pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-sigtran/+/43396?usp=email )

Change subject: xua_rkm: rx REG REQ: Fix potential assert reading optional rctx IE ......................................................................

xua_rkm: rx REG REQ: Fix potential assert reading optional rctx IE

RFC4666 3.6.1 clearly marks the IE as optional. Our exisitng logic also expected that the routing key may not be there.

Related: OS#7074 Reported-By: Tristan Madani tristan@talencesecurity.com Change-Id: I0dd6b2892f9ffa72880f98d03e13f0b354c47c61 --- M src/xua_rkm.c 1 file changed, 4 insertions(+), 2 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/96/43396/1

diff --git a/src/xua_rkm.c b/src/xua_rkm.c index 61730db..ec898d2 100644 --- a/src/xua_rkm.c +++ b/src/xua_rkm.c @@ -175,6 +175,7 @@ struct msgb *resp, struct osmo_ss7_as **newly_assigned_as, unsigned int max_nas_idx, unsigned int *nas_idx) { + struct xua_msg_part *rctx_ie; uint32_t rk_id, rctx, _tmode, dpc; enum osmo_ss7_as_traffic_mode tmode; struct osmo_ss7_as *as = NULL; @@ -186,7 +187,7 @@ /* mandatory local routing key ID */ rk_id = xua_msg_get_u32(inner, M3UA_IEI_LOC_RKEY_ID); /* ASP may already include a routing context value here */ - rctx = xua_msg_get_u32(inner, M3UA_IEI_ROUTE_CTX); + rctx_ie = xua_msg_find_tag(inner, M3UA_IEI_ROUTE_CTX);

/* traffic mode type (0 = undefined) */ _tmode = xua_msg_get_u32(inner, M3UA_IEI_TRAF_MODE_TYP); @@ -229,8 +230,9 @@ * all AS/RK in situations where the peers are trusted. */

- if (rctx) { + if (rctx_ie) { /* check if there is already an AS for this routing key */ + rctx = xua_msg_part_get_u32(rctx_ie); as = osmo_ss7_as_find_by_rctx(asp->inst, rctx); } else { /* if the ASP did not include a routing context number, allocate