dexter has uploaded this change for review.

View Change

eim_cfg: split eimPublicKey loading into separete function

When the eIM configuration is generated, the public eIM key is
loaded from the eIM certificate. Let's put this part into a
separate function and make this function public. (We will need
the function to be public in a follow up patch).

Related: SYS#8287
Change-Id: I6b62603e581ea204a55de6bcdb10adcd785642ca
---
M src/eim_cfg.erl
1 file changed, 21 insertions(+), 14 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/37/43937/1

diff --git a/src/eim_cfg.erl b/src/eim_cfg.erl
index dc2adac..1104853 100644
--- a/src/eim_cfg.erl
+++ b/src/eim_cfg.erl
@@ -7,24 +7,20 @@
 -module(eim_cfg).
 
 -include_lib("public_key/include/public_key.hrl").
--export([gen_eim_configuration_data/1]).
+-export([get_eimPublicKey_from_eim_cert/0, gen_eim_configuration_data/1]).
 
-% Generate an encoded eIM configuration string, which can be used to program the eIM configuration into an eUICC,
-% either via ES10b:AddInitialEim or ESep:addEim (eUICC package, eCO). The Format parameter selects how the output data
-% shall be formatted. Two formats are possible: request: AddInitialEimRequest, single: EimConfigurationData
-gen_eim_configuration_data(Format) ->
-    {ok, EimId} = application:get_env(onomondo_eim, eim_id),
-    {ok, EimFqdn} = application:get_env(onomondo_eim, eim_fqdn),
+% Load the eimPublicKey from the configured eIM certificate (see sys.config).
+get_eimPublicKey_from_eim_cert() ->
+    % Load eIM certificate and extract public key.
     {ok, EimCertPath} = utils:get_env_priv_file_path(onomondo_eim, eim_cert),
     {ok, EimCertPem} = file:read_file(EimCertPath),
     [{'Certificate', EimCertBer, not_encrypted}] = public_key:pem_decode(EimCertPem),
     {ok, EimCert} = 'PKIX1Explicit88':decode('Certificate', EimCertBer),
-    EimCert_TbsCertificate = maps:get(tbsCertificate, EimCert),
-    EimCert_SubjectPublicKeyInfo = maps:get(subjectPublicKeyInfo, EimCert_TbsCertificate),
-    {ok, CounterValue} = application:get_env(onomondo_eim, counter_value),
+    EimCertTbsCertificate = maps:get(tbsCertificate, EimCert),
+    EimCertSubjectPublicKeyInfo = maps:get(subjectPublicKeyInfo, EimCertTbsCertificate),
 
-    % Check certificate type
-    EimCert_algorithm = maps:get(algorithm, EimCert_SubjectPublicKeyInfo),
+    % Make sure that the algorithm is suitable and supported by this eIM.
+    EimCertAlgorithm = maps:get(algorithm, EimCertSubjectPublicKeyInfo),
     BrainpoolP256r1 = #{
         algorithm => {1, 2, 840, 10045, 2, 1},
         parameters => <<6, 9, 43, 36, 3, 3, 2, 8, 1, 1, 7>>
@@ -33,12 +29,23 @@
         algorithm => {1, 2, 840, 10045, 2, 1},
         parameters => <<6, 8, 42, 134, 72, 206, 61, 3, 1, 7>>
     },
-    case EimCert_algorithm of
+    case EimCertAlgorithm of
         BrainpoolP256r1 -> ok;
         Prime256v1 -> ok;
         _ -> throw("Incorrect eIM certificate, only BrainpoolP256r1 or Prime256v1 may be used!")
     end,
 
+    EimCertSubjectPublicKeyInfo.
+
+% Generate an encoded eIM configuration string, which can be used to program the eIM configuration into an eUICC,
+% either via ES10b:AddInitialEim or ESep:addEim (eUICC package, eCO). The Format parameter selects how the output data
+% shall be formatted. Two formats are possible: request: AddInitialEimRequest, single: EimConfigurationData
+gen_eim_configuration_data(Format) ->
+    {ok, EimId} = application:get_env(onomondo_eim, eim_id),
+    {ok, EimFqdn} = application:get_env(onomondo_eim, eim_fqdn),
+    EimCertSubjectPublicKeyInfo = get_eimPublicKey_from_eim_cert(),
+    {ok, CounterValue} = application:get_env(onomondo_eim, counter_value),
+
     % Generate eIM configuration
     EimConfigurationData = #{
         eimId => EimId,
@@ -49,7 +56,7 @@
         % Optional: instruct the eUICC to calculate an association token
         associationToken => -1,
         % Mandatory
-        eimPublicKeyData => {eimPublicKey, EimCert_SubjectPublicKeyInfo},
+        eimPublicKeyData => {eimPublicKey, EimCertSubjectPublicKeyInfo},
         % This eIM implementation currently only supports ESipa via HTTPs where the only supported eIM Package
         % transfer procedure is the eIM Package Retrieval procedure (see also SGP.32, section 3.1.1.1.
         eimSupportedProtocol => [eimRetrieveHttps],

To view, visit change 43937. To unsubscribe, or for help writing mail filters, visit settings.