Change in osmo-pcu[master]: gprs_bssgp_pcu: ensure only known BVCI can be resetted by the SGSN

[laforge]

laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-pcu/+/23014 )

Change subject: gprs_bssgp_pcu: ensure only known BVCI can be resetted by the SGSN
......................................................................

gprs_bssgp_pcu: ensure only known BVCI can be resetted by the SGSN

Related: OS#3879
Change-Id: I04e36ce4a29e51d85e67a0d3a81aa0e1eb9e9c08
---
M src/gprs_bssgp_pcu.c
1 file changed, 12 insertions(+), 0 deletions(-)

Approvals:
  laforge: Looks good to me, approved
  pespin: Looks good to me, but someone else must approve
  Jenkins Builder: Verified



diff --git a/src/gprs_bssgp_pcu.c b/src/gprs_bssgp_pcu.c
index fd3f0db..4170a66 100644
--- a/src/gprs_bssgp_pcu.c
+++ b/src/gprs_bssgp_pcu.c
@@ -415,6 +415,7 @@
 	struct tlv_parsed tp;
 	enum bssgp_pdu_type pdu_type = (enum bssgp_pdu_type) bgph->pdu_type;
 	uint16_t ns_bvci = msgb_bvci(msg), nsei = msgb_nsei(msg);
+	uint16_t bvci;
 	int data_len;
 	int rc = 0;
 	struct bssgp_bvc_ctx *bctx;
@@ -456,6 +457,17 @@
 	}
 
 	if (pdu_type == BSSGP_PDUT_BVC_RESET) {
+		if (ns_bvci != BVCI_SIGNALLING || !TLVP_PRESENT(&tp, BSSGP_IE_BVCI)) {
+			LOGP(DBSSGP, LOGL_ERROR, "Rx an invalid BVC-RESET %s\n", msgb_hexdump(msg));
+			return bssgp_tx_status(BSSGP_CAUSE_INV_MAND_INF, NULL, msg);
+		}
+
+		bvci = tlvp_val16be(&tp, BSSGP_IE_BVCI);
+		if (bvci != BVCI_SIGNALLING && bvci != the_pcu->bssgp.bctx->bvci) {
+			LOGP(DBSSGP, LOGL_ERROR, "Rx BVC-RESET for an unknown BVCI %d\n", bvci);
+			return bssgp_tx_status(BSSGP_CAUSE_UNKNOWN_BVCI, &bvci, msg);
+		}
+
 		return bssgp_rcvmsg(msg);
 	}
 

-- 
To view, visit https://gerrit.osmocom.org/c/osmo-pcu/+/23014
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-pcu
Gerrit-Branch: master
Gerrit-Change-Id: I04e36ce4a29e51d85e67a0d3a81aa0e1eb9e9c08
Gerrit-Change-Number: 23014
Gerrit-PatchSet: 6
Gerrit-Owner: lynxis lazus <lynxis at fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: daniel <dwillmann at sysmocom.de>
Gerrit-Reviewer: laforge <laforge at osmocom.org>
Gerrit-Reviewer: pespin <pespin at sysmocom.de>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20210323/91180e20/attachment.htm>