diff options
author | Harald Welte <laforge@gnumonks.org> | 2018-06-05 21:46:35 +0200 |
---|---|---|
committer | Harald Welte <laforge@gnumonks.org> | 2018-06-05 21:57:54 +0200 |
commit | b5f81b9fbd5de8ef45bffbe6136ac843f96f7130 (patch) | |
tree | 961d284903c870c5080d5fcd6ab595bf4bc66c37 /src | |
parent | 1f1c56c62279bbe4203f8d8a8e8e4a771f3b4eda (diff) |
Reject ASSIGNMENT REQ with CIC but no AoIP transp addr in AoIP case
If we receive a BSSMAP ASSIGNMENT REQ for a speech channel
containing only a CIC but no AoIP transport layer address, then that's
illegal and must be rejected.
In Change-Id If362a0084de452727cd063063dfb645eca2f9beb we re-introduced
accepting CIC-only ASSIGNMENT REQ, but we failed to verify that this
actually only happens over a SCCPlite A interface.
This fixes the BSC_Tests.TC_assignment_cic_only testcase.
Change-Id: Ia6e3897edca48b9f838ea69939d9b8be7185abf8
Diffstat (limited to 'src')
-rw-r--r-- | src/osmo-bsc/osmo_bsc_bssap.c | 33 |
1 files changed, 25 insertions, 8 deletions
diff --git a/src/osmo-bsc/osmo_bsc_bssap.c b/src/osmo-bsc/osmo_bsc_bssap.c index 24a5e3a3e..c2d51b5cb 100644 --- a/src/osmo-bsc/osmo_bsc_bssap.c +++ b/src/osmo-bsc/osmo_bsc_bssap.c @@ -742,6 +742,8 @@ static int bssmap_handle_assignm_req(struct gsm_subscriber_connection *conn, } msc = conn->sccp.msc; + if (msc->a.asp_proto != OSMO_SS7_ASP_PROT_IPA) + aoip = true; tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l4h + 1, length - 1, 0, 0); @@ -771,14 +773,27 @@ static int bssmap_handle_assignm_req(struct gsm_subscriber_connection *conn, cause = GSM0808_CAUSE_REQ_CODEC_TYPE_OR_CONFIG_NOT_SUPP; goto reject; case GSM0808_CHAN_SPEECH: - /* Detect if a CIC code is present, if so, we use the classic ip.access method to - * calculate the RTP port */ if (TLVP_PRESENT(&tp, GSM0808_IE_CIRCUIT_IDENTITY_CODE)) { + /* CIC is permitted in both AoIP and SCCPlite */ conn->user_plane.cic = osmo_load16be(TLVP_VAL(&tp, GSM0808_IE_CIRCUIT_IDENTITY_CODE)); timeslot = conn->user_plane.cic & 0x1f; multiplex = (conn->user_plane.cic & ~0x1f) >> 5; - } else if (TLVP_PRESENT(&tp, GSM0808_IE_AOIP_TRASP_ADDR)) { + } else { + if (!aoip) { + /* no CIC but SCCPlite: illegal */ + LOGP(DMSC, LOGL_ERROR, "SCCPlite MSC, but no CIC in ASSIGN REQ?\n"); + cause = GSM0808_CAUSE_INFORMATION_ELEMENT_OR_FIELD_MISSING; + goto reject; + } + } + if (TLVP_PRESENT(&tp, GSM0808_IE_AOIP_TRASP_ADDR)) { + if (!aoip) { + /* SCCPlite and AoIP transport address: illegal */ + LOGP(DMSC, LOGL_ERROR, "AoIP Transport address over IPA ?!?\n"); + cause = GSM0808_CAUSE_INCORRECT_VALUE; + goto reject; + } /* Decode AoIP transport address element */ rc = gsm0808_dec_aoip_trasp_addr(&rtp_addr, TLVP_VAL(&tp, GSM0808_IE_AOIP_TRASP_ADDR), @@ -788,12 +803,14 @@ static int bssmap_handle_assignm_req(struct gsm_subscriber_connection *conn, cause = GSM0808_CAUSE_INCORRECT_VALUE; goto reject; } - aoip = true; } else { - LOGP(DMSC, LOGL_ERROR, "AoIP transport address and CIC missing. " - "Audio would not work; rejecting\n"); - cause = GSM0808_CAUSE_INFORMATION_ELEMENT_OR_FIELD_MISSING; - goto reject; + if (aoip) { + /* no AoIP transport level address but AoIP transport: illegal */ + LOGP(DMSC, LOGL_ERROR, "AoIP transport address missing in ASSIGN REQ, " + "audio would not work; rejecting\n"); + cause = GSM0808_CAUSE_INFORMATION_ELEMENT_OR_FIELD_MISSING; + goto reject; + } } /* Decode speech codec list (AoIP) */ |