From bef72dd7479185e3c70f5997c7bd18f986cde79c Mon Sep 17 00:00:00 2001 From: Angelo Athanassopoulos Date: Thu, 27 Oct 2022 18:44:36 +0200 Subject: [PATCH 1/6] PSEA - SABOX fix - changed the max accumulated apn length --- .../NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c | 2 +- .../NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c index cbcd767c11..ee52e1f9c0 100644 --- a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c +++ b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c @@ -168,7 +168,7 @@ void capture_pdu_session_establishment_accept_msg(uint8_t *buffer, uint32_t msg_ LOG_T(NAS, "PDU SESSION ESTABLISHMENT ACCEPT - Received DNN IE\n"); psea_msg.dnn_ie.dnn_length = *(buffer + offset++); uint8_t i=0; - char apn[20]; + char apn[APN_MAX_LEN]; while (*(buffer + offset + i) != ASCII_ACK) { apn[i] = *(buffer + offset + i); diff --git a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h index ca92e54418..393d2cb4b6 100644 --- a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h +++ b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h @@ -58,6 +58,13 @@ #define ASCII_ACK 0x06 /* Delimiter in the DNN IEI */ +/* DNN - APN + * TS 23.003 9.1 + * The APN is composed of two parts, the APN Network Identifier (9.1.1) & The APN Operator Identifier (9.1.2). + * The accumulated max length of APN is 100 bytes. + */ +#define APN_MAX_LEN 100 + /* Mandatory Presence IE - TS 24.501 Table 8.3.2.1.1 */ typedef struct packet_filter_create_qos_rule_s { From dbd00175a77c57e2c28f4aa022ece3b9534a1b92 Mon Sep 17 00:00:00 2001 From: Angelo Athanassopoulos Date: Thu, 27 Oct 2022 19:13:59 +0200 Subject: [PATCH 2/6] PSEA - SABOX fix - Avoid the infinite loop, when not receiving an APN Operator Identifier --- openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c index ee52e1f9c0..67c58f1e85 100644 --- a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c +++ b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c @@ -167,13 +167,10 @@ void capture_pdu_session_establishment_accept_msg(uint8_t *buffer, uint32_t msg_ case IEI_DNN: LOG_T(NAS, "PDU SESSION ESTABLISHMENT ACCEPT - Received DNN IE\n"); psea_msg.dnn_ie.dnn_length = *(buffer + offset++); - uint8_t i=0; char apn[APN_MAX_LEN]; - while (*(buffer + offset + i) != ASCII_ACK) { + for (int i = 0 ; i < psea_msg.dnn_ie.dnn_length ; ++i) apn[i] = *(buffer + offset + i); - ++i; - } LOG_T(NAS, "PDU SESSION ESTABLISHMENT ACCEPT - APN: %s\n", apn); offset += psea_msg.dnn_ie.dnn_length; From d91cfdc6cfbf4883866a47904fcaa924ddf2c448 Mon Sep 17 00:00:00 2001 From: Angelo Athanassopoulos Date: Thu, 27 Oct 2022 20:05:16 +0200 Subject: [PATCH 3/6] PSEA - Remove of unused ASCII macro definition --- openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h | 4 ---- 1 file changed, 4 deletions(-) diff --git a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h index 393d2cb4b6..757455f340 100644 --- a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h +++ b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h @@ -54,10 +54,6 @@ #define ROC_MODIFY_QOS_RULE_WITHOUT_PF 0b110 /* Modify existing QoS rule without modifying packet filters */ #define ROC_RESERVED_1 0b111 /* Reserved */ -/* DNN - ASCII Codes */ - -#define ASCII_ACK 0x06 /* Delimiter in the DNN IEI */ - /* DNN - APN * TS 23.003 9.1 * The APN is composed of two parts, the APN Network Identifier (9.1.1) & The APN Operator Identifier (9.1.2). From 8e4ebb078a398872b60a70355701f19a134ffdda Mon Sep 17 00:00:00 2001 From: Angelo Athanassopoulos Date: Fri, 28 Oct 2022 12:39:31 +0200 Subject: [PATCH 4/6] PSEA - IEI DNN - added macro for min DNN length --- .../NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h index 757455f340..0e09425033 100644 --- a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h +++ b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.h @@ -57,9 +57,15 @@ /* DNN - APN * TS 23.003 9.1 * The APN is composed of two parts, the APN Network Identifier (9.1.1) & The APN Operator Identifier (9.1.2). - * The accumulated max length of APN is 100 bytes. + * + * The DNN information element has a length in the range of 3 to 102 octets. + * The Header is consisted of two octets, the DNN IEI and the Length of the DNN contents fields, each is 1 octet. + * The DNN value payload starts from the 3rd octet. + * The accumulated max length of APN payload is 100 octets. + * The min length of the APN payload is 1 octet. */ #define APN_MAX_LEN 100 +#define APN_MIN_LEN 1 /* Mandatory Presence IE - TS 24.501 Table 8.3.2.1.1 */ From 43f3d03ddb7991f2646bc0a5838022bf464fd3d8 Mon Sep 17 00:00:00 2001 From: Angelo Athanassopoulos Date: Fri, 28 Oct 2022 13:24:25 +0200 Subject: [PATCH 5/6] PSEA - IEI DNN - protect code from a bad DNN length received from the network --- .../NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c index 67c58f1e85..367fa0a71d 100644 --- a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c +++ b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c @@ -169,10 +169,14 @@ void capture_pdu_session_establishment_accept_msg(uint8_t *buffer, uint32_t msg_ psea_msg.dnn_ie.dnn_length = *(buffer + offset++); char apn[APN_MAX_LEN]; - for (int i = 0 ; i < psea_msg.dnn_ie.dnn_length ; ++i) - apn[i] = *(buffer + offset + i); + if(psea_msg.dnn_ie.dnn_length <= APN_MAX_LEN && + psea_msg.dnn_ie.dnn_length >= APN_MIN_LEN) { + for (int i = 0 ; i < psea_msg.dnn_ie.dnn_length ; ++i) + apn[i] = *(buffer + offset + i); + LOG_T(NAS, "PDU SESSION ESTABLISHMENT ACCEPT - APN: %s\n", apn); + } else + LOG_E(NAS, "PDU SESSION ESTABLISHMENT ACCEPT - DNN IE has invalid length\n"); - LOG_T(NAS, "PDU SESSION ESTABLISHMENT ACCEPT - APN: %s\n", apn); offset += psea_msg.dnn_ie.dnn_length; psea_iei = *(buffer + offset++); break; From 07abf4329d171c1c6cdc5965558e6bab17dd2520 Mon Sep 17 00:00:00 2001 From: Angelo Athanassopoulos Date: Fri, 28 Oct 2022 13:41:33 +0200 Subject: [PATCH 6/6] PSEA - IEI DNN - This is the last IEI in the message. Before this commit each time the message was captured, it entered the default switch statement, which is meant to show that we received an uknown IEI. Now after the DNN IEI, we set offset=msg_length, to exit the switch. --- openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c index 367fa0a71d..62d22698d7 100644 --- a/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c +++ b/openair3/NAS/COMMON/ESM/MSG/PduSessionEstablishmentAccept.c @@ -177,8 +177,7 @@ void capture_pdu_session_establishment_accept_msg(uint8_t *buffer, uint32_t msg_ } else LOG_E(NAS, "PDU SESSION ESTABLISHMENT ACCEPT - DNN IE has invalid length\n"); - offset += psea_msg.dnn_ie.dnn_length; - psea_iei = *(buffer + offset++); + offset = msg_length; break; default: