Skip to content

gtp: build an MS International Number IE without a length - #5295

Open
bIackr0se wants to merge 1 commit into
secdev:masterfrom
bIackr0se:fix/gtpv1-msisdn
Open

bIackr0se wants to merge 1 commit into
secdev:masterfrom
bIackr0se:fix/gtpv1-msisdn

Conversation

@bIackr0se

Copy link
Copy Markdown
Contributor

Description

IE_MSInternationalNumber reads its digits with length_from=lambda x: x.length - 1 (gtp.py#L686). With the default length=None, building the IE raises TypeError before IE_TLV.post_build can compute the Length, so IE_MSInternationalNumber(), IE_MSInternationalNumber(digits=...) and any message that carries one cannot be built unless the caller counts the octets by hand. The existing "basic instantiation" test creates the IE but never builds it.

This PR returns None from length_from when no length is set, which makes StrFixedLenField encode every digit, as IE_IMEI already does. IE_TLV.post_build then writes the Length (the flags octet plus the digit octets, 3GPP TS 29.060 section 7.7.33). Dissection and an explicit length are unchanged.

from scapy.all import raw, load_contrib
load_contrib("gtp")
from scapy.contrib.gtp import IE_MSInternationalNumber
print(raw(IE_MSInternationalNumber(digits="491701234567")).hex(" "))
print(raw(IE_MSInternationalNumber(digits="4917012345678")).hex(" "))

Before:

TypeError: While building field 'digits': unsupported operand type(s) for -: 'NoneType' and 'int'

After:

86 00 07 91 94 71 10 32 54 76
86 00 08 91 94 71 10 32 54 76 f8

tshark 4.6.9 decodes both MSISDNs in a Create PDP Context Request built this way (E.164 number (MSISDN): 491701234567 and 4917012345678). A test is added to test/contrib/gtp.uts.

This message was written with the help of AI (Claude Opus 5.5).

IE_MSInternationalNumber took the length of its digits from
`length - 1`, so building it with the default `length=None` raised
TypeError (`None - 1`). The digits field now uses every digit when
no length is given, as IE_IMEI does; IE_TLV.post_build then counts
the flags octet and the digits.

AI-Assisted: yes (Claude Opus 5.5)
@codecov

codecov Bot commented Nov 13, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.66%. Comparing base (0e2f6ba) to head (d255913).

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #5295      +/-   ##
==========================================
+ Coverage   80.06%   80.66%   +0.60%     
==========================================
  Files         375      375              
  Lines       98775    98775              
==========================================
+ Hits        79083    79676     +593     
+ Misses      19692    19099     -593     
Files with missing lines Coverage Δ
scapy/contrib/gtp.py 93.85% <ø> (ø)

... and 28 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant