pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmocore/+/43250?usp=email )
Change subject: gsm: Reject BSSMAP Encryption Information IE with no selected algo ......................................................................
gsm: Reject BSSMAP Encryption Information IE with no selected algo
3GPP TS 48.008 3.2.2.10 Encryption Information IE clearly states that case should not be used, so reject it.
Change-Id: I48ace0b3590c993b86f1471e5b57c3afee72217f --- M src/gsm/gsm0808_utils.c M tests/gsm0808/gsm0808_test.c 2 files changed, 11 insertions(+), 3 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/libosmocore refs/changes/50/43250/1
diff --git a/src/gsm/gsm0808_utils.c b/src/gsm/gsm0808_utils.c index c9f26d3..1abfbc8 100644 --- a/src/gsm/gsm0808_utils.c +++ b/src/gsm/gsm0808_utils.c @@ -820,7 +820,7 @@ return *tlv_len + 2; }
-/*! Decode TS 08.08 Encryption Information IE +/*! Decode 3GPP TS 48.008 3.2.2.10 Encryption Information IE * \param[out] ei Caller-provided memory to store encryption information * \param[in] elem IE value to be decoded * \param[in] len Length of \a elem in bytes @@ -843,6 +843,10 @@ perm_algo = *elem; elem++;
+ /* "A permitted algorithms octet containing all bits encoded as 0 shall not be used." */ + if (perm_algo == 0x00) + return -EINVAL; + for (i = 0; i < ENCRY_INFO_PERM_ALGO_MAXLEN; i++) { if (perm_algo & (1 << i)) { ei->perm_algo[perm_algo_len] = i + 1; diff --git a/tests/gsm0808/gsm0808_test.c b/tests/gsm0808/gsm0808_test.c index ed99245..497de6c 100644 --- a/tests/gsm0808/gsm0808_test.c +++ b/tests/gsm0808/gsm0808_test.c @@ -1281,10 +1281,14 @@
rc_dec = gsm0808_dec_encrypt_info(&dec_ei, msg->data + 2, msg->len - 2); OSMO_ASSERT(rc_dec == 9); - OSMO_ASSERT(memcmp(&enc_ei, &dec_ei, sizeof(enc_ei)) == 0); - msgb_free(msg); + + /* Test decoding of malformed IE with no algo selected: */ + uint8_t ei_enc_no_algo[] = { GSM0808_IE_ENCRYPTION_INFORMATION, 0x01, 0x00 }; + rc_dec = gsm0808_dec_encrypt_info(&dec_ei, &ei_enc_no_algo[2], sizeof(ei_enc_no_algo) - 2); + OSMO_ASSERT(rc_dec == -EINVAL); + }
static void test_gsm0808_dec_cell_id_list_srvcc(void)