Skip to content
GitLab
Find file Normal viewHistoryPermalink
ItsPki_TestCases.ttcn 948 KB
Newer Older
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16001 16002 16003 16004 16005 16006 16007 16008 16009 16010 16011 16012 16013 16014 16015 16016 16017 16018 16019 16020 16021 16022 16023 
       *                    containing digest
       *                        indicating HashedId8 of the certificate
       *                    containing appPermissions
       *                        not containing an item of type PsidSsp
       *                        containing psid
       *                            indicating AID_CERT_REQ
       *                        or containing an item of type PsidSsp
       *                            containing psid
       *                                indicating AID_CERT_REQ
       *                        and containing ssp
       *                             containing opaque[0] (version) 
       *                                 indicating other value than 1
       *                        or containing opaque[1] (value) 
       *                            indicating "AuthorizationValidationResponse" (bit 4) set to 0
       *         }
       *         then {
       *            the IUT answers with an AuthorisationValidationResponseMessage
       *                containing responseCode
       *                    indicating non-zero value
       *         }
       *     }
       * </pre>
       *
Yann Garcia's avatar
Validate TC_SECPKI_EA_BFK_AUTH_01_BV  
Yann Garcia committed
16024 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTHVAL_RCV_02_BI
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16025 16026 16027 16028 
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTHVAL_RCV_02_BI() runs on ItsPkiHttp system ItsPkiHttpSystem {} // End of testcase TC_SECPKI_AA_AUTHVAL_RCV_02_BI
Yann Garcia's avatar
Add clause references for EA/AA/CA/TLM/CPOC parts  
Yann Garcia committed
16029 
    } // End of group aa_authorization_validation_response
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16030
Yann Garcia's avatar
Implement TPs SECPKI_AA_AUTH_01..04_BV  
Yann Garcia committed
16031 
    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.5.4  Authorization response
Yann Garcia's avatar
Add clause references for EA/AA/CA/TLM/CPOC parts  
Yann Garcia committed
16032 
    group aa_authorization_response {
Yann Garcia's avatar
Implement TPs SECPKI_AA_AUTH_01..04_BV  
Yann Garcia committed
16033 16034 16035 16036 16037 16038 16039 16040 16041 16042 16043 16044 16045 16046 16047 16048 16049 16050 16051 16052 16053 16054 16055 16056 16057 16058 16059 16060 16061 16062 16063 16064 16065 16066 16067 16068 16069 16070 16071 16072 16073 16074 16075 16076 16077 16078 16079 16080 16081 16082 16083 16084 16085 16086 16087 16088 16089 16090 16091 16092 16093 16094 16095 16096 16097 16098 16099 16100 16101 16102 16103 16104 16105 16106 16107 16108 16109 16110 16111 16112 16113 16114 16115 16116 16117 16118 16119 16120 16121 16122 16123 16124 16125 16126 16127 16128 16129 16130 16131 16132 16133 16134 16135 16136 16137 16138 16139 16140 16141 16142 16143 16144 16145 16146 16147 16148 16149 16150 16151 16152 16153 16154 16155 16156 16157 16158 16159 16160 16161 16162 16163 16164 16165 16166 16167 16168 16169 16170 16171 16172 16173 16174 16175 16176 16177 16178 16179 16180 16181 16182 16183 16184 16185 16186 16187 16188 16189 16190 16191 16192 16193 16194 16195 16196 16197 16198 16199 16200 16201 16202 16203 16204 16205 16206 16207 16208 16209 16210 16211 16212 16213 16214 16215 16216 16217 16218 16219 16220 16221 16222 16223 16224 16225 16226 16227 16228 16229 16230 16231 16232 16233 16234 16235 16236 16237 16238 16239 16240 16241 16242 16243 16244 16245 16246 16247 16248 16249 16250 16251 16252 16253 16254 16255 16256 16257 16258 16259 16260 16261 16262 16263 16264 16265 16266 16267 16268 16269 16270 16271 16272 16273 16274 16275 16276 16277 16278 16279 16280 16281 16282 16283 16284 16285 16286 16287 16288 16289 16290 16291 16292 16293 16294 16295 16296 16297 16298 16299 16300 16301 16302 16303 16304 16305 16306 16307 16308 16309 16310 16311 16312 16313 16314 16315 16316 16317 16318 16319 16320 16321 16322 16323 16324 16325 16326 16327 16328 16329 16330 16331 16332 16333 16334 16335 16336 16337 16338 16339 16340 16341 16342 16343 16344 16345 16346 16347 16348 16349 16350 16351 16352 16353 16354 16355 16356 16357 16358 16359 16360 16361 16362 16363 16364 16365 16366 16367 16368 16369 16370 16371 16372 16373 16374 16375 16376 16377 16378 16379 16380 16381 16382 16383 16384 16385 16386 16387 16388 16389 16390 16391 16392 16393 16394 16395 16396 16397 16398 16399 16400 16401 16402 16403 16404 16405 16406 16407 16408 16409 16410 16411 16412 16413 16414 16415 16416 16417 16418 16419 16420 16421 16422 16423 16424 16425 16426 16427 16428 16429 16430 16431 16432 16433 16434 16435 16436 16437 16438 16439 16440 16441 16442 16443 16444 16445 16446 16447 16448 16449 16450 16451 16452 16453 16454 16455 16456 16457 16458 16459 16460 16461 16462 16463 16464 16465 16466 16467 16468 16469 16470 16471 16472 16473 16474 16475 16476 16477 16478 16479 16480 16481 16482 16483 16484 16485 16486 16487 16488 16489 16490 16491 16492 16493 16494 16495 16496 16497 16498 16499 16500 16501 16502 16503 16504 16505 16506 16507 16508 16509 16510 16511 16512 16513 16514 16515 16516 16517 16518 16519 16520 16521 16522 16523 16524 16525 16526 16527 16528 16529 16530 16531 16532 16533 16534 16535 16536 16537 16538 16539 16540 16541 16542 16543 16544 16545 16546 16547 16548 16549 16550 16551 16552 16553 16554 16555 16556 16557 16558 16559 16560 16561 16562 16563 16564 16565 16566 16567 16568 16569 16570 16571 16572 16573 16574 16575 16576 16577 16578 16579 16580 16581 16582 16583 16584 16585 16586 16587 16588 16589 16590 16591 16592 16593 16594 16595 16596 16597 16598 16599 16600 16601 16602 16603 16604 16605 16606 16607 16608 16609 16610 16611 16612 16613 16614 16615 16616 16617 16618 16619 16620 16621 16622 16623 16624 16625 16626 16627 16628 16629 16630 16631 16632 16633 16634 16635 16636 16637 16638 16639 16640 16641 16642 16643 16644 16645 16646 16647 16648 16649 16650 16651 16652 16653 16654 16655 16656 16657 16658 16659 16660 16661 16662 16663 16664 16665 16666 16667 16668 16669 16670 16671 

      /**
       * @desc Check that the AA sends encrypted authorization response.
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *          the ITS-S in "enrolled" state and
       *          the ITS-S has sent the AuthorizationRequestMessage
       *              containing encrypted enkKey
       *                  containing AES symmetric key (SYM_KEY) and
       *          the EA in "operational" state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *         }
       *         then {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *                containing content.encryptedData
       *                    containing recipients of size 1
       *                        containing the instance of RecipientInfo
       *                            containing pskRecipInfo
       *                                indicating HashedId8 of the SYM_KEY
       *                and containing cyphertext
       *                    encrypted using SYM_KEY
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTH_01_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTH_01_BV() runs on ServerSyncComp system ItsPkiHttpSystem {
        // Local variables
        var ItsPkiHttp v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_AA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp02(v_itss, v_ea);

        // Test adapter configuration

        // Start components
        v_itss.start(f_TC_SECPKI_AA_AUTH_01_BV_itss());
        v_ea.start(f_TC_SECPKI_AA_AUTH_01_BV_ea());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        f_cfMtcDown02(v_itss, v_ea);
      } // End of testcase TC_SECPKI_AA_AUTH_01_BV

      group f_TC_SECPKI_AA_AUTH_01_BV {

        function f_TC_SECPKI_AA_AUTH_01_BV_itss() runs on ItsPkiHttp system ItsPkiHttpSystem {
          var Oct32 v_private_key_ec;
          var Oct32 v_public_compressed_key_ec;
          var integer v_compressed_key_mode_ec;
          var InnerEcRequest v_inner_ec_request;
          var EtsiTs103097Certificate v_ec_certificate;
          var Oct32 v_private_key_at;
          var Oct32 v_public_compressed_key_at;
          var integer v_compressed_mode_at;
          var Oct32 v_private_enc_key_at;
          var Oct32 v_public_compressed_enc_key_at;
          var integer v_compressed_enc_mode_at;
          var octetstring v_request_hash;
          var Oct16 v_encrypted_sym_key;
          var Oct16 v_aes_sym_key;
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Oct16 v_authentication_vector;
          var Oct12 v_nonce;
          var octetstring v_salt;
          var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
          var Headers v_headers;
          var HttpMessage v_request;
          var HttpMessage v_response;
          var EtsiTs102941Data v_etsi_ts_102941_data;
          var Oct16 v_aes_enc_key;
          var InnerAtRequest v_inner_at_request;
          var InnerAtResponse v_inner_at_response;
          var HashedId8 v_ec_certificate_hashed_id8;

          // Test component configuration
          f_cfHttpUp_itss(cc_taCert_A_EA, PICS_IUT_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          // Generate EC certificate
          f_generate_inner_ec_request(v_private_key_ec, v_public_compressed_key_ec, v_compressed_key_mode_ec, v_inner_ec_request);
          f_generate_ec_certificate_for_inner_ec_response(v_inner_ec_request, v_private_key_ec, vc_eaWholeHash, v_ec_certificate, v_ec_certificate_hashed_id8);
          // Send AuthorizationRequest
          f_http_build_authorization_request(v_ec_certificate, v_private_key_ec, v_private_key_at, v_public_compressed_key_at, v_compressed_mode_at, v_private_enc_key_at, v_public_compressed_enc_key_at, v_compressed_enc_mode_at, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
          v_aes_sym_key_hashed_id8 := f_hashedId8FromSha256(f_hashWithSha256('80'O & v_aes_sym_key)); // Used to match the response
          f_init_default_headers_list(-, "inner_at_request", v_headers);
          f_http_send(
                      v_headers,
                      m_http_request(
                                     m_http_request_post(
                                                         PICS_HTTP_POST_URI_AT,
                                                         v_headers,
                                                         m_http_message_body_binary(
                                                                                    m_binary_body_ieee1609dot2_data(
                                                                                                                    v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                    )))));
          f_selfOrClientSyncAndVerdict(c_prDone, e_success);

          // Test body
          tc_ac.start;
          alt {
            [] a_await_at_http_response_from_iut(
                                                 mw_http_response(
                                                                  mw_http_response_ok(
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_authorizationRequestMessage(
                                                                                                                                                                                  mw_encryptedData(
                                                                                                                                                                                                   { *, mw_recipientInfo_pskRecipInfo, * },
                                                                                                                                                                                                   mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                   )))))),
                                                 v_response
                                                 ) {
              var integer v_result;

              tc_ac.stop;

              f_verify_http_at_response_from_iut_aa(v_response.response, v_private_key_at, v_aes_sym_key, v_authentication_vector, v_request_hash, v_inner_at_response, v_result);
              if ((v_result != -2) and (v_result != -3)){
                log("*** f_TC_SECPKI_AA_AUTH_01_BV_itss: PASS: Received exptected response ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
              } else {
                log("*** f_TC_SECPKI_AA_AUTH_01_BV_itss: FAIL: Unexptected response ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
              }
            }
            [] tc_ac.timeout {
              log("*** f_TC_SECPKI_AA_AUTH_01_BV_itss: INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfHttpDown_itss();
        } // End of function f_TC_SECPKI_AA_AUTH_01_BV_itss

        function f_TC_SECPKI_AA_AUTH_01_BV_ea() runs on ItsPkiHttp system ItsPkiHttpSystem {
          var Oct32 v_private_key_ec;
          var Oct32 v_public_compressed_key_ec;
          var integer v_compressed_key_mode_ec;
          var InnerEcRequest v_inner_ec_request;
          var EtsiTs103097Certificate v_ec_certificate;
          var Oct32 v_private_key_at;
          var Oct32 v_public_compressed_key_at;
          var integer v_compressed_mode_at;
          var Oct32 v_private_enc_key_at;
          var Oct32 v_public_compressed_enc_key_at;
          var integer v_compressed_enc_mode_at;
          var octetstring v_request_hash;
          var Oct16 v_encrypted_sym_key;
          var Oct16 v_aes_sym_key;
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Oct12 v_nonce;
          var octetstring v_salt;
          var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
          var Headers v_headers;
          var HttpMessage v_request;
          var HttpMessage v_response;
          var EtsiTs102941Data v_etsi_ts_102941_data;
          var Oct16 v_aes_enc_key := int2oct(0, 16);
          var SharedAtRequest v_shared_at_request;
          var AuthorizationValidationResponse v_authorization_validation_response;

          // Test component configuration
          f_cfHttpUp_ea(cc_taCert_A_EA, PICS_IUT_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          tc_ac.start;
          alt {
            [] a_await_atv_http_request_from_iut( // Wait for authorizationValidation Request from IUT to EA
                                                 mw_http_request(
                                                                 mw_http_request_post(
                                                                                      -, //FIXME: Use another PIXIT than PICS_HTTP_POST_URI_ATV,
                                                                                      -,
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_authorizationRequestMessage(
                                                                                                                                                                                  mw_encryptedData(
                                                                                                                                                                                                   { *, mw_recipientInfo_certRecipInfo(mw_pKRecipientInfo(vc_eaHashedId8)), * },
                                                                                                                                                                                                   mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                   )))))),
                                                 v_request
                                                  ) {
              var integer v_result;

              tc_ac.stop;

              f_verify_http_at_request_from_iut_atv(v_request.request, v_aes_sym_key, v_request_hash, v_shared_at_request, v_result);
              // Set verdict
              if (v_result == 0) {
                log("*** f_TC_SECPKI_AA_AUTH_01_BV_ea: INFO: IUT has sent AuthorizationValidation request ***");
                // Send AuthorizationValidation response to finalize the exchange
                log("*** f_TC_SECPKI_AA_AUTH_01_BV_ea: INFO: Send AuthorizationValidation response to finalize the exchange ***");
                f_init_default_headers_list(-, "inner_atv_response", v_headers);
                f_http_build_authorization_validation_response(v_shared_at_request, ok, v_request_hash, vc_eaPrivateKey, vc_eaWholeHash, v_aes_enc_key, v_authorization_validation_response, v_ieee1609dot2_signed_and_encrypted_data);
                f_http_send(
                            v_headers,
                            m_http_response(
                                            m_http_response_ok(
                                                               m_http_message_body_binary(
                                                                                          m_binary_body_ieee1609dot2_data(
                                                                                                                          v_ieee1609dot2_signed_and_encrypted_data
                                                                                          )),
                                                               v_headers
                            )));
                f_selfOrClientSyncAndVerdict(c_prDone, e_success);
              } else {
                log("*** f_TC_SECPKI_AA_AUTH_01_BV_ea: INCONC: Failed to verify AuthorizationValidation request ***");
                // Send AuthorizationValidation response to finalize the exchange
                log("*** f_TC_SECPKI_AA_AUTH_01_BV_ea: INFO: Send AuthorizationValidation response to finalize the exchange ***");
                f_init_default_headers_list(-, "inner_atv_response", v_headers);
                f_http_build_authorization_validation_response(v_shared_at_request, deniedpermissions, v_request_hash, vc_eaPrivateKey, vc_eaWholeHash, v_aes_enc_key, v_authorization_validation_response, v_ieee1609dot2_signed_and_encrypted_data);
                f_http_send(
                            v_headers,
                            m_http_request(
                                           m_http_request_post(
                                                               PICS_HTTP_POST_URI_AT,
                                                               v_headers,
                                                               m_http_message_body_binary(
                                                                                          m_binary_body_ieee1609dot2_data(
                                                                                                                          v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                          )))));
                f_selfOrClientSyncAndVerdict(c_prDone, e_timeout);
              }
            }
            [] tc_ac.timeout {
              log("*** f_TC_SECPKI_AA_AUTH_01_BV_ea: INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_prDone, e_timeout);
            }
          } // End of 'alt' statement

          // Test body
          f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);

          // Postamble
          // TODO Wait for AuthorizationResponse
          f_cfHttpDown_ea();

        } // End of function f_TC_SECPKI_AA_AUTH

      } // End of group f_TC_SECPKI_AA_AUTH_01_BV

      /**
       * @desc Check that the AA sends signed authorization response.
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *          the ITS-S in "enrolled" state and
       *          the IUT(AA) in 'operational' state
       *              authorized with CERT_AA certificate
       *          and the EA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *         }
       *         then {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *                containing the EtsiTs103097Data-Signed
       *                    containing signedData
       *                        containing signer
       *                            containing digest
       *                                indicating HashedId8 value of the CERT_AA
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTH_02_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTH_02_BV() runs on ServerSyncComp system ItsPkiHttpSystem {
        // Local variables
        var ItsPkiHttp v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_AA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp02(v_itss, v_ea);

        // Test adapter configuration

        // Start components
        v_itss.start(f_TC_SECPKI_AA_AUTH_02_BV_itss());
        v_ea.start(f_TC_SECPKI_AA_AUTH_02_BV_ea());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        f_cfMtcDown02(v_itss, v_ea);
      } // End of testcase TC_SECPKI_AA_AUTH_02_BV

      group f_TC_SECPKI_AA_AUTH_02_BV {

        function f_TC_SECPKI_AA_AUTH_02_BV_itss() runs on ItsPkiHttp system ItsPkiHttpSystem {
          var Oct32 v_private_key_ec;
          var Oct32 v_public_compressed_key_ec;
          var integer v_compressed_key_mode_ec;
          var InnerEcRequest v_inner_ec_request;
          var EtsiTs103097Certificate v_ec_certificate;
          var Oct32 v_private_key_at;
          var Oct32 v_public_compressed_key_at;
          var integer v_compressed_mode_at;
          var Oct32 v_private_enc_key_at;
          var Oct32 v_public_compressed_enc_key_at;
          var integer v_compressed_enc_mode_at;
          var octetstring v_request_hash;
          var Oct16 v_encrypted_sym_key;
          var Oct16 v_aes_sym_key;
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Oct16 v_authentication_vector;
          var Oct12 v_nonce;
          var octetstring v_salt;
          var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
          var Headers v_headers;
          var HttpMessage v_request;
          var HttpMessage v_response;
          var EtsiTs102941Data v_etsi_ts_102941_data;
          var Oct16 v_aes_enc_key;
          var InnerAtRequest v_inner_at_request;
          var InnerAtResponse v_inner_at_response;
          var HashedId8 v_ec_certificate_hashed_id8;

          // Test component configuration
          f_cfHttpUp_itss(cc_taCert_A_EA, PICS_IUT_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          // Generate EC certificate
          f_generate_inner_ec_request(v_private_key_ec, v_public_compressed_key_ec, v_compressed_key_mode_ec, v_inner_ec_request);
          f_generate_ec_certificate_for_inner_ec_response(v_inner_ec_request, v_private_key_ec, vc_eaWholeHash, v_ec_certificate, v_ec_certificate_hashed_id8);
          // Send AuthorizationRequest
          f_http_build_authorization_request(v_ec_certificate, v_private_key_ec, v_private_key_at, v_public_compressed_key_at, v_compressed_mode_at, v_private_enc_key_at, v_public_compressed_enc_key_at, v_compressed_enc_mode_at, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
          v_aes_sym_key_hashed_id8 := f_hashedId8FromSha256(f_hashWithSha256('80'O & v_aes_sym_key)); // Used to match the response
          f_init_default_headers_list(-, "inner_at_request", v_headers);
          f_http_send(
                      v_headers,
                      m_http_request(
                                     m_http_request_post(
                                                         PICS_HTTP_POST_URI_AT,
                                                         v_headers,
                                                         m_http_message_body_binary(
                                                                                    m_binary_body_ieee1609dot2_data(
                                                                                                                    v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                    )))));
          f_selfOrClientSyncAndVerdict(c_prDone, e_success);

          // Test body
          tc_ac.start;
          alt {
            [] a_await_at_http_response_from_iut(
                                                 mw_http_response(
                                                                  mw_http_response_ok(
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_authorizationRequestMessage(
                                                                                                                                                                                  mw_encryptedData(
                                                                                                                                                                                                   { *, mw_recipientInfo_pskRecipInfo, * },
                                                                                                                                                                                                   mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                   )))))),
                                                 v_response
                                                 ) {
              var integer v_result;

              tc_ac.stop;

              f_verify_http_at_response_from_iut_aa(v_response.response, v_private_key_at, v_aes_sym_key, v_authentication_vector, v_request_hash, v_inner_at_response, v_result);
              if (v_result == 0) {
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_itss: PASS: Received exptected response ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
              } else {
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_itss: FAIL: Unexptected response ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
              }
            }
            [] tc_ac.timeout {
              log("*** f_TC_SECPKI_AA_AUTH_02_BV_itss: INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfHttpDown_itss();
        } // End of function f_TC_SECPKI_AA_AUTH_02_BV_itss

        function f_TC_SECPKI_AA_AUTH_02_BV_ea() runs on ItsPkiHttp system ItsPkiHttpSystem {
          var Oct32 v_private_key_ec;
          var Oct32 v_public_compressed_key_ec;
          var integer v_compressed_key_mode_ec;
          var InnerEcRequest v_inner_ec_request;
          var EtsiTs103097Certificate v_ec_certificate;
          var Oct32 v_private_key_at;
          var Oct32 v_public_compressed_key_at;
          var integer v_compressed_mode_at;
          var Oct32 v_private_enc_key_at;
          var Oct32 v_public_compressed_enc_key_at;
          var integer v_compressed_enc_mode_at;
          var octetstring v_request_hash;
          var Oct16 v_encrypted_sym_key;
          var Oct16 v_aes_sym_key;
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Oct12 v_nonce;
          var octetstring v_salt;
          var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
          var Headers v_headers;
          var HttpMessage v_request;
          var HttpMessage v_response;
          var EtsiTs102941Data v_etsi_ts_102941_data;
          var Oct16 v_aes_enc_key := int2oct(0, 16);
          var SharedAtRequest v_shared_at_request;
          var AuthorizationValidationResponse v_authorization_validation_response;

          // Test component configuration
          f_cfHttpUp_ea(cc_taCert_A_EA, PICS_IUT_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          tc_ac.start;
          alt {
            [] a_await_atv_http_request_from_iut( // Wait for authorizationValidation Request from IUT to EA
                                                 mw_http_request(
                                                                 mw_http_request_post(
                                                                                      -, //FIXME: Use another PIXIT than PICS_HTTP_POST_URI_ATV,
                                                                                      -,
                                                                                      mw_http_message_body_binary(
                                                                                                                  mw_binary_body_ieee1609dot2_data(
                                                                                                                                                   mw_authorizationRequestMessage(
                                                                                                                                                                                  mw_encryptedData(
                                                                                                                                                                                                   { *, mw_recipientInfo_certRecipInfo(mw_pKRecipientInfo(vc_eaHashedId8)), * },
                                                                                                                                                                                                   mw_symmetricCiphertext_aes128ccm
                                                                                                                                                                                                   )))))),
                                                 v_request
                                                  ) {
              var integer v_result;

              tc_ac.stop;

              f_verify_http_at_request_from_iut_atv(v_request.request, v_aes_sym_key, v_request_hash, v_shared_at_request, v_result);
              // Set verdict
              if (v_result == 0) {
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INFO: IUT has sent AuthorizationValidation request ***");
                // Send AuthorizationValidation response to finalize the exchange
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INFO: Send AuthorizationValidation response to finalize the exchange ***");
                f_init_default_headers_list(-, "inner_atv_response", v_headers);
                f_http_build_authorization_validation_response(v_shared_at_request, ok, v_request_hash, vc_eaPrivateKey, vc_eaWholeHash, v_aes_enc_key, v_authorization_validation_response, v_ieee1609dot2_signed_and_encrypted_data);
                f_http_send(
                            v_headers,
                            m_http_response(
                                            m_http_response_ok(
                                                               m_http_message_body_binary(
                                                                                          m_binary_body_ieee1609dot2_data(
                                                                                                                          v_ieee1609dot2_signed_and_encrypted_data
                                                                                          )),
                                                               v_headers
                            )));
                f_selfOrClientSyncAndVerdict(c_prDone, e_success);
              } else {
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INCONC: Failed to verify AuthorizationValidation request ***");
                // Send AuthorizationValidation response to finalize the exchange
                log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INFO: Send AuthorizationValidation response to finalize the exchange ***");
                f_init_default_headers_list(-, "inner_atv_response", v_headers);
                f_http_build_authorization_validation_response(v_shared_at_request, deniedpermissions, v_request_hash, vc_eaPrivateKey, vc_eaWholeHash, v_aes_enc_key, v_authorization_validation_response, v_ieee1609dot2_signed_and_encrypted_data);
                f_http_send(
                            v_headers,
                            m_http_request(
                                           m_http_request_post(
                                                               PICS_HTTP_POST_URI_AT,
                                                               v_headers,
                                                               m_http_message_body_binary(
                                                                                          m_binary_body_ieee1609dot2_data(
                                                                                                                          v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                          )))));
                f_selfOrClientSyncAndVerdict(c_prDone, e_timeout);
              }
            }
            [] tc_ac.timeout {
              log("*** f_TC_SECPKI_AA_AUTH_02_BV_ea: INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_prDone, e_timeout);
            }
          } // End of 'alt' statement

          // Test body
          f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);

          // Postamble
          // TODO Wait for AuthorizationResponse
          f_cfHttpDown_ea();

        } // End of function f_TC_SECPKI_AA_AUTH

      } // End of group f_TC_SECPKI_AA_AUTH_02_BV

      /**
       * @desc Check that the AA sends signed authorization response with signature properly calculated using approved hash algorithm.
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *          the ITS-S in "enrolled" state and
       *          the IUT(AA) in 'operational' state
       *              authorized with CERT_AA certificate
       *                  containing verificationKey (AA_PUB_V_KEY)
       *          and the EA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *         }
       *         then {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *                containing the EtsiTs103097Data-Signed
       *                    containing signedData
       *                        containing hashId
       *                            indicating supported hash algorithm (HASH_ALG)
       *                        and containing signature
       *                            calculated using the HASH_ALG and private key correspondent to the AA_PUB_V_KEY
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTH_02_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTH_03_BV() runs on ServerSyncComp system ItsPkiHttpSystem {
        // Local variables
        var ItsPkiHttp v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_AA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp02(v_itss, v_ea);

        // Test adapter configuration

        // Start components
        v_itss.start(f_TC_SECPKI_AA_AUTH_02_BV_itss());
        v_ea.start(f_TC_SECPKI_AA_AUTH_02_BV_ea());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        f_cfMtcDown02(v_itss, v_ea);
      } // End of testcase TC_SECPKI_AA_AUTH_03_BV

      /**
       * @desc Check that the AA sends signed AuthorizationResponseMessage using valid ITS AID and only allowed headers.
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *          the ITS-S in "enrolled" state and
       *          the IUT(AA) in 'operational' state
       *          and the EA in 'operational' state
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *         }
       *         then {
       *            the IUT is triggered to send the authorization response to the ITS-S
       *                containing the EtsiTs103097Data-Signed
       *                    containing signedData
       *                        containing tbsData
       *                            containing psid
       *                                indicating AID_PKI_CERT_REQUEST
       *                        and containing generationTime
       *                        and not containing any other headers
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTH_02_BV
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_AUTH_04_BV() runs on ServerSyncComp system ItsPkiHttpSystem {
        // Local variables
        var ItsPkiHttp v_itss;
        var ItsPkiHttp v_ea;

        // Test control
        if (not PICS_IUT_AA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }

        // Test component configuration
        f_cfMtcUp02(v_itss, v_ea);

        // Test adapter configuration

        // Start components
        v_itss.start(f_TC_SECPKI_AA_AUTH_02_BV_itss());
        v_ea.start(f_TC_SECPKI_AA_AUTH_02_BV_ea());

        // Synchronization
        f_serverSync2ClientsAndStop({c_prDone, c_tbDone});

        f_cfMtcDown02(v_itss, v_ea);
      } // End of testcase TC_SECPKI_AA_AUTH_04_BV
Yann Garcia's avatar
Add clause references for EA/AA/CA/TLM/CPOC parts  
Yann Garcia committed
16672 
    } // End of group aa_authorization_response
Yann Garcia's avatar
Add support of BFK as defined in P1609.2.1/D7, January 2022 Clause 9.3.4.1.1 General  
Yann Garcia committed
16673
Yann Garcia's avatar
Implement TPs SECPKI_AA_AUTH_01..04_BV  
Yann Garcia committed
16674 
    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.5.5  CA Certificate Request
Yann Garcia's avatar
Add clause references for EA/AA/CA/TLM/CPOC parts  
Yann Garcia committed
16675 16676 16677 
    group aa_ca_certificates_request {
      // TODO
    } // End of group aa_ca_certificates_request
Yann Garcia's avatar
Add support of BFK as defined in P1609.2.1/D7, January 2022 Clause 9.3.4.1.1 General  
Yann Garcia committed
16678
Yann Garcia's avatar
Implement TPs SECPKI_AA_AUTH_01..04_BV  
Yann Garcia committed
16679 
    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.5.6  Authorization using butterfly key expansion mechanism
Yann Garcia's avatar
Add clause references for EA/AA/CA/TLM/CPOC parts  
Yann Garcia committed
16680 
    group aa_authorization_with_bfk {
Yann Garcia's avatar
Add support of BFK as defined in P1609.2.1/D7, January 2022 Clause 9.3.4.1.1 General  
Yann Garcia committed
16681 16682 16683 16684 16685 16686 16687 16688 16689 16690 16691 16692 16693 16694 16695 16696 16697 16698 16699 16700 16701 16702 16703 16704 16705 16706 16707 16708 16709 16710 16711 16712 16713 16714 16715 16716 16717 16718 16719 16720 16721 16722 16723 16724 16725 16726 16727 16728 16729 16730 16731 16732 16733 16734 16735 16736 16737 16738 16739 16740 16741 16742 

      group bfk_cert_request_helpers {

          function f_trigger_butterfly_cert_request(
                                                    out HashedId8 p_aes_sym_key_hashed_id8,
                                                    out RaAcaCertRequest p_ra_aca_cert_request
                                                    ) runs on ItsPkiHttp {
            // Local variables
            var octetstring v_caterpillar_private_key
            var octetstring v_caterpillar_public_key_compressed;
            var integer v_caterpillar_compressed_mode;
            var octetstring v_caterpillar_enc_private_key
            var octetstring v_caterpillar_enc_public_key_compressed;
            var integer v_caterpillar_enc_compressed_mode;
            var EeRaCertRequest v_ee_ra_cert_request;
            var octetstring v_private_key;
            var Oct16 v_encrypted_sym_key;
            var Oct16 v_aes_sym_key;
            var Oct16 v_authentication_vector;
            var Oct12 v_nonce;
            var Oct32 v_request_hash;
            var octetstring v_salt;
            var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
            var Headers v_headers;
            var HttpMessage v_response;
            var EtsiTs102941Data v_etsi_ts_102941_data;


            // Generate EeRaCertRequest
            if (f_generate_ee_ra_cert_request(v_caterpillar_private_key, v_caterpillar_public_key_compressed, v_caterpillar_compressed_mode, v_caterpillar_enc_private_key, v_caterpillar_enc_public_key_compressed, v_caterpillar_enc_compressed_mode, v_ee_ra_cert_request) == false) {
              log("*** f_trigger_butterfly_cert_request: ERROR: Failed to generate InnerEcRequest ***");
              f_selfOrClientSyncAndVerdict("error", e_error);
            }
            log ("f_trigger_butterfly_cert_request: p_ee_ra_cert_request: ", v_ee_ra_cert_request);
            // Buikd theHTTP request
            f_http_build_butterfly_cert_request(v_ee_ra_cert_request, vc_eaPrivateKey, v_aes_sym_key, v_encrypted_sym_key, v_authentication_vector, v_nonce, v_salt, p_ra_aca_cert_request, v_ieee1609dot2_signed_and_encrypted_data, v_request_hash);
            p_aes_sym_key_hashed_id8 := f_hashedId8FromSha256(f_hashWithSha256('80'O & v_aes_sym_key)); // Used to match the response
            f_init_default_headers_list(-, "bfk_cert_request", v_headers);
            f_http_send(
                        v_headers,
                        m_http_request(
                                      m_http_request_post(
                                                          PICS_HTTP_POST_URI_BFK_AA,
                                                          v_headers,
                                                          m_http_message_body_binary(
                                                                                    m_binary_body_ieee1609dot2_data(
                                                                                                                    v_ieee1609dot2_signed_and_encrypted_data
                                                                                                                    )))));
          } // End of function f_trigger_butterfly_cert_request

          function f_verify_http_butterfly_cert_request_message_to_ea(
                                                                      in Request p_request,
                                                                      in Headers p_headers,
                                                                      out integer p_result,
                                                                      out AcaRaCertResponse p_aca_ra_cert_response
                                                                      ) runs on ItsPkiHttp {

            // Local variables
            var Ieee1609Dot2Data v_ieee1609dot2_signed_and_encrypted_data;
            var EtsiTs102941Data v_etsi_ts_102941_data;
            var template (value) HttpMessage v_response;
            var Oct16 v_request_hash;
Yann Garcia's avatar
Validate TC_SECPKI_EA_BFK_AUTH_01_BV  
Yann Garcia committed
16743 
            var HashedId8 v_bfk_hashed_id8;
Yann Garcia's avatar
Add support of BFK as defined in P1609.2.1/D7, January 2022 Clause 9.3.4.1.1 General  
Yann Garcia committed
16744 16745 16746 16747 16748 16749 
            var Oct16 v_aes_enc_key;

            log(">>> f_verify_http_butterfly_cert_request_message_to_ea: ", p_request);

            p_result := 0;
Yann Garcia's avatar
Validate TC_SECPKI_EA_BFK_AUTH_01_BV  
Yann Garcia committed
16750 
            if (f_verify_pki_request_message(vc_aaPrivateEncKey, vc_aaWholeHash/*salt*/, ''O, p_request.body.binary_body.ieee1609dot2_data, true, v_request_hash, v_bfk_hashed_id8, v_etsi_ts_102941_data, v_aes_enc_key) == false) { // Cannot decrypt the message
Yann Garcia's avatar
Add support of BFK as defined in P1609.2.1/D7, January 2022 Clause 9.3.4.1.1 General  
Yann Garcia committed
16751 16752 16753 16754 16755 16756 16757 16758 16759 16760 16761 16762 16763 16764 16765 16766 16767 16768 16769 16770 16771 16772 16773 16774 16775 16776 16777 16778 16779 16780 16781 16782 16783 16784 16785 16786 16787 16788 16789 16790 16791 16792 16793 16794 16795 16796 16797 16798 16799 16800 16801 16802 16803 16804 16805 16806 16807 
              // Send error message
              v_response := m_http_response(m_http_response_ko_no_body(p_headers, 400, "Bad request")); // Initialize v_reponse with an error message
              // Set verdict
              p_result := -1;
            } else {
              var UInt64 v_current_time := f_getCurrentTimeUtc();
              var UInt64 v_delta_time := 30;

              log("f_verify_http_butterfly_cert_request_message_to_ea: match ", match(v_etsi_ts_102941_data, mw_etsiTs102941Data_ra_aca_cert_request(mw_ra_aca_cert_request))); // TODO In TITAN, this is the only way to get the unmatching in log
              if (match(v_etsi_ts_102941_data, mw_etsiTs102941Data_ra_aca_cert_request(mw_ra_aca_cert_request((v_current_time - v_delta_time .. v_current_time + v_delta_time), explicit, '00000000'B/*butterflyExplicit*/, mw_bfk_to_be_signed_certificate))) == false) {
                // Send error message
                v_response := m_http_response(m_http_response_ko_no_body(p_headers, 400, "Bad request")); // Initialize v_reponse with an error message
                // Set verdict
                p_result := -2;
              } else {
                // TODO Add checked ???
              }
            }

            log("<<< f_verify_http_butterfly_cert_request_message_to_ea: p_result: ", p_result);
          } // End of function f_verify_http_butterfly_cert_request_message_to_ea

      } // End of group bfk_cert_request_helpers

      /**
       * @desc Check that the AA sends the butterfly certificate response message after receiving of the butterfly certificate request
       *       Check that this message is encrypted using the same symmetric encryption key as the butterfly certificate request message
       * <pre>
       * Pics Selection: PICS_IUT_AA_ROLE
       * Initial conditions: 
       *     with {
       *         the EA in "operational" state
       *             authorized with CERT_AA certificate
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *            the IUT received the ButterflyCertificateRequestMessage
       *              containing content.encryptedData.recipients
       *                containing the instance of RecipientInfo
       *                  containing certRecipInfo
       *                    containing recipientId
       *                      indicating HashedId8 of the CERT_AA
       *                    and containing encKey
       *                      containing encrypted symmetric encryption key (ENC_KEY)
       *         }
       *         then {
       *           the IUT sends to the EA a EtsiTs103097Data-Encrypted
       *             containing content.encryptedData.recipients
       *               indicating size 1
       *             and containing the instance of RecipientInfo
       *               containing pskRecipInfo
       *                 indicating HashedId8 of the ENC_KEY
       *         }
       *     }
       * </pre>
       *
Yann Garcia's avatar
Validate TC_SECPKI_EA_BFK_AUTH_01_BV  
Yann Garcia committed
16808 
       * @see       ETSI TS 103 525-2 v2.0.1 SECPKI_AA_AUTHVAL_01_BV
Yann Garcia's avatar
Add support of BFK as defined in P1609.2.1/D7, January 2022 Clause 9.3.4.1.1 General  
Yann Garcia committed
16809 16810 16811 16812 16813 16814 16815 16816 16817 16818 16819 16820 16821 16822 16823 16824 16825 16826 16827 16828 16829 16830 16831 16832 16833 16834 16835 16836 16837 16838 16839 16840 16841 16842 16843 16844 16845 
       * @reference ETSI TS 102 941, clause 6.2.3.3.2
       */
      testcase TC_SECPKI_AA_BFK_AUTH_01_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
          // Local variables
          var HashedId8 v_aes_sym_key_hashed_id8;
          var Headers v_headers;
          var HttpMessage v_request;
          var integer v_result;
          var RaAcaCertRequest v_ra_aca_cert_request;
          var AcaRaCertResponse v_aca_ra_cert_response;

          // Test control
          if (not PICS_IUT_AA_ROLE) {
            log("*** " & testcasename() & ": PICS_IUT_AA_ROLE required for executing the TC ***");
            setverdict(inconc);
            stop;
          }

          // Test component configuration
          f_cfHttpUp(PICS_TS_EA_CERTIFICATE_ID, PICS_TS_AA_CERTIFICATE_ID);

          // Test adapter configuration

          // Preamble
          f_trigger_butterfly_cert_request(v_aes_sym_key_hashed_id8, v_ra_aca_cert_request);
          f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);

          // Test Body
          tc_ac.start;
          alt {
            [] httpAtVPort.receive(
                                   mw_http_request(
                                                   mw_http_request_post(
                                                                        -, // URI
                                                                        v_headers, // Headers
                                                                        mw_http_message_body_binary(
                                                                                                    mw_binary_body_ieee1609dot2_data(
Yann Garcia's avatar
Validate TC_SECPKI_EA_BFK_AUTH_01_BV  
Yann Garcia committed
16846 16847 
                                                                                                                                     mw_butterflyCertResponseMessage(
                                                                                                                                                                     mw_encryptedData
Yann Garcia's avatar
Add support of BFK as defined in P1609.2.1/D7, January 2022 Clause 9.3.4.1.1 General  
Yann Garcia committed
16848 16849 16850 16851 16852 16853 16854 16855 16856 16857 16858 16859 16860 16861 16862 16863 16864 16865 16866 16867 16868 16869 16870 16871 
                                  )))))) -> value v_request {
              tc_ac.stop;

              f_verify_http_butterfly_cert_request_message_to_ea(v_request.request, v_headers, v_result, v_aca_ra_cert_response);
              // Set verdict
              if (v_result == 0) {
                log("*** " & testcasename() & ": PASS: ButterflyCertResponsetMessage received ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Failed to verify ButterflyCertResponsetMessage ***");
                f_selfOrClientSyncAndVerdict(c_tbDone, e_error);
              }
            }
            [] tc_ac.timeout {
              log("*** " & testcasename() & ": INCONC: Expected message not received ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_timeout);
            }
          } // End of 'alt' statement

          // Postamble
          f_cfHttpDown();

        } // End of testcase TC_SECPKI_AA_BFK_AUTH_01_BV
Yann Garcia's avatar
Add clause references for EA/AA/CA/TLM/CPOC parts  
Yann Garcia committed
16872 
    } // End of group aa_authorization_with_bfk
Yann Garcia's avatar
Add support of BFK as defined in P1609.2.1/D7, January 2022 Clause 9.3.4.1.1 General  
Yann Garcia committed
16873
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16874 16875 
  } // End of group aa_beavior
Yann Garcia's avatar
Implement TPs SECPKI_AA_AUTH_01..04_BV  
Yann Garcia committed
16876 
  // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.6  RootCA behaviour
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16877 16878 
  group ca_behavior {
Yann Garcia's avatar
Implement TPs SECPKI_AA_AUTH_01..04_BV  
Yann Garcia committed
16879 
    // ETSI TS 103 525-2 V2.0.2 (2023-07) Clause 5.6.1  CTL generation
Yann Garcia's avatar
Add clause references for EA/AA/CA/TLM/CPOC parts  
Yann Garcia committed
16880 
    group ca_ctl_generation {
Yann Garcia's avatar
Fisrt implementation of BFK TPs done  
Yann Garcia committed
16881
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16882 16883 16884 16885 16886 16887 16888 16889 16890 16891 16892 16893 16894 16895 16896 16897 16898 16899 16900 16901 16902 16903 16904 16905 16906 16907 16908 16909 16910 16911 16912 16913 
      /**
       * @desc Check that the RootCA generates the Full CTL when new EA is about to be added to the Root CTL
       * <pre>
       * Pics Selection: PICS_IUT_CA_ROLE
       * Initial conditions: 
       *     }
       * Expected behaviour:
       *     ensure that {
       *         when {
       *             the RootCA is triggered to add new EA certificate (CERT_EA) in the CTL
       *         }
       *         then {
       *             the IUT issue a new CTL of type CtlFormat
       *                 containing isFullCtl
       *                     indicating TRUE
       *                 and containing ctlCommands
       *                     containing CtlCommand
       *                         containing add
       *                             containing ea
       *                                 containing eaCertificate
       *                                     indicating CERT_EA
       *         }
       *     }
       * </pre>
       * 
       * @see       ETSI TS 103 525-2 TP RCA_CTLGEN_01_BV
       * @reference ETSI TS 102 941, clause 6.3.2 and 6.3.4
       */
      testcase TC_RCA_CTLGEN_01_BV() runs on ItsPkiHttp system ItsPkiHttpSystem {
        // Local variables
        var Headers v_headers;
        var HttpMessage v_response;
Yann Garcia's avatar
Fisrt implementation of BFK TPs done  
Yann Garcia committed
16914
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16915 16916 16917 16918 16919 16920 
        // Test control
        if (not PICS_IUT_CA_ROLE) {
          log("*** " & testcasename() & ": PICS_IUT_CA_ROLE required for executing the TC ***");
          setverdict(inconc);
          stop;
        }
Yann Garcia's avatar
Fisrt implementation of BFK TPs done  
Yann Garcia committed
16921
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16922 16923 
        // Test component configuration
        f_cfHttpUp_ca();
Yann Garcia's avatar
Fisrt implementation of BFK TPs done  
Yann Garcia committed
16924
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16925 
        // Test adapter configuration
Yann Garcia's avatar
Fisrt implementation of BFK TPs done  
Yann Garcia committed
16926
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16927 16928 16929 16930 
        // Preamble
        f_init_default_headers_list(PICS_HEADER_CTL_CONTENT_TYPE, "ca_request", v_headers);
        action("The RootCA is triggered to add new EA certificate (CERT_EA) in the CTL");
        f_selfOrClientSyncAndVerdictPreamble(c_prDone, e_success);
Yann Garcia's avatar
Fisrt implementation of BFK TPs done  
Yann Garcia committed
16931
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16932 16933 16934 16935 16936 16937 16938 16939 16940 16941 16942 16943 16944 16945 16946 16947 16948 16949 16950 16951 16952 
        // Test Body
        f_http_send(
                    v_headers,
                    m_http_request(
                                   m_http_request_get(
                                                      PICS_HTTP_GET_URI_CTL,
                                                      v_headers
                                                      )));
        tc_ac.start;
        alt {
          [not(PICS_MULTIPLE_END_POINT)] httpPort.receive(
                                                          mw_http_response(
                                                                           mw_http_response_ok(
                                                                                               mw_http_message_body_binary(
                                                                                                                           mw_binary_body_ieee1609dot2_data(
                                                                                                                                                            mw_etsiTs103097Data_signed(
                                                                                                                                                                                       mw_signedData(
                                                                                                                                                                                                     -,
                                                                                                                                                                                                     mw_toBeSignedData(
                                                                                                                                                                                                                       mw_signedDataPayload
                                                                                                                                                                                                                       ),
YannGarcia's avatar
CV2X#3 Validation against PKIs  
YannGarcia committed
16953 
                                                                                                                                                                                                     ?
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16954 
                                                                                                                                                                                                     ))))))) -> value v_response {
YannGarcia's avatar
CV2X#3 Validation against PKIs  
YannGarcia committed
16955 
            var charstring_list v_etag;
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16956 16957 16958 16959 
            var ToBeSignedRcaCtl v_to_be_signed_rca_ctl;

            tc_ac.stop;
YannGarcia's avatar
CV2X#3 Validation against PKIs  
YannGarcia committed
16960 16961 
            // Check ETag header
            if (f_check_headers(v_response.response.header, c_etag_http_header) == false) {
YannGarcia's avatar
CV2X#3 Validation against PKIs (Remote)  
YannGarcia committed
16962 16963 
              log("*** " & testcasename() & ": INFO: 'ETag' HTTP header not set ***");
              //f_selfOrClientSyncAndVerdict(c_tbDone, e_timeout);
YannGarcia's avatar
CV2X#3 Validation against PKIs  
YannGarcia committed
16964 16965 16966 16967 16968 
            } else {
              f_get_header(v_response.response.header, c_etag_http_header, v_etag);
              log("*** " & testcasename() & ": INFO: ETag= ", v_etag[0]);
            }
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16969 16970 16971 16972 16973 16974 16975 16976 16977 16978 16979 16980 16981 16982 16983 16984 16985 16986 16987 16988 16989 16990 16991 16992 
            if (f_verify_rca_ctl_response_message(v_response.response.body.binary_body.ieee1609dot2_data, true, v_to_be_signed_rca_ctl) == false) {
              log("*** " & testcasename() & ": FAIL: Failed to verify RCA message ***");
              f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
            } else {
              if (f_verify_full_ctl(v_to_be_signed_rca_ctl) == true) {
                log("*** " & testcasename() & ": PASS: ToBeSignedRcaCtl received ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_success);
              } else {
                log("*** " & testcasename() & ": FAIL: Receive unexpected message ***");
                f_selfOrClientSyncAndVerdictTestBody(c_tbDone, e_error);
              }
            }
          }
          [PICS_MULTIPLE_END_POINT] httpCaPort.receive(
                                                       mw_http_response(
                                                                        mw_http_response_ok(
                                                                                            mw_http_message_body_binary(
                                                                                                                        mw_binary_body_ieee1609dot2_data(
                                                                                                                                                         mw_etsiTs103097Data_signed(
                                                                                                                                                                                    mw_signedData(
                                                                                                                                                                                                  -,
                                                                                                                                                                                                  mw_toBeSignedData(
                                                                                                                                                                                                                    mw_signedDataPayload
                                                                                                                                                                                                                    ),
YannGarcia's avatar
Start validation of AtsPki; Add missing AcSecurity primitive implementation in Facilities  
YannGarcia committed
16993 
                                                                                                                                                                                                  ?
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16994 
                                                                                                                                                                                                  ))))))) -> value v_response {
YannGarcia's avatar
CV2X#3 Validation against PKIs  
YannGarcia committed
16995 
            var charstring_list v_etag;
ASN.1 Documenter's avatar
Initial
ASN.1 Documenter committed
16996 16997 16998 16999 
            var ToBeSignedRcaCtl v_to_be_signed_rca_ctl;

            tc_ac.stop;
YannGarcia's avatar
CV2X#3 Validation against PKIs  
YannGarcia committed
17000 
            // Check ETag header
Show full blame