gbproxy: Avoid multiple tlli_info entries with the same IMSI

Currently it is possible to create several tlli_info entries with the
same IMSI.

This patch disables this by adding a check before the imsi field
is updated.

Sponsored-by: On-Waves ehf

3 files changed, 49 insertions, 38 deletions

diff --git a/openbsc/src/gprs/gb_proxy_tlli.c b/openbsc/src/gprs/gb_proxy_tlli.c
index 509e48991..beab9bb19 100644
--- a/openbsc/src/gprs/gb_proxy_tlli.c
+++ b/openbsc/src/gprs/gb_proxy_tlli.c
@@ -349,6 +349,39 @@ int gbproxy_check_tlli(struct gbproxy_peer *peer,
 	return tlli_info != NULL && tlli_info->enable_patching;
 }
 
+void gbproxy_assign_imsi(struct gbproxy_peer *peer,
+			 struct gbproxy_tlli_info *tlli_info,
+			 struct gprs_gb_parse_context *parse_ctx)
+{
+	int enable_patching;
+	struct gbproxy_tlli_info *other_tlli_info;
+
+	/* Make sure that there is a second entry with the same IMSI */
+	other_tlli_info = gbproxy_find_tlli_by_imsi(
+		peer, parse_ctx->imsi, parse_ctx->imsi_len);
+
+	if (other_tlli_info && other_tlli_info != tlli_info) {
+		char mi_buf[200];
+		mi_buf[0] = '\0';
+		gsm48_mi_to_string(mi_buf, sizeof(mi_buf),
+				   parse_ctx->imsi, parse_ctx->imsi_len);
+		LOGP(DGPRS, LOGL_INFO,
+		     "Removing TLLI %08x from list (IMSI %s re-used)\n",
+		     other_tlli_info->tlli.current, mi_buf);
+		gbproxy_delete_tlli(peer, other_tlli_info);
+	}
+
+	/* Update the IMSI field */
+	gbproxy_update_tlli_info(tlli_info,
+				 parse_ctx->imsi, parse_ctx->imsi_len);
+
+	/* Check, whether the IMSI matches */
+	enable_patching = gbproxy_check_imsi(peer, parse_ctx->imsi,
+					     parse_ctx->imsi_len);
+	if (enable_patching >= 0)
+		tlli_info->enable_patching = enable_patching;
+}
+
 struct gbproxy_tlli_info *gbproxy_get_tlli_info_ul(
 	struct gbproxy_peer *peer,
 	struct gprs_gb_parse_context *parse_ctx)
@@ -424,17 +457,8 @@ struct gbproxy_tlli_info *gbproxy_update_tlli_state_ul(
 		gbproxy_touch_tlli(peer, tlli_info, now);
 	}
 
-	if (parse_ctx->imsi && tlli_info && tlli_info->imsi_len == 0) {
-		int enable_patching;
-		gbproxy_update_tlli_info(tlli_info,
-					 parse_ctx->imsi, parse_ctx->imsi_len);
-
-		/* Check, whether the IMSI matches */
-		enable_patching = gbproxy_check_imsi(peer, parse_ctx->imsi,
-						     parse_ctx->imsi_len);
-		if (enable_patching >= 0)
-			tlli_info->enable_patching = enable_patching;
-	}
+	if (parse_ctx->imsi && tlli_info && tlli_info->imsi_len == 0)
+		gbproxy_assign_imsi(peer, tlli_info, parse_ctx);
 
 	return tlli_info;
 }
@@ -533,17 +557,8 @@ struct gbproxy_tlli_info *gbproxy_update_tlli_state_dl(
 		gbproxy_touch_tlli(peer, tlli_info, now);
 	}
 
-	if (parse_ctx->imsi && tlli_info && tlli_info->imsi_len == 0) {
-		int enable_patching;
-		gbproxy_update_tlli_info(tlli_info,
-					 parse_ctx->imsi, parse_ctx->imsi_len);
-
-		/* Check, whether the IMSI matches */
-		enable_patching = gbproxy_check_imsi(peer, parse_ctx->imsi,
-						     parse_ctx->imsi_len);
-		if (enable_patching >= 0)
-			tlli_info->enable_patching = enable_patching;
-	}
+	if (parse_ctx->imsi && tlli_info && tlli_info->imsi_len == 0)
+		gbproxy_assign_imsi(peer, tlli_info, parse_ctx);
 
 	return tlli_info;
 }
diff --git a/openbsc/tests/gbproxy/gbproxy_test.c b/openbsc/tests/gbproxy/gbproxy_test.c
index c4ebc73ea..cfbe68859 100644
--- a/openbsc/tests/gbproxy/gbproxy_test.c
+++ b/openbsc/tests/gbproxy/gbproxy_test.c
@@ -2959,10 +2959,10 @@ static void test_gbproxy_keep_info()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	/* TODO: There is one entry with this TLLI left (since there were 2
-	 *       before the detach precedure started. Add assertions when
-	 *       this is fixed.
-	 */
+	OSMO_ASSERT(!gbproxy_find_tlli(peer, local_tlli));
+	tlli_info = gbproxy_find_tlli_by_imsi(peer, imsi, sizeof(imsi));
+	OSMO_ASSERT(tlli_info);
+	OSMO_ASSERT(tlli_info->is_deregistered);
 
 	dump_global(stdout, 0);
 
diff --git a/openbsc/tests/gbproxy/gbproxy_test.ok b/openbsc/tests/gbproxy/gbproxy_test.ok
index 49ab7e3c4..0fb460b4b 100644
--- a/openbsc/tests/gbproxy/gbproxy_test.ok
+++ b/openbsc/tests/gbproxy/gbproxy_test.ok
@@ -4645,10 +4645,9 @@ result (ATTACH ACCEPT) = 92
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
     Attach Request count            : 5
-    TLLI cache size                 : 2
-    TLLI-Cache: 2
+    TLLI cache size                 : 1
+    TLLI-Cache: 1
       TLLI afe2b700/efe2b700 -> afe2b700/efe2b700, IMSI 12131415161718, AGE 0, STORED 1, IMSI acquisition in progress
-      TLLI efe2b700 -> efe2b700, IMSI 12131415161718, AGE 0
 PROCESSING ATTACH COMPLETE from 0x01020304:1111
 00 00 10 02 01 ef e2 b7 00 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 08 01 c0 3d 08 03 48 76 ea 
 
@@ -4668,10 +4667,9 @@ result (ATTACH COMPLETE) = 35
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
     Attach Request count            : 5
-    TLLI cache size                 : 2
-    TLLI-Cache: 2
+    TLLI cache size                 : 1
+    TLLI-Cache: 1
       TLLI afe2b700/efe2b700 -> afe2b700/efe2b700, IMSI 12131415161718, AGE 0
-      TLLI efe2b700 -> efe2b700, IMSI 12131415161718, AGE 0
 PROCESSING DETACH REQ from 0x05060708:32000
 00 00 10 02 00 ef e2 b7 00 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 8b 41 c0 2d 08 05 02 25 0a 59 61 41 
 
@@ -4687,9 +4685,8 @@ result (DETACH REQ) = 73
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
     Attach Request count            : 5
-    TLLI cache size                 : 2
-    TLLI-Cache: 2
-      TLLI efe2b700 -> efe2b700, IMSI 12131415161718, AGE 0
+    TLLI cache size                 : 1
+    TLLI-Cache: 1
       TLLI efe2b700 -> efe2b700, IMSI 12131415161718, AGE 0
 PROCESSING DETACH ACC from 0x05060708:32000
 00 00 10 02 01 ef e2 b7 00 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 08 01 c0 41 08 06 ae ff 70 
@@ -4706,10 +4703,9 @@ result (DETACH ACC) = 35
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
     Attach Request count            : 5
-    TLLI cache size                 : 2
-    TLLI-Cache: 2
+    TLLI cache size                 : 1
+    TLLI-Cache: 1
       TLLI 00000000, IMSI 12131415161718, AGE 0, DE-REGISTERED
-      TLLI efe2b700 -> efe2b700, IMSI 12131415161718, AGE 0
 Gbproxy global:
 Test TLLI info expiry