diff options
| author | Harald Welte <laforge@gnumonks.org> | 2019-02-09 09:33:33 +0100 |
|---|---|---|
| committer | Harald Welte <laforge@gnumonks.org> | 2019-02-12 20:08:56 +0100 |
| commit | e160ac6ea5850211f26495466a1f4d11b82714d2 (patch) | |
| tree | 995c1ec7810c61b64b2c74a0ecd042594c37bb67 | |
| parent | 96bded3ebd1f26e775da15f2bc18c8649ca386e6 (diff) | |
OML: Reject segmented OML messages
TS 12.21 describes segmenting of OML messages using placement
fist/middle/last and the "sequence' number of the OML header. We don't
implement this and hence must ignore or reject any related messages.
Before this patch however, we simply treated such segments as if they
were a complete OML message. Let's fix that.
Change-Id: Idd42cf4edc1bf9ab366853bd9b0f7afd9c060910
Closes: OS#3795
| -rw-r--r-- | src/common/oml.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/src/common/oml.c b/src/common/oml.c index c98ba9cd..d389e298 100644 --- a/src/common/oml.c +++ b/src/common/oml.c @@ -1424,7 +1424,7 @@ int down_oml(struct gsm_bts *bts, struct msgb *msg) struct abis_om_hdr *oh = msgb_l2(msg); int ret = 0; - if (msgb_l2len(msg) < 1) { + if (msgb_l2len(msg) < sizeof(*oh)) { oml_tx_failure_event_rep(&bts->mo, OSMO_EVT_MAJ_UKWN_MSG, "OML message too short\n"); msgb_free(msg); @@ -1432,6 +1432,14 @@ int down_oml(struct gsm_bts *bts, struct msgb *msg) } msg->l3h = (unsigned char *)oh + sizeof(*oh); + /* We don't implement de-segmentation of segmented OML messages */ + if (oh->placement != ABIS_OM_PLACEMENT_ONLY || oh->sequence != 0) { + oml_tx_failure_event_rep(&bts->mo, OSMO_EVT_MAJ_UKWN_MSG, + "Unsupported segmented O&M message\n"); + msgb_free(msg); + return -EIO; + } + switch (oh->mdisc) { case ABIS_OM_MDISC_FOM: if (msgb_l2len(msg) < sizeof(*oh)) { |