add SUCI parameters

Change-Id: I3c0793b8a67bbd0c8247784bd3b5cbd265f94ec2

contrib/jenkins.sh

@@ -10,11 +10,6 @@
 
 export PYTHONUNBUFFERED=1
 
-setup_venv() {
-	virtualenv -p python3 venv --system-site-packages
-	. venv/bin/activate
-}
-
 if [ ! -d "./tests/" ] ; then
 	echo "###############################################"
 	echo "Please call from pySim-prog top directory"
@@ -28,7 +23,8 @@ fi
 
 case "$JOB_TYPE" in
 "test")
-	setup_venv
+	virtualenv -p python3 venv --system-site-packages
+	. venv/bin/activate
 
 	pip install -r requirements.txt
 	pip install pyshark
@@ -36,27 +32,23 @@ case "$JOB_TYPE" in
 	# Execute automatically discovered unit tests first
 	python -m unittest discover -v -s tests/unittests
 
-	# Run pySim-trace test
-	tests/pySim-trace_test/pySim-trace_test.sh
-	;;
-"card-test") # tests requiring physical cards
-	setup_venv
-
-	pip install -r requirements.txt
-
-	# Run pySim-prog integration tests
+	# Run pySim-prog integration tests (requires physical cards)
 	cd tests/pySim-prog_test/
-	./pySim-prog_test.sh
+        ./pySim-prog_test.sh
 	cd ../../
 
-	# Run pySim-shell integration tests
+	# Run pySim-trace test
+	tests/pySim-trace_test/pySim-trace_test.sh
+
+	# Run pySim-shell integration tests (requires physical cards)
 	python3 -m unittest discover -v -s ./tests/pySim-shell_test/
 
 	# Run pySim-smpp2sim test
 	tests/pySim-smpp2sim_test/pySim-smpp2sim_test.sh
 	;;
 "distcheck")
-	setup_venv
+	virtualenv -p python3 venv --system-site-packages
+	. venv/bin/activate
 
 	pip install .
 	pip install pyshark
@@ -69,7 +61,8 @@ case "$JOB_TYPE" in
 	# Print pylint version
 	pip3 freeze | grep pylint
 
-	setup_venv
+	virtualenv -p python3 venv --system-site-packages
+	. venv/bin/activate
 
 	pip install .
 
@@ -87,7 +80,8 @@ case "$JOB_TYPE" in
 		contrib/*.py
 	;;
 "docs")
-	setup_venv
+	virtualenv -p python3 venv --system-site-packages
+	. venv/bin/activate
 
 	pip install -r requirements.txt
 

contrib/rcp/rcp_client.py

@@ -1,243 +0,0 @@
-#!/usr/bin/env python3
-
-# (C) 2026 by sysmocom - s.f.m.c. GmbH
-# All Rights Reserved
-#
-# Author: Philipp Maier
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import sys
-import os
-import websockets
-import asyncio
-import argparse
-import logging
-from copy import deepcopy
-from pathlib import Path
-from pySim.log import PySimLogger
-from rcp_utils import CltConnHdlr, backtrace, pytype_to_type, load_ca_cert, load_json_schema, JsonValidator
-from pySim.transport import init_reader, argparse_add_reader_args, LinkBase
-from packaging.version import Version
-
-SERVER_TIMEOUT = 10
-
-# The RCP Client software version shall be incremented when there are changes to the RCP Client (this module) or changes
-# to other related modules, which affect the RCP Client. The RCP Client software version is also disclosed towards the
-# RCP Server.
-RCPC_VERSION_SOFTWARE = "1.0.0"
-
-# The RCP Client protocol version refers to the protocol spoken between RCP Client and RCP Server. The protocol version
-# shall be incremented when there are changes to the protocol (JSON Schema and/or application logic, see also
-# RCPC_VERSION_PROTOCOL in rcp_server.py).
-RCPC_VERSION_PROTOCOL = "1.0.0"
-
-log = PySimLogger.get(Path(__file__).stem)
-option_parser = argparse.ArgumentParser(description='RCP Client',
-                                        formatter_class=argparse.ArgumentDefaultsHelpFormatter)
-argparse_add_reader_args(option_parser)
-option_parser.add_argument("--verbose", help="Enable verbose logging",
-                           action='store_true', default=False)
-option_parser.add_argument("--uri", help="URI of the RCP-Server")
-option_parser.add_argument("--ca-cert", help="SSL/TLS CA-Certificate of the RCP-Server")
-
-class RcpcCltConnHdlr(CltConnHdlr):
-    def __init__(self, sl, *args, **kwargs):
-        self.sl = sl
-        super().__init__(*args, **kwargs)
-
-    async def check_version(self):
-        """
-        Send the Protocol and Software version of this RCP Client to the RCP Server. The RCP Server will then check
-        if this client is (still) compatible. If an incompatibility is detected, the connection will be closed.
-        """
-        log.info("Checking version ...")
-        tx_json = {'rcpc_version': {'software' : RCPC_VERSION_SOFTWARE,
-                                    'protocol' : RCPC_VERSION_PROTOCOL}}
-        log.info("RCP Client version: software=%s, protocol=%s",
-                RCPC_VERSION_SOFTWARE, RCPC_VERSION_PROTOCOL)
-        rx_json = await self._transact(tx_json)
-        rcps_version_software = Version(rx_json['rcpc_version']['software'])
-        rcps_version_protocol = Version(rx_json['rcpc_version']['protocol'])
-        rcps_version_info = str(rx_json['rcpc_version'].get('info'))
-        if rcps_version_info:
-            log.info("RCP Server version: software=%s, protocol=%s",
-                     rcps_version_software, rcps_version_protocol)
-        else:
-            log.info("RCP Server version: software=%s, protocol=%s, %s",
-                     rcps_version_software, rcps_version_protocol, rcps_version_info)
-
-    async def describe(self, suitable_for:dict) -> list:
-        log.info("Requesting module descriptions from RCP Server ...")
-        tx_json = {'rcpc_hello': {'suitable_for' : suitable_for}}
-        rx_json = await self._transact(tx_json)
-        module_descr = rx_json['rcpc_welcome']['module_descr']
-        if not module_descr:
-            raise ValueError("No RCP module available for this card")
-        return module_descr
-
-    async def run(self, cmd:str, cmd_argv) -> int:
-        log.info("Executing command with RCP Server ...")
-        tx_json = {'rcpc_command': {'cmd' : cmd, 'cmd_argv' : cmd_argv}}
-        while(True):
-            rx_json = await self._transact(tx_json)
-            tx_json = None
-            if 'rcpc_instr' in rx_json:
-                rcpc_instr = rx_json['rcpc_instr']
-                if 'c_apdu' in rcpc_instr:
-                    c_apdu = rx_json['rcpc_instr']['c_apdu']
-                    data, sw = sl.send_apdu(c_apdu)
-                    tx_json = {'rcpc_result': {'r_apdu' : {'data': data.upper(), 'sw': sw.upper()}}}
-                elif 'reset' in rcpc_instr:
-                    sl.reset_card()
-                    atr = sl.get_atr()
-                    tx_json = {'rcpc_result': {'atr' : atr.upper()}}
-                elif 'print' in rcpc_instr:
-                    log.info(str(self) + " -- %s", rx_json['rcpc_instr']['print'])
-                    tx_json = {'rcpc_result': {'empty' : None}}
-            elif 'rcpc_goodbye' in rx_json:
-                rc = rx_json['rcpc_goodbye']
-                log.info("Command execution done, rc: %d", rc)
-                return rc
-
-def check_if_user_needs_basic_help(argv):
-    """
-    The '--uri' argument is the minimum requirement to connect to the RCP Server to retrieve the information about the
-    dynamic commandline arguments. In case this argument is missing while '--help' or '-h' arguments are present. Then
-    we will fall back to display only a basic help that contains only the static commandline arguments (see above).
-    """
-
-    if '--help' in argv or '-h' in argv:
-        if '--uri' not in argv:
-            option_parser.parse_args()
-            sys.exit(1)
-
-def parse_known_arguemnts(argv):
-    """
-    Parse the commandline arguments we know so far. Ignore unknown arguments and filter out '--help' and '-h'
-    arguments, in case those are present.
-    """
-
-    argv_filtered = deepcopy(argv)
-    if '--help' in argv_filtered:
-        argv_filtered.remove('--help')
-    if '-h' in argv_filtered:
-        argv_filtered.remove('-h')
-    opts, unknown = option_parser.parse_known_args(argv_filtered)
-    return opts
-
-async def run_rcp_session(opts, sl, ssl_context) -> int:
-    """
-    Connect to the RCP Server, retrieve the module description, use the module description to complete the commandline
-    argument parser, execute the command that the user has selected.
-    """
-
-    # Request ATR from card
-    card_atr = sl.get_atr().upper()
-    log.info("Detected Card with ATR: %s" % card_atr)
-
-    # Connect to RCP server
-    log.info("RCP Server URI: %s" % opts.uri)
-    async with websockets.connect(opts.uri, ssl=ssl_context) as websocket:
-        rcpc_to_rcps_schema = load_json_schema(os.path.join(Path(__file__).parent.resolve(), "rcpc_to_rcps_schema.json"))
-        rcps_to_rcpc_schema = load_json_schema(os.path.join(Path(__file__).parent.resolve(), "rcps_to_rcpc_schema.json"))
-        json_validator = JsonValidator(rcps_to_rcpc_schema, rcpc_to_rcps_schema)
-        client = RcpcCltConnHdlr(sl, websocket, SERVER_TIMEOUT, json_validator)
-
-        # Check software and protocol version
-        await client.check_version()
-
-        # Retrieve module description
-        module_descrs = await client.describe({"atr" : card_atr})
-
-        # Complete the commandline parser and set up a dict that we can use as filter
-        # TODO: Maybe it makes sense to integrate this as a method into the RcpcCltConnHdlr class?
-        option_subparsers = option_parser.add_subparsers(dest='command', help="RCP command to use", required=True)
-        sys_argv_filter = {}
-        for module_descr in module_descrs:
-            cmd_descr = module_descr['cmd_descr']
-            for cmd in cmd_descr:
-                command_name = module_descr['name'] + "_" + cmd['name']
-                option_parser_cmd = option_subparsers.add_parser(command_name, help=cmd['help'])
-                sys_argv_filter[command_name] = []
-                for arg in cmd['args']:
-                    arg['spec'] = pytype_to_type(arg['spec'])
-                    option_parser_cmd.add_argument(arg['name'], **arg['spec'])
-                    sys_argv_filter[command_name].append(arg['name'])
-
-        # Re-Parse commandline options with the completed commandline parser. In case commandline help is
-        # requested. The program is able to display the full help screen and exists.
-        opts = option_parser.parse_args()
-
-        # Filter the relevant command arguments from sys.argv
-        cmd_argv = []
-        next_is_value=False
-        for arg in sys.argv:
-            if arg in sys_argv_filter[opts.command]:
-                cmd_argv.append(arg)
-                next_is_value=True
-            elif next_is_value is True:
-                next_is_value=False
-                cmd_argv.append(arg)
-
-        # Run the command and close the connection
-        rc = await client.run(opts.command, cmd_argv)
-        await client.close()
-        return rc
-
-if __name__ == '__main__':
-
-    # Setup logging
-    PySimLogger.setup(print, {logging.WARN: "\033[33m", logging.DEBUG: "\033[90m"}, '--verbose' in sys.argv)
-
-    # Since parts of the commandline arguments are retrieved dynamically, we have to resolve a chicken-egg-problem.
-    # We cannot call option_parser.parse_args() at the beginning, since we haven't received all information to
-    # complete the option_parser yet. However in order to retrieve the arguments correctly we need to get the
-    # URI and the parameters for the smartcard reader before we make the connection. The situation is even further
-    # complicated in case the user requests commandline help.
-
-    # To resolve the problem we first check if the user needs basic help (no '--uri' parameter present). If this is the
-    # case, the program will exit with a basic help screen.
-    check_if_user_needs_basic_help(sys.argv)
-
-    # In all other cases we parse the arguments we know so far. In case the user requests commandline help, we will
-    # ignore this request and continue. The full help is then displayed later when the option_parser is completed
-    # afer we have requested the commandline argument descriptions from the RCP Server. (see below)
-    opts = parse_known_arguemnts(sys.argv)
-
-    # Load SSL/TLS CA certificate from file
-    if opts.ca_cert:
-        ssl_context = load_ca_cert("RCP Server CA", opts.ca_cert)
-    else:
-        ssl_context = None
-
-    # Initialize card reader
-    try:
-        sl = init_reader(opts)
-        sl.connect()
-    except Exception as e:
-        backtrace("Card reader initialization")
-        sys.exit(1)
-
-    # Run the RCP session
-    try:
-        rc = asyncio.run(run_rcp_session(opts, sl, ssl_context))
-        sys.exit(rc)
-    except SystemExit as rc:
-        sys.exit(rc)
-    except:
-        backtrace("RCP session")
-        sys.exit(1)
-
-

contrib/rcp/rcp_module_utils.py

@@ -1,424 +0,0 @@
-#!/usr/bin/env python3
-
-# (C) 2026 by sysmocom - s.f.m.c. GmbH
-# All Rights Reserved
-#
-# Author: Philipp Maier
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-
-import abc
-import os
-import argparse
-import logging
-import threading
-import asyncio
-import websockets
-from argparse import Namespace
-from copy import deepcopy
-from pathlib import Path
-from typing import Optional
-from osmocom.utils import Hexstr, is_hexstr
-from pySim.utils import ResTuple
-from pySim.transport import LinkBase
-from pySim.commands import SimCardCommands
-from pySim.log import PySimLogger
-from rcp_utils import SrvSyncConnHdlr, CltConnHdlr, backtrace, pytype_to_type, load_server_cert, load_ca_cert
-from rcp_utils import dict_from_key_value_pairs, load_json_schema, JsonValidator
-from rcp_server import RCPM_VERSION_PROTOCOL
-from websockets.sync.server import serve, ServerConnection
-from pySim.app import init_card
-from pySim.runtime import RuntimeState
-from pySim.cards import CardBase
-from pySim.card_key_provider import CardKeyFieldCryptor
-from packaging.version import Version
-
-# Response timeout towards the RCP Server (includes RCP Client latency)
-RCP_SERVER_TIMEOUT = 30 # sec.
-
-log = PySimLogger.get(Path(__file__).stem)
-
-class RcpsSimLink(LinkBase):
-    """
-    pySim: Transport Link for RCPM (Remote Card Procedure Module)
-    This is a 'headless' transport link implementation that can only be used from an RCPM module. It merely serves as
-    an adapter between the pySim transport API and the RCPM command server connection handler.
-    """
-
-    name = 'RCPM'
-
-    def __init__(self, conn_hdlr: SrvSyncConnHdlr, **kwargs):
-        self.conn_hdlr = conn_hdlr
-        self._atr = None
-        super().__init__(**kwargs)
-
-    def __str__(self) -> str:
-        return "rcpm:" + str(self.conn_hdlr)
-
-    def _send_apdu(self, apdu: Hexstr) -> ResTuple:
-        tx_json = {'rcps_instr': {'c_apdu' : apdu.upper()}}
-        rx_json = self.conn_hdlr._transact(tx_json)
-        data = rx_json['rcps_result']['r_apdu']['data']
-        sw = rx_json['rcps_result']['r_apdu']['sw']
-        return data, sw
-
-    def wait_for_card(self, timeout: Optional[int] = None, newcardonly: bool = False):
-        # In this setting, we do not have/cannot to wait for a card since we are not the entity that handles the
-        # direct connection to the card. When the procedure begins, we assume that the remote end already has set up
-        # a connection to the card and made it ready to perform operations on it.
-        pass
-
-    def connect(self):
-        # In this setting, we do not have/cannot to connect because we are not the entity that handles the direct
-        # connection to the card. The connection is established by the remote end.
-        pass
-
-    def get_atr(self) -> Hexstr:
-        return self._atr
-
-    def disconnect(self):
-        # In this setting, we do not have/cannot disconnect because we are not the entity that handles the direct
-        # connection to the card. The disconnect is eventually done by the remote end when the procedure has finished.
-        pass
-
-    def _reset_card(self):
-        tx_json = {'rcps_instr': {'reset' : None}}
-        rx_json = self.conn_hdlr._transact(tx_json)
-        self._atr = rx_json['rcps_result']['atr']
-        return 1
-
-class RcpsCltConnHdlr(CltConnHdlr):
-    """
-    The RCP Server client handler is used to connect to the RCP Server when RCP Module is started. The connection is
-    kept alive until the RCP Module is terminated. This connection is used to exchange management data with the RCP
-    Server.
-    """
-
-    def __init__(self, cmd_srv_addr: str, cmd_srv_port: int, module, *args, **kwargs):
-        self.cmd_srv_addr = cmd_srv_addr
-        self.cmd_srv_port = cmd_srv_port
-        self.module = module
-        super().__init__(*args, **kwargs)
-
-    async def check_version(self):
-        """
-        Send the Protocol and Software version of this RCP Module to the RCP Server. The RCP Server and the RCP Module
-        must always use the same protrocol version.
-        """
-        tx_json = {'rcpm_version': {'protocol' : RCPM_VERSION_PROTOCOL}}
-        rx_json = await self._transact(tx_json)
-        rcpm_version_protocol = Version(rx_json['rcpm_version']['protocol'])
-        if Version(RCPM_VERSION_PROTOCOL) != rcpm_version_protocol:
-            raise ValueError("Incompatible protocol version %s != %s", Version(RCPM_VERSION_PROTOCOL), rcpm_version_protocol)
-
-    async def describe(self):
-        """
-        Send a detailed description about this RCP Module to the RCP Server. This is also the initial message that
-        the RCP Server expects when an RCP Module connects.
-        """
-
-        # The rules (dict) in suitable_for (array of dict) may contain hexstrings. Here we go through those rules
-        # and convert those hexstrings to uppercase, since this is the standard we have set for the JSON messages.
-        suitable_for = []
-        for rule in self.module.suitable_for:
-            rule_filtered = {}
-            for k in rule:
-                if is_hexstr(rule[k]):
-                    rule_filtered[k] = rule[k].upper()
-                else:
-                    rule_filtered[k] = rule[k]
-            suitable_for.append(rule_filtered)
-
-        # Publish RCP Module description on the RCP server
-        tx_json = {'rcpm_hello':
-                   {'name' : self.module.name,
-                    'cmd_descr' : self.module.cmd_descr,
-                    'suitable_for' : suitable_for,
-                    'addr' : self.cmd_srv_addr,
-                    'port' : self.cmd_srv_port
-                    }
-                   }
-        rx_json = await self._transact(tx_json)
-        if 'rcpm_welcome' not in rx_json:
-            raise ValueError("description not accepted by RCP Server")
-
-class RcpModule(abc.ABC):
-    """
-    Base class to implement to derive a concrete RCP module class
-    """
-
-    # Module name used to identify the module in logs and user output. This module name should be short and concise.
-    name = "RCPM"
-
-    # Command description of this module. The command description consists of a short and concise command name, a
-    # helpstring and an argument specification in the form of a python dict. This specification, consisting of
-    # 'name', 'help', and 'args' is is directly passed to agparse on the client side.
-    #
-    # In addition to that, the API user may specify which keys the RCP Server shall retrieve before a command is
-    # executed. This is done via the 'get_keys' field. This field is optional and has the form of a dict with
-    # two optional fields 'uicc' and 'euicc'. The value part of both fields is a list of strings which name the
-    # columns that are passed to the CardKeyProvider for lookup. When the 'uicc' field is set, then the RCP Server
-    # will automatically request the ICCID from the card and do the lookup. When the 'euicc' field is set, the RCP
-    # Server will do the same with the EID. It is possible to mix both fields to request keys for the eUICC and the
-    # currently activated eSIM profile at the same time. However, this may be a very rare corner case.
-    #
-    # Example:
-    # cmd_descr = [{'name' : 'reset',
-    #               'help': 'reset the card',
-    #               'args' : []},
-    #              {'name' : 'read_binary',
-    #               'help': 'read binary data from a transparent file.',
-    #               'args' : [{ 'name' : '--fid',
-    #                            'spec' : {'required' : True,
-    #                                      'help' : 'File identifier to of the file to read',
-    #                                      'action' : 'append',
-    #                                      'pytype' : 'str'},
-    #                         }
-    #                        ]},
-    #              {'name' : 'unlock_aram',
-    #               'help': 'unlock a locked ARA-M applet on a sysmoISIM-SJA5',
-    #               'args' : [],
-    #               'get_keys' : {'uicc' : ['KIC', 'KID', 'KIK']}}
-    #              ]
-    cmd_descr = []
-
-    # Card properties to determine if this module is suitable for a specific card type or card types. The RCP Server
-    # will match those properties against user requests to determine which module provides useful services to the
-    # user's card.
-    #
-    # Example: [{"atr" : "3b9f96803f87828031e073fe211f574543753130136502"}]
-    suitable_for = []
-
-    # In addition the above, the derived class must implement command methods for each command that is defined in the
-    # command description (see above). Each command method must begin with the prefix "cmd_" followed by the command
-    # name used in the command description. A command method must have the form as shown in the example shown below.
-    # Each method should return an integer value which will become the final return code of the RCP client program.
-    #
-    # Args:
-    #     hdlr:     RcpModuleHdlr object, this object is provided by the RcpmCmdSrvConnHdlr object, which calls
-    #               the command method of the module. Through the RcpModuleHdlr object, the API user gets access
-    #               to special service methods (e.g. print) and other required properties (e.g. the SimCardCommands
-    #               objects, key material and others (see RcpModuleHdlr).
-    #
-    # Example:
-    # def cmd_reset(self, hdlr: RcpModuleHdlr) -> int: ...
-    # def cmd_read_binary(self, hdlr: RcpModuleHdlr) -> int: ...
-    # def cmd_unlock_aram(self, hdlr: RcpModuleHdlr) -> int: ...
-
-    # When the RCP Module class is passed to rcpm_run_module(), rcpm_run_module() also accepts *args and **kwargs
-    # parameter. Those parameters are passed to the constructor of RCP Module class when it is instaniated by
-    # rcpm_run_module(). API may override this constructor (below) with a custom implementation, if required.
-    def __init__(self, *args, **kwargs):
-        pass
-
-class RcpmCmdSrvConnHdlr(SrvSyncConnHdlr):
-    """
-    The RCP Module command server connection handler is used to handle dedicated connections from the RCP Server. Those
-    dedicated connections are technically transparent connections between the RCP Client and the RCP Module (this). The
-    RCP Server merely acts as a proxy at that point.
-    """
-
-    def __init__(self, module: RcpModule, field_cryptor: CardKeyFieldCryptor, *args, **kwargs):
-        SrvSyncConnHdlr.__init__(self, *args, *kwargs)
-        self.module = module
-        self.crypt = field_cryptor
-
-    def _parse_cmd_argv(self, cmd_suffix: str, cmd_argv: list[str]) -> Namespace:
-        """ Parse (and validate) the received argument vector """
-        # Use the cmd_descr of the module to create a (temporary) argument parser for the received argument vector.
-        cmd_parser = argparse.ArgumentParser()
-        for cmd in self.module.cmd_descr:
-            if cmd['name'] == cmd_suffix:
-                args = deepcopy(cmd['args'])
-                for arg in args:
-                    arg['spec'] = pytype_to_type(arg['spec'])
-                    cmd_parser.add_argument(arg['name'], **arg['spec'])
-
-        # Parse the arguments and return the parsed Namespace object.
-        try:
-            return cmd_parser.parse_args(cmd_argv)
-        except SystemExit:
-            raise ValueError("unable to parse arguments: %s", str(cmd_argv), )
-
-    def print(self, message: str):
-        """ Print a message on the client side """
-        log.info(str(self) + " -- %s" % message)
-        tx_json = {'rcps_instr': {'print' : message}}
-        rx_json = self._transact(tx_json)
-        if rx_json != {'rcps_result': {'empty' : None}}:
-            raise ValueError("unexpected response from RCP Client: %s", rx_json)
-
-    def procedure(self):
-        """ Receive and process a command from the RCP Client (via RCP Server) """
-
-        # Receive the command request.
-        rx_json = self._recv()
-        cmd = rx_json['rcps_command']['cmd']
-        cmd_argv = rx_json['rcps_command']['cmd_argv']
-        keys = rx_json['rcps_command'].get('keys')
-        log.info(str(self) + " -- executing command: %s %s", cmd, str(cmd_argv))
-
-        try:
-            # Make sure the command actually addresses this module.
-            cmd_prefix = self.module.name + "_"
-            if not cmd.startswith(cmd_prefix):
-                raise ValueError("invalid command: %s" % cmd)
-
-            # Make sure the module actually provides a command method for the requested command.
-            cmd_suffix = cmd[len(cmd_prefix):]
-            cmd_method = "cmd_" + cmd_suffix
-            if not hasattr(self.module, cmd_method):
-                raise ValueError("missing command method: %s" % cmd_method)
-
-            # Parse and validate command arguments.
-            cmd_args = self._parse_cmd_argv(cmd_suffix, cmd_argv)
-
-            # Setup a pySim RuntimeState, CardBase and a RuntimeLchan.
-            rs, card = init_card(RcpsSimLink(self))
-
-            # Hand over control to the command method provided by the specific module implementation.
-            rcp_module_hdlr = RcpModuleHdlr(self.print, rs, card, cmd_args, keys, self.crypt)
-            rs.reset()
-            try:
-                rc = getattr(self.module, cmd_method)(rcp_module_hdlr)
-            except Exception as e:
-                backtrace("command method")
-                rc = 1 # general error
-
-        except Exception as e:
-            backtrace("command parsing")
-            rc = 126 # cannot execute
-
-        # The prodedure is done, send "goodbye" message.
-        log.info(str(self) + " -- command execution done, rc: %d" % rc)
-        tx_json = {'rcps_goodbye': rc}
-        self._send(tx_json)
-
-class RcpModuleHdlr():
-    """
-    RCP Module handler class. This class is used by the RcpmCmdSrvConnHdlr to create the handler RcpModuleHdlr object
-    (hdlr), which is is passed to the command method. The RcpModuleHdlr gives the API user access to resources he can
-    use carry out the command.
-    """
-
-    # The RuntimeState (rs), the CardBase (card) and the RuntimeLchan (lchan) are the three major objects through which
-    # an API user may interact with the UICC/eUICC on the other remote end. Those objects have the same objectives as
-    # in pySim-shell.py, with lchan representing the currently selected lchan (set to self.rs.lchan[0] by default, API
-    # users may change the reference to a different lchan)
-    rs = None
-    card = None
-    lchan = None
-
-    # The cmd_args property contains the parsed command arguments which were passed by the end-user to the RCP Client.
-    # The arguments are already parsed and validated against the cmd_dscr property of the RcpModule. The arguments are
-    # in the form of a Namespace object and can be accessed like any argparse output. However, since the arguments
-    # contain user input, some caution is required.
-    cmd_args = None
-
-    # In case the retrieve_uicc_keys property of the RcpModule is used retrieve UICC key material, this property will
-    # contain the key material in the form of a dictionary. The format is similar to the return value of
-    # card_key_provider_get() (see also pySim.card_key_provider).
-    keys_uicc = {}
-
-    # Same as self.keys_uicc, but contains eUICC related key material in case requested using retrieve_uicc_keys.
-    keys_euicc = {}
-
-    def __init__(self, print: callable, rs: RuntimeState, card: CardBase, cmd_args: Namespace,
-                 keys: dict, field_cryptor: CardKeyFieldCryptor):
-        self.print = print
-        self.rs = rs
-        self.card = card
-        self.lchan = self.rs.lchan[0]
-        self.cmd_args = cmd_args
-        if keys:
-            if 'uicc' in keys:
-                self.keys_uicc = dict_from_key_value_pairs(keys['uicc'], keylabel='key', valuelabel='value')
-                for key in self.keys_uicc.keys():
-                    self.keys_uicc[key] = field_cryptor.decrypt_field(key, self.keys_uicc.get(key))
-            if 'euicc' in keys:
-                self.keys_euicc = dict_from_key_value_pairs(keys['euicc'], keylabel='key', valuelabel='value')
-                for key in self.keys_euicc.keys():
-                    self.keys_euicc[key] = field_cryptor.decrypt_field(key, self.keys_euicc.get(key))
-
-def rcpm_setup_argparse(description: str):
-    """Create argument parser and add the basic arguments all RCP Modules should have"""
-
-    option_parser = argparse.ArgumentParser(description='RCP Module: ' + description,
-                                            formatter_class=argparse.ArgumentDefaultsHelpFormatter)
-    option_parser.add_argument("--verbose", help="Enable verbose logging", action='store_true', default=False)
-    option_parser.add_argument("--uri", help="URI of the RCP-Server", required=True)
-    option_parser.add_argument("--rcps-ca-cert", help="SSL/TLS CA-Certificate of the RCP-Server", required=True)
-    option_parser.add_argument("--rcpm-cmd-server-addr", help="Local Host/IP to bind RCP-Module-Command-Server to",
-                               required=True)
-    option_parser.add_argument("--rcpm-cmd-server-port", help="Local TCP port to bind RCP-Module-Command-Server to",
-                               required=True, type=int)
-    option_parser.add_argument("--rcpm-cmd-server-cert", help="SSL/TLS Certificate of the RCP-Module-Command-Server",
-                               required=True)
-    CardKeyFieldCryptor.argparse_add_args(option_parser)
-    return option_parser
-
-def rcpm_run_module(opts: Namespace, module: RcpModule, *args, **kwargs):
-
-    PySimLogger.setup(print, {logging.WARN: "\033[33m", logging.DEBUG: "\033[90m"}, opts.verbose)
-    log.info("RCP Module startup: %s", module.name)
-    log.debug("Main process ID: %d", os.getpid())
-
-    # Load SSL/TLS certificates.
-    rcpm_cmd_ssl_context = load_server_cert("RCPM Command Server", opts.rcpm_cmd_server_cert)
-    ssl_context = load_ca_cert("RCPM Server Client", opts.rcps_ca_cert)
-
-    # Load JSON schema for message validation between RCP Server and RCP Module (this process)
-    rcpm_to_rcps_schema = load_json_schema(os.path.join(Path(__file__).parent.resolve(), "rcpm_to_rcps_schema.json"))
-    rcps_to_rcpm_schema = load_json_schema(os.path.join(Path(__file__).parent.resolve(), "rcps_to_rcpm_schema.json"))
-
-    # Load JSON schema for message validation between RCP Server and RCP Module Command Server (this process)
-    rcpmcs_to_rcps_schema = load_json_schema(os.path.join(Path(__file__).parent.resolve(), "rcpmcs_to_rcps_schema.json"))
-    rcps_to_rcpmcs_schema = load_json_schema(os.path.join(Path(__file__).parent.resolve(), "rcps_to_rcpmcs_schema.json"))
-
-    # Start local RCP Client Command Server.
-    log.info("RCPC command server at: %s:%d" % (opts.rcpm_cmd_server_addr, opts.rcpm_cmd_server_port))
-    def rcpm_cmd_conn_hdlr(websocket: ServerConnection):
-        json_validator = JsonValidator(rcps_to_rcpmcs_schema, rcpmcs_to_rcps_schema)
-        transport_keys = CardKeyFieldCryptor.transport_keys_from_opts(opts)
-        field_cryptor = CardKeyFieldCryptor(transport_keys)
-        hdlr = RcpmCmdSrvConnHdlr(module(*args, *kwargs), field_cryptor, websocket, RCP_SERVER_TIMEOUT, json_validator)
-        hdlr.procedure()
-        hdlr.close()
-
-    server = serve(rcpm_cmd_conn_hdlr, opts.rcpm_cmd_server_addr, opts.rcpm_cmd_server_port, ssl=rcpm_cmd_ssl_context)
-    def rcpm_cmd_server():
-        log.debug("RCPC command server thread ID: %d", threading.get_native_id())
-        server.serve_forever()
-    rcpm_cmd_server_thread = threading.Thread(target = rcpm_cmd_server)
-    rcpm_cmd_server_thread.start()
-
-    # Connect to RCP Server and publish module description.
-    async def rcps_client():
-        async with websockets.connect(opts.uri, ping_timeout=10.0, ping_interval=1.0, ssl=ssl_context) as websocket:
-            json_validator = JsonValidator(rcps_to_rcpm_schema, rcpm_to_rcps_schema)
-            client = RcpsCltConnHdlr(opts.rcpm_cmd_server_addr, opts.rcpm_cmd_server_port, module, websocket,
-                                     RCP_SERVER_TIMEOUT, json_validator)
-            await client.check_version()
-            await client.describe()
-            await client.wait_close()
-    try:
-        asyncio.run(rcps_client())
-    except Exception as e:
-        backtrace("RCPS client")
-
-    # Shutdown
-    server.shutdown()
-    rcpm_cmd_server_thread.join()
-    log.info("RCP Module shutdown: %s", module.name)

contrib/rcp/rcp_server.py

@@ -1,666 +0,0 @@
-#!/usr/bin/env python3
-
-# (C) 2026 by sysmocom - s.f.m.c. GmbH
-# All Rights Reserved
-#
-# Author: Philipp Maier
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import os
-import sys
-import argparse
-import asyncio
-import logging
-import time
-import requests
-import json
-import websockets
-from osmocom.utils import Hexstr
-from pySim.utils import ResTuple
-from copy import deepcopy
-from pathlib import Path
-from pySim.log import PySimLogger
-from pySim.utils import dec_iccid
-from websockets.asyncio.server import serve, ServerConnection
-from rcp_utils import SrvConnHdlr, CltConnHdlr, JsonValidator, FlightRecorder
-from rcp_utils import load_json_schema, backtrace, pytype_to_type, load_server_cert, load_ca_cert
-from rcp_utils import key_value_pairs_from_dict
-from pySim.card_key_provider import card_key_provider_argparse_add_args, card_key_provider_init
-from pySim.card_key_provider import card_key_provider_get_field, card_key_provider_get
-from packaging.version import Version
-
-CLIENT_TIMEOUT = 10
-
-# The protocol version between the RCP Server and the RCP Module must always match up. In case there as changes to
-# the protocol (JSON Schema and/or application logic). This version number shall be incremented accordingly. Since
-# RCP Modules usually run from the same pySim modules as the RCP Server, a change to this version number should
-# not affect the RCP Module implementation itself.
-RCPM_VERSION_PROTOCOL = "1.0.0"
-
-# The RCP Server software version shall be incremented when there are changes to the RCP Sever (this module) or changes
-# to other related modules, which affect the RCP Server. The RCP Server software version is also disclosed towards the
-# RCP Client.
-RCPS_VERSION_SOFTWARE = "1.0.0"
-
-# The RCP Server protocol version refers to the protocol spoken between RCP Client and RCP Server. The protocol version
-# shall be incremented when there are changes to the protocol (JSON Schema and/or application logic). When an
-# RCP Client connects, this protocol version is compared against the protocol version that the client sends
-# (see also RCPC_VERSION_PROTOCOL in rcp_client.py). It is up to the RCP Server to decide whether or not a deviation
-# between protocol versions is tolerable or not.
-RCPS_VERSION_PROTOCOL = "1.0.0"
-
-log = PySimLogger.get(Path(__file__).stem)
-runtime_state = None
-rate_limiter = None
-option_parser = argparse.ArgumentParser(description='RCP Server',
-                                        formatter_class=argparse.ArgumentDefaultsHelpFormatter)
-option_parser.add_argument("--verbose", help="Enable verbose logging",
-                           action='store_true', default=False)
-option_parser.add_argument("--rcpc-server-addr", help="Local Host/IP to bind RCP-Client-Server to",
-                           required=True)
-option_parser.add_argument("--rcpc-server-port", help="Local TCP port to bind RCP-Client-Server to",
-                           required=True, type=int)
-option_parser.add_argument("--rcpc-server-cert", help="SSL/TLS Certificate of the RCP-Client-Server",
-                           required=True)
-option_parser.add_argument("--rcpc-request-limit", help="number of RCP Client requests per minute",
-                           default=600)
-option_parser.add_argument("--rcpm-server-addr", help="Local Host/IP to bind RCP-Module-Server to",
-                           required=True)
-option_parser.add_argument("--rcpm-server-port", help="Local TCP port to bind RCP-Module-Server to",
-                           required=True, type=int)
-option_parser.add_argument("--rcpm-server-cert", help="SSL/TLS Certificate of the RCP-Module-Server",
-                           required=True)
-option_parser.add_argument("--rcpm-module-ca-cert", help="SSL/TLS CA-Certificate of the RCP-Module-Command-Server",
-                           required=True)
-option_parser.add_argument("--open-observe-url", help="OpenObserve API endpoint URL")
-option_parser.add_argument("--open-observe-email", help="OpenObserve service email address")
-option_parser.add_argument("--open-observe-token", help="OpenObserve service token")
-
-card_key_provider_argparse_add_args(option_parser)
-
-class ModuleRuntimeState:
-    def __init__(self, websocket:ServerConnection, name:str, cmd_descr:list, suitable_for:list, addr:str, port:int):
-        self.name = name
-        self.websocket = websocket
-
-        # Run the cmd_descr through argparse to catch malformed argument specifications early
-        for cmd in cmd_descr:
-            args = deepcopy(cmd['args'])
-            cmd_parser = argparse.ArgumentParser()
-            for arg in args:
-                try:
-                    arg['spec'] = pytype_to_type(arg['spec'])
-                    cmd_parser.add_argument(arg['name'], **arg['spec'])
-                except:
-                    raise ValueError("invalid argument spec %s -- check RCP Module" % str(arg))
-
-        self.cmd_descr = cmd_descr
-        self.suitable_for = suitable_for
-        self.addr = addr
-        self.port = port
-        log.debug("new RCP Module context created: '%s'", name)
-
-    def is_suitable(self, suitable_for:dict) -> bool:
-        """Check if this module is 'suitable_for' a specific card"""
-        if suitable_for in self.suitable_for:
-            return True
-        return False
-
-    def describe(self) -> dict:
-        """Describe this module towards the RCP Client"""
-
-        # The command description sent by the RCP Module also includes fields that are intended to be seen
-        # only by the RCP Server. Here we set up the command description as it is expected by the RCP Client.
-        cmd_descr = []
-        for descr in self.cmd_descr:
-            cmd_descr.append({'name' : descr['name'],
-                              'help' : descr['help'],
-                              'args' : descr['args']})
-
-        # Return module description
-        return {'name': self.name,
-                'cmd_descr': cmd_descr}
-
-    def get_cmd_descr(self, cmd: str) -> dict:
-        """Get the description for a specific command of this module"""
-        for descr in self.cmd_descr:
-            if self.name + "_" + descr['name'] == cmd:
-                return descr
-        raise ValueError("command %s not found in command description %s" % (cmd_name, str(self.cmd_descr)))
-
-    def __str__(self) -> str:
-        return self.name
-
-    def __del__(self):
-        log.debug("RCP module context destroyed: '%s'", self.name)
-
-class RuntimeState:
-    def __init__(self, rcpm_ca_ssl_context, open_observe_pars):
-        self.module_runtime_states = []
-        self.rcpm_ca_ssl_context = rcpm_ca_ssl_context
-        self.open_observe_pars = open_observe_pars
-
-        # Load JSON schema for message validation between RCP Client and RCP Server (this process)
-        self.rcpc_to_rcps_schema = load_json_schema(os.path.join(Path(__file__).parent.resolve(),
-                                                                 "rcpc_to_rcps_schema.json"))
-        self.rcps_to_rcpc_schema = load_json_schema(os.path.join(Path(__file__).parent.resolve(),
-                                                                 "rcps_to_rcpc_schema.json"))
-
-        # Load JSON schema for message validation between RCP Module and RCP Server (this process)
-        self.rcpm_to_rcps_schema = load_json_schema(os.path.join(Path(__file__).parent.resolve(),
-                                                                 "rcpm_to_rcps_schema.json"))
-        self.rcps_to_rcpm_schema = load_json_schema(os.path.join(Path(__file__).parent.resolve(),
-                                                                 "rcps_to_rcpm_schema.json"))
-
-        # Load JSON schema for message validation between RCP Module Command Server and RCP Server (this process)
-        self.rcpmcs_to_rcps_schema = load_json_schema(os.path.join(Path(__file__).parent.resolve(),
-                                                                 "rcpmcs_to_rcps_schema.json"))
-        self.rcps_to_rcpmcs_schema = load_json_schema(os.path.join(Path(__file__).parent.resolve(),
-                                                                 "rcps_to_rcpmcs_schema.json"))
-
-        log.debug("new runtime context created.")
-
-    def __log_modules_available(self) -> str:
-        if self.module_runtime_states:
-            modules_str = ""
-            for module in self.module_runtime_states:
-                modules_str += "'" + str(module) + "', "
-            return "RCP modules available: %s" % modules_str[:-2]
-        else:
-            return "RCP modules available: none"
-
-    def module_add(self, module: ModuleRuntimeState):
-        self.module_runtime_states.append(module)
-        log.info("new RCP module, %s", self.__log_modules_available())
-
-    def module_remove(self, websocket:ServerConnection):
-        for module in self.module_runtime_states:
-            if module.websocket == websocket:
-                self.module_runtime_states.remove(module)
-                log.info("RCP module removed, %s", self.__log_modules_available())
-                return
-        log.warning("cannot remove RCP module, no RCP module associated with RCPC connection: %s:%d, %s" %
-                    (*websocket.remote_address, self.__log_modules_available()))
-
-    def modules_find(self, suitable_for:dict) -> list[dict]:
-        modules = []
-        for module in self.module_runtime_states:
-            if module.is_suitable(suitable_for):
-                modules.append(module.describe())
-        if modules:
-            return modules
-        # It is absolutely tolerable if no suitable RCP module can be found. If this is the case, the client should
-        # display an empty help screen and exit normally.
-        log.warning("no suitable RCP module found, %s", self.__log_modules_available())
-        return []
-
-    def module_find(self, suitable_for:dict, cmd:str) -> ModuleRuntimeState:
-        modules = self.modules_find(suitable_for)
-        for m in modules:
-            module_name = m['name']
-            cmd_descr = m['cmd_descr']
-            for c in cmd_descr:
-                cmd_name = c['name']
-                if module_name + "_" + cmd_name == cmd:
-                    break
-        for module_runtime_state in self.module_runtime_states:
-            if module_runtime_state.name == module_name:
-                return module_runtime_state
-        # Normally we should find the RCP module. When this method is called, we have already called modules_find
-        # before because we had to return the command descriptions to the client. If we cannot find the RCP module
-        # now, the module have been disconnected or the client somehow called a command that does not exist. In any
-        # case, ending up here means we cannot continue.
-        raise ValueError("RCP module not found for command: %s, " % (cmd, self.__log_modules_available()))
-
-class RcpmCltConnHdlr(CltConnHdlr):
-    """
-    The RCP Module client connection handler is the dedicated client that is used by the RCP Client connection handler
-    to handle the dedicated connection towards the RCP Module (see below)
-    """
-
-class RcpcSrvConnHdlr(SrvConnHdlr):
-    """
-    The RCP Client connection handler takes care of the handling of client requests. Throughout the lifetime of a
-    connection, the client will request a description of the available commands and then request the execution of a
-    procedure. To execute the procedure, the handler will make a dedicated connection to the RCP Module and then
-    transparently pass the messages from the RCP Client to the RCP Module and vice versa.
-    """
-
-    module_client = None
-
-    async def check_version(self):
-        """
-        Check the RCP Client software and protocol version to ensure the requesting RCP Client is compatible with this
-        RCP Server version.
-        """
-
-        # Receive version info from RCP client
-        rx_json = await self._recv()
-        rcpc_version_software = Version(rx_json['rcpc_version']['software'])
-        rcpc_version_protocol = Version(rx_json['rcpc_version']['protocol'])
-        log.debug("RCP Client version: software=%s, protocol=%s",
-                  rcpc_version_software, rcpc_version_protocol)
-        if self.flight_recorder:
-            self.flight_recorder.record_meta('rcpc_version_software', str(rcpc_version_software))
-            self.flight_recorder.record_meta('rcpc_version_protocol', str(rcpc_version_protocol))
-
-        # Check if the RCP Client is compatible with this RCP Server. As of now we expect that the client uses the
-        # exact same protocol version as the server.
-        rcpc_version_protocol_expected = Version(RCPS_VERSION_PROTOCOL)
-        if rcpc_version_protocol != rcpc_version_protocol_expected:
-            info = "RCP Client uses unsupported protocol version (%s != %s)" % (rcpc_version_protocol, rcpc_version_protocol_expected)
-            raise_exception = True
-        else:
-            info = None
-            raise_exception = False
-
-        # Respond with RCP Server version info. We do this before we potentially raise an exception to make sure the
-        # RCP Server version info arrives at the client.
-        tx_json = {'rcpc_version': {'software' : RCPS_VERSION_SOFTWARE,
-                                    'protocol' : RCPS_VERSION_PROTOCOL}}
-        if info:
-            tx_json['rcpc_version']['info'] = info
-        await self._send(tx_json)
-
-        # Raise exception in case problems were detected. This will close the connection, but the client still has the
-        # version info (see above)
-        if raise_exception:
-            raise ValueError(info)
-
-    async def describe(self):
-        """
-        Collect the command/argument description of suitable modules and forward that definition to the RCP client. The
-        RCP client will then build an argument parser (commandline help, argument validation) from this information.
-        """
-        rx_json = await self._recv()
-        self.suitable_for = rx_json['rcpc_hello']['suitable_for']
-        if self.flight_recorder:
-            self.flight_recorder.record_meta('suitable_for', self.suitable_for)
-        modules = runtime_state.modules_find(self.suitable_for)
-        if self.flight_recorder:
-            suitable_modules = []
-            for m in modules:
-                suitable_modules.append(m['name'])
-            self.flight_recorder.record_meta('suitable_modules', suitable_modules)
-        tx_json = {'rcpc_welcome':
-                   {'module_descr' : modules}
-                   }
-        await self._send(tx_json)
-
-    async def _transact_apdu(self, apdu: Hexstr) -> ResTuple:
-        """Private low level method to exchange an APDU"""
-        tx_json = {'rcpc_instr': {'c_apdu' : apdu.upper()}}
-        rx_json = await self._transact(tx_json)
-        if rx_json is None:
-            raise ValueError("RCP Client vanished unexpectetly")
-        data = rx_json['rcpc_result']['r_apdu']['data']
-        sw = rx_json['rcpc_result']['r_apdu']['sw']
-        return data, sw
-
-    async def _reset(self) -> Hexstr:
-        """Private low level method to reset the UICC/eUICC"""
-        tx_json = {'rcpc_instr': {'reset' : None}}
-        rx_json = await self._transact(tx_json)
-        if rx_json is None:
-            raise ValueError("RCP Client vanished unexpectetly")
-        return rx_json['rcpc_result']['atr']
-
-    async def _read_iccid(self) -> Hexstr:
-        """Private low level method to read the EID from an UICC (or eSIM)"""
-        data, sw = await self._transact_apdu("00A40000022FE200")
-        if sw != "9000":
-            raise ValueError("Unable to select EF.ICCID, sw: %s, " % sw)
-        data, sw = await self._transact_apdu("00B000000A")
-        if sw != "9000":
-            raise ValueError("Unable to read EF.ICCID, sw: %s, " % sw)
-        return dec_iccid(data)
-
-    async def _read_eid(self) -> Hexstr:
-        """Private low level method to read the EID from an eUICC"""
-        data, sw = await self._transact_apdu("00A4040410A0000005591010FFFFFFFF890000010000")
-        if sw != "9000":
-            raise ValueError("Unable to select ISD-R, sw: %s, " % sw)
-        data, sw = await self._transact_apdu("80E2910006BF3E035C015A00")
-        if sw != "9000":
-            raise ValueError("Unable to retrieve EID, sw: %s, " % sw)
-        return data[10:]
-
-    async def print(self, message: str):
-        """ Print a message on the client side """
-        tx_json = {'rcpc_instr': {'print' : message}}
-        rx_json = await self._transact(tx_json)
-        if rx_json is None:
-            raise ValueError("RCP Client vanished unexpectedly")
-        if rx_json != {'rcpc_result': {'empty' : None}}:
-            raise ValueError("unexpected response from RCP Client: %s" % rx_json)
-
-    async def procedure(self):
-        """
-        Receive a command from the client, pick a matching module, make a dedicated connection to that module and
-        forward instruction/response messages between RCP Client and RCP Module until the procedure is done.
-        """
-        # Receive a command from the client.
-        rx_json = await self._recv()
-
-        # The procedure step is not mandatory. In case no procedure shall be executed, the client may close the
-        # connection early on his behalf. This is normal behavior and usually the case when the user instructs the
-        # RCP client to display the commandline help screens.
-        if rx_json is None:
-            log.debug(str(self) + " -- RCP client has closed the connection, no procedure executed")
-            return
-
-        # The RCP client has sent a command, so we continue with the procedure.
-        command = rx_json['rcpc_command']
-        if self.flight_recorder:
-            self.flight_recorder.record_meta('cmd', command['cmd'])
-            self.flight_recorder.record_meta('cmd_argv', command['cmd_argv'])
-
-        # Pick the matching RCP Module
-        module = runtime_state.module_find(self.suitable_for, command['cmd'])
-        if self.flight_recorder:
-            self.flight_recorder.record_meta('module', module.name)
-
-        # Retrieve keys (if the command requires them)
-        cmd_descr = module.get_cmd_descr(command['cmd'])
-        get_keys = cmd_descr.get('get_keys')
-        if get_keys:
-            keys = {}
-            get_keys_uicc = get_keys.get('uicc')
-            if get_keys_uicc:
-                iccid = await self._read_iccid()
-                if self.flight_recorder:
-                    self.flight_recorder.record_meta('iccid', iccid)
-                keys_uicc = card_key_provider_get(get_keys_uicc, 'ICCID', iccid)
-                keys['uicc'] = key_value_pairs_from_dict(keys_uicc, keylabel='key', valuelabel='value')
-            get_keys_euicc = get_keys.get('euicc')
-            if get_keys_euicc:
-                eid = await self._read_eid()
-                if self.flight_recorder:
-                    self.flight_recorder.record_meta('eid', eid)
-                keys_euicc = card_key_provider_get(get_keys_euicc, 'EID', eid)
-                keys['euicc'] = key_value_pairs_from_dict(keys_euicc, keylabel='key', valuelabel='value')
-            command['keys'] = keys
-
-        # Resetting card to ensure the card is in a defined state
-        await self._reset()
-
-        # Create a dedicated connection to the RCP Module and proxy the messages between RCP Client and RCP Module.
-        module_uri = "wss://%s:%d" % (module.addr, module.port)
-        log.info(str(self) + " -- executing procedure for command \"%s\" on module \"%s\" at: %s" %
-                 (command['cmd'], module.name, module_uri))
-        async with websockets.connect(module_uri, ssl=runtime_state.rcpm_ca_ssl_context) as websocket:
-            # Create a connection to the RCP Module Command Server
-            json_validator = JsonValidator(runtime_state.rcpmcs_to_rcps_schema, runtime_state.rcps_to_rcpmcs_schema)
-            self.module_client = RcpmCltConnHdlr(websocket, CLIENT_TIMEOUT, json_validator, self.flight_recorder)
-
-            # Prepare initial request to be send to the RCP Module Command Server
-            module_tx_json = {'rcps_command' : command}
-
-            # Forward messages between RCP Module Command Server and RCP Client until the procedure ends.
-            while(True):
-                # Send request to the RCP Module Command Server
-                module_rx_json = await self.module_client._transact(module_tx_json)
-
-                # Forward the response to the RCP Client
-                if 'rcps_instr' in module_rx_json:
-                    client_tx_json = {'rcpc_instr' : module_rx_json['rcps_instr']}
-                    await self._send(client_tx_json)
-                elif 'rcps_goodbye' in module_rx_json:
-                    rc = module_rx_json['rcps_goodbye']
-                    log.info(str(self) + " -- command execution done, rc: %d" % rc)
-                    if self.flight_recorder:
-                        self.flight_recorder.record_meta('rc', rc)
-                        if rc != 0:
-                            self.flight_recorder.crash_report()
-                    client_tx_json = {'rcpc_goodbye' : rc}
-                    await self._send(client_tx_json)
-                    break
-                else:
-                    raise ValueError("Unexpected response from RCP Module: %s" % str(module_rx_json))
-
-                # Receive the Result from the client, prepare request (module_tx_json) for the next turn
-                client_rx_json = await self._recv()
-                if client_rx_json is None:
-                    raise ValueError("RCP client vanished unexpectedly")
-                if 'rcpc_result' in client_rx_json:
-                    module_tx_json = {'rcps_result' : client_rx_json['rcpc_result']}
-                else:
-                    raise ValueError("Unexpected result from RCP Client: %s" % str(client_rx_json))
-
-    async def close(self):
-        """
-        Close the connection towards the RCP Module Command Server, then close the connection towards the RCP Client.
-        """
-        if self.module_client:
-            await self.module_client.close()
-        await super().close()
-
-class RcpmSrvConnHdlr(SrvConnHdlr):
-    """
-    The RCP Module connection handler is responsible to handle connect and disconnect events of RCP Modules. This
-    connection between the RCP Module and the RCP Server is used for management purposes only.
-    """
-
-    async def check_version(self):
-        """
-        Send the Protocol and Software version of this RCP Module to the RCP Server. The RCP Server and the RCP Module
-        must always use the same protocol version.
-        """
-        tx_json = {'rcpm_version': {'protocol' : RCPM_VERSION_PROTOCOL}}
-        rx_json = await self._transact(tx_json)
-        rcpm_version_protocol = Version(rx_json['rcpm_version']['protocol'])
-        if Version(RCPM_VERSION_PROTOCOL) != rcpm_version_protocol:
-            raise ValueError("Incompatible protocol version %s != %s", Version(RCPM_VERSION_PROTOCOL), rcpm_version_protocol)
-
-    async def describe(self):
-        """
-        Receive the module description from an RCP Module. This description will be stored in an internal list until
-        the module is disconnected from the server.
-        """
-        rx_json = await self._recv()
-        runtime_state.module_add(module = ModuleRuntimeState(self.websocket, **rx_json['rcpm_hello']))
-        tx_json = {'rcpm_welcome': None}
-        await self._send(tx_json)
-
-    def __del__(self):
-        """
-        Remove RCPM from internal list when the connection is closed (and the handler is deleted)
-        """
-        runtime_state.module_remove(self.websocket)
-        super().__del__()
-
-class RateLimiter():
-    """
-    Rate limiter: A rate limiter can be used to limit the amount of requests
-    per interval. Once the interval expires, the request counter is reset and
-    the requestor gets a new request budget to spend.
-    """
-
-    def __init__(self, interval:int, requests:int):
-        """
-        Args:
-                interval: reset interval after which request counter is reset.
-                requests: maximum number of requests per interval.
-        Returns:
-                True when rate limit has been exceeded, False otherwise.
-        """
-        self.table = {}
-        self.interval = interval
-        self.requests = requests
-        self.last_collect = time.time()
-        log.info("Rate-Limit: max %d requests per sec.", self.requests / self.interval)
-
-    def __collect_expired(self):
-        new_table = {}
-        for key in self.table.keys():
-            if time.time() - self.table[key]['timestamp'] <= self.interval:
-                new_table[key] = self.table[key]
-        self.table = new_table
-
-    def limit(self, address:str) -> bool:
-        """
-        Rate limit request
-
-        Args:
-                address: requestor address
-        Returns:
-                True when rate limit has been exceeded, False otherwise
-        """
-
-        timestamp = time.time()
-
-        # Collect expired entries once per minute
-        if time.time() - self.last_collect > 60:
-            self.__collect_expired()
-            self.last_collect = timestamp
-
-        # In case no entry exists yet, create a new one => don't block
-        if address not in self.table:
-            self.table[address] = {'timestamp' : timestamp, 'counter' : 1}
-            log.debug("Rate-Limit: %s (new, counter=%d, next reset in %d sec.)",
-                      address, 1, self.interval)
-            return False
-
-        # We have to access multiple times, so its better to story the entry
-        # in a temporary variable.
-        entry = self.table[address]
-
-        # If the entry has expired - delete it => don't block
-        if timestamp - entry['timestamp'] > self.interval:
-            log.debug("Rate-Limit: %s (reset, counter=%d, next reset in %d sec.)",
-                      address, 1, self.interval)
-            self.table[address] = {'timestamp' : timestamp, 'counter' : 1}
-            return False
-
-        # If the rate limit has been reached => block
-        if entry['counter'] >= self.requests:
-            log.warning("Rate-Limit: %s (exceeded, counter=%d, next reset in %d sec.)",
-                        address, entry['counter'], self.interval - (timestamp - entry['timestamp']))
-            return True
-
-        # Increment counter, don't block
-        entry['counter'] += 1
-        log.debug("Rate-Limit: %s (incrementing, counter=%d, next reset in %d sec.)",
-                  address, entry['counter'], self.interval - (timestamp - entry['timestamp']))
-        self.table[address] = entry
-        return False
-
-class OpenObserveFlightRecorder(FlightRecorder):
-    """Concrete implementation of a "flight recorder" using OpenObserve as a monitoring entity."""
-
-    def __init__(self, url: str, email: str, token: str):
-        self.service_auth = requests.auth.HTTPBasicAuth(email, token)
-        self.url = url
-        super().__init__()
-
-    def report(self):
-        report_json = json.dumps(self._gen_report())
-        rc = requests.post(self.url, auth=self.service_auth, data=report_json)
-        if rc.status_code != 200:
-            log.error("POST request to OpenObserve failed: %s", str(rc))
-
-async def rcpc_conn_hdlr(websocket: ServerConnection):
-    """
-    In this handler function we process the request from the the RCP Client. Before we perform any action we check if
-    the rate limit is not exceeded. Then we describe the available commands to the client and execute the procedure
-    the client asks for. When everything is done we close the connection normally. The client may skip executing any
-    procedure by closing the connection early on his behalf.
-
-    The interaction with the client is recorded using a "flight recorder" object. When the interaction is done, the
-    records are analyzed and a report is generated and sent to the OpenObserve monitoring entity.
-    """
-
-    # Immediately close the connection in case the rate limit has been exceeded.
-    if rate_limiter.limit(websocket.remote_address[0]):
-        await websocket.close(code=1008) # Policy Violation
-
-    # Create flight-recorder object
-    flight_recorder = None
-    if runtime_state.open_observe_pars:
-        flight_recorder = OpenObserveFlightRecorder(**runtime_state.open_observe_pars)
-
-    # Execute procedure
-    try:
-        json_validator = JsonValidator(runtime_state.rcpc_to_rcps_schema, runtime_state.rcps_to_rcpc_schema)
-        hdlr = RcpcSrvConnHdlr(websocket, CLIENT_TIMEOUT, json_validator, flight_recorder)
-        await hdlr.check_version()
-        await hdlr.describe()
-        await hdlr.procedure()
-        await hdlr.close()
-    except Exception as e:
-        backtrace("RCPC connection handler")
-        if flight_recorder:
-            flight_recorder.record_backtrace()
-            flight_recorder.crash_report()
-        await websocket.close(code=1011) # Internal Error
-
-    # Generate report from flight-recorder
-    if flight_recorder:
-        flight_recorder.report()
-
-async def rcpm_conn_hdlr(websocket: ServerConnection):
-    """
-    In this handler function we process requests from the RCP Module. We receive the description from the RCP Module.
-    We keep the connection open throughout the whole lifetime of the RCP Module process so that we can know when the
-    RCP Module becomes unavailable for some reason.
-    """
-    try:
-        json_validator = JsonValidator(runtime_state.rcpm_to_rcps_schema, runtime_state.rcps_to_rcpm_schema)
-        hdlr = RcpmSrvConnHdlr(websocket, CLIENT_TIMEOUT, json_validator)
-        await hdlr.check_version()
-        await hdlr.describe()
-        await hdlr.close()
-    except:
-        backtrace("RCPM connection handler")
-
-if __name__ == '__main__':
-    opts = option_parser.parse_args()
-    PySimLogger.setup(print, {logging.WARN: "\033[33m", logging.DEBUG: "\033[90m"}, opts.verbose)
-
-    # Load SSL/TLS certificates
-    rcpc_ssl_context = load_server_cert("RCP Client Server", opts.rcpc_server_cert)
-    rcpm_ssl_context = load_server_cert("RCP Module Server", opts.rcpm_server_cert)
-    rcpm_ca_ssl_context = load_ca_cert("RCP Module Command Server Client", opts.rcpm_module_ca_cert)
-
-    # Init card key provider for automatic card key retrieval
-    card_key_provider_init(opts)
-
-    # Prepare parameters for OpenObserve
-    if opts.open_observe_url and opts.open_observe_email and opts.open_observe_token:
-        open_observe_pars = {'url' : opts.open_observe_url,
-                             'email': opts.open_observe_email,
-                             'token' : opts.open_observe_token}
-        log.info("Reporting to OpenObserve: %s", open_observe_pars['url'])
-    else:
-        log.warning("Reporting to OpenObserve: (disabled)")
-        open_observe_pars = None
-
-    # Start RCP server
-    runtime_state = RuntimeState(rcpm_ca_ssl_context, open_observe_pars)
-    rate_limiter = RateLimiter(interval=60, requests=opts.rcpc_request_limit)
-    async def rcp_server():
-        log.info("RCP Client Server at: %s:%d" % (opts.rcpc_server_addr, opts.rcpc_server_port))
-        log.info("RCP Module server at: %s:%d" % (opts.rcpm_server_addr, opts.rcpm_server_port))
-        async with serve(rcpc_conn_hdlr, opts.rcpc_server_addr, opts.rcpc_server_port, ssl=rcpc_ssl_context), \
-                   serve(rcpm_conn_hdlr, opts.rcpm_server_addr, opts.rcpm_server_port, ssl=rcpm_ssl_context):
-            await asyncio.get_running_loop().create_future()
-    try:
-        asyncio.run(rcp_server())
-    except SystemExit:
-        pass
-    except:
-        backtrace("RCP Server")
-        sys.exit(1)
-

contrib/rcp/rcp_utils.py

@@ -1,330 +0,0 @@
-#!/usr/bin/env python3
-
-# (C) 2026 by sysmocom - s.f.m.c. GmbH
-# All Rights Reserved
-#
-# Author: Philipp Maier
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import sys
-import ssl
-import json
-import abc
-import asyncio
-import time
-import websockets
-import traceback
-import threading
-from copy import deepcopy
-from websockets.asyncio.server import ServerConnection
-from websockets.asyncio.client import ClientConnection
-from pathlib import Path
-from jsonschema import validate
-from pySim.log import PySimLogger
-from ssl import SSLContext
-
-log = PySimLogger.get(Path(__file__).stem)
-
-def backtrace(what: str):
-    log.error("%s failed with an exception:", what)
-    log.error("---------------------8<---------------------")
-    traceback_lines = traceback.format_exc()
-    for line in traceback_lines.split("\n"):
-        if line:
-            log.error(line)
-    log.error("---------------------8<---------------------")
-
-def key_value_pairs_from_dict(keys: dict, keylabel: str='key', valuelabel: str='value') -> list:
-    key_list = []
-    for key in keys:
-        key_list.append({keylabel : key, valuelabel : keys[key]})
-    return key_list
-
-def dict_from_key_value_pairs(keys: list, keylabel: str='key', valuelabel: str='value') -> dict:
-    key_dict = {}
-    for key in keys:
-        key_dict[key[keylabel]] = key[valuelabel]
-    return key_dict
-
-def pytype_to_type(dict_in: dict) -> dict:
-    """
-    There is no way to properly express python types in JSON. This function can be used to replace
-    each occurrence of "pytype", with "type", where the string type name is replaced with an actual
-    python type.
-    """
-    dict_out = deepcopy(dict_in)
-    if dict_out.get('pytype'):
-        if dict_out['pytype'] == "str":
-            dict_out.pop('pytype')
-            dict_out['type'] = str
-        elif dict_out['pytype'] == "int":
-            dict_out.pop('pytype')
-            dict_out['type'] = int
-        else:
-            raise ValueError("invalid type in command argument specification: %s" % arg['spec']['type'])
-    return dict_out
-
-def load_json_schema(filename: str) -> dict:
-    """Load a JSON schema from file"""
-    log.debug("loading JSON schema: %s", filename)
-    try:
-        with open(filename) as schema_file:
-            return json.load(schema_file)
-    except Exception as e:
-        backtrace("JSON schema load")
-        sys.exit(1)
-
-def load_server_cert(what: str, filename: str) -> SSLContext:
-    """Load an SSL/TLS server certificate"""
-    log.debug("loading SSL/TLS server certificate (%s): %s", what, filename)
-    ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-    ssl_context.load_cert_chain(filename)
-    return ssl_context
-
-def load_ca_cert(what: str, filename: str) -> SSLContext:
-    """Load an SSL/TLS CA certificate"""
-    log.info("loading SSL/TLS CA certificate (%s): %s", what, filename)
-    ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-    ssl_context.load_verify_locations(filename)
-    return ssl_context
-
-class JsonValidator():
-    """
-    JSON validator class, can be passed to any ConnHdlr object to automatically validate the JSON messages which are
-    sent and and received.
-    """
-
-    def __init__(self, rx_schema: dict, tx_schema: dict = None):
-        self.rx_schema = rx_schema
-        if tx_schema:
-            self.tx_schema = tx_schema
-        else:
-            self.tx_schema = None
-
-    def valid_rx_json(self, rx_json: dict):
-        validate(instance = rx_json, schema = self.rx_schema)
-
-    def valid_tx_json(self, tx_json: dict):
-        if self.tx_schema:
-            # We intentionally do not prevent the sending of an invalid JSON message. It is the responsibility of the
-            # receiving end to detect an invalid message and react accordingly. The purpose of this validation is to
-            # make developers/users aware of the problem.
-            try:
-                validate(instance = tx_json, schema = self.tx_schema)
-            except Exception as e:
-                backtrace("JSON schema validation (TX)")
-
-class FlightRecorder(abc.ABC):
-    """
-    Base class to create a FlightRecorder object which can be passed to any ConnHdlr object to record debug information
-    (record_comm, record_debug) and metadata (record_meta) throughout the lifetime of a ConnHdlr object. In case the
-    ConnHdlr throws an exception, the API user may call the record_backtrace method to record a backtrace. Finally,
-    the APU user may call the report method (which calls _gen_report internally) to send a report to an external
-    monitoring enitiy.
-    """
-
-    def __init__(self):
-        self.records_meta = {}
-        self.records_comm = []
-        self.records_debug = []
-        self.crash_report_flag = False
-        self.record_meta('timestamp_start', time.strftime('%Y-%m-%d %H:%M:%S'))
-
-    def record_meta(self, key: str, value):
-        """Record/Update metadata"""
-        self.records_meta[key] = value
-
-    def record_comm(self, key: str, value):
-        """Record communication (automatically called by the ConnHdlr object)"""
-        self.records_comm.append({key : value})
-
-    def record_debug(self, key: str, value):
-        """Record debug information"""
-        self.records_debug.append({key : value})
-
-    def record_backtrace(self):
-        """Record a backtrace"""
-        traceback_lines = traceback.format_exc()
-        traceback_lines_filtered = []
-        for line in traceback_lines.split("\n"):
-            if line:
-                traceback_lines_filtered.append(line)
-        self.record_debug('backtrace', traceback_lines_filtered)
-
-    def crash_report(self):
-        """Set crash_report_flag. Thie method shall be called if an unrecoverable error has occured."""
-        self.crash_report_flag = True
-
-    def _gen_report(self):
-        """
-        Generate a report from the collected data. In case the crash_report flag is set to true, the report will
-        inculde communications (records_comm) and debug information (records_debug). Otherwise only the metadata
-        (records_meta) will be included.
-        """
-        self.record_meta('timestamp_end', time.strftime('%Y-%m-%d %H:%M:%S'))
-        report = self.records_meta
-        if self.crash_report_flag:
-            report['comm'] = self.records_comm
-            report['debug'] = self.records_debug
-            report['report_type'] = 'crash'
-            log.warning("crash report: %s", str(report))
-            return report
-        else:
-            report['report_type'] = 'normal'
-            log.debug("normal report: %s", str(report))
-            return report
-
-    @abc.abstractmethod
-    def report(self):
-        """
-        To be implemented in the derived class. Shall call _gen_report and then send the report to an external
-        monitoring entity.
-        """
-        pass
-
-class ConnHdlr(abc.ABC):
-    """Base class that can be used to create a connection handler"""
-
-    def __init__(self, websocket: ServerConnection | ClientConnection, timeout: int,
-                 json_validator: JsonValidator = None, flight_recorder: FlightRecorder = None):
-        self.websocket = websocket
-        self.local_address = websocket.local_address
-        self.remote_address = websocket.remote_address
-        self.timeout = timeout
-        self.json_validator = json_validator
-        self.flight_recorder = flight_recorder
-        log.debug(str(self) + " -- new handler, timeout: %d sec.", self.timeout)
-        if self.flight_recorder:
-            self.flight_recorder.record_meta(type(self).__name__ + '_remote_address',
-                                             str(self.remote_address[0]) + ":" + str(self.remote_address[1]))
-            self.flight_recorder.record_meta(type(self).__name__ + '_timestamp', time.strftime('%Y-%m-%d %H:%M:%S'))
-            self.flight_recorder.record_meta(type(self).__name__ + '_id', id(self))
-
-    def _log_recv_peer(self, rx_json_str: str):
-        peer = "%s:%d<-%s:%d" % (self.local_address[0],
-                           self.local_address[1],
-                           self.remote_address[0],
-                           self.remote_address[1])
-        log.debug(str(self) + " -- RX(%s): %s", peer, rx_json_str)
-        if self.flight_recorder:
-            self.flight_recorder.record_comm(type(self).__name__ + '_rx', rx_json_str)
-
-    def _log_send_peer(self, tx_json_str: str):
-        peer = "%s:%d->%s:%d" % (self.local_address[0],
-                           self.local_address[1],
-                           self.remote_address[0],
-                           self.remote_address[1])
-        log.debug(str(self) + " -- TX(%s): %s", peer, tx_json_str)
-        if self.flight_recorder:
-            self.flight_recorder.record_comm(type(self).__name__ + '_tx', tx_json_str)
-
-    def __str__(self) -> str:
-        return "%s(%d)" % (type(self).__name__, id(self))
-
-    def __del__(self):
-        log.debug(str(self) + " -- closed handler")
-
-class SrvConnHdlr(ConnHdlr):
-    """Base class that can be used to create a connection handler for a server"""
-
-    async def _recv(self) -> dict:
-        """Receive JSON message from client"""
-        async with asyncio.timeout(self.timeout):
-            try:
-                rx_json_str = await self.websocket.recv()
-            except websockets.exceptions.ConnectionClosedOK:
-                log.debug(str(self) + " -- no data received, connection is closed")
-                return None
-        self._log_recv_peer(rx_json_str)
-        rx_json = json.loads(rx_json_str)
-        if self.json_validator:
-            self.json_validator.valid_rx_json(rx_json)
-        return rx_json
-
-    async def _send(self, tx_json: dict):
-        """Send JSON message to client"""
-        if self.json_validator:
-            self.json_validator.valid_tx_json(tx_json)
-        tx_json_str = json.dumps(tx_json)
-        self._log_send_peer(tx_json_str)
-        await self.websocket.send(tx_json_str)
-
-    async def _transact(self, tx_json: dict) -> dict:
-        """Exchange JSON message with client"""
-        await self._send(tx_json)
-        return await self._recv()
-
-    async def close(self):
-        """Wait for a connecion to close normally"""
-        await self.websocket.wait_closed()
-        log.debug(str(self) + " -- closed connection")
-
-class SrvSyncConnHdlr(ConnHdlr):
-    """Base class that can be used to create a synchronous connection handler for a server"""
-
-    def _recv(self) -> dict:
-        """Receive JSON message from client"""
-        rx_json_str = self.websocket.recv(self.timeout)
-        self._log_recv_peer(rx_json_str)
-        rx_json = json.loads(rx_json_str)
-        if self.json_validator:
-            self.json_validator.valid_rx_json(rx_json)
-        return rx_json
-
-    def _send(self, tx_json: dict):
-        """Send JSON message to client"""
-        if self.json_validator:
-            self.json_validator.valid_tx_json(tx_json)
-        tx_json_str = json.dumps(tx_json)
-        self._log_send_peer(tx_json_str)
-        self.websocket.send(tx_json_str)
-
-    def _transact(self, tx_json: dict) -> dict:
-        """Exchange JSON message with client"""
-        self._send(tx_json)
-        return self._recv()
-
-    def close(self):
-        """Close connection normally"""
-        self.websocket.close()
-        log.debug(str(self) + " -- closed connection")
-
-class CltConnHdlr(ConnHdlr):
-    """Base class that can be used to create a connection handler for a client"""
-
-    async def _transact(self, tx_json: dict) -> dict:
-        """Exchange JSON message with server"""
-        if self.json_validator:
-            self.json_validator.valid_tx_json(tx_json)
-        tx_json_str = json.dumps(tx_json)
-        self._log_send_peer(tx_json_str)
-        async with asyncio.timeout(self.timeout):
-            await self.websocket.send(tx_json_str)
-            rx_json_str = await self.websocket.recv()
-        self._log_recv_peer(rx_json_str)
-        rx_json = json.loads(rx_json_str);
-        if self.json_validator:
-            self.json_validator.valid_rx_json(rx_json)
-        return rx_json
-
-    async def close(self):
-        """Close connection normally"""
-        await self.websocket.close()
-        log.debug(str(self) + " -- closed connection")
-
-    async def wait_close(self):
-        """Wait for a connecion to close normally"""
-        await self.websocket.wait_closed()
-        log.debug(str(self) + " -- closed connection")

contrib/rcp/rcpc_to_rcps_schema.json

@@ -1,99 +0,0 @@
-{
-    "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "title": "RCP Client to RCP Server",
-    "type": "object",
-    "properties": {
-	"rcpc_version": {
-	    "type": "object",
-	    "properties": {
-		"software": {
-		    "type": "string"
-		},
-		"protocol": {
-		    "type": "string"
-		}
-	    },
-	    "required": [ "software",  "protocol" ],
-	    "additionalProperties": false
-	},
-	"rcpc_hello": {
-	    "type": "object",
-	    "properties": {
-		"suitable_for": {
-		    "type": "object",
-		    "properties": {
-			"atr": {
-			    "type": "string",
-			    "pattern": "^[0-9,A-F]{0,66}$"
-			}
-		    },
-		    "oneOf": [
-			{ "required": [ "atr" ] }
-		    ],
-		    "additionalProperties": false
-		}
-	    },
-	    "required": [ "suitable_for" ],
-	    "additionalProperties": false
-	},
-	"rcpc_command": {
-	    "type": "object",
-	    "properties": {
-		"cmd": {
-		    "type": "string",
-		    "pattern": "^[0-9,A-Z,a-z,_]{0,40}$"
-		},
-		"cmd_argv": {
-		    "type": "array",
-		    "items": {
-			"type": "string",
-			"pattern": "^.{0,512}$"
-		    },
-		    "maxItems": 255
-		}
-	    },
-	    "required": [ "cmd", "cmd_argv" ],
-	    "additionalProperties": false
-	},
-	"rcpc_result": {
-	    "type": "object",
-	    "properties": {
-		"r_apdu": {
-		    "type": "object",
-		    "properties": {
-			"data": {
-			    "type": "string",
-			    "pattern": "^[0-9,A-F]{0,512}$"
-			},
-			"sw": {
-			    "type": "string",
-			    "pattern": "^[0-9,A-F]{0,4}$"
-			}
-		    },
-		    "required": [ "data", "sw" ],
-		    "additionalProperties": false
-		},
-		"atr": {
-		    "type": "string",
-		    "pattern": "^[0-9,A-F]{0,66}$"
-		},
-		"empty": {
-		    "type": "null"
-		}
-	    },
-	    "oneOf": [
-		{ "required": [ "r_apdu" ] },
-		{ "required": [ "atr" ] },
-		{ "required": [ "empty" ] }
-	    ],
-	    "additionalProperties": false
-	}
-    },
-    "oneOf": [
-	{ "required": [ "rcpc_version" ] },
-	{ "required": [ "rcpc_hello" ] },
-	{ "required": [ "rcpc_command" ] },
-	{ "required": [ "rcpc_result" ] }
-    ],
-    "additionalProperties": false
-}

contrib/rcp/rcpm_to_rcps_schema.json

@@ -1,127 +0,0 @@
-{
-    "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "title": "RCP Module to RCP Server",
-    "type": "object",
-    "properties": {
-	"rcpm_version": {
-	    "type": "object",
-	    "properties": {
-		"protocol": {
-		    "type": "string"
-		}
-	    },
-	    "required": [ "protocol" ],
-	    "additionalProperties": false
-	},
-	"rcpm_hello": {
-	    "type": "object",
-	    "properties": {
-		"name": {
-		    "type": "string"
-		},
-		"cmd_descr": {
-		    "type": "array",
-		    "items": {
-			"type": "object",
-			"properties": {
-			    "name": {
-				"type": "string"
-			    },
-			    "help": {
-				"type": "string"
-			    },
-			    "args": {
-				"type": "array",
-				"items": {
-				    "type": "object",
-				    "properties": {
-					"name": {
-					    "type": "string"
-					},
-					"spec": {
-					    "type": "object",
-					    "properties": {
-						"required" : {
-						    "type": "boolean"
-						},
-						"help": {
-						    "type": "string"
-						},
-						"action": {
-						    "type": "string"
-						},
-						"pytype": {
-						    "type": "string"
-						},
-						"default" : {
-						    "type": ["string", "integer"]
-						}
-					    },
-					    "required": [ "help" ],
-					    "additionalProperties": false
-					}
-				    },
-				    "required": [ "name", "spec" ],
-				    "additionalProperties": false
-				}
-			    },
-			    "get_keys": {
-				"type": "object",
-				"properties": {
-				    "uicc" : {
-					"type": "array",
-					"items": {
-					    "type": "string"
-					}
-				    },
-				    "euicc" : {
-					"type": "array",
-					"items": {
-					    "type": "string"
-					}
-				    }
-				},
-				"oneOf": [
-				    { "required": [ "uicc" ] },
-				    { "required": [ "euicc" ] }
-				],
-				"additionalProperties": false
-			    }
-			},
-			"required": [ "name",  "help", "args" ],
-			"additionalProperties": false
-		    }
-		},
-		"suitable_for": {
-		    "type": "array",
-		    "items": {
-			"type": "object",
-			"properties": {
-			    "atr": {
-				"type": "string",
-				"pattern": "^[0-9,A-F]{0,66}$"
-			    }
-			},
-			"oneOf": [
-			    { "required": [ "atr" ] }
-			],
-			"additionalProperties": false
-		    }
-		},
-		"addr": {
-		    "type": "string"
-		},
-		"port": {
-		    "type": "integer"
-		}
-	    },
-	    "required": [ "name",  "cmd_descr", "suitable_for", "addr", "port" ],
-	    "additionalProperties": false
-	}
-    },
-    "oneOf": [
-	{ "required": [ "rcpm_hello" ] },
-	{ "required": [ "rcpm_version" ] }
-    ],
-    "additionalProperties": false
-}

contrib/rcp/rcpmcs_to_rcps_schema.json

@@ -1,36 +0,0 @@
-{
-    "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "title": "RCP Module Command Server to RCP Server",
-    "type": "object",
-    "properties": {
-	"rcps_instr": {
-	    "type": "object",
-	    "properties": {
-		"print": {
-		    "type": "string"
-		},
-		"reset": {
-		    "type": "null"
-		},
-		"c_apdu": {
-		    "type": "string",
-		    "pattern": "^[0-9,A-F]{0,512}$"
-		}
-	    },
-	    "oneOf": [
-		{ "required": [ "print" ] },
-		{ "required": [ "reset" ] },
-		{ "required": [ "c_apdu" ] }
-	    ],
-	    "additionalProperties": false
-	},
-	"rcps_goodbye": {
-	    "type": "integer"
-	}
-    },
-    "oneOf": [
-	{ "required": [ "rcps_instr" ] },
-	{ "required": [ "rcps_goodbye" ] }
-    ],
-    "additionalProperties": false
-}

contrib/rcp/rcps_to_rcpc_schema.json

@@ -1,125 +0,0 @@
-{
-    "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "title": "RCP Server to RCP Client",
-    "type": "object",
-    "properties": {
-	"rcpc_version": {
-	    "type": "object",
-	    "properties": {
-		"software": {
-		    "type": "string"
-		},
-		"protocol": {
-		    "type": "string"
-		},
-		"info": {
-		    "type": "string"
-		}
-	    },
-	    "required": [ "software",  "protocol" ],
-	    "additionalProperties": false
-	},
-	"rcpc_welcome": {
-	    "type": "object",
-	    "properties": {
-		"module_descr": {
-		    "type": "array",
-		    "items": {
-			"type": "object",
-			"properties": {
-			    "name": {
-				"type": "string"
-			    },
-			    "cmd_descr": {
-				"type": "array",
-				"items": {
-				    "type": "object",
-				    "properties": {
-					"name": {
-					    "type": "string"
-					},
-					"help": {
-					    "type": "string"
-					},
-					"args": {
-					    "type": "array",
-					    "items": {
-						"type": "object",
-						"properties": {
-						    "name": {
-							"type": "string"
-						    },
-						    "spec": {
-							"type": "object",
-							"properties": {
-							    "required" : {
-								"type": "boolean"
-							    },
-							    "help": {
-								"type": "string"
-							    },
-							    "action": {
-								"type": "string"
-							    },
-							    "pytype": {
-								"type": "string"
-							    },
-							    "default" : {
-								"type": ["string", "integer"]
-							    }
-							},
-							"required": [ "help" ],
-							"additionalProperties": false
-						    }
-						},
-						"required": [ "name", "spec" ],
-						"additionalProperties": false
-					    }
-					}
-				    },
-				    "required": [ "name",  "help", "args" ],
-				    "additionalProperties": false
-				}
-			    }
-			},
-			"required": [ "name",  "cmd_descr" ],
-			"additionalProperties": false
-		    }
-		}
-	    },
-	    "required": [ "module_descr" ],
-	    "additionalProperties": false
-	},
-	"rcpc_instr": {
-	    "type": "object",
-	    "properties": {
-		"print": {
-		    "type": "string"
-		},
-		"reset": {
-		    "type": "null"
-		},
-		"c_apdu": {
-		    "type": "string",
-		    "pattern": "^[0-9,A-F]{0,512}$"
-		}
-	    },
-	    "oneOf": [
-		{ "required": [ "print" ] },
-		{ "required": [ "reset" ] },
-		{ "required": [ "c_apdu" ] }
-	    ],
-	    "additionalProperties": false
-	},
-	"rcpc_goodbye": {
-	    "type": "integer"
-	}
-    },
-    "oneOf": [
-	{ "required": [ "rcpc_version" ] },
-	{ "required": [ "rcpc_welcome" ] },
-	{ "required": [ "rcpc_instr" ] },
-	{ "required": [ "rcpc_goodbye" ] }
-    ],
-    "additionalProperties": false
-}

contrib/rcp/rcps_to_rcpm_schema.json

@@ -1,25 +0,0 @@
-{
-    "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "title": "RCP Server to RCP Module",
-    "type": "object",
-    "properties": {
-	"rcpm_version": {
-	    "type": "object",
-	    "properties": {
-		"protocol": {
-		    "type": "string"
-		}
-	    },
-	    "required": [ "protocol" ],
-	    "additionalProperties": false
-	},
-	"rcpm_welcome": {
-	    "type": "null"
-	}
-    },
-    "oneOf": [
-	{ "required": [ "rcpm_version" ] },
-	{ "required": [ "rcpm_welcome" ] }
-    ],
-    "additionalProperties": false
-}

contrib/rcp/rcps_to_rcpmcs_schema.json

@@ -1,106 +0,0 @@
-{
-    "$schema": "https://json-schema.org/draft/2020-12/schema",
-    "title": "RCP Server to RCP Module Command Server",
-    "type": "object",
-    "properties": {
-    	"rcps_command": {
-	    "type": "object",
-	    "properties": {
-		"cmd": {
-		    "type": "string",
-		    "pattern": "^[0-9,A-Z,a-z,_]{0,40}$"
-		},
-		"cmd_argv": {
-		    "type": "array",
-		    "items": {
-			"type": "string",
-			"pattern": "^.{0,512}$"
-		    },
-		    "maxItems": 255
-		},
-		"keys" : {
-		    "type": "object",
-		    "properties": {
-			"uicc" : {
-			    "type": "array",
-			    "items": {
-				"type": "object",
-				"properties": {
-				    "key": {
-					"type": "string"
-				    },
-				    "value": {
-					"type": "string"
-				    }
-				},
-				"required": [ "key", "value" ],
-				"additionalProperties": false
-			    }
-			},
-			"euicc" : {
-			    "type": "array",
-			    "items": {
-				"type": "object",
-				"properties": {
-				    "key": {
-					"type": "string"
-				    },
-				    "value": {
-					"type": "string"
-				    }
-				},
-				"required": [ "key", "value" ],
-				"additionalProperties": false
-			    }
-			}
-		    },
-		    "oneOf": [
-			{ "required": [ "uicc" ] },
-			{ "required": [ "euicc" ] }
-		    ],
-		    "additionalProperties": false
-		}
-	    },
-	    "required": [ "cmd", "cmd_argv" ],
-	    "additionalProperties": false
-	},
-	"rcps_result": {
-	    "type": "object",
-	    "properties": {
-		"r_apdu": {
-		    "type": "object",
-		    "properties": {
-			"data": {
-			    "type": "string",
-			    "pattern": "^[0-9,A-F]{0,512}$"
-			},
-			"sw": {
-			    "type": "string",
-			    "pattern": "^[0-9,A-F]{0,4}$"
-			}
-		    },
-		    "required": [ "data", "sw" ],
-		    "additionalProperties": false
-		},
-		"atr": {
-		    "type": "string",
-		    "pattern": "^[0-9,A-F]{0,66}$"
-		},
-		"empty": {
-		    "type": "null"
-		}
-	    },
-	    "oneOf": [
-		{ "required": [ "r_apdu" ] },
-		{ "required": [ "atr" ] },
-		{ "required": [ "empty" ] }
-	    ],
-	    "additionalProperties": false
-	}
-    },
-    "oneOf": [
-	{ "required": [ "rcps_command" ] },
-	{ "required": [ "rcps_result" ] }
-    ],
-    "additionalProperties": false
-}

contrib/rcp/usage_example/card_data.csv

@@ -1,2 +0,0 @@
-iccid,kic,kid,kik
-8949440000001155306,F09C43EE1A0391665CC9F05AF4E0BD10,01981F4A20999F62AF99988007BAF6CA,8F8AEE5CDCC5D361368BC45673D99195

contrib/rcp/usage_example/card_data.csv.encr

@@ -1,2 +0,0 @@
-"ICCID","KIC","KID","KIK"
-"8949440000001155306","eae46224fa0a4ac1c12cba9d102f1188","3f14b978ddb38c08d832d4e4c2e0639d","9e19db4a5ed5cb8c4f5d96283eab273a"

contrib/rcp/usage_example/certs/example_ssl_rcp_ca_cert.crt

@@ -1,20 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDSzCCAjOgAwIBAgIUEv1f0yjVtkr+RNYLItZ33eTJwHMwDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjYwNDI5MTIwOTM0WhcNMzYw
-NDI2MTIwOTM0WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcN
-AQEBBQADggEPADCCAQoCggEBANXdkSyQlDzuo2cJmnBmFiZpc0V9tYBcNkpZd3Ac
-R0WljazKKgXDWNmOcSO7891bi+1HZzz+nDfV0mJY776ScGkTqF43Hzpg9eZakMAx
-yC24mT4h+uyRcPWZrBwaQhpiQrvZy4MRyuUB+BEgBSmhoDiuXP44kWiuEJHuzpOq
-X6Q2dW8RIeQPDGGK6XPZIQLqx+krxkaqphd/vHgT1/yd7Ol5xxMc4x2UuPaVCj0D
-OzslFsbb0Zu77ffCtHOVVnzSCzeEGGx1MPQm6hDVW+KUXXTwke1K55fmFZhu0gKO
-HYSEjgPj6X8muDb+GvOAQX3fHmS6KvFS4fwWd2InZ3v2f3cCAwEAAaOBkDCBjTAM
-BgNVHRMEBTADAQH/MB0GA1UdDgQWBBS6zY4Dd0pJFrvWLmyjn0vDTFqVqzBRBgNV
-HSMESjBIgBS6zY4Dd0pJFrvWLmyjn0vDTFqVq6EapBgwFjEUMBIGA1UEAwwLRWFz
-eS1SU0EgQ0GCFBL9X9Mo1bZK/kTWCyLWd93kycBzMAsGA1UdDwQEAwIBBjANBgkq
-hkiG9w0BAQsFAAOCAQEAGJUXlbnVhh+xL+pyTyjwtd8nxhUcHzYZl+OT0bkGY9zT
-S3NjHkKBbdnEftuYDYqp0uBuGFQ1WIOKiM3rp4IePKe84lSivZMVh9ObtNalcEQr
-sqxBziNOMJM2mh5V2NdxiK2E1gCZ959wOQ8yzM6gGC+wW8w4zwULhv4JimQDjk+G
-kAdiGL7+WAxrNWUulvm8khFt2nOlucJg4IAYVt2SI1AFMt/YSXoA4wMwM9QcHGj0
-1A069IxX93WVhUpIL1Avwz+KJK0BPY6SM8LYUy6V50Hojp76BB7VD6SxQrSoceUo
-6cRNDtCmofOlltfeUJLr1mI4S2tM50bQVsHD92EJBA==
------END CERTIFICATE-----

contrib/rcp/usage_example/certs/example_ssl_rcpc_rcps_cert.pem

@@ -1,115 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            42:38:a5:6f:70:53:40:e4:a4:1a:2c:0f:fc:81:13:42
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: CN=Easy-RSA CA
-        Validity
-            Not Before: Apr 29 12:09:35 2026 GMT
-            Not After : Aug  1 12:09:35 2028 GMT
-        Subject: CN=example_ssl_rcpc_rcps_cert
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:ae:0f:e1:ee:fc:f6:db:75:45:c0:f4:49:72:46:
-                    3d:e3:db:0c:c4:34:d2:9e:49:d4:86:4f:19:0d:55:
-                    70:50:81:e4:e6:64:56:a8:58:e8:e6:54:0a:16:bc:
-                    f4:4b:84:cd:1d:b9:2e:ed:62:b6:cd:62:35:8b:81:
-                    18:ab:ff:63:f5:c1:dc:16:3e:a8:dc:ac:11:dd:43:
-                    12:f8:ef:f2:f1:af:84:fd:83:fe:a8:d3:46:7d:77:
-                    e6:ae:95:61:a6:c9:99:6b:40:61:8d:6e:7e:66:1e:
-                    97:77:b0:e8:b7:3d:3a:d5:d7:d3:ee:66:95:62:83:
-                    14:cc:5e:32:ff:9e:bd:f1:06:e6:8d:6a:7c:0a:27:
-                    22:19:b9:06:09:cf:ef:c7:dc:e8:8f:04:4b:83:0d:
-                    cc:8d:b1:c2:cf:ab:40:25:6e:f2:bf:b7:c6:1d:8f:
-                    d2:fc:3d:c8:a1:be:4a:09:b9:91:e3:76:4f:c7:9b:
-                    fc:2f:de:d9:bb:eb:df:d3:d8:8c:72:79:bd:bf:10:
-                    8b:01:e6:0f:7f:bb:f6:75:31:5a:40:ad:df:e1:07:
-                    e6:12:12:b2:d3:99:d0:bd:24:5a:9a:ce:62:4f:da:
-                    fe:0d:df:09:ae:da:04:83:54:e8:cb:68:c0:57:78:
-                    c2:f4:68:42:d7:f4:81:4a:a3:b4:4e:0b:49:95:26:
-                    1d:15
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            X509v3 Subject Key Identifier: 
-                8E:99:9D:C0:70:98:57:16:08:8E:DF:6E:51:78:A6:86:18:FF:06:52
-            X509v3 Authority Key Identifier: 
-                keyid:BA:CD:8E:03:77:4A:49:16:BB:D6:2E:6C:A3:9F:4B:C3:4C:5A:95:AB
-                DirName:/CN=Easy-RSA CA
-                serial:12:FD:5F:D3:28:D5:B6:4A:FE:44:D6:0B:22:D6:77:DD:E4:C9:C0:73
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment
-            X509v3 Subject Alternative Name: 
-                DNS:127.0.0.1, IP Address:127.0.0.1
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        3e:56:20:f9:3b:fa:13:6e:7e:a9:80:a6:15:18:01:82:f1:b8:
-        4d:1b:f1:ee:da:ed:50:f7:3b:13:01:a5:14:f9:4c:0e:34:57:
-        dc:e6:d1:7e:02:30:af:3b:fd:c9:ae:18:16:c9:3b:0a:4e:20:
-        da:cd:e8:cc:05:0c:b3:7d:6f:e5:15:ff:66:59:6b:fe:ff:1a:
-        ef:ca:b5:3a:1a:ad:dd:f6:19:43:d9:2b:61:18:29:95:b4:0c:
-        1e:b2:4a:ce:80:d3:1b:59:dc:62:ec:50:21:37:9c:2f:7a:4d:
-        c2:ac:de:1b:1d:a3:25:e0:e8:33:42:cf:77:31:2a:f2:44:36:
-        ef:59:89:da:6c:3e:9a:e8:d7:06:39:17:d5:78:82:6d:b6:63:
-        3f:9a:40:3b:e6:12:58:52:3d:63:4e:85:0b:02:cb:40:d2:8a:
-        59:8d:8f:ee:4a:c8:97:91:51:a9:2f:1b:15:81:9c:20:dd:94:
-        08:6f:ac:fa:c6:28:90:6c:17:5a:23:87:9a:5b:e5:c6:2e:f3:
-        09:66:de:76:1b:60:42:c1:5c:71:88:87:f6:7b:cb:e3:7e:14:
-        67:c9:a0:15:98:b6:7b:75:40:9a:08:fc:77:39:3a:23:cb:e3:
-        78:7d:57:f9:a7:66:36:b4:b5:07:de:61:3a:dd:07:58:b3:4f:
-        41:f6:f4:d9
------BEGIN CERTIFICATE-----
-MIIDhDCCAmygAwIBAgIQQjilb3BTQOSkGiwP/IETQjANBgkqhkiG9w0BAQsFADAW
-MRQwEgYDVQQDDAtFYXN5LVJTQSBDQTAeFw0yNjA0MjkxMjA5MzVaFw0yODA4MDEx
-MjA5MzVaMCUxIzAhBgNVBAMMGmV4YW1wbGVfc3NsX3JjcGNfcmNwc19jZXJ0MIIB
-IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArg/h7vz223VFwPRJckY949sM
-xDTSnknUhk8ZDVVwUIHk5mRWqFjo5lQKFrz0S4TNHbku7WK2zWI1i4EYq/9j9cHc
-Fj6o3KwR3UMS+O/y8a+E/YP+qNNGfXfmrpVhpsmZa0BhjW5+Zh6Xd7Dotz061dfT
-7maVYoMUzF4y/5698QbmjWp8CiciGbkGCc/vx9zojwRLgw3MjbHCz6tAJW7yv7fG
-HY/S/D3Iob5KCbmR43ZPx5v8L97Zu+vf09iMcnm9vxCLAeYPf7v2dTFaQK3f4Qfm
-EhKy05nQvSRams5iT9r+Dd8JrtoEg1Toy2jAV3jC9GhC1/SBSqO0TgtJlSYdFQID
-AQABo4G+MIG7MAkGA1UdEwQCMAAwHQYDVR0OBBYEFI6ZncBwmFcWCI7fblF4poYY
-/wZSMFEGA1UdIwRKMEiAFLrNjgN3SkkWu9YubKOfS8NMWpWroRqkGDAWMRQwEgYD
-VQQDDAtFYXN5LVJTQSBDQYIUEv1f0yjVtkr+RNYLItZ33eTJwHMwEwYDVR0lBAww
-CgYIKwYBBQUHAwEwCwYDVR0PBAQDAgWgMBoGA1UdEQQTMBGCCTEyNy4wLjAuMYcE
-fwAAATANBgkqhkiG9w0BAQsFAAOCAQEAPlYg+Tv6E25+qYCmFRgBgvG4TRvx7trt
-UPc7EwGlFPlMDjRX3ObRfgIwrzv9ya4YFsk7Ck4g2s3ozAUMs31v5RX/Zllr/v8a
-78q1Ohqt3fYZQ9krYRgplbQMHrJKzoDTG1ncYuxQITecL3pNwqzeGx2jJeDoM0LP
-dzEq8kQ271mJ2mw+mujXBjkX1XiCbbZjP5pAO+YSWFI9Y06FCwLLQNKKWY2P7krI
-l5FRqS8bFYGcIN2UCG+s+sYokGwXWiOHmlvlxi7zCWbedhtgQsFccYiH9nvL434U
-Z8mgFZi2e3VAmgj8dzk6I8vjeH1X+admNrS1B95hOt0HWLNPQfb02Q==
------END CERTIFICATE-----
------BEGIN PRIVATE KEY-----
-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCuD+Hu/PbbdUXA
-9ElyRj3j2wzENNKeSdSGTxkNVXBQgeTmZFaoWOjmVAoWvPRLhM0duS7tYrbNYjWL
-gRir/2P1wdwWPqjcrBHdQxL47/Lxr4T9g/6o00Z9d+aulWGmyZlrQGGNbn5mHpd3
-sOi3PTrV19PuZpVigxTMXjL/nr3xBuaNanwKJyIZuQYJz+/H3OiPBEuDDcyNscLP
-q0AlbvK/t8Ydj9L8PcihvkoJuZHjdk/Hm/wv3tm769/T2Ixyeb2/EIsB5g9/u/Z1
-MVpArd/hB+YSErLTmdC9JFqazmJP2v4N3wmu2gSDVOjLaMBXeML0aELX9IFKo7RO
-C0mVJh0VAgMBAAECggEAGBhmQhdeE+Cu1Ihsn2dWW3PAF2wpiNR3GVWbRfOBHf/x
-QCx9K4ZNTU8ua1niZo7edyIiuyVaYWGaQHLRR8QNoiBhN2oapZujSHInzvKmeqr9
-ubt7NgMzQ5ykwB+5OiW3uXda2cGFOV08QgspF+6ftakQMzUbslyrdSQIIscmi5Ya
-uTDvE6+lBFinxy3RHFKVCZ3UrsDwfHR4eTUmgCHRB27joB7DFXL32amv0M8HjoGz
-EZKGJgTwmRf9U4z4D4wCnOfVAPlsuthKUqMuTlBg0ZEstMZrzlP4suT2ieku0Usv
-0XbJ38VozPYYFdR7nApVVvrJgHzI9cpoUbGto4BLOQKBgQDbXjFVLffOec8hv9dN
-2VGZQmK61S9OrbvTnEOlxJd+kRid71X1pV5TuPKJJQtUJXf429bQOs40YbLeOmJt
-BiRSR5yIBH7hDDC/c0ynqunstwDlgz+QX2Oh2B4alvVaWy0rZYF6NpBiI0+R5r5V
-C2fHRS4LLPoflg83+CMubyLS6QKBgQDLIOXxlp1JQTzXhJkrkytLkafmEHAafovt
-wbRD50/s+dl16BRX12sK0gXj2vwu0FleUD6Z7afDfspmvQdg3fyDxYw9Q+vw5LYQ
-7BvoVU99o1m468yXwX/v36peCt4nOpwkJZKJfjgxjnMJByyeSUgL9uW4K+0D0LBV
-a5Iv7QklTQKBgH30BkVPIHKIE/rfyIJlXemuaTu2/fOh4y9sEJdUWluMeeLssaFa
-ct+FWJSQFYIaBVl4+E0VBqKi2e2o/ix1E1O+1ExwsF0M/8xdKk024BtPNA+TnWKK
-so0Rpq9Dr9pScYvyOzZtr9b5SU2PfAcehlavDPHTwEV0hoZvTdvyab9JAoGADMBJ
-7vp3cSvJN/Y470VTyHCiS4zonKEpA4nPWRviJowgnIgvDryVGZ7Jg94xSncFxSfg
-ZiVHDLye1Ag1uFz3BwaVoRrsarjQvQs1TUZdsRNaBIO42iXpdBNkTHb+LxQ8zQAW
-zM7BlErO6dgrctxCy416Ki+Ht1+YUiRojt2gX1kCgYBqytUy+XkPi5j3Ga29xcvP
-WI3Uc8RI2GmoAmrw5QFiSG6lNXAzfo2ZNQbFnxgxeMOG9fV9yzBdIjXWNWr0E/KH
-Fsb65R8iIrXQB9BZjuQqjz9nDm7eZZUBNGGbQ4DgSepnp194gXC5DoAElzuwOXbE
-pY/kM1KwlpUR3J3LeF3i+Q==
------END PRIVATE KEY-----

contrib/rcp/usage_example/certs/example_ssl_rcpm_rcps_cert.pem

@@ -1,115 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            e7:09:ab:70:b5:dc:1f:11:d9:2a:23:04:39:87:34:f3
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: CN=Easy-RSA CA
-        Validity
-            Not Before: Apr 29 12:09:35 2026 GMT
-            Not After : Aug  1 12:09:35 2028 GMT
-        Subject: CN=example_ssl_rcpm_rcps_cert
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:cc:79:9b:d3:f3:1f:41:9f:00:48:cd:47:0b:ae:
-                    b9:1c:4e:3e:55:e2:4e:5f:a8:cc:13:d5:dd:bd:f0:
-                    01:4c:19:ae:e3:a9:09:06:89:92:49:f7:bb:90:28:
-                    fb:8c:22:69:b5:f5:a0:50:3d:97:0f:1e:1d:b1:a8:
-                    57:9b:d7:e2:0d:99:67:7f:02:82:0c:9c:8e:dd:13:
-                    03:28:93:b5:cb:7e:b5:78:06:10:bf:7b:55:c3:f7:
-                    10:8b:20:4a:1c:f9:f1:b2:fa:f1:c7:44:9d:0a:ce:
-                    ef:8d:f9:e8:ff:d1:c1:69:ec:8e:5f:11:cc:c9:98:
-                    d5:1c:33:e2:5b:7a:4d:34:dc:76:c3:cd:db:4c:93:
-                    d1:08:78:6f:3c:9a:ee:74:39:1e:cd:65:1e:c9:35:
-                    cc:3b:2b:9e:d7:49:10:8e:58:85:b0:10:5b:90:1e:
-                    f1:5e:d5:92:04:93:f9:33:c6:9d:77:63:d1:33:46:
-                    5b:98:ff:9a:a8:f5:df:f7:84:21:e2:88:28:7a:a4:
-                    c6:0d:9f:25:7e:0d:73:5b:d5:53:4a:90:79:94:37:
-                    14:f3:c8:75:76:d4:1c:32:51:bf:58:16:74:d5:8d:
-                    18:b6:53:f4:ab:cb:91:a8:8c:a3:ca:3c:5c:35:b6:
-                    5f:62:57:37:5a:75:28:b7:4d:26:aa:ea:50:da:a4:
-                    1c:55
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            X509v3 Subject Key Identifier: 
-                47:92:B5:81:8B:5C:14:98:B3:83:B6:EB:06:9F:43:F3:3A:7E:ED:24
-            X509v3 Authority Key Identifier: 
-                keyid:BA:CD:8E:03:77:4A:49:16:BB:D6:2E:6C:A3:9F:4B:C3:4C:5A:95:AB
-                DirName:/CN=Easy-RSA CA
-                serial:12:FD:5F:D3:28:D5:B6:4A:FE:44:D6:0B:22:D6:77:DD:E4:C9:C0:73
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment
-            X509v3 Subject Alternative Name: 
-                DNS:127.0.0.1, IP Address:127.0.0.1
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        6d:31:e6:29:d2:3b:a8:90:5c:4b:ac:61:15:95:5d:70:66:a5:
-        77:9d:88:47:49:73:75:be:70:69:d8:2f:62:82:5e:83:86:3b:
-        a8:48:3f:f1:5f:22:ae:81:23:64:c4:f2:2b:dd:4d:be:e5:6a:
-        26:a5:ea:c7:ba:1b:3e:6a:34:03:5a:f1:49:28:5f:56:4a:a6:
-        0e:1b:7a:07:48:76:95:b6:4b:f5:3f:b9:67:2e:e0:33:06:80:
-        d4:d6:01:a5:76:01:c0:a5:18:e5:38:8b:52:73:6e:6d:45:50:
-        b7:9a:ab:86:5d:e3:65:b4:b8:c7:ee:b2:dc:bf:e3:d5:bb:e4:
-        91:eb:f5:0c:38:22:5e:37:54:9e:ba:96:25:10:04:18:23:f7:
-        ae:73:4d:d0:aa:03:81:b4:89:36:97:15:da:1a:60:a0:98:5f:
-        03:f8:1b:22:83:57:41:4b:12:28:7d:8d:ea:88:74:24:28:5c:
-        53:41:89:5e:9a:da:fd:7b:bf:60:dc:de:9b:49:ce:5c:a3:b2:
-        01:7d:1d:cb:28:8c:ba:f4:7b:5d:2b:cb:15:5b:2a:97:1a:d1:
-        f9:e7:12:e3:43:b9:f4:2a:88:dd:6d:b6:a0:72:d3:bd:63:23:
-        e9:d7:f0:ac:b5:6d:0d:f2:d9:8b:2c:c4:35:5b:4d:83:dc:e8:
-        7d:0b:3d:a3
------BEGIN CERTIFICATE-----
-MIIDhTCCAm2gAwIBAgIRAOcJq3C13B8R2SojBDmHNPMwDQYJKoZIhvcNAQELBQAw
-FjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjYwNDI5MTIwOTM1WhcNMjgwODAx
-MTIwOTM1WjAlMSMwIQYDVQQDDBpleGFtcGxlX3NzbF9yY3BtX3JjcHNfY2VydDCC
-ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMx5m9PzH0GfAEjNRwuuuRxO
-PlXiTl+ozBPV3b3wAUwZruOpCQaJkkn3u5Ao+4wiabX1oFA9lw8eHbGoV5vX4g2Z
-Z38Cggycjt0TAyiTtct+tXgGEL97VcP3EIsgShz58bL68cdEnQrO74356P/RwWns
-jl8RzMmY1Rwz4lt6TTTcdsPN20yT0Qh4bzya7nQ5Hs1lHsk1zDsrntdJEI5YhbAQ
-W5Ae8V7VkgST+TPGnXdj0TNGW5j/mqj13/eEIeKIKHqkxg2fJX4Nc1vVU0qQeZQ3
-FPPIdXbUHDJRv1gWdNWNGLZT9KvLkaiMo8o8XDW2X2JXN1p1KLdNJqrqUNqkHFUC
-AwEAAaOBvjCBuzAJBgNVHRMEAjAAMB0GA1UdDgQWBBRHkrWBi1wUmLODtusGn0Pz
-On7tJDBRBgNVHSMESjBIgBS6zY4Dd0pJFrvWLmyjn0vDTFqVq6EapBgwFjEUMBIG
-A1UEAwwLRWFzeS1SU0EgQ0GCFBL9X9Mo1bZK/kTWCyLWd93kycBzMBMGA1UdJQQM
-MAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIFoDAaBgNVHREEEzARggkxMjcuMC4wLjGH
-BH8AAAEwDQYJKoZIhvcNAQELBQADggEBAG0x5inSO6iQXEusYRWVXXBmpXediEdJ
-c3W+cGnYL2KCXoOGO6hIP/FfIq6BI2TE8ivdTb7laial6se6Gz5qNANa8UkoX1ZK
-pg4begdIdpW2S/U/uWcu4DMGgNTWAaV2AcClGOU4i1Jzbm1FULeaq4Zd42W0uMfu
-sty/49W75JHr9Qw4Il43VJ66liUQBBgj965zTdCqA4G0iTaXFdoaYKCYXwP4GyKD
-V0FLEih9jeqIdCQoXFNBiV6a2v17v2Dc3ptJzlyjsgF9HcsojLr0e10ryxVbKpca
-0fnnEuNDufQqiN1ttqBy071jI+nX8Ky1bQ3y2YssxDVbTYPc6H0LPaM=
------END CERTIFICATE-----
------BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDMeZvT8x9BnwBI
-zUcLrrkcTj5V4k5fqMwT1d298AFMGa7jqQkGiZJJ97uQKPuMImm19aBQPZcPHh2x
-qFeb1+INmWd/AoIMnI7dEwMok7XLfrV4BhC/e1XD9xCLIEoc+fGy+vHHRJ0Kzu+N
-+ej/0cFp7I5fEczJmNUcM+Jbek003HbDzdtMk9EIeG88mu50OR7NZR7JNcw7K57X
-SRCOWIWwEFuQHvFe1ZIEk/kzxp13Y9EzRluY/5qo9d/3hCHiiCh6pMYNnyV+DXNb
-1VNKkHmUNxTzyHV21BwyUb9YFnTVjRi2U/Sry5GojKPKPFw1tl9iVzdadSi3TSaq
-6lDapBxVAgMBAAECggEADJFN6K9OWhYX1PcEWUgOLxqdCLd95Iccsfxot7ekcMUP
-A4WnHRyACLqor9c2V3o2//IpU2fnB2IXu6ISmRd3WKl3hm4vnZmoIJeTpQm9Iv/g
-+fqkyrbIgktcHDJUySal+n+jiYFNW2B1h1xXUT/scMz+FthNJg1Azfi0vorMFjCk
-SBOSo7BQ2hiQ83FneVJU1TsxD4S4IBLx9fF6AW05norRmvm17Ip2pKk4QYzKiOI3
-NIoSwbOgU0Vp1X3MMlilM5ZZdN3a9lI6lfBZE682WOxBmH67mKMQnR8aC+nwynQ+
-45pUQIn8Fjx2hQHehbD7ZNw9Nob9AyGWqWGKFV74IQKBgQDox/j7dCHNm1mz1QRm
-Q2YyN4OGXJI97t9Gd8UdNCv5bAkdx2cR2lmP3tRc6iAzrfNIpPCGaXo1vwJx477X
-wO95W2b4hfm3j6v0cqRbsFzzVIHZUB77pXfAJfZeICpoqu0vxn5nb+yPgzgmToLX
-pbIDdqWafzzrDLTmLCfwfKDI9QKBgQDg3tgpAXo8WCL4phNuW44XQ172lPTijpn+
-wj1Z0rBrS806gL/+QvZZLS1WCym/QBV7TgGlxIJbmAfghcGyin3NliskSHAiccxG
-/9eCSQes8czfsVj6qmBMwyff5r+wmk662qV0u07UHmuykYk3Dgs/zYdwq2SsTlL4
-Y9eRjutp4QKBgQCONg0wYcR8/hmROeRULXzz1OJvZYKaf6K8RFOSAduTp6LyJG4d
-hA4PTQzkLsy5hd4JVWr0UuAskaMGvSJMYTxsIaEI16C1ufpNfvRWZ6qBpfEmOEKV
-boN4Sjj3TCNcioAZHeT/gGs/SeU10eUxpbLZVtTZTD6FQuAJdpR34UvBOQKBgFNM
-mXxPLM2vxHyhYK9PwQoDDel/8lr+gjMqFvnwHyQP911FllmEyqbsIlAuYG+VOJ/t
-nJSgf72YSsq0IbWWsdV3XFHbd5Z62zYtzdJYZTx+cesnUhPBC11EKcA6RSYRczqq
-hgIA5MmU30ZNvSukyyv+Yb6t7uQZO4kByzgDXldhAoGBALgRkAHxgbKUXp5XyCDJ
-e8dwVx0g9tfDM/DEZtU/Si5oUaunBaPV/Byov7OXOT02V8JLnA5ChUYgwUFI030x
-QL/3eK12Qh5Gb9VabvYCicDRk4GzmqZU9Wcvm1zgbUr5jY8Lou44nFjol/Y1m70n
-51WZbVkkWmBZO5m3NqN66SkJ
------END PRIVATE KEY-----

contrib/rcp/usage_example/certs/example_ssl_rcps_rcpm_cert.pem

@@ -1,115 +0,0 @@
-Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number:
-            28:96:2e:a1:40:e0:7e:f1:fb:63:1a:f4:53:6f:ce:fb
-        Signature Algorithm: sha256WithRSAEncryption
-        Issuer: CN=Easy-RSA CA
-        Validity
-            Not Before: Apr 29 12:09:35 2026 GMT
-            Not After : Aug  1 12:09:35 2028 GMT
-        Subject: CN=example_ssl_rcps_rcpm_cert
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:ae:11:46:ef:d1:81:34:dd:23:5d:54:40:f3:9c:
-                    85:35:95:a6:91:57:92:5c:bf:eb:40:34:69:eb:db:
-                    c0:86:3c:7b:ff:9c:d7:ba:0e:41:57:84:15:cd:94:
-                    f1:48:63:50:9c:34:97:ee:be:be:b0:27:d8:fd:cd:
-                    8a:cf:85:ff:08:1f:07:d8:28:96:0e:e4:2d:d0:8b:
-                    df:a8:fa:41:47:a0:a2:80:2e:2e:58:01:cc:6f:43:
-                    5c:c2:fb:84:a7:ff:9e:97:bb:b3:a3:1f:63:64:73:
-                    8d:73:dd:f4:7e:96:d7:6b:b3:cb:e2:35:59:55:e0:
-                    e7:e3:c0:41:f8:b6:0f:c5:46:4c:cd:0e:91:80:ef:
-                    e3:43:f0:72:26:12:10:be:83:a2:db:23:2d:b4:b1:
-                    07:5a:b1:b3:10:9c:09:69:98:42:79:81:77:5e:22:
-                    e4:71:47:70:27:15:2c:a7:13:c2:6d:44:59:b4:73:
-                    c9:bb:27:7f:d6:e8:3d:85:bb:36:f6:cb:71:36:11:
-                    b1:99:1a:1d:1a:15:dd:cd:65:7f:cd:cc:10:00:49:
-                    ed:07:2d:7b:15:88:be:73:ba:1d:15:69:bc:d3:02:
-                    55:ea:dc:2c:3f:0b:cd:18:57:59:7a:e3:09:b2:89:
-                    cd:d6:e7:f6:95:c4:2e:8a:53:2b:a8:96:82:94:53:
-                    00:77
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            X509v3 Subject Key Identifier: 
-                60:BD:48:06:68:15:D4:DC:ED:EE:E4:C7:B1:9F:C4:93:6D:50:3A:77
-            X509v3 Authority Key Identifier: 
-                keyid:BA:CD:8E:03:77:4A:49:16:BB:D6:2E:6C:A3:9F:4B:C3:4C:5A:95:AB
-                DirName:/CN=Easy-RSA CA
-                serial:12:FD:5F:D3:28:D5:B6:4A:FE:44:D6:0B:22:D6:77:DD:E4:C9:C0:73
-            X509v3 Extended Key Usage: 
-                TLS Web Server Authentication
-            X509v3 Key Usage: 
-                Digital Signature, Key Encipherment
-            X509v3 Subject Alternative Name: 
-                DNS:127.0.0.1, IP Address:127.0.0.1
-    Signature Algorithm: sha256WithRSAEncryption
-    Signature Value:
-        c5:35:61:58:23:e2:69:da:6c:d5:41:ab:a8:70:f4:dd:cc:a0:
-        a3:3d:84:89:93:b6:7f:69:7d:10:35:9d:c5:d1:0d:db:d2:d7:
-        36:af:d4:54:30:14:a7:5d:31:ca:5c:13:92:d5:60:50:f8:56:
-        4a:cb:16:b1:b3:b1:03:bf:96:53:77:1f:4a:0f:9c:29:2b:bf:
-        a4:e0:da:6f:ad:13:c7:2d:8e:18:c4:72:50:17:ed:1f:36:51:
-        7a:12:9f:fc:a6:d6:c8:55:e0:db:ea:16:d6:22:0d:a2:cb:eb:
-        b2:ba:07:92:2f:db:33:d6:a2:0c:ec:89:29:f1:96:40:e5:0b:
-        e6:1f:08:50:d6:29:87:a8:20:b2:e2:17:50:25:ff:53:36:ee:
-        7f:ce:e6:1d:ed:b3:16:61:18:42:a9:17:9e:a6:86:0d:a5:fc:
-        f9:42:c8:50:48:74:72:35:eb:8c:ff:4d:e8:98:88:a0:b4:b3:
-        d0:82:b3:2f:ea:19:d7:d5:ac:47:35:96:24:37:34:0c:7a:a2:
-        e0:4d:99:a7:55:61:85:1e:7e:6a:23:77:f5:07:13:e6:50:5c:
-        65:00:13:f6:b5:4b:5b:8c:11:c3:5d:af:ba:41:e9:84:1d:f1:
-        a4:70:16:28:c2:be:6e:d8:67:38:c5:a0:ba:8a:64:6f:27:ce:
-        63:a0:92:9b
------BEGIN CERTIFICATE-----
-MIIDhDCCAmygAwIBAgIQKJYuoUDgfvH7Yxr0U2/O+zANBgkqhkiG9w0BAQsFADAW
-MRQwEgYDVQQDDAtFYXN5LVJTQSBDQTAeFw0yNjA0MjkxMjA5MzVaFw0yODA4MDEx
-MjA5MzVaMCUxIzAhBgNVBAMMGmV4YW1wbGVfc3NsX3JjcHNfcmNwbV9jZXJ0MIIB
-IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArhFG79GBNN0jXVRA85yFNZWm
-kVeSXL/rQDRp69vAhjx7/5zXug5BV4QVzZTxSGNQnDSX7r6+sCfY/c2Kz4X/CB8H
-2CiWDuQt0IvfqPpBR6CigC4uWAHMb0NcwvuEp/+el7uzox9jZHONc930fpbXa7PL
-4jVZVeDn48BB+LYPxUZMzQ6RgO/jQ/ByJhIQvoOi2yMttLEHWrGzEJwJaZhCeYF3
-XiLkcUdwJxUspxPCbURZtHPJuyd/1ug9hbs29stxNhGxmRodGhXdzWV/zcwQAEnt
-By17FYi+c7odFWm80wJV6twsPwvNGFdZeuMJsonN1uf2lcQuilMrqJaClFMAdwID
-AQABo4G+MIG7MAkGA1UdEwQCMAAwHQYDVR0OBBYEFGC9SAZoFdTc7e7kx7GfxJNt
-UDp3MFEGA1UdIwRKMEiAFLrNjgN3SkkWu9YubKOfS8NMWpWroRqkGDAWMRQwEgYD
-VQQDDAtFYXN5LVJTQSBDQYIUEv1f0yjVtkr+RNYLItZ33eTJwHMwEwYDVR0lBAww
-CgYIKwYBBQUHAwEwCwYDVR0PBAQDAgWgMBoGA1UdEQQTMBGCCTEyNy4wLjAuMYcE
-fwAAATANBgkqhkiG9w0BAQsFAAOCAQEAxTVhWCPiadps1UGrqHD03cygoz2EiZO2
-f2l9EDWdxdEN29LXNq/UVDAUp10xylwTktVgUPhWSssWsbOxA7+WU3cfSg+cKSu/
-pODab60Txy2OGMRyUBftHzZRehKf/KbWyFXg2+oW1iINosvrsroHki/bM9aiDOyJ
-KfGWQOUL5h8IUNYph6ggsuIXUCX/Uzbuf87mHe2zFmEYQqkXnqaGDaX8+ULIUEh0
-cjXrjP9N6JiIoLSz0IKzL+oZ19WsRzWWJDc0DHqi4E2Zp1VhhR5+aiN39QcT5lBc
-ZQAT9rVLW4wRw12vukHphB3xpHAWKMK+bthnOMWguopkbyfOY6CSmw==
------END CERTIFICATE-----
------BEGIN PRIVATE KEY-----
-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCuEUbv0YE03SNd
-VEDznIU1laaRV5Jcv+tANGnr28CGPHv/nNe6DkFXhBXNlPFIY1CcNJfuvr6wJ9j9
-zYrPhf8IHwfYKJYO5C3Qi9+o+kFHoKKALi5YAcxvQ1zC+4Sn/56Xu7OjH2Nkc41z
-3fR+ltdrs8viNVlV4OfjwEH4tg/FRkzNDpGA7+ND8HImEhC+g6LbIy20sQdasbMQ
-nAlpmEJ5gXdeIuRxR3AnFSynE8JtRFm0c8m7J3/W6D2Fuzb2y3E2EbGZGh0aFd3N
-ZX/NzBAASe0HLXsViL5zuh0VabzTAlXq3Cw/C80YV1l64wmyic3W5/aVxC6KUyuo
-loKUUwB3AgMBAAECggEABGfLiSZJmYeUmDgZrLtkDlx16sJx9zGkR+u2V+cn6D3U
-+uiCoo2EedfjSrYKT/AI35Xf19sGrc6ptJgPJfwY3aEWFxJv5HtB7ZVHWS98QiPT
-+QqHgb1fPzGlQgoQ7Bo8GVBW1joPz0Bdbsv0ntTn1CyowauNUe8Z71mzpxJ0iQ7u
-Z8LNoD7INEAZDBjHVov6pLGDHS9KFxGy20WG549mE37I4QxyxetJEgmuyhJkZOQ4
-noEWiCMQjGsSg4YuSc1GS1jAVf3p2g3/TiheD/31r1jleY/T5s2qYC6MJ4vY+7yA
-5sl7m8A47i0lHSKBdR3nWz+vXEsxB0nXK3Sulyt9AQKBgQDYRZ1nEe32CCZcWn/7
-nG+9e6XNOe9E25skuvY/uEpikt92kdnyZOgHFfwM9Nv+w2IWGLZ8MmDDJ6/4hGvj
-fJjcOUb3d/SJiivPvdRC9GYMrDUZe5AJ3p6fPqi4IeZOw7bMTcVB6aHAr9KoO//J
-2t0WNvwzkOyl6KlhaQEIDK8bOQKBgQDOCvWvUEg8nHaKcmN0uQaKuPvCorhnyqUT
-VFqLlSrYC79ffHCwp2y8nkFUnxpeHXENrtHtcrdnKBNkgGEn2l4xs63CjhKrBuIG
-bDjrtp3vKlHRhQjX6HkrEEuUk52wYzuX7CfU8nTZnrtV74MocOEewJVW+84Rtwiw
-vIUcgfgJLwKBgAbgj9TLOSntsGqXZiJ2Iwd/exI/mWAzK4fLejEkhxkDWp/Gm4ud
-sdMn28/9qVE8nU3ek073uyP5ixr3+wZM2/+EwsDzy47kGeiNPMa0Rtp4T2f0CeyG
-a7zcnTjduxkeGB3/CxrBdydNcAFxhvzAPO+L6BErtpq//0Ldt+6tmJPhAoGAFxEh
-Cjx5qdd2ae9+dO3V7qfg/5xJ+sy0CGL0NBZCEqfWB/GdiBlmUgOBmuCpCgpPwtFk
-jSm/oJva9/BrcBPBYd0Uweg37M+7dC6ffLwYGFNrj4JOSCWtkwWjAII6MCob3NlC
-aFOwg0CDBo7m5xskCNZUocVU/6S3I1onqNZgF18CgYAczBf1NS4VPZvebrutTBEH
-zyUX3XU9mR+dy0ncCGNVS8zYMtz7cweZInzNB2cTOfisIHzzdOnazm7D9uzPsREi
-pKgaL+ErWYDlGiDTxMtGSRPTWGocYBYdU6y/0bobhZb0qyvyRhpGvPK0ReMUuvqu
-FkNgoQ1lo0n6vawvxWW8Mw==
------END PRIVATE KEY-----

contrib/rcp/usage_example/certs/make_certs.sh

@@ -1,49 +0,0 @@
-#!/bin/bash
-EASYRSA=/usr/share/easy-rsa/easyrsa
-CA_NAME="example_ssl_rcp_ca_cert"
-
-export EASYRSA_PASSIN=pass:test
-export EASYRSA_PASSOUT=pass:test
-
-echo "Cleaning up..."
-rm -rf ./ca
-rm -rf ./*.pem
-rm -rf ./*.key
-rm -rf ./*.crt
-
-echo "Creating CA cert..."
-mkdir -p ./ca
-cd ./ca
-$EASYRSA init-pki
-cp ../vars ./pki/
-$EASYRSA --batch build-ca
-cp ./pki/ca.crt  ../$CA_NAME.crt
-
-echo "Creating server certs..."
-# Secures connection between RCP-Client and RCP-Server:
-$EASYRSA --batch --subject-alt-name="DNS:127.0.0.1,IP:127.0.0.1" build-server-full example_ssl_rcpc_rcps_cert nopass
-
-# Secures connection between RCP-Module and RCP-Server (module description):
-$EASYRSA --batch --subject-alt-name="DNS:127.0.0.1,IP:127.0.0.1" build-server-full example_ssl_rcpm_rcps_cert nopass
-
-# Secures connection between RCP-Server and RCP-Module (command execution):
-$EASYRSA --batch --subject-alt-name="DNS:127.0.0.1,IP:127.0.0.1" build-server-full example_ssl_rcps_rcpm_cert nopass
-
-echo "Collecting server certs..."
-cp ./pki/issued/* ../
-cp ./pki/private/* ../
-cd ..
-rm ./ca.key
-
-echo "Merging server certs..."
-for CRT in ./*.crt; do
-    CRT_NAME=`basename ${CRT%.*}`
-    if [ -f $CRT_NAME.key ]; then
-	cat $CRT_NAME.crt $CRT_NAME.key > $CRT_NAME.pem
-	rm $CRT_NAME.key
-	rm $CRT_NAME.crt
-    fi
-done
-
-echo "Finalizing..."
-rm -rf ./ca

contrib/rcp/usage_example/encrypt_card_data.sh

@@ -1,8 +0,0 @@
-#!/bin/bash
-. ./params.cfg
-
-PYTHONPATH=$PYSIM_DIR $PYSIM_DIR/contrib/csv-encrypt-columns.py \
-		      --csv-column-key kic:$CSV_COLUMN_KEY \
-		      --csv-column-key kid:$CSV_COLUMN_KEY \
-		      --csv-column-key kik:$CSV_COLUMN_KEY \
-		      card_data.csv

contrib/rcp/usage_example/params.cfg

@@ -1,36 +0,0 @@
-# Verbosity switch passed to all components (comment-out to disable verbose mode)
-#VERBOSE="--verbose"
-
-# PYSIM_DIR passed to all components
-PYSIM_DIR=../../../ # Points to the psyim top directory
-
-# CSV column key to decrypt KIC, KID and KIK in csv_data.csv.encr
-# (use encrypt_card_data.sh to regenerate csv_data.csv.encr from csv_data.csv)
-CSV_COLUMN_KEY="00112233445566778899AABBCCDDEEFF"
-
-# PCSC reader that the RCP Client shall use
-PCSC_READER=0
-
-# CA of the certificates used in this example
-CERT_DIR="./certs"
-CA_CERT="$CERT_DIR/example_ssl_rcp_ca_cert.crt"
-
-# Network interface where RCP Clients connect
-RCPC_SERVER_PORT=8000
-RCPC_SERVER_ADDR="127.0.0.1"
-RCPC_SERVER_CERT="$CERT_DIR/example_ssl_rcpc_rcps_cert.pem"
-RCPC_SERVER_URI="wss://$RCPC_SERVER_ADDR:$RCPC_SERVER_PORT"
-
-# Network interface where RCP Modules connect
-RCPM_SERVER_PORT=8010
-RCPM_SERVER_ADDR="127.0.0.1"
-RCPM_SERVER_CERT="$CERT_DIR/example_ssl_rcpm_rcps_cert.pem"
-RCPM_SERVER_URI="wss://$RCPM_SERVER_ADDR:$RCPM_SERVER_PORT"
-
-# Network interface where the (example) RCP Module binds its Command Server to.
-# The command server is used by the RCP Server to run the command requested
-# by the user. Each module needs a dedicated port. The address and port is
-# automatically forwarded to the RCP Server.
-RCPM_CMD_SERVER_PORT=8020
-RCPM_CMD_SERVER_ADDR="127.0.0.1"
-RCPM_CMD_SERVER_CERT="$CERT_DIR/example_ssl_rcps_rcpm_cert.pem"

contrib/rcp/usage_example/rcp_module.py

@@ -1,130 +0,0 @@
-#!/usr/bin/env python3
-
-# (C) 2026 by sysmocom - s.f.m.c. GmbH
-# All Rights Reserved
-#
-# Author: Philipp Maier
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import logging
-from pathlib import Path
-from pySim.log import PySimLogger
-from argparse import Namespace
-from pySim.global_platform import GpCardKeyset, SCP02, ADF_SD
-from Cryptodome.Random import get_random_bytes
-from osmocom.utils import h2b, b2h
-from rcp_module_utils import rcpm_setup_argparse, rcpm_run_module, RcpModule, RcpModuleHdlr
-
-log = PySimLogger.get(Path(__file__).stem)
-option_parser = rcpm_setup_argparse("Example Module")
-
-class ExmpleModule(RcpModule):
-
-    def __init__(self, *args, **kwargs):
-        log.info("rcpm_run_module was called with the following additional arguments:")
-        log.info("%s, %s", str(args), str(kwargs))
-
-    name = 'rcp_module'
-    cmd_descr = [{'name' : 'reset',
-                  'help': 'reset the card',
-                  'args' : []},
-                 {'name' : 'read_binary',
-                  'help': 'read binary data from a transparent file.',
-                  'args' : [{ 'name' : '--fid',
-                               'spec' : {'required' : True,
-                                         'help' : 'File identifier to of the file to read',
-                                         'action' : 'append',
-                                         'pytype' : 'str'},
-                             }
-                            ]},
-                 {'name' : 'read_record',
-                  'help': 'read binary data from a transparent file.',
-                  'args' : [{ 'name' : '--fid',
-                               'spec' : {'required' : True,
-                                         'help' : 'File identifier to of the file to read',
-                                         'action' : 'append',
-                                         'pytype' : 'str'},
-                             },
-                            { 'name' : '--record',
-                               'spec' : {'required' : True,
-                                         'help' : 'File record to read',
-                                         'default' : 1,
-                                         'pytype' : 'int'},
-                              }
-                            ]},
-                 {'name' : 'unlock_aram',
-                  'help': 'unlock a locked ARA-M applet on a sysmoISIM-SJA5',
-                  'args' : [],
-                  'get_keys' : {'uicc' : ['KIC', 'KID', 'KIK']}}
-                 ]
-    suitable_for = [{'atr' : '3b9f96801f878031e073fe211b674a357530350265f8'}]
-
-    def cmd_reset(self, hdlr: RcpModuleHdlr) -> int:
-        hdlr.print("resetting UICC/eUICC ...")
-        hdlr.card._scc.reset_card()
-        hdlr.print("ATR is: %s" % hdlr.card._scc.get_atr())
-        return 0
-
-    def cmd_read_binary(self, hdlr: RcpModuleHdlr) -> int:
-        fid = hdlr.cmd_args.fid
-        hdlr.print("reading transparent file: %s ..." % fid)
-        (res, _) = hdlr.card._scc.read_binary(fid)
-        hdlr.print("file content is: %s" % res)
-        return 0
-
-    def cmd_read_record(self, hdlr: RcpModuleHdlr) -> int:
-        fid = hdlr.cmd_args.fid
-        record = hdlr.cmd_args.record
-        hdlr.print("reading linear-fixed file: %s ..." % fid)
-        (res, _) = hdlr.card._scc.read_record(fid, record)
-        hdlr.print("file content is: %s" % res)
-        return 0
-
-    def cmd_unlock_aram(self, hdlr: RcpModuleHdlr) -> int:
-        # Select ADF.ISD
-        hdlr.print("Selecting ADF.ISD ...")
-        hdlr.lchan.scc.send_apdu_checksw("00a4040408a00000000300000000")
-
-        # Establish secure channel
-        hdlr.print("Establishing secure channel ...")
-        key_ver = 112
-        key_enc = hdlr.keys_uicc['KIC']
-        key_mac = hdlr.keys_uicc['KID']
-        key_dek = hdlr.keys_uicc['KIK']
-        security_level = 3
-        host_challenge_len = 8
-        host_challenge = get_random_bytes(host_challenge_len)
-        kset = GpCardKeyset(key_ver, h2b(key_enc), h2b(key_mac), h2b(key_dek))
-        scp = SCP02(card_keys=kset)
-        ADF_SD.establish_scp(hdlr.lchan.scc, scp, host_challenge, security_level)
-
-        # To prove that it works, we need to do something that actually requires to be authenticated
-        # via a secure channel. In this example we will send an unlock command to the ARA-M applet
-        # found on any sysmoISIM-SJA5 card. (see also: https://gitea.osmocom.org/sim-card/aram-applet)
-        hdlr.print("Unlocking ARA-M applet ...")
-        ara_m_aid = "a00000015141434c00"
-        ADF_SD.install(hdlr.lchan.scc, 0x20, 0x00, "0000%02x%s000000" % (len(ara_m_aid) // 2, ara_m_aid))
-        ADF_SD.store_data(hdlr.lchan.scc, h2b("A2"), structure = 'ber_tlv')
-
-        # Release the secure channel
-        hdlr.print("Done, releasing secure channel ...")
-        ADF_SD.release_scp(hdlr.lchan.scc)
-        return 0
-
-if __name__ == '__main__':
-    opts = option_parser.parse_args()
-    rcpm_run_module(opts, ExmpleModule,
-                    "arg1", "arg2", "arg3",
-                    kwarg1="kwarg1", kwarg2="kwarg2", kwarg3="kwarg3")

contrib/rcp/usage_example/readme.txt

@@ -1,16 +0,0 @@
-How to try:
-
-Go to the directory that contains the usage example:
-cd pysim/contrib/rcp/usage_example
-
-Edit card_data.csv to fill in the SCP02 keys for the ISD of your sysmoISIM-SJA5
-
-Start the RCP Server:
-./start_rcp_server.sh
-
-Start the RCP Module:
- ./start_rcp_module.sh
-
-Run the exmple scripts:
-./run_rcp_client.sh
-(it is also possible to call the run_rcp_client_*.sh scripts individually)

contrib/rcp/usage_example/run_rcp_client.sh

@@ -1,29 +0,0 @@
-#!/bin/bash
-
-echo "basic help"
-echo "===================================================================================="
-./run_rcp_client_help.sh
-echo "===================================================================================="
-echo ""
-echo ""
-
-echo "help for which commands are available"
-echo "===================================================================================="
-./run_rcp_client_help_cmd.sh
-echo "===================================================================================="
-echo ""
-echo ""
-
-echo "help for specific commands"
-echo "===================================================================================="
-./run_rcp_client_help_cmd_specific.sh
-echo "===================================================================================="
-echo ""
-echo ""
-
-echo "run specific RCP commands"
-echo "===================================================================================="
-./run_rcp_client_cmd.sh
-echo "===================================================================================="
-echo ""
-echo ""

contrib/rcp/usage_example/run_rcp_client_cmd.sh

@@ -1,28 +0,0 @@
-#!/bin/bash
-. ./params.cfg
-
-set -x
-
-PYTHONPATH=$PYSIM_DIR $PYSIM_DIR/contrib/rcp/rcp_client.py $VERBOSE \
-		      --uri $RCPC_SERVER_URI\
-		      --ca-cert $CA_CERT \
-		      -p $PCSC_READER \
-		      rcp_module_reset
-
-PYTHONPATH=$PYSIM_DIR $PYSIM_DIR/contrib/rcp/rcp_client.py $VERBOSE \
-		      --uri $RCPC_SERVER_URI \
-		      --ca-cert $CA_CERT \
-		      -p $PCSC_READER \
-		      rcp_module_read_binary --fid 3f00 --fid 2fe2
-
-PYTHONPATH=$PYSIM_DIR $PYSIM_DIR/contrib/rcp/rcp_client.py $VERBOSE \
-		      --uri $RCPC_SERVER_URI \
-		      --ca-cert $CA_CERT \
-		      -p $PCSC_READER \
-		      rcp_module_read_record --fid 3f00 --fid 2f00 --record 1
-
-PYTHONPATH=$PYSIM_DIR $PYSIM_DIR/contrib/rcp/rcp_client.py $VERBOSE \
-		      --uri $RCPC_SERVER_URI \
-		      --ca-cert $CA_CERT \
-		      -p $PCSC_READER \
-		      rcp_module_unlock_aram

contrib/rcp/usage_example/run_rcp_client_help.sh

@@ -1,6 +0,0 @@
-#!/bin/bash
-. ./params.cfg
-
-set -x
-PYTHONPATH=$PYSIM_DIR $PYSIM_DIR/contrib/rcp/rcp_client.py $VERBOSE \
-		      -h

contrib/rcp/usage_example/run_rcp_client_help_cmd.sh

@@ -1,9 +0,0 @@
-#!/bin/bash
-. ./params.cfg
-
-set -x
-PYTHONPATH=$PYSIM_DIR $PYSIM_DIR/contrib/rcp/rcp_client.py $VERBOSE \
-		      --uri $RCPC_SERVER_URI \
-		      --ca-cert $CA_CERT \
-		      -p $PCSC_READER \
-		      -h

contrib/rcp/usage_example/run_rcp_client_help_cmd_specific.sh

@@ -1,28 +0,0 @@
-#!/bin/bash
-. ./params.cfg
-
-set -x
-
-PYTHONPATH=$PYSIM_DIR $PYSIM_DIR/contrib/rcp/rcp_client.py $VERBOSE \
-		      --uri $RCPC_SERVER_URI \
-		      --ca-cert $CA_CERT \
-		      -p $PCSC_READER \
-		      rcp_module_reset --help
-
-PYTHONPATH=$PYSIM_DIR $PYSIM_DIR/contrib/rcp/rcp_client.py $VERBOSE \
-		      --uri $RCPC_SERVER_URI \
-		      --ca-cert $CA_CERT \
-		      -p $PCSC_READER \
-		      rcp_module_read_binary --help
-
-PYTHONPATH=$PYSIM_DIR $PYSIM_DIR/contrib/rcp/rcp_client.py $VERBOSE \
-		      --uri $RCPC_SERVER_URI \
-		      --ca-cert $CA_CERT \
-		      -p $PCSC_READER \
-		      rcp_module_read_record --help
-
-PYTHONPATH=$PYSIM_DIR $PYSIM_DIR/contrib/rcp/rcp_client.py $VERBOSE \
-		      --uri $RCPC_SERVER_URI \
-		      --ca-cert $CA_CERT \
-		      -p $PCSC_READER \
-		      rcp_module_unlock_aram --help

contrib/rcp/usage_example/start_rcp_module.sh

@@ -1,14 +0,0 @@
-#!/bin/bash
-. ./params.cfg
-
-set -x
-PYTHONPATH=$PYSIM_DIR:$PYSIM_DIR/contrib/rcp ./rcp_module.py $VERBOSE \
-					     --uri $RCPM_SERVER_URI \
-					     --rcps-ca-cert $CA_CERT \
-					     --rcpm-cmd-server-addr $RCPM_CMD_SERVER_ADDR \
-					     --rcpm-cmd-server-port $RCPM_CMD_SERVER_PORT \
-					     --rcpm-cmd-server-cert $RCPM_CMD_SERVER_CERT \
-					     --column-key kic:$CSV_COLUMN_KEY \
-					     --column-key kid:$CSV_COLUMN_KEY \
-					     --column-key kik:$CSV_COLUMN_KEY
-

contrib/rcp/usage_example/start_rcp_server.sh

@@ -1,13 +0,0 @@
-#!/bin/bash
-. ./params.cfg
-
-set -x
-PYTHONPATH=$PYSIM_DIR $PYSIM_DIR/contrib/rcp/rcp_server.py $VERBOSE \
-		      --rcpc-server-addr $RCPC_SERVER_ADDR \
-		      --rcpc-server-port $RCPC_SERVER_PORT \
-		      --rcpc-server-cert $RCPC_SERVER_CERT \
-		      --rcpm-server-addr $RCPM_SERVER_ADDR \
-		      --rcpm-server-port $RCPM_SERVER_PORT \
-		      --rcpm-server-cert $RCPM_SERVER_CERT \
-		      --rcpm-module-ca-cert $CA_CERT \
-		      --csv ./card_data.csv.encr

docs/conf.py

@@ -14,8 +14,6 @@ import os
 import sys
 sys.path.insert(0, os.path.abspath('..'))
 sys.path.insert(0, os.path.abspath('.'))   # for local extensions (pysim_fs_sphinx, ...)
-sys.path.insert(0, os.path.abspath('../contrib/rcp'))  # for argparse
-sys.path.insert(0, os.path.abspath('../contrib/rcp/usage_example'))  # for argparse
 
 
 # -- Project information -----------------------------------------------------
@@ -44,7 +42,6 @@ extensions = [
         "sphinx.ext.autosectionlabel",
         "sphinx.ext.napoleon",
         "pysim_fs_sphinx",
-        "sphinx.ext.graphviz",
 ]
 
 # Add any paths that contain templates here, relative to this directory.

docs/index.rst

@@ -50,7 +50,6 @@ pySim consists of several parts:
    suci-keytool
    saip-tool
    smpp-ota-tool
-   rcpf
 
 
 Indices and tables

docs/rcpf.rst

@@ -1,690 +0,0 @@
-Remote Card Procedure Framework
-===============================
-
-The Remote Card Procedure Framework `(RCPF)` is a modular system to provide
-custom, remote controlled, procedures to card `(UICC or eUICC)` holders. The
-card holder uses a minimal client program `(RCP Client)` together with a PC/SC
-reader. The client program will then connect to a remote server `(RCP Server)`.
-The remote server maintains connections to custom modules `(RCP Modules)`, where
-each module implements a set of procedures (commands). Based on an internal list,
-the remote server will offer a set of suitable commands to the client. The card
-holder may then chose a command to request the execution of a specific remote
-card procedure. The server will make the connection to the matching module and
-act as a proxy between the module and the client program.
-
-.. graphviz::
-
-   digraph foo {
-
-      subgraph cluster_server {
-         label = "server (card issuer)"
-         RCPS [label = "RCP Server"];
-         RCPM [label = "RCP Module"];
-	 CKP [label = "CardKeyProvider"];
-      }
-
-      subgraph cluster_field {
-         label = "field (card holder)"
-         ICC [label = "UICC/eUICC"];
-         RCPC [label = "RCP Client"];
-      }
-
-      RCPC -> ICC [label="PC/SC, APDU"];
-      RCPC -> RCPS [label="WS, JSON"];
-      RCPS -> CKP [label="pgSQL or CSV"];
-      RCPS -> RCPM [label="WS, JSON", headlabel="n", taillabel="1", dir=both];
-
-   }
-
-in case the procedure requires a secure channel, the key material is retrieved
-using a `CardKeyProvider` [1]. Since the retrieval of the key material
-as well as the secure channel establishment happens internally, the related
-key material is never disclosed to the client side.
-
-This solves a major problem many card deployments suffer from: Due to security
-reasons it is not always be possible to disclose key material to the card
-holder. This becomes a problem in case card contents have to be modified after
-the card had been deployed. This often means that the card issuer has to
-physically replace the already deployed cards. With `RCPF`, the card issuer can
-replace this process by deploying a suitable `RCP Module` on his server to offer
-a fix-up procedure that the card holder can call remotely.
-
-[1] :ref:`Retrieving card-individual keys via CardKeyProvider`
-
-In the following we will describe the system components in further detail. We
-will also give an introduction on how to implement custom `RCP Modules`
-
-RCP Server
-~~~~~~~~~~
-
-The `RCP Server` is the core component in the overall system. It acts as a proxy
-between the `RCP Modules` (see below) and the `RCP Client` (see below). The
-`RCP Server` is permanently aware of which `RCP Modules` are available and knows
-their properties. With this knowledge, the `RCP Server` is able to check which
-module provides suitable procedures for a specific card type.
-
-Another responsibility of the `RCP Server` is to retrieve the key material using
-the `CardKeyProvider`. As far as the `CardKeyProvider` is concerned, the RCP
-Server takes the exact same commandline options as `pySim-shell.py`. However, in
-case column encryption is used. The decryption key shall be passed to the
-`RCP Module` instead to the `RCP Server`. This moves the decryption to the point
-where the key material is actually needed.
-
-To ensure the privacy of the traffic exchanged between `RCP Client`,
-`RCP Server` and the `RCP Modules`, all links use SSL/TLS encrypted channels.
-This is in particular relevant for the `RCP Client` which usually connects to
-the `RCP Server` via the public internet.
-
-Since the `RCP Server` is exposed to the public internet, it also requires some
-level of protection against malicious requests. To minimize the risk arising
-from malformed requests, each incoming and outgoing message is validated against
-a JSON schema (also on the internal interfaces). Incoming requests from the
-`RCP Client` side are also rate-limited to guard against excessive requests
-(DoS).
-
-To monitor the `RCP Client` requests, the `RCP Server` supports logging to an
-`OpenObserve` monitoring entity. For each request exactly one report es
-generated and sent to `OpenObserve`. For successful request, this report will
-only contain metadata. In case of crashes or when the return code of the
-`RCP Module` procedure is not 0, a full debug log is included as well.
-
-.. argparse::
-   :module: contrib.rcp.rcp_server
-   :func: option_parser
-   :prog: contrib/rcp/rcp_server.py
-
-
-RCP Client
-~~~~~~~~~~
-
-The `RCP Client` is used in the field by the card holder to request command
-lists and to request the execution of procedures from the `RCP Server`.
-
-The execution of a procedure is usually done in two steps. In the first step,
-the card holder will request a list with available commands using the `--help`
-option. The command list is then requested from the `RCP Server` displayed as
-a regular commandline help-screen. The list will only contain commands, which
-are actually suitable for the specific card type/model that card holder owns.
-
-In the second step, the card holder will choose a command to request the
-execution of the related procedure. In case the user already knows exactly
-which command to execute, the first step may also be skipped. The request of
-command lists for the purpose of displaying commandline help-screens is
-entirely optional.
-
-To avoid having to upgrade the `RCP Client` too often, the implementation is kept
-as simple as possible. Technically, the RCP Client is not much more than a
-proxy between a PC/SC-Reader and the `RCP Server`. All higher level tasks, like
-requesting the ICCID (UICC or eSIM) or the EID (eUICC) are implemented on the
-server side.
-
-.. argparse::
-   :module: contrib.rcp.rcp_client
-   :func: option_parser
-   :prog: contrib/rcp/rcp_client.py
-
-
-RCP Module
-~~~~~~~~~~
-
-The processing chain terminates at one of multiple `RCP Modules`. The `RCP Module`
-is the custom implementation that implements one or more procedures. The
-framework is designed in such a way that `RCP Modules` have minimal boilerplate
-code. The implementation is kept simple. Users, which are familiar with
-`pySim-shell.py` and its API will find the implementation of custom `RCP Modules`
-as simple as implementing a new `pySim-shell.py` command.
-
-From inside a procedure, the API user has access to the same objects (rs, card,
-lchan) that are also usually available in `pySim-shell.py` environment.
-
-To reset the card, retrieve the ATR and to exchange APDUs, the `pySim.transport`
-API together with a custom `LinkBase (RcpsSimLink)` object is used. This means
-that all modules which depend on the `pySim.transport` API can be used without
-modification.
-
-A procedure always runs in a dedicated thread, which means no special
-precautions are necessary. A procedure may wait or sleep without disturbing
-other requests.
-
-Even though there are similarities to `pySim-shell` one has to keep in mind that
-`RCP Modules` are intended to run non-interactively, which means they naturally
-do not provide any support for `cmd2` API calls. This means that before code
-from `pySim-shell` commands can be re-used, any `cmd2` entanglement must be
-removed or separated otherwise.
-
-.. argparse::
-   :module: contrib.rcp.usage_example.rcp_module
-   :func: option_parser
-   :prog: contrib/rcp/usage_example/rcp_module.py
-
-
-Usage Example
-~~~~~~~~~~~~~
-
-All system components and related modules can be found in `contrib/rcp`. The
-sub directory `usage_example` contains an example `RCP Module` and scripts to
-make it easier to get started. The following steps explain in detail how to get
-the `usage_example` running.
-
-Parameters
-----------
-
-The `usage_example` contains a file `params.cfg`. This file contains variables,
-which hold the parameters for the shell-scripts included in the example. The
-parameters set up the system in such a way that everything runs locally.
-Normally no changes are required, but it is strongly advised to review the
-parameters to verify there are no clashes with other services.
-
-Preparing Card Keys
--------------------
-
-The example assumes a PC/SC reader and a `sysmoISIM-SJA5` or similar. To run
-the `usage_example`, no modification to the card itself are required, but the
-example key material (SCP02) in `card_data.csv` must match the test card.
-
-The following example assumes that the card has the ICCID ``8949440000001155306``
-and the following SCP02 keys:
-
-+---------+----------------------------------+
-| Keyname | Keyvalue                         |
-+=========+==================================+
-| ENC/KIC | F09C43EE1A0391665CC9F05AF4E0BD10 |
-+---------+----------------------------------+
-| MAC/KID | 01981F4A20999F62AF99988007BAF6CA |
-+---------+----------------------------------+
-| DEK/KIK | 8F8AEE5CDCC5D361368BC45673D99195 |
-+---------+----------------------------------+
-
-This would result into a `card_data.csv` file with the following content:
-
-::
-
-   iccid,kic,kid,kik
-   8949440000001155306,F09C43EE1A0391665CC9F05AF4E0BD10,01981F4A20999F62AF99988007BAF6CA,8F8AEE5CDCC5D361368BC45673D99195
-
-
-See also: :ref:`Retrieving card-individual keys via CardKeyProvider` and :ref:`Guide: Managing GP Keys`
-
-When `card_data.csv` is re-aligned, the columns containing key material need to
-be encrypted. This is done by running `encrypt_card_data.sh`. This script will
-output a file `card_data.csv.encr` which contains the encrypted key material.
-
-Running the RCP Server
-----------------------
-
-The `RCP Server` can be started using the included `start_rcp_server.sh` script.
-
-::
-
-   $ ./start_rcp_server.sh
-   + PYTHONPATH=../../../
-   + ../../..//contrib/rcp/rcp_server.py --rcpc-server-addr 127.0.0.1 --rcpc-server-port 8000 --rcpc-server-cert ./certs/example_ssl_rcpc_rcps_cert.pem --rcpm-server-addr 127.0.0.1 --rcpm-server-port 8010 --rcpm-server-cert ./certs/example_ssl_rcpm_rcps_cert.pem --rcpm-module-ca-cert ./certs/example_ssl_rcp_ca_cert.crt --csv ./card_data.csv.encr
-   INFO: loading SSL/TLS CA certificate (RCP Module Command Server Client): ./certs/example_ssl_rcp_ca_cert.crt
-   INFO: Using CSV file as card key data source: ./card_data.csv.encr
-   WARNING: Reporting to OpenObserve: (disabled)
-   INFO: Rate-Limit: max 10 requests per sec.
-   INFO: RCP Client Server at: 127.0.0.1:8000
-   INFO: RCP Module server at: 127.0.0.1:8010
-
-We can see that now to ports have been opened. `127.0.0.1:8000` is the port
-where `RCP Clients` can connect. In a productive setup, this port would
-normally be reachable from outside. The other port on `127.0.0.1:8010` is
-accepting connections from `RCP Modules` This port should not be reachable
-from the outside. It is intended to be used for the interprocess communication
-between the `RCP Server` and the `RCP Modules`
-
-In this state, the `RCP Server` waits for requests from both `RCP Clients` and
-`RCP Modules`. However, there are not `RCP Modules` registered yet, so any
-request from an `RCP Client` would be quilted with an error message.
-
-Running the RCP Module
-----------------------
-
-For a functioning setup a suitable `RCP Module` is needed. The provided
-`rcp_module.py` python program implements a few procedures which are suitable
-for a `sysmoISIM-SJA5` card.
-
-We can start the `RCP Module` with the provided start script
-`start_rcp_module.sh`
-
-::
-
-   $ ./start_rcp_module.sh
-   + PYTHONPATH=../../../:../../..//contrib/rcp
-   + ./rcp_module.py --uri wss://127.0.0.1:8010 --rcps-ca-cert ./certs/example_ssl_rcp_ca_cert.crt --rcpm-cmd-server-addr 127.0.0.1 --rcpm-cmd-server-port 8020 --rcpm-cmd-server-cert ./certs/example_ssl_rcps_rcpm_cert.pem --column-key kic:00112233445566778899AABBCCDDEEFF --column-key kid:00112233445566778899AABBCCDDEEFF --column-key kik:00112233445566778899AABBCCDDEEFF
-   INFO: RCP Module startup: rcp_module
-   INFO: loading SSL/TLS CA certificate (RCPM Server Client): ./certs/example_ssl_rcp_ca_cert.crt
-   INFO: RCPC command server at: 127.0.0.1:8020
-
-The `RCP Module` is now connected to the `RCP Server`. The log output of the
-`RCP Server` also confirms that there is a new `RCP Module` available.
-
-::
-
-   INFO: new RCP module, RCP modules available: 'rcp_module'
-
-On the output of the `RCP Module` we can see that the `RCP Module` has
-opened another port on `127.0.0.1:8020`. This is where the `RCP Module` accepts
-dedicated connections from the `RCP Server` when an `RCP Client` requests a
-procedure. In an installation with multiple `RCP Modules`, each `RCP Module`
-must use a dedicated port number.
-
-Note that we also pass the column key for the key material using the
-`--column-key` parameter. This parameter works exactly as in `pySim-shell`.
-We supply the column key to the `RCP Module` and not to the `RCP Server`
-move the decryption as close as possible to where it is needed.
-
-
-Running the RCP Client
-----------------------
-
-The `usage_example` provides a shell-script `run_rcp_client.sh` that which
-requests commandline help and requests procedures by calling other scripts.
-However to get an understanding on how the `RCP Client` is supposed to be used,
-it makes more sense to call the sub scripts individually. We will now go through
-step by step.
-
-The first shell-script `./run_rcp_client_help.sh` assumes that the card holder
-uses the `RCP Client` for the first time. He does not know which commandline
-arguments are available, so he just calls `rcp_client.py` with the option `-h`.
-
-::
-
-   $ ./run_rcp_client_help.sh
-   + PYTHONPATH=../../../
-     + ../../..//contrib/rcp/rcp_client.py -h
-       usage: rcp_client.py [-h] [-d DEV] [-b BAUD] [--pcsc-shared] [-p PCSC | --pcsc-regex REGEX] [--modem-device DEV] [--modem-baud BAUD] [--osmocon PATH]
-                     [--apdu-trace] [--verbose] [--uri URI] [--ca-cert CA_CERT]
-
-   RCP Client
-
-   options:
-     -h, --help            show this help message and exit
-     --apdu-trace          Trace the command/response APDUs exchanged with the card (default: False)
-     --verbose             Enable verbose logging (default: False)
-     --uri URI             URI of the RCP-Server (default: None)
-     --ca-cert CA_CERT     SSL/TLS CA-Certificate of the RCP-Server (default: None)
-     ...
-
-   PC/SC Reader:
-     Use a PC/SC card reader to talk to the SIM card. PC/SC is a standard API for how applications access smart card readers, and is available on a variety of
-     operating systems, such as Microsoft Windows, MacOS X and Linux. Most vendors of smart card readers provide drivers that offer a PC/SC interface, if not even
-     a generic USB CCID driver is used. You can use a tool like ``pcsc_scan -r`` to obtain a list of readers available on your system.
-
-     --pcsc-shared         Open PC/SC reaer in SHARED access (default: EXCLUSIVE) (default: False)
-     -p, --pcsc-device PCSC
-                           Number of PC/SC reader to use for SIM access (default: None)
-     --pcsc-regex REGEX    Regex matching PC/SC reader to use for SIM access (default: None)
-     ...
-
-
-From the output the card holder learns that there is an `--uri` parameter and
-that the same PC/SC options like in `pySim-shell.py` are supported. There is
-also a `--ca-cert` parameter where a CA certificate can be supplied in case the
-`RCP Server` uses a self-signed CA (which applies to this example)
-
-The second script `run_rcp_client_help_cmd.sh` assumes that the card holder now
-knows that the minimum required parameters are the `--uri` of the `RCP Server`,
-the `--ca-cert` of the `RCP Server` and `-p` to tell the `RCP Client` which PC/SC
-reader to use.
-
-::
-
-   $ ./run_rcp_client_help_cmd.sh
-   + PYTHONPATH=../../../
-   + ../../..//contrib/rcp/rcp_client.py --uri wss://127.0.0.1:8000 --ca-cert ./certs/example_ssl_rcp_ca_cert.crt -p 0 -h
-   INFO: loading SSL/TLS CA certificate (RCP Server CA): ./certs/example_ssl_rcp_ca_cert.crt
-   INFO: Using reader PCSC[Alcor Micro AU9540 00 00]
-   INFO: Detected Card with ATR: 3B9F96801F878031E073FE211B674A357530350265F8
-   INFO: RCP Server URI: wss://127.0.0.1:8000
-   INFO: Checking version ...
-   INFO: RCP Client version: software=1.0.0, protocol=1.0.0
-   INFO: RCP Server version: software=1.0.0, protocol=1.0.0
-   INFO: Requesting module descriptions from RCP Server ...
-   usage: rcp_client.py [-h] [-d DEV] [-b BAUD] [--pcsc-shared] [-p PCSC | --pcsc-regex REGEX] [--modem-device DEV] [--modem-baud BAUD] [--osmocon PATH]
-                     [--apdu-trace] [--verbose] [--uri URI] [--ca-cert CA_CERT]
-                     {rcp_module_reset,rcp_module_read_binary,rcp_module_read_record,rcp_module_unlock_aram} ...
-
-   RCP Client
-
-   positional arguments:
-     {rcp_module_reset,rcp_module_read_binary,rcp_module_read_record,rcp_module_unlock_aram}
-                           RCP command to use
-       rcp_module_reset    reset the card
-       rcp_module_read_binary
-                           read binary data from a transparent file.
-       rcp_module_read_record
-                           read binary data from a transparent file.
-       rcp_module_unlock_aram
-                           unlock a locked ARA-M applet on a sysmoISIM-SJA5
-   ...
-
-The help screen now shows additional positional arguments. Those positional
-arguments are the commands which the card holder can use to request a
-procedure. In this example we have four procedures we can call:
-`rcp_module_reset`, `rcp_module_read_binary`, `rcp_module_read_record`,
-and `rcp_module_unlock_aram`
-
-In the log output above the help screen, we can also see that a connection was
-made and that the `RCP Client` has requested module descriptions from the
-server. The `RCP Client` has sent the ATR of the card to the `RCP Server`. The
-`RCP Server` has used this information to look through its internal list to
-find modules which offer procedures suitable for this specific card.
-
-The card holder now knows which commands or procedures are available, but he
-still does not know if arguments are required and what those arguments are.
-The third script `run_rcp_client_help_cmd_specific.sh` shows how the card
-holder can request a dedicated help-screen for each of the commands.
-
-::
-
-   $ ./run_rcp_client_help_cmd_specific.sh
-   ...
-   + PYTHONPATH=../../../
-   + ../../..//contrib/rcp/rcp_client.py --uri wss://127.0.0.1:8000 --ca-cert ./certs/example_ssl_rcp_ca_cert.crt -p 0 rcp_module_read_record --help
-   INFO: loading SSL/TLS CA certificate (RCP Server CA): ./certs/example_ssl_rcp_ca_cert.crt
-   INFO: Using reader PCSC[Alcor Micro AU9540 00 00]
-   INFO: Detected Card with ATR: 3B9F96801F878031E073FE211B674A357530350265F8
-   INFO: RCP Server URI: wss://127.0.0.1:8000
-   INFO: Checking version ...
-   INFO: RCP Client version: software=1.0.0, protocol=1.0.0
-   INFO: RCP Server version: software=1.0.0, protocol=1.0.0
-   INFO: Requesting module descriptions from RCP Server ...
-   usage: rcp_client.py rcp_module_read_record [-h] --fid FID --record RECORD
-
-   options:
-     -h, --help       show this help message and exit
-     --fid FID        File identifier to of the file to read
-     --record RECORD  File record to read
-   ...
-
-We can see in the log that the `RCP Client` again sends a request to the
-`RCP Server` and retrieves the `RCP Module` descriptions. Then a dedicated
-help-screen for the `rcp_module_read_record` command is displayed. Now the card
-holder knows which parameters are required to perform the related procedure.
-
-Until this point there was only interaction with the `RCP Client` and the
-`RCP Server`. The `RCP Module` has not seen any requests yet. The provided
-script `run_rcp_client_cmd.sh` illustrates how the card holder can run an
-command that performs an actual procedure with the `RCP Module`.
-
-::
-
-   $ ./run_rcp_client_cmd.sh
-   ...
-   + PYTHONPATH=../../../
-   + ../../..//contrib/rcp/rcp_client.py --uri wss://127.0.0.1:8000 --ca-cert ./certs/example_ssl_rcp_ca_cert.crt -p 0 rcp_module_read_record --fid 3f00 --fid 2f00 --record 1
-   INFO: loading SSL/TLS CA certificate (RCP Server CA): ./certs/example_ssl_rcp_ca_cert.crt
-   INFO: Using reader PCSC[Alcor Micro AU9540 00 00]
-   INFO: Detected Card with ATR: 3B9F96801F878031E073FE211B674A357530350265F8
-   INFO: RCP Server URI: wss://127.0.0.1:8000
-   INFO: Checking version ...
-   INFO: RCP Client version: software=1.0.0, protocol=1.0.0
-   INFO: RCP Server version: software=1.0.0, protocol=1.0.0
-   INFO: Requesting module descriptions from RCP Server ...
-   INFO: Executing command with RCP Server ...
-   INFO: RcpcCltConnHdlr(140335960510480) -- reading linear-fixed file: ['3f00', '2f00'] ...
-   INFO: RcpcCltConnHdlr(140335960510480) -- file content is: 61294F10A0000000871002FFFFFFFF890709000050055553696D31730EA00C80011781025F608203454150
-   INFO: Command execution done, rc: 0
-
-The example reads record 1 from the file ``3F00/2F00`` and returns the file
-content. We also can see by the return code that the procedure was successful.
-The return code is also passed to `sys.exit()`, so that the card holder can
-use it in a script.
-
-The APDUs required to perform this action were entirely generated under the
-control of the `RCP Module`. In the log of the `RCP Server` we can see which
-command was executed on which `RCP Module` was used. We also see the return
-code here as well.
-
-::
-
-   ...
-   INFO: RcpcSrvConnHdlr(140093766623552) -- executing procedure for command "rcp_module_read_record" on module "rcp_module" at: wss://127.0.0.1:8020
-   INFO: RcpcSrvConnHdlr(140093766623552) -- command execution done, rc: 0
-   ...
-
-In the log of the `RCP Module` we can follow up on how the procedure was
-carried out.
-
-::
-
-   ...
-   INFO: RcpmCmdSrvConnHdlr(140156091028880) -- executing command: rcp_module_read_record ['--fid', '3f00', '--fid', '2f00', '--record', '1']
-   INFO: Waiting for card...
-   INFO: Card is of type: UICC
-   INFO: Detected UICC Add-on "SIM"
-   INFO: Detected UICC Add-on "GSM-R"
-   INFO: Detected UICC Add-on "RUIM"
-   WARNING: EF.DIR seems to be empty!
-   INFO:  ADF.ISD: a000000003000000
-   INFO:  ARA-M: a00000015141434c00
-   INFO:  ISIM: a0000000871004
-   INFO:  USIM: a0000000871002
-   INFO: Detected CardModel: SysmocomSJA5
-   INFO: RcpmCmdSrvConnHdlr(140156091028880) -- reading linear-fixed file: ['3f00', '2f00'] ...
-   INFO: RcpmCmdSrvConnHdlr(140156091028880) -- file content is: 61294F10A0000000871002FFFFFFFF890709000050055553696D31730EA00C80011781025F608203454150
-   INFO: RcpmCmdSrvConnHdlr(140156091028880) -- command execution done, rc: 0
-   ...
-
-In first line we see the command and its parameters. The lines that follow will
-look familiar to `pySim-shell` users. The last three log lines carry the print
-statements which we also see in the log messages on the `RCP Client`. The last
-line informs about the conclusion of the procedure and also shows the return
-code.
-
-
-Implementing an RCP Module
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-To make use of the Remote Card Procedure Framework, it is eventually necessary
-to implement a custom `RCP Module`. In the following section, we will go
-through the implementation of the `RCP Module` that is provided with the
-`usage_example`.
-
-NOTE: much of the following is explained in greater detail in the comments
-found in `rcp_module_utils.py`.
-
-Overview
---------
-
-`RCP Modules` are normal python programs that can started directly from the
-command prompt. However, due to the location of the file it is necessary that
-`PYTHONPATH` points to the location of the `pySim` modules as well as to the
-modules found in `contrib/rcp` (see `start_rcp_module.sh` for reference).
-
-As mentioned earlier `RCP Modules` may use the `pySim` API like any other
-`pySim` program, given that there is no dependency to `cmd2`. So it is no
-surprise that we find some `pySim` modules in the import section of the
-provided example.
-
-The utilities required to implement an `RCP Module` are imported from
-`rcp_module_utils.py`. From this module we import two functions
-`rcpm_setup_argparse` and `rcpm_run_module` and the two classes `RCP Module`
-and `RcpModuleHdlr`.
-
-Function: rcpm_setup_argparse
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-The first function `rcpm_setup_argparse` returns an argument parser that is already
-equipped with the basic commandline arguments that an `RCP Module` needs. In
-case the specific `RCP Module` implementation requires additional arguments,
-those can be added using normal `argparse` API calls.
-
-Function: rcpm_run_module
-^^^^^^^^^^^^^^^^^^^^^^^^^
-
-The second function `rcpm_run_module` is used to run the `RCP Module`. This
-function gets the parsed commandline options (`opts`) and the `RcpModule` class
-(`module`) as parameters. In addition to that, `rcpm_run_module` also accepts
-custom `*args` and `**kwargs` arguments, which are passed to the constructor of
-the `RcpModule` class.
-
-When `rcpm_run_module` is called. It registers the `RCP Module` and starts the
-RCP Client command server. It also takes care of the proper instantiation of the
-`RcpModule` class, which were passed with the `module` parameter.
-
-Class: RcpModule
-^^^^^^^^^^^^^^^^
-
-The Class `RcpModule` is the base class that is used to create a concrete
-`RCP Module` implementaion. Through this class, the API user defines the
-properties of the `RCP Module` as well as the command methods, which implement
-the related `Remote Card Procedures`.
-
-Class: RcpModuleHdlr
-^^^^^^^^^^^^^^^^^^^^
-
-The class `RcpModuleHdlr` is used by the framework to instantiate a handler
-object (`hdlr`), which is passed to each of the aforementioned command methods.
-The handler object is used as a vehicle to provide access the resources we need
-to send APDUs, print messages on the `RCP Client`, etc.
-
-Module Properties
------------------
-
-Before we can define any module properties, we first need to create a derived
-class from the `RcpModule` class we have imported from `rcp_module_utils.py`.
-In that class, we then define the basic properties of the `RCP Module`.
-
-name
-^^^^
-
-Each `RCP Module` needs a distinct name. The name must not collide with the
-names of other `RCP Modules`. The name uniquely identifies the `RCP Module` and
-is used as a prefix for the command names used with the user interface of the
-`RCP Client`. Therefore a short name is desirable.
-
-cmd_descr
-^^^^^^^^^
-
-The `cmd_descr` property defines the command properties. Since an `RCP Module`
-may offer multiple commands (procedures), this property is an array, where
-each item holds the definition for one specific command.
-
-The command definitions are formatted as a python dict. Like the `RCP Module`
-itself, each command has a `name`. As mentioned before. This name is concatenated
-with the name of the `RCP Module`.
-
-Each command definition also gets a `help` string. The help string will show up
-in the commandline help of the `RCP Client`. It should be short and concise.
-
-Command definitions also need to define commandline arguments. For this an
-`args` array is added to the command definition as well. In case no arguments
-are provided. The array is empty. Otherwise it will contain one or more dict
-members, where each specifies a `name` and a `spec`. The `name` sets the
-argument name (e.g. --fid), and the `spec` specifies the properties of the
-argument. The concept is borrowed from `argparse` and works very similar. API
-users can specify `required`, `help`, `default` and a type. However, to avoid
-name-space collisions, the type field is called `pytype` and the type identifier
-must be passed as a string (e.g. 'int').
-
-In case a procedure requires key material from the `CardKeyProvider`, the API
-user may add a `get_keys` field to the command definition. In case eUICC keys
-are needed. The API user will add a dict member with key `euicc` and populate
-the value with an array that holds the column names of the columns where the
-keys are found. The same also works for UICC keys by using 'uicc' as dict key.
-When `get_keys` is correctly populated and the correct column keys are supplied
-to the `RCP Module` at runtime. The `RCP Framework` will automatically retrieve
-the key material, decrypt it and make it available to the related command
-method.
-
-suitable_for
-^^^^^^^^^^^^
-
-`suitable_for` is the third and last property, the API user must define. This
-property holds an array where each member is a dict that defines a distinct
-property of the card for which the module is suitable for. The `RCP Server`
-uses this information to see which modules are suitable for a specific request.
-As of now, the only property we can use to make the distinction, is the ATR of
-the card.
-
-Custom Resources
-^^^^^^^^^^^^^^^^
-
-In case an `RCP Module` requires custom resources, those may be initialized using
-a custom constructor in the `RCP Module` class derived from `RcpModule`. This
-constructor receives the `*args` and `**kwargs` arguments passed to
-`rcpm_run_module`. However, this is an optional step. In case no constructor is
-defined, the default constructor is used.
-
-In addition to that, the API user may also define additional properties and
-methods, provided they do not collide with existing methods of the base class.
-
-Command Methods
-^^^^^^^^^^^^^^^
-
-Command methods are essentially normal python methods. However, since those
-methods are called by the `RCP Framework`, they must follow a distinct scheme,
-which we will go through in the following.
-
-Each command defined in `cmd_descr` requires a corresponding command method. A
-command method is always prefixed with `cmd_`. Then the exact name of the
-command follows as defined in `cmd_descr`. For example if we have defined a
-command with the name `read_record`, we must also define a method with the name
-`cmd_read_record`.
-
-The parameter list of a command method always contains only `self` and `hdlr`.
-The `hdlr` parameter is the handler object (`RcpModuleHdlr`) through which we
-access the resources provided by the `RCP Framework`.
-
-Inside a command method, the API user is free to perform any task he wants.
-Command Methods always run in a dedicated thread and may sleep or wait at any
-time without disturbing running procedures from other requestors.
-
-A command method should always return an integer as return code. In case the
-procedure ends successfully, the return code shall be `0`. The return code is
-passed through to the `RCP Client`, which returns it on exit to the operating
-system.
-
-
-Handler Resources
------------------
-
-As mentioned earlier, a commend method receives a handler object via
-the `hdlr` parameter. This object is of type `RcpModuleHdlr` and vaguely
-comparable to the `app` (`PysimApp`) object found in `pySim-shell.py`.
-
-The handler object provides the command method with the resources it needs to
-perform the card procedure.
-
-rs, card, lchan
-^^^^^^^^^^^^^^^
-
-The Runtime State (`rs`), the Card (`card`)  and the Lchan (`lchan`) Object
-have the same objectives asn in `pySim-shell.py`. Those objects work and are
-used the same way as they would in `pySim-shell.py`. It is assumed that the
-API user is already familiar with those objects.
-
-cmd_args
-^^^^^^^^
-
-The command arguments (`cmd_args`) contains the command line arguments as they
-were passed by the card holder on the `RCP Client` commandline in the form of
-a `Namespace` object.
-
-Even though the command arguments are syntax-checked against the `args`
-description given in `cmd_descr`, caution is required to avoid security
-problems arising from malicious input.
-
-keys_uicc and keys_euicc
-^^^^^^^^^^^^^^^^^^^^^^^^
-
-In case key material was requested via the `get_keys` in `cmd_descr`,
-`keys_uicc` and `keys_euicc` will contain those keys in the form of a dict. The
-dict key is the is the `CardKeyProvider` column name and the related dict value
-is the key material in its decrypted form.
-
-When accessing `keys_uicc` and `keys_euicc`, extra care should be taken. It may
-make sense to delete/overwrite those dictionaries as soon as the keys were used
-for the intended purpose. However, due to python's internal memory management
-key material may remain longer in the system memory as expected.
-
-print
-^^^^^
-
-The `hdlr` object also provides a `print` method. This method accepts a string
-as the only parameter and can be used to display custom messages in the log
-output of the `RCP Client`. The method can be used to inform the card holder
-about the progress of a procedure or to print error messages in case a
-procedure fails.

osmo-smdpp.py

@@ -640,7 +640,7 @@ class SmDppHttpServer:
                 # look up profile based on matchingID.  We simply check if a given file exists for now..
                 path = os.path.join(self.upp_dir, matchingId) + '.der'
                 # prevent directory traversal attack
-                if os.path.commonpath((os.path.realpath(path),self.upp_dir)) != self.upp_dir:
+                if os.path.commonprefix((os.path.realpath(path),self.upp_dir)) != self.upp_dir:
                     raise ApiError('8.2.6', '3.8', 'Refused')
                 if not os.path.isfile(path) or not os.access(path, os.R_OK):
                     raise ApiError('8.2.6', '3.8', 'Refused')

pySim-shell.py

@@ -24,21 +24,21 @@ import traceback
 import re
 import cmd2
 from packaging import version
+from cmd2 import style
+
 import logging
 from pySim.log import PySimLogger
 from osmocom.utils import auto_uint8
 
-# cmd2 >= 3.0 replaced Fg + style() with Color + stylize()
-if version.parse(cmd2.__version__) >= version.parse("3.0.0"):
-    from cmd2 import Color, stylize # pylint: disable=no-name-in-module
-    RED = Color.RED
-    YELLOW = Color.YELLOW
-    LIGHT_RED = Color.BRIGHT_RED
-    LIGHT_GREEN = Color.BRIGHT_GREEN
-    def style(text, fg=None, bg=None, bold=False): # pylint: disable=function-redefined
-        return stylize(text, fg) if fg else text
+# cmd2 >= 2.3.0 has deprecated the bg/fg in favor of Bg/Fg :(
+if version.parse(cmd2.__version__) < version.parse("2.3.0"):
+    from cmd2 import fg, bg # pylint: disable=no-name-in-module
+    RED = fg.red
+    YELLOW = fg.yellow
+    LIGHT_RED = fg.bright_red
+    LIGHT_GREEN = fg.bright_green
 else:
-    from cmd2 import style, Fg # pylint: disable=no-name-in-module
+    from cmd2 import Fg, Bg # pylint: disable=no-name-in-module
     RED = Fg.RED
     YELLOW = Fg.YELLOW
     LIGHT_RED = Fg.LIGHT_RED
@@ -69,26 +69,50 @@ from pySim.ts_102_222 import Ts102222Commands
 from pySim.gsm_r import DF_EIRENE
 from pySim.cat import ProactiveCommand
 
-from pySim.card_key_provider import card_key_provider_argparse_add_args, card_key_provider_init
-from pySim.card_key_provider import card_key_provider_get_field, card_key_provider_get
+from pySim.card_key_provider import CardKeyProviderCsv, CardKeyProviderPgsql
+from pySim.card_key_provider import card_key_provider_register, card_key_provider_get_field, card_key_provider_get
 
 from pySim.app import init_card
 
 log = PySimLogger.get(Path(__file__).stem)
 
-class PysimApp(cmd2.Cmd):
+class Cmd2Compat(cmd2.Cmd):
+    """Backwards-compatibility wrapper around cmd2.Cmd to support older and newer
+    releases. See https://github.com/python-cmd2/cmd2/blob/master/CHANGELOG.md"""
+    def run_editor(self, file_path: Optional[str] = None) -> None:
+        if version.parse(cmd2.__version__) < version.parse("2.0.0"):
+            return self._run_editor(file_path) # pylint: disable=no-member
+        else:
+            return super().run_editor(file_path) # pylint: disable=no-member
+
+class Settable2Compat(cmd2.Settable):
+    """Backwards-compatibility wrapper around cmd2.Settable to support older and newer
+    releases. See https://github.com/python-cmd2/cmd2/blob/master/CHANGELOG.md"""
+    def __init__(self, name, val_type, description, settable_object, **kwargs):
+        if version.parse(cmd2.__version__) < version.parse("2.0.0"):
+            super().__init__(name, val_type, description, **kwargs) # pylint: disable=no-value-for-parameter
+        else:
+            super().__init__(name, val_type, description, settable_object, **kwargs) # pylint: disable=too-many-function-args
+
+class PysimApp(Cmd2Compat):
     CUSTOM_CATEGORY = 'pySim Commands'
     BANNER = """Welcome to pySim-shell!
 (C) 2021-2023 by Harald Welte, sysmocom - s.f.m.c. GmbH and contributors
 Online manual available at https://downloads.osmocom.org/docs/pysim/master/html/shell.html """
 
     def __init__(self, verbose, card, rs, sl, ch, script=None):
+        if version.parse(cmd2.__version__) < version.parse("2.0.0"):
+            kwargs = {'use_ipython': True}
+        else:
+            kwargs = {'include_ipy': True}
+
         self.verbose = verbose
         PySimLogger.setup(self.poutput, {logging.WARN: YELLOW})
         self._onchange_verbose('verbose', False, self.verbose)
 
+        # pylint: disable=unexpected-keyword-arg
         super().__init__(persistent_history_file='~/.pysim_shell_history', allow_cli_args=False,
-                         auto_load_commands=False, startup_script=script, include_ipy=True)
+                         auto_load_commands=False, startup_script=script, **kwargs)
         self.intro = style(self.BANNER, fg=RED)
         self.default_category = 'pySim-shell built-in commands'
         self.card = None
@@ -104,24 +128,18 @@ Online manual available at https://downloads.osmocom.org/docs/pysim/master/html/
         self.apdu_trace = False
         self.apdu_strict = False
 
-        self.add_settable(cmd2.Settable('numeric_path', bool,
-                                        'Print File IDs instead of names',
-                                        self, onchange_cb=self._onchange_numeric_path))
-        self.add_settable(cmd2.Settable('conserve_write', bool,
-                                        'Read and compare before write',
-                                        self, onchange_cb=self._onchange_conserve_write))
-        self.add_settable(cmd2.Settable('json_pretty_print', bool,
-                                        'Pretty-Print JSON output',
-                                        self))
-        self.add_settable(cmd2.Settable('apdu_trace', bool,
-                                        'Trace and display APDUs exchanged with card',
-                                        self, onchange_cb=self._onchange_apdu_trace))
-        self.add_settable(cmd2.Settable('apdu_strict', bool,
-                                        'Strictly apply APDU format according to ISO/IEC 7816-3, table 12',
-                                        self))
-        self.add_settable(cmd2.Settable('verbose', bool,
-                                        'Enable/disable verbose logging',
-                                        self, onchange_cb=self._onchange_verbose))
+        self.add_settable(Settable2Compat('numeric_path', bool, 'Print File IDs instead of names', self,
+                                          onchange_cb=self._onchange_numeric_path))
+        self.add_settable(Settable2Compat('conserve_write', bool, 'Read and compare before write', self,
+                                          onchange_cb=self._onchange_conserve_write))
+        self.add_settable(Settable2Compat('json_pretty_print', bool, 'Pretty-Print JSON output', self))
+        self.add_settable(Settable2Compat('apdu_trace', bool, 'Trace and display APDUs exchanged with card', self,
+                                          onchange_cb=self._onchange_apdu_trace))
+        self.add_settable(Settable2Compat('apdu_strict', bool,
+                                          'Strictly apply APDU format according to ISO/IEC 7816-3, table 12', self))
+        self.add_settable(Settable2Compat('verbose', bool,
+                                          'Enable/disable verbose logging', self,
+                                          onchange_cb=self._onchange_verbose))
         self.equip(card, rs)
 
     def equip(self, card, rs):
@@ -1128,6 +1146,18 @@ global_group.add_argument("--skip-card-init", help="Skip all card/profile initia
 global_group.add_argument("--verbose", help="Enable verbose logging",
                           action='store_true', default=False)
 
+card_key_group = option_parser.add_argument_group('Card Key Provider Options')
+card_key_group.add_argument('--csv', metavar='FILE',
+                            default="~/.osmocom/pysim/card_data.csv",
+                            help='Read card data from CSV file')
+card_key_group.add_argument('--pgsql', metavar='FILE',
+                            default="~/.osmocom/pysim/card_data_pgsql.cfg",
+                            help='Read card data from PostgreSQL database (config file)')
+card_key_group.add_argument('--csv-column-key', metavar='FIELD:AES_KEY_HEX', default=[], action='append',
+                            help=argparse.SUPPRESS, dest='column_key')
+card_key_group.add_argument('--column-key', metavar='FIELD:AES_KEY_HEX', default=[], action='append',
+                            help='per-column AES transport key', dest='column_key')
+
 adm_group = global_group.add_mutually_exclusive_group()
 adm_group.add_argument('-a', '--pin-adm', metavar='PIN_ADM1', dest='pin_adm', default=None,
                        help='ADM PIN used for provisioning (overwrites default)')
@@ -1140,7 +1170,6 @@ option_parser.add_argument("command", nargs='?',
                            help="A pySim-shell command that would optionally be executed at startup")
 option_parser.add_argument('command_args', nargs=argparse.REMAINDER,
                            help="Optional Arguments for command")
-card_key_provider_argparse_add_args(option_parser)
 
 if __name__ == '__main__':
     startup_errors = False
@@ -1149,8 +1178,16 @@ if __name__ == '__main__':
     # Ensure that we are able to print formatted warnings from the beginning.
     PySimLogger.setup(print, {logging.WARN: YELLOW}, opts.verbose)
 
-    # Init card key provider for automatic card key retrieval
-    card_key_provider_init(opts)
+    # Register csv-file as card data provider, either from specified CSV
+    # or from CSV file in home directory
+    column_keys = {}
+    for par in opts.column_key:
+        name, key = par.split(':')
+        column_keys[name] = key
+    if os.path.isfile(os.path.expanduser(opts.csv)):
+        card_key_provider_register(CardKeyProviderCsv(os.path.expanduser(opts.csv), column_keys))
+    if os.path.isfile(os.path.expanduser(opts.pgsql)):
+        card_key_provider_register(CardKeyProviderPgsql(os.path.expanduser(opts.pgsql), column_keys))
 
     # Init card reader driver
     sl = init_reader(opts, proactive_handler = Proact())

pySim/app.py

@@ -26,9 +26,6 @@ from pySim.cdma_ruim import CardProfileRUIM
 from pySim.ts_102_221 import CardProfileUICC
 from pySim.utils import all_subclasses
 from pySim.exceptions import SwMatchError
-from pySim.log import PySimLogger
-
-log = PySimLogger.get(__name__)
 
 # we need to import this module so that the SysmocomSJA2 sub-class of
 # CardModel is created, which will add the ATR-based matching and
@@ -57,7 +54,7 @@ def init_card(sl: LinkBase, skip_card_init: bool = False) -> Tuple[RuntimeState,
 
     # Wait up to three seconds for a card in reader and try to detect
     # the card type.
-    log.info("Waiting for card...")
+    print("Waiting for card...")
     sl.wait_for_card(3)
 
     # The user may opt to skip all card initialization. In this case only the
@@ -69,7 +66,7 @@ def init_card(sl: LinkBase, skip_card_init: bool = False) -> Tuple[RuntimeState,
     generic_card = False
     card = card_detect(scc)
     if card is None:
-        log.warning("Could not detect card type - assuming a generic card type...")
+        print("Warning: Could not detect card type - assuming a generic card type...")
         card = SimCardBase(scc)
         generic_card = True
 
@@ -79,7 +76,7 @@ def init_card(sl: LinkBase, skip_card_init: bool = False) -> Tuple[RuntimeState,
         # just means that pySim was unable to recognize the card profile. This
         # may happen in particular with unprovisioned cards that do not have
         # any files on them yet.
-        log.warning("Unsupported card type!")
+        print("Unsupported card type!")
         return None, card
 
     # ETSI TS 102 221, Table 9.3 specifies a default for the PIN key
@@ -90,7 +87,7 @@ def init_card(sl: LinkBase, skip_card_init: bool = False) -> Tuple[RuntimeState,
     if generic_card and isinstance(profile, CardProfileUICC):
         card._adm_chv_num = 0x0A
 
-    log.info("Card is of type: %s", str(profile))
+    print("Info: Card is of type: %s" % str(profile))
 
     # FIXME: this shouldn't really be here but somewhere else/more generic.
     # We cannot do it within pySim/profile.py as that would create circular

pySim/ara_m.py

@@ -300,51 +300,6 @@ class ADF_ARAM(CardADF):
                                'major': v_major, 'minor': v_minor, 'patch': v_patch}}])
         return ADF_ARAM.xceive_apdu_tlv(scc, '80cadf21', cmd_do, ResponseAramConfigDO)
 
-    @staticmethod
-    def store_ref_ar_do(scc, aid:Hexstr, aid_empty:bool, device_app_id:Hexstr, pkg_ref:str,
-                        apdu_filter:Hexstr, apdu_never:bool, apdu_always:bool,
-                        nfc_always:bool, nfc_never:bool, android_permissions:Hexstr):
-        # REF
-        ref_do_content = []
-        if aid is not None:
-            ref_do_content += [{'aid_ref_do': aid}]
-        elif aid_empty:
-            ref_do_content += [{'aid_ref_empty_do': None}]
-        ref_do_content += [{'dev_app_id_ref_do': device_app_id}]
-        if pkg_ref:
-            ref_do_content += [{'pkg_ref_do': {'package_name_string': pkg_ref}}]
-        # AR
-        ar_do_content = []
-        if apdu_never:
-            ar_do_content += [{'apdu_ar_do': {'generic_access_rule': 'never'}}]
-        elif apdu_always:
-            ar_do_content += [{'apdu_ar_do': {'generic_access_rule': 'always'}}]
-        elif apdu_filter:
-            if len(apdu_filter) % 16:
-                raise ValueError(f'Invalid non-modulo-16 length of APDU filter: {len(apdu_filter)}')
-            offset = 0
-            apdu_filter_list = []
-            while offset < len(apdu_filter):
-                apdu_filter_list += [{'header': apdu_filter[offset:offset+8],
-                                      'mask': apdu_filter[offset+8:offset+16]}]
-                offset += 16 # Move offset to the beginning of the next apdu_filter object
-            ar_do_content += [{'apdu_ar_do': {'apdu_filter': apdu_filter_list}}]
-        if nfc_never:
-            ar_do_content += [{'nfc_ar_do': {'nfc_event_access_rule': 'never'}}]
-        elif nfc_always:
-            ar_do_content += [{'nfc_ar_do': {'nfc_event_access_rule': 'always'}}]
-        if android_permissions:
-            ar_do_content += [{'perm_ar_do': {'permissions': android_permissions}}]
-        d = [{'ref_ar_do': [{'ref_do': ref_do_content}, {'ar_do': ar_do_content}]}]
-        csrado = CommandStoreRefArDO()
-        csrado.from_val_dict(d)
-        return ADF_ARAM.store_data(scc, csrado)
-
-    @staticmethod
-    def aram_delete_all(scc):
-        deldo = CommandDelete()
-        return ADF_ARAM.store_data(scc, deldo)
-
     @with_default_category('Application-Specific Commands')
     class AddlShellCommands(CommandSet):
         def do_aram_get_all(self, _opts):
@@ -379,25 +334,58 @@ class ADF_ARAM(CardADF):
         apdu_grp.add_argument(
             '--apdu-filter', help='APDU filter: multiple groups of 8 hex bytes (4 byte CLA/INS/P1/P2 followed by 4 byte mask)')
         nfc_grp = store_ref_ar_do_parse.add_mutually_exclusive_group()
-        nfc_grp.add_argument('--nfc-never', action='store_true',
-                             help='NFC event access is not allowed')
         nfc_grp.add_argument('--nfc-always', action='store_true',
                              help='NFC event access is allowed')
+        nfc_grp.add_argument('--nfc-never', action='store_true',
+                             help='NFC event access is not allowed')
         store_ref_ar_do_parse.add_argument(
             '--android-permissions', help='Android UICC Carrier Privilege Permissions (8 hex bytes)')
 
         @cmd2.with_argparser(store_ref_ar_do_parse)
         def do_aram_store_ref_ar_do(self, opts):
             """Perform STORE DATA [Command-Store-REF-AR-DO] to store a (new) access rule."""
-            res_do = ADF_ARAM.store_ref_ar_do(self._cmd.lchan.scc, opts.aid, opts.aid_empty, opts.device_app_id,
-                                              opts.pkg_ref, opts.apdu_filter, opts.apdu_never, opts.apdu_always,
-                                              opts.nfc_always, opts.nfc_never, opts.android_permissions)
+            # REF
+            ref_do_content = []
+            if opts.aid is not None:
+                ref_do_content += [{'aid_ref_do': opts.aid}]
+            elif opts.aid_empty:
+                ref_do_content += [{'aid_ref_empty_do': None}]
+            ref_do_content += [{'dev_app_id_ref_do': opts.device_app_id}]
+            if opts.pkg_ref:
+                ref_do_content += [{'pkg_ref_do': {'package_name_string': opts.pkg_ref}}]
+            # AR
+            ar_do_content = []
+            if opts.apdu_never:
+                ar_do_content += [{'apdu_ar_do': {'generic_access_rule': 'never'}}]
+            elif opts.apdu_always:
+                ar_do_content += [{'apdu_ar_do': {'generic_access_rule': 'always'}}]
+            elif opts.apdu_filter:
+                if len(opts.apdu_filter) % 16:
+                    raise ValueError(f'Invalid non-modulo-16 length of APDU filter: {len(opts.apdu_filter)}')
+                offset = 0
+                apdu_filter = []
+                while offset < len(opts.apdu_filter):
+                    apdu_filter += [{'header': opts.apdu_filter[offset:offset+8],
+                                     'mask': opts.apdu_filter[offset+8:offset+16]}]
+                    offset += 16 # Move offset to the beginning of the next apdu_filter object
+                ar_do_content += [{'apdu_ar_do': {'apdu_filter': apdu_filter}}]
+            if opts.nfc_always:
+                ar_do_content += [{'nfc_ar_do': {'nfc_event_access_rule': 'always'}}]
+            elif opts.nfc_never:
+                ar_do_content += [{'nfc_ar_do': {'nfc_event_access_rule': 'never'}}]
+            if opts.android_permissions:
+                ar_do_content += [{'perm_ar_do': {'permissions': opts.android_permissions}}]
+            d = [{'ref_ar_do': [{'ref_do': ref_do_content}, {'ar_do': ar_do_content}]}]
+            csrado = CommandStoreRefArDO()
+            csrado.from_val_dict(d)
+            res_do = ADF_ARAM.store_data(self._cmd.lchan.scc, csrado)
             if res_do:
                 self._cmd.poutput_json(res_do.to_dict())
 
         def do_aram_delete_all(self, _opts):
             """Perform STORE DATA [Command-Delete[all]] to delete all access rules."""
-            res_do = ADF_ARAM.aram_delete_all(self._cmd.lchan.scc)
+            deldo = CommandDelete()
+            res_do = ADF_ARAM.store_data(self._cmd.lchan.scc, deldo)
             if res_do:
                 self._cmd.poutput_json(res_do.to_dict())
 
@@ -406,6 +394,7 @@ class ADF_ARAM(CardADF):
             (Proprietary feature that is specific to sysmocom's fork of Bertrand Martel’s ARA-M implementation.)"""
             self._cmd.lchan.scc.send_apdu_checksw('80e2900001A1', '9000')
 
+
 # SEAC v1.1 Section 4.1.2.2 + 5.1.2.2
 sw_aram = {
     'ARA-M': {

pySim/card_key_provider.py

@@ -33,12 +33,10 @@ from Cryptodome.Cipher import AES
 from osmocom.utils import h2b, b2h
 from pySim.log import PySimLogger
 
-import os
 import abc
 import csv
 import logging
 import yaml
-import argparse
 
 log = PySimLogger.get(__name__)
 
@@ -132,31 +130,6 @@ class CardKeyFieldCryptor:
         cipher = AES.new(h2b(self.transport_keys[field_name.upper()]), AES.MODE_CBC, self.__IV)
         return b2h(cipher.encrypt(h2b(plaintext_val)))
 
-    @staticmethod
-    def argparse_add_args(arg_parser: argparse.ArgumentParser):
-        arg_parser.add_argument('--column-key', metavar='FIELD:AES_KEY_HEX', default=[], action='append',
-                                help='per-column AES transport key', dest='column_key')
-        # Depprecated argument, replaced by --column-key (see above)
-        arg_parser.add_argument('--csv-column-key', metavar='FIELD:AES_KEY_HEX', default=[], action='append',
-                                help=argparse.SUPPRESS, dest='column_key')
-
-    @staticmethod
-    def transport_keys_from_opts(opts: argparse.Namespace) -> dict:
-        """
-        Transport keys are passed via the commandline using the '--column-key' option. Each column requires a
-        dedicated transport key. This method can be used to extract the column keys parameters from the commandline
-        options into a dict that can be directly passed to the construtor with the transport_keys argument.
-
-        Args:
-                opts: parsed commandline options (Namespace)
-        """
-
-        transport_keys = {}
-        for par in opts.column_key:
-            name, key = par.split(':')
-            transport_keys[name] = key
-        return transport_keys
-
 class CardKeyProvider(abc.ABC):
     """Base class, not containing any concrete implementation."""
 
@@ -175,33 +148,24 @@ class CardKeyProvider(abc.ABC):
                 fond None shall be returned.
         """
 
-    @staticmethod
-    def argparse_add_args(arg_parser: argparse.ArgumentParser):
-        """
-        Add the commandline arguments relevant for this card key provider.
-
-        Args:
-                arg_parser : argument parser group
-        """
-
     def __str__(self):
         return type(self).__name__
 
 class CardKeyProviderCsv(CardKeyProvider):
     """Card key provider implementation that allows to query against a specified CSV file."""
 
-    def __init__(self, csv_filename: str, field_cryptor: CardKeyFieldCryptor):
+    def __init__(self, csv_filename: str, transport_keys: dict):
         """
         Args:
                 csv_filename : file name (path) of CSV file containing card-individual key/data
-                field_cryptor : (see class CardKeyFieldCryptor)
+                transport_keys : (see class CardKeyFieldCryptor)
         """
         log.info("Using CSV file as card key data source: %s" % csv_filename)
         self.csv_file = open(csv_filename, 'r')
         if not self.csv_file:
             raise RuntimeError("Could not open CSV file '%s'" % csv_filename)
         self.csv_filename = csv_filename
-        self.crypt = field_cryptor
+        self.crypt = CardKeyFieldCryptor(transport_keys)
 
     def get(self, fields: List[str], key: str, value: str) -> Dict[str, str]:
         self.csv_file.seek(0)
@@ -224,20 +188,14 @@ class CardKeyProviderCsv(CardKeyProvider):
             return None
         return return_dict
 
-    @staticmethod
-    def argparse_add_args(arg_parser: argparse.ArgumentParser):
-        arg_parser.add_argument('--csv', metavar='FILE',
-                                default="~/.osmocom/pysim/card_data.csv",
-                                help='Read card data from CSV file')
-
 class CardKeyProviderPgsql(CardKeyProvider):
     """Card key provider implementation that allows to query against a specified PostgreSQL database table."""
 
-    def __init__(self, config_filename: str, field_cryptor: CardKeyFieldCryptor):
+    def __init__(self, config_filename: str, transport_keys: dict):
         """
         Args:
                 config_filename : file name (path) of CSV file containing card-individual key/data
-                field_cryptor : (see class CardKeyFieldCryptor)
+                transport_keys : (see class CardKeyFieldCryptor)
         """
         import psycopg2
         log.info("Using SQL database as card key data source: %s" % config_filename)
@@ -254,7 +212,7 @@ class CardKeyProviderPgsql(CardKeyProvider):
                                          host=config.get('host'))
             self.tables = config.get('table_names')
             log.info("Card key database tables: %s" % str(self.tables))
-            self.crypt = field_cryptor
+            self.crypt = CardKeyFieldCryptor(transport_keys)
 
     def get(self, fields: List[str], key: str, value: str) -> Dict[str, str]:
         import psycopg2
@@ -294,11 +252,6 @@ class CardKeyProviderPgsql(CardKeyProvider):
             result[k] = self.crypt.decrypt_field(k, result.get(k))
         return result
 
-    @staticmethod
-    def argparse_add_args(arg_parser: argparse.ArgumentParser):
-        arg_parser.add_argument('--pgsql', metavar='FILE',
-                                default="~/.osmocom/pysim/card_data_pgsql.cfg",
-                                help='Read card data from PostgreSQL database (config file)')
 
 def card_key_provider_register(provider: CardKeyProvider, provider_list=card_key_providers):
     """Register a new card key provider.
@@ -352,19 +305,3 @@ def card_key_provider_get_field(field: str, key: str, value: str, provider_list=
     fields = [field]
     result = card_key_provider_get(fields, key, value, card_key_providers)
     return result.get(field.upper())
-
-def card_key_provider_argparse_add_args(arg_parser: argparse.ArgumentParser):
-    """Add card key provider commandline options to the given argument parser"""
-    card_key_group = arg_parser.add_argument_group('Card Key Provider Options')
-    CardKeyProviderCsv.argparse_add_args(card_key_group)
-    CardKeyProviderPgsql.argparse_add_args(card_key_group)
-    CardKeyFieldCryptor.argparse_add_args(card_key_group)
-
-def card_key_provider_init(opts: argparse.Namespace):
-    """Initialize card key provider depending on the user provided commandline options"""
-    transport_keys = CardKeyFieldCryptor.transport_keys_from_opts(opts)
-    card_key_field_cryptor = CardKeyFieldCryptor(transport_keys)
-    if os.path.isfile(os.path.expanduser(opts.csv)):
-        card_key_provider_register(CardKeyProviderCsv(os.path.expanduser(opts.csv), card_key_field_cryptor))
-    if os.path.isfile(os.path.expanduser(opts.pgsql)):
-        card_key_provider_register(CardKeyProviderPgsql(os.path.expanduser(opts.pgsql), card_key_field_cryptor))

pySim/esim/es2p.py

@@ -16,12 +16,6 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import requests
-from klein import Klein
-from twisted.internet import defer, protocol, ssl, task, endpoints, reactor
-from twisted.internet.posixbase import PosixReactorBase
-from pathlib import Path
-from twisted.web.server import Site, Request
-
 import logging
 from datetime import datetime
 import time
@@ -129,12 +123,10 @@ class Es2PlusApiFunction(JsonHttpApiFunction):
 class DownloadOrder(Es2PlusApiFunction):
     path = '/gsma/rsp2/es2plus/downloadOrder'
     input_params = {
-        'header': JsonRequestHeader,
         'eid': param.Eid,
         'iccid': param.Iccid,
         'profileType': param.ProfileType
       }
-    input_mandatory = ['header']
     output_params = {
         'header': JsonResponseHeader,
         'iccid': param.Iccid,
@@ -145,7 +137,6 @@ class DownloadOrder(Es2PlusApiFunction):
 class ConfirmOrder(Es2PlusApiFunction):
     path = '/gsma/rsp2/es2plus/confirmOrder'
     input_params = {
-        'header': JsonRequestHeader,
         'iccid': param.Iccid,
         'eid': param.Eid,
         'matchingId': param.MatchingId,
@@ -153,7 +144,7 @@ class ConfirmOrder(Es2PlusApiFunction):
         'smdsAddress': param.SmdsAddress,
         'releaseFlag': param.ReleaseFlag,
       }
-    input_mandatory = ['header', 'iccid', 'releaseFlag']
+    input_mandatory = ['iccid', 'releaseFlag']
     output_params = {
         'header': JsonResponseHeader,
         'eid': param.Eid,
@@ -166,13 +157,12 @@ class ConfirmOrder(Es2PlusApiFunction):
 class CancelOrder(Es2PlusApiFunction):
     path = '/gsma/rsp2/es2plus/cancelOrder'
     input_params = {
-        'header': JsonRequestHeader,
         'iccid': param.Iccid,
         'eid': param.Eid,
         'matchingId': param.MatchingId,
         'finalProfileStatusIndicator': param.FinalProfileStatusIndicator,
       }
-    input_mandatory = ['header', 'finalProfileStatusIndicator', 'iccid']
+    input_mandatory = ['finalProfileStatusIndicator', 'iccid']
     output_params = {
         'header': JsonResponseHeader,
       }
@@ -182,10 +172,9 @@ class CancelOrder(Es2PlusApiFunction):
 class ReleaseProfile(Es2PlusApiFunction):
     path = '/gsma/rsp2/es2plus/releaseProfile'
     input_params = {
-        'header': JsonRequestHeader,
         'iccid': param.Iccid,
       }
-    input_mandatory = ['header', 'iccid']
+    input_mandatory = ['iccid']
     output_params = {
         'header': JsonResponseHeader,
       }
@@ -195,7 +184,6 @@ class ReleaseProfile(Es2PlusApiFunction):
 class HandleDownloadProgressInfo(Es2PlusApiFunction):
     path = '/gsma/rsp2/es2plus/handleDownloadProgressInfo'
     input_params = {
-        'header': JsonRequestHeader,
         'eid': param.Eid,
         'iccid': param.Iccid,
         'profileType': param.ProfileType,
@@ -204,9 +192,10 @@ class HandleDownloadProgressInfo(Es2PlusApiFunction):
         'notificationPointStatus': param.NotificationPointStatus,
         'resultData': param.ResultData,
     }
-    input_mandatory = ['header', 'iccid', 'profileType', 'timestamp', 'notificationPointId', 'notificationPointStatus']
+    input_mandatory = ['iccid', 'profileType', 'timestamp', 'notificationPointId', 'notificationPointStatus']
     expected_http_status = 204
 
+
 class Es2pApiClient:
     """Main class representing a full ES2+ API client. Has one method for each API function."""
     def __init__(self, url_prefix:str, func_req_id:str, server_cert_verify: str = None, client_cert: str = None):
@@ -217,17 +206,18 @@ class Es2pApiClient:
         if client_cert:
             self.session.cert = client_cert
 
-        self.downloadOrder = JsonHttpApiClient(DownloadOrder(), url_prefix, func_req_id, self.session)
-        self.confirmOrder = JsonHttpApiClient(ConfirmOrder(), url_prefix, func_req_id, self.session)
-        self.cancelOrder = JsonHttpApiClient(CancelOrder(), url_prefix, func_req_id, self.session)
-        self.releaseProfile = JsonHttpApiClient(ReleaseProfile(), url_prefix, func_req_id, self.session)
-        self.handleDownloadProgressInfo = JsonHttpApiClient(HandleDownloadProgressInfo(), url_prefix, func_req_id, self.session)
+        self.downloadOrder = DownloadOrder(url_prefix, func_req_id, self.session)
+        self.confirmOrder = ConfirmOrder(url_prefix, func_req_id, self.session)
+        self.cancelOrder = CancelOrder(url_prefix, func_req_id, self.session)
+        self.releaseProfile = ReleaseProfile(url_prefix, func_req_id, self.session)
+        self.handleDownloadProgressInfo = HandleDownloadProgressInfo(url_prefix, func_req_id, self.session)
 
     def _gen_func_id(self) -> str:
         """Generate the next function call id."""
         self.func_id += 1
         return 'FCI-%u-%u' % (time.time(), self.func_id)
 
+
     def call_downloadOrder(self, data: dict) -> dict:
         """Perform ES2+ DownloadOrder function (SGP.22 section 5.3.1)."""
         return self.downloadOrder.call(data, self._gen_func_id())
@@ -247,116 +237,3 @@ class Es2pApiClient:
     def call_handleDownloadProgressInfo(self, data: dict) -> dict:
         """Perform ES2+ HandleDownloadProgressInfo function (SGP.22 section 5.3.5)."""
         return self.handleDownloadProgressInfo.call(data, self._gen_func_id())
-
-class Es2pApiServerHandlerSmdpp(abc.ABC):
-    """ES2+ (SMDP+ side) API Server handler class. The API user is expected to override the contained methods."""
-
-    @abc.abstractmethod
-    def call_downloadOrder(self, data: dict) -> (dict, str):
-        """Perform ES2+ DownloadOrder function (SGP.22 section 5.3.1)."""
-        pass
-
-    @abc.abstractmethod
-    def call_confirmOrder(self, data: dict) -> (dict, str):
-        """Perform ES2+ ConfirmOrder function (SGP.22 section 5.3.2)."""
-        pass
-
-    @abc.abstractmethod
-    def call_cancelOrder(self, data: dict) -> (dict, str):
-        """Perform ES2+ CancelOrder function (SGP.22 section 5.3.3)."""
-        pass
-
-    @abc.abstractmethod
-    def call_releaseProfile(self, data: dict) -> (dict, str):
-        """Perform ES2+ CancelOrder function (SGP.22 section 5.3.4)."""
-        pass
-
-class Es2pApiServerHandlerMno(abc.ABC):
-    """ES2+ (MNO side) API Server handler class. The API user is expected to override the contained methods."""
-
-    @abc.abstractmethod
-    def call_handleDownloadProgressInfo(self, data: dict) -> (dict, str):
-        """Perform ES2+ HandleDownloadProgressInfo function (SGP.22 section 5.3.5)."""
-        pass
-
-class Es2pApiServer(abc.ABC):
-    """Main class representing a full ES2+ API server. Has one method for each API function."""
-    app = None
-
-    def __init__(self, port: int, interface: str, server_cert: str = None, client_cert_verify: str = None):
-        logger.debug("HTTP SRV: starting ES2+ API server on %s:%s" % (interface, port))
-        self.port = port
-        self.interface = interface
-        if server_cert:
-            self.server_cert = ssl.PrivateCertificate.loadPEM(Path(server_cert).read_text())
-        else:
-            self.server_cert = None
-        if client_cert_verify:
-            self.client_cert_verify = ssl.Certificate.loadPEM(Path(client_cert_verify).read_text())
-        else:
-            self.client_cert_verify = None
-
-    def reactor(self, reactor: PosixReactorBase):
-        logger.debug("HTTP SRV: listen on %s:%s" % (self.interface, self.port))
-        if self.server_cert:
-            if self.client_cert_verify:
-                reactor.listenSSL(self.port, Site(self.app.resource()), self.server_cert.options(self.client_cert_verify),
-                                  interface=self.interface)
-            else:
-                reactor.listenSSL(self.port, Site(self.app.resource()), self.server_cert.options(),
-                                  interface=self.interface)
-        else:
-            reactor.listenTCP(self.port, Site(self.app.resource()), interface=self.interface)
-        return defer.Deferred()
-
-class Es2pApiServerSmdpp(Es2pApiServer):
-    """ES2+ (SMDP+ side) API Server."""
-    app = Klein()
-
-    def __init__(self, port: int, interface: str, handler: Es2pApiServerHandlerSmdpp,
-                 server_cert: str = None, client_cert_verify: str = None):
-        super().__init__(port, interface, server_cert, client_cert_verify)
-        self.handler = handler
-        self.downloadOrder = JsonHttpApiServer(DownloadOrder(), handler.call_downloadOrder)
-        self.confirmOrder = JsonHttpApiServer(ConfirmOrder(), handler.call_confirmOrder)
-        self.cancelOrder = JsonHttpApiServer(CancelOrder(), handler.call_cancelOrder)
-        self.releaseProfile = JsonHttpApiServer(ReleaseProfile(), handler.call_releaseProfile)
-        task.react(self.reactor)
-
-    @app.route(DownloadOrder.path)
-    def call_downloadOrder(self, request: Request) -> dict:
-        """Perform ES2+ DownloadOrder function (SGP.22 section 5.3.1)."""
-        return self.downloadOrder.call(request)
-
-    @app.route(ConfirmOrder.path)
-    def call_confirmOrder(self, request: Request) -> dict:
-        """Perform ES2+ ConfirmOrder function (SGP.22 section 5.3.2)."""
-        return self.confirmOrder.call(request)
-
-    @app.route(CancelOrder.path)
-    def call_cancelOrder(self, request: Request) -> dict:
-        """Perform ES2+ CancelOrder function (SGP.22 section 5.3.3)."""
-        return self.cancelOrder.call(request)
-
-    @app.route(ReleaseProfile.path)
-    def call_releaseProfile(self, request: Request) -> dict:
-        """Perform ES2+ CancelOrder function (SGP.22 section 5.3.4)."""
-        return self.releaseProfile.call(request)
-
-class Es2pApiServerMno(Es2pApiServer):
-    """ES2+ (MNO side) API Server."""
-
-    app = Klein()
-
-    def __init__(self, port: int, interface: str, handler: Es2pApiServerHandlerMno,
-                 server_cert: str = None, client_cert_verify: str = None):
-        super().__init__(port, interface, server_cert, client_cert_verify)
-        self.handler = handler
-        self.handleDownloadProgressInfo = JsonHttpApiServer(HandleDownloadProgressInfo(),
-                                                            handler.call_handleDownloadProgressInfo)
-        task.react(self.reactor)
-
-    @app.route(HandleDownloadProgressInfo.path)
-    def call_handleDownloadProgressInfo(self, request: Request) -> dict:
-        """Perform ES2+ HandleDownloadProgressInfo function (SGP.22 section 5.3.5)."""
-        return self.handleDownloadProgressInfo.call(request)

pySim/esim/es9p.py

@@ -155,11 +155,11 @@ class Es9pApiClient:
         if server_cert_verify:
             self.session.verify = server_cert_verify
 
-        self.initiateAuthentication = JsonHttpApiClient(InitiateAuthentication(), url_prefix, '', self.session)
-        self.authenticateClient = JsonHttpApiClient(AuthenticateClient(), url_prefix, '', self.session)
-        self.getBoundProfilePackage = JsonHttpApiClient(GetBoundProfilePackage(), url_prefix, '', self.session)
-        self.handleNotification = JsonHttpApiClient(HandleNotification(), url_prefix, '', self.session)
-        self.cancelSession = JsonHttpApiClient(CancelSession(), url_prefix, '', self.session)
+        self.initiateAuthentication = InitiateAuthentication(url_prefix, '', self.session)
+        self.authenticateClient = AuthenticateClient(url_prefix, '', self.session)
+        self.getBoundProfilePackage = GetBoundProfilePackage(url_prefix, '', self.session)
+        self.handleNotification = HandleNotification(url_prefix, '', self.session)
+        self.cancelSession = CancelSession(url_prefix, '', self.session)
 
     def call_initiateAuthentication(self, data: dict) -> dict:
         return self.initiateAuthentication.call(data)

pySim/esim/http_json_api.py

@@ -19,10 +19,8 @@ import abc
 import requests
 import logging
 import json
-from typing import Optional, Tuple
+from typing import Optional
 import base64
-from twisted.web.server import Request
-
 
 logger = logging.getLogger(__name__)
 logger.setLevel(logging.DEBUG)
@@ -133,16 +131,6 @@ class JsonResponseHeader(ApiParam):
         if status not in ['Executed-Success', 'Executed-WithWarning', 'Failed', 'Expired']:
             raise ValueError('Unknown/unspecified status "%s"' % status)
 
-class JsonRequestHeader(ApiParam):
-    """SGP.22 section 6.5.1.3."""
-    @classmethod
-    def verify_decoded(cls, data):
-        func_req_id = data.get('functionRequesterIdentifier')
-        if not func_req_id:
-            raise ValueError('Missing mandatory functionRequesterIdentifier in header')
-        func_call_id = data.get('functionCallIdentifier')
-        if not func_call_id:
-            raise ValueError('Missing mandatory functionCallIdentifier in header')
 
 class HttpStatusError(Exception):
     pass
@@ -173,118 +161,65 @@ class ApiError(Exception):
 
 class JsonHttpApiFunction(abc.ABC):
     """Base class for representing an HTTP[s] API Function."""
-    # The below class variables are used to describe the properties of the API function. Derived classes are expected
-    # to orverride those class properties with useful values. The prefixes "input_" and "output_" refer to the API
-    # function from an abstract point of view. Seen from the client perspective, "input_" will refer to parameters the
-    # client sends to a HTTP server. Seen from the server perspective, "input_" will refer to parameters the server
-    # receives from the a requesting client. The same applies vice versa to class variables that have an "output_"
-    # prefix.
+     # the below class variables are expected to be overridden in derived classes
 
-    # path of the API function (e.g. '/gsma/rsp2/es2plus/confirmOrder', see also method rewrite_url).
     path = None
-
     # dictionary of input parameters. key is parameter name, value is ApiParam class
     input_params = {}
-
     # list of mandatory input parameters
     input_mandatory = []
-
     # dictionary of output parameters. key is parameter name, value is ApiParam class
     output_params = {}
-
     # list of mandatory output parameters (for successful response)
     output_mandatory = []
-
-    # list of mandatory output parameters (for failed response)
-    output_mandatory_failed = []
-
     # expected HTTP status code of the response
     expected_http_status = 200
-
     # the HTTP method used (GET, OPTIONS, HEAD, POST, PUT, PATCH or DELETE)
     http_method = 'POST'
-
-    # additional custom HTTP headers (client requests)
     extra_http_req_headers = {}
 
-    # additional custom HTTP headers (server responses)
-    extra_http_res_headers = {}
+    def __init__(self, url_prefix: str, func_req_id: Optional[str], session: requests.Session):
+        self.url_prefix = url_prefix
+        self.func_req_id = func_req_id
+        self.session = session
 
-    def __new__(cls, *args, role = 'legacy_client', **kwargs):
-        """
-        Args:
-                args: (see JsonHttpApiClient and JsonHttpApiServer)
-                role: role ('server' or 'client') in which the JsonHttpApiFunction should be created.
-                kwargs: (see JsonHttpApiClient and JsonHttpApiServer)
-        """
-
-        # Create a dictionary with the class attributes of this class (the properties listed above and the encode_
-        # decode_ methods below). The dictionary will not include any dunder/magic methods
-        cls_attr = {attr_name: getattr(cls, attr_name) for attr_name in dir(cls) if not attr_name.startswith('__')}
-
-        # Normal instantiation as JsonHttpApiFunction:
-        if len(args) == 0 and len(kwargs) == 0:
-            return type(cls.__name__, (abc.ABC,), cls_attr)()
-
-        # Instantiation as as JsonHttpApiFunction with a JsonHttpApiClient or JsonHttpApiServer base
-        if role == 'legacy_client':
-            # Deprecated: With the advent of the server role (JsonHttpApiServer) the API had to be changed. To maintain
-            # compatibility with existing code (out-of-tree) the original behaviour and API interface and behaviour had
-            # to be preserved. Already existing JsonHttpApiFunction definitions will still work and the related objects
-            # may still be created on the original way: my_api_func = MyApiFunc(url_prefix, func_req_id, self.session)
-            logger.warning('implicit role (falling back to legacy JsonHttpApiClient) is deprecated, please specify role explcitly')
-            result = type(cls.__name__, (JsonHttpApiClient,), cls_attr)(None, *args, **kwargs)
-            result.api_func = result
-            result.legacy = True
-            return result
-        elif role == 'client':
-            # Create a JsonHttpApiFunction in client role
-            # Example: my_api_func = MyApiFunc(url_prefix, func_req_id, self.session, role='client')
-            result = type(cls.__name__, (JsonHttpApiClient,), cls_attr)(None, *args, **kwargs)
-            result.api_func = result
-            return result
-        elif role == 'server':
-            # Create a JsonHttpApiFunction in server role
-            # Example: my_api_func = MyApiFunc(url_prefix, func_req_id, self.session, role='server')
-            result = type(cls.__name__, (JsonHttpApiServer,), cls_attr)(None, *args, **kwargs)
-            result.api_func = result
-            return result
-        else:
-            raise ValueError('Invalid role \'%s\' specified' % role)
-
-    def encode_client(self, data: dict) -> dict:
+    def encode(self, data: dict, func_call_id: Optional[str] = None) -> dict:
         """Validate an encode input dict into JSON-serializable dict for request body."""
         output = {}
+        if func_call_id:
+            output['header'] = {
+                    'functionRequesterIdentifier': self.func_req_id,
+                    'functionCallIdentifier': func_call_id
+                }
+
         for p in self.input_mandatory:
             if not p in data:
                 raise ValueError('Mandatory input parameter %s missing' % p)
         for p, v in data.items():
             p_class = self.input_params.get(p)
             if not p_class:
-                # pySim/esim/http_json_api.py:269:47: E1101: Instance of 'JsonHttpApiFunction' has no 'legacy' member (no-member)
-                # pylint: disable=no-member
-                if hasattr(self, 'legacy') and self.legacy:
-                    output[p] = JsonRequestHeader.encode(v)
-                else:
-                    logger.warning('Unexpected/unsupported input parameter %s=%s', p, v)
-                    output[p] = v
+                logger.warning('Unexpected/unsupported input parameter %s=%s', p, v)
+                output[p] = v
             else:
                 output[p] = p_class.encode(v)
         return output
 
-    def decode_client(self, data: dict) -> dict:
+    def decode(self, data: dict) -> dict:
         """[further] Decode and validate the JSON-Dict of the response body."""
         output = {}
-        output_mandatory = self.output_mandatory
+        if 'header' in self.output_params:
+            # let's first do the header, it's special
+            if not 'header' in data:
+                raise ValueError('Mandatory output parameter "header" missing')
+            hdr_class = self.output_params.get('header')
+            output['header'] = hdr_class.decode(data['header'])
 
-        # In case a provided header (may be optional) indicates that the API function call was unsuccessful, a
-        # different set of mandatory parameters applies.
-        header = data.get('header')
-        if header:
-            if data['header']['functionExecutionStatus']['status'] not in ['Executed-Success','Executed-WithWarning']:
-                output_mandatory = self.output_mandatory_failed
-
-        for p in output_mandatory:
+            if output['header']['functionExecutionStatus']['status'] not in ['Executed-Success','Executed-WithWarning']:
+                raise ApiError(output['header']['functionExecutionStatus'])
+        # we can only expect mandatory parameters to be present in case of successful execution
+        for p in self.output_mandatory:
+            if p == 'header':
+                continue
             if not p in data:
                 raise ValueError('Mandatory output parameter "%s" missing' % p)
         for p, v in data.items():
@@ -296,195 +231,35 @@ class JsonHttpApiFunction(abc.ABC):
                 output[p] = p_class.decode(v)
         return output
 
-    def encode_server(self, data: dict) -> dict:
-        """Validate an encode input dict into JSON-serializable dict for response body."""
-        output = {}
-        output_mandatory = self.output_mandatory
-
-        # In case a provided header (may be optional) indicates that the API function call was unsuccessful, a
-        # different set of mandatory parameters applies.
-        header = data.get('header')
-        if header:
-            if data['header']['functionExecutionStatus']['status'] not in ['Executed-Success','Executed-WithWarning']:
-                output_mandatory = self.output_mandatory_failed
-
-        for p in output_mandatory:
-            if not p in data:
-                raise ValueError('Mandatory output parameter %s missing' % p)
-        for p, v in data.items():
-            p_class = self.output_params.get(p)
-            if not p_class:
-                logger.warning('Unexpected/unsupported output parameter %s=%s', p, v)
-                output[p] = v
-            else:
-                output[p] = p_class.encode(v)
-        return output
-
-    def decode_server(self, data: dict) -> dict:
-        """[further] Decode and validate the JSON-Dict of the request body."""
-        output = {}
-
-        for p in self.input_mandatory:
-            if not p in data:
-                raise ValueError('Mandatory input parameter "%s" missing' % p)
-        for p, v in data.items():
-            p_class = self.input_params.get(p)
-            if not p_class:
-                logger.warning('Unexpected/unsupported input parameter "%s"="%s"', p, v)
-                output[p] = v
-            else:
-                output[p] = p_class.decode(v)
-        return output
-
-    def rewrite_url(self, data: dict, url: str) -> Tuple[dict, str]:
-        """
-        Rewrite a static URL using information passed in the data dict. This method may be overloaded by a derived
-        class to allow fully dynamic URLs. The input parameters required for the URL rewriting may be passed using
-        data parameter. In case those parameters are additional parameters that are not intended to be passed to
-        the encode_client method later, they must be removed explcitly.
-
-        Args:
-                data: (see JsonHttpApiClient and JsonHttpApiServer)
-                url: statically generated URL string (see comment in JsonHttpApiClient)
-        """
-
-        # This implementation is a placeholder in which we do not perform any URL rewriting. We just pass through data
-        # and url unmodified.
-        return data, url
-
-class JsonHttpApiClient():
-    def __init__(self, api_func: JsonHttpApiFunction, url_prefix: str, func_req_id: Optional[str],
-                 session: requests.Session):
-        """
-        Args:
-                api_func : API function definition (JsonHttpApiFunction)
-                url_prefix : prefix to be put in front of the API function path (see JsonHttpApiFunction)
-                func_req_id : function requestor id to use for requests
-                session : session object (requests)
-        """
-        self.api_func = api_func
-        self.url_prefix = url_prefix
-        self.func_req_id = func_req_id
-        self.session = session
-
     def call(self, data: dict, func_call_id: Optional[str] = None, timeout=10) -> Optional[dict]:
-        """
-        Make an API call to the HTTP API endpoint represented by this object. Input data is passed in `data` as
-        json-serializable fields. `data` may also contain additional parameters required for URL rewriting (see
-        rewrite_url in class JsonHttpApiFunction). Output data is returned as json-deserialized dict.
-
-        Args:
-                data: Input data required to perform the request.
-                func_call_id: Function Call Identifier, if present a header field is generated automatically.
-                timeout: Maximum amount of time to wait for the request to complete.
-        """
-
-        # In case a function caller ID is supplied, use it together with the stored function requestor ID to generate
-        # and prepend the header field according to SGP.22, section 6.5.1.1 and 6.5.1.3. (the presence of the header
-        # field is checked by the encode_client method)
-        if func_call_id:
-            data = {'header' : {'functionRequesterIdentifier': self.func_req_id,
-                                'functionCallIdentifier': func_call_id}} | data
-
-        # The URL used for the HTTP request (see below) normally consists of the initially given url_prefix
-        # concatenated with the path defined by the JsonHttpApiFunction definition. This static URL path may be
-        # rewritten by rewrite_url method defined in the JsonHttpApiFunction.
-        data, url = self.api_func.rewrite_url(data, self.url_prefix + self.api_func.path)
-
-        # Encode the message (the presence of mandatory fields is checked during encoding)
-        encoded = json.dumps(self.api_func.encode_client(data))
-
-        # Apply HTTP request headers according to SGP.22, section 6.5.1
+        """Make an API call to the HTTP API endpoint represented by this object.
+        Input data is passed in `data` as json-serializable dict.  Output data
+        is returned as json-deserialized dict."""
+        url = self.url_prefix + self.path
+        encoded = json.dumps(self.encode(data, func_call_id))
         req_headers = {
             'Content-Type': 'application/json',
             'X-Admin-Protocol': 'gsma/rsp/v2.5.0',
         }
-        req_headers.update(self.api_func.extra_http_req_headers)
+        req_headers.update(self.extra_http_req_headers)
 
-        # Perform HTTP request
         logger.debug("HTTP REQ %s - hdr: %s '%s'" % (url, req_headers, encoded))
-        response = self.session.request(self.api_func.http_method, url, data=encoded, headers=req_headers, timeout=timeout)
+        response = self.session.request(self.http_method, url, data=encoded, headers=req_headers, timeout=timeout)
         logger.debug("HTTP RSP-STS: [%u] hdr: %s" % (response.status_code, response.headers))
         logger.debug("HTTP RSP: %s" % (response.content))
 
-        # Check HTTP response status code and make sure that the returned HTTP headers look plausible (according to
-        # SGP.22, section 6.5.1)
-        if response.status_code != self.api_func.expected_http_status:
+        if response.status_code != self.expected_http_status:
             raise HttpStatusError(response)
-        if response.content and not response.headers.get('Content-Type').startswith(req_headers['Content-Type']):
+        if not response.headers.get('Content-Type').startswith(req_headers['Content-Type']):
             raise HttpHeaderError(response)
         if not response.headers.get('X-Admin-Protocol', 'gsma/rsp/v2.unknown').startswith('gsma/rsp/v2.'):
             raise HttpHeaderError(response)
 
-        # Decode response and return the result back to the caller
         if response.content:
-            output = self.api_func.decode_client(response.json())
-            # In case the response contains a header, check it to make sure that the API call was executed successfully
-            # (the presence of the header field is checked by the decode_client method)
-            if 'header' in output:
-                if output['header']['functionExecutionStatus']['status'] not in ['Executed-Success','Executed-WithWarning']:
-                    raise ApiError(output['header']['functionExecutionStatus'])
-            return output
+            if response.headers.get('Content-Type').startswith('application/json'):
+                return self.decode(response.json())
+            elif response.headers.get('Content-Type').startswith('text/plain;charset=UTF-8'):
+                return { 'data': response.content.decode('utf-8') }
+            raise HttpHeaderError(f'unimplemented response Content-Type: {response.headers=!r}')
+
         return None
-
-class JsonHttpApiServer():
-    def __init__(self, api_func: JsonHttpApiFunction, call_handler = None):
-        """
-        Args:
-                api_func : API function definition (JsonHttpApiFunction)
-                call_handler : handler function to process the request. This function must accept the
-                               decoded request as a dictionary. The handler function must return a tuple consisting
-                               of the response in the form of a dictionary (may be empty), and a function execution
-                               status string ('Executed-Success', 'Executed-WithWarning', 'Failed' or 'Expired')
-        """
-        self.api_func = api_func
-        if call_handler:
-            self.call_handler = call_handler
-        else:
-            self.call_handler = self.default_handler
-
-    def default_handler(self, data: dict) -> (dict, str):
-        """default handler, used in case no call handler is provided."""
-        logger.error("no handler function for request: %s" % str(data))
-        return {}, 'Failed'
-
-    def call(self, request: Request) -> str:
-        """ Process an incoming request.
-        Args:
-                request : request object as received using twisted.web.server
-        Returns:
-                encoded JSON string (HTTP response code and headers are set by calling the appropriate methods on the
-                provided the request object)
-        """
-
-        # Make sure the request is done with the correct HTTP method
-        if (request.method.decode() != self.api_func.http_method):
-            raise ValueError('Wrong HTTP method %s!=%s' % (request.method.decode(), self.api_func.http_method))
-
-        # Decode the request
-        decoded_request = self.api_func.decode_server(json.loads(request.content.read()))
-
-        # Run call handler (see above)
-        data, fe_status = self.call_handler(decoded_request)
-
-        # In case a function execution status is returned, use it to generate and prepend the header field according to
-        # SGP.22, section 6.5.1.2 and 6.5.1.4 (the presence of the header filed is checked by the encode_server method)
-        if fe_status:
-            data = {'header' : {'functionExecutionStatus': {'status' : fe_status}}} | data
-
-        # Encode the message (the presence of mandatory fields is checked during encoding)
-        encoded = json.dumps(self.api_func.encode_server(data))
-
-        # Apply HTTP request headers according to SGP.22, section 6.5.1
-        res_headers = {
-            'Content-Type': 'application/json',
-            'X-Admin-Protocol': 'gsma/rsp/v2.5.0',
-        }
-        res_headers.update(self.api_func.extra_http_res_headers)
-        for header, value in res_headers.items():
-            request.setHeader(header, value)
-        request.setResponseCode(self.api_func.expected_http_status)
-
-        # Return the encoded result back to the caller for sending (using twisted/klein)
-        return encoded
-

pySim/esim/saip/batch.py

@@ -20,15 +20,19 @@
 
 import copy
 import pprint
-from typing import Generator, Union
+import logging
+import traceback
+import inspect
+from typing import List, Generator
 from pySim.esim.saip.personalization import ConfigurableParameter
 from pySim.esim.saip import param_source
 from pySim.esim.saip import ProfileElementSequence, ProfileElementSD
 from pySim.global_platform import KeyUsageQualifier
 from osmocom.utils import b2h
 
-# a list of ConfigurableParameter classes and/or ConfigurableParameter class instances
-ParamList = list[Union[type[ConfigurableParameter], ConfigurableParameter]]
+logger = logging.getLogger(__name__)
+def _func_():
+    return inspect.currentframe().f_back.f_code.co_name
 
 class BatchPersonalization:
     """Produce a series of eSIM profiles from predefined parameters.
@@ -36,9 +40,9 @@ class BatchPersonalization:
 
     Usage example:
 
-    der_input = open('some_file', 'rb').read()
+    der_input = some_file.open('rb').read()
     pes = ProfileElementSequence.from_der(der_input)
-    p = BatchPersonalization(
+    p = pers.BatchPersonalization(
         n=10,
         src_pes=pes,
         csv_rows=get_csv_reader())
@@ -60,12 +64,9 @@ class BatchPersonalization:
     """
 
     class ParamAndSrc:
-        """tie a ConfigurableParameter to a source of actual values"""
+        'tie a ConfigurableParameter to a source of actual values'
         def __init__(self, param: ConfigurableParameter, src: param_source.ParamSource):
-            if isinstance(param, type):
-                self.param_cls = param
-            else:
-                self.param_cls = param.__class__
+            self.param = param
             self.src = src
 
     def __init__(self,
@@ -80,10 +81,10 @@ class BatchPersonalization:
                  copied.
         params: list of ParamAndSrc instances, defining a ConfigurableParameter and corresponding ParamSource to fill in
                 profile values.
-        csv_rows: A generator (e.g. iter(list_of_rows)) producing all CSV rows one at a time, starting with a row
-                  containing the column headers. This is compatible with the python csv.reader. Each row gets passed to
-                  ParamSource.get_next(), such that ParamSource implementations can access the row items. See
-                  param_source.CsvSource.
+        csv_rows: A list or generator producing all CSV rows one at a time, starting with a row containing the column
+                  headers. This is compatible with the python csv.reader. Each row gets passed to
+                  ParamSource.get_next(), such that ParamSource implementations can access the row items.
+                  See param_source.CsvSource.
         """
         self.n = n
         self.params = params or []
@@ -91,7 +92,7 @@ class BatchPersonalization:
         self.csv_rows = csv_rows
 
     def add_param_and_src(self, param:ConfigurableParameter, src:param_source.ParamSource):
-        self.params.append(BatchPersonalization.ParamAndSrc(param, src))
+        self.params.append(BatchPersonalization.ParamAndSrc(param=param, src=src))
 
     def generate_profiles(self):
         # get first row of CSV: column names
@@ -118,10 +119,12 @@ class BatchPersonalization:
                 try:
                     input_value = p.src.get_next(csv_row=csv_row)
                     assert input_value is not None
-                    value = p.param_cls.validate_val(input_value)
-                    p.param_cls.apply_val(pes, value)
+                    value = p.param.__class__.validate_val(input_value)
+                    p.param.__class__.apply_val(pes, value)
                 except Exception as e:
-                    raise ValueError(f'{p.param_cls.get_name()} fed by {p.src.name}: {e}') from e
+                    print(traceback.format_exc())
+                    logger.error('during %s: %r', _func_(), e)
+                    raise ValueError(f'{p.param.name} fed by {p.src.name}: {e!r}') from e
 
             yield pes
 
@@ -134,14 +137,14 @@ class UppAudit(dict):
     """
 
     @classmethod
-    def from_der(cls, der: bytes, params: ParamList, der_size=False, additional_sd_keys=False):
-        """return a dict of parameter name and set of selected parameter values found in a DER encoded profile. Note:
+    def from_der(cls, der: bytes, params: List, der_size=False, additional_sd_keys=False):
+        '''return a dict of parameter name and set of selected parameter values found in a DER encoded profile. Note:
         some ConfigurableParameter implementations return more than one key-value pair, for example, Imsi returns
         both 'IMSI' and 'IMSI-ACC' parameters.
 
         e.g.
             UppAudit.from_der(my_der, [Imsi, ])
-            --> {'IMSI': {'001010000000023'}, 'IMSI-ACC': {'5'}}
+            --> {'IMSI': '001010000000023', 'IMSI-ACC': '5'}
 
         (where 'IMSI' == Imsi.name)
 
@@ -157,7 +160,7 @@ class UppAudit(dict):
         Scp80Kvn03. So we would not show kvn 0x04..0x0f in an audit. additional_sd_keys=True includes audits of all SD
         key KVN there may be in the UPP. This helps to spot SD keys that may already be present in a UPP template, with
         unexpected / unusual kvn.
-        """
+        '''
 
         # make an instance of this class
         upp_audit = cls()
@@ -186,11 +189,11 @@ class UppAudit(dict):
                 audit_key = f'SdKey_KVN{key.key_version_number:02x}_ID{key.key_identifier:02x}'
                 kuq_bin = KeyUsageQualifier.build(key.key_usage_qualifier).hex()
                 audit_val = f'{key.key_components=!r} key_usage_qualifier=0x{kuq_bin}={key.key_usage_qualifier!r}'
-                upp_audit.add_values({audit_key: audit_val})
+                upp_audit[audit_key] = set((audit_val, ))
 
         return upp_audit
 
-    def get_single_val(self, key, allow_absent=False, absent_val=None):
+    def get_single_val(self, key, validate=True, allow_absent=False, absent_val=None):
         """
         Return the audit's value for the given audit key (like 'IMSI' or 'IMSI-ACC').
         Any kind of value may occur multiple times in a profile. When all of these agree to the same unambiguous value,
@@ -230,7 +233,7 @@ class UppAudit(dict):
 
         v = try_single_val(v)
         if isinstance(v, bytes):
-            v = b2h(v)
+            v = bytes_to_hexstr(v)
         if v is None:
             return 'not present'
         return str(v)
@@ -240,21 +243,21 @@ class UppAudit(dict):
         return UppAudit.audit_val_to_str(self.get(key))
 
     def add_values(self, src:dict):
-        """Merge a plain dict of values into self, which is a dict of sets.
+        """self and src are both a dict of sets.
         For example from
-            self == { 'a': {123} }
+            self == { 'a': set((123,)) }
         and
-            src == { 'a': 456, 'b': 789 }
+            src == { 'a': set((456,)), 'b': set((789,)) }
         then after this function call:
-            self == { 'a': {123, 456}, 'b': {789} }
+            self == { 'a': set((123, 456,)), 'b': set((789,)) }
         """
         assert isinstance(src, dict)
-        for key, srcval in src.items():
+        for key, srcvalset in src.items():
             dstvalset = self.get(key)
             if dstvalset is None:
                 dstvalset = set()
                 self[key] = dstvalset
-            dstvalset.add(srcval)
+            dstvalset.add(srcvalset)
 
     def __str__(self):
         return '\n'.join(f'{key}: {self.get_val_str(key)}' for key in sorted(self.keys()))
@@ -279,7 +282,7 @@ class BatchAudit(list):
     BatchAudit itself is a list, callers may use the standard python list API to access the UppAudit instances.
     """
 
-    def __init__(self, params: ParamList):
+    def __init__(self, params:List):
         assert params
         self.params = params
 
@@ -322,12 +325,15 @@ class BatchAudit(list):
 
         return batch_audit
 
-    def to_csv_rows(self, headers=True, sort_key=None):
-        """generator that yields all audits' values as rows, useful feed to a csv.writer."""
+    def to_csv_rows(self, headers=True, sort_key=None, column_blacklist=None):
+        '''generator that yields all audits' values as rows, useful feed to a csv.writer.'''
         columns = set()
         for audit in self:
             columns.update(audit.keys())
 
+        if column_blacklist:
+            columns.difference_update(set(column_blacklist))
+
         columns = tuple(sorted(columns, key=sort_key))
 
         if headers:
@@ -336,6 +342,9 @@ class BatchAudit(list):
         for audit in self:
             yield (audit.get_single_val(col, allow_absent=True, absent_val="") for col in columns)
 
+def bytes_to_hexstr(b:bytes, sep=''):
+    return sep.join(f'{x:02x}' for x in b)
+
 def esim_profile_introspect(upp):
     pes = ProfileElementSequence.from_der(upp.read())
     d = {}
@@ -343,7 +352,7 @@ def esim_profile_introspect(upp):
 
     def show_bytes_as_hexdump(item):
         if isinstance(item, bytes):
-            return b2h(item)
+            return bytes_to_hexstr(item)
         if isinstance(item, list):
             return list(show_bytes_as_hexdump(i) for i in item)
         if isinstance(item, tuple):

pySim/esim/saip/param_source.py

@@ -37,10 +37,13 @@ class ParamSource:
     name = "none"
     numeric_base = None # or 10 or 16
 
-    def __init__(self, input_str:str):
-        """Subclasses should call super().__init__(input_str) before evaluating self.input_str. Each subclass __init__()
-        may in turn manipulate self.input_str to apply expansions or decodings."""
-        self.input_str = input_str
+    @classmethod
+    def from_str(cls, s:str):
+        """Subclasses implement this:
+           if a parameter source defines some string input magic, override this function.
+           For example, a RandomDigitSource derives the number of digits from the string length,
+           so the user can enter '0000' to get a four digit random number."""
+        return cls(s)
 
     def get_next(self, csv_row:dict=None):
         """Subclasses implement this: return the next value from the parameter source.
@@ -48,143 +51,146 @@ class ParamSource:
            This default implementation is an empty source."""
         raise ParamSourceExhaustedExn()
 
-    @classmethod
-    def from_str(cls, input_str:str):
-        """compatibility with earlier version of ParamSource. Just use the constructor."""
-        return cls(input_str)
 
 class ConstantSource(ParamSource):
     """one value for all"""
     name = "constant"
 
+    def __init__(self, val:str):
+        self.val = val
+
     def get_next(self, csv_row:dict=None):
-        return self.input_str
+        return self.val
 
 class InputExpandingParamSource(ParamSource):
 
-    def __init__(self, input_str:str):
-        super().__init__(input_str)
-        self.input_str = self.expand_input_str(self.input_str)
-
     @classmethod
-    def expand_input_str(cls, input_str:str):
+    def expand_str(cls, s:str):
         # user convenience syntax '0*32' becomes '00000000000000000000000000000000'
-        if "*" not in input_str:
-            return input_str
-        # re:                "XX            *        123" with optional spaces
-        tokens = re.split(r"([^ \t]+)[ \t]*\*[ \t]*([0-9]+)", input_str)
+        if "*" not in s:
+            return s
+        tokens = re.split(r"([^ \t]+)[ \t]*\*[ \t]*([0-9]+)", s)
         if len(tokens) < 3:
-            return input_str
+            return s
         parts = []
         for unchanged, snippet, repeat_str in zip(tokens[0::3], tokens[1::3], tokens[2::3]):
             parts.append(unchanged)
             repeat = int(repeat_str)
             parts.append(snippet * repeat)
-
         return "".join(parts)
 
+    @classmethod
+    def from_str(cls, s:str):
+        return cls(cls.expand_str(s))
+
 class DecimalRangeSource(InputExpandingParamSource):
     """abstract: decimal numbers with a value range"""
 
     numeric_base = 10
 
-    def __init__(self, input_str:str=None, num_digits:int=None, first_value:int=None, last_value:int=None):
-        """Constructor to set up values from a (user entered) string: DecimalRangeSource(input_str).
-        Constructor to set up values directly: DecimalRangeSource(num_digits=3, first_value=123, last_value=456)
-
-        num_digits produces leading zeros when first_value..last_value are shorter.
+    def __init__(self, num_digits, first_value, last_value):
         """
-        assert ((input_str is not None and (num_digits, first_value, last_value) == (None, None, None))
-                or (input_str is None and None not in (num_digits, first_value, last_value)))
-
-        if input_str is not None:
-            super().__init__(input_str)
-
-            input_str = self.input_str
-
-            if ".." in input_str:
-                first_str, last_str = input_str.split('..')
-                first_str = first_str.strip()
-                last_str = last_str.strip()
-            else:
-                first_str = input_str.strip()
-                last_str = None
-
-            num_digits = len(first_str)
-            first_value = int(first_str)
-            last_value = int(last_str if last_str is not None else "9" * num_digits)
+        See also from_str().
 
+        All arguments are integer values, and are converted to int if necessary, so a string of an integer is fine.
+        num_digits: fixed number of digits (possibly with leading zeros) to generate.
+        first_value, last_value: the decimal range in which to provide digits.
+        """
+        num_digits = int(num_digits)
+        first_value = int(first_value)
+        last_value = int(last_value)
         assert num_digits > 0
         assert first_value <= last_value
         self.num_digits = num_digits
-        self.first_value = first_value
-        self.last_value = last_value
+        self.val_first_last = (first_value, last_value)
 
     def val_to_digit(self, val:int):
         return "%0*d" % (self.num_digits, val)  # pylint: disable=consider-using-f-string
 
+    @classmethod
+    def from_str(cls, s:str):
+        s = cls.expand_str(s)
+
+        if ".." in s:
+            first_str, last_str = s.split('..')
+            first_str = first_str.strip()
+            last_str = last_str.strip()
+        else:
+            first_str = s.strip()
+            last_str = None
+
+        first_value = int(first_str)
+        last_value = int(last_str) if last_str is not None else "9" * len(first_str)
+        return cls(num_digits=len(first_str), first_value=first_value, last_value=last_value)
+
 class RandomSourceMixin:
     random_impl = secrets.SystemRandom()
 
 class RandomDigitSource(DecimalRangeSource, RandomSourceMixin):
     """return a different sequence of random decimal digits each"""
     name = "random decimal digits"
-
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.used_keys = set()
+    used_keys = set()
 
     def get_next(self, csv_row:dict=None):
-        # try to generate random digits that are always different from previously produced random digits
-        for _ in range(10):
-            val = self.random_impl.randint(self.first_value, self.last_value)
-            if val not in self.used_keys:
-                break
-        self.used_keys.add(val)
+        # try to generate random digits that are always different from previously produced random bytes
+        attempts = 10
+        while True:
+            val = self.random_impl.randint(*self.val_first_last)
+            if val in RandomDigitSource.used_keys:
+                attempts -= 1
+                if attempts:
+                    continue
+            RandomDigitSource.used_keys.add(val)
+            break
         return self.val_to_digit(val)
 
 class RandomHexDigitSource(InputExpandingParamSource, RandomSourceMixin):
     """return a different sequence of random hexadecimal digits each"""
     name = "random hexadecimal digits"
     numeric_base = 16
-    def __init__(self, input_str:str):
-        super().__init__(input_str)
-        input_str = self.input_str
+    used_keys = set()
 
-        num_digits = len(input_str.strip())
+    def __init__(self, num_digits):
+        """see from_str()"""
+        num_digits = int(num_digits)
         if num_digits < 1:
             raise ValueError("zero number of digits")
         # hex digits always come in two
         if (num_digits & 1) != 0:
             raise ValueError(f"hexadecimal value should have even number of digits, not {num_digits}")
         self.num_digits = num_digits
-        self.used_keys = set()
 
     def get_next(self, csv_row:dict=None):
         # try to generate random bytes that are always different from previously produced random bytes
-        for _ in range(10):
+        attempts = 10
+        while True:
             val = self.random_impl.randbytes(self.num_digits // 2)
-            if val not in self.used_keys:
-                break
-        self.used_keys.add(val)
+            if val in RandomHexDigitSource.used_keys:
+                attempts -= 1
+                if attempts:
+                    continue
+            RandomHexDigitSource.used_keys.add(val)
+            break
 
         return b2h(val)
 
+    @classmethod
+    def from_str(cls, s:str):
+        s = cls.expand_str(s)
+        return cls(num_digits=len(s.strip()))
+
 class IncDigitSource(DecimalRangeSource):
     """incrementing sequence of digits"""
     name = "incrementing decimal digits"
 
-    def __init__(self, input_str:str=None, num_digits:int=None, first_value:int=None, last_value:int=None):
-        """input_str: the range of values to iterate. Format: 'FIRST..LAST' (e.g. '0001..9999') or
-        just 'FIRST' (iterates to the maximum value for the given digit width). Leading zeros in
-        FIRST determine the digit width and are preserved in returned values."""
-        super().__init__(input_str, num_digits, first_value, last_value)
+    def __init__(self, num_digits, first_value, last_value):
+        super().__init__(num_digits, first_value, last_value)
         self.next_val = None
         self.reset()
 
     def reset(self):
         """Restart from the first value of the defined range passed to __init__()."""
-        self.next_val = self.first_value
+        self.next_val = self.val_first_last[0]
 
     def get_next(self, csv_row:dict=None):
         val = self.next_val
@@ -194,7 +200,7 @@ class IncDigitSource(DecimalRangeSource):
         returnval = self.val_to_digit(val)
 
         val += 1
-        if val > self.last_value:
+        if val > self.val_first_last[1]:
             self.next_val = None
         else:
             self.next_val = val
@@ -205,17 +211,18 @@ class CsvSource(ParamSource):
     """apply a column from a CSV row, as passed in to ParamSource.get_next(csv_row)"""
     name = "from CSV"
 
-    def __init__(self, input_str:str):
-        """input_str: the CSV column name to read values from.
-        The caller passes the current CSV row to get_next(), from which CsvSource picks the column matching
-        this name."""
-        super().__init__(input_str)
-        self.csv_column = self.input_str
+    def __init__(self, csv_column):
+        """
+        csv_column: column name indicating the column to use for this parameter.
+                    This name is used in get_next(): the caller passes the current CSV row to get_next(), from which
+                    CsvSource picks the column with the name matching csv_column.
+        """
+        self.csv_column = csv_column
 
     def get_next(self, csv_row:dict=None):
         val = None
         if csv_row:
             val = csv_row.get(self.csv_column)
-        if val is None:
+        if not val:
             raise ParamSourceUndefinedExn(f"no value for CSV column {self.csv_column!r}")
         return val

pySim/esim/saip/personalization.py

@@ -16,16 +16,18 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import abc
-import enum
 import io
+import os
 import re
+import pprint
+import json
 from typing import List, Tuple, Generator, Optional
 
 from construct.core import StreamError
 from osmocom.tlv import camel_to_snake
 from osmocom.utils import hexstr
 from pySim.utils import enc_iccid, dec_iccid, enc_imsi, dec_imsi, h2b, b2h, rpad, sanitize_iccid
-from pySim.ts_31_102 import EF_AD
+from pySim.ts_31_102 import EF_AD, EF_UST, EF_Routing_Indicator, EF_SUCI_Calc_Info
 from pySim.ts_51_011 import EF_SMSP
 from pySim.esim.saip import param_source
 from pySim.esim.saip import ProfileElement, ProfileElementSD, ProfileElementSequence
@@ -238,7 +240,7 @@ class ConfigurableParameter(abc.ABC, metaclass=ClassVarMeta):
             if val is None:
                 val = v
             elif val != v:
-                raise ValueError(f'get_value_from_pes(): got distinct values: {val!r} != {v!r}')
+                    raise ValueError(f'get_value_from_pes(): got distinct values: {val!r} != {v!r}')
         return val
 
     @classmethod
@@ -290,7 +292,9 @@ class ConfigurableParameter(abc.ABC, metaclass=ClassVarMeta):
            May be overridden by subclasses.
            This default implementation returns the maximum allowed value length -- a good fit for most subclasses.
            '''
-        return cls.get_len_range()[1] or 16
+        l = cls.get_len_range()[1] or 16
+        l = min(10*80, l)
+        return l
 
     @classmethod
     def is_super_of(cls, other_class):
@@ -329,7 +333,6 @@ class DecimalHexParam(DecimalParam):
     @classmethod
     def validate_val(cls, val):
         val = super().validate_val(val)
-        assert isinstance(val, str)
         val = ''.join('%02x' % ord(x) for x in val)
         if cls.rpad is not None:
             c = cls.rpad_char
@@ -339,7 +342,7 @@ class DecimalHexParam(DecimalParam):
 
     @classmethod
     def decimal_hex_to_str(cls, val):
-        """useful for get_values_from_pes() implementations of subclasses"""
+        'useful for get_values_from_pes() implementations of subclasses'
         if isinstance(val, bytes):
             val = b2h(val)
         assert isinstance(val, hexstr)
@@ -420,69 +423,67 @@ class BinaryParam(ConfigurableParameter):
 
 
 class EnumParam(ConfigurableParameter):
-    """ConfigurableParameter for named integer enumeration values.
-
-    Subclasses must define a nested enum.IntEnum named 'Values' listing all valid names and their
-    integer codes.  apply_val() and get_values_from_pes() are not implemented here and this must
-    be inherited from another mixin."""
-
-    class Values(enum.IntEnum):
-        pass  # subclasses override this
+    value_map = {
+            # For example:
+            #'Meaningful label for value 23': 0x23,
+            # Where 0x23 is a valid value to use for apply_val().
+        }
+    _value_map_reverse = None
 
     @classmethod
-    def validate_val(cls, val) -> int:
-        if isinstance(val, int):
-            try:
-                return int(cls.Values(val))
-            except ValueError:
-                pass
-        elif isinstance(val, str):
-            member = cls.map_name_to_val(val, strict=False)
-            if member is not None:
-                return member
+    def validate_val(cls, val):
+        orig_val = val
+        enum_val = None
+        if isinstance(val, str):
+            enum_name = val
+            enum_val = cls.map_name_to_val(enum_name)
 
-        valid = ', '.join(m.name for m in cls.Values)
-        raise ValueError(f"{cls.get_name()}: invalid argument: {val!r}. Valid arguments are: {valid}")
+        # if the str is not one of the known value_map.keys(), is it maybe one of value_map.keys()?
+        if enum_val is None and val in cls.value_map.values():
+            enum_val = val
+
+        if enum_val not in cls.value_map.values():
+            raise ValueError(f"{cls.get_name()}: invalid argument: {orig_val!r}. Valid arguments are:"
+                             f" {', '.join(cls.value_map.keys())}")
+
+        return enum_val
 
     @classmethod
-    def map_name_to_val(cls, name: str, strict=True) -> int:
-        """Return the integer value for a given enum member name. Performs an exact match first,
-        then falls back to fuzzy matching (case-insensitive, punctuation-insensitive)."""
-        try:
-            return int(cls.Values[name])
-        except KeyError:
-            pass
+    def map_name_to_val(cls, name:str, strict=True):
+        val = cls.value_map.get(name)
+        if val is not None:
+            return val
 
-        clean = cls.clean_name_str(name)
-        for member in cls.Values:
-            if cls.clean_name_str(member.name) == clean:
-                return int(member)
+        clean_name = cls.clean_name_str(name)
+        for k, v in cls.value_map.items():
+            if clean_name == cls.clean_name_str(k):
+                return v
 
         if strict:
-            valid = ', '.join(m.name for m in cls.Values)
-            raise ValueError(f"{cls.get_name()}: {name!r} is not a known value. Known values are: {valid}")
+            raise ValueError(f"Problem in {cls.get_name()}: {name!r} is not a known value."
+                    f" Known values are: {cls.value_map.keys()!r}")
         return None
 
     @classmethod
     def map_val_to_name(cls, val, strict=False) -> str:
-        """Return the enum member name for a given integer value."""
-        try:
-            return cls.Values(val).name
-        except ValueError:
-            if strict:
-                raise ValueError(f"{cls.get_name()}: {val!r} ({type(val).__name__}) is not a known value.")
-            return None
+        if cls._value_map_reverse is None:
+            cls._value_map_reverse = dict((v, k) for k, v in cls.value_map.items())
+
+        name = cls._value_map_reverse.get(val)
+        if name:
+            return name
+        if strict:
+            raise ValueError(f"Problem in {cls.get_name()}: {val!r} ({type(val)}) is not a known value."
+                    f" Known values are: {cls.value_map.values()!r}")
+        return None
 
     @classmethod
-    def name_normalize(cls, name: str) -> str:
-        """Map a (possibly fuzzy) name to its canonical enum member name."""
-        return cls.Values(cls.map_name_to_val(name)).name
+    def name_normalize(cls, name:str) -> str:
+        return cls.map_val_to_name(cls.map_name_to_val(name))
 
     @classmethod
-    def clean_name_str(cls, val: str) -> str:
-        """Strip punctuation and case for fuzzy name comparison.
-        Treats hyphens and underscores as equivalent (both removed)."""
-        return re.sub('[^0-9A-Za-z]', '', val).lower()
+    def clean_name_str(cls, val):
+        return re.sub('[^0-9A-Za-z-_]', '', val).lower()
 
 
 class Iccid(DecimalParam):
@@ -635,21 +636,28 @@ class SmspTpScAddr(ConfigurableParameter):
             # - To generate the right amount of fillFileContent, pass total_len=42 to encode_record_bin().
             # - To show the right size in the PES, set f_smsp.rec_len = 42
             ef_smsp_dec['alpha_id'] = ''
-            f_smsp.rec_len = 42
+
+            # we can set this to choose a fixed length:
+            #f_smsp.rec_len = 42
+            # but leave rec_len unchanged to keep the same length as was found in the eSIM template.
 
             # re-encode into the File body.
-            #
-            #print("SMSP  (new): %s" % f_smsp.body)
-            # re-generate the pe.decoded member from the File instance
             f_smsp.body = ef_smsp.encode_record_bin(ef_smsp_dec, 1, total_len=f_smsp.rec_len)
+            # re-generate the pe.decoded member from the File instance
             pe.file2pe(f_smsp)
 
     @classmethod
     def get_values_from_pes(cls, pes: ProfileElementSequence):
         for pe in pes.get_pes_for_type('usim'):
-            f_smsp = pe.files['ef-smsp']
-            ef_smsp = EF_SMSP()
-            ef_smsp_dec = ef_smsp.decode_record_bin(f_smsp.body, 1)
+            f_smsp = pe.files.get('ef-smsp', None)
+            if f_smsp is None:
+                continue
+
+            try:
+                ef_smsp = EF_SMSP()
+                ef_smsp_dec = ef_smsp.decode_record_bin(f_smsp.body, 1)
+            except IndexError:
+                continue
 
             tp_sc_addr = ef_smsp_dec.get('tp_sc_addr', None)
 
@@ -663,69 +671,57 @@ class SmspTpScAddr(ConfigurableParameter):
 
 
 class MncLen(EnumParam):
-    """MNC length.  Sets only the MNC length field in EF.AD (Administrative Data).
-    Accepted values: integer 2 or 3, digit strings '2' or '3', or enum names 'MNC2'/'MNC3'.
-    """
+    """MNC length. Must be either 2 or 3. Sets only the MNC length field in EF-AD (Administrative Data)."""
     name = 'MNC-LEN'
-    example_input = '2'
+    value_map = { '2': 2, '3': 3 }
     default_source = param_source.ConstantSource
-
-    class Values(enum.IntEnum):
-        MNC2 = 2
-        MNC3 = 3
+    example_input = '2'
 
     @classmethod
-    def validate_val(cls, val):
-        if isinstance(val, str) and val.isdigit():
-            val = int(val)
-        return super().validate_val(val)
-
-    @classmethod
-    def _get_f_ad(cls, pe: ProfileElement):
-        if not hasattr(pe, 'files'):
-            return None
-        f_ad = pe.files.get('ef-ad', None)
-        if f_ad and f_ad.body:
-            return f_ad
-        return None
-
-    @classmethod
-    def _decode_f_ad(cls, f_ad):
-        try:
-            ef_ad_dec = EF_AD().decode_bin(f_ad.body)
-        except StreamError:
-            return None
-        if 'mnc_len' not in ef_ad_dec:
-            return None
-        return ef_ad_dec
-
-    @classmethod
-    def apply_val(cls, pes: ProfileElementSequence, val: int):
+    def apply_val(cls, pes: ProfileElementSequence, val):
+        """val must be an int: either 2 or 3"""
         for pe in pes.get_pes_for_type('usim'):
-            f_ad = cls._get_f_ad(pe)
-            if f_ad is None:
+            if not hasattr(pe, 'files'):
+                continue
+            f_ad = pe.files.get('ef-ad')
+            if not f_ad:
                 continue
             # decode existing values
-            ef_ad_dec = cls._decode_f_ad(f_ad)
-            if ef_ad_dec is None:
+            if not f_ad.body:
+                continue
+            try:
+                ef_ad = EF_AD()
+                ef_ad_dec = ef_ad.decode_bin(f_ad.body)
+            except StreamError:
+                continue
+            if 'mnc_len' not in ef_ad_dec:
                 continue
             # change mnc_len
             ef_ad_dec['mnc_len'] = val
             # re-encode into the File body
-            f_ad.body = EF_AD().encode_bin(ef_ad_dec)
+            f_ad.body = ef_ad.encode_bin(ef_ad_dec)
             pe.file2pe(f_ad)
 
     @classmethod
     def get_values_from_pes(cls, pes: ProfileElementSequence):
         for pe in pes.get_pes_for_type('usim'):
-            f_ad = cls._get_f_ad(pe)
+            if not hasattr(pe, 'files'):
+                continue
+            f_ad = pe.files.get('ef-ad', None)
             if f_ad is None:
                 continue
-            ef_ad_dec = cls._decode_f_ad(f_ad)
-            if ef_ad_dec is None:
+
+            try:
+                ef_ad = EF_AD()
+                ef_ad_dec = ef_ad.decode_bin(f_ad.body)
+            except StreamError:
                 continue
-            mnc_len = ef_ad_dec.get('mnc_len')
-            yield { cls.name: str(mnc_len) }
+
+            mnc_len = ef_ad_dec.get('mnc_len', None)
+            if mnc_len is None:
+                continue
+
+            yield { cls.name: cls.map_val_to_name(int(mnc_len)) }
 
 
 class SdKey(BinaryParam):
@@ -734,6 +730,7 @@ class SdKey(BinaryParam):
     # these will be set by subclasses
     key_type = None
     kvn = None
+    reserved_kvn = tuple() # tuple of all reserved kvn for a given SCPxx
     key_id = None
     key_usage_qual = None
 
@@ -779,6 +776,8 @@ class SdKey(BinaryParam):
                 yield { cls.name: b2h(kc) }
 
 
+    NO_OP = (('', {}))
+
     LEN_128 = (16,)
     LEN_128_192_256 = (16, 24, 32)
     LEN_128_256 = (16, 32)
@@ -1018,7 +1017,7 @@ class Pin(DecimalHexParam):
 
             for pinCode in pinCodes.decoded['pinCodes'][1]:
                 if pinCode['keyReference'] == cls.keyReference:
-                    yield { cls.name: cls.decimal_hex_to_str(pinCode['pinValue']) }
+                     yield { cls.name: cls.decimal_hex_to_str(pinCode['pinValue']) }
 
     @classmethod
     def get_values_from_pes(cls, pes: ProfileElementSequence):
@@ -1096,20 +1095,22 @@ class AlgoConfig(ConfigurableParameter):
             yield { cls.name: val }
 
 class AlgorithmID(EnumParam, AlgoConfig):
-    """use validate_val() from EnumParam, and apply_val() from AlgoConfig.
-    In get_values_from_pes(), return enum value names, not raw values."""
+    '''use validate_val() from EnumParam, and apply_val() from AlgoConfig.
+    In get_values_from_pes(), return enum value names, not raw values.'''
     name = "Algorithm"
-    algo_config_key = 'algorithmID'
+
+    # as in pySim/esim/asn1/saip/PE_Definitions-3.3.1.asn
+    value_map = {
+            "Milenage" : 1,
+            "TUAK" : 2,
+            "usim-test" : 3,
+        }
     example_input = "Milenage"
     default_source = param_source.ConstantSource
 
-    # as in pySim/esim/asn1/saip/PE_Definitions-3.3.1.asn
-    class Values(enum.IntEnum):
-        Milenage  = 1
-        TUAK      = 2
-        usim_test = 3  # input 'usim-test' also accepted via fuzzy matching
+    algo_config_key = 'algorithmID'
 
-    # EnumParam.validate_val() returns the int values from Values
+    # EnumParam.validate_val() returns the int values from value_map
 
     @classmethod
     def get_values_from_pes(cls, pes: ProfileElementSequence):
@@ -1184,3 +1185,203 @@ class TuakNumberOfKeccak(IntegerParam, AlgoConfig):
     max_val = 255
     example_input = '1'
     default_source = param_source.ConstantSource
+    numeric_base = None  # indicate that this won't need random number sources
+
+
+class EfUstServiceParam(EnumParam):
+    """superclass for EF-UST service flag parameters"""
+    service_idx = 0
+    value_map = { 'enabled': True, 'disabled': False }
+    default_source = param_source.ConstantSource
+    example_input = sorted(value_map.keys())[0]
+
+    @classmethod
+    def apply_val(cls, pes: ProfileElementSequence, val):
+        for pe in pes.get_pes_for_type('usim'):
+            f_ust = pe.files['ef-ust']
+            ef_ust = EF_UST()
+            ust = ef_ust.decode_bin(f_ust.body)
+
+            ust[cls.service_idx]['activated'] = val
+
+            f_ust.body = ef_ust.encode_bin(ust)
+            pe.file2pe(f_ust)
+
+    @classmethod
+    def get_values_from_pes(cls, pes: ProfileElementSequence):
+        for pe in pes.get_pes_for_type('usim'):
+            f_ust = pe.files.get('ef-ust', None)
+            if not f_ust:
+                continue
+            ef_ust = EF_UST()
+            try:
+                ust = ef_ust.decode_bin(f_ust.body)
+
+                service_flag = ust[cls.service_idx]['activated']
+                yield { cls.name: cls.map_val_to_name(service_flag) }
+            except:
+                pass
+
+class SuciActive(EfUstServiceParam):
+    """EF-UST service nr 124: enable or disable the SUCI service."""
+    service_idx = 124
+    name = '5G-SUCI-active'
+    value_map = { 'SUCI-off': False, 'SUCI-on': True }
+    example_input = 'SUCI-on'
+
+class SuciInUsim(EfUstServiceParam):
+    """EF-UST service nr 125: calculate SUCI in UE or in USIM"""
+    service_idx = 125
+    name = '5G-SUCI-in-USIM'
+    value_map = { 'SUCI-in-UE': False, 'SUCI-in-USIM': True }
+    example_input = 'SUCI-in-USIM'
+
+class SuciRi(ConfigurableParameter):
+    """SUCI Routing Indicator as in section 4.4.11.11 of 3GPP TS 31.102"""
+    name = '5G-SUCI-RI'
+    allow_chars = '0123456789'
+    min_len = 1
+    max_len = 4
+    allow_types = (str,)
+    example_input = '0'
+    default_source = param_source.ConstantSource
+
+    KEY_RI = "routing_indicator"
+
+    @classmethod
+    def apply_val(cls, pes: ProfileElementSequence, val):
+        for pe in pes.get_pes_for_type('df-5gs'):
+            f_ri = pe.files.get('ef-routing-indicator', None)
+            if f_ri is None:
+                continue
+            ef_ri = EF_Routing_Indicator()
+            ri = ef_ri.decode_bin(f_ri.body)
+
+            ri[cls.KEY_RI] = str(val)
+
+            f_ri.body = ef_ri.encode_bin(ri)
+            pe.file2pe(f_ri)
+
+    @classmethod
+    def get_values_from_pes(cls, pes: ProfileElementSequence):
+        for pe in pes.get_pes_for_type('df-5gs'):
+            f_ri = pe.files.get('ef-routing-indicator', None)
+            if f_ri is None:
+                continue
+            ef_ri = EF_Routing_Indicator()
+            try:
+                ri = ef_ri.decode_bin(f_ri.body)
+                yield { cls.name: ri.get(cls.KEY_RI) }
+            except:
+                pass
+
+class SuciCalcInfoParameter(ConfigurableParameter):
+    """SUCI Calculation Information as in section 4.4.11.8 of 3GPP TS 31.102"""
+    name = '5G-SUCI-CalcInfo'
+    default_source = param_source.ConstantSource
+    allow_types = (str,)
+    max_len = 4096  # to indicate a large input field to UI renderers
+    example_input = '{"prot_scheme_id_list": [{"priority": 0, "identifier": 0, "key_index": 0}], "hnet_pubkey_list": []}'
+
+    PE_IN_UE = ("df-5gs", "ef-suci-calc-info")
+    PE_IN_USIM = ("df-saip", "ef-suci-calc-info-usim")
+    suci_calc_info_pe = None
+
+    @classmethod
+    def validate_val(cls, val):
+        val = super().validate_val(val)
+
+        if not val:
+            val = "{}"
+
+        # check that it is a dict something like
+        # {
+        #     "prot_scheme_id_list": [
+        #         {"priority": 0, "identifier": 2, "key_index": 1},
+        #         {"priority": 1, "identifier": 1, "key_index": 2},
+        #         ],
+        #     "hnet_pubkey_list": [
+        #         {"hnet_pubkey_identifier": 27,
+        #          "hnet_pubkey": "0472DA71976234CE833A6907425867B82E074D44EF907DFB4B3E21C1C2256EBCD15A7DED52FCBB097A4ED250E036C7B9C8C7004C4EEDC4F068CD7BF8D3F900E3B4"},
+        #         {"hnet_pubkey_identifier": 30,
+        #          "hnet_pubkey": "5A8D38864820197C3394B92613B20B91633CBD897119273BF8E4A6F4EEC0A650"},
+        #          ],
+        # }
+
+        try:
+            d = json.loads(val)
+        except json.decoder.JSONDecodeError as e:
+            raise ValueError(f"Cannot parse SUCI Calc Info: {e}") from e
+
+        KEY_PSI_LIST = 'prot_scheme_id_list'
+        KEY_HPK_LIST = 'hnet_pubkey_list'
+        KEYS_D = set((KEY_HPK_LIST, KEY_PSI_LIST))
+        KEYS_PSI = set(('identifier', 'key_index', 'priority'))
+        KEYS_HPK = set(('hnet_pubkey_identifier', 'hnet_pubkey'))
+
+        if not d:
+            d = { KEY_PSI_LIST: [], KEY_HPK_LIST: [] }
+
+        if not (isinstance(d, dict)
+                and set(d.keys()) == KEYS_D):
+            raise ValueError(f"Unexpected structure in SUCI Calc Info: expected dict with entries {KEYS_D}")
+
+        psi = d.get(KEY_PSI_LIST, None)
+        if not all((set(e.keys()) == KEYS_PSI) for e in psi):
+            raise ValueError("Unexpected structure in SUCI Calc Info:"
+                             f" in {KEY_PSI_LIST}, expected dict with entries {KEYS_PSI}")
+
+        hpk = d.get(KEY_HPK_LIST, None)
+        if not all((set(e.keys()) == KEYS_HPK) for e in hpk):
+            raise ValueError("Unexpected structure in SUCI Calc Info:"
+                             f" in {KEY_HPK_LIST}, expected dict with entries {KEYS_HPK}")
+        return d
+
+    @classmethod
+    def _apply_suci(cls, pes: ProfileElementSequence, val, pe_type="df-5gs", pe_file="ef-suci-calc-info"):
+        for pe in pes.get_pes_for_type(pe_type):
+            f_sucici = pe.files.get(pe_file, None)
+            if not f_sucici:
+                continue
+            ef_sucici = EF_SUCI_Calc_Info()
+            f_sucici.body = ef_sucici.encode_bin(val)
+            pe.file2pe(f_sucici)
+
+    @classmethod
+    def apply_val(cls, pes: ProfileElementSequence, val):
+        cls._apply_suci(pes, val, *cls.suci_calc_info_pe)
+
+    @classmethod
+    def _get_suci(cls, pes: ProfileElementSequence, pe_type="df-5gs", pe_file="ef-suci-calc-info"):
+        for pe in pes.get_pes_for_type(pe_type):
+            f_sucici = pe.files.get(pe_file, None)
+            if not f_sucici:
+                continue
+            ef_sucici = EF_SUCI_Calc_Info()
+            sucici = ef_sucici.decode_bin(f_sucici.body)
+
+            if not sucici:
+                sucici = {}
+
+            # normalize to string (bytes cannot go into json)
+            for hnet_pubkey in sucici.get('hnet_pubkey_list', ()):
+                val = hnet_pubkey['hnet_pubkey']
+                if isinstance(val, bytes):
+                    val = b2h(val)
+                    hnet_pubkey['hnet_pubkey'] = val
+
+            yield { cls.name: json.dumps(sucici) }
+
+    @classmethod
+    def get_values_from_pes(cls, pes: ProfileElementSequence):
+        yield from cls._get_suci(pes, *cls.suci_calc_info_pe)
+
+class SuciCalcInfoUe(SuciCalcInfoParameter):
+    """SUCI Calculation Information as in section 4.4.11.8 of 3GPP TS 31.102, readable by UE (DF-5GS)"""
+    name = '5G-SUCI-CalcInfo-UE'
+    suci_calc_info_pe = SuciCalcInfoParameter.PE_IN_UE
+
+class SuciCalcInfoUsim(SuciCalcInfoParameter):
+    """SUCI Calculation Information as in section 4.4.11.8 of 3GPP TS 31.102, readable only by USIM (DF-SAIP)"""
+    name = '5G-SUCI-CalcInfo-USIM'
+    suci_calc_info_pe = SuciCalcInfoParameter.PE_IN_USIM

pySim/euicc.py

@@ -226,28 +226,9 @@ class Icon(BER_TLV_IE, tag=0x94):
     _construct = GreedyBytes
 class ProfileClass(BER_TLV_IE, tag=0x95):
     _construct = Enum(Int8ub, test=0, provisioning=1, operational=2)
-class ProfilePolicyRules(BER_TLV_IE, tag=0x99):
-    _construct = GreedyBytes
-class NotificationConfigurationInfo(BER_TLV_IE, tag=0xb6):
-    _construct = GreedyBytes
-
-# ProfileOwner
-class ProfileOwnerPLMN(BER_TLV_IE, tag=0x80):
-    _construct = PlmnAdapter(Bytes(3))
-class ProfileOwnerGID1(BER_TLV_IE, tag=0x81):
-    _construct = GreedyBytes
-class ProfileOwnerGID2(BER_TLV_IE, tag=0x82):
-    _construct = GreedyBytes
-class ProfileOwner(BER_TLV_IE, tag=0xb7, nested=[ProfileOwnerPLMN, ProfileOwnerGID1, ProfileOwnerGID2]):
-    _construct = GreedyBytes
-
-class SMDPPProprietaryData(BER_TLV_IE, tag=0xb8):
-    _construct = GreedyBytes
-
 class ProfileInfo(BER_TLV_IE, tag=0xe3, nested=[Iccid, IsdpAid, ProfileState, ProfileNickname,
                                                 ServiceProviderName, ProfileName, IconType, Icon,
-                                                ProfileClass, ProfilePolicyRules, NotificationConfigurationInfo,
-                                                ProfileOwner, SMDPPProprietaryData]):
+                                                ProfileClass]): # FIXME: more IEs
     pass
 class ProfileInfoSeq(BER_TLV_IE, tag=0xa0, nested=[ProfileInfo]):
     pass
@@ -463,28 +444,9 @@ class CardApplicationISDR(pySim.global_platform.CardApplicationSD):
             d = rn.to_dict()
             self._cmd.poutput_json(flatten_dict_lists(d['notification_sent_resp']))
 
-        get_profiles_info_parser = argparse.ArgumentParser()
-        get_profiles_info_parser.add_argument('--all', action='store_true', help='Retrieve all known tags of a profile')
-
-        @cmd2.with_argparser(get_profiles_info_parser)
-        def do_get_profiles_info(self, opts):
+        def do_get_profiles_info(self, _opts):
             """Perform an ES10c GetProfilesInfo function."""
-            if opts.all:
-                tags = [nest.tag for nest in ProfileInfo.nested_collection_cls().nested]
-                u8tags = []
-                # TODO: rework TagList to support 2 byte tags to not filter it into u8 tags
-                for tag in tags:
-                    if tag <= 255:
-                        u8tags.append(tag)
-                    elif tag <= 65535:
-                        u8tags.append(tag >> 8)
-                        u8tags.append(tag & 0xff)
-                    # Ignoring 3 byte tags
-                req = ProfileInfoListReq(children=[TagList(decoded=u8tags)])
-            else:
-                req = ProfileInfoListReq()
-
-            pi = CardApplicationISDR.store_data_tlv(self._cmd.lchan.scc, req, ProfileInfoListResp)
+            pi = CardApplicationISDR.store_data_tlv(self._cmd.lchan.scc, ProfileInfoListReq(), ProfileInfoListResp)
             d = pi.to_dict()
             self._cmd.poutput_json(flatten_dict_lists(d['profile_info_list_resp']))
 

pySim/filesystem.py

@@ -44,7 +44,6 @@ from pySim.utils import sw_match, decomposeATR
 from pySim.jsonpath import js_path_modify
 from pySim.commands import SimCardCommands
 from pySim.exceptions import SwMatchError
-from pySim.log import PySimLogger
 
 # int: a single service is associated with this file
 # list: any of the listed services requires this file
@@ -53,8 +52,6 @@ CardFileService = Union[int, List[int], Tuple[int, ...]]
 
 Size = Tuple[int, Optional[int]]
 
-log = PySimLogger.get(__name__)
-
 class CardFile:
     """Base class for all objects in the smart card filesystem.
     Serve as a common ancestor to all other file types; rarely used directly.
@@ -1612,14 +1609,14 @@ class CardModel(abc.ABC):
         card_atr = scc.get_atr()
         for atr in cls._atrs:
             if atr == card_atr:
-                log.info("Detected CardModel: %s", cls.__name__)
+                print("Detected CardModel:", cls.__name__)
                 return True
         # if nothing found try to just compare the Historical Bytes of the ATR
         card_atr_hb = decomposeATR(card_atr)['hb']
         for atr in cls._atrs:
             atr_hb = decomposeATR(atr)['hb']
             if atr_hb == card_atr_hb:
-                log.info("Detected CardModel: %s", cls.__name__)
+                print("Detected CardModel:", cls.__name__)
                 return True
         return False
 

pySim/global_platform/__init__.py

@@ -29,15 +29,12 @@ from osmocom.tlv import *
 from osmocom.construct import *
 from pySim.utils import ResTuple
 from pySim.card_key_provider import card_key_provider_get_field
-from pySim.global_platform.scp import SCP, SCP02, SCP03
+from pySim.global_platform.scp import SCP02, SCP03
 from pySim.global_platform.install_param import gen_install_parameters
 from pySim.filesystem import *
 from pySim.profile import CardProfile
 from pySim.ota import SimFileAccessAndToolkitAppSpecParams
 from pySim.javacard import CapFile
-from pySim.log import PySimLogger
-
-log = PySimLogger.get(__name__)
 
 # GPCS Table 11-48 Load Parameter Tags
 class NonVolatileCodeMinMemoryReq(BER_TLV_IE, tag=0xC6):
@@ -530,129 +527,6 @@ class ADF_SD(CardADF):
     def decode_select_response(self, data_hex: str) -> object:
         return decode_select_response(data_hex)
 
-    @staticmethod
-    def store_data(scc: SimCardCommands, data: bytes, structure:str = 'none', encryption:str = 'none',
-                   response_permitted: bool = False) -> bytes:
-        """
-        Perform the GlobalPlatform STORE DATA command in order to store some card-specific data.
-        See GlobalPlatform CardSpecification v2.3 Section 11.11 for details.
-        """
-        max_cmd_len =scc.max_cmd_len
-        # Table 11-89 of GP Card Specification v2.3
-        remainder = data
-        block_nr = 0
-        response = ''
-        while len(remainder):
-            chunk = remainder[:max_cmd_len]
-            remainder = remainder[max_cmd_len:]
-            p1b = build_construct(ADF_SD.StoreData,
-                                  {'last_block': len(remainder) == 0, 'encryption': encryption,
-                                   'structure': structure, 'response': response_permitted})
-            hdr = "80E2%02x%02x%02x" % (p1b[0], block_nr, len(chunk))
-            data, _sw =scc.send_apdu_checksw(hdr + b2h(chunk) + "00")
-            block_nr += 1
-            response += data
-        return h2b(response)
-
-    @staticmethod
-    def get_data(scc: SimCardCommands, tag: int) -> bytes:
-        (data, _sw) =scc.get_data(cla=0x80, tag=tag)
-        return data
-
-    @staticmethod
-    def put_key(scc: SimCardCommands, old_kvn:int, kvn: int, kid: int, key_dict: dict) -> bytes:
-        """
-        Perform the GlobalPlatform PUT KEY command in order to store a new key on the card.
-        See GlobalPlatform CardSpecification v2.3 Section 11.8 for details.
-        """
-
-        # Table 11-68: Key Data Field - Format 1 (Basic Format)
-        KeyDataBasic = GreedyRange(Struct('key_type'/KeyType,
-                                          'kcb'/Prefixed(Int8ub, GreedyBytes),
-                                          'kcv'/Prefixed(Int8ub, GreedyBytes)))
-
-        key_data = kvn.to_bytes(1, 'big') + build_construct(KeyDataBasic, key_dict)
-        hdr = "80D8%02x%02x%02x" % (old_kvn, kid, len(key_data))
-        data, _sw =scc.send_apdu_checksw(hdr + b2h(key_data) + "00")
-        return data
-
-    @staticmethod
-    def get_status(scc: SimCardCommands, subset:str, aid_search_qualifier:Hexstr = '') -> List[GpRegistryRelatedData]:
-        subset_hex = b2h(build_construct(StatusSubset, subset))
-        aid = ApplicationAID(decoded=aid_search_qualifier)
-        cmd_data = aid.to_tlv() + h2b('5c054f9f70c5cc')
-        p2 = 0x02 # TLV format according to Table 11-36
-        grd_list = []
-        while True:
-            hdr = "80F2%s%02x%02x" % (subset_hex, p2, len(cmd_data))
-            data, sw =scc.send_apdu(hdr + b2h(cmd_data) + "00")
-            remainder = h2b(data)
-            while len(remainder):
-                # tlv sequence, each element is one GpRegistryRelatedData()
-                grd = GpRegistryRelatedData()
-                _dec, remainder = grd.from_tlv(remainder)
-                grd_list.append(grd)
-            if sw != '6310':
-                return grd_list
-            else:
-                p2 |= 0x01
-        return grd_list
-
-    @staticmethod
-    def set_status(scc: SimCardCommands, scope:str, status:str, aid:Hexstr = ''):
-        SetStatus = Struct(Const(0x80, Byte), Const(0xF0, Byte),
-                           'scope'/SetStatusScope, 'status'/CLifeCycleState,
-                           'aid'/Prefixed(Int8ub, COptional(GreedyBytes)))
-        apdu = build_construct(SetStatus, {'scope':scope, 'status':status, 'aid':aid})
-        _data, _sw =scc.send_apdu_checksw(b2h(apdu))
-
-    @staticmethod
-    def install(scc: SimCardCommands, p1:int, p2:int, data:Hexstr) -> ResTuple:
-        cmd_hex = "80E6%02x%02x%02x%s00" % (p1, p2, len(data)//2, data)
-        return scc.send_apdu_checksw(cmd_hex)
-
-    @staticmethod
-    def delete(scc: SimCardCommands, p1:int, p2:int, data:Hexstr) -> ResTuple:
-        cmd_hex = "80E4%02x%02x%02x%s00" % (p1, p2, len(data)//2, data)
-        return scc.send_apdu_checksw(cmd_hex)
-
-    @staticmethod
-    def load(scc: SimCardCommands, contents:bytes, chunk_len:int = 240):
-        # TODO:tune chunk_len based on the overhead of the used SCP?
-        # build TLV according to GPC_SPE_034 section 11.6.2.3 / Table 11-58 for unencrypted case
-        remainder = b'\xC4' + bertlv_encode_len(len(contents)) + contents
-        # transfer this in various chunks to the card
-        total_size = len(remainder)
-        block_nr = 0
-        while len(remainder):
-            block = remainder[:chunk_len]
-            remainder = remainder[chunk_len:]
-            # build LOAD command APDU according to GPC_SPE_034 section 11.6.2 / Table 11-56
-            p1 = 0x00 if len(remainder) else 0x80
-            p2 = block_nr % 256
-            block_nr += 1
-            cmd_hex = "80E8%02x%02x%02x%s00" % (p1, p2, len(block), b2h(block))
-            _rsp_hex, _sw =scc.send_apdu_checksw(cmd_hex)
-        log.info("Loaded a total of %u bytes in %u blocks. Don't forget install_for_install (and make selectable) now!",
-                 total_size, block_nr)
-
-    @staticmethod
-    def establish_scp(scc: SimCardCommands, scp: SCP, host_challenge: Optional[bytes] = None,
-                      security_level: int = 0x01):
-        # perform the common functionality shared by SCP02 and SCP03 establishment
-        init_update_apdu = scp.gen_init_update_apdu(host_challenge=host_challenge)
-        init_update_resp, _sw =scc.send_apdu_checksw(b2h(init_update_apdu))
-        scp.parse_init_update_resp(h2b(init_update_resp))
-        ext_auth_apdu = scp.gen_ext_auth_apdu(security_level)
-        _ext_auth_resp, _sw =scc.send_apdu_checksw(b2h(ext_auth_apdu))
-        log.info("Successfully established a %s secure channel", str(scp))
-        # store a reference to the SCP instance
-        scc.scp = scp
-
-    @staticmethod
-    def release_scp(scc: SimCardCommands):
-       scc.scp = None
-
     @with_default_category('Application-Specific Commands')
     class AddlShellCommands(CommandSet):
         get_data_parser = argparse.ArgumentParser()
@@ -670,8 +544,7 @@ class ADF_SD(CardADF):
                 self._cmd.poutput('Unknown data object "%s", available options: %s' % (tlv_cls_name,
                                                                                        do_names))
                 return
-
-            data = ADF_SD.get_data(self._cmd.lchan.scc, tag=tlv_cls.tag)
+            (data, _sw) = self._cmd.lchan.scc.get_data(cla=0x80, tag=tlv_cls.tag)
             ie = tlv_cls()
             ie.from_tlv(h2b(data))
             self._cmd.poutput_json(ie.to_dict())
@@ -692,8 +565,27 @@ class ADF_SD(CardADF):
             """Perform the GlobalPlatform STORE DATA command in order to store some card-specific data.
             See GlobalPlatform CardSpecification v2.3 Section 11.11 for details."""
             response_permitted = opts.response == 'may_be_returned'
-            ADF_SD.store_data(self._cmd.lchan.scc, h2b(opts.DATA), opts.data_structure, opts.encryption,
-                              response_permitted)
+            self.store_data(h2b(opts.DATA), opts.data_structure, opts.encryption, response_permitted)
+
+        def store_data(self, data: bytes, structure:str = 'none', encryption:str = 'none', response_permitted: bool = False) -> bytes:
+            """Perform the GlobalPlatform STORE DATA command in order to store some card-specific data.
+            See GlobalPlatform CardSpecification v2.3 Section 11.11 for details."""
+            max_cmd_len = self._cmd.lchan.scc.max_cmd_len
+            # Table 11-89 of GP Card Specification v2.3
+            remainder = data
+            block_nr = 0
+            response = ''
+            while len(remainder):
+                chunk = remainder[:max_cmd_len]
+                remainder = remainder[max_cmd_len:]
+                p1b = build_construct(ADF_SD.StoreData,
+                                      {'last_block': len(remainder) == 0, 'encryption': encryption,
+                                       'structure': structure, 'response': response_permitted})
+                hdr = "80E2%02x%02x%02x" % (p1b[0], block_nr, len(chunk))
+                data, _sw = self._cmd.lchan.scc.send_apdu_checksw(hdr + b2h(chunk) + "00")
+                block_nr += 1
+                response += data
+            return h2b(response)
 
         put_key_parser = argparse.ArgumentParser()
         put_key_parser.add_argument('--old-key-version-nr', type=auto_uint8, default=0, help='Old Key Version Number')
@@ -744,8 +636,20 @@ class ADF_SD(CardADF):
             p2 = opts.key_id
             if len(opts.key_type) > 1:
                 p2 |= 0x80
-            ADF_SD.put_key(self._cmd.lchan.scc, opts.old_key_version_nr, opts.key_version_nr, p2, kdb)
+            self.put_key(opts.old_key_version_nr, opts.key_version_nr, p2, kdb)
 
+        # Table 11-68: Key Data Field - Format 1 (Basic Format)
+        KeyDataBasic = GreedyRange(Struct('key_type'/KeyType,
+                                          'kcb'/Prefixed(Int8ub, GreedyBytes),
+                                          'kcv'/Prefixed(Int8ub, GreedyBytes)))
+
+        def put_key(self, old_kvn:int, kvn: int, kid: int, key_dict: dict) -> bytes:
+            """Perform the GlobalPlatform PUT KEY command in order to store a new key on the card.
+            See GlobalPlatform CardSpecification v2.3 Section 11.8 for details."""
+            key_data = kvn.to_bytes(1, 'big') + build_construct(ADF_SD.AddlShellCommands.KeyDataBasic, key_dict)
+            hdr = "80D8%02x%02x%02x" % (old_kvn, kid, len(key_data))
+            data, _sw = self._cmd.lchan.scc.send_apdu_checksw(hdr + b2h(key_data) + "00")
+            return data
 
         get_status_parser = argparse.ArgumentParser()
         get_status_parser.add_argument('subset', choices=list(StatusSubset.ksymapping.values()),
@@ -757,10 +661,31 @@ class ADF_SD(CardADF):
         def do_get_status(self, opts):
             """Perform GlobalPlatform GET STATUS command in order to retrieve status information
             on Issuer Security Domain, Executable Load File, Executable Module or Applications."""
-            grd_list = ADF_SD.get_status(self._cmd.lchan.scc, opts.subset, opts.aid)
+            grd_list = self.get_status(opts.subset, opts.aid)
             for grd in grd_list:
                 self._cmd.poutput_json(grd.to_dict())
 
+        def get_status(self, subset:str, aid_search_qualifier:Hexstr = '') -> List[GpRegistryRelatedData]:
+            subset_hex = b2h(build_construct(StatusSubset, subset))
+            aid = ApplicationAID(decoded=aid_search_qualifier)
+            cmd_data = aid.to_tlv() + h2b('5c054f9f70c5cc')
+            p2 = 0x02 # TLV format according to Table 11-36
+            grd_list = []
+            while True:
+                hdr = "80F2%s%02x%02x" % (subset_hex, p2, len(cmd_data))
+                data, sw = self._cmd.lchan.scc.send_apdu(hdr + b2h(cmd_data) + "00")
+                remainder = h2b(data)
+                while len(remainder):
+                    # tlv sequence, each element is one GpRegistryRelatedData()
+                    grd = GpRegistryRelatedData()
+                    _dec, remainder = grd.from_tlv(remainder)
+                    grd_list.append(grd)
+                if sw != '6310':
+                    return grd_list
+                else:
+                    p2 |= 0x01
+            return grd_list
+
         set_status_parser = argparse.ArgumentParser()
         set_status_parser.add_argument('scope', choices=list(SetStatusScope.ksymapping.values()),
                                        help='Defines the scope of the requested status change')
@@ -774,7 +699,14 @@ class ADF_SD(CardADF):
             """Perform GlobalPlatform SET STATUS command in order to change the life cycle state of the
             Issuer Security Domain, Supplementary Security Domain or Application.  This normally requires
             prior authentication with a Secure Channel Protocol."""
-            ADF_SD.set_status(self._cmd.lchan.scc, opts.scope, opts.status, opts.aid)
+            self.set_status(opts.scope, opts.status, opts.aid)
+
+        def set_status(self, scope:str, status:str, aid:Hexstr = ''):
+            SetStatus = Struct(Const(0x80, Byte), Const(0xF0, Byte),
+                               'scope'/SetStatusScope, 'status'/CLifeCycleState,
+                               'aid'/Prefixed(Int8ub, COptional(GreedyBytes)))
+            apdu = build_construct(SetStatus, {'scope':scope, 'status':status, 'aid':aid})
+            _data, _sw = self._cmd.lchan.scc.send_apdu_checksw(b2h(apdu))
 
         inst_perso_parser = argparse.ArgumentParser()
         inst_perso_parser.add_argument('application_aid', type=is_hexstr, help='Application AID')
@@ -784,8 +716,7 @@ class ADF_SD(CardADF):
             """Perform GlobalPlatform INSTALL [for personalization] command in order to inform a Security
             Domain that the following STORE DATA commands are meant for a specific AID (specified here)."""
             # Section 11.5.2.3.6 / Table 11-47
-            ADF_SD.install(self._cmd.lchan.scc, 0x20, 0x00, "0000%02x%s000000" %
-                           (len(opts.application_aid)//2, opts.application_aid))
+            self.install(0x20, 0x00, "0000%02x%s000000" % (len(opts.application_aid)//2, opts.application_aid))
 
         inst_inst_parser = argparse.ArgumentParser()
         inst_inst_parser.add_argument('--load-file-aid', type=is_hexstr, default='',
@@ -820,7 +751,7 @@ class ADF_SD(CardADF):
             # convert from list to "true-dict" as required by construct.FlagsEnum
             decoded['privileges'] = {x: True for x in decoded['privileges']}
             ifi_bytes = build_construct(InstallForInstallCD, decoded)
-            ADF_SD.install(self._cmd.lchan.scc, p1, 0x00, b2h(ifi_bytes))
+            self.install(p1, 0x00, b2h(ifi_bytes))
 
         inst_load_parser = argparse.ArgumentParser()
         inst_load_parser.add_argument('--load-file-aid', type=is_hexstr, required=True,
@@ -845,7 +776,11 @@ class ADF_SD(CardADF):
                                       'load_parameters'/Prefixed(Int8ub, GreedyBytes),
                                       'load_token'/Prefixed(Int8ub, GreedyBytes))
             ifl_bytes = build_construct(InstallForLoadCD, vars(opts))
-            ADF_SD.install(self._cmd.lchan.scc, 0x02, 0x00, b2h(ifl_bytes))
+            self.install(0x02, 0x00, b2h(ifl_bytes))
+
+        def install(self, p1:int, p2:int, data:Hexstr) -> ResTuple:
+            cmd_hex = "80E6%02x%02x%02x%s00" % (p1, p2, len(data)//2, data)
+            return self._cmd.lchan.scc.send_apdu_checksw(cmd_hex)
 
         del_cc_parser = argparse.ArgumentParser()
         del_cc_parser.add_argument('aid', type=is_hexstr,
@@ -859,7 +794,7 @@ class ADF_SD(CardADF):
             File, an Application or an Executable Load File and its related Applications."""
             p2 = 0x80 if opts.delete_related_objects else 0x00
             aid = ApplicationAID(decoded=opts.aid)
-            ADF_SD.delete(self._cmd.lchan.scc, 0x00, p2, b2h(aid.to_tlv()))
+            self.delete(0x00, p2, b2h(aid.to_tlv()))
 
         del_key_parser = argparse.ArgumentParser()
         del_key_parser.add_argument('--key-id', type=auto_uint7, help='Key Identifier (KID)')
@@ -880,7 +815,11 @@ class ADF_SD(CardADF):
                 cmd += "d001%02x" % opts.key_id
             if opts.key_ver is not None:
                 cmd += "d201%02x" % opts.key_ver
-            ADF_SD.delete(self._cmd.lchan.scc, 0x00, p2, cmd)
+            self.delete(0x00, p2, cmd)
+
+        def delete(self, p1:int, p2:int, data:Hexstr) -> ResTuple:
+            cmd_hex = "80E4%02x%02x%02x%s00" % (p1, p2, len(data)//2, data)
+            return self._cmd.lchan.scc.send_apdu_checksw(cmd_hex)
 
         load_parser = argparse.ArgumentParser()
         load_parser_from_grp = load_parser.add_mutually_exclusive_group(required=True)
@@ -893,15 +832,33 @@ class ADF_SD(CardADF):
             """Perform a GlobalPlatform LOAD command. (We currently only support loading without DAP and
             without ciphering.)"""
             if opts.from_hex is not None:
-                ADF_SD.load(self._cmd.lchan.scc, h2b(opts.from_hex))
+                self.load(h2b(opts.from_hex))
             elif opts.from_file is not None:
-                ADF_SD.load(self._cmd.lchan.scc, opts.from_file.read())
+                self.load(opts.from_file.read())
             elif opts.from_cap_file is not None:
                 cap = CapFile(opts.from_cap_file)
-                ADF_SD.load(self._cmd.lchan.scc, cap.get_loadfile())
+                self.load(cap.get_loadfile())
             else:
                 raise ValueError('load source not specified!')
 
+        def load(self, contents:bytes, chunk_len:int = 240):
+            # TODO:tune chunk_len based on the overhead of the used SCP?
+            # build TLV according to GPC_SPE_034 section 11.6.2.3 / Table 11-58 for unencrypted case
+            remainder = b'\xC4' + bertlv_encode_len(len(contents)) + contents
+            # transfer this in various chunks to the card
+            total_size = len(remainder)
+            block_nr = 0
+            while len(remainder):
+                block = remainder[:chunk_len]
+                remainder = remainder[chunk_len:]
+                # build LOAD command APDU according to GPC_SPE_034 section 11.6.2 / Table 11-56
+                p1 = 0x00 if len(remainder) else 0x80
+                p2 = block_nr % 256
+                block_nr += 1
+                cmd_hex = "80E8%02x%02x%02x%s00" % (p1, p2, len(block), b2h(block))
+                _rsp_hex, _sw = self._cmd.lchan.scc.send_apdu_checksw(cmd_hex)
+            self._cmd.poutput("Loaded a total of %u bytes in %u blocks. Don't forget install_for_install (and make selectable) now!" % (total_size, block_nr))
+
         install_cap_parser = argparse.ArgumentParser(usage='%(prog)s FILE [--install-parameters | --install-parameters-*]')
         install_cap_parser.add_argument('cap_file', type=str, metavar='FILE',
                                         help='JAVA-CARD CAP file to install')
@@ -962,7 +919,7 @@ class ADF_SD(CardADF):
             self._cmd.poutput("step #1: install for load...")
             self.do_install_for_load("--load-file-aid %s --security-domain-aid %s" % (load_file_aid, security_domain_aid))
             self._cmd.poutput("step #2: load...")
-            ADF_SD.load(self._cmd.lchan.scc, load_file)
+            self.load(load_file)
             self._cmd.poutput("step #3: install_for_install (and make selectable)...")
             self.do_install_for_install("--load-file-aid %s --module-aid %s --application-aid %s --install-parameters %s --make-selectable" %
                                         (load_file_aid, module_aid, application_aid, install_parameters))
@@ -1002,7 +959,7 @@ class ADF_SD(CardADF):
             host_challenge = h2b(opts.host_challenge) if opts.host_challenge else get_random_bytes(8)
             kset = GpCardKeyset(opts.key_ver, h2b(opts.key_enc), h2b(opts.key_mac), h2b(opts.key_dek))
             scp02 = SCP02(card_keys=kset)
-            ADF_SD.establish_scp(self._cmd.lchan.scc, scp02, host_challenge, opts.security_level)
+            self._establish_scp(scp02, host_challenge, opts.security_level)
 
         est_scp03_parser = deepcopy(est_scp02_parser)
         est_scp03_parser.description = None
@@ -1030,14 +987,27 @@ class ADF_SD(CardADF):
             host_challenge = h2b(opts.host_challenge) if opts.host_challenge else get_random_bytes(s_mode)
             kset = GpCardKeyset(opts.key_ver, h2b(opts.key_enc), h2b(opts.key_mac), h2b(opts.key_dek))
             scp03 = SCP03(card_keys=kset, s_mode = s_mode)
-            ADF_SD.establish_scp(self._cmd.lchan.scc, scp03, host_challenge, opts.security_level)
+            self._establish_scp(scp03, host_challenge, opts.security_level)
+
+        def _establish_scp(self, scp, host_challenge, security_level):
+            # perform the common functionality shared by SCP02 and SCP03 establishment
+            init_update_apdu = scp.gen_init_update_apdu(host_challenge=host_challenge)
+            init_update_resp, _sw = self._cmd.lchan.scc.send_apdu_checksw(b2h(init_update_apdu))
+            scp.parse_init_update_resp(h2b(init_update_resp))
+            ext_auth_apdu = scp.gen_ext_auth_apdu(security_level)
+            _ext_auth_resp, _sw = self._cmd.lchan.scc.send_apdu_checksw(b2h(ext_auth_apdu))
+            self._cmd.poutput("Successfully established a %s secure channel" % str(scp))
+            # store a reference to the SCP instance
+            self._cmd.lchan.scc.scp = scp
+            self._cmd.update_prompt()
+
 
         def do_release_scp(self, _opts):
             """Release a previously establiehed secure channel."""
             if not self._cmd.lchan.scc.scp:
                 self._cmd.poutput("Cannot release SCP as none is established")
                 return
-            ADF_SD.release_scp(self._cmd.lchan.scc)
+            self._cmd.lchan.scc.scp = None
             self._cmd.update_prompt()
 
 

pySim/global_platform/scp.py

@@ -27,9 +27,9 @@ from osmocom.utils import b2h
 from osmocom.tlv import bertlv_parse_len, bertlv_encode_len
 from pySim.utils import parse_command_apdu
 from pySim.secure_channel import SecureChannel
-from pySim.log import PySimLogger
 
-log = PySimLogger.get(__name__)
+logger = logging.getLogger(__name__)
+logger.setLevel(logging.DEBUG)
 
 def scp02_key_derivation(constant: bytes, counter: int, base_key: bytes) -> bytes:
     assert len(constant) == 2
@@ -75,7 +75,7 @@ class Scp02SessionKeys:
             h = e.encrypt(strxor(h, bytes(padded_data[8*i:8*(i+1)])))
         h = d.decrypt(h)
         h = e.encrypt(h)
-        log.debug("mac_1des(%s,icv=%s) -> %s", b2h(data), b2h(icv), b2h(h))
+        logger.debug("mac_1des(%s,icv=%s) -> %s", b2h(data), b2h(icv), b2h(h))
         if self.des_icv_enc:
             self.icv = self.des_icv_enc.encrypt(h)
         else:
@@ -89,7 +89,7 @@ class Scp02SessionKeys:
         h = b'\x00' * 8
         for i in range(q):
             h = e.encrypt(strxor(h, bytes(padded_data[8*i:8*(i+1)])))
-        log.debug("mac_3des(%s) -> %s", b2h(data), b2h(h))
+        logger.debug("mac_3des(%s) -> %s", b2h(data), b2h(h))
         return h
 
     def __init__(self, counter: int, card_keys: 'GpCardKeyset', icv_encrypt=True):
@@ -276,10 +276,10 @@ class SCP02(SCP):
         return cipher.decrypt(ciphertext)
 
     def _compute_cryptograms(self, card_challenge: bytes, host_challenge: bytes):
-        log.debug("host_challenge(%s), card_challenge(%s)", b2h(host_challenge), b2h(card_challenge))
+        logger.debug("host_challenge(%s), card_challenge(%s)", b2h(host_challenge), b2h(card_challenge))
         self.host_cryptogram = self.sk.calc_mac_3des(self.sk.counter.to_bytes(2, 'big') + card_challenge + host_challenge)
         self.card_cryptogram = self.sk.calc_mac_3des(self.host_challenge + self.sk.counter.to_bytes(2, 'big') + card_challenge)
-        log.debug("host_cryptogram(%s), card_cryptogram(%s)", b2h(self.host_cryptogram), b2h(self.card_cryptogram))
+        logger.debug("host_cryptogram(%s), card_cryptogram(%s)", b2h(self.host_cryptogram), b2h(self.card_cryptogram))
 
     def gen_init_update_apdu(self, host_challenge: bytes = b'\x00'*8) -> bytes:
         """Generate INITIALIZE UPDATE APDU."""
@@ -291,7 +291,7 @@ class SCP02(SCP):
         resp = self.constr_iur.parse(resp_bin)
         self.card_challenge = resp['card_challenge']
         self.sk = Scp02SessionKeys(resp['seq_counter'], self.card_keys)
-        log.debug(self.sk)
+        logger.debug(self.sk)
         self._compute_cryptograms(self.card_challenge, self.host_challenge)
         if self.card_cryptogram != resp['card_cryptogram']:
             raise ValueError("card cryptogram doesn't match")
@@ -311,7 +311,7 @@ class SCP02(SCP):
 
     def _wrap_cmd_apdu(self, apdu: bytes, *args, **kwargs) -> bytes:
         """Wrap Command APDU for SCP02: calculate MAC and encrypt."""
-        log.debug("wrap_cmd_apdu(%s)", b2h(apdu))
+        logger.debug("wrap_cmd_apdu(%s)", b2h(apdu))
 
         if not self.do_cmac:
             return apdu
@@ -378,7 +378,7 @@ def scp03_key_derivation(constant: bytes, context: bytes, base_key: bytes, l: Op
     if l is None:
         l = len(base_key) * 8
 
-    log.debug("scp03_kdf(constant=%s, context=%s, base_key=%s, l=%u)", b2h(constant), b2h(context), b2h(base_key), l)
+    logger.debug("scp03_kdf(constant=%s, context=%s, base_key=%s, l=%u)", b2h(constant), b2h(context), b2h(base_key), l)
     output_len = l // 8
     # SCP03 Section 4.1.5 defines a different parameter order than NIST SP 800-108, so we cannot use the
     # existing Cryptodome.Protocol.KDF.SP800_108_Counter function :(
@@ -451,7 +451,7 @@ class Scp03SessionKeys:
         # This block SHALL be encrypted with S-ENC to produce the ICV for command encryption.
         cipher = AES.new(self.s_enc, AES.MODE_CBC, iv)
         icv = cipher.encrypt(data)
-        log.debug("_get_icv(data=%s, is_resp=%s) -> icv=%s", b2h(data), is_response, b2h(icv))
+        logger.debug("_get_icv(data=%s, is_resp=%s) -> icv=%s", b2h(data), is_response, b2h(icv))
         return icv
 
     # TODO: Resolve duplication with pySim.esim.bsp.BspAlgoCryptAES128 which provides pad80-wrapping
@@ -489,12 +489,12 @@ class SCP03(SCP):
         return cipher.decrypt(ciphertext)
 
     def _compute_cryptograms(self):
-        log.debug("host_challenge(%s), card_challenge(%s)", b2h(self.host_challenge), b2h(self.card_challenge))
+        logger.debug("host_challenge(%s), card_challenge(%s)", b2h(self.host_challenge), b2h(self.card_challenge))
         # Card + Host Authentication Cryptogram: Section 6.2.2.2 + 6.2.2.3
         context = self.host_challenge + self.card_challenge
         self.card_cryptogram = scp03_key_derivation(self.sk.DERIV_CONST_AUTH_CGRAM_CARD, context, self.sk.s_mac, l=self.s_mode*8)
         self.host_cryptogram = scp03_key_derivation(self.sk.DERIV_CONST_AUTH_CGRAM_HOST, context, self.sk.s_mac, l=self.s_mode*8)
-        log.debug("host_cryptogram(%s), card_cryptogram(%s)", b2h(self.host_cryptogram), b2h(self.card_cryptogram))
+        logger.debug("host_cryptogram(%s), card_cryptogram(%s)", b2h(self.host_cryptogram), b2h(self.card_cryptogram))
 
     def gen_init_update_apdu(self, host_challenge: Optional[bytes] = None) -> bytes:
         """Generate INITIALIZE UPDATE APDU."""
@@ -514,7 +514,7 @@ class SCP03(SCP):
         self.i_param = resp['i_param']
         # derive session keys and compute cryptograms
         self.sk = Scp03SessionKeys(self.card_keys, self.host_challenge, self.card_challenge)
-        log.debug(self.sk)
+        logger.debug(self.sk)
         self._compute_cryptograms()
         # verify computed cryptogram matches received cryptogram
         if self.card_cryptogram != resp['card_cryptogram']:
@@ -529,7 +529,7 @@ class SCP03(SCP):
 
     def _wrap_cmd_apdu(self, apdu: bytes, skip_cenc: bool = False) -> bytes:
         """Wrap Command APDU for SCP03: calculate MAC and encrypt."""
-        log.debug("wrap_cmd_apdu(%s)", b2h(apdu))
+        logger.debug("wrap_cmd_apdu(%s)", b2h(apdu))
 
         if not self.do_cmac:
             return apdu
@@ -584,7 +584,7 @@ class SCP03(SCP):
         # status word: in this case only the status word shall be returned in the response. All status words
         # except '9000' and warning status words (i.e. '62xx' and '63xx') shall be interpreted as error status
         # words.
-        log.debug("unwrap_rsp_apdu(sw=%s, rsp_apdu=%s)", sw, rsp_apdu)
+        logger.debug("unwrap_rsp_apdu(sw=%s, rsp_apdu=%s)", sw, rsp_apdu)
         if not self.do_rmac:
             assert not self.do_renc
             return rsp_apdu
@@ -600,9 +600,9 @@ class SCP03(SCP):
         if self.do_renc:
             # decrypt response data
             decrypted = self.sk._decrypt(response_data)
-            log.debug("decrypted: %s", b2h(decrypted))
+            logger.debug("decrypted: %s", b2h(decrypted))
             # remove padding
             response_data = unpad80(decrypted)
-            log.debug("response_data: %s", b2h(response_data))
+            logger.debug("response_data: %s", b2h(response_data))
 
         return response_data

pySim/legacy/cards.py

@@ -152,8 +152,7 @@ class SimCard(SimCardBase):
         return sw
 
     def update_smsp(self, smsp):
-        print("using update_smsp")
-        data, sw = self._scc.update_record(EF['SMSP'], 1, smsp, leftpad=True)
+        data, sw = self._scc.update_record(EF['SMSP'], 1, rpad(smsp, 84))
         return sw
 
     def update_ad(self, mnc=None, opmode=None, ofm=None, path=EF['AD']):

pySim/log.py

@@ -24,15 +24,7 @@
 #
 
 import logging
-import cmd2
-from packaging import version
-
-if version.parse(cmd2.__version__) >= version.parse("3.0.0"):
-    from cmd2 import stylize as _stylize # pylint: disable=no-name-in-module
-    def _style(text, fg=None): # pylint: disable=function-redefined
-        return _stylize(text, fg) if fg else text
-else: # cmd2>=2.6.2
-    from cmd2 import style as _style # pylint: disable=no-name-in-module
+from cmd2 import style
 
 class _PySimLogHandler(logging.Handler):
     def __init__(self, log_callback):
@@ -52,7 +44,7 @@ class PySimLogger:
     """
 
     LOG_FMTSTR = "%(levelname)s: %(message)s"
-    LOG_FMTSTR_VERBOSE = "%(name)s.%(lineno)d -- " + LOG_FMTSTR
+    LOG_FMTSTR_VERBOSE = "%(module)s.%(lineno)d -- " + LOG_FMTSTR
     __formatter = logging.Formatter(LOG_FMTSTR)
     __formatter_verbose = logging.Formatter(LOG_FMTSTR_VERBOSE)
 
@@ -129,7 +121,7 @@ class PySimLogger:
                 if isinstance(color, str):
                     PySimLogger.print_callback(color + formatted_message + "\033[0m")
                 else:
-                    PySimLogger.print_callback(_style(formatted_message, fg = color))
+                    PySimLogger.print_callback(style(formatted_message, fg = color))
             else:
                 PySimLogger.print_callback(formatted_message)
 

pySim/transport/__init__.py

@@ -301,54 +301,24 @@ class LinkBaseTpdu(LinkBase):
 
         prev_tpdu = tpdu
         data, sw = self.send_tpdu(tpdu)
-        log.debug("T0: case #%u TPDU: %s => %s %s", case, tpdu, data or "(no data)", sw or "(no status word)")
-        if sw is None:
-            raise ValueError("no status word received")
 
-        # After sending the APDU/TPDU the UICC/eUICC or SIM may response with a status word that indicates that further
-        # TPDUs have to be sent in order to complete the task.
-        if case == 4 or self.apdu_strict == False:
-            # In case the APDU is a case #4 APDU, the UICC/eUICC/SIM may indicate that there is response data
-            # available which has to be retrieved using a GET RESPONSE command TPDU.
-            #
-            # ETSI TS 102 221, section 7.3.1.1.4 is very cleare about the fact that the GET RESPONSE mechanism
-            # shall only apply on case #4 APDUs but unfortunately it is impossible to distinguish between case #3
-            # and case #4 when the APDU format is not strictly followed. In order to be able to detect case #4
-            # correctly the Le byte (usually 0x00) must be present, is often forgotten. To avoid problems with
-            # legacy scripts that use raw APDU strings, we will still loosely apply GET RESPONSE based on what
-            # the status word indicates. Unless the user explicitly enables the strict mode (set apdu_strict true)
-            while True:
-                if sw in ['9000', '9100']:
-                    # A status word of 9000 (or 9100 in case there is pending data from a proactive SIM command)
-                    # indicates that either no response data was returnd or all response data has been retrieved
-                    # successfully. We may discontinue the processing at this point.
-                    break;
-                if sw[0:2] in ['61', '9f']:
-                    # A status word of 61xx or 9fxx indicates that there is (still) response data available. We
-                    # send a GET RESPONSE command with the length value indicated in the second byte of the status
-                    # word. (see also ETSI TS 102 221, section 7.3.1.1.4, clause 4a and 3GPP TS 51.011 9.4.1 and
-                    # ISO/IEC 7816-4, Table 5)
-                    le_gr = sw[2:4]
-                elif sw[0:2] in ['62', '63']:
-                    # There are corner cases (status word is 62xx or 63xx) where the UICC/eUICC/SIM asks us
-                    # to send a dummy GET RESPONSE command. We send a GET RESPONSE command with a length of 0.
-                    # (see also ETSI TS 102 221, section 7.3.1.1.4, clause 4b and ETSI TS 151 011, section 9.4.1)
-                    le_gr = '00'
-                else:
-                    # A status word other then the ones covered by the above logic may indicate an error. In this
-                    # case we will discontinue the processing as well.
-                    # (see also ETSI TS 102 221, section 7.3.1.1.4, clause 4c)
-                    break
-                tpdu_gr = tpdu[0:2] + 'c00000' + le_gr
+        # When we have sent the first APDU, the SW may indicate that there are response bytes
+        # available. There are two SWs commonly used for this 9fxx (sim) and 61xx (usim), where
+        # xx is the number of response bytes available.
+        # See also:
+        if sw is not None:
+            while (sw[0:2] in ['9f', '61', '62', '63']):
+                # SW1=9F: 3GPP TS 51.011 9.4.1, Responses to commands which are correctly executed
+                # SW1=61: ISO/IEC 7816-4, Table 5 — General meaning of the interindustry values of SW1-SW2
+                # SW1=62: ETSI TS 102 221 7.3.1.1.4 Clause 4b): 62xx, 63xx, 9xxx != 9000
+                tpdu_gr = tpdu[0:2] + 'c00000' + sw[2:4]
                 prev_tpdu = tpdu_gr
-                data_gr, sw = self.send_tpdu(tpdu_gr)
-                log.debug("T0: GET RESPONSE TPDU: %s => %s %s", tpdu_gr, data_gr or "(no data)", sw or "(no status word)")
-                data += data_gr
-        if sw[0:2] == '6c':
-            # SW1=6C: ETSI TS 102 221 Table 7.1: Procedure byte coding
-            tpdu_gr = prev_tpdu[0:8] + sw[2:4]
-            data, sw = self.send_tpdu(tpdu_gr)
-            log.debug("T0: repated case #%u TPDU: %s => %s %s", case, tpdu_gr, data or "(no data)", sw or "(no status word)")
+                d, sw = self.send_tpdu(tpdu_gr)
+                data += d
+            if sw[0:2] == '6c':
+                # SW1=6C: ETSI TS 102 221 Table 7.1: Procedure byte coding
+                tpdu_gr = prev_tpdu[0:8] + sw[2:4]
+                data, sw = self.send_tpdu(tpdu_gr)
 
         return data, sw
 

pySim/ts_31_102.py

@@ -327,7 +327,7 @@ class EF_SUCI_Calc_Info(TransparentEF):
         """conversion method to generate list of {hnet_pubkey_identifier, hnet_pubkey} dicts
         from flat [{hnet_pubkey_identifier: }, {net_pubkey: }, ...] list"""
         out = []
-        while len(l):
+        while l:
             a = l.pop(0)
             b = l.pop(0)
             z = {**a, **b}

pySim/ts_51_011.py

@@ -251,16 +251,6 @@ class EF_SMSP(LinFixedEF):
                                                       "numbering_plan_id": "isdn_e164" },
                             "call_number": "4915790109999" },
             "tp_pid": b"\x00", "tp_dcs": b"\x00", "tp_vp_minutes": 4320 } ),
-        ( 'e1ffffffffffffffffffffffff0891945197109099f9ffffff0000a9',
-          { "alpha_id": "", "parameter_indicators": { "tp_dest_addr": False, "tp_sc_addr": True,
-                                                          "tp_pid": True, "tp_dcs": True, "tp_vp": True },
-            "tp_dest_addr": { "length": 255, "ton_npi": { "ext": True, "type_of_number": "reserved_for_extension",
-                                                          "numbering_plan_id": "reserved_for_extension" },
-                              "call_number": "" },
-            "tp_sc_addr": { "length": 8, "ton_npi": { "ext": True, "type_of_number": "international",
-                                                      "numbering_plan_id": "isdn_e164" },
-                            "call_number": "4915790109999" },
-            "tp_pid": b"\x00", "tp_dcs": b"\x00", "tp_vp_minutes": 4320 } ),
         ( '454e6574776f726b73fffffffffffffff1ffffffffffffffffffffffffffffffffffffffffffffffff0000a7',
           { "alpha_id": "ENetworks", "parameter_indicators": { "tp_dest_addr": False, "tp_sc_addr": True,
                                                                "tp_pid": True, "tp_dcs": True, "tp_vp": False },
@@ -341,8 +331,7 @@ class EF_SMSP(LinFixedEF):
                         'ton_npi'/TonNpi, 'call_number'/PaddedBcdAdapter(Rpad(Bytes(10))))
         DestAddr = Struct('length'/Rebuild(Int8ub, lambda ctx: EF_SMSP.dest_addr_len(ctx)),
                         'ton_npi'/TonNpi, 'call_number'/PaddedBcdAdapter(Rpad(Bytes(10))))
-        # (see comment below)
-        self._construct = Struct('alpha_id'/GsmOrUcs2Adapter(Rpad(Bytes(this._.total_len-28))),
+        self._construct = Struct('alpha_id'/COptional(GsmOrUcs2Adapter(Rpad(Bytes(this._.total_len-28)))),
                                  'parameter_indicators'/InvertAdapter(BitStruct(
                                                                         Const(7, BitsInteger(3)),
                                                                         'tp_vp'/Flag,
@@ -356,25 +345,6 @@ class EF_SMSP(LinFixedEF):
                                  'tp_dcs'/Bytes(1),
                                  'tp_vp_minutes'/EF_SMSP.ValidityPeriodAdapter(Byte))
 
-    # Ensure 'alpha_id' is always present
-    def encode_record_hex(self, abstract_data: dict, record_nr: int, total_len: int = None) -> str:
-        # Problem: TS 51.011 Section 10.5.6 describes the 'alpha_id' field as optional. However, this is only true
-        # at the time when the record length of the file is set up in the file system. A card manufacturer may decide
-        # to remove the field by setting the record length to 28. Likewise, the card manaufacturer may also decide to
-        # set the field to a distinct length by setting the record length to a value greater than 28 (e.g. 14 bytes
-        # 'alpha_id' + 28 bytes). Due to the fixed nature of the record length, this eventually means that in practice
-        # 'alpha_id' is a mandatory field with a fixed length.
-        #
-        # Due to the problematic specification of 'alpha_id' as a pseudo-optional field at the beginning of a
-        # fixed-size memory, the construct definition in self._construct has been incorrectly implemented and the field
-        # has been marked as COptional. We may correct the problem by removing COptional. But to maintain compatibility,
-        # we then have to ensure that in case the field is not provided (None), it is set to an empty string ('').
-        #
-        # See also ts_31_102.py, class EF_OCI for a correct example.
-        if abstract_data['alpha_id'] is None:
-            abstract_data['alpha_id'] = ''
-        return super().encode_record_hex(abstract_data, record_nr, total_len)
-
 # TS 51.011 Section 10.5.7
 class EF_SMSS(TransparentEF):
     class MemCapAdapter(Adapter):
@@ -1263,11 +1233,9 @@ class CardProfileSIM(CardProfile):
 
     @staticmethod
     def decode_select_response(resp_hex: str) -> object:
-        """
-        Decode the select response to a dict representation, similar to the one of TS 102.221 (see ts_102_221.py,
-        class FcpTemplate), so that higher-level code only has to deal with one respresentation. See also
-        3GPP TS 51.011, section 9.2.1
-        """
+        # we try to build something that resembles a dict resulting from the TLV decoder
+        # of TS 102.221 (FcpTemplate), so that higher-level code only has to deal with one
+        # format of SELECT response
         resp_bin = h2b(resp_hex)
         struct_of_file_map = {
             0: 'transparent',
@@ -1305,24 +1273,13 @@ class CardProfileSIM(CardProfile):
                 record_len = resp_bin[14]
                 ret['file_descriptor']['record_len'] = record_len
                 ret['file_descriptor']['num_of_rec'] = ret['file_size'] // record_len
-            ret['access_conditions'] = b2h(resp_bin[8:11])
-
-            # Life cycle status integer, see also ETSI TS 102 221, table 11.7b
-            lcsi = resp_bin[11]
-            if lcsi == 0x00:
-                ret['life_cycle_status_int'] = 'no_information'
-            elif lcsi == 0x01:
-                ret['life_cycle_status_int'] = 'creation'
-            elif lcsi == 0x03:
-                ret['life_cycle_status_int'] = 'initialization'
-            elif lcsi & 0xFD == 0x05:
+            ret['access_conditions'] = b2h(resp_bin[8:10])
+            if resp_bin[11] & 0x01 == 0:
                 ret['life_cycle_status_int'] = 'operational_activated'
-            elif lcsi & 0xFD == 0x04:
+            elif resp_bin[11] & 0x04:
                 ret['life_cycle_status_int'] = 'operational_deactivated'
-            elif lcsi & 0xFC == 0x0C:
-                ret['life_cycle_status_int'] = 'termination'
             else:
-                ret['life_cycle_status_int'] = lcsi
+                ret['life_cycle_status_int'] = 'terminated'
         return ret
 
     @classmethod

pyproject.toml

@@ -4,7 +4,3 @@ build-backend = "setuptools.build_meta"
 
 [tool.pylint.main]
 ignored-classes = ["twisted.internet.reactor"]
-
-[tool.pylint.TYPECHECK]
-# SdKey subclasses are generated dynamically via SdKey.generate_sd_key_classes()
-generated-members = ["SdKey[A-Za-z0-9]+"]

requirements.txt

@@ -1,7 +1,7 @@
 pyscard
 pyserial
 pytlv
-cmd2>=2.6.2,<4.0
+cmd2>=2.6.2,<3.0
 jsonpath-ng
 construct>=2.10.70
 bidict

setup.py

@@ -21,7 +21,7 @@ setup(
         "pyscard",
         "pyserial",
         "pytlv",
-        "cmd2 >= 2.6.2, < 4.0",
+        "cmd2 >= 1.5.0, < 3.0",
         "jsonpath-ng",
         "construct >= 2.10.70",
         "bidict",

tests/pySim-prog_test/Fairwaves-SIM.ok

@@ -5,7 +5,7 @@ ICCID: 8988219000000117833
 IMSI: 001010000000111
 GID1: ffffffffffffffff
 GID2: ffffffffffffffff
-SMSP: ffffffffffffffffffffffffffffe1ffffffffffffffffffffffff0581005155f5ffffffffffff000000
+SMSP: e1ffffffffffffffffffffffff0581005155f5ffffffffffff000000ffffffffffffffffffffffffffff
 SMSC: 0015555
 SPN: Fairwaves
 Show in HPLMN: False

tests/pySim-prog_test/Wavemobile-SIM.ok

@@ -5,7 +5,7 @@ ICCID: 89445310150011013678
 IMSI: 001010000000102
 GID1: Can't read file -- SW match failed! Expected 9000 and got 6a82.
 GID2: Can't read file -- SW match failed! Expected 9000 and got 6a82.
-SMSP: ffffffffffffffffffffffffffffe1ffffffffffffffffffffffff0581005155f5ffffffffffff000000
+SMSP: e1ffffffffffffffffffffffff0581005155f5ffffffffffff000000ffffffffffffffffffffffffffff
 SMSC: 0015555
 SPN: wavemobile
 Show in HPLMN: False

tests/pySim-shell_test/apdu/test_apdu.script

@@ -7,24 +7,10 @@ set apdu_strict true
 # No command data field, No response data field present
 apdu 00700001 --expect-sw 9000 --expect-response-regex '^$'
 
-# Case #1: (verify pin)
-# This command returns the number of remaining authentication attempts in the
-# form of a status that has the form 63cX, where X is the number of remaining
-# attempts. Such a status word can be easily confused with the response to a
-# case #4 APDU. This test checks if the transport layer correctly distinguishes
-# the between APDU case #1 and APDU case #4.
-apdu 0020000A --expect-sw 63c? --expect-response-regex '^$'
-
 # Case #2: (status)
 # No command data field, Response data field present
 apdu 80F2000000 --expect-sw 9000 --expect-response-regex '^[a-fA-F0-9]+$'
 
-# Case #2: (verify pin)
-# (see also above). This test checks if the transport layer is also able to
-# distinguish correctly between APDU case #2 (with zero length response) and
-# APDU case #4.
-apdu 0020000A00 --expect-sw 63c? --expect-response-regex '^$'
-
 # Case #3: (terminal capability)
 # Command data field present, No response data field
 apdu 80AA000005a903830180 --expect-sw 9000 --expect-response-regex '^$'

tests/pySim-smpp2sim_test/pySim-smpp2sim_test.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Utility to verify the functionality of pySim-smpp2sim.py
+# Utility to verify the functionality of pySim-trace.py
 #
 # (C) 2026 by sysmocom - s.f.m.c. GmbH
 # All Rights Reserved

tests/unittests/test_card_key_provider.py

@@ -20,8 +20,7 @@ class TestCardKeyProviderCsv(unittest.TestCase):
                        "KIK3" : "00010204040506070809488B0C0D0E0F"}
 
         csv_file_path = os.path.dirname(os.path.abspath(__file__)) + "/test_card_key_provider.csv"
-        card_key_field_cryptor = CardKeyFieldCryptor(column_keys)
-        card_key_provider_register(CardKeyProviderCsv(csv_file_path, card_key_field_cryptor))
+        card_key_provider_register(CardKeyProviderCsv(csv_file_path, column_keys))
         super().__init__(*args, **kwargs)
 
     def test_card_key_provider_get(self):

tests/unittests/test_configurable_parameters.py

@@ -17,10 +17,11 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import enum
 import io
 import sys
 import unittest
+import io
+import json
 from importlib import resources
 from osmocom.utils import hexstr
 from pySim.esim.saip import ProfileElementSequence
@@ -60,11 +61,15 @@ class ConfigurableParameterTest(unittest.TestCase):
                )
 
         class Paramtest:
-            def __init__(self, param_cls, val, expect_val, expect_clean_val=None):
+            iff_present_default = False
+            def __init__(self, param_cls, val, expect_val, expect_clean_val=None, iff_present=None):
                 self.param_cls = param_cls
                 self.val = val
                 self.expect_clean_val = expect_clean_val
                 self.expect_val = expect_val
+                if iff_present is None:
+                    iff_present = Paramtest.iff_present_default
+                self.iff_present = iff_present
 
         param_tests = [
             Paramtest(param_cls=p13n.Imsi, val='123456',
@@ -150,7 +155,7 @@ class ConfigurableParameterTest(unittest.TestCase):
             Paramtest(param_cls=p13n.AlgorithmID,
                       val='usim-test',
                       expect_clean_val=3,
-                      expect_val='usim_test'),
+                      expect_val='usim-test'),
 
             Paramtest(param_cls=p13n.AlgorithmID,
                       val=1,
@@ -163,7 +168,7 @@ class ConfigurableParameterTest(unittest.TestCase):
             Paramtest(param_cls=p13n.AlgorithmID,
                       val=3,
                       expect_clean_val=3,
-                      expect_val='usim_test'),
+                      expect_val='usim-test'),
 
             Paramtest(param_cls=p13n.K,
                       val='01020304050607080910111213141516',
@@ -267,6 +272,7 @@ class ConfigurableParameterTest(unittest.TestCase):
                                  '11111111111111111111111111111111'
                                  '22222222222222222222222222222222'),
 
+
             Paramtest(param_cls=p13n.MncLen,
                       val='2',
                       expect_clean_val=2,
@@ -275,8 +281,56 @@ class ConfigurableParameterTest(unittest.TestCase):
                       val=3,
                       expect_clean_val=3,
                       expect_val='3'),
+        ]
 
-            ]
+        Paramtest.iff_present_default = True
+
+        sucici = {
+             "prot_scheme_id_list": [
+                 {"priority": 0, "identifier": 2, "key_index": 1},
+                 {"priority": 1, "identifier": 1, "key_index": 2},
+                 ],
+             "hnet_pubkey_list": [
+                 {"hnet_pubkey_identifier": 27,
+                  "hnet_pubkey": "0472da71976234ce833a6907425867b82e074d44ef907dfb4b3e21c1c2256ebcd15a7ded52fcbb097a4ed250e036c7b9c8c7004c4eedc4f068cd7bf8d3f900e3b4"},
+                 {"hnet_pubkey_identifier": 30,
+                  "hnet_pubkey": "5a8d38864820197c3394b92613b20b91633cbd897119273bf8e4a6f4eec0a650"},
+                  ],
+        }
+
+        param_tests.extend([
+            Paramtest(param_cls=p13n.SuciActive, val='SUCI-on',
+                      expect_clean_val=True,
+                      expect_val={'5G-SUCI-active': 'SUCI-on'}),
+            Paramtest(param_cls=p13n.SuciActive, val='SUCI-off',
+                      expect_clean_val=False,
+                      expect_val={'5G-SUCI-active': 'SUCI-off'}),
+
+            Paramtest(param_cls=p13n.SuciInUsim, val='SUCI-in-UE',
+                      expect_clean_val=False,
+                      expect_val={'5G-SUCI-in-USIM': 'SUCI-in-UE'}),
+            Paramtest(param_cls=p13n.SuciInUsim, val='SUCI-in-USIM',
+                      expect_clean_val=True,
+                      expect_val={'5G-SUCI-in-USIM': 'SUCI-in-USIM'}),
+
+            Paramtest(param_cls=p13n.SuciRi, val='123',
+                      expect_clean_val='123',
+                      expect_val={'5G-SUCI-RI': '123'}),
+            Paramtest(param_cls=p13n.SuciRi, val='0',
+                      expect_clean_val='0',
+                      expect_val={'5G-SUCI-RI': '0'}),
+            Paramtest(param_cls=p13n.SuciRi, val='9999',
+                      expect_clean_val='9999',
+                      expect_val={'5G-SUCI-RI': '9999'}),
+
+            Paramtest(param_cls=p13n.SuciCalcInfo,
+                      val=json.dumps(sucici),
+                      expect_clean_val=sucici,
+                      expect_val={'5G-SUCI-CalcInfo': json.dumps(sucici)}),
+
+        ])
+
+        Paramtest.iff_present_default = False
 
         for sdkey_cls in (
             # thin out the number of tests, as a compromise between completeness and test runtime
@@ -319,11 +373,14 @@ class ConfigurableParameterTest(unittest.TestCase):
             p13n.SdKeyScp80Kvn03DesDek,
            #p13n.SdKeyScp80Kvn03DesEnc,
            #p13n.SdKeyScp80Kvn03DesMac,
-            p13n.SdKeyScp81Kvn40AesDek,
+           #p13n.SdKeyScp81Kvn40AesDek,
+            p13n.SdKeyScp81Kvn40DesDek,
            #p13n.SdKeyScp81Kvn40Tlspsk,
            #p13n.SdKeyScp81Kvn41AesDek,
+           #p13n.SdKeyScp81Kvn41DesDek,
             p13n.SdKeyScp81Kvn41Tlspsk,
            #p13n.SdKeyScp81Kvn42AesDek,
+           #p13n.SdKeyScp81Kvn42DesDek,
            #p13n.SdKeyScp81Kvn42Tlspsk,
             ):
 
@@ -369,7 +426,8 @@ class ConfigurableParameterTest(unittest.TestCase):
 
                 for t in param_tests:
                     test_idx += 1
-                    logloc = f'{upp_fname} {t.param_cls.__name__}(val={valtypestr(t.val)})'
+                    testlog = []
+                    testlog.append(f'{upp_fname} {t.param_cls.__name__}(val={valtypestr(t.val)})')
 
                     param = None
                     try:
@@ -377,21 +435,32 @@ class ConfigurableParameterTest(unittest.TestCase):
                         param.input_value = t.val
                         param.validate()
                     except ValueError as e:
-                        raise ValueError(f'{logloc}: {e}') from e
+                        raise ValueError(f'{" ".join(testlog)}: {e}') from e
 
                     clean_val = param.value
-                    logloc = f'{logloc} clean_val={valtypestr(clean_val)}'
+                    testlog.append(f'clean_val={valtypestr(clean_val)}')
                     if t.expect_clean_val is not None and t.expect_clean_val != clean_val:
-                        raise ValueError(f'{logloc}: expected'
+                        raise ValueError(f'{" ".join(testlog)}: expected'
                                          f' expect_clean_val={valtypestr(t.expect_clean_val)}')
 
                     # on my laptop, deepcopy is about 30% slower than decoding the DER from scratch:
                     # pes = copy.deepcopy(orig_pes)
                     pes = ProfileElementSequence.from_der(der)
+
+                    found = list((t.param_cls.get_value_from_pes(pes) or {}).values())
+                    testlog.append(f"previous value: {found}")
+
+                    if t.iff_present and not found:
+                        testlog.append("skipping, param not in template.")
+                        output = "\nskip: " + "\n  ".join(testlog)
+                        outputs.append(output)
+                        print(output)
+                        continue
+
                     try:
                         param.apply(pes)
                     except ValueError as e:
-                        raise ValueError(f'{logloc} apply_val(clean_val): {e}') from e
+                        raise ValueError(f'{" ".join(testlog)} apply_val(clean_val): {e}') from e
 
                     changed_der = pes.to_der()
 
@@ -409,22 +478,18 @@ class ConfigurableParameterTest(unittest.TestCase):
                     else:
                         read_back_val_type = f'{type(read_back_val).__name__}'
 
-                    logloc = (f'{logloc} read_back_val={valtypestr(read_back_val)}')
+                    testlog.append(f'read_back_val={valtypestr(read_back_val)}')
 
                     if isinstance(read_back_val, dict) and not t.param_cls.get_name() in read_back_val.keys():
-                        raise ValueError(f'{logloc}: expected to find name {t.param_cls.get_name()!r} in read_back_val')
+                        raise ValueError(f'{" ".join(testlog)}: expected to find name {t.param_cls.get_name()!r} in read_back_val')
 
                     expect_val = t.expect_val
                     if not isinstance(expect_val, dict):
                         expect_val = { t.param_cls.get_name(): expect_val }
                     if read_back_val != expect_val:
-                        raise ValueError(f'{logloc}: expected {expect_val=!r}:{type(t.expect_val).__name__}')
+                        raise ValueError(f'{" ".join(testlog)}: expected {expect_val=!r}:{type(t.expect_val).__name__}')
 
-                    ok = logloc.replace(' clean_val', '\n\tclean_val'
-                              ).replace(' read_back_val', '\n\tread_back_val'
-                              ).replace('=', '=\t'
-                              )
-                    output = f'\nok: {ok}'
+                    output = "\nok: " + "\n  ".join(testlog)
                     outputs.append(output)
                     print(output)
 
@@ -450,191 +515,6 @@ class ConfigurableParameterTest(unittest.TestCase):
                 raise RuntimeError(f'output differs from expected output at position {at}: "{output[at:at+20]}" != "{xo_str[at:at+20]}"')
 
 
-class TestValidateVal(unittest.TestCase):
-    """validate_val() tests for various ConfigurableParameter subclasses."""
-
-    def _ok(self, cls, val, expected=None):
-        result = cls.validate_val(val)
-        if expected is not None:
-            self.assertEqual(result, expected)
-        return result
-
-    def _err(self, cls, val):
-        with self.assertRaises(ValueError):
-            cls.validate_val(val)
-
-    # --- Iccid ---
-
-    def test_iccid_18digits_adds_luhn(self):
-        result = self._ok(p13n.Iccid, '998877665544332211')
-        self.assertIsInstance(result, str)
-        self.assertEqual(len(result), 19)
-        self.assertTrue(result.isdecimal())
-
-    def test_iccid_19digits_passthrough(self):
-        result = self._ok(p13n.Iccid, '9988776655443322110')
-        self.assertIsInstance(result, str)
-        self.assertEqual(len(result), 19)
-
-    def test_iccid_too_short(self):
-        self._err(p13n.Iccid, '12345678901234567')  # 17 digits
-
-    def test_iccid_too_long(self):
-        self._err(p13n.Iccid, '1' * 21)
-
-    def test_iccid_non_digits(self):
-        self._err(p13n.Iccid, '99887766554433221X')
-
-    # --- Imsi ---
-
-    def test_imsi_valid_short(self):
-        self._ok(p13n.Imsi, '001010', '001010')
-
-    def test_imsi_valid_long(self):
-        self._ok(p13n.Imsi, '001010123456789', '001010123456789')
-
-    def test_imsi_too_short(self):
-        self._err(p13n.Imsi, '12345')  # 5 digits, min is 6
-
-    def test_imsi_too_long(self):
-        self._err(p13n.Imsi, '1' * 16)
-
-    def test_imsi_non_digits(self):
-        self._err(p13n.Imsi, '00101A123456789')
-
-    # --- Pin1 ---
-
-    def test_pin1_4digits(self):
-        # DecimalHexParam encodes each digit as its ASCII byte, then rpad to 8 bytes with 0xff
-        self._ok(p13n.Pin1, '1234', b'1234\xff\xff\xff\xff')
-
-    def test_pin1_8digits(self):
-        self._ok(p13n.Pin1, '12345678', b'12345678')
-
-    def test_pin1_too_short(self):
-        self._err(p13n.Pin1, '123')
-
-    def test_pin1_too_long(self):
-        self._err(p13n.Pin1, '123456789')
-
-    def test_pin1_non_digits(self):
-        self._err(p13n.Pin1, '123A')
-
-    # --- Puk1 ---
-
-    def test_puk1_8digits(self):
-        self._ok(p13n.Puk1, '12345678', b'12345678')
-
-    def test_puk1_wrong_length(self):
-        self._err(p13n.Puk1, '1234567')   # 7 digits
-        self._err(p13n.Puk1, '123456789')  # 9 digits
-
-    def test_puk1_non_digits(self):
-        self._err(p13n.Puk1, '1234567X')
-
-    # --- K (BinaryParam) ---
-
-    def test_k_valid_hex_str(self):
-        self._ok(p13n.K, '000102030405060708090a0b0c0d0e0f',
-                 b'\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f')
-
-    def test_k_valid_bytes(self):
-        raw = bytes(range(16))
-        self._ok(p13n.K, raw, raw)
-
-    def test_k_wrong_length(self):
-        self._err(p13n.K, '00' * 15)  # 15 bytes, allow_len requires 16 or 32
-
-    def test_k_non_hex(self):
-        self._err(p13n.K, 'gg' * 16)
-
-    def test_k_odd_hex_digits(self):
-        self._err(p13n.K, '0' * 31)   # odd number of hex digits
-
-
-class TestEnumParam(unittest.TestCase):
-    """Tests for the EnumParam machinery, using AlgorithmID as the concrete subclass."""
-
-    # --- validate_val ---
-
-    def test_validate_by_name_exact(self):
-        self.assertEqual(p13n.AlgorithmID.validate_val('Milenage'), 1)
-        self.assertEqual(p13n.AlgorithmID.validate_val('TUAK'), 2)
-        self.assertEqual(p13n.AlgorithmID.validate_val('usim_test'), 3)
-
-    def test_validate_by_int(self):
-        self.assertEqual(p13n.AlgorithmID.validate_val(1), 1)
-        self.assertEqual(p13n.AlgorithmID.validate_val(2), 2)
-        self.assertEqual(p13n.AlgorithmID.validate_val(3), 3)
-
-    def test_validate_fuzzy_case(self):
-        self.assertEqual(p13n.AlgorithmID.validate_val('milenage'), 1)
-        self.assertEqual(p13n.AlgorithmID.validate_val('MILENAGE'), 1)
-        self.assertEqual(p13n.AlgorithmID.validate_val('tuak'), 2)
-
-    def test_validate_fuzzy_hyphen_underscore(self):
-        # 'usim-test' has a hyphen; enum member is 'usim_test' — must fuzzy-match
-        self.assertEqual(p13n.AlgorithmID.validate_val('usim-test'), 3)
-
-    def test_validate_invalid_name(self):
-        with self.assertRaises(ValueError):
-            p13n.AlgorithmID.validate_val('unknown')
-
-    def test_validate_invalid_int(self):
-        with self.assertRaises(ValueError):
-            p13n.AlgorithmID.validate_val(99)
-
-    def test_validate_returns_int(self):
-        result = p13n.AlgorithmID.validate_val('Milenage')
-        self.assertIsInstance(result, int)
-        self.assertNotIsInstance(result, enum.Enum)
-
-    # --- map_name_to_val ---
-
-    def test_map_name_exact(self):
-        self.assertEqual(p13n.AlgorithmID.map_name_to_val('Milenage'), 1)
-
-    def test_map_name_fuzzy(self):
-        self.assertEqual(p13n.AlgorithmID.map_name_to_val('milenage'), 1)
-        self.assertEqual(p13n.AlgorithmID.map_name_to_val('usim-test'), 3)
-
-    def test_map_name_strict_raises(self):
-        with self.assertRaises(ValueError):
-            p13n.AlgorithmID.map_name_to_val('unknown', strict=True)
-
-    def test_map_name_nonstrict_returns_none(self):
-        self.assertIsNone(p13n.AlgorithmID.map_name_to_val('unknown', strict=False))
-
-    # --- map_val_to_name ---
-
-    def test_map_val_known(self):
-        self.assertEqual(p13n.AlgorithmID.map_val_to_name(1), 'Milenage')
-        self.assertEqual(p13n.AlgorithmID.map_val_to_name(2), 'TUAK')
-        self.assertEqual(p13n.AlgorithmID.map_val_to_name(3), 'usim_test')
-
-    def test_map_val_unknown_nonstrict(self):
-        self.assertIsNone(p13n.AlgorithmID.map_val_to_name(99))
-
-    def test_map_val_unknown_strict(self):
-        with self.assertRaises(ValueError):
-            p13n.AlgorithmID.map_val_to_name(99, strict=True)
-
-    # --- name_normalize ---
-
-    def test_name_normalize(self):
-        self.assertEqual(p13n.AlgorithmID.name_normalize('Milenage'), 'Milenage')
-        self.assertEqual(p13n.AlgorithmID.name_normalize('milenage'), 'Milenage')
-        self.assertEqual(p13n.AlgorithmID.name_normalize('usim-test'), 'usim_test')
-
-    # --- clean_name_str ---
-
-    def test_clean_name_str(self):
-        self.assertEqual(p13n.AlgorithmID.clean_name_str('usim-test'), 'usimtest')
-        self.assertEqual(p13n.AlgorithmID.clean_name_str('usim_test'), 'usimtest')
-        self.assertEqual(p13n.AlgorithmID.clean_name_str('Milenage'), 'milenage')
-        self.assertEqual(p13n.AlgorithmID.clean_name_str('foo bar!'), 'foobar')
-
-
 if __name__ == "__main__":
     if '-u' in sys.argv:
         update_expected_output = True

tests/unittests/test_decode_select_resp.py

@@ -1,78 +0,0 @@
-#!/usr/bin/env python3
-
-# (C) 2026 by sysmocom - s.f.m.c. GmbH
-# All Rights Reserved
-#
-# Author: Philipp Maier <pmaier@sysmocom.de>
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import unittest
-import os
-from pySim.profile import CardProfile
-from pySim.ts_51_011 import CardProfileSIM
-from pySim.ts_102_221 import CardProfileUICC
-
-class TestDecodeSelectResponse_CardProfile(unittest.TestCase):
-
-    def decode_select_response(self, card_Profile: CardProfile, testcases: list[dict]):
-        for testcase in testcases:
-            resp_hex = testcase['resp_hex']
-            decoded = card_Profile.decode_select_response(resp_hex)
-            if testcase['decoded']:
-                self.assertEqual(decoded, testcase['decoded'])
-            else:
-                print("no testvector to compare against, assuming the following output is correct:")
-                print("resp_hex:", resp_hex)
-                print("decoded:", decoded)
-
-    def test_CardProfileSIM(self):
-        testcases = [
-            # MF
-            {"resp_hex" : "000000003f000100000000000981020c0400838a838a",
-             "decoded" : {'file_descriptor': {'file_descriptor_byte': {'file_type': 'mf'}}, 'proprietary_info': {'available_memory': 0}, 'file_id': '3f00', 'file_characteristics': '81', 'num_direct_child_df': 2, 'num_direct_child_ef': 12, 'num_chv_unblock_adm_codes': 4}},
-            # DF.TELECOM
-            {"resp_hex" : "000000007f100200000000000981000d0400838a838a",
-             "decoded" : {'file_descriptor': {'file_descriptor_byte': {'file_type': 'df'}}, 'proprietary_info': {'available_memory': 0}, 'file_id': '7f10', 'file_characteristics': '81', 'num_direct_child_df': 0, 'num_direct_child_ef': 13, 'num_chv_unblock_adm_codes': 4}},
-            # EF.MSISDN
-            {"resp_hex" : "000000346f40040011ffff0102011a",
-             "decoded" : {'file_descriptor': {'file_descriptor_byte': {'file_type': 'working_ef', 'structure': 'linear_fixed'}, 'record_len': 26, 'num_of_rec': 2}, 'proprietary_info': {}, 'file_id': '6f40', 'file_size': 52, 'access_conditions': '11ffff', 'life_cycle_status_int': 'creation'}},
-            # EF.ICCID
-            {"resp_hex" : "0000000a2fe204000cffff01020000",
-             "decoded" : {'file_descriptor': {'file_descriptor_byte': {'file_type': 'working_ef', 'structure': 'transparent'}}, 'proprietary_info': {}, 'file_id': '2fe2', 'file_size': 10, 'access_conditions': '0cffff', 'life_cycle_status_int': 'creation'}},
-        ]
-        self.decode_select_response(CardProfileSIM, testcases)
-
-    def test_CardProfileUICC(self):
-        testcases = [
-            # MF
-            {"resp_hex" : "622c8202782183023f00a50c80017183040003a7388701018a01058b032f0601c60c90016083010183010a83010b",
-             "decoded" : {'file_descriptor': {'file_descriptor_byte': {'shareable': True, 'file_type': 'df', 'structure': 'no_info_given'}, 'record_len': None, 'num_of_rec': None}, 'file_identifier': b'?\x00', 'proprietary_information': {'uicc_characteristics': b'q', 'available_memory': 239416, 'supported_filesystem_commands': {'terminal_capability': True}}, 'life_cycle_status_integer': 'operational_activated', 'security_attrib_referenced': {'ef_arr_file_id': b'/\x06', 'ef_arr_record_nr': 1}, 'pin_status_template_do': [{'ps_do': b'`'}, {'key_reference': 1}, {'key_reference': 10}, {'key_reference': 11}]}},
-            # ADF.USIM
-            {"resp_hex" : "623d8202782183027fd0840ca0000000871002ff49ff0589a50c80017183040003a7388701018a01058b032f0601c60f90017083010183018183010a83010b",
-             "decoded" : {'file_descriptor': {'file_descriptor_byte': {'shareable': True, 'file_type': 'df', 'structure': 'no_info_given'}, 'record_len': None, 'num_of_rec': None}, 'file_identifier': b'\x7f\xd0', 'df_name': b'\xa0\x00\x00\x00\x87\x10\x02\xffI\xff\x05\x89', 'proprietary_information': {'uicc_characteristics': b'q', 'available_memory': 239416, 'supported_filesystem_commands': {'terminal_capability': True}}, 'life_cycle_status_integer': 'operational_activated', 'security_attrib_referenced': {'ef_arr_file_id': b'/\x06', 'ef_arr_record_nr': 1}, 'pin_status_template_do': [{'ps_do': b'p'}, {'key_reference': 1}, {'key_reference': 129}, {'key_reference': 10}, {'key_reference': 11}]}},
-            # ADF.ISIM
-            {"resp_hex" : "623d8202782183027fb0840ca0000000871004ff49ff0589a50c80017183040003a7388701018a01058b032f0601c60f90017083010183018183010a83010b",
-             "decoded" : {'file_descriptor': {'file_descriptor_byte': {'shareable': True, 'file_type': 'df', 'structure': 'no_info_given'}, 'record_len': None, 'num_of_rec': None}, 'file_identifier': b'\x7f\xb0', 'df_name': b'\xa0\x00\x00\x00\x87\x10\x04\xffI\xff\x05\x89', 'proprietary_information': {'uicc_characteristics': b'q', 'available_memory': 239416, 'supported_filesystem_commands': {'terminal_capability': True}}, 'life_cycle_status_integer': 'operational_activated', 'security_attrib_referenced': {'ef_arr_file_id': b'/\x06', 'ef_arr_record_nr': 1}, 'pin_status_template_do': [{'ps_do': b'p'}, {'key_reference': 1}, {'key_reference': 129}, {'key_reference': 10}, {'key_reference': 11}]}},
-            # EF.IMSI
-            {"resp_hex" : "62178202412183026f078a01058b036f060a80020009880138",
-             "decoded" : {'file_descriptor': {'file_descriptor_byte': {'shareable': True, 'file_type': 'working_ef', 'structure': 'transparent'}, 'record_len': None, 'num_of_rec': None}, 'file_identifier': b'o\x07', 'life_cycle_status_integer': 'operational_activated', 'security_attrib_referenced': {'ef_arr_file_id': b'o\x06', 'ef_arr_record_nr': 10}, 'file_size': 9, 'short_file_identifier': 7}},
-            # EF.ECC
-            {"resp_hex" : "621a82054221000e0283026fb78a01058b036f06088002001c880108",
-             "decoded" : {'file_descriptor': {'file_descriptor_byte': {'shareable': True, 'file_type': 'working_ef', 'structure': 'linear_fixed'}, 'record_len': 14, 'num_of_rec': 2}, 'file_identifier': b'o\xb7', 'life_cycle_status_integer': 'operational_activated', 'security_attrib_referenced': {'ef_arr_file_id': b'o\x06', 'ef_arr_record_nr': 8}, 'file_size': 28, 'short_file_identifier': 1}},
-        ]
-        self.decode_select_response(CardProfileUICC, testcases)
-
-if __name__ == "__main__":
-	unittest.main()

tests/unittests/test_param_src.py

@@ -68,7 +68,7 @@ class ParamSourceTest(unittest.TestCase):
 
     def test_param_source(self):
 
-        class Paramtest(D):
+        class ParamSourceTest(D):
             mandatory = (
                     'param_source',
                     'n',
@@ -78,11 +78,6 @@ class ParamSourceTest(unittest.TestCase):
                     'expect_arg',
                     'csv_rows',
                     )
-            param_source: param_source.ParamSource
-            n: int
-            expect: object
-            expect_arg: object
-            csv_rows: object
 
         def expect_const(t, vals):
             return tuple(t.expect_arg) == tuple(vals)
@@ -105,59 +100,74 @@ class ParamSourceTest(unittest.TestCase):
             return True
 
         param_source_tests = [
-            Paramtest(param_source=param_source.ConstantSource.from_str('123'),
-                      n=3,
-                      expect=expect_const,
-                      expect_arg=('123', '123', '123')),
-            Paramtest(param_source=param_source.RandomDigitSource.from_str('12345'),
-                      n=3,
-                      expect=expect_random,
-                      expect_arg={'digits': decimals,
-                                  'val_minlen': 5,
-                                  'val_maxlen': 5}),
-            Paramtest(param_source=param_source.RandomDigitSource.from_str('1..999'),
-                      n=10,
-                      expect=expect_random,
-                      expect_arg={'digits': decimals,
-                                  'val_minlen': 1,
-                                  'val_maxlen': 3}),
-            Paramtest(param_source=param_source.RandomDigitSource.from_str('001..999'),
-                      n=10,
-                      expect=expect_random,
-                      expect_arg={'digits': decimals,
-                                  'val_minlen': 3,
-                                  'val_maxlen': 3}),
-            Paramtest(param_source=param_source.RandomHexDigitSource.from_str('12345678'),
-                      n=3,
-                      expect=expect_random,
-                      expect_arg={'digits': hexadecimals,
-                                  'val_minlen': 8,
-                                  'val_maxlen': 8}),
-            Paramtest(param_source=param_source.RandomHexDigitSource.from_str('0*8'),
-                      n=3,
-                      expect=expect_random,
-                      expect_arg={'digits': hexadecimals,
-                                  'val_minlen': 8,
-                                  'val_maxlen': 8}),
-            Paramtest(param_source=param_source.RandomHexDigitSource.from_str('00*4'),
-                      n=3,
-                      expect=expect_random,
-                      expect_arg={'digits': hexadecimals,
-                                  'val_minlen': 8,
-                                  'val_maxlen': 8}),
-            Paramtest(param_source=param_source.IncDigitSource.from_str('10001'),
-                      n=3,
-                      expect=expect_const,
-                      expect_arg=('10001', '10002', '10003')),
-            Paramtest(param_source=param_source.CsvSource('column_name'),
-                      n=3,
-                      expect=expect_const,
-                      expect_arg=('first val', 'second val', 'third val'),
-                      csv_rows=(
-                          {'column_name': 'first val'},
-                          {'column_name': 'second val'},
-                          {'column_name': 'third val'},
-                      )),
+            ParamSourceTest(param_source=param_source.ConstantSource.from_str('123'),
+                            n=3,
+                            expect=expect_const,
+                            expect_arg=('123', '123', '123')
+                           ),
+            ParamSourceTest(param_source=param_source.RandomDigitSource.from_str('12345'),
+                            n=3,
+                            expect=expect_random,
+                            expect_arg={'digits': decimals,
+                                        'val_minlen': 5,
+                                        'val_maxlen': 5,
+                                        },
+                           ),
+            ParamSourceTest(param_source=param_source.RandomDigitSource.from_str('1..999'),
+                            n=10,
+                            expect=expect_random,
+                            expect_arg={'digits': decimals,
+                                        'val_minlen': 1,
+                                        'val_maxlen': 3,
+                                        },
+                           ),
+            ParamSourceTest(param_source=param_source.RandomDigitSource.from_str('001..999'),
+                            n=10,
+                            expect=expect_random,
+                            expect_arg={'digits': decimals,
+                                        'val_minlen': 3,
+                                        'val_maxlen': 3,
+                                        },
+                           ),
+            ParamSourceTest(param_source=param_source.RandomHexDigitSource.from_str('12345678'),
+                            n=3,
+                            expect=expect_random,
+                            expect_arg={'digits': hexadecimals,
+                                        'val_minlen': 8,
+                                        'val_maxlen': 8,
+                                       },
+                           ),
+            ParamSourceTest(param_source=param_source.RandomHexDigitSource.from_str('0*8'),
+                            n=3,
+                            expect=expect_random,
+                            expect_arg={'digits': hexadecimals,
+                                        'val_minlen': 8,
+                                        'val_maxlen': 8,
+                                       },
+                           ),
+            ParamSourceTest(param_source=param_source.RandomHexDigitSource.from_str('00*4'),
+                            n=3,
+                            expect=expect_random,
+                            expect_arg={'digits': hexadecimals,
+                                        'val_minlen': 8,
+                                        'val_maxlen': 8,
+                                       },
+                           ),
+            ParamSourceTest(param_source=param_source.IncDigitSource.from_str('10001'),
+                            n=3,
+                            expect=expect_const,
+                            expect_arg=('10001', '10002', '10003')
+                           ),
+            ParamSourceTest(param_source=param_source.CsvSource('column_name'),
+                            n=3,
+                            expect=expect_const,
+                            expect_arg=('first val', 'second val', 'third val'),
+                            csv_rows=(
+                                      {'column_name': 'first val',},
+                                      {'column_name': 'second val',},
+                                      {'column_name': 'third val',},
+                                     )
+                           ),
             ]
 
         outputs = []