August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in libosmocore[master]: iuup: Fix formatting of log line printing payload checksum error
by pespin 14 Aug '26

14 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43246?usp=email ) Change subject: iuup: Fix formatting of log line printing payload checksum error ...................................................................... iuup: Fix formatting of log line printing payload checksum error The payload CRC is 10bits long, hence 2 bytes are used. Printing 3 digits would be enough, but keep it as 4 digits since anyway we are storing it in uint16_t. Change-Id: Ife1de59a8257d6c857f724460b546f511db59ebd --- M src/gsm/iuup.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/46/43246/1 diff --git a/src/gsm/iuup.c b/src/gsm/iuup.c index 622302a..b7aa5f9 100644 --- a/src/gsm/iuup.c +++ b/src/gsm/iuup.c @@ -923,7 +923,7 @@ return 0; payload_crc_err: - LOGP(DLIUUP, LOGL_NOTICE, "Payload Checksum error (pdu type %u): rx 0x%02x vs exp 0x%02x\n", + LOGP(DLIUUP, LOGL_NOTICE, "Payload Checksum error (pdu type %u): rx 0x%04x vs exp 0x%04x\n", pdu_type, payload_crc, payload_crc_computed); return -EIO; } -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43246?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Ife1de59a8257d6c857f724460b546f511db59ebd Gerrit-Change-Number: 43246 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[L] Change in libosmocore[master]: iuup: Validate msgb input length in rx Initialization path
by pespin 14 Aug '26

14 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43247?usp=email ) Change subject: iuup: Validate msgb input length in rx Initialization path ...................................................................... iuup: Validate msgb input length in rx Initialization path Input length validation of msgb was left as a TODO in iuup_rx_initialization(), which could end up in OOB reads. Related: SYS#7063 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Change-Id: Id0f7b0f63efc37376024359a3bf7fabbc40bc387 --- M src/gsm/iuup.c M tests/iuup/iuup_test.c M tests/iuup/iuup_test.err M tests/iuup/iuup_test.ok 4 files changed, 327 insertions(+), 59 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/47/43247/1 diff --git a/src/gsm/iuup.c b/src/gsm/iuup.c index b7aa5f9..a233fb9 100644 --- a/src/gsm/iuup.c +++ b/src/gsm/iuup.c @@ -539,7 +539,8 @@ /* return: whether the last Init was Acked correctly and hence can transition to next state */ static bool iuup_rx_initialization(struct osmo_iuup_instance *iui, struct osmo_iuup_tnl_prim *itp) { - struct iuup_pdutype14_hdr *hdr; + struct msgb *msg = itp->oph.msg; + struct iuup_pdutype14_hdr *hdr = (struct iuup_pdutype14_hdr *)msgb_l2(msg); struct iuup_ctrl_init_hdr *ihdr; struct iuup_ctrl_init_rfci_hdr *ihdr_rfci; struct iuup_ctrl_init_tail *itail; @@ -551,9 +552,16 @@ struct osmo_iuup_rnl_prim *irp; struct osmo_iuup_tnl_prim *resp; - /* TODO: whenever we check message boundaries, length, etc. and we fail, send NACK */ + /* We expect at least the INIT header with at least 1 RFCI header: */ + if (msgb_l2len(msg) < sizeof(struct iuup_pdutype14_hdr) + + sizeof(struct iuup_ctrl_init_hdr) + + sizeof(struct iuup_ctrl_init_rfci_hdr)) { + LOGPFSML(iui->fi, LOGL_NOTICE, + "Initialization: Malformed packet, length %u too short\n", msgb_l2len(msg)); + err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT; + goto send_nack; + } - hdr = (struct iuup_pdutype14_hdr *)msgb_l2(itp->oph.msg); ihdr = (struct iuup_ctrl_init_hdr *)hdr->payload; if (ihdr->num_subflows_per_rfci == 0) { LOGPFSML(iui->fi, LOGL_NOTICE, "Initialization: Unexpected num_subflows=0 received\n"); @@ -562,16 +570,33 @@ } ihdr_rfci = (struct iuup_ctrl_init_rfci_hdr *)ihdr->rfci_data; + /* Iterate over RFCIs and parse and store its subflow lengths: */ do { struct osmo_iuup_rfci *rfci = &iui->config.rfci[num_rfci]; uint8_t l_size_bytes = ihdr_rfci->li + 1; + struct iuup_ctrl_init_rfci_hdr *next_ihdr_rfci = + (struct iuup_ctrl_init_rfci_hdr *)(&ihdr_rfci->subflow_length[0] + + (ihdr->num_subflows_per_rfci * l_size_bytes)); is_last = ihdr_rfci->lri; + if (num_rfci >= IUUP_MAX_RFCIS) { LOGPFSML(iui->fi, LOGL_NOTICE, "Initialization: Too many RFCIs received (%u)\n", - num_rfci); + num_rfci); err_cause = IUUP_ERR_CAUSE_UNEXPECTED_RFCI; goto send_nack; } + + /* Check contents of current RFCI are available in msgb, and if not last RFCI, + * also check for availability of next ihdr_rfci, all in one go: */ + if ((((uint8_t *)next_ihdr_rfci) + (is_last ? 0 : sizeof(struct iuup_ctrl_init_rfci_hdr))) > + msg->tail) { + LOGPFSML(iui->fi, LOGL_NOTICE, + "Initialization: Malformed packet, length %u too short\n", + msgb_l2len(msg)); + err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT; + goto send_nack; + } + rfci->used = 1; rfci->id = ihdr_rfci->rfci; if (l_size_bytes == 2) { @@ -588,13 +613,21 @@ } } num_rfci++; - ihdr_rfci++; - ihdr_rfci = (struct iuup_ctrl_init_rfci_hdr *)(((uint8_t *)ihdr_rfci) + ihdr->num_subflows_per_rfci * l_size_bytes); + ihdr_rfci = next_ihdr_rfci; } while (!is_last); if (ihdr->ti) { /* Timing information present */ uint8_t *buf = (uint8_t *)ihdr_rfci; uint8_t num_bytes = (num_rfci + 1) / 2; + + if (buf + num_bytes > msg->tail) { + LOGPFSML(iui->fi, LOGL_NOTICE, + "Initialization: Malformed packet, length %u too short\n", + msgb_l2len(msg)); + err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT; + goto send_nack; + } + iui->config.IPTIs_present = true; for (i = 0; i < num_bytes - 1; i++) { iui->config.rfci[i*2].IPTI = *buf >> 4; @@ -610,6 +643,15 @@ iui->config.IPTIs_present = false; itail = (struct iuup_ctrl_init_tail *)ihdr_rfci; } + + if (((uint8_t *)itail) + sizeof(*itail) > msg->tail) { + LOGPFSML(iui->fi, LOGL_NOTICE, + "Initialization: Malformed packet, length %u too short\n", + msgb_l2len(msg)); + err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT; + goto send_nack; + } + if (itail->data_pdu_type > 1) { LOGPFSML(iui->fi, LOGL_NOTICE, "Initialization: Unexpected Data PDU Type %u received\n", itail->data_pdu_type); err_cause = IUUP_ERR_CAUSE_UNEXPECTED_VALUE; @@ -643,9 +685,10 @@ resp = itp_ctrl_ack_alloc(iui, IUUP_PROC_INIT, hdr->frame_nr); iui->transport_prim_cb(&resp->oph, iui->transport_prim_priv); return ihdr->chain_ind == 0; + send_nack: LOGPFSML(iui->fi, LOGL_NOTICE, "Tx Initialization NACK cause=%u orig_message=%s\n", - err_cause, osmo_hexdump((const unsigned char *) msgb_l2(itp->oph.msg), msgb_l2len(itp->oph.msg))); + err_cause, osmo_hexdump((const unsigned char *) msgb_l2(msg), msgb_l2len(msg))); resp = tnp_ctrl_nack_alloc(iui, IUUP_PROC_INIT, err_cause, hdr->frame_nr); iui->transport_prim_cb(&resp->oph, iui->transport_prim_priv); return false; diff --git a/tests/iuup/iuup_test.c b/tests/iuup/iuup_test.c index 725a7d9..353c76a 100644 --- a/tests/iuup/iuup_test.c +++ b/tests/iuup/iuup_test.c @@ -31,6 +31,56 @@ .t_rc = { .t_ms = IUUP_TIMER_RC_T_DEFAULT, .n_max = IUUP_TIMER_RC_N_DEFAULT }, }; +/* Frame 46, "Initialization", SYS#5969 call4_Iu_Iuh.pcap + 1110 .... = PDU Type: Control Procedure (14) + .... 00.. = Ack/Nack: Procedure (0) + .... ..00 = Frame Number: 0 + 0000 .... = Mode Version: 0x0 + .... 0000 = Procedure: Initialization (0) + 1101 11.. = Header CRC: 0x37 [correct] + .... ..01 1011 0100 = Payload CRC: 0x1b4 + 000. .... = Spare: 0x0 + ...0 .... = TI: IPTIs not present (0) + .... 011. = Subflows: 3 + .... ...0 = Chain Indicator: this frame is the last frame for the procedure (0) + RFCI 1 Initialization + 0... .... = RFCI 0 LRI: Not last RFCI (0x0) + .0.. .... = RFCI 0 LI: one octet used (0x0) + ..00 0001 = RFCI 0: 1 + RFCI 0 Flow 0 Len: 81 + RFCI 0 Flow 1 Len: 103 + RFCI 0 Flow 2 Len: 60 + RFCI 6 Initialization + 1... .... = RFCI 1 LRI: Last RFCI in current frame (0x1) + .0.. .... = RFCI 1 LI: one octet used (0x0) + ..00 0110 = RFCI 1: 6 + RFCI 1 Flow 0 Len: 39 + RFCI 1 Flow 1 Len: 0 + RFCI 1 Flow 2 Len: 0 + Iu UP Mode Versions Supported: 0x0001 + 0... .... .... .... = Version 16: not supported (0x0) + .0.. .... .... .... = Version 15: not supported (0x0) + ..0. .... .... .... = Version 14: not supported (0x0) + ...0 .... .... .... = Version 13: not supported (0x0) + .... 0... .... .... = Version 12: not supported (0x0) + .... .0.. .... .... = Version 11: not supported (0x0) + .... ..0. .... .... = Version 10: not supported (0x0) + .... ...0 .... .... = Version 9: not supported (0x0) + .... .... 0... .... = Version 8: not supported (0x0) + .... .... .0.. .... = Version 7: not supported (0x0) + .... .... ..0. .... = Version 6: not supported (0x0) + .... .... ...0 .... = Version 5: not supported (0x0) + .... .... .... 0... = Version 4: not supported (0x0) + .... .... .... .0.. = Version 3: not supported (0x0) + .... .... .... ..0. = Version 2: not supported (0x0) + .... .... .... ...1 = Version 1: supported (0x1) + 0000 .... = RFCI Data Pdu Type: PDU type 0 (0x0) +*/ +const uint8_t iuup_initialization_no_iptis[] = { + 0xe0, 0x00, 0xdd, 0xb4, 0x06, 0x01, 0x51, 0x67, 0x3c, 0x86, 0x27, + 0x00, 0x00, 0x00, 0x01, 0x00 +}; + /* Frame 33, "Initialization", OS#4744 3g_call_23112021.pcapng IuUP 1110 .... = PDU Type: Control Procedure (14) @@ -665,56 +715,6 @@ struct iuup_pdutype14_hdr *hdr14; int rc; - /* Frame 46, "Initialization", SYS#5969 call4_Iu_Iuh.pcap - 1110 .... = PDU Type: Control Procedure (14) - .... 00.. = Ack/Nack: Procedure (0) - .... ..00 = Frame Number: 0 - 0000 .... = Mode Version: 0x0 - .... 0000 = Procedure: Initialization (0) - 1101 11.. = Header CRC: 0x37 [correct] - .... ..01 1011 0100 = Payload CRC: 0x1b4 - 000. .... = Spare: 0x0 - ...0 .... = TI: IPTIs not present (0) - .... 011. = Subflows: 3 - .... ...0 = Chain Indicator: this frame is the last frame for the procedure (0) - RFCI 1 Initialization - 0... .... = RFCI 0 LRI: Not last RFCI (0x0) - .0.. .... = RFCI 0 LI: one octet used (0x0) - ..00 0001 = RFCI 0: 1 - RFCI 0 Flow 0 Len: 81 - RFCI 0 Flow 1 Len: 103 - RFCI 0 Flow 2 Len: 60 - RFCI 6 Initialization - 1... .... = RFCI 1 LRI: Last RFCI in current frame (0x1) - .0.. .... = RFCI 1 LI: one octet used (0x0) - ..00 0110 = RFCI 1: 6 - RFCI 1 Flow 0 Len: 39 - RFCI 1 Flow 1 Len: 0 - RFCI 1 Flow 2 Len: 0 - Iu UP Mode Versions Supported: 0x0001 - 0... .... .... .... = Version 16: not supported (0x0) - .0.. .... .... .... = Version 15: not supported (0x0) - ..0. .... .... .... = Version 14: not supported (0x0) - ...0 .... .... .... = Version 13: not supported (0x0) - .... 0... .... .... = Version 12: not supported (0x0) - .... .0.. .... .... = Version 11: not supported (0x0) - .... ..0. .... .... = Version 10: not supported (0x0) - .... ...0 .... .... = Version 9: not supported (0x0) - .... .... 0... .... = Version 8: not supported (0x0) - .... .... .0.. .... = Version 7: not supported (0x0) - .... .... ..0. .... = Version 6: not supported (0x0) - .... .... ...0 .... = Version 5: not supported (0x0) - .... .... .... 0... = Version 4: not supported (0x0) - .... .... .... .0.. = Version 3: not supported (0x0) - .... .... .... ..0. = Version 2: not supported (0x0) - .... .... .... ...1 = Version 1: supported (0x1) - 0000 .... = RFCI Data Pdu Type: PDU type 0 (0x0) - */ - const uint8_t iuup_init[] = { - 0xe0, 0x00, 0xdd, 0xb4, 0x06, 0x01, 0x51, 0x67, 0x3c, 0x86, 0x27, - 0x00, 0x00, 0x00, 0x01, 0x00 - }; - iui = osmo_iuup_instance_alloc(iuup_test_ctx, __func__); OSMO_ASSERT(iui); osmo_iuup_instance_set_user_prim_cb(iui, _decode_passive_init_2_rfci_no_iptis_user_prim_cb, NULL); @@ -732,9 +732,9 @@ /* Send Init: */ tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE); - tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_init)); + tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_initialization_no_iptis)); hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg); - memcpy(hdr14, iuup_init, sizeof(iuup_init)); + memcpy(hdr14, iuup_initialization_no_iptis, sizeof(iuup_initialization_no_iptis)); rc = osmo_iuup_tnl_prim_up(iui, tnp); OSMO_ASSERT(rc == 0); @@ -742,6 +742,176 @@ osmo_iuup_instance_free(iui); } +static int _decode_passive_init_exp_nack_transport_prim_cb(struct osmo_prim_hdr *oph, void *ctx) +{ + struct osmo_iuup_tnl_prim *itp = (struct osmo_iuup_tnl_prim *)oph; + struct msgb *msg; + struct iuup_pdutype14_hdr *hdr; + + printf("%s()\n", __func__); + msg = oph->msg; + OSMO_ASSERT(OSMO_PRIM_HDR(&itp->oph) == OSMO_PRIM(OSMO_IUUP_TNL_UNITDATA, PRIM_OP_REQUEST)); + printf("Transport: DL len=%u: %s\n", msgb_l2len(msg), + osmo_hexdump((const unsigned char *) msgb_l2(msg), msgb_l2len(msg))); + hdr = msgb_l2(msg); + OSMO_ASSERT(hdr->pdu_type == IUUP_PDU_T_CONTROL); + OSMO_ASSERT(hdr->ack_nack == IUUP_AN_NACK); + msgb_free(msg); + return 0; +} +/* Send a malformed Initialization to UIT containing num_subflows_per_rfci = 0. + * It shall be rejected since num_subflows_per_rfci should be at least one accoridng to 3GPP TS 25.415 Figure 24 */ +void test_decode_passive_init_malformed_0subflows(void) +{ + /* Here we check the passive INIT code path, aka receiving INIT and returning INIT_ACK/NACK */ + struct osmo_iuup_instance *iui; + struct osmo_iuup_rnl_prim *rnp; + struct osmo_iuup_tnl_prim *tnp; + struct iuup_pdutype14_hdr *hdr14; + struct iuup_ctrl_init_hdr *ihdr; + uint16_t payload_crc; + int rc; + + iui = osmo_iuup_instance_alloc(iuup_test_ctx, __func__); + OSMO_ASSERT(iui); + osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL); + + clock_override_set(0, 0); + + /* Tx CONFIG.req */ + rnp = osmo_iuup_rnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, IUUP_MSGB_SIZE); + rnp->u.config = def_configure_req; + rnp->u.config.active = false; + + rc = osmo_iuup_rnl_prim_down(iui, rnp); + OSMO_ASSERT(rc == 0); + + /* Prepare and send Init: copy iuup_initialization_no_iptis, modify setting TI=1 (becoming malformed) and dispatch it. */ + tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE); + tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_initialization_no_iptis)); + hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg); + memcpy(hdr14, iuup_initialization_no_iptis, sizeof(iuup_initialization_no_iptis)); + + ihdr = (struct iuup_ctrl_init_hdr *)hdr14->payload; + ihdr->num_subflows_per_rfci = 0; + payload_crc = osmo_iuup_compute_payload_crc(msgb_l2(tnp->oph.msg), msgb_l2len(tnp->oph.msg)); + hdr14->payload_crc_hi = (payload_crc >> 8) & 0x03; + hdr14->payload_crc_lo = payload_crc & 0xff; + + rc = osmo_iuup_tnl_prim_up(iui, tnp); + OSMO_ASSERT(rc == 0); + + osmo_iuup_instance_free(iui); +} + +/* Send a malformed Initialization to UIT containing TI=1 and no IPTIs encoded. + * As a result, the msgb content is too short and should be rejected. */ +void test_decode_passive_init_malformed_ti1_no_iptis(void) +{ + /* Here we check the passive INIT code path, aka receiving INIT and returning INIT_ACK/NACK */ + struct osmo_iuup_instance *iui; + struct osmo_iuup_rnl_prim *rnp; + struct osmo_iuup_tnl_prim *tnp; + struct iuup_pdutype14_hdr *hdr14; + struct iuup_ctrl_init_hdr *ihdr; + uint16_t payload_crc; + int rc; + + iui = osmo_iuup_instance_alloc(iuup_test_ctx, __func__); + OSMO_ASSERT(iui); + osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL); + + clock_override_set(0, 0); + + /* Tx CONFIG.req */ + rnp = osmo_iuup_rnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, IUUP_MSGB_SIZE); + rnp->u.config = def_configure_req; + rnp->u.config.active = false; + + rc = osmo_iuup_rnl_prim_down(iui, rnp); + OSMO_ASSERT(rc == 0); + + /* Prepare and send Init: copy iuup_initialization_no_iptis, modify setting TI=1 (becoming malformed) and dispatch it. */ + tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE); + tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_initialization_no_iptis)); + hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg); + memcpy(hdr14, iuup_initialization_no_iptis, sizeof(iuup_initialization_no_iptis)); + + ihdr = (struct iuup_ctrl_init_hdr *)hdr14->payload; + ihdr->ti = 1; + payload_crc = osmo_iuup_compute_payload_crc(msgb_l2(tnp->oph.msg), msgb_l2len(tnp->oph.msg)); + hdr14->payload_crc_hi = (payload_crc >> 8) & 0x03; + hdr14->payload_crc_lo = payload_crc & 0xff; + + rc = osmo_iuup_tnl_prim_up(iui, tnp); + OSMO_ASSERT(rc == 0); + + osmo_iuup_instance_free(iui); +} + +/* Send a malformed Initialization to UIT containing no RFCIs. + * As a result, the msgb content is too short and should be rejected. */ +void _test_submit_iuup_initialization_trimmed(unsigned int pkt_len, const char *test_name) +{ + /* Here we check the passive INIT code path, aka receiving INIT and returning INIT_ACK/NACK */ + struct osmo_iuup_instance *iui; + struct osmo_iuup_rnl_prim *rnp; + struct osmo_iuup_tnl_prim *tnp; + struct iuup_pdutype14_hdr *hdr14; + uint16_t payload_crc; + int rc; + + OSMO_ASSERT(pkt_len <= sizeof(iuup_initialization_no_iptis)); + + iui = osmo_iuup_instance_alloc(iuup_test_ctx, test_name); + OSMO_ASSERT(iui); + osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL); + + /* Tx CONFIG.req */ + rnp = osmo_iuup_rnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, IUUP_MSGB_SIZE); + rnp->u.config = def_configure_req; + rnp->u.config.active = false; + + rc = osmo_iuup_rnl_prim_down(iui, rnp); + OSMO_ASSERT(rc == 0); + + /* Prepare and send Init: copy iuup_initialization_no_iptis, modify setting TI=1 (becoming malformed) and dispatch it. */ + tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE); + tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, pkt_len); + hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg); + memcpy(hdr14, iuup_initialization_no_iptis, pkt_len); + + payload_crc = osmo_iuup_compute_payload_crc(msgb_l2(tnp->oph.msg), msgb_l2len(tnp->oph.msg)); + hdr14->payload_crc_hi = (payload_crc >> 8) & 0x03; + hdr14->payload_crc_lo = payload_crc & 0xff; + + rc = osmo_iuup_tnl_prim_up(iui, tnp); + OSMO_ASSERT(rc == 0); + + osmo_iuup_instance_free(iui); +} +void test_decode_passive_init_malformed_no_rfci(void) +{ + unsigned int pkt_len = sizeof(struct iuup_pdutype14_hdr) + sizeof(struct iuup_ctrl_init_hdr); + clock_override_set(0, 0); + _test_submit_iuup_initialization_trimmed(pkt_len, __func__); +} + +/* Send a malformed Initialization to UIT containing malformed RFCIs. + * As a result, the msgb content is too short and should be rejected. */ +void test_decode_passive_init_malformed_rfci_too_short(void) +{ + unsigned int pkt_len = sizeof(struct iuup_pdutype14_hdr) + sizeof(struct iuup_ctrl_init_hdr) + 2; + clock_override_set(0, 0); + _test_submit_iuup_initialization_trimmed(pkt_len, __func__); +} + +void test_decode_passive_init_malformed_missing_last_byte(void) +{ + clock_override_set(0, 0); + _test_submit_iuup_initialization_trimmed(sizeof(iuup_initialization_no_iptis) - 1, __func__); +} + int main(int argc, char **argv) { iuup_test_ctx = talloc_named_const(NULL, 0, "iuup_test"); @@ -762,6 +932,11 @@ test_passive_init(); test_passive_init_retrans(); test_decode_passive_init_2_rfci_no_iptis(); + test_decode_passive_init_malformed_0subflows(); + test_decode_passive_init_malformed_ti1_no_iptis(); + test_decode_passive_init_malformed_no_rfci(); + test_decode_passive_init_malformed_rfci_too_short(); + test_decode_passive_init_malformed_missing_last_byte(); printf("OK.\n"); } diff --git a/tests/iuup/iuup_test.err b/tests/iuup/iuup_test.err index fe1ed397..0298420 100644 --- a/tests/iuup/iuup_test.err +++ b/tests/iuup/iuup_test.err @@ -53,3 +53,38 @@ DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){Initialisation}: Tx Initialization ACK DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){Initialisation}: state_chg to SMpSDU_Data_Transfer_Ready DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){SMpSDU_Data_Transfer_Ready}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Initialization: Unexpected num_subflows=0 received +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Tx Initialization NACK cause=20 orig_message=e0 00 dc 62 00 01 51 67 3c 86 27 00 00 00 01 00 +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Initialization: Malformed packet, length 16 too short +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 dc 06 16 01 51 67 3c 86 27 00 00 00 01 00 +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Initialization: Malformed packet, length 5 too short +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 dc cc 06 +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Initialization: Malformed packet, length 7 too short +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 df 7d 06 01 51 +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Initialization: Malformed packet, length 15 too short +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 df f7 06 01 51 67 3c 86 27 00 00 00 01 +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Deallocated diff --git a/tests/iuup/iuup_test.ok b/tests/iuup/iuup_test.ok index 57baba9..204c290 100644 --- a/tests/iuup/iuup_test.ok +++ b/tests/iuup/iuup_test.ok @@ -58,4 +58,19 @@ _decode_passive_init_2_rfci_no_iptis_user_prim_cb(): Initialization decoded fine! _decode_passive_init_2_rfci_no_iptis_transport_prim_cb() Transport: DL len=4: e4 00 24 00 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 50 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 20 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 20 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 20 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 20 OK. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43247?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Id0f7b0f63efc37376024359a3bf7fabbc40bc387 Gerrit-Change-Number: 43247 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-ttcn3-hacks[master]: SGP32Definitions_Templates: fix tr/ts_getBoundProfilePackageRequestEsipa
by dexter 14 Aug '26

14 Aug '26

dexter has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43224?usp=email ) Change subject: SGP32Definitions_Templates: fix tr/ts_getBoundProfilePackageRequestEsipa ...................................................................... SGP32Definitions_Templates: fix tr/ts_getBoundProfilePackageRequestEsipa The templates transactionId parameter on the templates tr/ts_getBoundProfilePackageRequestEsipa is not used. In the templates itself the related member is still populated with constants. Change-Id: I6de1272ca22e31b906a49ce532066b76d2a80ad1 Related: SYS#8100 --- M library/euicc/SGP32Definitions_Templates.ttcn 1 file changed, 3 insertions(+), 3 deletions(-) Approvals: jolly: Looks good to me, approved Jenkins Builder: Verified diff --git a/library/euicc/SGP32Definitions_Templates.ttcn b/library/euicc/SGP32Definitions_Templates.ttcn index be715b6..eccaee0 100644 --- a/library/euicc/SGP32Definitions_Templates.ttcn +++ b/library/euicc/SGP32Definitions_Templates.ttcn @@ -744,10 +744,10 @@ downloadResponseOk := ts_prepareDownloadResponseOk } template (present) EsipaMessageFromIpaToEim -tr_getBoundProfilePackageRequestEsipa(template (present) octetstring transactionId := 'ABCDEF'O, +tr_getBoundProfilePackageRequestEsipa(template (present) octetstring transactionId := ?, template (present) SGP32_PrepareDownloadResponse prepareDownloadResponse := tr_SGP32_prepareDownloadResponse) := { getBoundProfilePackageRequestEsipa := { - transactionId := ?, + transactionId := transactionId, prepareDownloadResponse := prepareDownloadResponse } } @@ -755,7 +755,7 @@ ts_getBoundProfilePackageRequestEsipa(template (value) octetstring transactionId := 'ABCDEF'O, template (value) SGP32_PrepareDownloadResponse prepareDownloadResponse := ts_SGP32_prepareDownloadResponse) := { getBoundProfilePackageRequestEsipa := { - transactionId := 'ABCDEF'O, + transactionId := transactionId, prepareDownloadResponse := prepareDownloadResponse } } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43224?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I6de1272ca22e31b906a49ce532066b76d2a80ad1 Gerrit-Change-Number: 43224 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu>

1 0

[S] Change in osmo-msc[master]: sgs_iface: clean up code in function decode_mme_name
by dexter 14 Aug '26

14 Aug '26

Attention is currently required from: laforge, pespin. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email ) Change subject: sgs_iface: clean up code in function decode_mme_name ...................................................................... Patch Set 4: (1 comment) File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43237/comment/d781c035_76a40063?usp… : PS2, Line 204: OSMO_ASSERT(osmo_parse_mme_domain(&gummei, mme_fqdn) == 0); > As it seems it gets even more problematic here: Let's assume we have called decode_mme_name before w […] Ah, no. Looks like a made a thinking mistake here. Let's forget about this. -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9aec8300f15264b68ac8e7805e93e621b12cafb2 Gerrit-Change-Number: 43237 Gerrit-PatchSet: 4 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:48:13 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in osmo-msc[master]: sgs_iface: clean up code in function decode_mme_name
by dexter 14 Aug '26

14 Aug '26

Attention is currently required from: laforge, pespin. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email ) Change subject: sgs_iface: clean up code in function decode_mme_name ...................................................................... Patch Set 4: (2 comments) File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43237/comment/c6388a77_7018663e?usp… : PS2, Line 178: > the questions is what such proprietary formats are, how they look like, used by whom, and why there […] We do try to parse it again (see below). We also use it to extract the gummei but as it seems the result is only used to name an FSM. The mme_fqdn is also used in the VLR. It is probably difficult to trace if it is really safe to use an arbitrary string as MME name. https://gerrit.osmocom.org/c/osmo-msc/+/43237/comment/e01fb919_6e4be4c2?usp… : PS2, Line 204: OSMO_ASSERT(osmo_parse_mme_domain(&gummei, mme_fqdn) == 0); As it seems it gets even more problematic here: Let's assume we have called decode_mme_name before with a SGSAP_IE_MME_NAME that was not acceted by osmo_parse_mme_domain, so we took the memcpy path and just copied the value. Now we call sgs_mme_fqdn_received here with that value. Since the value didn't change, osmo_parse_mme_domain will reject it and the OSMO_ASSERT will crash the MSC. The OSMO_ASSERT was introduced with: ``` commit 0df904dea9106587f40ec379e9cc05ea251beb7e Author: Harald Welte <laforge(a)gnumonks.org> Date: Mon Dec 3 11:00:04 2018 +0100 ``` This is much earlier than: ``` commit e2bd9eb37d8160b436a5a1bffc14690321f40ae6 Author: Omar Ramadan <omar.ramadan93(a)gmail.com> Date: Fri Apr 12 09:03:39 2019 -0700 ``` So from what I can see the alternate path was never actively used, as it would have crashed the MSC. If this is true I would see that as an argument for removing the alternate path altogether as it has never worked. -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9aec8300f15264b68ac8e7805e93e621b12cafb2 Gerrit-Change-Number: 43237 Gerrit-PatchSet: 4 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:44:57 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in osmo-ci[master]: contrib/jenkins: add script for running pytest
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: osmith. laforge has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ci/+/43242?usp=email ) Change subject: contrib/jenkins: add script for running pytest ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43242?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: Iaec67a252fca8f1978d1465f3ce3e1d4c9415a9b Gerrit-Change-Number: 43242 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:08:07 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ci[master]: tests: add test_gerrit_verifications
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: osmith. laforge has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ci/+/43241?usp=email ) Change subject: tests: add test_gerrit_verifications ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43241?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I6139e0385470e4c0c48d8a698f67645ac1605cbc Gerrit-Change-Number: 43241 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:07:51 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ci[master]: scripts/update-osmo-ci: rename from contrib/jenkins.sh
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: osmith. laforge has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ci/+/43240?usp=email ) Change subject: scripts/update-osmo-ci: rename from contrib/jenkins.sh ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43240?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: Ie9793663aa9b60683fc78c738b550913e8f01fbb Gerrit-Change-Number: 43240 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:07:35 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ci[master]: jobs/gerrit-verifications: support up to 5 distros
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria, osmith, pespin. laforge has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ci/+/43239?usp=email ) Change subject: jobs/gerrit-verifications: support up to 5 distros ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43239?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I9fd3c90cee659706a53e81244f3324d0e9940069 Gerrit-Change-Number: 43239 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:07:08 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ttcn3-hacks[master]: deps/Makefile: eclipse gitlab -> osmocom mirror
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria, osmith, pespin. laforge has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43245?usp=email ) Change subject: deps/Makefile: eclipse gitlab -> osmocom mirror ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43245?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ica33853154438a81a42196e9bfefac98764cbf18 Gerrit-Change-Number: 43245 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:06:32 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026