pespin has submitted this change. ( https://gerrit.osmocom.org/c/libosmocore/+/43247?usp=email )
Change subject: iuup: Validate msgb input length in rx Initialization path ...................................................................... iuup: Validate msgb input length in rx Initialization path Input length validation of msgb was left as a TODO in iuup_rx_initialization(), which could end up in OOB reads. Related: OS#7063 Reported-By: Adam Bedard <[email protected]> Change-Id: Id0f7b0f63efc37376024359a3bf7fabbc40bc387 --- M src/gsm/iuup.c M tests/iuup/iuup_test.c M tests/iuup/iuup_test.err M tests/iuup/iuup_test.ok 4 files changed, 327 insertions(+), 59 deletions(-) Approvals: laforge: Looks good to me, but someone else must approve osmith: Looks good to me, but someone else must approve pespin: Looks good to me, approved Jenkins Builder: Verified diff --git a/src/gsm/iuup.c b/src/gsm/iuup.c index b7aa5f9..a233fb9 100644 --- a/src/gsm/iuup.c +++ b/src/gsm/iuup.c @@ -539,7 +539,8 @@ /* return: whether the last Init was Acked correctly and hence can transition to next state */ static bool iuup_rx_initialization(struct osmo_iuup_instance *iui, struct osmo_iuup_tnl_prim *itp) { - struct iuup_pdutype14_hdr *hdr; + struct msgb *msg = itp->oph.msg; + struct iuup_pdutype14_hdr *hdr = (struct iuup_pdutype14_hdr *)msgb_l2(msg); struct iuup_ctrl_init_hdr *ihdr; struct iuup_ctrl_init_rfci_hdr *ihdr_rfci; struct iuup_ctrl_init_tail *itail; @@ -551,9 +552,16 @@ struct osmo_iuup_rnl_prim *irp; struct osmo_iuup_tnl_prim *resp; - /* TODO: whenever we check message boundaries, length, etc. and we fail, send NACK */ + /* We expect at least the INIT header with at least 1 RFCI header: */ + if (msgb_l2len(msg) < sizeof(struct iuup_pdutype14_hdr) + + sizeof(struct iuup_ctrl_init_hdr) + + sizeof(struct iuup_ctrl_init_rfci_hdr)) { + LOGPFSML(iui->fi, LOGL_NOTICE, + "Initialization: Malformed packet, length %u too short\n", msgb_l2len(msg)); + err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT; + goto send_nack; + } - hdr = (struct iuup_pdutype14_hdr *)msgb_l2(itp->oph.msg); ihdr = (struct iuup_ctrl_init_hdr *)hdr->payload; if (ihdr->num_subflows_per_rfci == 0) { LOGPFSML(iui->fi, LOGL_NOTICE, "Initialization: Unexpected num_subflows=0 received\n"); @@ -562,16 +570,33 @@ } ihdr_rfci = (struct iuup_ctrl_init_rfci_hdr *)ihdr->rfci_data; + /* Iterate over RFCIs and parse and store its subflow lengths: */ do { struct osmo_iuup_rfci *rfci = &iui->config.rfci[num_rfci]; uint8_t l_size_bytes = ihdr_rfci->li + 1; + struct iuup_ctrl_init_rfci_hdr *next_ihdr_rfci = + (struct iuup_ctrl_init_rfci_hdr *)(&ihdr_rfci->subflow_length[0] + + (ihdr->num_subflows_per_rfci * l_size_bytes)); is_last = ihdr_rfci->lri; + if (num_rfci >= IUUP_MAX_RFCIS) { LOGPFSML(iui->fi, LOGL_NOTICE, "Initialization: Too many RFCIs received (%u)\n", - num_rfci); + num_rfci); err_cause = IUUP_ERR_CAUSE_UNEXPECTED_RFCI; goto send_nack; } + + /* Check contents of current RFCI are available in msgb, and if not last RFCI, + * also check for availability of next ihdr_rfci, all in one go: */ + if ((((uint8_t *)next_ihdr_rfci) + (is_last ? 0 : sizeof(struct iuup_ctrl_init_rfci_hdr))) > + msg->tail) { + LOGPFSML(iui->fi, LOGL_NOTICE, + "Initialization: Malformed packet, length %u too short\n", + msgb_l2len(msg)); + err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT; + goto send_nack; + } + rfci->used = 1; rfci->id = ihdr_rfci->rfci; if (l_size_bytes == 2) { @@ -588,13 +613,21 @@ } } num_rfci++; - ihdr_rfci++; - ihdr_rfci = (struct iuup_ctrl_init_rfci_hdr *)(((uint8_t *)ihdr_rfci) + ihdr->num_subflows_per_rfci * l_size_bytes); + ihdr_rfci = next_ihdr_rfci; } while (!is_last); if (ihdr->ti) { /* Timing information present */ uint8_t *buf = (uint8_t *)ihdr_rfci; uint8_t num_bytes = (num_rfci + 1) / 2; + + if (buf + num_bytes > msg->tail) { + LOGPFSML(iui->fi, LOGL_NOTICE, + "Initialization: Malformed packet, length %u too short\n", + msgb_l2len(msg)); + err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT; + goto send_nack; + } + iui->config.IPTIs_present = true; for (i = 0; i < num_bytes - 1; i++) { iui->config.rfci[i*2].IPTI = *buf >> 4; @@ -610,6 +643,15 @@ iui->config.IPTIs_present = false; itail = (struct iuup_ctrl_init_tail *)ihdr_rfci; } + + if (((uint8_t *)itail) + sizeof(*itail) > msg->tail) { + LOGPFSML(iui->fi, LOGL_NOTICE, + "Initialization: Malformed packet, length %u too short\n", + msgb_l2len(msg)); + err_cause = IUUP_ERR_CAUSE_FRAME_TOO_SHORT; + goto send_nack; + } + if (itail->data_pdu_type > 1) { LOGPFSML(iui->fi, LOGL_NOTICE, "Initialization: Unexpected Data PDU Type %u received\n", itail->data_pdu_type); err_cause = IUUP_ERR_CAUSE_UNEXPECTED_VALUE; @@ -643,9 +685,10 @@ resp = itp_ctrl_ack_alloc(iui, IUUP_PROC_INIT, hdr->frame_nr); iui->transport_prim_cb(&resp->oph, iui->transport_prim_priv); return ihdr->chain_ind == 0; + send_nack: LOGPFSML(iui->fi, LOGL_NOTICE, "Tx Initialization NACK cause=%u orig_message=%s\n", - err_cause, osmo_hexdump((const unsigned char *) msgb_l2(itp->oph.msg), msgb_l2len(itp->oph.msg))); + err_cause, osmo_hexdump((const unsigned char *) msgb_l2(msg), msgb_l2len(msg))); resp = tnp_ctrl_nack_alloc(iui, IUUP_PROC_INIT, err_cause, hdr->frame_nr); iui->transport_prim_cb(&resp->oph, iui->transport_prim_priv); return false; diff --git a/tests/iuup/iuup_test.c b/tests/iuup/iuup_test.c index 725a7d9..353c76a 100644 --- a/tests/iuup/iuup_test.c +++ b/tests/iuup/iuup_test.c @@ -31,6 +31,56 @@ .t_rc = { .t_ms = IUUP_TIMER_RC_T_DEFAULT, .n_max = IUUP_TIMER_RC_N_DEFAULT }, }; +/* Frame 46, "Initialization", SYS#5969 call4_Iu_Iuh.pcap + 1110 .... = PDU Type: Control Procedure (14) + .... 00.. = Ack/Nack: Procedure (0) + .... ..00 = Frame Number: 0 + 0000 .... = Mode Version: 0x0 + .... 0000 = Procedure: Initialization (0) + 1101 11.. = Header CRC: 0x37 [correct] + .... ..01 1011 0100 = Payload CRC: 0x1b4 + 000. .... = Spare: 0x0 + ...0 .... = TI: IPTIs not present (0) + .... 011. = Subflows: 3 + .... ...0 = Chain Indicator: this frame is the last frame for the procedure (0) + RFCI 1 Initialization + 0... .... = RFCI 0 LRI: Not last RFCI (0x0) + .0.. .... = RFCI 0 LI: one octet used (0x0) + ..00 0001 = RFCI 0: 1 + RFCI 0 Flow 0 Len: 81 + RFCI 0 Flow 1 Len: 103 + RFCI 0 Flow 2 Len: 60 + RFCI 6 Initialization + 1... .... = RFCI 1 LRI: Last RFCI in current frame (0x1) + .0.. .... = RFCI 1 LI: one octet used (0x0) + ..00 0110 = RFCI 1: 6 + RFCI 1 Flow 0 Len: 39 + RFCI 1 Flow 1 Len: 0 + RFCI 1 Flow 2 Len: 0 + Iu UP Mode Versions Supported: 0x0001 + 0... .... .... .... = Version 16: not supported (0x0) + .0.. .... .... .... = Version 15: not supported (0x0) + ..0. .... .... .... = Version 14: not supported (0x0) + ...0 .... .... .... = Version 13: not supported (0x0) + .... 0... .... .... = Version 12: not supported (0x0) + .... .0.. .... .... = Version 11: not supported (0x0) + .... ..0. .... .... = Version 10: not supported (0x0) + .... ...0 .... .... = Version 9: not supported (0x0) + .... .... 0... .... = Version 8: not supported (0x0) + .... .... .0.. .... = Version 7: not supported (0x0) + .... .... ..0. .... = Version 6: not supported (0x0) + .... .... ...0 .... = Version 5: not supported (0x0) + .... .... .... 0... = Version 4: not supported (0x0) + .... .... .... .0.. = Version 3: not supported (0x0) + .... .... .... ..0. = Version 2: not supported (0x0) + .... .... .... ...1 = Version 1: supported (0x1) + 0000 .... = RFCI Data Pdu Type: PDU type 0 (0x0) +*/ +const uint8_t iuup_initialization_no_iptis[] = { + 0xe0, 0x00, 0xdd, 0xb4, 0x06, 0x01, 0x51, 0x67, 0x3c, 0x86, 0x27, + 0x00, 0x00, 0x00, 0x01, 0x00 +}; + /* Frame 33, "Initialization", OS#4744 3g_call_23112021.pcapng IuUP 1110 .... = PDU Type: Control Procedure (14) @@ -665,56 +715,6 @@ struct iuup_pdutype14_hdr *hdr14; int rc; - /* Frame 46, "Initialization", SYS#5969 call4_Iu_Iuh.pcap - 1110 .... = PDU Type: Control Procedure (14) - .... 00.. = Ack/Nack: Procedure (0) - .... ..00 = Frame Number: 0 - 0000 .... = Mode Version: 0x0 - .... 0000 = Procedure: Initialization (0) - 1101 11.. = Header CRC: 0x37 [correct] - .... ..01 1011 0100 = Payload CRC: 0x1b4 - 000. .... = Spare: 0x0 - ...0 .... = TI: IPTIs not present (0) - .... 011. = Subflows: 3 - .... ...0 = Chain Indicator: this frame is the last frame for the procedure (0) - RFCI 1 Initialization - 0... .... = RFCI 0 LRI: Not last RFCI (0x0) - .0.. .... = RFCI 0 LI: one octet used (0x0) - ..00 0001 = RFCI 0: 1 - RFCI 0 Flow 0 Len: 81 - RFCI 0 Flow 1 Len: 103 - RFCI 0 Flow 2 Len: 60 - RFCI 6 Initialization - 1... .... = RFCI 1 LRI: Last RFCI in current frame (0x1) - .0.. .... = RFCI 1 LI: one octet used (0x0) - ..00 0110 = RFCI 1: 6 - RFCI 1 Flow 0 Len: 39 - RFCI 1 Flow 1 Len: 0 - RFCI 1 Flow 2 Len: 0 - Iu UP Mode Versions Supported: 0x0001 - 0... .... .... .... = Version 16: not supported (0x0) - .0.. .... .... .... = Version 15: not supported (0x0) - ..0. .... .... .... = Version 14: not supported (0x0) - ...0 .... .... .... = Version 13: not supported (0x0) - .... 0... .... .... = Version 12: not supported (0x0) - .... .0.. .... .... = Version 11: not supported (0x0) - .... ..0. .... .... = Version 10: not supported (0x0) - .... ...0 .... .... = Version 9: not supported (0x0) - .... .... 0... .... = Version 8: not supported (0x0) - .... .... .0.. .... = Version 7: not supported (0x0) - .... .... ..0. .... = Version 6: not supported (0x0) - .... .... ...0 .... = Version 5: not supported (0x0) - .... .... .... 0... = Version 4: not supported (0x0) - .... .... .... .0.. = Version 3: not supported (0x0) - .... .... .... ..0. = Version 2: not supported (0x0) - .... .... .... ...1 = Version 1: supported (0x1) - 0000 .... = RFCI Data Pdu Type: PDU type 0 (0x0) - */ - const uint8_t iuup_init[] = { - 0xe0, 0x00, 0xdd, 0xb4, 0x06, 0x01, 0x51, 0x67, 0x3c, 0x86, 0x27, - 0x00, 0x00, 0x00, 0x01, 0x00 - }; - iui = osmo_iuup_instance_alloc(iuup_test_ctx, __func__); OSMO_ASSERT(iui); osmo_iuup_instance_set_user_prim_cb(iui, _decode_passive_init_2_rfci_no_iptis_user_prim_cb, NULL); @@ -732,9 +732,9 @@ /* Send Init: */ tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE); - tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_init)); + tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_initialization_no_iptis)); hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg); - memcpy(hdr14, iuup_init, sizeof(iuup_init)); + memcpy(hdr14, iuup_initialization_no_iptis, sizeof(iuup_initialization_no_iptis)); rc = osmo_iuup_tnl_prim_up(iui, tnp); OSMO_ASSERT(rc == 0); @@ -742,6 +742,176 @@ osmo_iuup_instance_free(iui); } +static int _decode_passive_init_exp_nack_transport_prim_cb(struct osmo_prim_hdr *oph, void *ctx) +{ + struct osmo_iuup_tnl_prim *itp = (struct osmo_iuup_tnl_prim *)oph; + struct msgb *msg; + struct iuup_pdutype14_hdr *hdr; + + printf("%s()\n", __func__); + msg = oph->msg; + OSMO_ASSERT(OSMO_PRIM_HDR(&itp->oph) == OSMO_PRIM(OSMO_IUUP_TNL_UNITDATA, PRIM_OP_REQUEST)); + printf("Transport: DL len=%u: %s\n", msgb_l2len(msg), + osmo_hexdump((const unsigned char *) msgb_l2(msg), msgb_l2len(msg))); + hdr = msgb_l2(msg); + OSMO_ASSERT(hdr->pdu_type == IUUP_PDU_T_CONTROL); + OSMO_ASSERT(hdr->ack_nack == IUUP_AN_NACK); + msgb_free(msg); + return 0; +} +/* Send a malformed Initialization to UIT containing num_subflows_per_rfci = 0. + * It shall be rejected since num_subflows_per_rfci should be at least one accoridng to 3GPP TS 25.415 Figure 24 */ +void test_decode_passive_init_malformed_0subflows(void) +{ + /* Here we check the passive INIT code path, aka receiving INIT and returning INIT_ACK/NACK */ + struct osmo_iuup_instance *iui; + struct osmo_iuup_rnl_prim *rnp; + struct osmo_iuup_tnl_prim *tnp; + struct iuup_pdutype14_hdr *hdr14; + struct iuup_ctrl_init_hdr *ihdr; + uint16_t payload_crc; + int rc; + + iui = osmo_iuup_instance_alloc(iuup_test_ctx, __func__); + OSMO_ASSERT(iui); + osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL); + + clock_override_set(0, 0); + + /* Tx CONFIG.req */ + rnp = osmo_iuup_rnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, IUUP_MSGB_SIZE); + rnp->u.config = def_configure_req; + rnp->u.config.active = false; + + rc = osmo_iuup_rnl_prim_down(iui, rnp); + OSMO_ASSERT(rc == 0); + + /* Prepare and send Init: copy iuup_initialization_no_iptis, modify setting TI=1 (becoming malformed) and dispatch it. */ + tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE); + tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_initialization_no_iptis)); + hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg); + memcpy(hdr14, iuup_initialization_no_iptis, sizeof(iuup_initialization_no_iptis)); + + ihdr = (struct iuup_ctrl_init_hdr *)hdr14->payload; + ihdr->num_subflows_per_rfci = 0; + payload_crc = osmo_iuup_compute_payload_crc(msgb_l2(tnp->oph.msg), msgb_l2len(tnp->oph.msg)); + hdr14->payload_crc_hi = (payload_crc >> 8) & 0x03; + hdr14->payload_crc_lo = payload_crc & 0xff; + + rc = osmo_iuup_tnl_prim_up(iui, tnp); + OSMO_ASSERT(rc == 0); + + osmo_iuup_instance_free(iui); +} + +/* Send a malformed Initialization to UIT containing TI=1 and no IPTIs encoded. + * As a result, the msgb content is too short and should be rejected. */ +void test_decode_passive_init_malformed_ti1_no_iptis(void) +{ + /* Here we check the passive INIT code path, aka receiving INIT and returning INIT_ACK/NACK */ + struct osmo_iuup_instance *iui; + struct osmo_iuup_rnl_prim *rnp; + struct osmo_iuup_tnl_prim *tnp; + struct iuup_pdutype14_hdr *hdr14; + struct iuup_ctrl_init_hdr *ihdr; + uint16_t payload_crc; + int rc; + + iui = osmo_iuup_instance_alloc(iuup_test_ctx, __func__); + OSMO_ASSERT(iui); + osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL); + + clock_override_set(0, 0); + + /* Tx CONFIG.req */ + rnp = osmo_iuup_rnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, IUUP_MSGB_SIZE); + rnp->u.config = def_configure_req; + rnp->u.config.active = false; + + rc = osmo_iuup_rnl_prim_down(iui, rnp); + OSMO_ASSERT(rc == 0); + + /* Prepare and send Init: copy iuup_initialization_no_iptis, modify setting TI=1 (becoming malformed) and dispatch it. */ + tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE); + tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, sizeof(iuup_initialization_no_iptis)); + hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg); + memcpy(hdr14, iuup_initialization_no_iptis, sizeof(iuup_initialization_no_iptis)); + + ihdr = (struct iuup_ctrl_init_hdr *)hdr14->payload; + ihdr->ti = 1; + payload_crc = osmo_iuup_compute_payload_crc(msgb_l2(tnp->oph.msg), msgb_l2len(tnp->oph.msg)); + hdr14->payload_crc_hi = (payload_crc >> 8) & 0x03; + hdr14->payload_crc_lo = payload_crc & 0xff; + + rc = osmo_iuup_tnl_prim_up(iui, tnp); + OSMO_ASSERT(rc == 0); + + osmo_iuup_instance_free(iui); +} + +/* Send a malformed Initialization to UIT containing no RFCIs. + * As a result, the msgb content is too short and should be rejected. */ +void _test_submit_iuup_initialization_trimmed(unsigned int pkt_len, const char *test_name) +{ + /* Here we check the passive INIT code path, aka receiving INIT and returning INIT_ACK/NACK */ + struct osmo_iuup_instance *iui; + struct osmo_iuup_rnl_prim *rnp; + struct osmo_iuup_tnl_prim *tnp; + struct iuup_pdutype14_hdr *hdr14; + uint16_t payload_crc; + int rc; + + OSMO_ASSERT(pkt_len <= sizeof(iuup_initialization_no_iptis)); + + iui = osmo_iuup_instance_alloc(iuup_test_ctx, test_name); + OSMO_ASSERT(iui); + osmo_iuup_instance_set_transport_prim_cb(iui, _decode_passive_init_exp_nack_transport_prim_cb, NULL); + + /* Tx CONFIG.req */ + rnp = osmo_iuup_rnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_RNL_CONFIG, PRIM_OP_REQUEST, IUUP_MSGB_SIZE); + rnp->u.config = def_configure_req; + rnp->u.config.active = false; + + rc = osmo_iuup_rnl_prim_down(iui, rnp); + OSMO_ASSERT(rc == 0); + + /* Prepare and send Init: copy iuup_initialization_no_iptis, modify setting TI=1 (becoming malformed) and dispatch it. */ + tnp = osmo_iuup_tnl_prim_alloc(iuup_test_ctx, OSMO_IUUP_TNL_UNITDATA, PRIM_OP_INDICATION, IUUP_MSGB_SIZE); + tnp->oph.msg->l2h = msgb_put(tnp->oph.msg, pkt_len); + hdr14 = (struct iuup_pdutype14_hdr *)msgb_l2(tnp->oph.msg); + memcpy(hdr14, iuup_initialization_no_iptis, pkt_len); + + payload_crc = osmo_iuup_compute_payload_crc(msgb_l2(tnp->oph.msg), msgb_l2len(tnp->oph.msg)); + hdr14->payload_crc_hi = (payload_crc >> 8) & 0x03; + hdr14->payload_crc_lo = payload_crc & 0xff; + + rc = osmo_iuup_tnl_prim_up(iui, tnp); + OSMO_ASSERT(rc == 0); + + osmo_iuup_instance_free(iui); +} +void test_decode_passive_init_malformed_no_rfci(void) +{ + unsigned int pkt_len = sizeof(struct iuup_pdutype14_hdr) + sizeof(struct iuup_ctrl_init_hdr); + clock_override_set(0, 0); + _test_submit_iuup_initialization_trimmed(pkt_len, __func__); +} + +/* Send a malformed Initialization to UIT containing malformed RFCIs. + * As a result, the msgb content is too short and should be rejected. */ +void test_decode_passive_init_malformed_rfci_too_short(void) +{ + unsigned int pkt_len = sizeof(struct iuup_pdutype14_hdr) + sizeof(struct iuup_ctrl_init_hdr) + 2; + clock_override_set(0, 0); + _test_submit_iuup_initialization_trimmed(pkt_len, __func__); +} + +void test_decode_passive_init_malformed_missing_last_byte(void) +{ + clock_override_set(0, 0); + _test_submit_iuup_initialization_trimmed(sizeof(iuup_initialization_no_iptis) - 1, __func__); +} + int main(int argc, char **argv) { iuup_test_ctx = talloc_named_const(NULL, 0, "iuup_test"); @@ -762,6 +932,11 @@ test_passive_init(); test_passive_init_retrans(); test_decode_passive_init_2_rfci_no_iptis(); + test_decode_passive_init_malformed_0subflows(); + test_decode_passive_init_malformed_ti1_no_iptis(); + test_decode_passive_init_malformed_no_rfci(); + test_decode_passive_init_malformed_rfci_too_short(); + test_decode_passive_init_malformed_missing_last_byte(); printf("OK.\n"); } diff --git a/tests/iuup/iuup_test.err b/tests/iuup/iuup_test.err index fe1ed397..0298420 100644 --- a/tests/iuup/iuup_test.err +++ b/tests/iuup/iuup_test.err @@ -53,3 +53,38 @@ DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){Initialisation}: Tx Initialization ACK DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){Initialisation}: state_chg to SMpSDU_Data_Transfer_Ready DLIUUP IuUP(test_decode_passive_init_2_rfci_no_iptis){SMpSDU_Data_Transfer_Ready}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Initialization: Unexpected num_subflows=0 received +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Tx Initialization NACK cause=20 orig_message=e0 00 dc 62 00 01 51 67 3c 86 27 00 00 00 01 00 +DLIUUP IuUP(test_decode_passive_init_malformed_0subflows){Initialisation}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Initialization: Malformed packet, length 16 too short +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 dc 06 16 01 51 67 3c 86 27 00 00 00 01 00 +DLIUUP IuUP(test_decode_passive_init_malformed_ti1_no_iptis){Initialisation}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Initialization: Malformed packet, length 5 too short +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 dc cc 06 +DLIUUP IuUP(test_decode_passive_init_malformed_no_rfci){Initialisation}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Initialization: Malformed packet, length 7 too short +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 df 7d 06 01 51 +DLIUUP IuUP(test_decode_passive_init_malformed_rfci_too_short){Initialisation}: Deallocated +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){NULL}: Allocated +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){NULL}: Received Event IuUP-CONFIG-req +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){NULL}: state_chg to Initialisation +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Received Event INIT +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Initialization: Malformed packet, length 15 too short +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Tx Initialization NACK cause=8 orig_message=e0 00 df f7 06 01 51 67 3c 86 27 00 00 00 01 +DLIUUP IuUP(test_decode_passive_init_malformed_missing_last_byte){Initialisation}: Deallocated diff --git a/tests/iuup/iuup_test.ok b/tests/iuup/iuup_test.ok index 57baba9..204c290 100644 --- a/tests/iuup/iuup_test.ok +++ b/tests/iuup/iuup_test.ok @@ -58,4 +58,19 @@ _decode_passive_init_2_rfci_no_iptis_user_prim_cb(): Initialization decoded fine! _decode_passive_init_2_rfci_no_iptis_transport_prim_cb() Transport: DL len=4: e4 00 24 00 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 50 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 20 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 20 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 20 +sys={0.000000}, clock_override_set +_decode_passive_init_exp_nack_transport_prim_cb() +Transport: DL len=5: e8 00 90 00 20 OK. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43247?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: Id0f7b0f63efc37376024359a3bf7fabbc40bc387 Gerrit-Change-Number: 43247 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <[email protected]> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <[email protected]> Gerrit-Reviewer: neels <[email protected]> Gerrit-Reviewer: osmith <[email protected]> Gerrit-Reviewer: pespin <[email protected]>
