aboutsummaryrefslogtreecommitdiffstats
path: root/openbsc/src/gprs/sgsn_auth.c
AgeCommit message (Collapse)AuthorFilesLines
2017-07-12move openbsc/* to repos rootNeels Hofmeyr1-312/+0
This is the first step in creating this repository from the legacy openbsc.git. Like all other Osmocom repositories, keep the autoconf and automake files in the repository root. openbsc.git has been the sole exception, which ends now. Change-Id: I9c6f2a448d9cb1cc088cf1cf6918b69d7e69b4e7
2017-02-27SGSN: Integrate support for UMTS AKANeels Hofmeyr1-1/+2
The general infrastructure for UMTS AKA is already in place: * GSUP with capability to send us auth_vectors that contain either triplets or quintuples * mm_context that holds such auth_vectors Add: * capability to send UMTS AUTN in GMM AUTH REQ * parse extended UMTS RES * on auth response, validate expected AKA with vector and received res/sres * add Auth Failure message to receive resync AUTS token and * send to HLR * clear out-of-sync auth tuple * enter new state for when we're waiting for HLR to resync and send new tuples so that the next Auth Request will be handled Original first half of this patch by: Harald Welte <laforge@gnumonks.org> Full UMTS AKA procedure including AUTS resync tested to work against OsmoHLR with R99 USIM and Milenage algorithm. The sgsn_test.c needs adjustment because we're checking the vector's auth_types now. Depends: libosmocore change-ids I277fb3d407396dffa5c07a9c5454d87a415d393f If943731a78089f0aac3d55245de80596d01314a4 Related: OS#1956 Change-Id: Ie6a0cefba5e4e7f02cc2eaf6ec006ac07d5c1816
2017-02-25add struct gprs_subscr, separating gprs from gsm_subscriberNeels Hofmeyr1-4/+4
Prepare for replacing gsm_subscriber with vlr_subscriber. vlr_subscriber will not make sense to be used in gprs, so have a dedicated GPRS subscriber struct. (Could change if the gprs code were to use libvlr; is currently independent). Related: OS#1592 Change-Id: Ia8b391ee009c8545763cba04505be3947835120e
2017-01-23cosmetic: use osmo_strlcpy() everywhereNeels Hofmeyr1-1/+2
Shorten some code and make obvious to the reader that the string copy is done in a safe way. Change-Id: I900726cf06d34128db22a3d3d911ee0d1423b1bd
2016-05-05Add human-readable name of SGSN_AUTH_AUTHENTICATEHarald Welte1-0/+1
In commit 4adb136da63a1d3ed523ad85e12fd99fc62f5701 we introduced a new authentication state SGSN_AUTH_AUTHENTICATE, but we didn't add that to auth_state_names[] resulting in log messages printing it abut 'unknown 0x1' rather than something more useful.
2016-04-29move gsm_04_08_gprs.h to libosmocoreHarald Welte1-1/+1
This requres the corresponding commit in libosmocore.
2015-01-26sgsn: Ensure 0-terminated imsi strings (Coverity)Jacob Erlbeck1-1/+1
Currently the size argument of strncpy is set to sizeof(mm->imsi) in some places. If the source IMSI string is too long, the terminating NUL byte in the static mm->imsi field gets overwritten. This patch limits the size to sizeof(mm->imsi)-1, so that the last byte of the buffer (that has been initialized to 0) is not overwritten. Fixes: Coverity CID 12065751, 12065754, 1206575 Sponsored-by: On-Waves ehf
2015-01-20sgsn: Add SGSN_ERROR_CAUSE_NONE and use it instead of 0Jacob Erlbeck1-1/+3
Currently an error_cause of 0 is being used to indicate normal operation. Albeit this is not a defined GMM cause, the value is not explicitly reserved. This commit adds the macro SGSN_ERROR_CAUSE_NONE and uses it for initialisation (instead of relying on talloc_zero) and comparisons. The value is set to -1 to be on the safe side. The VTY code is updated to set the error_cause when using the 'update-subscriber imsi IMSI update-location-result CAUSE' command. Sponsored-by: On-Waves ehf
2015-01-20sgsn: Fix access to subscr in sgsn_auth_update (Coverity)Jacob Erlbeck1-1/+1
Currently the access to subscr->sgsn_data->error_cause is not protected against subscr == NULL like it is done in other code paths of sgsn_auth_update. This commit adds a conditional to avoid a NULL-dereference. Fixes: Coverity CID 1264589 Sponsored-by: On-Waves ehf
2015-01-18sgsn: Pass subscriber error causes to the GMM layerJacob Erlbeck1-2/+5
This patch extends gsm0408_gprs_access_denied and gsm0408_gprs_access_cancelled to accept GMM cause codes. These are then passed to the MS, unless gsm0408_gprs_access_cancelled is called with cause 0 (no error -> updateProcedure). Since gsm0408_gprs_access_denied uses GMM_CAUSE_GPRS_NOTALLOWED if the cause is not set, and the subscriber's error_cause is never set (and thus always 0), the SGSN's behaviour does not change with this patch. Sponsored-by: On-Waves ehf Conflicts: openbsc/include/openbsc/gprs_sgsn.h [hfreyther: Conflict due the removal of the unused authenticate flag]
2015-01-18sgsn: Add global require_update_location flagJacob Erlbeck1-4/+7
This flag is used to determine, whether the Update Location procedure shall be invoked. This is currently only set, when the 'remote' authorization policy is set. When the flag is set, sgsn_auth_update will not never be called directly by sgsn_auth_request, if an Attach Request procedure is pending, even if the remote connection fails for some reason. Sponsored-by: On-Waves ehf
2015-01-18sgsn: Replace subscr.authenticate by global require_authentication flagJacob Erlbeck1-2/+2
Currently the flag 'authenticate' is managed per subscriber. This patch replaces that flag by a global cfg.require_authentication flag that enables/disables the use of the Auth & Ciph procedure for every subscriber. The flag is set by the VTY, if and only if the authorization policy is 'remote'. The VTY command - update-subscriber imsi IMSI insert authenticate <0-1> is removed. Sponsored-by: On-Waves ehf
2014-12-24sgsn: Add a subscriber based authentication phaseJacob Erlbeck1-10/+69
This implements the MAP way of subscriber validation when the MS tries to perform an Attach Request: 1. perform authentication (optionally invoke the sendAuthInfo procedure), starts the Auth & Ciph procedure 2. perform update location 3. insert subscriber data 4. finish the update location 5. Attach Accept / Attach Reject The authentication triplets are used and eventually updated if all of them have been used. This is currently accessible via the VTY interface by the following commands: - update-subscriber imsi IMSI update-auth-info - update-subscriber imsi IMSI update-location-result (ok|ERR-CAUSE) Sponsored-by: On-Waves ehf
2014-12-24sgsn: Add support for authentication tripletsJacob Erlbeck1-0/+37
This commit add data structures, functions, initialization, and VTY commands for per subscriber authentication triplets. The following VTY command is added: - update-subscriber imsi IMSI \ insert auth-triplet <1-5> sres SRES rand RAND kc KC Note that the triplets are not really used by the SGSN yet. Sponsored-by: On-Waves ehf
2014-12-23sgsn: Log requested state change in sgsn_auth_updateJacob Erlbeck1-2/+5
Sponsored-by: On-Waves ehf
2014-12-10sgsn: Support subscriber based authenticationJacob Erlbeck1-0/+7
This commit mainly extends sgsn_auth.c to use and support the auth_state SGSN_AUTH_AUTHENTICATE. It will be activated when IMSI and IMEI are available, authentication is required (subscr->sgsn_data->authenticate is set), but the MM context is not marked as authenticated. If the state has been set to SGSN_AUTH_AUTHENTICATE and sgsn_auth_update() is called, the GMM layer will be informed by invoking gsm0408_gprs_authenticate(). Sponsored-by: On-Waves ehf
2014-12-09sgsn: Add gsm0408_gprs_access_cancelledJacob Erlbeck1-1/+4
This function is called to delete an established MM context silently without invoking a detach procedure. It is called when a subscriber is cancelled by the HLR. This generally happens, when an MS has moved to another routing area and has to use another SGSN. Sponsored-by: On-Waves ehf
2014-12-09sgsn: Integrate subscriber handling into the SGSNJacob Erlbeck1-3/+26
This commit adds a new authorization policy 'remote' and uses the subscriber cache for authorization when this policy is being used. Note that there is no remote backend implemented yet. After the IMSI/IMEI have been acquired, a request would be sent to the remote peer. The attach/auth-ciph procedure continues when authorization info has been received from the peer. This means, that gprs_subscr_update() must be called then to tell the GMM layer that it can proceed. A later commit will add VTY commands to do this manually. Sponsored-by: On-Waves ehf
2014-11-14sgsn: Remove explicit sgsn_instance parametersJacob Erlbeck1-8/+7
Currently the function in sgsn_auth.c either have an sgsn_config or an sgsn_instance parameter. Since then global sgsn variable is already being used in that file and since other parts of the SGSN related code also rely on a global sgsn singleton, these parameters pretend to provide a flexibility that is not really supported. Therefore this patch removes these parameters except for the ACL related functions, which do not call code that uses the sgsn variable. Sponsored-by: On-Waves ehf
2014-11-14sgsn: Refactor sgsn_auth to separate request and authorizationJacob Erlbeck1-14/+24
Currently the authorization is done in sgsn_auth_request for ACL based authorization. This doesn't match the way remote authorization would work, so that there is a second call to sgsn_auth_state already present in sgsn_auth_update. This patch removes the autorization check completely from sgsn_auth_request which in turn calls sgsn_auth_update directly now. Sponsored-by: On-Waves ehf
2014-11-14sgsn: Add 'acl-only' authentication policyJacob Erlbeck1-7/+23
Currently the VTY 'auth-policy' command results in setting or clearing the acl_enabled flag. This also enables the matching of the MCC/MNC prefix of the IMSI. This patch adds an additional policy 'acl-only' which disables the MCC/MNC matching and relies on the ACL only. Sponsored-by: On-Waves ehf
2014-11-14sgsn: Make authorization asynchronousJacob Erlbeck1-0/+73
Currently the authorization of an IMSI is done by checking ACLs synchronously which is not feasible when the subscriber data has to be retrieved from an external source. This patch changes this by using a callback when the information is available. This is also done when only ACL are checked, in this case the callback is invoked from within sgsn_auth_request(). The callback function sgsn_update_subscriber_data calls sgsn_auth_update which in turn calls either gsm0408_gprs_access_granted or gsm0408_gprs_access_denied. gsm48_gmm_authorize is extended by a call to sgsn_auth_request when IMSI and IMEI are available but the auth_state is unknown. The change has been successfully tested with single phones (E71 and IPhone 5c). Sponsored-by: On-Waves ehf
2014-10-27sgsn: Moved IMSI ACL management to sgsn_auth.cJacob Erlbeck1-0/+71
Currently the ACL code is located in sgsn_vty.c. This commit moves this to a new file sgsn_auth.c as a first step to make authorization more flexible in order to implement remote acquisition on subsciber data. Sponsored-by: On-Waves ehf
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-29 12:25:47 +0000