From 959c90492ffd284851e747414f966f8af3ecda05 Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Sat, 19 Oct 2019 12:24:31 +0200 Subject: ipa: Don't send non-SCCP data over IPA/SCCPlite The IPA/SCCPlite stacking is - as the name implies - constrained to the transport of SCCP messages. We have to reject any non-SCCP payload. Change-Id: I5e5a2879013ee8cf08aa4199b4bee498dcb61446 Fixes: OS#4235 --- src/ipa.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/ipa.c b/src/ipa.c index f3a7a52..d013916 100644 --- a/src/ipa.c +++ b/src/ipa.c @@ -57,6 +57,7 @@ int ipa_tx_xua_as(struct osmo_ss7_as *as, struct xua_msg *xua) { struct xua_msg_part *data_ie; + struct m3ua_data_hdr *data_hdr; struct msgb *msg; unsigned int src_len; const uint8_t *src; @@ -68,6 +69,13 @@ int ipa_tx_xua_as(struct osmo_ss7_as *as, struct xua_msg *xua) data_ie = xua_msg_find_tag(xua, M3UA_IEI_PROT_DATA); if (!data_ie || data_ie->len < sizeof(struct m3ua_data_hdr)) return -1; + data_hdr = (struct m3ua_data_hdr *) data_ie->dat; + + if (data_hdr->si != MTP_SI_SCCP) { + LOGPAS(as, DLSS7, LOGL_ERROR, "Cannot transmit non-SCCP SI (%u) to IPA peer\n", + data_hdr->si); + return -1; + } /* and even the data part still has the header prepended */ src = data_ie->dat + sizeof(struct m3ua_data_hdr); -- cgit v1.2.3