August 2026 - gerrit-log - lists.osmocom.org

[L] Change in osmo-ttcn3-hacks[master]: SGP32Definitions_Templates: rework templates, imrove flexibilty
by dexter 07 Aug '26

07 Aug '26

dexter has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43181?usp=email ) Change subject: SGP32Definitions_Templates: rework templates, imrove flexibilty ...................................................................... SGP32Definitions_Templates: rework templates, imrove flexibilty The templates in their current form where originally developed to generate and match messages for the ASN.1 ESipa interface. This interface uses a top-level envelope structure for sending and receiving messages (EsipaMessageFromIpaToEim and EsipaMessageFromEimToIpa). The JSON ESipa interface is different. Here the top level envelope is a JSON formatted body whith Base64 encoded ASN.1 mebers. Those members have to be encoded and decoded by accessing ASN.1 structures below the top-level envelope structure directly. Unfortunately the current templates do not provide the required flexibility for that. With this patch we rework the templates to be more flexible and open, so that we can integrate JSON ESipa bindings into the eIM testsuite with a follow-up patch. Related: SYS#8100 Change-Id: I69a29b30578b0280006c2655b20c2a4eb62f5e75 --- M eim/eIM_Tests.ttcn M ipad/IPAd_Tests.ttcn M library/euicc/SGP32Definitions_Templates.ttcn 3 files changed, 309 insertions(+), 260 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/81/43181/1 diff --git a/eim/eIM_Tests.ttcn b/eim/eIM_Tests.ttcn index ba3855a..26fe2bf 100644 --- a/eim/eIM_Tests.ttcn +++ b/eim/eIM_Tests.ttcn @@ -490,7 +490,7 @@ /* Check the eIM for new eIM packages, we expect to get a profileDownloadTriggerRequest that contains the * activationCode that we have created the download with (see above) */ esipa_res := f_esipa_transceive(valueof(ts_getEimPackageRequest(eID)), - tr_getEimPackageResponse_dnlTrigReq(activationCode)); + tr_getEimPackageResponse_dnlTrigReq(tr_profileDownloadTriggerRequest(activationCode))); eimTransactionId := valueof(esipa_res.getEimPackageResponse.profileDownloadTriggerRequest.eimTransactionId); /* Perform common mutial authentication procedure */ @@ -502,7 +502,7 @@ f_esipa_receive(tr_getBoundProfilePackageResponseEsipa); /* Handle notification */ - f_esipa_send(valueof(ts_handleNotificationEsipa_prfleInstRslt(notificationAddress := smdpp_add))); + f_esipa_send(valueof(ts_handleNotificationEsipa_pendingNotif(ts_SGP32_pendingNotification_prfleInstRslt(notificationAddress := smdpp_add)))); f_es9p_transceive_empty_response(tr_handleNotification); f_rest_lookup_resource(resource_id, "download", tr_JSON_REST_success); @@ -548,7 +548,7 @@ /* Check the eIM for new eIM packages, we expect to get an euiccPackageRequest that contains the PSMO * that we have created (see above) */ esipa_res := f_esipa_transceive(valueof(ts_getEimPackageRequest(str2oct(order.eidValue))), - tr_getEimPackageResponse_euiccPkgReq(euiccPackage)); + tr_getEimPackageResponse_euiccPkgReq(tr_euiccPackageRequest(euiccPackage))); /* The eIM will generate a counterValue and an eimTransactionId, both must be echoed in the response. */ euiccPackageResult.euiccPackageResultSigned.euiccPackageResultDataSigned.counterValue := @@ -557,7 +557,7 @@ esipa_res.getEimPackageResponse.euiccPackageRequest.euiccPackageSigned.eimTransactionId; /* Respond with a plausible EimPackage result */ - f_esipa_transceive(valueof(ts_provideEimPackageResult_ePRAndNotif(eID, euiccPackageResult)), + f_esipa_transceive(valueof(ts_provideEimPackageResult(eID, ts_eimPackageResult_ePRAndNotif(euiccPackageResult))), tr_provideEimPackageResultResponse_empty); f_rest_lookup_resource(resource_id, facility, tr_JSON_REST_success); @@ -833,7 +833,7 @@ eimTransactionId := valueof(esipa_res.getEimPackageResponse.ipaEuiccDataRequest.eimTransactionId); /* Provide a plausible ipaEuiccDataResponse to the eIM */ - f_esipa_transceive(valueof(ts_provideEimPackageResult_euiccDataResp(eID, eimTransactionId)), + f_esipa_transceive(valueof(ts_provideEimPackageResult(eID, ts_eimPackageResult_euiccDataResp(eimTransactionId))), tr_provideEimPackageResultResponse_empty); f_rest_lookup_resource(resource_id, "edr", tr_JSON_REST_success); @@ -878,7 +878,7 @@ eimTransactionId := valueof(esipa_res.getEimPackageResponse.ipaEuiccDataRequest.eimTransactionId); /* Provide a plausible ipaEuiccDataResponse to the eIM */ - f_esipa_transceive(valueof(ts_provideEimPackageResult_euiccDataResp_err(eID, eimTransactionId)), + f_esipa_transceive(valueof(ts_provideEimPackageResult(eID, ts_eimPackageResult_euiccDataResp_err(eimTransactionId))), tr_provideEimPackageResultResponse_empty); f_rest_lookup_resource(resource_id, "edr", tr_JSON_REST_success(outcome := expected_outcome) ); diff --git a/ipad/IPAd_Tests.ttcn b/ipad/IPAd_Tests.ttcn index c999cfb..ce744d0 100644 --- a/ipad/IPAd_Tests.ttcn +++ b/ipad/IPAd_Tests.ttcn @@ -409,7 +409,7 @@ /* Step #5-#10 */ esipa_req := f_esipa_receive(tr_initiateAuthenticationRequestEsipa); - esipa_res := valueof(ts_initiateAuthenticationResponseEsipa(euiccChallenge := esipa_req.initiateAuthenticationRequestEsipa.euiccChallenge)); + esipa_res := valueof(ts_initiateAuthenticationResponseEsipa(serverSigned1 := ts_serverSigned1(euiccChallenge := esipa_req.initiateAuthenticationRequestEsipa.euiccChallenge))); f_esipa_send(esipa_res); /* Step #11-#14 */ @@ -482,7 +482,7 @@ f_vpcd_transceive(enc_ImmediateEnableResponse(valueof(ts_immediateEnableResponse))); /* Receive ProfileInstallationResult from iPAD->eIM */ - f_esipa_transceive_empty_response(tr_handleNotificationEsipa_prfleInstRslt); + f_esipa_transceive_empty_response(tr_handleNotificationEsipa_pendingNotif(tr_SGP32_pendingNotification_prfleInstRslt)); /* Receive RemoveNotificationFromList from iPAD->eUICC */ f_vpcd_transceive(enc_NotificationSentResponse(valueof(ts_notificationSentResponse))); @@ -522,7 +522,7 @@ /* Step #10-14 */ f_esipa_transceive(valueof(ts_provideEimPackageResultResponse_eimAck(eimAcknowledgements := {1,2,3,4})), - tr_provideEimPackageResult_ePRAndNotif); + tr_provideEimPackageResult(*, tr_eimPackageResult_ePRAndNotif)); /* Step #15-17 */ f_vpcd_transceive(enc_NotificationSentResponse(valueof(ts_notificationSentResponse))); @@ -580,7 +580,7 @@ /* Step #10-14 */ f_esipa_transceive(valueof(ts_provideEimPackageResultResponse_eimAck(eimAcknowledgements := {1,2,3,4})), - tr_provideEimPackageResult_ePRAndNotif(euiccPackageResult := ?)); + tr_provideEimPackageResult(*, tr_eimPackageResult_ePRAndNotif(euiccPackageResult := ?))); /* Step #15-17 */ f_vpcd_transceive(enc_NotificationSentResponse(valueof(ts_notificationSentResponse))); @@ -628,7 +628,7 @@ /* IPAd will return the data to us */ f_esipa_transceive(valueof(ts_provideEimPackageResultResponse_eimAck(eimAcknowledgements := {1,2,3,4})), - tr_provideEimPackageResult_euiccDataResp); + tr_provideEimPackageResult(*, tr_eimPackageResult_euiccDataResp)); /* Wait some time until the the last HTTP response is actually delivered */ f_sleep(2.0); diff --git a/library/euicc/SGP32Definitions_Templates.ttcn b/library/euicc/SGP32Definitions_Templates.ttcn index bdc5fba..6722e11 100644 --- a/library/euicc/SGP32Definitions_Templates.ttcn +++ b/library/euicc/SGP32Definitions_Templates.ttcn @@ -83,37 +83,43 @@ /* GSMA SGP.32, section 6.3.2.1 */ template (present) EsipaMessageFromEimToIpa -tr_initiateAuthenticationResponseEsipa(template (present) octetstring euiccChallenge := ?, - template (present) universal charstring serverAddress := ?) := { +tr_initiateAuthenticationResponseEsipa(template octetstring transactionId := *, + template (present) ServerSigned1 serverSigned1 := tr_serverSigned1, + template (present) octetstring serverSignature1 := ?, + template (present) octetstring euiccCiPKIdentifierToBeUsed := ?, + template (present) Certificate serverCertificate := ?, + template charstring matchingId := *, + template CtxParams1 ctxParams1 := *) := { initiateAuthenticationResponseEsipa := { initiateAuthenticationOkEsipa := { - transactionId := *, - serverSigned1 := tr_serverSigned1(euiccChallenge := euiccChallenge, serverAddress := serverAddress), - serverSignature1 := ?, - euiccCiPKIdentifierToBeUsed := ?, + transactionId := transactionId, + serverSigned1 := serverSigned1, + serverSignature1 := serverSignature1, + euiccCiPKIdentifierToBeUsed := euiccCiPKIdentifierToBeUsed, serverCertificate := ?, - matchingId := *, - ctxParams1 := * + matchingId := matchingId, + ctxParams1 := ctxParams1 } } } - template (value) EsipaMessageFromEimToIpa -ts_initiateAuthenticationResponseEsipa(template (value) octetstring euiccChallenge := '00112233445566778899AABBCCDDEEFF'O, - template (value) universal charstring serverAddress := "smdp.example.com") := { +ts_initiateAuthenticationResponseEsipa(template (omit) octetstring transactionId := omit, + template (value) ServerSigned1 serverSigned1 := ts_serverSigned1, + template (value) octetstring serverSignature1 := '5252525252525252525252525252525252525252525252525252525252525252 + 5353535353535353535353535353535353535353535353535353535353535353'O, + template (value) octetstring euiccCiPKIdentifierToBeUsed := 'F54172BDF98A95D65CBEB88A38A1C11D800A85C3'O /* NIST */, + template (value) Certificate serverCertificate := ts_cert_s_sm_dpauth_nist, + template (omit) universal charstring matchingId := omit, + template (omit) CtxParams1 ctxParams1 := omit) := { initiateAuthenticationResponseEsipa := { initiateAuthenticationOkEsipa := { - transactionId := omit, - serverSigned1 := ts_serverSigned1(euiccChallenge := euiccChallenge, serverAddress := serverAddress), - serverSignature1 := '5252525252525252525252525252525252525252525252525252525252525252 - 5353535353535353535353535353535353535353535353535353535353535353'O, - euiccCiPKIdentifierToBeUsed := 'F54172BDF98A95D65CBEB88A38A1C11D800A85C3'O, /* NIST */ - serverCertificate := ts_cert_s_sm_dpauth_nist, -// serverCertificate := ts_cert_s_sm_dpauth_brp, -// serverCertificate := ts_cert_s_sm_dp2auth_nist, -// serverCertificate := ts_cert_s_sm_dp2auth_brp, - matchingId := omit, - ctxParams1 := omit + transactionId := transactionId, + serverSigned1 := serverSigned1, + serverSignature1 := serverSignature1, + euiccCiPKIdentifierToBeUsed := euiccCiPKIdentifierToBeUsed, + serverCertificate := serverCertificate, + matchingId := matchingId, + ctxParams1 := ctxParams1 } } } @@ -164,28 +170,39 @@ euiccInfo2 := euiccInfo2, ctxParams1 := ctxParams1 } +template (present) SGP32_AuthenticateServerResponse +tr_SGP32_authenticateServerResponse := { + authenticateResponseOk := { + euiccSigned1 := tr_euiccSigned1, + euiccSignature1 := ?, + euiccCertificate := ?, + eumCertificate := ? + } +} +template (value) SGP32_AuthenticateServerResponse +ts_SGP32_authenticateServerResponse := { + authenticateResponseOk := { + euiccSigned1 := ts_euiccSigned1, + euiccSignature1 := '5252525252525252525252525252525252525252525252525252525252525252 + 5353535353535353535353535353535353535353535353535353535353535353'O, + euiccCertificate := ts_cert_euicc_nist, + eumCertificate := ts_cert_eum_nist + } +} template (present) EsipaMessageFromIpaToEim -tr_authenticateClientRequestEsipa := { +tr_authenticateClientRequestEsipa(template (present) octetstring transactionId := ?, + template (present) SGP32_AuthenticateServerResponse authenticateServerResponse := tr_SGP32_authenticateServerResponse) := { authenticateClientRequestEsipa := { - transactionId := ?, - authenticateServerResponse := { - authenticateResponseOk := ? - } + transactionId := transactionId, + authenticateServerResponse := authenticateServerResponse } } template (value) EsipaMessageFromIpaToEim -ts_authenticateClientRequestEsipa(template (value) octetstring transactionId := 'ABCDEF'O) := { +ts_authenticateClientRequestEsipa(template (value) octetstring transactionId := 'ABCDEF'O, + template (value) SGP32_AuthenticateServerResponse authenticateServerResponse := ts_SGP32_authenticateServerResponse) := { authenticateClientRequestEsipa := { transactionId := transactionId, - authenticateServerResponse := { - authenticateResponseOk := { - euiccSigned1 := ts_euiccSigned1, - euiccSignature1 := '5252525252525252525252525252525252525252525252525252525252525252 - 5353535353535353535353535353535353535353535353535353535353535353'O, - euiccCertificate := ts_cert_euicc_nist, - eumCertificate := ts_cert_eum_nist - } - } + authenticateServerResponse := authenticateServerResponse } } @@ -223,40 +240,39 @@ /* GSMA SGP.32, section 6.3.2.2 */ template (present) EsipaMessageFromEimToIpa -tr_authenticateClientResponseEsipa_dpe(template (present) octetstring transactionId := ?) := { +tr_authenticateClientResponseEsipa_dpe(template octetstring transactionId := *, + template SGP32_StoreMetadataRequest profileMetaData := *, + template (present) SmdpSigned2 smdpSigned2 := tr_smdpSigned2, + template (present) octetstring smdpSignature2 := ?, + template (present) Certificate smdpCertificate := ?, + template octetstring hashCc := *) := { authenticateClientResponseEsipa := { authenticateClientOkDPEsipa := { transactionId := transactionId, - profileMetaData := *, - smdpSigned2 := { - transactionId := ?, - ccRequiredFlag := ?, - bppEuiccOtpk := * - }, - smdpSignature2 := ?, - smdpCertificate := ?, - hashCc := * + profileMetaData := profileMetaData, + smdpSigned2 := smdpSigned2, + smdpSignature2 := smdpSignature2, + smdpCertificate := smdpCertificate, + hashCc := hashCc } } } template (value) EsipaMessageFromEimToIpa -ts_authenticateClientResponseEsipa_dpe(template (value) octetstring transactionId := 'ABCDEF'O) := { +ts_authenticateClientResponseEsipa_dpe(template (omit) octetstring transactionId := omit, + template (omit) SGP32_StoreMetadataRequest profileMetaData := omit, + template (value) SmdpSigned2 smdpSigned2 := ts_smdpSigned2, + template (value) octetstring smdpSignature2 := '5252525252525252525252525252525252525252525252525252525252525252 + 5353535353535353535353535353535353535353535353535353535353535353'O, + template (value) Certificate smdpCertificate := ts_cert_s_sm_dpauth_nist, + template (omit) octetstring hashCc := omit) := { authenticateClientResponseEsipa := { authenticateClientOkDPEsipa := { transactionId := transactionId, - profileMetaData := omit, - smdpSigned2 := { - transactionId := transactionId, - ccRequiredFlag := false, - bppEuiccOtpk := omit - }, - smdpSignature2 := '5252525252525252525252525252525252525252525252525252525252525252 - 5353535353535353535353535353535353535353535353535353535353535353'O, - smdpCertificate := ts_cert_s_sm_dpauth_nist, -// smdpCertificate := ts_cert_s_sm_dpauth_brp, -// smdpCertificate := ts_cert_s_sm_dp2auth_nist, -// smdpCertificate := ts_cert_s_sm_dp2auth_brp, - hashCc := omit + profileMetaData := profileMetaData, + smdpSigned2 := smdpSigned2, + smdpSignature2 := smdpSignature2, + smdpCertificate := smdpCertificate, + hashCc := hashCc } } } @@ -274,62 +290,71 @@ template (value) EsipaMessageFromIpaToEim ts_getEimPackageRequest(template (value) octetstring eidValue, template (omit) AsnNull notifyStateChange := omit, - template (omit) integer stateChangeCause := omit) := { + template (omit) integer stateChangeCause := omit, + template (omit) octetstring rPLMN := omit) := { getEimPackageRequest := { eidValue := eidValue, notifyStateChange := notifyStateChange, stateChangeCause := stateChangeCause, - rPLMN := omit + rPLMN := rPLMN } } /* GSMA SGP.32, section 6.3.2.6 and 2.11.1.3 */ +template (present) ProfileDownloadTriggerRequest +tr_profileDownloadTriggerRequest(template (present) charstring activationCode := ?) := { + profileDownloadData := { + activationCode := activationCode + }, + eimTransactionId := * +} +template (value) ProfileDownloadTriggerRequest +ts_profileDownloadTriggerRequest(template (value) charstring activationCode := "1$SMDP.EXAMPLE.COM$$1.3.6.1.4.1.31746") := { + profileDownloadData := { + activationCode := activationCode + }, + eimTransactionId := omit +} template (present) EsipaMessageFromEimToIpa -tr_getEimPackageResponse_dnlTrigReq(template (present) charstring activationCode := ?) := { +tr_getEimPackageResponse_dnlTrigReq(template (present) ProfileDownloadTriggerRequest profileDownloadTriggerRequest := tr_profileDownloadTriggerRequest) := { getEimPackageResponse := { - profileDownloadTriggerRequest := { - profileDownloadData := { - activationCode := activationCode - }, - eimTransactionId := * - } + profileDownloadTriggerRequest := profileDownloadTriggerRequest } } template (value) EsipaMessageFromEimToIpa -ts_getEimPackageResponse_dnlTrigReq(template (value) charstring activationCode := "1$SMDP.EXAMPLE.COM$$1.3.6.1.4.1.31746") := { +ts_getEimPackageResponse_dnlTrigReq(template (value) ProfileDownloadTriggerRequest profileDownloadTriggerRequest := ts_profileDownloadTriggerRequest) := { getEimPackageResponse := { - profileDownloadTriggerRequest := { - profileDownloadData := { - activationCode := activationCode - }, - eimTransactionId := omit - } + profileDownloadTriggerRequest := profileDownloadTriggerRequest } } /* GSMA SGP.32, section 6.3.2.6 and 2.11.1.2 */ +template (present) IpaEuiccDataRequest +tr_ipaEuiccDataRequest := { + tagList := ?, + euiccCiPKIdentifierToBeUsed := *, + searchCriteriaNotification := *, + searchCriteriaEuiccPackageResult := *, + eimTransactionId := * +} +template (value) IpaEuiccDataRequest +ts_ipaEuiccDataRequest := { + tagList := '81BF20BF228384A5A6A8A9A0'O, + euiccCiPKIdentifierToBeUsed := omit, + searchCriteriaNotification := omit, + searchCriteriaEuiccPackageResult := omit, + eimTransactionId := omit +} template (present) EsipaMessageFromEimToIpa -tr_getEimPackageResponse_euiccDataReq := { +tr_getEimPackageResponse_euiccDataReq(template (present) IpaEuiccDataRequest ipaEuiccDataRequest := tr_ipaEuiccDataRequest) := { getEimPackageResponse := { - ipaEuiccDataRequest := { - tagList := ?, - euiccCiPKIdentifierToBeUsed := *, - searchCriteriaNotification := *, - searchCriteriaEuiccPackageResult := *, - eimTransactionId := * - } + ipaEuiccDataRequest := ipaEuiccDataRequest } } template (value) EsipaMessageFromEimToIpa -ts_getEimPackageResponse_euiccDataReq := { +ts_getEimPackageResponse_euiccDataReq(template (value) IpaEuiccDataRequest ipaEuiccDataRequest := ts_ipaEuiccDataRequest) := { getEimPackageResponse := { - ipaEuiccDataRequest := { - tagList := '81BF20BF228384A5A6A8A9A0'O, - euiccCiPKIdentifierToBeUsed := omit, - searchCriteriaNotification := omit, - searchCriteriaEuiccPackageResult := omit, - eimTransactionId := omit - } + ipaEuiccDataRequest := ipaEuiccDataRequest } } @@ -629,55 +654,65 @@ } /* GSMA SGP.32, section 6.3.2.6 */ +template (present) EuiccPackageRequest +tr_euiccPackageRequest(template (present) EuiccPackage euiccPackage := tr_euiccPackage_enablePsmo) := { + euiccPackageSigned := { + eimId := ?, + eidValue := ?, + counterValue := ?, + eimTransactionId := *, + euiccPackage := euiccPackage + }, + eimSignature := ? +} +template (value) EuiccPackageRequest +ts_euiccPackageRequest(template (value) EuiccPackage euiccPackage := ts_euiccPackage_enablePsmo) := { + euiccPackageSigned := { + eimId := "myEim", + eidValue := '00112233445566778899AABBCCDDEEFF'O, + counterValue := 123, + eimTransactionId := omit, + euiccPackage := euiccPackage + }, + eimSignature := '5252525252525252525252525252525252525252525252525252525252525252 + 5353535353535353535353535353535353535353535353535353535353535353'O +} template (present) EsipaMessageFromEimToIpa -tr_getEimPackageResponse_euiccPkgReq(template (present) EuiccPackage euiccPackage := tr_euiccPackage_enablePsmo) := { +tr_getEimPackageResponse_euiccPkgReq(template (present) EuiccPackageRequest euiccPackageRequest := tr_euiccPackageRequest) := { getEimPackageResponse := { - euiccPackageRequest := { - euiccPackageSigned := { - eimId := ?, - eidValue := ?, - counterValue := ?, - eimTransactionId := *, - euiccPackage := euiccPackage - }, - eimSignature := ? - } + euiccPackageRequest := euiccPackageRequest } } template (value) EsipaMessageFromEimToIpa -ts_getEimPackageResponse_euiccPkgReq(template (value) EuiccPackage euiccPackage := ts_euiccPackage_enablePsmo) := { +ts_getEimPackageResponse_euiccPkgReq(template (value) EuiccPackageRequest euiccPackageRequest := ts_euiccPackageRequest) := { getEimPackageResponse := { - euiccPackageRequest := { - euiccPackageSigned := { - eimId := "myEim", - eidValue := '00112233445566778899AABBCCDDEEFF'O, - counterValue := 123, - eimTransactionId := omit, - euiccPackage := euiccPackage - }, - eimSignature := '5252525252525252525252525252525252525252525252525252525252525252 - 5353535353535353535353535353535353535353535353535353535353535353'O - } + euiccPackageRequest := euiccPackageRequest } } /* GSMA SGP.32, section 6.3.2.5 */ +template (present) SGP32_CancelSessionResponse +tr_SGP32_cancelSessionResponse := { + cancelSessionResponseOk := tr_cancelSessionResponseOk +} +template (value) SGP32_CancelSessionResponse +ts_SGP32_cancelSessionResponse := { + cancelSessionResponseOk := ts_cancelSessionResponseOk +} template (present) EsipaMessageFromIpaToEim -tr_cancelSessionRequestEsipa := { +tr_cancelSessionRequestEsipa(template (present) octetstring transactionId := ?, + template (present) SGP32_CancelSessionResponse cancelSessionResponse := tr_SGP32_cancelSessionResponse) := { cancelSessionRequestEsipa := { - transactionId := ?, - cancelSessionResponse := { - cancelSessionResponseOk := tr_cancelSessionResponseOk - } + transactionId := transactionId, + cancelSessionResponse := cancelSessionResponse } } template (value) EsipaMessageFromIpaToEim -ts_cancelSessionRequestEsipa := { +ts_cancelSessionRequestEsipa(template (value) octetstring transactionId := 'ABCDEF'O, + template (value) SGP32_CancelSessionResponse cancelSessionResponse := ts_SGP32_cancelSessionResponse) := { cancelSessionRequestEsipa := { - transactionId := 'AABBCC'O, - cancelSessionResponse := { - cancelSessionResponseOk := ts_cancelSessionResponseOk - } + transactionId := transactionId, + cancelSessionResponse := cancelSessionResponse } } @@ -700,40 +735,48 @@ } /* GSMA SGP.32, section 6.3.2.3 */ +template (present) SGP32_PrepareDownloadResponse +tr_SGP32_prepareDownloadResponse := { + downloadResponseOk := tr_prepareDownloadResponseOk +} +template (value) SGP32_PrepareDownloadResponse +ts_SGP32_prepareDownloadResponse := { + downloadResponseOk := ts_prepareDownloadResponseOk +} template (present) EsipaMessageFromIpaToEim -tr_getBoundProfilePackageRequestEsipa := { +tr_getBoundProfilePackageRequestEsipa(template (present) octetstring transactionId := 'ABCDEF'O, + template (present) SGP32_PrepareDownloadResponse prepareDownloadResponse := tr_SGP32_prepareDownloadResponse) := { getBoundProfilePackageRequestEsipa := { transactionId := ?, - prepareDownloadResponse := { - downloadResponseOk := tr_prepareDownloadResponseOk - } + prepareDownloadResponse := prepareDownloadResponse } } template (value) EsipaMessageFromIpaToEim -ts_getBoundProfilePackageRequestEsipa := { +ts_getBoundProfilePackageRequestEsipa(template (value) octetstring transactionId := 'ABCDEF'O, + template (value) SGP32_PrepareDownloadResponse prepareDownloadResponse := ts_SGP32_prepareDownloadResponse) := { getBoundProfilePackageRequestEsipa := { transactionId := 'ABCDEF'O, - prepareDownloadResponse := { - downloadResponseOk := ts_prepareDownloadResponseOk - } + prepareDownloadResponse := prepareDownloadResponse } } /* GSMA SGP.32, section 6.3.2.3 */ template (present) EsipaMessageFromEimToIpa -tr_getBoundProfilePackageResponseEsipa := { +tr_getBoundProfilePackageResponseEsipa(template octetstring transactionId := *, + template (present) BoundProfilePackage boundProfilePackage := ?) := { getBoundProfilePackageResponseEsipa := { getBoundProfilePackageOkEsipa := { - transactionId := *, + transactionId := transactionId, boundProfilePackage := tr_boundProfilePackage } } } template (value) EsipaMessageFromEimToIpa -ts_getBoundProfilePackageResponseEsipa := { +ts_getBoundProfilePackageResponseEsipa(template (omit) octetstring transactionId := omit, + template (value) BoundProfilePackage boundProfilePackage := ts_boundProfilePackage) := { getBoundProfilePackageResponseEsipa := { getBoundProfilePackageOkEsipa := { - transactionId := omit, + transactionId := transactionId, boundProfilePackage := ts_boundProfilePackage } } @@ -773,27 +816,53 @@ } /* GSMA SGP.32, section 6.3.2.4 */ +template (present) SGP32_PendingNotification tr_SGP32_pendingNotification_prfleInstRslt := { + profileInstallationResult := { + profileInstallationResultData := tr_profileInstallationResultData, + euiccSignPIR := ? + } +} +template (value) SGP32_PendingNotification ts_SGP32_pendingNotification_prfleInstRslt(template (value) charstring notificationAddress := "smdp.example.com") := { + profileInstallationResult := { + profileInstallationResultData := ts_profileInstallationResultData(notificationAddress), + euiccSignPIR := '5252525252525252525252525252525252525252525252525252525252525252 + 5353535353535353535353535353535353535353535353535353535353535353'O + } +} template (present) EsipaMessageFromIpaToEim -tr_handleNotificationEsipa_prfleInstRslt(template (present) charstring notificationAddress := ?) := { +tr_handleNotificationEsipa_pendingNotif(template (present) SGP32_PendingNotification pendingNotification := tr_SGP32_pendingNotification_prfleInstRslt) := { handleNotificationEsipa := { - pendingNotification := { - profileInstallationResult := { - profileInstallationResultData := tr_profileInstallationResultData, - euiccSignPIR := ? - } - } + pendingNotification := pendingNotification } } template (value) EsipaMessageFromIpaToEim -ts_handleNotificationEsipa_prfleInstRslt(template (value) charstring notificationAddress := "smdp.example.com") := { +ts_handleNotificationEsipa_pendingNotif(template (value) SGP32_PendingNotification pendingNotification := ts_SGP32_pendingNotification_prfleInstRslt) := { handleNotificationEsipa := { - pendingNotification := { - profileInstallationResult := { - profileInstallationResultData := ts_profileInstallationResultData(notificationAddress), - euiccSignPIR := '5252525252525252525252525252525252525252525252525252525252525252 - 5353535353535353535353535353535353535353535353535353535353535353'O - } - } + pendingNotification := pendingNotification + } +} +template (present) ProvideEimPackageResult +tr_handleNotif_provideEimPackageResult(template octetstring eidValue := *, + template (present) EimPackageResult eimPackageResult := tr_eimPackageResult_ePRAndNotif) := { + eidValue := eidValue, + eimPackageResult := eimPackageResult +} +template (value) ProvideEimPackageResult +ts_handleNotif_provideEimPackageResult(template (omit) octetstring eidValue := omit, + template (value) EimPackageResult eimPackageResult := ts_eimPackageResult_ePRAndNotif) := { + eidValue := eidValue, + eimPackageResult := eimPackageResult +} +template (present) EsipaMessageFromIpaToEim +tr_handleNotificationEsipa_prvdeEimPkgRslt(template (present) ProvideEimPackageResult provideEimPackageResult := tr_handleNotif_provideEimPackageResult) := { + handleNotificationEsipa := { + provideEimPackageResult := provideEimPackageResult + } +} +template (value) EsipaMessageFromIpaToEim +ts_handleNotificationEsipa_prvdeEimPkgRslt(template (value) ProvideEimPackageResult provideEimPackageResult := ts_handleNotif_provideEimPackageResult) := { + handleNotificationEsipa := { + provideEimPackageResult := provideEimPackageResult } } @@ -1377,110 +1446,90 @@ } } +template (present) EimPackageResult +tr_eimPackageResult_ePRAndNotif(template (present) EuiccPackageResult euiccPackageResult := tr_euiccPackageResultSigned_enablePsmo) := { + ePRAndNotifications := { + euiccPackageResult := euiccPackageResult, + notificationList := ? + } +} +template (value) EimPackageResult +ts_eimPackageResult_ePRAndNotif(template (value) EuiccPackageResult euiccPackageResult := ts_euiccPackageResultSigned_enablePsmo) := { + ePRAndNotifications := { + euiccPackageResult := euiccPackageResult, + notificationList := { } + } +} +template (present) EimPackageResult +tr_eimPackageResult_euiccDataResp := { + ipaEuiccDataResponse := { + ipaEuiccData := { + notificationsList := *, + defaultSmdpAddress := *, + euiccPackageResultList := *, + euiccInfo1 := *, + euiccInfo2 := *, + rootSmdsAddress := *, + associationToken := *, + eumCertificate := *, + euiccCertificate := *, + eimTransactionId := *, + ipaCapabilities := *, + deviceInfo := * + } + } +} +template (value) EimPackageResult +ts_eimPackageResult_euiccDataResp(template (omit) octetstring eimTransactionId := omit) := { + ipaEuiccDataResponse := { + ipaEuiccData := { + notificationsList := omit, + defaultSmdpAddress := "smdp.example.com", + euiccPackageResultList := omit, + euiccInfo1 := ts_EUICCInfo1, + euiccInfo2 := ts_SGP32_EUICCInfo2, + rootSmdsAddress := "smds.example.com", + associationToken := 1, + eumCertificate := ts_cert_eum_nist, + euiccCertificate := ts_cert_euicc_nist, + eimTransactionId := eimTransactionId, + ipaCapabilities := omit, + deviceInfo := omit + } + } +} +template (present) EimPackageResult +tr_eimPackageResult_euiccDataResp_err := { + ipaEuiccDataResponse := { + ipaEuiccDataResponseError := { + eimTransactionId := *, + ipaEuiccDataErrorCode := ? + } + } +} +template (value) EimPackageResult +ts_eimPackageResult_euiccDataResp_err(template (omit) octetstring eimTransactionId := omit) := { + ipaEuiccDataResponse := { + ipaEuiccDataResponseError := { + eimTransactionId := eimTransactionId, + ipaEuiccDataErrorCode := 127 + } + } +} template (present) EsipaMessageFromIpaToEim -tr_provideEimPackageResult_ePRAndNotif(template octetstring eidValue := *, - template (present) EuiccPackageResult euiccPackageResult := tr_euiccPackageResultSigned_enablePsmo) := { +tr_provideEimPackageResult(template octetstring eidValue := *, + template (present) EimPackageResult eimPackageResult := ?) := { provideEimPackageResult := { eidValue := eidValue, - eimPackageResult := { - ePRAndNotifications := { - euiccPackageResult := euiccPackageResult, - notificationList := ? - } - } + eimPackageResult := eimPackageResult } } template (value) EsipaMessageFromIpaToEim -ts_provideEimPackageResult_ePRAndNotif(template (omit) octetstring eidValue := omit, - template (value) EuiccPackageResult euiccPackageResult := ts_euiccPackageResultSigned_enablePsmo) := { +ts_provideEimPackageResult(template (omit) octetstring eidValue := omit, + template (value) EimPackageResult eimPackageResult := ts_eimPackageResult_ePRAndNotif) := { provideEimPackageResult := { eidValue := eidValue, - eimPackageResult := { - ePRAndNotifications := { - euiccPackageResult := euiccPackageResult, - notificationList := { } - } - } - } -} - -template (present) EsipaMessageFromIpaToEim -tr_provideEimPackageResult_euiccDataResp(template octetstring eidValue := *) := { - provideEimPackageResult := { - eidValue := eidValue, - eimPackageResult := { - ipaEuiccDataResponse := { - ipaEuiccData := { - notificationsList := *, - defaultSmdpAddress := *, - euiccPackageResultList := *, - euiccInfo1 := *, - euiccInfo2 := *, - rootSmdsAddress := *, - associationToken := *, - eumCertificate := *, - euiccCertificate := *, - eimTransactionId := *, - ipaCapabilities := *, - deviceInfo := * - } - } - } - } -} -template (value) EsipaMessageFromIpaToEim -ts_provideEimPackageResult_euiccDataResp(template (omit) octetstring eidValue := omit, - template (omit) octetstring eimTransactionId := omit) := { - provideEimPackageResult := { - eidValue := eidValue, - eimPackageResult := { - ipaEuiccDataResponse := { - ipaEuiccData := { - notificationsList := omit, - defaultSmdpAddress := "smdp.example.com", - euiccPackageResultList := omit, - euiccInfo1 := ts_EUICCInfo1, - euiccInfo2 := ts_SGP32_EUICCInfo2, - rootSmdsAddress := "smds.example.com", - associationToken := 1, - eumCertificate := ts_cert_eum_nist, - euiccCertificate := ts_cert_euicc_nist, - eimTransactionId := eimTransactionId, - ipaCapabilities := omit, - deviceInfo := omit - } - } - } - } -} - -template (present) EsipaMessageFromIpaToEim -tr_provideEimPackageResult_euiccDataResp_err(template octetstring eidValue := *) := { - provideEimPackageResult := { - eidValue := eidValue, - eimPackageResult := { - ipaEuiccDataResponse := { - ipaEuiccDataResponseError := { - eimTransactionId := *, - ipaEuiccDataErrorCode := ? - } - } - } - } -} -template (value) EsipaMessageFromIpaToEim -ts_provideEimPackageResult_euiccDataResp_err(template (omit) octetstring eidValue := omit, - template (omit) octetstring eimTransactionId := omit) := { - provideEimPackageResult := { - eidValue := eidValue, - eimPackageResult := { - ipaEuiccDataResponse := { - ipaEuiccDataResponseError := { - eimTransactionId := eimTransactionId, - ipaEuiccDataErrorCode := 127 - } - } - } + eimPackageResult := eimPackageResult } } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43181?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I69a29b30578b0280006c2655b20c2a4eb62f5e75 Gerrit-Change-Number: 43181 Gerrit-PatchSet: 1 Gerrit-Owner: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: RFC: sim/class_tables: add a size attribute
by lynxis lazus 07 Aug '26

07 Aug '26

lynxis lazus has uploaded a new patch set (#2). ( https://gerrit.osmocom.org/c/libosmocore/+/43178?usp=email ) Change subject: RFC: sim/class_tables: add a size attribute ...................................................................... RFC: sim/class_tables: add a size attribute osim_determine_apdu_case() doesn't know the size of the APDU, this may result in reading invalid data outside the APDU. Warning: this is an API breakage! Instead adding a second function osim_determine_apdu_case_size() could allow it. However because the class_tables.h also defines the internal struct with the helper functions, which in turn has the same problem. Change-Id: Iee50063399a0c3b29594e737f44aaa125fd06a2e --- M include/osmocom/sim/class_tables.h M src/sim/class_tables.c M tests/sim/sim_test.c 3 files changed, 30 insertions(+), 16 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/78/43178/2 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43178?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Iee50063399a0c3b29594e737f44aaa125fd06a2e Gerrit-Change-Number: 43178 Gerrit-PatchSet: 2 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>

1 0

[S] Change in libosmocore[master]: sim/class_tables: add a size attribute
by lynxis lazus 07 Aug '26

07 Aug '26

lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43178?usp=email ) Change subject: sim/class_tables: add a size attribute ...................................................................... sim/class_tables: add a size attribute osim_determine_apdu_case() doesn't know the size of the APDU, this may result in reading invalid data outside the APDU. Warning: this is an API breakage! Instead adding a second function osim_determine_apdu_case_size() could allow it. However because the class_tables.h also defines the internal struct with the helper functions, which in turn has the same problem. Change-Id: Iee50063399a0c3b29594e737f44aaa125fd06a2e --- M include/osmocom/sim/class_tables.h M src/sim/class_tables.c M tests/sim/sim_test.c 3 files changed, 30 insertions(+), 16 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/78/43178/1 diff --git a/include/osmocom/sim/class_tables.h b/include/osmocom/sim/class_tables.h index ec9ec49..2c7c206 100644 --- a/include/osmocom/sim/class_tables.h +++ b/include/osmocom/sim/class_tables.h @@ -20,7 +20,7 @@ struct osim_cla_ins_case { uint8_t cla; uint8_t cla_mask; - int (*helper)(const struct osim_cla_ins_case *cic, const uint8_t *hdr); + int (*helper)(const struct osim_cla_ins_case *cic, const uint8_t *apdu, size_t apdu_size); const uint8_t *ins_tbl; }; @@ -36,4 +36,4 @@ extern const struct osim_cla_ins_card_profile osim_uicc_sim_cic_profile; int osim_determine_apdu_case(const struct osim_cla_ins_card_profile *prof, - const uint8_t *hdr); + const uint8_t *apdu, size_t apdu_size); diff --git a/src/sim/class_tables.c b/src/sim/class_tables.c index 7500fc5..0a792c6 100644 --- a/src/sim/class_tables.c +++ b/src/sim/class_tables.c @@ -16,6 +16,7 @@ */ #include <stdint.h> +#include <errno.h> #include <osmocom/core/utils.h> #include <osmocom/sim/class_tables.h> @@ -139,13 +140,16 @@ }; static int uicc046_cla_ins_helper(const struct osim_cla_ins_case *cic, - const uint8_t *hdr) + const uint8_t *hdr, size_t hdr_size) { - uint8_t ins = hdr[1]; - uint8_t p1 = hdr[2]; - uint8_t p2 = hdr[3]; - uint8_t p2_cmd; + uint8_t ins, p1, p2, p2_cmd; + if (hdr_size < 4) + return -EINVAL; + + ins = hdr[1]; + p1 = hdr[2]; + p2 = hdr[3]; switch (ins) { case 0x73: /* MANAGE SECURE CHANNEL */ if (p1 == 0x00) /* Retrieve UICC Endpoints */ @@ -182,12 +186,16 @@ } static int gp_cla_ins_helper(const struct osim_cla_ins_case *cic, - const uint8_t *hdr) + const uint8_t *hdr, size_t hdr_size) { - uint8_t ins = hdr[1]; - uint8_t p1 = hdr[2]; - uint8_t p3 = hdr[4]; + uint8_t ins, p1, p3; + if (hdr_size < 5) + return -EINVAL; + + ins = hdr[1]; + p1 = hdr[2]; + p3 = hdr[4]; switch (ins) { case 0xE2: /* STORE DATA */ switch (p1 & 0x01) { @@ -394,13 +402,17 @@ }; int osim_determine_apdu_case(const struct osim_cla_ins_card_profile *prof, - const uint8_t *hdr) + const uint8_t *apdu, size_t apdu_len) { - uint8_t cla = hdr[0]; - uint8_t ins = hdr[1]; + uint8_t cla, ins; int i; int rc; + if (apdu_len < 4) + return -EINVAL; + + cla = apdu[0]; + ins = apdu[1]; for (i = 0; i < prof->cic_arr_size; i++) { const struct osim_cla_ins_case *cic = &prof->cic_arr[i]; if ((cla & cic->cla_mask) != cic->cla) @@ -408,7 +420,8 @@ rc = cic->ins_tbl[ins]; switch (rc) { case 0x80: - return cic->helper(cic, hdr); + /* the length of the hdr is unknown */ + return cic->helper(cic, apdu, apdu_len); case 0x00: /* continue with further cic, rather than abort * now */ diff --git a/tests/sim/sim_test.c b/tests/sim/sim_test.c index ab5d2be..801c559 100644 --- a/tests/sim/sim_test.c +++ b/tests/sim/sim_test.c @@ -19,6 +19,7 @@ #include <string.h> #include <osmocom/sim/sim.h> +#include <osmocom/core/utils.h> #include <osmocom/sim/class_tables.h> const uint8_t sim_sel_mf[] = { 0xA0, 0xA4, 0x00, 0x00, 0x02, 0x3F, 0x00 }; @@ -35,7 +36,7 @@ #define APDU_CASE_ASSERT(x, y) \ do { \ printf("Testing " #x "\n"); \ - int rc = osim_determine_apdu_case(&osim_uicc_sim_cic_profile, x); \ + int rc = osim_determine_apdu_case(&osim_uicc_sim_cic_profile, x, ARRAY_SIZE(x)); \ if (rc != y) \ printf("%d (actual) != %d (intended)\n", rc, y); \ OSMO_ASSERT(rc == y); \ -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43178?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Iee50063399a0c3b29594e737f44aaa125fd06a2e Gerrit-Change-Number: 43178 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>

1 0

[XS] Change in libsmpp34[master]: smpp34_unpack: bound C_OCTET scan with strnlen()
by n0k0 07 Aug '26

07 Aug '26

n0k0 has uploaded a new patch set (#3). ( https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email ) Change subject: smpp34_unpack: bound C_OCTET scan with strnlen() ...................................................................... smpp34_unpack: bound C_OCTET scan with strnlen() The C_OCTET macro runs strlen() on the attacker-controlled wire buffer before any bounds check. SMPP PDUs are decoded straight out of a buffer sized exactly to the wire command_length with no trailing NUL, so a C-Octet-String field that runs to the end of the buffer without a terminator makes strlen() read past the end of the allocation (out of bounds heap read), and the post-hoc "lenval > left" check runs only after the over-read has already happened. Scan with strnlen(aux, left) so the read can never go past the remaining buffer; if no terminator is found within 'left' bytes, lenval becomes left + 1 and the existing length check rejects the PDU. This issue has been assigned the CVE candidate identifier CAN-2026-2051038. Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 --- M src/smpp34_unpack.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libsmpp34 refs/changes/89/42889/3 -- To view, visit https://gerrit.osmocom.org/c/libsmpp34/+/42889?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libsmpp34 Gerrit-Branch: master Gerrit-Change-Id: Ie87b16cad0dbdc8ea8397c1b065b8545f23ac814 Gerrit-Change-Number: 42889 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software>

1 0

[S] Change in osmo-iuh[master]: iu_client: reject oversized RANAP NAS-PDU
by n0k0 07 Aug '26

07 Aug '26

n0k0 has uploaded a new patch set (#3). ( https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email ) Change subject: iu_client: reject oversized RANAP NAS-PDU ...................................................................... iu_client: reject oversized RANAP NAS-PDU The connection-oriented RANAP handlers ranap_handle_co_initial_ue() and ranap_handle_co_dt() copy the attacker-controlled NAS-PDU into a msgb allocated with a fixed 256 bytes. RANAP NAS-PDU is an unconstrained OCTET STRING, so the APER decoder accepts an arbitrarily large PDU; when nas_pdu.size exceeds the msgb tailroom, msgb_put() hits MSGB_ABORT and osmo_panic()s the process (MSGB_DEBUG is compiled in unconditionally), which a femtocell (HNB) peer can use to crash osmo-hnbgw / osmo-hnodeb by sending an InitialUE or DirectTransfer with a NAS-PDU > 256 bytes. Validate nas_pdu.size against the msgb tailroom and drop the message gracefully instead of panicking. This issue has been assigned the CVE candidate identifier CAN-2026-2051037. Change-Id: I7dbce926477f9842cd466d46cda836638f04011f --- M src/iu_client.c 1 file changed, 12 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-iuh refs/changes/87/42887/3 -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/42887?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I7dbce926477f9842cd466d46cda836638f04011f Gerrit-Change-Number: 42887 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software>

1 0

[XS] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by n0k0 07 Aug '26

07 Aug '26

n0k0 has uploaded a new patch set (#3). ( https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email ) Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... ipaccess-proxy: reject oversized IPA frame length ipaccess_proxy_read_msg() reads the 16-bit IPA frame length from the wire header and passes it straight as the recv() count into a msgb that was allocated with a fixed PROXY_ALLOC_SIZE (1200) bytes, without ever checking it against the buffer tailroom. A peer that advertises a body length larger than the remaining buffer space makes recv() write past the end of the heap allocation (heap buffer overflow). Reject frames whose advertised length exceeds the msgb tailroom, the same way the other IPA read paths bound the read to msgb_tailroom(). This issue has been assigned the CVE candidate identifier CAN-2026-2051036. Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 6 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/86/42886/3 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software>

1 0

[S] Change in osmo-ggsn[master]: gtp: fix OOB write in PDP ctx GSN-Address decode
by n0k0 07 Aug '26

07 Aug '26

n0k0 has uploaded a new patch set (#3). ( https://gerrit.osmocom.org/c/osmo-ggsn/+/42885?usp=email ) Change subject: gtp: fix OOB write in PDP ctx GSN-Address decode ...................................................................... gtp: fix OOB write in PDP ctx GSN-Address decode gtp_decode_pdp_ctx() takes the GSN-Address sub-field lengths of a PDP Context IE (gsnrc / gsnru, the GGSN control- and user-plane addresses) straight from the wire and memcpy()s that many bytes into the fixed 16-byte 'struct ul16_t' v[] array, with no check against the destination size. decode_pdp_ctx_len_check() only validates the declared lengths against the *input* buffer, never against the destination capacity, so a wire length of 17..255 overflows the 16-byte field by up to 239 bytes, clobbering adjacent struct pdp_t state. The PDP Context IE is carried in SGSN Context Response / Forward Relocation messages exchanged between peer GSNs over Gn/Gp, so a malicious or spoofed peer GSN can trigger this. The same libgtp decoder is linked by osmo-sgsn, so it is affected as well. A GSN address is 4 (IPv4) or 16 (IPv6) bytes, so reject any length that does not fit the destination before copying. This issue has been assigned the CVE candidate identifier CAN-2026-2051035. Change-Id: Id69e82fe1a16933d8c6b9c848a2ede29f7920d98 --- M gtp/gtp.c 1 file changed, 12 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ggsn refs/changes/85/42885/3 -- To view, visit https://gerrit.osmocom.org/c/osmo-ggsn/+/42885?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-ggsn Gerrit-Branch: master Gerrit-Change-Id: Id69e82fe1a16933d8c6b9c848a2ede29f7920d98 Gerrit-Change-Number: 42885 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software>

1 0

[M] Change in pysim[master]: GP: LOAD/STORE DATA chunk size from SCP overhead
by Hoernchen 07 Aug '26

07 Aug '26

Attention is currently required from: dexter, laforge. Hoernchen has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/pysim/+/43172?usp=email ) Change subject: GP: LOAD/STORE DATA chunk size from SCP overhead ...................................................................... Patch Set 2: (2 comments) File pySim/global_platform/__init__.py: https://gerrit.osmocom.org/c/pysim/+/43172/comment/b9400ec7_a4658458?usp=em… : PS1, Line 871: load_parser.add_argument('--chunk-len', type=auto_uint8, default=None, > (cosmetic, no blocker) as far as I know the default is always None, no need to set it explicitly. I wanted to make sure that auto uint8 as None is a deliberate default, not accidental implicit None. File pySim/global_platform/scp.py: https://gerrit.osmocom.org/c/pysim/+/43172/comment/1fba4d61_33286b2f?usp=em… : PS1, Line 195: # is one byte less than the largest block-size multiple within 255 - mac_len. > Would be nice to have a spec reference here (for the interested reader). there you go, it's just standard aes... -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43172?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 Gerrit-Change-Number: 43172 Gerrit-PatchSet: 2 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 11:51:13 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[M] Change in pysim[master]: GP: LOAD/STORE DATA chunk size from SCP overhead
by Hoernchen 07 Aug '26

07 Aug '26

Attention is currently required from: Hoernchen, dexter, laforge. Hello Jenkins Builder, dexter, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/43172?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Code-Review+1 by laforge, Code-Review+2 by dexter, Verified+1 by Jenkins Builder, Verified+1 by dexter The change is no longer submittable: Code-Review and Verified are unsatisfied now. Change subject: GP: LOAD/STORE DATA chunk size from SCP overhead ...................................................................... GP: LOAD/STORE DATA chunk size from SCP overhead SCP.overhead was so far set at construction time (SCP02: 8, SCP03: s_mode), so the C-MAC length only. Unfortunately sec lvl >= 3 pads the data field to the cipher block size before encryption, so the real worst-case overhead is larger, scc.max_cmd_len (255 - overhead) was too big, and ADF_SD.load() used a hardcoded chunk_len=240. Real world issue with a 286 byte CAP + SCP02 + sec lvl 3: - 240-byte LOAD block is padded to 248, - encrypted - gets 8 byte C-MAC appended -> Lc = 256 That dies with a weird "ValueError: bytes must be in range(0, 256)". The only "fix" for that was to downgrade the seclevel. STORE DATA has the same overflow with large max_cmd_len (247 + padding + MAC = 256 as well). Therefore the overhead must be properly calculated from the sec level. While at it adjust the error in case I missed something to get a more useful ValueError. Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 --- M pySim/global_platform/__init__.py M pySim/global_platform/scp.py M tests/unittests/test_globalplatform.py 3 files changed, 224 insertions(+), 12 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/72/43172/2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43172?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ic208f3959a38896f64fb6ccefb24cc360a3ac3a2 Gerrit-Change-Number: 43172 Gerrit-PatchSet: 2 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: dexter <pmaier(a)sysmocom.de>

1 0

[M] Change in ...pyosmocom[master]: tlv: preserve the comprehension bit
by dexter 07 Aug '26

07 Aug '26

Attention is currently required from: Hoernchen. dexter has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/python/pyosmocom/+/43171?usp=email ) Change subject: tlv: preserve the comprehension bit ...................................................................... Patch Set 1: Code-Review+1 (5 comments) Patchset: PS1: I have looked through your patch and I think it is plausible, however it introduces a state that other TLV classes don't have. Maybe this needs some explanation. Commit Message: https://gerrit.osmocom.org/c/python/pyosmocom/+/43171/comment/fec56f4a_fb90… : PS1, Line 35: instead of setting the flag, currently tag=0x8123 -> 0x81a3. I would split this in a separate patch (only if you think this would speed things up, as I think this part would be ready at least.) File src/osmocom/tlv.py: https://gerrit.osmocom.org/c/python/pyosmocom/+/43171/comment/4228f038_52c1… : PS1, Line 658: # True/False: as received Maybe it makes sense to explain this property in greater detail? This is an additional state an API user would expect right away. I understand this as a state that flips to the state of the last parsed CR bit when from_tlv() has been used. This basically means that when I have used from_tlv() once, the API user cannot rely on the CR bit set as originally defined. This is probably a corner case as the IE objects are usually short lived and probably not wildly mixed. Decode, change something, Re-Encode is probably the most exciting usecase to expect but I still think we should have an explanatory comment here. File tests/test_tlv.py: https://gerrit.osmocom.org/c/python/pyosmocom/+/43171/comment/873ef7ec_0ebd… : PS1, Line 83: I would add a comment that explains that the first vector has the CR bit set, but the second has not. And both must come out the same when they are decoded and re-encoded. https://gerrit.osmocom.org/c/python/pyosmocom/+/43171/comment/81a1304c_23ed… : PS1, Line 86: ie.from_tlv(encoded) maybe add an assert that checks that ie.comprension has changed state as expected? -- To view, visit https://gerrit.osmocom.org/c/python/pyosmocom/+/43171?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: python/pyosmocom Gerrit-Branch: master Gerrit-Change-Id: Ifae37785e2a586d9130d154bc7244f35fa6f2a55 Gerrit-Change-Number: 43171 Gerrit-PatchSet: 1 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 11:30:55 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026