neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/pysim/+/40203?usp=email ) Change subject: personalization: fix SdKey.apply_val() implementation ...................................................................... personalization: fix SdKey.apply_val() implementation 'securityDomain' elements are decoded to ProfileElementSD instances, which keep higher level representations of the key data apart from the decoded[] lists. So far, apply_val() was dropping binary values in decoded[], which does not work, because ProfileElementSD._pre_encode() overwrites self.decoded[] from the higher level representation. Implement using - ProfileElementSD.find_key() and SecurityDomainKeyComponent to modify an exsiting entry, or - ProfileElementSD.add_key() to create a new entry. Before this patch, SdKey parameters seemed to patch PES successfully, but their modifications did not end up in the encoded DER. (BTW, this does not fix any other errors that may still be present in the various SdKey subclasses, patches coming up.) Related: SYS#6768 Change-Id: I07dfc378705eba1318e9e8652796cbde106c6a52 --- M pySim/esim/saip/__init__.py M pySim/esim/saip/personalization.py 2 files changed, 41 insertions(+), 27 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/03/40203/1 diff --git a/pySim/esim/saip/__init__.py b/pySim/esim/saip/__init__.py index 21f44ef..0b3d302 100644 --- a/pySim/esim/saip/__init__.py +++ b/pySim/esim/saip/__init__.py @@ -991,6 +991,13 @@ 'keyVersionNumber': bytes([self.key_version_number]), 'keyComponents': [k.to_saip_dict() for k in self.key_components]} + def get_key_component(self, key_type): + for kc in self.key_components: + if kc.key_type == key_type: + return kc.key_data + return None + + class ProfileElementSD(ProfileElement): """Class representing a securityDomain ProfileElement.""" type = 'securityDomain' diff --git a/pySim/esim/saip/personalization.py b/pySim/esim/saip/personalization.py index e3ded68..0eb0671 100644 --- a/pySim/esim/saip/personalization.py +++ b/pySim/esim/saip/personalization.py @@ -24,8 +24,10 @@ from osmocom.tlv import camel_to_snake from osmocom.utils import hexstr from pySim.utils import enc_iccid, dec_iccid, enc_imsi, dec_imsi, h2b, b2h, rpad, sanitize_iccid, all_subclasses_of -from pySim.esim.saip import ProfileElement, ProfileElementSequence from pySim.esim.saip import param_source +from pySim.esim.saip import ProfileElement, ProfileElementSD, ProfileElementSequence +from pySim.esim.saip import SecurityDomainKey, SecurityDomainKeyComponent +from pySim.global_platform import KeyUsageQualifier, KeyType def unrpad(s: hexstr, c='f') -> hexstr: return hexstr(s.rstrip(c)) @@ -498,36 +500,41 @@ default_source = param_source.RandomHexDigitSource @classmethod - def _apply_sd(cls, pe: ProfileElement, value): - assert pe.type == 'securityDomain' - for key in pe.decoded['keyList']: - if key['keyIdentifier'][0] == cls.key_id and key['keyVersionNumber'][0] == cls.kvn: - assert len(key['keyComponents']) == 1 - key['keyComponents'][0]['keyData'] = value - return - # Could not find matching key to patch, create a new one - key = { - 'keyUsageQualifier': bytes([cls.key_usage_qual]), - 'keyIdentifier': bytes([cls.key_id]), - 'keyVersionNumber': bytes([cls.kvn]), - 'keyComponents': [ - { 'keyType': bytes([cls.key_type]), 'keyData': value }, - ] - } - pe.decoded['keyList'].append(key) + def apply_val(cls, pes: ProfileElementSequence, val): + set_components = [ SecurityDomainKeyComponent(cls.key_type, val) ] - @classmethod - def apply_val(cls, pes: ProfileElementSequence, value): - for pe in pes.get_pes_for_type('securityDomain'): - cls._apply_sd(pe, value) + for pe in pes.pe_list: + if pe.type != 'securityDomain': + continue + assert isinstance(pe, ProfileElementSD) + + key = pe.find_key(key_version_number=cls.kvn, key_id=cls.key_id) + if not key: + # Could not find matching key to patch, create a new one + key = SecurityDomainKey( + key_version_number=cls.kvn, + key_id=cls.key_id, + key_usage_qualifier=KeyUsageQualifier.build(cls.key_usage_qual), + key_components=set_components, + ) + pe.add_key(key) + else: + print(f'{key.key_usage_qualifier=!r}') + key.key_components = set_components @classmethod def get_values_from_pes(cls, pes: ProfileElementSequence): - for pe in pes.get_pes_for_type('securityDomain'): - for key in pe.decoded['keyList']: - if key['keyIdentifier'][0] == cls.key_id and key['keyVersionNumber'][0] == cls.kvn: - if len(key['keyComponents']) >= 1: - yield { cls.name: b2h(key['keyComponents'][0]['keyData']) } + for pe in pes.pe_list: + if pe.type != 'securityDomain': + continue + assert isinstance(pe, ProfileElementSD) + + key = pe.find_key(key_version_number=cls.kvn, key_id=cls.key_id) + if not key: + continue + kc = key.get_key_component(cls.key_type) + if kc: + yield { cls.name: b2h(kc) } class SdKeyScp80_01(SdKey): kvn = 0x01 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/40203?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I07dfc378705eba1318e9e8652796cbde106c6a52 Gerrit-Change-Number: 40203 Gerrit-PatchSet: 1 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>