diff options
| author | Neels Hofmeyr <nhofmeyr@sysmocom.de> | 2016-05-02 15:57:53 +0200 |
|---|---|---|
| committer | Neels Hofmeyr <nhofmeyr@sysmocom.de> | 2016-05-02 17:03:36 +0200 |
| commit | 04bfcdd6c243023fa5ba351a7f481ba7bc49c23c (patch) | |
| tree | d5b7c6b3fc24cf8ef20aadadffa146f3a0ff2a0b /openbsc/src | |
| parent | 3a9c52a5dc8a625b916193b7bea90254af0e04f1 (diff) | |
paging: actually verify subscriber authorization
Before this, any paging response would be accepted by the CN, without
checking the database whether the subscriber is in fact authorized.
The probability that a subscriber would be able to take unauthorized action
is slim, nevertheless checking authorization status with the database should
happen before we accept a connection.
Diffstat (limited to 'openbsc/src')
| -rw-r--r-- | openbsc/src/libmsc/gsm_subscriber.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/openbsc/src/libmsc/gsm_subscriber.c b/openbsc/src/libmsc/gsm_subscriber.c index 46b6b03eb..20029252f 100644 --- a/openbsc/src/libmsc/gsm_subscriber.c +++ b/openbsc/src/libmsc/gsm_subscriber.c @@ -132,7 +132,14 @@ int subscr_rx_paging_response(struct msgb *msg, pr = (struct gsm48_pag_resp *)gh->data; /* Secure the connection */ - return gsm48_secure_channel(conn, pr->key_seq, subscr_paging_sec_cb, NULL); + if (subscr_authorized(conn->subscr)) + return gsm48_secure_channel(conn, pr->key_seq, + subscr_paging_sec_cb, NULL); + + /* Not authorized. Failure. */ + subscr_paging_sec_cb(GSM_HOOK_RR_SECURITY, GSM_SECURITY_AUTH_FAILED, + msg, conn, NULL); + return -1; } int msc_paging_request(struct gsm_network *network, struct gsm_subscriber *subscr, |