dexter has submitted this change. ( https://gerrit.osmocom.org/c/onomondo-eim/+/43647?usp=email )

Change subject: crypto_utils: log EID and encoded EUM cert instead of decoded cert ......................................................................

crypto_utils: log EID and encoded EUM cert instead of decoded cert

When a profile download happens, the eIM automatically tries to check the EUM (and the eUICC certificate). This is done in order to cache the public key of the eUICC certificate. For the check, a the root certificate of the EUM certificate is required. If none is found, an error is logged with the decoded EUM certificate as context. This produces a lot of log lines and the decoded certificate contents are barely readable.

Let's instead log the EID of the eUICC and the EUM certificate in its encoded form (hexdump). This is much more compact and still gives eIM operators enough context to track down the problem.

Related: SYS#8100 Change-Id: I33c19fee0bec31b4c6b3c8052976625f3213aac1 --- M src/crypto_utils.erl 1 file changed, 9 insertions(+), 9 deletions(-)

Approvals: laforge: Looks good to me, but someone else must approve Jenkins Builder: Verified fixeria: Looks good to me, approved

diff --git a/src/crypto_utils.erl b/src/crypto_utils.erl index 49f5a25..d07b931 100644 --- a/src/crypto_utils.erl +++ b/src/crypto_utils.erl @@ -205,14 +205,14 @@ error end.

-get_root_cert(EumCertificate, []) -> +get_root_cert(EumCertificate, EidValue, []) -> + {ok, EumCertificateEncoded} = 'PKIX1Explicit88':encode('Certificate', EumCertificate), logger:error( - "Certificate verification failed, no root certificate found,~nEumCertificate=~p~n", [ - EumCertificate - ] + "unable to verify eUICC/EUM certificate, no root certificate for EUM certificate found,~nEidValue=~p,~nEumCertificate=~p~n", + [EidValue, utils:binary_to_hex(EumCertificateEncoded)] ), error; -get_root_cert(EumCertificate, RootCiCerts) -> +get_root_cert(EumCertificate, EidValue, RootCiCerts) -> [RootCiCert | RootCiCertsTail] = RootCiCerts, {ok, RootCiCertPath} = utils:get_priv_file_path(onomondo_eim, RootCiCert), {ok, RootCiCertPem} = file:read_file(RootCiCertPath), @@ -222,12 +222,12 @@ true -> {ok, RootCiCertPem}; _ -> - get_root_cert(EumCertificate, RootCiCertsTail) + get_root_cert(EumCertificate, EidValue, RootCiCertsTail) end.

-verify_euicc_cert(EumCertificate, EuiccCertificate) -> +verify_euicc_cert(EumCertificate, EuiccCertificate, EidValue) -> {ok, RootCiCerts} = application:get_env(onomondo_eim, root_ci_certs), - case get_root_cert(EumCertificate, RootCiCerts) of + case get_root_cert(EumCertificate, EidValue, RootCiCerts) of {ok, RootCiCertPem} -> [{'Certificate', RootCiCertBer, not_encrypted}] = public_key:pem_decode(RootCiCertPem), {ok, RootCiCert} = 'PKIX1Explicit88':decode('Certificate', RootCiCertBer), @@ -264,7 +264,7 @@ end.

store_euicc_pubkey(EumCertificate, EuiccCertificate, EidValue) -> - case verify_euicc_cert(EumCertificate, EuiccCertificate) of + case verify_euicc_cert(EumCertificate, EuiccCertificate, EidValue) of ok -> {{'ECPoint', SignPubKey}, {namedCurve, NamedCurve}} = pubkey_from_cert( EuiccCertificate