August 2026 - gerrit-log - lists.osmocom.org

[L] Change in libosmocore[master]: iuup: Validate msgb input length in rx Initialization path
by pespin 14 Aug '26

14 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43247?usp=email ) Change subject: iuup: Validate msgb input length in rx Initialization path ...................................................................... iuup: Validate msgb input length in rx Initialization path Input length validation of msgb was left as a TODO in iuup_rx_initialization(), which could end up in OOB reads. Related: SYS#7063 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Change-Id: Id0f7b0f63efc37376024359a3bf7fabbc40bc387 --- M src/gsm/iuup.c M tests/iuup/iuup_test.c M tests/iuup/iuup_test.err M tests/iuup/iuup_test.ok 4 files changed, 327 insertions(+), 59 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/47/43247/1 diff --git a/src/gsm/iuup.c b/src/gsm/iuup.c index b7aa5f9..a233fb9 100644 --- a/src/gsm/iuup.c +++ b/src/gsm/iuup.c @@ -539,7 +539,8 @@ /* return: whether the last Init was Acked correctly and hence can transition to next state */ static bool iuup_rx_initialization(struct osmo_iuup_instance *iui, struct osmo_iuup_tnl_prim *itp) { - struct iuup_pdutype14_hdr *hdr; + struct msgb *msg = itp->oph.msg; + struct iuup_pdutype14_hdr *hdr = (struct iuup_pdutype14_hdr *)msgb_l2(msg); struct iuup_ctrl_init_hdr *ihdr; struct iuup_ctrl_init_rfci_hdr *ihdr_rfci; struct iuup_ctrl_init_tail *itail; @@ -551,9 +552,16 @@ struct osmo_iuup_rnl_prim *irp; struct osmo_iuup_tnl_prim *resp; - /* TODO: whenever we check message boundaries, length, etc. and we fail, send NACK */ + /* We expect at least the INIT header with at least 1 RFCI header: */ + if (msgb_l2len(msg) < sizeof(struct iuup_pdutype14_hdr) + + sizeof(struct iuup_ctrl_init_hdr) + + sizeof(struct iuup_ctrl_init_rfci_hdr)) { + LOGPFSML(iui->fi, LOGL_NOTICE, + "Initialization: Malformed packet, length %u too short\n", msgb_l2len(msg)); + err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT; + goto send_nack; + } - hdr = (struct iuup_pdutype14_hdr *)msgb_l2(itp->oph.msg); ihdr = (struct iuup_ctrl_init_hdr *)hdr->payload; if (ihdr->num_subflows_per_rfci == 0) { LOGPFSML(iui->fi, LOGL_NOTICE, "Initialization: Unexpected num_subflows=0 received\n"); @@ -562,16 +570,33 @@ } ihdr_rfci = (struct iuup_ctrl_init_rfci_hdr *)ihdr->rfci_data; + /* Iterate over RFCIs and parse and store its subflow lengths: */ do { struct osmo_iuup_rfci *rfci = &iui->config.rfci[num_rfci]; uint8_t l_size_bytes = ihdr_rfci->li + 1; + struct iuup_ctrl_init_rfci_hdr *next_ihdr_rfci = + (struct iuup_ctrl_init_rfci_hdr *)(&ihdr_rfci->subflow_length[0] + + (ihdr->num_subflows_per_rfci * l_size_bytes)); is_last = ihdr_rfci->lri; + if (num_rfci >= IUUP_MAX_RFCIS) { LOGPFSML(iui->fi, LOGL_NOTICE, "Initialization: Too many RFCIs received (%u)\n", - num_rfci); + num_rfci); err_cause = IUUP_ERR_CAUSE_UNEXPECTED_RFCI; goto send_nack; } + + /* Check contents of current RFCI are available in msgb, and if not last RFCI, + * also check for availability of next ihdr_rfci, all in one go: */ + if ((((uint8_t *)next_ihdr_rfci) + (is_last ? 0 : sizeof(struct iuup_ctrl_init_rfci_hdr))) > + msg->tail) { + LOGPFSML(iui->fi, LOGL_NOTICE, + "Initialization: Malformed packet, length %u too short\n", + msgb_l2len(msg)); + err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT; + goto send_nack; + } + rfci->used = 1; rfci->id = ihdr_rfci->rfci; if (l_size_bytes == 2) { @@ -588,13 +613,21 @@ } } num_rfci++; - ihdr_rfci++; - ihdr_rfci = (struct iuup_ctrl_init_rfci_hdr *)(((uint8_t *)ihdr_rfci) + ihdr->num_subflows_per_rfci * l_size_bytes); + ihdr_rfci = next_ihdr_rfci; } while (!is_last); if (ihdr->ti) { /* Timing information present */ uint8_t *buf = (uint8_t *)ihdr_rfci; uint8_t num_bytes = (num_rfci + 1) / 2; + + if (buf + num_bytes > msg->tail) { + LOGPFSML(iui->fi, LOGL_NOTICE, + "Initialization: Malformed packet, length %u too short\n", + msgb_l2len(msg)); + err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT; + goto send_nack; + } + iui->config.IPTIs_present = true; for (i = 0; i < num_bytes - 1; i++) { iui->config.rfci[i*2].IPTI = *buf >> 4; @@ -610,6 +643,15 @@ iui->config.IPTIs_present = false; itail = (struct iuup_ctrl_init_tail *)ihdr_rfci; } + + if (((uint8_t *)itail) + sizeof(*itail) > msg->tail) { + LOGPFSML(iui->fi, LOGL_NOTICE, + "Initialization: Malformed packet, length %u too short\n", + msgb_l2len(msg)); + err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT; + goto send_nack; + } + if (itail->data_pdu_type > 1) { LOGPFSML(iui->fi, LOGL_NOTICE, "Initialization: Unexpected Data PDU Type %u received\n", itail->data_pdu_type); err_cause = IUUP_ERR_CAUSE_UNEXPECTED_VALUE; @@ -643,9 +685,10 @@ resp = itp_ctrl_ack_alloc(iui, IUUP_PROC_INIT, hdr->frame_nr); iui->transport_prim_cb(&resp->oph, iui->transport_prim_priv); return ihdr->chain_ind == 0; + send_nack: LOGPFSML(iui->fi, LOGL_NOTICE, "Tx Initialization NACK cause=%u orig_message=%s\n", - err_cause, osmo_hexdump((const unsigned char *) msgb_l2(itp->oph.msg), msgb_l2len(itp->oph.msg))); + err_cause, osmo_hexdump((const unsigned char *) msgb_l2(msg), msgb_l2len(msg))); resp = tnp_ctrl_nack_alloc(iui, IUUP_PROC_INIT, err_cause, hdr->frame_nr); iui->transport_prim_cb(&resp->oph, iui->transport_prim_priv); return false; diff --git a/tests/iuup/iuup_test.c b/tests/iuup/iuup_test.c index 725a7d9..353c76a 100644 --- a/tests/iuup/iuup_test.c +++ b/tests/iuup/iuup_test.c @@ -31,6 +31,56 @@ .t_rc = { .t_ms = IUUP_TIMER_RC_T_DEFAULT, .n_max = IUUP_TIMER_RC_N_DEFAULT }, }; +/* Frame 46, "Initialization", SYS#5969 call4_Iu_Iuh.pcap + 1110 .... = PDU Type: Control Procedure (14) + .... 00.. = Ack/Nack: Procedure (0) + .... ..00 = Frame Number: 0 + 0000 .... = Mode Version: 0x0 + .... 0000 = Procedure: Initialization (0) + 1101 11.. = Header CRC: 0x37 [correct] + .... ..01 1011 0100 = Payload CRC: 0x1b4 + 000. .... = Spare: 0x0 + ...0 .... = TI: IPTIs not present (0) + .... 011. = Subflows: 3 + .... ...0 = Chain Indicator: this frame is the last frame for the procedure (0) + RFCI 1 Initialization + 0... .... = RFCI 0 LRI: Not last RFCI (0x0) + .0.. .... = RFCI 0 LI: one octet used (0x0) + ..00 0001 = RFCI 0: 1 + RFCI 0 Flow 0 Len: 81 + RFCI 0 Flow 1 Len: 103 + RFCI 0 Flow 2 Len: 60 + RFCI 6 Initialization + 1... .... = RFCI 1 LRI: Last RFCI in current frame (0x1) + .0.. .... = RFCI 1 LI: one octet used (0x0) + ..00 0110 = RFCI 1: 6 + RFCI 1 Flow 0 Len: 39 + RFCI 1 Flow 1 Len: 0 + RFCI 1 Flow 2 Len: 0 + Iu UP Mode Versions Supported: 0x0001 + 0... .... .... .... = Version 16: not supported (0x0) + .0.. .... .... .... = Version 15: not supported (0x0) + ..0. .... .... .... = Version 14: not supported (0x0) + ...0 .... .... .... = Version 13: not supported (0x0) + .... 0... .... .... = Version 12: not supported (0x0) + .... .0.. .... .... = Version 11: not supported (0x0) + .... ..0. .... .... = Version 10: not supported (0x0) + .... ...0 .... .... = Version 9: not supported (0x0) + .... .... 0... .... = Version 8: not supported (0x0) + .... .... .0.. .... = Version 7: not supported (0x0) + .... .... ..0. .... = Version 6: not supported (0x0) + .... .... ...0 .... = Version 5: not supported (0x0) + .... .... .... 0... = Version 4: not supported (0x0) + .... .... .... .0.. = Version 3: not supported (0x0) + .... .... .... ..0. = Version 2: not supported (0x0) + .... .... .... ...1 = Version 1: supported (0x1) + 0000 .... = RFCI Data Pdu Type: PDU type 0 (0x0) +*/ +const uint8_t iuup_initialization_no_iptis[] = { + 0xe0, 0x00, 0xdd, 0xb4, 0x06, 0x01, 0x51, 0x67, 0x3c, 0x86, 0x27, + 0x00, 0x00, 0x00, 0x01, 0x00 +}; + /* Frame 33, "Initialization", OS#4744 3g_call_23112021.pcapng IuUP 1110 .... = PDU Type: Control Procedure (14) @@ -665,56 +715,6 @@ struct iuup_pdutype14_hdr *hdr14; int rc; - /* Frame 46, "Initialization", SYS#5969 call4_Iu_Iuh.pcap - 1110 .... = PDU Type: Control Procedure (14) - .... 00.. = Ack/Nack: Procedure (0) - .... ..00 = Frame Number: 0 - 0000 .... = Mode Version: 0x0 - .... 0000 = Procedure: Initialization (0) - 1101 11.. = Header CRC: 0x37 [correct] - .... ..01 1011 0100 = Payload CRC: 0x1b4 - 000. .... = Spare: 0x0 - ...0 .... = TI: IPTIs not present (0) - .... 011. = Subflows: 3 - .... ...0 = Chain Indicator: this frame is the last frame for the procedure (0) - RFCI 1 Initialization - 0... .... = RFCI 0 LRI: Not last RFCI (0x0) - .0.. .... = RFCI 0 LI: one octet used (0x0) - ..00 0001 = RFCI 0: 1 - RFCI 0 Flow 0 Len: 81 - RFCI 0 Flow 1 Len: 103 - RFCI 0 Flow 2 Len: 60 - RFCI 6 Initialization - 1... .... = RFCI 1 LRI: Last RFCI in current frame (0x1) - .0.. .... = RFCI 1 LI: one octet used (0x0) - ..00 0110 = RFCI 1: 6 - RFCI 1 Flow 0 Len: 39 - RFCI 1 Flow 1 Len: 0 - RFCI 1 Flow 2 Len: 0 - Iu UP Mode Versions Supported: 0x0001 - 0... .... .... .... = Version 16: not supported (0x0) - .0.. .... .... .... = Version 15: not supported (0x0) - ..0. .... .... .... = Version 14: not supported (0x0) - ...0 .... .... .... = Version 13: not supported (0x0) - .... 0... .... .... = Version 12: not supported (0x0) - .... .0.. .... .... = Version 11: not supported (0x0) - .... ..0. .... .... = Version 10: not supported (0x0) - .... ...0 .... .... = Version 9: not supported (0x0) - .... .... 0... .... = Version 8: not supported (0x0) - .... .... .0.. .... = Version 7: not supported (0x0) - .... .... ..0. .... = Version 6: not supported (0x0) - .... .... ...0 .... = Version 5: not supported (0x0) - .... .... .... 0... = Version 4: not supported (0x0) - .... .... .... .0.. = Version 3: not supported (0x0) - .... .... .... ..0. = Version 2: not supported (0x0) - .... .... .... ...1 = Version 1: supported (0x1) - 0000 .... = RFCI Data Pdu Type: PDU type 0 (0x0) - */ - const uint8_t iuup_init[] = { - 0xe0, 0x00, 0xdd, 0xb4, 0x06, 0x01, 0x51, 0x67, 0x3c, 0x86, 0x27, - 0x00, 0x00, 0x00, 0x01, 0x00 - }; - iui = osmo_iuup_instance_alloc(iuup_test_ctx, __func__); OSMO_ASSERT(iui); osmo_iuup_instance_set_user_prim_cb(iui, _decode_passive_init_2_rfci_no_iptis_user_prim_cb, NULL); @@ -732,9 +732,9 @@ /* Send Init: */ tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE); - tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_init)); + tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_initialization_no_iptis)); hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg); - memcpy(hdr14, iuup_init, sizeof(iuup_init)); + memcpy(hdr14, iuup_initialization_no_iptis, sizeof(iuup_initialization_no_iptis)); rc = osmo_iuup_tnl_prim_up(iui, tnp); OSMO_ASSERT(rc == 0); @@ -742,6 +742,176 @@ osmo_iuup_instance_free(iui); } +static int _decode_passive_init_exp_nack_transport_prim_cb(struct osmo_prim_hdr *oph, void *ctx) +{ + struct osmo_iuup_tnl_prim *itp = (struct osmo_iuup_tnl_prim *)oph; + struct msgb *msg; + struct iuup_pdutype14_hdr *hdr; + + printf("%s()\n", __func__); + msg = oph->msg; + OSMO_ASSERT(OSMO_PRIM_HDR(&itp->oph) == OSMO_PRIM(OSMO_IUUP_TNL_UNITDATA, PRIM_OP_REQUEST)); + printf("Transport: DL len=%u: %s\n", msgb_l2len(msg), + osmo_hexdump((const unsigned char *) msgb_l2(msg), msgb_l2len(msg))); + hdr = msgb_l2(msg); + OSMO_ASSERT(hdr->pdu_type == IUUP_PDU_T_CONTROL); + OSMO_ASSERT(hdr->ack_nack == IUUP_AN_NACK); + msgb_free(msg); + return 0; +} +/* Send a malformed Initialization to UIT containing num_subflows_per_rfci = 0. + * It shall be rejected since num_subflows_per_rfci should be at least one accoridng to 3GPP TS 25.415 Figure 24 */ +void test_decode_passive_init_malformed_0subflows(void) +{ + /* Here we check the passive INIT code path, aka receiving INIT and returning INIT_ACK/NACK */ + struct osmo_iuup_instance *iui; + struct osmo_iuup_rnl_prim *rnp; + struct osmo_iuup_tnl_prim *tnp; + struct iuup_pdutype14_hdr *hdr14; + struct iuup_ctrl_init_hdr *ihdr; + uint16_t payload_crc; + int rc; + + iui = osmo_iuup_instance_alloc(iuup_test_ctx, __func__); + OSMO_ASSERT(iui); + osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL); + + clock_override_set(0, 0); + + /* Tx CONFIG.req */ + rnp = osmo_iuup_rnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, IUUP_MSGB_SIZE); + rnp->u.config = def_configure_req; + rnp->u.config.active = false; + + rc = osmo_iuup_rnl_prim_down(iui, rnp); + OSMO_ASSERT(rc == 0); + + /* Prepare and send Init: copy iuup_initialization_no_iptis, modify setting TI=1 (becoming malformed) and dispatch it. */ + tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE); + tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_initialization_no_iptis)); + hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg); + memcpy(hdr14, iuup_initialization_no_iptis, sizeof(iuup_initialization_no_iptis)); + + ihdr = (struct iuup_ctrl_init_hdr *)hdr14->payload; + ihdr->num_subflows_per_rfci = 0; + payload_crc = osmo_iuup_compute_payload_crc(msgb_l2(tnp->oph.msg), msgb_l2len(tnp->oph.msg)); + hdr14->payload_crc_hi = (payload_crc >> 8) & 0x03; + hdr14->payload_crc_lo = payload_crc & 0xff; + + rc = osmo_iuup_tnl_prim_up(iui, tnp); + OSMO_ASSERT(rc == 0); + + osmo_iuup_instance_free(iui); +} + +/* Send a malformed Initialization to UIT containing TI=1 and no IPTIs encoded. + * As a result, the msgb content is too short and should be rejected. */ +void test_decode_passive_init_malformed_ti1_no_iptis(void) +{ + /* Here we check the passive INIT code path, aka receiving INIT and returning INIT_ACK/NACK */ + struct osmo_iuup_instance *iui; + struct osmo_iuup_rnl_prim *rnp; + struct osmo_iuup_tnl_prim *tnp; + struct iuup_pdutype14_hdr *hdr14; + struct iuup_ctrl_init_hdr *ihdr; + uint16_t payload_crc; + int rc; + + iui = osmo_iuup_instance_alloc(iuup_test_ctx, __func__); + OSMO_ASSERT(iui); + osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL); + + clock_override_set(0, 0); + + /* Tx CONFIG.req */ + rnp = osmo_iuup_rnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, IUUP_MSGB_SIZE); + rnp->u.config = def_configure_req; + rnp->u.config.active = false; + + rc = osmo_iuup_rnl_prim_down(iui, rnp); + OSMO_ASSERT(rc == 0); + + /* Prepare and send Init: copy iuup_initialization_no_iptis, modify setting TI=1 (becoming malformed) and dispatch it. */ + tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE); + tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_initialization_no_iptis)); + hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg); + memcpy(hdr14, iuup_initialization_no_iptis, sizeof(iuup_initialization_no_iptis)); + + ihdr = (struct iuup_ctrl_init_hdr *)hdr14->payload; + ihdr->ti = 1; + payload_crc = osmo_iuup_compute_payload_crc(msgb_l2(tnp->oph.msg), msgb_l2len(tnp->oph.msg)); + hdr14->payload_crc_hi = (payload_crc >> 8) & 0x03; + hdr14->payload_crc_lo = payload_crc & 0xff; + + rc = osmo_iuup_tnl_prim_up(iui, tnp); + OSMO_ASSERT(rc == 0); + + osmo_iuup_instance_free(iui); +} + +/* Send a malformed Initialization to UIT containing no RFCIs. + * As a result, the msgb content is too short and should be rejected. */ +void _test_submit_iuup_initialization_trimmed(unsigned int pkt_len, const char *test_name) +{ + /* Here we check the passive INIT code path, aka receiving INIT and returning INIT_ACK/NACK */ + struct osmo_iuup_instance *iui; + struct osmo_iuup_rnl_prim *rnp; + struct osmo_iuup_tnl_prim *tnp; + struct iuup_pdutype14_hdr *hdr14; + uint16_t payload_crc; + int rc; + + OSMO_ASSERT(pkt_len <= sizeof(iuup_initialization_no_iptis)); + + iui = osmo_iuup_instance_alloc(iuup_test_ctx, test_name); + OSMO_ASSERT(iui); + osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL); + + /* Tx CONFIG.req */ + rnp = osmo_iuup_rnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, IUUP_MSGB_SIZE); + rnp->u.config = def_configure_req; + rnp->u.config.active = false; + + rc = osmo_iuup_rnl_prim_down(iui, rnp); + OSMO_ASSERT(rc == 0); + + /* Prepare and send Init: copy iuup_initialization_no_iptis, modify setting TI=1 (becoming malformed) and dispatch it. */ + tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE); + tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, pkt_len); + hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg); + memcpy(hdr14, iuup_initialization_no_iptis, pkt_len); + + payload_crc = osmo_iuup_compute_payload_crc(msgb_l2(tnp->oph.msg), msgb_l2len(tnp->oph.msg)); + hdr14->payload_crc_hi = (payload_crc >> 8) & 0x03; + hdr14->payload_crc_lo = payload_crc & 0xff; + + rc = osmo_iuup_tnl_prim_up(iui, tnp); + OSMO_ASSERT(rc == 0); + + osmo_iuup_instance_free(iui); +} +void test_decode_passive_init_malformed_no_rfci(void) +{ + unsigned int pkt_len = sizeof(struct iuup_pdutype14_hdr) + sizeof(struct iuup_ctrl_init_hdr); + clock_override_set(0, 0); + _test_submit_iuup_initialization_trimmed(pkt_len, __func__); +} + +/* Send a malformed Initialization to UIT containing malformed RFCIs. + * As a result, the msgb content is too short and should be rejected. */ +void test_decode_passive_init_malformed_rfci_too_short(void) +{ + unsigned int pkt_len = sizeof(struct iuup_pdutype14_hdr) + sizeof(struct iuup_ctrl_init_hdr) + 2; + clock_override_set(0, 0); + _test_submit_iuup_initialization_trimmed(pkt_len, __func__); +} + +void test_decode_passive_init_malformed_missing_last_byte(void) +{ + clock_override_set(0, 0); + _test_submit_iuup_initialization_trimmed(sizeof(iuup_initialization_no_iptis) - 1, __func__); +} + int main(int argc, char **argv) { iuup_test_ctx = talloc_named_const(NULL, 0, "iuup_test"); @@ -762,6 +932,11 @@ test_passive_init(); test_passive_init_retrans(); test_decode_passive_init_2_rfci_no_iptis(); + test_decode_passive_init_malformed_0subflows(); + test_decode_passive_init_malformed_ti1_no_iptis(); + test_decode_passive_init_malformed_no_rfci(); + test_decode_passive_init_malformed_rfci_too_short(); + test_decode_passive_init_malformed_missing_last_byte(); printf("OK.\n"); } diff --git a/tests/iuup/iuup_test.err b/tests/iuup/iuup_test.err index fe1ed397..0298420 100644 --- a/tests/iuup/iuup_test.err +++ b/tests/iuup/iuup_test.err @@ -53,3 +53,38 @@ DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){Initialisation}: Tx Initialization ACK DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){Initialisation}: state_chg to SMpSDU_Data_Transfer_Ready DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){SMpSDU_Data_Transfer_Ready}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Initialization: Unexpected num_subflows=0 received +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Tx Initialization NACK cause=20 orig_message=e0 00 dc 62 00 01 51 67 3c 86 27 00 00 00 01 00 +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Initialization: Malformed packet, length 16 too short +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 dc 06 16 01 51 67 3c 86 27 00 00 00 01 00 +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Initialization: Malformed packet, length 5 too short +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 dc cc 06 +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Initialization: Malformed packet, length 7 too short +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 df 7d 06 01 51 +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Initialization: Malformed packet, length 15 too short +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 df f7 06 01 51 67 3c 86 27 00 00 00 01 +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Deallocated diff --git a/tests/iuup/iuup_test.ok b/tests/iuup/iuup_test.ok index 57baba9..204c290 100644 --- a/tests/iuup/iuup_test.ok +++ b/tests/iuup/iuup_test.ok @@ -58,4 +58,19 @@ _decode_passive_init_2_rfci_no_iptis_user_prim_cb(): Initialization decoded fine! _decode_passive_init_2_rfci_no_iptis_transport_prim_cb() Transport: DL len=4: e4 00 24 00 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 50 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 20 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 20 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 20 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 20 OK. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43247?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Id0f7b0f63efc37376024359a3bf7fabbc40bc387 Gerrit-Change-Number: 43247 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-ttcn3-hacks[master]: SGP32Definitions_Templates: fix tr/ts_getBoundProfilePackageRequestEsipa
by dexter 14 Aug '26

14 Aug '26

dexter has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43224?usp=email ) Change subject: SGP32Definitions_Templates: fix tr/ts_getBoundProfilePackageRequestEsipa ...................................................................... SGP32Definitions_Templates: fix tr/ts_getBoundProfilePackageRequestEsipa The templates transactionId parameter on the templates tr/ts_getBoundProfilePackageRequestEsipa is not used. In the templates itself the related member is still populated with constants. Change-Id: I6de1272ca22e31b906a49ce532066b76d2a80ad1 Related: SYS#8100 --- M library/euicc/SGP32Definitions_Templates.ttcn 1 file changed, 3 insertions(+), 3 deletions(-) Approvals: jolly: Looks good to me, approved Jenkins Builder: Verified diff --git a/library/euicc/SGP32Definitions_Templates.ttcn b/library/euicc/SGP32Definitions_Templates.ttcn index be715b6..eccaee0 100644 --- a/library/euicc/SGP32Definitions_Templates.ttcn +++ b/library/euicc/SGP32Definitions_Templates.ttcn @@ -744,10 +744,10 @@ downloadResponseOk := ts_prepareDownloadResponseOk } template (present) EsipaMessageFromIpaToEim -tr_getBoundProfilePackageRequestEsipa(template (present) octetstring transactionId := 'ABCDEF'O, +tr_getBoundProfilePackageRequestEsipa(template (present) octetstring transactionId := ?, template (present) SGP32_PrepareDownloadResponse prepareDownloadResponse := tr_SGP32_prepareDownloadResponse) := { getBoundProfilePackageRequestEsipa := { - transactionId := ?, + transactionId := transactionId, prepareDownloadResponse := prepareDownloadResponse } } @@ -755,7 +755,7 @@ ts_getBoundProfilePackageRequestEsipa(template (value) octetstring transactionId := 'ABCDEF'O, template (value) SGP32_PrepareDownloadResponse prepareDownloadResponse := ts_SGP32_prepareDownloadResponse) := { getBoundProfilePackageRequestEsipa := { - transactionId := 'ABCDEF'O, + transactionId := transactionId, prepareDownloadResponse := prepareDownloadResponse } } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43224?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I6de1272ca22e31b906a49ce532066b76d2a80ad1 Gerrit-Change-Number: 43224 Gerrit-PatchSet: 2 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu>

1 0

[S] Change in osmo-msc[master]: sgs_iface: clean up code in function decode_mme_name
by dexter 14 Aug '26

14 Aug '26

Attention is currently required from: laforge, pespin. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email ) Change subject: sgs_iface: clean up code in function decode_mme_name ...................................................................... Patch Set 4: (1 comment) File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43237/comment/d781c035_76a40063?usp… : PS2, Line 204: OSMO_ASSERT(osmo_parse_mme_domain(&gummei, mme_fqdn) == 0); > As it seems it gets even more problematic here: Let's assume we have called decode_mme_name before w […] Ah, no. Looks like a made a thinking mistake here. Let's forget about this. -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9aec8300f15264b68ac8e7805e93e621b12cafb2 Gerrit-Change-Number: 43237 Gerrit-PatchSet: 4 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:48:13 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[S] Change in osmo-msc[master]: sgs_iface: clean up code in function decode_mme_name
by dexter 14 Aug '26

14 Aug '26

Attention is currently required from: laforge, pespin. dexter has posted comments on this change by dexter. ( https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email ) Change subject: sgs_iface: clean up code in function decode_mme_name ...................................................................... Patch Set 4: (2 comments) File src/libmsc/sgs_iface.c: https://gerrit.osmocom.org/c/osmo-msc/+/43237/comment/c6388a77_7018663e?usp… : PS2, Line 178: > the questions is what such proprietary formats are, how they look like, used by whom, and why there […] We do try to parse it again (see below). We also use it to extract the gummei but as it seems the result is only used to name an FSM. The mme_fqdn is also used in the VLR. It is probably difficult to trace if it is really safe to use an arbitrary string as MME name. https://gerrit.osmocom.org/c/osmo-msc/+/43237/comment/e01fb919_6e4be4c2?usp… : PS2, Line 204: OSMO_ASSERT(osmo_parse_mme_domain(&gummei, mme_fqdn) == 0); As it seems it gets even more problematic here: Let's assume we have called decode_mme_name before with a SGSAP_IE_MME_NAME that was not acceted by osmo_parse_mme_domain, so we took the memcpy path and just copied the value. Now we call sgs_mme_fqdn_received here with that value. Since the value didn't change, osmo_parse_mme_domain will reject it and the OSMO_ASSERT will crash the MSC. The OSMO_ASSERT was introduced with: ``` commit 0df904dea9106587f40ec379e9cc05ea251beb7e Author: Harald Welte <laforge(a)gnumonks.org> Date: Mon Dec 3 11:00:04 2018 +0100 ``` This is much earlier than: ``` commit e2bd9eb37d8160b436a5a1bffc14690321f40ae6 Author: Omar Ramadan <omar.ramadan93(a)gmail.com> Date: Fri Apr 12 09:03:39 2019 -0700 ``` So from what I can see the alternate path was never actively used, as it would have crashed the MSC. If this is true I would see that as an argument for removing the alternate path altogether as it has never worked. -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/43237?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: I9aec8300f15264b68ac8e7805e93e621b12cafb2 Gerrit-Change-Number: 43237 Gerrit-PatchSet: 4 Gerrit-Owner: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:44:57 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: dexter <pmaier(a)sysmocom.de>

1 0

[XS] Change in osmo-ci[master]: contrib/jenkins: add script for running pytest
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: osmith. laforge has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ci/+/43242?usp=email ) Change subject: contrib/jenkins: add script for running pytest ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43242?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: Iaec67a252fca8f1978d1465f3ce3e1d4c9415a9b Gerrit-Change-Number: 43242 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:08:07 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ci[master]: tests: add test_gerrit_verifications
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: osmith. laforge has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ci/+/43241?usp=email ) Change subject: tests: add test_gerrit_verifications ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43241?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I6139e0385470e4c0c48d8a698f67645ac1605cbc Gerrit-Change-Number: 43241 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:07:51 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ci[master]: scripts/update-osmo-ci: rename from contrib/jenkins.sh
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: osmith. laforge has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ci/+/43240?usp=email ) Change subject: scripts/update-osmo-ci: rename from contrib/jenkins.sh ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43240?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: Ie9793663aa9b60683fc78c738b550913e8f01fbb Gerrit-Change-Number: 43240 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:07:35 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ci[master]: jobs/gerrit-verifications: support up to 5 distros
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria, osmith, pespin. laforge has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ci/+/43239?usp=email ) Change subject: jobs/gerrit-verifications: support up to 5 distros ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/43239?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I9fd3c90cee659706a53e81244f3324d0e9940069 Gerrit-Change-Number: 43239 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:07:08 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ttcn3-hacks[master]: deps/Makefile: eclipse gitlab -> osmocom mirror
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria, osmith, pespin. laforge has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43245?usp=email ) Change subject: deps/Makefile: eclipse gitlab -> osmocom mirror ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43245?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ica33853154438a81a42196e9bfefac98764cbf18 Gerrit-Change-Number: 43245 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 14 Aug 2026 09:06:32 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ttcn3-hacks[master]: deps/Makefile: eclipse gitlab -> osmocom mirror
by osmith 14 Aug '26

14 Aug '26

osmith has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43245?usp=email ) Change subject: deps/Makefile: eclipse gitlab -> osmocom mirror ...................................................................... deps/Makefile: eclipse gitlab -> osmocom mirror Even with recent changes to the deps logic, we occasionally still run into the rate limits of the eclipse gitlab. Change it to clone from our forgejo instance instead, where we now have mirrors of these repositories that get updated every 8 hours. Change-Id: Ica33853154438a81a42196e9bfefac98764cbf18 --- M deps/Makefile 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/45/43245/1 diff --git a/deps/Makefile b/deps/Makefile index 7df5746..acdadcd 100644 --- a/deps/Makefile +++ b/deps/Makefile @@ -2,7 +2,7 @@ # Copyright 2018 sysmocom - s.f.m.c. GmbH # SPDX-License-Identifier: Apache-2.0 -ECLIPSEGITLAB:=https://gitlab.eclipse.org/eclipse/titan +ECLIPSEGITLAB:=https://gitea.osmocom.org/mirrors OSMOGITHUB:=https://github.com/osmocom OSMOGERRIT:=https://gerrit.osmocom.org OSMOGITEA:=https://gitea.osmocom.org/ttcn3 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43245?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ica33853154438a81a42196e9bfefac98764cbf18 Gerrit-Change-Number: 43245 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026