aboutsummaryrefslogtreecommitdiffstats
path: root/openbsc/tests/sgsn
AgeCommit message (Collapse)AuthorFilesLines
2015-01-26sgsn: Remove the "permanent" subscriber cacheHolger Hans Peter Freyther1-70/+10
The subscriber cache would help in case: * GPRS DETACH, GPRS ATTACH. In that case we might still have some cached authentication tuples we avoid another sendAuthenticationInfo request. * After a detach the cache expiry would make sure to eventually send a purgeMS to the HLR (which might be ignored). At the same time to make the cache work we will need to make sure to start and stop timers. In case we don't start we might accumulate subscribers. I am afraid that the above two benefits do not outweight the complexity of this implementation.
2015-01-26sgsn: Remove inactive LLME/MM after inactivity timeoutJacob Erlbeck1-1/+1
Currently old LLMEs and MM contexts that haven't been explicitly detached or cancelled are not removed until another request with the same IMSI is made. These stale entries may accumulate over time and severely compromise the operation of the SGSN. This patch implements age based LLME expiry, when the maximum age has been reached, the corresponding MM context is cancelled. If such an MM context doesn't exist, the LLME is unassigned directly. The implementation works as follows. - llme->age_timestamp is reset on each received PTP LLC message - sgsn_llme_check_cb is invoked periodically (each 30s) - sgsn_llme_check_cb sets the age_timestamp to the current time if it has been reset - sgsn_llme_check_cb computes the age and expires the LLME if it exceeds gprs_max_time_to_idle() Ticket: OW#1364 Sponsored-by: On-Waves ehf [hfreyther: Fix typo in comment LMME -> LLME]
2015-01-20sgsn/test: Make assert_substr safer (Coverity)Jacob Erlbeck1-2/+3
Currently, if assert_subscr were called with subscr == NULL, the later call to subscr_put might fail, as Coverity has complained. In addition, the call to subscr_put would free the subscr object if it were in the cache with a refcount of 0 at the time assert_substr was called. This patch adds a check for the subscr being non-NULL and reorders the checks, so that the subscr_put comes last. Fixes: Coverity CID 1264590 Sponsored-by: On-Waves ehf
2015-01-20gprs: Support the full cancellation procedureJacob Erlbeck1-0/+17
Currently no GSUP LocationCancellationResult message is sent back to the peer (HLR), if the procedure succeeded at the SGSN's side. This patch adds the missing message and put the whole request handling of this procedure into a separate function. Ticket: OW#1338 Sponsored-by: On-Waves ehf
2015-01-20gprs: Don't create a subscr entry on InsertSubscriberDataJacob Erlbeck1-2/+1
Currently gprs_subscr_rx_gsup_message creates a subscriber entry if such an entry doesn't exist for the IMSI within an InsertSubscriberData GSUP message. This behaviour is not compliant to GSM 09.02, 20.3.3.2 (Subscriber data management/SGSN) where it is defined, that an error ("Unidentified subscriber") shall be returned. This patch removes the case distinction, so that an existing subscriber entry is required for all incoming GSUP messages. Sponsored-by: On-Waves ehf
2015-01-20gprs: Add replies for all GSUP requestsJacob Erlbeck1-1/+46
Currently, an incoming GSUP request message isn't answered at all if it is not handled due to an error or missing implementation. This patch adds GSUP error replies for these requests (and only for requests). It also adds tests for these cases. Note that several of these tests check for GMM_CAUSE_MSGT_NOTEXIST_NOTIMPL, which will have to be changed, when the features are implemented. Sponsored-by: On-Waves ehf
2015-01-20gprs: Block other GSUP procedures during PURGE_MSJacob Erlbeck2-0/+93
GSM 09.02, 19.4.1.4 mandates that no other MAP procedures shall be started until the PURGE_MS procedure has been completed. This patch implements this by adding corresponding state and checks to gprs_subscr_purge, gprs_subscr_location_update, and gprs_subscr_update_auth_info. If an Update Location or a Send Auth Info Req procedure is not started because of blocking, the retry mechanism is aborted to shorten the blocking time. The outstanding Purge MS procedure itself is not aborted. Sponsored-by: On-Waves ehf
2015-01-18gprs: Use PURGE MS messagesJacob Erlbeck1-6/+10
When a subscriber entry is going to be deleted by SGSN and when the subscriber info has been obtained from a remote peer via GSUP, the peer should be informed before the entry is really deleted. For this purpose, MAP defines the PURGE MS procedure (see GSM 09.02, 19.1.4). This patch adds support for the PURGE_MS_REQ/_ERR/_RES messages and invokes the procedure when the subscriber entry is going to be removed. This only applies if GSUP is being used, the Update Location procedure has been completed successfully, and the subscriber has not been cancelled. The removal of the entry is delayed until a PURGE_MS_RES or PURGE_MS_ERR message is received. Note that GSM 09.02, 19.1.4.4 implies that the subscriber data is not to be removed when the procedure fails which is not the way the feature has been implemented. Note that handling 'P-TMSI freezing' is not implemented. Ticket: OW#1338 Sponsored-by: On-Waves ehf
2015-01-18sgsn/test: Add checks and reports to detect subscr leakageJacob Erlbeck1-4/+26
This commit adds talloc reports to log remaining NULL chunks after the terminates. It also adds explicit checks for empty subscriber lists. Sponsored-by: On-Waves ehf
2015-01-18sgsn/test: Add test that intercepts gprs_gsup_client_sendJacob Erlbeck3-3/+101
This test replaces gprs_gsup_client_send by a custom function, that emulates a GSUP remote peer by calling gprs_subscr_rx_gsup_message with responses for all requests. It then executes a full Attach/Detach cycle. Sponsored-by: On-Waves ehf
2015-01-18gprs: Add expiry timeout for subscriber entriesJacob Erlbeck1-1/+34
Set the expiry delay after the subscriber has been deleted (e.g. by freeing the MM context). If cancelled, the subscriber will be deleted immediately and no timeout will be set. If the expiry time is set to SGSN_TIMEOUT_NEVER, no timer will be started and the subscriber entry will be kept until it is cancelled. The following VTY command is added to the sgsn node: - subscriber-expiry-time <0-999999> set expiry time in seconds - no subscriber-expiry-time set to SGSN_TIMEOUT_NEVER The default is an expiry time of 0 seconds, which means that the subscriber entries are wiped out immediately after an MM context is destroyed. Note that unused MM contexts are not expired yet. Therefore the subscriber will only be expired after a successful MM detach. Sponsored-by: On-Waves ehf
2015-01-18sgsn/test: Refactor subscriber testJacob Erlbeck1-21/+24
The code sequence that checks, whether a subscriber is still reachable for a given IMSI, is repeated several times. This patch puts this code sequence into a single function and adds a check for the IMSI after the entry has been found. In addition, some comments are extended. Sponsored-by: On-Waves ehf
2015-01-18sgsn/test: Fix subscriber cleanupJacob Erlbeck1-1/+4
Currently the subscribers are not really deleted by cleanup_subscr_by_imsi, but kept in RAM instead. This patch fixes this and adds a test to verify, that the subscriber is really deleted afterwards. Sponsored-by: On-Waves ehf
2015-01-18gprs/test: Move subscr cleanup code into a separate functionJacob Erlbeck1-9/+12
Refactor several occurences of the same subscriber cleanup code into a seperate cleanup_subscr_by_imsi function. Sponsored-by: On-Waves ehf
2015-01-18gprs: Let GSUP parser functions return GMM causes on errorsJacob Erlbeck1-2/+3
Currently the GSUP message handling function in gprs_subscriber.c and the functions in gprs_gsup_messages.c are not consistent with respect to the return codes if an error happens. Albeit all error return codes are negative, the semantics of the absolute value are not clearly defined. In addition, some return codes are not passed to the calling function. This path changes these functions to always return a negated GMM cause value in case of errors. Return values of called parser functions are not longer ignored. Sponsored-by: On-Waves ehf
2015-01-18sgsn: Pass subscriber error causes to the GMM layerJacob Erlbeck1-1/+1
This patch extends gsm0408_gprs_access_denied and gsm0408_gprs_access_cancelled to accept GMM cause codes. These are then passed to the MS, unless gsm0408_gprs_access_cancelled is called with cause 0 (no error -> updateProcedure). Since gsm0408_gprs_access_denied uses GMM_CAUSE_GPRS_NOTALLOWED if the cause is not set, and the subscriber's error_cause is never set (and thus always 0), the SGSN's behaviour does not change with this patch. Sponsored-by: On-Waves ehf Conflicts: openbsc/include/openbsc/gprs_sgsn.h [hfreyther: Conflict due the removal of the unused authenticate flag]
2015-01-18gprs: Move protocol value_strings to gsm_04_08_gprs.cJacob Erlbeck1-0/+1
Currently the mapping between GSM 04.08 (GPRS) protocol specific numbers and their textual description was put into gprs_gmm.c and not exported. This commit moves the mappings to a new file gsm_04_08_gprs.c, renames some of them, and exports them via gsm_04_08_gprs.h. The following identifiers are renamed to match the corresponding type names: - gmm_cause_names -> gsm48_gmm_cause_names - gsm_cause_names -> gsm48_gsm_cause_names Sponsored-by: On-Waves ehf
2015-01-18sgsn/test: Extend tests to simulate lost GSUP requestsJacob Erlbeck2-12/+44
This patch extends test_gmm_attach to optionally resend Attach Requests until the SGSN responds to it instead of calling OSMO_ASSERT at a few places. The test_gmm_attach_subscr_gsup_auth test optionally uses this feature. It is called once in either mode. Sponsored-by: On-Waves ehf
2015-01-18sgsn/test: Add GMM test for a GSUP based attach procedureJacob Erlbeck2-0/+73
This test calls test_gmm_attach() where the mocked subscriber functions insert GSUP messages instead of manipulating the subscriber structure directly. Sponsored-by: On-Waves ehf
2015-01-18sgsn/test: Add wrapper for gprs_subscr_rx_gsup_messageJacob Erlbeck1-27/+21
Currently, several lines of boiler plate are needed around a call to gprs_subscr_rx_gsup_message. This patch puts all of this (including the call to gprs_subscr_rx_gsup_message) into a separate function. Sponsored-by: On-Waves ehf
2015-01-18sgsn: Add global require_update_location flagJacob Erlbeck1-0/+2
This flag is used to determine, whether the Update Location procedure shall be invoked. This is currently only set, when the 'remote' authorization policy is set. When the flag is set, sgsn_auth_update will not never be called directly by sgsn_auth_request, if an Attach Request procedure is pending, even if the remote connection fails for some reason. Sponsored-by: On-Waves ehf
2015-01-18sgsn: Replace subscr.authenticate by global require_authentication flagJacob Erlbeck1-2/+2
Currently the flag 'authenticate' is managed per subscriber. This patch replaces that flag by a global cfg.require_authentication flag that enables/disables the use of the Auth & Ciph procedure for every subscriber. The flag is set by the VTY, if and only if the authorization policy is 'remote'. The VTY command - update-subscriber imsi IMSI insert authenticate <0-1> is removed. Sponsored-by: On-Waves ehf
2015-01-18sgsn: Integrate the GSUP client into the SGSNJacob Erlbeck1-0/+2
This commit adds GSUP client configuration (via VTY), connection set up, and real message sending. The following configuration commands are added: - gsup remote-ip A.B.C.D set server IP address - gsup remote-port PORT set server TCP port Ticket: OW#1338 Sponsored-by: On-Waves ehf
2015-01-18sgsn/test: Fix msgb freeing in mocked bssgp_tx_dl_udJacob Erlbeck1-2/+2
Currently the mocked bssgp_tx_dl_ud function used for testing in sgsn_test.c does not free the msg as it is done by the original function. This leads to a msgb leak in the test. This patch fixes the test code accordingly and uncomments the assertion that checks for left-over msgbs. Sponsored-by: On-Waves ehf
2015-01-18sgsn/test: Add checks and reports to detect msgb leakageJacob Erlbeck1-0/+4
This commit adds talloc reports to log remaining chunks after the testing has been finished. It also adds a (currently disabled) check, that no msgbs are allocated after running the tests. Sponsored-by: On-Waves ehf
2015-01-10gprs: Add subscriber functions to create/handle GSUP messagesJacob Erlbeck3-0/+168
This patch extends gprs_subscr_query_auth_info and gprs_subscr_location_update to create GSUP messages with the help of a static gprs_subscr_tx_gsup_message function. A corresponding gprs_subscr_rx_gsup_message is added which takes a messages, gets the subscr, and updates it accordingly. Sponsored-by: On-Waves ehf [hfreyther: Added a msgb_free gprs_subscr_tx_gsup_message]
2014-12-24sgsn: Add a subscriber based authentication phaseJacob Erlbeck3-37/+99
This implements the MAP way of subscriber validation when the MS tries to perform an Attach Request: 1. perform authentication (optionally invoke the sendAuthInfo procedure), starts the Auth & Ciph procedure 2. perform update location 3. insert subscriber data 4. finish the update location 5. Attach Accept / Attach Reject The authentication triplets are used and eventually updated if all of them have been used. This is currently accessible via the VTY interface by the following commands: - update-subscriber imsi IMSI update-auth-info - update-subscriber imsi IMSI update-location-result (ok|ERR-CAUSE) Sponsored-by: On-Waves ehf
2014-12-24sgsn: Add support for authentication tripletsJacob Erlbeck2-0/+66
This commit add data structures, functions, initialization, and VTY commands for per subscriber authentication triplets. The following VTY command is added: - update-subscriber imsi IMSI \ insert auth-triplet <1-5> sres SRES rand RAND kc KC Note that the triplets are not really used by the SGSN yet. Sponsored-by: On-Waves ehf
2014-12-10sgsn: Support subscriber based authenticationJacob Erlbeck2-0/+56
This commit mainly extends sgsn_auth.c to use and support the auth_state SGSN_AUTH_AUTHENTICATE. It will be activated when IMSI and IMEI are available, authentication is required (subscr->sgsn_data->authenticate is set), but the MM context is not marked as authenticated. If the state has been set to SGSN_AUTH_AUTHENTICATE and sgsn_auth_update() is called, the GMM layer will be informed by invoking gsm0408_gprs_authenticate(). Sponsored-by: On-Waves ehf
2014-12-09sgsn: Add gsm0408_gprs_access_cancelledJacob Erlbeck2-0/+118
This function is called to delete an established MM context silently without invoking a detach procedure. It is called when a subscriber is cancelled by the HLR. This generally happens, when an MS has moved to another routing area and has to use another SGSN. Sponsored-by: On-Waves ehf
2014-12-09sgsn: Integrate subscriber handling into the SGSNJacob Erlbeck3-5/+58
This commit adds a new authorization policy 'remote' and uses the subscriber cache for authorization when this policy is being used. Note that there is no remote backend implemented yet. After the IMSI/IMEI have been acquired, a request would be sent to the remote peer. The attach/auth-ciph procedure continues when authorization info has been received from the peer. This means, that gprs_subscr_update() must be called then to tell the GMM layer that it can proceed. A later commit will add VTY commands to do this manually. Sponsored-by: On-Waves ehf
2014-12-09sgsn: Add gprs_subscriber.cJacob Erlbeck3-1/+103
This patch adds GPRS specific functions for gsm_subscriber objects (allocation, retrieval, deletion) and subscriber data requests/updates. The sgsn_update_subscriber_data callback is used to notify the sgsn about updates and is extended by a parameter that passes a reference to a gsm_subscriber. Sponsored-by: On-Waves ehf
2014-12-02sgsn/test: Add test case for unexpected Detach AcceptsJacob Erlbeck2-0/+36
The commit "sgsn: Don't send XID reset after Detach Accept" fixed the SGSN to not respond to a Detach Accept message when there is no MM context. This patch adds a test case to verify, that there is really no message sent in that case. The test fails when the commit mentioned aboved is reverted. Sponsored-by: On-Waves ehf
2014-12-02sgsn/test: Don't rely on the actual PRNG sequenceJacob Erlbeck1-1/+9
Currently the expected P-TMSI generated by the SGSN is hard-coded into the test. This adds a dependency on the implementation of rand() and thus the libc used. This breaks the test e.g. on FreeBSD. This patch modifies test_gmm_attach() to srand(1) first, generate the P-TMSI, and finally srand(1) again before starting the test. Sponsored-by: On-Waves ehf
2014-11-14sgsn: Remove explicit sgsn_instance parametersJacob Erlbeck1-1/+1
Currently the function in sgsn_auth.c either have an sgsn_config or an sgsn_instance parameter. Since then global sgsn variable is already being used in that file and since other parts of the SGSN related code also rely on a global sgsn singleton, these parameters pretend to provide a flexibility that is not really supported. Therefore this patch removes these parameters except for the ACL related functions, which do not call code that uses the sgsn variable. Sponsored-by: On-Waves ehf
2014-11-14sgsn: Don't assign a new P-TMSI if one is pendingJacob Erlbeck2-0/+196
Currently every time an RA Update Req or an Attach Req is processed, a new P-TMSI is allocated. When an MS issues another of these messages before it has completed the first procedure, old_ptmsi is replaced by ptmsi (and thus lost) and ptmsi is replaced by the newly allocated P-TMSI. This can confuse the gbproxy, which can loose track of the logical link then. At least a Blackberry emits a double set of RA Upd Req messages from time to time which may be just 20ms apart. This patch adds a check whether mm->ptmsi or mm->old_ptmsi are set. If both are set, the P-TMSI is not re-allocated. This is only the case, when the Complete message has not been received yet, since that message will reset old_ptmsi. Sponsored-by: On-Waves ehf
2014-11-14sgsn: Cleanup after RA Update Reject / Attach RejectJacob Erlbeck2-0/+149
Currently, the LLME is not cleaned up after sending an RA Update Reject. This happens after entering a routing area from outside, since in that case the SGSN sends an RA Update Reject (implicitly detached) which causes the MS to restart the attach procedure. The LLME is also not updated if an Attach Request with message errors (encoding, invalid MI type) is received or if an MM context cannot be allocated. This patch changes gsm48_rx_gmm_ra_upd_req and gsm48_rx_gmm_att_req to unassign the LLME or free the MM context (if available) after a Reject message has been sent. Ticket: OW#1324 Sponsored-by: On-Waves ehf
2014-11-14sgsn: Add 'acl-only' authentication policyJacob Erlbeck1-1/+1
Currently the VTY 'auth-policy' command results in setting or clearing the acl_enabled flag. This also enables the matching of the MCC/MNC prefix of the IMSI. This patch adds an additional policy 'acl-only' which disables the MCC/MNC matching and relies on the ACL only. Sponsored-by: On-Waves ehf
2014-11-14sgsn: Move IMSI authorization to gsm48_gmm_authorizeJacob Erlbeck1-3/+4
Currently the IMSI is only checked immediately when an Attach Request is received that contains an IMSI IE. If it contains a P-TMSI instead, access is always granted. This commit moves the IMSI check to gsm48_gmm_authorize where it is applied when IMSI and IMEI have been acquired. This fixes the authorization when the Attach Accept doesn't contain an IMSI. Sponsored-by: On-Waves ehf
2014-11-14sgsn: Cleanup GMM state transitionsJacob Erlbeck1-5/+1
Currently the GMM state is set to GMM-REGISTERED when an Attach Accept or a RA Update Accept message is sent, even if a new P-TMSI is included. In this case 04.08 requires (see 4.7.3.1.3 and 4.7.5.1.3), that the state is set to GMM-COMMON-PROCEDURE-INITIATED when the Accept is sent. When the Complete is received, the SGSN shall set the state to GMM-REGISTERED. This patch modifies the state updates accordingly. Sponsored-by: On-Waves ehf
2014-11-11sgsn/test: Add test_gmm_attachJacob Erlbeck2-1/+123
This test checks the attach procedure until the Attach Complete is received. Note that authorization and GMM state updates are not working properly yet. Sponsored-by: On-Waves ehf
2014-11-11sgsn/test: Move message sending to send_0408_messageJacob Erlbeck1-29/+24
This replaces serveral occurences of duplicated code for message creation and sending (passing to gsm0408_gprs_rcvmsg) into a single function. In addition, the sgsn_tx_counter is always reset within send_0408_message to simplify the code that checks for the number of messages sent. Sponsored-by: On-Waves ehf
2014-11-05sgsn: Unassign the LLME after GMM Status without mmctxJacob Erlbeck2-0/+40
Currently the LLME is not deleted when a GMM Status message is received for which a mmctx cannot be found. This can fill the LLME list with unneeded entries. This patch adds code to unassign the LLME in that case. Ticket: OW#1324 Sponsored-by: On-Waves ehf
2014-10-27sgsn: Handle Detach Requests even when there is no mmctxJacob Erlbeck2-0/+37
Currently, when a Detach Request is received with an unknown TLLI, it is answered by another Detach Request (!), even when a power_off Type is used. This patch uses gsm48_rx_gmm_det_req to handle the message instead. So this function is changed to cope with a NULL mmctx. In that case it doesn't unassign the llme, so this must be done manually afterwards. Sponsored-by: On-Waves ehf
2014-10-27sgsn: Only send Detach Accept (MO) if power_off isn't setJacob Erlbeck1-1/+1
Currently, every time the SGSN received a Detach Request from the MS via an established logical link, it is answered by a Detach Accept. This violates the specification (GSM 04.08, 4.7.4.1.2 and .3), which states, that it should only be sent, if "the detach type IE value indicates that the detach request has not been sent due to switching off". This patch adds a conditional to limit the sending of Detach Accept accordingly. Sponsored-by: On-Waves ehf
2014-10-27sgsn/test: Add test case for Detach Request (MO, power-off = 1)Jacob Erlbeck2-0/+64
Currently only a Detach Request (MO) message with power_off = 0 is checked. This commit adds a new test case with power_off set to 1. It also adds checks for the number of messages generated by the SGSN to verify that these messages are handled differently. Note that the handling of power_off isn't implemented yet. Therefore the corresponding assertion is being disabled yet. Sponsored-by: On-Waves ehf
2014-10-27sgsn/test: Move MM context allocation into separate functionJacob Erlbeck1-10/+25
This refactores serveral code lines needed for the allocation of MM contexts into the new function alloc_mm_ctx. Sponsored-by: On-Waves ehf
2014-10-27sgsn: Moved IMSI ACL management to sgsn_auth.cJacob Erlbeck1-0/+1
Currently the ACL code is located in sgsn_vty.c. This commit moves this to a new file sgsn_auth.c as a first step to make authorization more flexible in order to implement remote acquisition on subsciber data. Sponsored-by: On-Waves ehf
2014-10-09sgsn: Free MM context after receiving a Detach RequestJacob Erlbeck1-3/+1
On a Detach/Re-attach cycle the Address Sanitizer detected a use-after-free kind of problem. That is because we tried to destroy the LLME twice. The first time it is destroyed as part of the Detach handling ans the second time it is destroyed as part of destroying the old MM context. In case the GPRS GMM detach message is lost the SGSN needs to reply besides not having a MM entry. The alternative would have been to add NULL checks for all usages of ctx->llme which would not have helped with the readability. Sponsored-by: On-Waves ehf
2014-10-09sgsn: Add test that exposes a dangling pointer to the LLMEHolger Hans Peter Freyther2-0/+61
On detach the LLME get's unassigned (and hence destroyed) but the GMM context will still point to that dead structure.
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-19 12:53:36 +0000