aboutsummaryrefslogtreecommitdiffstats
path: root/openbsc
AgeCommit message (Collapse)AuthorFilesLines
2014-10-27sgsn: Moved IMSI ACL management to sgsn_auth.cJacob Erlbeck7-54/+88
Currently the ACL code is located in sgsn_vty.c. This commit moves this to a new file sgsn_auth.c as a first step to make authorization more flexible in order to implement remote acquisition on subsciber data. Sponsored-by: On-Waves ehf
2014-10-27sgsn: Avoid duplicated Attach Accept messagesJacob Erlbeck1-0/+10
Currently each received Ident Resp triggers an Attach Accept/Reject if IMSI and IMEI are known. This has led to duplicated Attach Accept messages when used with the gbproxy (IMSI acquisition active) and with certain mobile equipment (iOS). This patch modifies gsm48_rx_gmm_id_resp to discard Ident Resp messages if all required information (IMEI and IMSI) has been gathered. Ticket: OW#1322 Sponsored-by: On-Waves ehf
2014-10-27gbproxy: Patch BSSGP P-TMSI in PAGING PS messagesJacob Erlbeck6-9/+133
Currently the P-TMSI IE in PAGING_PS is not patched. This commit adds code to patch BSSGP P-TMSI IE in gbproxy_patch_bssgp independently from the P-TMSI patching at the LLC layer. It also extends gbproxy_update_link_state_dl to use the IMSI to find the link_info if the TLLI is not present in the message. Note that the spec (GSM 08.18, 7.2) requires to use of the P-TMSI instead of the IMSI to select the MS if that IE is available. Nevertheless as long as the IMSI is always present in downlink BSSGP messages and as long as the optional P-TMSI refers to the same MS (which is the case currently), this is not an issue. Sponsored-by: On-Waves ehf
2014-10-27gbproxy: Fix P-TMSI generation for repeated Attach Accept messagesJacob Erlbeck3-32/+32
Currently, when P-TMSI patching is enabled, a new BSS P-TMSI is generated for each Attach Accept. So two duplicated, subsequent Attach Accept messages will be mapped to different BSS side P-TMSI. Because the last one will replace former ones in the link_info struct, the MS will fail to access the SGSN if it uses the former P-TMSI to derive the new TLLI. This patch checks the SGSN P-TMSI already assigned to the link_info and only generates a new BSS P-TMSI on mismatch (or if the BSS P-TMSI hasn't been set yet). Ticket: OW#1322 Sponsored-by: On-Waves ehf
2014-10-27gbproxy/test: Add test case for repeated and otherwise bad messagesJacob Erlbeck2-0/+500
This adds a test case to check gbproxy's behaviour when processing two subsequent but identical Attach Accept messages. Ticket: OW#1322 Sponsored-by: On-Waves ehf
2014-10-27gbproxy/test: Add expect_msg checks to test_gbproxy_keep_infoJacob Erlbeck2-16/+117
This patch adds assertions to check the LLC/GMM message received from the gbproxy by the test framework within the function test_gbproxy_keep_info. It also fixes the source address of the DETACH ACC messages. Sponsored-by: On-Waves ehf
2014-10-27sgsn: Send detach(re-attach) instead of gmm status if TLLI unknownJacob Erlbeck7-12/+164
The osmo-sgsn sends Status messages (or nothing in case of non GMM/GSM) when the TLLI is unknown. This prevents the MS from reconnecting. This patch adds the initiation of an MT detach procedure to force a re-attach to set up a valid LLE context if an LLE or an MM context cannot be found. Since this can also be triggered by non-GMM SAPI messages, a GPRS application callback sgsn_force_reattach_oldmsg is added which in turn calls the GMM layer to generate the GSM 04.08 specific messages. Note that the MS can be left in REGISTERED state after initially wanting to detach itself, since it will receive a Detach Req (re-attach) when sending a DEACT PDP CTX REQ after the SGSN or gbproxy (P-TMSI patching enabled) has been restarted. This same behaviour has been observed with another SGSN. Sponsored-by: On-Waves ehf
2014-10-27sgsn: Delete PDP contexts properlyJacob Erlbeck5-33/+84
Currently the PDP contexts are hard freed (via sgsn_pdp_ctx_free) at some places in gprs_gmm.c on the reception of a Detach Req and on re-use of an IMSI that is already associated with an MM context. This can lead to segfaults when there is a pending request or a data indication at libgtp. This patch add a new function sgsn_pdp_ctx_terminate that de-associates the PTP context from the MM context, deactivates SNDCP, sets pdp->mm to NULL and then calls sgsn_delete_pdp_ctx. sgsn_libgtp is updated to check for pdp->mm being non-NULL before dereferencing it. The sgsn_pdp_ctx_terminate function will be called for each PDP context of an MM context before this context is going to be deleted via sgsn_mm_ctx_free. To ensure, that the ctx->llme (which is accessed during the deactivation of SNDCP) remains valid, the call to gprs_llgmm_assign is moved after the call to sgsn_mm_ctx_free. The handling of re-used IMSIs is changed to mimic the processing of a Detach Req. Addresses: <0002> gprs_gmm.c:654 MM(/f6b31ab0) Deleting old MM Context for same IMSI p_tmsi_old=0xc6f19134 <000f> gprs_sgsn.c:259 PDP freeing PDP context that still has a libgtp handle attached to it, this shouldn't happen! [...] SEGFAULT Ticket: OW#1311 Sponsored-by: On-Waves ehf
2014-10-27sgsn: Cancel pending timer in sgsn_mm_ctx_freeJacob Erlbeck1-0/+5
Currently the timer is not stopped before the MM context is freed which can lead to failure if sgsn_mm_ctx_free is called while timer protected procedures are active. This patch add code to cancel the timer if necessary from within sgsn_mm_ctx_free. Ticket: OW#1322 Sponsored-by: On-Waves ehf
2014-10-27gprs: Fix typo in the commentHolger Hans Peter Freyther1-1/+1
2014-10-27gbproxy: Fix segfault for VTY delete-gbproxy-linkJacob Erlbeck1-0/+2
Currently the code segfaults when the link shall be deleted by IMSI when the IMSI has not been set yet. This patch adds a NULL check to skip the entry before calling gsm48_mi_to_string, Adresses: Program received signal SIGSEGV, Segmentation fault. 0xb693af77 in gsm48_mi_to_string (string=0xbfffe020 "", str_len=200, mi=0x0, mi_len=0) at gsm48.c:360 360 mi_type = mi[0] & GSM_MI_TYPE_MASK; str_len=200, mi=0x0, mi_len=0) at gsm48.c:360 self=0x807c9a0 <delete_gb_link_by_id_cmd>, vty=0xb4303c70, argc=3, argv=0xbfffe1c0) at gb_proxy_vty.c:670 ... Sponsored-by: On-Waves ehf
2014-10-27gbproxy/test: Don't assign a variable within OSMO_ASSERT (Coverity)Jacob Erlbeck1-7/+10
Coverity complains about having side effects in OSMO_ASSERT argument expressions. This would be an issue in this case, because that variable is only reference in other OSMO_ASSERT expressions. Nevertheless this patch changes this to assign the variable outside of OSMO_ASSERT. Fixes: Coverity CID 1244239 Sponsored-by: On-Waves ehf
2014-10-27gbproxy: Discard UL PTP messages with an unknown BVCIJacob Erlbeck1-10/+10
Currently all PTP messages are in general forwarded to the SGSN even when the BVCI is not known to the gbproxy. Only if message patching is active and the peer cannot be determined, a log message is generated, a STATUS message returned, and the message discarded. The intention for this was to keep the old gbproxy's behaviour if patching is disabled. But the code gets much more complex this way. Another drawback is that when the SGSN returns a corresponding STATUS message, it cannot be routed to the BSS where the original message came from. This patch therefore changes the behaviour to reject BSSGP PTP uplink messages immediately if the BVCI is not known. Fixes: Coverity CID 1244240 Ticket: OW#1317 Sponsored-by: On-Waves ehf
2014-10-10sgsn: Prevent memory leak and double freeHolger Hans Peter Freyther2-3/+8
This has been re-produced using the "osmo-pcu emulator" code and a ping to force segmented SNDCP messages. When the NS link enters the DEAD/BLOCKED state the msgb would be freed twice. Once inside gprs_ns_sendmsg and once by the caller. Based on the return one can not see if the parameter has been deleted. I changed libosmocore/libosmogb to always free the msgb in case of an error on the way to gprs_ns_sendmsg. Catch up, avoid the double free and fix some memory leaks. In case the sending fails assume the entire segmented message is at end and free the original input data. This has been tested by posix suspending/resuming the emulator process to have the GPRS-NS link go to dead/blocked to alive and unblocked. The ping recovers and "SIGUSR1" to the SGSN does not show active memory allocations. The SGSN calls bssgp_tx_dl_ud at the lowest level and has the following callchains. Most of them allocate the msgb and have no early return and transfer ownership already: <- gprs_llc_tx_u <- gprs_llc_tx_ui <- gsm48_gmm_sendmsg (all callers sane) <- _tx_status <- _tx_detach_req <- gprs_llc_tx_xid (all callers sane) <- sndcp_unitdata_req <- sndcp_send_ud_frag
2014-10-09gbproxy: Log more information on parse errorsJacob Erlbeck1-16/+18
To get a clue which message caused the error without having to enable LOGL_DEBUG, information about how far the parser came (message name, parsed fields) is logged with LOGL_NOTICE along with a full hexdump of the message. Ticket: OW#1307 Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Pass the log level as argument to gprs_gb_log_parse_contextJacob Erlbeck3-16/+18
Currently, the log level is always LOGL_DEBUG. In case of errors it would be helpful to use a higher log level. This patch adds a log_level parameter to gprs_gb_log_parse_context to let the caller decide about the level. Ticket: OW#1307 Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Add gprs_gb_message_name functionJacob Erlbeck2-4/+29
This function tries to get an accurate name for the message even if the parsing has been aborted due to message errors. The patch also moves the settings of the BSSGP related fields in parse_ctx from behind to the front of bssgp_tlv_parse, to get more information in the case of failure. This is now consistent with the handling of the llc and g48_hdr fields. Id addition, gprs_gb_log_parse_context now uses the new function to derive a more accurate message name. Ticket: OW#1307 Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Refuse to configure conflicting NSEIsJacob Erlbeck1-3/+17
Currently it is possible to set the secondary SGSN NSEI to the same value like the (primary) SGSN NSEI. This leads to undefined behaviour and is hard to recognize. This patch adds checks to either NSEI configuration command to refuse conflicting values. Ticket: OW#1306 Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Use pointer to PTMSI value instead of MIJacob Erlbeck5-45/+26
Currently, ptmsi_enc and new_ptmsi_enc point to the beginning of the mobile identity. Since all P-TMSI in 04.08 (MM) are encoded this way (1 byte header + 4 byte P-TMSI value). This is different to the P-TMSI encoding in 08.18 (BSSGP), where the P-TMSI is encoded into 4 byte without MI header. This patch changes the code to use pointers to the P-TMSI value, which is encoded in the same way in both specifications. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Send STATUS(BVCI unknown) to BSS on unknown PTP BVCIJacob Erlbeck1-4/+11
Currently BSSGP PTP messages are silently dropped when the BVCI is not known and patching is enabled. The nanoBTS will not recognize this and continue to send messages on the BVCI. If it receives a STATUS(BVCI unknown) instead, it will start a BVC reset procedure instead. This patch modifies gbprox_rx_ptp_from_bss() to return a STATUS(BVCI unknown) to the BSS instead of dropping the message. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Replace ';;' by ';'Jacob Erlbeck2-5/+5
This patch removes some superfluous ';' from the code. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Fix parser to accept GSM 24.008 Attach Req messagesJacob Erlbeck1-1/+1
Currently the parse expects a 'MS network capability' IE with 2 <= length <= 3 which is compliant to GSM 04.08, 9.4.1 but not to GSM 24.008, 9.4.1 which specifies 3 <= length <= 9. Thus the parser rejects messages with a length >= 4 (including length field). This patch relaxes the length check to accept either range by requiring 2 <= length <= 9. Ticket: OW#1258 Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Use a separate regexp for routingJacob Erlbeck4-7/+10
Currently one regexp ('patching') is used for all matching. This patch adds a second category 'routing' which is exclusively used for SGSN selection. It also adds a corresponding VTY command: - match-imsi patching RE : MS related patching (currently APN) - match-imsi routing RE : Select secondary SGSN on match only - no match-imsi : Clear all filter expressions Ticket: OW#1258 Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Extend the match-imsi VTY command to support categoriesJacob Erlbeck1-7/+20
This patch modifies the match-imsi command to allow for different match categories (currently only 'patching' is provided). - match-imsi patching RE : Filter APN patching and routing - no match-imsi : Clear all filter expressions Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Cleanup match config after testsJacob Erlbeck2-28/+35
Currently, patch filter configurations are leaking between tests. This adds a call to gbproxy_clear_patch_filter() to the end of each test that calls gbproxy_set_patch_filter(). Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Refactor IMSI matchingJacob Erlbeck6-97/+133
The current implementation makes it difficult to add further match expressions. This patch adds a new struct gbproxy_match that contains the fields needed for each match expression. The matches (config) and the results (link_info) are stored in arrays. All related functions are updated to use them. The old fields in the config structure are removed. Sponsored-by: On-Waves ehf
2014-10-09gbproxy/test: Add expect_msg checks to test_gbproxy_ra_patchingJacob Erlbeck1-0/+59
This patch adds assertions to check the LLC/GMM message received from the gbproxy by the test framework within the function test_gbproxy_ra_patching. Sponsored-by: On-Waves ehf
2014-10-09gbproxy/test: Save and check received messagesJacob Erlbeck1-0/+155
Currently the only way to check, whether the right message have been generated is to look into the generated text output. This is error-prone if there are many messages. This patch adds a way to optionally store all received messages into a FIFO. They can then be checked by calling expect_msg() which removes the first message from the FIFO and returns a pointer to it or NULL if there is none. The pointer is only valid until the next call to this function. A few convenience functions are added to check for common message types: - expect_gmm_msg checks for certain GSM 04.08 messages in LLC/GMM - expect_llc_msg checks for arbitrary LLC messages in BSSGP/UD - expect_bssgp_msg checks for arbitrary BSSG messages Each of their arguments can be set by MATCH_ANY to ignore it while matching. On success, they return a pointer to a statically allocated struct containing the pointer to the msg and the full parse context. Recording is enabled by setting the global variable received_messages to a pointer to a struct llist_head. It can be disabled again by setting it to NULL. Sponsored-by: On-Waves ehf
2014-10-09gprs: Fix gprs_msgb_copy pointer computationJacob Erlbeck1-7/+15
Currently the pointers are computed by adding an offset to the new message's _data pointer even when the original pointer is NULL. This leads to invalid pointers in the copied msgb. This patch adds a NULL check to each computation such that NULL pointers are not adjusted. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Refactor local message generationJacob Erlbeck4-25/+33
This patch adds und uses the function gbproxy_gsm48_to_peer() which takes a GSM 04.08 message, encapsulates it in BSSGP and LLC, and sends it to the BSS peer. This function increments vu_gen_tx_bss which is now used instead of imsi_acq_retries to set the N(U) of the outgoing message. Since imsi_acq_retries isn't currently incremented before a Detach Accept is generated, this patch also fixes the N(U) of such messages. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Reset IMSI acquisition within gbproxy_unregister_link_infoJacob Erlbeck4-1/+10
Currently then link_info is not cleaned up completely, when gbproxy_unregister_link_info is called. This patch adds a function gbproxy_reset_link that must be defined externally. This is done in gb_proxy.c, where it resets the IMSI acquisition. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Parse Attach Reject messagesJacob Erlbeck3-1/+23
That message is currently ignored but should invalidate the TLLI and de-register the logical link instead. This patch extends the parser to recognize such messages and to set the invalidate_tlli flag. Sponsored-by: On-Waves ehf
2014-10-09gbproxy/test: Add invalidation tests to test_gbproxy_keep_info()Jacob Erlbeck2-17/+295
The TLLI should also be invalidated: - when an Attach Reject info is received from the SGSN - when an Attach Req is immediately followed by a Detach Req - when an Attach Req is immediately followed by an MT detach procedure To verify that, this patch adds corresponding message sequences to the test. Sponsored-by: On-Waves ehf
2014-10-09gbproxy/test: Fix IMSI length check (Coverity)Jacob Erlbeck1-1/+1
This fixes the IMSI length assertion, which currently uses a greater-or-equal than zero comparison which always yields true. It is replaced by a greater than zero check. Fixes: Coverity CID 1239442 Sponsored-by: On-Waves ehf
2014-10-09gbproxy/test: Fix time calculation in test_gbproxy_tlli_expire()Jacob Erlbeck1-1/+1
A single test case still uses time() to obtain the reference time. This commit fixes this by using the 'now' variable instead, that contains a fixed time value and does therefore not depend on when the test is executed. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Use monotonic system time instead of time-of-dayJacob Erlbeck2-4/+19
Currently time() is used for age calculations. This time source may jump either forwards or backwards in time (NTP update, leap seconds). This patch replaces the use of time() by using clock_gettime(CLOCK_MONOTONIC) instead. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Only search by valid identifiersJacob Erlbeck1-0/+12
Don't return a link_info if TLLI is 0 resp. P-TMSI is 0xffff. These values are used for uninitialised or cleared fields and can possibly match several entries. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Replace 'tlli' by 'link' in VTY commandsJacob Erlbeck1-47/+47
Since the (former) TLLI list has developed into a logical link list, related commands are renamed accordingly. - tlli-list * -> link-list * - delete-gbproxy-tlli * -> delete-gbproxy-link * - show gbproxy tllis -> show gbproxy links Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Rename the field 'enabled_tllis' to 'logical_links'Jacob Erlbeck5-50/+50
This field in struct gbproxy_patch_state has involved and holds a list of all tracked logical links now. Thus the name is modified accordingly. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Use the term 'link' instead of 'tlli'Jacob Erlbeck7-764/+764
Currently in many places where 'tlli' (Temporary Logical Link Identifier) within identifiers is used, the logical link itself is meant instead. For instance, the tlli_info contain information about an LLC logical link including up to four individual TLLI. To avoid confusion between these concepts, this patch replaces all 'tlli_info' by 'link_info' and a few 'tlli' by 'link'. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Rename functions related to tlli_infoJacob Erlbeck6-149/+148
This patch replaces 'tlli' by 'tlli_info' within the following function identifiers: - gbproxy_delete_tlli - gbproxy_delete_tllis - gbproxy_remove_stale_tllis - gbproxy_touch_tlli - gbproxy_unregister_tlli - gbproxy_remove_matching_tllis - gbproxy_find_tlli -> gbproxy_tlli_info_by_tlli - gbproxy_find_tlli_by_* -> gbproxy_tlli_info_by_* These functions refer to the whole logical link info rather than to a certain TLLI. So they are renamed to be named consistently with gbproxy_attach_tlli_info and others. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Remove sgsn_nsei parameterJacob Erlbeck1-7/+5
The function gbproxy_imsi_acquisition() has a parameter sgsn_nsei that is alyways equal to tlli_info->sgsn_nsei (if tlli_info is not NULL). This patch removes this parameter from gbproxy_imsi_acquisition() and gbproxy_flush_stored_messages() and accesses tlli_info->sgsn_nsei instead within these functions. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Rename identifiers related to IMSI matchingJacob Erlbeck5-16/+16
This patch renames gbproxy_check_tlli() to gbproxy_imsi_matches() and struct tlli_info's enable_patching to imsi_matches. It's meant to be more obvious and consistent this way. Sponsored-by: On-Waves ehf
2014-10-09gbproxy/sgsn: Enforce termination when creating a P-TMSI/TLLIJacob Erlbeck2-3/+20
Currently the number of iterations when creating a P-TMSI/TLLI is not limited. It is nevertheless very unlikely that the loop will not terminate. On the other hand, the number of iterations of every loop should have an upper bound (loop variant) which wouldn't be the case here if an arbitrary random generator was used. This patch limits the number of iterations to 23 and logs an error if the creation of the indentifier was aborted due to this limit. Sponsored-by: On-Waves ehf
2014-10-09gbproxy: Restart IMSI acquisition on RA UDP REQJacob Erlbeck2-3/+8
Currently the IMSI acquisition is not restarted when a RA Update Request is received. This leads to repeated N(U) in the generated Ident Request message, which in turn causes the MS to drop the second of these message. This is bad, when the first Ident Response has been lost between MS and gbproxy. This patch changes gbproxy_imsi_acquisition() to handle RA Update Request messages like Attach Requests. Sponsored-by: On-Waves ehf
2014-10-09gbproxy/test: Test IMSI acquisition for RA UDP REQJacob Erlbeck2-18/+218
When a MS is state GMM_REGISTERED enters a new RA, it sends a RA Update Request which is then handled by a gbproxy that possibly doesn't have a matching tlli_info. In this case, depending on the configuration an identification procedure to acquire the IMSI must be started. This adds tests to test_gbproxy_imsi_acquisition(): - IMSI acquisition triggered by a RA Update Request message - Reaction to repeated RA Update Request messages, like it could be caused by packet loss between PCU and gbproxy. Sponsored-by: On-Waves ehf
2014-10-09sgsn: Free MM context after receiving a Detach RequestJacob Erlbeck2-3/+5
On a Detach/Re-attach cycle the Address Sanitizer detected a use-after-free kind of problem. That is because we tried to destroy the LLME twice. The first time it is destroyed as part of the Detach handling ans the second time it is destroyed as part of destroying the old MM context. In case the GPRS GMM detach message is lost the SGSN needs to reply besides not having a MM entry. The alternative would have been to add NULL checks for all usages of ctx->llme which would not have helped with the readability. Sponsored-by: On-Waves ehf
2014-10-09sgsn: Add test that exposes a dangling pointer to the LLMEHolger Hans Peter Freyther2-0/+61
On detach the LLME get's unassigned (and hence destroyed) but the GMM context will still point to that dead structure.
2014-10-09sgsn: Create testcase that verifies that llmes get deletedHolger Hans Peter Freyther5-11/+182
On an "unassignment" this code verifies that the LLME will vanish from the list of LLMEs. We assume that this doesn't create a memory leak.
2014-10-09sgsn: Add boilerplate code for a SGSN testHolger Hans Peter Freyther8-0/+52
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-04 18:02:13 +0000