aboutsummaryrefslogtreecommitdiffstats
path: root/openbsc/src/libmsc/gsm_04_08.c
AgeCommit message (Collapse)AuthorFilesLines
2016-05-09Merge branch 'master' into sysmocom/iu, with tweakssysmocom/iu_orig_historyNeels Hofmeyr1-17/+70
Numerous manual adjustments are included to make sense on the sysmocom/iu branch: * gsm_04_08_gprs.h has moved to libosmocore on the master branch, but sysmocom/iu has added some entries. Until it is clear whether to move the additions to libosmocore as well, keep gsm_04_08_gprs.h on sysmocom/iu with merely the additions. * Thus, keep using the old gsm_04_08_gprs.[hc] from openbsc in the Makefiles, but only where the sysmocom/iu additions are needed. * In openbsc's gsm_04_08_gprs.h, * include the libosmocore gsm_04_08_gprs.h, * use '#pragma once' instead of #ifndef and * add a TODO comment about moving the rest to libosmocore. * Apply the addition of an osmo_auth_vector to gsm_auth_tuple: in the Iu auth vector hacks, use the gsm_auth_tuple.vec instead of a local struct. See iu_hack__get_hardcoded_auth_tuple() and gsm48_rx_gmm_att_req(). * In the si2q tests, pass NULL as ctx to gsm_network_init(). * In cscn_main.c, add a debug log that was originally added to osmo-nitb. * openbsc/.gitignore: keep only one addition of 'writtenconfig' Conflicts: openbsc/include/openbsc/gprs_sgsn.h openbsc/include/openbsc/gsm_04_08_gprs.h openbsc/src/gprs/gsm_04_08_gprs.c openbsc/src/libmsc/gsm_04_08.c openbsc/src/osmo-cscn/cscn_main.c openbsc/tests/gsm0408/Makefile.am
2016-05-04msc: fix: two missing security operation releasesNeels Hofmeyr1-0/+1
When receiving authentication response or security mode complete messages, actually release the security operation stored with the subscriber conn.
2016-05-04msc: ignore cb retval on auth/sec mode rxNeels Hofmeyr1-4/+4
Just return 0 regardless of the security callback's return value when receiving authentication response or security mode complete messages.
2016-05-04gsm0408_clear_request(): actually free the released connNeels Hofmeyr1-0/+2
By having conn->in_release == 1, calling msc_release_connection() has no effect and thus never frees the conn. So, after all pending requests have been discarded, also discard and free the unused connection.
2016-05-04gsm04_08_clear_request(): release loc with arg release=0Neels Hofmeyr1-1/+1
In gsm04_08_clear_request(), in_release == 1 anyway and msc_release_connection() would exit immediately without any effect. Don't confuse the reader by passing release=1 arg.
2016-05-04cosmetic: move subscr_conn alloc&free to gsm_04_08.cNeels Hofmeyr1-0/+27
Subscriber conn stuff doesn't really belong in gsm_subscriber.c. (I moved because I thought it would call some static functions in gsm_04_08.c, which ended up not being the case; anyway, it makes more sense to stay in gsm_04_08.c.)
2016-05-02msc: paging: use gsm_subscriber API to add Integrity Protection for IuCSNeels Hofmeyr1-22/+1
During peliminary paging response testing, I introduced some code duplication. Remove that and instead call the code that was there before 63b99ced83773d923 ("add preliminary paging response handling, incomplete"). By calling the gsm_subscriber API, the connection is also secured and hence Integrity Protection is enabled for IuCS.
2016-05-02cosmetic: msc: handle_paging_resp() tweaksNeels Hofmeyr1-7/+7
Tweak debug logging, use paging category DPAG. Change the order of arguments to make more sense in the causal relationship.
2016-05-02gsm_04_08 mscsplit: subscr_request_channel() -> subscr_request_conn()Neels Hofmeyr1-2/+2
Rename subscr_request_channel() to _conn() and remove the channel_type arg. The "channel" is a term from closely tied MSC+BSC code, after separation we shall call it a "connection", i.e. over IuCS or A. The channel_type arg is already unused from a previous MSCSPLIT commit.
2016-05-02gsm_04_08: factor out subscr authorization checkNeels Hofmeyr1-27/+5
Add function subscr_authorized(), absorbing the guts of static authorize_subscriber() from gsm_04_08.c, except the parts specific to Location Updating. subscr_authorized() is a check that is to be added to validation of a paging response.
2016-04-29Start to use struct osmo_auth_vector from gsm_auth_tupleHarald Welte1-5/+5
Rather than having a 'private' structure for kc, sres and rand, we now finally (with 4 years delay) use osmo_auth_vector from libosmogsm, which encapsulates authentication vectors that can be either GSM triplets or UMTS quintuples or a combination of both. gsm_auth_tuple becomes a wrapper around osmo_auth_vector, adding use_count and key_seq to it. key_seq is no longer initialized inside gprs_gsup_messages.c, as there is no CKSN / key_seq inside the message anyway. If a usre of the code needs key_seq, they need to manage it themselves.
2016-04-29Disconnect calls with incompatible channel types / modesMax1-1/+45
In case both TCH/H and TCH/F or different codecs are configured and internal MNCC handler is used we might end up in a situation where call legs with incompatible channel types or codecs would be connected resulting in a broken audio. Disconnect such calls with appropriate error message. Fixes: OS#1663
2016-04-27debug log for paging: add/tweakNeels Hofmeyr1-5/+2
2016-04-25paging response: remove extraneous null check, assert conn and msg further upNeels Hofmeyr1-1/+4
In handle_paging_response(), don't check conn against NULL after using it all the time anyway. To ensure beyond doubt that it is actually never NULL, assert conn further up in the call stack, i.e. in gsm0408_dispatch(), the main entry point for receiving data from the BSC/RNC level. Also assert msg while at it. Fixes: CID#93769
2016-04-22Add extra debug output with channel mode and typeMax1-5/+18
This provides helpful information for debugging internal MNCC handler.
2016-04-20add preliminary paging response handling, incompleteNeels Hofmeyr1-5/+45
In gsm_04_08.c, add a static handle_paging_resp() to take over from the libbsc function gsm48_handle_paging_resp(). Use the subscr->requests listing to handle a Paging Response and call the pending cbfn. In NITB, this used to be done via BTS, and I haven't entirely resolved yet how exactly to rewire this in standalone libmsc. So far, this "works for me", but is worth another visit. Still missing: enable Integrity Protection.
2016-04-20gsm_04_08.c: fix security mode cmd: use auth tuple from MM authNeels Hofmeyr1-12/+2
2016-04-20cosmetic: auth tuple memcpy: rather use target's sizeof()Neels Hofmeyr1-3/+3
2016-04-20tweak tmp_rand[] type to avoid compiler warningsNeels Hofmeyr1-2/+2
2016-04-20IuCS auth: generate auth tuples, factor outNeels Hofmeyr1-11/+32
Factor out hardcoded-Ki and auth tuple creation into a static function. Add generation of fresh random bytes and generate a valid auth tuple so that the authentication token is different for every MM Auth.
2016-04-19libmsc: Pass KeyStatus to iu_tx_sec_mode_cmdDaniel Willmann1-1/+1
2016-03-22comments about incomplete MM cipheringNeels Hofmeyr1-0/+5
2016-03-22cscn: implement integrity protectionNeels Hofmeyr1-1/+24
Upon authentication response, initiate integrity protection for Iu by sending a Security Mode Command (IK), with hardcoded auth tuple so far. Implement RANAP event handling to receive Security Mode Complete message, adding stubs for the other events; in new files osmo-cscn/iucs_ranap.[hc] to keep RANAP dependencies separate, and particularly out of libmsc. Upon receiving Security Mode Complete, call the security operation callback (conn->sec_operation->cb) to complete the Location Update. Introduce enum integrity_protection_state constants to indicate integrity protection, record in gsm_subscriber_conn.iu.integrity_protection. Make subscr_conn_lookup_iu() non-static and declare in iu_cs.h to be able to call from iucs_ranap.c's Security Mode Complete event. Implement dummy iu_tx_sec_mode_cmd() to allow tests to build without RANAP dependencies. In cscn_main.c, call iucs_rx_ranap_event(), to populate the struct gsm_network struct with cscn_network explicitly (don't share cscn_network across compilation scopes because it's ugly).
2016-03-22in gsm8_rx_mm_auth_resp(): call sec_operation.cb() instead of finish_lu() ↵Neels Hofmeyr1-9/+7
directly
2016-03-22gsm0408_authorize(): remove unused msgb arg, make non-staticNeels Hofmeyr1-3/+3
Prepares for calling from IuCS RANAP events.
2016-03-22cosmetic: whitespace, comment, rename static func rx_iu_event()Neels Hofmeyr1-1/+1
2016-03-17fix confusing typo in constant (THAN -> THEN)Neels Hofmeyr1-1/+1
2016-03-1504.08: apply new transaction id inline functionsNeels Hofmeyr1-1/+1
libosmocore recently added inline functions to relieve callers from applying bitmasks and bit shifts to access the transaction id of a GSM 04.08 header. Apply these functions.
2016-03-1504.08: apply new bitmask functions, fix bitmask useNeels Hofmeyr1-6/+5
Replace hardcoded protocol discriminator and message type bitmasks with function calls recently introduced in libosmocore. Note that the release 98 bitmasks slightly differ from the release 99 bitmasks. This patch uses the "default" gsm48_hdr_msg_type invocation, thus it depends on libosmocore whether 98 or 99 bitmasks are used. In some places, use of the bitmask was erratic. Fix these implicitly by employing the bitmask functions: * silent_call.c: silent_call_reroute(): add missing bitmask for MM. * bsc_msg_filter.c: bsc_msg_filter_initial(): RR vs. MM messages. * osmo_bsc_filter.c: bsc_find_msc() and bsc_scan_bts_msg(): RR vs. MM messages. * bsc_nat_rewrite.c: bsc_nat_rewrite_msg(): SMS vs. CC messages. * bsc_ussd.c: no bitmask is applicable for the message types used here. * gb_proxy.c: gbproxy_imsi_acquisition(): missing bit mask for pdisc. In gprs_gb_parse.c: gprs_gb_parse_dtap(), add a log notice for unexpected message types.
2016-03-1504.08: apply new transaction id inline functionsNeels Hofmeyr1-1/+1
libosmocore recently added inline functions to relieve callers from applying bitmasks and bit shifts to access the transaction id of a GSM 04.08 header. Apply these functions.
2016-03-1504.08: apply new bitmask functions, fix bitmask useNeels Hofmeyr1-4/+4
Replace hardcoded protocol discriminator and message type bitmasks with function calls recently introduced in libosmocore. Note that the release 98 bitmasks slightly differ from the release 99 bitmasks. This patch uses the "default" gsm48_hdr_msg_type invocation, thus it depends on libosmocore whether 98 or 99 bitmasks are used. In some places, use of the bitmask was erratic. Fix these implicitly by employing the bitmask functions: * silent_call.c: silent_call_reroute(): add missing bitmask for MM. * bsc_msg_filter.c: bsc_msg_filter_initial(): RR vs. MM messages. * osmo_bsc_filter.c: bsc_find_msc() and bsc_scan_bts_msg(): RR vs. MM messages. * bsc_nat_rewrite.c: bsc_nat_rewrite_msg(): SMS vs. CC messages. * bsc_ussd.c: no bitmask is applicable for the message types used here. * gb_proxy.c: gbproxy_imsi_acquisition(): missing bit mask for pdisc. In gprs_gb_parse.c: gprs_gb_parse_dtap(), add a log notice for unexpected message types.
2016-03-15cosmetic: commentsNeels Hofmeyr1-1/+1
2016-03-14msc: allow only authentication without cipheringNeels Hofmeyr1-4/+14
So far the code did only auth+ciph or none. Add case handling for only authentication without ciphering (basically just fill in the blanks).
2016-03-14HACK: hardcode subscriber auth tuple for IuCSNeels Hofmeyr1-0/+12
2016-03-14cosmeticNeels Hofmeyr1-3/+2
2016-03-14Adjust authentication logic for Iu, move a log noticeNeels Hofmeyr1-4/+27
Depending on conn->via_iface, fail upon missing auth for 3G. Move the log notice saying "skipping auth" to gsm48_secure_channel() where conn->via_iface is actually known.
2016-03-14spread a few debug logs around authenticationNeels Hofmeyr1-7/+43
2016-03-14fix confusing typo in constant (THAN -> THEN)Neels Hofmeyr1-1/+1
2016-03-14Remove unused auth code and add commentNeels Hofmeyr1-4/+13
As commented in the code, the GSM_SECURITY_AUTH_FAILED path is never invoked by the gsm48_secure_channel() function as it is today. Note that the upcoming Iu auth will probably add a GSM_SECURITY_AUTH_FAILED status. In that case, sending a LU Reject immediately may be desirable, but arguably a bit of timeout could make life harder for auth attackers. The code removed by this patch doesn't send out a LU Reject ever, since a call to release_loc_updating_req() only releases the connection. To reject, a call to gsm0408_loc_upd_rej() would be necessary, as seen in loc_upd_rej_cb(). And finally, if _gsm0408_authorize_sec_cb() doesn't do anything about anything, the same loc_upd_rej_cb() will be run by a timeout and send a LU Reject properly (as commented in the code).
2016-03-04libmsc: stubify paging (A-/Iu-interfaces need to reimplement this)Neels Hofmeyr1-0/+5
2016-03-03mscsplit: fix compilation and comments. move msc_api.h.Neels Hofmeyr1-2/+3
2016-03-03cscn wip: direct dtap responses to IuCSNeels Hofmeyr1-1/+3
2016-03-03mscsplit: remove bts and lchan pointers from libmscNeels Hofmeyr1-182/+109
The diff between this and master will probably need a lot of review and fixes. The current state does compile, but I expect pretty much everything to be broken now. Future development will reinstate proper functionality piecemeal. The first goal is to get basic signalling to work, then SMS. The voice control (RTP) is completely disabled now (see "#if BEFORE_MSCSPLIT") and will be fixed last AFAICT.
2016-03-03gsm_04_08.c: Don't set msg->lchan nor msg->dstHarald Welte1-20/+5
the BSC-side of the API behind gsm0808_submit_dtap() is doing this resolving again anyway. So let's avoid doing it twice, and avoid having more dependency of the MSC down into the lchan details.
2016-03-03gsm_04_11.c/04_08.c: s/lchan/conn/ where we don't use lchan for yearsHarald Welte1-8/+7
2016-03-03subscr_name(): Handle case for subscr == NULLHarald Welte1-5/+2
subscr_name() was called from several places: * either without a check for subscr being NULL, which for example was causing a segfault if we hand-over a channel before identifying the subscriber * or with an explicit NULL check and the ternary operator (?). We now simplify the code by checking for the NULL Subscriber in subscr_name() itself.
2016-03-03Fix two rc values in gsm0408_dispatch()Neels Hofmeyr1-0/+2
I do hope the unimplemented/unknown messages did not return 0 intentionally.
2016-01-30gsm0408: Provide unique strings for the gsm 04.08 messageHolger Hans Peter Freyther1-29/+29
At Rhizomatica we see that some GSM 04.08 messages are leaked and have no other indication if that is Call Control, SMS or something else.
2015-12-12mncc: introduce 'struct gsm_mncc_bridge' for MNCC_BRIDGEHarald Welte1-3/+3
When a MNCC handler wants to issue the MNCC_BRIDGE primitive overt the MNCC interface, this was not possible so far via the MNCC socket. This primitive was so far only available from the internal MNCC handler, more or less by accident I suppose. The reason for this is in the way the array of two call references had been passed into mncc_tx_to_cc().
2015-09-14mncc: Use the default codec from the built-in mncc modeHolger Hans Peter Freyther1-4/+5
In case of the RTP bridge mode we need to select the codec ourselves. Rely on the same (incomplete) codec selection that can be done using the mncc-int configuration node. This might gain bearer capabilities support. In case of a SDCCH a TCH/F will be attempted to be assigned. This is an open issue for both modes and there should be a preference for full or half-rate channels somewhere.
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-10 11:35:01 +0000