1038087 - [dolphin][flame] FFOS cannot receive the OTA message when userPIN is empty.

Status: RESOLVED WONTFIX

(Firefox OS Graveyard :: Gaia::Wappush, defect)

Description

[Peipei Cheng (needinfo if you need my action)]

Attachment: slog_20140710164435_scx15_sp7715ga_userdebug.zip

Partner is using "NOW SMS" to simulate the case that Operators send OTA msgs to users. The purpose is to check if APN can be configured successfully. 
userPIN is used to encrypt the OTA message. When user receives the OTA message, they need to input the user PIN to use this configuration.

The problem partner experienced is:
--> FFOS cannot receive the OTA message when userPIN is empty. 

Both dolphin and Flame has this problem. But on android device, the ota message can be received when userpin is empty.

Attached is the slog.

Comment 1

[Rachelle Yang [:ryang][[e-mail]]]

Hi Shawn,could you please kindly help with this ? Thanks !

Comment 2

[Chuck Lee [:chucklee, Triggered by NI, Review, and Feedback requests]]

If WAP Push message doesn't contain any authentication info, it will be dropped by wap push app[1] for security.
Maybe this is the cause.

[1] http://git.mozilla.org/?p=releases/gaia.git;a=blob;f=apps/wappush/js/parsed_message.js;h=cce6c59d9406b6e92ad7d66415614dfe68b82d73;hb=HEAD#l193

Comment 3

[shawn ku [:sku]]

Clear ni? due to comment 2 by Chuck.

Hi Rachelle:
 It looks like OMA define auth as a must attribute. Please double confirm with partner if this is really an issue?

Comment 4

[Rachelle Yang [:ryang][[e-mail]]]

Hi Shawn,thank you very much. I will further check with partner.Thanks!

Comment 5

[Peipei Cheng (needinfo if you need my action)]

Just FYI. The reason partner why think this is an issue is because android device can receive such messages while ffos cannot.

Comment 6

[Peipei Cheng (needinfo if you need my action)]

Is it possible to not block this type of message but pop up a warning to users and let user choose to "Accept" or "Reject" it?

Because there might be some case that user needs such OTA message(although I cannot name for now), and the current design will block all OTA msg without authentication.

Comment 7

[shawn ku [:sku]]

Attachment: OMA-WAP-ProvBoot-v1_1-20050428-C.pdf

Comment 8

[shawn ku [:sku]]

(In reply to pcheng from comment #6)
> Is it possible to not block this type of message but pop up a warning to
> users and let user choose to "Accept" or "Reject" it?
> 
> Because there might be some case that user needs such OTA message(although I
> cannot name for now), and the current design will block all OTA msg without
> authentication.

I am not sure if I understand the whole flow/spec. correctly.
However, OMA CP define one of NETWPIN/USERPIN/USERNETWPIN/USERPINMAC is mandatory.
If auth. is a necessary attribute, I am afraid we cannot simply ignore auth. check. (see also [1])


If there is anything wrong, please kindly correct me.


[1] http://dl-developer.sonymobile.com/documentation/DW-100361-dg_device_mgmnt(v5-6)_r14a.pdf

Comment 9

[siiaceon]

(In reply to shawn ku [:sku] (OOO 7/17 ~ 7/31) from comment #8)
For the Statistics Data from our test department For Global area：
1.Need Pin Area: Urop, Europe / America / Southeast Asia / Brazil and so on
2.No Need Pin Area：Middle East / in / Honduras and so on
Means many country no need pin, so this designe will make them lose the function. However as I know , in these areas , such as Wap Push, USSD are very useful. 

And our tester research the SPEC, found that the security check is optional，it says：
"The security information consists of the message authentication code and the
security method. The parameters MAC and SEC have been defined for this purpose and these MUST be supported by the WAP client
The parameter specifies the security mechanism used (if it is not present, no security is used)."

So what is the opinion please? Or waiting for the other customers feedback in future?

Comment 10

[Peipei Cheng (needinfo if you need my action)]

As I know, the target market for dolphin is Bangladesh. So maybe this should not be a problem for this release?

Comment 11

[Wayne Chang [:wchang]]

siiaceon,

When a PIN input by user is not desired, you should not be sending type USERPIN with empty PIN. NetwPIN or UserNetwPIN should be used instead.

Can you provide the reference to the SPEC you are referring to?

Comment 12

[Chuck Lee [:chucklee, Triggered by NI, Review, and Feedback requests]]

The description of Comment 9 comes from Provisioning Content spec[1], clause 4.3. It's like a base definition of WAP Push message.
I think our wap push app implements Provisioning Bootstrap, as the attachment, where authentication info becomes a must according to clause 5.2.

[1] http://technical.openmobilealliance.org/Technical/release_program/docs/ClientProv/V1_1-20090728-A/OMA-WAP-TS-ProvCont-V1_1-20090728-A.pdf

Comment 13

[Peipei Cheng (needinfo if you need my action)]

The test case for this bug is: SEC authentication type is USERPIN, but user pin value is empty.

Reading through the spec and bootstrap, I didn't see any limitation on the user pin value. So maybe it could be empty?

Comment 14

[Peipei Cheng (needinfo if you need my action)]

The only limitation I saw is as following, but the limit is related to MAC calculation.

When presented to the user as well as when used as input to the MAC calculation, the user PIN MUST be a string of ASCII
encoded decimal digits (i.e. octets with hexadecimal values 30 to 39).

Comment 15

[Chuck Lee [:chucklee, Triggered by NI, Review, and Feedback requests]]

I don't know if you select USERPIN but doesn't provide PIN code in nowSMS, it will send message containing auth info of USERPIN and MAC, or ignore the USERPIN settings and send message with no auth info.

Based on the code, if we received a message of USERPIN, gaia would pop out a dialog ask for PIN code, because it doesn't know if the PIN code is empty. But the reported behavior says "cannot receive the OTA message", which means no dialog box is shown.
So I think it's more likely that the incoming message doesn't have authentication info at all.

We have a small test app, "Test Wap Push", in engineer build, that will show info of received WAP Push message[1].
If we all agree that incoming OTA message must contains authentication information, I suggest to check if the information do exist in the message sent from nowSMS.

[1] http://git.mozilla.org/?p=releases/gaia.git;a=tree;f=dev_apps/test-wappush;h=322230ba86fa88e01ec67d7e761c226198b66c97;hb=HEAD

Comment 16

[Peipei Cheng (needinfo if you need my action)]

siiaceon, could you please help check on comment 15? We don't have SMS NOW test environment. Please help.

Comment 17

[Peipei Cheng (needinfo if you need my action)]

According to jinghua's test, there is no authentication info in the message. Jinghua, could you please comment?

Comment 18

[jinghua.xing]

In the test case, we didn't have checked any security type, and it shows there is no authentication info in the message by using the test app. 

How do we check if there is no userPIN in the case or the userPIN is null?

Comment 19

[Chuck Lee [:chucklee, Triggered by NI, Review, and Feedback requests]]

Attachment: Screenshot of WAP Push Test app after receiving message with USERPIN

If you receive WAP Push with USERPIN authentication, the app will show "USERPIN" in the "Auth - Security Type" field.
So if it's empty, there's no authentication info in WAP Push info.

Note that I found a bug in WAP Push Test app that, if it receives a message with auth info first, then a message without message.
The second message won't clear the Auth Info field.

Comment 20

[jinghua.xing]

Attachment: Screenshot of WAP Push Test app after receiving message without USERPIN

(In reply to Chuck Lee [:chucklee] from comment #19)
The "Auth - Security Type" field is empty when we receive the message without userPIN.

Comment 21

[Ivan Tsay (:ITsay)]

This is behavior by design. Remove nomination for now. This would be the feature request if we need it.

Comment 22

[Hsin-Yi Tsai (she/her) [:hsinyi]]

The check of "authInfo" is on gaia side, thus changing the component to Gaia:Wappush.

Comment 23

[BMO Automation]

Firefox OS is not being worked on