Skip to content
GitLab
Commits (8)
Hide whitespace changes
Inline Side-by-side
ttcn/IVIM/LibItsIvim_Functions.ttcn
View file @ 3c0c0de3
......@@ -36,22 +36,6 @@ module LibItsIvim_Functions {
import from LibItsIvim_Pics all;
import from LibItsIvim_Pixits all;
group itsFunction {
/**
* @desc Gets the Provifr of test system
* @return Test system's Provider value
* @see PX_PROVIDER
*/
function f_getProvider()
return Provider {
return PX_PROVIDER;
} // End of function f_getProvider
} // End of group itsFunction
group utFuntions {
/**
......
ttcn/IVIM/LibItsIvim_Templates.ttcn
View file @ 3c0c0de3
......@@ -31,7 +31,7 @@ module LibItsIvim_Templates {
// LibItsIvim
import from LibItsIvim_TestSystem all;
import from LibItsIvim_TypesAndValues all;
import from LibItsIvim_Functions all;
import from LibItsIvim_Pixits all;
import from LibItsIvim_ASN1_IVInamedNumbers all;
group asn1Constants {
......@@ -597,4 +597,20 @@ module LibItsIvim_Templates {
} // End of group roadConfigurationContainerGroup
group itsFunction {
/**
* @desc Gets the Provifr of test system
* @return Test system's Provider value
* @see PX_PROVIDER
*/
function f_getProvider()
return Provider {
return PX_PROVIDER;
} // End of function f_getProvider
} // End of group itsFunction
} // End of module LibItsIvimTemplates
ttcn/Pki/LibItsPki_Functions.ttcn
View file @ 3c0c0de3
......@@ -65,17 +65,29 @@ module LibItsPki_Functions {
group pkiConfigurationFunctions {
function f_cfMtcUp(
out ItsPkiItss p_itss,
out ItsPkiHttp p_pki
) runs on ItsMtc {
function f_cfMtcUp01(
out ItsPkiItss p_itss,
out ItsPkiHttp p_pki
) runs on ItsMtc {
p_itss := ItsPkiItss.create("IUT") alive;
p_pki := ItsPkiHttp.create("TS") alive;
connect(self:syncPort, mtc:syncPort);
connect(p_itss:syncPort, self:syncPort);
connect(p_pki:syncPort, self:syncPort);
}
} // End of function f_cfMtcUp01
function f_cfMtcUp02(
out ItsPkiHttp p_itss,
out ItsPkiHttp p_ea
) runs on ServerSyncComp {
p_itss := ItsPkiItss.create("ITS-S") alive;
p_ea := ItsPkiHttp.create("EA") alive;
connect(self:syncPort, mtc:syncPort);
connect(p_itss:syncPort, self:syncPort);
connect(p_ea:syncPort, self:syncPort);
} // End of function f_cfMtcUp02
/**
* @desc Setups default configuration
......@@ -128,6 +140,100 @@ module LibItsPki_Functions {
}
} // End of function f_cfHttpUp
/**
* @desc Setups default configuration
* @param p_certificate_id The certificate identifier the TA shall use in case of secured IUT
*/
function f_cfHttpUp_itss(
in charstring p_ea_certificate_id := "CERT_TS_A_EA", // TODO Use a constant
in charstring p_aa_certificate_id := "CERT_TS_A_AA"
) runs on ItsPkiHttp /* TITAN TODO: system ItsPkiHttpSystem */ {
if (PICS_MULTIPLE_END_POINT == false) {
map(self:httpPort, system:httpPort);
} else {
map(self:httpEcPort, system:httpEcPort);
}
f_initialiseSecuredMode(p_ea_certificate_id, p_aa_certificate_id); // TODO To be removed???
// Setup EA certificate shared with PKI EA entity
f_readCertificate(p_ea_certificate_id, vc_eaCertificate);
f_readSigningKey(p_ea_certificate_id, vc_eaPrivateKey); // TODO To be removed
f_readEncryptingKey(p_ea_certificate_id, vc_eaPrivateEncKey);
f_getCertificateDigest(p_ea_certificate_id, vc_eaHashedId8);
f_getCertificateHash(p_ea_certificate_id, vc_eaWholeHash);
log("f_cfHttpUp_itss: vc_eaPrivateKey= ", vc_eaPrivateKey);
log("f_cfHttpUp_itss: vc_eaPrivateEncKey= ", vc_eaPrivateEncKey);
log("f_cfHttpUp_itss: vc_eaHashedId8= ", vc_eaHashedId8);
log("f_cfHttpUp_itss: vc_eaWholeHash= ", vc_eaWholeHash);
// Setup AA certificate shared with PKI AA entity
f_readCertificate(p_aa_certificate_id, vc_aaCertificate);
f_readSigningKey(p_aa_certificate_id, vc_aaPrivateKey); // Required for AuthorizationValidation request
f_readEncryptingKey(p_aa_certificate_id, vc_aaPrivateEncKey);
f_getCertificateDigest(p_aa_certificate_id, vc_aaHashedId8);
f_getCertificateHash(p_aa_certificate_id, vc_aaWholeHash);
log("f_cfHttpUp_itss: vc_aaPrivateKey= ", vc_aaPrivateKey);
log("f_cfHttpUp_itss: vc_aaPrivateEncKey= ", vc_aaPrivateEncKey);
log("f_cfHttpUp_itss: vc_aaHashedId8= ", vc_aaHashedId8);
log("f_cfHttpUp_itss: vc_aaWholeHash= ", vc_aaWholeHash);
if (PICS_MULTIPLE_END_POINT == false) {
activate(a_default_pki_http());
} else {
activate(a_default_pki_http_ec());
}
} // End of function f_cfHttpUp_itss
/**
* @desc Setups default configuration
* @param p_certificate_id The certificate identifier the TA shall use in case of secured IUT
*/
function f_cfHttpUp_ea(
in charstring p_ea_certificate_id := "CERT_TS_A_EA", // TODO Use a constant
in charstring p_aa_certificate_id := "CERT_TS_A_AA"
) runs on ItsPkiHttp /* TITAN TODO: system ItsPkiHttpSystem */ {
if (PICS_MULTIPLE_END_POINT == false) {
map(self:httpPort, system:httpPort);
} else {
map(self:httpAtVPort, system:httpAtVPort);
map(self:httpAtPort, system:httpAtPort);
}
f_initialiseSecuredMode(p_ea_certificate_id, p_aa_certificate_id); // TODO To be removed???
// Setup EA certificate shared with PKI EA entity
f_readCertificate(p_ea_certificate_id, vc_eaCertificate);
f_readSigningKey(p_ea_certificate_id, vc_eaPrivateKey); // TODO To be removed
f_readEncryptingKey(p_ea_certificate_id, vc_eaPrivateEncKey);
f_getCertificateDigest(p_ea_certificate_id, vc_eaHashedId8);
f_getCertificateHash(p_ea_certificate_id, vc_eaWholeHash);
log("f_cfHttpUp_ea: vc_eaPrivateKey= ", vc_eaPrivateKey);
log("f_cfHttpUp_ea: vc_eaPrivateEncKey= ", vc_eaPrivateEncKey);
log("f_cfHttpUp_ea: vc_eaHashedId8= ", vc_eaHashedId8);
log("f_cfHttpUp_ea: vc_eaWholeHash= ", vc_eaWholeHash);
// Setup AA certificate shared with PKI AA entity
f_readCertificate(p_aa_certificate_id, vc_aaCertificate);
f_readSigningKey(p_aa_certificate_id, vc_aaPrivateKey); // Required for AuthorizationValidation request
f_readEncryptingKey(p_aa_certificate_id, vc_aaPrivateEncKey);
f_getCertificateDigest(p_aa_certificate_id, vc_aaHashedId8);
f_getCertificateHash(p_aa_certificate_id, vc_aaWholeHash);
log("f_cfHttpUp_ea: vc_aaPrivateKey= ", vc_aaPrivateKey);
log("f_cfHttpUp_ea: vc_aaPrivateEncKey= ", vc_aaPrivateEncKey);
log("f_cfHttpUp_ea: vc_aaHashedId8= ", vc_aaHashedId8);
log("f_cfHttpUp_ea: vc_aaWholeHash= ", vc_aaWholeHash);
if (PICS_MULTIPLE_END_POINT == false) {
activate(a_default_pki_http());
} else {
activate(a_default_pki_http_atv());
activate(a_default_pki_http_at());
}
} // End of function f_cfHttpUp_ea
function f_cfUp_itss(
in charstring p_certificate_id := "CERT_TS_A_EA" // TODO Use a constant
) runs on ItsPkiItss /* TITAN TODO: system ItsPkiItssSystem */ {
......@@ -144,10 +250,10 @@ module LibItsPki_Functions {
/**
* @desc Deletes default configuration
*/
function f_cfMtcDown(
inout ItsPkiItss p_itss,
inout ItsPkiHttp p_pki
) runs on ItsMtc {
function f_cfMtcDown01(
inout ItsPkiItss p_itss,
inout ItsPkiHttp p_pki
) runs on ItsMtc {
disconnect(self:syncPort, mtc:syncPort);
disconnect(p_itss:syncPort, self:syncPort);
disconnect(p_pki:syncPort, self:syncPort);
......@@ -156,6 +262,18 @@ module LibItsPki_Functions {
p_pki.done;
}
function f_cfMtcDown02(
inout ItsPkiHttp p_itss,
inout ItsPkiHttp p_ea
) runs on ServerSyncComp {
disconnect(self:syncPort, mtc:syncPort);
disconnect(p_itss:syncPort, self:syncPort);
disconnect(p_ea:syncPort, self:syncPort);
p_itss.done;
p_ea.done;
}
/**
* @desc Deletes default configuration
*/
......@@ -171,6 +289,33 @@ module LibItsPki_Functions {
f_uninitialiseSecuredMode();
} // End of function f_cfHttpDown
/**
* @desc Deletes default configuration
*/
function f_cfHttpDown_itss() runs on ItsPkiHttp /* TITAN TODO: system ItsPkiHttpSystem */ {
if (PICS_MULTIPLE_END_POINT == false) {
unmap(self:httpPort, system:httpPort);
} else {
unmap(self:httpEcPort, system:httpEcPort);
}
f_disconnect4SelfOrClientSync();
f_uninitialiseSecuredMode();
} // End of function f_cfHttpDown_itss
/**
* @desc Deletes default configuration
*/
function f_cfHttpDown_ea() runs on ItsPkiHttp /* TITAN TODO: system ItsPkiHttpSystem */ {
if (PICS_MULTIPLE_END_POINT == false) {
unmap(self:httpPort, system:httpPort);
} else {
unmap(self:httpAtVPort, system:httpAtVPort);
unmap(self:httpAtPort, system:httpAtPort);
}
f_disconnect4SelfOrClientSync();
f_uninitialiseSecuredMode();
} // End of function f_cfHttpDown_ea
/**
* @desc Deletes default configuration
*/
......@@ -3661,9 +3806,13 @@ module LibItsPki_Functions {
log("f_verify_ec_certificate: Signature not verified");
return false;
}
// TODO Check that requested information are present
if (f_verifySspPermissions(p_ec_certificate.toBeSigned.appPermissions, p_ea_certificate.toBeSigned.appPermissions) == false) {
log("f_verify_ec_certificate: Ssp permissions not verified");
return false;
}
return true;
} // End of function f_verify_ec_certificate
......@@ -3703,6 +3852,13 @@ module LibItsPki_Functions {
return false;
}
// TODO Check that requested information are present
if (f_verifySspPermissions(p_aa_certificate.toBeSigned.appPermissions, p_at_certificate.toBeSigned.appPermissions) == false) {
log("f_verify_ec_certificate: Ssp permissions not verified");
return false;
}
return true;
} // End of function f_verify_at_certificate
......
ttcn/Pki/LibItsPki_Pics.ttcn
View file @ 3c0c0de3
......@@ -113,7 +113,7 @@ module LibItsPki_Pics {
/**
* @desc Set to true if the PKI configuration authorize to configure an external EA entity
*/
modulepar boolean PICS_SIMULATE_EA_ENTITY := false;
/**
......
ttcn/Pki/LibItsPki_TestSystem.ttcn
View file @ 3c0c0de3
......@@ -82,7 +82,7 @@ module LibItsPki_TestSystem {
var octetstring vc_aaPrivateEncKey; /** Test Adapter AA private key for encryption */
var HashedId8 vc_aaHashedId8; /** Test Adapter AA HashedId8 for decryption of IUT's response */
var octetstring vc_aaWholeHash; /** Test Adapter AA whole-hash for signature check */
} // End of component ItsPki
} // End of component ItsPkiHttp
/**
* @desc Test component for ITS-S entity
......
ttcn/Security/LibItsSecurity_Functions.ttcn
View file @ 3c0c0de3
......@@ -1993,7 +1993,7 @@ module LibItsSecurity_Functions {
log(">>> f_verifyGnSecuredMessageSignatureWithCertificate: p_certificate=", p_certificate);
if (f_getCertificateHash(valueof(p_certificate_id), v_issuer) == false) {
log("f_verifyCertificateSignatureWithPublicKey: Invalid certificate id: " & p_certificate_id);
log("f_verifyCertificateSignatureWithPublicKey: Invalid certificate id: " & valueof(p_certificate_id));
return false;
}
if (ischosen(p_securedMessage.content.signedData.signature_.ecdsaBrainpoolP256r1Signature)) {
......@@ -2009,6 +2009,66 @@ module LibItsSecurity_Functions {
} // End of group deviceSignatureHelpers
group sspPermissions {
function f_verifySspPermissions(
in SequenceOfPsidSsp p_issuer_ssp_permissions,
in SequenceOfPsidSsp p_subordinate_ssp_permissions
) return boolean {
// Local variables
var integer v_idx := 0;
for (v_idx := 0; v_idx < lengthof(p_issuer_ssp_permissions); v_idx := v_idx + 1) {
var PsidSsp v_issuerPsidSsp := p_issuer_ssp_permissions[v_idx];
var PsidSsp v_subordinatePsidSsp;
var boolean v_found := false;
var integer v_jdx := 0;
// 1. Check permission from issuer is present
for (v_jdx := 0; v_jdx < lengthof(p_subordinate_ssp_permissions); v_jdx := v_jdx + 1) {
if (match(v_issuerPsidSsp, m_appPermissions(p_subordinate_ssp_permissions[v_jdx].psid, p_subordinate_ssp_permissions[v_jdx].ssp)) == true) {
v_subordinatePsidSsp := p_subordinate_ssp_permissions[v_jdx];
v_found := true;
break;
}
} // End of 'for' statement
if (v_found == false) {
log("f_verifySspPermissions: Permission set not found: ", v_issuerPsidSsp)
return false;
}
// 2. Validate bits mask
if (ispresent(v_issuerPsidSsp.ssp)) {
if (ispresent(v_subordinatePsidSsp.ssp) == false) {
log("f_verifySspPermissions: Ssp shall not be omitted: ", v_issuerPsidSsp)
return false;
}
if ((ischosen(v_issuerPsidSsp.ssp.bitmapSsp) == false) or (ischosen(v_subordinatePsidSsp.ssp.bitmapSsp) == false)) {
log("f_verifySspPermissions: Wrong variant : ", v_issuerPsidSsp.ssp, " / ", v_subordinatePsidSsp.ssp);
return false;
}
if (lengthof(v_issuerPsidSsp.ssp.bitmapSsp) < lengthof(v_subordinatePsidSsp.ssp.bitmapSsp)) {
log("f_verifySspPermissions: Ssp not be compliant: ", v_issuerPsidSsp.ssp, " / ", v_subordinatePsidSsp.ssp);
return false;
} else {
var charstring v_issuerSsp := bit2str(oct2bit(v_issuerPsidSsp.ssp.bitmapSsp));
var charstring v_subordinateSsp := bit2str(oct2bit(v_subordinatePsidSsp.ssp.bitmapSsp));
for (var integer i := 0; i < lengthof(v_issuerSsp); i := i + 1) {
if (v_issuerSsp[i] == "1") { // TODO How to check Permission using SspBitmask/SspValue
if (v_subordinateSsp[i] != "1") {
log("f_verifySspPermissions: Ssp bitmask mismatch at index: ", i);
return false;
}
} // else, no restriction, subordinate certificate can have any value.
} // End of 'for' statement
}
}
} // End of 'for' statement
return true;
} // End of function f_verifySspPermissions
} // End of group sspPermissions
group messageGetters {
/**
......