- gerrit-log - lists.osmocom.org

[M] Change in pysim[master]: add PlmnAdapter for decoding PLMN bcd-strings like 262f01 to 262-01
by fixeria 29 Dec '23

29 Dec '23

Attention is currently required from: laforge. fixeria has posted comments on this change. ( https://gerrit.osmocom.org/c/pysim/+/35451?usp=email ) Change subject: add PlmnAdapter for decoding PLMN bcd-strings like 262f01 to 262-01 ...................................................................... Patch Set 3: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35451?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I96f276e6dcdb54a5a3d2bcde5ee6dbaf981ed789 Gerrit-Change-Number: 35451 Gerrit-PatchSet: 3 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Fri, 29 Dec 2023 11:22:39 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in libosmocore[master]: tests: fix update-exp: soft_uart_test overwrites rlp_test.ok
by laforge 29 Dec '23

29 Dec '23

Attention is currently required from: fixeria. laforge has posted comments on this change. ( https://gerrit.osmocom.org/c/libosmocore/+/35463?usp=email ) Change subject: tests: fix update-exp: soft_uart_test overwrites rlp_test.ok ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/35463?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I41ea2c3d5b1e2e0349740acd63c39413472e0dad Gerrit-Change-Number: 35463 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 29 Dec 2023 07:54:43 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in libosmocore[master]: tests: fix update-exp: soft_uart_test overwrites rlp_test.ok
by fixeria 29 Dec '23

29 Dec '23

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/35463?usp=email ) Change subject: tests: fix update-exp: soft_uart_test overwrites rlp_test.ok ...................................................................... tests: fix update-exp: soft_uart_test overwrites rlp_test.ok Change-Id: I41ea2c3d5b1e2e0349740acd63c39413472e0dad Fixes: 9ef304dd2 "soft_uart: add unit tests for the receiver and transmitter" --- M tests/Makefile.am 1 file changed, 11 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/63/35463/1 diff --git a/tests/Makefile.am b/tests/Makefile.am index 4eac635..72ecc1e 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -709,7 +709,7 @@ >$(srcdir)/osmo_io/osmo_io_test.ok \ 2>$(srcdir)/osmo_io/osmo_io_test.err soft_uart/soft_uart_test \ - >$(srcdir)/soft_uart/soft_uart.ok \ + >$(srcdir)/soft_uart/soft_uart.ok rlp/rlp_test \ >$(srcdir)/rlp/rlp_test.ok \ $(NULL) -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/35463?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I41ea2c3d5b1e2e0349740acd63c39413472e0dad Gerrit-Change-Number: 35463 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-MessageType: newchange

1 0

[L] Change in libosmocore[master]: tests/{gb,iuup}: also match stderr
by fixeria 29 Dec '23

29 Dec '23

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/35464?usp=email ) Change subject: tests/{gb,iuup}: also match stderr ...................................................................... tests/{gb,iuup}: also match stderr Change-Id: Icc2b372563f9ca142d256f2b8e9700220c37fddf --- M tests/Makefile.am A tests/gb/gprs_ns2_test.err A tests/gb/gprs_ns_test.err A tests/iuup/iuup_test.err M tests/testsuite.at 5 files changed, 367 insertions(+), 7 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/64/35464/1 diff --git a/tests/Makefile.am b/tests/Makefile.am index 72ecc1e..478dd48 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -414,10 +414,13 @@ gsm0408/gsm0408_test.ok gsm0408/gsm0408_test.err \ gsm0808/gsm0808_test.ok gb/bssgp_fc_tests.err \ gb/bssgp_fc_tests.ok gb/bssgp_fc_tests.sh \ - gb/gprs_bssgp_test.ok gb/gprs_ns_test.ok gea/gea_test.ok \ + gb/gprs_bssgp_test.ok gea/gea_test.ok \ gb/gprs_bssgp_rim_test.ok \ gb/gprs_ns2_vty.vty gb/osmoappdesc.py gb/osmo-ns-dummy.cfg \ + gb/gprs_ns_test.ok \ + gb/gprs_ns_test.err \ gb/gprs_ns2_test.ok \ + gb/gprs_ns2_test.err \ gprs/gprs_test.ok kasumi/kasumi_test.ok \ msgfile/msgfile_test.ok msgfile/msgconfig.cfg \ logging/logging_test.ok logging/logging_test.err \ @@ -483,6 +486,7 @@ gsm48/rest_octets_test.ok \ base64/base64_test.ok \ iuup/iuup_test.ok \ + iuup/iuup_test.err \ smscb/smscb_test.ok \ smscb/gsm0341_test.ok \ smscb/cbsp_test.ok \ @@ -605,9 +609,11 @@ gb/gprs_bssgp_rim_test \ >$(srcdir)/gb/gprs_bssgp_rim_test.ok gb/gprs_ns_test \ - >$(srcdir)/gb/gprs_ns_test.ok + >$(srcdir)/gb/gprs_ns_test.ok \ + 2>$(srcdir)/gb/gprs_ns_test.err gb/gprs_ns2_test \ - >$(srcdir)/gb/gprs_ns2_test.ok + >$(srcdir)/gb/gprs_ns2_test.ok \ + 2>$(srcdir)/gb/gprs_ns2_test.err endif if ENABLE_UTILITIES utils/utils_test \ @@ -698,7 +704,8 @@ time_cc/time_cc_test \ >$(srcdir)/time_cc/time_cc_test.ok iuup/iuup_test \ - >$(srcdir)/iuup/iuup_test.ok + >$(srcdir)/iuup/iuup_test.ok \ + 2>$(srcdir)/iuup/iuup_test.err v110/frame_test \ >$(srcdir)/v110/frame_test.ok v110/ra1_test \ diff --git a/tests/gb/gprs_ns2_test.err b/tests/gb/gprs_ns2_test.err new file mode 100644 index 0000000..5ed62db --- /dev/null +++ b/tests/gb/gprs_ns2_test.err @@ -0,0 +1,139 @@ +NSE(01001) NS-STATUS.ind(bvci=00000): cause=NSE recovery, transfer=42, first=1, mtu=119 +NSE(01001) NS-STATUS.ind(bvci=00000): cause=NSE failure, transfer=0, first=0, mtu=119 +NSE(01001)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01001)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01001)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01001) NS-STATUS.ind(bvci=00000): cause=NSE recovery, transfer=42, first=1, mtu=119 +NSE(01001)-NSVC(none) Tx NS-BLOCK cause=O&M intervention +NSE(01001)-NSVC(none) Tx NS-ALIVE +NSE(01001)-NSVC(none) Tx NS-UNBLOCK +NSE(01001)-NSVC(none) Rx NS-UNBLOCK-ACK +NSE(01001)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC recovery, transfer=84, first=0, mtu=119 +NSE(01001) NS-STATUS.ind(bvci=00000): cause=NSE failure, transfer=0, first=0, mtu=119 +NSE(01001)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01001)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01001) NS-STATUS.ind(bvci=00000): cause=NSE recovery, transfer=42, first=1, mtu=119 +NSE(01001)-NSVC(none) Tx NS-BLOCK cause=O&M intervention +NSE(01001)-NSVC(none) Tx NS-ALIVE +NSE(01001) NS-STATUS.ind(bvci=00000): cause=NSE failure, transfer=0, first=0, mtu=119 +NSE(01001)-NSVC(none) Tx NS-BLOCK cause=O&M intervention +NSE(01001)-NSVC(none) Tx NS-ALIVE +NSE(01001)-NSVC(none) Tx NS-UNBLOCK +NSE(01001)-NSVC(none) Rx NS-UNBLOCK-ACK +NSE(01001) NS-STATUS.ind(bvci=00000): cause=NSE recovery, transfer=42, first=0, mtu=119 +NSE(01001)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC recovery, transfer=42, first=0, mtu=119 +NSE(01001) NS-STATUS.ind(bvci=00000): cause=NSE failure, transfer=0, first=0, mtu=119 +NSE(01001)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01001)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01004)-NSVC(none) Tx NS-RESET cause=O&M intervention +NSE(01004)-NSVC(none) Rx NS-RESET +NSE(01004)-NSVC(none) Tx NS-RESET-ACK +NSE(01004)-NSVC(none) Tx NS-ALIVE +NSE(01004)-NSVC(none) Tx NS-UNBLOCK +NSE(01004)-NSVC(none) Rx NS-UNBLOCK +NSE(01004)-NSVC(none) Tx NS-UNBLOCK-ACK +NSE(01004) NS-STATUS.ind(bvci=00000): cause=NSE recovery, transfer=42, first=1, mtu=119 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC recovery, transfer=42, first=0, mtu=119 +NSE(01004)-NSVC(none) Tx NS-RESET cause=O&M intervention +NSE(01004)-NSVC(none) Rx NS-RESET +NSE(01004)-NSVC(none) Tx NS-RESET-ACK +NSE(01004)-NSVC(none) Tx NS-ALIVE +NSE(01004)-NSVC(none) Tx NS-UNBLOCK +NSE(01004)-NSVC(none) Rx NS-UNBLOCK +NSE(01004)-NSVC(none) Tx NS-UNBLOCK-ACK +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC recovery, transfer=84, first=0, mtu=119 +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-BLOCK cause=O&M intervention +NSE(01004)-NSVC(none) Tx NS-BLOCK-ACK +NSE(01004)-NSVC(none) Rx NS-BLOCK-ACK +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-STATUS cause=NS-VC blocked +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004) NS-STATUS.ind(bvci=00000): cause=NSE failure, transfer=0, first=0, mtu=119 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01004)-NSVC(none) Tx NS-ALIVE +NSE(01004)-NSVC(none) Tx NS-ALIVE-ACK +NSE(01004)-NSVC(none) Rx NS-ALIVE-ACK +NSE(01004) NS-STATUS.ind(bvci=00000): cause=NSE recovery, transfer=42, first=1, mtu=119 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC recovery, transfer=42, first=0, mtu=119 +NSE(01004)-NSVC(none) Tx NS-ALIVE +NSE(01004)-NSVC(none) Tx NS-ALIVE-ACK +NSE(01004)-NSVC(none) Rx NS-ALIVE-ACK +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC recovery, transfer=84, first=0, mtu=119 +NSE(01004)-NSVC(none) Tx NS-ALIVE +NSE(01004)-NSVC(none) Tx NS-ALIVE-ACK +NSE(01004)-NSVC(none) Rx NS-ALIVE-ACK +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC recovery, transfer=126, first=0, mtu=119 +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-UNITDATA +NSE(01004)-NSVC(none) Tx NS-UNITDATA +count_pdus(bind[0]) = 2 +count_pdus(bind[1]) = 4 +count_pdus(bind[2]) = 6 +NSE(01004) NS-STATUS.ind(bvci=00000): cause=NSE failure, transfer=0, first=0, mtu=119 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01004)-NSVC(none) Tx NS-RESET cause=O&M intervention +NSE(01004)-NSVC(none) Rx NS-RESET +NSE(01004)-NSVC(none) Tx NS-RESET-ACK +NSE(01004)-NSVC(none) Tx NS-ALIVE +NSE(01004)-NSVC(none) Tx NS-UNBLOCK +NSE(01004)-NSVC(none) Rx NS-UNBLOCK +NSE(01004)-NSVC(none) Tx NS-UNBLOCK-ACK +NSE(01004) NS-STATUS.ind(bvci=00000): cause=NSE recovery, transfer=42, first=1, mtu=119 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC recovery, transfer=42, first=0, mtu=119 +NSE(01004)-NSVC(none) Tx NS-RESET cause=O&M intervention +NSE(01004)-NSVC(none) Rx NS-RESET +NSE(01004)-NSVC(none) Tx NS-RESET-ACK +NSE(01004)-NSVC(none) Tx NS-ALIVE +NSE(01004)-NSVC(none) Tx NS-UNBLOCK +NSE(01004)-NSVC(none) Rx NS-UNBLOCK +NSE(01004)-NSVC(none) Tx NS-UNBLOCK-ACK +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC recovery, transfer=84, first=0, mtu=119 +NSE(01004) NS-STATUS.ind(bvci=00000): cause=NSE failure, transfer=0, first=0, mtu=119 +NSE(01004) NS-STATUS.ind(bvci=00000): cause=NSE failure, transfer=0, first=0, mtu=119 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=119 +NSE(01004)-NSVC(none) Tx NS-RESET cause=O&M intervention +NSE(01004)-NSVC(none) Rx NS-RESET +NSE(01004)-NSVC(none) Tx NS-RESET-ACK +NSE(01004)-NSVC(none) Tx NS-ALIVE +NSE(01004)-NSVC(none) Tx NS-UNBLOCK +NSE(01004)-NSVC(none) Rx NS-UNBLOCK +NSE(01004)-NSVC(none) Tx NS-UNBLOCK-ACK +NSE(01004) NS-STATUS.ind(bvci=00000): cause=NSE recovery, transfer=42, first=1, mtu=119 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC recovery, transfer=42, first=0, mtu=119 +NSE(01004)-NSVC(none) Tx NS-RESET cause=O&M intervention +NSE(01004)-NSVC(none) Rx NS-RESET +NSE(01004)-NSVC(none) Tx NS-RESET-ACK +NSE(01004)-NSVC(none) Tx NS-ALIVE +NSE(01004)-NSVC(none) Tx NS-UNBLOCK +NSE(01004)-NSVC(none) Rx NS-UNBLOCK +NSE(01004)-NSVC(none) Tx NS-UNBLOCK-ACK +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC recovery, transfer=84, first=0, mtu=119 +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004)-NSVC(none) Rx NS-UNITDATA +NSE(01004) NS-STATUS.ind(bvci=00000): cause=NSE MTU changed, transfer=84, first=0, mtu=96 +NSE(01004) NS-STATUS.ind(bvci=00000): cause=NSE failure, transfer=0, first=0, mtu=96 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=96 +NSE(01004)-NSVC(none) NS-STATUS.ind(bvci=00000): cause=NSVC failure, transfer=0, first=0, mtu=96 diff --git a/tests/gb/gprs_ns_test.err b/tests/gb/gprs_ns_test.err new file mode 100644 index 0000000..266fb4e --- /dev/null +++ b/tests/gb/gprs_ns_test.err @@ -0,0 +1,147 @@ +NSVCI=65534 Creating NS-VC with Signal weight 1, Data weight 1 +NSVCI=65535 Creating NS-VC with Signal weight 1, Data weight 1 +Creating NS-VC for BSS at 1.2.3.4:1111 +NSVCI=65535(invalid) Rx NS RESET (NSEI=4096, NSVCI=4097, cause=O&M intervention) +NSEI=4096 Tx NS RESET ACK (NSVCI=4097) +NSVCI=65535 Creating NS-VC with Signal weight 1, Data weight 1 +Creating NS-VC for BSS at 1.2.3.4:1111 +NSVCI=65535(invalid) Rx NS RESET (NSEI=4096, NSVCI=4097, cause=O&M intervention) +NSEI=4096 Tx NS RESET ACK (NSVCI=4097) +NSVCI=65535 Creating NS-VC with Signal weight 1, Data weight 1 +Creating NS-VC for BSS at 1.2.3.4:1111 +NSVCI=65535(invalid) Rx NS RESET (NSEI=4096, NSVCI=4097, cause=O&M intervention) +NSEI=4096 Tx NS RESET ACK (NSVCI=4097) +NSVCI=65535 Creating NS-VC with Signal weight 1, Data weight 1 +Creating NS-VC for BSS at 1.2.3.4:1111 +NSVCI=65535(invalid) Rx NS RESET (NSEI=4096, NSVCI=4097, cause=O&M intervention) +NSEI=4096 Tx NS RESET ACK (NSVCI=4097) +NSVCI=65534 Creating NS-VC with Signal weight 1, Data weight 1 +Ignoring NS STATUS from 1.2.3.4:1111 for non-existing NS-VC +Ignoring NS ALIVE ACK from 1.2.3.4:1111 for non-existing NS-VC +Ignoring NS RESET ACK from 1.2.3.4:1111 for non-existing NS-VC +NSVCI=65534 Creating NS-VC with Signal weight 1, Data weight 1 +NSVCI=65535 Creating NS-VC with Signal weight 1, Data weight 1 +Creating NS-VC for BSS at 1.2.3.4:1111 +NSVCI=65535(invalid) Rx NS RESET (NSEI=4386, NSVCI=4386, cause=O&M intervention) +NSEI=4386 Tx NS RESET ACK (NSVCI=4386) +NSEI=4386 Rx NS UNBLOCK +NSVCI=4386 Rx NS RESET (NSEI=4386, NSVCI=4386, cause=O&M intervention) +NSEI=4386 Tx NS RESET ACK (NSVCI=4386) +NSVCI=65535 Creating NS-VC with Signal weight 1, Data weight 1 +Creating NS-VC for BSS at 1.2.3.4:3333 +NSVCI=65535(invalid) Rx NS RESET (NSEI=4386, NSVCI=13124, cause=O&M intervention) +NSEI=4386 Tx NS RESET ACK (NSVCI=13124) +NS-VC changed NSEI (NSVCI=4386) from 4386 to 13124 +NSVCI=4386 Rx NS RESET (NSEI=13124, NSVCI=4386, cause=O&M intervention) +NSEI=13124 Tx NS RESET ACK (NSVCI=4386) +NSVCI=13124 Rx NS RESET (NSEI=4386, NSVCI=4386, cause=O&M intervention) +NS-VC changed link (NSVCI=4386) from 1.2.3.4:3333 to 1.2.3.4:4444 +NSEI=4386 Tx NS RESET ACK (NSVCI=4386) +NSVCI=4386 Rx NS RESET (NSEI=4386, NSVCI=4386, cause=O&M intervention) +NSEI=4386 Tx NS RESET ACK (NSVCI=4386) +NSVCI=65534 Creating NS-VC with Signal weight 1, Data weight 1 +NSVCI=65535 Creating NS-VC with Signal weight 1, Data weight 1 +Creating NS-VC for BSS at 1.2.3.4:1111 +NSVCI=65535(invalid) Rx NS RESET (NSEI=4096, NSVCI=4097, cause=O&M intervention) +NSEI=4096 Tx NS RESET ACK (NSVCI=4097) +NSEI=4096 Rx NS UNBLOCK +NSVCI=65535 Creating NS-VC with Signal weight 1, Data weight 1 +Creating NS-VC for BSS at 1.2.3.4:2222 +NSVCI=65535(invalid) Rx NS RESET (NSEI=8192, NSVCI=8193, cause=O&M intervention) +NSEI=8192 Tx NS RESET ACK (NSVCI=8193) +NSEI=8192 Rx NS UNBLOCK +NSEI=4096 RESET procedure based on API request +NSEI=4096 Tx NS RESET (NSVCI=4097, cause=O&M intervention) +NSVCI=4097 Rx NS RESET ACK (NSEI=4096, NSVCI=4097) +NSEI=8192 RESET procedure based on API request +NSEI=8192 Tx NS RESET (NSVCI=8193, cause=O&M intervention) +NSVCI=8193 Rx NS RESET ACK (NSEI=4096, NSVCI=4097) +NS-VC changed link (NSVCI=4097) from 1.2.3.4:2222 to 1.2.3.4:1111 +NSEI=8192 RESET procedure based on API request +NSEI=8192 Tx NS RESET (NSVCI=8193, cause=O&M intervention) +failed to send NS message via UDP: Operation not permitted +NSEI=8192, error resetting NS-VC +NSEI=4096 RESET procedure based on API request +NSEI=4096 Tx NS RESET (NSVCI=4097, cause=O&M intervention) +NSVCI=4097 Rx NS RESET ACK (NSEI=4096, NSVCI=4097) +NSVCI=8193 Rx NS RESET (NSEI=8192, NSVCI=8193, cause=O&M intervention) +NSEI=8192 Tx NS RESET ACK (NSVCI=8193) +NSEI=8192 Rx NS UNBLOCK +NSVCI=4097 Rx NS RESET (NSEI=61440, NSVCI=4097, cause=O&M intervention) +NSEI=61440 Tx NS RESET ACK (NSVCI=4097) +NSVCI=4097 Rx NS RESET (NSEI=4096, NSVCI=61441, cause=O&M intervention) +Creating NS-VC 61441 replacing 4097 at 1.2.3.4:2222 +NSVCI=61441 Creating NS-VC with Signal weight 1, Data weight 1 +NSEI=4096 Tx NS RESET ACK (NSVCI=61441) +NSVCI=61441 Rx NS RESET (NSEI=4096, NSVCI=4097, cause=O&M intervention) +NS-VC changed link (NSVCI=4097) from 1.2.3.4:2222 to 0.0.0.0:0 +NSEI=4096 Tx NS RESET ACK (NSVCI=4097) +NSVCI=4097 Rx NS RESET ACK (NSEI=4096, NSVCI=4097) +NS RESET ACK Discarding unexpected message for NS-VCI 4097 from SGSN NSEI=4096 +NSEI=4096 RESET procedure based on API request +NSEI=4096 Tx NS RESET (NSVCI=4097, cause=O&M intervention) +NSVCI=4097 Rx NS RESET ACK (NSEI=61440, NSVCI=4097) +NSEI=61440 RESET procedure based on API request +NSEI=61440 Tx NS RESET (NSVCI=4097, cause=O&M intervention) +NSVCI=4097 Rx NS RESET ACK (NSEI=4096, NSVCI=61441) +NS-VC changed link (NSVCI=61441) from 1.2.3.4:2222 to 0.0.0.0:0 +NSVCI=61441 Rx NS RESET (NSEI=4096, NSVCI=4097, cause=O&M intervention) +NS-VC changed link (NSVCI=4097) from 1.2.3.4:2222 to 0.0.0.0:0 +NSEI=4096 Tx NS RESET ACK (NSVCI=4097) +NSEI=4096 Rx NS UNBLOCK +NSEI=4096 RESET procedure based on API request +NSEI=4096 Tx NS RESET (NSVCI=4097, cause=O&M intervention) +NSEI=4096 Rx NS UNBLOCK ACK +NSVCI=4097 Rx NS RESET ACK (NSEI=4096, NSVCI=4097) +NS RESET ACK Discarding unexpected message for NS-VCI 4097 from SGSN NSEI=4096 +NSEI=4096 Reset timed out but RESET flag is not set +NSEI=4096 Tx NS RESET (NSVCI=4097, cause=O&M intervention) +NSVCI=4097 Rx NS RESET ACK (NSEI=4096, NSVCI=4097) +NSVCI=65534 Creating NS-VC with Signal weight 1, Data weight 1 +NSVCI=257 Creating NS-VC with Signal weight 1, Data weight 1 +NSEI=256 RESET procedure based on API request +NSEI=256 Tx NS RESET (NSVCI=257, cause=O&M intervention) +NSVCI=257 Rx NS RESET ACK (NSEI=256, NSVCI=257) +NSEI=256 Tx NS UNBLOCK (NSVCI=257) +NSEI=256 Rx NS UNBLOCK ACK +NSVCI=257 Rx NS RESET (NSEI=256, NSVCI=257, cause=O&M intervention) +NSEI=256 Tx NS RESET ACK (NSVCI=257) +NSVCI=257 Rx NS RESET (NSEI=61440, NSVCI=257, cause=O&M intervention) +NSEI=256 Tx NS RESET ACK (NSVCI=257) +NSVCI=257 Rx NS RESET (NSEI=256, NSVCI=61441, cause=O&M intervention) +NSEI=256 Tx NS RESET ACK (NSVCI=257) +NSVCI=257 Rx NS RESET (NSEI=256, NSVCI=257, cause=O&M intervention) +NSEI=256 Tx NS RESET ACK (NSVCI=257) +NSVCI=257 Rx NS RESET ACK (NSEI=256, NSVCI=257) +NS RESET ACK Discarding unexpected message for NS-VCI 257 from SGSN NSEI=256 +NSEI=256 RESET procedure based on API request +NSEI=256 Tx NS RESET (NSVCI=257, cause=O&M intervention) +NSVCI=257 Rx NS RESET ACK (NSEI=57344, NSVCI=257) +NS RESET ACK Unknown NSEI 57344 (NS-VCI=257) from 5.6.7.8:32000 +NSEI=256 RESET procedure based on API request +NSEI=256 Tx NS RESET (NSVCI=257, cause=O&M intervention) +NSVCI=257 Rx NS RESET ACK (NSEI=256, NSVCI=57345) +NS RESET ACK Unknown NS-VCI 57345 (SGSN NSEI=256) from 5.6.7.8:32000 +NSVCI=65534 Creating NS-VC with Signal weight 1, Data weight 1 +NSVCI=257 Creating NS-VC with Signal weight 1, Data weight 1 +NSEI=256 RESET procedure based on API request +NSEI=256 Tx NS RESET (NSVCI=257, cause=O&M intervention) +NSVCI=257 Rx NS RESET ACK (NSEI=256, NSVCI=257) +NSEI=256 Tx NS UNBLOCK (NSVCI=257) +NSEI=256 Rx NS UNBLOCK ACK +NSEI=256 Tns-alive expired more then 10 times, blocking NS-VC +NSEI=256 RESET procedure based on API request +NSEI=256 Tx NS RESET (NSVCI=257, cause=PDU not compatible with protocol state) +NSVCI=257 Rx NS RESET ACK (NSEI=256, NSVCI=257) +NSEI=256 Tx NS UNBLOCK (NSVCI=257) +NSEI=256 Rx NS UNBLOCK ACK +NSVCI=65534 Creating NS-VC with Signal weight 1, Data weight 1 +Unable to resolve NSEI 256 to NS-VC! +NSVCI=257 Creating NS-VC with Signal weight 1, Data weight 1 +NSEI=256 RESET procedure based on API request +NSEI=256 Tx NS RESET (NSVCI=257, cause=O&M intervention) +All NS-VCs for NSEI 256 are either dead or blocked! +NSVCI=257 Rx NS RESET ACK (NSEI=256, NSVCI=257) +NSEI=256 Tx NS UNBLOCK (NSVCI=257) +All NS-VCs for NSEI 256 are either dead or blocked! +NSEI=256 Rx NS UNBLOCK ACK diff --git a/tests/iuup/iuup_test.err b/tests/iuup/iuup_test.err new file mode 100644 index 0000000..fe1ed397 --- /dev/null +++ b/tests/iuup/iuup_test.err @@ -0,0 +1,55 @@ +DLIUUP IuUP(test_tinit_timeout_retrans){NULL}: Allocated +DLIUUP IuUP(test_tinit_timeout_retrans){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_tinit_timeout_retrans){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_tinit_timeout_retrans){Initialisation}: Timeout of T1 +DLIUUP IuUP(test_tinit_timeout_retrans){Initialisation}: Timeout of T1 +DLIUUP IuUP(test_tinit_timeout_retrans){Initialisation}: Timeout of T1 +DLIUUP IuUP(test_tinit_timeout_retrans){Initialisation}: Timeout of T1 +DLIUUP IuUP(test_tinit_timeout_retrans){Initialisation}: Deallocated +DLIUUP IuUP(test_init_nack_retrans){NULL}: Allocated +DLIUUP IuUP(test_init_nack_retrans){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_init_nack_retrans){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_init_nack_retrans){Initialisation}: Received Event INIT_NACK +DLIUUP IuUP(test_init_nack_retrans){Initialisation}: Rx Initialization NACK N=0/3 +DLIUUP IuUP(test_init_nack_retrans){Initialisation}: Received Event INIT_NACK +DLIUUP IuUP(test_init_nack_retrans){Initialisation}: Rx Initialization NACK N=1/3 +DLIUUP IuUP(test_init_nack_retrans){Initialisation}: Received Event INIT_NACK +DLIUUP IuUP(test_init_nack_retrans){Initialisation}: Rx Initialization NACK N=2/3 +DLIUUP IuUP(test_init_nack_retrans){Initialisation}: Received Event INIT_NACK +DLIUUP IuUP(test_init_nack_retrans){Initialisation}: Rx Initialization NACK N=3/3 +DLIUUP IuUP(test_init_nack_retrans){Initialisation}: Deallocated +DLIUUP IuUP(test_init_ack){NULL}: Allocated +DLIUUP IuUP(test_init_ack){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_init_ack){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_init_ack){Initialisation}: Received Event LAST_INIT_ACK +DLIUUP IuUP(test_init_ack){Initialisation}: state_chg to SMpSDU_Data_Transfer_Ready +DLIUUP IuUP(test_init_ack){SMpSDU_Data_Transfer_Ready}: Received Event IuUP-DATA-ind +DLIUUP IuUP(test_init_ack){SMpSDU_Data_Transfer_Ready}: Received Event IuUP-DATA-req +DLIUUP IuUP(test_init_ack){SMpSDU_Data_Transfer_Ready}: Deallocated +DLIUUP IuUP(test_passive_init){NULL}: Allocated +DLIUUP IuUP(test_passive_init){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_passive_init){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_passive_init){Initialisation}: Received Event INIT +DLIUUP IuUP(test_passive_init){Initialisation}: Tx Initialization ACK +DLIUUP IuUP(test_passive_init){Initialisation}: state_chg to SMpSDU_Data_Transfer_Ready +DLIUUP IuUP(test_passive_init){SMpSDU_Data_Transfer_Ready}: Received Event IuUP-DATA-ind +DLIUUP IuUP(test_passive_init){SMpSDU_Data_Transfer_Ready}: Received Event IuUP-DATA-req +DLIUUP IuUP(test_passive_init){SMpSDU_Data_Transfer_Ready}: Deallocated +DLIUUP IuUP(test_passive_init_retrans){NULL}: Allocated +DLIUUP IuUP(test_passive_init_retrans){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_passive_init_retrans){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_passive_init_retrans){Initialisation}: Received Event INIT +DLIUUP IuUP(test_passive_init_retrans){Initialisation}: Tx Initialization ACK +DLIUUP IuUP(test_passive_init_retrans){Initialisation}: state_chg to SMpSDU_Data_Transfer_Ready +DLIUUP IuUP(test_passive_init_retrans){SMpSDU_Data_Transfer_Ready}: Received Event INIT +DLIUUP IuUP(test_passive_init_retrans){SMpSDU_Data_Transfer_Ready}: Tx Initialization ACK +DLIUUP IuUP(test_passive_init_retrans){SMpSDU_Data_Transfer_Ready}: Received Event IuUP-DATA-ind +DLIUUP IuUP(test_passive_init_retrans){SMpSDU_Data_Transfer_Ready}: Received Event IuUP-DATA-req +DLIUUP IuUP(test_passive_init_retrans){SMpSDU_Data_Transfer_Ready}: Deallocated +DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){Initialisation}: Tx Initialization ACK +DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){Initialisation}: state_chg to SMpSDU_Data_Transfer_Ready +DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){SMpSDU_Data_Transfer_Ready}: Deallocated diff --git a/tests/testsuite.at b/tests/testsuite.at index b525928..e88e0a8 100644 --- a/tests/testsuite.at +++ b/tests/testsuite.at @@ -262,13 +262,15 @@ AT_SETUP([gprs-ns]) AT_KEYWORDS([gprs-ns]) cat $abs_srcdir/gb/gprs_ns_test.ok > expout -AT_CHECK([$abs_top_builddir/tests/gb/gprs_ns_test], [0], [expout], [ignore]) +cat $abs_srcdir/gb/gprs_ns_test.err > experr +AT_CHECK([$abs_top_builddir/tests/gb/gprs_ns_test], [0], [expout], [experr]) AT_CLEANUP AT_SETUP([gprs-ns2]) AT_KEYWORDS([gprs-ns2]) cat $abs_srcdir/gb/gprs_ns2_test.ok > expout -AT_CHECK([$abs_top_builddir/tests/gb/gprs_ns2_test], [0], [expout], [ignore]) +cat $abs_srcdir/gb/gprs_ns2_test.err > experr +AT_CHECK([$abs_top_builddir/tests/gb/gprs_ns2_test], [0], [expout], [experr]) AT_CLEANUP AT_SETUP([utils]) @@ -492,7 +494,8 @@ AT_SETUP([iuup]) AT_KEYWORDS([iuup]) cat $abs_srcdir/iuup/iuup_test.ok > expout -AT_CHECK([$abs_top_builddir/tests/iuup/iuup_test], [0], [expout], [ignore]) +cat $abs_srcdir/iuup/iuup_test.err > experr +AT_CHECK([$abs_top_builddir/tests/iuup/iuup_test], [0], [expout], [experr]) AT_CLEANUP AT_SETUP([v110_frame_test]) -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/35464?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Icc2b372563f9ca142d256f2b8e9700220c37fddf Gerrit-Change-Number: 35464 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-MessageType: newchange

1 0

[L] Change in pysim[master]: WIP: GlobalPlatform SCP02 implementation
by laforge 28 Dec '23

28 Dec '23

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/35462?usp=email ) Change subject: WIP: GlobalPlatform SCP02 implementation ...................................................................... WIP: GlobalPlatform SCP02 implementation Change-Id: I56020382b9dfe8ba0f7c1c9f71eb1a9746bc5a27 --- M pySim/global_platform.py A pySim/scp02.py A tests/test_globalplatform.py 3 files changed, 280 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/62/35462/1 diff --git a/pySim/global_platform.py b/pySim/global_platform.py index e04e845..b782492 100644 --- a/pySim/global_platform.py +++ b/pySim/global_platform.py @@ -343,3 +343,20 @@ # # def __init__(self, name='GlobalPlatform'): # super().__init__(name, desc='GlobalPlatfomr 2.1.1', cla=['00','80','84'], sw=sw_table) + + +class GpCardKeyset: + """A single set of GlobalPlatform card keys and the associated KVN.""" + def __init__(self, kvn: int, enc: bytes, mac: bytes, dek: bytes): + self.kvn = kvn + self.enc = enc + self.mac = mac + self.dek = dek + + @classmethod + def from_single_key(cls, kvn: int, base_key: bytes) -> 'GpCardKeyset': + return cls(int, base_key, base_key, base_key) + + def __str__(self): + return "%s(KVN=%u, ENC=%s, MAC=%s, DEK=%s)" % (self.__class__.__name__, + self.kvn, b2h(self.enc), b2h(self.mac), b2h(self.dek)) diff --git a/pySim/scp02.py b/pySim/scp02.py new file mode 100644 index 0000000..2449f2e --- /dev/null +++ b/pySim/scp02.py @@ -0,0 +1,189 @@ +# Global Platform SCP02 (Secure Channel Protocol) implementation +# +# (C) 2023 by Harald Welte <laforge(a)osmocom.org> +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +from pySim.utils import b2h, h2b +from pySim.global_platform import GpCardKeyset +from Cryptodome.Cipher import DES3, DES +from Cryptodome.Util.strxor import strxor +from construct import * + +def scp02_key_derivation(constant: bytes, counter: int, base_key: bytes) -> bytes: + assert(len(constant) == 2) + assert(counter >= 0 and counter <= 65535) + assert(len(base_key) == 16) + + derivation_data = constant + counter.to_bytes(2) + b'\x00' * 12 + cipher = DES3.new(base_key, DES.MODE_CBC, b'\x00' * 8) + return cipher.encrypt(derivation_data) + +def pad80(s: bytes, BS=8) -> bytes: + """ Pad bytestring s: add '\x80' and '\0'* so the result to be multiple of BS.""" + l = BS-1 - len(s) % BS + return s + b'\x80' + b'\0'*l + +class Scp02SessionKeys: + """A single set of GlobalPlatform session keys.""" + DERIV_CONST_CMAC = b'\x01\x01' + DERIV_CONST_RMAC = b'\x01\x02' + DERIV_CONST_ENC = b'\x01\x82' + DERIV_CONST_DENC = b'\x01\x81' + + def calc_mac_1des(self, data: bytes, reset_icv: bool = False) -> bytes: + """Pad and calculate MAC according to B.1.2.2 - Single DES plus final 3DES""" + e = DES.new(self.c_mac[:8], DES.MODE_ECB) + d = DES.new(self.c_mac[8:], DES.MODE_ECB) + padded_data = pad80(data, 8) + q = len(padded_data) // 8 + icv = b'\x00' * 8 if reset_icv else self.icv + h = icv + for i in range(q): + h = e.encrypt(strxor(h, bytes(padded_data[8*i:8*(i+1)]))) + h = d.decrypt(h) + h = e.encrypt(h) + print("mac_1des(%s,icv=%s) -> %s" % (b2h(data), b2h(icv), b2h(h))) + if self.des_icv_enc: + self.icv = self.des_icv_enc.encrypt(h) + else: + self.icv = h + return h + + def calc_mac_3des(self, data: bytes) -> bytes: + e = DES3.new(self.enc, DES.MODE_ECB) + padded_data = pad80(data, 8) + q = len(padded_data) // 8 + h = b'\x00' * 8 + for i in range(q): + h = e.encrypt(strxor(h, bytes(padded_data[8*i:8*(i+1)]))) + print("mac_3des(%s) -> %s" % (b2h(data), b2h(h))) + return h + + def __init__(self, counter: int, card_keys: GpCardKeyset, icv_encrypt=True): + self.icv = None + self.counter = counter + self.card_keys = card_keys + self.c_mac = scp02_key_derivation(self.DERIV_CONST_CMAC, self.counter, card_keys.mac) + self.r_mac = scp02_key_derivation(self.DERIV_CONST_RMAC, self.counter, card_keys.mac) + self.enc = scp02_key_derivation(self.DERIV_CONST_ENC, self.counter, card_keys.enc) + self.data_enc = scp02_key_derivation(self.DERIV_CONST_DENC, self.counter, card_keys.dek) + self.des_icv_enc = DES.new(self.c_mac[:8], DES.MODE_ECB) if icv_encrypt else None + + def __str__(self) -> str: + return "%s(CTR=%u, ICV=%s, ENC=%s, D-ENC=%s, MAC-C=%s, MAC-R=%s)" % ( + self.__class__.__name__, self.counter, b2h(self.icv) if self.icv else "None", + b2h(self.enc), b2h(self.data_enc), b2h(self.c_mac), b2h(self.r_mac)) + +INS_INIT_UPDATE = 0x50 +INS_EXT_AUTH = 0x82 +CLA_SM = 0x04 + +class SCP02: + """An instance of the GlobalPlatform SCP02 secure channel protocol.""" + + constr_iur = Struct('key_div_data'/Bytes(10), 'key_ver'/Int8ub, Const(b'\x02'), + 'seq_counter'/Int16ub, 'card_challenge'/Bytes(6), 'card_cryptogram'/Bytes(8)) + + def __init__(self, card_keys: GpCardKeyset, lchan_nr: int = 0): + self.lchan_nr = lchan_nr + self.card_keys = card_keys + self.sk = None + self.mac_on_unmodified = False + self.key_ver = 0x70 + + def _cla(self, sm: bool = False, b8: bool = True) -> int: + ret = 0x80 if b8 else 0x00 + if sm: + ret = ret | CLA_SM + return ret + self.lchan_nr + + def _compute_cryptograms(self, card_challenge: bytes, host_challenge: bytes): + print("host_challenge(%s), card_challenge(%s)" % (b2h(host_challenge), b2h(card_challenge))) + self.host_cryptogram = self.sk.calc_mac_3des(self.sk.counter.to_bytes(2) + card_challenge + host_challenge) + self.card_cryptogram = self.sk.calc_mac_3des(self.host_challenge + self.sk.counter.to_bytes(2) + card_challenge) + print("host_cryptogram(%s), card_cryptogram(%s)" % (b2h(self.host_cryptogram), b2h(self.card_cryptogram))) + + def gen_init_update_apdu(self, host_challenge: bytes = b'\x00'*8) -> bytes: + """Generate INITIALIZE UPDATE APDU.""" + self.host_challenge = host_challenge + return bytes([self._cla(), INS_INIT_UPDATE, self.key_ver, 0, 8]) + self.host_challenge + + def parse_init_update_resp(self, resp_bin: bytes): + """Parse response to INITIALZIE UPDATE.""" + resp = self.constr_iur.parse(resp_bin) + self.card_challenge = resp['card_challenge'] + self.sk = Scp02SessionKeys(resp['seq_counter'], self.card_keys) + print(self.sk) + self._compute_cryptograms(self.card_challenge, self.host_challenge) + if self.card_cryptogram != resp['card_cryptogram']: + raise ValueError("card cryptogram doesn't match") + + @property + def do_cmac(self) -> bool: + """Should we perform C-MAC?""" + return self.security_level & 0x01 + + @property + def do_rmac(self) -> bool: + """Should we perform R-MAC?""" + return self.security_level & 0x10 + + @property + def do_cenc(self) -> bool: + """Should we perform C-ENC?""" + return self.security_level & 0x02 + + def gen_ext_auth_apdu(self, security_level: int =0x01) -> bytes: + """Generate EXTERNAL AUTHENTICATE APDU.""" + self.security_level = security_level + if self.mac_on_unmodified: + header = bytes([self._cla(), INS_EXT_AUTH, self.security_level, 0, 8]) + else: + header = bytes([self._cla(True), INS_EXT_AUTH, self.security_level, 0, 16]) + #return self.wrap_cmd_apdu(header + self.host_cryptogram) + mac = self.sk.calc_mac_1des(header + self.host_cryptogram, True) + return bytes([self._cla(True), INS_EXT_AUTH, self.security_level, 0, 16]) + self.host_cryptogram + mac + + def wrap_cmd_apdu(self, apdu: bytes) -> bytes: + """Wrap Command APDU for SCP02: calculate MAC and encrypt.""" + lc = len(apdu) - 5 + assert len(apdu) >= 5, "Wrong APDU length: %d" % len(apdu) + assert len(apdu) == 5 or apdu[4] == lc, "Lc differs from length of data: %d vs %d" % (apdu[4], lc) + + print("wrap_cmd_apdu(%s)" % b2h(apdu)) + + cla = apdu[0] + b8 = cla & 0x80 + if cla & 0x03 or cla & CLA_SM: + # nonzero logical channel in APDU, check that are the same + assert cla == self._cla(False, b8), "CLA mismatch" + # CLA without log. channel can be 80 or 00 only + if self.do_cmac: + if self.mac_on_unmodified: + mlc = lc + clac = cla + else: # CMAC on modified APDU + mlc = lc + 8 + clac = cla | CLA_SM + mac = self.sk.calc_mac_1des(bytes([clac]) + apdu[1:4] + bytes([mlc]) + apdu[5:]) + if self.do_cenc: + k = DES3.new(self.sk.enc, DES.MODE_CBC, b'\x00'*8) + data = k.encrypt(pad80(apdu[5:], 8)) + lc = len(data) + else: + data = apdu[5:] + lc += 8 + apdu = bytes([self._cla(True, b8)]) + apdu[1:4] + bytes([lc]) + data + mac + return apdu diff --git a/tests/test_globalplatform.py b/tests/test_globalplatform.py new file mode 100644 index 0000000..b47c67b --- /dev/null +++ b/tests/test_globalplatform.py @@ -0,0 +1,65 @@ +#!/usr/bin/env python3 + +# (C) 2023 by Harald Welte <laforge(a)osmocom.org> +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +import unittest +import logging + +from pySim.global_platform import * +from pySim.scp02 import * +from pySim.utils import b2h, h2b + +KIC = h2b('100102030405060708090a0b0c0d0e0f') # enc +KID = h2b('101102030405060708090a0b0c0d0e0f') # MAC +KIK = h2b('102102030405060708090a0b0c0d0e0f') # DEK +ck_3des_70 = GpCardKeyset(0x70, KIC, KID, KIK) + +class SCP02_Auth_Test(unittest.TestCase): + host_challenge = h2b('40A62C37FA6304F8') + init_update_resp = h2b('00000000000000000000700200016B4524ABEE7CF32EA3838BC148F3') + + def setUp(self): + self.scp02 = SCP02(card_keys=ck_3des_70) + + def test_mutual_auth_success(self): + init_upd_cmd = self.scp02.gen_init_update_apdu(host_challenge=self.host_challenge) + self.assertEqual(b2h(init_upd_cmd).upper(), '805070000840A62C37FA6304F8') + self.scp02.parse_init_update_resp(self.init_update_resp) + ext_auth_cmd = self.scp02.gen_ext_auth_apdu() + self.assertEqual(b2h(ext_auth_cmd).upper(), '8482010010BA6961667737C5BCEBECE14C7D6A4376') + + def test_mutual_auth_fail_card_cryptogram(self): + init_upd_cmd = self.scp02.gen_init_update_apdu(host_challenge=self.host_challenge) + self.assertEqual(b2h(init_upd_cmd).upper(), '805070000840A62C37FA6304F8') + wrong_init_update_resp = self.init_update_resp.copy() + wrong_init_update_resp[-1:] = b'\xff' + with self.assertRaises(ValueError): + self.scp02.parse_init_update_resp(wrong_init_update_resp) + + +class SCP02_Test(unittest.TestCase): + host_challenge = h2b('40A62C37FA6304F8') + init_update_resp = h2b('00000000000000000000700200016B4524ABEE7CF32EA3838BC148F3') + + def setUp(self): + self.scp02 = SCP02(card_keys=ck_3des_70) + init_upd_cmd = self.scp02.gen_init_update_apdu(host_challenge=self.host_challenge) + self.scp02.parse_init_update_resp(self.init_update_resp) + ext_auth_cmd = self.scp02.gen_ext_auth_apdu() + + def test_mac_command(self): + wrapped = self.scp02.wrap_cmd_apdu(h2b('80f28002024f00')) + self.assertEqual(b2h(wrapped).upper(), '84F280020A4F00B21AAFA3EB2D1672') -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35462?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I56020382b9dfe8ba0f7c1c9f71eb1a9746bc5a27 Gerrit-Change-Number: 35462 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[L] Change in pysim[master]: HACK/WIP: some work on ES9+ / SM-DP crypto
by laforge 28 Dec '23

28 Dec '23

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/35461?usp=email ) Change subject: HACK/WIP: some work on ES9+ / SM-DP crypto ...................................................................... HACK/WIP: some work on ES9+ / SM-DP crypto Change-Id: I6232847432dc6920cd2bd08c84d7099c29ca1c11 --- A DPauth/CERT_S_SM_DP2auth_ECDSA_BRP.der A DPauth/CERT_S_SM_DP2auth_ECDSA_NIST.der A DPauth/CERT_S_SM_DPauth_ECDSA_BRP.der A DPauth/CERT_S_SM_DPauth_ECDSA_NIST.der A DPauth/PK_S_SM_DP2auth_ECDSA_BRP.pem A DPauth/PK_S_SM_DP2auth_ECDSA_NIST.pem A DPauth/PK_S_SM_DPauth_ECDSA_BRP.pem A DPauth/PK_S_SM_DPauth_ECDSA_NIST.pem A DPauth/SK_S_SM_DP2auth_ECDSA_BRP.pem A DPauth/SK_S_SM_DP2auth_ECDSA_NIST.pem A DPauth/SK_S_SM_DPauth_ECDSA_BRP.pem A DPauth/SK_S_SM_DPauth_ECDSA_NIST.pem A DPauth/data_sig.der A DPtls/CERT_S_SM_DP2_TLS.csr.cnf A DPtls/CERT_S_SM_DP2_TLS.der A DPtls/CERT_S_SM_DP2_TLS.ext.cnf A DPtls/CERT_S_SM_DP4_TLS.csr.cnf A DPtls/CERT_S_SM_DP4_TLS.der A DPtls/CERT_S_SM_DP4_TLS.ext.cnf A DPtls/CERT_S_SM_DP8_TLS.csr.cnf A DPtls/CERT_S_SM_DP8_TLS.der A DPtls/CERT_S_SM_DP8_TLS.ext.cnf A DPtls/CERT_S_SM_DP_TLS.csr.cnf A DPtls/CERT_S_SM_DP_TLS.ext.cnf A DPtls/CERT_S_SM_DP_TLS_BRP.der A DPtls/CERT_S_SM_DP_TLS_NIST.der A DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP2_TLS.der A DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP4_TLS.der A DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP8_TLS.der A DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP_TLS_BRP.der A DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP_TLS_NIST.der A DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP2_TLS.der A DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP4_TLS.der A DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP8_TLS.der A DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP_TLS_BRP.der A DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP_TLS_NIST.der A DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP2_TLS.der A DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP4_TLS.der A DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP8_TLS.der A DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP_TLS_BRP.der A DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP_TLS_NIST.der A DPtls/PK_S_SM_DP2_TLS_NIST.pem A DPtls/PK_S_SM_DP4_TLS.pem A DPtls/PK_S_SM_DP8_TLS.pem A DPtls/PK_S_SM_DP_TLS_BRP.pem A DPtls/PK_S_SM_DP_TLS_NIST.pem A DPtls/SK_S_SM_DP2_TLS_NIST.pem A DPtls/SK_S_SM_DP4_TLS.pem A DPtls/SK_S_SM_DP8_TLS.pem A DPtls/SK_S_SM_DP_TLS_BRP.pem A DPtls/SK_S_SM_DP_TLS_NIST.pem A es9p_sig.py A pySim/smdp_crypto.py A server.pem A sm-dp-http.py 55 files changed, 804 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/61/35461/1 diff --git a/DPauth/CERT_S_SM_DP2auth_ECDSA_BRP.der b/DPauth/CERT_S_SM_DP2auth_ECDSA_BRP.der new file mode 100644 index 0000000..a3caae5 --- /dev/null +++ b/DPauth/CERT_S_SM_DP2auth_ECDSA_BRP.der Binary files differ diff --git a/DPauth/CERT_S_SM_DP2auth_ECDSA_NIST.der b/DPauth/CERT_S_SM_DP2auth_ECDSA_NIST.der new file mode 100644 index 0000000..81715bb --- /dev/null +++ b/DPauth/CERT_S_SM_DP2auth_ECDSA_NIST.der Binary files differ diff --git a/DPauth/CERT_S_SM_DPauth_ECDSA_BRP.der b/DPauth/CERT_S_SM_DPauth_ECDSA_BRP.der new file mode 100644 index 0000000..45c043c --- /dev/null +++ b/DPauth/CERT_S_SM_DPauth_ECDSA_BRP.der Binary files differ diff --git a/DPauth/CERT_S_SM_DPauth_ECDSA_NIST.der b/DPauth/CERT_S_SM_DPauth_ECDSA_NIST.der new file mode 100644 index 0000000..914b8a1 --- /dev/null +++ b/DPauth/CERT_S_SM_DPauth_ECDSA_NIST.der Binary files differ diff --git a/DPauth/PK_S_SM_DP2auth_ECDSA_BRP.pem b/DPauth/PK_S_SM_DP2auth_ECDSA_BRP.pem new file mode 100644 index 0000000..e37c621 --- /dev/null +++ b/DPauth/PK_S_SM_DP2auth_ECDSA_BRP.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFowFAYHKoZIzj0CAQYJKyQDAwIIAQEHA0IABC7uB8ltAFvlGV95rR2tzR03jKMJ +XkT3LupBDwjHVhIskGPJZbf8hSnAyk6bT2WWnCg8ZWNkV4dxGPbRFy1qI2U= +-----END PUBLIC KEY----- diff --git a/DPauth/PK_S_SM_DP2auth_ECDSA_NIST.pem b/DPauth/PK_S_SM_DP2auth_ECDSA_NIST.pem new file mode 100644 index 0000000..63fc92d --- /dev/null +++ b/DPauth/PK_S_SM_DP2auth_ECDSA_NIST.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKy6bRdNRwJr0DpFDg6GQOEfyYH3m +DverJcQOA/jbtlCOFFdQjCvgAXNH7Pob+fd159B+gF5S4ZiLe1hacRGuMw== +-----END PUBLIC KEY----- diff --git a/DPauth/PK_S_SM_DPauth_ECDSA_BRP.pem b/DPauth/PK_S_SM_DPauth_ECDSA_BRP.pem new file mode 100644 index 0000000..cbd8ccc --- /dev/null +++ b/DPauth/PK_S_SM_DPauth_ECDSA_BRP.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFowFAYHKoZIzj0CAQYJKyQDAwIIAQEHA0IABCVdfa8A74Qddvp6Y9Y+s/5sn3BJ +LTgZI/j4vXsk88WtFo6+OwndgPKef/0kpNG+dH+DI+RykoOW3engFRzquhg= +-----END PUBLIC KEY----- diff --git a/DPauth/PK_S_SM_DPauth_ECDSA_NIST.pem b/DPauth/PK_S_SM_DPauth_ECDSA_NIST.pem new file mode 100644 index 0000000..8424bb4 --- /dev/null +++ b/DPauth/PK_S_SM_DPauth_ECDSA_NIST.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAETf7U9GlHkb8Wlc6gMHo1tBgBlpU4 +e7dbfSRHtrUgnwRFrk5eUhzROIjXX+B8hYAiKuINuqwdd812MEmTQhvXOQ== +-----END PUBLIC KEY----- diff --git a/DPauth/SK_S_SM_DP2auth_ECDSA_BRP.pem b/DPauth/SK_S_SM_DP2auth_ECDSA_BRP.pem new file mode 100644 index 0000000..dc20882 --- /dev/null +++ b/DPauth/SK_S_SM_DP2auth_ECDSA_BRP.pem @@ -0,0 +1,8 @@ +-----BEGIN EC PARAMETERS----- +BgkrJAMDAggBAQc= +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHgCAQEEIAwXNVwBHQ/o19rdY/GXhc9sUcvNRmroi+j4G8EFiEb2oAsGCSskAwMC +CAEBB6FEA0IABC7uB8ltAFvlGV95rR2tzR03jKMJXkT3LupBDwjHVhIskGPJZbf8 +hSnAyk6bT2WWnCg8ZWNkV4dxGPbRFy1qI2U= +-----END EC PRIVATE KEY----- diff --git a/DPauth/SK_S_SM_DP2auth_ECDSA_NIST.pem b/DPauth/SK_S_SM_DP2auth_ECDSA_NIST.pem new file mode 100644 index 0000000..0b19301 --- /dev/null +++ b/DPauth/SK_S_SM_DP2auth_ECDSA_NIST.pem @@ -0,0 +1,8 @@ +-----BEGIN EC PARAMETERS----- +BggqhkjOPQMBBw== +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIJwyoJXUiELZ/6QE9xJRKqLFQloaJjhqtqFF1YEeA5FBoAoGCCqGSM49 +AwEHoUQDQgAEKy6bRdNRwJr0DpFDg6GQOEfyYH3mDverJcQOA/jbtlCOFFdQjCvg +AXNH7Pob+fd159B+gF5S4ZiLe1hacRGuMw== +-----END EC PRIVATE KEY----- diff --git a/DPauth/SK_S_SM_DPauth_ECDSA_BRP.pem b/DPauth/SK_S_SM_DPauth_ECDSA_BRP.pem new file mode 100644 index 0000000..6e9d064 --- /dev/null +++ b/DPauth/SK_S_SM_DPauth_ECDSA_BRP.pem @@ -0,0 +1,8 @@ +-----BEGIN EC PARAMETERS----- +BgkrJAMDAggBAQc= +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHgCAQEEIJP7M9BYTzSbB/i10q+T18PjVLNJo7kTUC5qvAcOTUkpoAsGCSskAwMC +CAEBB6FEA0IABCVdfa8A74Qddvp6Y9Y+s/5sn3BJLTgZI/j4vXsk88WtFo6+Ownd +gPKef/0kpNG+dH+DI+RykoOW3engFRzquhg= +-----END EC PRIVATE KEY----- diff --git a/DPauth/SK_S_SM_DPauth_ECDSA_NIST.pem b/DPauth/SK_S_SM_DPauth_ECDSA_NIST.pem new file mode 100644 index 0000000..35df74b --- /dev/null +++ b/DPauth/SK_S_SM_DPauth_ECDSA_NIST.pem @@ -0,0 +1,8 @@ +-----BEGIN EC PARAMETERS----- +BggqhkjOPQMBBw== +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIAp8wcJE5gxSzVt4B6uMNgwmUkYBUH3KvF3VmLWmFtXVoAoGCCqGSM49 +AwEHoUQDQgAETf7U9GlHkb8Wlc6gMHo1tBgBlpU4e7dbfSRHtrUgnwRFrk5eUhzR +OIjXX+B8hYAiKuINuqwdd812MEmTQhvXOQ== +-----END EC PRIVATE KEY----- diff --git a/DPauth/data_sig.der b/DPauth/data_sig.der new file mode 100644 index 0000000..7f44ce2 --- /dev/null +++ b/DPauth/data_sig.der @@ -0,0 +1 @@ +0D AL¶þV¿eRÌÍìAHÊt£×ôÍºnìE<Nåû R¤~&Àk\þ~ ÉRlÜÛ°¥7ì¶NmWø \ No newline at end of file diff --git a/DPtls/CERT_S_SM_DP2_TLS.csr.cnf b/DPtls/CERT_S_SM_DP2_TLS.csr.cnf new file mode 100644 index 0000000..8ed5b2b --- /dev/null +++ b/DPtls/CERT_S_SM_DP2_TLS.csr.cnf @@ -0,0 +1,10 @@ +[ req ] +prompt = no +distinguished_name = req_distinguished_name + +[ req_distinguished_name ] +O = ACME + +# shall be aligned with SGP.23 value #TEST_DP_ADDRESS2 +CN = testsmdpplus2.example.com + diff --git a/DPtls/CERT_S_SM_DP2_TLS.der b/DPtls/CERT_S_SM_DP2_TLS.der new file mode 100644 index 0000000..be20b34 --- /dev/null +++ b/DPtls/CERT_S_SM_DP2_TLS.der Binary files differ diff --git a/DPtls/CERT_S_SM_DP2_TLS.ext.cnf b/DPtls/CERT_S_SM_DP2_TLS.ext.cnf new file mode 100644 index 0000000..d224daf --- /dev/null +++ b/DPtls/CERT_S_SM_DP2_TLS.ext.cnf @@ -0,0 +1,14 @@ +###################################################################################################################################################################### +# Extensions for a DPTLS +keyUsage = critical, digitalSignature +extendedKeyUsage = critical, serverAuth, clientAuth +certificatePolicies = 2.23.146.1.2.1.3 +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer + +# RID shall be aligend with SGP.23 value SM-DP+OID2 +# DNS name shall be aligned with SGP.23 value #TEST_DP_ADDRESS2 +subjectAltName = DNS:testsmdpplus2.example.com, RID:2.999.12 + +crlDistributionPoints=URI:http://ci.test.example.com/CRL-A.crl, URI:http://ci.test.example.com/CRL-B.crl + diff --git a/DPtls/CERT_S_SM_DP4_TLS.csr.cnf b/DPtls/CERT_S_SM_DP4_TLS.csr.cnf new file mode 100644 index 0000000..abaa1da --- /dev/null +++ b/DPtls/CERT_S_SM_DP4_TLS.csr.cnf @@ -0,0 +1,10 @@ +[ req ] +prompt = no +distinguished_name = req_distinguished_name + +[ req_distinguished_name ] +O = ACME + +# shall be aligned with SGP.23 value #TEST_DP_ADDRESS4 +CN = testsmdpplus4.example.com + diff --git a/DPtls/CERT_S_SM_DP4_TLS.der b/DPtls/CERT_S_SM_DP4_TLS.der new file mode 100644 index 0000000..07b4c85 --- /dev/null +++ b/DPtls/CERT_S_SM_DP4_TLS.der Binary files differ diff --git a/DPtls/CERT_S_SM_DP4_TLS.ext.cnf b/DPtls/CERT_S_SM_DP4_TLS.ext.cnf new file mode 100644 index 0000000..31f6463 --- /dev/null +++ b/DPtls/CERT_S_SM_DP4_TLS.ext.cnf @@ -0,0 +1,14 @@ +###################################################################################################################################################################### +# Extensions for a DPTLS +keyUsage = critical, digitalSignature +extendedKeyUsage = critical, serverAuth, clientAuth +certificatePolicies = 2.23.146.1.2.1.3 +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer + +# RID shall be aligend with SGP.23 value SM-DP+OID4 +# DNS name shall be aligned with SGP.23 value #TEST_DP_ADDRESS4 +subjectAltName = DNS:testsmdpplus4.example.com, RID:2.999.14 + +crlDistributionPoints=URI:http://ci.test.example.com/CRL-A.crl, URI:http://ci.test.example.com/CRL-B.crl + diff --git a/DPtls/CERT_S_SM_DP8_TLS.csr.cnf b/DPtls/CERT_S_SM_DP8_TLS.csr.cnf new file mode 100644 index 0000000..39ebdfb --- /dev/null +++ b/DPtls/CERT_S_SM_DP8_TLS.csr.cnf @@ -0,0 +1,10 @@ +[ req ] +prompt = no +distinguished_name = req_distinguished_name + +[ req_distinguished_name ] +O = ACME + +# shall be aligned with SGP.23 value #TEST_DP_ADDRESS8 +CN = testsmdpplus8.example.com + diff --git a/DPtls/CERT_S_SM_DP8_TLS.der b/DPtls/CERT_S_SM_DP8_TLS.der new file mode 100644 index 0000000..3b45b14 --- /dev/null +++ b/DPtls/CERT_S_SM_DP8_TLS.der Binary files differ diff --git a/DPtls/CERT_S_SM_DP8_TLS.ext.cnf b/DPtls/CERT_S_SM_DP8_TLS.ext.cnf new file mode 100644 index 0000000..cc88f83 --- /dev/null +++ b/DPtls/CERT_S_SM_DP8_TLS.ext.cnf @@ -0,0 +1,14 @@ +###################################################################################################################################################################### +# Extensions for a DPTLS +keyUsage = critical, digitalSignature +extendedKeyUsage = critical, serverAuth, clientAuth +certificatePolicies = 2.23.146.1.2.1.3 +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer + +# RID shall be aligend with SGP.23 value SM-DP+OID8 +# DNS name shall be aligned with SGP.23 value #TEST_DP_ADDRESS8 +subjectAltName = DNS:testsmdpplus8.example.com, RID:2.999.18 + +crlDistributionPoints=URI:http://ci.test.example.com/CRL-A.crl, URI:http://ci.test.example.com/CRL-B.crl + diff --git a/DPtls/CERT_S_SM_DP_TLS.csr.cnf b/DPtls/CERT_S_SM_DP_TLS.csr.cnf new file mode 100644 index 0000000..d9b785c --- /dev/null +++ b/DPtls/CERT_S_SM_DP_TLS.csr.cnf @@ -0,0 +1,10 @@ +[ req ] +prompt = no +distinguished_name = req_distinguished_name + +[ req_distinguished_name ] +O = ACME + +# shall be aligned with SGP.23 value #TEST_DP_ADDRESS1 +CN = testsmdpplus1.example.com + diff --git a/DPtls/CERT_S_SM_DP_TLS.ext.cnf b/DPtls/CERT_S_SM_DP_TLS.ext.cnf new file mode 100644 index 0000000..f80caf6 --- /dev/null +++ b/DPtls/CERT_S_SM_DP_TLS.ext.cnf @@ -0,0 +1,14 @@ +###################################################################################################################################################################### +# Extensions for a DPTLS +keyUsage = critical, digitalSignature +extendedKeyUsage = critical, serverAuth, clientAuth +certificatePolicies = 2.23.146.1.2.1.3 +subjectKeyIdentifier = hash +authorityKeyIdentifier = keyid:always,issuer + +# RID shall be aligend with SGP.23 value SM-DP+OID +# DNS name shall be aligned with SGP.23 value #TEST_DP_ADDRESS1 +subjectAltName = DNS:testsmdpplus1.example.com, RID:2.999.10 + +crlDistributionPoints=URI:http://ci.test.example.com/CRL-A.crl, URI:http://ci.test.example.com/CRL-B.crl + diff --git a/DPtls/CERT_S_SM_DP_TLS_BRP.der b/DPtls/CERT_S_SM_DP_TLS_BRP.der new file mode 100644 index 0000000..dc730f0 --- /dev/null +++ b/DPtls/CERT_S_SM_DP_TLS_BRP.der Binary files differ diff --git a/DPtls/CERT_S_SM_DP_TLS_NIST.der b/DPtls/CERT_S_SM_DP_TLS_NIST.der new file mode 100644 index 0000000..0cb9ba7 --- /dev/null +++ b/DPtls/CERT_S_SM_DP_TLS_NIST.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP2_TLS.der b/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP2_TLS.der new file mode 100644 index 0000000..4f91532 --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP2_TLS.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP4_TLS.der b/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP4_TLS.der new file mode 100644 index 0000000..70820fa --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP4_TLS.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP8_TLS.der b/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP8_TLS.der new file mode 100644 index 0000000..33cc6fb --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP8_TLS.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP_TLS_BRP.der b/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP_TLS_BRP.der new file mode 100644 index 0000000..5d0ae30 --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP_TLS_BRP.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP_TLS_NIST.der b/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP_TLS_NIST.der new file mode 100644 index 0000000..38927b1 --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2021/CERT_S_SM_DP_TLS_NIST.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP2_TLS.der b/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP2_TLS.der new file mode 100644 index 0000000..32909ce --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP2_TLS.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP4_TLS.der b/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP4_TLS.der new file mode 100644 index 0000000..ea11075 --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP4_TLS.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP8_TLS.der b/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP8_TLS.der new file mode 100644 index 0000000..93a0cc0 --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP8_TLS.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP_TLS_BRP.der b/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP_TLS_BRP.der new file mode 100644 index 0000000..3d00317 --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP_TLS_BRP.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP_TLS_NIST.der b/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP_TLS_NIST.der new file mode 100644 index 0000000..179c37b --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2022/CERT_S_SM_DP_TLS_NIST.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP2_TLS.der b/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP2_TLS.der new file mode 100644 index 0000000..da5516c --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP2_TLS.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP4_TLS.der b/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP4_TLS.der new file mode 100644 index 0000000..b1c222c --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP4_TLS.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP8_TLS.der b/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP8_TLS.der new file mode 100644 index 0000000..638e4a1 --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP8_TLS.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP_TLS_BRP.der b/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP_TLS_BRP.der new file mode 100644 index 0000000..6746cbb --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP_TLS_BRP.der Binary files differ diff --git a/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP_TLS_NIST.der b/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP_TLS_NIST.der new file mode 100644 index 0000000..6977bd3 --- /dev/null +++ b/DPtls/Old_TLS_Validity/Expired 2023/CERT_S_SM_DP_TLS_NIST.der Binary files differ diff --git a/DPtls/PK_S_SM_DP2_TLS_NIST.pem b/DPtls/PK_S_SM_DP2_TLS_NIST.pem new file mode 100644 index 0000000..702bcf7 --- /dev/null +++ b/DPtls/PK_S_SM_DP2_TLS_NIST.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGtkADHVON2E+dQ+3v3NC/tULwHJS +7YRla0XW9wh4lQip/+CWFyOvEe/I3aaaafK1GIuzEhOCCrLdHvWALo/Utg== +-----END PUBLIC KEY----- diff --git a/DPtls/PK_S_SM_DP4_TLS.pem b/DPtls/PK_S_SM_DP4_TLS.pem new file mode 100644 index 0000000..9c165c7 --- /dev/null +++ b/DPtls/PK_S_SM_DP4_TLS.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOtvoTSOoGvY7otiZg2y7aKdiVrMN +cCYwPcNrwV32ETbE++cCAbTFpm49rGsrO5V6mbtOdBAD6L90LwgTAqp9pg== +-----END PUBLIC KEY----- diff --git a/DPtls/PK_S_SM_DP8_TLS.pem b/DPtls/PK_S_SM_DP8_TLS.pem new file mode 100644 index 0000000..0ff4586 --- /dev/null +++ b/DPtls/PK_S_SM_DP8_TLS.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEzkExGPpkmW7Yspv8rIUzg+ZdPyKh +meeWa/QGmmlYOSvlOdAA6lGlSIsQh9brR8ABhG0eaH7EkOgagJZJQgxSaw== +-----END PUBLIC KEY----- diff --git a/DPtls/PK_S_SM_DP_TLS_BRP.pem b/DPtls/PK_S_SM_DP_TLS_BRP.pem new file mode 100644 index 0000000..8fd826f --- /dev/null +++ b/DPtls/PK_S_SM_DP_TLS_BRP.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFowFAYHKoZIzj0CAQYJKyQDAwIIAQEHA0IABEwizNgsjQIh+dhUO3LhB7zJ/ZBU +1mx1wOt0p73nMOdhjvZbJwteguQ6eW+N7guvivvrilNiU3oC/WXHnkEZa7U= +-----END PUBLIC KEY----- diff --git a/DPtls/PK_S_SM_DP_TLS_NIST.pem b/DPtls/PK_S_SM_DP_TLS_NIST.pem new file mode 100644 index 0000000..15ea8ea --- /dev/null +++ b/DPtls/PK_S_SM_DP_TLS_NIST.pem @@ -0,0 +1,4 @@ +-----BEGIN PUBLIC KEY----- +MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEKCQwdc6O/R+uZ2g5QH2ybkzLQ3CU +YhybOWEz8bJLtQG4/k6yTT4NOS8lP28blGJws8opLjTbb3qHs6X2rJRfCA== +-----END PUBLIC KEY----- diff --git a/DPtls/SK_S_SM_DP2_TLS_NIST.pem b/DPtls/SK_S_SM_DP2_TLS_NIST.pem new file mode 100644 index 0000000..b25606d --- /dev/null +++ b/DPtls/SK_S_SM_DP2_TLS_NIST.pem @@ -0,0 +1,8 @@ +-----BEGIN EC PARAMETERS----- +BggqhkjOPQMBBw== +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIE5lYcZAiPZpkHrb45SxGoQkLgM6gqiEAjFjbckbTuP1oAoGCCqGSM49 +AwEHoUQDQgAEGtkADHVON2E+dQ+3v3NC/tULwHJS7YRla0XW9wh4lQip/+CWFyOv +Ee/I3aaaafK1GIuzEhOCCrLdHvWALo/Utg== +-----END EC PRIVATE KEY----- diff --git a/DPtls/SK_S_SM_DP4_TLS.pem b/DPtls/SK_S_SM_DP4_TLS.pem new file mode 100644 index 0000000..32bdfde --- /dev/null +++ b/DPtls/SK_S_SM_DP4_TLS.pem @@ -0,0 +1,8 @@ +-----BEGIN EC PARAMETERS----- +BggqhkjOPQMBBw== +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIPJlnS9Sj0sRN0DVig0q8+srSOEiwrYKavb8lq2Gvm+koAoGCCqGSM49 +AwEHoUQDQgAEOtvoTSOoGvY7otiZg2y7aKdiVrMNcCYwPcNrwV32ETbE++cCAbTF +pm49rGsrO5V6mbtOdBAD6L90LwgTAqp9pg== +-----END EC PRIVATE KEY----- diff --git a/DPtls/SK_S_SM_DP8_TLS.pem b/DPtls/SK_S_SM_DP8_TLS.pem new file mode 100644 index 0000000..51ca168 --- /dev/null +++ b/DPtls/SK_S_SM_DP8_TLS.pem @@ -0,0 +1,8 @@ +-----BEGIN EC PARAMETERS----- +BggqhkjOPQMBBw== +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIP9uSlCbrds4EIgxwjzMLUQwevKB6SWWf4zfHZVUoCiNoAoGCCqGSM49 +AwEHoUQDQgAEzkExGPpkmW7Yspv8rIUzg+ZdPyKhmeeWa/QGmmlYOSvlOdAA6lGl +SIsQh9brR8ABhG0eaH7EkOgagJZJQgxSaw== +-----END EC PRIVATE KEY----- diff --git a/DPtls/SK_S_SM_DP_TLS_BRP.pem b/DPtls/SK_S_SM_DP_TLS_BRP.pem new file mode 100644 index 0000000..6ad37b0 --- /dev/null +++ b/DPtls/SK_S_SM_DP_TLS_BRP.pem @@ -0,0 +1,8 @@ +-----BEGIN EC PARAMETERS----- +BgkrJAMDAggBAQc= +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHgCAQEEID9nFSgCs/TH+uZ5WFX2glQeReNe//TooFVloPGRKnguoAsGCSskAwMC +CAEBB6FEA0IABEwizNgsjQIh+dhUO3LhB7zJ/ZBU1mx1wOt0p73nMOdhjvZbJwte +guQ6eW+N7guvivvrilNiU3oC/WXHnkEZa7U= +-----END EC PRIVATE KEY----- diff --git a/DPtls/SK_S_SM_DP_TLS_NIST.pem b/DPtls/SK_S_SM_DP_TLS_NIST.pem new file mode 100644 index 0000000..c1329f9 --- /dev/null +++ b/DPtls/SK_S_SM_DP_TLS_NIST.pem @@ -0,0 +1,8 @@ +-----BEGIN EC PARAMETERS----- +BggqhkjOPQMBBw== +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHcCAQEEIKA+fORVBHS+pLeoc5nOWoyfZhtoD5QBOf/4Tp3sak2MoAoGCCqGSM49 +AwEHoUQDQgAEKCQwdc6O/R+uZ2g5QH2ybkzLQ3CUYhybOWEz8bJLtQG4/k6yTT4N +OS8lP28blGJws8opLjTbb3qHs6X2rJRfCA== +-----END EC PRIVATE KEY----- diff --git a/es9p_sig.py b/es9p_sig.py new file mode 100755 index 0000000..fc08a9f --- /dev/null +++ b/es9p_sig.py @@ -0,0 +1,98 @@ +#!/usr/bin/env python3 + +from pySim.utils import b2h, h2b +from pprint import pprint as pp + +from cryptography.hazmat.primitives.serialization import load_pem_private_key +from cryptography.hazmat.primitives import hashes +from cryptography.hazmat.primitives.asymmetric.utils import encode_dss_signature +from cryptography.hazmat.primitives.asymmetric import ec +from cryptography.x509 import load_pem_x509_certificate, load_der_x509_certificate +from base64 import b64decode + +with open('server.pem', 'rb') as f: + pem_bytes = f.read() + +#cert = load_pem_x509_certificate(pem_bytes) +#print(cert) +#key = load_pem_private_key(pem_bytes, None) +#print(key) + +# from an actual exchange between Comprion test eUICC + lpac against rsp.esim.me:8083 +# {"type":"progress","payload":{"code":0,"message":"es9p_initiate_authentication","data":null}} +# HTTP Req https://rsp.esim.me:8083/gsma/rsp2/es9plus/initiateAuthentication: {"smdpAddress":"rsp.esim.me:8083","euiccChallenge":"cRHkgblvUbp7uM+hwM8p7Q==","euiccInfo1":"vyBhggMCAgCpLAQUwLxwujaSnUO0Z/9XVwUw5Xq4/NgEFPVBcr35ipXWXL64ijihwR2ACoXDqiwEFMC8cLo2kp1DtGf/V1cFMOV6uPzYBBT1QXK9+YqV1ly+uIo4ocEdgAqFww=="} +euicc_challenge = b64decode('cRHkgblvUbp7uM+hwM8p7Q==') +euicc_info1 = b64decode("vyBhggMCAgCpLAQUwLxwujaSnUO0Z/9XVwUw5Xq4/NgEFPVBcr35ipXWXL64ijihwR2ACoXDqiwEFMC8cLo2kp1DtGf/V1cFMOV6uPzYBBT1QXK9+YqV1ly+uIo4ocEdgAqFww==") +# HTTP Resp: {"header":{"functionExecutionStatus":{"status":"Executed-Success"}},"serverSigned1":"MEiAEF7KJ2yimkyhlcxrsBiHaCKBEHER5IG5b1G6e7jPocDPKe2DEHJzcC5lc2ltLm1lOjgwODOEEAvjnivyXEiliHwazCzm9x4=","euiccCiPKIdToBeUsed":"BBT1QXK9+YqV1ly+uIo4ocEdgAqFww==","serverSignature1":"XzdAtrqULn5f\/AwhetyKdDLdORLx9Hzo\/bfV4scgA8J4exhkasTC\/xZZmZ331OQsdJuq7Fpqh3+gI7uI0SE2BKVBvA==","serverCertificate":"MIICYDCCAgWgAwIBAgICAQAwCgYIKoZIzj0EAwIwSTELMAkGA1UEBhMCSVQxEDAOBgNVBAoMB1JTUFRFU1QxETAPBgNVBAsMCFRFU1RDRVJUMRUwEwYDVQQDDAxHU01BIFRlc3QgQ0kwHhcNMTgwMzI4MDAwMDAwWhcNMjEwMzI3MDAwMDAwWjBMMScwJQYDVQQDDB5OWFAgVGVzdCBTTS1EUCsgQXV0aGVudGljYXRpb24xFDASBgNVBAoMC05YUCBBdXN0cmlhMQswCQYDVQQGEwJBVDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABPQ+vACwEgNEUzAYXNszI19AOQOAuPgAesSbf7CEzdRQ8AtH6n1ZivF9sYBsaNm6qodzZHjlPgE3WzcMQN5pCw+jgdkwgdYwHQYDVR0OBBYEFJbWoxNJ9dzzl4TKofi3hBWqFQwjMB8GA1UdIwQYMBaAFPVBcr35ipXWXL64ijihwR2ACoXDMA4GA1UdDwEB\/wQEAwIHgDAXBgNVHSABAf8EDTALMAkGB2eBEgECAQQwWwYDVR0fBFQwUjAnoCWgI4YhaHR0cDovL2NpLnRlc3QuZ3NtYS5jb20vQ1JMLUEuY3JsMCegJaAjhiFodHRwOi8vY2kudGVzdC5nc21hLmNvbS9DUkwtQi5jcmwwDgYDVR0RBAcwBYgDiDcKMAoGCCqGSM49BAMCA0kAMEYCIQDIkDnIR8wmryRs5A98C3sqQ8Dq5pjD5bkZs78VhSbLUAIhAOP5S+QXJDyt9gLkhoR1v1i\/gyojU0v\/XibSOO6JNn50","transactionId":"5ECA276CA29A4CA195CC6BB018876822"} +server_signed1 = b64decode("MEiAEF7KJ2yimkyhlcxrsBiHaCKBEHER5IG5b1G6e7jPocDPKe2DEHJzcC5lc2ltLm1lOjgwODOEEAvjnivyXEiliHwazCzm9x4=") +euicc_ci_pikd_to_be_used = b64decode('BBT1QXK9+YqV1ly+uIo4ocEdgAqFww==') +server_signature = b64decode("XzdAtrqULn5f\/AwhetyKdDLdORLx9Hzo\/bfV4scgA8J4exhkasTC\/xZZmZ331OQsdJuq7Fpqh3+gI7uI0SE2BKVBvA==") +server_certificate = b64decode("MIICYDCCAgWgAwIBAgICAQAwCgYIKoZIzj0EAwIwSTELMAkGA1UEBhMCSVQxEDAOBgNVBAoMB1JTUFRFU1QxETAPBgNVBAsMCFRFU1RDRVJUMRUwEwYDVQQDDAxHU01BIFRlc3QgQ0kwHhcNMTgwMzI4MDAwMDAwWhcNMjEwMzI3MDAwMDAwWjBMMScwJQYDVQQDDB5OWFAgVGVzdCBTTS1EUCsgQXV0aGVudGljYXRpb24xFDASBgNVBAoMC05YUCBBdXN0cmlhMQswCQYDVQQGEwJBVDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABPQ+vACwEgNEUzAYXNszI19AOQOAuPgAesSbf7CEzdRQ8AtH6n1ZivF9sYBsaNm6qodzZHjlPgE3WzcMQN5pCw+jgdkwgdYwHQYDVR0OBBYEFJbWoxNJ9dzzl4TKofi3hBWqFQwjMB8GA1UdIwQYMBaAFPVBcr35ipXWXL64ijihwR2ACoXDMA4GA1UdDwEB\/wQEAwIHgDAXBgNVHSABAf8EDTALMAkGB2eBEgECAQQwWwYDVR0fBFQwUjAnoCWgI4YhaHR0cDovL2NpLnRlc3QuZ3NtYS5jb20vQ1JMLUEuY3JsMCegJaAjhiFodHRwOi8vY2kudGVzdC5nc21hLmNvbS9DUkwtQi5jcmwwDgYDVR0RBAcwBYgDiDcKMAoGCCqGSM49BAMCA0kAMEYCIQDIkDnIR8wmryRs5A98C3sqQ8Dq5pjD5bkZs78VhSbLUAIhAOP5S+QXJDyt9gLkhoR1v1i\/gyojU0v\/XibSOO6JNn50") +with open('server_cert.der','wb') as f: + f.write(server_certificate) +with open('data_sig.bin','wb') as f: + f.write(server_signature) +with open('data.bin','wb') as f: + f.write(server_signed1) + +# {"type":"progress","payload":{"code":0,"message":"es10b_authenticate_server","data":null}} +server_cert = load_der_x509_certificate(server_certificate) +print("Server certificate") +pp(server_cert) +pp(server_cert.issuer) +pp(server_cert.subject) +pp(server_cert.signature_algorithm_oid) +pp(server_cert.extensions) +pp(b2h(euicc_ci_pikd_to_be_used)) +pkey = server_cert.public_key() +print("server_signed1: %s" % b2h(server_signed1)) +print("server_signature: %s" % b2h(server_signature)) +# convert ECDSA signature from "BSI TS 03111 wrapped in TLV" into more commonly used DER format +r = server_signature[3:3+32] +s = server_signature[3+32:3+32+32] +print("r: %s" % b2h(r)) +print("s: %s" % b2h(s)) +server_signature_der = encode_dss_signature(int.from_bytes(r), int.from_bytes(s)) +print("server_signature_der: %s" % b2h(server_signature_der)) +with open('data_sig.der','wb') as f: + f.write(server_signature_der) +pkey.verify(server_signature_der, server_signed1, ec.ECDSA(hashes.SHA256())) + +#sys.exit(0) + +print() +# {"type":"progress","payload":{"code":0,"message":"es9p_authenticate_client","data":null}} +# HTTP Req https://rsp.esim.me:8083/gsma/rsp2/es9plus/authenticateClient: {"transactionId":"5ECA276CA29A4CA195CC6BB018876822","authenticateServerResponse":"vziCBiCgggYcMIIBU4AQXsonbKKaTKGVzGuwGIdoIoMQcnNwLmVzaW0ubWU6ODA4M4QQC+OeK/JcSKWIfBrMLOb3Hr8igfiBAwIBAIIDAgIAgwMEBACED4EBAIIEAAfqFoMEAAAW4IUEBn82wIYDCQIAhwMCAwCIAgSQqSwEFMC8cLo2kp1DtGf/V1cFMOV6uPzYBBT1QXK9+YqV1ly+uIo4ocEdgAqFw6osBBTAvHC6NpKdQ7Rn/1dXBTDlerj82AQU9UFyvfmKldZcvriKOKHBHYAKhcOZAgeABAMAAAEME0cmREFjY3JlZGl0YXRpb25OYnKsSIAfMS4yLjg0MC4xMjM0NTY3L215UGxhdGZvcm1MYWJlbIElaHR0cHM6Ly9teWNvbXBhbnkuY29tL215RExPQVJlZ2lzdHJhcqAfgBMyRUxDLU8vVkktTExBRy1FWFgyoQiABDUpBhGhAF83QPAWFuGoVL0uxcI4Vl0+uy2IZEORlFJ0Oo72SBzG2cSTSt6FwHdR0P8ay80p6PA27Odq5lNqVCL7gSlC58mLKBYwggH+MIIBpaADAgECAgkCAAAAAAAAAAEwCgYIKoZIzj0EAwIwNzELMAkGA1UEBhMCREUxFTATBgNVBAoMDFJTUCBUZXN0IEVVTTERMA8GA1UEAwwIRVVNIFRlc3QwIBcNMTcwMTA5MTQzOTAzWhgPNzQ5MjExMDIxNDM5MDNaMGQxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxSU1AgVGVzdCBFVU0xKTAnBgNVBAUTIDg5MDQ5MDMyMTIzNDUxMjM0NTEyMzQ1Njc4OTAxMjM1MRMwEQYDVQQDDApUZXN0IGVVSUNDMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbbP1OtyH3C/xDHv82HrROulwCa+gZaZ1fuVxs/LrsY9GwdaPPt6w50suXVQgUefSf1CVIChgWv3vef6f/9A5WaNrMGkwHwYDVR0jBBgwFoAU3T2iTTUMHMXQrwll9A7DTF7kCfEwHQYDVR0OBBYEFKUkdq9dUKo3ZDfMsdohcu9F9ITwMA4GA1UdDwEB/wQEAwIHgDAXBgNVHSABAf8EDTALMAkGB2eBEgECAQEwCgYIKoZIzj0EAwIDRwAwRAIgXtrp47knijYSZdy9E6O/SNeuxD0pBRJb+sovTPOn5lQCIAiflWu5iVlld+yYbfevZvKkRiXzhXdMVmUH9vLNcuAsMIICfDCCAiGgAwIBAgIEEjRWeDAKBggqhkjOPQQDAjBJMRUwEwYDVQQDDAxHU01BIFRlc3QgQ0kxETAPBgNVBAsMCFRFU1RDRVJUMRAwDgYDVQQKDAdSU1BURVNUMQswCQYDVQQGEwJJVDAgFw0xNzAxMTkxODEwMzBaGA8yMDUxMDExOTE4MTAzMFowNzELMAkGA1UEBhMCREUxFTATBgNVBAoMDFJTUCBUZXN0IEVVTTERMA8GA1UEAwwIRVVNIFRlc3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQTMNWSVqwMtQvZKND0xoAHxIX+P0KYitPuOHWuM/SYOrI7TdTDE0DWdt2OEfnFy6GxHraU7tCZTbUpKF5jLIkGo4IBBTCCAQEwHwYDVR0jBBgwFoAU9UFyvfmKldZcvriKOKHBHYAKhcMwHQYDVR0OBBYEFN09ok01DBzF0K8JZfQOw0xe5AnxMA4GA1UdDwEB/wQEAwICBDAXBgNVHSABAf8EDTALMAkGB2eBEgECAQIwDgYDVR0RBAcwBYgDiDcFMBIGA1UdEwEB/wQIMAYBAf8CAQAwMgYDVR0fBCswKTAnoCWgI4YhaHR0cDovL2NpLnRlc3QuZ3NtYS5jb20vQ1JMLUIuY3JsMD4GA1UdHgEB/wQ0MDKgMDAupCwwKjEVMBMGA1UECgwMUlNQIFRlc3QgRVVNMREwDwYDVQQFEwg4OTA0OTAzMjAKBggqhkjOPQQDAgNJADBGAiEAjE1LJkBOpd3qZeu0PBjbqxLLkJfet38LoVfjjHsYtO4CIQDRjZzzoTSH7mXKa0j4wa3ALnp9ifF0ta4rXh2CCpsjIw=="} +authenticate_server_resp = b64decode("vziCBiCgggYcMIIBU4AQXsonbKKaTKGVzGuwGIdoIoMQcnNwLmVzaW0ubWU6ODA4M4QQC+OeK/JcSKWIfBrMLOb3Hr8igfiBAwIBAIIDAgIAgwMEBACED4EBAIIEAAfqFoMEAAAW4IUEBn82wIYDCQIAhwMCAwCIAgSQqSwEFMC8cLo2kp1DtGf/V1cFMOV6uPzYBBT1QXK9+YqV1ly+uIo4ocEdgAqFw6osBBTAvHC6NpKdQ7Rn/1dXBTDlerj82AQU9UFyvfmKldZcvriKOKHBHYAKhcOZAgeABAMAAAEME0cmREFjY3JlZGl0YXRpb25OYnKsSIAfMS4yLjg0MC4xMjM0NTY3L215UGxhdGZvcm1MYWJlbIElaHR0cHM6Ly9teWNvbXBhbnkuY29tL215RExPQVJlZ2lzdHJhcqAfgBMyRUxDLU8vVkktTExBRy1FWFgyoQiABDUpBhGhAF83QPAWFuGoVL0uxcI4Vl0+uy2IZEORlFJ0Oo72SBzG2cSTSt6FwHdR0P8ay80p6PA27Odq5lNqVCL7gSlC58mLKBYwggH+MIIBpaADAgECAgkCAAAAAAAAAAEwCgYIKoZIzj0EAwIwNzELMAkGA1UEBhMCREUxFTATBgNVBAoMDFJTUCBUZXN0IEVVTTERMA8GA1UEAwwIRVVNIFRlc3QwIBcNMTcwMTA5MTQzOTAzWhgPNzQ5MjExMDIxNDM5MDNaMGQxCzAJBgNVBAYTAkRFMRUwEwYDVQQKDAxSU1AgVGVzdCBFVU0xKTAnBgNVBAUTIDg5MDQ5MDMyMTIzNDUxMjM0NTEyMzQ1Njc4OTAxMjM1MRMwEQYDVQQDDApUZXN0IGVVSUNDMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbbP1OtyH3C/xDHv82HrROulwCa+gZaZ1fuVxs/LrsY9GwdaPPt6w50suXVQgUefSf1CVIChgWv3vef6f/9A5WaNrMGkwHwYDVR0jBBgwFoAU3T2iTTUMHMXQrwll9A7DTF7kCfEwHQYDVR0OBBYEFKUkdq9dUKo3ZDfMsdohcu9F9ITwMA4GA1UdDwEB/wQEAwIHgDAXBgNVHSABAf8EDTALMAkGB2eBEgECAQEwCgYIKoZIzj0EAwIDRwAwRAIgXtrp47knijYSZdy9E6O/SNeuxD0pBRJb+sovTPOn5lQCIAiflWu5iVlld+yYbfevZvKkRiXzhXdMVmUH9vLNcuAsMIICfDCCAiGgAwIBAgIEEjRWeDAKBggqhkjOPQQDAjBJMRUwEwYDVQQDDAxHU01BIFRlc3QgQ0kxETAPBgNVBAsMCFRFU1RDRVJUMRAwDgYDVQQKDAdSU1BURVNUMQswCQYDVQQGEwJJVDAgFw0xNzAxMTkxODEwMzBaGA8yMDUxMDExOTE4MTAzMFowNzELMAkGA1UEBhMCREUxFTATBgNVBAoMDFJTUCBUZXN0IEVVTTERMA8GA1UEAwwIRVVNIFRlc3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQTMNWSVqwMtQvZKND0xoAHxIX+P0KYitPuOHWuM/SYOrI7TdTDE0DWdt2OEfnFy6GxHraU7tCZTbUpKF5jLIkGo4IBBTCCAQEwHwYDVR0jBBgwFoAU9UFyvfmKldZcvriKOKHBHYAKhcMwHQYDVR0OBBYEFN09ok01DBzF0K8JZfQOw0xe5AnxMA4GA1UdDwEB/wQEAwICBDAXBgNVHSABAf8EDTALMAkGB2eBEgECAQIwDgYDVR0RBAcwBYgDiDcFMBIGA1UdEwEB/wQIMAYBAf8CAQAwMgYDVR0fBCswKTAnoCWgI4YhaHR0cDovL2NpLnRlc3QuZ3NtYS5jb20vQ1JMLUIuY3JsMD4GA1UdHgEB/wQ0MDKgMDAupCwwKjEVMBMGA1UECgwMUlNQIFRlc3QgRVVNMREwDwYDVQQFEwg4OTA0OTAzMjAKBggqhkjOPQQDAgNJADBGAiEAjE1LJkBOpd3qZeu0PBjbqxLLkJfet38LoVfjjHsYtO4CIQDRjZzzoTSH7mXKa0j4wa3ALnp9ifF0ta4rXh2CCpsjIw==") +# HTTP Resp: {"smdpSigned2":"MBWAEF7KJ2yimkyhlcxrsBiHaCIBAf8=","smdpSignature2":"XzdAlSZBMgwHOMrxZkmFrZKf5HPDc2+4cbDbik31VW2YIPb4kp+uLN8OVGuJeQZS+XkvDfTNJnYkphv9rC+K34kueQ==","profileMetadata":"vyU2WgqYlFGIKCAQEACCkQZUZVZpLTKSDVRlbGNvIFZpbGxhZ2WVAQK2DjAMgAIHgIEGQUJDREVG","smdpCertificate":"MIICYTCCAgagAwIBAgICAQEwCgYIKoZIzj0EAwIwSTELMAkGA1UEBhMCSVQxEDAOBgNVBAoMB1JTUFRFU1QxETAPBgNVBAsMCFRFU1RDRVJUMRUwEwYDVQQDDAxHU01BIFRlc3QgQ0kwHhcNMTgwMzI4MDAwMDAwWhcNMTMwMzI3MDAwMDAwWjBNMSgwJgYDVQQDDB9OWFAgVGVzdCBTTS1EUCsgUHJvZmlsZSBCaW5kaW5nMRQwEgYDVQQKDAtOWFAgQXVzdHJpYTELMAkGA1UEBhMCQVQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAR6J+\/982zA4p\/2wYxdP9qbhbMf9w1M6CEc\/0Gw6dXNn3gMG+wy7vqAsf0mx5KkKlQdEf2kTvelNvN85p1ZiPdWo4HZMIHWMB0GA1UdDgQWBBR3DJnk7lhra7KKQyoQROJXe40QezAfBgNVHSMEGDAWgBT1QXK9+YqV1ly+uIo4ocEdgAqFwzAOBgNVHQ8BAf8EBAMCB4AwFwYDVR0gAQH\/BA0wCzAJBgdngRIBAgEFMFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6Ly9jaS50ZXN0LmdzbWEuY29tL0NSTC1BLmNybDAnoCWgI4YhaHR0cDovL2NpLnRlc3QuZ3NtYS5jb20vQ1JMLUIuY3JsMA4GA1UdEQQHMAWIA4g3CjAKBggqhkjOPQQDAgNJADBGAiEAmrnxGnTKBZVIbLM+1vDjhg9PNVZhVVl7r2KJWNFw2H0CIQDNtrIB8LKhsUgFXuFxhCXYEnGH7h0aW\/9Je04k5nd\/tw==","header":{"functionExecutionStatus":{"status":"Executed-Success"}},"transactionId":"5ECA276CA29A4CA195CC6BB018876822"} +smdp_signed2 = b64decode("MBWAEF7KJ2yimkyhlcxrsBiHaCIBAf8=") +smdp_signature2 = b64decode("XzdAlSZBMgwHOMrxZkmFrZKf5HPDc2+4cbDbik31VW2YIPb4kp+uLN8OVGuJeQZS+XkvDfTNJnYkphv9rC+K34kueQ==") +profile_metadata = b64decode("vyU2WgqYlFGIKCAQEACCkQZUZVZpLTKSDVRlbGNvIFZpbGxhZ2WVAQK2DjAMgAIHgIEGQUJDREVG") +smdp_certificate = b64decode("MIICYTCCAgagAwIBAgICAQEwCgYIKoZIzj0EAwIwSTELMAkGA1UEBhMCSVQxEDAOBgNVBAoMB1JTUFRFU1QxETAPBgNVBAsMCFRFU1RDRVJUMRUwEwYDVQQDDAxHU01BIFRlc3QgQ0kwHhcNMTgwMzI4MDAwMDAwWhcNMTMwMzI3MDAwMDAwWjBNMSgwJgYDVQQDDB9OWFAgVGVzdCBTTS1EUCsgUHJvZmlsZSBCaW5kaW5nMRQwEgYDVQQKDAtOWFAgQXVzdHJpYTELMAkGA1UEBhMCQVQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAR6J+\/982zA4p\/2wYxdP9qbhbMf9w1M6CEc\/0Gw6dXNn3gMG+wy7vqAsf0mx5KkKlQdEf2kTvelNvN85p1ZiPdWo4HZMIHWMB0GA1UdDgQWBBR3DJnk7lhra7KKQyoQROJXe40QezAfBgNVHSMEGDAWgBT1QXK9+YqV1ly+uIo4ocEdgAqFwzAOBgNVHQ8BAf8EBAMCB4AwFwYDVR0gAQH\/BA0wCzAJBgdngRIBAgEFMFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6Ly9jaS50ZXN0LmdzbWEuY29tL0NSTC1BLmNybDAnoCWgI4YhaHR0cDovL2NpLnRlc3QuZ3NtYS5jb20vQ1JMLUIuY3JsMA4GA1UdEQQHMAWIA4g3CjAKBggqhkjOPQQDAgNJADBGAiEAmrnxGnTKBZVIbLM+1vDjhg9PNVZhVVl7r2KJWNFw2H0CIQDNtrIB8LKhsUgFXuFxhCXYEnGH7h0aW\/9Je04k5nd\/tw==") +# {"type":"progress","payload":{"code":0,"message":"es10b_prepare_download","data":null}} + +smdp_cert = load_der_x509_certificate(smdp_certificate) +print("SMDP certificate") +pp(smdp_cert) +pp(smdp_cert.issuer) +pp(smdp_cert.subject) +pp(smdp_cert.signature_algorithm_oid) +pp(server_cert.extensions) +pkey = smdp_cert.public_key() +r = smdp_signature2[3:3+32] +s = smdp_signature2[3+32:3+32+32] +smdp_signature2_der = encode_dss_signature(int.from_bytes(r), int.from_bytes(s)) +pkey.verify(smdp_signature2_der, smdp_signed2, ec.ECDSA(hashes.SHA256())) + + + + + +# {"type":"progress","payload":{"code":0,"message":"es9p_get_bound_profile_package","data":null}} +# HTTP Req https://rsp.esim.me:8083/gsma/rsp2/es9plus/getBoundProfilePackage: {"transactionId":"5ECA276CA29A4CA195CC6BB018876822","prepareDownloadResponse":"vyEXoRWAEF7KJ2yimkyhlcxrsBiHaCICAX8="} +# HTTP Resp: {"header":{"functionExecutionStatus":{"status":"Failed","statusCodeData":{"subjectIdentifier":"2ELC-O\/VI-LLAG-EXX2","subjectCode":"8.1.1","reasonCode":"3.8","message":"Confirmation Code mismatch"}}}} +# {"type":"lpa","payload":{"code":-1,"message":"es9p_get_bound_profile_package","data":"{\"subjectIdentifier\":\"2ELC-O/VI-LLAG-EXX2\",\"subjectCode\":\"8.1.1\",\"reasonCode\":\"3.8\",\"message\":\"Confirmation Code mismatch\"}"}} + + + +print("PKId To be used: %s" % b2h(euicc_ci_pikd_to_be_used)) diff --git a/pySim/smdp_crypto.py b/pySim/smdp_crypto.py new file mode 100644 index 0000000..a99e3b7 --- /dev/null +++ b/pySim/smdp_crypto.py @@ -0,0 +1,242 @@ + +# That block of data is split into segments of a maximum size of 1020 bytes (including the tag, length field and MAC). +MAX_SEGMENT_SIZE = 1020 + +import abc +from typing import List + +# for BPS key derivation +from cryptography.hazmat.primitives import hashes +from cryptography.hazmat.primitives.kdf.x963kdf import X963KDF + +from Cryptodome.Cipher import AES +from Cryptodome.Hash import CMAC + +from pySim.utils import bertlv_encode_len, bertlv_parse_one, b2h + +class BspAlgo(abc.ABC): + blocksize = None + enum_name = None + + def _get_padding(self, in_len: int, multiple: int, padding: int = 0): + """Return padding bytes towards multiple of N.""" + if in_len % multiple == 0: + return b'' + pad_cnt = multiple - (in_len % multiple) + return b'\x00' * pad_cnt + + def _pad_to_multiple(self, indat: bytes, multiple: int, padding: int = 0): + return indat + self._get_padding(len(indat), self.blocksize, padding) + + def __init__(self): + pass + + def __str__(self): + return self.__class__.__name__ + +class BspAlgoCrypt(BspAlgo, abc.ABC): + + def __init__(self, s_enc: bytes): + self.iv = bytes([0] * (self.blocksize-1)) + b'\x01' + self.s_enc = s_enc + self.block_nr = 0 + pass + + def encrypt(self, data:bytes) -> bytes: + """Encrypt given input bytes using the key material given in constructor.""" + padded_data = self._pad_to_multiple(data, self.blocksize) + return self._encrypt(padded_data) + + def decrypt(self, data:bytes) -> bytes: + """Decrypt given input bytes using the key material given in constructor.""" + return self._decrypt(data) + + @abc.abstractmethod + def _encrypt(self, data:bytes) -> bytes: + """Actual implementation, to be implemented by derived class.""" + pass + + #(a)abc.abstractmethod + def _decrypt(self, data:bytes) -> bytes: + """Actual implementation, to be implemented by derived class.""" + pass + +class BspAlgoCryptAES128(BspAlgoCrypt): + name = 'AES-CBC-128' + blocksize = 16 + + def _get_padding(self, in_len: int, multiple: int, padding: int = 0): + # SGP.22 section 2.6.4.4 + # Append a byte with value '80' to the right of the data block; + pad = b'\x80' + # Append 0 to 15 bytes with value '00' so that the length of the padded data block + # is a multiple of 16 bytes. + if (in_len + 1) % multiple == 0: + return pad + pad_cnt = multiple - ((in_len + 1) % multiple) + pad = pad + b'\x00' * pad_cnt + return pad + + def _get_icv(self): + # The binary value of this number SHALL be left padded with zeroes to form a full block. + data = self.block_nr.to_bytes(self.blocksize, "big") + iv = bytes([0] * (self.blocksize-1)) + b'\x01' + # This block SHALL be encrypted with S-ENC to produce the ICV for command encryption. + cipher = AES.new(self.s_enc, AES.MODE_CBC, iv) + icv = cipher.encrypt(data) + self.block_nr = self.block_nr + 1 + return icv + + def _encrypt(self, data: bytes) -> bytes: + cipher = AES.new(self.s_enc, AES.MODE_CBC, self._get_icv()) + return cipher.encrypt(data) + + def _decrypt(self, data: bytes) -> bytes: + cipher = AES.new(self.s_enc, AES.MODE_CBC, self._get_icv()) + return cipher.decrypt(data) + + +class BspAlgoMac(BspAlgo, abc.ABC): + + def __init__(self, s_mac: bytes, initial_mac_chaining_value: bytes): + self.s_mac = s_mac + self.mac_chain = initial_mac_chaining_value + + def auth(self, tag: int, data: bytes) -> bytes: + assert tag <= 255 + # The input data used for C-MAC computation comprises the MAC Chaining value, the tag, the final length and the result of step 2 + lcc = len(data) + self.l_mac + tag_and_length = bytes([tag]) + bertlv_encode_len(lcc) + temp_data = self.mac_chain + tag_and_length + data + c_mac = self._auth(temp_data) + # The output data is computed by concatenating the following data: the tag, the final length, the result of step 2 and the C-MAC value. + return tag_and_length + data + c_mac + + def verify(self, ciphertext: bytes) -> bool: + print("ciphertext=%s" % b2h(ciphertext)) + mac_stripped = ciphertext[0:-self.l_mac] + mac_received = ciphertext[-self.l_mac:] + print("mac_stripped=%s" % b2h(mac_stripped)) + print("mac_received=%s" % b2h(mac_received)) + temp_data = self.mac_chain + mac_stripped + mac_computed = self._auth(temp_data) + print("mac_computed=%s" % b2h(mac_computed)) + if mac_received != mac_computed: + raise ValueError("MAC value not matching") + return mac_stripped + + @abc.abstractmethod + def _auth(self, temp_data: bytes) -> bytes: + """To be implemented by algorithm specific derived class.""" + pass + +class BspAlgoMacAES128(BspAlgoMac): + name = 'AES-CMAC-128' + l_mac = 8 + + def _auth(self, temp_data: bytes) -> bytes: + # The full MAC value is computed using the MACing algorithm as defined in table 4c. + cmac = CMAC.new(self.s_mac, ciphermod=AES) + cmac.update(temp_data) + full_c_mac = cmac.digest() + # Subsequent MAC chaining values are the full result of step 4 of the previous data block + self.mac_chain = full_c_mac + # If the algorithm is AES-CBC-128 or SM4-CBC, the C-MAC value is the 8 most significant bytes of the result of step 4 + return full_c_mac[0:8] + + + +def bsp_key_derivation(shared_secret: bytes, key_type: int, key_length: int, host_id_lv: bytes, eid_lv, l : int = 16): + """BSP protocol key derivation as per SGP.22 v3.0 Section 2.6.4.2""" + assert key_type <= 255 + assert key_length <= 255 + shared_info = bytes([key_type, key_length]) + host_id_lv + eid_lv + + # X9.63 Key Derivation Function with SHA256 + xkdf = X963KDF(algorithm=hashes.SHA256(), length=l*3, sharedinfo=shared_info) + out = xkdf.derive(shared_secret) + + initial_mac_chaining_value = out[0:l] + s_enc = out[l:2*l] + s_mac = out[l*2:3*l] + return s_enc, s_mac, initial_mac_chaining_value + + + +class BspInstance: + """An instance of the BSP crypto. Initialized once with the key material via constructor, + then the user can call any number of encrypt_and_mac cycles to protect plaintext and + generate the respective ciphertext.""" + def __init__(self, s_enc: bytes, s_mac: bytes, initial_mcv: bytes): + self.c_algo = BspAlgoCryptAES128(s_enc) + self.m_algo = BspAlgoMacAES128(s_mac, initial_mcv) + + TAG_LEN = 1 + length_len = len(bertlv_encode_len(MAX_SEGMENT_SIZE)) + self.max_payload_size = MAX_SEGMENT_SIZE - 1 - length_len - TAG_LEN - self.m_algo.l_mac + + @classmethod + def from_kdf(cls, shared_secret: bytes, key_type: int, key_length: int, host_id_lv: bytes, eid_lv: bytes): + """Convenience constructor for constructing an instance with keys from KDF.""" + s_enc, s_mac, initial_mcv = bsp_key_derivation(shared_secret, key_type, key_length, host_id_lv, eid_lv) + return cls(s_enc, s_mac, initial_mcv) + + def encrypt_and_mac_one(self, tag: int, plaintext:bytes) -> bytes: + assert tag <= 255 + assert len(plaintext) < self.max_payload_size + """Encrypt + MAC a single plaintext TLV. Returns the protected ciphertex.""" + ciphered = self.c_algo.encrypt(plaintext) + maced = self.m_algo.auth(tag, ciphered) + return maced + + def encrypt_and_mac(self, tag: int, plaintext:bytes) -> List[bytes]: + remainder = plaintext + result = [] + while len(remainder): + remaining_len = len(remainder) + if remaining_len < self.max_payload_size: + segment_len = remaining_len + segment = remainder + remainder = b'' + else: + segment_len = self.max_payload_size + segment = remainder[0:segment_len] + remainder = remainder[segment_len:] + result.append(self.encrypt_and_mac_one(tag, segment)) + return result + + def mac_only_one(self, tag: int, plaintext: bytes) -> bytes: + """MAC a single plaintext TLV. Returns the protected ciphertex.""" + assert tag <= 255 + assert len(plaintext) < self.max_payload_size + maced = self.m_algo.auth(tag, plaintext) + return maced + + def mac_only(self, tag: int, plaintext:bytes) -> List[bytes]: + remainder = plaintext + result = [] + while len(remainder): + remaining_len = len(remainder) + if remaining_len < self.max_payload_size: + segment_len = remaining_len + segment = remainder + remainder = b'' + else: + segment_len = self.max_payload_size + segment = remainder[0:segment_len] + remainder = remainder[segment_len:] + result.append(self.mac_only_one(tag, segment)) + return result + + def demac_and_decrypt_one(self, ciphertext: bytes) -> bytes: + payload = self.m_algo.verify(ciphertext) + tdict, l, val, remain = bertlv_parse_one(payload) + print("tag=%s, l=%u, val=%s, remain=%s" % (tdict, l, b2h(val), b2h(remain))) + plaintext = self.c_algo.decrypt(val) + return plaintext + + def demac_and_decrypt(self, ciphertext_list: List[bytes]): + plaintext_list = [] + for ciphertext in ciphertext_list: + plaintext_list.append(self.demac_and_decrypt_one(ciphertext)) + return plaintext_list diff --git a/server.pem b/server.pem new file mode 100644 index 0000000..5a63365 --- /dev/null +++ b/server.pem @@ -0,0 +1,28 @@ +-----BEGIN PUBLIC KEY----- +MFowFAYHKoZIzj0CAQYJKyQDAwIIAQEHA0IABEwizNgsjQIh+dhUO3LhB7zJ/ZBU +1mx1wOt0p73nMOdhjvZbJwteguQ6eW+N7guvivvrilNiU3oC/WXHnkEZa7U= +-----END PUBLIC KEY----- +-----BEGIN EC PARAMETERS----- +BgkrJAMDAggBAQc= +-----END EC PARAMETERS----- +-----BEGIN EC PRIVATE KEY----- +MHgCAQEEID9nFSgCs/TH+uZ5WFX2glQeReNe//TooFVloPGRKnguoAsGCSskAwMC +CAEBB6FEA0IABEwizNgsjQIh+dhUO3LhB7zJ/ZBU1mx1wOt0p73nMOdhjvZbJwte +guQ6eW+N7guvivvrilNiU3oC/WXHnkEZa7U= +-----END EC PRIVATE KEY----- +-----BEGIN CERTIFICATE----- +MIICgjCCAimgAwIBAgIBCTAKBggqhkjOPQQDAjBEMRAwDgYDVQQDDAdUZXN0IENJ +MREwDwYDVQQLDAhURVNUQ0VSVDEQMA4GA1UECgwHUlNQVEVTVDELMAkGA1UEBhMC +SVQwHhcNMjMwNjA5MTkwNDU3WhcNMjQwNzExMTkwNDU3WjAzMQ0wCwYDVQQKDARB +Q01FMSIwIAYDVQQDDBl0ZXN0c21kcHBsdXMxLmV4YW1wbGUuY29tMFowFAYHKoZI +zj0CAQYJKyQDAwIIAQEHA0IABEwizNgsjQIh+dhUO3LhB7zJ/ZBU1mx1wOt0p73n +MOdhjvZbJwteguQ6eW+N7guvivvrilNiU3oC/WXHnkEZa7WjggEaMIIBFjAOBgNV +HQ8BAf8EBAMCB4AwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBQG +A1UdIAQNMAswCQYHZ4ESAQIBAzAdBgNVHQ4EFgQUPTMJg/OfzFvS5K1ophmnR0iu +i50wHwYDVR0jBBgwFoAUwLxwujaSnUO0Z/9XVwUw5Xq4/NgwKQYDVR0RBCIwIIIZ +dGVzdHNtZHBwbHVzMS5leGFtcGxlLmNvbYgDiDcKMGEGA1UdHwRaMFgwKqAooCaG +JGh0dHA6Ly9jaS50ZXN0LmV4YW1wbGUuY29tL0NSTC1BLmNybDAqoCigJoYkaHR0 +cDovL2NpLnRlc3QuZXhhbXBsZS5jb20vQ1JMLUIuY3JsMAoGCCqGSM49BAMCA0cA +MEQCIApcIEyTa5qMAEzGohhaowudyFI+gtlVJCdRkigpaJUbAiARhnBzfX903/Uw +2s35o2v0PlFVG3p940QMCCoc4yz3hA== +-----END CERTIFICATE----- diff --git a/sm-dp-http.py b/sm-dp-http.py new file mode 100755 index 0000000..2195529 --- /dev/null +++ b/sm-dp-http.py @@ -0,0 +1,222 @@ +#!/usr/bin/env python3 + +# SM-DP+ HTTP service for GSMA consumer eSIM RSP +# +# (C) 2023 by Harald Welte <laforge(a)osmocom.org> +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +import json +import sys +import argparse +import uuid +import os +from pprint import pprint as pp + +import base64 +from base64 import b64decode +from klein import Klein +import asn1tools + +from pySim.utils import h2b, b2h + +ASN1_DIR="/home/laforge/Downloads/sim_usim_isim/esim/asn1/" +ASN1_FILES=['rsp.asn','PKIX1Implicit88.asn', 'PKIX1Explicit88.asn'] + +# TODO: evaluate User-Agent + X-Admin-Protocol header +# TODO: reject any non-JSON Content-type + +def b64encode2str(req: bytes) -> str: + return base64.b64encode(req).decode('ascii') + +def set_headers(request): + request.setHeader('Content-Type', 'application/json;charset=UTF-8') + request.setHeader('X-Admin-Protocol', 'gsma/rsp/v2.1.0') + +def build_resp_header(js: dict, status: str = 'Executed-Success', status_code_data = None): + # SGP.22 v3.0 6.5.1.4 + js['header'] = { + 'functionExecutionStatus': { + 'status': status, + } + } + if status_code_data: + js['header']['functionExecutionStatus']['statusCodeData'] = status_code_data + +from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature, encode_dss_signature +from cryptography.hazmat.primitives.serialization import load_pem_private_key, Encoding +from cryptography.hazmat.primitives.asymmetric import ec +from cryptography.hazmat.primitives import hashes +from cryptography import x509 + +def ecdsa_dss_to_tr03111(sig: bytes) -> bytes: + """convert from DER format to BSI TR-03111; first get long integers; then convert those to bytes.""" + r, s = decode_dss_signature(sig) + return r.to_bytes(32, 'big') + s.to_bytes(32, 'big') + +def ecdsa_tr03111_to_dss(sig: bytes) -> bytes: + """convert an ECDSA signature from BSI TR-03111 format to DER: first get long integers; then encode those.""" + r = int.from_bytes(sig[0:32], 'big') + s = int.from_bytes(sig[32:32*2], 'big') + return encode_dss_signature(r, s) + +class ApiError: + def __init__(self, status:str, ): + self.status = status + + def __str__(self): + js = {} + build_resp_header(js, status, status_code_data) + return json.dumps(js) + +class SmDppHttpServer: + app = Klein() + asn1 = asn1tools.compile_files([ASN1_DIR + x for x in ASN1_FILES]) + with open('DPauth/CERT_S_SM_DPauth_ECDSA_BRP.der', 'rb') as f: + server_cert = x509.load_der_x509_certificate(f.read()) + with open('DPauth/SK_S_SM_DPauth_ECDSA_BRP.pem', 'rb') as f: + server_private_key = load_pem_private_key(f.read(), None) + + def _ecdsa_sign(self, plaintext: bytes) -> bytes: + """Sign some input-data using an ECDSA signature compliant with SGP.22, + which internally refers to Global Platform 2.2 Annex E, which in turn points + to BSI TS-03111 which states "concatengated raw R + S values". """ + sig = self.server_private_key.sign(plaintext, ec.ECDSA(hashes.SHA256())) + # convert from DER format to BSI TR-03111; first get long integers; then convert those to bytes + return ecdsa_dss_to_tr03111(sig) + + + @app.route('/gsma/rsp2/es9plus/initiateAuthentication', methods=['POST']) + def initiateAutentication(self, request): + output = {} + set_headers(request) + content = json.loads(request.content.read()) + print("Rx JSON: %s" % content) + # TODO: Verify that the received address matches its own SM-DP+ address, where the comparison SHALL be + # case-insensitive. Otherwise, the SM-DP+ SHALL return a status code "SM-DP+ Address - Refused". + #if content['smdpAddress'] != FIXME: ... + + euiccChallenge = b64decode(content['euiccChallenge']) + if len(euiccChallenge) != 16: + raise ValueError + + euiccInfo1_bin = b64decode(content['euiccInfo1']) + euiccInfo1 = self.asn1.decode('EUICCInfo1', euiccInfo1_bin) + print("euiccInfo1: %s" % euiccInfo1) + #euiccInfo1['svn'] + + # TODO: If euiccCiPKIdListForSigningV3 is present ... + # verify it supports one of the keys indicated by euiccCiPKIdListForSigning + #euiccInfo1['euiccCiPKIdListForSigning'] + + # TODO: Determine the set of CERT.DPauth.SIG that satisfy the following criteria: + # * Part of a certificate chain ending at one of the eSIM CA RootCA Certificate, whose Public Keys is + # supported by the eUICC (indicated by euiccCiPKIdListForVerification). + # * Using a certificate chain that the eUICC and the LPA both support: + #euiccInfo1['euiccCiPKIdListForVerification'] + + # Generate a TransactionID which is used to identify the ongoing RSP session. The TransactionID + # SHALL be unique within the scope and lifetime of each SM-DP+. + transactionId = uuid.uuid4().hex + + # Generate a serverChallenge for eUICC authentication attached to the ongoing RSP session. + serverChallenge = os.urandom(16) + + # Generate a serverSigned1 data object as expected by the eUICC and described in section 5.7.13 "ES10b.AuthenticateServer". If and only if both eUICC and LPA indicate crlStaplingV3Support, the SM-DP+ SHALL indicate crlStaplingV3Used in sessionContext. + serverSigned1 = { + 'transactionId': h2b(transactionId), + 'euiccChallenge': euiccChallenge, + 'serverAddress': 'testsmdpplus1.example.com', + 'serverChallenge': serverChallenge, + } + print("Tx serverSigned1: %s" % serverSigned1) + serverSigned1_bin = self.asn1.encode('ServerSigned1', serverSigned1) + output['serverSigned1'] = b64encode2str(serverSigned1_bin) + + # Generate a signature (serverSignature1) as described in section 5.7.13 "ES10b.AuthenticateServer" using the SK related to the selected CERT.DPauth.SIG. + # serverSignature1 SHALL be created using the private key associated to the RSP Server Certificate for authentication, and verified by the eUICC using the contained public key as described in section 2.6.9. serverSignature1 SHALL apply on serverSigned1 data object. + output['serverSignature1'] = b64encode2str(b'\x5f\x37\x40' + self._ecdsa_sign(serverSigned1_bin)) + + output['transactionId'] = transactionId + server_cert_aki = self.server_cert.extensions.get_extension_for_class(x509.AuthorityKeyIdentifier) + output['euiccCiPKIdToBeUsed'] = b64encode2str(server_cert_aki.value.key_identifier) + output['serverCertificate'] = b64encode2str(self.server_cert.public_bytes(Encoding.DER)) + #output['otherCertsInChain'] = b64encode2str() + build_resp_header(output) + print("Tx JSON: %s" % output) + + # FIXME: store all that state somewhere + + return json.dumps(output) + + @app.route('/gsma/rsp2/es9plus/authenticateClient', methods=['POST']) + def authenticateClient(self, request): + set_headers(request) + content = json.loads(request.content.read()) + print("Rx JSON: %s" % content) + transactionId = content['transactionId'] + authenticateServerResp_bin = b64decode(content['authenticateServerResponse']) + authenticateServerResp = self.asn1.decode('AuthenticateServerResponse', authenticateServerResp_bin) + #print("Rx authenticateServerResp: %s" % authenticateServerResp) + print(authenticateServerResp) + if 'authenticateResponseError' in authenticateServerResp: + #r_err = authenticateServerResp['authenticateResponseError'] + #r_err['transactionId'] + #r_err['authenticateErrorCode'] + raise ValueError + + r_ok = authenticateServerResp['authenticateResponseOk'] + #r_ok['euiccSigned1'] + #r_ok['euiccSignature1'] + #r_ok['euiccCertificate'] + #r_ok['eumCertificate'] + + output = {} + output['transactionId'] = transactionId + build_resp_header(output) + + return json.dumps(output) + + @app.route('/gsma/rsp2/es9plus/getBoundProfilePackage', methods=['POST']) + def getBoundProfilePackage(self, request): + set_headers(request) + content = json.loads(request.content.read()) + transactionId = content['transactionId'] + #content['prepareDownloadResponse'] + + output = {} + output['transactionId'] = transactionId + output['boundProfilePackage'] = bpp + build_resp_header(output) + + return json.dumps(output) + + #(a)app.route('/gsma/rsp2/es9plus/handleNotification', methods=['POST']) + #(a)app.route('/gsma/rsp3/es9plus/handleDeviceChangeRequest, methods=['POST']') + #(a)app.route('/gsma/rsp2/es9plus/cancelSession', methods=['POST']) + +def main(argv): + parser = argparse.ArgumentParser() + #parser.add_argument("-H", "--host", help="Host/IP to bind HTTP to", default="localhost") + #parser.add_argument("-p", "--port", help="TCP port to bind HTTP to", default=8000) + #parser.add_argument("-v", "--verbose", help="increase output verbosity", action='count', default=0) + + args = parser.parse_args() + + hs = SmDppHttpServer() + #hs.app.run(endpoint_description="ssl:port=8000:dhParameters=dh_param_2048.pem") + hs.app.run("localhost", 80) + +if __name__ == "__main__": + main(sys.argv) -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35461?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I6232847432dc6920cd2bd08c84d7099c29ca1c11 Gerrit-Change-Number: 35461 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[S] Change in pysim[master]: ts_31_103: Add construct for EF.GBABP and EF.GBANL
by laforge 28 Dec '23

28 Dec '23

Attention is currently required from: laforge. Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/35424?usp=email to look at the new patch set (#3). The following approvals got outdated and were removed: Verified-1 by Jenkins Builder Change subject: ts_31_103: Add construct for EF.GBABP and EF.GBANL ...................................................................... ts_31_103: Add construct for EF.GBABP and EF.GBANL Change-Id: Ife06f54c2443f3e048bd36f706f309843703403a --- M pySim/ts_31_103.py 1 file changed, 24 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/24/35424/3 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35424?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ife06f54c2443f3e048bd36f706f309843703403a Gerrit-Change-Number: 35424 Gerrit-PatchSet: 3 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newpatchset

1 0

[M] Change in pysim[master]: global_platform: Add support for more GET DATA TLVs
by laforge 28 Dec '23

28 Dec '23

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/35460?usp=email ) Change subject: global_platform: Add support for more GET DATA TLVs ...................................................................... global_platform: Add support for more GET DATA TLVs Example: pySIM-shell (00:MF/ADF.ISD)> get_data extended_card_resources_info { "extended_card_resources_info": [ { "number_of_installed_app": 8 }, { "free_non_volatile_memory": 354504 }, { "free_volatile_memory": 10760 } ] } Change-Id: I129e43c377b62dae1b9a88a0a2dc9663ac2a97da --- M pySim/global_platform.py 1 file changed, 87 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/60/35460/1 diff --git a/pySim/global_platform.py b/pySim/global_platform.py index 0ceb884..e04e845 100644 --- a/pySim/global_platform.py +++ b/pySim/global_platform.py @@ -114,6 +114,60 @@ class KeyInformation(BER_TLV_IE, tag=0xe0, nested=[KeyInformationData]): pass +# GlobalPlatform v2.3.1 Section H.4 +class ScpInformation(BER_TLV_IE, tag=0xa0): + pass +class PrivilegesAvailableSSD(BER_TLV_IE, tag=0x81): + pass +class PrivilegesAvailableApplication(BER_TLV_IE, tag=0x82): + pass +class SupportedLFDBHAlgorithms(BER_TLV_IE, tag=0x83): + pass +class CiphersForLFDBEncryption(BER_TLV_IE, tag=0x84): + pass +class CiphersForTokens(BER_TLV_IE, tag=0x85): + pass +class CiphersForReceipts(BER_TLV_IE, tag=0x86): + pass +class CiphersForDAPs(BER_TLV_IE, tag=0x87): + pass +class KeyParameterReferenceList(BER_TLV_IE, tag=0x88): + pass +class CardCapabilityInformation(BER_TLV_IE, tag=0x67, nested=[ScpInformation, PrivilegesAvailableSSD, + PrivilegesAvailableApplication, + SupportedLFDBHAlgorithms, + CiphersForLFDBEncryption, CiphersForTokens, + CiphersForReceipts, CiphersForDAPs, + KeyParameterReferenceList]): + pass + +class CurrentSecurityLevel(BER_TLV_IE, tag=0xd3): + _construct = Int8ub + +# GlobalPlatform v2.3.1 Section 11.3.3.1.3 +class ApplicationAID(BER_TLV_IE, tag=0x4f): + _construct = HexAdapter(GreedyBytes) +class ApplicationTemplate(BER_TLV_IE, tag=0x61, ntested=[ApplicationAID]): + pass +class ListOfApplications(BER_TLV_IE, tag=0x2f00, nested=[ApplicationTemplate]): + pass + +# GlobalPlatform v2.3.1 Section 11.3.3.1.2 + TS 102 226 +class NumberOFInstalledApp(BER_TLV_IE, tag=0x81): + _construct = GreedyInteger() +class FreeNonVolatileMemory(BER_TLV_IE, tag=0x82): + _construct = GreedyInteger() +class FreeVolatileMemory(BER_TLV_IE, tag=0x83): + _construct = GreedyInteger() +class ExtendedCardResourcesInfo(BER_TLV_IE, tag=0xff21, nested=[NumberOFInstalledApp, FreeNonVolatileMemory, + FreeVolatileMemory]): + pass + +# GlobalPlatform v2.3.1 Section 7.4.2.4 + GP SPDM +class SecurityDomainManagerURL(BER_TLV_IE, tag=0x5f50): + pass + + # card data sample, returned in response to GET DATA (80ca006600): # 66 31 # 73 2f @@ -216,7 +270,13 @@ CardData, KeyInformation, SequenceCounterOfDefaultKvn, - ConfirmationCounter]): + ConfirmationCounter, + # v2.3.1 + CardCapabilityInformation, + CurrentSecurityLevel, + ListOfApplications, + ExtendedCardResourcesInfo, + SecurityDomainManagerURL]): pass def decode_select_response(resp_hex: str) -> object: -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35460?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I129e43c377b62dae1b9a88a0a2dc9663ac2a97da Gerrit-Change-Number: 35460 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[M] Change in pysim[master]: sysmocom_sja2: Implement EF_CHV files using construct
by laforge 28 Dec '23

28 Dec '23

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/35458?usp=email ) Change subject: sysmocom_sja2: Implement EF_CHV files using construct ...................................................................... sysmocom_sja2: Implement EF_CHV files using construct this has the advantage of getting the encoder for free (so far we only had the decoder). While at it, also add some tests data for the unit tests. Change-Id: Ifb8caf5cd96706d7fb6b452d6552b115c0828797 --- M pySim/sysmocom_sja2.py 1 file changed, 37 insertions(+), 20 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/58/35458/1 diff --git a/pySim/sysmocom_sja2.py b/pySim/sysmocom_sja2.py index a25bece..5bec446 100644 --- a/pySim/sysmocom_sja2.py +++ b/pySim/sysmocom_sja2.py @@ -46,27 +46,31 @@ class EF_PIN(TransparentEF): - def __init__(self, fid, name): + _test_de_encode = [ + ( 'f1030331323334ffffffff0a0a3132333435363738', + { 'state': { 'valid': True, 'change_able': True, 'unblock_able': True, 'disable_able': True, + 'not_initialized': False, 'disabled': True }, + 'attempts_remaining': 3, 'maximum_attempts': 3, 'pin': '31323334', + 'puk': { 'attempts_remaining': 10, 'maximum_attempts': 10, 'puk': '3132333435363738' } + } ), + ( 'f003039999999999999999', + { 'state': { 'valid': True, 'change_able': True, 'unblock_able': True, 'disable_able': True, + 'not_initialized': False, 'disabled': False }, + 'attempts_remaining': 3, 'maximum_attempts': 3, 'pin': '9999999999999999', + 'puk': None } ), + ] + def __init__(self, fid='6f01', name='EF.CHV1'): super().__init__(fid, name=name, desc='%s PIN file' % name) - - def _decode_bin(self, raw_bin_data): - u = unpack('!BBB8s', raw_bin_data[:11]) - res = {'enabled': (True, False)[u[0] & 0x01], - 'initialized': (True, False)[u[0] & 0x02], - 'disable_able': (False, True)[u[0] & 0x10], - 'unblock_able': (False, True)[u[0] & 0x20], - 'change_able': (False, True)[u[0] & 0x40], - 'valid': (False, True)[u[0] & 0x80], - 'attempts_remaining': u[1], - 'maximum_attempts': u[2], - 'pin': u[3].hex(), - } - if len(raw_bin_data) == 21: - u2 = unpack('!BB8s', raw_bin_data[11:10]) - res['attempts_remaining_puk'] = u2[0] - res['maximum_attempts_puk'] = u2[1] - res['puk'] = u2[2].hex() - return res + StateByte = FlagsEnum(Byte, disabled=1, not_initialized=2, disable_able=0x10, unblock_able=0x20, + change_able=0x40, valid=0x80) + PukStruct = Struct('attempts_remaining'/Int8ub, + 'maximum_attempts'/Int8ub, + 'puk'/HexAdapter(Rpad(Bytes(8)))) + self._construct = Struct('state'/StateByte, + 'attempts_remaining'/Int8ub, + 'maximum_attempts'/Int8ub, + 'pin'/HexAdapter(Rpad(Bytes(8))), + 'puk'/Optional(PukStruct)) class EF_MILENAGE_CFG(TransparentEF): -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35458?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ifb8caf5cd96706d7fb6b452d6552b115c0828797 Gerrit-Change-Number: 35458 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

[S] Change in pysim[master]: commands: Ignore exceptions during READ while UPDATE
by laforge 28 Dec '23

28 Dec '23

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/35459?usp=email ) Change subject: commands: Ignore exceptions during READ while UPDATE ...................................................................... commands: Ignore exceptions during READ while UPDATE If we are reading a file to check if we can skip the write to conserve writes, don't treat exceptions as fatal. The file may well have the access mode in a way that permits us to UPDATE but not to READ. Simply fall-back to unconditional UPDATE in this case. Change-Id: I7bffdaa7596e63c8f0ab04a3cb3ebe12f137d3a8 --- M pySim/commands.py 1 file changed, 35 insertions(+), 7 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/59/35459/1 diff --git a/pySim/commands.py b/pySim/commands.py index 336cf0c..d785251 100644 --- a/pySim/commands.py +++ b/pySim/commands.py @@ -279,9 +279,16 @@ # Save write cycles by reading+comparing before write if conserve: - data_current, sw = self.read_binary(ef, data_length, offset) - if data_current == data: - return None, sw + try: + data_current, sw = self.read_binary(ef, data_length, offset) + if data_current == data: + return None, sw + except Exception: + # cannot read data. This is not a fatal error, as reading is just done to + # conserve the amount of smart card writes. The access conditions of the file + # may well permit us to UPDATE but not permit us to READ. So let's ignore + # any such exception during READ. + pass self.select_path(ef) total_data = '' @@ -363,10 +370,17 @@ # Save write cycles by reading+comparing before write if conserve: - data_current, sw = self.read_record(ef, rec_no) - data_current = data_current[0:rec_length*2] - if data_current == data: - return None, sw + try: + data_current, sw = self.read_record(ef, rec_no) + data_current = data_current[0:rec_length*2] + if data_current == data: + return None, sw + except Exception: + # cannot read data. This is not a fatal error, as reading is just done to + # conserve the amount of smart card writes. The access conditions of the file + # may well permit us to UPDATE but not permit us to READ. So let's ignore + # any such exception during READ. + pass pdu = (self.cla_byte + 'dc%02x04%02x' % (rec_no, rec_length)) + data res = self._tp.send_apdu_checksw(pdu) -- To view, visit https://gerrit.osmocom.org/c/pysim/+/35459?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I7bffdaa7596e63c8f0ab04a3cb3ebe12f137d3a8 Gerrit-Change-Number: 35459 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newchange

1 0

2026

2025

2024

2023

2022

gerrit-log