[M] Change in libosmo-sigtran[master]: xua_rkm: Validate IE lengths of RKM inner messages

25 Aug 2026

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43394?usp=email )
Change subject: xua_rkm: Validate IE lengths of RKM inner messages
......................................................................
xua_rkm: Validate IE lengths of RKM inner messages
Change-Id: Ibe7e446b1a537c0c09f8049add3460e37cdd58e8
---
M src/m3ua.c
M src/xua_internal.h
M src/xua_msg.c
M src/xua_msg.h
M src/xua_rkm.c
5 files changed, 140 insertions(+), 39 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/94/43394/1

diff --git a/src/m3ua.c b/src/m3ua.c
index d1a7e27..46282c4 100644
--- a/src/m3ua.c
+++ b/src/m3ua.c
@@ -202,14 +202,32 @@
    XUA_MSG_PART_CLASS(M3UA_IEI_ROUT_KEY, (mandatory), 0, UINT16_MAX)
#define M3UA_MSG_PART_CLASS_REG_RESULT(mandatory) \
-	XUA_MSG_PART_CLASS(M3UA_IEI_REG_RESULT, (mandatory), 0, UINT16_MAX)
+	XUA_MSG_PART_CLASS(M3UA_IEI_REG_RESULT, (mandatory), 24, UINT16_MAX)
#define M3UA_MSG_PART_CLASS_DEREG_RESULT(mandatory) \
-	XUA_MSG_PART_CLASS(M3UA_IEI_DEREG_RESULT, (mandatory), 0, UINT16_MAX)
+	XUA_MSG_PART_CLASS(M3UA_IEI_DEREG_RESULT, (mandatory), 16, UINT16_MAX)
+
+#define M3UA_MSG_PART_CLASS_LOC_RKEY_ID(mandatory) \
+	XUA_MSG_PART_CLASS_U32(M3UA_IEI_LOC_RKEY_ID, (mandatory))
+
+#define M3UA_MSG_PART_CLASS_DEST_PC(mandatory) \
+	XUA_MSG_PART_CLASS_U32(M3UA_IEI_DEST_PC, (mandatory))
+
+#define M3UA_MSG_PART_CLASS_SVC_IND(mandatory) \
+	XUA_MSG_PART_CLASS(M3UA_IEI_SVC_IND, (mandatory), 0, UINT16_MAX)
+
+#define M3UA_MSG_PART_CLASS_ORIG_PC(mandatory) \
+	XUA_MSG_PART_CLASS(M3UA_IEI_ORIG_PC, (mandatory), 0, UINT16_MAX)
#define M3UA_MSG_PART_CLASS_PROT_DATA(mandatory) \
    XUA_MSG_PART_CLASS(M3UA_IEI_PROT_DATA, (mandatory), 0, UINT16_MAX)
+#define M3UA_MSG_PART_CLASS_REG_STATUS(mandatory) \
+	XUA_MSG_PART_CLASS_U32(M3UA_IEI_REG_STATUS, (mandatory))
+
+#define M3UA_MSG_PART_CLASS_DEREG_STATUS(mandatory) \
+	XUA_MSG_PART_CLASS_U32(M3UA_IEI_DEREG_STATUS, (mandatory))
+
 /* XFER */
 static const struct xua_msg_part_class data_ies[] = {
    M3UA_MSG_PART_CLASS_NET_APPEAR(false),
@@ -452,6 +470,34 @@
    },
 };
+/* Inner RKM messages: RKM REG REQ "Routing Key" */
+const struct xua_msg_part_class m3ua_rkm_reg_req_routing_key_ies[] = {
+	M3UA_MSG_PART_CLASS_LOC_RKEY_ID(true),
+	M3UA_MSG_PART_CLASS_ROUTE_CTX1(false),
+	M3UA_MSG_PART_CLASS_TRAF_MODE_TYP(false),
+	M3UA_MSG_PART_CLASS_DEST_PC(true),
+	M3UA_MSG_PART_CLASS_NET_APPEAR(false),
+	M3UA_MSG_PART_CLASS_SVC_IND(false),
+	M3UA_MSG_PART_CLASS_ORIG_PC(false),
+	XUA_MSG_PART_CLASS_EOF
+};
+
+/* Inner RKM messages: RKM REG RSP "Registration Result" */
+const struct xua_msg_part_class m3ua_rkm_reg_rsp_registration_result_ies[] = {
+	M3UA_MSG_PART_CLASS_LOC_RKEY_ID(true),
+	M3UA_MSG_PART_CLASS_ROUTE_CTX1(true),
+	M3UA_MSG_PART_CLASS_REG_STATUS(true),
+	XUA_MSG_PART_CLASS_EOF
+};
+
+
+/* Inner RKM messages: RKM DEREG RSP "Deregistration Result" */
+const struct xua_msg_part_class m3ua_rkm_dereg_rsp_deregistration_result_ies[] = {
+	M3UA_MSG_PART_CLASS_ROUTE_CTX1(true),
+	M3UA_MSG_PART_CLASS_DEREG_STATUS(true),
+	XUA_MSG_PART_CLASS_EOF
+};
+
 /* M3UA dialect of XUA, MGMT,XFER,SNM,ASPSM,ASPTM,RKM */
 const struct xua_dialect xua_dialect_m3ua = {
    .name = "M3UA",
diff --git a/src/xua_internal.h b/src/xua_internal.h
index 5195b35..47c4974 100644
--- a/src/xua_internal.h
+++ b/src/xua_internal.h
@@ -90,6 +90,9 @@
 extern const struct xua_msg_class m3ua_msg_class_rkm;
 extern const struct xua_msg_class m3ua_msg_class_aspsm;
 extern const struct xua_msg_class m3ua_msg_class_asptm;
+extern const struct xua_msg_part_class m3ua_rkm_reg_req_routing_key_ies[];
+extern const struct xua_msg_part_class m3ua_rkm_reg_rsp_registration_result_ies[];
+extern const struct xua_msg_part_class m3ua_rkm_dereg_rsp_deregistration_result_ies[];
extern const struct value_string m3ua_snm_msgt_names[];
 extern const struct value_string m3ua_err_names[];
diff --git a/src/xua_msg.c b/src/xua_msg.c
index 44b173d..1b37c89 100644
--- a/src/xua_msg.c
+++ b/src/xua_msg.c
@@ -535,6 +535,47 @@
    return buf;
 }
+
+/* Validate incoming xua_msg. returns 0 on success, M3UA_ERR_* on failure. */
+int xua_dialect_check_all_ies_ext(const struct xua_dialect *dialect, const struct xua_msg_class *xmc,
+				  uint8_t msg_type, const struct xua_msg_part_class *ies,
+				  const struct xua_msg *xua, bool repeated_parts)
+{
+	const struct xua_msg_part_class *ie;
+
+	for (ie = ies; ie->tag; ie = ies++) {
+		struct xua_msg_part *part;
+		bool found = false;
+		llist_for_each_entry(part, &xua->headers, entry) {
+			if (part->tag != ie->tag)
+				continue;
+			found = true;
+			if (part->len < ie->len_min || part->len > ie->len_max) {
+				LOGP(dialect->log_subsys, LOGL_ERROR,
+					"%s Message %s:%s IE %s length %" PRIu16
+					" out of range [%" PRIu16 ", %" PRIu16 "]\n",
+					dialect->name, xmc->name,
+					xua_class_msg_name(xmc, msg_type),
+					xua_class_iei_name(xmc, ie->tag),
+					part->len, ie->len_min, ie->len_max);
+				return M3UA_ERR_PARAM_FIELD_ERR;
+			}
+			if (!repeated_parts)
+				break;
+		}
+		if (ie->mandatory && !found) {
+			LOGP(dialect->log_subsys, LOGL_ERROR,
+				"%s Message %s:%s should contain IE %s, but doesn't\n",
+				dialect->name, xmc->name,
+				xua_class_msg_name(xmc, msg_type),
+				xua_class_iei_name(xmc, ie->tag));
+			return M3UA_ERR_MISSING_PARAM;
+		}
+	}
+
+	return 0;
+}
+
 /* Validate incoming xua_msg. returns 0 on success, M3UA_ERR_* on failure. */
 int xua_dialect_check_all_ies(const struct xua_dialect *dialect, const struct xua_msg *xua)
 {
@@ -542,7 +583,6 @@
    uint8_t msg_type = xua->hdr.msg_type;
    const struct xua_msg_class *xmc = dialect->class[msg_class];
    const struct xua_msg_part_class *ies;
-	const struct xua_msg_part_class *ie;
/* unknown class? */
    if (!xmc)
@@ -553,32 +593,7 @@
    if (!ies)
    	return 0;
-	for (ie = ies; ie->tag; ie = ies++) {
-		struct xua_msg_part *part = xua_msg_find_tag(xua, ie->tag);
-		if (!part) {
-			if (!ie->mandatory)
-				continue;
-			LOGP(dialect->log_subsys, LOGL_ERROR,
-				"%s Message %s:%s should contain IE %s, but doesn't\n",
-				dialect->name, xmc->name,
-				xua_class_msg_name(xmc, msg_type),
-				xua_class_iei_name(xmc, ie->tag));
-			return M3UA_ERR_MISSING_PARAM;
-		}
-
-		if (part->len < ie->len_min || part->len > ie->len_max) {
-			LOGP(dialect->log_subsys, LOGL_ERROR,
-				"%s Message %s:%s IE %s length %" PRIu16
-				" out of range [%" PRIu16 ", %" PRIu16 "]\n",
-				dialect->name, xmc->name,
-				xua_class_msg_name(xmc, msg_type),
-				xua_class_iei_name(xmc, ie->tag),
-				part->len, ie->len_min, ie->len_max);
-			return M3UA_ERR_PARAM_FIELD_ERR;
-		}
-	}
-
-	return 0;
+	return xua_dialect_check_all_ies_ext(dialect, xmc, msg_type, ies, xua, false);
 }
char *xua_msg_dump(const struct xua_msg *xua, const struct xua_dialect *dialect)
diff --git a/src/xua_msg.h b/src/xua_msg.h
index 3070435..6e36a7b 100644
--- a/src/xua_msg.h
+++ b/src/xua_msg.h
@@ -126,6 +126,9 @@
 char *xua_hdr_dump(const struct xua_msg *xua, const struct xua_dialect *dialect);
 char *xua_msg_dump(const struct xua_msg *xua, const struct xua_dialect *dialect);
 int xua_dialect_check_all_ies(const struct xua_dialect *dialect, const struct xua_msg *xua);
+int xua_dialect_check_all_ies_ext(const struct xua_dialect *dialect, const struct xua_msg_class *xmc,
+				  uint8_t msg_type, const struct xua_msg_part_class *ies,
+				  const struct xua_msg *xua, bool repeated_parts);
int xua_msg_event_map(const struct xua_msg *xua,
    	      const struct xua_msg_event_map *maps,
diff --git a/src/xua_rkm.c b/src/xua_rkm.c
index 92fbdac..6f2efc2 100644
--- a/src/xua_rkm.c
+++ b/src/xua_rkm.c
@@ -349,6 +349,7 @@
    struct msgb *resp = m3ua_msgb_alloc(__func__);
    struct osmo_ss7_as *newly_assigned_as[MAX_NEW_AS];
    unsigned int i, num_newly_assigned_as = 0;
+	int rc;
memset(newly_assigned_as, 0, sizeof(newly_assigned_as));
@@ -362,7 +363,17 @@
    	inner = xua_from_nested(part);
    	if (!inner) {
    		LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Unable to parse "
-				"nested IE for Routing Key\n");
+				"nested IEs in Routing Key\n");
+			/* FIXME: ERROR to peer */
+			continue;
+		}
+		rc = xua_dialect_check_all_ies_ext(&xua_dialect_m3ua, &m3ua_msg_class_rkm, M3UA_RKM_REG_REQ,
+						   m3ua_rkm_reg_req_routing_key_ies, inner, true);
+		if (rc > 0) {
+			LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Unable to parse "
+				"nested IEs in Routing Key\n");
+			xua_msg_free(inner);
+			/* FIXME: ERROR to peer */
    		continue;
    	}
    	/* handle single registration and append result to
@@ -502,6 +513,7 @@
 {
    struct xua_msg_part *part;
    struct xua_msg *inner = NULL;
+	int rc;
llist_for_each_entry(part, &xua->headers, entry) {
    	/* skip other IEs and/or short REG_RES IEs */
@@ -512,8 +524,22 @@
    	 * registration result (we only support one AS per ASP
    	 * for now) */
    	inner = xua_from_nested(part);
-		if (!inner)
+		if (!inner) {
+			LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Unable to parse "
+				"nested IEs in Registration Result\n");
+			/* FIXME: ERROR to peer */
    		continue;
+		}
+
+		rc = xua_dialect_check_all_ies_ext(&xua_dialect_m3ua, &m3ua_msg_class_rkm, M3UA_RKM_REG_RSP,
+						   m3ua_rkm_reg_rsp_registration_result_ies, inner, false);
+		if (rc > 0) {
+			LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Unable to parse "
+				"nested IEs in Registration Result\n");
+			xua_msg_free(inner);
+			/* FIXME: ERROR to peer */
+			continue;
+		}
handle_rkey_reg_resp(asp, inner);
    	xua_msg_free(inner);
@@ -526,13 +552,6 @@
 {
    struct osmo_xlm_prim *oxp;
-	if (!xua_msg_find_tag(inner, M3UA_IEI_DEREG_STATUS) ||
-	    !xua_msg_find_tag(inner, M3UA_IEI_ROUTE_CTX)) {
-		LOGPASP(asp, DLSS7, LOGL_NOTICE, "Missing Inner IE in DEREG RESP\n");
-		/* FIXME: ERROR to peer */
-		return -1;
-	}
-
    oxp = xua_xlm_prim_alloc_m_rk_dereg_cfm(xua_msg_get_u32(inner, M3UA_IEI_ROUTE_CTX),
    					xua_msg_get_u32(inner, M3UA_IEI_DEREG_STATUS));
@@ -551,6 +570,7 @@
 {
    struct xua_msg_part *part;
    struct xua_msg *inner = NULL;
+	int rc;
llist_for_each_entry(part, &xua->headers, entry) {
    	/* skip other IEs and/or short REG_RES IEs */
@@ -561,8 +581,22 @@
    	 * registration result (we only support one AS per ASP
    	 * for now) */
    	inner = xua_from_nested(part);
-		if (!inner)
+		if (!inner) {
+			LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Unable to parse "
+				"nested IEs in Deregistration Result\n");
+			/* FIXME: ERROR to peer */
    		continue;
+		}
+
+		rc = xua_dialect_check_all_ies_ext(&xua_dialect_m3ua, &m3ua_msg_class_rkm, M3UA_RKM_DEREG_RSP,
+						   m3ua_rkm_dereg_rsp_deregistration_result_ies, inner, false);
+		if (rc > 0) {
+			LOGPASP(asp, DLSS7, LOGL_NOTICE, "RKM: Unable to parse "
+				"nested IEs in Deregistration Result\n");
+			xua_msg_free(inner);
+			/* FIXME: ERROR to peer */
+			continue;
+		}
handle_rkey_dereg_resp(asp, inner);
    	xua_msg_free(inner);
-- 
To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43394?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email

Gerrit-MessageType: newchange
Gerrit-Project: libosmo-sigtran
Gerrit-Branch: master
Gerrit-Change-Id: Ibe7e446b1a537c0c09f8049add3460e37cdd58e8
Gerrit-Change-Number: 43394
Gerrit-PatchSet: 1
Gerrit-Owner: pespin pespin@sysmocom.de



    

2026

2025

2024

2023

2022

[M] Change in libosmo-sigtran[master]: xua_rkm: Validate IE lengths of RKM inner messages