procedureError' code is communicated to the REST API user. Usually the - polling is triggered through some side channel or the polling happens periodically. Depending on the situation the - timeout may be set to several hours or even days. In any case it should not be lower than `rest_timeout_stuck` for - obvious reasons. A recommended timeout value would be 1800 (30 min). + order gets marked as done and an appropriate 'eimProcedureError' code is communicated to the REST API user. Usually + the polling is triggered through some side channel or the polling happens periodically. Depending on the situation + the timeout may be set to several hours or even days. In any case it should not be lower than `rest_timeout_stuck` + for obvious reasons. A recommended timeout value would be 1800 (30 min). * The timeout `rest_timeout_expired` guards against careless REST API users. As mentioned already, the REST API user is expected to carefully monitor his orders and delete them on his own responsibility. However, it may be that a REST diff --git a/doc/database.md b/doc/database.md index 8ae5471..3b066b7 100644 --- a/doc/database.md +++ b/doc/database.md @@ -137,4 +137,4 @@ in progress (`status` = `work`) are terminated. Since the `work` table is kept in RAM only it will naturally lose its contents. When onomondo-eim restarts it will go through the `rest` table to set the status of each rest resource that still has its `status` set to `work` to `done`. To make the REST API user aware of the situation an appropriate -`procedureError` code is set as well (`abortedOrder`). +`eimProcedureError` code is set as well (`abortedOrder`). diff --git a/priv/rest_api_response_schema.json b/priv/rest_api_response_schema.json index 6542215..f8df3f7 100644 --- a/priv/rest_api_response_schema.json +++ b/priv/rest_api_response_schema.json @@ -31,135 +31,92 @@ "anyOf": [ { "enableResult": { - "description": "profile enable PSMO result, see also SGP32Definitions.asn1", - "type": "string", - "enum": [ - "ok", - "iccidOrAidNotFound", - "profileNotInDisabledState", - "disallowedByPolicy", - "catBusy", - "rollbackNotAvailable", - "undefinedError" - ] + "description": "profile enable PSMO result, see also GSMA SGP.32, section 2.11.2.1 (EnableProfileResult)", + "type": "string" } }, { "disableResult": { - "description": "profile disable PSMO result, see also SGP32Definitions.asn1", - "type": "string", - "enum": [ - "ok", - "iccidOrAidNotFound", - "profileNotInEnabledState", - "disallowedByPolicy", - "catBusy", - "undefinedError" - ] + "description": "profile disable PSMO result, see also GSMA SGP.32, section 2.11.2.1 (DisableProfileResult)", + "type": "string" } }, { "deleteResult": { - "description": "profile delete PSMO result, see also SGP32Definitions.asn1", - "type": "string", - "enum": [ - "ok", - "iccidOrAidNotFound", - "profileNotInDisabledState", - "disallowedByPolicy", - "rollbackNotAvailable", - "returnFallbackProfile", - "undefinedError" - ] + "description": "profile delete PSMO result, see also GSMA SGP.32, section 2.11.2.1 (DeleteProfileResult)", + "type": "string" } }, { "listProfileInfoResult": { - "description": "listProfileInfoResult PSMO result, see also SGP32Definitions.asn1", - "type": "object", - "properties": { - "finalResult": { - "description": "overall status code to inform about success or failure", - "type": "string", - "enum": [ - "successResult", - "errorResult" - ] - }, - "profileInfoList": { - "description": "contains a list of installed profiles and their meta data, see also RSPDefinitions.asn1", - "type": "array", - "items": { - "type": "object", - "properties": { - "iccid": { - "description": "ICCID of the profile. (ICCID in nibble-swapped raw format, see also ETSI TS 102 221, section 13.2)", - "type": "string", - "pattern": "^[0-9A-F]{18,20}$" - }, - "isdpAid": { - "description": "AID of the ISDP (identifies a profile)", - "type": "string", - "pattern": "^[0-9A-F]{2,32}$" - }, - "profileState": { - "description": "usage state of the prifle", - "type": "string", - "enum": [ - "disabled", - "enabled" - ] - }, - "profileNickname": { - "description": "human readable nickname name of the profile", - "type": "string" - }, - "serviceProviderName": { - "description": "human readable name of the related service provider", - "type": "string" - }, - "profileName": { - "description": "human readable name of the profile", - "type": "string" - }, - "iconType": { - "description": "graphics format in which the profile icon is supplied", - "type": "string" - }, - "icon": { - "description": "icon graphic", - "type": "string", - "pattern": "^[0-9A-F].*$" - }, - "profileClass": { - "description": "0=test, 1=provisioning, 2=operational", - "type": "integer" - }, - "ecallIndication": { - "description": "indicates if the profile is an Emergency Profile", - "type": "boolean" - }, - "fallbackAttribute": { - "description": "indicates a Fallback Profile", - "type": "boolean" - }, - "fallbackAllowed": { - "description": "indicates if Fallback is authorized by the Profile Owner", - "type": "boolean" - } - } + "description": "contains a list of installed profiles and their meta data, see also GSMA SGP.32, section 4.4 (ProfileInfo)", + "type": "array", + "items": { + "type": "object", + "properties": { + "iccid": { + "description": "ICCID of the profile. (ICCID in nibble-swapped raw format, see also ETSI TS 102 221, section 13.2)", + "type": "string", + "pattern": "^[0-9A-F]{18,20}$" + }, + "isdpAid": { + "description": "AID of the ISDP (identifies a profile)", + "type": "string", + "pattern": "^[0-9A-F]{2,32}$" + }, + "profileState": { + "description": "usage state of the prifle", + "type": "string", + "enum": [ + "disabled", + "enabled" + ] + }, + "profileNickname": { + "description": "human readable nickname name of the profile", + "type": "string" + }, + "serviceProviderName": { + "description": "human readable name of the related service provider", + "type": "string" + }, + "profileName": { + "description": "human readable name of the profile", + "type": "string" + }, + "iconType": { + "description": "graphics format in which the profile icon is supplied", + "type": "string" + }, + "icon": { + "description": "icon graphic", + "type": "string", + "pattern": "^[0-9A-F].*$" + }, + "profileClass": { + "description": "0=test, 1=provisioning, 2=operational", + "type": "integer" + }, + "ecallIndication": { + "description": "indicates if the profile is an Emergency Profile", + "type": "boolean" + }, + "fallbackAttribute": { + "description": "indicates a Fallback Profile", + "type": "boolean" + }, + "fallbackAllowed": { + "description": "indicates if Fallback is authorized by the Profile Owner", + "type": "boolean" } } }, - "required": [ - "finalResult" - ], "additionalProperties": false } }, { "getRATResult": { - "description": "getRAT (rules authorization table) PSMO result, see also RSPDefinitions.asn1", + "description": "getRAT (rules authorization table) PSMO result, see also GSMA SGP.22, section 5.7.22 (ProfilePolicyAuthorisationRule)", "type": "array", "items": { "type": "object", @@ -177,7 +134,7 @@ "type": "boolean" }, "allowedOperators": { - "description": "list of allowed operaters, see also GSMA SGP.22, section 2.9.2.1", + "description": "list of allowed operaters, see also GSMA SGP.22, section 2.8.1.2 (OperatorId)", "type": "array", "items": { "mccMnc": { @@ -219,213 +176,175 @@ }, { "configureImmediateEnableResult": { - "description": "configureImmediateEnableResult (automatic profile enabeling) PSMO result, see also SGP32Definitions.asn1", - "type": "string", - "enum": [ - "ok", - "insufficientMemory", - "commandError", - "undefinedError" - ] - } - }, - { - "setFallbackAttributeResult": { - "description": "setFallbackAttributeResult PSMO result, see also SGP32Definitions.asn1", - "type": "string", - "enum": [ - "ok", - "iccidOrAidNotFound", - "fallbackNotAllowed", - "fallbackProfileEnabled", - "undefinedError" - ] - } - }, - { - "unsetFallbackAttributeResult": { - "description": "unsetFallbackAttributeResult PSMO result, see also SGP32Definitions.asn1", - "type": "string", - "enum": [ - "ok", - "noFallbackAttribute", - "fallbackProfileEnabled", - "commandError", - "undefinedError" - ] - } - }, - { - "setDefaultDpAddressResult": { - "description": "setDefaultDpAddressResult PSMO result, see also SGP32Definitions.asn1", - "type": "string", - "enum": [ - "ok", - "undefinedError" - ] + "description": "configureImmediateEnableResult (automatic profile enabeling) PSMO result, see also GSMA SGP.32, section 2.11.2.1 (ConfigureImmediateEnableResult)", + "type": "string" } }, { "addEimResult": { - "description": "addEimResult eCO result", + "description": "addEimResult eCO result, see also GSMA SGP.32, section 2.11.2.1 (AddEimResult)", "type": "object", "properties": { "addEimResultCode": { - "description": "overall status code to inform about success or failure", - "type": "string", - "enum": [ - "ok", - "insufficientMemory", - "associatedEimAlreadyExists", - "ciPKUnknown", - "invalidAssociationToken", - "counterValueOutOfRange", - "commandError", - "undefinedError", - "malformedResult" - ] + "description": "overall status code to inform about success or failure, see also GSMA SGP.32, section 2.11.2.1", + "type": "string" }, "associationToken": { "description": "resulting association token, see also GSMA SGP.32, section 2.11.1.1.1", "type": "integer" } }, - "required": [ - "addEimResultCode" - ], "additionalProperties": false } }, { "deleteEimResult": { - "description": "deleteEimResult eCO result, see also SGP32Definitions.asn1", - "type": "string", - "enum": [ - "ok", - "eimNotFound", - "lastEimDeleted", - "commandError", - "undefinedError" - ] + "description": "deleteEimResult eCO result, see also GSMA SGP.32, section 2.11.1.1.1 (DeleteEimResult)", + "type": "string" } }, { "updateEimResult": { - "description": "updateEimResult eCO result, see also SGP32Definitions.asn1", - "type": "string", - "enum": [ - "ok", - "eimNotFound", - "ciPKUnknown", - "counterValueOutOfRange", - "commandError", - "undefinedError" - ] + "description": "updateEimResult eCO result, see also GSMA SGP.32, section 2.11.1.1.1 (UpdateEimResult)", + "type": "string" } }, { "listEimResult": { - "description": "listEimResult eCO result, see also SGP32Definitions.asn1", - "type": "object", - "properties": { - "finalResult": { - "description": "overall status code to inform about success or failure", + "description": "listEimResult eCO result, see also GSMA SGP.32, section 2.11.1.1.1 (EimIdInfo)", + "type": "array", + "items": { + "eimId": { + "description": "eIM ID", + "type": "string" + }, + "eimIdType": { + "description": "specifies the type of the eIM ID", "type": "string", "enum": [ - "successResult", - "errorResult" - ] - }, - "eimIdList": { - "description": "list containing the IDs of all configured eIM servers", - "type": "array", - "items": { - "eimId": { - "description": "eIM ID", - "type": "string" - }, - "eimIdType": { - "description": "specifies the type of the eIM ID", - "type": "string", - "enum": [ - "eimIdTypeOid", - "eimIdTypeFqdn", - "eimIdTypeProprietary" - ] - } - }, - "required": [ - "eimId" + "eimIdTypeOid", + "eimIdTypeFqdn", + "eimIdTypeProprietary" ] } }, "required": [ - "finalResult" + "eimId" ], "additionalProperties": false } }, { "rollbackResult": { - "description": "Status code of the execution of a profile rollback maneuver, see also GSMA SGP.32, section 2.11.1.13 and SGP32Definitions.asn1", - "type": "string", - "enum": [ - "ok", - "undefinedError" - ] + "description": "Status code of the execution of a profile rollback maneuver, see also GSMA SGP.32, section 2.11.2.1 (RollbackProfileResult)", + "type": "string" + } + }, + { + "setFallbackAttributeResult": { + "description": "setFallbackAttributeResult PSMO result, see also GSMA SGP.32, section 2.11.2.1 (SetFallbackAttributeResult)", + "type": "string" + } + }, + { + "unsetFallbackAttributeResult": { + "description": "unsetFallbackAttributeResult PSMO result, see also GSMA SGP.32, section 2.11.2.1 (UnsetFallbackAttributeResult)", + "type": "string" } }, { "processingTerminated": { - "description": "Error code in case the eUICC has terminated the overall eUICC package execution, see also SGP32Definitions.asn1", - "type": "string", - "enum": [ - "resultSizeOverflow", - "unknownOrDamagedCommand", - "interruption", - "undefinedError" - ] + "description": "Error code in case the eUICC has terminated the overall eUICC package execution, see also GSMA SGP.32, section 2.11.2.1 (EuiccResultData->processingTerminated)", + "type": "string" } }, { - "notificationResult": { - "description": "Status code to indicate that an otherSignedNotification has been received", - "type": "string", - "enum": [ - "otherSignedNotification" - ] + "setDefaultDpAddressResult": { + "description": "setDefaultDpAddressResult PSMO result, see also GSMA SGP.32, section 2.11.2.1 (SetDefaultDpAddressResponse->setDefaultDpAddressResult)", + "type": "string" } }, { - "cancelSessionResult": { - "description": "Status code to indicate that the session has been canceled", - "type": "string", - "enum": [ - "ok", - "undefinedError" - ] + "euiccDataResult": { + "description": "contains the resulting eUICC data objects, see also SGP.32, section 2.11.2.2 (IpaEuiccData)", + "type": "object", + "properties": { + "defaultSmdpAddress": { + "description": "see GSMA SGP.32", + "type": "string" + }, + "euiccInfo1": { + "description": "ASN.1 encoded, see GSMA SGP.22", + "type": "string", + "pattern": "^[0-9A-F].*$" + }, + "euiccInfo2": { + "description": "ASN.1 encoded, see GSMA SGP.22 and GSMA SGP.32", + "type": "string", + "pattern": "^[0-9A-F].*$" + }, + "rootSmdsAddress": { + "description": "see GSMA SGP.32", + "type": "string" + }, + "associationToken": { + "description": "see GSMA SGP.32", + "type": "integer" + }, + "eumCertificate": { + "description": "ASN.1 encoded, see GSMA SGP.22", + "type": "string", + "pattern": "^[0-9A-F].*$" + }, + "euiccCertificate": { + "description": "ASN.1 encoded, see GSMA SGP.22", + "type": "string", + "pattern": "^[0-9A-F].*$" + }, + "ipaCapabilities": { + "description": "ASN.1 encoded, see GSMA SGP.32", + "type": "string", + "pattern": "^[0-9A-F].*$" + }, + "deviceInfo": { + "description": "ASN.1 encoded, see GSMA SGP.32", + "type": "string", + "pattern": "^[0-9A-F].*$" + }, + "notificationsList": { + "description": "ASN.1 encoded, see GSMA SGP.32", + "type": "string", + "pattern": "^[0-9A-F].*$" + } + }, + "additionalProperties": false } }, { "profileInstallationResult": { - "description": "Final result of a profile download, see also SGP32Definitions.asn1", + "description": "Profile installation result (success)", "type": "object", "properties": { - "finalResult": { - "description": "overall status code to inform about succes or failure", - "enum": [ - "successResult", - "errorResult" - ] - }, "iccid": { "description": "ICCID of the profile. (ICCID in nibble-swapped raw format, see also ETSI TS 102 221, section 13.2)", "type": "string", "pattern": "^[0-9A-F]{18,20}$" + }, + "aid": { + "description": "AID of the profile. (ICCID in nibble-swapped raw format, see also ETSI TS 102 221, section 13.2)", + "type": "string", + "pattern": "^[0-9A-F]{5,16}$" + }, + "simaResponse": { + "description": "SIMA Response, see also TCA eUICC Profile Package: Interoperable Format, Technical Specificationsection, section 8.11", + "type": "string", + "pattern": "^[0-9A-F].*$" } }, "required": [ - "finalResult" + "iccid", + "aid", + "simaResponse" ], "additionalProperties": false } @@ -464,103 +383,119 @@ } }, { - "euiccDataResult": { - "description": "contains the result of an ipaEuiccDataRequest request (see also GSMA SGP.32, section 2.11.1.2)", + "cancelSessionReason": { + "description": "Status code to indicate that (and why) the session has been canceled, see also GSMA SGP.22, section 5.7.14 (CancelSessionReason)", + "type": "string" + } + }, + { + "euiccPackageError": { + "description": "indicates a problem with the processing of an eUICC package, see also GSMA SGP.32, section 2.11.2.1 (EuiccPackageErrorCode)", + "type": "string" + } + }, + { + "ipaEuiccDataError": { + "description": "indicates a problem with the retrieval of eUICC data, see also GSMA SGP.32, section 2.11.2.2 (IpaEuiccDataErrorCode)", + "type": "string" + } + }, + { + "eimPackageResultError": { + "description": "indicates a problem with the processing of an eIM package, see also GSMA SGP.32, section 6.3.2.7 (EimPackageResultErrorCode)", + "type": "string" + } + }, + { + "initiateAuthenticationError": { + "description": "indicates an eUICC/SM-DP+ authentication problem, see also GSMA SGP.32, section 6.3.2.1 (initiateAuthenticationErrorEsipa)", + "type": "string" + } + }, + { + "authenticateResponseError": { + "description": "indicates an eUICC/SM-DP+ authentication problem, see also GSMA SGP.22, section 5.7.13 (AuthenticateErrorCode)", + "type": "string" + } + }, + { + "authenticateClientError": { + "description": "indicates an eUICC/SM-DP+ authentication problem, see also GSMA SGP.32, section 6.3.2.2 (authenticateClientErrorEsipa)", + "type": "string" + } + }, + { + "downloadResponseError": { + "description": "indicates a profile download problem, see also GSMA SGP.22, section 5.7.5 (DownloadErrorCode)", + "type": "string" + } + }, + { + "getBoundProfilePackageError": { + "description": "indicates a profile download problem, see also GSMA SGP.23, section 6.3.2.3 (getBoundProfilePackageErrorEsipa)", + "type": "string" + } + }, + { + "cancelSessionResponseError": { + "description": "indicates a session cancellation problem, see also GSMA SGP.23, section 5.14.8 (CancelSessionResponse->cancelSessionResponseError)", + "type": "string" + } + }, + { + "profileInfoListError": { + "description": "indicates a problem during the collection of profile information, see also GSMA SGP.23, section 2.11.2.1 (ProfileInfoListError)", + "type": "string" + } + }, + { + "listEimError": { + "description": "indicates a problem during the collection of eIM information, see also GSMA SGP.23, section 2.11.2.1 (ListEimResult->listEimError)", + "type": "string" + } + }, + { + "profileInstallationError": { + "description": "Indicates a problem during Profile installation", "type": "object", "properties": { - "edrResult": { - "description": "status code of the execution of the ipaEuiccDataRequest", - "type": "string", - "enum": [ - "ok", - "incorrectTagList", - "euiccCiPKIdNotFound", - "undefinedError" - ] + "bppCommandId": { + "description": "Identifies the ES8+ function that has failed, see also GSMA SGP.22, section 2.5.6 and section 5.5", + "type": "string" }, - "euiccData": { - "description": "contains the resulting eUICC data objects", - "type": "object", - "properties": { - "defaultSmdpAddress": { - "description": "see GSMA SGP.32", - "type": "string" - }, - "euiccInfo1": { - "description": "ASN.1 encoded, see GSMA SGP.22", - "type": "string", - "pattern": "^[0-9A-F].*$" - }, - "euiccInfo2": { - "description": "ASN.1 encoded, see GSMA SGP.22 and GSMA SGP.32", - "type": "string", - "pattern": "^[0-9A-F].*$" - }, - "rootSmdsAddress": { - "description": "see GSMA SGP.32", - "type": "string" - }, - "associationToken": { - "description": "see GSMA SGP.32", - "type": "integer" - }, - "eumCertificate": { - "description": "ASN.1 encoded, see GSMA SGP.22", - "type": "string", - "pattern": "^[0-9A-F].*$" - }, - "euiccCertificate": { - "description": "ASN.1 encoded, see GSMA SGP.22", - "type": "string", - "pattern": "^[0-9A-F].*$" - }, - "ipaCapabilities": { - "description": "ASN.1 encoded, see GSMA SGP.32", - "type": "string", - "pattern": "^[0-9A-F].*$" - }, - "deviceInfo": { - "description": "ASN.1 encoded, see GSMA SGP.32", - "type": "string", - "pattern": "^[0-9A-F].*$" - }, - "notificationsList": { - "description": "ASN.1 encoded, see GSMA SGP.32", - "type": "string", - "pattern": "^[0-9A-F].*$" - } - }, - "additionalProperties": false + "errorReason": { + "description": "Reason to narrow down what caused the error, see also GSMA SGP.22, section 2.5.6", + "type": "string" + }, + "simaResponse": { + "description": "SIMA Response, see also TCA eUICC Profile Package: Interoperable Format, Technical Specificationsection, section 8.11", + "type": "string", + "pattern": "^[0-9A-F].*$" } }, "required": [ - "edrResult" + "bppCommandId", + "errorReason", + "simaResponse" ], "additionalProperties": false } }, { - "procedureError": { - "description": "indicates a problem that lead to a termination of a procedure", + "eimProcedureError": { + "description": "indicates an eIM internal problem that lead to a termination of a procedure", "type": "string", - "enum": [ - "initiateAuthenticationError", - "authenticateResponseError", - "authenticateClientError", - "downloadResponseError", - "getBoundProfilePackageError", - "cancelSessionResponseError", - "handleNotificationError", - "euiccSignatureInvalid", - "undefinedError", - "badPsmo", - "badEco", - "badEdr", - "badState", - "badOrder", - "abortedOrder", - "stuckOrder", - "noshowOrder" + "enum": [ + "abortedOrder", + "stuckOrder", + "noshowOrder", + "badOrder", + "badSignature", + "badCounter", + "badEuiccResult", + "badState", + "badEid", + "undefinedError" ] } } diff --git a/src/esipa_asn1_handler.erl b/src/esipa_asn1_handler.erl index 3d0d6b0..df208cf 100644 --- a/src/esipa_asn1_handler.erl +++ b/src/esipa_asn1_handler.erl @@ -50,11 +50,8 @@ }, {initiateAuthenticationOkEsipa, InitAuthOkEsipa}; {initiateAuthenticationError, InitAuthErr} -> - ok = mnesia_db_work:finish( - Pid, - [{[{procedureError, initiateAuthenticationError}]}], - EsipaReq - ), + Outcome = [{[{initiateAuthenticationError, InitAuthErr}]}], + ok = mnesia_db_work:finish(Pid, Outcome, EsipaReq), {initiateAuthenticationErrorEsipa, InitAuthErr} end, {initiateAuthenticationResponseEsipa, EsipaResp}; @@ -76,11 +73,8 @@ authenticateServerResponse => {authenticateResponseOk, AuthRespOk} }}; {authenticateResponseError, AuthRespErr} -> - ok = mnesia_db_work:finish( - Pid, - [{[{procedureError, authenticateResponseError}]}], - EsipaReq - ), + OutcomeEsipa = [{[{authenticateResponseError, AuthRespErr}]}], + ok = mnesia_db_work:finish(Pid, OutcomeEsipa, EsipaReq), {authenticateClientRequest, #{ transactionId => TransactionId, authenticateServerResponse => {authenticateResponseError, AuthRespErr} @@ -99,11 +93,8 @@ {authenticateClientOk, AuthClntRespEs9} -> {authenticateClientOkDPEsipa, AuthClntRespEs9}; {authenticateClientError, AuthClntErr} -> - ok = mnesia_db_work:finish( - Pid, - [{[{procedureError, authenticateClientError}]}], - EsipaReq - ), + OutcomeEs9p = [{[{authenticateClientError, AuthClntErr}]}], + ok = mnesia_db_work:finish(Pid, OutcomeEs9p, EsipaReq), {authenticateClientErrorEsipa, AuthClntErr} end, {authenticateClientResponseEsipa, EsipaResp}; @@ -123,11 +114,9 @@ prepareDownloadResponse => {downloadResponseOk, DwnldRespOk} }}; {downloadResponseError, DwnldRespErr} -> - ok = mnesia_db_work:finish( - Pid, - [{[{procedureError, downloadResponseError}]}], - EsipaReq - ), + DownloadErrorCode = maps:get(downloadErrorCode, DwnldRespErr), + OutcomeEsipa = [{[{downloadResponseError, DownloadErrorCode}]}], + ok = mnesia_db_work:finish(Pid, OutcomeEsipa, EsipaReq), {getBoundProfilePackageRequest, #{ transactionId => TransactionId, prepareDownloadResponse => {downloadResponseError, DwnldRespErr} @@ -148,11 +137,8 @@ % however, this eIM does not support the IPA capability minimizeEsipaBytes) {getBoundProfilePackageOkEsipa, GetBndPrflePkgOk}; {getBoundProfilePackageError, GetBndPrflePkgErr} -> - ok = mnesia_db_work:finish( - Pid, - [{[{procedureError, getBoundProfilePackageError}]}], - EsipaReq - ), + OutcomeEs9p = [{[{getBoundProfilePackageError, GetBndPrflePkgErr}]}], + ok = mnesia_db_work:finish(Pid, OutcomeEs9p, EsipaReq), {getBoundProfilePackageErrorEsipa, GetBndPrflePkgErr} end, {getBoundProfilePackageResponseEsipa, EsipaResp}; @@ -172,11 +158,6 @@ cancelSessionResponse => {cancelSessionResponseOk, CancelSessionRespOk} }}; {cancelSessionResponseError, CancelSessionRespErr} -> - ok = mnesia_db_work:finish( - Pid, - [{[{procedureError, cancelSessionResponseError}]}], - EsipaReq - ), {cancelSessionRequestEs9, #{ transactionId => TransactionId, cancelSessionResponse => {cancelSessionResponseError, CancelSessionRespErr} @@ -221,25 +202,18 @@ % context but it will foward it to the SMDP+ anyway. case mnesia_db_work:bind(Pid, TransactionId) of ok -> - % A work item exists, foward the ProfileInstallationResult and make its contents - % available to the REST API user - case es9p_client:request_json(Es9Req, BaseUrl) of - {} -> - Outcome = esipa_rest_utils:profileInstallationResult_to_outcome( - PrfleInstRslt - ), - ok = mnesia_db_work:finish(Pid, Outcome, EsipaReq); - _ -> - ok = mnesia_db_work:finish( - Pid, - [{[{procedureError, handleNotificationError}]}], - EsipaReq - ) - end; + % A related work item exists, make the notification contents available to the REST API user + Outcome = esipa_rest_utils:profileInstallationResult_to_outcome( + PrfleInstRslt + ), + ok = mnesia_db_work:finish(Pid, Outcome, EsipaReq); _ -> - % No work item exists, foward the ProfileInstallationResult - {} = es9p_client:request_json(Es9Req, BaseUrl) - end; + % No related work item exists, so we cannot do anything useful with the notification + % contents. + ok + end, + % foward the ProfileInstallationResult + {} = es9p_client:request_json(Es9Req, BaseUrl); {otherSignedNotification, OtherSignNotif} -> Es9Req = {handleNotification, #{ @@ -318,11 +292,8 @@ ), case EuiccPackageSigned of error -> - ok = mnesia_db_work:finish( - Pid, - [{[{procedureError, badPsmo}]}], - EsipaReq - ), + Outcome = [{[{eimProcedureError, badOrder}]}], + ok = mnesia_db_work:finish(Pid, Outcome, EsipaReq), {eimPackageError, undefinedError}; _ -> EimSignature = crypto_utils:sign_euiccPackageSigned( @@ -344,11 +315,8 @@ ), case EuiccPackageSigned of error -> - ok = mnesia_db_work:finish( - Pid, - [{[{procedureError, badEco}]}], - EsipaReq - ), + Outcome = [{[{eimProcedureError, badOrder}]}], + ok = mnesia_db_work:finish(Pid, Outcome, EsipaReq), {eimPackageError, undefinedError}; _ -> EimSignature = crypto_utils:sign_euiccPackageSigned( @@ -368,11 +336,8 @@ ), case IpaEuiccDataRequest of error -> - ok = mnesia_db_work:finish( - Pid, - [{[{procedureError, badEdr}]}], - EsipaReq - ), + Outcome = [{[{eimProcedureError, badOrder}]}], + ok = mnesia_db_work:finish(Pid, Outcome, EsipaReq), {eimPackageError, undefinedError}; _ -> IpaEuiccDataRequest @@ -380,7 +345,7 @@ none -> {eimPackageError, noEimPackageAvailable}; _ -> - ok = mnesia_db_work:finish(Pid, [{[{procedureError, badOrder}]}], EsipaReq), + ok = mnesia_db_work:finish(Pid, [{[{eimProcedureError, badOrder}]}], EsipaReq), {eimPackageError, undefinedError} end, {getEimPackageResponse, EsipaResp}; @@ -423,7 +388,8 @@ {provideEimPackageResultResponse, {emptyResponse, #{}}}; %Unsupported request handle_asn1(Pid, Request) -> - mnesia_db_work:finish(Pid, [{[{procedureError, abortedOrder}]}], unsupported), + Outcome = [{[{eimProcedureError, abortedOrder}]}], + mnesia_db_work:finish(Pid, Outcome, unsupported), logger:info( "Handling of IPAd request failed, the request type is unsupported,~nRequest=~p,~nPid=~p~n", [Request, Pid] diff --git a/src/esipa_asn1_handler_utils.erl b/src/esipa_asn1_handler_utils.erl index 373922f..ebff01b 100644 --- a/src/esipa_asn1_handler_utils.erl +++ b/src/esipa_asn1_handler_utils.erl @@ -77,10 +77,10 @@ EuiccPackageResultDataSigned ); _ -> - [{[{euiccPackageErrorCode, counterValueMismatch}]}] + [{[{eimProcedureError, badCounter}]}] end; _ -> - [{[{procedureError, euiccSignatureInvalid}]}] + [{[{eimProcedureError, badSignature}]}] end; {euiccPackageErrorSigned, EuiccPackageErrorSigned} -> case @@ -95,15 +95,17 @@ ), case CheckCounterValue(EuiccPackageErrorDataSigned) of ok -> - [{[{euiccPackageErrorCode, EuiccPackageErrorCode}]}]; + [{[{euiccPackageError, EuiccPackageErrorCode}]}]; _ -> - [{[{euiccPackageErrorCode, counterValueMismatch}]}] + [{[{eimProcedureError, badCounter}]}] end; _ -> - [{[{procedureError, euiccSignatureInvalid}]}] + [{[{eimProcedureError, badSignature}]}] end; {euiccPackageErrorUnsigned, _} -> - [{[{euiccPackageErrorCode, undefinedError}]}] + [{[{euiccPackageError, undefinedError}]}]; + _ -> + [{[{eimProcedureError, badEuiccResult}]}] end, mnesia_db_work:finish(Pid, Outcome, Debuginfo). @@ -127,5 +129,5 @@ EimTransactionId = maps:get(eimTransactionId, EimPackageResultResponseError), {_, _, _} = mnesia_db_work:pickup(Pid, EimTransactionId), EimPackageResultErrorCode = maps:get(eimPackageResultErrorCode, EimPackageResultResponseError), - Outcome = [{[{eimPackageError, EimPackageResultErrorCode}]}], + Outcome = [{[{eimPackageResultError, EimPackageResultErrorCode}]}], mnesia_db_work:finish(Pid, Outcome, Debuginfo). diff --git a/src/esipa_asn1_http_handler.erl b/src/esipa_asn1_http_handler.erl index 3b03826..fdb5706 100644 --- a/src/esipa_asn1_http_handler.erl +++ b/src/esipa_asn1_http_handler.erl @@ -61,7 +61,7 @@ ok; _ -> mnesia_db_work:finish( - maps:get(pid, Req0), [{[{procedureError, abortedOrder}]}], Reason + maps:get(pid, Req0), [{[{eimProcedureError, abortedOrder}]}], Reason ), logger:info( "Handling of IPAd request (ASN.1) terminated unexpectedly, Reason=~p Pid=~p~n", diff --git a/src/esipa_json_handler.erl b/src/esipa_json_handler.erl index c5d8368..a0911b5 100644 --- a/src/esipa_json_handler.erl +++ b/src/esipa_json_handler.erl @@ -412,7 +412,7 @@ end; %Unsupported request handle_json(Pid, Request) -> - mnesia_db_work:finish(Pid, [{[{procedureError, abortedOrder}]}], unsupported), + mnesia_db_work:finish(Pid, [{[{eimProcedureError, abortedOrder}]}], unsupported), logger:info( "Handling of IPAd request failed, the request type is unsupported,~nRequest=~p,~nPid=~p~n", [Request, Pid] diff --git a/src/esipa_json_http_handler.erl b/src/esipa_json_http_handler.erl index 7d2de97..20fb61a 100644 --- a/src/esipa_json_http_handler.erl +++ b/src/esipa_json_http_handler.erl @@ -56,7 +56,7 @@ ok; _ -> mnesia_db_work:finish( - maps:get(pid, Req0), [{[{procedureError, abortedOrder}]}], Reason + maps:get(pid, Req0), [{[{eimProcedureError, abortedOrder}]}], Reason ), logger:info( "Handling of IPAd request (JSON) terminated unexpectedly, Reason=~p Pid=~p~n", diff --git a/src/esipa_rest_utils.erl b/src/esipa_rest_utils.erl index 419bc0a..b481d1c 100644 --- a/src/esipa_rest_utils.erl +++ b/src/esipa_rest_utils.erl @@ -377,12 +377,12 @@ case ListProfileInfoResult of {profileInfoListOk, ProfileInfoListOk} -> - ProfileInfoList = [ProfileInfo2Json(O) || O <- ProfileInfoListOk], - ListProfileInfoResultValue = - {[{finalResult, successResult}, {profileInfoList, ProfileInfoList}]}, - {[{listProfileInfoResult, ListProfileInfoResultValue}]}; + ListProfileInfoResultRest = [ProfileInfo2Json(O) || O <- ProfileInfoListOk], + {[{listProfileInfoResult, ListProfileInfoResultRest}]}; + {profileInfoListError, ProfileInfoListError} -> + {[{profileInfoListError, ProfileInfoListError}]}; _ -> - {[{listProfileInfoResult, {[{finalResult, errorResult}]}}]} + {[{eimProcedureError, badEuiccResult}]} end. result_to_json_listEimResult(ListEimResult) -> @@ -395,22 +395,24 @@ end, case ListEimResult of + % Same here, let's flatten this {eimIdList, EimIdList} -> - EimIdInfoList = [EimIdList2Json(O) || O <- EimIdList], - ListEimResultValue = {[{finalResult, successResult}, {eimIdList, EimIdInfoList}]}, - {[{listEimResult, ListEimResultValue}]}; + ListEimResultRest = [EimIdList2Json(O) || O <- EimIdList], + {[{listEimResult, ListEimResultRest}]}; + {listEimError, ListEimError} -> + {[{listEimError, ListEimError}]}; _ -> - {[{listEimResult, {[{finalResult, errorResult}]}}]} + {[{eimProcedureError, badEuiccResult}]} end. result_to_json_addEimResult(AddEimResult) -> case AddEimResult of {associationToken, AssociationToken} -> - {[{addEimResult, {[{addEimResultCode, ok}, {associationToken, AssociationToken}]}}]}; + {[{addEimResult, {[{associationToken, AssociationToken}]}}]}; {addEimResultCode, AddEimResultCode} -> {[{addEimResult, {[{addEimResultCode, AddEimResultCode}]}}]}; _ -> - {[{addEimResult, {[{addEimResultCode, malformedResult}]}}]} + {[{eimProcedureError, badEuiccResult}]} end. result_to_json_getRATResult(GetRATResult) -> @@ -437,7 +439,7 @@ % generate a JSON encodeable outcome (JSON REST API) from an EuiccPackageResultDataSigned euiccPackageResultDataSigned_to_outcome(EuiccPackageResultDataSigned) -> EuiccResult = maps:get(euiccResult, EuiccPackageResultDataSigned), - Error = {[{error, malformedResult}]}, + Error = {[{eimProcedureError, badEuiccResult}]}, EuiccResultData2Json = fun(EuiccResultData) -> case EuiccResultData of {enableResult, EnableResult} -> @@ -485,31 +487,50 @@ profileInstallationResultData, ProfileInstallationResult ), NotificationMetadata = maps:get(notificationMetadata, ProfileInstallationResultData), + Iccid = maps:get(iccid, NotificationMetadata, <<"">>), FinalResult = maps:get(finalResult, ProfileInstallationResultData), - case FinalResult of - {successResult, _} -> - Iccid = maps:get(iccid, NotificationMetadata), + {successResult, SuccessResult} -> + Aid = maps:get(aid, SuccessResult), + SimaResponse = maps:get(simaResponse, SuccessResult), [ {[ {profileInstallationResult, {[ - {finalResult, successResult}, - {iccid, utils:binary_to_hex(Iccid)} + {iccid, utils:binary_to_hex(Iccid)}, + {aid, utils:binary_to_hex(Aid)}, + {simaResponse, utils:binary_to_hex(SimaResponse)} + ]}} + ]} + ]; + {errorResult, ErrorResult} -> + BppCommandId = maps:get(bppCommandId, ErrorResult), + ErrorReason = maps:get(errorReason, ErrorResult), + SimaResponse = maps:get(simaResponse, ErrorResult, <<"">>), + [ + {[ + {profileInstallationError, + {[ + {bppCommandId, BppCommandId}, + {errorReason, ErrorReason}, + {simaResponse, utils:binary_to_hex(SimaResponse)} ]}} ]} ]; _ -> - [{[{profileInstallationResult, {[{finalResult, errorResult}]}}]}] + {[{eimProcedureError, badEuiccResult}]} end. % generate a JSON encodeable outcome (JSON REST API) from an CancelSessionResponse cancelSessionResponse_to_outcome(CancelSessionResponse) -> case CancelSessionResponse of - {cancelSessionResponseOk, _} -> - [{[{cancelSessionResult, ok}]}]; + {cancelSessionResponseOk, #{euiccCancelSessionSigned := EuiccCancelSessionSigned}} -> + CancelSessionReason = maps:get(reason, EuiccCancelSessionSigned), + [{[{cancelSessionReason, CancelSessionReason}]}]; + {cancelSessionResponseError, CancelSessionResponseError} -> + [{[{cancelSessionResponseError, CancelSessionResponseError}]}]; _ -> - [{[{cancelSessionResult, undefinedError}]}] + {[{eimProcedureError, badEuiccResult}]} end. % Generate an ipaEuiccDataRequest from a eDR Order (JSON REST API) @@ -579,9 +600,9 @@ ], IpaEuiccDataJsonFiltered = {lists:filter(fun(Member) -> Member /= nil end, IpaEuiccDataJson)}, - [{[{euiccDataResult, {[{edrResult, ok}, {euiccData, IpaEuiccDataJsonFiltered}]}}]}]; + [{[{euiccDataResult, IpaEuiccDataJsonFiltered}]}]; {ipaEuiccDataResponseError, #{ipaEuiccDataErrorCode := IpaEuiccDataErrorCode}} -> - [{[{euiccDataResult, {[{edrResult, IpaEuiccDataErrorCode}]}}]}]; + [{[{ipaEuiccDataError, IpaEuiccDataErrorCode}]}]; _ -> - [{[{euiccDataResult, {[{edrResult, undefinedError}]}}]}] + [{[{eimProcedureError, badEuiccResult}]}] end. diff --git a/src/mnesia_db.erl b/src/mnesia_db.erl index 63028c4..62cd861 100644 --- a/src/mnesia_db.erl +++ b/src/mnesia_db.erl @@ -99,7 +99,7 @@ mnesia_db_rest:trans_set_status( ResourceId, done, - [{[{procedureError, abortedOrder}]}], + [{[{eimProcedureError, abortedOrder}]}], none ) end, diff --git a/src/mnesia_db_euicc.erl b/src/mnesia_db_euicc.erl index 2c18990..6940ebb 100644 --- a/src/mnesia_db_euicc.erl +++ b/src/mnesia_db_euicc.erl @@ -115,11 +115,14 @@ stateChangeCauseList -> mnesia:write(Row#euicc{stateChangeCauseList = Value}); _ -> + % eimProcedureError throw(badState) end; [] -> - throw(eidUnknown); + % eimProcedureError + throw(badEid); _ -> + % eimProcedureError throw(undefinedError) end. @@ -142,11 +145,14 @@ stateChangeCauseList -> Row#euicc.stateChangeCauseList; _ -> + % eimProcedureError throw(badState) end; [] -> - throw(eidUnknown); + % eimProcedureError + throw(badEid); _ -> + % eimProcedureError throw(undefinedError) end. @@ -244,6 +250,7 @@ ok = trans_state_set(EidValue, binary_to_atom(Name), Value), {[{Name, Value}]}; _ -> + % eimProcedureError throw(badOrder) end end, @@ -258,6 +265,7 @@ {[{<<"euicc">>, {[{<<"get">>, States}]}}]} -> [{[{euiccStateResult, [HandleStateGet(EidValue, State) || State <- States]}]}]; _ -> + % eimProcedureError throw(badOrder) end end, @@ -268,10 +276,10 @@ Outcome; {aborted, {throw, ErrorCode}} -> logger:error("eUICC: order process failed with error code ~p~n", [ErrorCode]), - [{[{procedureError, ErrorCode}]}]; + [{[{eimProcedureError, ErrorCode}]}]; _ -> logger:error("eUICC: order process failed, database error~n"), - [{[{procedureError, undefinedError}]}] + [{[{eimProcedureError, undefinedError}]}] end. timer_rest_finish(RestResource, Outcome) -> diff --git a/src/mnesia_db_rest.erl b/src/mnesia_db_rest.erl index 0976beb..cef68c9 100644 --- a/src/mnesia_db_rest.erl +++ b/src/mnesia_db_rest.erl @@ -169,7 +169,7 @@ end, % set status in the rest table - trans_set_status(ResourceId, done, [{[{procedureError, stuckOrder}]}], none) + trans_set_status(ResourceId, done, [{[{eimProcedureError, stuckOrder}]}], none) end, % Find all rest resources that stall in status "work" and older than the specified timeout value @@ -202,7 +202,7 @@ % Remove Resource from work table and set an appropriate status in the rest table HandleResource = fun(ResourceId) -> - trans_set_status(ResourceId, done, [{[{procedureError, noshowOrder}]}], none) + trans_set_status(ResourceId, done, [{[{eimProcedureError, noshowOrder}]}], none) end, % Find all rest resources that stall in status "work" and older than the specified timeout value diff --git a/src/mnesia_db_work.erl b/src/mnesia_db_work.erl index 1d488be..3c11112 100644 --- a/src/mnesia_db_work.erl +++ b/src/mnesia_db_work.erl @@ -35,7 +35,7 @@ {atomic, PidExists} = mnesia:transaction(TransPidExists), case PidExists of true -> - finish(Pid, [{[{procedureError, stuckOrder}]}], none); + finish(Pid, [{[{eimProcedureError, stuckOrder}]}], none); false -> ok end, -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43402?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I16cc063c185727e1b30f26d656bd15154504b087 Gerrit-Change-Number: 43402 Gerrit-PatchSet: 5 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[L] Change in onomondo-eim[master]: rest_api_response_schema: re-structure REST API responses
by dexter 09 Sep '26

09 Sep '26

dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43402?usp=email ) Change subject: rest_api_response_schema: re-structure REST API responses ...................................................................... Patch Set 5: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43402?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I16cc063c185727e1b30f26d656bd15154504b087 Gerrit-Change-Number: 43402 Gerrit-PatchSet: 5 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Wed, 09 Sep 2026 08:03:36 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in onomondo-eim[master]: cosmetic/esipa_rest_utils: re-order IpaEuiccDataJson list
by dexter 09 Sep '26

09 Sep '26

dexter has submitted this change. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43401?usp=email ) Change subject: cosmetic/esipa_rest_utils: re-order IpaEuiccDataJson list ...................................................................... cosmetic/esipa_rest_utils: re-order IpaEuiccDataJson list The order of the IEs in that list are not in the same order as in the SGP.32 ASN.1 spec. Change-Id: I6f962ce90d512369f8df37928546ec4b437d0b48 --- M src/esipa_rest_utils.erl 1 file changed, 6 insertions(+), 6 deletions(-) Approvals: dexter: Looks good to me, approved laforge: Looks good to me, but someone else must approve Jenkins Builder: Verified diff --git a/src/esipa_rest_utils.erl b/src/esipa_rest_utils.erl index c415692..419bc0a 100644 --- a/src/esipa_rest_utils.erl +++ b/src/esipa_rest_utils.erl @@ -531,6 +531,12 @@ case IpaEuiccDataResponse of {ipaEuiccData, IpaEuiccData} -> IpaEuiccDataJson = [ + memberOrNilAsnHex( + notificationsList, + IpaEuiccData, + 'SGP32Definitions', + 'PendingNotificationList' + ), memberOrNil(defaultSmdpAddress, IpaEuiccData), memberOrNilAsnHex( euiccInfo1, @@ -569,12 +575,6 @@ IpaEuiccData, 'RSPDefinitions', 'DeviceInfo' - ), - memberOrNilAsnHex( - notificationsList, - IpaEuiccData, - 'SGP32Definitions', - 'PendingNotificationList' ) ], IpaEuiccDataJsonFiltered = -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43401?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I6f962ce90d512369f8df37928546ec4b437d0b48 Gerrit-Change-Number: 43401 Gerrit-PatchSet: 3 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: laforge <laforge(a)osmocom.org>

1 0

[S] Change in onomondo-eim[master]: cosmetic/esipa_rest_utils: re-order IpaEuiccDataJson list
by dexter 09 Sep '26

09 Sep '26

Attention is currently required from: jolly. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43401?usp=email ) Change subject: cosmetic/esipa_rest_utils: re-order IpaEuiccDataJson list ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/onomondo-eim/+/43401?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: onomondo-eim Gerrit-Branch: master Gerrit-Change-Id: I6f962ce90d512369f8df37928546ec4b437d0b48 Gerrit-Change-Number: 43401 Gerrit-PatchSet: 3 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Wed, 09 Sep 2026 08:03:17 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

2026

2025

2024

2023

2022

gerrit-log September 2026