dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43647?usp=email )
Change subject: crypto_utils: log EID instead of entire EUM certificate ......................................................................
crypto_utils: log EID instead of entire EUM certificate
When a profile download happens, the eIM automatically tries to check the EUM and the eUICC certificate. This is done in order to cache the public key of the eUICC certificate. For the check, a suitable root certificate is required. If none is found, an error is logged with the entire EUM certificate as context. Let's instead log the EID of the eUICC that caused the problem, which is much more helpful then just a certificate dump that is barely readable.
Related: SYS#8100 Change-Id: I33c19fee0bec31b4c6b3c8052976625f3213aac1 --- M src/crypto_utils.erl 1 file changed, 7 insertions(+), 9 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/47/43647/1
diff --git a/src/crypto_utils.erl b/src/crypto_utils.erl index 49f5a25..0097074 100644 --- a/src/crypto_utils.erl +++ b/src/crypto_utils.erl @@ -205,14 +205,12 @@ error end.
-get_root_cert(EumCertificate, []) -> +get_root_cert(_, EidValue, []) -> logger:error( - "Certificate verification failed, no root certificate found,~nEumCertificate=~p~n", [ - EumCertificate - ] + "unable to verify eUICC/EUM certificate, no suitable root certificate found,~nEidValue=~p~n", [EidValue] ), error; -get_root_cert(EumCertificate, RootCiCerts) -> +get_root_cert(EumCertificate, EidValue, RootCiCerts) -> [RootCiCert | RootCiCertsTail] = RootCiCerts, {ok, RootCiCertPath} = utils:get_priv_file_path(onomondo_eim, RootCiCert), {ok, RootCiCertPem} = file:read_file(RootCiCertPath), @@ -222,12 +220,12 @@ true -> {ok, RootCiCertPem}; _ -> - get_root_cert(EumCertificate, RootCiCertsTail) + get_root_cert(EumCertificate, EidValue, RootCiCertsTail) end.
-verify_euicc_cert(EumCertificate, EuiccCertificate) -> +verify_euicc_cert(EumCertificate, EuiccCertificate, EidValue) -> {ok, RootCiCerts} = application:get_env(onomondo_eim, root_ci_certs), - case get_root_cert(EumCertificate, RootCiCerts) of + case get_root_cert(EumCertificate, EidValue, RootCiCerts) of {ok, RootCiCertPem} -> [{'Certificate', RootCiCertBer, not_encrypted}] = public_key:pem_decode(RootCiCertPem), {ok, RootCiCert} = 'PKIX1Explicit88':decode('Certificate', RootCiCertBer), @@ -264,7 +262,7 @@ end.
store_euicc_pubkey(EumCertificate, EuiccCertificate, EidValue) -> - case verify_euicc_cert(EumCertificate, EuiccCertificate) of + case verify_euicc_cert(EumCertificate, EuiccCertificate, EidValue) of ok -> {{'ECPoint', SignPubKey}, {namedCurve, NamedCurve}} = pubkey_from_cert( EuiccCertificate