From 531734a547f16de08ce94ec64d58cf94c2230893 Mon Sep 17 00:00:00 2001
From: Neels Hofmeyr <nhofmeyr@sysmocom.de>
Date: Mon, 14 Mar 2016 16:13:24 +0100
Subject: 04.08: apply new bitmask functions, fix bitmask use

Replace hardcoded protocol discriminator and message type bitmasks with
function calls recently introduced in libosmocore.

Note that the release 98 bitmasks slightly differ from the release 99 bitmasks.
This patch uses the "default" gsm48_hdr_msg_type invocation, thus it depends on
libosmocore whether 98 or 99 bitmasks are used.

In some places, use of the bitmask was erratic. Fix these implicitly by
employing the bitmask functions:

 * silent_call.c: silent_call_reroute(): add missing bitmask for MM.
 * bsc_msg_filter.c: bsc_msg_filter_initial(): RR vs. MM messages.
 * osmo_bsc_filter.c: bsc_find_msc() and bsc_scan_bts_msg(): RR vs. MM
   messages.
 * bsc_nat_rewrite.c: bsc_nat_rewrite_msg(): SMS vs. CC messages.
 * bsc_ussd.c: no bitmask is applicable for the message types used here.
 * gb_proxy.c: gbproxy_imsi_acquisition(): missing bit mask for pdisc.

In gprs_gb_parse.c: gprs_gb_parse_dtap(), add a log notice for unexpected
message types.
---
 openbsc/src/gprs/gb_proxy.c                |  4 ++--
 openbsc/src/gprs/gprs_gb_parse.c           | 13 ++++++++++---
 openbsc/src/gprs/gprs_gmm.c                |  2 +-
 openbsc/src/libbsc/bsc_api.c               |  8 +++++---
 openbsc/src/libfilter/bsc_msg_filter.c     | 10 +++++-----
 openbsc/src/libmsc/gsm_04_08.c             | 11 +++++------
 openbsc/src/libmsc/silent_call.c           |  5 +++--
 openbsc/src/osmo-bsc/osmo_bsc_api.c        |  8 ++++----
 openbsc/src/osmo-bsc/osmo_bsc_filter.c     | 10 +++++-----
 openbsc/src/osmo-bsc_nat/bsc_nat.c         |  4 ++--
 openbsc/src/osmo-bsc_nat/bsc_nat_rewrite.c |  4 ++--
 openbsc/src/osmo-bsc_nat/bsc_ussd.c        |  4 ++--
 12 files changed, 46 insertions(+), 37 deletions(-)

(limited to 'openbsc/src')

diff --git a/openbsc/src/gprs/gb_proxy.c b/openbsc/src/gprs/gb_proxy.c
index 955133562..6e6b03b86 100644
--- a/openbsc/src/gprs/gb_proxy.c
+++ b/openbsc/src/gprs/gb_proxy.c
@@ -462,8 +462,8 @@ static int gbproxy_imsi_acquisition(struct gbproxy_peer *peer,
 	if (link_info->imsi_acq_pending && link_info->imsi_len > 0) {
 		int is_ident_resp =
 			parse_ctx->g48_hdr &&
-			parse_ctx->g48_hdr->proto_discr == GSM48_PDISC_MM_GPRS &&
-			parse_ctx->g48_hdr->msg_type == GSM48_MT_GMM_ID_RESP;
+			gsm48_hdr_pdisc(parse_ctx->g48_hdr) == GSM48_PDISC_MM_GPRS &&
+			gsm48_hdr_msg_type(parse_ctx->g48_hdr) == GSM48_MT_GMM_ID_RESP;
 
 		/* The IMSI is now available */
 		gbproxy_flush_stored_messages(peer, msg, now, link_info,
diff --git a/openbsc/src/gprs/gprs_gb_parse.c b/openbsc/src/gprs/gprs_gb_parse.c
index 609685407..63ac9028d 100644
--- a/openbsc/src/gprs/gprs_gb_parse.c
+++ b/openbsc/src/gprs/gprs_gb_parse.c
@@ -329,17 +329,20 @@ int gprs_gb_parse_dtap(uint8_t *data, size_t data_len,
 		       struct gprs_gb_parse_context *parse_ctx)
 {
 	struct gsm48_hdr *g48h;
+	uint8_t pdisc;
+	uint8_t msg_type;
 
 	if (gprs_shift_v_fixed(&data, &data_len, sizeof(*g48h), (uint8_t **)&g48h) <= 0)
 		return 0;
 
 	parse_ctx->g48_hdr = g48h;
 
-	if ((g48h->proto_discr & 0x0f) != GSM48_PDISC_MM_GPRS &&
-	    (g48h->proto_discr & 0x0f) != GSM48_PDISC_SM_GPRS)
+	pdisc = gsm48_hdr_pdisc(g48h);
+	if (pdisc != GSM48_PDISC_MM_GPRS && pdisc != GSM48_PDISC_SM_GPRS)
 		return 1;
 
-	switch (g48h->msg_type) {
+	msg_type = gsm48_hdr_msg_type(g48h);
+	switch (msg_type) {
 	case GSM48_MT_GMM_ATTACH_REQ:
 		return gprs_gb_parse_gmm_attach_req(data, data_len, parse_ctx);
 
@@ -376,6 +379,10 @@ int gprs_gb_parse_dtap(uint8_t *data, size_t data_len,
 		break;
 
 	default:
+		LOGP(DLLC, LOGL_NOTICE,
+		     "Unknown GSM 04.08 message type 0x%02hhx for protocol"
+		     " discriminator 0x%02hhx.\n",
+		     msg_type, pdisc);
 		break;
 	};
 
diff --git a/openbsc/src/gprs/gprs_gmm.c b/openbsc/src/gprs/gprs_gmm.c
index d93ba3f77..9d94c24fe 100644
--- a/openbsc/src/gprs/gprs_gmm.c
+++ b/openbsc/src/gprs/gprs_gmm.c
@@ -2089,7 +2089,7 @@ int gsm0408_gprs_force_reattach(struct sgsn_mm_ctx *mmctx)
 int gsm0408_gprs_rcvmsg(struct msgb *msg, struct gprs_llc_llme *llme)
 {
 	struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_gmmh(msg);
-	uint8_t pdisc = gh->proto_discr & 0x0f;
+	uint8_t pdisc = gsm48_hdr_pdisc(gh);
 	struct sgsn_mm_ctx *mmctx;
 	struct gprs_ra_id ra_id;
 	int rc = -EINVAL;
diff --git a/openbsc/src/libbsc/bsc_api.c b/openbsc/src/libbsc/bsc_api.c
index 504f044fb..e6d820d7e 100644
--- a/openbsc/src/libbsc/bsc_api.c
+++ b/openbsc/src/libbsc/bsc_api.c
@@ -563,6 +563,7 @@ static void dispatch_dtap(struct gsm_subscriber_connection *conn,
 	struct bsc_api *api = msg->lchan->ts->trx->bts->network->bsc_api;
 	struct gsm48_hdr *gh;
 	uint8_t pdisc;
+	uint8_t msg_type;
 	int rc;
 
 	if (msgb_l3len(msg) < sizeof(*gh)) {
@@ -571,7 +572,8 @@ static void dispatch_dtap(struct gsm_subscriber_connection *conn,
 	}
 
 	gh = msgb_l3(msg);
-	pdisc = gh->proto_discr & 0x0f;
+	pdisc = gsm48_hdr_pdisc(gh);
+	msg_type = gsm48_hdr_msg_type(gh);
 
 	/* the idea is to handle all RR messages here, and only hand
 	 * MM/CC/SMS-CP/LCS up to the MSC.  Some messages like PAGING
@@ -581,7 +583,7 @@ static void dispatch_dtap(struct gsm_subscriber_connection *conn,
 	 * will call api->compl_l3() for it */
 	switch (pdisc) {
 	case GSM48_PDISC_RR:
-		switch (gh->msg_type) {
+		switch (msg_type) {
 		case GSM48_MT_RR_GPRS_SUSP_REQ:
 			DEBUGP(DRR, "GRPS SUSPEND REQUEST\n");
 			break;
@@ -640,7 +642,7 @@ static void dispatch_dtap(struct gsm_subscriber_connection *conn,
 			 * messages, but we'd rather forward what we
 			 * don't know than drop it... */
 			LOGP(DRR, LOGL_NOTICE, "BSC: Passing unknown 04.08 "
-			     "RR message type 0x%02x to MSC\n", gh->msg_type);
+			     "RR message type 0x%02x to MSC\n", msg_type);
 			if (api->dtap)
 				api->dtap(conn, link_id, msg);
 		}
diff --git a/openbsc/src/libfilter/bsc_msg_filter.c b/openbsc/src/libfilter/bsc_msg_filter.c
index eafeff4db..115d376cb 100644
--- a/openbsc/src/libfilter/bsc_msg_filter.c
+++ b/openbsc/src/libfilter/bsc_msg_filter.c
@@ -339,15 +339,15 @@ int bsc_msg_filter_initial(struct gsm48_hdr *hdr48, size_t hdr48_len,
 	cause->lu_reject_cause = GSM48_REJECT_PLMN_NOT_ALLOWED;
 	*imsi = NULL;
 
-	proto = hdr48->proto_discr & 0x0f;
-	msg_type = hdr48->msg_type & 0xbf;
+	proto = gsm48_hdr_pdisc(hdr48);
+	msg_type = gsm48_hdr_msg_type(hdr48);
 	if (proto == GSM48_PDISC_MM &&
 	    msg_type == GSM48_MT_MM_LOC_UPD_REQUEST) {
 		*con_type = FLT_CON_TYPE_LU;
 		ret = _cr_check_loc_upd(req->ctx, &hdr48->data[0],
 					hdr48_len - sizeof(*hdr48), imsi);
 	} else if (proto == GSM48_PDISC_MM &&
-		  msg_type == GSM48_MT_MM_CM_SERV_REQ) {
+		   msg_type == GSM48_MT_MM_CM_SERV_REQ) {
 		*con_type = FLT_CON_TYPE_CM_SERV_REQ;
 		ret = _cr_check_cm_serv_req(req->ctx, &hdr48->data[0],
 					     hdr48_len - sizeof(*hdr48),
@@ -388,8 +388,8 @@ int bsc_msg_filter_data(struct gsm48_hdr *hdr48, size_t len,
 	if (state->imsi_checked)
 		return 0;
 
-	proto = hdr48->proto_discr & 0x0f;
-	msg_type = hdr48->msg_type & 0xbf;
+	proto = gsm48_hdr_pdisc(hdr48);
+	msg_type = gsm48_hdr_msg_type(hdr48);
 	if (proto != GSM48_PDISC_MM || msg_type != GSM48_MT_MM_ID_RESP)
 		return 0;
 
diff --git a/openbsc/src/libmsc/gsm_04_08.c b/openbsc/src/libmsc/gsm_04_08.c
index d9d739032..9e70ba922 100644
--- a/openbsc/src/libmsc/gsm_04_08.c
+++ b/openbsc/src/libmsc/gsm_04_08.c
@@ -124,13 +124,12 @@ static int gsm48_conn_sendmsg(struct msgb *msg, struct gsm_subscriber_connection
 		msg->lchan = trans->conn->lchan;
 	}
 
-
 	if (msg->lchan) {
 		struct e1inp_sign_link *sign_link =
 				msg->lchan->ts->trx->rsl_link;
 
 		msg->dst = sign_link;
-		if ((gh->proto_discr & GSM48_PDISC_MASK) == GSM48_PDISC_CC)
+		if (gsm48_hdr_pdisc(gh) == GSM48_PDISC_CC)
 			DEBUGP(DCC, "(bts %d trx %d ts %d ti %02x) "
 				"Sending '%s' to MS.\n",
 				sign_link->trx->bts->nr,
@@ -1131,7 +1130,7 @@ static int gsm0408_rcv_mm(struct gsm_subscriber_connection *conn, struct msgb *m
 	struct gsm48_hdr *gh = msgb_l3(msg);
 	int rc = 0;
 
-	switch (gh->msg_type & 0xbf) {
+	switch (gsm48_hdr_msg_type(gh)) {
 	case GSM48_MT_MM_LOC_UPD_REQUEST:
 		DEBUGP(DMM, "LOCATION UPDATING REQUEST: ");
 		rc = mm_rx_loc_upd_req(conn, msg);
@@ -1860,7 +1859,7 @@ static void gsm48_start_cc_timer(struct gsm_trans *trans, int current,
 static int gsm48_cc_rx_setup(struct gsm_trans *trans, struct msgb *msg)
 {
 	struct gsm48_hdr *gh = msgb_l3(msg);
-	uint8_t msg_type = gh->msg_type & 0xbf;
+	uint8_t msg_type = gsm48_hdr_msg_type(gh);
 	unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh);
 	struct tlv_parsed tp;
 	struct gsm_mncc setup;
@@ -3487,7 +3486,7 @@ static struct datastate {
 static int gsm0408_rcv_cc(struct gsm_subscriber_connection *conn, struct msgb *msg)
 {
 	struct gsm48_hdr *gh = msgb_l3(msg);
-	uint8_t msg_type = gh->msg_type & 0xbf;
+	uint8_t msg_type = gsm48_hdr_msg_type(gh);
 	uint8_t transaction_id = ((gh->proto_discr & 0xf0) ^ 0x80) >> 4; /* flip */
 	struct gsm_trans *trans = NULL;
 	int i, rc = 0;
@@ -3578,7 +3577,7 @@ int gsm0408_new_conn(struct gsm_subscriber_connection *conn)
 int gsm0408_dispatch(struct gsm_subscriber_connection *conn, struct msgb *msg)
 {
 	struct gsm48_hdr *gh = msgb_l3(msg);
-	uint8_t pdisc = gh->proto_discr & 0x0f;
+	uint8_t pdisc = gsm48_hdr_pdisc(gh);
 	int rc = 0;
 
 	LOGP(DRLL, LOGL_DEBUG, "Dispatching 04.08 message, pdisc=%d\n", pdisc);
diff --git a/openbsc/src/libmsc/silent_call.c b/openbsc/src/libmsc/silent_call.c
index e9ece1835..131a1786b 100644
--- a/openbsc/src/libmsc/silent_call.c
+++ b/openbsc/src/libmsc/silent_call.c
@@ -95,7 +95,8 @@ static const struct msg_match silent_call_accept[] = {
 int silent_call_reroute(struct gsm_subscriber_connection *conn, struct msgb *msg)
 {
 	struct gsm48_hdr *gh = msgb_l3(msg);
-	uint8_t pdisc = gh->proto_discr & 0x0f;
+	uint8_t pdisc = gsm48_hdr_pdisc(gh);
+	uint8_t msg_type = gsm48_hdr_msg_type(gh);
 	int i;
 
 	/* if we're not part of a silent call, never reroute */
@@ -105,7 +106,7 @@ int silent_call_reroute(struct gsm_subscriber_connection *conn, struct msgb *msg
 	/* check if we are a special message that is handled in openbsc */
 	for (i = 0; i < ARRAY_SIZE(silent_call_accept); i++) {
 		if (silent_call_accept[i].pdisc == pdisc &&
-		    silent_call_accept[i].msg_type == gh->msg_type)
+		    silent_call_accept[i].msg_type == msg_type)
 			return 0;
 	}
 
diff --git a/openbsc/src/osmo-bsc/osmo_bsc_api.c b/openbsc/src/osmo-bsc/osmo_bsc_api.c
index fbeed77b7..d31e6c152 100644
--- a/openbsc/src/osmo-bsc/osmo_bsc_api.c
+++ b/openbsc/src/osmo-bsc/osmo_bsc_api.c
@@ -180,8 +180,8 @@ static void bsc_send_ussd_no_srv(struct gsm_subscriber_connection *conn,
 		return;
 
 	gh = msgb_l3(msg);
-	pdisc = gh->proto_discr & 0x0f;
-	mtype = gh->msg_type & 0xbf;
+	pdisc = gsm48_hdr_pdisc(gh);
+	mtype = gsm48_hdr_msg_type(gh);
 
 	/* Is CM service request? */
 	if (pdisc == GSM48_PDISC_MM && mtype == GSM48_MT_MM_CM_SERV_REQ) {
@@ -341,8 +341,8 @@ static int handle_cc_setup(struct gsm_subscriber_connection *conn,
 			   struct msgb *msg)
 {
 	struct gsm48_hdr *gh = msgb_l3(msg);
-	uint8_t pdisc = gh->proto_discr & 0x0f;
-	uint8_t mtype = gh->msg_type & 0xbf;
+	uint8_t pdisc = gsm48_hdr_pdisc(gh);
+	uint8_t mtype = gsm48_hdr_msg_type(gh);
 
 	struct osmo_msc_data *msc;
 	struct gsm_mncc_number called;
diff --git a/openbsc/src/osmo-bsc/osmo_bsc_filter.c b/openbsc/src/osmo-bsc/osmo_bsc_filter.c
index 389a124fd..a71871f77 100644
--- a/openbsc/src/osmo-bsc/osmo_bsc_filter.c
+++ b/openbsc/src/osmo-bsc/osmo_bsc_filter.c
@@ -141,8 +141,8 @@ struct osmo_msc_data *bsc_find_msc(struct gsm_subscriber_connection *conn,
 	}
 
 	gh = msgb_l3(msg);
-	pdisc = gh->proto_discr & 0x0f;
-	mtype = gh->msg_type & 0xbf;
+	pdisc = gsm48_hdr_pdisc(gh);
+	mtype = gsm48_hdr_msg_type(gh);
 
 	/*
 	 * We are asked to select a MSC here but they are not equal. We
@@ -212,8 +212,8 @@ paging:
 int bsc_scan_bts_msg(struct gsm_subscriber_connection *conn, struct msgb *msg)
 {
 	struct gsm48_hdr *gh = msgb_l3(msg);
-	uint8_t pdisc = gh->proto_discr & 0x0f;
-	uint8_t mtype = gh->msg_type & 0xbf;
+	uint8_t pdisc = gsm48_hdr_pdisc(gh);
+	uint8_t mtype = gsm48_hdr_msg_type(gh);
 
 	if (pdisc == GSM48_PDISC_MM) {
 		if (mtype == GSM48_MT_MM_LOC_UPD_REQUEST)
@@ -347,7 +347,7 @@ int bsc_scan_msc_msg(struct gsm_subscriber_connection *conn, struct msgb *msg)
 	gh = (struct gsm48_hdr *) msgb_l3(msg);
 	length -= (const char *)&gh->data[0] - (const char *)gh;
 
-	mtype = gh->msg_type & 0xbf;
+	mtype = gsm48_hdr_msg_type(gh);
 	net = conn->bts->network;
 	msc = conn->sccp_con->msc;
 
diff --git a/openbsc/src/osmo-bsc_nat/bsc_nat.c b/openbsc/src/osmo-bsc_nat/bsc_nat.c
index cdab4064d..cacb9199d 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_nat.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_nat.c
@@ -670,8 +670,8 @@ static void update_con_authorize(struct nat_sccp_connection *con,
 		if (!hdr48)
 			return;
 
-		proto = hdr48->proto_discr & 0x0f;
-		msg_type = hdr48->msg_type & 0xbf;
+		proto = gsm48_hdr_pdisc(hdr48);
+		msg_type = gsm48_hdr_msg_type(hdr48);
 		if (proto == GSM48_PDISC_MM &&
 		    msg_type == GSM48_MT_MM_CM_SERV_ACC)
 			con->authorized = 1;
diff --git a/openbsc/src/osmo-bsc_nat/bsc_nat_rewrite.c b/openbsc/src/osmo-bsc_nat/bsc_nat_rewrite.c
index ca5670ca4..58667fe8c 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_nat_rewrite.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_nat_rewrite.c
@@ -594,8 +594,8 @@ struct msgb *bsc_nat_rewrite_msg(struct bsc_nat *nat, struct msgb *msg, struct b
 		return msg;
 
 	link_id = msg->l3h[1];
-	proto = hdr48->proto_discr & 0x0f;
-	msg_type = hdr48->msg_type & 0xbf;
+	proto = gsm48_hdr_pdisc(hdr48);
+	msg_type = gsm48_hdr_msg_type(hdr48);
 
 	if (proto == GSM48_PDISC_CC && msg_type == GSM48_MT_CC_SETUP)
 		new_msg = rewrite_setup(nat, msg, parsed, imsi, hdr48, len);
diff --git a/openbsc/src/osmo-bsc_nat/bsc_ussd.c b/openbsc/src/osmo-bsc_nat/bsc_ussd.c
index 108241421..2905c85b0 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_ussd.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_ussd.c
@@ -407,8 +407,8 @@ int bsc_ussd_check(struct nat_sccp_connection *con, struct bsc_nat_parsed *parse
 	if (!hdr48)
 		return 0;
 
-	proto = hdr48->proto_discr & 0x0f;
-	msg_type = hdr48->msg_type & 0xbf;
+	proto = gsm48_hdr_pdisc(hdr48);
+	msg_type = gsm48_hdr_msg_type(hdr48);
 	ti = (hdr48->proto_discr & 0x70) >> 4;
 	if (proto != GSM48_PDISC_NC_SS)
 		return 0;
-- 
cgit v1.2.3


From 961bd0b121d604612ea27bd2c83edd73290b2cb6 Mon Sep 17 00:00:00 2001
From: Neels Hofmeyr <nhofmeyr@sysmocom.de>
Date: Mon, 14 Mar 2016 16:13:25 +0100
Subject: 04.08: apply new transaction id inline functions

libosmocore recently added inline functions to relieve callers from applying
bitmasks and bit shifts to access the transaction id of a GSM 04.08 header.
Apply these functions.
---
 openbsc/src/gprs/gprs_gmm.c         | 8 ++++----
 openbsc/src/libmsc/gsm_04_08.c      | 2 +-
 openbsc/src/libmsc/gsm_04_11.c      | 2 +-
 openbsc/src/osmo-bsc_nat/bsc_ussd.c | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

(limited to 'openbsc/src')

diff --git a/openbsc/src/gprs/gprs_gmm.c b/openbsc/src/gprs/gprs_gmm.c
index 9d94c24fe..5f0a5fda1 100644
--- a/openbsc/src/gprs/gprs_gmm.c
+++ b/openbsc/src/gprs/gprs_gmm.c
@@ -1753,7 +1753,7 @@ static int do_act_pdp_req(struct sgsn_mm_ctx *mmctx, struct msgb *msg)
 	uint8_t req_qos_len, req_pdpa_len;
 	uint8_t *req_qos, *req_pdpa;
 	struct tlv_parsed tp;
-	uint8_t transaction_id = (gh->proto_discr >> 4);
+	uint8_t transaction_id = gsm48_hdr_trans_id(gh);
 	struct sgsn_ggsn_ctx *ggsn;
 	struct sgsn_pdp_ctx *pdp;
 	enum gsm48_gsm_cause gsm_cause;
@@ -1923,7 +1923,7 @@ static int gsm48_rx_gsm_act_pdp_req(struct sgsn_mm_ctx *mmctx,
 	msg = gprs_msgb_copy(_msg, __func__);
 	if (!msg) {
 		struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_gmmh(_msg);
-		uint8_t transaction_id = (gh->proto_discr >> 4);
+		uint8_t transaction_id = gsm48_hdr_trans_id(gh);
 
 		LOGMMCTXP(LOGL_ERROR, mmctx, "-> ACTIVATE PDP CONTEXT REQ failed copy.\n");
 		/* Send reject with GSM_CAUSE_INV_MAND_INFO */
@@ -1941,7 +1941,7 @@ static int gsm48_rx_gsm_act_pdp_req(struct sgsn_mm_ctx *mmctx,
 static int gsm48_rx_gsm_deact_pdp_req(struct sgsn_mm_ctx *mm, struct msgb *msg)
 {
 	struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_gmmh(msg);
-	uint8_t transaction_id = (gh->proto_discr >> 4);
+	uint8_t transaction_id = gsm48_hdr_trans_id(gh);
 	struct sgsn_pdp_ctx *pdp;
 
 	LOGMMCTXP(LOGL_INFO, mm, "-> DEACTIVATE PDP CONTEXT REQ (cause: %s)\n",
@@ -1962,7 +1962,7 @@ static int gsm48_rx_gsm_deact_pdp_req(struct sgsn_mm_ctx *mm, struct msgb *msg)
 static int gsm48_rx_gsm_deact_pdp_ack(struct sgsn_mm_ctx *mm, struct msgb *msg)
 {
 	struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_gmmh(msg);
-	uint8_t transaction_id = (gh->proto_discr >> 4);
+	uint8_t transaction_id = gsm48_hdr_trans_id(gh);
 	struct sgsn_pdp_ctx *pdp;
 
 	LOGMMCTXP(LOGL_INFO, mm, "-> DEACTIVATE PDP CONTEXT ACK\n");
diff --git a/openbsc/src/libmsc/gsm_04_08.c b/openbsc/src/libmsc/gsm_04_08.c
index 9e70ba922..1a1d6f2d4 100644
--- a/openbsc/src/libmsc/gsm_04_08.c
+++ b/openbsc/src/libmsc/gsm_04_08.c
@@ -3487,7 +3487,7 @@ static int gsm0408_rcv_cc(struct gsm_subscriber_connection *conn, struct msgb *m
 {
 	struct gsm48_hdr *gh = msgb_l3(msg);
 	uint8_t msg_type = gsm48_hdr_msg_type(gh);
-	uint8_t transaction_id = ((gh->proto_discr & 0xf0) ^ 0x80) >> 4; /* flip */
+	uint8_t transaction_id = gsm48_hdr_trans_id_flip_ti(gh);
 	struct gsm_trans *trans = NULL;
 	int i, rc = 0;
 
diff --git a/openbsc/src/libmsc/gsm_04_11.c b/openbsc/src/libmsc/gsm_04_11.c
index bf256c32a..20d18a959 100644
--- a/openbsc/src/libmsc/gsm_04_11.c
+++ b/openbsc/src/libmsc/gsm_04_11.c
@@ -780,7 +780,7 @@ int gsm0411_rcv_sms(struct gsm_subscriber_connection *conn,
 {
 	struct gsm48_hdr *gh = msgb_l3(msg);
 	uint8_t msg_type = gh->msg_type;
-	uint8_t transaction_id = ((gh->proto_discr >> 4) ^ 0x8); /* flip */
+	uint8_t transaction_id = gsm48_hdr_trans_id_flip_ti(gh);
 	struct gsm_trans *trans;
 	int new_trans = 0;
 	int rc = 0;
diff --git a/openbsc/src/osmo-bsc_nat/bsc_ussd.c b/openbsc/src/osmo-bsc_nat/bsc_ussd.c
index 2905c85b0..e0809059a 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_ussd.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_ussd.c
@@ -409,7 +409,7 @@ int bsc_ussd_check(struct nat_sccp_connection *con, struct bsc_nat_parsed *parse
 
 	proto = gsm48_hdr_pdisc(hdr48);
 	msg_type = gsm48_hdr_msg_type(hdr48);
-	ti = (hdr48->proto_discr & 0x70) >> 4;
+	ti = gsm48_hdr_trans_id_no_ti(hdr48);
 	if (proto != GSM48_PDISC_NC_SS)
 		return 0;
 
-- 
cgit v1.2.3


From 8c515272c3e82c2400b15b5bfefa9dd883b86b96 Mon Sep 17 00:00:00 2001
From: Holger Hans Peter Freyther <holger@moiji-mobile.com>
Date: Tue, 15 Mar 2016 14:21:49 +0100
Subject: meas: Do not retry to close the database

There is no concurrency involved and if it failed the first time,
it will fail the second, third, ... time as well. Simply print that
we will leak the database instance.
---
 openbsc/src/utils/meas_db.c | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

(limited to 'openbsc/src')

diff --git a/openbsc/src/utils/meas_db.c b/openbsc/src/utils/meas_db.c
index 6c7e7ae6e..a3b694e6b 100644
--- a/openbsc/src/utils/meas_db.c
+++ b/openbsc/src/utils/meas_db.c
@@ -314,7 +314,6 @@ err_io:
 
 void meas_db_close(struct meas_db_state *st)
 {
-	int retries;
 	if (sqlite3_finalize(st->stmt_ins_mr) != SQLITE_OK)
 		fprintf(stderr, "DB insert measurement report finalize error: %s\n",
 			sqlite3_errmsg(st->db));
@@ -324,16 +323,8 @@ void meas_db_close(struct meas_db_state *st)
 	if (sqlite3_finalize(st->stmt_upd_mr) != SQLITE_OK)
 		fprintf(stderr, "DB update measurement report finalize error: %s\n",
 			sqlite3_errmsg(st->db));
-	retries = 0;
-	while (1) {
-		if (sqlite3_close(st->db) == SQLITE_OK)
-			break;
-		if ((++retries) >= 3) {
-			fprintf(stderr, "Unable to close DB, abandoning.\n");
-			break;
-		}
-		sleep(1);
-	}
+	if (sqlite3_close(st->db) != SQLITE_OK)
+		fprintf(stderr, "Unable to close DB, abandoning.\n");
 
 	talloc_free(st);
 
-- 
cgit v1.2.3


From 10cd11345c2dd3f38793e7dd7456e7882ab95dd9 Mon Sep 17 00:00:00 2001
From: Neels Hofmeyr <nhofmeyr@sysmocom.de>
Date: Mon, 14 Mar 2016 16:15:02 +0100
Subject: bsc_scan_msc_msg: check protocol discriminator

The function assumed an MM protocol discriminator without verifying it.
---
 openbsc/src/osmo-bsc/osmo_bsc_filter.c | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'openbsc/src')

diff --git a/openbsc/src/osmo-bsc/osmo_bsc_filter.c b/openbsc/src/osmo-bsc/osmo_bsc_filter.c
index a71871f77..14e0b7144 100644
--- a/openbsc/src/osmo-bsc/osmo_bsc_filter.c
+++ b/openbsc/src/osmo-bsc/osmo_bsc_filter.c
@@ -336,6 +336,7 @@ int bsc_scan_msc_msg(struct gsm_subscriber_connection *conn, struct msgb *msg)
 	struct gsm_network *net;
 	struct gsm48_loc_area_id *lai;
 	struct gsm48_hdr *gh;
+	uint8_t pdisc;
 	uint8_t mtype;
 	int length = msgb_l3len(msg);
 
@@ -347,6 +348,10 @@ int bsc_scan_msc_msg(struct gsm_subscriber_connection *conn, struct msgb *msg)
 	gh = (struct gsm48_hdr *) msgb_l3(msg);
 	length -= (const char *)&gh->data[0] - (const char *)gh;
 
+	pdisc = gsm48_hdr_pdisc(gh);
+	if (pdisc != GSM48_PDISC_MM)
+		return 0;
+
 	mtype = gsm48_hdr_msg_type(gh);
 	net = conn->bts->network;
 	msc = conn->sccp_con->msc;
-- 
cgit v1.2.3


From f4afcf0b2345a51d3e69c4dbb61279af233388cf Mon Sep 17 00:00:00 2001
From: Holger Hans Peter Freyther <holger@moiji-mobile.com>
Date: Wed, 16 Mar 2016 11:15:19 +0100
Subject: mgcp: Fix compiler warnings on size_t on AMD64

mgcp_transcode.c: In function 'decode_audio':
mgcp_transcode.c:332:4: warning: format '%d' expects argument of type 'int', but argument 7 has type 'size_t' [-Wformat=]
    LOGP(DMGCP, LOGL_ERROR,
    ^
mgcp_transcode.c:332:4: warning: format '%d' expects argument of type 'int', but argument 8 has type 'long unsigned int' [-Wformat=]
mgcp_transcode.c: In function 'encode_audio':
mgcp_transcode.c:390:4: warning: format '%d' expects argument of type 'int', but argument 7 has type 'size_t' [-Wformat=]
    LOGP(DMGCP, LOGL_INFO,
    ^
mgcp_transcode.c:390:4: warning: format '%d' expects argument of type 'int', but argument 8 has type 'size_t' [-Wformat=]
mgcp_transcode.c: In function 'mgcp_transcoding_process_rtp':
mgcp_transcode.c:542:5: warning: format '%d' expects argument of type 'int', but argument 9 has type 'size_t' [-Wformat=]
     LOGP(DMGCP, LOGL_NOTICE,
     ^
mgcp_transcode.c:571:4: warning: format '%d' expects argument of type 'int', but argument 7 has type 'size_t' [-Wformat=]
    LOGP(DMGCP, LOGL_NOTICE,
    ^
---
 openbsc/src/libmgcp/mgcp_transcode.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'openbsc/src')

diff --git a/openbsc/src/libmgcp/mgcp_transcode.c b/openbsc/src/libmgcp/mgcp_transcode.c
index c994d3291..f31e7aefb 100644
--- a/openbsc/src/libmgcp/mgcp_transcode.c
+++ b/openbsc/src/libmgcp/mgcp_transcode.c
@@ -330,7 +330,7 @@ static int decode_audio(struct mgcp_process_rtp_state *state,
 	while (*nbytes >= state->src_frame_size) {
 		if (state->sample_cnt + state->src_samples_per_frame > ARRAY_SIZE(state->samples)) {
 			LOGP(DMGCP, LOGL_ERROR,
-			     "Sample buffer too small: %d > %d.\n",
+			     "Sample buffer too small: %zu > %zu.\n",
 			     state->sample_cnt + state->src_samples_per_frame,
 			     ARRAY_SIZE(state->samples));
 			return -ENOSPC;
@@ -388,7 +388,7 @@ static int encode_audio(struct mgcp_process_rtp_state *state,
 
 			/* Not even one frame fits into the buffer */
 			LOGP(DMGCP, LOGL_INFO,
-			     "Encoding (RTP) buffer too small: %d > %d.\n",
+			     "Encoding (RTP) buffer too small: %zu > %zu.\n",
 			     nbytes + state->dst_frame_size, buf_size);
 			return -ENOSPC;
 		}
@@ -540,7 +540,7 @@ int mgcp_transcoding_process_rtp(struct mgcp_endpoint *endp,
 				 * instead if the delta is small enough.
 				 */
 				LOGP(DMGCP, LOGL_NOTICE,
-					"0x%x dropping sample buffer due delta=%d sample_cnt=%d\n",
+					"0x%x dropping sample buffer due delta=%d sample_cnt=%zu\n",
 					ENDPOINT_NUMBER(endp), delta, state->sample_cnt);
 				state->sample_cnt = 0;
 				state->next_time = ts_no;
@@ -569,7 +569,7 @@ int mgcp_transcoding_process_rtp(struct mgcp_endpoint *endp,
 
 		if (nbytes > 0)
 			LOGP(DMGCP, LOGL_NOTICE,
-			     "Skipped audio frame in RTP packet: %d octets\n",
+			     "Skipped audio frame in RTP packet: %zu octets\n",
 			     nbytes);
 	} else
 		ts_no = state->next_time;
-- 
cgit v1.2.3


From d2fa7a509a989bb775b56932502d128ec974330d Mon Sep 17 00:00:00 2001
From: Neels Hofmeyr <nhofmeyr@sysmocom.de>
Date: Thu, 10 Mar 2016 23:30:37 +0100
Subject: fix confusing typo in constant (THAN -> THEN)

---
 openbsc/src/libmsc/auth.c      | 2 +-
 openbsc/src/libmsc/gsm_04_08.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'openbsc/src')

diff --git a/openbsc/src/libmsc/auth.c b/openbsc/src/libmsc/auth.c
index 0a2f59e36..65a9b03c4 100644
--- a/openbsc/src/libmsc/auth.c
+++ b/openbsc/src/libmsc/auth.c
@@ -132,6 +132,6 @@ int auth_get_tuple_for_subscr(struct gsm_auth_tuple *atuple,
         db_sync_lastauthtuple_for_subscr(atuple, subscr);
 
 	DEBUGP(DMM, "Need to do authentication and ciphering\n");
-	return AUTH_DO_AUTH_THAN_CIPH;
+	return AUTH_DO_AUTH_THEN_CIPH;
 }
 
diff --git a/openbsc/src/libmsc/gsm_04_08.c b/openbsc/src/libmsc/gsm_04_08.c
index 1a1d6f2d4..1524ec44f 100644
--- a/openbsc/src/libmsc/gsm_04_08.c
+++ b/openbsc/src/libmsc/gsm_04_08.c
@@ -231,7 +231,7 @@ int gsm48_secure_channel(struct gsm_subscriber_connection *conn, int key_seq,
 		/* FIXME: Should start a timer for completion ... */
 
 	/* Then do whatever is needed ... */
-	if (rc == AUTH_DO_AUTH_THAN_CIPH) {
+	if (rc == AUTH_DO_AUTH_THEN_CIPH) {
 		/* Start authentication */
 		return gsm48_tx_mm_auth_req(conn, op->atuple.rand, op->atuple.key_seq);
 	} else if (rc == AUTH_DO_CIPH) {
-- 
cgit v1.2.3


From 044fbe6568f82a12bf4e3addc7e3d6db529b6548 Mon Sep 17 00:00:00 2001
From: Vadim Yanitskiy <axilirator@gmail.com>
Date: Wed, 16 Mar 2016 21:14:03 +0600
Subject: move to hex TMSI representation

In OpenBSC, we traditionally displayed a TMSI in its integer
representation, which is quite unusual in the telecom world.  A TMSI is
normally printed as a series of 8 hex digits.

This patch aligns OpenBSC with the telecom industry standard.

Signed-off-by: Vadim Yanitskiy <axilirator@gmail.com>
---
 openbsc/src/libmsc/db.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

(limited to 'openbsc/src')

diff --git a/openbsc/src/libmsc/db.c b/openbsc/src/libmsc/db.c
index 0935fc54d..952151e90 100644
--- a/openbsc/src/libmsc/db.c
+++ b/openbsc/src/libmsc/db.c
@@ -893,9 +893,10 @@ struct gsm_subscriber *db_get_subscriber(enum gsm_subscriber_field field,
 	subscr->id = dbi_result_get_ulonglong(result, "id");
 
 	db_set_from_query(subscr, result);
-	DEBUGP(DDB, "Found Subscriber: ID %llu, IMSI %s, NAME '%s', TMSI %u, EXTEN '%s', LAC %hu, AUTH %u\n",
-		subscr->id, subscr->imsi, subscr->name, subscr->tmsi, subscr->extension,
-		subscr->lac, subscr->authorized);
+	DEBUGP(DDB, "Found Subscriber: ID %llu, IMSI %s, NAME '%s', "
+		"TMSI 0x%08x, EXTEN '%s', LAC %hu, AUTH %u\n",
+		subscr->id, subscr->imsi, subscr->name, subscr->tmsi,
+		subscr->extension, subscr->lac, subscr->authorized);
 	dbi_result_free(result);
 
 	get_equipment_by_subscr(subscr);
@@ -935,7 +936,7 @@ int db_subscriber_update(struct gsm_subscriber *subscr)
 int db_sync_subscriber(struct gsm_subscriber *subscriber)
 {
 	dbi_result result;
-	char tmsi[14];
+	char tmsi[11];
 	char *q_tmsi, *q_name, *q_extension;
 
 	dbi_conn_quote_string_copy(conn, 
@@ -944,7 +945,7 @@ int db_sync_subscriber(struct gsm_subscriber *subscriber)
 				   subscriber->extension, &q_extension);
 	
 	if (subscriber->tmsi != GSM_RESERVED_TMSI) {
-		sprintf(tmsi, "%u", subscriber->tmsi);
+		sprintf(tmsi, "0x%08x", subscriber->tmsi);
 		dbi_conn_quote_string_copy(conn,
 				   tmsi,
 				   &q_tmsi);
@@ -1194,7 +1195,7 @@ int db_subscriber_expire(void *priv, void (*callback)(void *priv, long long unsi
 int db_subscriber_alloc_tmsi(struct gsm_subscriber *subscriber)
 {
 	dbi_result result = NULL;
-	char tmsi[14];
+	char tmsi[11];
 	char *tmsi_quoted;
 
 	for (;;) {
@@ -1205,7 +1206,7 @@ int db_subscriber_alloc_tmsi(struct gsm_subscriber *subscriber)
 		if (subscriber->tmsi == GSM_RESERVED_TMSI)
 			continue;
 
-		sprintf(tmsi, "%u", subscriber->tmsi);
+		sprintf(tmsi, "0x%08x", subscriber->tmsi);
 		dbi_conn_quote_string_copy(conn, tmsi, &tmsi_quoted);
 		result = dbi_conn_queryf(conn,
 			"SELECT * FROM Subscriber "
-- 
cgit v1.2.3


From 3ad0346f00c4d135f7d4d15017ce2941e13e2c54 Mon Sep 17 00:00:00 2001
From: Harald Welte <laforge@gnumonks.org>
Date: Thu, 17 Mar 2016 14:41:26 +0100
Subject: Revert "move to hex TMSI representation"

This reverts commit 044fbe6568f82a12bf4e3addc7e3d6db529b6548.
---
 openbsc/src/libmsc/db.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

(limited to 'openbsc/src')

diff --git a/openbsc/src/libmsc/db.c b/openbsc/src/libmsc/db.c
index 952151e90..0935fc54d 100644
--- a/openbsc/src/libmsc/db.c
+++ b/openbsc/src/libmsc/db.c
@@ -893,10 +893,9 @@ struct gsm_subscriber *db_get_subscriber(enum gsm_subscriber_field field,
 	subscr->id = dbi_result_get_ulonglong(result, "id");
 
 	db_set_from_query(subscr, result);
-	DEBUGP(DDB, "Found Subscriber: ID %llu, IMSI %s, NAME '%s', "
-		"TMSI 0x%08x, EXTEN '%s', LAC %hu, AUTH %u\n",
-		subscr->id, subscr->imsi, subscr->name, subscr->tmsi,
-		subscr->extension, subscr->lac, subscr->authorized);
+	DEBUGP(DDB, "Found Subscriber: ID %llu, IMSI %s, NAME '%s', TMSI %u, EXTEN '%s', LAC %hu, AUTH %u\n",
+		subscr->id, subscr->imsi, subscr->name, subscr->tmsi, subscr->extension,
+		subscr->lac, subscr->authorized);
 	dbi_result_free(result);
 
 	get_equipment_by_subscr(subscr);
@@ -936,7 +935,7 @@ int db_subscriber_update(struct gsm_subscriber *subscr)
 int db_sync_subscriber(struct gsm_subscriber *subscriber)
 {
 	dbi_result result;
-	char tmsi[11];
+	char tmsi[14];
 	char *q_tmsi, *q_name, *q_extension;
 
 	dbi_conn_quote_string_copy(conn, 
@@ -945,7 +944,7 @@ int db_sync_subscriber(struct gsm_subscriber *subscriber)
 				   subscriber->extension, &q_extension);
 	
 	if (subscriber->tmsi != GSM_RESERVED_TMSI) {
-		sprintf(tmsi, "0x%08x", subscriber->tmsi);
+		sprintf(tmsi, "%u", subscriber->tmsi);
 		dbi_conn_quote_string_copy(conn,
 				   tmsi,
 				   &q_tmsi);
@@ -1195,7 +1194,7 @@ int db_subscriber_expire(void *priv, void (*callback)(void *priv, long long unsi
 int db_subscriber_alloc_tmsi(struct gsm_subscriber *subscriber)
 {
 	dbi_result result = NULL;
-	char tmsi[11];
+	char tmsi[14];
 	char *tmsi_quoted;
 
 	for (;;) {
@@ -1206,7 +1205,7 @@ int db_subscriber_alloc_tmsi(struct gsm_subscriber *subscriber)
 		if (subscriber->tmsi == GSM_RESERVED_TMSI)
 			continue;
 
-		sprintf(tmsi, "0x%08x", subscriber->tmsi);
+		sprintf(tmsi, "%u", subscriber->tmsi);
 		dbi_conn_quote_string_copy(conn, tmsi, &tmsi_quoted);
 		result = dbi_conn_queryf(conn,
 			"SELECT * FROM Subscriber "
-- 
cgit v1.2.3


From 56ea30ff3f9f98a4903d060196b185ce124d7eaa Mon Sep 17 00:00:00 2001
From: Neels Hofmeyr <nhofmeyr@sysmocom.de>
Date: Sat, 26 Mar 2016 21:35:11 +0100
Subject: osmo-bsc: fix compiler warning: store struct in vty->index

Don't store an MSC index number in the vty->index void* value. Instead,
store the osmo_msc_data struct directly. Thus avoid warnings about
differences in int vs void* sizes, and save some index lookups.
---
 openbsc/src/osmo-bsc/osmo_bsc_vty.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'openbsc/src')

diff --git a/openbsc/src/osmo-bsc/osmo_bsc_vty.c b/openbsc/src/osmo-bsc/osmo_bsc_vty.c
index d871f015a..e623c9c10 100644
--- a/openbsc/src/osmo-bsc/osmo_bsc_vty.c
+++ b/openbsc/src/osmo-bsc/osmo_bsc_vty.c
@@ -43,7 +43,7 @@ static struct osmo_bsc_data *osmo_bsc_data(struct vty *vty)
 
 static struct osmo_msc_data *osmo_msc_data(struct vty *vty)
 {
-	return osmo_msc_data_find(bsc_gsmnet, (int) vty->index);
+	return vty->index;
 }
 
 static struct cmd_node bsc_node = {
@@ -70,7 +70,7 @@ DEFUN(cfg_net_msc, cfg_net_msc_cmd,
 		return CMD_WARNING;
 	}
 
-	vty->index = (void *) index;
+	vty->index = msc;
 	vty->node = MSC_NODE;
 	return CMD_SUCCESS;
 }
-- 
cgit v1.2.3


From 37984bdb1b507446421e5aa6131ccdf117dd269f Mon Sep 17 00:00:00 2001
From: Neels Hofmeyr <nhofmeyr@sysmocom.de>
Date: Wed, 30 Mar 2016 11:22:24 +0200
Subject: Add MM Auth test; add auth_action_str() function

Add basic MM Authentication test setup, with fake DB access and RAND_bytes().

So far implement simple tests for IO error during DB access and missing auth
entry.

To print the auth action during tests, add struct auth_action_names and
auth_action_str() inline function in auth.[hc].
---
 openbsc/src/libmsc/auth.c | 9 +++++++++
 1 file changed, 9 insertions(+)

(limited to 'openbsc/src')

diff --git a/openbsc/src/libmsc/auth.c b/openbsc/src/libmsc/auth.c
index 65a9b03c4..85123167b 100644
--- a/openbsc/src/libmsc/auth.c
+++ b/openbsc/src/libmsc/auth.c
@@ -31,6 +31,15 @@
 
 #include <stdlib.h>
 
+const struct value_string auth_action_names[] = {
+#define AUTH_ACTION_STR(X) { X, #X }
+	{ -1, "(internal error)" }, /* soon to be fixed with an enum val */
+	AUTH_ACTION_STR(AUTH_NOT_AVAIL),
+	AUTH_ACTION_STR(AUTH_DO_AUTH_THEN_CIPH),
+	AUTH_ACTION_STR(AUTH_DO_CIPH),
+	AUTH_ACTION_STR(AUTH_DO_AUTH),
+#undef AUTH_ACTION_STR
+};
 
 static int
 _use_xor(struct gsm_auth_info *ainfo, struct gsm_auth_tuple *atuple)
-- 
cgit v1.2.3


From f9b212fabd0d5c37dac9639fc9d9ecd73688e3a3 Mon Sep 17 00:00:00 2001
From: Neels Hofmeyr <nhofmeyr@sysmocom.de>
Date: Wed, 30 Mar 2016 11:22:27 +0200
Subject: MM Auth: introduce AUTH_ERROR constant.

Instead of using hardcoded -1 for errors, include -1 in the enum auth_action
type; apply its use.

In the mm_auth test, the string output changes from '(internal error)' to
'AUTH_ERROR', since now the proper enum value is used in auth_action_names[].
---
 openbsc/src/libmsc/auth.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'openbsc/src')

diff --git a/openbsc/src/libmsc/auth.c b/openbsc/src/libmsc/auth.c
index 85123167b..99e3a243e 100644
--- a/openbsc/src/libmsc/auth.c
+++ b/openbsc/src/libmsc/auth.c
@@ -33,7 +33,7 @@
 
 const struct value_string auth_action_names[] = {
 #define AUTH_ACTION_STR(X) { X, #X }
-	{ -1, "(internal error)" }, /* soon to be fixed with an enum val */
+	AUTH_ACTION_STR(AUTH_ERROR),
 	AUTH_ACTION_STR(AUTH_NOT_AVAIL),
 	AUTH_ACTION_STR(AUTH_DO_AUTH_THEN_CIPH),
 	AUTH_ACTION_STR(AUTH_DO_CIPH),
@@ -93,7 +93,7 @@ int auth_get_tuple_for_subscr(struct gsm_auth_tuple *atuple,
 	if (rc < 0) {
 		LOGP(DMM, LOGL_NOTICE,
 			"No retrievable Ki for subscriber, skipping auth\n");
-		return rc == -ENOENT ? AUTH_NOT_AVAIL : -1;
+		return rc == -ENOENT ? AUTH_NOT_AVAIL : AUTH_ERROR;
 	}
 
 	/* If possible, re-use the last tuple and skip auth */
@@ -114,7 +114,7 @@ int auth_get_tuple_for_subscr(struct gsm_auth_tuple *atuple,
 
 	if (RAND_bytes(atuple->rand, sizeof(atuple->rand)) != 1) {
 		LOGP(DMM, LOGL_NOTICE, "RAND_bytes failed, can't generate new auth tuple\n");
-		return -1;
+		return AUTH_ERROR;
 	}
 
 	switch (ainfo.auth_algo) {
-- 
cgit v1.2.3


From 4e875aec0fda55bc93ea76c6992aaf3d90931d2d Mon Sep 17 00:00:00 2001
From: Neels Hofmeyr <nhofmeyr@sysmocom.de>
Date: Wed, 30 Mar 2016 11:22:28 +0200
Subject: MM Auth: return AUTH_NOT_AVAIL instead of hardcoded zero

AUTH_NOT_AVAIL == 0, so this is no functional change.
---
 openbsc/src/libmsc/auth.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'openbsc/src')

diff --git a/openbsc/src/libmsc/auth.c b/openbsc/src/libmsc/auth.c
index 99e3a243e..4ce183935 100644
--- a/openbsc/src/libmsc/auth.c
+++ b/openbsc/src/libmsc/auth.c
@@ -120,22 +120,22 @@ int auth_get_tuple_for_subscr(struct gsm_auth_tuple *atuple,
 	switch (ainfo.auth_algo) {
 	case AUTH_ALGO_NONE:
 		DEBUGP(DMM, "No authentication for subscriber\n");
-		return 0;
+		return AUTH_NOT_AVAIL;
 
 	case AUTH_ALGO_XOR:
 		if (_use_xor(&ainfo, atuple))
-			return 0;
+			return AUTH_NOT_AVAIL;
 		break;
 
 	case AUTH_ALGO_COMP128v1:
 		if (_use_comp128_v1(&ainfo, atuple))
-			return 0;
+			return AUTH_NOT_AVAIL;
 		break;
 
 	default:
 		DEBUGP(DMM, "Unsupported auth type algo_id=%d\n",
 			ainfo.auth_algo);
-		return 0;
+		return AUTH_NOT_AVAIL;
 	}
 
         db_sync_lastauthtuple_for_subscr(atuple, subscr);
-- 
cgit v1.2.3


From 0d929be8264ba592313f2cdd9bc4bd9b2579df00 Mon Sep 17 00:00:00 2001
From: Neels Hofmeyr <nhofmeyr@sysmocom.de>
Date: Wed, 30 Mar 2016 11:22:29 +0200
Subject: Fix MM Auth: disallow key_seq mismatch

In auth_get_tuple_for_subscr(), add missing condition to match incoming
key_seq with stored key_seq, so that re-authentication is requested for
mismatching key_seqs.

Add test for this issue.
---
 openbsc/src/libmsc/auth.c | 1 +
 1 file changed, 1 insertion(+)

(limited to 'openbsc/src')

diff --git a/openbsc/src/libmsc/auth.c b/openbsc/src/libmsc/auth.c
index 4ce183935..ca39d0118 100644
--- a/openbsc/src/libmsc/auth.c
+++ b/openbsc/src/libmsc/auth.c
@@ -100,6 +100,7 @@ int auth_get_tuple_for_subscr(struct gsm_auth_tuple *atuple,
 	rc = db_get_lastauthtuple_for_subscr(atuple, subscr);
 	if ((rc == 0) &&
 	    (key_seq != GSM_KEY_SEQ_INVAL) &&
+	    (key_seq == atuple->key_seq) &&
 	    (atuple->use_count < 3))
 	{
 		atuple->use_count++;
-- 
cgit v1.2.3


From cf1302e4cb4875816615a23e5d7e2e9f7bcb5bca Mon Sep 17 00:00:00 2001
From: Neels Hofmeyr <nhofmeyr@sysmocom.de>
Date: Wed, 30 Mar 2016 11:22:30 +0200
Subject: Fix MM Auth: zero-initialize auth tuple before first use

Make sure a new auth tuple is initialized after
db_get_lastauthtuple_for_subscr() returns an error, i.e. if no tuple is present
for the subscriber yet.

Before this patch, the first key_seq depended on the typically uninitialized
value that was present in auth tuple's key_seq upon calling
auth_get_tuple_for_subscr().

The very first key_seq used for a new subscriber will now always be 0. Before,
it used to be mostly 1 ("(0 + 1) % 7"), but depended on whether the key_seq was
indeed initialized with 0, actually by random.
---
 openbsc/src/libmsc/auth.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

(limited to 'openbsc/src')

diff --git a/openbsc/src/libmsc/auth.c b/openbsc/src/libmsc/auth.c
index ca39d0118..f30d56dce 100644
--- a/openbsc/src/libmsc/auth.c
+++ b/openbsc/src/libmsc/auth.c
@@ -110,8 +110,17 @@ int auth_get_tuple_for_subscr(struct gsm_auth_tuple *atuple,
 	}
 
 	/* Generate a new one */
+	if (rc != 0) {
+		/* If db_get_lastauthtuple_for_subscr() returned nothing, make
+		 * sure the atuple memory is initialized to zero and thus start
+		 * off with key_seq = 0. */
+		memset(atuple, 0, sizeof(*atuple));
+	} else {
+		/* If db_get_lastauthtuple_for_subscr() returned a previous
+		 * tuple, use the next key_seq. */
+		atuple->key_seq = (atuple->key_seq + 1) % 7;
+	}
 	atuple->use_count = 1;
-	atuple->key_seq = (atuple->key_seq + 1) % 7;
 
 	if (RAND_bytes(atuple->rand, sizeof(atuple->rand)) != 1) {
 		LOGP(DMM, LOGL_NOTICE, "RAND_bytes failed, can't generate new auth tuple\n");
-- 
cgit v1.2.3