From eaa245385383420cd4a5aca2ffe9f06032ae69fe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=90=D0=BD=D1=82=D0=BE=D0=BD=20=D0=A2=D1=80=D0=BE=D1=88?= =?UTF-8?q?=D0=B8=D0=BD?= Date: Thu, 17 Sep 2026 00:23:56 +0300 Subject: [PATCH] http ota: spec-correct retry timer, TLV and APDU edges (v2.2.12) Audit against GP v2.2 Am.B 4.7 / TS 102 226 / GP Card Spec 11.11 found the retry waiting delay encoded as plain hex instead of the TP-SCTS semi-octet order required by TS 102 223 8.38 -> TS 23.040 9.1.2.3 (1 min must be 10, 20 s must be 02); the builder now encodes semi-octets, clamps 0-59 / 0-99 and pads the 2-byte counter. Odd-length hex is padded instead of producing fractional BER lengths; empty 83/84/89 sub-TLVs are omitted (lengths are 1-n per Tables 4-3/4-5/4-8..10) and an empty trigger becomes 81 00; a store payload above a short APDU is chained as P1.b8=0 STORE DATA blocks (P2 = block number). Connection presets fixed: device identities 82, alpha 05, command details 81, bearer 35/03; the A5 store tag and the 'B0,00=unlimited' counter hint are marked unverified (not in the pinned spec). Docs: UICC_SPECS.md 9.6.5 example annotated 2 s, findings 10-minute timer corrected to 1 minute; help updated. SW cache otaman-v177. --- docs/scp81-findings.md | 7 ++- frontend/help-ru.html | 6 +-- frontend/help.html | 6 +-- frontend/index.html | 90 +++++++++++++++++++++------------- frontend/sw.js | 2 +- frontend/tests/httpota.test.js | 55 ++++++++++++++++----- pyproject.toml | 2 +- pysim_otaman_server/server.py | 2 +- 8 files changed, 115 insertions(+), 55 deletions(-) diff --git a/docs/scp81-findings.md b/docs/scp81-findings.md index ad2382e..72c6fcf 100644 --- a/docs/scp81-findings.md +++ b/docs/scp81-findings.md @@ -51,7 +51,9 @@ continuation GET STATUS (P2=02 with the last AID as search criterion). - `80CA008500` (GET DATA HTTP administration parameters) **works** and returns the SD's stored OTA configuration: `8A 09 "localhost"`, `8B 14 `, `8C 01 "/"` (stored URI), `85 14 `, `86 07 00 01 25 03 00 10 00` - (retry counter 1, timer **10 minutes**), `02 40 01` (KVN/KID), APN-ish + (retry counter 1, timer **1 minute** — the `25 03` h:m:s fields are TP-SCTS + semi-octets, TS 23.040 §9.1.2.3: low nibble = most significant digit, so + `10` = `01` min), `02 40 01` (KVN/KID), APN-ish `C7 04 03 47 50 42`, destination `BE 05 21 5B D5 05 02` = 91.213.5.2. - `80F28002/80F24002/80F21002 ...4F0000` return `6985` through the reader when the ISD is not the current DF; the reference platform sends @@ -64,7 +66,8 @@ continuation GET STATUS (P2=02 with the last AID as search criterion). `0A` channel status. - A Location status event re-triggers the OTA session only while the last session is incomplete; after a clean session end the card waits for a push. -- The SD stores a 10-minute retry timer (`25 03 00 10 00`). +- The SD stores a 1-minute retry timer (`25 03 00 10 00`; timer fields are + TP-SCTS semi-octets per TS 102 223 §8.38 / TS 23.040 §9.1.2.3). ## Confirmed rules (with evidence) diff --git a/frontend/help-ru.html b/frontend/help-ru.html index 87d0fce..5f7817b 100644 --- a/frontend/help-ru.html +++ b/frontend/help-ru.html @@ -212,15 +212,15 @@

Сборка payload’ов Remote Application Management over HTTP по GlobalPlatform GPC v2.2 Amendment B v1.1 (§4.7). Два режима:

  • Триггер (Push SMS) — параметры запуска административной сессии (81 > 83 > 84/[85]/[86]/89, таблица 4-3). Сообщение, которое просит Security Domain карты исходящим запросом начать HTTP-сессию.
    • -
  • Store (параметры SD) — записывает те же параметры как данные карты (параметры Security Domain) командой STORE DATA в TLV-режиме (80 E2 90 00, P1=90 = последний блок + BER-TLV по GP v2.2 Amendment B v1.1.3), обёрнутые в тег 85 (или A5) по таблице 4-4.
    • +
  • Store (параметры SD) — записывает те же параметры как данные карты (параметры Security Domain) командой STORE DATA в TLV-режиме (80 E2 90 00, P1=90 = последний блок + без шифрования + BER-TLV по GP Card Spec v2.3.1 §11.11; данные длиннее короткого APDU разбиваются на цепочку блоков с P1.b8=0), обёрнутые в тег 85 по таблице 4-4 (A5 — непроверенный вариант).

Разделы соответствуют таблицам спецификации:

- + - +
РазделTagСодержимое
Параметры соединения84Любые COMPREHENSION-TLV для открытия TCP-соединения (OPEN CHANNEL по TS 102 223): Device Identities 02, Alpha 80, Bearer 01, вендорские TLV. Редактор строк + пресеты, редактируемый hex.
Параметры соединения84Любые COMPREHENSION-TLV для открытия TCP-соединения (OPEN CHANNEL по TS 102 223): Device Identities 82, Alpha 05, Command details 81, Bearer 35 (03 = bearer по умолчанию), вендорские TLV. Редактор строк + пресеты, редактируемый hex.
Параметры безопасности85Таблица 4-6: LV PSK Identity (текст), LV Key version/KID. Идентифицирует ключ PSK TLS (RFC 4279).
Политика повтора86Таблица 4-7: счётчик повторов (2 байта, напр. B000), задержка повторной попытки как timer TLV из TS 102 223 (25 03 HH MM SS), опциональный вендорский TLV отчёта о сбое.
Политика повтора86Таблица 4-7: счётчик повторов (2 байта, напр. 0003), задержка повторной попытки как timer TLV из TS 102 223 (25 03 HH MM SS) с полями в полуоктетном порядке TP-SCTS (TS 23.040 §9.1.2.3): 00 10 00 = 1 мин, 00 00 02 = 20 с; опциональный TLV отчёта о сбое.
HTTP POST89Таблицы 4-8/9/10: Host-заголовок (8A), X-Admin-From agent ID (8B), URI (8C) — текст преобразуется в октеты.
diff --git a/frontend/help.html b/frontend/help.html index a6967b6..03696e6 100644 --- a/frontend/help.html +++ b/frontend/help.html @@ -212,15 +212,15 @@

Builds the Remote Application Management over HTTP payloads defined in GlobalPlatform GPC v2.2 Amendment B v1.1 (§4.7). Two modes:

  • Trigger (Push SMS) — administration session triggering parameters (81 > 83 > 84/[85]/[86]/89, Table 4-3). This is the message that asks the card's Security Domain to dial out and start an HTTP session.
    • -
  • Store (SD admin params) — writes the same parameters as card (Security Domain) data via STORE DATA in TLV mode (80 E2 90 00, P1=90 = last block + BER-TLV per GP v2.2 Amendment B v1.1.3), wrapped in tag 85 (or A5) per Table 4-4.
    • +
  • Store (SD admin params) — writes the same parameters as card (Security Domain) data via STORE DATA in TLV mode (80 E2 90 00, P1=90 = last block + no encryption + BER-TLV per GP Card Spec v2.3.1 §11.11; data above a short APDU is chained as P1.b8=0 blocks), wrapped in tag 85 per Table 4-4 (A5 is offered as an unverified variant).

Sections mirror the spec tables:

- + - +
SectionTagContents
Connection parameters84Any COMPREHENSION-TLV needed to open the TCP connection (OPEN CHANNEL per TS 102 223): Device Identities 02, Alpha 80, Bearer 01, vendor TLVs. Row editor + presets, editable hex.
Connection parameters84Any COMPREHENSION-TLV needed to open the TCP connection (OPEN CHANNEL per TS 102 223): Device Identities 82, Alpha 05, Command details 81, Bearer 35 (03 = default bearer), vendor TLVs. Row editor + presets, editable hex.
Security parameters85Table 4-6: LV PSK Identity (text), LV Key version/KID. Identifies the PSK TLS key (RFC 4279).
Retry policy86Table 4-7: retry counter (2 bytes, e.g. B000), retry waiting delay as the TS 102 223 timer TLV (25 03 HH MM SS), optional vendor-specific report-failure TLV.
Retry policy86Table 4-7: retry counter (2 bytes, e.g. 0003), retry waiting delay as the TS 102 223 timer TLV (25 03 HH MM SS) with TP-SCTS semi-octet fields (TS 23.040 §9.1.2.3): 00 10 00 = 1 min, 00 00 02 = 20 s; optional report-failure TLV.
HTTP POST89Tables 4-8/9/10: Host header (8A), X-Admin-From agent ID (8B), URI (8C) — text converted to octets.
diff --git a/frontend/index.html b/frontend/index.html index 4ed14af..205af79 100644 --- a/frontend/index.html +++ b/frontend/index.html @@ -18,7 +18,7 @@
-

OTAMan SIM OTA with a Human Face v2.2.11

+

OTAMan SIM OTA with a Human Face v2.2.12

● @@ -174,7 +174,7 @@
@@ -188,7 +188,8 @@ - + +
@@ -219,13 +220,13 @@