August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in libosmo-sigtran[master]: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE
by osmith 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria, pespin. osmith has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email ) Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 Gerrit-Change-Number: 43216 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:10:17 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: sua: fix buffer overflow in sua_parse_gt()
by fixeria 14 Aug '26

14 Aug '26

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email ) Change subject: sua: fix buffer overflow in sua_parse_gt() ...................................................................... sua: fix buffer overflow in sua_parse_gt() Cap num_digits to the size of gt->digits before decoding. Add a unit test covering both the exact-fit and oversized num_digits cases. Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Fixes: OS#7046 --- M src/sua.c M tests/xua/xua_test.c M tests/xua/xua_test.ok 3 files changed, 34 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/28/43228/1 diff --git a/src/sua.c b/src/sua.c index b169d50..50fe030 100644 --- a/src/sua.c +++ b/src/sua.c @@ -400,6 +400,10 @@ gt->npi = data[6]; gt->nai = data[7]; + /* cap num_digits to what fits into gt->digits (leaving room for '\0') */ + if (num_digits > sizeof(gt->digits) - 1) + num_digits = sizeof(gt->digits) - 1; + /* parse digits */ out_digits = gt->digits; for (i = 0; i < datalen-8; i++) { diff --git a/tests/xua/xua_test.c b/tests/xua/xua_test.c index 3c5f5fd..ac044be 100644 --- a/tests/xua/xua_test.c +++ b/tests/xua/xua_test.c @@ -372,6 +372,31 @@ msgb_free(msg); } +static void test_sua_parse_gt_overflow(void) +{ + /* 8-byte header + way more digit octets than fit into gt->digits[32] */ + uint8_t data[8 + 64]; + struct osmo_sccp_gt gt = {}; + + memset(data, 0x11, sizeof(data)); + data[3] = 0x42; /* gti */ + data[5] = 0x00; /* tt */ + data[6] = 0x01; /* npi */ + data[7] = 0x04; /* nai */ + + data[4] = sizeof(gt.digits); /* num_digits: not enough room for '\0' */ + printf("Testing sua_parse_gt() with num_digits=%u\n", data[4]); + OSMO_ASSERT(sua_parse_gt(&gt, data, sizeof(data)) == 0); + OSMO_ASSERT(strlen(gt.digits) == sizeof(gt.digits) - 1); + printf("OUT:%s\n", osmo_sccp_gt_dump(&gt)); + + data[4] = 0xff; /* num_digits: attacker-controlled, way too large */ + printf("Testing sua_parse_gt() with oversized num_digits\n"); + OSMO_ASSERT(sua_parse_gt(&gt, data, sizeof(data)) == 0); + OSMO_ASSERT(strlen(gt.digits) == sizeof(gt.digits) - 1); + printf("OUT:%s\n", osmo_sccp_gt_dump(&gt)); +} + /* SCCP Message Transcoding */ struct sccp2sua_testcase { @@ -679,6 +704,7 @@ test_isup_parse(); test_sccp_addr_parser(); test_helpers(); + test_sua_parse_gt_overflow(); test_sccp2sua(); test_rkm(); test_sccp_addr_encdec(); diff --git a/tests/xua/xua_test.ok b/tests/xua/xua_test.ok index 02e5f49..d4a70b1 100644 --- a/tests/xua/xua_test.ok +++ b/tests/xua/xua_test.ok @@ -16,6 +16,10 @@ 0400000001000000040000003931393936393637393338390000000000000000000000000000000000000000 OUT:TT=0,NPL=1,NAI=4,DIG=919969679389 0400000001000000040000003931393936393637393338390000000000000000000000000000000000000000 +Testing sua_parse_gt() with num_digits=32 +OUT:DIG=1111111111111111111111111111111 +Testing sua_parse_gt() with oversized num_digits +OUT:DIG=1111111111111111111111111111111 => BSSMAP-RESET SCCP Input: [L2]> 09 00 03 05 07 02 42 fe 02 42 fe 06 00 04 30 04 01 20 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43228?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I59f601f2d8706748797c802f0f09887e4b9ba31f Gerrit-Change-Number: 43228 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[XS] Change in libosmo-sigtran[master]: xua: Avoid OOB read of Routing Context with len < 4
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43222?usp=email ) Change subject: xua: Avoid OOB read of Routing Context with len < 4 ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43222?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: If19f210c8d6a308f99b4f06fdc06581ffdc62696 Gerrit-Change-Number: 43222 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:04:57 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmo-sigtran[master]: m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_not...
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43221?usp=email ) Change subject: m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_notify() ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43221?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I8eea6c7722b2049e04632bf3f99570b3f979d751 Gerrit-Change-Number: 43221 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:04:52 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmo-sigtran[master]: sua: Dispatch M-NOTIFY.ind to ASP
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43219?usp=email ) Change subject: sua: Dispatch M-NOTIFY.ind to ASP ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43219?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I62255aea1448bb76181b5f6799c3b9bf8c7daa79 Gerrit-Change-Number: 43219 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:04:21 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in libosmo-sigtran[master]: xUA: Avoid sending M-NOTIFY.ind with garbage if decoding xUA NOTIFY f...
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43220?usp=email ) Change subject: xUA: Avoid sending M-NOTIFY.ind with garbage if decoding xUA NOTIFY fails ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43220?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I59e67f03fab6fbf8aa50f44bd1d4165dcd7c8b2f Gerrit-Change-Number: 43220 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:04:16 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in libosmo-sigtran[master]: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE
by laforge 14 Aug '26

14 Aug '26

Attention is currently required from: fixeria, osmith, pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email ) Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE ...................................................................... Patch Set 2: Code-Review+1 (1 comment) Patchset: PS1: > The fix is different than the one proposed. I added a Reported-By: tag to the commit. Done -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 Gerrit-Change-Number: 43216 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 14:00:17 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in libosmo-sigtran[master]: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE
by pespin 13 Aug '26

13 Aug '26

Attention is currently required from: fixeria, laforge, osmith. pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email ) Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE ...................................................................... Patch Set 2: (1 comment) Patchset: PS1: > Bug reporter shoukd geht credit. If its his fix, git author should reflect it. […] The fix is different than the one proposed. I added a Reported-By: tag to the commit. -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 Gerrit-Change-Number: 43216 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Thu, 13 Aug 2026 13:57:08 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org>

1 0

[XS] Change in libosmo-sigtran[master]: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE
by pespin 13 Aug '26

13 Aug '26

Attention is currently required from: fixeria, laforge, osmith, pespin. Hello Jenkins Builder, fixeria, laforge, osmith, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Code-Review+1 by laforge, Code-Review+1 by osmith Change subject: m3ua: Fix potential OOB read in rx NOTIFY INFO String IE ...................................................................... m3ua: Fix potential OOB read in rx NOTIFY INFO String IE Despite RFC4666 states it can contain "any meaningful UTF-8 character string", it also states that the string can be 0 bytes, which implicitly means a string could come without null char at the end. In any case, it's good practice to guard against it, as already done in all the other libosmo-sigtran code. Related: OS#7056 Reported-By: Adam Bedard <adam.bedard(a)gmail.com> Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 --- M src/m3ua.c 1 file changed, 3 insertions(+), 4 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/16/43216/2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43216?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I0bab40ba56d40436ce1295141d92d3555ea8e1d4 Gerrit-Change-Number: 43216 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[M] Change in osmo-ttcn3-hacks[master]: 5gc: keep NUS after UeContextRelease
by pespin 13 Aug '26

13 Aug '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email ) Change subject: 5gc: keep NUS after UeContextRelease ...................................................................... 5gc: keep NUS after UeContextRelease Since open5gs.git b9823196b5de3394b7a144569f186d7d62fad6f9, open5gs properly validates received seq_nr (ul_count) of integrity protected NG-NAS message to make sure it increases with each new UL message, in order to protect against accepting replayed messages. This means that tests going over UeContextRelease procedure need to keep a copy of the NUS (NAS state) because the UeContextreleaseCommand erases the NGAP entry in the NGAP_Emulation table, together with the associated NUS. We need the copy of NUS because we need to keep reusing the NAS state, increasing the previous ul_count. This fixes tests TC_ue_service_request_cm_* as well as TC_net_triggered_service_req. Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3 --- M 5gc/C5G_Tests.ttcn M 5gc/ConnHdlr.ttcn M library/NGAP_Emulation.ttcn 3 files changed, 80 insertions(+), 27 deletions(-) Approvals: Jenkins Builder: Verified osmith: Looks good to me, approved diff --git a/5gc/C5G_Tests.ttcn b/5gc/C5G_Tests.ttcn index 2be26ff..0edd792 100644 --- a/5gc/C5G_Tests.ttcn +++ b/5gc/C5G_Tests.ttcn @@ -576,13 +576,19 @@ * UE signals the active session as active, and it has UL data for it */ private function f_TC_ue_service_request_cm_idle_ul_data() runs on ConnHdlr { var PDU_SessionStatus pdu_session_status; + var NG_NAS_UE_State nus; f_register(); f_pdu_sess_establish(configure_userplane := false); f_sleep(1.0); + /* UECtx State in NGAP_Emulation will be destroyed upon rx of NGAP UeContextReleaseCmd. + * We need to store the NAS state here and feed it back to NGAP_Emulation so it is available for InitialUE(Service Request), + * since the NAS state is still the same one and needs to be used. */ + nus := f_ngap_obtain_nus(g_pars.ue_pars.ran_id); f_ue_context_release(); f_sleep(1.0); pdu_session_status := f_PDU_SessionStatus(); + f_ngap_set_nus(g_pars.ue_pars.ran_id, nus, create_nonexist := true); f_service_request_cm_idle(ul_data_status := pdu_session_status, pdu_sess_status := pdu_session_status); @@ -606,12 +612,18 @@ * UE signals that the active session is now inactive. AMF sends a PFCP Session Delete to SMF. */ private function f_TC_ue_service_request_cm_idle_inact_sess() runs on ConnHdlr { var NGAP_PDU rx_ngap; + var NG_NAS_UE_State nus; f_register(); f_pdu_sess_establish(configure_userplane := false); f_sleep(1.0); + /* UECtx State in NGAP_Emulation will be destroyed upon rx of NGAP UeContextReleaseCmd. + * We need to store the NAS state here and feed it back to NGAP_Emulation so it is available for InitialUE(Service Request), + * since the NAS state is still the same one and needs to be used. */ + nus := f_ngap_obtain_nus(g_pars.ue_pars.ran_id); f_ue_context_release(); f_sleep(1.0); + f_ngap_set_nus(g_pars.ue_pars.ran_id, nus, create_nonexist := true); f_service_request_cm_idle(pdu_sess_status := cs_PDU_SessionStatus('00000000'B, '00000000'B)); NGAP.receive(cr_NG_SERVICE_ACCEPT(p_PDU_SessionStatus := cr_PDU_SessionStatus('00000000'B, '00000000'B))); g_pars.ue_pars.amf_id := f_ngap_obtain_amf_id(); @@ -630,10 +642,17 @@ /* 3GPP TS 23.502 4.2.3.2 UE Triggered Service Request. * UE signals that a session unknown to network is active: */ private function f_TC_ue_service_request_cm_idle_unknown_sess_active() runs on ConnHdlr { + var NG_NAS_UE_State nus; + f_register(); f_sleep(1.0); + /* UECtx State in NGAP_Emulation will be destroyed upon rx of NGAP UeContextReleaseCmd. + * We need to store the NAS state here and feed it back to NGAP_Emulation so it is available for InitialUE(Service Request), + * since the NAS state is still the same one and needs to be used. */ + nus := f_ngap_obtain_nus(g_pars.ue_pars.ran_id); f_ue_context_release(); f_sleep(1.0); + f_ngap_set_nus(g_pars.ue_pars.ran_id, nus, create_nonexist := true); f_service_request_cm_idle(pdu_sess_status := cs_PDU_SessionStatus('00000010'B, '00000000'B)); NGAP.receive(cr_NG_SERVICE_ACCEPT(p_PDU_SessionStatus := cr_PDU_SessionStatus('00000000'B, '00000000'B))); g_pars.ue_pars.amf_id := f_ngap_obtain_amf_id(); @@ -674,13 +693,19 @@ /* 3GPP TS 23.502 4.2.3.3 Network Triggered Service Request */ private function f_TC_net_triggered_service_req() runs on ConnHdlr { var PDU_SessionStatus pdu_session_status; + var NG_NAS_UE_State nus; f_register(); f_pdu_sess_establish(); f_sleep(1.0); + /* UECtx State in NGAP_Emulation will be destroyed upon rx of NGAP UeContextReleaseCmd. + * We need to store the NAS state here and feed it back to NGAP_Emulation so it is available for InitialUE(Service Request), + * since the NAS state is still the same one and needs to be used. */ + nus := f_ngap_obtain_nus(g_pars.ue_pars.ran_id); f_ue_context_release(); f_sleep(1.0); f_create_ngap_expect_proc(id_Paging, self); + f_ngap_set_nus(g_pars.ue_pars.ran_id, nus, create_nonexist := true); /* NOTE: In theory we should generate DL-originated traffic here, but since * UPF let our UL traffic pass (bug?), make use of it to generate some DL diff --git a/5gc/ConnHdlr.ttcn b/5gc/ConnHdlr.ttcn index 8f5e5c5..6125489 100644 --- a/5gc/ConnHdlr.ttcn +++ b/5gc/ConnHdlr.ttcn @@ -879,6 +879,34 @@ NGAP.send(nas_ul_msg); } +private function f_encode_nas(NG_NAS_UL_Message_Type nas_ul_msg) runs on ConnHdlr return NAS_PDU { + var NAS_PDU nas_pdu; + var NG_NAS_UE_State nus; + var BIT4 sec_hdr_t := '0001'B; + var OCT1 seq_nr; + var OCT4 mac; + var NG_NAS_UL_Message_Type nas_out; + + nus := f_ngap_obtain_nus(g_pars.ue_pars.ran_id); + + nus.tx_count := nus.tx_count + 1; + seq_nr := int2oct(nus.tx_count, 1); + nas_pdu := enc_NG_NAS_UL_Message_Type(valueof(nas_ul_msg)); + mac := f_NG_NAS_mac_calc(NG_NAS_ALG_IP_NIA1, f_kdf_ng_nas_int(g_keys.kamf, NG_NAS_ALG_IP_NIA1), + nus.tx_count, + bit2int(tsc_NG_RegResult_3GPP), + false, seq_nr & nas_pdu); + nas_out := valueof(cs_NG_SECURITY_PROTECTED_NAS_MESSAGE(tsc_EPD_GMM, + sec_hdr_t, + mac, + seq_nr, + nas_pdu)); + nas_pdu := enc_NG_NAS_UL_Message_Type(valueof(nas_out)); + + f_ngap_set_nus(g_pars.ue_pars.ran_id, nus); + return nas_pdu; +} + /* 3GPP TS 24.501 5.6.1 Service request procedure * 3GPP TS 23.502 4.2.3.2 UE Triggered Service Request */ function f_service_request_cm_idle(template (omit) ULDataStatus ul_data_status := omit, @@ -898,21 +926,8 @@ f_NG_MobileIdentity_STMSI(), p_Msg := cs_ReplayedNASMessageContainerTLV(nas_pdu)); - //TODO: add a function to send a NAS_UL_MSG and receive the encoded one. - var BIT4 sec_hdr_t := '0001'B; - var integer tx_count := 0; - nas_pdu := enc_NG_NAS_UL_Message_Type(valueof(nas_ul_msg)); - var OCT4 mac := f_NG_NAS_mac_calc(NG_NAS_ALG_IP_NIA1, f_kdf_ng_nas_int(g_keys.kamf, NG_NAS_ALG_IP_NIA1), - tx_count, - bit2int(tsc_NG_RegResult_3GPP), - false, '00'O & nas_pdu); - var NG_NAS_UL_Message_Type nas_out; - nas_out := valueof(cs_NG_SECURITY_PROTECTED_NAS_MESSAGE(tsc_EPD_GMM, - sec_hdr_t, - mac, - int2oct(tx_count, 1), - nas_pdu)); - nas_pdu := enc_NG_NAS_UL_Message_Type(valueof(nas_out)); + nas_pdu := f_encode_nas(valueof(nas_ul_msg)); + tx_pdu := m_ngap_initMsg(m_n2_initialUeMessage(g_pars.ue_pars.ran_id, nas_pdu, /* Service request */ f_ULI(), diff --git a/library/NGAP_Emulation.ttcn b/library/NGAP_Emulation.ttcn index ea23a35..ba2b7d2 100644 --- a/library/NGAP_Emulation.ttcn +++ b/library/NGAP_Emulation.ttcn @@ -118,7 +118,7 @@ signature NGAPEM_register_proc(in integer procedureCode, in NGAP_ConnHdlr hdlr); signature NGAPEM_obtain_amf_id() return AMF_UE_NGAP_ID; signature NGAPEM_obtain_nus(in RAN_UE_NGAP_ID ran_id) return NG_NAS_UE_State; -signature NGAPEM_set_nus(in RAN_UE_NGAP_ID ran_id, in NG_NAS_UE_State nus); +signature NGAPEM_set_nus(in RAN_UE_NGAP_ID ran_id, in NG_NAS_UE_State nus, in boolean create_nonexist); //signature NGAPEM_derive_nas_token(in octetstring kasme, in NGAP_ConnHdlr hdlr, out OCT32 nas_token); type port NGAPEM_PROC_PT procedure { @@ -304,7 +304,7 @@ return -1; /* make ttcn3 compiler happy */ } -private function f_assoc_id_by_comp(NGAP_ConnHdlr client, template (omit) RAN_UE_NGAP_ID ran_id := omit) +private function f_assoc_id_by_comp(NGAP_ConnHdlr client, template (omit) RAN_UE_NGAP_ID ran_id := omit, boolean fail_notfound := true) runs on NGAP_Emulation_CT return integer { var integer i; for (i := 0; i < sizeof(NGapAssociationTable); i := i+1) { @@ -317,8 +317,11 @@ } return i; } - setverdict(fail, "NGAP Association Table not found by component ", client, " RAN-ID=", ran_id); - mtc.stop; + if (fail_notfound) { + setverdict(fail, "NGAP Association Table not found by component ", client, " RAN-ID=", ran_id); + mtc.stop; + } + return -1; } private function f_assoc_by_comp(NGAP_ConnHdlr client) @@ -531,6 +534,7 @@ var integer ai; var octetstring kasme; var NG_NAS_UE_State nus; + var boolean create_nonexist; alt { /* Configuration primitive from client */ @@ -561,8 +565,14 @@ } /* NGAP from client: InitialUE */ [] NGAP_CLIENT.receive(mw_ngap_initMsg(mw_n2_initialUeMessage)) -> value msg sender vc_conn { - /* create a table entry about this connection */ - ai := f_ngap_id_table_add(vc_conn, omit, valueof(f_NGAP_get_RAN_UE_NGAP_ID(msg))); + /* create a table entry about this connection if not yet existing. */ + ran_id := valueof(f_NGAP_get_RAN_UE_NGAP_ID(msg)); + ai := f_assoc_id_by_comp(vc_conn, ran_id, fail_notfound := false); + if (ai >= 0) { + NGapAssociationTable[ai].amf_ue_ngap_id := omit; + } else { + ai := f_ngap_id_table_add(vc_conn, omit, ran_id); + } /* Store ULI so we can use it for generating UlNasTransport from NAS */ NGapAssociationTable[ai].uli := msg.initiatingMessage.value_.InitialUEMessage.protocolIEs[2].value_.userLocationInformation; /* Pass message through */ @@ -692,10 +702,13 @@ var integer i := f_assoc_id_by_comp(vc_conn, ran_id); NGAP_PROC.reply(NGAPEM_obtain_nus:{ran_id} value NGapAssociationTable[i].nus) to vc_conn; } - [] NGAP_PROC.getcall(NGAPEM_set_nus:{?, ?}) -> param(ran_id, nus) sender vc_conn { - var integer i := f_assoc_id_by_comp(vc_conn, ran_id); + [] NGAP_PROC.getcall(NGAPEM_set_nus:{?, ?, ?}) -> param(ran_id, nus, create_nonexist) sender vc_conn { + var integer i := f_assoc_id_by_comp(vc_conn, ran_id, fail_notfound := not create_nonexist); + if (i < 0) { + i := f_ngap_id_table_add(vc_conn, omit, ran_id); + } NGapAssociationTable[i].nus := nus; - NGAP_PROC.reply(NGAPEM_set_nus:{ran_id, nus}) to vc_conn; + NGAP_PROC.reply(NGAPEM_set_nus:{ran_id, nus, create_nonexist}) to vc_conn; } // [] NGAP_PROC.getcall(NGAPEM_derive_nas_token:{?, ?, -}) -> param(kasme, vc_conn) { // var integer assoc_id := f_assoc_id_by_comp(vc_conn); @@ -815,9 +828,9 @@ } } -function f_ngap_set_nus(RAN_UE_NGAP_ID ran_id, NG_NAS_UE_State nus) runs on NGAP_ConnHdlr { - NGAP_PROC.call(NGAPEM_set_nus:{ran_id, nus}) { - [] NGAP_PROC.getreply(NGAPEM_set_nus:{ran_id, nus}); +function f_ngap_set_nus(RAN_UE_NGAP_ID ran_id, NG_NAS_UE_State nus, boolean create_nonexist := false) runs on NGAP_ConnHdlr { + NGAP_PROC.call(NGAPEM_set_nus:{ran_id, nus, create_nonexist}) { + [] NGAP_PROC.getreply(NGAPEM_set_nus:{ran_id, nus, create_nonexist}); } } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3 Gerrit-Change-Number: 43214 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026