From: Álvaro Neira Ayuso anayuso@sysmocom.de

I have split the function check_oml_msg, in two functions. One for checking if the ipa header is well-formed and in check_oml_msg, I have removed this code for using in the future the function check_oml_msg for passing a sanity check to oml message without ipa header.

Signed-off-by: Alvaro Neira Ayuso anayuso@sysmocom.de --- src/osmo-bts-sysmo/main.c | 11 +++++++++- src/osmo-bts-sysmo/utils.c | 50 ++++++++++++++++++++++++-------------------- src/osmo-bts-sysmo/utils.h | 1 + 3 files changed, 38 insertions(+), 24 deletions(-)

diff --git a/src/osmo-bts-sysmo/main.c b/src/osmo-bts-sysmo/main.c index bd6a181..797f174 100644 --- a/src/osmo-bts-sysmo/main.c +++ b/src/osmo-bts-sysmo/main.c @@ -317,7 +317,16 @@ static int read_sock(struct osmo_fd *fd, unsigned int what)

msgb_put(msg, rc);

- if (check_oml_msg(msg) < 0) { + rc = check_ipa_header(msg); + if (rc < 0) { + LOGP(DL1C, LOGL_ERROR, "Malformed receive message: Ipa hdr\n"); + goto err; + } + + msgb_pull(msg, sizeof(struct ipaccess_head)); + + rc = check_oml_msg(msg); + if (rc < 0) { LOGP(DL1C, LOGL_ERROR, "Malformed receive message\n"); goto err; } diff --git a/src/osmo-bts-sysmo/utils.c b/src/osmo-bts-sysmo/utils.c index 2da1228..1fa5796 100644 --- a/src/osmo-bts-sysmo/utils.c +++ b/src/osmo-bts-sysmo/utils.c @@ -181,33 +181,10 @@ void prepend_oml_ipa_header(struct msgb *msg)

int check_oml_msg(struct msgb *msg) { - struct ipaccess_head *hh; struct abis_om_hdr *omh; int abis_oml_hdr_len; char label_id[255];

- if (msg->len < sizeof(struct ipaccess_head)) { - LOGP(DL1C, LOGL_ERROR, "Ipa header insufficient space %d %d\n", - msg->len, sizeof(struct ipaccess_head)); - return -1; - } - - hh = (struct ipaccess_head *)msg->data; - - if (hh->proto != IPAC_PROTO_OML) { - LOGP(DL1C, LOGL_ERROR, "Incorrect ipa header protocol %x %x\n", - hh->proto, IPAC_PROTO_OML); - return -1; - } - - if (ntohs(hh->len) != msg->len - sizeof(struct ipaccess_head)) { - LOGP(DL1C, LOGL_ERROR, "Incorrect ipa header msg size %d %d\n", - ntohs(hh->len), msg->len - sizeof(struct ipaccess_head)); - return -1; - } - - msgb_pull(msg, sizeof(struct ipaccess_head)); - abis_oml_hdr_len = sizeof(struct abis_om_hdr);

if (msg->len < abis_oml_hdr_len) { @@ -287,6 +264,33 @@ int check_oml_msg(struct msgb *msg) return 0; }

+int check_ipa_header(struct msgb *msg) +{ + struct ipaccess_head *hh; + + if (msg->len < sizeof(struct ipaccess_head)) { + LOGP(DL1C, LOGL_ERROR, "Ipa header insufficient space %d %d\n", + msg->len, sizeof(struct ipaccess_head)); + return -1; + } + + hh = (struct ipaccess_head *)msg->data; + + if (hh->proto != IPAC_PROTO_OML) { + LOGP(DL1C, LOGL_ERROR, "Incorrect ipa header protocol %x %x\n", + hh->proto, IPAC_PROTO_OML); + return -1; + } + + if (ntohs(hh->len) != msg->len - sizeof(struct ipaccess_head)) { + LOGP(DL1C, LOGL_ERROR, "Incorrect ipa header msg size %d %d\n", + ntohs(hh->len), msg->len - sizeof(struct ipaccess_head)); + return -1; + } + + return 0; +} + int add_manufacturer_id_label(struct msgb *msg, int manuf_type_id) { uint8_t *manuf; diff --git a/src/osmo-bts-sysmo/utils.h b/src/osmo-bts-sysmo/utils.h index 85a5e88..4f2293a 100644 --- a/src/osmo-bts-sysmo/utils.h +++ b/src/osmo-bts-sysmo/utils.h @@ -29,4 +29,5 @@ int add_manufacturer_id_label(struct msgb *msg, int manuf_type_id); void prepend_oml_ipa_header(struct msgb *msg);

int check_oml_msg(struct msgb *msg); +int check_ipa_header(struct msgb *msg); #endif