Hello Jenkins Builder,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/aram-applet/+/39614?usp=email
to look at the new patch set (#2).
Change subject: AccessRuleMaster: use constants for the command bytes
......................................................................
AccessRuleMaster: use constants for the command bytes
The command bytes (0xF0, b0xF1, 0xF2) only appear as magic numbers
in the code. Let's use constants, so that it is clear what those
bytes mean and where they come from.
Related: SYS#7245
Change-Id: Ia3ccb511886b7da9a3a8e4ab7c89af3ab99c0abf
---
M aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java
1 file changed, 9 insertions(+), 7 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/aram-applet refs/changes/14/39614/2
--
To view, visit https://gerrit.osmocom.org/c/aram-applet/+/39614?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: aram-applet
Gerrit-Branch: master
Gerrit-Change-Id: Ia3ccb511886b7da9a3a8e4ab7c89af3ab99c0abf
Gerrit-Change-Number: 39614
Gerrit-PatchSet: 2
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/aram-applet/+/39615?usp=email )
Change subject: AccessRuleMaster: allow locking of STORE DATA commands
......................................................................
AccessRuleMaster: allow locking of STORE DATA commands
The ara-m applet has no security features whatsoever. The rules can
be edited by any user that has APDU access to the ARA-M application.
To add a bit of security for users who want to make sure that their
ARA-M rules are not edited by unauthorized partys, let's add a
propritary lock/unlock command that can be used to lock the access
to STORE DATA on the normal APDU interface of the application. Once
locked, the access to STORE DATA can only be unlocked via an INSTALL
for personalization command that is issued from the ISD on a secure
channel.
Related: SYS#7245
Change-Id: I86437844585c22fc4280cc48b99edbb56e3159db
---
M aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java
1 file changed, 16 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/aram-applet refs/changes/15/39615/1
diff --git a/aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java b/aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java
index bdce9c3..4e90f80 100644
--- a/aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java
+++ b/aram/src/main/java/fr/bmartel/aram/AccessRuleMaster.java
@@ -48,6 +48,9 @@
public final static byte COMMAND_DELETE = (byte) 0xF1;
public final static byte COMMAND_UPDATE_REFRESH_TAG = (byte) 0xF2;
+ public final static byte COMMAND_LOCK_ARAM = (byte) 0xA1;
+ public final static byte COMMAND_UNLOCK_ARAM = (byte) 0xA2;
+
/**
* APDU data size.
*/
@@ -70,6 +73,11 @@
* current chunk index to send for next GET NEXT command.
*/
private short currentNext;
+ /**
+ * lock status of the Access Rule Master. When set to true, it is no longer possible to issue
+ * STORE DATA commands to the applet through its process interface.
+ */
+ private boolean aram_lock_status;
private AccessRuleMaster() {
refreshTag = new byte[8];
@@ -94,7 +102,8 @@
case INS_STORE_DATA:
if (apdu.setIncomingAndReceive() != (short) (buffer[ISO7816.OFFSET_LC] & 0xFF))
ISOException.throwIt(ISO7816.SW_WRONG_LENGTH);
-
+ if (this.aram_lock_status)
+ ISOException.throwIt(ISO7816.SW_SECURITY_STATUS_NOT_SATISFIED);
processCmdStoreData(APDU.getCurrentAPDUBuffer());
break;
case INS_GET_DATA:
@@ -291,6 +300,12 @@
deleteArDo(buf);
} else if (buf[ofs] == AccessRuleMaster.COMMAND_UPDATE_REFRESH_TAG) {
updateRefreshTag();
+ } else if (buf[ofs] == AccessRuleMaster.COMMAND_LOCK_ARAM) {
+ this.aram_lock_status = true;
+ return;
+ } else if (buf[ofs] == AccessRuleMaster.COMMAND_UNLOCK_ARAM) {
+ this.aram_lock_status = false;
+ return;
} else {
ISOException.throwIt(ISO7816.SW_DATA_INVALID);
}
--
To view, visit https://gerrit.osmocom.org/c/aram-applet/+/39615?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: aram-applet
Gerrit-Branch: master
Gerrit-Change-Id: I86437844585c22fc4280cc48b99edbb56e3159db
Gerrit-Change-Number: 39615
Gerrit-PatchSet: 1
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Attention is currently required from: pespin.
Hello Jenkins Builder,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/libosmo-sigtran/+/39613?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Verified-1 by Jenkins Builder
Change subject: vty: show cs7 route: display qos-class configured value
......................................................................
vty: show cs7 route: display qos-class configured value
Change-Id: I2d2a246c7fbdf495af94ac5da14d4a93ef837f81
---
M src/osmo_ss7_vty.c
M tests/vty/osmo_stp_route_prio.vty
2 files changed, 13 insertions(+), 6 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/13/39613/2
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/39613?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: I2d2a246c7fbdf495af94ac5da14d4a93ef837f81
Gerrit-Change-Number: 39613
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/39612?usp=email )
Change subject: pySim-shell: obey quit command in startup commands+scripts
......................................................................
pySim-shell: obey quit command in startup commands+scripts
Startup scripts are executed using the cmd2 provided onecmd_plus_hooks
method. This method can run arbitrary commands, which also includes
the command "run_scrit" that we use to execute startup scripts.
When a script executes a quit command, or when someone issues a quit
command using the --execute-command or the command argument, then
this commands is executed. However a quit command won't actually quit
the process. All it does is to change the return code of
app.onecmd_plus_hooks (see [1]). So we must evaluate the return code
and take care of the quitting ourselves.
[1] https://cmd2.readthedocs.io/en/0.9.15/api/cmd.html#cmd2.cmd2.Cmd.onecmd_plu…
Related: OS#6731
Change-Id: Ic6e9c54cdb6955d65011af3eb5a025eee5da4143
---
M pySim-shell.py
1 file changed, 9 insertions(+), 3 deletions(-)
Approvals:
Jenkins Builder: Verified
laforge: Looks good to me, approved
diff --git a/pySim-shell.py b/pySim-shell.py
index 9733b22..c59e481 100755
--- a/pySim-shell.py
+++ b/pySim-shell.py
@@ -1159,14 +1159,18 @@
# Run optional commands
for c in opts.execute_command:
if not startup_errors:
- app.onecmd_plus_hooks(c)
+ stop = app.onecmd_plus_hooks(c)
+ if stop == True:
+ sys.exit(0)
else:
print("Errors during startup, refusing to execute command (%s)" % c)
# Run optional command
if opts.command:
if not startup_errors:
- app.onecmd_plus_hooks('{} {}'.format(opts.command, ' '.join(opts.command_args)))
+ stop = app.onecmd_plus_hooks('{} {}'.format(opts.command, ' '.join(opts.command_args)))
+ if stop == True:
+ sys.exit(0)
else:
print("Errors during startup, refusing to execute command (%s)" % opts.command)
@@ -1177,7 +1181,9 @@
print("Error: script file (%s) not readable!" % opts.script)
startup_errors = True
else:
- app.onecmd_plus_hooks('{} {}'.format('run_script', opts.script), add_to_history = False)
+ stop = app.onecmd_plus_hooks('{} {}'.format('run_script', opts.script), add_to_history = False)
+ if stop == True:
+ sys.exit(0)
else:
print("Errors during startup, refusing to execute script (%s)" % opts.script)
--
To view, visit https://gerrit.osmocom.org/c/pysim/+/39612?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: pysim
Gerrit-Branch: master
Gerrit-Change-Id: Ic6e9c54cdb6955d65011af3eb5a025eee5da4143
Gerrit-Change-Number: 39612
Gerrit-PatchSet: 1
Gerrit-Owner: dexter <pmaier(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>