R2.5.1

Author: Gematik-Entwicklung

ReleaseNotes.md

@@ -3,9 +3,13 @@
 # Release Notes popp-sample-code
 
 ### Known Issues
-- If your eGK has an older CVCA you may get problems while testing with the RÍSE PoPP-Service
 - Standard-Kartenleser with Docker is not supported
 
+## Release 2.5.1
+
+### fixed
+- contact(less)-virtual now uses correct SubCA CVC from card image used
+
 ## Release 2.5.0
 
 ### added

pom.xml

@@ -7,7 +7,7 @@
   </parent>
   <groupId>de.gematik.refpopp</groupId>
   <artifactId>popp-example-impl-global</artifactId>
-  <version>2.5.0</version>
+  <version>2.5.1</version>
   <packaging>pom</packaging>
   <name>popp-sample-code</name>
   <description>PoPP - example implementation</description>
@@ -65,7 +65,7 @@
     <version.maven-clean-plugin>3.5.0</version.maven-clean-plugin>
     <version.maven-compiler-plugin>3.15.0</version.maven-compiler-plugin>
     <version.maven-enforcer-plugin>3.6.3</version.maven-enforcer-plugin>
-    <version.maven-failsafe-plugin>3.5.5</version.maven-failsafe-plugin>
+    <version.maven-failsafe-plugin>3.5.6</version.maven-failsafe-plugin>
     <version.maven-gpg-plugin>3.2.8</version.maven-gpg-plugin>
     <version.maven-javadoc-plugin>3.12.0</version.maven-javadoc-plugin>
     <version.maven-project-info-reports-plugin>3.9.0</version.maven-project-info-reports-plugin>
@@ -74,11 +74,11 @@
     <version.maven-site-plugin>3.22.0</version.maven-site-plugin>
     <!-- settings for upload to sonar server -->
     <version.maven-source-plugin>3.4.0</version.maven-source-plugin>
-    <version.maven-surefire-plugin>3.5.5</version.maven-surefire-plugin>
+    <version.maven-surefire-plugin>3.5.6</version.maven-surefire-plugin>
     <version.central-publishing-maven-plugin>0.10.0</version.central-publishing-maven-plugin>
     <version.openhealth.healthcard>0.4.0-alpha1</version.openhealth.healthcard>
-    <version.sonar-maven-plugin>5.6.0.6792</version.sonar-maven-plugin>
-    <version.spotless-maven-plugin>3.5.1</version.spotless-maven-plugin>
+    <version.sonar-maven-plugin>5.7.0.6970</version.sonar-maven-plugin>
+    <version.spotless-maven-plugin>3.6.0</version.spotless-maven-plugin>
     <version.spotless.google-java-format>1.27.0</version.spotless.google-java-format>
     <version.spring-boot-maven-plugin>3.3.2</version.spring-boot-maven-plugin>
     <version.zeta-sdk-jvm>1.0.1</version.zeta-sdk-jvm>

popp-client/pom.xml

@@ -7,7 +7,7 @@
   <parent>
     <groupId>de.gematik.refpopp</groupId>
     <artifactId>popp-example-impl-global</artifactId>
-    <version>2.5.0</version>
+    <version>2.5.1</version>
     <relativePath>../pom.xml</relativePath>
   </parent>
 
@@ -152,7 +152,7 @@
     <dependency>
       <groupId>com.nimbusds</groupId>
       <artifactId>nimbus-jose-jwt</artifactId>
-      <version>10.9</version>
+      <version>10.9.1</version>
     </dependency>
   </dependencies>
 
@@ -222,7 +222,7 @@
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-dependency-plugin</artifactId>
-        <version>3.10.0</version>
+        <version>3.11.0</version>
         <executions>
           <execution>
             <id>unpack-openhealth-linux-natives</id>

popp-client/src/main/java/de/gematik/refpopp/popp_client/PoppClientApplication.java

@@ -20,12 +20,25 @@
 
 package de.gematik.refpopp.popp_client;
 
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.context.event.ApplicationReadyEvent;
+import org.springframework.context.event.EventListener;
 
+@Slf4j
 @SpringBootApplication(scanBasePackages = "de.gematik.refpopp.popp_client")
 public class PoppClientApplication {
 
+  @Value("${popp-server.url}")
+  private String poppServerUrl;
+
+  @EventListener(ApplicationReadyEvent.class)
+  public void onApplicationReady() {
+    log.info("### PoPP Service: {}", poppServerUrl);
+  }
+
   public static void main(final String[] args) {
     SpringApplication.run(PoppClientApplication.class, args);
   }

popp-client/src/main/java/de/gematik/refpopp/popp_client/cardreader/card/VirtualCardService.java

@@ -91,10 +91,6 @@ public class VirtualCardService {
 
   public static final String APDU_RESPONSE_OK = "9000";
 
-  public static final String APDU_RESPONSE_READ_VERSION =
-      "ef2bc003020000c103040502c210444549444d4548435f39303030030005c403010000c503020000c703010000";
-  public static final String APDU_RESPONSE_READ_SUB_CA_CV_CERTIFICATE =
-      "7f2181d87f4e81915f290170420844454758588702227f494d06082a8648ce3d04030286410428405a0ccc5c53b6780356a5141eb47fed5f56be44bc22f2046fc053fedbc25e50e24a6d6af95c1cfee9497acce359a253f7d0b7abaea5d1a62de030145f0c975f200844454758581102237f4c1306082a8214004c0481185307800000000000005f25060203000703015f24060301000703005f37404cd260c0803b125a001ba81ba9f2e2b1390de4f14691c822a28cc776a186d7ba7f08704c27fdcdaeb1f8b243a37976cf37bf7c121858d0f0419de83217a395de";
   public static final String APDU_RESPONSE_RETRIEVE_PUBLIC_KEY_IDENTIFIERS =
       "e0154f07d2760001448000b60a83084445475858870222e0154f07d2760001448000b60a83084445475858120223e0194f07d2760001448000a40e830c000a80276001011699902101e0194f07d2760001448000a40e830c4d6f7270686f414343455353e0164f07d2760001448000b60b83094d6f7270686f564552e0154f07d2760001448000b60a83084445475858860220e0154f07d2760001448000b60a83080000000000000013";
   private static final String APDU_SELECT_MASTER_FILE =
@@ -152,6 +148,8 @@ public class VirtualCardService {
   private String apduReadEndEntityCvCertificate;
   private String apduMutualAuthenticationStep1;
   private String apduReadEfCChAutE256;
+  private String subCaCvCertificate;
+  private String version2;
 
   private static final byte[] EMPTY_BYTES = new byte[0];
 
@@ -188,9 +186,8 @@ public VirtualCardService(
     this.apduReadEfCChAutE256 = normalize(apduReadEfCChAutE256);
 
     registerStaticApduResponse(apduSelectMasterFile, "");
-    registerStaticApduResponse(apduReadVersion, APDU_RESPONSE_READ_VERSION);
-    registerStaticApduResponse(
-        apduReadSubCaCvCertificate, APDU_RESPONSE_READ_SUB_CA_CV_CERTIFICATE);
+    registerStaticApduResponse(apduReadVersion, version2);
+    registerStaticApduResponse(apduReadSubCaCvCertificate, subCaCvCertificate);
     registerStaticApduResponse(
         apduRetrievePublicKeyIdentifiers, APDU_RESPONSE_RETRIEVE_PUBLIC_KEY_IDENTIFIERS);
     registerStaticApduResponse(apduSelectPrivateKey, "");
@@ -214,6 +211,10 @@ public void loadCardImage(String imageFile) {
       log.info("| CV certificate: " + cvCertificate);
       authCertificate = getCertificateData(xmlString, "EF.C.CH.AUT.E256");
       log.info("| X.509 certificate: " + authCertificate);
+      subCaCvCertificate = getCertificateData(xmlString, "EF.C.CA_eGK.CS.E256");
+      log.info("| Sub-CA CV certificate:  " + subCaCvCertificate);
+      version2 = getCertificateData(xmlString, "EF.Version2");
+      log.info("| EF.Version2:  " + version2);
       egkAuthCvcPrivateKey = loadEgkAuthCvcPrivateKey(xmlString);
     } catch (IOException | SAXException | ParserConfigurationException e) {
       throw new RuntimeException("Error when loading XML card image file", e);
@@ -310,10 +311,10 @@ private String resolveStaticResponse(final String normalizedCommandApdu) {
       return "";
     }
     if (normalizedCommandApdu.equals(APDU_READ_VERSION)) {
-      return APDU_RESPONSE_READ_VERSION;
+      return version2;
     }
     if (normalizedCommandApdu.equals(APDU_READ_SUB_CA_CV_CERTIFICATE)) {
-      return APDU_RESPONSE_READ_SUB_CA_CV_CERTIFICATE;
+      return subCaCvCertificate;
     }
     if (normalizedCommandApdu.equals(APDU_RETRIEVE_PUBLIC_KEY_IDENTIFIERS)) {
       return APDU_RESPONSE_RETRIEVE_PUBLIC_KEY_IDENTIFIERS;

popp-client/src/main/java/de/gematik/refpopp/popp_client/client/ClientServerCommunicationService.java

@@ -53,9 +53,9 @@ public void connect() {
       log.info("| Websocket client is closed");
       try {
         secureWebSocketClient.connectBlocking();
-      } catch (final Exception e) {
+      } catch (final RuntimeException e) {
         log.error("Error connecting to WebSocket server: {}", e.getMessage(), e);
-        Thread.currentThread().interrupt();
+        throw e;
       }
     }
 

popp-client/src/main/java/de/gematik/refpopp/popp_client/client/SecureWebSocketClient.java

@@ -79,6 +79,7 @@ public class SecureWebSocketClient {
   private final ExecutorService pool;
   private final CountDownLatch sessionReady = new CountDownLatch(1);
   private final AtomicReference<WsClientExtension.WsSession> session = new AtomicReference<>();
+  private final AtomicReference<Throwable> connectError = new AtomicReference<>();
   private final Map<String, Object> sessionMetadata;
   private final WsClientWrapper wsClientWrapper;
 
@@ -207,7 +208,8 @@ public boolean isOpen() {
 
   public void connectBlocking() {
     pool.submit(
-        () ->
+        () -> {
+          try {
             wsClientWrapper.ws(
                 zetaSdk,
                 this.serverUri.toString(),
@@ -234,12 +236,23 @@ public void connectBlocking() {
                       log.debug("WebSocket received binary (bytes): {}", bin.getBytes().length);
                     }
                   }
-                }));
+                });
+          } catch (final Throwable t) {
+            connectError.set(t);
+            log.error("WebSocket connect failed: {}", t.getMessage(), t);
+            sessionReady.countDown();
+          }
+        });
 
     try {
-      if (!sessionReady.await(10, TimeUnit.SECONDS)) {
+      if (!sessionReady.await(150, TimeUnit.SECONDS)) {
         throw new RuntimeException("Connection timeout");
       }
+      final Throwable cause = connectError.get();
+      if (cause != null) {
+        throw new RuntimeException(
+            "Failed to establish WebSocket connection: " + cause.getMessage(), cause);
+      }
     } catch (InterruptedException e) {
       Thread.currentThread().interrupt();
       throw new IllegalStateException(

popp-client/src/main/resources/application-dev-local.yaml

@@ -17,7 +17,7 @@ connector:
       clientSystemId: ${CONTEXT_CLIENT_SYSTEM_ID:C1}
       workplaceId: ${CONTEXT_WORKPLACE_ID:W1}
       mandantId: ${CONTEXT_MANDANT_ID:M1}
-    ct-id: "" # Identifikation des Kartenterminals
+    ct-id: ${CARD_TERMINAL_ID:ktId} # Identifikation des Kartenterminals
 
 zeta:
   client:

popp-client/src/test/java/de/gematik/refpopp/popp_client/cardreader/card/VirtualCardServiceTest.java

@@ -55,6 +55,10 @@ class VirtualCardServiceTest {
   private static final String GENERAL_AUTHENTICATE_STEP_2 =
       "00 86 0000    45"
           + " 7c43854104987fce93bfc191e4db006b56f8fd5f749d256fc5842f0f3f31becf613ce146f66318f77ff7ee51c10b6b6a0f349896400c7601bfc07608ff08fe0ce1d921ca42";
+  private static final String APDU_RESPONSE_READ_VERSION =
+      "ef2bc003020000c103040502c21045474b5f47322e312020202020040502c403010000c503020000c703010000";
+  private static final String APDU_RESPONSE_READ_SUB_CA_CV_CERTIFICATE =
+      "7F2181D87F4E81915F290170420844454758588702227F494D06082A8648CE3D04030286410428405A0CCC5C53B6780356A5141EB47FED5F56BE44BC22F2046FC053FEDBC25E50E24A6D6AF95C1CFEE9497ACCE359A253F7D0B7ABAEA5D1A62DE030145F0C975F200844454758581102237F4C1306082A8214004C0481185307800000000000005F25060203000703015F24060301000703005F37404CD260C0803B125A001BA81BA9F2E2B1390DE4F14691C822A28CC776A186D7BA7F08704C27FDCDAEB1F8B243A37976CF37BF7C121858D0F0419DE83217A395DE";
 
   private VirtualCardService virtualCardService;
 
@@ -181,17 +185,15 @@ void processReturnsStaticAndDynamicResponsesAndReportsConfiguredState() {
         .endsWith(VirtualCardService.APDU_RESPONSE_OK);
     Assertions.assertThat(responses.get(2))
         .isEqualTo("AUTH_CERT" + VirtualCardService.APDU_RESPONSE_OK);
-    Assertions.assertThat(responses.get(3))
-        .isEqualTo(
-            VirtualCardService.APDU_RESPONSE_READ_VERSION + VirtualCardService.APDU_RESPONSE_OK);
     Assertions.assertThat(responses.get(4)).isEqualTo(VirtualCardService.APDU_RESPONSE_OK);
   }
 
   @Test
   void processSupportsOpenHealthDefaultsWithoutConfiguredCommandApdus() {
     final var eventPublisher = mock(ApplicationEventPublisher.class);
     final var service =
-        new VirtualCardService(eventPublisher, "", "", "", "", "", "", "", "", "", "", "");
+        new VirtualCardService(
+            eventPublisher, "IMG_eGK_G21_TU_root6 1.xml", "", "", "", "", "", "", "", "", "", "");
     service.setCvCertificate("CV_CERT");
     service.setAuthCertificate("AUTH_CERT");
 
@@ -211,12 +213,9 @@ void processSupportsOpenHealthDefaultsWithoutConfiguredCommandApdus() {
 
     Assertions.assertThat(responses.get(0)).isEqualTo(VirtualCardService.APDU_RESPONSE_OK);
     Assertions.assertThat(responses.get(1))
-        .isEqualTo(
-            VirtualCardService.APDU_RESPONSE_READ_VERSION + VirtualCardService.APDU_RESPONSE_OK);
+        .isEqualTo(APDU_RESPONSE_READ_VERSION + VirtualCardService.APDU_RESPONSE_OK);
     Assertions.assertThat(responses.get(2))
-        .isEqualTo(
-            VirtualCardService.APDU_RESPONSE_READ_SUB_CA_CV_CERTIFICATE
-                + VirtualCardService.APDU_RESPONSE_OK);
+        .isEqualTo(APDU_RESPONSE_READ_SUB_CA_CV_CERTIFICATE + VirtualCardService.APDU_RESPONSE_OK);
     Assertions.assertThat(responses.get(3))
         .isEqualTo(
             VirtualCardService.APDU_RESPONSE_RETRIEVE_PUBLIC_KEY_IDENTIFIERS

popp-client/src/test/java/de/gematik/refpopp/popp_client/client/SecureWebSocketClientTest.java

@@ -234,6 +234,21 @@ void testConnectBlockingTimeout() throws Exception {
     assertThat(ex).hasMessage("Connection timeout");
   }
 
+  @Test
+  void connectBlockingRethrowsConnectErrorFromWorkerThread() {
+    // given
+    final var connectionException = new RuntimeException("Service discovery failed");
+    doThrow(connectionException)
+        .when(wsClientWrapperMock)
+        .ws(any(), anyString(), any(), anyMap(), any());
+
+    // when / then
+    assertThatThrownBy(() -> sut.connectBlocking())
+        .isInstanceOf(RuntimeException.class)
+        .hasMessage("Failed to establish WebSocket connection: Service discovery failed")
+        .hasCause(connectionException);
+  }
+
   @Test
   void testConnectBlockingInterrupted() throws Exception {
     // given