magma

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

All tagged milestones are available in public.

Repository on GitHub, which uses git. git is distributed.

Note unique identifiers at https://github.com/magma/magma/releases

All releases identified with git tags. https://github.com/magma/magma/releases

See https://github.com/magma/magma/releases/tag/v1.8.0 for compatible release notes.

No publically known vulnerabilities.

Issue tracker: https://github.com/magma/magma/issues/

https://github.com/magma/magma/issues

is:issue created:>2022-05-02 interactions:0 label:"type: bug" 24 open, 32 closed

is:issue created:>2022-05-02 interactions:>0 label:"type: bug" 37 open, 135 closed

The proportion of acknowledged is 24 / (32+37+135) = 0.11

This query shows relevant items: https://github.com/magma/magma/issues?q=is%3Aissue+label%3A%22type%3A+enhancement%22+created%3A%3E2022-06-13+

Status of items (2 open, 1 closed):

[Enhancement] Migration of hashlists to protobuf map for imei_htbl and sac_to_tacs_map_htbl #14734 (responded to on 6/13/2023) Enable S1AP Tester for ARM based AGW for magma-ci #14102 (responded to with much discussion)

[Enhancement] TRF Server VM should be migrated to Ubuntu 20.04 #13203 (closed)

Response rate: 100%.

https://github.com/magma/magma/issues/

https://github.com/magma/magma/security/policy

https://github.com/magma/magma/security/advisories/new

These URLs are access controlled.

https://github.com/magma/magma/actions

https://github.com/magma/magma/actions

Only FLOSS tools are used.

https://magma.github.io/magma/docs/basics/quick_start_guide

yarn run test

I don't know t

https://github.com/magma/magma

https://github.com/magma/magma/wiki/Contributing-Code

Release notes (https://github.com/magma/magma/issues/15127) show growth in tests to accompany new features "Testing with new gNB for 5G SA"

The checklist for PRs requires submitters to document how they tested, ideally with unit tests.

The project uses eslint and other linters.

Golang pass: code can be assumed to be strict because the language doesn't have a non-strict option.
C pass: "${CMAKE_C_FLAGS} ${C_FLAGS_PROCESSOR} -std=gnu99 -Wall -Wstrict-prototypes -fno-strict-aliasing 
C++ fail: -Wall is rarely used. (See find . -name CMakeLists.txt -exec grep " -W" "{}" \; -print)
Python N/A: "Python does not have a use strict or any near-equivalent as any of the safety features it provides are either mandatory or not available in the Python language, and does not have a use warnings"
Shell scripts: N/A
Javascript pass: tsconfig.json sets "strict": true

The project has a dedicated Security TPM. The TPM is trained in the eight principles from Salzer and Schroeder.

The project has a dedicated Security TPM. The TPM is trained in the eight principles from Salzer and Schroeder.

The security protocols and algorithms are dictated by a standards body, 3GPP.

The industry sector does not have high-quality FLOSS libraries for all algorithms and protocols. Some have had to be implemented from scratch. Part of the purpose of the project is to create FLOSS libraries.

In CSR creator, factoring modulus (RSA) default length is 2048 https://github.com/magma/magma/blob/d189c381ff763ef551f6ef6a4a2e9ff69a52f54a/orc8r/cloud/go/tools/create_csr/create_csr.go#L31

Configuring the software to disable smaller keylengths would require an architectural change so that this value was set at runtime rather than compile time.

The milenage algorithm is based on AES. The only GSM crypto algo we support is PreComputedA3A8 auth tuples. MD5 is required for Baicells enodeb - it's a hardware limitation for the purposes of compatibility with an important device. I found an implementation of MD5 in EncodeMsMppeKey, but it is only invoked by unit tests. RC4 is off by default but a user can configure and build for RC4 (see enable_header_enrichment). Dual_EC_DRBG is not used.

async function createUser(userObject: UserObject) { const {organization, email, password, role} = userObject; const salt = await bcrypt.genSalt(SALT_GEN_ROUNDS); const passwordHash = await bcrypt.hash(password, salt); const org = await createOrFetchOrganization(organization); await User.create({ email: email.toLowerCase(), password: passwordHash, role, networkIDs: [], organization: org.name, }); }

Formerly broken, but fixed in https://github.com/magma/magma/pull/12417

The part of the protocol stack that goes over the open internet uses HTTPS to connect with providers.

The application is not SAAS and it's not a REST client. Architecturally this type of weakness just wouldn't exist.

When we get a disclosure, we move aggressively. At this moment we are putting all possible resources into shipping fixes for a number of memory issues disclosed by an independent researcher. We expect those to go live with our upcoming 1.9.0 release.

Snyk secret scanner used. Results triaged.

SonarQube

SonarQube has standard rules

The analyzer runs in the CI.

Fuzzing has been done recently. It has detected items for which fixes are in progress, with ETA the upcoming release.

We have implemented unit tests for all the fuzzing failures identified.

The project uses Assertions for unit testing.

Work is in progress on fixes to known vulnerabilities discovered through fuzzing. We expect to ship fixes soon.