pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43221?usp=email )
Change subject: m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_notify()
......................................................................
m3ua: always initialize asp_id and route_ctx_count in m3ua_decode_notify()
In theory user should have a look at npar->presence before accessing
those fields, but in case it is somewhere forgotten then best having
some initialized values, specially in the route_ctx_count which could
turn into buffer overflows or reading more garbage from uninitialized
array members.
Change-Id: I8eea6c7722b2049e04632bf3f99570b3f979d751
---
M src/m3ua.c
1 file changed, 4 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/21/43221/1
diff --git a/src/m3ua.c b/src/m3ua.c
index 39402fd..f2455eb 100644
--- a/src/m3ua.c
+++ b/src/m3ua.c
@@ -484,6 +484,8 @@
if (aspid_ie) {
npar->asp_id = xua_msg_part_get_u32(aspid_ie);
npar->presence |= NOTIFY_PAR_P_ASP_ID;
+ } else {
+ npar->asp_id = 0;
}
if (rctx_ie) {
@@ -502,6 +504,8 @@
for (unsigned int i = 0; i < npar->route_ctx_count; i++)
npar->route_ctx[i] = ntohl(*(uint32_t *)&rctx_ie->dat[i << 2]);
npar->presence |= NOTIFY_PAR_P_ROUTE_CTX;
+ } else {
+ npar->route_ctx_count = 0;
}
if (info_ie)
--
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43221?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: I8eea6c7722b2049e04632bf3f99570b3f979d751
Gerrit-Change-Number: 43221
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Attention is currently required from: laforge.
pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email )
Change subject: 5gc: keep NUS after UeContextRelease
......................................................................
Patch Set 2:
(1 comment)
Patchset:
PS2:
> I know too little details about the 5GC test suite, but if you are convinced this is the way to go, […]
Changing all that now is quite some work though, so for now I think let's merge this patch to overcome the limitations and have the tests passing again, and I'll give it a deeper look later on when I come back to this.
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3
Gerrit-Change-Number: 43214
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: laforge <laforge(a)osmocom.org>
Gerrit-CC: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Comment-Date: Thu, 13 Aug 2026 08:50:48 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: laforge <laforge(a)osmocom.org>
Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>
Attention is currently required from: pespin.
laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email )
Change subject: 5gc: keep NUS after UeContextRelease
......................................................................
Patch Set 2:
(1 comment)
Patchset:
PS2:
> TBH the more I work with the NGAP/S1AP Emulation the more I see stuffing the NAS enc/dec in there wa […]
I know too little details about the 5GC test suite, but if you are convinced this is the way to go, I trust you.
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3
Gerrit-Change-Number: 43214
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: laforge <laforge(a)osmocom.org>
Gerrit-CC: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Comment-Date: Thu, 13 Aug 2026 08:29:28 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: laforge <laforge(a)osmocom.org>
Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>
pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43212?usp=email )
Change subject: 5gc: Fix NG NAS ul_count not incremented
......................................................................
5gc: Fix NG NAS ul_count not incremented
Since open5gs.git b9823196b5de3394b7a144569f186d7d62fad6f9, open5gs
properly validates received seq_nr (ul_count) of integrity protected
NG-NAS message to make sure it increases with each new UL message, in
order to protect against accepting replayed messages.
This made the 5gc testsuite fail since our NGAP/NG-NAS emulation was not
properly increasing ul_count when sending new messages, but always using
ul_count=0.
Change-Id: I7ea4460c902a5f612243e155a484acc89acd447f
---
M library/NG_CryptoFunctions.ttcn
1 file changed, 10 insertions(+), 6 deletions(-)
Approvals:
Jenkins Builder: Verified
osmith: Looks good to me, approved
laforge: Looks good to me, but someone else must approve
diff --git a/library/NG_CryptoFunctions.ttcn b/library/NG_CryptoFunctions.ttcn
index b16029e..840ed91 100644
--- a/library/NG_CryptoFunctions.ttcn
+++ b/library/NG_CryptoFunctions.ttcn
@@ -307,13 +307,16 @@
var BIT4 sec_hdr_t;
var OCT4 mac;
var NG_NAS_UL_Message_Type nas_out;
-
- if (nus.use_enc == false and nus.use_int == false) {
- return nas_in;
- }
+ var OCT1 seq_nr;
if (nus.new_ctx) {
nus.tx_count := 0;
+ } else {
+ nus.tx_count := nus.tx_count + 1;
+ }
+
+ if (nus.use_enc == false and nus.use_int == false) {
+ return nas_in;
}
var octetstring nas_enc := enc_NG_NAS_UL_Message_Type(nas_in)
@@ -327,14 +330,15 @@
Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, "Not supported");
}
+ seq_nr := int2oct(nus.tx_count mod 256, 1);
sec_hdr_t := f_NG_NAS_determine_sec_hdr_t(nus.use_enc, nus.use_int, nus.new_ctx);
mac := f_NG_NAS_mac_calc(nus.alg_int, nus.k_nas_int, nus.tx_count,
bit2int(tsc_NG_RegResult_3GPP),
- f_tx_is_downlink(nus), '00'O & nas_enc);
+ f_tx_is_downlink(nus), seq_nr & nas_enc);
nas_out := valueof(cs_NG_SECURITY_PROTECTED_NAS_MESSAGE(tsc_EPD_GMM,
sec_hdr_t,
mac,
- int2oct(nus.tx_count, 1),
+ seq_nr,
nas_enc));
return nas_out;
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43212?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: I7ea4460c902a5f612243e155a484acc89acd447f
Gerrit-Change-Number: 43212
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43213?usp=email )
Change subject: mme: Fix NG NAS ul_count not incremented
......................................................................
mme: Fix NG NAS ul_count not incremented
Since open5gs.git b9823196b5de3394b7a144569f186d7d62fad6f9, open5gs
properly validates received seq_nr (ul_count) of integrity protected
4G NAS message to make sure it increases with each new UL message, in
order to protect against accepting replayed messages.
This made the mme testsuite fail since our S1AP/4G-NAS emulation was not
properly increasing ul_count when sending new messages, but always using
ul_count=0.
Change-Id: Idace7ad5c832cbfa48696de69e604eb4bd411980
---
M library/LTE_CryptoFunctions.ttcn
1 file changed, 9 insertions(+), 5 deletions(-)
Approvals:
Jenkins Builder: Verified
osmith: Looks good to me, approved
laforge: Looks good to me, but someone else must approve
diff --git a/library/LTE_CryptoFunctions.ttcn b/library/LTE_CryptoFunctions.ttcn
index 882861b..954e085 100644
--- a/library/LTE_CryptoFunctions.ttcn
+++ b/library/LTE_CryptoFunctions.ttcn
@@ -247,13 +247,16 @@
{
var BIT4 sec_hdr_t;
var PDU_NAS_EPS nas_out;
-
- if (nus.use_enc == false and nus.use_int == false) {
- return nas_in;
- }
+ var OCT1 seq_nr;
if (nus.new_ctx) {
nus.tx_count := 0;
+ } else {
+ nus.tx_count := nus.tx_count + 1;
+ }
+
+ if (nus.use_enc == false and nus.use_int == false) {
+ return nas_in;
}
var octetstring nas_enc := enc_PDU_NAS_EPS(nas_in);
@@ -262,11 +265,12 @@
f_tx_is_downlink(nus), nas_enc);
}
+ seq_nr := int2oct(nus.tx_count mod 256, 1);
sec_hdr_t := f_nas_determine_sec_hdr_t(nus.use_enc, nus.use_int, nus.new_ctx);
nas_out := valueof(ts_NAS_EMM_SecurityProtected(sec_hdr_t, nus.tx_count, nas_enc));
if (nus.use_int) {
var OCT4 mac := f_nas_mac_calc(nus.alg_int, nus.k_nas_int, nus.tx_count, 0,
- f_tx_is_downlink(nus), '00'O & nas_enc);
+ f_tx_is_downlink(nus), seq_nr & nas_enc);
nas_out.ePS_messages.ePS_MobilityManagement.pDU_NAS_EPS_SecurityProtectedNASMessage.messageAuthenticationCode := mac;
}
return nas_out;
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43213?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: Idace7ad5c832cbfa48696de69e604eb4bd411980
Gerrit-Change-Number: 43213
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43211?usp=email )
Change subject: 5gc: TC_ng_register_ping46_256: Increase Tguard
......................................................................
5gc: TC_ng_register_ping46_256: Increase Tguard
The 30.0 are sometimes not enough to run the test, specially on
resource-constrained systems.
Change-Id: I312f132094707a39b2980529cf363af4b172e66a
---
M 5gc/C5G_Tests.ttcn
1 file changed, 1 insertion(+), 1 deletion(-)
Approvals:
Jenkins Builder: Verified
osmith: Looks good to me, approved
laforge: Looks good to me, but someone else must approve
diff --git a/5gc/C5G_Tests.ttcn b/5gc/C5G_Tests.ttcn
index 2649a2f..2be26ff 100644
--- a/5gc/C5G_Tests.ttcn
+++ b/5gc/C5G_Tests.ttcn
@@ -559,7 +559,7 @@
var ConnHdlr vc_conn[256];
var integer i;
- f_init();
+ f_init(t_guard := 60.0);
f_ngap_setup(0);
for (i := 0; i < sizeof(vc_conn); i := i + 1) {
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43211?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: merged
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: I312f132094707a39b2980529cf363af4b172e66a
Gerrit-Change-Number: 43211
Gerrit-PatchSet: 1
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: jolly <andreas(a)eversberg.eu>
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Attention is currently required from: fixeria, laforge.
pespin has posted comments on this change by laforge. ( https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email )
Change subject: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
......................................................................
Patch Set 2: Code-Review-1
(1 comment)
Patchset:
PS2:
tp is a pointer, not an array. Either change the tp param or pass a num_elem_array or something.
--
To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: libosmocore
Gerrit-Branch: master
Gerrit-Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737
Gerrit-Change-Number: 43215
Gerrit-PatchSet: 2
Gerrit-Owner: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Comment-Date: Thu, 13 Aug 2026 08:01:19 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Attention is currently required from: laforge.
pespin has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email )
Change subject: 5gc: keep NUS after UeContextRelease
......................................................................
Patch Set 2:
(1 comment)
Patchset:
PS2:
> Isn't there some more automatic way how we can unburden the test cases from manually managing the nu […]
TBH the more I work with the NGAP/S1AP Emulation the more I see stuffing the NAS enc/dec in there was a bad idea, as it comes with all sorts of limitations and problems.
In the end the NAS send/recv from NGAP/S1AP_Emulation is only used with UplinkTransport and DownlinkTransport, and can't be used to eg. send NAS on other types of messages like the one in this test. It also creates problems in DL messages containing multiple NAS messages (eg. creating multiple bearers).
The more I look into it, the more I think the NAS state should be kept in the ConnHdlr of the test and operate on it directly.
--
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3
Gerrit-Change-Number: 43214
Gerrit-PatchSet: 2
Gerrit-Owner: pespin <pespin(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-CC: laforge <laforge(a)osmocom.org>
Gerrit-CC: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: laforge <laforge(a)osmocom.org>
Gerrit-Comment-Date: Thu, 13 Aug 2026 07:59:07 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: laforge <laforge(a)osmocom.org>