August 2026 - gerrit-log - lists.osmocom.org

[S] Change in osmo-msc[master]: smpp: Fix potential write buffer overflow on sms->user_data
by pespin 19 Aug '26

19 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-msc/+/43253?usp=email ) Change subject: smpp: Fix potential write buffer overflow on sms->user_data ...................................................................... smpp: Fix potential write buffer overflow on sms->user_data The writes to sms->user_data in submit_to_sms() were not being validated against the maximum size of the buffer, which could lead into writing past the buffer limits. In order to assure safe encdoing of septets into the buffer, the new libosmocore gsm_septet_pack2() is required. Related: OS#7059 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Depends: libosmocore.git Change-Id I4baa19007c65275ead3d1fc92462bfb8ab68e036 Change-Id: Iee701a3b033d78244fc10dd8563a094b8de385c0 --- M TODO-RELEASE M src/libsmpputil/smpp_msc.c 2 files changed, 25 insertions(+), 5 deletions(-) Approvals: osmith: Looks good to me, but someone else must approve Jenkins Builder: Verified fixeria: Looks good to me, approved diff --git a/TODO-RELEASE b/TODO-RELEASE index c8858d8..84a2985 100644 --- a/TODO-RELEASE +++ b/TODO-RELEASE @@ -9,3 +9,4 @@ #library what description / commit summary line libosmovty >=1.12.1 working optional-multi-choice libosmocore >1.12.0 log_get_context(), log_{get,set}_filter(_data)() +libosmogsm >1.14.1 gsm_septet_pack2() diff --git a/src/libsmpputil/smpp_msc.c b/src/libsmpputil/smpp_msc.c index d68dcc0..5fdba36 100644 --- a/src/libsmpputil/smpp_msc.c +++ b/src/libsmpputil/smpp_msc.c @@ -132,6 +132,7 @@ struct tlv_t *t; int mode; int can_store_sms = ((submit->esm_class & SMPP34_MSG_MODE_MASK) != 2); /* != forward mode */ + int rc; dest = subscr_by_dst(net, submit->dest_addr_npi, submit->dest_addr_ton, @@ -247,21 +248,39 @@ ud_len = *sms_msg + 1; if (ud_len > sms_msg_len) { sms_free(sms); - LOGP(DLSMS, LOGL_ERROR, "invalid ud_len=%u > sms_msg_len=%u\n", ud_len, - sms_msg_len); + LOGP(DLSMS, LOGL_ERROR, "invalid ud_len=%u > sms_msg_len=%u\n", + ud_len, sms_msg_len); + return ESME_RINVPARLEN; + } + if (ud_len > sizeof(sms->user_data)) { + sms_free(sms); + LOGP(DLSMS, LOGL_ERROR, "invalid sms_msg_len=%u > %zu\n", + sms_msg_len, sizeof(sms->user_data)); return ESME_RINVPARLEN; } printf("copying %u bytes user data...\n", ud_len); - memcpy(sms->user_data, sms_msg, - OSMO_MIN(ud_len, sizeof(sms->user_data))); + memcpy(sms->user_data, sms_msg, ud_len); sms_msg += ud_len; sms_msg_len -= ud_len; padbits = 7 - (ud_len % 7); } - gsm_septet_pack(sms->user_data+ud_len, sms_msg, sms_msg_len, padbits); + rc = gsm_septet_pack2(sms->user_data + ud_len, sizeof(sms->user_data) - ud_len, + sms_msg, sms_msg_len, padbits); + if (rc < 0) { + sms_free(sms); + LOGP(DLSMS, LOGL_ERROR, "invalid ud_len=%u + sms_msg_len=%u > %zu\n", + ud_len, sms_msg_len, sizeof(sms->user_data)); + return ESME_RINVPARLEN; + } sms->user_data_len = (ud_len*8 + padbits)/7 + sms_msg_len;/* SEPTETS */ /* FIXME: sms->text */ } else { + if (sms_msg_len > sizeof(sms->user_data)) { + sms_free(sms); + LOGP(DLSMS, LOGL_ERROR, "invalid sms_msg_len=%u > %zu\n", + sms_msg_len, sizeof(sms->user_data)); + return ESME_RINVPARLEN; + } memcpy(sms->user_data, sms_msg, sms_msg_len); sms->user_data_len = sms_msg_len; } -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43253?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: Iee701a3b033d78244fc10dd8563a094b8de385c0 Gerrit-Change-Number: 43253 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[L] Change in osmo-ttcn3-hacks[master]: DIAMETER: Get Rid of DIAMETER_ConnHdlr_CT in several testsuites
by pespin 19 Aug '26

19 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43284?usp=email ) Change subject: DIAMETER: Get Rid of DIAMETER_ConnHdlr_CT in several testsuites ...................................................................... DIAMETER: Get Rid of DIAMETER_ConnHdlr_CT in several testsuites A man-in-the-middle component DIAMETER_ConnHdlr_CT was used so far for tests willing to use multiple DIAMETER_ConnHdlr connected to a single component served by multiple DIAMETER_Emulation. Remove the need for this component by modifying the DIAMETER_ConnHdlr component to have an array of ports. This way the same ConnHdlr can be registered on multiple DIAMETER_Emulation components directly. Change-Id: Id88b88d2f3472e1f4daa8344ca1fc6d408edfb62 --- M epdg/EPDG_Tests.ttcn M hss/HSS_Tests.ttcn M library/DIAMETER_Emulation.ttcn M pcrf/PCRF_Tests.ttcn M pgw/PGW_Tests.ttcn 5 files changed, 125 insertions(+), 276 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/84/43284/1 diff --git a/epdg/EPDG_Tests.ttcn b/epdg/EPDG_Tests.ttcn index e4aed42..0127988 100644 --- a/epdg/EPDG_Tests.ttcn +++ b/epdg/EPDG_Tests.ttcn @@ -68,6 +68,9 @@ integer mp_diam_watchdog_initial_wait_sec := 6*3; } +const integer DIA_SWx := 0; +const integer DIA_S6b := 1; + type port Coord_PT message { inout charstring; @@ -107,43 +110,8 @@ } } -type component DIAMETER_ConnHdlr_CT extends DIAMETER_ConnHdlr { - port DIAMETER_Conn_PT DIAMETER_CLIENT; - port DIAMETEREM_PROC_PT DIAMETER_PROC_CLIENT; -} - -function f_diam_connhldr_ct_main(hexstring imsi) runs on DIAMETER_ConnHdlr_CT { - var DIAMETER_ConnHdlr vc_conn_unused; - var PDU_DIAMETER msg; - var UINT32 ete_id; - - f_diameter_expect_imsi(imsi); - - while (true) { - alt { - [] DIAMETER_CLIENT.receive(PDU_DIAMETER:?) -> value msg { - DIAMETER.send(msg); - } - [] DIAMETER.receive(PDU_DIAMETER:?) -> value msg { - DIAMETER_CLIENT.send(msg); - } - [] DIAMETER_PROC_CLIENT.getcall(DIAMETEREM_register_eteid:{?,?}) -> param(ete_id, vc_conn_unused) { - DIAMETER_PROC.call(DIAMETEREM_register_eteid:{ete_id, self}) { - [] DIAMETER_PROC.getreply(DIAMETEREM_register_eteid:{?,?}) {}; - } - DIAMETER_PROC_CLIENT.reply(DIAMETEREM_register_eteid:{ete_id, vc_conn_unused}); - } - } - } -} - type component EPDG_ConnHdlr extends DIAMETER_ConnHdlr, GSUP_ConnHdlr, GTP2_ConnHdlr, GTP1U_ConnHdlr { var EPDG_ConnHdlrPars g_pars; - - port DIAMETER_Conn_PT SWx; - port DIAMETEREM_PROC_PT SWx_PROC; - port DIAMETER_Conn_PT S6b; - port DIAMETEREM_PROC_PT S6b_PROC; port Coord_PT COORD; }; type record of EPDG_ConnHdlr EPDG_ConnHdlrList; @@ -174,17 +142,6 @@ AuthVector vec optional }; -private function f_epdg_connhldr_SWx_expect_eteid(UINT32 ete_id) runs on EPDG_ConnHdlr { - SWx_PROC.call(DIAMETEREM_register_eteid:{ete_id, null}) { - [] SWx_PROC.getreply(DIAMETEREM_register_eteid:{?,?}) {}; - } -} -private function f_epdg_connhldr_S6b_expect_eteid(UINT32 ete_id) runs on EPDG_ConnHdlr { - S6b_PROC.call(DIAMETEREM_register_eteid:{ete_id, null}) { - [] S6b_PROC.getreply(DIAMETEREM_register_eteid:{?,?}) {}; - } -} - private function f_gen_addr_in_pool(integer idx := 0) return charstring { /* Skip first 2 addresses reserved for TUN */ @@ -346,6 +303,10 @@ private function f_init_handler(void_fn fn, charstring id, EPDG_ConnHdlrPars pars) runs on EPDG_ConnHdlr { g_pars := pars; + + f_diameter_expect_imsi(g_pars.imsi, idx := DIA_SWx); + f_diameter_expect_imsi(g_pars.imsi, idx := DIA_S6b); + /* tell GSUP dispatcher to send this IMSI to us */ f_create_gsup_expect(hex2str(g_pars.imsi)); @@ -359,7 +320,6 @@ runs on MTC_CT return EPDG_ConnHdlr { var EPDG_ConnHdlr vc_conn; var charstring id := testcasename(); - var DIAMETER_ConnHdlr_CT vc_conn_swx, vc_conn_s6b; vc_conn := EPDG_ConnHdlr.create(id); @@ -375,20 +335,12 @@ connect(vc_conn:GTP1U_PROC[0], vc_GTP1U:CLIENT_PROC); /* SWx */ - vc_conn_swx := DIAMETER_ConnHdlr_CT.create(id); - connect(vc_conn_swx:DIAMETER, vc_SWx:DIAMETER_CLIENT); - connect(vc_conn_swx:DIAMETER_PROC, vc_SWx:DIAMETER_PROC); - connect(vc_conn:SWx, vc_conn_swx:DIAMETER_CLIENT); - connect(vc_conn:SWx_PROC, vc_conn_swx:DIAMETER_PROC_CLIENT); - vc_conn_swx.start(f_diam_connhldr_ct_main(pars.imsi)); + connect(vc_conn:DIAMETER[DIA_SWx], vc_SWx:DIAMETER_CLIENT); + connect(vc_conn:DIAMETER_PROC[DIA_SWx], vc_SWx:DIAMETER_PROC); /* S6b */ - vc_conn_s6b := DIAMETER_ConnHdlr_CT.create(id); - connect(vc_conn_s6b:DIAMETER, vc_S6b:DIAMETER_CLIENT); - connect(vc_conn_s6b:DIAMETER_PROC, vc_S6b:DIAMETER_PROC); - connect(vc_conn:S6b, vc_conn_s6b:DIAMETER_CLIENT); - connect(vc_conn:S6b_PROC, vc_conn_s6b:DIAMETER_PROC_CLIENT); - vc_conn_s6b.start(f_diam_connhldr_ct_main(pars.imsi)); + connect(vc_conn:DIAMETER[DIA_S6b], vc_S6b:DIAMETER_CLIENT); + connect(vc_conn:DIAMETER_PROC[DIA_S6b], vc_S6b:DIAMETER_PROC); /* COORD */ connect(vc_conn:COORD, self:COORD); @@ -415,7 +367,7 @@ g_pars.vec.autn, g_pars.vec.auts); /* Send MAA to translator; expect it to show up on GSUP side */ - SWx.send(ts_DIA_SWx_MAA(g_pars.imsi, sip_auth_data_item, + DIAMETER[DIA_SWx].send(ts_DIA_SWx_MAA(g_pars.imsi, sip_auth_data_item, sess_id := sess_id, hbh_id := rx_mar.hop_by_hop_id, ete_id := rx_mar.end_to_end_id)); @@ -434,7 +386,7 @@ g_pars.vec.ck, g_pars.vec.autn, g_pars.vec.auts); - SWx.send(ts_DIA_SWx_MAA_result(g_pars.imsi, result, + DIAMETER[DIA_SWx].send(ts_DIA_SWx_MAA_result(g_pars.imsi, result, sess_id := sess_id, hbh_id := rx_mar.hop_by_hop_id, ete_id := rx_mar.end_to_end_id)); @@ -443,7 +395,7 @@ /* Diameter SWx MAR + MAA. */ private altstep as_DIA_SWx_MA_success(boolean exp_req_resync := false) runs on EPDG_ConnHdlr { var PDU_DIAMETER rx_dia; - [] SWx.receive(tr_DIA_SWx_MAR(g_pars.imsi)) -> value rx_dia { + [] DIAMETER[DIA_SWx].receive(tr_DIA_SWx_MAR(g_pars.imsi)) -> value rx_dia { if (exp_req_resync) { var octetstring rand_autn_concatenated := g_pars.vec.rand & g_pars.vec.auts; var AVP avp_grp; @@ -462,7 +414,7 @@ f_DIA_SWx_tx_MAA_success(rx_dia); setverdict(pass); } - [] SWx.receive(PDU_DIAMETER:?) -> value rx_dia { + [] DIAMETER[DIA_SWx].receive(PDU_DIAMETER:?) -> value rx_dia { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Unexpected Diameter msg rx: ", rx_dia)); } } @@ -472,11 +424,11 @@ var PDU_DIAMETER rx_dia; var template (omit) AVP avp; var octetstring sess_id; - [] SWx.receive(tr_DIA_SWx_SAR(g_pars.imsi)) -> value rx_dia { + [] DIAMETER[DIA_SWx].receive(tr_DIA_SWx_SAR(g_pars.imsi)) -> value rx_dia { avp := f_DIAMETER_get_avp(rx_dia, c_AVP_Code_BASE_NONE_Session_Id); sess_id := valueof(avp.avp_data.avp_BASE_NONE_Session_Id); /* Send SAA to translator; expect it to show up on GSUP side */ - SWx.send(ts_DIA_SWx_SAA(g_pars.imsi, + DIAMETER[DIA_SWx].send(ts_DIA_SWx_SAA(g_pars.imsi, IPv4, g_pars.apn, sess_id := sess_id, @@ -484,7 +436,7 @@ ete_id := rx_dia.end_to_end_id)); setverdict(pass); } - [] SWx.receive(PDU_DIAMETER:?) -> value rx_dia { + [] DIAMETER[DIA_SWx].receive(PDU_DIAMETER:?) -> value rx_dia { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Unexpected Diameter msg rx: ", rx_dia)); } } @@ -500,9 +452,9 @@ /* Unlike PPR, PPA contains no IMSI. Register ete_id in DIAMETER_Emulation, * so PPA is forwarded back to us in DIAMETER port instead of MTC_CT.DIAMETER_UNIT. */ - f_epdg_connhldr_SWx_expect_eteid(ete_id); + f_diameter_expect_eteid(ete_id, idx := DIA_SWx); - SWx.send(ts_DIA_SWx_PPR(g_pars.imsi, + DIAMETER[DIA_SWx].send(ts_DIA_SWx_PPR(g_pars.imsi, IPv4, g_pars.apn, hbh_id := hbh_id, @@ -527,8 +479,8 @@ } alt { - [] SWx.receive(tr_DIA_SWx_PPA(exp_result_tmpl, hbh_id := hbh_id, ete_id := ete_id)) -> value rx_dia {} - [] SWx.receive(PDU_DIAMETER:?) -> value rx_dia { + [] DIAMETER[DIA_SWx].receive(tr_DIA_SWx_PPA(exp_result_tmpl, hbh_id := hbh_id, ete_id := ete_id)) -> value rx_dia {} + [] DIAMETER[DIA_SWx].receive(PDU_DIAMETER:?) -> value rx_dia { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Unexpected Diameter SWx msg rx: ", rx_dia)); } } @@ -547,9 +499,9 @@ /* Unlike STR, STA contains no IMSI. Register ete_id in DIAMETER_Emulation, * so AIA is forwarded back to us in DIAMETER port instead of MTC_CT.DIAMETER_UNIT. */ - f_epdg_connhldr_SWx_expect_eteid(ete_id); + f_diameter_expect_eteid(ete_id, idx := DIA_SWx); - SWx.send(ts_DIA_SWx_RTR(g_pars.imsi, reason_code, reason_info, + DIAMETER[DIA_SWx].send(ts_DIA_SWx_RTR(g_pars.imsi, reason_code, reason_info, hbh_id := hbh_id, ete_id := ete_id)); @@ -564,8 +516,8 @@ } alt { - [] SWx.receive(tr_DIA_SWx_RTA(exp_result_tmpl, hbh_id := hbh_id, ete_id := ete_id)) -> value rx_dia {} - [] SWx.receive(PDU_DIAMETER:?) -> value rx_dia { + [] DIAMETER[DIA_SWx].receive(tr_DIA_SWx_RTA(exp_result_tmpl, hbh_id := hbh_id, ete_id := ete_id)) -> value rx_dia {} + [] DIAMETER[DIA_SWx].receive(PDU_DIAMETER:?) -> value rx_dia { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Unexpected Diameter SWx msg rx: ", rx_dia)); } } @@ -584,9 +536,9 @@ /* Unlike AAR, AAA contains no IMSI. Register ete_id in DIAMETER_Emulation, * so AIA is forwarded back to us in DIAMETER port instead of MTC_CT.DIAMETER_UNIT. */ - f_epdg_connhldr_S6b_expect_eteid(ete_id); + f_diameter_expect_eteid(ete_id, idx := DIA_S6b) - S6b.send(ts_DIA_S6b_AAR(f_nai(), + DIAMETER[DIA_S6b].send(ts_DIA_S6b_AAR(f_nai(), int2oct(DIA_TS29_373_MIP6_Feature_Vector_GTPv2_SUPPORTED, 8), g_pars.apn, pgw_addr, @@ -598,8 +550,8 @@ } alt { - [] S6b.receive(tr_DIA_S6b_AAA) -> value rx_dia {} - [] S6b.receive(PDU_DIAMETER:?) -> value rx_dia { + [] DIAMETER[DIA_S6b].receive(tr_DIA_S6b_AAA) -> value rx_dia {} + [] DIAMETER[DIA_S6b].receive(PDU_DIAMETER:?) -> value rx_dia { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Unexpected Diameter S6b msg rx: ", rx_dia)); } } @@ -614,13 +566,13 @@ /* Unlike STR, STA contains no IMSI. Register ete_id in DIAMETER_Emulation, * so AIA is forwarded back to us in DIAMETER port instead of MTC_CT.DIAMETER_UNIT. */ - f_epdg_connhldr_S6b_expect_eteid(ete_id); + f_diameter_expect_eteid(ete_id, idx := DIA_S6b) - S6b.send(ts_DIA_S6b_STR(g_pars.imsi, DIAMETER_LOGOUT, + DIAMETER[DIA_S6b].send(ts_DIA_S6b_STR(g_pars.imsi, DIAMETER_LOGOUT, hbh_id := hbh_id, ete_id := ete_id)); alt { - [] S6b.receive(tr_DIA_S6b_STA(DIAMETER_SUCCESS)) -> value rx_dia {} - [] S6b.receive(PDU_DIAMETER:?) -> value rx_dia { + [] DIAMETER[DIA_S6b].receive(tr_DIA_S6b_STA(DIAMETER_SUCCESS)) -> value rx_dia {} + [] DIAMETER[DIA_S6b].receive(PDU_DIAMETER:?) -> value rx_dia { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Unexpected Diameter S6b msg rx: ", rx_dia)); } } @@ -631,16 +583,16 @@ var PDU_DIAMETER rx_dia; var template (omit) AVP avp; var octetstring sess_id; - [] S6b.receive(tr_DIA_S6b_RAR(f_nai())) -> value rx_dia { + [] DIAMETER[DIA_S6b].receive(tr_DIA_S6b_RAR(f_nai())) -> value rx_dia { avp := f_DIAMETER_get_avp(rx_dia, c_AVP_Code_BASE_NONE_Session_Id); sess_id := valueof(avp.avp_data.avp_BASE_NONE_Session_Id); - S6b.send(ts_DIA_S6b_RAA(DIAMETER_SUCCESS, - sess_id := sess_id, - hbh_id := rx_dia.hop_by_hop_id, - ete_id := rx_dia.end_to_end_id)); + DIAMETER[DIA_S6b].send(ts_DIA_S6b_RAA(DIAMETER_SUCCESS, + sess_id := sess_id, + hbh_id := rx_dia.hop_by_hop_id, + ete_id := rx_dia.end_to_end_id)); setverdict(pass); } - [] S6b.receive(PDU_DIAMETER:?) -> value rx_dia { + [] DIAMETER[DIA_S6b].receive(PDU_DIAMETER:?) -> value rx_dia { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Unexpected Diameter S6b msg rx: ", rx_dia)); } } @@ -650,16 +602,16 @@ var PDU_DIAMETER rx_dia; var template (omit) AVP avp; var octetstring sess_id; - [] S6b.receive(tr_DIA_S6b_ASR(f_nai())) -> value rx_dia { + [] DIAMETER[DIA_S6b].receive(tr_DIA_S6b_ASR(f_nai())) -> value rx_dia { avp := f_DIAMETER_get_avp(rx_dia, c_AVP_Code_BASE_NONE_Session_Id); sess_id := valueof(avp.avp_data.avp_BASE_NONE_Session_Id); - S6b.send(ts_DIA_S6b_ASA(DIAMETER_SUCCESS, - sess_id := sess_id, - hbh_id := rx_dia.hop_by_hop_id, - ete_id := rx_dia.end_to_end_id)); + DIAMETER[DIA_S6b].send(ts_DIA_S6b_ASA(DIAMETER_SUCCESS, + sess_id := sess_id, + hbh_id := rx_dia.hop_by_hop_id, + ete_id := rx_dia.end_to_end_id)); setverdict(pass); } - [] S6b.receive(PDU_DIAMETER:?) -> value rx_dia { + [] DIAMETER[DIA_S6b].receive(PDU_DIAMETER:?) -> value rx_dia { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Unexpected Diameter S6b msg rx: ", rx_dia)); } } @@ -1096,7 +1048,7 @@ var DIAMETER_ExperimentalResultcode exp_result_code := DIAMETER_ERROR_USER_UNKNOWN; f_GSUP_tx_SAI_REQ(); - SWx.receive(tr_DIA_SWx_MAR(g_pars.imsi)) -> value rx_dia; + DIAMETER[DIA_SWx].receive(tr_DIA_SWx_MAR(g_pars.imsi)) -> value rx_dia; f_DIA_SWx_tx_MAA_error(rx_dia, ts_AVP_ExperimentalResult(vendor_id_3GPP, int2oct(enum2int(exp_result_code), 4))); diff --git a/hss/HSS_Tests.ttcn b/hss/HSS_Tests.ttcn index 1ebb673..7e55968 100644 --- a/hss/HSS_Tests.ttcn +++ b/hss/HSS_Tests.ttcn @@ -39,6 +39,8 @@ HSS_Impl mp_hss_impl := HSS_IMPL_OPEN5GS; } +const integer DIA_S6a := 0; + /* main component, we typically have one per testcase */ type component MTC_CT { @@ -58,48 +60,9 @@ } } -type component DIAMETER_ConnHdlr_CT extends DIAMETER_ConnHdlr { - port DIAMETER_Conn_PT DIAMETER_CLIENT; - port DIAMETEREM_PROC_PT DIAMETER_PROC_CLIENT; -} - -function f_diam_connhldr_ct_main(hexstring imsi) runs on DIAMETER_ConnHdlr_CT { - var DIAMETER_ConnHdlr vc_conn_unused; - var PDU_DIAMETER msg; - var UINT32 ete_id; - - f_diameter_expect_imsi(imsi); - - while (true) { - alt { - [] DIAMETER_CLIENT.receive(PDU_DIAMETER:?) -> value msg { - DIAMETER.send(msg); - } - [] DIAMETER.receive(PDU_DIAMETER:?) -> value msg { - DIAMETER_CLIENT.send(msg); - } - [] DIAMETER_PROC_CLIENT.getcall(DIAMETEREM_register_eteid:{?,?}) -> param(ete_id, vc_conn_unused) { - DIAMETER_PROC.call(DIAMETEREM_register_eteid:{ete_id, self}) { - [] DIAMETER_PROC.getreply(DIAMETEREM_register_eteid:{?,?}) {}; - } - DIAMETER_PROC_CLIENT.reply(DIAMETEREM_register_eteid:{ete_id, vc_conn_unused}); - } - } - } -} - /* per-session component; we typically have 1..N per testcase */ -type component Cli_Session_CT extends Prometheus_Checker_CT { +type component Cli_Session_CT extends DIAMETER_ConnHdlr, Prometheus_Checker_CT { var SessionPars g_pars; - - port DIAMETER_Conn_PT S6a; - port DIAMETEREM_PROC_PT S6a_PROC; - -} -function f_diam_connhldr_expect_eteid(UINT32 ete_id) runs on Cli_Session_CT { - S6a_PROC.call(DIAMETEREM_register_eteid:{ete_id, null}) { - [] S6a_PROC.getreply(DIAMETEREM_register_eteid:{?,?}) {}; - } } /* configuration data for a given Session */ @@ -167,7 +130,6 @@ function f_start_handler(void_fn fn, template (omit) SessionPars pars_tmpl := omit) runs on MTC_CT return Cli_Session_CT { var charstring id := testcasename(); - var DIAMETER_ConnHdlr_CT vc_conn_s6a; var Cli_Session_CT vc_conn; var SessionPars pars; @@ -179,12 +141,8 @@ vc_conn := Cli_Session_CT.create(id); - vc_conn_s6a := DIAMETER_ConnHdlr_CT.create(id); - connect(vc_conn_s6a:DIAMETER, vc_S6a:DIAMETER_CLIENT); - connect(vc_conn_s6a:DIAMETER_PROC, vc_S6a:DIAMETER_PROC); - connect(vc_conn:S6a, vc_conn_s6a:DIAMETER_CLIENT); - connect(vc_conn:S6a_PROC, vc_conn_s6a:DIAMETER_PROC_CLIENT); - vc_conn_s6a.start(f_diam_connhldr_ct_main(pars.imsi)); + connect(vc_conn:DIAMETER[DIA_S6a], vc_S6a:DIAMETER_CLIENT); + connect(vc_conn:DIAMETER_PROC[DIA_S6a], vc_S6a:DIAMETER_PROC); vc_conn.start(f_handler_init(fn, pars)); return vc_conn; @@ -193,6 +151,7 @@ private function f_handler_init(void_fn fn, SessionPars pars) runs on Cli_Session_CT { g_pars := valueof(pars); + f_diameter_expect_imsi(g_pars.imsi, idx := DIA_S6a); f_prometheus_init(mp_hss_prometheus_hostname, mp_hss_prometheus_port); fn.apply(); } @@ -207,20 +166,20 @@ /* Unlike ULR, ULA contains no IMSI. Register ete_id in DIAMETER_Emulation, * so AIA is forwarded back to us in DIAMETER port instead of MTC_CT.DIAMETER_UNIT. */ - f_diam_connhldr_expect_eteid(ete_id); + f_diameter_expect_eteid(ete_id, idx := DIA_S6a) /* TODO: change this into a ts_DIA_ULR */ - S6a.send(ts_DIA_ULR(g_pars.imsi, '111F11'O, sess_id, - mp_diam_orig_host, mp_diam_orig_realm, - mp_diam_dest_realm, hbh_id, ete_id)); + DIAMETER[DIA_S6a].send(ts_DIA_ULR(g_pars.imsi, '111F11'O, sess_id, + mp_diam_orig_host, mp_diam_orig_realm, + mp_diam_dest_realm, hbh_id, ete_id)); g_pars.s6a_next_hbh_id := g_pars.s6a_next_hbh_id + 1; g_pars.s6a_next_ete_id := g_pars.s6a_next_ete_id + 1; alt { - [] S6a.receive(tr_DIA_ULA(ula_sub_data, sess_id, ?, ?, hbh_id, ete_id)) -> value rx_dia { + [] DIAMETER[DIA_S6a].receive(tr_DIA_ULA(ula_sub_data, sess_id, ?, ?, hbh_id, ete_id)) -> value rx_dia { setverdict(pass); } - [] S6a.receive(PDU_DIAMETER:?) -> value rx_dia { + [] DIAMETER[DIA_S6a].receive(PDU_DIAMETER:?) -> value rx_dia { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Received unexpected DIAMETER ", rx_dia)); } diff --git a/library/DIAMETER_Emulation.ttcn b/library/DIAMETER_Emulation.ttcn index e5698fd..6e79fd6 100644 --- a/library/DIAMETER_Emulation.ttcn +++ b/library/DIAMETER_Emulation.ttcn @@ -49,10 +49,11 @@ PDU_DIAMETER tx }; +const integer DIAMETER_ConnHdlr_MAX_PORTS := 3; type component DIAMETER_ConnHdlr { - port DIAMETER_Conn_PT DIAMETER; + port DIAMETER_Conn_PT DIAMETER[DIAMETER_ConnHdlr_MAX_PORTS]; /* procedure based port to register for incoming connections */ - port DIAMETEREM_PROC_PT DIAMETER_PROC; + port DIAMETEREM_PROC_PT DIAMETER_PROC[DIAMETER_ConnHdlr_MAX_PORTS]; } /* port between individual per-connection components and this dispatcher */ @@ -468,9 +469,9 @@ signature DIAMETEREM_register_eteid(in UINT32 ete_id, in DIAMETER_ConnHdlr hdlr); /* client/conn_hdlr side function to use procedure port to create expect in emulation */ -function f_diameter_expect_eteid(UINT32 ete_id) runs on DIAMETER_ConnHdlr { - DIAMETER_PROC.call(DIAMETEREM_register_eteid:{ete_id, self}) { - [] DIAMETER_PROC.getreply(DIAMETEREM_register_eteid:{?,?}) {}; +function f_diameter_expect_eteid(UINT32 ete_id, integer idx := 0) runs on DIAMETER_ConnHdlr { + DIAMETER_PROC[idx].call(DIAMETEREM_register_eteid:{ete_id, self}) { + [] DIAMETER_PROC[idx].getreply(DIAMETEREM_register_eteid:{?,?}) {}; } } @@ -529,9 +530,9 @@ } /* client/conn_hdlr side function to use procedure port to create expect in emulation */ -function f_diameter_expect_imsi(hexstring imsi) runs on DIAMETER_ConnHdlr { - DIAMETER_PROC.call(DIAMETEREM_register_imsi:{imsi, self}) { - [] DIAMETER_PROC.getreply(DIAMETEREM_register_imsi:{?,?}) {}; +function f_diameter_expect_imsi(hexstring imsi, integer idx := 0) runs on DIAMETER_ConnHdlr { + DIAMETER_PROC[idx].call(DIAMETEREM_register_imsi:{imsi, self}) { + [] DIAMETER_PROC[idx].getreply(DIAMETEREM_register_imsi:{?,?}) {}; } } diff --git a/pcrf/PCRF_Tests.ttcn b/pcrf/PCRF_Tests.ttcn index 7979d75..c62880d 100644 --- a/pcrf/PCRF_Tests.ttcn +++ b/pcrf/PCRF_Tests.ttcn @@ -34,6 +34,8 @@ }; } +const integer DIA_Gx := 0; + /* main component, we typically have one per testcase */ type component MTC_CT { @@ -53,48 +55,9 @@ } } -type component DIAMETER_ConnHdlr_CT extends DIAMETER_ConnHdlr { - port DIAMETER_Conn_PT DIAMETER_CLIENT; - port DIAMETEREM_PROC_PT DIAMETER_PROC_CLIENT; -} - -function f_diam_connhldr_ct_main(hexstring imsi) runs on DIAMETER_ConnHdlr_CT { - var DIAMETER_ConnHdlr vc_conn_unused; - var PDU_DIAMETER msg; - var UINT32 ete_id; - - f_diameter_expect_imsi(imsi); - - while (true) { - alt { - [] DIAMETER_CLIENT.receive(PDU_DIAMETER:?) -> value msg { - DIAMETER.send(msg); - } - [] DIAMETER.receive(PDU_DIAMETER:?) -> value msg { - DIAMETER_CLIENT.send(msg); - } - [] DIAMETER_PROC_CLIENT.getcall(DIAMETEREM_register_eteid:{?,?}) -> param(ete_id, vc_conn_unused) { - DIAMETER_PROC.call(DIAMETEREM_register_eteid:{ete_id, self}) { - [] DIAMETER_PROC.getreply(DIAMETEREM_register_eteid:{?,?}) {}; - } - DIAMETER_PROC_CLIENT.reply(DIAMETEREM_register_eteid:{ete_id, vc_conn_unused}); - } - } - } -} - /* per-session component; we typically have 1..N per testcase */ -type component Cli_Session_CT extends Prometheus_Checker_CT { +type component Cli_Session_CT extends DIAMETER_ConnHdlr, Prometheus_Checker_CT { var SessionPars g_pars; - - port DIAMETER_Conn_PT Gx; - port DIAMETEREM_PROC_PT Gx_PROC; - -} -function f_diam_connhldr_expect_eteid(UINT32 ete_id) runs on Cli_Session_CT { - Gx_PROC.call(DIAMETEREM_register_eteid:{ete_id, null}) { - [] Gx_PROC.getreply(DIAMETEREM_register_eteid:{?,?}) {}; - } } /* configuration data for a given Session */ @@ -162,7 +125,6 @@ function f_start_handler(void_fn fn, template (omit) SessionPars pars_tmpl := omit) runs on MTC_CT return Cli_Session_CT { var charstring id := testcasename(); - var DIAMETER_ConnHdlr_CT vc_conn_gx; var Cli_Session_CT vc_conn; var SessionPars pars; @@ -174,12 +136,8 @@ vc_conn := Cli_Session_CT.create(id); - vc_conn_gx := DIAMETER_ConnHdlr_CT.create(id); - connect(vc_conn_gx:DIAMETER, vc_Gx:DIAMETER_CLIENT); - connect(vc_conn_gx:DIAMETER_PROC, vc_Gx:DIAMETER_PROC); - connect(vc_conn:Gx, vc_conn_gx:DIAMETER_CLIENT); - connect(vc_conn:Gx_PROC, vc_conn_gx:DIAMETER_PROC_CLIENT); - vc_conn_gx.start(f_diam_connhldr_ct_main(pars.imsi)); + connect(vc_conn:DIAMETER[DIA_Gx], vc_Gx:DIAMETER_CLIENT); + connect(vc_conn:DIAMETER_PROC[DIA_Gx], vc_Gx:DIAMETER_PROC); vc_conn.start(f_handler_init(fn, pars)); return vc_conn; @@ -188,6 +146,7 @@ private function f_handler_init(void_fn fn, SessionPars pars) runs on Cli_Session_CT { g_pars := valueof(pars); + f_diameter_expect_imsi(g_pars.imsi, idx := DIA_Gx); f_prometheus_init(mp_pcrf_prometheus_hostname, mp_pcrf_prometheus_port); fn.apply(); } @@ -204,24 +163,24 @@ /* Unlike CCR, CCA contains no IMSI. Register ete_id in DIAMETER_Emulation, * so CCA is forwarded back to us in DIAMETER port instead of MTC_CT.DIAMETER_UNIT. */ - f_diam_connhldr_expect_eteid(ete_id); + f_diameter_expect_eteid(ete_id, idx := DIA_Gx); /* TODO: change this into a ts_DIA_ULR */ - Gx.send(ts_DIA_Gx_CCR(hbh_id, ete_id, - sess_id, - {ts_AVP_SubcrIdType(END_USER_IMSI), ts_AVP_SubcrIdData(imsi)}, - apn, - INITIAL_REQUEST, - req_num := '00000000'O - )); + DIAMETER[DIA_Gx].send(ts_DIA_Gx_CCR(hbh_id, ete_id, + sess_id, + {ts_AVP_SubcrIdType(END_USER_IMSI), ts_AVP_SubcrIdData(imsi)}, + apn, + INITIAL_REQUEST, + req_num := '00000000'O + )); g_pars.gx_next_hbh_id := g_pars.gx_next_hbh_id + 1; g_pars.gx_next_ete_id := g_pars.gx_next_ete_id + 1; alt { - [] Gx.receive(tr_DIA_Gx_CCA(sess_id)) -> value rx_dia { + [] DIAMETER[DIA_Gx].receive(tr_DIA_Gx_CCA(sess_id)) -> value rx_dia { setverdict(pass); } - [] Gx.receive(PDU_DIAMETER:?) -> value rx_dia { + [] DIAMETER[DIA_Gx].receive(PDU_DIAMETER:?) -> value rx_dia { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Received unexpected DIAMETER ", rx_dia)); } diff --git a/pgw/PGW_Tests.ttcn b/pgw/PGW_Tests.ttcn index 85d5820..9dd759b 100644 --- a/pgw/PGW_Tests.ttcn +++ b/pgw/PGW_Tests.ttcn @@ -26,7 +26,6 @@ import from DIAMETER_ts32_299_Templates all; import from DIAMETER_Emulation all; - modulepar { charstring mp_pgw_hostname := "127.0.0.4"; charstring mp_local_hostname_c := "127.0.0.1"; @@ -49,6 +48,10 @@ charstring mp_diam_realm := "localdomain"; } +const integer DIA_Gx := 0; +const integer DIA_Gy := 1; +const integer DIA_S6b := 2; + /* main component, we typically have one per testcase */ type component PGW_Test_CT extends GTP2_ConnHdlr, GTP1U_ConnHdlr { var GTPv2_Emulation_CT vc_GTP2; @@ -80,38 +83,10 @@ } } -type component DIAMETER_ConnHdlr_CT extends DIAMETER_ConnHdlr { - port DIAMETER_Conn_PT DIAMETER_CLIENT; -} - -function f_diam_connhldr_ct_main(hexstring imsi) runs on DIAMETER_ConnHdlr_CT { - var PDU_DIAMETER msg; - - if (DIAMETER_PROC.checkstate("Connected")) { - f_diameter_expect_imsi(imsi); - } - - while (true) { - alt { - [] DIAMETER_CLIENT.receive(PDU_DIAMETER:?) -> value msg { - DIAMETER.send(msg); - } - [] DIAMETER.receive(PDU_DIAMETER:?) -> value msg { - DIAMETER_CLIENT.send(msg); - } - } - } -} - - /* per-session component; we typically have 1..N per testcase */ -type component PGW_Session_CT extends GTP2_ConnHdlr, GTP1U_ConnHdlr { +type component PGW_Session_CT extends GTP2_ConnHdlr, GTP1U_ConnHdlr, DIAMETER_ConnHdlr { var SessionPars g_pars; - port DIAMETER_Conn_PT Gx; - port DIAMETER_Conn_PT Gy; - port DIAMETER_Conn_PT S6b; - /* GTP-U IPv4 address remote sie */ var OCT4 g_gtpu4_remote; var OCT16 g_gtpu6_remote; @@ -332,7 +307,6 @@ function f_start_handler(void_fn fn, template (omit) SessionPars pars_tmpl := omit) runs on PGW_Test_CT return PGW_Session_CT { var charstring id := testcasename(); - var DIAMETER_ConnHdlr_CT vc_conn_gx, vc_conn_gy, vc_conn_s6b; var PGW_Session_CT vc_conn; var SessionPars pars; @@ -349,27 +323,18 @@ connect(vc_conn:GTP1U_PROC[0], vc_GTP1U:CLIENT_PROC); if (isbound(vc_Gx)) { - vc_conn_gx := DIAMETER_ConnHdlr_CT.create(id); - connect(vc_conn_gx:DIAMETER, vc_Gx:DIAMETER_CLIENT); - connect(vc_conn_gx:DIAMETER_PROC, vc_Gx:DIAMETER_PROC); - connect(vc_conn:Gx, vc_conn_gx:DIAMETER_CLIENT); - vc_conn_gx.start(f_diam_connhldr_ct_main(pars.imsi)); + connect(vc_conn:DIAMETER_PROC[DIA_Gx], vc_Gx:DIAMETER_PROC); + connect(vc_conn:DIAMETER[DIA_Gx], vc_Gx:DIAMETER_CLIENT); } if (isbound(vc_Gy)) { - vc_conn_gy := DIAMETER_ConnHdlr_CT.create(id); - connect(vc_conn_gy:DIAMETER, vc_Gy:DIAMETER_CLIENT); - connect(vc_conn_gy:DIAMETER_PROC, vc_Gy:DIAMETER_PROC); - connect(vc_conn:Gy, vc_conn_gy:DIAMETER_CLIENT); - vc_conn_gy.start(f_diam_connhldr_ct_main(pars.imsi)); + connect(vc_conn:DIAMETER_PROC[DIA_Gy], vc_Gy:DIAMETER_PROC); + connect(vc_conn:DIAMETER[DIA_Gy], vc_Gy:DIAMETER_CLIENT); } if (isbound(vc_S6b)) { - vc_conn_s6b := DIAMETER_ConnHdlr_CT.create(id); - connect(vc_conn_s6b:DIAMETER, vc_S6b:DIAMETER_CLIENT); - connect(vc_conn_s6b:DIAMETER_PROC, vc_S6b:DIAMETER_PROC); - connect(vc_conn:S6b, vc_conn_s6b:DIAMETER_CLIENT); - vc_conn_s6b.start(f_diam_connhldr_ct_main(pars.imsi)); + connect(vc_conn:DIAMETER_PROC[DIA_S6b], vc_S6b:DIAMETER_PROC); + connect(vc_conn:DIAMETER[DIA_S6b], vc_S6b:DIAMETER_CLIENT); } vc_conn.start(f_handler_init(fn, pars)); @@ -379,6 +344,19 @@ private function f_handler_init(void_fn fn, SessionPars pars) runs on PGW_Session_CT { g_pars := valueof(pars); + + if (DIAMETER_PROC[DIA_Gx].checkstate("Connected")) { + f_diameter_expect_imsi(g_pars.imsi, idx := DIA_Gx); + } + + if (DIAMETER_PROC[DIA_Gy].checkstate("Connected")) { + f_diameter_expect_imsi(g_pars.imsi, idx := DIA_Gy); + } + + if (DIAMETER_PROC[DIA_S6b].checkstate("Connected")) { + f_diameter_expect_imsi(g_pars.imsi, idx := DIA_S6b); + } + /* allocate + register TEI{C,D} on local side */ g_pars.teic_local := f_gtp2_allocate_teic(); g_pars.bearer.teid_local := f_gtp1u_allocate_teid(); @@ -404,19 +382,19 @@ /* S6b emulation (AAA-Server) */ private altstep as_DIA_S6b_AAR() runs on PGW_Session_CT { var PDU_DIAMETER rx_dia; - [] S6b.receive(tr_DIA_S6b_AAR()) -> value rx_dia { + [] DIAMETER[DIA_S6b].receive(tr_DIA_S6b_AAR()) -> value rx_dia { var template (omit) AVP avp; var octetstring sess_id; avp := f_DIAMETER_get_avp(rx_dia, c_AVP_Code_BASE_NONE_Session_Id); sess_id := valueof(avp.avp_data.avp_BASE_NONE_Session_Id); - S6b.send(ts_DIA_S6b_AAA(sess_id, "aaa." & mp_diam_realm, - mp_diam_realm, mp_diam_realm, - rx_dia.hop_by_hop_id, rx_dia.end_to_end_id)); + DIAMETER[DIA_S6b].send(ts_DIA_S6b_AAA(sess_id, "aaa." & mp_diam_realm, + mp_diam_realm, mp_diam_realm, + rx_dia.hop_by_hop_id, rx_dia.end_to_end_id)); setverdict(pass); } - [] S6b.receive(PDU_DIAMETER:?) -> value rx_dia { + [] DIAMETER[DIA_S6b].receive(PDU_DIAMETER:?) -> value rx_dia { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Received unexpected DIAMETER ", rx_dia)); } @@ -425,7 +403,7 @@ /* Gx emulation (PCRF)*/ private altstep as_DIA_Gx_CCR(DCC_NONE_CC_Request_Type req_type) runs on PGW_Session_CT { var PDU_DIAMETER rx_dia; - [] Gx.receive(tr_DIA_Gx_CCR(req_type := req_type)) -> value rx_dia { + [] DIAMETER[DIA_Gx].receive(tr_DIA_Gx_CCR(req_type := req_type)) -> value rx_dia { var template (omit) AVP avp; var octetstring sess_id; var AVP_Unsigned32 req_num; @@ -436,10 +414,10 @@ avp := f_DIAMETER_get_avp(rx_dia, c_AVP_Code_DCC_NONE_CC_Request_Number); req_num := valueof(avp.avp_data.avp_DCC_NONE_CC_Request_Number); - Gx.send(ts_DIA_Gx_CCA(rx_dia.hop_by_hop_id, rx_dia.end_to_end_id, sess_id, - req_type, req_num)); + DIAMETER[DIA_Gx].send(ts_DIA_Gx_CCA(rx_dia.hop_by_hop_id, rx_dia.end_to_end_id, sess_id, + req_type, req_num)); } - [] Gx.receive(PDU_DIAMETER:?) -> value rx_dia { + [] DIAMETER[DIA_Gx].receive(PDU_DIAMETER:?) -> value rx_dia { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Received unexpected DIAMETER ", rx_dia)); } @@ -643,12 +621,12 @@ private altstep as_DIA_Gy_CCR(DCC_NONE_CC_Request_Type req_type) runs on PGW_Session_CT { - [] Gy.receive(f_tr_DIA_Gy_CCR(req_type := req_type)) -> value g_rx_gy { + [] DIAMETER[DIA_Gy].receive(f_tr_DIA_Gy_CCR(req_type := req_type)) -> value g_rx_gy { var template (value) PDU_DIAMETER tx_dia; tx_dia := f_ts_DIA_Gy_CCA(g_rx_gy); - Gy.send(tx_dia); + DIAMETER[DIA_Gy].send(tx_dia); } - [] Gy.receive(PDU_DIAMETER:?) -> value g_rx_gy { + [] DIAMETER[DIA_Gy].receive(PDU_DIAMETER:?) -> value g_rx_gy { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Received unexpected DIAMETER Gy", g_rx_gy)); } @@ -794,14 +772,14 @@ g2c.gtpcv2_pdu.createSessionRequest.servingNetwork := ts_GTP2C_ServingNetwork('001'H, '01F'H); GTP2.send(g2c); - if (do_s6b and S6b.checkstate("Connected")) { + if (do_s6b and DIAMETER[DIA_S6b].checkstate("Connected")) { as_DIA_S6b_AAR(); } - if (Gx.checkstate("Connected")) { + if (DIAMETER[DIA_Gx].checkstate("Connected")) { as_DIA_Gx_CCR(INITIAL_REQUEST); } /* FIXME: When on S2b interface, SMF is not using the Gy interface, unknown reason. */ - if (Gy.checkstate("Connected")) { + if (DIAMETER[DIA_Gy].checkstate("Connected")) { as_DIA_Gy_CCR(INITIAL_REQUEST); } alt { @@ -920,10 +898,10 @@ teid_list := {}, bearer_id := g_pars.bearer.ebi); GTP2.send(g2c); - if (Gx.checkstate("Connected") and expect_diameter) { + if (DIAMETER[DIA_Gx].checkstate("Connected") and expect_diameter) { as_DIA_Gx_CCR(TERMINATION_REQUEST); } - if (Gy.checkstate("Connected") and expect_diameter) { + if (DIAMETER[DIA_Gy].checkstate("Connected") and expect_diameter) { as_DIA_Gy_CCR(TERMINATION_REQUEST); } alt { -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43284?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Id88b88d2f3472e1f4daa8344ca1fc6d408edfb62 Gerrit-Change-Number: 43284 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in osmo-ttcn3-hacks[master]: IPAd: Add test for function ES10b.ExecuteFallbackMechanism
by laforge 19 Aug '26

19 Aug '26

Attention is currently required from: jolly. laforge has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43269?usp=email ) Change subject: IPAd: Add test for function ES10b.ExecuteFallbackMechanism ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43269?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I66745a24e227ac5c638f6dc5228f7f3fbe2deea1 Gerrit-Change-Number: 43269 Gerrit-PatchSet: 1 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Tue, 18 Aug 2026 15:06:41 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ttcn3-hacks[master]: IPA: Start (and stop) IPAd from test cases
by laforge 19 Aug '26

19 Aug '26

Attention is currently required from: jolly. laforge has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43268?usp=email ) Change subject: IPA: Start (and stop) IPAd from test cases ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43268?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I178f8e8750bcd8e1ddbe9a16c615be4bb3e64c1c Gerrit-Change-Number: 43268 Gerrit-PatchSet: 1 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Tue, 18 Aug 2026 15:06:29 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[L] Change in osmo-ttcn3-hacks[master]: testenv: vendor the open5gs-dbctl script
by daniel 19 Aug '26

19 Aug '26

Attention is currently required from: fixeria, osmith. daniel has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43262?usp=email ) Change subject: testenv: vendor the open5gs-dbctl script ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43262?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: If30273899d7ee498c160b723f2425a033ae4d971 Gerrit-Change-Number: 43262 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Tue, 18 Aug 2026 15:05:05 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[NoOp] Change in osmo-ttcn3-hacks[master]: IPAd: Update nvstate.bin to SGP.32 Version 1.2
by dexter 19 Aug '26

19 Aug '26

Attention is currently required from: jolly. dexter has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42969?usp=email ) Change subject: IPAd: Update nvstate.bin to SGP.32 Version 1.2 ...................................................................... Patch Set 5: (1 comment) Patchset: PS5: > This patch illustrates the problem with nvstate.bin quite well. If you use a prepared nvstate. […] As far as I can see we do not have to do anything actively to generate the nvstate.bin. onomondo-ipa will generate it automatically when it is missing. So you can just remove it and everything should still work fine. Unlike with the IoT emulation, we use for manual testing, we do not have to load any initial EIM configuration. The EIM configuration is read from the card, which means it comes from the testsuite directly via ES10. -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42969?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I3d22980f5f8be546f0d80423b3bd80d197aa8872 Gerrit-Change-Number: 42969 Gerrit-PatchSet: 5 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Tue, 18 Aug 2026 14:54:54 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sua: fix buffer overflow in sua_parse_gt()
by fixeria 19 Aug '26

19 Aug '26

fixeria has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email ) Change subject: sua: fix buffer overflow in sua_parse_gt() ...................................................................... sua: fix buffer overflow in sua_parse_gt() RFC 3868 does not impose a limit on the Number of Digits, so ideally we should be able to parse up to 255 digits. However, our gt->digits[] can only fit up to 31 digits + a terminating NUL. Cap num_digits to the size of gt->digits before decoding and parse as much as we can, returning -ENOSPC if not all digits fit. Add a unit test covering both the exact-fit and oversized num_digits cases. Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Reported-By: 3ntr0py1337 Fixes: OS#7046 --- M src/sua.c M tests/xua/xua_test.c M tests/xua/xua_test.ok 3 files changed, 42 insertions(+), 1 deletion(-) Approvals: fixeria: Looks good to me, approved pespin: Looks good to me, but someone else must approve laforge: Looks good to me, but someone else must approve Jenkins Builder: Verified diff --git a/src/sua.c b/src/sua.c index f5dcd66..35c4a8e 100644 --- a/src/sua.c +++ b/src/sua.c @@ -383,12 +383,14 @@ * \param[out] gt User-allocated structure for decoded output * \param[in] data binary-encoded data * \param[in] datalen length of \ref data in octets + * \returns 0 on success; negative on error */ int sua_parse_gt(struct osmo_sccp_gt *gt, const uint8_t *data, unsigned int datalen) { uint8_t num_digits; char *out_digits; unsigned int i; + int rc = 0; /* 8 byte header at minimum, plus digits */ if (datalen < 8) @@ -401,6 +403,15 @@ gt->npi = data[6]; gt->nai = data[7]; + /* XXX: RFC 3868 does not impose a limit on the Number of Digits, so + * ideally we should be able to parse up to 255 digits. However, our + * gt->digits[] can only fit up to 31 digits + a terminating NUL. */ + if (num_digits > sizeof(gt->digits) - 1) { + /* Parse as much as we can; return -ENOSPC */ + num_digits = sizeof(gt->digits) - 1; + rc = -ENOSPC; + } + /* parse digits */ out_digits = gt->digits; for (i = 0; i < datalen-8; i++) { @@ -414,7 +425,7 @@ } *out_digits++ = '\0'; - return 0; + return rc; } /*! \brief parse SCCP address from given xUA message part diff --git a/tests/xua/xua_test.c b/tests/xua/xua_test.c index 3c5f5fd..dcd2089 100644 --- a/tests/xua/xua_test.c +++ b/tests/xua/xua_test.c @@ -372,6 +372,31 @@ msgb_free(msg); } +static void test_sua_parse_gt_overflow(void) +{ + /* 8-byte header + way more digit octets than fit into gt->digits[32] */ + uint8_t data[8 + 64]; + struct osmo_sccp_gt gt = {}; + + memset(data, 0x11, sizeof(data)); + data[3] = 0x42; /* gti */ + data[5] = 0x00; /* tt */ + data[6] = 0x01; /* npi */ + data[7] = 0x04; /* nai */ + + data[4] = sizeof(gt.digits); /* num_digits: not enough room for '\0' */ + printf("Testing sua_parse_gt() with num_digits=%u\n", data[4]); + OSMO_ASSERT(sua_parse_gt(&gt, data, sizeof(data)) == -ENOSPC); + OSMO_ASSERT(strlen(gt.digits) == sizeof(gt.digits) - 1); + printf("OUT:%s\n", osmo_sccp_gt_dump(&gt)); + + data[4] = 0xff; /* num_digits: way too large */ + printf("Testing sua_parse_gt() with num_digits=%u\n", data[4]); + OSMO_ASSERT(sua_parse_gt(&gt, data, sizeof(data)) == -ENOSPC); + OSMO_ASSERT(strlen(gt.digits) == sizeof(gt.digits) - 1); + printf("OUT:%s\n", osmo_sccp_gt_dump(&gt)); +} + /* SCCP Message Transcoding */ struct sccp2sua_testcase { @@ -679,6 +704,7 @@ test_isup_parse(); test_sccp_addr_parser(); test_helpers(); + test_sua_parse_gt_overflow(); test_sccp2sua(); test_rkm(); test_sccp_addr_encdec(); diff --git a/tests/xua/xua_test.ok b/tests/xua/xua_test.ok index 02e5f49..f6f30d6 100644 --- a/tests/xua/xua_test.ok +++ b/tests/xua/xua_test.ok @@ -16,6 +16,10 @@ 0400000001000000040000003931393936393637393338390000000000000000000000000000000000000000 OUT:TT=0,NPL=1,NAI=4,DIG=919969679389 0400000001000000040000003931393936393637393338390000000000000000000000000000000000000000 +Testing sua_parse_gt() with num_digits=32 +OUT:DIG=1111111111111111111111111111111 +Testing sua_parse_gt() with num_digits=255 +OUT:DIG=1111111111111111111111111111111 => BSSMAP-RESET SCCP Input: [L2]> 09 00 03 05 07 02 42 fe 02 42 fe 06 00 04 30 04 01 20 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Gerrit-Change-Number: 43228 Gerrit-PatchSet: 3 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: sua: fix buffer overflow in sua_parse_gt()
by fixeria 19 Aug '26

19 Aug '26

fixeria has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email ) Change subject: sua: fix buffer overflow in sua_parse_gt() ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Gerrit-Change-Number: 43228 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Tue, 18 Aug 2026 14:53:26 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[M] Change in osmo-ttcn3-hacks[master]: IPAd: Make tests work with testenv and current master of IPAd
by laforge 19 Aug '26

19 Aug '26

Attention is currently required from: jolly, osmith. laforge has posted comments on this change by jolly. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42967?usp=email ) Change subject: IPAd: Make tests work with testenv and current master of IPAd ...................................................................... Patch Set 5: -Code-Review -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/42967?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Id4abf15feb179b17594bd11c6e7089469684900c Gerrit-Change-Number: 42967 Gerrit-PatchSet: 5 Gerrit-Owner: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Comment-Date: Tue, 18 Aug 2026 14:49:19 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ci[master]: ansible: build-host: configure email sending
by laforge 19 Aug '26

19 Aug '26

Attention is currently required from: osmith. laforge has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ci/+/43283?usp=email ) Change subject: ansible: build-host: configure email sending ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43283?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I22ea83de3417cbbb578345d34f18095c47441610 Gerrit-Change-Number: 43283 Gerrit-PatchSet: 2 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Tue, 18 Aug 2026 14:48:54 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026