aboutsummaryrefslogtreecommitdiffstats
path: root/openbsc/src/libmsc
AgeCommit message (Collapse)AuthorFilesLines
2014-05-06osmo-nitb support for codec negotiationAndreas Eversberg3-63/+110
The caller's most preferred codec is selected out of the union of codecs, which both parties support. Since codec negotiation is done automatically, there is no need to define codec for TCH/F and TCH/H via VTY anymore.
2014-05-06Add check to tch_map(), if RTP sockets existAndreas Eversberg1-0/+11
2014-05-06Fix: If half rate channel is used, indicate hr when modifying channel modeAndreas Eversberg1-1/+2
2014-05-06Add check for non existing lchan at tch_frame_down()Andreas Eversberg1-0/+4
Traffic cannot sent to BTS, if there is (currently) no logical channel associated with the transaction. This happens, if TCH traffic is received from upper layer, but there is no lchan available before completing immediate assignment, handover or assignment process.
2014-05-06Allow dynamic RTP payload types between application and MNCC interfaceAndreas Eversberg1-0/+2
Since EFR/AMR/HR codecs use dynamic RTP payload, the payload type can be set. If it is set, the frame type must be set also, so OpenBSC knows what frame types are received via RTP. This modification only affects traffic beween application and MNCC interface, not the RTP traffic between OpenBSC and BTS.
2014-05-06Add traffic forwarding via RTP to remote applicationAndreas Eversberg3-38/+176
Instead of forwarding traffic through MNCC interface, traffic can be forwarded to a given RTP peer directly. A special MNCC message is used to control the peer's destination. The traffic can still be forwarded through MNCC interface when this special MNCC message is not used. It also works with E1 based BTSs. In conjunction with LCR's "rtp-bridge" feature, the RTP traffic can be directly exchanged with a remote SIP endpoint, so that the traffic is not forwarded by LCR itself. This way the performance of handling traffic only depends on OpenBSC and the remote SIP endpoint. Also the traffic is exchanged with the SIP endpoint without transcoding, to have maximum performance. Increment MNCC version to 5.
2014-05-06Add support for AMR frames to MNCC/RTP interfaceAndreas Eversberg1-0/+1
AMR rate is currently fixed to 5.9k.
2014-05-06nitb: Add ctrl command to get/set maximum amount of SMS delivery failuresfairwaves/ctrl-interfaceIvan Kluchnikov2-0/+39
2014-05-06nitb: Add ctrl commands to get paging counters, state of oml link and SMS ↵Ivan Kluchnikov1-0/+12
queue status
2014-04-30db: Fix fall-out with the subscriber removal in the subscriber deletion codeHolger Hans Peter Freyther1-2/+2
The sender_id is gone so the code that attempted to delete SMS didn't work anymore. Delete the SMS based on src_addr or the dest_addr. Fixes: ====================================================================== ERROR: testSubscriberAddRemove (__main__.TestCtrlNITB) ---------------------------------------------------------------------- Traceback (most recent call last): File "tests/ctrl_test_runner.py", line 379, in testSubscriberAddRemove r = self.do_set('subscriber-delete-v1', '2620345') File "tests/ctrl_test_runner.py", line 114, in do_set return self.recv_msgs()[id] KeyError: 1002
2014-04-30db: Add testcase for the db migration.Holger Hans Peter Freyther1-0/+2
2014-04-30sms: Add code to migrate the database to the new schemaHolger Hans Peter Freyther1-16/+193
This is mostly based on Alexander's migration code. The code adds transaction handling and some sanity checks and cleanups to the code. We made the decision to fork the sms_from_result method and freeze it to that version. This way sms_from_result can move forward without having to deal with legacy.
2014-04-30sms: Do not store received id in the SMS database.Alexander Chemeris1-21/+10
That was a bad idea from the very beginning. A visible result of this is a wrong SMS routing when you change subscriber extensions, while having queued SMS. It's also a very wrong thing from the code layering perspective. I think the next logical step should be to remove "receiver" pointer from the gsm_sms structure into a structure, special for the internal SMS queue.
2014-04-30sms: Kill the sms->sender and use addr/ton/npi throughout the codeHolger Hans Peter Freyther3-34/+42
This is an incompatible database schema change. Store the type of the address in the database for both the sender and the receiver. Currently it is possible to use SMPP to store a SMS and the NPI and TON will be lost on the delivery of the SMS. The schema is changed to make the delivery always use the right NPI/TON. This patch is not ready for the master branch as there is no upgrade path for the HLR yet.
2014-04-04bsc/msc: Extension can never be NULL use strlen insteadHolger Hans Peter Freyther1-1/+1
Fixes: Coverity CID 1040717
2014-04-04msc: Name is never NULL use strlen to check if it is emptyHolger Hans Peter Freyther1-1/+1
Fixes: Coverity CID 1040716
2014-03-23nitb/ctrl: Implement a command to list all active subscribersHolger Hans Peter Freyther2-0/+62
This is only useful for small networks. List the IMSI and MSISDN of all active subscribers. Fixes: SYS#266
2014-03-23nitb/ctrl: Implement creating and deleting subscribersHolger Hans Peter Freyther2-0/+131
Sadly there is no proper foreign key relationship on the tables that related to the Subscriber. This means we can't use a DELETE with Cascade and need to delete everything by hand. To make things worse maybe the SMS/Paging code is still using the subscriber making the operation more dangerous. I had added NULL checks for sender_id/receiver_id at 30C3 so we should not crash in this situation. Fixes: SYS#274
2014-03-23nitb/ctrl: Add command to add/modify a subscriber to the databaseHolger Hans Peter Freyther2-1/+107
The test has been manually verified. Executing the select for the subscribers showed: sqlite> select * from Subscriber; 1|2014-03-23 12:12:46|2014-03-23 12:19:09|2620345||445567|1||0| This created a subscriber with the right IMSI, MSISDN and has it authorized. Fixes: SYS#275
2014-03-20mncc: Add support for half rate V1 frames to MNCC/RTP interfaceAndreas Eversberg1-2/+4
2014-03-20mncc: Use helper function to check if an MNCC frame is data (speech/traffic)Andreas Eversberg2-16/+9
Rename method mncc_rcv_tchf() to mncc_rcv_data(), because the check applies to all types of data frames, not only TCH/F data.
2014-03-20mncc: Complete definitions for all speech traffic frames at MNCC interfaceAndreas Eversberg1-1/+5
The new definitions are: half rate and AMR Change of definition name for bad frame, because it applies to all types of traffic, not only TCH/F. Increase MNCC interface version to 4. Version 3 is skipped, because it was used by older version of Linux-Call-Router which is incompatible with the current version of the MNCC interface.
2014-03-09sms: Rename gsm340_gen_tpdu() to gsm340_gen_sms_deliver_tpdu()Alexander Chemeris1-5/+5
Rename gsm340_gen_tpdu() to gsm340_gen_sms_deliver_tpdu() to show that it generates SMS-DELIVER TPDU and is not a generic function.
2014-03-09db,sms: Rename db_sms_mark_sent() to db_sms_mark_delivered()Alexander Chemeris2-3/+3
In MT-SMS the message is being delivered. Make the naming follow that. The schema still refers to "sent" while it should be "delivered" too.
2014-03-07db: Remove the german from the log messageAlexander Chemeris1-1/+1
2014-03-06smpp_smsc: Fix integer overflow in read return value and msgb_alloc()Daniel Willmann1-6/+6
The size parameter of msgb_alloc is uint16_t so any length value above 65535 will allocate a msgb with incorrect size. This patch changes the type of rdlen and rc to ssize_t (the return value of read) and guards against the read length being larger than UINT16_MAX. To reproduce the issue run: echo -en "\x00\x01\x00\x01\x01" |socat stdin tcp:localhost:2775
2014-03-06smpp_smsc: Check that the size is large enough to hold actual dataDaniel Willmann1-0/+6
The first 4 bytes are the length including the length field. For length < 4 the subsequent msgb_put(msg, sizeof(uint32_t)) will fail, resulting in an abort. The code also expects (in smpp_msgb_cmdid()) the existence of 4 more bytes for the SMPP command ID. This patch checks that the length received is large enough to hold all 8 bytes in the msgb and drops the connection if that's not the case. The issue is reproducible with: echo -e "\x00\x00\x00\x02\x00" |socat stdin tcp:localhost:2775
2014-03-06smpp_smsc: Fix socket read() error handlingDaniel Willmann1-16/+31
Read returning -1 is an error here so make sure to print the actual reason and close the socket. Before this patch we just looped over the fd with read returning -1 every time. EINTR is handled to not cause an error and we don't need to check EAGAIN/EWOULDBLOCK since the callback is only called in case there is something to read. To avoid copy&paste issues the check is implemented as a macro and the log message moved into a separate if.
2014-02-24sms: Address the TODO and schedule the next SMS for an active subscriberHolger Hans Peter Freyther1-6/+45
When one SMS has been delivered check if a second SMS can be scheduled to that subscriber. If nothing can be scheduled kick the normal SMS queue as one slot has become free now. Otherwise send the SMS and create a pending entry.
2014-02-24sms: Do not interfere with the SMS queue from within gsm_04_11Holger Hans Peter Freyther2-17/+6
It was possible that two SMS would be delivered at the same time which violates GSM 04.11. We should solely rely on the sms queue to schedule more SMS to the subscriber.
2014-02-21SMPP: UCS2 data_coding is 0x08, not 0x80!Harald Welte1-1/+1
As can clearly be seen from SMPP Spec v3.4 Chapter 5.2.19, a SUBMIT-SM with data_coding == 0x08 is UCS2, not with 0x80. Thanks to ciaby@rhizomatica.org for reporting the bug.
2014-02-20sms: Increment the RP Message Reference for each transactionHolger Hans Peter Freyther3-3/+41
Each RP-DATA should have a unique msg reference. Currently 42 is used for all of these. Remember the last reference we used and increment it on the next SMS. Do not track if the reference is still in use a clash is a lot less likely now. First unless SMPP is used only one SMS is delivered at a time, second the transaction space is a lot smaller than the one for the reference.
2014-01-31sms/dtap: Add log messages to analyse SMS message lossJacob Erlbeck3-0/+10
Incoming DTAP messages from MS are discarded during silent calls, which leads to the repeated delivery of SMS since the ACKs are not being processed. This patch adds some log messages that have been helpful to track this down. Sponsored-by: On-Waves ehf
2014-01-27Add function to update TRAU muxer after assignment or handoverAndreas Eversberg1-3/+16
E1 based BTS use TRAU muxer to decode TRAU frames. After changing channel from one timeslot to another (due to handover or assignment), the TRAU muxer must be updated. The call reference of the call is disconnected from the old channel and connected to the new channel.
2014-01-16Remove obsolete check of conn and lchan pointers not beeing NULLAndreas Eversberg1-4/+2
The check is removed from gsm48_cc_rx_setup() and gsm48_cc_rx_call_conf(). Receiving a layer 3 message implies that the transaction has a subscriber connection and a logical channel. This patch fixes the Coverity issues with CID 115311 and CID 1155312.
2014-01-14Each BTS can be configured for speech support (other than GSM full rate)Andreas Eversberg2-1/+29
Speech codings which are not supported by BTS will be removed from the bearer capability information element after parsing. This way it is not required for the MNCC application to consider support of each BTS. Only GSM full rate is supported by default.
2014-01-08nitb: Set the DST field in generated MM info messagesJacob Erlbeck1-0/+15
Currently the NET_DST information element (see GSM 24.008) is not included in generated MM info messages even when the DST field in the timezone info has been set via the VTY or the control interface. This patch modifies gsm48_tx_mm_info() to append this information element if (and only if) a non-zero DST has been configured. The DST IE is not part of GSM 4.8. Therefore it will only be sent, if the DST offset is configured to a value != 0. The DST functionality has been verified with wireshark by Jacob. Sponsored-by: On-Waves ehf
2013-12-29smpp: In case we know the receiver set the context for loggingHolger Hans Peter Freyther1-0/+2
2013-12-29mncc: Add the context we get from the MNCC interfaceHolger Hans Peter Freyther1-0/+13
Currently we only set the SUBSCR on RSL messages. Extend it to messages that go through MNCC. For call control/bridging it is difficult to pick the right subscriber. We should support a list or at least two legs in the imsi filter context.
2013-12-28ussd: Reject and release unhandled SS requests/interrogationTobias Engel1-1/+9
In case the unpack of a USSD request is failing the channel would remain open and the phone would not receive a response. Simply reject the interrogation. Example interrogation: 0000 1b 7b 1c 0d a1 0b 02 01 01 02 01 0e 30 03 04 01 0010 11 7f 01 00
2013-12-27sms: Fix crash on RLL Establish Request timeouts with active callHolger Hans Peter Freyther1-13/+18
Sylvain pointed out that in the current crash log the transaction we try to read the SMS from is actually a transaction for Call Control. On AMD64 the struct layout is different and that leads to a crash when the CC transaction is in front of the SMS transaction. Look at the trans->protocol to fix the crash. The issue got introduced in 6a3d765bf97349535602ed5b2b55d2093aa18d71 (2010) when I added the SAPI N Reject handling. #0 smpp_sms_cb (subsys=1, signal=4, handler_data=0xbb8270, signal_data=0x7fff33574ea0) at smpp_openbsc.c:284 284 if (sms->source != SMS_SOURCE_SMPP) (gdb) bt #0 smpp_sms_cb (subsys=1, signal=4, handler_data=0xbb8270, signal_data=0x7fff33574ea0) at smpp_openbsc.c:284 #1 0x00007f424e4a094c in osmo_signal_dispatch (subsys=1, signal=4, signal_data=0x7fff33574ea0) at signal.c:105 #2 0x000000000042b070 in send_signal (sig_no=<optimized out>, trans=<optimized out>, sms=<optimized out>, paging_result=<optimized out>) at gsm_04_11.c:125 #3 0x000000000042ccd2 in gsm411_sapi_n_reject (conn=0xec6790) at gsm_04_11.c:1000 #4 0x0000000000408983 in send_sapi_reject (link_id=<optimized out>, conn=<optimized out>) at bsc_api.c:733 #5 rll_ind_cb (_data=<optimized out>, lchan=<optimized out>, link_id=<optimized out>, rllr_ind=<optimized out>) at bsc_api.c:755 #6 rll_ind_cb (lchan=<optimized out>, link_id=<optimized out>, _data=<optimized out>, rllr_ind=<optimized out>) at bsc_api.c:736 #7 0x000000000041f8d2 in complete_rllr (rllr=<optimized out>, type=<optimized out>) at bsc_rll.c:55 #8 0x00007f424e4a03bc in osmo_timers_update () at timer.c:243 #9 0x00007f424e4a069b in osmo_select_main (polling=0) at select.c:133 #10 0x0000000000407394 in main (argc=<optimized out>, argv=0x7fff33575238) at bsc_hack.c:346 (gdb) frame 3 #3 0x000000000042ccd2 in gsm411_sapi_n_reject (conn=0xec6790) at gsm_04_11.c:1000 1000 send_signal(S_SMS_UNKNOWN_ERROR, trans, sms, 0); (gdb) p trans $1 = (struct gsm_trans *) 0xedba80 (gdb) p *trans .... data = 0x1}}, sms = 0x3439323400000003}}} (gdb) p trans->protocol $4 = 3 '\003'
2013-12-27db: Avoid crash we have seen with the dbi code when reading a SMSHolger Hans Peter Freyther1-0/+15
Avoid a crash when reading a SMS and a Subscriber could not be resolved. It is not clear why the read was failing. The sender_id and the receiver_id was valid for the given sms. I assume that the database has been locked due external access to it. The side-effect is that in case of such a failure the sms_queue will start to deliver starting from subscriber id = 0 again. #1 0x0000000000428bec in sms_from_result (net=0x156a270, result=0x15eda30) at db.c:1146 #2 0x000000000042a8e0 in db_sms_get_unsent_by_subscr (net=0x156a270, min_subscr_id=<optimized out>, failed=<optimized out>) at db.c:1255 #3 0x000000000042e900 in take_next_sms (smsq=<optimized out>) at sms_queue.c:193 #4 sms_submit_pending (_data=0x158e300) at sms_queue.c:227 #5 0x00007f3fd30de3bc in osmo_timers_update () at timer.c:243 #6 0x00007f3fd30de69b in osmo_select_main (polling=0) at select.c:133 #7 0x0000000000406fbc in main (argc=9, argv=<optimized out>) at bsc_hack.c:346 (gdb) frame 1 #1 0x0000000000428bec in sms_from_result (net=0x156a270, result=0x15eda30) at db.c:1146 1146 strncpy(sms->src.addr, sms->sender->extension, sizeof(sms->src.addr)-1); (gdb) p *sms (gdb) p sms->sender $1 = (struct gsm_subscriber *) 0x0 (gdb) p sender_id $2 = <optimized out>
2013-12-27libmsc: Set the "trans->conn" to NULL to catch invalid usageHolger Hans Peter Freyther1-1/+1
Make finding use-after-free more easy and set it to NULL.
2013-12-27lu crash: Fix a crash that likely occurred during the LU procedureHolger Hans Peter Freyther1-0/+3
conn->loc_operation is already NULL (e.g. due a five second timeout but we are still processing a RSL message after we initiated the release procedure). Do not attempt to authorize a subcriber without knowing the key_sequence. This can cause more problems but we will need to test this in the field. (gdb) bt #0 gsm0408_authorize (conn=0x19fc2f0, msg=<optimized out>) at gsm_04_08.c:323 #1 gsm0408_authorize (conn=0x19fc2f0, msg=<optimized out>) at gsm_04_08.c:319 #2 0x000000000043a99a in mm_rx_id_resp (conn=0x19fc2f0, msg=<optimized out>) at gsm_04_08.c:495 #3 gsm0408_rcv_mm (msg=<optimized out>, conn=0x19fc2f0) at gsm_04_08.c:1041 #4 gsm0408_dispatch (conn=0x19fc2f0, msg=<optimized out>) at gsm_04_08.c:3232 (gdb) p *conn $5 = {entry = {next = 0x1746930, prev = 0x1a14270}, subscr = 0x1745eb0, expire_timer_stopped = 1 '\001', loc_operation = 0x0, sec_operation = 0x0, anch_operation = 0x0, silent_call = 0, put_channel = 0, sccp_con = 0x0, in_release = 0, lchan = 0x7f8c79007218, ho_lchan = 0x0, bts = 0x1719f90, T10 = {node = { rb_parent_color = 0, rb_right = 0x0, rb_left = 0x0}, list = {next = 0x0, prev = 0x0}, timeout = {tv_sec = 0, tv_usec = 0}, active = 0, cb = 0, data = 0x0}, secondary_lchan = 0x0}
2013-12-27periodic/lu: Attempt to implicitly attach a subscriber instead of rejectingHolger Hans Peter Freyther1-4/+17
When modern Smartphones receive "Not in VLR". The baseband firmware apparently does not try to do an IMSI ATTACH but just remains un-happy and will not connect to the network anymore.
2013-12-27Revert "gsm_04_11: Speculative fix for MT SMS and SAPI 'n Reject"Holger Hans Peter Freyther1-2/+0
Let's revert it and see if we can find the real issue about the sms being invalid. Sylvain has pointed out that we get invoked from a timer and might not have stopped it properly. This reverts commit 80ba9b5dd62cc8bfd10dae2f3b63420ef1e8452d.
2013-12-27gsm_04_11: Speculative fix for MT SMS and SAPI 'n RejectHolger Hans Peter Freyther1-0/+2
I am not sure why it is crashing so this is a speculative fix based on something we already did in 3e9b2ec257bc064b866ce6a2735206dc6131f615. #0 sms_find_pending (smsq=0x2706300, sms=<optimized out>) at sms_queue.c:77 #1 sms_sms_cb (subsys=<optimized out>, signal=4, handler_data=0x26e2270, signal_data=0x7fffdac256c0) at sms_queue.c:396 #2 0x00007fcdea94394c in osmo_signal_dispatch (subsys=1, signal=4, signal_data=0x7fffdac256c0) at signal.c:105 #3 0x000000000042acc0 in send_signal (sig_no=<optimized out>, trans=<optimized out>, sms=<optimized out>, paging_result=<optimized out>) at gsm_04_11.c:124 #4 0x000000000042c8e2 in gsm411_sapi_n_reject (conn=0x2722d30) at gsm_04_11.c:999 #5 0x00000000004085d3 in send_sapi_reject (link_id=<optimized out>, conn=<optimized out>) at bsc_api.c:733 #6 rll_ind_cb (_data=<optimized out>, lchan=<optimized out>, link_id=<optimized out>, rllr_ind=<optimized out>) at bsc_api.c:755 #7 rll_ind_cb (lchan=<optimized out>, link_id=<optimized out>, _data=<optimized out>, rllr_ind=<optimized out>) at bsc_api.c:736 #8 0x000000000041f522 in complete_rllr (rllr=<optimized out>, type=<optimized out>) at bsc_rll.c:55 #9 0x00007fcdea9433bc in osmo_timers_update () at timer.c:243 #10 0x00007fcdea94369b in osmo_select_main (polling=0) at select.c:133 #11 0x0000000000406fbc in main (argc=9, argv=<optimized out>) at bsc_hack.c:346
2013-12-26sms: Move to gsm_7bit_encode_n in the sms sending codeHolger Hans Peter Freyther1-1/+2
Do not rely on the potential wrong gsm_7bit_encode result but use gsm_7bit_encode_n with maximum available space.
2013-12-26ussd: Move to use gsm_7bit_encode_n_ussd for USSD encodingHolger Hans Peter Freyther1-1/+1
The legacy functions have a bad/wrong return value for the number of septets in the string. Change the code to use the new functions which will fix encoding issues as well.
2013-12-26db: Fetch the authorized key using ulonglongKevin Redon1-2/+3
Location Update Requests time out and get rejected because the subscriber is not authorized. Authorizing the subscriber through openBSC or sqlite3 doesn't help the subscriber is still seen and shown as not authorized The value is read as uint, this is the wrong type it's a (u)longlong in libdbi 0.9.0 and later.
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-25 22:49:54 +0000