August 2026 - gerrit-log - lists.osmocom.org

[S] Change in libosmocore[master]: gsm: Reject BSSMAP Encryption Information IE with no selected algo
by pespin 14 Aug '26

14 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43250?usp=email ) Change subject: gsm: Reject BSSMAP Encryption Information IE with no selected algo ...................................................................... gsm: Reject BSSMAP Encryption Information IE with no selected algo 3GPP TS 48.008 3.2.2.10 Encryption Information IE clearly states that case should not be used, so reject it. Change-Id: I48ace0b3590c993b86f1471e5b57c3afee72217f --- M src/gsm/gsm0808_utils.c M tests/gsm0808/gsm0808_test.c 2 files changed, 11 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/50/43250/1 diff --git a/src/gsm/gsm0808_utils.c b/src/gsm/gsm0808_utils.c index c9f26d3..1abfbc8 100644 --- a/src/gsm/gsm0808_utils.c +++ b/src/gsm/gsm0808_utils.c @@ -820,7 +820,7 @@ return *tlv_len + 2; } -/*! Decode TS 08.08 Encryption Information IE +/*! Decode 3GPP TS 48.008 3.2.2.10 Encryption Information IE * \param[out] ei Caller-provided memory to store encryption information * \param[in] elem IE value to be decoded * \param[in] len Length of \a elem in bytes @@ -843,6 +843,10 @@ perm_algo = *elem; elem++; + /* "A permitted algorithms octet containing all bits encoded as 0 shall not be used." */ + if (perm_algo == 0x00) + return -EINVAL; + for (i = 0; i < ENCRY_INFO_PERM_ALGO_MAXLEN; i++) { if (perm_algo & (1 << i)) { ei->perm_algo[perm_algo_len] = i + 1; diff --git a/tests/gsm0808/gsm0808_test.c b/tests/gsm0808/gsm0808_test.c index ed99245..497de6c 100644 --- a/tests/gsm0808/gsm0808_test.c +++ b/tests/gsm0808/gsm0808_test.c @@ -1281,10 +1281,14 @@ rc_dec = gsm0808_dec_encrypt_info(&dec_ei, msg->data + 2, msg->len - 2); OSMO_ASSERT(rc_dec == 9); - OSMO_ASSERT(memcmp(&enc_ei, &dec_ei, sizeof(enc_ei)) == 0); - msgb_free(msg); + + /* Test decoding of malformed IE with no algo selected: */ + uint8_t ei_enc_no_algo[] = { GSM0808_IE_ENCRYPTION_INFORMATION, 0x01, 0x00 }; + rc_dec = gsm0808_dec_encrypt_info(&dec_ei, &ei_enc_no_algo[2], sizeof(ei_enc_no_algo) - 2); + OSMO_ASSERT(rc_dec == -EINVAL); + } static void test_gsm0808_dec_cell_id_list_srvcc(void) -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43250?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I48ace0b3590c993b86f1471e5b57c3afee72217f Gerrit-Change-Number: 43250 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmocore[master]: gsm: Reject BSSMAP Encryption Information IE with key length != 8
by pespin 14 Aug '26

14 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43251?usp=email ) Change subject: gsm: Reject BSSMAP Encryption Information IE with key length != 8 ...................................................................... gsm: Reject BSSMAP Encryption Information IE with key length != 8 From early TS 08.08 to current 3GPP TS 48.008 release 19, 3.2.2.10 Encryption Information IE clearly states that the key size should be 8 if present. This also in turn fixes a potential write buffer overflow if an IE with len>253 was passed to the decoding function. This patch fixes the problem by rewriting the function, since it actually was way too convoluted/complex for the kind of checks it had to do. This way also a call to memcpy is avoided if no key is present. Related: OS#7054 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Change-Id: I9fd70875f35cebb923278869e1260c5bf3047439 --- M src/gsm/gsm0808_utils.c M tests/gsm0808/gsm0808_test.c 2 files changed, 38 insertions(+), 7 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/51/43251/1 diff --git a/src/gsm/gsm0808_utils.c b/src/gsm/gsm0808_utils.c index 1abfbc8..d7bc275 100644 --- a/src/gsm/gsm0808_utils.c +++ b/src/gsm/gsm0808_utils.c @@ -831,7 +831,6 @@ uint8_t perm_algo; unsigned int i; unsigned int perm_algo_len = 0; - const uint8_t *old_elem = elem; if (!elem) return -EINVAL; @@ -854,14 +853,18 @@ } } ei->perm_algo_len = perm_algo_len; - - /* FIXME: 48.008 3.2.2.10 Encryption Information says: - * "When present, the key shall be 8 octets long." */ ei->key_len = len - 1; - memcpy(ei->key, elem, ei->key_len); - elem+=ei->key_len; - return (int)(elem - old_elem); + /* No key present, done */ + if (ei->key_len == 0) + return len; + + /* "When present, the key shall be 8 octets long." */ + if (ei->key_len != 8) + return -EINVAL; + OSMO_ASSERT(sizeof(ei->key) >= ei->key_len); + memcpy(ei->key, elem, ei->key_len); + return len; } /*! Encode TS 48.008 Kc128 IE. diff --git a/tests/gsm0808/gsm0808_test.c b/tests/gsm0808/gsm0808_test.c index 497de6c..e636d28 100644 --- a/tests/gsm0808/gsm0808_test.c +++ b/tests/gsm0808/gsm0808_test.c @@ -1282,6 +1282,25 @@ rc_dec = gsm0808_dec_encrypt_info(&dec_ei, msg->data + 2, msg->len - 2); OSMO_ASSERT(rc_dec == 9); OSMO_ASSERT(memcmp(&enc_ei, &dec_ei, sizeof(enc_ei)) == 0); + + + /* Test decoding IE with No Encryption and hence with no Key */ + struct gsm0808_encrypt_info enc_ei_no_encryption = { + .perm_algo = { GSM0808_ALG_ID_A5_0 }, + .perm_algo_len = 1, + .key = { 0 }, + .key_len = 0, + }; + uint8_t ei_enc_no_encryption_expected[] = { GSM0808_IE_ENCRYPTION_INFORMATION, 0x01, 0x01 }; + + msg = msgb_alloc(1024, "output buffer"); + rc_enc = gsm0808_enc_encrypt_info(msg, &enc_ei_no_encryption); + OSMO_ASSERT(rc_enc == 3); + OSMO_ASSERT(memcmp(ei_enc_no_encryption_expected, msg->data, msg->len) == 0); + + rc_dec = gsm0808_dec_encrypt_info(&dec_ei, msg->data + 2, msg->len - 2); + OSMO_ASSERT(rc_dec == 1); + OSMO_ASSERT(memcmp(&enc_ei_no_encryption, &dec_ei, sizeof(enc_ei_no_encryption)) == 0); msgb_free(msg); /* Test decoding of malformed IE with no algo selected: */ @@ -1289,6 +1308,15 @@ rc_dec = gsm0808_dec_encrypt_info(&dec_ei, &ei_enc_no_algo[2], sizeof(ei_enc_no_algo) - 2); OSMO_ASSERT(rc_dec == -EINVAL); + /* Test decoding of malformed IE with wrong key length: */ + uint8_t ei_enc_wrong_key_len[256] = { GSM0808_IE_ENCRYPTION_INFORMATION, 0xfd, 0x03 }; + rc_dec = gsm0808_dec_encrypt_info(&dec_ei, &ei_enc_wrong_key_len[2], 0xfd); + OSMO_ASSERT(rc_dec == -EINVAL); + /* test with naother invalid key length: */ + ei_enc_wrong_key_len[1] = 0x03; + rc_dec = gsm0808_dec_encrypt_info(&dec_ei, &ei_enc_wrong_key_len[2], 0x03); + OSMO_ASSERT(rc_dec == -EINVAL); + } static void test_gsm0808_dec_cell_id_list_srvcc(void) -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43251?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I9fd70875f35cebb923278869e1260c5bf3047439 Gerrit-Change-Number: 43251 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-ci[master]: update-osmo-ci: fix WORKSPACE_DIR
by osmith 14 Aug '26

14 Aug '26

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ci/+/43249?usp=email ) Change subject: update-osmo-ci: fix WORKSPACE_DIR ...................................................................... update-osmo-ci: fix WORKSPACE_DIR Adjust WORKSPACE_DIR after the script was moved. Fixes: f49407ff ("scripts/update-osmo-ci: rename from contrib/jenkins.sh") Change-Id: I6dd10ee2236e5f28099752dbdb6b2957bff76ca5 --- M scripts/update-osmo-ci/update-osmo-ci.sh 1 file changed, 1 insertion(+), 1 deletion(-) Approvals: pespin: Looks good to me, approved Jenkins Builder: Verified fixeria: Looks good to me, but someone else must approve diff --git a/scripts/update-osmo-ci/update-osmo-ci.sh b/scripts/update-osmo-ci/update-osmo-ci.sh index 96becc7..717cd63 100755 --- a/scripts/update-osmo-ci/update-osmo-ci.sh +++ b/scripts/update-osmo-ci/update-osmo-ci.sh @@ -1,6 +1,6 @@ #!/bin/sh set -e -x -WORKSPACE_DIR="$(realpath "$(dirname "$0")/..")" +WORKSPACE_DIR="$(realpath "$(dirname "$0")/../..")" # Clone repository to ~/, or update existing # $1: name of osmocom project -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43249?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I6dd10ee2236e5f28099752dbdb6b2957bff76ca5 Gerrit-Change-Number: 43249 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-ci[master]: update-osmo-ci: fix WORKSPACE_DIR
by fixeria 14 Aug '26

14 Aug '26

Attention is currently required from: osmith. fixeria has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ci/+/43249?usp=email ) Change subject: update-osmo-ci: fix WORKSPACE_DIR ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43249?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I6dd10ee2236e5f28099752dbdb6b2957bff76ca5 Gerrit-Change-Number: 43249 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 11:11:01 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ci[master]: update-osmo-ci: fix WORKSPACE_DIR
by pespin 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria, osmith. pespin has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ci/+/43249?usp=email ) Change subject: update-osmo-ci: fix WORKSPACE_DIR ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43249?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I6dd10ee2236e5f28099752dbdb6b2957bff76ca5 Gerrit-Change-Number: 43249 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 11:09:28 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ci[master]: update-osmo-ci: fix WORKSPACE_DIR
by osmith 14 Aug '26

14 Aug '26

osmith has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ci/+/43249?usp=email ) Change subject: update-osmo-ci: fix WORKSPACE_DIR ...................................................................... update-osmo-ci: fix WORKSPACE_DIR Adjust WORKSPACE_DIR after the script was moved. Fixes: f49407ff ("scripts/update-osmo-ci: rename from contrib/jenkins.sh") Change-Id: I6dd10ee2236e5f28099752dbdb6b2957bff76ca5 --- M scripts/update-osmo-ci/update-osmo-ci.sh 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ci refs/changes/49/43249/1 diff --git a/scripts/update-osmo-ci/update-osmo-ci.sh b/scripts/update-osmo-ci/update-osmo-ci.sh index 96becc7..717cd63 100755 --- a/scripts/update-osmo-ci/update-osmo-ci.sh +++ b/scripts/update-osmo-ci/update-osmo-ci.sh @@ -1,6 +1,6 @@ #!/bin/sh set -e -x -WORKSPACE_DIR="$(realpath "$(dirname "$0")/..")" +WORKSPACE_DIR="$(realpath "$(dirname "$0")/../..")" # Clone repository to ~/, or update existing # $1: name of osmocom project -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43249?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I6dd10ee2236e5f28099752dbdb6b2957bff76ca5 Gerrit-Change-Number: 43249 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de>

1 0

[M] Change in libosmocore[master]: iuup: test receival of IuUP Data with way too big payload
by osmith 14 Aug '26

14 Aug '26

Attention is currently required from: pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmocore/+/43248?usp=email ) Change subject: iuup: test receival of IuUP Data with way too big payload ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43248?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Id7059e08aa78af4c18c2be1493fb780a31e3e862 Gerrit-Change-Number: 43248 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 11:01:32 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[L] Change in libosmocore[master]: iuup: Validate msgb input length in rx Initialization path
by osmith 14 Aug '26

14 Aug '26

Attention is currently required from: pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmocore/+/43247?usp=email ) Change subject: iuup: Validate msgb input length in rx Initialization path ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43247?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Id0f7b0f63efc37376024359a3bf7fabbc40bc387 Gerrit-Change-Number: 43247 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 11:01:20 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[M] Change in libosmocore[master]: iuup: test receival of IuUP Data with way too big payload
by pespin 14 Aug '26

14 Aug '26

Attention is currently required from: osmith. pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmocore/+/43248?usp=email ) Change subject: iuup: test receival of IuUP Data with way too big payload ...................................................................... Patch Set 2: (1 comment) File tests/iuup/iuup_test.c: https://gerrit.osmocom.org/c/libosmocore/+/43248/comment/481dc15d_64ad0f62?… : PS1, Line 930: //osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL); > leftover? Done -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43248?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Id7059e08aa78af4c18c2be1493fb780a31e3e862 Gerrit-Change-Number: 43248 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 10:58:38 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: osmith <osmith(a)sysmocom.de>

1 0

[L] Change in libosmocore[master]: iuup: Validate msgb input length in rx Initialization path
by pespin 14 Aug '26

14 Aug '26

Attention is currently required from: osmith. pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmocore/+/43247?usp=email ) Change subject: iuup: Validate msgb input length in rx Initialization path ...................................................................... Patch Set 2: (1 comment) Commit Message: https://gerrit.osmocom.org/c/libosmocore/+/43247/comment/c7a2c879_9c436e1d?… : PS1, Line 12: Related: SYS#7063 > ```suggestion […] Done -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43247?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Id0f7b0f63efc37376024359a3bf7fabbc40bc387 Gerrit-Change-Number: 43247 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 10:58:33 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: osmith <osmith(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026