August 2026 - gerrit-log - lists.osmocom.org

[XS] Change in libosmocore[master]: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder
by laforge 13 Aug '26

13 Aug '26

laforge has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email ) Change subject: gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder ...................................................................... gsm/cbsp: stack OOB read in the CBSP WRITE-REPLACE decoder cbsp_dec_write_repl() then takes the 8-bit page count straight off the wire and uses it as the bound over an array of 16 entries, overflowing the array on the heap. Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737 --- M src/gsm/cbsp.c 1 file changed, 3 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/15/43215/1 diff --git a/src/gsm/cbsp.c b/src/gsm/cbsp.c index a5e58f4..7532ca9 100644 --- a/src/gsm/cbsp.c +++ b/src/gsm/cbsp.c @@ -684,8 +684,10 @@ out->u.cbs.num_bcast_req = tlvp_val16be(tp, CBSP_IEI_NUM_BCAST_REQ); out->u.cbs.dcs = *TLVP_VAL(tp, CBSP_IEI_DCS); num_of_pages = *TLVP_VAL(tp, CBSP_IEI_NUM_OF_PAGES); - if (num_of_pages < 1) + if (num_of_pages < 1 || num_of_pages > ARRAY_SIZE(tp)) { + osmo_cbsp_errstr = "invalid number of pages"; return -EINVAL; + } /* parse pages */ for (i = 0; i < num_of_pages; i++) { const uint8_t *ie = TLVP_VAL(&tp[i], CBSP_IEI_MSG_CONTENT); -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43215?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Ifd3d2c65722fbc124c48b860f060077e539d2737 Gerrit-Change-Number: 43215 Gerrit-PatchSet: 1 Gerrit-Owner: laforge <laforge(a)osmocom.org>

1 0

[XS] Change in simtrace2[master]: cosmetic: fix typo in comment
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: lynxis lazus. laforge has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/simtrace2/+/43141?usp=email ) Change subject: cosmetic: fix typo in comment ...................................................................... Patch Set 4: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/simtrace2/+/43141?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: simtrace2 Gerrit-Branch: master Gerrit-Change-Id: I9647fd799839e1d7aa7ab9c118a2e51455536ce4 Gerrit-Change-Number: 43141 Gerrit-PatchSet: 4 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Wed, 12 Aug 2026 19:15:58 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ttcn3-hacks[master]: mme: Fix NG NAS ul_count not incremented
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43213?usp=email ) Change subject: mme: Fix NG NAS ul_count not incremented ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43213?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Idace7ad5c832cbfa48696de69e604eb4bd411980 Gerrit-Change-Number: 43213 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Wed, 12 Aug 2026 19:15:19 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ttcn3-hacks[master]: 5gc: Fix NG NAS ul_count not incremented
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43212?usp=email ) Change subject: 5gc: Fix NG NAS ul_count not incremented ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43212?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I7ea4460c902a5f612243e155a484acc89acd447f Gerrit-Change-Number: 43212 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Wed, 12 Aug 2026 19:15:08 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ttcn3-hacks[master]: 5gc: TC_ng_register_ping46_256: Increase Tguard
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: fixeria, jolly, osmith, pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43211?usp=email ) Change subject: 5gc: TC_ng_register_ping46_256: Increase Tguard ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43211?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I312f132094707a39b2980529cf363af4b172e66a Gerrit-Change-Number: 43211 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Wed, 12 Aug 2026 19:14:45 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[M] Change in osmo-ttcn3-hacks[master]: 5gc: keep NUS after UeContextRelease
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: pespin. laforge has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email ) Change subject: 5gc: keep NUS after UeContextRelease ...................................................................... Patch Set 2: (1 comment) Patchset: PS2: Isn't there some more automatic way how we can unburden the test cases from manually managing the nus copy? -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3 Gerrit-Change-Number: 43214 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Wed, 12 Aug 2026 19:14:37 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[M] Change in osmo-ttcn3-hacks[master]: 5gc: keep NUS after UeContextRelease
by pespin 13 Aug '26

13 Aug '26

pespin has uploaded a new patch set (#2). ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email ) Change subject: 5gc: keep NUS after UeContextRelease ...................................................................... 5gc: keep NUS after UeContextRelease Since open5gs.git b9823196b5de3394b7a144569f186d7d62fad6f9, open5gs properly validates received seq_nr (ul_count) of integrity protected NG-NAS message to make sure it increases with each new UL message, in order to protect against accepting replayed messages. This means that tests going over UeContextRelease procedure need to keep a copy of the NUS (NAS state) because the UeContextreleaseCommand erases the NGAP entry in the NGAP_Emulation table, together with the associated NUS. We need the copy of NUS because we need to keep reusing the NAS state, increasing the previous ul_count. This fixes tests TC_ue_service_request_cm_* as well as TC_net_triggered_service_req. Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3 --- M 5gc/C5G_Tests.ttcn M 5gc/ConnHdlr.ttcn M library/NGAP_Emulation.ttcn 3 files changed, 81 insertions(+), 28 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/14/43214/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3 Gerrit-Change-Number: 43214 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-CC: Jenkins Builder

1 0

[M] Change in osmo-ttcn3-hacks[master]: WIP: 5gc TODO
by pespin 13 Aug '26

13 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email ) Change subject: WIP: 5gc TODO ...................................................................... WIP: 5gc TODO Since open5gs.git b9823196b5de3394b7a144569f186d7d62fad6f9, open5gs properly validates received seq_nr (ul_count) of integrity protected NG-NAS message to make sure it increases with each new UL message, in order to protect against accepting replayed messages. This means that tests going over UeContextRelease procedure need to keep a copy of the NUS (NAS state) because the UeContextreleaseCommand erases the NGAP entry in the NGAP_Emulation table, together with the associated NUS. We need the copy of NUS because we need to keep reusing the NAS state, increasing the previous ul_count. This fixes tests TC_ue_service_request_cm_* as well as TC_net_triggered_service_req. Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3 --- M 5gc/C5G_Tests.ttcn M 5gc/ConnHdlr.ttcn M library/NGAP_Emulation.ttcn 3 files changed, 81 insertions(+), 28 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/14/43214/1 diff --git a/5gc/C5G_Tests.ttcn b/5gc/C5G_Tests.ttcn index 2be26ff..0edd792 100644 --- a/5gc/C5G_Tests.ttcn +++ b/5gc/C5G_Tests.ttcn @@ -576,13 +576,19 @@ * UE signals the active session as active, and it has UL data for it */ private function f_TC_ue_service_request_cm_idle_ul_data() runs on ConnHdlr { var PDU_SessionStatus pdu_session_status; + var NG_NAS_UE_State nus; f_register(); f_pdu_sess_establish(configure_userplane := false); f_sleep(1.0); + /* UECtx State in NGAP_Emulation will be destroyed upon rx of NGAP UeContextReleaseCmd. + * We need to store the NAS state here and feed it back to NGAP_Emulation so it is available for InitialUE(Service Request), + * since the NAS state is still the same one and needs to be used. */ + nus := f_ngap_obtain_nus(g_pars.ue_pars.ran_id); f_ue_context_release(); f_sleep(1.0); pdu_session_status := f_PDU_SessionStatus(); + f_ngap_set_nus(g_pars.ue_pars.ran_id, nus, create_nonexist := true); f_service_request_cm_idle(ul_data_status := pdu_session_status, pdu_sess_status := pdu_session_status); @@ -606,12 +612,18 @@ * UE signals that the active session is now inactive. AMF sends a PFCP Session Delete to SMF. */ private function f_TC_ue_service_request_cm_idle_inact_sess() runs on ConnHdlr { var NGAP_PDU rx_ngap; + var NG_NAS_UE_State nus; f_register(); f_pdu_sess_establish(configure_userplane := false); f_sleep(1.0); + /* UECtx State in NGAP_Emulation will be destroyed upon rx of NGAP UeContextReleaseCmd. + * We need to store the NAS state here and feed it back to NGAP_Emulation so it is available for InitialUE(Service Request), + * since the NAS state is still the same one and needs to be used. */ + nus := f_ngap_obtain_nus(g_pars.ue_pars.ran_id); f_ue_context_release(); f_sleep(1.0); + f_ngap_set_nus(g_pars.ue_pars.ran_id, nus, create_nonexist := true); f_service_request_cm_idle(pdu_sess_status := cs_PDU_SessionStatus('00000000'B, '00000000'B)); NGAP.receive(cr_NG_SERVICE_ACCEPT(p_PDU_SessionStatus := cr_PDU_SessionStatus('00000000'B, '00000000'B))); g_pars.ue_pars.amf_id := f_ngap_obtain_amf_id(); @@ -630,10 +642,17 @@ /* 3GPP TS 23.502 4.2.3.2 UE Triggered Service Request. * UE signals that a session unknown to network is active: */ private function f_TC_ue_service_request_cm_idle_unknown_sess_active() runs on ConnHdlr { + var NG_NAS_UE_State nus; + f_register(); f_sleep(1.0); + /* UECtx State in NGAP_Emulation will be destroyed upon rx of NGAP UeContextReleaseCmd. + * We need to store the NAS state here and feed it back to NGAP_Emulation so it is available for InitialUE(Service Request), + * since the NAS state is still the same one and needs to be used. */ + nus := f_ngap_obtain_nus(g_pars.ue_pars.ran_id); f_ue_context_release(); f_sleep(1.0); + f_ngap_set_nus(g_pars.ue_pars.ran_id, nus, create_nonexist := true); f_service_request_cm_idle(pdu_sess_status := cs_PDU_SessionStatus('00000010'B, '00000000'B)); NGAP.receive(cr_NG_SERVICE_ACCEPT(p_PDU_SessionStatus := cr_PDU_SessionStatus('00000000'B, '00000000'B))); g_pars.ue_pars.amf_id := f_ngap_obtain_amf_id(); @@ -674,13 +693,19 @@ /* 3GPP TS 23.502 4.2.3.3 Network Triggered Service Request */ private function f_TC_net_triggered_service_req() runs on ConnHdlr { var PDU_SessionStatus pdu_session_status; + var NG_NAS_UE_State nus; f_register(); f_pdu_sess_establish(); f_sleep(1.0); + /* UECtx State in NGAP_Emulation will be destroyed upon rx of NGAP UeContextReleaseCmd. + * We need to store the NAS state here and feed it back to NGAP_Emulation so it is available for InitialUE(Service Request), + * since the NAS state is still the same one and needs to be used. */ + nus := f_ngap_obtain_nus(g_pars.ue_pars.ran_id); f_ue_context_release(); f_sleep(1.0); f_create_ngap_expect_proc(id_Paging, self); + f_ngap_set_nus(g_pars.ue_pars.ran_id, nus, create_nonexist := true); /* NOTE: In theory we should generate DL-originated traffic here, but since * UPF let our UL traffic pass (bug?), make use of it to generate some DL diff --git a/5gc/ConnHdlr.ttcn b/5gc/ConnHdlr.ttcn index 8f5e5c5..80679ec 100644 --- a/5gc/ConnHdlr.ttcn +++ b/5gc/ConnHdlr.ttcn @@ -879,6 +879,34 @@ NGAP.send(nas_ul_msg); } +private function f_encode_nas(NG_NAS_UL_Message_Type nas_ul_msg) runs on ConnHdlr return NAS_PDU { + var NAS_PDU nas_pdu; + var NG_NAS_UE_State nus; + var BIT4 sec_hdr_t := '0001'B; + var OCT1 seq_nr; + var OCT4 mac; + var NG_NAS_UL_Message_Type nas_out; + + nus := f_ngap_obtain_nus(g_pars.ue_pars.ran_id); + + nus.tx_count := nus.tx_count + 1; + seq_nr := int2oct(nus.tx_count, 1); + nas_pdu := enc_NG_NAS_UL_Message_Type(valueof(nas_ul_msg)); + mac := f_NG_NAS_mac_calc(NG_NAS_ALG_IP_NIA1, f_kdf_ng_nas_int(g_keys.kamf, NG_NAS_ALG_IP_NIA1), + nus.tx_count, + bit2int(tsc_NG_RegResult_3GPP), + false, seq_nr & nas_pdu); + nas_out := valueof(cs_NG_SECURITY_PROTECTED_NAS_MESSAGE(tsc_EPD_GMM, + sec_hdr_t, + mac, + seq_nr, + nas_pdu)); + nas_pdu := enc_NG_NAS_UL_Message_Type(valueof(nas_out)); + + f_ngap_set_nus(g_pars.ue_pars.ran_id, nus); + return nas_pdu; +} + /* 3GPP TS 24.501 5.6.1 Service request procedure * 3GPP TS 23.502 4.2.3.2 UE Triggered Service Request */ function f_service_request_cm_idle(template (omit) ULDataStatus ul_data_status := omit, @@ -898,21 +926,8 @@ f_NG_MobileIdentity_STMSI(), p_Msg := cs_ReplayedNASMessageContainerTLV(nas_pdu)); - //TODO: add a function to send a NAS_UL_MSG and receive the encoded one. - var BIT4 sec_hdr_t := '0001'B; - var integer tx_count := 0; - nas_pdu := enc_NG_NAS_UL_Message_Type(valueof(nas_ul_msg)); - var OCT4 mac := f_NG_NAS_mac_calc(NG_NAS_ALG_IP_NIA1, f_kdf_ng_nas_int(g_keys.kamf, NG_NAS_ALG_IP_NIA1), - tx_count, - bit2int(tsc_NG_RegResult_3GPP), - false, '00'O & nas_pdu); - var NG_NAS_UL_Message_Type nas_out; - nas_out := valueof(cs_NG_SECURITY_PROTECTED_NAS_MESSAGE(tsc_EPD_GMM, - sec_hdr_t, - mac, - int2oct(tx_count, 1), - nas_pdu)); - nas_pdu := enc_NG_NAS_UL_Message_Type(valueof(nas_out)); + nas_pdu := f_encode_nas(valueof(nas_ul_msg)); + tx_pdu := m_ngap_initMsg(m_n2_initialUeMessage(g_pars.ue_pars.ran_id, nas_pdu, /* Service request */ f_ULI(), @@ -995,7 +1010,7 @@ /* 3GPP TS 38.413 8.3.2 UE Context Release Request (NG-RAN node initiated), * 3GPP TS 23.502 4.2.6 AN Release */ -function f_ue_context_release(template (value) Cause cause := m_cause_radioNetwork(unspecified)) runs on ConnHdlr { +function f_ue_context_release(template (value) Cause cause := m_cause_radioNetwork(unspecified)) runs on ConnHdlr { var template (value) NGAP_PDU tx_pdu; if (ispresent(g_pars.ue_pars.sess_pars.cn_gtpu_teid)) { diff --git a/library/NGAP_Emulation.ttcn b/library/NGAP_Emulation.ttcn index ea23a35..ba2b7d2 100644 --- a/library/NGAP_Emulation.ttcn +++ b/library/NGAP_Emulation.ttcn @@ -118,7 +118,7 @@ signature NGAPEM_register_proc(in integer procedureCode, in NGAP_ConnHdlr hdlr); signature NGAPEM_obtain_amf_id() return AMF_UE_NGAP_ID; signature NGAPEM_obtain_nus(in RAN_UE_NGAP_ID ran_id) return NG_NAS_UE_State; -signature NGAPEM_set_nus(in RAN_UE_NGAP_ID ran_id, in NG_NAS_UE_State nus); +signature NGAPEM_set_nus(in RAN_UE_NGAP_ID ran_id, in NG_NAS_UE_State nus, in boolean create_nonexist); //signature NGAPEM_derive_nas_token(in octetstring kasme, in NGAP_ConnHdlr hdlr, out OCT32 nas_token); type port NGAPEM_PROC_PT procedure { @@ -304,7 +304,7 @@ return -1; /* make ttcn3 compiler happy */ } -private function f_assoc_id_by_comp(NGAP_ConnHdlr client, template (omit) RAN_UE_NGAP_ID ran_id := omit) +private function f_assoc_id_by_comp(NGAP_ConnHdlr client, template (omit) RAN_UE_NGAP_ID ran_id := omit, boolean fail_notfound := true) runs on NGAP_Emulation_CT return integer { var integer i; for (i := 0; i < sizeof(NGapAssociationTable); i := i+1) { @@ -317,8 +317,11 @@ } return i; } - setverdict(fail, "NGAP Association Table not found by component ", client, " RAN-ID=", ran_id); - mtc.stop; + if (fail_notfound) { + setverdict(fail, "NGAP Association Table not found by component ", client, " RAN-ID=", ran_id); + mtc.stop; + } + return -1; } private function f_assoc_by_comp(NGAP_ConnHdlr client) @@ -531,6 +534,7 @@ var integer ai; var octetstring kasme; var NG_NAS_UE_State nus; + var boolean create_nonexist; alt { /* Configuration primitive from client */ @@ -561,8 +565,14 @@ } /* NGAP from client: InitialUE */ [] NGAP_CLIENT.receive(mw_ngap_initMsg(mw_n2_initialUeMessage)) -> value msg sender vc_conn { - /* create a table entry about this connection */ - ai := f_ngap_id_table_add(vc_conn, omit, valueof(f_NGAP_get_RAN_UE_NGAP_ID(msg))); + /* create a table entry about this connection if not yet existing. */ + ran_id := valueof(f_NGAP_get_RAN_UE_NGAP_ID(msg)); + ai := f_assoc_id_by_comp(vc_conn, ran_id, fail_notfound := false); + if (ai >= 0) { + NGapAssociationTable[ai].amf_ue_ngap_id := omit; + } else { + ai := f_ngap_id_table_add(vc_conn, omit, ran_id); + } /* Store ULI so we can use it for generating UlNasTransport from NAS */ NGapAssociationTable[ai].uli := msg.initiatingMessage.value_.InitialUEMessage.protocolIEs[2].value_.userLocationInformation; /* Pass message through */ @@ -692,10 +702,13 @@ var integer i := f_assoc_id_by_comp(vc_conn, ran_id); NGAP_PROC.reply(NGAPEM_obtain_nus:{ran_id} value NGapAssociationTable[i].nus) to vc_conn; } - [] NGAP_PROC.getcall(NGAPEM_set_nus:{?, ?}) -> param(ran_id, nus) sender vc_conn { - var integer i := f_assoc_id_by_comp(vc_conn, ran_id); + [] NGAP_PROC.getcall(NGAPEM_set_nus:{?, ?, ?}) -> param(ran_id, nus, create_nonexist) sender vc_conn { + var integer i := f_assoc_id_by_comp(vc_conn, ran_id, fail_notfound := not create_nonexist); + if (i < 0) { + i := f_ngap_id_table_add(vc_conn, omit, ran_id); + } NGapAssociationTable[i].nus := nus; - NGAP_PROC.reply(NGAPEM_set_nus:{ran_id, nus}) to vc_conn; + NGAP_PROC.reply(NGAPEM_set_nus:{ran_id, nus, create_nonexist}) to vc_conn; } // [] NGAP_PROC.getcall(NGAPEM_derive_nas_token:{?, ?, -}) -> param(kasme, vc_conn) { // var integer assoc_id := f_assoc_id_by_comp(vc_conn); @@ -815,9 +828,9 @@ } } -function f_ngap_set_nus(RAN_UE_NGAP_ID ran_id, NG_NAS_UE_State nus) runs on NGAP_ConnHdlr { - NGAP_PROC.call(NGAPEM_set_nus:{ran_id, nus}) { - [] NGAP_PROC.getreply(NGAPEM_set_nus:{ran_id, nus}); +function f_ngap_set_nus(RAN_UE_NGAP_ID ran_id, NG_NAS_UE_State nus, boolean create_nonexist := false) runs on NGAP_ConnHdlr { + NGAP_PROC.call(NGAPEM_set_nus:{ran_id, nus, create_nonexist}) { + [] NGAP_PROC.getreply(NGAPEM_set_nus:{ran_id, nus, create_nonexist}); } } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43214?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I84b91bf00491a1ba0c2ee8d57e61996a88fe12d3 Gerrit-Change-Number: 43214 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in simtrace2[master]: firmware: Drop CEMU_TX_DATA when emulated sim is in-active
by laforge 13 Aug '26

13 Aug '26

Attention is currently required from: lynxis lazus, pespin. laforge has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/simtrace2/+/43003?usp=email ) Change subject: firmware: Drop CEMU_TX_DATA when emulated sim is in-active ...................................................................... Patch Set 7: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/simtrace2/+/43003?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: simtrace2 Gerrit-Branch: master Gerrit-Change-Id: I796e548225a742cddfde12bd6a60e4d2e5c04c8f Gerrit-Change-Number: 43003 Gerrit-PatchSet: 7 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Wed, 12 Aug 2026 16:35:23 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ttcn3-hacks[master]: mme: Fix NG NAS ul_count not incremented
by pespin 13 Aug '26

13 Aug '26

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43213?usp=email ) Change subject: mme: Fix NG NAS ul_count not incremented ...................................................................... mme: Fix NG NAS ul_count not incremented Since open5gs.git b9823196b5de3394b7a144569f186d7d62fad6f9, open5gs properly validates received seq_nr (ul_count) of integrity protected 4G NAS message to make sure it increases with each new UL message, in order to protect against accepting replayed messages. This made the mme testsuite fail since our S1AP/4G-NAS emulation was not properly increasing ul_count when sending new messages, but always using ul_count=0. Change-Id: Idace7ad5c832cbfa48696de69e604eb4bd411980 --- M library/LTE_CryptoFunctions.ttcn 1 file changed, 9 insertions(+), 5 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/13/43213/1 diff --git a/library/LTE_CryptoFunctions.ttcn b/library/LTE_CryptoFunctions.ttcn index 882861b..954e085 100644 --- a/library/LTE_CryptoFunctions.ttcn +++ b/library/LTE_CryptoFunctions.ttcn @@ -247,13 +247,16 @@ { var BIT4 sec_hdr_t; var PDU_NAS_EPS nas_out; - - if (nus.use_enc == false and nus.use_int == false) { - return nas_in; - } + var OCT1 seq_nr; if (nus.new_ctx) { nus.tx_count := 0; + } else { + nus.tx_count := nus.tx_count + 1; + } + + if (nus.use_enc == false and nus.use_int == false) { + return nas_in; } var octetstring nas_enc := enc_PDU_NAS_EPS(nas_in); @@ -262,11 +265,12 @@ f_tx_is_downlink(nus), nas_enc); } + seq_nr := int2oct(nus.tx_count mod 256, 1); sec_hdr_t := f_nas_determine_sec_hdr_t(nus.use_enc, nus.use_int, nus.new_ctx); nas_out := valueof(ts_NAS_EMM_SecurityProtected(sec_hdr_t, nus.tx_count, nas_enc)); if (nus.use_int) { var OCT4 mac := f_nas_mac_calc(nus.alg_int, nus.k_nas_int, nus.tx_count, 0, - f_tx_is_downlink(nus), '00'O & nas_enc); + f_tx_is_downlink(nus), seq_nr & nas_enc); nas_out.ePS_messages.ePS_MobilityManagement.pDU_NAS_EPS_SecurityProtectedNASMessage.messageAuthenticationCode := mac; } return nas_out; -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43213?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Idace7ad5c832cbfa48696de69e604eb4bd411980 Gerrit-Change-Number: 43213 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log August 2026