Skip to content

gtp: build the address of a GSN or Charging Gateway Address IE without a length - #5290

Merged
gpotter2 merged 2 commits into
secdev:masterfrom
bIackr0se:fix/gtpv1-gsn-address
Nov 12, 2026
Merged

gpotter2 merged 2 commits into
secdev:masterfrom
bIackr0se:fix/gtpv1-gsn-address

Conversation

@bIackr0se

Copy link
Copy Markdown
Contributor

Description

IE_GSNAddress and IE_CharginGatewayAddress condition their address fields on length == 4 and length == 16 (gtp.py#L658-L665, gtp.py#L891-L899). With the default length=None, IE_GSNAddress(ipv4_address="10.0.0.1") builds Length 0 and no address, and so do the GSN Address IEs in the default GTPUpdatePDPContextRequest and GTPPDUNotificationRequest. IE_CharginGatewayAddress defaults to length=4, so an ipv6_address is replaced by 127.0.0.1. 3GPP TS 29.060 sections 7.7.32 and 7.7.44 give Length 4 for IPv4 and 16 for IPv6.

This PR applies the IE_IP_Address design from #5278 to both IEs: one address MultipleTypeField, with ipv4_address and ipv6_address kept as deprecated names.

from scapy.all import raw, load_contrib
load_contrib("gtp")
from scapy.contrib.gtp import IE_GSNAddress, IE_CharginGatewayAddress
print(raw(IE_GSNAddress(ipv4_address="10.0.0.1")).hex(" "))
print(raw(IE_GSNAddress(ipv6_address="2001:db8::1")).hex(" "))
print(raw(IE_CharginGatewayAddress(ipv6_address="2001:db8::2")).hex(" "))

Before:

85 00 00
85 00 00
fb 00 04 7f 00 00 01

After:

85 00 04 0a 00 00 01
85 00 10 20 01 0d b8 00 00 00 00 00 00 00 00 00 00 00 01
fb 00 10 20 01 0d b8 00 00 00 00 00 00 00 00 00 00 00 02

tshark 4.6.9 decodes these addresses after the change and reports "unknown type or wrong length" for the GSN Address IEs before it. As with #5278, a Length other than 4 or 16 now reads that many octets into address, so the next IE stays aligned. Tests are added to test/contrib/gtp.uts.

This message was written with the help of AI (Claude Opus 5.5).

…t a length

IE_GSNAddress and IE_CharginGatewayAddress only built an address when
`length` was set to 4 or 16, so IE_GSNAddress(ipv4_address=...) built
Length 0 and no address. Both now use one `address` MultipleTypeField,
as IE_IP_Address does in gtp_v2, with ipv4_address and ipv6_address
kept as deprecated names.

AI-Assisted: yes (Claude Opus 5.5)
@codecov

codecov Bot commented Nov 12, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.16%. Comparing base (df72ff3) to head (b3ace4f).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #5290      +/-   ##
==========================================
+ Coverage   80.07%   80.16%   +0.08%     
==========================================
  Files         375      375              
  Lines       98740    98752      +12     
==========================================
+ Hits        79065    79161      +96     
+ Misses      19675    19591      -84     
Files with missing lines Coverage Δ
scapy/contrib/gtp.py 93.85% <100.00%> (+0.03%) ⬆️

... and 17 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@gpotter2
gpotter2 merged commit 7b38504 into secdev:master Nov 12, 2026
22 of 23 checks passed
@gpotter2

Copy link
Copy Markdown
Member

Thanks for the PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants