August 2026 - gerrit-log - lists.osmocom.org

[L] Change in libosmo-sigtran[master]: xua: Validate IE lengths of incoming messages
by pespin 25 Aug '26

25 Aug '26

Attention is currently required from: fixeria, laforge, osmith. Hello Jenkins Builder, fixeria, laforge, osmith, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43386?usp=email to look at the new patch set (#5). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder Change subject: xua: Validate IE lengths of incoming messages ...................................................................... xua: Validate IE lengths of incoming messages Improve the data structures defining M3UA/SUA messages to also include expected min/max lengths of each IE in a given message. This way we already cover in one place validation of fixed length IEs. Related: OS#7074 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: I9b1ae0dbc324123790942c9e6068f6822e3bb957 --- M src/m3ua.c M src/sua.c M src/xua_msg.c M src/xua_msg.h 4 files changed, 399 insertions(+), 112 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/86/43386/5 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43386?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I9b1ae0dbc324123790942c9e6068f6822e3bb957 Gerrit-Change-Number: 43386 Gerrit-PatchSet: 5 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[XS] Change in libosmo-sigtran[master]: xua_asp_fsm: ASP ACT: Avoid double lookup of Traffic Mode Type IE
by pespin 25 Aug '26

25 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43398?usp=email ) Change subject: xua_asp_fsm: ASP ACT: Avoid double lookup of Traffic Mode Type IE ...................................................................... xua_asp_fsm: ASP ACT: Avoid double lookup of Traffic Mode Type IE Change-Id: Idc764d9d6f517cd28defaf226e6b0957cce92585 --- M src/xua_asp_fsm.c 1 file changed, 3 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/98/43398/1 diff --git a/src/xua_asp_fsm.c b/src/xua_asp_fsm.c index 679533b..62bc932 100644 --- a/src/xua_asp_fsm.c +++ b/src/xua_asp_fsm.c @@ -640,6 +640,7 @@ struct osmo_ss7_as *as; struct ss7_as_asp_assoc *assoc; struct xua_msg_part *asp_id_ie; + struct xua_msg_part *traf_mode_ie; struct xua_msg *xua_in; uint32_t traf_mode = 0; struct xua_msg_part *rctx_ie; @@ -689,8 +690,8 @@ case XUA_ASP_E_ASPTM_ASPAC: xua_in = data; ENSURE_SG_OR_IPSP(fi, event); - if (xua_msg_find_tag(xua_in, M3UA_IEI_TRAF_MODE_TYP)) { - traf_mode = xua_msg_get_u32(xua_in, M3UA_IEI_TRAF_MODE_TYP); + if ((traf_mode_ie = xua_msg_find_tag(xua_in, M3UA_IEI_TRAF_MODE_TYP))) { + traf_mode = xua_msg_part_get_u32(traf_mode_ie); if (traf_mode != M3UA_TMOD_OVERRIDE && traf_mode != M3UA_TMOD_LOADSHARE && traf_mode != M3UA_TMOD_BCAST) { -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43398?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Idc764d9d6f517cd28defaf226e6b0957cce92585 Gerrit-Change-Number: 43398 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in libosmo-sigtran[master]: xua_rkm: rx REG REQ: clean up Routing Context IE checks
by pespin 25 Aug '26

25 Aug '26

Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43396?usp=email to look at the new patch set (#2). Change subject: xua_rkm: rx REG REQ: clean up Routing Context IE checks ...................................................................... xua_rkm: rx REG REQ: clean up Routing Context IE checks RFC4666 3.6.1 clearly marks the IE as optional. Our exisitng logic also expected that the routing key may not be there. Validate existence of the IE and explicitly set local variable to 0 instead of relying on xua_msg_get_u32() returning 0 on failure. Change-Id: I0dd6b2892f9ffa72880f98d03e13f0b354c47c61 --- M src/xua_rkm.c 1 file changed, 4 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/96/43396/2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43396?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I0dd6b2892f9ffa72880f98d03e13f0b354c47c61 Gerrit-Change-Number: 43396 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder

1 0

[S] Change in libosmo-sigtran[master]: xua_rkm: REG REQ: clean up Traffic Mode Type checks
by pespin 25 Aug '26

25 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43397?usp=email ) Change subject: xua_rkm: REG REQ: clean up Traffic Mode Type checks ...................................................................... xua_rkm: REG REQ: clean up Traffic Mode Type checks Validate existence of the IE and explicitly set local variable to 0 instead of relying on xua_msg_get_u32() returning 0 on failure. Change-Id: I4b07b0608eaf2e841f47f7c664e056152ca68f72 --- M src/xua_rkm.c 1 file changed, 17 insertions(+), 8 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/97/43397/1 diff --git a/src/xua_rkm.c b/src/xua_rkm.c index ec898d2..3ceeaa2 100644 --- a/src/xua_rkm.c +++ b/src/xua_rkm.c @@ -175,7 +175,7 @@ struct msgb *resp, struct osmo_ss7_as **newly_assigned_as, unsigned int max_nas_idx, unsigned int *nas_idx) { - struct xua_msg_part *rctx_ie; + struct xua_msg_part *rctx_ie, *tmode_ie; uint32_t rk_id, rctx, _tmode, dpc; enum osmo_ss7_as_traffic_mode tmode; struct osmo_ss7_as *as = NULL; @@ -189,13 +189,22 @@ /* ASP may already include a routing context value here */ rctx_ie = xua_msg_find_tag(inner, M3UA_IEI_ROUTE_CTX); - /* traffic mode type (0 = undefined) */ - _tmode = xua_msg_get_u32(inner, M3UA_IEI_TRAF_MODE_TYP); - if (xua_msg_find_tag(inner, M3UA_IEI_TRAF_MODE_TYP) && _tmode != M3UA_TMOD_OVERRIDE && - _tmode != M3UA_TMOD_LOADSHARE && _tmode != M3UA_TMOD_BCAST) { - LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Invalid Traffic Mode %u\n", _tmode); - msgb_append_reg_res(resp, rk_id, M3UA_RKM_REG_ERR_UNSUPP_TRAF_MODE, 0); - return -1; + /* traffic mode type */ + tmode_ie = xua_msg_find_tag(inner, M3UA_IEI_TRAF_MODE_TYP); + if (tmode_ie) { + _tmode = xua_msg_part_get_u32(tmode_ie); + switch (_tmode) { + case M3UA_TMOD_OVERRIDE: + case M3UA_TMOD_LOADSHARE: + case M3UA_TMOD_BCAST: + break; + default: + LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Invalid Traffic Mode %u\n", _tmode); + msgb_append_reg_res(resp, rk_id, M3UA_RKM_REG_ERR_UNSUPP_TRAF_MODE, 0); + return -1; + } + } else { + _tmode = 0; /* (0 = undefined) */ } /* destination point code (mandatory) */ -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43397?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I4b07b0608eaf2e841f47f7c664e056152ca68f72 Gerrit-Change-Number: 43397 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: xua_rkm: rx DEREG REQ: Fix potential read buffer overflow
by pespin 25 Aug '26

25 Aug '26

Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43395?usp=email to look at the new patch set (#2). Change subject: xua_rkm: rx DEREG REQ: Fix potential read buffer overflow ...................................................................... xua_rkm: rx DEREG REQ: Fix potential read buffer overflow The loop in the function was not taking into account cases like data being non-multiple of 4. Related: OS#7074 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: I861259b2bb57ce80167a8f2d1c1770b56dc09718 --- M src/xua_rkm.c 1 file changed, 21 insertions(+), 7 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/95/43395/2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43395?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I861259b2bb57ce80167a8f2d1c1770b56dc09718 Gerrit-Change-Number: 43395 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder

1 0

[XS] Change in libosmo-sigtran[master]: xua_rkm: rx REG REQ: Fix potential assert reading optional rctx IE
by pespin 25 Aug '26

25 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43396?usp=email ) Change subject: xua_rkm: rx REG REQ: Fix potential assert reading optional rctx IE ...................................................................... xua_rkm: rx REG REQ: Fix potential assert reading optional rctx IE RFC4666 3.6.1 clearly marks the IE as optional. Our exisitng logic also expected that the routing key may not be there. Related: OS#7074 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: I0dd6b2892f9ffa72880f98d03e13f0b354c47c61 --- M src/xua_rkm.c 1 file changed, 4 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/96/43396/1 diff --git a/src/xua_rkm.c b/src/xua_rkm.c index 61730db..ec898d2 100644 --- a/src/xua_rkm.c +++ b/src/xua_rkm.c @@ -175,6 +175,7 @@ struct msgb *resp, struct osmo_ss7_as **newly_assigned_as, unsigned int max_nas_idx, unsigned int *nas_idx) { + struct xua_msg_part *rctx_ie; uint32_t rk_id, rctx, _tmode, dpc; enum osmo_ss7_as_traffic_mode tmode; struct osmo_ss7_as *as = NULL; @@ -186,7 +187,7 @@ /* mandatory local routing key ID */ rk_id = xua_msg_get_u32(inner, M3UA_IEI_LOC_RKEY_ID); /* ASP may already include a routing context value here */ - rctx = xua_msg_get_u32(inner, M3UA_IEI_ROUTE_CTX); + rctx_ie = xua_msg_find_tag(inner, M3UA_IEI_ROUTE_CTX); /* traffic mode type (0 = undefined) */ _tmode = xua_msg_get_u32(inner, M3UA_IEI_TRAF_MODE_TYP); @@ -229,8 +230,9 @@ * all AS/RK in situations where the peers are trusted. */ - if (rctx) { + if (rctx_ie) { /* check if there is already an AS for this routing key */ + rctx = xua_msg_part_get_u32(rctx_ie); as = osmo_ss7_as_find_by_rctx(asp->inst, rctx); } else { /* if the ASP did not include a routing context number, allocate -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43396?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I0dd6b2892f9ffa72880f98d03e13f0b354c47c61 Gerrit-Change-Number: 43396 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in libosmo-sigtran[master]: xua_rkm: Validate IE lengths of RKM inner messages
by pespin 25 Aug '26

25 Aug '26

Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43394?usp=email to look at the new patch set (#2). Change subject: xua_rkm: Validate IE lengths of RKM inner messages ...................................................................... xua_rkm: Validate IE lengths of RKM inner messages Related: OS#7074 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: Ibe7e446b1a537c0c09f8049add3460e37cdd58e8 --- M src/m3ua.c M src/xua_internal.h M src/xua_msg.c M src/xua_msg.h M src/xua_rkm.c 5 files changed, 140 insertions(+), 39 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/94/43394/2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43394?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ibe7e446b1a537c0c09f8049add3460e37cdd58e8 Gerrit-Change-Number: 43394 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder

1 0

[M] Change in libosmocore[master]: linuxlist: fix false-positive UBSan misaligned-access reports
by fixeria 25 Aug '26

25 Aug '26

Attention is currently required from: laforge, pespin. fixeria has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/libosmocore/+/43150?usp=email ) Change subject: linuxlist: fix false-positive UBSan misaligned-access reports ...................................................................... Patch Set 2: (1 comment) Patchset: PS2: Related: https://stackoverflow.com/questions/64859526/does-linux-kernel-list-impleme… https://www.kernel.org/doc/html/v7.2/dev-tools/ubsan.html Quote from the 2nd link: > Detection of unaligned accesses controlled through the separate option -CONFIG_UBSAN_ALIGNMENT. It’s off by default on architectures that support unaligned accesses (CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y). One could still enable it in config, just note that it will produce a lot of UBSAN reports. We need to decide how much do we care about this, especially given that this is a false positive. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43150?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I0424e76e76d8aa9402bd1a5aefe789de16e72fae Gerrit-Change-Number: 43150 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-CC: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Tue, 25 Aug 2026 16:10:24 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: xua_rkm: rx DEREG REQ: Fix potential read buffer overflow
by pespin 25 Aug '26

25 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43395?usp=email ) Change subject: xua_rkm: rx DEREG REQ: Fix potential read buffer overflow ...................................................................... xua_rkm: rx DEREG REQ: Fix potential read buffer overflow The loop in the function was not taking into account cases like data being non-multiple of 4. Change-Id: I861259b2bb57ce80167a8f2d1c1770b56dc09718 --- M src/xua_rkm.c 1 file changed, 21 insertions(+), 7 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/95/43395/1 diff --git a/src/xua_rkm.c b/src/xua_rkm.c index 6f2efc2..61730db 100644 --- a/src/xua_rkm.c +++ b/src/xua_rkm.c @@ -462,19 +462,33 @@ /* SG: receive a De-Registration request from ASP */ static int m3ua_rx_rkm_dereg_req(struct osmo_ss7_asp *asp, struct xua_msg *xua) { - struct xua_msg_part *part = xua_msg_find_tag(xua, M3UA_IEI_ROUTE_CTX); + struct xua_msg_part *rctx_ie = xua_msg_find_tag(xua, M3UA_IEI_ROUTE_CTX); struct msgb *resp = m3ua_msgb_alloc(__func__); - uint32_t *rctx; - if (!part) - return -1; + OSMO_ASSERT(rctx_ie); - for (rctx = (uint32_t *)part->dat; (uint8_t *)rctx < part->dat + part->len; rctx++) - handle_rkey_dereg(asp, ntohl(*rctx), resp); + if (rctx_ie->len == 0) { + LOGPASP(asp, DLSS7, LOGL_ERROR, "%s(): Received Routing Context with len 0\n", __func__); + msgb_append_dereg_res(resp, M3UA_RKM_DEREG_ERR_INVAL_RCTX, 0); + goto send_resp; + } + if (rctx_ie->len & 0x03) { + LOGPASP(asp, DLSS7, LOGL_ERROR, + "%s(): Received Routing Context IE length non-multiple of 4!\n", __func__); + msgb_append_dereg_res(resp, M3UA_RKM_DEREG_ERR_INVAL_RCTX, 0); + goto send_resp; + } + + for (unsigned int i = 0; i < rctx_ie->len / sizeof(uint32_t); i++) { + uint8_t *rctx_raw = &rctx_ie->dat[i * sizeof(uint32_t)]; + uint32_t rctx = osmo_load32be(rctx_raw); + handle_rkey_dereg(asp, rctx, resp); + } + +send_resp: msgb_push_m3ua_hdr(resp, M3UA_MSGC_RKM, M3UA_RKM_DEREG_RSP); osmo_ss7_asp_send(asp, resp); - return 0; } -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43395?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I861259b2bb57ce80167a8f2d1c1770b56dc09718 Gerrit-Change-Number: 43395 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in libosmo-sigtran[master]: xua_rkm: Validate IE lengths of RKM inner messages
by pespin 25 Aug '26

25 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43394?usp=email ) Change subject: xua_rkm: Validate IE lengths of RKM inner messages ...................................................................... xua_rkm: Validate IE lengths of RKM inner messages Change-Id: Ibe7e446b1a537c0c09f8049add3460e37cdd58e8 --- M src/m3ua.c M src/xua_internal.h M src/xua_msg.c M src/xua_msg.h M src/xua_rkm.c 5 files changed, 140 insertions(+), 39 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/94/43394/1 diff --git a/src/m3ua.c b/src/m3ua.c index d1a7e27..46282c4 100644 --- a/src/m3ua.c +++ b/src/m3ua.c @@ -202,14 +202,32 @@ XUA_MSG_PART_CLASS(M3UA_IEI_ROUT_KEY, (mandatory), 0, UINT16_MAX) #define M3UA_MSG_PART_CLASS_REG_RESULT(mandatory) \ - XUA_MSG_PART_CLASS(M3UA_IEI_REG_RESULT, (mandatory), 0, UINT16_MAX) + XUA_MSG_PART_CLASS(M3UA_IEI_REG_RESULT, (mandatory), 24, UINT16_MAX) #define M3UA_MSG_PART_CLASS_DEREG_RESULT(mandatory) \ - XUA_MSG_PART_CLASS(M3UA_IEI_DEREG_RESULT, (mandatory), 0, UINT16_MAX) + XUA_MSG_PART_CLASS(M3UA_IEI_DEREG_RESULT, (mandatory), 16, UINT16_MAX) + +#define M3UA_MSG_PART_CLASS_LOC_RKEY_ID(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_LOC_RKEY_ID, (mandatory)) + +#define M3UA_MSG_PART_CLASS_DEST_PC(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_DEST_PC, (mandatory)) + +#define M3UA_MSG_PART_CLASS_SVC_IND(mandatory) \ + XUA_MSG_PART_CLASS(M3UA_IEI_SVC_IND, (mandatory), 0, UINT16_MAX) + +#define M3UA_MSG_PART_CLASS_ORIG_PC(mandatory) \ + XUA_MSG_PART_CLASS(M3UA_IEI_ORIG_PC, (mandatory), 0, UINT16_MAX) #define M3UA_MSG_PART_CLASS_PROT_DATA(mandatory) \ XUA_MSG_PART_CLASS(M3UA_IEI_PROT_DATA, (mandatory), 0, UINT16_MAX) +#define M3UA_MSG_PART_CLASS_REG_STATUS(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_REG_STATUS, (mandatory)) + +#define M3UA_MSG_PART_CLASS_DEREG_STATUS(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_DEREG_STATUS, (mandatory)) + /* XFER */ static const struct xua_msg_part_class data_ies[] = { M3UA_MSG_PART_CLASS_NET_APPEAR(false), @@ -452,6 +470,34 @@ }, }; +/* Inner RKM messages: RKM REG REQ "Routing Key" */ +const struct xua_msg_part_class m3ua_rkm_reg_req_routing_key_ies[] = { + M3UA_MSG_PART_CLASS_LOC_RKEY_ID(true), + M3UA_MSG_PART_CLASS_ROUTE_CTX1(false), + M3UA_MSG_PART_CLASS_TRAF_MODE_TYP(false), + M3UA_MSG_PART_CLASS_DEST_PC(true), + M3UA_MSG_PART_CLASS_NET_APPEAR(false), + M3UA_MSG_PART_CLASS_SVC_IND(false), + M3UA_MSG_PART_CLASS_ORIG_PC(false), + XUA_MSG_PART_CLASS_EOF +}; + +/* Inner RKM messages: RKM REG RSP "Registration Result" */ +const struct xua_msg_part_class m3ua_rkm_reg_rsp_registration_result_ies[] = { + M3UA_MSG_PART_CLASS_LOC_RKEY_ID(true), + M3UA_MSG_PART_CLASS_ROUTE_CTX1(true), + M3UA_MSG_PART_CLASS_REG_STATUS(true), + XUA_MSG_PART_CLASS_EOF +}; + + +/* Inner RKM messages: RKM DEREG RSP "Deregistration Result" */ +const struct xua_msg_part_class m3ua_rkm_dereg_rsp_deregistration_result_ies[] = { + M3UA_MSG_PART_CLASS_ROUTE_CTX1(true), + M3UA_MSG_PART_CLASS_DEREG_STATUS(true), + XUA_MSG_PART_CLASS_EOF +}; + /* M3UA dialect of XUA, MGMT,XFER,SNM,ASPSM,ASPTM,RKM */ const struct xua_dialect xua_dialect_m3ua = { .name = "M3UA", diff --git a/src/xua_internal.h b/src/xua_internal.h index 5195b35..47c4974 100644 --- a/src/xua_internal.h +++ b/src/xua_internal.h @@ -90,6 +90,9 @@ extern const struct xua_msg_class m3ua_msg_class_rkm; extern const struct xua_msg_class m3ua_msg_class_aspsm; extern const struct xua_msg_class m3ua_msg_class_asptm; +extern const struct xua_msg_part_class m3ua_rkm_reg_req_routing_key_ies[]; +extern const struct xua_msg_part_class m3ua_rkm_reg_rsp_registration_result_ies[]; +extern const struct xua_msg_part_class m3ua_rkm_dereg_rsp_deregistration_result_ies[]; extern const struct value_string m3ua_snm_msgt_names[]; extern const struct value_string m3ua_err_names[]; diff --git a/src/xua_msg.c b/src/xua_msg.c index 44b173d..1b37c89 100644 --- a/src/xua_msg.c +++ b/src/xua_msg.c @@ -535,6 +535,47 @@ return buf; } + +/* Validate incoming xua_msg. returns 0 on success, M3UA_ERR_* on failure. */ +int xua_dialect_check_all_ies_ext(const struct xua_dialect *dialect, const struct xua_msg_class *xmc, + uint8_t msg_type, const struct xua_msg_part_class *ies, + const struct xua_msg *xua, bool repeated_parts) +{ + const struct xua_msg_part_class *ie; + + for (ie = ies; ie->tag; ie = ies++) { + struct xua_msg_part *part; + bool found = false; + llist_for_each_entry(part, &xua->headers, entry) { + if (part->tag != ie->tag) + continue; + found = true; + if (part->len < ie->len_min || part->len > ie->len_max) { + LOGP(dialect->log_subsys, LOGL_ERROR, + "%s Message %s:%s IE %s length %" PRIu16 + " out of range [%" PRIu16 ", %" PRIu16 "]\n", + dialect->name, xmc->name, + xua_class_msg_name(xmc, msg_type), + xua_class_iei_name(xmc, ie->tag), + part->len, ie->len_min, ie->len_max); + return M3UA_ERR_PARAM_FIELD_ERR; + } + if (!repeated_parts) + break; + } + if (ie->mandatory && !found) { + LOGP(dialect->log_subsys, LOGL_ERROR, + "%s Message %s:%s should contain IE %s, but doesn't\n", + dialect->name, xmc->name, + xua_class_msg_name(xmc, msg_type), + xua_class_iei_name(xmc, ie->tag)); + return M3UA_ERR_MISSING_PARAM; + } + } + + return 0; +} + /* Validate incoming xua_msg. returns 0 on success, M3UA_ERR_* on failure. */ int xua_dialect_check_all_ies(const struct xua_dialect *dialect, const struct xua_msg *xua) { @@ -542,7 +583,6 @@ uint8_t msg_type = xua->hdr.msg_type; const struct xua_msg_class *xmc = dialect->class[msg_class]; const struct xua_msg_part_class *ies; - const struct xua_msg_part_class *ie; /* unknown class? */ if (!xmc) @@ -553,32 +593,7 @@ if (!ies) return 0; - for (ie = ies; ie->tag; ie = ies++) { - struct xua_msg_part *part = xua_msg_find_tag(xua, ie->tag); - if (!part) { - if (!ie->mandatory) - continue; - LOGP(dialect->log_subsys, LOGL_ERROR, - "%s Message %s:%s should contain IE %s, but doesn't\n", - dialect->name, xmc->name, - xua_class_msg_name(xmc, msg_type), - xua_class_iei_name(xmc, ie->tag)); - return M3UA_ERR_MISSING_PARAM; - } - - if (part->len < ie->len_min || part->len > ie->len_max) { - LOGP(dialect->log_subsys, LOGL_ERROR, - "%s Message %s:%s IE %s length %" PRIu16 - " out of range [%" PRIu16 ", %" PRIu16 "]\n", - dialect->name, xmc->name, - xua_class_msg_name(xmc, msg_type), - xua_class_iei_name(xmc, ie->tag), - part->len, ie->len_min, ie->len_max); - return M3UA_ERR_PARAM_FIELD_ERR; - } - } - - return 0; + return xua_dialect_check_all_ies_ext(dialect, xmc, msg_type, ies, xua, false); } char *xua_msg_dump(const struct xua_msg *xua, const struct xua_dialect *dialect) diff --git a/src/xua_msg.h b/src/xua_msg.h index 3070435..6e36a7b 100644 --- a/src/xua_msg.h +++ b/src/xua_msg.h @@ -126,6 +126,9 @@ char *xua_hdr_dump(const struct xua_msg *xua, const struct xua_dialect *dialect); char *xua_msg_dump(const struct xua_msg *xua, const struct xua_dialect *dialect); int xua_dialect_check_all_ies(const struct xua_dialect *dialect, const struct xua_msg *xua); +int xua_dialect_check_all_ies_ext(const struct xua_dialect *dialect, const struct xua_msg_class *xmc, + uint8_t msg_type, const struct xua_msg_part_class *ies, + const struct xua_msg *xua, bool repeated_parts); int xua_msg_event_map(const struct xua_msg *xua, const struct xua_msg_event_map *maps, diff --git a/src/xua_rkm.c b/src/xua_rkm.c index 92fbdac..6f2efc2 100644 --- a/src/xua_rkm.c +++ b/src/xua_rkm.c @@ -349,6 +349,7 @@ struct msgb *resp = m3ua_msgb_alloc(__func__); struct osmo_ss7_as *newly_assigned_as[MAX_NEW_AS]; unsigned int i, num_newly_assigned_as = 0; + int rc; memset(newly_assigned_as, 0, sizeof(newly_assigned_as)); @@ -362,7 +363,17 @@ inner = xua_from_nested(part); if (!inner) { LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Unable to parse " - "nested IE for Routing Key\n"); + "nested IEs in Routing Key\n"); + /* FIXME: ERROR to peer */ + continue; + } + rc = xua_dialect_check_all_ies_ext(&xua_dialect_m3ua, &m3ua_msg_class_rkm, M3UA_RKM_REG_REQ, + m3ua_rkm_reg_req_routing_key_ies, inner, true); + if (rc > 0) { + LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Unable to parse " + "nested IEs in Routing Key\n"); + xua_msg_free(inner); + /* FIXME: ERROR to peer */ continue; } /* handle single registration and append result to @@ -502,6 +513,7 @@ { struct xua_msg_part *part; struct xua_msg *inner = NULL; + int rc; llist_for_each_entry(part, &xua->headers, entry) { /* skip other IEs and/or short REG_RES IEs */ @@ -512,8 +524,22 @@ * registration result (we only support one AS per ASP * for now) */ inner = xua_from_nested(part); - if (!inner) + if (!inner) { + LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Unable to parse " + "nested IEs in Registration Result\n"); + /* FIXME: ERROR to peer */ continue; + } + + rc = xua_dialect_check_all_ies_ext(&xua_dialect_m3ua, &m3ua_msg_class_rkm, M3UA_RKM_REG_RSP, + m3ua_rkm_reg_rsp_registration_result_ies, inner, false); + if (rc > 0) { + LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Unable to parse " + "nested IEs in Registration Result\n"); + xua_msg_free(inner); + /* FIXME: ERROR to peer */ + continue; + } handle_rkey_reg_resp(asp, inner); xua_msg_free(inner); @@ -526,13 +552,6 @@ { struct osmo_xlm_prim *oxp; - if (!xua_msg_find_tag(inner, M3UA_IEI_DEREG_STATUS) || - !xua_msg_find_tag(inner, M3UA_IEI_ROUTE_CTX)) { - LOGPASP(asp, DLSS7, LOGL_NOTICE, "Missing Inner IE in DEREG RESP\n"); - /* FIXME: ERROR to peer */ - return -1; - } - oxp = xua_xlm_prim_alloc_m_rk_dereg_cfm(xua_msg_get_u32(inner, M3UA_IEI_ROUTE_CTX), xua_msg_get_u32(inner, M3UA_IEI_DEREG_STATUS)); @@ -551,6 +570,7 @@ { struct xua_msg_part *part; struct xua_msg *inner = NULL; + int rc; llist_for_each_entry(part, &xua->headers, entry) { /* skip other IEs and/or short REG_RES IEs */ @@ -561,8 +581,22 @@ * registration result (we only support one AS per ASP * for now) */ inner = xua_from_nested(part); - if (!inner) + if (!inner) { + LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Unable to parse " + "nested IEs in Deregistration Result\n"); + /* FIXME: ERROR to peer */ continue; + } + + rc = xua_dialect_check_all_ies_ext(&xua_dialect_m3ua, &m3ua_msg_class_rkm, M3UA_RKM_DEREG_RSP, + m3ua_rkm_dereg_rsp_deregistration_result_ies, inner, false); + if (rc > 0) { + LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Unable to parse " + "nested IEs in Deregistration Result\n"); + xua_msg_free(inner); + /* FIXME: ERROR to peer */ + continue; + } handle_rkey_dereg_resp(asp, inner); xua_msg_free(inner); -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43394?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ibe7e446b1a537c0c09f8049add3460e37cdd58e8 Gerrit-Change-Number: 43394 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026