Change in libosmo-sccp[master]: SUA: Verify routing context IE of incoming CL and CO messages

[laforge]

laforge has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-sccp/+/22776 )

Change subject: SUA: Verify routing context IE of incoming CL and CO messages
......................................................................

SUA: Verify routing context IE of incoming CL and CO messages

When receiving user-data (connectionless / connection-oriented),
we must make sure that there either
a) no routing context IE in the message, and only one AS within the ASP, or
b) a valid routing context IE for an AS within the ASP

This important input validation has been done in M3UA for a long time,
but somehow never been implemented on the SUA side so far.

Change-Id: Icc232250513009137add3b45fecbb5d2a07c0645
---
M src/sua.c
1 file changed, 14 insertions(+), 0 deletions(-)

Approvals:
  Jenkins Builder: Verified
  laforge: Looks good to me, approved
  pespin: Looks good to me, but someone else must approve



diff --git a/src/sua.c b/src/sua.c
index 4a98b9a..42d43e8 100644
--- a/src/sua.c
+++ b/src/sua.c
@@ -510,10 +510,17 @@
 /* connectionless messages received from socket */
 static int sua_rx_cl(struct osmo_ss7_asp *asp, struct xua_msg *xua)
 {
+	struct xua_msg_part *rctx_ie = xua_msg_find_tag(xua, SUA_IEI_ROUTE_CTX);
 	struct osmo_sccp_instance *inst = asp->inst->sccp;
+	struct osmo_ss7_as *as;
+	int rc;
 
 	OSMO_ASSERT(xua->hdr.msg_class == SUA_MSGC_CL);
 
+	rc = xua_find_as_for_asp(&as, asp, rctx_ie);
+	if (rc)
+		return rc;
+
 	switch (xua->hdr.msg_type) {
 	case 0: /* Reserved, permitted by ETSI TS 101 592 5.2.3.2 */
 	case SUA_CL_CLDT:
@@ -531,10 +538,17 @@
 /* connection-oriented messages received from socket */
 static int sua_rx_co(struct osmo_ss7_asp *asp, struct xua_msg *xua)
 {
+	struct xua_msg_part *rctx_ie = xua_msg_find_tag(xua, SUA_IEI_ROUTE_CTX);
 	struct osmo_sccp_instance *inst = asp->inst->sccp;
+	struct osmo_ss7_as *as;
+	int rc;
 
 	OSMO_ASSERT(xua->hdr.msg_class == SUA_MSGC_CO);
 
+	rc = xua_find_as_for_asp(&as, asp, rctx_ie);
+	if (rc)
+		return rc;
+
 	switch (xua->hdr.msg_type) {
 	case 0: /* Reserved, permitted by ETSI TS 101 592 5.2.3.2 */
 	case SUA_CO_CORE:

-- 
To view, visit https://gerrit.osmocom.org/c/libosmo-sccp/+/22776
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: libosmo-sccp
Gerrit-Branch: master
Gerrit-Change-Id: Icc232250513009137add3b45fecbb5d2a07c0645
Gerrit-Change-Number: 22776
Gerrit-PatchSet: 2
Gerrit-Owner: laforge <laforge at osmocom.org>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge at osmocom.org>
Gerrit-Reviewer: pespin <pespin at sysmocom.de>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20210208/6343de7b/attachment.htm>