- gerrit-log - lists.osmocom.org

[M] Change in libosmo-sigtran[master]: TCAP: Refactoring unroutable messages into own function
by lynxis lazus 08 Aug '26

08 Aug '26

Attention is currently required from: daniel, laforge, pespin. lynxis lazus has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007?usp=email ) Change subject: TCAP: Refactoring unroutable messages into own function ...................................................................... Patch Set 2: (4 comments) File src/tcap_as_loadshare.c: https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007/comment/87db6544_c09cc… : PS2, Line 458: the message will be paths. > what do you mean by "the message will be paths"? I don't understand what this is supposed to say. Done https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007/comment/445464c7_6fc8e… : PS2, Line 466: static int asp_loadshare_tcap_unroutable(struct osmo_ss7_asp **rasp, > asp_loadshare_tcap_unroutable_fallback() may be more descriptive. […] fallback will be used by the DPC routing. I've renamed it to asp_loadshare_tcap_handle_unroutable https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007/comment/c03bd5cf_e5413… : PS2, Line 608: rate_ctr_inc2(as->ctrg, SS7_AS_CTR_TCAP_ASP_FALLBACK); > AFAIU this patch could be reduce to only adding the following line here: […] no, because you also have to set the rc code. In general this function needs to be refactored. it is far to long and complex. I've refactored some of the parts. But still this function would need a refactoring https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007/comment/9aa931d1_c8ed9… : PS2, Line 636: rate_ctr_inc2(as->ctrg, SS7_AS_CTR_TCAP_ASP_FALLBACK); > AFAIU this patch could be reduce to only adding the following line here: […] see above. -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43007?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ib4d114273423730418458767d17b11de9bd815d4 Gerrit-Change-Number: 43007 Gerrit-PatchSet: 2 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: laforge <laforge(a)osmocom.org> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: daniel <dwillmann(a)sysmocom.de> Gerrit-Comment-Date: Sat, 08 Aug 2026 12:33:48 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: laforge <laforge(a)osmocom.org> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in ...osmo_dia2gsup[master]: Set Item-Number in UTRAN and GERAN vectors.
by lynxis lazus 08 Aug '26

08 Aug '26

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/erlang/osmo_dia2gsup/+/43092?usp=email ) Change subject: Set Item-Number in UTRAN and GERAN vectors. ...................................................................... Set Item-Number in UTRAN and GERAN vectors. For some reason this field was only being set on E-UTRAN vectors, even though its required for all vectors. Change-Id: I75da04b806f23452c9b4cfaad0446dceb32a0369 --- M src/server_cb.erl 1 file changed, 22 insertions(+), 8 deletions(-) Approvals: lynxis lazus: Looks good to me, approved Jenkins Builder: Verified fixeria: Looks good to me, but someone else must approve diff --git a/src/server_cb.erl b/src/server_cb.erl index f51bb5c..1606085 100644 --- a/src/server_cb.erl +++ b/src/server_cb.erl @@ -74,13 +74,13 @@ #'E-UTRAN-Vector'{'Item-Number'=Idx, 'RAND'=Rand, 'XRES'=Res , 'AUTN'=Autn, 'KASME'=compute_kasme(Ck, Ik, Vplmn, Autn)}. --spec gsup_tuple2dia_utran('GSUPAuthTuple'()) -> #'UTRAN-Vector'{}. -gsup_tuple2dia_utran(#{autn:=Autn, ck:=Ck, ik:=Ik, rand:=Rand, res:=Res}) -> - #'UTRAN-Vector'{'RAND'=Rand, 'XRES'=Res, 'AUTN'=Autn, 'Confidentiality-Key'=Ck, 'Integrity-Key'=Ik}. +-spec gsup_tuple2dia_utran('GSUPAuthTuple'(), integer()) -> #'UTRAN-Vector'{}. +gsup_tuple2dia_utran(#{autn:=Autn, ck:=Ck, ik:=Ik, rand:=Rand, res:=Res}, Idx) -> + #'UTRAN-Vector'{'Item-Number'=Idx, 'RAND'=Rand, 'XRES'=Res, 'AUTN'=Autn, 'Confidentiality-Key'=Ck, 'Integrity-Key'=Ik}. --spec gsup_tuple2dia_geran('GSUPAuthTuple'()) -> #'GERAN-Vector'{}. -gsup_tuple2dia_geran(#{rand:=Rand, sres:=Sres, kc:=Kc}) -> - #'GERAN-Vector'{'RAND'=Rand, 'SRES'=Sres, 'Kc'=Kc}. +-spec gsup_tuple2dia_geran('GSUPAuthTuple'(), integer()) -> #'GERAN-Vector'{}. +gsup_tuple2dia_geran(#{rand:=Rand, sres:=Sres, kc:=Kc}, Idx) -> + #'GERAN-Vector'{'Item-Number'=Idx, 'RAND'=Rand, 'SRES'=Sres, 'Kc'=Kc}. -spec gsup_tuples2dia_eutran(['GSUPAuthTuple'()], binary()) -> [#'E-UTRAN-Vector'{}]. gsup_tuples2dia_eutran(List, Vplmn) -> gsup_tuples2dia_eutran(List, Vplmn, [], 1). @@ -89,6 +89,20 @@ Dia = gsup_tuple2dia_eutran(Head, Vplmn, Ctr), gsup_tuples2dia_eutran(Tail, Vplmn, [Dia|Out], Ctr+1). +-spec gsup_tuples2dia_utran(['GSUPAuthTuple'()]) -> [#'UTRAN-Vector'{}]. +gsup_tuples2dia_utran(List) -> gsup_tuples2dia_utran(List, [], 1). +gsup_tuples2dia_utran([], Out, _Idx) -> Out; +gsup_tuples2dia_utran([Head|Tail], Out, Ctr) -> + Dia = gsup_tuple2dia_utran(Head, Ctr), + gsup_tuples2dia_utran(Tail, [Dia|Out], Ctr+1). + +-spec gsup_tuples2dia_geran(['GSUPAuthTuple'()]) -> [#'GERAN-Vector'{}]. +gsup_tuples2dia_geran(List) -> gsup_tuples2dia_geran(List, [], 1). +gsup_tuples2dia_geran([], Out, _Idx) -> Out; +gsup_tuples2dia_geran([Head|Tail], Out, Ctr) -> + Dia = gsup_tuple2dia_geran(Head, Ctr), + gsup_tuples2dia_geran(Tail, [Dia|Out], Ctr+1). + -type int_or_false() :: false | integer(). -spec gsup_tuples2dia(['GSUPAuthTuple'()], binary(), int_or_false(), int_or_false(), int_or_false()) -> #'Authentication-Info'{}. gsup_tuples2dia(Tuples, Vplmn, NumEutran, NumUtran, NumGeran) -> @@ -100,12 +114,12 @@ case NumUtran of false -> UtranVecs = []; 0 -> UtranVecs = []; - _ -> UtranVecs = lists:map(fun gsup_tuple2dia_utran/1, lists:sublist(Tuples,NumUtran)) + _ -> UtranVecs = gsup_tuples2dia_utran(lists:sublist(Tuples,NumUtran)) end, case NumGeran of false -> GeranVecs = []; 0 -> GeranVecs = []; - _ -> GeranVecs = lists:map(fun gsup_tuple2dia_geran/1, lists:sublist(Tuples,NumGeran)) + _ -> GeranVecs = gsup_tuples2dia_geran(lists:sublist(Tuples,NumGeran)) end, #'Authentication-Info'{'E-UTRAN-Vector'=EutranVecs, 'UTRAN-Vector'=UtranVecs, 'GERAN-Vector'=GeranVecs}. -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo_dia2gsup/+/43092?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: erlang/osmo_dia2gsup Gerrit-Branch: master Gerrit-Change-Id: I75da04b806f23452c9b4cfaad0446dceb32a0369 Gerrit-Change-Number: 43092 Gerrit-PatchSet: 2 Gerrit-Owner: theenbyperor <q(a)magicalcodewit.ch> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu>

1 0

[S] Change in ...osmo_dia2gsup[master]: Set Item-Number in UTRAN and GERAN vectors.
by lynxis lazus 08 Aug '26

08 Aug '26

Attention is currently required from: theenbyperor. lynxis lazus has posted comments on this change by theenbyperor. ( https://gerrit.osmocom.org/c/erlang/osmo_dia2gsup/+/43092?usp=email ) Change subject: Set Item-Number in UTRAN and GERAN vectors. ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo_dia2gsup/+/43092?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: erlang/osmo_dia2gsup Gerrit-Branch: master Gerrit-Change-Id: I75da04b806f23452c9b4cfaad0446dceb32a0369 Gerrit-Change-Number: 43092 Gerrit-PatchSet: 2 Gerrit-Owner: theenbyperor <q(a)magicalcodewit.ch> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: theenbyperor <q(a)magicalcodewit.ch> Gerrit-Comment-Date: Sat, 08 Aug 2026 10:46:41 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-bsc[master]: ipaccess-proxy: reject short IPA header
by n0k0 07 Aug '26

07 Aug '26

n0k0 has uploaded a new patch set (#2). ( https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email ) Change subject: ipaccess-proxy: reject short IPA header ...................................................................... ipaccess-proxy: reject short IPA header recv() of the 3-byte IPA header can return fewer than 3 bytes on a stream socket. ipaccess_proxy_read_msg() only handles ret < 0 and ret == 0, so a short read falls through: msgb_put() advances msg->tail by 'ret' while msg->l2h is set to msg->data + sizeof(*hh). The frame length is then validated against msgb_tailroom() (measured from msg->tail), so the subsequent body recv() into msg->l2h can write up to sizeof(*hh) - ret bytes past the msgb. Reject a short header, the same way handle_udp_read() already does. Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 10 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/88/43188/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b Gerrit-Change-Number: 43188 Gerrit-PatchSet: 2 Gerrit-Owner: n0k0 <osmocom(a)hacky.software>

1 0

[S] Change in osmo-bsc[master]: ipaccess-proxy: reject short IPA header in ipaccess_proxy_read_msg
by n0k0 07 Aug '26

07 Aug '26

n0k0 has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email ) Change subject: ipaccess-proxy: reject short IPA header in ipaccess_proxy_read_msg ...................................................................... ipaccess-proxy: reject short IPA header in ipaccess_proxy_read_msg recv() of the 3-byte IPA header can return fewer than 3 bytes on a stream socket. ipaccess_proxy_read_msg() only handles ret < 0 and ret == 0, so a short read falls through: msgb_put() advances msg->tail by 'ret' while msg->l2h is set to msg->data + sizeof(*hh). The frame length is then validated against msgb_tailroom() (measured from msg->tail), so the subsequent body recv() into msg->l2h can write up to sizeof(*hh) - ret bytes past the msgb. Reject a short header, the same way handle_udp_read() already does. Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 10 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/88/43188/1 diff --git a/src/ipaccess/ipaccess-proxy.c b/src/ipaccess/ipaccess-proxy.c index 71190f6..b1c500c 100644 --- a/src/ipaccess/ipaccess-proxy.c +++ b/src/ipaccess/ipaccess-proxy.c @@ -576,6 +576,16 @@ msgb_free(msg); *error = ret; return NULL; + } else if (ret < sizeof(*hh)) { + /* A short (split) IPA header would leave msg->l2h (msg->data + + * sizeof(*hh)) ahead of msg->tail, while the frame length below is + * validated against msgb_tailroom() measured from msg->tail; the + * body recv() could then write up to sizeof(*hh) - ret bytes past + * the buffer. Reject it, like the other IPA read paths do. */ + LOGP(DLINP, LOGL_ERROR, "short read of IPA header (%d)\n", ret); + msgb_free(msg); + *error = -EIO; + return NULL; } msgb_put(msg, ret); -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/43188?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I3043cccd110db19984f47916c269a4c59f82b08b Gerrit-Change-Number: 43188 Gerrit-PatchSet: 1 Gerrit-Owner: n0k0 <osmocom(a)hacky.software>

1 0

[XS] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by n0k0 07 Aug '26

07 Aug '26

Attention is currently required from: fixeria, n0k0. Hello Jenkins Builder, fixeria, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email to look at the new patch set (#5). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... ipaccess-proxy: reject oversized IPA frame length ipaccess_proxy_read_msg() reads the 16-bit IPA frame length from the wire header and passes it straight as the recv() count into a msgb that was allocated with a fixed PROXY_ALLOC_SIZE (1200) bytes, without ever checking it against the buffer tailroom. A peer that advertises a body length larger than the remaining buffer space makes recv() write past the end of the heap allocation (heap buffer overflow). Reject frames whose advertised length exceeds the msgb tailroom, the same way the other IPA read paths bound the read to msgb_tailroom(). This issue has been assigned the CVE candidate identifier CAN-2026-2051036. Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f --- M src/ipaccess/ipaccess-proxy.c 1 file changed, 6 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-bsc refs/changes/86/42886/5 -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 5 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[XS] Change in libasn1c[master]: constr_CHOICE: fix always-true bounds check
by pespin 07 Aug '26

07 Aug '26

Attention is currently required from: n0k0. pespin has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email ) Change subject: constr_CHOICE: fix always-true bounds check ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/libasn1c/+/42890?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libasn1c Gerrit-Branch: master Gerrit-Change-Id: I25e414729f314505bce50bd8107d61bb1e3a44bf Gerrit-Change-Number: 42890 Gerrit-PatchSet: 3 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Fri, 07 Aug 2026 20:55:09 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-ggsn[master]: gtp: clamp GSN-Address copy to sockaddr_in size
by pespin 07 Aug '26

07 Aug '26

Attention is currently required from: n0k0. pespin has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-ggsn/+/43187?usp=email ) Change subject: gtp: clamp GSN-Address copy to sockaddr_in size ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ggsn/+/43187?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ggsn Gerrit-Branch: master Gerrit-Change-Id: If49f1929645c0ba8d19f3c9aa95f57d0a432ad53 Gerrit-Change-Number: 43187 Gerrit-PatchSet: 1 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Comment-Date: Fri, 07 Aug 2026 20:53:32 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-hlr[master]: mslookup: fix size_t underflow in mDNS decode
by pespin 07 Aug '26

07 Aug '26

Attention is currently required from: fixeria, n0k0. pespin has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email ) Change subject: mslookup: fix size_t underflow in mDNS decode ...................................................................... Patch Set 4: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-hlr/+/42888?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-hlr Gerrit-Branch: master Gerrit-Change-Id: I1bf5bade953217b1a998f91679711a6170a886a8 Gerrit-Change-Number: 42888 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 20:51:46 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[S] Change in osmo-bsc[master]: ipaccess-proxy: reject oversized IPA frame length
by pespin 07 Aug '26

07 Aug '26

Attention is currently required from: fixeria, n0k0. pespin has posted comments on this change by n0k0. ( https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email ) Change subject: ipaccess-proxy: reject oversized IPA frame length ...................................................................... Patch Set 4: (1 comment) Patchset: PS4: Please actually break this into 2 patches, you added an unrelated problem/change in the new version. -- To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/42886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-bsc Gerrit-Branch: master Gerrit-Change-Id: I05137e114eaa99ff0e85eecccf7645c90945214f Gerrit-Change-Number: 42886 Gerrit-PatchSet: 4 Gerrit-Owner: n0k0 <osmocom(a)hacky.software> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: n0k0 <osmocom(a)hacky.software> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Fri, 07 Aug 2026 20:49:31 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

2026

2025

2024

2023

2022

gerrit-log