aboutsummaryrefslogtreecommitdiffstats
path: root/openbsc/tests/gbproxy/gbproxy_test.c
AgeCommit message (Collapse)AuthorFilesLines
2016-11-15test/gbproxy: Test for possible memory corruption when link_info is freedDaniel Willmann1-0/+95
This test is to trigger the use-after free issue in commit bff7b0d80972. If compiled with address-sanitizer the test will abort without the fix. Change-Id: I5e8c6626ba43342740f08d699383bdded739079f Ticket: OW#3049 Sponsored-by: On-Waves ehf
2016-10-13msgb talloc ctx: initialize in all main() scopesNeels Hofmeyr1-0/+2
Add msgb_talloc_ctx_init() call to many main() functions still lacking a msgb talloc context. Change-Id: Ib0d6751260659cabf18a7ce80680ba2fb4228ea1
2016-04-29move gsm_04_08_gprs.h to libosmocoreHarald Welte1-1/+1
This requres the corresponding commit in libosmocore.
2016-04-16gbproxy_test: assert msg allocation (CID #57873)Neels Hofmeyr1-0/+1
2015-10-13gprs/gb_proxy: Use RAND_bytes for gbproxy TLLI/TMSI allocationDaniel Willmann1-35/+55
This change has some implications for the test case. It manipulated bss_ptmsi_state and sgsn_tlli_state variables to make the output of rand_r() and thus the TLLI/TMSI used predictable. This possibility is gone when using RAND_bytes() so instead it is overridden by a function that returns a deterministic sequence of values (0x00dead00, 0x00dead01, ...). The test cases are adapted to expect these values instead of the pseudo random values before. The gbproxy_test stdout file changes as well, but only where the TLLI/TMSI is displayed (in the hex dumps as well as the TLLI cache entries). All other output is the same.
2015-10-13gbproxy/test: Add and call cleanup_test functionDaniel Willmann1-0/+20
This (currently empty) function is meant to contain code that cleans up the left-overs of the test functions. This is needed by the next commit to reset the RAND_bytes sequence.
2015-08-0364bit: Fix compiler warnings in regard to 64bitHolger Hans Peter Freyther1-1/+1
vty_interface_layer3.c:584:4: warning: format '%d' expects argument of type 'int', but argument 3 has type 'long unsigned int' [-Wformat=] sizeof(subscr->extension)-1, VTY_NEWLINE);
2015-04-23misc: Fix warnings about size of size_t in printfHolger Hans Peter Freyther1-7/+7
Fixes warnings like: warning: format '%d' expects argument of type 'int', but argument 3 has type 'long int' [-Wformat]
2015-01-02Partial revert "Fix most compiler warnings with gcc-4.9.2"Holger Hans Peter Freyther1-8/+8
Most of the "fixes" have nothing to do with gcc-4.9.2 but are a question of ABI/Architecture (e.g. x86 vs. AMD64). Revert these for now. This partially reverts commit 7b1d25a11e44bbc1cb0d2acd9f1a3d4a16ec7c90. abis_test.c: In function ‘test_simple_sw_config’: abis_test.c:68:2: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 2 has type ‘int’ [-Wformat=] printf("Start: %ld len: %zu\n", descr[0].start - simple_config, descr[0].len); ^ abis_test.c: In function ‘test_dual_sw_config’: abis_test.c:111:2: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 2 has type ‘int’ [-Wformat=] printf("Start: %ld len: %zu\n", descr[0].start - dual_config, descr[0].len); ^ abis_test.c:115:2: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 2 has type ‘int’ [-Wformat=] printf("Start: %ld len: %zu\n", descr[1].start - dual_config, descr[1].len); ^ abis_test.c: In function ‘test_sw_selection’: abis_test.c:132:2: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 2 has type ‘int’ [-Wformat=] printf("Start: %ld len: %zu\n", descr[0].start - load_config, descr[0].len); ^ abis_test.c:136:2: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 2 has type ‘int’ [-Wformat=] printf("Start: %ld len: %zu\n", descr[1].start - load_config, descr[1].len);
2015-01-01Fix most compiler warnings with gcc-4.9.2Harald Welte1-8/+8
2014-12-23gprs: Move TLV parser functions to gprs_utils.c and rename themJacob Erlbeck1-236/+0
Currently the parser functions for single information elements are defined within gprs_gb_parse.c and not exported explicitely. In addition they are named like libosmocore's TLV parser functions and do not have a proper name prefix. Since it is planned to use them for other protocols, they need to be globally accessible. This patch moves them to gprs_utils.c and renames them. The new names are: lv_shift -> gprs_shift_lv v_fixed_shift -> gprs_shift_v_fixed lv_shift -> gprs_shift_lv v_fixed_shift -> gprs_shift_v_fixed In the long term, these functions should be moved to libosmocore (and renamed again). Sponsored-by: On-Waves ehf
2014-12-02gbproxy: Reset TLLIs when the link_info is found by IMSI/P-TMSIJacob Erlbeck1-12/+4
Currently when the MS does a re-attach without doing a proper detach first, the gbproxy uses the old local TLLI if patching and the keep mode are enabled. This leads to a failing attachment procedure when TLLI patching is also enabled. This patch changes gbproxy_update_link_state_ul to reset all TLLIs within the link_info if the message contains an unknown TLLI and an MI. This is generally the case with Attach Request messages. The gbproxy_get_link_info_ul gets an additional tlli_is_valid output parameter that is set, when a TLLI was present and found. This flag is then used instead of checking tlli.current == 0 to set TLLI/P-TMSI e.g. Attach Requests when a link_info was already present for the P-TMSI/IMSI used in such a request. Ticket: OW#1324 Sponsored-by: On-Waves ehf
2014-11-05gbproxy/test: Extend test_gbproxy_keep_infoJacob Erlbeck1-0/+375
Add new test message sequences: - Normal attach (with IMSI) after detach (ok) - Normal attach (with local TLLI) after detach (ok) - Unexpected attach (with IMSI) after successful TLLI validation (fails) - Unexpected attach (with P-TMSI) after successful TLLI validation (fails) Ticket: OW#1324 Sponsored-by: On-Waves ehf
2014-10-27gbproxy: Patch BSSGP P-TMSI in PAGING PS messagesJacob Erlbeck1-0/+57
Currently the P-TMSI IE in PAGING_PS is not patched. This commit adds code to patch BSSGP P-TMSI IE in gbproxy_patch_bssgp independently from the P-TMSI patching at the LLC layer. It also extends gbproxy_update_link_state_dl to use the IMSI to find the link_info if the TLLI is not present in the message. Note that the spec (GSM 08.18, 7.2) requires to use of the P-TMSI instead of the IMSI to select the MS if that IE is available. Nevertheless as long as the IMSI is always present in downlink BSSGP messages and as long as the optional P-TMSI refers to the same MS (which is the case currently), this is not an issue. Sponsored-by: On-Waves ehf
2014-10-27gbproxy: Fix P-TMSI generation for repeated Attach Accept messagesJacob Erlbeck1-9/+9
Currently, when P-TMSI patching is enabled, a new BSS P-TMSI is generated for each Attach Accept. So two duplicated, subsequent Attach Accept messages will be mapped to different BSS side P-TMSI. Because the last one will replace former ones in the link_info struct, the MS will fail to access the SGSN if it uses the former P-TMSI to derive the new TLLI. This patch checks the SGSN P-TMSI already assigned to the link_info and only generates a new BSS P-TMSI on mismatch (or if the BSS P-TMSI hasn't been set yet). Ticket: OW#1322 Sponsored-by: On-Waves ehf
2014-10-27gbproxy/test: Add test case for repeated and otherwise bad messagesJacob Erlbeck1-0/+181
This adds a test case to check gbproxy's behaviour when processing two subsequent but identical Attach Accept messages. Ticket: OW#1322 Sponsored-by: On-Waves ehf
2014-10-27gbproxy/test: Add expect_msg checks to test_gbproxy_keep_infoJacob Erlbeck1-4/+101
This patch adds assertions to check the LLC/GMM message received from the gbproxy by the test framework within the function test_gbproxy_keep_info. It also fixes the source address of the DETACH ACC messages. Sponsored-by: On-Waves ehf
2014-10-27gbproxy/test: Don't assign a variable within OSMO_ASSERT (Coverity)Jacob Erlbeck1-7/+10
Coverity complains about having side effects in OSMO_ASSERT argument expressions. This would be an issue in this case, because that variable is only reference in other OSMO_ASSERT expressions. Nevertheless this patch changes this to assign the variable outside of OSMO_ASSERT. Fixes: Coverity CID 1244239 Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Use a separate regexp for routingJacob Erlbeck1-2/+2
Currently one regexp ('patching') is used for all matching. This patch adds a second category 'routing' which is exclusively used for SGSN selection. It also adds a corresponding VTY command: - match-imsi patching RE : MS related patching (currently APN) - match-imsi routing RE : Select secondary SGSN on match only - no match-imsi : Clear all filter expressions Ticket: OW#1258 Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Cleanup match config after testsJacob Erlbeck1-0/+7
Currently, patch filter configurations are leaking between tests. This adds a call to gbproxy_clear_patch_filter() to the end of each test that calls gbproxy_set_patch_filter(). Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Refactor IMSI matchingJacob Erlbeck1-51/+57
The current implementation makes it difficult to add further match expressions. This patch adds a new struct gbproxy_match that contains the fields needed for each match expression. The matches (config) and the results (link_info) are stored in arrays. All related functions are updated to use them. The old fields in the config structure are removed. Sponsored-by: On-Waves ehf
2014-10-09gbproxy/test: Add expect_msg checks to test_gbproxy_ra_patchingJacob Erlbeck1-0/+59
This patch adds assertions to check the LLC/GMM message received from the gbproxy by the test framework within the function test_gbproxy_ra_patching. Sponsored-by: On-Waves ehf
2014-10-09gbproxy/test: Save and check received messagesJacob Erlbeck1-0/+155
Currently the only way to check, whether the right message have been generated is to look into the generated text output. This is error-prone if there are many messages. This patch adds a way to optionally store all received messages into a FIFO. They can then be checked by calling expect_msg() which removes the first message from the FIFO and returns a pointer to it or NULL if there is none. The pointer is only valid until the next call to this function. A few convenience functions are added to check for common message types: - expect_gmm_msg checks for certain GSM 04.08 messages in LLC/GMM - expect_llc_msg checks for arbitrary LLC messages in BSSGP/UD - expect_bssgp_msg checks for arbitrary BSSG messages Each of their arguments can be set by MATCH_ANY to ignore it while matching. On success, they return a pointer to a statically allocated struct containing the pointer to the msg and the full parse context. Recording is enabled by setting the global variable received_messages to a pointer to a struct llist_head. It can be disabled again by setting it to NULL. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Parse Attach Reject messagesJacob Erlbeck1-0/+2
That message is currently ignored but should invalidate the TLLI and de-register the logical link instead. This patch extends the parser to recognize such messages and to set the invalidate_tlli flag. Sponsored-by: On-Waves ehf
2014-10-09gbproxy/test: Add invalidation tests to test_gbproxy_keep_info()Jacob Erlbeck1-6/+122
The TLLI should also be invalidated: - when an Attach Reject info is received from the SGSN - when an Attach Req is immediately followed by a Detach Req - when an Attach Req is immediately followed by an MT detach procedure To verify that, this patch adds corresponding message sequences to the test. Sponsored-by: On-Waves ehf
2014-10-09gbproxy/test: Fix IMSI length check (Coverity)Jacob Erlbeck1-1/+1
This fixes the IMSI length assertion, which currently uses a greater-or-equal than zero comparison which always yields true. It is replaced by a greater than zero check. Fixes: Coverity CID 1239442 Sponsored-by: On-Waves ehf
2014-10-09gbproxy/test: Fix time calculation in test_gbproxy_tlli_expire()Jacob Erlbeck1-1/+1
A single test case still uses time() to obtain the reference time. This commit fixes this by using the 'now' variable instead, that contains a fixed time value and does therefore not depend on when the test is executed. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Rename the field 'enabled_tllis' to 'logical_links'Jacob Erlbeck1-21/+21
This field in struct gbproxy_patch_state has involved and holds a list of all tracked logical links now. Thus the name is modified accordingly. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Use the term 'link' instead of 'tlli'Jacob Erlbeck1-444/+444
Currently in many places where 'tlli' (Temporary Logical Link Identifier) within identifiers is used, the logical link itself is meant instead. For instance, the tlli_info contain information about an LLC logical link including up to four individual TLLI. To avoid confusion between these concepts, this patch replaces all 'tlli_info' by 'link_info' and a few 'tlli' by 'link'. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Rename functions related to tlli_infoJacob Erlbeck1-92/+92
This patch replaces 'tlli' by 'tlli_info' within the following function identifiers: - gbproxy_delete_tlli - gbproxy_delete_tllis - gbproxy_remove_stale_tllis - gbproxy_touch_tlli - gbproxy_unregister_tlli - gbproxy_remove_matching_tllis - gbproxy_find_tlli -> gbproxy_tlli_info_by_tlli - gbproxy_find_tlli_by_* -> gbproxy_tlli_info_by_* These functions refer to the whole logical link info rather than to a certain TLLI. So they are renamed to be named consistently with gbproxy_attach_tlli_info and others. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Rename identifiers related to IMSI matchingJacob Erlbeck1-6/+6
This patch renames gbproxy_check_tlli() to gbproxy_imsi_matches() and struct tlli_info's enable_patching to imsi_matches. It's meant to be more obvious and consistent this way. Sponsored-by: On-Waves ehf
2014-10-09gbproxy/test: Test IMSI acquisition for RA UDP REQJacob Erlbeck1-0/+57
When a MS is state GMM_REGISTERED enters a new RA, it sends a RA Update Request which is then handled by a gbproxy that possibly doesn't have a matching tlli_info. In this case, depending on the configuration an identification procedure to acquire the IMSI must be started. This adds tests to test_gbproxy_imsi_acquisition(): - IMSI acquisition triggered by a RA Update Request message - Reaction to repeated RA Update Request messages, like it could be caused by packet loss between PCU and gbproxy. Sponsored-by: On-Waves ehf
2014-09-19gbproxy: Separate SGSN numeric namespacesJacob Erlbeck1-22/+73
Currently the SGSN side message's TLLI are searched without checking the originating SGSN. This leads to collisions if both SGSN use the same P-TMSI for different MS. With this patch, the SGSN NSEI is stored within the tlli_info and is used in comparisons to separate the namespaces. Note that this type of collision cannot happen with BSS numbers, since the tlli_info are already separated and stored per (BSS) peer. Sponsored-by: On-Waves ehf
2014-09-19gbproxy/test: Add a test with a P-TMSI collision between two SGSNsJacob Erlbeck1-0/+78
This patch extends test_gbproxy_secondary_sgsn() by the establishment of a third MS connection using a P-TMSI that has been assigned by the other SGSN already. It is expected that the entries do not interfere and are properly retrieved. Note that these collisions are not handled properly yet. Sponsored-by: On-Waves ehf
2014-09-19gbproxy/test: Fix Identification ResponseJacob Erlbeck1-1/+1
At one place, the reply to the second Ident Req contains the wrong IMSI. That is fixed by this patch. Sponsored-by: On-Waves ehf
2014-09-19gbproxy: Check other tlli_infos for matching TLLI/P-TMSIJacob Erlbeck1-2/+2
Currently it is possible to create serveral entries referring to the same P-TMSI/TLLI by using P-TMSI assigment via Attach Accept or RA Update Accept messages. This can lead to the use of the wrong tlli_info. This patch adds gbproxy_remove_matching_tllis() that removes all conflicting entries. This function is called after the P-TMSIs and the resulting TLLIs has been set up. Sponsored-by: On-Waves ehf
2014-09-19gbproxy/test: Add test case for P-TMSI assigmentJacob Erlbeck1-0/+215
This tests P-TMSI assignment when P-TMSI patching is disabled. A test with colliding P-TMSI in Attach Accept messages is included. Note that P-TMSI collisions are not handled properly yet. Sponsored-by: On-Waves ehf
2014-09-19gbproxy: Parse RA_UPD_REJ and invalidate TLLIJacob Erlbeck1-3/+4
Since this message puts the MS into DEREGISTERED state (like a detach procedure), this message is parsed and the invalidate_tlli field is set accordingly. Sponsored-by: On-Waves ehf
2014-09-19gbproxy: Avoid multiple tlli_info entries with the same IMSIJacob Erlbeck1-4/+4
Currently it is possible to create several tlli_info entries with the same IMSI. This patch disables this by adding a check before the imsi field is updated. Sponsored-by: On-Waves ehf
2014-09-19gbproxy: Keep tlli_info after detachJacob Erlbeck1-3/+75
Currently a tlli_info entry is deleted when the TLLI gets invalidated by a Detach message. This patch introduces the possibility to keep tlli_info entries in the list. Those entries then have cleared TLLI fields, are marked as de-registered, and can only be retrieved by a message containing an IMSI or a P-TMSI. The following VTY configuration commands are added to the gbproxy node: - tlli-list keep-mode never : Don't keep the entries (default) - tlli-list keep-mode re-attach : Only keep them, when a Detach message with re-attach required has been received - tlli-list keep-mode identified : Only keep entries which are associated with an IMSI - tlli-list keep-mode always : Keep all entries Note that at least one of max-length or max-age should be set when this feature is used to limit the number of entries. Sponsored-by: On-Waves ehf
2014-09-18gbproxy/test: Add test case for tlli_info persistenceJacob Erlbeck1-1/+341
This test case consists of a sequence of several attach and detach procedures. The kind of detach varies (mobile originated, mobile terminated re-attach required, mobile terminated re-attach not required, routing area update reject). To main focus is to check that the tlli_info is de-registered correctly (not accessible via the TLLI) and that can be re-used afterwards (which is not implemented yet). Sponsored-by: On-Waves ehf
2014-09-18gbproxy: Remove gbproxy_register_tlliJacob Erlbeck1-11/+62
This function is a remainder of the initial implemenation that was not meant for TLLI patching and can be used for the BSS side only. The SGSN side is already using a composition of more flexible single purpose functions. This patch changes the implementation to use a similar approach. The function is moved to gbproxy_test.c and renamed to register_tlli to keep the tests intact. Sponsored-by: On-Waves ehf
2014-09-18gbproxy: Fixed RAI patching in Attach Request messagesJacob Erlbeck1-0/+33
Currently the RAI in the LLC part of the message is not updated if the message has been taken from the list of stored messages. The reason is, that old_raid_matches is update in gbprox_process_bssgp_ul() but not in gbproxy_flush_stored_messages(). This patch moves the check to gprs_gb_parse_bssgp() which is called at both places and where other fields like parse_ctx->tlli are set, too. In addition, old_raid_matches is replaced by old_raid_is_foreign since this is clearer in the case when there is no old RAI at all. Several RAI patch counter assertions are also added to test_gbproxy_ra_patching(). Sponsored-by: On-Waves ehf
2014-09-18gbproxy/test: Add/modify test casesJacob Erlbeck1-1/+35
Add a Attach Request message to test_gbproxy_ra_patching, where the BSSGP RAI differs from the old RAI signalled in the LLC part. This case had not been tested explicitely yet. Change the RAI in the first Attach Request in test_gbproxy_imsi_acquisition from rai_unknown to rai_bss. Add Detach Requests to test_gbproxy_imsi_acquisition, one for a incomplete attach procedure and one for an unknown (fresh) TLLI. In these cases, the acquisition of a IMSI is not necessary and also doesn't work properly with an E71. Sponsored-by: On-Waves ehf
2014-09-18gbproxy: Replace 'mi_data' by 'imsi'Jacob Erlbeck1-14/+14
Since at all places where mi_data/mi_data_len is used it will always contain an IMSI. Thus the names of the identifiers have been updated accordingly for clarity. Sponsored-by: On-Waves ehf
2014-09-09gbproxy/test: Add assertions, improve test coverageJacob Erlbeck1-0/+51
This patch add explicit tests for - gbproxy_peer_by_bvci - gbproxy_peer_by_nsei - gbproxy_cleanup_peers - gbproxy_peer_by_rai - gbproxy_peer_by_lai - gbproxy_peer_by_lac and for messages with an unknown TLLI sent by the SGSN. Sponsored-by: On-Waves ehf
2014-09-09gbproxy/test: Add test cases for IMSI acquisitionJacob Erlbeck1-3/+22
If the Attach Request procedure gets restarted e.g. because of a lost message, all of these messages are stored if IMSI acquisition is in progress. This patch adds a test for this case and modifies the dump_peers function to output the number of stored messages. Note that the number of stored messages currently increases with each (repeatedly) received Attach Request which is not the desired behaviour. Sponsored-by: On-Waves ehf
2014-09-08gbproxy/test: Extend P-TMSI patch test by a sequence of RA UDP REQJacob Erlbeck1-9/+123
This adds a sequence of two RA update procedures to test_gbproxy_ptmsi_patching(). Each of them assigns a new P-TMSI. Note that the implementation fails to patch the RAI within the message labelled 'RA UDP ACC (P-TMSI 3)' and logs 'TLLI sent by the SGSN is unknown'. Sponsored-by: On-Waves ehf
2014-09-08gbproxy/test: Check APN patching while P-TMSI patching is enabledJacob Erlbeck1-0/+7
This commit adds a single ACT PDP CTX REQ message to test_gbproxy_ptmsi_patching() to check whether APN patching works in this case, too. Note that this doesn't work currently, the APN patch count is not incremented. Sponsored-by: On-Waves ehf
2014-09-08gbproxy/test: Add test case for secondary SGSNJacob Erlbeck1-8/+458
This patch adds a case to test the establishment (and shutdown) of connection between 2 MS and 2 SGSN, where the assignment is based on each IMSI. Since BVC-RESET and FLOW-CONTROL-BVC will have to be sent to both SGSN, an ACK is simulated for both. New functions to generate FLOW-CONTROL-BVC(-ACK) messages are provided. It modifies dump_peers to add the string "IMSI matches" to a TLLI dump line if appropriate. Note that there is no real support to use a secondary SGSN in the gbproxy yet, but the test code reflects the expected behaviour when the feature is implemented. Sponsored-by: On-Waves ehf
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-19 18:10:53 +0000