fix _gsm48_cc_trans_free(): send MNCC REL.ind on Clear Request

Calling gsm48_cc_tx_release() before mncc_release_ind() has a side
effect: the former may change CC state to GSM_CSTATE_RELEASE_REQ.
This makes the later send MNCC_REL_CNF instead of MNCC_REL_IND, so
if one of the call leg disconnects due to RF failure, the other one
will not be terminated correctly.

Makes both TC_{mo,mt}_call_clear_request TTCN-3 test cases pass.

Change-Id: I3ad4a99757878de3796027325627c87d9a4e93f1
Related: Id16969fe0de04445d1320a96d35cf1d48cc8cf09
Related: SYS#5340

3 files changed, 10 insertions, 12 deletions

diff --git a/src/libmsc/gsm_04_08_cc.c b/src/libmsc/gsm_04_08_cc.c
index ed29e8494..704e5964e 100644
--- a/src/libmsc/gsm_04_08_cc.c
+++ b/src/libmsc/gsm_04_08_cc.c
@@ -272,6 +272,13 @@ void _gsm48_cc_trans_free(struct gsm_trans *trans)
 
 	/* send release to L4, if callref still exists */
 	if (trans->callref) {
+		/* Send MNCC REL.ind (cause='Resource unavailable') */
+		if (trans->cc.mncc_initiated) {
+			mncc_release_ind(trans->net, trans, trans->callref,
+					 GSM48_CAUSE_LOC_PRN_S_LU,
+					 GSM48_CC_CAUSE_RESOURCE_UNAVAIL);
+		}
+
 		/* FIXME: currently, a CC trans that would not yet be in state GSM_CSTATE_RELEASE_REQ fails to send a
 		 * CC Release to the MS if it gets freed here. Hack it to do so. */
 		if (trans->cc.state != GSM_CSTATE_RELEASE_REQ) {
@@ -280,11 +287,6 @@ void _gsm48_cc_trans_free(struct gsm_trans *trans)
 			mncc_set_cause(&rel, GSM48_CAUSE_LOC_PRN_S_LU, GSM48_CC_CAUSE_RESOURCE_UNAVAIL);
 			gsm48_cc_tx_release(trans, &rel);
 		}
-		/* Resource unavailable */
-		if (trans->cc.mncc_initiated)
-			mncc_release_ind(trans->net, trans, trans->callref,
-					 GSM48_CAUSE_LOC_PRN_S_LU,
-					 GSM48_CC_CAUSE_RESOURCE_UNAVAIL);
 		/* This is a final freeing of the transaction. The MNCC release may have triggered the
 		 * T308 release timer, but we don't have the luxury of graceful CC Release here. */
 		gsm48_stop_cc_timer(trans);
diff --git a/tests/msc_vlr/msc_vlr_test_call.c b/tests/msc_vlr/msc_vlr_test_call.c
index b4e20be38..9ab1066a6 100644
--- a/tests/msc_vlr/msc_vlr_test_call.c
+++ b/tests/msc_vlr/msc_vlr_test_call.c
@@ -457,11 +457,7 @@ static void test_call_mt2()
 	fake_time_passes(15, 23);
 
 	btw("The call failed, the BSC sends a BSSMAP Clear Request");
-	/* FIXME: in this scenario, we send an MNCC_REL_CNF even though MNCC never asked us to MNCC_REL_REQ.  Legacy
-	 * behavior did get to both MNCC_REL_IND, then an MNCC_REL_REQ from MNCC as well as a final MNCC_REL_CNF, but
-	 * this only worked synchronously, i.e. only with internal MNCC. Instead of mimicking that, we need a proper
-	 * async solution that also works with a PBX. */
-	cc_to_mncc_expect_tx("", MNCC_REL_CNF);
+	cc_to_mncc_expect_tx("", MNCC_REL_IND);
 	dtap_expect_tx("032d0802e1af"); /* CC: Release */
 	expect_iu_release();
 	msc_a_release_cn(msub_msc_a(g_msub));
diff --git a/tests/msc_vlr/msc_vlr_test_call.err b/tests/msc_vlr/msc_vlr_test_call.err
index 1bcc48915..e8e3880aa 100644
--- a/tests/msc_vlr/msc_vlr_test_call.err
+++ b/tests/msc_vlr/msc_vlr_test_call.err
@@ -1302,6 +1302,8 @@ DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 + vlr_subscr_c
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 - vlr_subscr_cancel_attach_fsm: now used by 4 (attached,CC,active-conn,msc_a_fsm_releasing_onenter)
 DCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) Freeing transaction
 DCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) stopping pending timer T301
+DMNCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_REL_IND
+  MSC --> MNCC: callref 0x423: MNCC_REL_IND
 DCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) starting timer T308 with 10 seconds
 DCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) new state CALL_RECEIVED -> RELEASE_REQ
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_RELEASING}: Sending DTAP: CC GSM48_MT_CC_RELEASE
@@ -1309,8 +1311,6 @@ DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RES
 - DTAP --UTRAN-Iu--> MS: GSM48_MT_CC_RELEASE: 032d0802e1af
 - DTAP matches expected message
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
-DMNCC trans(CC:RELEASE_REQ IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_REL_CNF
-  MSC --> MNCC: callref 0x423: MNCC_REL_CNF
 DCC trans(CC:RELEASE_REQ IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) stopping pending timer T308
 DCC trans(CC:RELEASE_REQ IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) new state RELEASE_REQ -> NULL
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 - CC: now used by 3 (attached,active-conn,msc_a_fsm_releasing_onenter)