August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by laforge 10 Aug '26

10 Aug '26

Attention is currently required from: n0k0. laforge has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email ) Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... Patch Set 5: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 5 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Mon, 10 Aug 2026 06:21:25 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-bsc[master]: ipaccess-proxy: reject short IPA header
by fixeria 09 Aug '26

09 Aug '26

Attention is currently required from: n0k0. fixeria has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email ) Change subject: ipaccess-proxy: reject short IPA header ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b Gerrit-Change-Number: 43188 Gerrit-PatchSet: 2 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Sun, 09 Aug 2026 15:21:38 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by fixeria 09 Aug '26

09 Aug '26

Attention is currently required from: n0k0. fixeria has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email ) Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... Patch Set 5: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 5 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Sun, 09 Aug 2026 15:20:33 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ggsn[master]: gtp: clamp GSN-Address copy to sockaddr_in size
by lynxis lazus 08 Aug '26

08 Aug '26

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ggsn/+/43187?usp=email ) Change subject: gtp: clamp GSN-Address copy to sockaddr_in size ...................................................................... gtp: clamp GSN-Address copy to sockaddr_in size gtp_data_req() builds an IPv4 destination sockaddr_in and does memcpy(&addr.sin_addr, pdp->gsnru.v, pdp->gsnru.l); gtp_gpdu_ind() checks the GPDU source with memcmp(&peer->sin_addr, pdp->gsnru.v, pdp->gsnru.l). Both use the wire GSN-Address length as the count into the 4-byte sin_addr, so a GSN-Address longer than 4 bytes (e.g. a 16-byte IPv6 address) writes up to 4 bytes past the sockaddr_in on the stack, or reads up to 12 bytes past sin_addr. Both sites already carried a 'TODO range check' comment. This is the AF_INET user-plane path, where the GSN address is a 4-byte IPv4 address, so copy and compare exactly sizeof(sin_addr) bytes. Change-Id: If49f1929645c0ba8d19f3c9aa95f57d0a432ad53 --- M gtp/gtp.c 1 file changed, 8 insertions(+), 2 deletions(-) Approvals: pespin: Looks good to me, but someone else must approve lynxis lazus: Looks good to me, approved Jenkins Builder: Verified diff --git a/gtp/gtp.c b/gtp/gtp.c index fa65575..7a439d9 100644 --- a/gtp/gtp.c +++ b/gtp/gtp.c @@ -3280,7 +3280,10 @@ } /* If the GPDU was not from the peer GSN tell him to delete context */ - if (memcmp(&peer->sin_addr, pdp->gsnru.v, pdp->gsnru.l)) { /* TODO Range? */ + /* Compare only the IPv4 address bytes; peer->sin_addr is 4 bytes, so + * bound the compare to sizeof(sin_addr) rather than the (attacker-influenced) + * gsnru length to avoid reading past sin_addr. */ + if (memcmp(&peer->sin_addr, pdp->gsnru.v, sizeof(peer->sin_addr))) { rate_ctr_inc2(gsn->ctrg, GSN_CTR_ERR_UNKNOWN_PDP); GTP_LOGPKG(LOGL_ERROR, peer, pack, len, "Unknown GSN peer %s\n", inet_ntoa(peer->sin_addr)); return gtp_error_ind_resp(gsn, version, peer, fd, pack, len); @@ -3778,7 +3781,10 @@ #if defined(__FreeBSD__) || defined(__APPLE__) addr.sin_len = sizeof(addr); #endif - memcpy(&addr.sin_addr, pdp->gsnru.v, pdp->gsnru.l); /* TODO range check */ + /* gsnru is the IPv4 GSN user-plane address for this AF_INET path; copy + * exactly sizeof(sin_addr) bytes so an over-long (e.g. 16-byte IPv6) + * address cannot write past addr on the stack. */ + memcpy(&addr.sin_addr, pdp->gsnru.v, sizeof(addr.sin_addr)); /* prepare msghdr */ memset(&msgh, 0, sizeof(msgh)); -- To view, visit https://gerrit.osmocom.org/c/osmo-ggsn/+/43187?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ggsn Gerrit-Branch: master Gerrit-Change-Id: If49f1929645c0ba8d19f3c9aa95f57d0a432ad53 Gerrit-Change-Number: 43187 Gerrit-PatchSet: 1 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-ggsn[master]: gtp: clamp GSN-Address copy to sockaddr_in size
by lynxis lazus 08 Aug '26

08 Aug '26

Attention is currently required from: n0k0. lynxis lazus has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-ggsn/+/43187?usp=email ) Change subject: gtp: clamp GSN-Address copy to sockaddr_in size ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ggsn/+/43187?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ggsn Gerrit-Branch: master Gerrit-Change-Id: If49f1929645c0ba8d19f3c9aa95f57d0a432ad53 Gerrit-Change-Number: 43187 Gerrit-PatchSet: 1 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Sat, 08 Aug 2026 20:28:12 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in pysim[master]: ts_31_102: EF SUCI_Calc_Info: fix decoding empty files
by lynxis lazus 08 Aug '26

08 Aug '26

Attention is currently required from: laforge. Hello Jenkins Builder, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/41581?usp=email to look at the new patch set (#3). Change subject: ts_31_102: EF SUCI_Calc_Info: fix decoding empty files ...................................................................... ts_31_102: EF SUCI_Calc_Info: fix decoding empty files When trying to use `edit_binary_decoded` with an empty file, pysim runs into a len(None) exception, because hpkl.to_dict()['hnet_pubkey_list'] returns None. Can reproduced with a CCC Camp 2023 usim and editing the file. a000ff..ff (len = 200) Co-authored-by: Harald Welte <laforge(a)osmocom.org> Change-Id: Ib8e322e65dd768bfd49e7a5620a2163f12a74ec7 --- M pySim/ts_31_102.py 1 file changed, 9 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/81/41581/3 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/41581?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ib8e322e65dd768bfd49e7a5620a2163f12a74ec7 Gerrit-Change-Number: 41581 Gerrit-PatchSet: 3 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: laforge <laforge(a)osmocom.org>

1 0

[XS] Change in docker-playground[master]: osmo-stp: add support for tcap-loadsharing
by lynxis lazus 08 Aug '26

08 Aug '26

lynxis lazus has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/docker-playground/+/41390?usp=email ) The change is no longer submittable: Code-Review is unsatisfied now. Change subject: osmo-stp: add support for tcap-loadsharing ...................................................................... Patch Set 1: Code-Review-2 (1 comment) Patchset: PS1: Need to check if we want to have it on fedora. -- To view, visit https://gerrit.osmocom.org/c/docker-playground/+/41390?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: docker-playground Gerrit-Branch: master Gerrit-Change-Id: Ib58f07d28a38109b4dd053479ddbdb1937eda64e Gerrit-Change-Number: 41390 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-CC: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Sat, 08 Aug 2026 17:23:30 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[XS] Change in pysim[master]: ts_31_102: EF SUCI_Calc_Info: fix decoding empty files
by lynxis lazus 08 Aug '26

08 Aug '26

Attention is currently required from: laforge. lynxis lazus has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/pysim/+/41581?usp=email ) Change subject: ts_31_102: EF SUCI_Calc_Info: fix decoding empty files ...................................................................... Patch Set 1: (1 comment) File pySim/ts_31_102.py: https://gerrit.osmocom.org/c/pysim/+/41581/comment/98db3acd_f35ebf37?usp=em… : PS1, Line 392: hnet_pubkey_list = self._compact_pubkey_list(hpkl.to_dict()['hnet_pubkey_list']) > wouldn't something more compact work without interrupting the cotrol flow of the source / indent / . […] Acknowledged -- To view, visit https://gerrit.osmocom.org/c/pysim/+/41581?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ib8e322e65dd768bfd49e7a5620a2163f12a74ec7 Gerrit-Change-Number: 41581 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Comment-Date: Sat, 08 Aug 2026 17:19:34 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org>

1 0

[XS] Change in pysim[master]: ts_31_102: EF SUCI_Calc_Info: fix decoding empty files
by lynxis lazus 08 Aug '26

08 Aug '26

Attention is currently required from: laforge, lynxis lazus. Hello Jenkins Builder, laforge, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/41581?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Code-Review+1 by laforge, Verified+1 by Jenkins Builder Change subject: ts_31_102: EF SUCI_Calc_Info: fix decoding empty files ...................................................................... ts_31_102: EF SUCI_Calc_Info: fix decoding empty files When trying to use `edit_binary_decoded` with an empty file, pysim runs into a len(None) exception, because hpkl.to_dict()['hnet_pubkey_list'] returns None. Can reproduced with a CCC Camp 2023 usim and editing the file. a000ff..ff (len = 200) Co-authored-by: Harald Welte <laforge(a)osmocom.org> Change-Id: Ib8e322e65dd768bfd49e7a5620a2163f12a74ec7 --- M pySim/ts_31_102.py 1 file changed, 4 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/81/41581/2 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/41581?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ib8e322e65dd768bfd49e7a5620a2163f12a74ec7 Gerrit-Change-Number: 41581 Gerrit-PatchSet: 2 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>

1 0

[XS] Change in pysim[master]: pySim/global_platform: replace deprecated argument group() creation
by lynxis lazus 08 Aug '26

08 Aug '26

lynxis lazus has abandoned this change. ( https://gerrit.osmocom.org/c/pysim/+/42066?usp=email ) Change subject: pySim/global_platform: replace deprecated argument group() creation ...................................................................... Abandoned master already implemented a similar patch -- To view, visit https://gerrit.osmocom.org/c/pysim/+/42066?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: abandon Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I4f73d3417a12b7fe94e33a265cdae244f3c9a1e9 Gerrit-Change-Number: 42066 Gerrit-PatchSet: 3 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: laforge <laforge(a)osmocom.org> Gerrit-CC: osmith <osmith(a)sysmocom.de>

1 0