Attention is currently required from: laforge, lynxis lazus.
Hello Jenkins Builder, laforge,
I'd like you to reexamine a change. Please visit
https://gerrit.osmocom.org/c/osmo-remsim/+/43347?usp=email
to look at the new patch set (#2).
The following approvals got outdated and were removed:
Code-Review+1 by laforge, Verified+1 by Jenkins Builder
Change subject: remsim_client: only set usb parameters if given by arguments
......................................................................
remsim_client: only set usb parameters if given by arguments
When calling osmo-remsim-client-st2 without setting the usb address (-A),
previous libusb_claim_interface() was called with an usb address of 255,
which is not valid on usb.
Only set arguments to libusb_claim_interface() when given.
Change-Id: I30f27b166db72fa8796aa4da98f9fc01e348c87a
---
M src/client/user_simtrace2.c
1 file changed, 12 insertions(+), 6 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-remsim refs/changes/47/43347/2
--
To view, visit https://gerrit.osmocom.org/c/osmo-remsim/+/43347?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newpatchset
Gerrit-Project: osmo-remsim
Gerrit-Branch: master
Gerrit-Change-Id: I30f27b166db72fa8796aa4da98f9fc01e348c87a
Gerrit-Change-Number: 43347
Gerrit-PatchSet: 2
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>
pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/43342?usp=email )
Change subject: ranap: Avoid write buffer overflow on GTPv1U outter IPv6 addr
......................................................................
ranap: Avoid write buffer overflow on GTPv1U outter IPv6 addr
If an IPv6 address was passed by libgtp in pdp->lib->gsnru,
sgsn_pdp_ctx_iu_rab_activate() would write 16 bytes to an uint32_t
variable, overflowing it and writing further on the stack.
The proper extended fix can be found in osmo-sgsn.git master branch
commit 6fd7c8b7fb0be7f96de7e7c5b4d22c54642f383a, this is a "backport" for
it fixing the security issue (write buffer overflow) in a simple way,
since the code has changed quite a lot in master.
Change-Id: Id521fbc904f847952736e8d63f77a616f1f8e838
Related: OS#7060
Reported-By: Adam Bedard <adam.bedard(a)gmail.com>
---
M src/sgsn/gprs_ranap.c
1 file changed, 5 insertions(+), 0 deletions(-)
Approvals:
Jenkins Builder: Verified
osmith: Looks good to me, approved
diff --git a/src/sgsn/gprs_ranap.c b/src/sgsn/gprs_ranap.c
index 2ad663e..6f82850 100644
--- a/src/sgsn/gprs_ranap.c
+++ b/src/sgsn/gprs_ranap.c
@@ -236,6 +236,11 @@
use_x213_nsap = (uectx->rab_assign_addr_enc == RANAP_NSAP_ADDR_ENC_X213);
/* Get the IP address for ggsn user plane */
+ if (pdp->lib->gsnru.l != sizeof(ggsn_ip)) {
+ LOGPDPCTXP(LOGL_ERROR, pdp, "GSN-U address length %u unsupported\n",
+ pdp->lib->gsnru.l);
+ return -EINVAL;
+ }
memcpy(&ggsn_ip, pdp->lib->gsnru.v, pdp->lib->gsnru.l);
ggsn_ip = htonl(ggsn_ip);
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43342?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-sgsn
Gerrit-Branch: pespin/rel-1.13.1
Gerrit-Change-Id: Id521fbc904f847952736e8d63f77a616f1f8e838
Gerrit-Change-Number: 43342
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/43339?usp=email )
Change subject: gprs_sm: gsm48_tx_gsm_act_pdp_acc(): fix QoS profile length
......................................................................
gprs_sm: gsm48_tx_gsm_act_pdp_acc(): fix QoS profile length
The Activate PDP Context Accept was always sending sizeof(default_qos)
(14 bytes) as the QoS profile length, regardless of what the UE
requested. Older modules such as the Air20X may crash and restart
during PDP attachment because of that.
In GTP, qos_req.l encodes 1 ARP byte followed by the QoS profile
octets, so (qos_req.l - 1) is the actual profile length. Mirror
back the same QoS profile length the UE sent in its request,
capped at sizeof(default_qos) to avoid overrunning the default_qos
buffer. This matters in particular for R97/R98 UEs that send a
3-byte QoS profile and should not receive a 14-byte response.
Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
Related: OS#6922
(cherry picked from commit c1cf2817a3a0680ac6b69d40b134f881a314c7f0)
---
M src/sgsn/gprs_sm.c
1 file changed, 10 insertions(+), 1 deletion(-)
Approvals:
osmith: Looks good to me, approved
Jenkins Builder: Verified
diff --git a/src/sgsn/gprs_sm.c b/src/sgsn/gprs_sm.c
index bcf2923..4f55b57 100644
--- a/src/sgsn/gprs_sm.c
+++ b/src/sgsn/gprs_sm.c
@@ -206,7 +206,16 @@
/* FIXME: copy QoS parameters from original request */
//msgb_lv_put(msg, pdp->lib->qos_neg.l, pdp->lib->qos_neg.v);
- msgb_lv_put(msg, sizeof(default_qos), (uint8_t *)&default_qos);
+
+ /* qos_req.l is encoded as 1 (ARP byte) + N QoS profile bytes in GTP.
+ * Mirror back the same QoS profile length the UE requested, capped at
+ * sizeof(default_qos) (14 bytes, covering up to R99/R7 QoS format). */
+ uint8_t qos_len = sizeof(default_qos);
+ if (pdp->lib->qos_req.l > 1)
+ qos_len = pdp->lib->qos_req.l - 1;
+ if (qos_len > sizeof(default_qos))
+ qos_len = sizeof(default_qos);
+ msgb_lv_put(msg, qos_len, (uint8_t *)&default_qos);
/* Radio priority 10.5.7.2 */
msgb_v_put(msg, pdp->lib->radio_pri);
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43339?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-sgsn
Gerrit-Branch: pespin/rel-1.13.1
Gerrit-Change-Id: I11c24b64f0e49cf80c825969dbf018b2948d855c
Gerrit-Change-Number: 43339
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Gerrit-CC: fixeria <vyanitskiy(a)sysmocom.de>