August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in osmo-remsim[master]: cosmetic: fix missing space
by lynxis lazus 21 Aug '26

21 Aug '26

lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-remsim/+/43353?usp=email ) Change subject: cosmetic: fix missing space ...................................................................... cosmetic: fix missing space Change-Id: Ia83c96e5e39431dedfa64444290f1b7b816ce540 --- M src/client/remsim_client_main.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/osmo-remsim refs/changes/53/43353/1 diff --git a/src/client/remsim_client_main.c b/src/client/remsim_client_main.c index 76e79d9..16e2dd7 100644 --- a/src/client/remsim_client_main.c +++ b/src/client/remsim_client_main.c @@ -214,7 +214,7 @@ OSMO_ASSERT(cfg); handle_options(cfg, argc, argv); - g_client = remsim_client_create(g_tall_ctx, hostname, "remsim-client",cfg); + g_client = remsim_client_create(g_tall_ctx, hostname, "remsim-client", cfg); osmo_fsm_inst_dispatch(g_client->srv_conn.fi, SRVC_E_ESTABLISH, NULL); -- To view, visit https://gerrit.osmocom.org/c/osmo-remsim/+/43353?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-remsim Gerrit-Branch: master Gerrit-Change-Id: Ia83c96e5e39431dedfa64444290f1b7b816ce540 Gerrit-Change-Number: 43353 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>

1 0

[XS] Change in osmo-remsim[master]: client: simtrace2: Use the new API osmo_apdu_segment_in2()
by lynxis lazus 21 Aug '26

21 Aug '26

lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-remsim/+/43351?usp=email ) Change subject: client: simtrace2: Use the new API osmo_apdu_segment_in2() ...................................................................... client: simtrace2: Use the new API osmo_apdu_segment_in2() The old osmo_apdu_segment_in() could not parse GP GET DATA correctly and will fail when parsing a GP GET DATA case 2 with an Le != 0. Related: SYS#8147 Change-Id: I432c96c8cdbcb78bc3e4f135ebd51c4077aa9007 --- M src/client/user_simtrace2.c 1 file changed, 3 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-remsim refs/changes/51/43351/1 diff --git a/src/client/user_simtrace2.c b/src/client/user_simtrace2.c index 2535efb..0abd268 100644 --- a/src/client/user_simtrace2.c +++ b/src/client/user_simtrace2.c @@ -82,7 +82,7 @@ return 0; } -static struct osmo_apdu_context ac; // this will hold the complete APDU (across calls) +static struct osmo_apdu_context ac, prev_ac; // this will hold the complete APDU and previous APDU (across calls) /*! \brief Process a RX-DATA indication message from the SIMtrace2 */ static int process_do_rx_da(struct osmo_st2_cardem_inst *ci, uint8_t *buf, int len) @@ -96,8 +96,8 @@ osmo_hexdump(data->data, data->data_len)); /* parse the APDU data in the USB message */ - rc = osmo_apdu_segment_in(&ac, data->data, data->data_len, - data->flags & CEMU_DATA_F_TPDU_HDR); + rc = osmo_apdu_segment_in2(&ac, &prev_ac, data->data, data->data_len, + data->flags & CEMU_DATA_F_TPDU_HDR); if (rc & APDU_ACT_TX_CAPDU_TO_CARD) { /* there is no pending data coming from the modem */ -- To view, visit https://gerrit.osmocom.org/c/osmo-remsim/+/43351?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-remsim Gerrit-Branch: master Gerrit-Change-Id: I432c96c8cdbcb78bc3e4f135ebd51c4077aa9007 Gerrit-Change-Number: 43351 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>

1 0

[XS] Change in simtrace2[master]: simtrace2-cardem-pcsc: use new API osmo_apdu_segment_in2() to fix GP ...
by lynxis lazus 21 Aug '26

21 Aug '26

lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/simtrace2/+/43350?usp=email ) Change subject: simtrace2-cardem-pcsc: use new API osmo_apdu_segment_in2() to fix GP GET DATA ...................................................................... simtrace2-cardem-pcsc: use new API osmo_apdu_segment_in2() to fix GP GET DATA The old osmo_apdu_segment_in() could not parse GP GET DATA correctly and will fail when parsing a GP GET DATA case 2 with an Le != 0. Related: SYS#8147 Change-Id: Id5642cb76da4fcbcdd318d41691415781bf0bc50 --- M host/src/simtrace2-cardem-pcsc.c 1 file changed, 3 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/simtrace2 refs/changes/50/43350/1 diff --git a/host/src/simtrace2-cardem-pcsc.c b/host/src/simtrace2-cardem-pcsc.c index f26698e..1f5c46d 100644 --- a/host/src/simtrace2-cardem-pcsc.c +++ b/host/src/simtrace2-cardem-pcsc.c @@ -159,7 +159,7 @@ /*! \brief Process a RX-DATA indication message from the SIMtrace2 */ static int process_do_rx_da(struct osmo_st2_cardem_inst *ci, uint8_t *buf, int len) { - static struct osmo_apdu_context ac; + static struct osmo_apdu_context ac, prev_ac; struct cardemu_usb_msg_rx_data *data; int rc; @@ -168,8 +168,8 @@ LOGCI(ci, LOGL_INFO, "=> DATA: flags=0x%02x (%s), %s\n ", data->flags, cemu_data_flags2str(data->flags), osmo_hexdump(data->data, data->data_len)); - rc = osmo_apdu_segment_in(&ac, data->data, data->data_len, - data->flags & CEMU_DATA_F_TPDU_HDR); + rc = osmo_apdu_segment_in2(&ac, &prev_ac, data->data, data->data_len, + data->flags & CEMU_DATA_F_TPDU_HDR); if (rc < 0) { /* At this point the communication is broken. We cannot keep running, as we * don't know if we should continue transmitting or receiving. Only a successful -- To view, visit https://gerrit.osmocom.org/c/simtrace2/+/43350?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: simtrace2 Gerrit-Branch: master Gerrit-Change-Id: Id5642cb76da4fcbcdd318d41691415781bf0bc50 Gerrit-Change-Number: 43350 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>

1 0

[M] Change in osmo-ttcn3-hacks[master]: hnbgw: Move generic PFCP ConnHdlr helpers to library/PFCP_Emulation.ttcn
by fixeria 21 Aug '26

21 Aug '26

Attention is currently required from: pespin. fixeria has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43299?usp=email ) Change subject: hnbgw: Move generic PFCP ConnHdlr helpers to library/PFCP_Emulation.ttcn ...................................................................... Patch Set 3: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43299?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ic40bea51934ad465a68e0d5690de066cbe1dc57d Gerrit-Change-Number: 43299 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 20 Aug 2026 14:51:42 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ttcn3-hacks[master]: hnbgw: Send correct recovery timestamp in PFCP Assoc Setup Resp
by fixeria 21 Aug '26

21 Aug '26

Attention is currently required from: pespin. fixeria has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43298?usp=email ) Change subject: hnbgw: Send correct recovery timestamp in PFCP Assoc Setup Resp ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43298?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: If57d58edbb4f4da529c6c189a84c25b153ac3326 Gerrit-Change-Number: 43298 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 20 Aug 2026 14:50:29 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ttcn3-hacks[master]: pgw: Move generic helper find_teid to library/
by fixeria 21 Aug '26

21 Aug '26

Attention is currently required from: osmith, pespin. fixeria has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43297?usp=email ) Change subject: pgw: Move generic helper find_teid to library/ ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43297?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I7dc56e2462436edc058da72dff3dded6569a5e95 Gerrit-Change-Number: 43297 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 20 Aug 2026 14:49:49 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: sua: refactor sua_parse_gt() digit loop
by laforge 21 Aug '26

21 Aug '26

Attention is currently required from: fixeria. laforge has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43348?usp=email ) Change subject: sua: refactor sua_parse_gt() digit loop ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43348?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I39c1e8acbec371a27c7871799619695d77b4d61e Gerrit-Change-Number: 43348 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 20 Aug 2026 14:46:58 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: sua: sua_parse_gt(): reject GT with num_digits exceeding blob length
by laforge 21 Aug '26

21 Aug '26

Attention is currently required from: fixeria. laforge has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43349?usp=email ) Change subject: sua: sua_parse_gt(): reject GT with num_digits exceeding blob length ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43349?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I918278b6471bc78511bf97a292204e6719d4031a Gerrit-Change-Number: 43349 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-CC: Jenkins Builder Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 20 Aug 2026 14:46:26 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-bsc[master]: OM2K: Check bounds of OM2K Negotiation Request
by laforge 21 Aug '26

21 Aug '26

Attention is currently required from: jolly. laforge has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-bsc/+/43293?usp=email ) Change subject: OM2K: Check bounds of OM2K Negotiation Request ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/43293?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I2de0db1b717a97ab07964d49509a8242c7e4c3ed Gerrit-Change-Number: 43293 Gerrit-PatchSet: 1 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Thu, 20 Aug 2026 14:45:43 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: sua: sua_parse_gt(): reject GT with num_digits exceeding blob length
by fixeria 21 Aug '26

21 Aug '26

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43349?usp=email ) Change subject: sua: sua_parse_gt(): reject GT with num_digits exceeding blob length ...................................................................... sua: sua_parse_gt(): reject GT with num_digits exceeding blob length The digit-parsing loop only clamped num_digits against the capacity of gt->digits[], but never validated it against the actual length of the given input. A blob claiming more digits than it carries was silently truncated to whatever data happened to be available, without any error indication to the caller. Add an explicit check of num_digits against datalen before the parsing loop, alongside the existing gt->digits[] capacity check. This keeps the loop body free of per-iteration bounds checks, and reports -EINVAL to the caller for such malformed input. Change-Id: I918278b6471bc78511bf97a292204e6719d4031a Related: OS#7046 --- M src/sua.c M tests/xua/xua_test.c M tests/xua/xua_test.ok 3 files changed, 34 insertions(+), 6 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/49/43349/1 diff --git a/src/sua.c b/src/sua.c index 7c6d57f..be18d5c 100644 --- a/src/sua.c +++ b/src/sua.c @@ -412,16 +412,20 @@ rc = -ENOSPC; } - /* parse digits: bounded by num_digits (already clamped above), so this - * can never write more than sizeof(gt->digits)-1 nibbles into gt->digits[] */ + /* claimed num_digits must fit into the remaining input octets */ + if (num_digits > (datalen - 8) * 2) { + /* Parse as much as we can; return -EINVAL */ + num_digits = (datalen - 8) * 2; + rc = -EINVAL; + } + + /* parse digits: bounded by num_digits + * (already clamped above to fit both gt->digits[] and the input data) */ out_digits = gt->digits; for (i = 0; i < num_digits; i++) { unsigned int byte_off = 8 + i / 2; - uint8_t byte; + uint8_t byte = data[byte_off]; - if (byte_off >= datalen) - break; - byte = data[byte_off]; if (i & 1) *out_digits++ = osmo_bcd2char(byte >> 4); else diff --git a/tests/xua/xua_test.c b/tests/xua/xua_test.c index dcd2089..76fe9db 100644 --- a/tests/xua/xua_test.c +++ b/tests/xua/xua_test.c @@ -397,6 +397,27 @@ printf("OUT:%s\n", osmo_sccp_gt_dump(&gt)); } +static void test_sua_parse_gt_truncated(void) +{ + /* 8-byte header + only 2 digit octets (4 digits worth of data) */ + uint8_t data[8 + 2]; + struct osmo_sccp_gt gt = {}; + + memset(data, 0x11, sizeof(data)); + data[3] = 0x42; /* gti */ + data[5] = 0x00; /* tt */ + data[6] = 0x01; /* npi */ + data[7] = 0x04; /* nai */ + + /* num_digits fits into gt->digits[], but claims more digits than the + * given blob actually carries */ + data[4] = 10; + printf("Testing sua_parse_gt() with num_digits=%u, datalen=%zu\n", data[4], sizeof(data)); + OSMO_ASSERT(sua_parse_gt(&gt, data, sizeof(data)) == -EINVAL); + OSMO_ASSERT(strlen(gt.digits) == (sizeof(data) - 8) * 2); + printf("OUT:%s\n", osmo_sccp_gt_dump(&gt)); +} + /* SCCP Message Transcoding */ struct sccp2sua_testcase { @@ -705,6 +726,7 @@ test_sccp_addr_parser(); test_helpers(); test_sua_parse_gt_overflow(); + test_sua_parse_gt_truncated(); test_sccp2sua(); test_rkm(); test_sccp_addr_encdec(); diff --git a/tests/xua/xua_test.ok b/tests/xua/xua_test.ok index f6f30d6..b3bc8e3 100644 --- a/tests/xua/xua_test.ok +++ b/tests/xua/xua_test.ok @@ -20,6 +20,8 @@ OUT:DIG=1111111111111111111111111111111 Testing sua_parse_gt() with num_digits=255 OUT:DIG=1111111111111111111111111111111 +Testing sua_parse_gt() with num_digits=10, datalen=10 +OUT:DIG=1111 => BSSMAP-RESET SCCP Input: [L2]> 09 00 03 05 07 02 42 fe 02 42 fe 06 00 04 30 04 01 20 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43349?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I918278b6471bc78511bf97a292204e6719d4031a Gerrit-Change-Number: 43349 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026