August 2026 - gerrit-log - lists.osmocom.org

[S] Change in libosmo-sigtran[master]: xua_msg: return M3UA_ERR in xua_dialect_check_all_ies()
by pespin 25 Aug '26

25 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43389?usp=email ) Change subject: xua_msg: return M3UA_ERR in xua_dialect_check_all_ies() ...................................................................... xua_msg: return M3UA_ERR in xua_dialect_check_all_ies() This way we can provide better information to peer on what went wrong. Furthermore, the return values now become much clearer. Change-Id: I9df00f9b10f7341171912cf32e8ba57344ae8b4a --- M src/m3ua.c M src/sua.c M src/xua_msg.c 3 files changed, 11 insertions(+), 10 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/89/43389/1 diff --git a/src/m3ua.c b/src/m3ua.c index 5c7c4ef..d1a7e27 100644 --- a/src/m3ua.c +++ b/src/m3ua.c @@ -1054,8 +1054,8 @@ LOGPASP(asp, DLM3UA, LOGL_DEBUG, "Received M3UA Message (%s)\n", xua_hdr_dump(xua, &xua_dialect_m3ua)); - if (!xua_dialect_check_all_ies(&xua_dialect_m3ua, xua)) { - rc = M3UA_ERR_MISSING_PARAM; + rc = xua_dialect_check_all_ies(&xua_dialect_m3ua, xua); + if (rc > 0) { xua_msg_free(xua); goto out; } diff --git a/src/sua.c b/src/sua.c index 53ca3b8..2011f86 100644 --- a/src/sua.c +++ b/src/sua.c @@ -937,9 +937,9 @@ LOGPASP(asp, DLSUA, LOGL_DEBUG, "Received SUA Message (%s)\n", xua_hdr_dump(xua, &xua_dialect_sua)); - if (!xua_dialect_check_all_ies(&xua_dialect_sua, xua)) { - /* FIXME: Return error? */ - err = sua_gen_error_msg(SUA_ERR_MISSING_PARAM, msg); + rc = xua_dialect_check_all_ies(&xua_dialect_sua, xua); + if (rc > 0) { + err = sua_gen_error_msg(rc, msg); goto out; } diff --git a/src/xua_msg.c b/src/xua_msg.c index 2ec1497..44b173d 100644 --- a/src/xua_msg.c +++ b/src/xua_msg.c @@ -535,6 +535,7 @@ return buf; } +/* Validate incoming xua_msg. returns 0 on success, M3UA_ERR_* on failure. */ int xua_dialect_check_all_ies(const struct xua_dialect *dialect, const struct xua_msg *xua) { uint8_t msg_class = xua->hdr.msg_class; @@ -545,12 +546,12 @@ /* unknown class? */ if (!xmc) - return 1; + return 0; ies = &xmc->ies[msg_type][0]; /* no mandatory IEs? */ if (!ies) - return 1; + return 0; for (ie = ies; ie->tag; ie = ies++) { struct xua_msg_part *part = xua_msg_find_tag(xua, ie->tag); @@ -562,7 +563,7 @@ dialect->name, xmc->name, xua_class_msg_name(xmc, msg_type), xua_class_iei_name(xmc, ie->tag)); - return 0; + return M3UA_ERR_MISSING_PARAM; } if (part->len < ie->len_min || part->len > ie->len_max) { @@ -573,11 +574,11 @@ xua_class_msg_name(xmc, msg_type), xua_class_iei_name(xmc, ie->tag), part->len, ie->len_min, ie->len_max); - return 0; + return M3UA_ERR_PARAM_FIELD_ERR; } } - return 1; + return 0; } char *xua_msg_dump(const struct xua_msg *xua, const struct xua_dialect *dialect) -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43389?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I9df00f9b10f7341171912cf32e8ba57344ae8b4a Gerrit-Change-Number: 43389 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in libosmo-sigtran[master]: xua_msg: Constify input xua_msg param
by pespin 25 Aug '26

25 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43388?usp=email ) Change subject: xua_msg: Constify input xua_msg param ...................................................................... xua_msg: Constify input xua_msg param Change-Id: I3641f9b2ab487ac32faa1872831ca249ce41ffb8 --- M src/xua_msg.c M src/xua_msg.h 2 files changed, 2 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/88/43388/1 diff --git a/src/xua_msg.c b/src/xua_msg.c index 690f0a6..2ec1497 100644 --- a/src/xua_msg.c +++ b/src/xua_msg.c @@ -535,7 +535,7 @@ return buf; } -int xua_dialect_check_all_ies(const struct xua_dialect *dialect, struct xua_msg *xua) +int xua_dialect_check_all_ies(const struct xua_dialect *dialect, const struct xua_msg *xua) { uint8_t msg_class = xua->hdr.msg_class; uint8_t msg_type = xua->hdr.msg_type; diff --git a/src/xua_msg.h b/src/xua_msg.h index 39249e2..3070435 100644 --- a/src/xua_msg.h +++ b/src/xua_msg.h @@ -125,7 +125,7 @@ const char *xua_class_iei_name(const struct xua_msg_class *xmc, uint16_t iei); char *xua_hdr_dump(const struct xua_msg *xua, const struct xua_dialect *dialect); char *xua_msg_dump(const struct xua_msg *xua, const struct xua_dialect *dialect); -int xua_dialect_check_all_ies(const struct xua_dialect *dialect, struct xua_msg *xua); +int xua_dialect_check_all_ies(const struct xua_dialect *dialect, const struct xua_msg *xua); int xua_msg_event_map(const struct xua_msg *xua, const struct xua_msg_event_map *maps, -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43388?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I3641f9b2ab487ac32faa1872831ca249ce41ffb8 Gerrit-Change-Number: 43388 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in libosmo-sigtran[master]: m3ua: Validate IE lengths of ASPTM & ASPSM messages
by pespin 25 Aug '26

25 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43387?usp=email ) Change subject: m3ua: Validate IE lengths of ASPTM & ASPSM messages ...................................................................... m3ua: Validate IE lengths of ASPTM & ASPSM messages Since all IEs in APTM and ASPSM messages are Optional, and until recently we only validated presence of mandatory IEs, there were no related structs for such messages. Now that we validate lengths of IEs, add the definitions for those messages too. Related: OS#7074 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: I27406eac5b82c1e6702961bb3482b0bf7fe4ff15 --- M src/m3ua.c 1 file changed, 64 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/87/43387/1 diff --git a/src/m3ua.c b/src/m3ua.c index 7de2414..5c7c4ef 100644 --- a/src/m3ua.c +++ b/src/m3ua.c @@ -163,6 +163,12 @@ #define M3UA_MSG_PART_CLASS_DIAG_INFO(mandatory) \ XUA_MSG_PART_CLASS(M3UA_IEI_DIAG_INFO, (mandatory), 0, UINT16_MAX) +#define M3UA_MSG_PART_CLASS_HEARDBT_DATA(mandatory) \ + XUA_MSG_PART_CLASS(M3UA_IEI_HEARDBT_DATA, (mandatory), 0, UINT16_MAX) + +#define M3UA_MSG_PART_CLASS_TRAF_MODE_TYP(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_TRAF_MODE_TYP, (mandatory)) + #define M3UA_MSG_PART_CLASS_ERR_CODE(mandatory) \ XUA_MSG_PART_CLASS_U32(M3UA_IEI_ERR_CODE, (mandatory)) @@ -293,6 +299,28 @@ }; /* ASPSM */ +static const struct xua_msg_part_class asp_up_ies[] = { + M3UA_MSG_PART_CLASS_ASP_ID(false), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF +}; +static const struct xua_msg_part_class asp_down_ies[] = { + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF +}; +static const struct xua_msg_part_class beat_ies[] = { + M3UA_MSG_PART_CLASS_HEARDBT_DATA(false), + XUA_MSG_PART_CLASS_EOF +}; +static const struct xua_msg_part_class asp_up_ack_ies[] = { + M3UA_MSG_PART_CLASS_ASP_ID(false), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF +}; +static const struct xua_msg_part_class asp_down_ack_ies[] = { + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF +}; static const struct value_string m3ua_aspsm_msgt_names[] = { { M3UA_ASPSM_UP, "UP" }, { M3UA_ASPSM_DOWN, "DOWN" }, @@ -305,9 +333,39 @@ const struct xua_msg_class m3ua_msg_class_aspsm = { .name = "ASPSM", .msgt_names = m3ua_aspsm_msgt_names, + .ies = { + IES(M3UA_ASPSM_UP, asp_up_ies), + IES(M3UA_ASPSM_DOWN, asp_down_ies), + IES(M3UA_ASPSM_BEAT, beat_ies), + IES(M3UA_ASPSM_UP_ACK, asp_up_ack_ies), + IES(M3UA_ASPSM_DOWN_ACK, asp_down_ack_ies), + /* M3UA_ASPSM_BEAT_ACK has not IEs */ + }, }; /* ASPTM */ +static const struct xua_msg_part_class asp_act_ies[] = { + M3UA_MSG_PART_CLASS_TRAF_MODE_TYP(false), + M3UA_MSG_PART_CLASS_ROUTE_CTX(false), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF +}; +static const struct xua_msg_part_class asp_inact_ies[] = { + M3UA_MSG_PART_CLASS_ROUTE_CTX(false), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF +}; +static const struct xua_msg_part_class asp_act_ack_ies[] = { + M3UA_MSG_PART_CLASS_TRAF_MODE_TYP(false), + M3UA_MSG_PART_CLASS_ROUTE_CTX(false), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF +}; +static const struct xua_msg_part_class asp_inact_ack_ies[] = { + M3UA_MSG_PART_CLASS_ROUTE_CTX(false), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF +}; const struct value_string m3ua_asptm_msgt_names[] = { { M3UA_ASPTM_ACTIVE, "ACTIVE" }, { M3UA_ASPTM_INACTIVE, "INACTIVE" }, @@ -319,6 +377,12 @@ .name = "ASPTM", .msgt_names = m3ua_asptm_msgt_names, .iei_names = m3ua_iei_names, + .ies = { + IES(M3UA_ASPTM_ACTIVE, asp_act_ies), + IES(M3UA_ASPTM_INACTIVE, asp_inact_ies), + IES(M3UA_ASPTM_ACTIVE_ACK, asp_act_ack_ies), + IES(M3UA_ASPTM_INACTIVE_ACK, asp_inact_ack_ies), + }, }; /* MGMT */ -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43387?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I27406eac5b82c1e6702961bb3482b0bf7fe4ff15 Gerrit-Change-Number: 43387 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[L] Change in libosmo-sigtran[master]: xua: Validate IE lengths of incoming messages
by pespin 25 Aug '26

25 Aug '26

Attention is currently required from: fixeria, laforge, osmith. Hello Jenkins Builder, fixeria, laforge, osmith, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43386?usp=email to look at the new patch set (#4). Change subject: xua: Validate IE lengths of incoming messages ...................................................................... xua: Validate IE lengths of incoming messages Improve the data structures defining M3UA/SUA messages to also include expected min/max lengths of each IE in a given message. This way we already cover in one place validation of fixed length IEs. Related: OS#7074 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: I9b1ae0dbc324123790942c9e6068f6822e3bb957 --- M src/m3ua.c M src/sua.c M src/xua_msg.c M src/xua_msg.h 4 files changed, 399 insertions(+), 112 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/86/43386/4 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43386?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I9b1ae0dbc324123790942c9e6068f6822e3bb957 Gerrit-Change-Number: 43386 Gerrit-PatchSet: 4 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[L] Change in libosmo-sigtran[master]: xua: Validate IE lengths of incoming messages
by pespin 25 Aug '26

25 Aug '26

Attention is currently required from: fixeria, laforge, osmith. Hello Jenkins Builder, fixeria, laforge, osmith, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43386?usp=email to look at the new patch set (#3). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder Change subject: xua: Validate IE lengths of incoming messages ...................................................................... xua: Validate IE lengths of incoming messages Improve the data structures defining M3UA/SUA messages to also include expected min/max lengths of each IE in a given message. This way we already cover in one place validation of fixed length IEs. Related: OS#7074 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: I9b1ae0dbc324123790942c9e6068f6822e3bb957 --- M src/m3ua.c M src/sua.c M src/xua_msg.c M src/xua_msg.h 4 files changed, 399 insertions(+), 111 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/86/43386/3 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43386?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I9b1ae0dbc324123790942c9e6068f6822e3bb957 Gerrit-Change-Number: 43386 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[XS] Change in libosmo-sigtran[master]: ss7_instance: Only call osmo_ss7_pc_width() when needed
by pespin 25 Aug '26

25 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43384?usp=email ) Change subject: ss7_instance: Only call osmo_ss7_pc_width() when needed ...................................................................... ss7_instance: Only call osmo_ss7_pc_width() when needed Change-Id: Ie0728cef36c1cbeb755baef105f3ab88d025db01 --- M src/ss7_instance.c 1 file changed, 2 insertions(+), 2 deletions(-) Approvals: laforge: Looks good to me, but someone else must approve Jenkins Builder: Verified fixeria: Looks good to me, approved diff --git a/src/ss7_instance.c b/src/ss7_instance.c index 05f6be8..b349974 100644 --- a/src/ss7_instance.c +++ b/src/ss7_instance.c @@ -671,15 +671,15 @@ int osmo_ss7_pointcode_parse_mask_or_len(const struct osmo_ss7_instance *inst, const char *in) { - unsigned int width = osmo_ss7_pc_width(inst ? &inst->cfg.pc_fmt : &default_pc_fmt); - if (in[0] == '/') { /* parse mask by length */ + unsigned int width; int masklen = atoi(in+1); if (masklen < 0 || masklen > 32) return -EINVAL; if (masklen == 0) return 0; + width = osmo_ss7_pc_width(inst ? &inst->cfg.pc_fmt : &default_pc_fmt); return (0xFFFFFFFF << (width - masklen)) & ((1 << width)-1); } /* parse mask as point code */ -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43384?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ie0728cef36c1cbeb755baef105f3ab88d025db01 Gerrit-Change-Number: 43384 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in libosmo-sigtran[master]: m3ua: Validate Protocol Data IE of incoming messages
by pespin 25 Aug '26

25 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43385?usp=email ) Change subject: m3ua: Validate Protocol Data IE of incoming messages ...................................................................... m3ua: Validate Protocol Data IE of incoming messages This fixes a potential assert hit by peer sending SLS > 0x0f over M3UA to us. Related: OS#7073 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: I28ac1cb0039d1be99dd200de9f93003289c48055 --- M src/m3ua.c 1 file changed, 73 insertions(+), 13 deletions(-) Approvals: laforge: Looks good to me, but someone else must approve fixeria: Looks good to me, approved Jenkins Builder: Verified diff --git a/src/m3ua.c b/src/m3ua.c index f2455eb..b29cfcf 100644 --- a/src/m3ua.c +++ b/src/m3ua.c @@ -24,6 +24,7 @@ #include <errno.h> #include <unistd.h> #include <string.h> +#include <inttypes.h> #include <osmocom/core/utils.h> #include <osmocom/core/linuxlist.h> @@ -606,6 +607,74 @@ return data_hdr; } +static int m3ua_rx_xfer_validate_data_ie(struct osmo_ss7_asp *asp, const struct xua_msg_part *data_ie) +{ + struct m3ua_data_hdr *dh; + uint32_t pc; + + /* As already checked by xua_dialect_check_all_mand_ies(): */ + OSMO_ASSERT(data_ie); + + if (data_ie->len < sizeof(struct m3ua_data_hdr)) { + LOGPASP(asp, DLM3UA, LOGL_NOTICE, + "Discarding received M3UA XFER:DATA: Wrong Protocol Data parameter IE len=%" PRIu16 "\n", + data_ie->len); + return M3UA_ERR_INVAL_PARAM_VAL; + } + + dh = (struct m3ua_data_hdr *) data_ie->dat; + OSMO_ASSERT(dh); + + pc = ntohl(dh->opc); + if (!osmo_ss7_pc_is_valid(pc)) { + LOGPASP(asp, DLM3UA, LOGL_NOTICE, + "Discarding received M3UA XFER:DATA: Invalid OPC=%" PRIu32 "\n", + pc); + return M3UA_ERR_INVAL_PARAM_VAL; + } + + pc = ntohl(dh->dpc); + if (!osmo_ss7_pc_is_valid(pc)) { + LOGPASP(asp, DLM3UA, LOGL_NOTICE, + "Discarding received M3UA XFER:DATA: Invalid DPC=%" PRIu32 "\n", + pc); + return M3UA_ERR_INVAL_PARAM_VAL; + } + + if (dh->si & ~0x0F) { + LOGPASP(asp, DLM3UA, LOGL_NOTICE, + "Discarding received M3UA XFER:DATA: Invalid SI=%" PRIu8 "\n", + dh->si); + return M3UA_ERR_INVAL_PARAM_VAL; + } + + /* Drop packets not matching our configured Network Indicator: */ + if (dh->ni != asp->inst->cfg.network_indicator) { + LOGPASP(asp, DLM3UA, LOGL_NOTICE, + "Discarding received M3UA XFER:DATA: NI=%u not matching ss7 instance configured NI=%u\n", + dh->ni, asp->inst->cfg.network_indicator); + rate_ctr_inc2(asp->inst->ctrg, SS7_INST_CTR_PKT_RX_NI_MISMATCH); + rate_ctr_inc2(asp->ctrg, SS7_ASP_CTR_PKT_RX_NI_MISMATCH); + return M3UA_ERR_UNEXPECTED_MSG; + } + + if (dh->mp & ~0x03) { + LOGPASP(asp, DLM3UA, LOGL_NOTICE, + "Discarding received M3UA XFER:DATA: Invalid MP=%" PRIu8 "\n", + dh->mp); + return M3UA_ERR_INVAL_PARAM_VAL; + } + + if (dh->sls & ~0x0F) { + LOGPASP(asp, DLM3UA, LOGL_NOTICE, + "Discarding received M3UA XFER:DATA: Invalid SLS=%" PRIu8 "\n", + dh->sls); + return M3UA_ERR_INVAL_PARAM_VAL; + } + + return 0; +} + /* This function takes ownership of xua msg passed to it. */ static int m3ua_rx_xfer(struct osmo_ss7_asp *asp, struct xua_msg *xua) { @@ -641,11 +710,13 @@ goto ret_free; } + rc = m3ua_rx_xfer_validate_data_ie(asp, data_ie); + if (rc) + goto ret_free; + /* store the MTP-level information in the xua_msg for use by * higher layer protocols */ - OSMO_ASSERT(data_ie); dh = (struct m3ua_data_hdr *) data_ie->dat; - OSMO_ASSERT(dh); m3ua_dh_to_xfer_param(&xua->mtp, dh); LOGPASP(asp, DLM3UA, LOGL_DEBUG, "%s(): M3UA data header: opc=%u=%s dpc=%u=%s sls=%u\n", @@ -653,17 +724,6 @@ xua->mtp.dpc, osmo_ss7_pointcode_print2(asp->inst, xua->mtp.dpc), xua->mtp.sls); - /* Drop packets not matching our configured Network Indicator: */ - if (dh->ni != asp->inst->cfg.network_indicator) { - LOGPASP(asp, DLM3UA, LOGL_NOTICE, - "Discarding received XUA Message %s: NI=%u not matching ss7 instance configured NI=%u\n", - xua_hdr_dump(xua, &xua_dialect_sua), dh->ni, asp->inst->cfg.network_indicator); - rate_ctr_inc2(asp->inst->ctrg, SS7_INST_CTR_PKT_RX_NI_MISMATCH); - rate_ctr_inc2(asp->ctrg, SS7_ASP_CTR_PKT_RX_NI_MISMATCH); - rc = M3UA_ERR_UNEXPECTED_MSG; - goto ret_free; - } - rc = xua_find_as_for_asp(&as, asp, rctx_ie); if (rc) goto ret_free; -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43385?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I28ac1cb0039d1be99dd200de9f93003289c48055 Gerrit-Change-Number: 43385 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[L] Change in libosmo-sigtran[master]: xua: Validate IE lengths of incoming messages
by pespin 25 Aug '26

25 Aug '26

Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43386?usp=email to look at the new patch set (#2). Change subject: xua: Validate IE lengths of incoming messages ...................................................................... xua: Validate IE lengths of incoming messages Improve the data structures defining M3UA/SUA messages to also include expected min/max lengths of each IE in a given message. This way we already cover in one place validation of fixed length IEs. Related: OS#7074 Reported-By: Tristan Madani <tristan(a)talencesecurity.com> Change-Id: I9b1ae0dbc324123790942c9e6068f6822e3bb957 --- M src/m3ua.c M src/sua.c M src/xua_msg.c M src/xua_msg.h 4 files changed, 398 insertions(+), 107 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/86/43386/2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43386?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I9b1ae0dbc324123790942c9e6068f6822e3bb957 Gerrit-Change-Number: 43386 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder

1 0

[L] Change in libosmo-sigtran[master]: xua: Validate IE lengths of incoming messages
by pespin 25 Aug '26

25 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43386?usp=email ) Change subject: xua: Validate IE lengths of incoming messages ...................................................................... xua: Validate IE lengths of incoming messages Change-Id: I9b1ae0dbc324123790942c9e6068f6822e3bb957 --- M src/m3ua.c M src/sua.c M src/xua_msg.c M src/xua_msg.h 4 files changed, 398 insertions(+), 107 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/86/43386/1 diff --git a/src/m3ua.c b/src/m3ua.c index b29cfcf..fa26707 100644 --- a/src/m3ua.c +++ b/src/m3ua.c @@ -146,11 +146,71 @@ { 0, NULL } }; -#define MAND_IES(msgt, ies) [msgt] = (ies) +#define IES(msgt, ies) \ + [msgt] = (ies) + +/* M3UA/SUA shared: */ + +#define M3UA_MSG_PART_CLASS_INFO_STRING(mandatory) \ + XUA_MSG_PART_CLASS(M3UA_IEI_ROUTE_CTX, (mandatory), 0, UINT16_MAX) + +#define M3UA_MSG_PART_CLASS_ROUTE_CTX(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_ROUTE_CTX, (mandatory)) + +#define M3UA_MSG_PART_CLASS_ROUTE_CTX1(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_ROUTE_CTX, (mandatory)) + +#define M3UA_MSG_PART_CLASS_DIAG_INFO(mandatory) \ + XUA_MSG_PART_CLASS(M3UA_IEI_DIAG_INFO, (mandatory), 0, UINT16_MAX) + +#define M3UA_MSG_PART_CLASS_ERR_CODE(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_ERR_CODE, (mandatory)) + +#define M3UA_MSG_PART_CLASS_STATUS(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_STATUS, (mandatory)) + +#define M3UA_MSG_PART_CLASS_ASP_ID(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_ASP_ID, (mandatory)) + +#define M3UA_MSG_PART_CLASS_AFFECTED_PC(mandatory) \ + XUA_MSG_PART_CLASS(M3UA_IEI_AFFECTED_PC, (mandatory), 0, UINT16_MAX) + +#define M3UA_MSG_PART_CLASS_CORR_ID(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_CORR_ID, (mandatory)) + +/* M3UA specific: */ + +#define M3UA_MSG_PART_CLASS_NET_APPEAR(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_NET_APPEAR, (mandatory)) + +#define M3UA_MSG_PART_CLASS_USER_CAUSE(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_USER_CAUSE, (mandatory)) + +#define M3UA_MSG_PART_CLASS_CONG_IND(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_CONG_IND, (mandatory)) + +#define M3UA_MSG_PART_CLASS_CONC_DEST(mandatory) \ + XUA_MSG_PART_CLASS_U32(M3UA_IEI_CONC_DEST, (mandatory)) + +#define M3UA_MSG_PART_CLASS_ROUT_KEY(mandatory) \ + XUA_MSG_PART_CLASS(M3UA_IEI_ROUT_KEY, (mandatory), 0, UINT16_MAX) + +#define M3UA_MSG_PART_CLASS_REG_RESULT(mandatory) \ + XUA_MSG_PART_CLASS(M3UA_IEI_REG_RESULT, (mandatory), 0, UINT16_MAX) + +#define M3UA_MSG_PART_CLASS_DEREG_RESULT(mandatory) \ + XUA_MSG_PART_CLASS(M3UA_IEI_DEREG_RESULT, (mandatory), 0, UINT16_MAX) + +#define M3UA_MSG_PART_CLASS_PROT_DATA(mandatory) \ + XUA_MSG_PART_CLASS(M3UA_IEI_PROT_DATA, (mandatory), 0, UINT16_MAX) /* XFER */ -static const uint16_t data_mand_ies[] = { - M3UA_IEI_PROT_DATA, 0 +static const struct xua_msg_part_class data_ies[] = { + M3UA_MSG_PART_CLASS_NET_APPEAR(false), + M3UA_MSG_PART_CLASS_ROUTE_CTX1(false), + M3UA_MSG_PART_CLASS_PROT_DATA(true), + M3UA_MSG_PART_CLASS_CORR_ID(false), + XUA_MSG_PART_CLASS_EOF }; static const struct value_string m3ua_xfer_msgt_names[] = { { M3UA_XFER_DATA, "DATA" }, @@ -159,29 +219,56 @@ static const struct xua_msg_class msg_class_xfer = { .name = "XFER", .msgt_names = m3ua_xfer_msgt_names, - .mand_ies = { - MAND_IES(M3UA_XFER_DATA, data_mand_ies), + .ies = { + IES(M3UA_XFER_DATA, data_ies), }, }; /* SNM */ -static const uint16_t duna_mand_ies[] = { - M3UA_IEI_AFFECTED_PC, 0 +static const struct xua_msg_part_class duna_ies[] = { + M3UA_MSG_PART_CLASS_NET_APPEAR(false), + M3UA_MSG_PART_CLASS_ROUTE_CTX(false), + M3UA_MSG_PART_CLASS_AFFECTED_PC(true), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t dava_mand_ies[] = { - M3UA_IEI_AFFECTED_PC, 0 +static const struct xua_msg_part_class dava_ies[] = { + M3UA_MSG_PART_CLASS_NET_APPEAR(false), + M3UA_MSG_PART_CLASS_ROUTE_CTX(false), + M3UA_MSG_PART_CLASS_AFFECTED_PC(true), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t daud_mand_ies[] = { - M3UA_IEI_AFFECTED_PC, 0 +static const struct xua_msg_part_class daud_ies[] = { + M3UA_MSG_PART_CLASS_NET_APPEAR(false), + M3UA_MSG_PART_CLASS_ROUTE_CTX(false), + M3UA_MSG_PART_CLASS_AFFECTED_PC(true), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t scon_mand_ies[] = { - M3UA_IEI_AFFECTED_PC, 0 +static const struct xua_msg_part_class scon_ies[] = { + M3UA_MSG_PART_CLASS_NET_APPEAR(false), + M3UA_MSG_PART_CLASS_ROUTE_CTX(false), + M3UA_MSG_PART_CLASS_AFFECTED_PC(true), + M3UA_MSG_PART_CLASS_CONC_DEST(false), + M3UA_MSG_PART_CLASS_CONG_IND(false), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t dupu_mand_ies[] = { - M3UA_IEI_AFFECTED_PC, M3UA_IEI_USER_CAUSE, 0 +static const struct xua_msg_part_class dupu_ies[] = { + M3UA_MSG_PART_CLASS_NET_APPEAR(false), + M3UA_MSG_PART_CLASS_ROUTE_CTX(false), + M3UA_MSG_PART_CLASS_AFFECTED_PC(true), + M3UA_MSG_PART_CLASS_USER_CAUSE(true), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t drst_mand_ies[] = { - M3UA_IEI_AFFECTED_PC, 0 +static const struct xua_msg_part_class drst_ies[] = { + M3UA_MSG_PART_CLASS_NET_APPEAR(false), + M3UA_MSG_PART_CLASS_ROUTE_CTX(false), + M3UA_MSG_PART_CLASS_AFFECTED_PC(true), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF }; const struct value_string m3ua_snm_msgt_names[] = { { M3UA_SNM_DUNA, "DUNA" }, @@ -195,13 +282,13 @@ const struct xua_msg_class m3ua_msg_class_snm = { .name = "SNM", .msgt_names = m3ua_snm_msgt_names, - .mand_ies = { - MAND_IES(M3UA_SNM_DUNA, duna_mand_ies), - MAND_IES(M3UA_SNM_DAVA, dava_mand_ies), - MAND_IES(M3UA_SNM_DAUD, daud_mand_ies), - MAND_IES(M3UA_SNM_SCON, scon_mand_ies), - MAND_IES(M3UA_SNM_DUPU, dupu_mand_ies), - MAND_IES(M3UA_SNM_DRST, drst_mand_ies), + .ies = { + IES(M3UA_SNM_DUNA, duna_ies), + IES(M3UA_SNM_DAVA, dava_ies), + IES(M3UA_SNM_DAUD, daud_ies), + IES(M3UA_SNM_SCON, scon_ies), + IES(M3UA_SNM_DUPU, dupu_ies), + IES(M3UA_SNM_DRST, drst_ies), }, }; @@ -235,11 +322,20 @@ }; /* MGMT */ -static const uint16_t err_req_ies[] = { - M3UA_IEI_ERR_CODE, 0 +static const struct xua_msg_part_class err_req_ies[] = { + M3UA_MSG_PART_CLASS_ERR_CODE(true), + M3UA_MSG_PART_CLASS_ROUTE_CTX(false), + M3UA_MSG_PART_CLASS_NET_APPEAR(false), + M3UA_MSG_PART_CLASS_AFFECTED_PC(false), + M3UA_MSG_PART_CLASS_DIAG_INFO(false), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t ntfy_req_ies[] = { - M3UA_IEI_STATUS, 0 +static const struct xua_msg_part_class ntfy_req_ies[] = { + M3UA_MSG_PART_CLASS_STATUS(true), + M3UA_MSG_PART_CLASS_ASP_ID(false), + M3UA_MSG_PART_CLASS_ROUTE_CTX(false), + M3UA_MSG_PART_CLASS_INFO_STRING(false), + XUA_MSG_PART_CLASS_EOF }; static const struct value_string m3ua_mgmt_msgt_names[] = { { M3UA_MGMT_ERR, "ERROR" }, @@ -250,24 +346,28 @@ .name = "MGMT", .msgt_names = m3ua_mgmt_msgt_names, .iei_names = m3ua_iei_names, - .mand_ies = { - MAND_IES(M3UA_MGMT_ERR, err_req_ies), - MAND_IES(M3UA_MGMT_NTFY, ntfy_req_ies), + .ies = { + IES(M3UA_MGMT_ERR, err_req_ies), + IES(M3UA_MGMT_NTFY, ntfy_req_ies), }, }; /* RKM */ -static const uint16_t reg_req_ies[] = { - M3UA_IEI_ROUT_KEY, 0 +static const struct xua_msg_part_class reg_req_ies[] = { + M3UA_MSG_PART_CLASS_ROUT_KEY(true), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t reg_rsp_ies[] = { - M3UA_IEI_REG_RESULT, 0 +static const struct xua_msg_part_class reg_rsp_ies[] = { + M3UA_MSG_PART_CLASS_REG_RESULT(true), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t dereg_req_ies[] = { - M3UA_IEI_ROUTE_CTX, 0 +static const struct xua_msg_part_class dereg_req_ies[] = { + M3UA_MSG_PART_CLASS_ROUTE_CTX(true), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t dereg_rsp_ies[] = { - M3UA_IEI_DEREG_RESULT, 0 +static const struct xua_msg_part_class dereg_rsp_ies[] = { + M3UA_MSG_PART_CLASS_DEREG_RESULT(true), + XUA_MSG_PART_CLASS_EOF }; const struct value_string m3ua_rkm_msgt_names[] = { { M3UA_RKM_REG_REQ, "REG-REQ" }, @@ -280,11 +380,11 @@ .name = "RKM", .msgt_names = m3ua_rkm_msgt_names, .iei_names = m3ua_iei_names, - .mand_ies = { - MAND_IES(M3UA_RKM_REG_REQ, reg_req_ies), - MAND_IES(M3UA_RKM_REG_RSP, reg_rsp_ies), - MAND_IES(M3UA_RKM_DEREG_REQ, dereg_req_ies), - MAND_IES(M3UA_RKM_DEREG_RSP, dereg_rsp_ies), + .ies = { + IES(M3UA_RKM_REG_REQ, reg_req_ies), + IES(M3UA_RKM_REG_RSP, reg_rsp_ies), + IES(M3UA_RKM_DEREG_REQ, dereg_req_ies), + IES(M3UA_RKM_DEREG_RSP, dereg_rsp_ies), }, }; @@ -612,7 +712,7 @@ struct m3ua_data_hdr *dh; uint32_t pc; - /* As already checked by xua_dialect_check_all_mand_ies(): */ + /* As already checked by xua_dialect_check_all_ies(): */ OSMO_ASSERT(data_ie); if (data_ie->len < sizeof(struct m3ua_data_hdr)) { @@ -894,7 +994,7 @@ LOGPASP(asp, DLM3UA, LOGL_DEBUG, "Received M3UA Message (%s)\n", xua_hdr_dump(xua, &xua_dialect_m3ua)); - if (!xua_dialect_check_all_mand_ies(&xua_dialect_m3ua, xua)) { + if (!xua_dialect_check_all_ies(&xua_dialect_m3ua, xua)) { rc = M3UA_ERR_MISSING_PARAM; xua_msg_free(xua); goto out; diff --git a/src/sua.c b/src/sua.c index 7c6d57f..53ca3b8 100644 --- a/src/sua.c +++ b/src/sua.c @@ -121,15 +121,111 @@ { 0, NULL } }; -#define MAND_IES(msgt, ies) [msgt] = (ies) +#define IES(msgt, ies) \ + [msgt] = (ies) -static const uint16_t cldt_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_PROTO_CLASS, SUA_IEI_SRC_ADDR, - SUA_IEI_DEST_ADDR, SUA_IEI_SEQ_CTRL, SUA_IEI_DATA, 0 +/* M3UA/SUA shared: */ + +#define SUA_MSG_PART_CLASS_INFO_STRING(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_ROUTE_CTX, (mandatory), 0, UINT16_MAX) + +#define SUA_MSG_PART_CLASS_ROUTE_CTX(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_ROUTE_CTX, (mandatory)) + +#define SUA_MSG_PART_CLASS_ROUTE_CTX1(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_ROUTE_CTX, (mandatory)) + +#define SUA_MSG_PART_CLASS_DIAG_INFO(mandatory) \ + XUA_MSG_PART_CLASS(SUA_IEI_DIAG_INFO, (mandatory), 0, UINT16_MAX) + +#define SUA_MSG_PART_CLASS_ERR_CODE(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_ERR_CODE, (mandatory)) + +#define SUA_MSG_PART_CLASS_STATUS(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_STATUS, (mandatory)) + +#define SUA_MSG_PART_CLASS_ASP_ID(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_ASP_ID, (mandatory)) + +#define SUA_MSG_PART_CLASS_AFFECTED_PC(mandatory) \ + XUA_MSG_PART_CLASS(SUA_IEI_AFFECTED_PC, (mandatory), 0, UINT16_MAX) + +#define SUA_MSG_PART_CLASS_CORR_ID(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_CORR_ID, (mandatory)) + +/* SUA specific: */ + +#define SUA_MSG_PART_CLASS_HOP_CTR(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_S7_HOP_CTR, (mandatory)) + +#define SUA_MSG_PART_CLASS_SRC_ADDR(mandatory) \ + XUA_MSG_PART_CLASS(SUA_IEI_SRC_ADDR, (mandatory), 0, UINT16_MAX) + +#define SUA_MSG_PART_CLASS_DEST_ADDR(mandatory) \ + XUA_MSG_PART_CLASS(SUA_IEI_DEST_ADDR, (mandatory), 0, UINT16_MAX) + +#define SUA_MSG_PART_CLASS_SEQ_CTRL(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_SEQ_CTRL, (mandatory)) + +#define SUA_MSG_PART_CLASS_SEQ_NR(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_SEQ_NR, (mandatory)) + +#define SUA_MSG_PART_CLASS_RX_SEQ_NR(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_RX_SEQ_NR, (mandatory)) + +#define SUA_MSG_PART_CLASS_CREDIT(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_CREDIT, (mandatory)) + +#define SUA_MSG_PART_CLASS_SRC_REF(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_SRC_REF, (mandatory)) + +#define SUA_MSG_PART_CLASS_DEST_REF(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_DEST_REF, (mandatory)) + +#define SUA_MSG_PART_CLASS_CAUSE(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_CAUSE, (mandatory)) + +#define SUA_MSG_PART_CLASS_DATA(mandatory) \ + XUA_MSG_PART_CLASS(SUA_IEI_DATA, (mandatory), 0, UINT16_MAX) + +#define SUA_MSG_PART_CLASS_IMPORTANCE(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_IMPORTANCE, (mandatory)) + +#define SUA_MSG_PART_CLASS_MSG_PRIO(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_MSG_PRIO, (mandatory)) + +#define SUA_MSG_PART_CLASS_PROTO_CLASS(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_PROTO_CLASS, (mandatory)) + +#define SUA_MSG_PART_CLASS_SEGMENTATION(mandatory) \ + XUA_MSG_PART_CLASS_U32(SUA_IEI_SEGMENTATION, (mandatory)) + +static const struct xua_msg_part_class cldt_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_PROTO_CLASS(true), + SUA_MSG_PART_CLASS_SRC_ADDR(true), + SUA_MSG_PART_CLASS_DEST_ADDR(true), + SUA_MSG_PART_CLASS_SEQ_CTRL(true), + SUA_MSG_PART_CLASS_HOP_CTR(false), + SUA_MSG_PART_CLASS_IMPORTANCE(false), + SUA_MSG_PART_CLASS_MSG_PRIO(false), + SUA_MSG_PART_CLASS_CORR_ID(false), + SUA_MSG_PART_CLASS_SEGMENTATION(false), + SUA_MSG_PART_CLASS_DATA(true), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t cldr_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_CAUSE, SUA_IEI_SRC_ADDR, - SUA_IEI_DEST_ADDR, 0 +static const struct xua_msg_part_class cldr_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_CAUSE(true), + SUA_MSG_PART_CLASS_SRC_ADDR(true), + SUA_MSG_PART_CLASS_DEST_ADDR(true), + SUA_MSG_PART_CLASS_HOP_CTR(false), + SUA_MSG_PART_CLASS_IMPORTANCE(false), + SUA_MSG_PART_CLASS_MSG_PRIO(false), + SUA_MSG_PART_CLASS_CORR_ID(false), + SUA_MSG_PART_CLASS_SEGMENTATION(false), + SUA_MSG_PART_CLASS_DATA(false), + XUA_MSG_PART_CLASS_EOF }; static const struct value_string sua_cl_msgt_names[] = { { SUA_CL_CLDT, "CLDT" }, @@ -140,49 +236,110 @@ .name = "CL", .msgt_names = sua_cl_msgt_names, .iei_names = sua_iei_names, - .mand_ies = { - MAND_IES(SUA_CL_CLDT, cldt_mand_ies), - MAND_IES(SUA_CL_CLDR, cldr_mand_ies), + .ies = { + IES(SUA_CL_CLDT, cldt_ies), + IES(SUA_CL_CLDR, cldr_ies), }, }; -static const uint16_t codt_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_DEST_REF, SUA_IEI_DATA, 0 +static const struct xua_msg_part_class codt_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_SEQ_NR(false), + SUA_MSG_PART_CLASS_DEST_REF(true), + SUA_MSG_PART_CLASS_MSG_PRIO(false), + SUA_MSG_PART_CLASS_CORR_ID(false), + SUA_MSG_PART_CLASS_DATA(true), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t coda_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_DEST_REF, 0 +static const struct xua_msg_part_class coda_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_DEST_REF(true), + SUA_MSG_PART_CLASS_RX_SEQ_NR(false), + SUA_MSG_PART_CLASS_RX_SEQ_NR(false), + SUA_MSG_PART_CLASS_CREDIT(false), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t core_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_PROTO_CLASS, SUA_IEI_SRC_REF, - SUA_IEI_DEST_ADDR, SUA_IEI_SEQ_CTRL, 0 +static const struct xua_msg_part_class core_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_PROTO_CLASS(true), + SUA_MSG_PART_CLASS_SRC_REF(true), + SUA_MSG_PART_CLASS_SEQ_CTRL(true), + SUA_MSG_PART_CLASS_SEQ_NR(false), + SUA_MSG_PART_CLASS_SRC_ADDR(false), + SUA_MSG_PART_CLASS_HOP_CTR(false), + SUA_MSG_PART_CLASS_IMPORTANCE(false), + SUA_MSG_PART_CLASS_MSG_PRIO(false), + SUA_MSG_PART_CLASS_CREDIT(false), + SUA_MSG_PART_CLASS_DATA(false), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t coak_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_PROTO_CLASS, SUA_IEI_DEST_REF, - SUA_IEI_SRC_REF, SUA_IEI_SEQ_CTRL, 0 +static const struct xua_msg_part_class coak_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_PROTO_CLASS(true), + SUA_MSG_PART_CLASS_DEST_REF(true), + SUA_MSG_PART_CLASS_SRC_REF(true), + SUA_MSG_PART_CLASS_SEQ_CTRL(true), + SUA_MSG_PART_CLASS_CREDIT(false), + SUA_MSG_PART_CLASS_SRC_ADDR(false), + SUA_MSG_PART_CLASS_IMPORTANCE(false), + SUA_MSG_PART_CLASS_MSG_PRIO(false), + SUA_MSG_PART_CLASS_DEST_ADDR(false), + SUA_MSG_PART_CLASS_DATA(false), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t coref_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_DEST_REF, SUA_IEI_CAUSE, 0 +static const struct xua_msg_part_class coref_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_DEST_REF(true), + SUA_MSG_PART_CLASS_CAUSE(true), + SUA_MSG_PART_CLASS_SRC_ADDR(false), + SUA_MSG_PART_CLASS_DEST_ADDR(false), + SUA_MSG_PART_CLASS_IMPORTANCE(false), + SUA_MSG_PART_CLASS_DATA(false), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t relre_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_DEST_REF, SUA_IEI_SRC_REF, - SUA_IEI_CAUSE, 0 +static const struct xua_msg_part_class relre_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_DEST_REF(true), + SUA_MSG_PART_CLASS_SRC_REF(true), + SUA_MSG_PART_CLASS_CAUSE(true), + SUA_MSG_PART_CLASS_IMPORTANCE(false), + SUA_MSG_PART_CLASS_DATA(false), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t relco_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_DEST_REF, SUA_IEI_SRC_REF, 0 +static const struct xua_msg_part_class relco_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_DEST_REF(true), + SUA_MSG_PART_CLASS_SRC_REF(true), + SUA_MSG_PART_CLASS_IMPORTANCE(false), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t resre_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_DEST_REF, SUA_IEI_SRC_REF, - SUA_IEI_CAUSE, 0 +static const struct xua_msg_part_class resre_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_DEST_REF(true), + SUA_MSG_PART_CLASS_SRC_REF(true), + SUA_MSG_PART_CLASS_CAUSE(true), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t resco_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_DEST_REF, SUA_IEI_SRC_REF, 0 +static const struct xua_msg_part_class resco_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_DEST_REF(true), + SUA_MSG_PART_CLASS_SRC_REF(true), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t coerr_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_DEST_REF, SUA_IEI_CAUSE, 0 +static const struct xua_msg_part_class coerr_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_DEST_REF(true), + SUA_MSG_PART_CLASS_CAUSE(true), + XUA_MSG_PART_CLASS_EOF }; -static const uint16_t coit_mand_ies[] = { - SUA_IEI_ROUTE_CTX, SUA_IEI_PROTO_CLASS, SUA_IEI_SRC_REF, - SUA_IEI_DEST_REF, 0 +static const struct xua_msg_part_class coit_ies[] = { + SUA_MSG_PART_CLASS_ROUTE_CTX(true), + SUA_MSG_PART_CLASS_PROTO_CLASS(true), + SUA_MSG_PART_CLASS_SRC_REF(true), + SUA_MSG_PART_CLASS_DEST_REF(true), + SUA_MSG_PART_CLASS_SEQ_NR(false), + SUA_MSG_PART_CLASS_CREDIT(false), + XUA_MSG_PART_CLASS_EOF }; /* ITU-T Rec Q.713 */ @@ -204,18 +361,18 @@ .name = "CO", .msgt_names = sua_co_msgt_names, .iei_names = sua_iei_names, - .mand_ies = { - MAND_IES(SUA_CO_CODT, codt_mand_ies), - MAND_IES(SUA_CO_CODA, coda_mand_ies), - MAND_IES(SUA_CO_CORE, core_mand_ies), - MAND_IES(SUA_CO_COAK, coak_mand_ies), - MAND_IES(SUA_CO_COREF, coref_mand_ies), - MAND_IES(SUA_CO_RELRE, relre_mand_ies), - MAND_IES(SUA_CO_RELCO, relco_mand_ies), - MAND_IES(SUA_CO_RESRE, resre_mand_ies), - MAND_IES(SUA_CO_RESCO, resco_mand_ies), - MAND_IES(SUA_CO_COERR, coerr_mand_ies), - MAND_IES(SUA_CO_COIT, coit_mand_ies), + .ies = { + IES(SUA_CO_CODT, codt_ies), + IES(SUA_CO_CODA, coda_ies), + IES(SUA_CO_CORE, core_ies), + IES(SUA_CO_COAK, coak_ies), + IES(SUA_CO_COREF, coref_ies), + IES(SUA_CO_RELRE, relre_ies), + IES(SUA_CO_RELCO, relco_ies), + IES(SUA_CO_RESRE, resre_ies), + IES(SUA_CO_RESCO, resco_ies), + IES(SUA_CO_COERR, coerr_ies), + IES(SUA_CO_COIT, coit_ies), }, }; @@ -780,7 +937,7 @@ LOGPASP(asp, DLSUA, LOGL_DEBUG, "Received SUA Message (%s)\n", xua_hdr_dump(xua, &xua_dialect_sua)); - if (!xua_dialect_check_all_mand_ies(&xua_dialect_sua, xua)) { + if (!xua_dialect_check_all_ies(&xua_dialect_sua, xua)) { /* FIXME: Return error? */ err = sua_gen_error_msg(SUA_ERR_MISSING_PARAM, msg); goto out; diff --git a/src/xua_msg.c b/src/xua_msg.c index 1761fee..690f0a6 100644 --- a/src/xua_msg.c +++ b/src/xua_msg.c @@ -32,6 +32,7 @@ #include <string.h> #include <errno.h> +#include <inttypes.h> static void *tall_xua = NULL; @@ -534,31 +535,44 @@ return buf; } -int xua_dialect_check_all_mand_ies(const struct xua_dialect *dialect, struct xua_msg *xua) +int xua_dialect_check_all_ies(const struct xua_dialect *dialect, struct xua_msg *xua) { uint8_t msg_class = xua->hdr.msg_class; uint8_t msg_type = xua->hdr.msg_type; const struct xua_msg_class *xmc = dialect->class[msg_class]; - const uint16_t *ies; - uint16_t ie; + const struct xua_msg_part_class *ies; + const struct xua_msg_part_class *ie; /* unknown class? */ if (!xmc) return 1; - ies = xmc->mand_ies[msg_type]; + ies = &xmc->ies[msg_type][0]; /* no mandatory IEs? */ if (!ies) return 1; - for (ie = *ies; ie; ie = *ies++) { - if (!xua_msg_find_tag(xua, ie)) { + for (ie = ies; ie->tag; ie = ies++) { + struct xua_msg_part *part = xua_msg_find_tag(xua, ie->tag); + if (!part) { + if (!ie->mandatory) + continue; LOGP(dialect->log_subsys, LOGL_ERROR, - "%s Message %s:%s should " - "contain IE %s, but doesn't\n", + "%s Message %s:%s should contain IE %s, but doesn't\n", dialect->name, xmc->name, xua_class_msg_name(xmc, msg_type), - xua_class_iei_name(xmc, ie)); + xua_class_iei_name(xmc, ie->tag)); + return 0; + } + + if (part->len < ie->len_min || part->len > ie->len_max) { + LOGP(dialect->log_subsys, LOGL_ERROR, + "%s Message %s:%s IE %s length %" PRIu16 + " out of range [%" PRIu16 ", %" PRIu16 "]\n", + dialect->name, xmc->name, + xua_class_msg_name(xmc, msg_type), + xua_class_iei_name(xmc, ie->tag), + part->len, ie->len_min, ie->len_max); return 0; } } diff --git a/src/xua_msg.h b/src/xua_msg.h index f5d5de4..39249e2 100644 --- a/src/xua_msg.h +++ b/src/xua_msg.h @@ -21,6 +21,7 @@ #include <osmocom/core/linuxlist.h> #include <osmocom/sigtran/mtp_sap.h> +#include <stdint.h> #define XUA_HDR(class, type) ((struct xua_common_hdr) { .spare = 0, .msg_class = (class), .msg_type = (type) }) @@ -46,11 +47,30 @@ /* TODO: keep small data in the struct for perf reasons */ }; +struct xua_msg_part_class { + uint16_t tag; + bool mandatory; + uint16_t len_min; + uint16_t len_max; +}; +#define XUA_MSG_PART_CLASS(tag_, mandatory_, min_len, max_len) \ + { .tag = (tag_), \ + .mandatory = (mandatory_), \ + .len_min = (min_len), \ + .len_max = (max_len) \ + } +#define XUA_MSG_PART_CLASS_FIXED(tag, mandatory, len) \ + XUA_MSG_PART_CLASS((tag), (mandatory), (len), (len)) +#define XUA_MSG_PART_CLASS_U32(tag, mandatory) \ + XUA_MSG_PART_CLASS_FIXED((tag), (mandatory), sizeof(uint32_t)) +#define XUA_MSG_PART_CLASS_EOF \ + XUA_MSG_PART_CLASS(0, false, 0, 0) + struct xua_msg_class { const char *name; const struct value_string *msgt_names; const struct value_string *iei_names; - const uint16_t *mand_ies[256]; + const struct xua_msg_part_class *ies[256]; }; struct xua_dialect { @@ -105,7 +125,7 @@ const char *xua_class_iei_name(const struct xua_msg_class *xmc, uint16_t iei); char *xua_hdr_dump(const struct xua_msg *xua, const struct xua_dialect *dialect); char *xua_msg_dump(const struct xua_msg *xua, const struct xua_dialect *dialect); -int xua_dialect_check_all_mand_ies(const struct xua_dialect *dialect, struct xua_msg *xua); +int xua_dialect_check_all_ies(const struct xua_dialect *dialect, struct xua_msg *xua); int xua_msg_event_map(const struct xua_msg *xua, const struct xua_msg_event_map *maps, -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43386?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I9b1ae0dbc324123790942c9e6068f6822e3bb957 Gerrit-Change-Number: 43386 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in libosmo-sigtran[master]: ss7_instance: Only call osmo_ss7_pc_width() when needed
by fixeria 25 Aug '26

25 Aug '26

Attention is currently required from: pespin. fixeria has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43384?usp=email ) Change subject: ss7_instance: Only call osmo_ss7_pc_width() when needed ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43384?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ie0728cef36c1cbeb755baef105f3ab88d025db01 Gerrit-Change-Number: 43384 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Tue, 25 Aug 2026 12:49:48 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026