summaryrefslogtreecommitdiffstats
path: root/openbsc
AgeCommit message (Collapse)AuthorFilesLines
2015-05-03filter: Move the method definition to the filter moduleHolger Hans Peter Freyther9-59/+80
Move the filter methods to the filter module. This is still only usable for the NAT and the _dt/_cr filter routines need to move back to the bsc_nat in the long run.
2015-05-03filter: Move the gsm 04.08 filter to a common placeHolger Hans Peter Freyther6-4/+16
For customer requirements we want to be able to do filtering on the BSC as well. The same messages need to be scanned and the same access-lists will be looked at. In the future we might even split traffic based on the IMSI. Begin with moving the code to a new top level directory and then renaming and removing the nat dependency.
2015-05-02mgcp: Fix compiler warning on 64bit buildsHolger Hans Peter Freyther1-1/+1
ENDPOINT_NUMBER takes the difference of two pointers. On 64bit builds the difference is a long and the compiler then complains about the usage of abs. We will never have thousands of endpoints so silence the warning by casting the ENDPOINT_NUMBER to int. mgcp_vty.c:1381:34: warning: absolute value function 'abs' given an argument of type 'long' but has parameter of type 'int' which may cause truncation of value [-Wabsolute-value] rtp_port = rtp_calculate_port(ENDPOINT_NUMBER(endp), ^ ../../include/openbsc/mgcp_internal.h:206:31: note: expanded from macro 'ENDPOINT_NUMBER' #define ENDPOINT_NUMBER(endp) abs(endp - endp->tcfg->endpoints) ^ mgcp_vty.c:1381:34: note: use function 'labs' instead
2015-04-29sub: Remove the queue from the subscriber codeHolger Hans Peter Freyther10-201/+102
The idea of "subscriber_get_channel" was that different requests would be coordinated. At the same time we have seen that the "queue" can get stuck at both 31C3 and the rhizomatica installations. Voice calls and SMS do not need coordination. We should be able to send SMS on a voice channel and switch the MS from a SDCCH to a TCH in case we establish a voice call. The SMS code itself needs to coordinate to obey the limit of one SMS per direction but this should be enforced in the sms layer and not on the subscriber. Modify the code to have a simple paging coordination. The subscriber code will schedule the paging and register who would like to know about success/failure. This allowed to greatly simplify the paging response handling for the transaction code (and in fact we could move the transaction list into the subscriber structure now). The code gained to support to cancel the notification of a request (but not the paging itself yet). TODO: Cancel paging request in case no one cares about it anymore.
2015-04-29sub: Remove introspection of the "channel queue"Holger Hans Peter Freyther3-127/+4
Over the next commits the queuing of commits will be completely modified to remove the queue and move the scheduling/limits to the outer callers.
2015-04-29sub: Remove paging requests before dispatchingHolger Hans Peter Freyther1-4/+10
The dispatching might lead to the removal of more paging requests and makes "request" invalid. Remove it before calling the callback.
2015-04-29mncc: Select the codec similar to the modify handlingHolger Hans Peter Freyther1-1/+1
In case the default TCH/F codec is "EFR" and we do an early assignment from SDCCH to a TCH we would assign the TCH/H codec. This is because the lchan_type will be neither a TCH/H nor a TCH/F. At the same time the _gsm48_lchan_modify code to check for half vs. full-rate is the other way around. Align both. It is full-rate if it is not a TCH_H. This will have some other complications down the way (early assignment on cells with only TCH/H). So the mode should not depend on the _current_ channel but the kind of channel we want.
2015-04-29mgcp/test: Fix mgcp-transcoding assertion (Coverity)Jacob Erlbeck1-1/+1
In test_rtp_seq_state an assignment is accidently done within an assertion. This commit changes that into a comparison as it was intended. Fixes: Coverity CID 1295457, 1295458 Sponsored-by: On-Waves ehf
2015-04-28mgcp: Move assignment of src_codec downwardsJacob Erlbeck1-1/+2
Currently the src_codec const variable is set to &src_end->codec before src_end is checked against NULL. Since the assigment is just an address operation and the memory where it points to is only accessed after the NULL check, this does not harm technically. Nevertheless this is potential source for errors if that code is changed. This commit moves the definition below the NULL check. This does not comply with the coding style, but it cannot be split into definition and a later assignment due to the const qualifier. Sponsored-by: On-Waves ehf
2015-04-24mgcp: Allow to disable transcoding for trunksHolger Hans Peter Freyther3-0/+56
We might have compiled transcoding into the MGW but we don't want to enable it for a given user. Add a new switch that should allow that. I had manually tested the allow-transcoding/no allow VTY interface for the primary interface and a new trunk using show running-config.
2015-04-24mgcp: Ignore the case for finding a codecHolger Hans Peter Freyther1-5/+5
It is unlikely that GSM, gsm and GsM refer to different codecs. The mera mvts does send the audio codecs in lower case even if RFC 3551 has them in upper case (but copy and paste is sometimes too hard).
2015-04-23nat: Make mode-set patching optionalHolger Hans Peter Freyther7-6/+68
2015-04-23sgsn/gtp: Fill out the optional RAT typeHolger Hans Peter Freyther1-0/+5
Assume we are always a GERAN network right now.
2015-04-23misc: Fix warnings about size of size_t in printfHolger Hans Peter Freyther4-16/+16
Fixes warnings like: warning: format '%d' expects argument of type 'int', but argument 3 has type 'long int' [-Wformat]
2015-04-10nitb: Fix IMSI/IMEI buffer handling (Coverity)Jacob Erlbeck3-5/+4
Currently the handling of the buffers is not done consistently. Some code assumes that the whole buffer may be used to store the string while at other places, the last buffer byte is left untouched in the assumption that it contains a terminating NUL-character. The latter is the correct behaviour. This commit changes to code to not touch the last byte in the buffers and to rely on the last byte being NUL. So the maximum IMSI/IMEI length is GSM_IMSI_LENGTH-1/GSM_IMEI_LENGTH-1. For information: We assume that we allocate the structure with talloc_zero. This means we have NULed the entire imsi array and then only write sizeof - 1 characters to it. So the last byte remains NUL. Fixes: Coverity CID 1206568, 1206567 Sponsored-by: On-Waves ehf
2015-04-07nitb: Check source string length before calling strncpy (Coverity)Jacob Erlbeck2-0/+40
Currently some VTY command do neither check the length of the source string before calling strncpy nor ensure NUL-termination afterwards. This can to destination string buffers whose contents are not NUL-teminated. This commit adds checks and corresponding warnings to the VTY commands 'subscriber TYPE ID name .NAME" and "subscriber TYPE ID extension EXTENSION". Fixes: Coverity CID 1206570, 1206569 Sponsored-by: On-Waves ehf
2015-04-07gprs: Fix GSUP cancel_type handling (Coverity)Jacob Erlbeck2-1/+14
When handling an incoming GSUP cancellation request, the cancel_type if effectively ignored, such that is always handled as GPRS_GSUP_CANCEL_TYPE_UPDATE and never as WITHDRAW. This commit fixes the expression used to set the variable is_update_procedure. Fixes: Coverity CID 1267739 Sponsored-by: On-Waves ehf
2015-04-07nat: Fix timeslot range in 'show bsc mgcp' VTY commandJacob Erlbeck1-1/+1
Currently the inner loop in show_bsc_mgcp iterates of the timeslot interval [0, 31]. Timeslot 0 is not valid, which causes mgcp_timeslot_to_endpoint to generate a corresponding warning and to return an invalid endp value. That value causes an out-of-bound read access, possibly hitting unallocated memory. This patch fixes the loop range by starting with timeslot 1. Note that this does not prevent mgcp_timeslot_to_endpoint from returning an invalid endpoint index when called with arguments not within its domain. Addresses: <000b> ../../include/openbsc/mgcp.h:250 Timeslot should not be 0 [...] vty=0xb4203db0, argc=1, argv=0xbfffebb0) at bsc_nat_vty.c:256 max = 1 con = 0xb4a004f0 i = 0 j = 0 [...] ==15700== ERROR: AddressSanitizer: heap-use-after-free on address 0xb520be4f at pc 0x8062a42 bp 0xbfffeb18 sp 0xbfffeb0c Sponsored-by: On-Waves ehf
2015-04-07nat: Check for the access list in set command as wellHolger Hans Peter Freyther1-1/+8
I omitted the check as this was already done by the verify function for this command. Please Coverity and do the check again even if it is not necessary. I begin to doubt the usage of a "dedicated" verify method as well. Silences: Coverity CID 1293150
2015-04-07nat: Check the con->imsi for the tracked IMSIHolger Hans Peter Freyther1-2/+2
On DT messages we directly write into the tracked SCCP connection. This means "imsi" will always be NULL at this check. Change the code to use con->imsi Fixes: Coverity CID 1293151
2015-04-05nat: Add ctrl command to save the configurationHolger Hans Peter Freyther1-0/+31
$ bsc_control.py -d localhost -p 4250 -s net.0.save-configuration 0
2015-04-05nat: Add a ctrl command to add to an existing ACC listHolger Hans Peter Freyther2-0/+74
We want to have a program add entries to the allow list this can be done using: $ bsc_control.py -d localhost -p 4250 -s net.0.add.allow.access-list.NAME "^IMSI$"
2015-04-05nat: Inform others if an IMSI is rejectedHolger Hans Peter Freyther3-0/+26
In case one wants to monitor the access lists one there is now a trap for the IMSI.
2015-04-05nat: The reject cause of "-1" has failure meaning, change itHolger Hans Peter Freyther1-1/+1
bsc_stat_reject is treating -1 as parsing failure but for the global barring. Change it to another return value so it is not counted as parsing failure.
2015-04-04bts: "Repair" broken channels if we receive the release ackHolger Hans Peter Freyther2-3/+25
We had issues with odd behavior on the nanoBTS which lead to the introduction of the "broken" state. On busy multi BTS cells (e.g. rhizomatica) with wifi backhaul the timeout we set to wait for a RF Channe Release ACK is sometimes too little and channels are marked broken that look to be okay (besides the still to be determined delay). In case of a sysmoBTS we now know that we can change the state of a broken channel back to normal in case we do receive the right response. Manually verified using the Smalltalk BTS code PackageLoader fileInPackage: 'FakeBTS' bts := FakeBTS.BTS new. bts btsId: '1903/0/0'. bts connect: 'localhost'. bts waitForBTSReady. test := FakeBTS.OpenBSCTest new. test bts: bts. test requireAnyChannel ... wait for NITB output <0004> abis_rsl.c:223 (bts=0,trx=0,ts=0,ss=0) Timeout during deactivation! Marked as broken. ... process pending messages stdin next <0004> abis_rsl.c:735 (bts=0,trx=0,ts=0,ss=0) CHAN REL ACK for broken channel. Releasing it. So the channel went from broken to unallocated.
2015-04-01bsc: Change paging strategy based on override or notHolger Hans Peter Freyther1-6/+16
Change the paging strategy based on on if a LAC override is in place or not. In case we had changed the LAC we need to page on all the BTS. Change the "grace" handling to iterate over the BTS and filter out all non matching ones LAC in case no LAC handling is active. Manually verified all four cases with a single BTS: * No LAC handling and grace period * LAC handling and grace period * No LAC handling and not lock * LAC handling and lock. Related: SYS#1398
2015-04-01bsc: In preparation to the MT lac/ci patching split the codeHolger Hans Peter Freyther1-11/+21
For MT we can't page per lac as we don't know which BTS was the original one. Split the grace period and normal mode into two methods so we can bloat both of them later.
2015-04-01bsc: Allow to use different LAC/CI for the core-networkHolger Hans Peter Freyther6-8/+85
We need to use different LAC/CI towards the core network. It is a bit problematic as LAC/CI is a per BTS attribute so this feature only works if a BSC manages everything in the same LAC. Related: SYS#1398
2015-03-29libmgcp: Fail if transcoding can't be configuredHolger Hans Peter Freyther1-10/+14
We want to fail theallocation of an endpoint in case the transcoding can't be configured. Manually verified with: ./src/osmo-bsc_mgcp/osmo-bsc_mgcp -c doc/examples/osmo-bsc_mgcp/mgcp.cfg $ ./contrib/mgcp_server.py 0000 32 30 30 20 33 30 36 39 200 3069 0008 31 20 4F 4B 0D 0A 1 OK.. ('127.0.0.1', 2427) 0000 34 30 30 20 35 39 30 36 400 5906 0008 39 20 46 41 49 4C 0D 0A 9 FAIL.. ('127.0.0.1', 2427) 0000 34 30 30 20 33 35 34 36 400 3546 0008 33 20 46 41 49 4C 0D 0A 3 FAIL.. ('127.0.0.1', 2427) 0000 34 30 30 20 36 32 31 37 400 6217 0008 30 20 46 41 49 4C 0D 0A 0 FAIL.. ('127.0.0.1', 2427) Verified by not sending L: in the CRCX and then failing on the MDCX.
2015-03-28write_queue: Check the result of osmo_wqueue_enqueue and freeHolger Hans Peter Freyther3-3/+16
The write_queue is designed to have a maximum amount of pending messages and will refuse to take new messages when it has been reached. The caller can decide if it wants to flush the queue and add the message again, create a log. But in all cases the ownership of the msgb has not been transferred. Fix the potential memory leak in the failure situation.
2015-03-28rtp: Fixed problem of mute audio on some callsAndreas Eversberg1-1/+10
When reading from RTP socket, the first read() may fail right after connecting to remote socket. Subsequent read() will work as it should. If the remote socket does not open fast enough, the transmitted RTP payload can cause an ICMP (connection refused) packet reply. This causes the read to fail with errno=111. In all other error cases, the errno is logged at debug level. In all error cases, reading is not disabled. Conflicts: openbsc/src/libtrau/rtp_proxy.c [hfreyther: Fix typo, stop reading in all cases but ECONNREFUSED]
2015-03-28rtp: Fix memory leak fixed by Andreas without mentioning itHolger Hans Peter Freyther1-1/+1
We allocate the msgb at entry of the method and we always need to msgb_free it.
2015-03-28rtp: Add handling of BFI (Bad Frame Indicatior) of received TRAU framesAndreas Eversberg2-1/+18
If a bad TRAU frame is received, it is forwarded to MNCC application as GSM_BAD_FRAME. The application can now handle the GAP of missing audio. (e.g. by extrapolation) If TRAU frames are forwarded via RTP, bad frames are dropped, but frame counter and timestamp of RTP sender state is incremented. Conflicts: openbsc/src/libtrau/rtp_proxy.c [hfreyther: Merge without testcase, fix typo]
2015-03-28ignore debian build byproductsMax1-0/+1
Signed-off-by: Max <max.suraev@fairwaves.co>
2015-03-22rtp: And really catch up and remove all occurences of openbsc/rtp.hHolger Hans Peter Freyther1-1/+3
2015-03-22rtp: Catch up with the removal of the rtp.hHolger Hans Peter Freyther1-1/+1
2015-03-22rtp: Use osmocom/netif/rtp.h for the rtp structure definitionHolger Hans Peter Freyther4-63/+7
We depend on libosmo-netif unconditionally. Let's use this definition of rtp and have one portability issue less.
2015-02-10ctrl: Implement a global result for rf_locked0.14.0Holger Hans Peter Freyther2-2/+37
Create a one stop command to give a statement for the entire network. This can be used to check the policy and the state of the entire network.
2015-02-10ctrl: Add a command to check how many bts are configuredHolger Hans Peter Freyther2-0/+16
This can be used to query how many bts are configured to check if all of them are locked or not.
2015-02-10nitb: Move the rf-lock commands from osmo-bsc to libbscHolger Hans Peter Freyther2-86/+83
The bts.0.rf-state and rf_locked command have been moved from the osmo-bsc binary to libbsc. All tests continue to pass.
2015-02-08smpp: Fix potential crash in handling submitSMHolger Hans Peter Freyther1-3/+4
In case: * No message_payload and a 0 sm_length was used * esm_class indicates UDH being present * 7bit encoding was requested The code would execute: ud_len = *sms_msg + 1; Which is a NULL pointer dereference and would lead to a crash of the NITB. Enforce the limits of the sm_length parameter and reject the messae otherwise. Fixes: Coverity CID 1042373
2015-02-08nat: getopt returns "static" data no need to copy itHolger Hans Peter Freyther1-1/+1
I used strdup in case the data would not be valid from after the call to getopt and this creates a potential leak if a user is specifying multiple configuration files. If I depend on the fact that the string is a pointer into the argv[] array I can kill the strdup and fix the unlikely leak. Fixes: Coverity CID 1206578
2015-02-08smpp: Do not check conn for being nullHolger Hans Peter Freyther1-1/+1
We are deferencing conn earlier in this function without doing a null check. At the time deliver_to_esme is called the conn will always exist and even the lchan is likely to be present. Remove the null check for conn right now. Fixes: Coverity CID 1210594
2015-02-07nokia: Allow to set the reset time for the nokia btsSipos Csaba4-4/+26
2015-02-06sgsn: Add easy APN commands with just the nameHolger Hans Peter Freyther2-0/+41
For most configurations we don't address multiple GGSNs but only want to enforce a list of APNs. In the future we might add a special global GGSN context but not right now. Fixes: SYS#593
2015-02-06Revert "gprs: Block other GSUP procedures during PURGE_MS"Jacob Erlbeck4-146/+1
This reverts commit f81cacc6814dde73f203d125b0065d1451a98317. Since the PURGE MS retry mechanism had been removed, this feature is not used anymore. It just makes the code more complex. Conflicts: openbsc/include/openbsc/gprs_sgsn.h openbsc/src/gprs/gprs_subscriber.c openbsc/tests/sgsn/sgsn_test.c
2015-02-06sgsn: Select GGSN based on APNJacob Erlbeck5-6/+258
Currently the APN IE in the Activate PDP Contex Request and the PDP data that is stored with the subscriber is ignored completely. This commit adds the sgsn_mm_ctx_find_ggsn_ctx that checks the APN IE against the subscriber's PDP data entries if both are present. If there is no match, the request is rejected. If an APN IE has not been included but PDP data entries are present, the function checks all of these entries against the static 'apn' configuration to find a suitable entry. If an APN has not been determined so far and any APN is allowed, the configuration is checked with an empty APN string, to allow for default configurations based on the IMSI prefix only. If nothing of this succeeded but the request wasn't rejected either, and there is no 'apn' configuration at all or if any APN is allowed but a default configuration ist not present, the GGSN with id 0 is used (if present). Otherwise the request is rejected ('missing APN'). Ticket: OW#1334 Sponsored-by: On-Waves ehf
2015-02-06sgsn: Add sgsn_ggsn_ctx_free functionJacob Erlbeck2-0/+7
This function will be needed for testing, since the leak check would fail if the GGSN context are not cleaned up after use. Sponsored-by: On-Waves ehf
2015-02-06sgsn: Add functions to handle APN contextsJacob Erlbeck6-13/+249
This commit adds the exported functions apn_ctx_find_alloc, apn_ctx_free, apn_ctx_by_name, and apn_ctx_match to manage and retrieve APN to GGSN mappings. The following VTY commands are added to 'config-sgsn': - apn APN ggsn <0-255> - apn APN imsi-prefix PREFIX ggsn <0-255> which maps an APN gateway string to an SGSN id. The SGSN must be configured in advance. When matching an APN string, entries with a leading '*' are used for suffix matching, otherwise an exact match is done. When a prefix is given, it is matched against the IMSI. If several entries match, a longer matching IMSI prefix has precedence. If there are several matching entries with the same PREFIX, the entry with longest matching APN is returned. Ticket: OW#1334 Sponsored-by: On-Waves ehf
2015-02-06sgsn: Add PDP info to subscriber dataJacob Erlbeck4-9/+105
Currently the PDP info that is transmitted via GSUP is just parsed and then discarded. This commit adds a new data structure sgsn_subscriber_pdp_data and maintains a list of those in sgsn_subscriber_data. The PDP data is copied from an incoming GSUP UpdateLocationResult message. If that message contains the PDPInfoComplete flag, the list is cleared before new entries are added. The 'show subscriber cache' output now also shows the PDP data entries. Note that the InsertSubscriberData message is still not supported. [hfreyther: Added talloc_free in gprs_subscr_pdp_data_clear] Sponsored-by: On-Waves ehf