Commit Graph

4985 Commits

Author SHA1 Message Date
Max 0c32685898 bsc_control.py: remove unused -i option
This option only served to demonstrate possibility of manually selecting
<id> field in CTRL protocol. Since the transition to generic ipa module
this is no longer exposed so the option became a no-op. Correspondingly
there's no need to explicitly initialize the RNG - the Ctrl class
handles random <id> generation internally.

Change-Id: I10cc7c069354cced2bba84fe67c69c28b8596ded
2016-12-19 08:57:43 +00:00
Neels Hofmeyr ea619f1704 gtphub: fix possible NULL deref: don't print NULL tunnel
Fixes: coverity CID#158302
Change-Id: Ic500a3eb0c49393c7962a20e61eb57fd467208d3
2016-12-18 16:58:41 +00:00
Neels Hofmeyr ecdfd6d097 fix: missing terminator in two value_string arrays
iu_event_type_names[] and auth_action_names[] lacked a { 0, NULL }.

Change-Id: I2e3f271b887e711c8139fbaa32410c16e7fe9921
2016-12-16 14:19:19 +01:00
Neels Hofmeyr 37f9252361 oap_client: make use of OAP optional: disable for NULL config
When passing a NULL config to osmo_oap_client_init(), set OAP to disabled
state. Along with the previous fix that ensures message rejection in the
disabled state, this makes use of OAP in the GSUP client optional.

oap_client_test: expect null config to set state to disabled.

Related: OS#1592
Change-Id: Ie4d622fcfd24cb7d89d19f93e4b2571d8fadd1a3
2016-12-13 14:54:02 +00:00
Neels Hofmeyr 2fa74faf92 oap_client: reject all messages in disabled/uninitialized state
Fixes the bug indicated in oap_client_test.c: adjust to actually expect the
proper behavior.

Also adjust for modified return value for message rejection. Instead of -1,
just expect < 0.

Adjust experr for new error messages.

Related: OS#1592
Change-Id: I16165d228653e8a2689f9df94b77b470c06480c6
2016-12-13 14:54:02 +00:00
Neels Hofmeyr 3cbc052101 oap_client_test: show bug: disabled state does not reject message
There is a hole in OAP where a disabled OAP still accepts at least a
Registration Reject message, after which it will do things it shouldn't. Show
this by expecting the bugs, to be adjusted with the upcoming fix.

Related: OS#1592
Change-Id: I4a5fde308b876946fea2571ea1a550f0cc7ee136
2016-12-13 14:54:02 +00:00
Neels Hofmeyr 73ed45599b oap_client: move logging to DLOAP logging category
Use libosmocore's DLOAP logging category for OAP.

oap_client_test.c: make sure DLOAP is in DEBUG level to not lose any logging
messages from experr.

Todo: we're using a "Library" logging category, which is not really what the
library category was intended for. Instead, the OAP client should probably be
given a logging category like DVLR or DGPRS in its initialization API.

Related: OS#1592
Change-Id: Ic765c19381b0d983da90a5d8aee9cd17e31cf34a
2016-12-13 14:54:02 +00:00
Neels Hofmeyr 2e109f08c0 oap_client_test: print test descr to stderr, check stderr
Related: OS#1592
Change-Id: If1696c8e7bfa696b250f7eac24f08f85f8f492a2
2016-12-13 14:54:02 +00:00
Neels Hofmeyr 28786bb209 oap_test.c: rename to avoid clash with libosmocore oap_test.c
Rename to oap_client_test.c, which is also a more accurate name.

Related: OS#1592
Change-Id: I3ca333141a15940df07a1ae77a30bc54885db41f
2016-12-13 14:54:02 +00:00
Neels Hofmeyr 2c1f8c8ceb move grps_gsup_client.c to libcommon/gsup_client.c
This is in preparation for libvlr.

Related: OS#1592
Change-Id: I9ad7dc7f17f3b033c779de9ae8bc120655502fce
2016-12-13 14:54:02 +00:00
Neels Hofmeyr 3d6b9f4fe9 move gprs/oap.c to libcommon/oap_client.c
This is in preparation for libvlr.

Related: OS#1592
Change-Id: Ib526df6d9de55a1e59a379d5e2c8541ed0ef67e3
2016-12-13 14:54:01 +00:00
Neels Hofmeyr 11ecc9320c rename oap.h to oap_client.h
Related: OS#1592
Change-Id: I05bd65ff81b0f70f68217b2e0a9466e160bdbdec
2016-12-13 14:54:01 +00:00
Neels Hofmeyr 49012f14dd oap: rename public API from oap_ to oap_client_
Mainly to differentiate the OAP messaging API (osmo_oap_ in libosmocore) from
the OAP client.

This is in preparation for moving the oap client to libcommon, which is in turn
preparation for libvlr. Add the osmo_ prefix, as all public Osmocom API should
have. We also have OAP messages code in libosmocore, so clarify by naming this
osmo_oap_client, and by also renaming the oap_test to oap_client_test. This
reshuffling will allow an easy move of OAP to libosmocore if we should want to
do that. A number of patches will follow up on this.

Related: OS#1592
Change-Id: Id447d2bebc026a375567654adafa5f82439ea7e1
2016-12-13 14:54:01 +00:00
Harald Welte 736474ce45 move OAP messages implementations to libosmocore
This corresponds to change-id If5099e60681a215e798b6675f21813f26769c253 in
libosmocore, which is now required to build openbsc.

Related: OS#1592
Change-Id: I2f06aaa6eb54eafa860cfed8e72e41d82ff1c4cf
2016-12-13 14:54:01 +00:00
Neels Hofmeyr ef022783c3 gsup client, gsup_test_client: move logging to DLGSUP category
Use the DLGSUP logging category for GSUP.

Bump the required version of libosmocore to 0.9.5 to benefit from the DLGSUP
logging category fix in core/logging.[hc].
(Id974c7be158e4d60421a98110f5c807aefd31119)

Todo: we're using a "Library" logging category, which is not really what the
library category was intended for. Instead, the GSUP client should probably be
given a logging category like DVLR or DGPRS in its initialization API.

Related: OS#1592
Change-Id: Id3938267fa062e1a997d3704cd678874306f86ee
2016-12-13 14:54:01 +00:00
Neels Hofmeyr eaaee92db5 rename gprs_gsup_client.h to gsup_client.h
This is in preparation for moving gsup to libcommon, which is in turn
preparation for libvlr.

Related: OS#1592
Change-Id: I9c95d00f1a9420887a44c938b1d0ee3e20586f4c
2016-12-13 14:54:01 +00:00
Neels Hofmeyr 814fef04b0 gprs_gsup_client*: remove the gprs_ prefix
Make sure everything is named gsup_client_ / GSUP_CLIENT_.

Rename static gsup_client_send() to client_send() to avoid clash with public
gprs_gsup_client_send() being renamed to gsup_client_send().

This is in preparation for moving gsup to libcommon, which is in turn
preparation for libvlr. libvlr and osmo-sgsn will use the same GSUP client
code. A number of patches will follow up on this, also for the the OAP client.

Related: OS#1592
Change-Id: I57433973b1c4f6cc1e12e7b1c96b5f719f418b51
2016-12-13 14:54:01 +00:00
Neels Hofmeyr 3df5d53a04 comments: gsup client: rename to Generic, adjust copyright and authors
Related: OS#1592
Change-Id: I2c5d145e05aa4afd43ef1341d22563448f1c3577
2016-12-13 14:54:01 +00:00
Harald Welte 4f8e34b226 add gsup_test_client program
Related: OS#1592
Change-Id: Iafd844393dd90b899f84ed61c875c1eb533436d7
2016-12-13 14:54:01 +00:00
Neels Hofmeyr 08586c68db build: bump required libosmocore, libosmogsm to 0.9.4, for GSUP
GSUP was added to libosmocore in 0.9.4. We're using it here, so make up for a
previously missing bump.

(BTW: I'm pretty sure that other dependencies are also in dire need of a bump,
but leaving that for another patch)

Change-Id: I4f245a7d78d0889b37084c52478372bddb8289d6
2016-12-13 14:54:00 +00:00
Max bd33f54444 bsc_control.py: use ipa.py module
Simplify code by using Ctrl implementation from ipa.py

Change-Id: I25fd7cd4b42126354b72abd60a3837be5d13e159
2016-12-13 14:47:32 +01:00
Max 82caa3e9b7 bsc_control.py: style corrections
* replace some tabs indent with spaces
* add comment to make sure no new tabs are used for indentation by emacs
* remove unnecessary parenthesis

Change-Id: Ib79fd4317d40ee4fd87b090b9faf8ebaf4bfca64
2016-12-13 14:47:32 +01:00
Max 688231331b Add twisted-based IPA multiplex
Add sample applications using twisted framework for IPA and CTRL
multiplex.

Change-Id: I07559df420b7fe8418f3412f45acd9a375e43bc5
Related: SYS#3028
2016-12-13 14:47:32 +01:00
Max 3e6768937e Use IPA module for vty tests
Replace hackish ipa_send_* routines with proper implementation from IPA
module thus making it part of extended tests.

Change-Id: If13ed7fd243ce3aeef505d2e8468e221aa62f79e
2016-12-13 14:47:32 +01:00
Neels Hofmeyr d53e9b51b6 Revert "Support Deactivate PDP Context Request from network"
This reverts commit 1611df5226.

This is due to a segfault introduced to the asan build only. See:
http://lists.osmocom.org/pipermail/openbsc/2016-December/009966.html
 Subject: new sanitizer breakage: SIGSEGV in sgsn_create_pdp_ctx()
 Date: Tue Dec 13 12:08:32 UTC 2016

Change-Id: Ic926c0e6778947b516994822e3a21d4fde25bb02
2016-12-13 12:42:45 +00:00
Max c3b94f92c5 Add IPA multiplex
Add base class and derived Ctrl class implementing ctrl-specific
routines.

Change-Id: I41e37ec143183e422c0b31af95d183bd84f0c328
Related: SYS#3028
2016-12-13 10:52:23 +00:00
Pravin Kumarvel 1611df5226 Support Deactivate PDP Context Request from network
Enable Deactivate PDP context based on the IMSI of the subscriber.
When there are PDP contexts present for a MM context,
PDP context will be deactivated along with GMM Detach(MM context deletion).
If there are no PDP present, MM context will be deleted to avoid
further PDP context request from the MS.
Test cases is added to check this functionality.

Change-Id: Ia0a41aa2218ec2fda4ea17a37c8cc55cba63dd13
2016-12-12 17:20:39 +05:30
Harald Welte b8e8d0a402 channel_mode_from_lchan(): Add missing break statement
GSM48_CMODE_DATA_6k0 was not properly terminated and thus resulted in a
bug.

Change-Id: I4000f06d0b49c4afb0446beddd150521c4ba3cf0
Fixes: Coverity CID 148207
2016-12-09 16:26:23 +00:00
Harald Welte c59e28fa5e gsm0408_test.c: Don't pass negative value to strerror()
Change-Id: I4fcf24ec1bc974a3189486d2372b9713d7fdab70
Fixes: Coverity CID 135192
2016-12-09 15:36:58 +00:00
Harald Welte 1cd50585e9 cfg_bts_si2quater_neigh_add(): Don't call strerror() on negative value
Change-Id: I1300eede3f22df812b7e83902327ce4cde21aa35
Fixes: Coverity CID 135185
2016-12-09 15:35:31 +00:00
Harald Welte 4a7d0e79cc mgcp_protocol: Ensure we don't call strtok_r with NULL data
Change-Id: I1dce4df6a49fe95db592b0598194e3a8b8b1b994
Fixes: Coverity CID 135181
2016-12-09 15:35:31 +00:00
Harald Welte 2327cede9c bsc_ctrl: Ensure we don't pass NULL string into strtok_r()
Change-Id: I03bea132377c0136b55b6fdad99a5d92da12e692
Fixes: Coverity CID 135180
2016-12-09 15:35:31 +00:00
Harald Welte 8d35965f24 abisip-find: check bsc_fd_register() result
Change-Id: I72d713725d287d32ec90506099751aeb9b15ef15
Fixes: Coverity CID 70462
2016-12-09 15:35:30 +00:00
Harald Welte c346f87371 sgsn_test: Fix missing = in == type check
Change-Id: I696a7d25d2f4d19922e05a7e83c4aeec5c44fb07
Fixes: Coverity CID 135156
2016-12-09 15:35:30 +00:00
Neels Hofmeyr 8825c69409 Fix TCH/F_PDCH: no need to check ts subslots for PDCH
For TCH/F_PDCH in PDCH mode, directly return the lchan to use, in order to
switch it to TCH/F. To check the pchan type in chan_alloc.c, make ts_pchan()
public in gsm_data_shared.h.

Commit c3f72f63af broke TCH/F_PDCH, as a fallout
of setting the GSM_PCHAN_PDCH subslots number to 0. This is sane and correct,
but the chan_alloc code failed to see a ts as available if it has no subslots.

Explanation:

_lc_find_trx() checks each timeslot. For normal, static TCH timeslots we
determine the number of logical subslots contained and check whether one of
them is free. For dynamic TS, we can do the same when in TCH mode, but when in
PDCH mode, we already know that it is available for immediate switchover for
voice and hence can return it right away. TCH/F_TCH/H_PDCH already has a
special check for that. TCH/F_PDCH doesn't, but this worked for TCH/F_PDCH as
long as ts_subslots() returned 1 for PDCH: the for-loop at the bottom of
_lc_find_trx() checked one subslot, which succeeded on an lchan in PDCH mode,
since PDCH lchans are always marked type == NONE and state == NONE. Now we more
accurately acknowledge that a PDCH timeslot has zero subslots and that a
dynamic timeslot in PDCH mode can always be switched to voice immediately,
without checking lchan type or state.

So, above mentioned commit set PDCH to zero subslots, and the for-loop to check
the (zero) subslots never ran and hence never returned the lchan. This fix adds
a special condition for TCH/F_PDCH in PDCH mode, same as TCH/F_TCH/H_PDCH.

(Todo: ts_pchan() can probably be used in other places as well to remove some
code dup. Leaving that for another patch.)

Fixes: OS#1868
Change-Id: I5d555d018a5bcb8d948e54059d32ec4c9b3070d0
2016-12-09 12:13:03 +00:00
Neels Hofmeyr e14f4b93f2 cosmetic: chan_alloc: use switch instead of if-cascade
Preparing cosmetically for a subsequent commit which will add another pchan
kind to be checked, rather use a "switch (pchan) {}". Also reverse one if()
branch to "early-exit" style.

Change-Id: Ie5eb0fa859c4f225616095dc56d52ce0f2dc8bdc
2016-12-09 12:13:02 +00:00
Max 2440f49a72 Replace duplicated code with macro call
Use already defined GSM48_LEN2PLEN for computing SI length.

Change-Id: I2020417119c844b886f89e34dbfd75e716743dc4
2016-12-09 12:06:27 +00:00
Neels Hofmeyr ec16c16193 lchan release in error state: SACCH deact only for SACCH pchans
This is useful particularly in case where we deactivate PDCHs
which don't have a SACCH associated.  The existin code would
always attempt to deactivate a SACCH even in those cases, leading
to the BTS responsding with related error messages.

Change-Id: Iaf46782329b38ba8f3d438e6c75c2d467b852734
2016-12-09 11:35:41 +00:00
Philipp Maier f788d93382 LLC: Fixup element order in LLC-XID
When the LLC-XID request is constructed the order of the elements
in the TLV structure is reversed. This is in theory not a problem,
but differs from what we know from our practical experience. This
commit fixes the problem.

Change-Id: I1d71c947350d3c5a85ff36b71c1b8f036071d162
2016-12-05 18:56:51 +00:00
Neels Hofmeyr 2b9c53408f abis_om2k: fix typo that declared non-existent struct gsm_bts_trx_s
The typo was recently committed in 80ccb95267,
"OM2000: Fix missing dynamic TCH initialization"

Change-Id: I8e3eec8cf63494962fa31d85a0ec9db9a9e5df46
2016-12-02 12:09:41 +00:00
Neels Hofmeyr ce090f890b gsm_subscriber_connection: mark BSC specific items
This is intended to prepare for splitting gsm_subscriber_connection into BSC
and MSC specific structs, to make the splitting patch more readable.

Change-Id: Ib9666225fb9bfec2cf1e364343560571869fe6a7
2016-12-02 12:09:17 +00:00
Neels Hofmeyr 50669bebdb osmo-nitb: exit when MNCC socket init failed
Change-Id: Icef97bb5da9840b810fe6f4b4da6abd4baa66915
2016-12-02 12:09:17 +00:00
Neels Hofmeyr 42eb0141d7 split subscr_con_allocate()/_free() in bsc_ and msc_
Rename current subscr_con_allocate() and subscr_con_free to bsc_*,
and add two separate msc_subscr_con_allocate() and _free().
The msc_subscr_con_free() ignores all lchan members.

In libbsc use bsc_*, in libmsc use msc_*.

Change-Id: I3cf7c7cafdf4672ec7b26058bba8a77159855257
Future: there will be distinct subscr conns for libbsc and libmsc.
2016-12-02 12:09:17 +00:00
Neels Hofmeyr 640b794de0 move to libcommon-cs: net timezone VTY config
Leave the timezone VTY output in libbsc's config_write_net(), until the BSC/MSC
separation of struct gsm_network is completed.

Change-Id: I9712b2e07b4f1ab8d2e4ad40a8d771e98ed25b20
2016-12-02 12:09:17 +00:00
Neels Hofmeyr 7398395cc0 Move timezone settings up to network level
Time zone used to be configurable per-BTS. In the upcoming MSC-split, no BTS
structures will be available on the MSC level. To simplify, drop the ability to
manage several time zones in a core network and place the time zone config on
the network VTY level, i.e. in gsm_network. If we are going to re-add fine
grained time zone settings, it should probably be tied to the LAC.

Adjust time zone VTY config code (to be moved to libcommon-cs in subsequent commit).

Adjust time zone Ctrl Interface code.

Change-Id: I69848887d92990f3d6f969be80f6ef91f6bdbbe8
2016-12-02 12:09:17 +00:00
Neels Hofmeyr 1a60644eb2 reinvent connection_for_subscr() and move to libmsc
Implement connection_for_subscr() from a completely different angle: instead of
looking up lchans in bts structs, look up the subscriber in the global list of
gsm_subscriber_connection. static lchan_find() is thus obsoleted.

All callers of connection_for_subscr() live in libmsc, so move to libmsc.

The move and edit are done in a single commit since the old and new
implementation have nothing in common.

Future: osmo-cscn will use this, without bts being present.

Remove implementation of connection_for_subscr() from channel_test.c -- it is
possible that the abort() in there was intended for a regression test, but
actually it seems the implementation was merely added for linking reasons, and
the abort() added to guard against the NULL return value: no comment nor the
commit log indicate that the abort() is test critical; the addition was the
only change in channel_test.c for that commit; at the same time a
connection_for_subscr() call was added in libmsc.

Change-Id: I5e0ba0ecf1726ebd540800f4e98fdfc937c904ff
2016-12-02 12:09:17 +00:00
Neels Hofmeyr ea11bf8095 bsc vty: rename show_net_cmd to bsc_show_net_cmd
Future: there will be an MSC-land show-net-cmd, so rename to something with
bsc in its name.

Change-Id: Ifb86698cd57a09f03b935b6d3fcea87eff4cd397
2016-12-02 12:09:16 +00:00
Neels Hofmeyr 06d39fdb72 move to libcommon-cs: network VTY that isn't BSC-specific
Keep only BSC specific bits of the 'network' VTY node in bsc_vty.c, move more
general VTY commands to common_cs_vty.c.

Add arg to common_cs_vty_init() to pass a config_write_net() function. Pass a libbsc
specific config_write_net() function.

Future: upcoming omso-cscn will re-use the VTY bits moved to libcommon-cs and pass a
different config_write_net() function.

Change-Id: I871b7b32a0c56fdce983e409cf244ec487d24e71
2016-12-02 12:09:16 +00:00
Neels Hofmeyr b90eabfb46 move to libcommon-cs: global vty gsm_network pointer
Move gsmnet_from_vty() and the bsc_gsmnet global to common_cs_vty.c.

Rename bsc_gsmnet to vty_global_gsm_network and make it static to common_cs_vty.c, to
clearly mark the global variable for VTY use only.

Introduce common_cs_vty_init() to set vty_global_gsm_network.

Change-Id: I26c5c47de08f899b896813d09612d5cb2f8e42d6
2016-12-02 12:09:16 +00:00
Neels Hofmeyr 2c05f75bbf global gsm_network: move allocation further up
Now that bsc_network_alloc() is separate, move it to before the VTY init (a
subsequent patch will pass the gsm_network instance as a parameter to
vty_init()).

bsc_hack.c: drop the comment that says about the VTY init: "This needs to
precede handle_options()" -- it is not accurate. Actually move the
handle_options() above both vty_init() and the bsc_network_alloc() calls, to be
able to decide which mncc callback to pass to bsc_network_alloc. It would make
sense to set this later on, but that would require further refactoring of the
bsc_network_init() and gsm_network_init() signatures, so not in this patch.

Change-Id: Ie6a7037e703b5a2d08ceeb20d35f197aaddc9d1b
2016-12-02 12:09:15 +00:00
Neels Hofmeyr e235441f73 split bsc_bootstrap_network() in alloc and config
For patch clarity, keep some code dup to be removed in a subsequent patch. In
the same sense don't change the fact that mncc_sock_init()'s return value is
ignored.

The global gsm_network instance 'bsc_gsmnet' is basically only used by the VTY,
and a future patch will "hide" that global in a vty .c file. In a nutshell, I
want to

- first allocate a gsm_network,
- then initialize the VTY passing the gsm_network pointer,
- and then read the config file using the initialized VTY.

So far, bsc_bootstrap_network() allocates the gsm_network and reads the config
file right away, which only works by sharing the extern bsc_gsmnet pointer,
which I would like to uncouple.

Change-Id: I480a09a31a79766ad07b627dd5238b7e37f3be7a
2016-12-02 12:09:15 +00:00
Neels Hofmeyr 6a366055dd tests: drop unused libmsc, unneeded duplicate libbsc linking
Because of libcommon-cs, tests/gsm0408,subscr,trau no longer need libmsc.

Change-Id: I9073eba41a1cd3136ed7a9def6fe8aaf282eaa18
2016-12-02 12:09:15 +00:00
Neels Hofmeyr 05667a0aff sms_next_rp_msg_ref(): use direct pointer to next_rp_ref counter
libbsc and libmsc will have separate subscriber connection structs. Hence don't
rely on gsm_subscriber_connection, but work on a direct pointer to the counter
for the next RP reference.

The only very thin function in gsm_04_11_helper.c thus becomes obsolete: drop
the entire file.

Change-Id: I2a2e9ba6a981a385d1f8f07acbe03536ffed0072
2016-12-02 12:09:15 +00:00
Neels Hofmeyr ac1f1436e9 factor out & introduce struct gsm_encr, in common_cs.h
Factor out encryption info from struct gsm_lchan as struct gsm_encr, placed in
common_cs.h.

Change-Id: I94015fb9dd511c37c1e3058a0963c780b3f700ac
Future: this will be used by libmsc's subscriber connection, for osmo-cscn.
2016-12-02 12:09:15 +00:00
Neels Hofmeyr 43273c63de factor out gen of USSD notify and release complete to libosmocore
Both libmsc and libbsc will need distinct gsm0480_send_ussdNotify() and
gsm0480_send_releaseComplete() functions, since there will be distinct
subscriber connection structs.

Rename to msc_send_ussd_notify() and msc_send_ussd_release_complete(), and add
the same in libbsc with bsc_ prefix in new file gsm_04_80_utils.c.

In preparation of this patch, the message generation part of these functions
has been added to libosmocore as gsm0480_create_ussd_notify() and
gsm0480_create_ussd_release_complete(). Use these.

Adjust all libmsc and libbsc callers according to use the msc_* or bsc_*
implementation, respectively.

Change-Id: I33a84e3c28576ced91d2ea24103123431f551173
2016-12-02 12:09:15 +00:00
Neels Hofmeyr eb52aad198 IuPS: properly update ra_id on GMM Attach Request
For new MM contexts, the ra_id was correctly obtained from the ue_ctx, but in
case an MM ctx is re-used and the ra_id changed, the new ra_id was not copied
to the MM context; instead, the ra_id was overwritten with uninitialized data.

Always initialize the local ra_id variable from the ue_ctx->ra_id for Iu
connections; it is used further below to update the ctx->ra_id.

For the case of a brand new Iu MM ctx, the ctx->ra_id then gets initialized a
second time. We could technically drop the init in sgsn_mm_ctx_alloc_iu(), but
it doesn't hurt either way.

Fixes: CID#57936
Change-Id: Ia06458758362e76925690b1757d8ced95e9609e4
2016-11-28 12:09:06 +01:00
Philipp Maier 143a274051 sndcp: fixup for coverity scan defect CID 149097
Coverity scan detects a Null pointer deref (FORWARD_NULL) in
gprs_sndcp_comp.c: 67 in gprs_sndcp_comp_create().

The reason for this is that gprs_sndcp_dcomp_init() and also
gprs_sndcp_pcomp_init() rely on the comp_entity->algo algo
flag. If the program logic is correct a null pointer deref
should never occur.

This commit adds OSMO_ASSERT() statements to ensure a null
pointer deref is catched if if the ...comp_init() functions
are used with incorrect parameters.

Change-Id: I7748f06d1739a697edad5100a031e5aa1ef11ed1
2016-11-27 18:27:57 +00:00
Harald Welte 487436138e bsc_msc.c: Check setsockopt() return value
Change-Id: I79a8fe9c025772e51560503504f517485b0ace34
Fixes: Coverity CID 57644
2016-11-26 17:10:29 +01:00
Harald Welte be67050a36 abis_nm: ceck fseek() return code in is_last_line()
Change-Id: I8ed4e703625c9da959e0938cd1eb3f0c73a2d4d0
Fixes: Coverity CID 57643
2016-11-26 17:10:29 +01:00
Harald Welte 3c165d02bb ipaccess-proxy: Check setsockopt() return value
Change-Id: I34b082907b6f0b25fe2779f3a1f0a642a9002664
Fixes: Coverity CID 57642
2016-11-26 17:10:29 +01:00
Harald Welte 54f44ec585 ipaccess-config: Handle setsockopt return value
Change-Id: I8c2082f9a9c865cc663ad2abb63ee0f70914dabe
Fixes: Coverity CID 57640
2016-11-26 17:10:29 +01:00
Harald Welte 18712f0bd1 Fix possible non-null-terminated buffer
Change-Id: I22100c260856991b9a836135b3650e5b8c5449ca
Fixes: Coverity CID 57623
2016-11-26 17:10:29 +01:00
Harald Welte 96df077083 libmsc/db: avoid subscr->name without terminating NULL char
Change-Id: Ic8944ac4c5e940c9d835c52f1701461f274238db
Fixes: Coverity CID 57621
2016-11-26 16:08:38 +00:00
Harald Welte b0993e61d0 abis_nm: Fix non-null terminated buffer
Unrealistic case (filename of 4096 bytes)

Change-Id: Icf7b835f9edaf66976556fce1e9e0f66aa2010bc
Fixes: Coverity CID 57620
2016-11-26 16:08:38 +00:00
Harald Welte 7b6bae6584 abis_nm: Fix possible not-null-terminated buffer
Unrealistic case with file name of 4096 bytes length.

Change-Id: I503200b879b854cf2dc218d5fe3059a555732d92
Fixes: Coverity CID 57619
2016-11-26 16:08:37 +00:00
Neels Hofmeyr 28f637ec2c move to libcommon-cs: gsm48_create_mm_serv_rej(), gsm48_create_loc_upd_rej()
Used by libbsc, libmsc as well as osmo-bsc and osmo-bsc_nat.

Moving gsm48_create* to libcommon-cs affects linking of osmo-bsc_nat, resulting in
undefined references to gsm48_extract_mi() and gsm48_paging_extract_mi(); fix
that by placing libfilter.a left of libbsc.a upon linker invocation.

Change-Id: I212c2567b56191022b683674c1c4daf842839946
2016-11-24 16:58:31 +01:00
Neels Hofmeyr e78ae21ff4 move to libcommon-cs: net init 3: actual move
Reincarnate gsm_network_init() as the parts not specific to libbsc.
Move from bsc_network_init() those bits that are not BSC specific (and useful
for upcoming osmo-cscn).

Add libcommon-cs to all linkages that use gsm_network_init().

Note: the only requirement to allow linking gsm_network_init() without libbsc
is to keep the call to gsm_net_update_ctype() out of libcommon-cs. The other items
are kept out of libcommon-cs because it makes sense semantically. But the separation
is not strong in that the BSC specific data members are of course still
omnipresent in struct gsm_network. If bsc_network_init() is not called, these
are not initialized properly -- for now no users of uninitialized members
exist.

So this is just a first step towards a sensible split of the BSC and MSC
gsm_network structs. The long term aim should be to have entirely separate
structs with some common general items.

Change-Id: If06316b97002390dc9a434686750cb96193ea63b
2016-11-24 16:58:31 +01:00
Neels Hofmeyr 2d521a0296 move to libcommon-cs: net init 2: move bsc_network_init decl to new .h
bsc_network_init() is more fit to live in a BSC specific header, move it to new
common_bsc.h. It will probably also absorb the BSC-specific part of gsm_network
in the future.

Adjust header includes across the board. Particularly, fix abis_nm.h by
explicitly including gsm_data.h: it so far relied on other headers to do that,
which now is no longer always given.

Change-Id: I9edfb1e748bb1cb484fadd48b0406f5b3098e89b
2016-11-24 16:58:31 +01:00
Neels Hofmeyr 27681a3407 move to libcommon-cs: net init 1: rename to bsc_network_init
The gsm_network_init() function initializes a whole lot of BSC specific stuff.
Aiming to move some of it to libcommon-cs, first rename it to bsc_network_init().
This will retain the BSC specific stuff when the move is done.

Adjust all callers.

Future: osmo-cscn will call the more generic part and not the BSC specific
part.

Change-Id: I4816ae19374390fc5c64972f7cad2e9ec3d8bcc3
2016-11-24 16:58:31 +01:00
Neels Hofmeyr 402006dfdf define mncc_recv_cb_t to avoid code dup
Put mncc_recv_cb_t in common_cs.h to avoid header include complications: if placing
right above struct gsm_network, one must include gsm_data.h to use
mncc_recv_cb_t as function parameter in a header, which will include
gsm_data_shared.h, which will include common_cs.h (future knowledge). Since I will
need to use mncc_recv_cb_t in common_cs.h, including gsm_data.h from there would
introduce an #include loop. Avoid that and define mncc_recv_cb_t in common_cs.h to
begin with.

Change-Id: I2e64cffa563750ce9f3172ffba6f9cf5b9280e9c
2016-11-24 16:58:30 +01:00
Neels Hofmeyr c69ee8527c Add empty libcommon-cs
This will gradually soak up code shared by libbsc and libmsc.

Change-Id: If34e2bd38a099d0799238337468d56e0305ab8ae
2016-11-24 16:58:30 +01:00
Pravin Kumarvel 16606c9007 Add support for pdpctx_timer_stop
Timer T3395 starts  at the transmission of Deactivate PDP request using
pdpctx_timer_start  but there was no corresponding stop function.
The timer is stopped when Deactivate PDP Context Accept is received.
This according to 3gpp spec reference 24.008 section 6.1.3.4.2.

Change-Id: I825c0a47d39e784dd1b8251f564609262530a5c6
2016-11-23 12:23:41 +00:00
Holger Hans Peter Freyther 5085e0bf4c ussd: Add band-aid for interrogationSS
This is a speculative change for interrogateSS and by not answering
the request the radio connection would remain open long.

The SS/USSD code is from a time where none of knew much about GSM. We
do not support SS but should reject it. We have checked for an empty
string in the text field to guess if it is a result/release to not send
more information. The right way forward is to decode the ASN1 into the
fields REQUEST/RESULT(last).

Fix an issue and make the code worse. Assume ss_code > 0 to see if this
is a interrogate invoke. The issue is that code 0 is a well defined
value but unlikely to be used.

MAP ASN1 definition:

SS-Code ::= OCTET STRING (SIZE (1))
        -- This type is used to represent the code identifying a single
        -- supplementary service, a group of supplementary services, or
        -- all supplementary services. The services and abbreviations
        -- used are defined in TS 3GPP TS 22.004 [5]. The internal structure is
        -- defined as follows:
        --
        -- bits 87654321: group (bits 8765), and specific service
        -- (bits 4321)

allSS                   SS-Code ::= '00000000'B

Change-Id: Ib0dc4485388f030eb172fe21f5327b7ab94751f5
2016-11-18 19:04:37 +00:00
Pravin Kumarvel 26f6ced05c Correct Logging macro for pdpctx_timer_start
This commit corrects the Logging macro used in pdpctx_timer_start.

Change-Id: Id4e3a7fb934ed82af8096fda9ddd3f4550e05844
2016-11-17 12:19:01 +05:30
Harald Welte 80ccb95267 OM2000: Fix missing dynamic TCH initialization
When OM2000 has confirmed that a TS is started, call dyn_ts_init()
on the timeslot to start the processing for fully dynamic (osmocom
style) TCH/F_TCH/H_PDCH.  This should in turn trigger the activation of
idle timeslots as PDCH until we want to allocate any of them for TCH/F
or TCH/H.

Change-Id: I1a1fd61d6afd85449cacad4bacfb830252dab6b1
2016-11-16 18:20:22 +01:00
Harald Welte 96638d141e OM2000: Add three IEs to TCH activation about which we have no clue
Change-Id: Ie3067606033e894c558659ddf0025d01b8198cf9
2016-11-16 18:20:21 +01:00
Philipp Maier 309425e105 rsl: support for ericssons propritary SI13 format
Ericsson has introduced a propritary format to issue the S13 BCCH
information. Normally the system info type field for SI13 would
be encoded as 0x28. Ericsson encodes that field as 0x02 and ads
a bcch mapping parameter, (IEI=F2) This patch sets the BCCH mapping
to 0x00 (=BCCH Normal) statically (0xF200)

The new constands are added to libosmocore, see commit:
f0f9c8c29daaefbf9cff19177ade4a13ffb2e36c

Change-Id: Ie0900f9b810744172b3090ce1b0ef7b7a1132946
2016-11-16 16:36:17 +00:00
Philipp Maier 38cba5aa79 OM2000: Fixup based on Coverity Scan suggestion
This commit fixes Coverity Scan defect:

CID 151901:  Insecure data handling  (TAINTED_SCALAR)
Passing tainted variable "tag_len" to a tainted sink.

Change-Id: Ic71ed6a3bbb228bc03e95bfc4a6f5fe09cf5a021
2016-11-16 16:35:42 +00:00
Philipp Maier fb89b9b00b rbs2000: Add missing bts feature definitions
function bts_model_rbs2k_start() in bts_ericsson_rbs2000.c lacks
the feature definition for GPRS and EGPRS.

Change-Id: I777a67862084aa6cca39cfc43f5708e47608b0e6
2016-11-16 16:35:05 +00:00
Max c04c6ed4af abisip-find: use protocol constant
Use library define instead of directly using hardcoded value.

Change-Id: Ie9b8bc55bf40cf005434f27e205d47ffab959413
2016-11-15 22:35:38 +00:00
Philipp Maier 7d3093506a SNDCP: Fixup based on Coverity Scan suggestion
This commit fixes Coverity Scan defect:

CID 151900:  Null pointer dereferences  (FORWARD_NULL)
Passing null pointer "comp_field->v42bis_params->nsapi"
to "memcpy", which dereferences it.

Change-Id: Iff83e21168a267dd4b4c401ab7c603e029b3ac39
2016-11-15 22:32:20 +00:00
Daniel Willmann bb42eee113 test/gbproxy: Test for possible memory corruption when link_info is freed
This test is to trigger the use-after free issue in commit bff7b0d80972. If
compiled with address-sanitizer the test will abort without the fix.

Change-Id: I5e8c6626ba43342740f08d699383bdded739079f
Ticket: OW#3049
Sponsored-by: On-Waves ehf
2016-11-15 22:32:03 +00:00
Daniel Willmann beade314d0 gbproxy: Check whether gbproxy_update_link_state_after() deletes the link_info
In case the link_info is deleted we have to stop handling the stored messages
inside link_info. Not doing so can lead to invalid memory being accessed.

Change-Id: Ieb8503e9e94e7a5ac450ad8aa1713ec4f21cdea5
Ticket: OW#3049
Sponsored-by: On-Waves ehf
2016-11-15 22:32:02 +00:00
Harald Welte 58273f4b88 OM2000: CON MO: Allow larger range for CCP and CI values
it seesm more recent RBS2000 models have much larger CCP and CI value ranges
than those of older models.

Change-Id: Ib116c1fac901b293929fce34223d1fd0af15d2bc
2016-11-13 21:22:33 +01:00
Harald Welte eae68292bd Support configuration of CON MO Groups/Paths from VTY
The code for supporting the configuration of the OM2000 CON (LAPD
Concentrator) MO was so far incomplete and not used from the OM2000 FSM
initialization.  This patch adds
* VTY commands for configuration of CON Groups and Paths
* The FSM integration to actually configure the CON MO

Change-Id: I56dc1b5e35adef3a2078bcf9536537eb0f454192
2016-11-13 21:22:29 +01:00
Harald Welte fe7be8ddd0 RBS2000: Ensure the is-connection-list command is only used on RBS2000
... and not on other BTS models.

Change-Id: I8882ca9a9ab974b0bbdcbd5c3bab0eadf4bc0927
2016-11-11 21:20:49 +01:00
Harald Welte c1efa67c13 RBS2000: Avoid segfault if ts->lapd instance doesn't exist
This happens e.g. with DAHDI driver, when the DAHDI device cannot be
opened.  Let's not prematurely seg-fault early in the RBS2000 signal
handler, but take the proper error handlign for this.

Change-Id: I9223fb1568d3db7e278f07240c4be334c6602a13
2016-11-11 21:20:49 +01:00
Harald Welte dfe48fdecf bs11_config: remove compiler waring about unused variable
bs11_config.c:78:22: warning: ‘too_fast’ defined but not used [-Wunused-const-variable=]
 static const uint8_t too_fast[] = { 0x12, 0x80, 0x00, 0x00, 0x02, 0x02
};
                      ^~~~~~~~

Change-Id: I1fdb9645128c2dfeb489bf75e89ab0adea919d2b
2016-11-11 15:34:05 +00:00
Harald Welte af9a9b0b44 talloc_cxt: Fix compiler warning / missing #include
talloc_ctx.c: In function ‘talloc_ctx_init’:
talloc_ctx.c:40:2: warning: implicit declaration of function ‘msgb_talloc_ctx_init’ [-Wimplicit-function-declaration]
  msgb_talloc_ctx_init(ctx_root, 0);
  ^~~~~~~~~~~~~~~~~~~~

Change-Id: Ib8ebc02d5cf0d2b4019473d3750ae7c6f8a32896
2016-11-11 15:52:58 +01:00
Neels Hofmeyr 87ef68eb33 OM2000: disallow ip.access style TCH/F_PDCH pchan type
For TCH/F_PDCH, return an invalid chan comb (0) and print an error message
that hints at the proper pchan type to use instead: TCH/F_TCH/H_PDCH

Change-Id: Ibe0f944573f0a6d1be4bf7cf4986c4b2b3bd6d0d
2016-11-10 17:05:02 +00:00
Neels Hofmeyr f926f45c4b OM2000: for TS conf of dyn TS, always send TCH/F chan comb
When OM2K sets up the timeslots with the BTS, the dynamic channel state
is not yet resolved to any particular pchan type. Instead of using the
dyn state, always advertise dynamic timeslots as pchan2comb(TCH/F).

In the past, the Ericsson dynamic timeslots were handled as pchan type
TCH/F_PDCH. This is a mistake, as this pchan type is intended for
the ip.access dynamic PDCH way of dynamic channels. In any case, in the
initial state of this pchan type, the timeslot was initialized as
pchan2comb(TCH/F) because the ts->flags do not reflect an active PDCH
yet. In short, this patch does not change the behavior of TCH/F_PDCH
timeslots, only clarifies it.

It would in fact make sense to disallow use of TCH/F_PDCH for OM2K,
but that should probably be a separate patch.

The proper pchan to use for Ericsson dynamic timeslots is
TCH/F_TCH/H_PDCH. These do not use ts->flags, but ts->dyn.* as state,
which first reflects pchan_want == pchan_is == GSM_PCHAN_NONE. Hence
the timeslot was initialized by OM2K as pchan type zero, which is
unknown / invalid. So, instead of using pchan_is, which is not yet
reflecting anything meaningful, always initialize as TCH/F chan comb,
as Ericsson hardware apparently expects it.

Change-Id: If0693f7c5c85977b0e4acbc701ee5d635434d0d1
2016-11-10 17:05:02 +00:00
Neels Hofmeyr 194b4cb4fd fix use after free in bsc_config_free
talloc_free the cfg only after asserting num_bsc count sanity.
This caused a failure in the 'bsc-nat' test with -fsanitize build.

Should fix the Osmocom_Sanitizer build on jenkins.osmocom.org
https://jenkins.osmocom.org/jenkins/job/Osmocom_Sanitizer/

Change-Id: Ic20aacaccffcaa58ccec6d24c884727dc1bc50e6
2016-11-10 03:19:22 +01:00
Philipp Maier b4ecc1d43b OM2000: Throw error when MO can not be enabled
Throw warning message in case the MO state does not change
to enabled after sendeing an Enable-Request message.

Change-Id: Idfde8d6f71526e8acfea51835732515a4bee858e
2016-11-09 15:43:34 +00:00
Philipp Maier 6bbcfbb78c om2000: added support for ericssons sabm negotiation
This patch adds support for ericssons sambm negotiation.

This patch depends on libosmo-abis commit:
2788c7eacab91cd39d68e316fc8ee87763bbfeb4

Change-Id: I56b1c1cef07a61143fc0e8058480805cddfeff96
2016-11-09 15:43:34 +00:00
Philipp Maier 8136e4b9af OM2000: Add fault report parsing
This patch adds parsing for OM2000 MO fault report map parsing,
the bits in the fault maps are counted out and displayed.

Change-Id: I6e2928f39b09bc08e9ab78bc10bc81e07f7eb55d
2016-11-09 15:43:34 +00:00
Harald Welte 7975ddf0ec RBS2000: re-establish any lost signalling links
Contrary to standard A-bis, in the RBS2000 case the BSC connects
the signalling data links (LAPD) to the BTS.  In case one of them
drop, we need to attempt to re-establish them.

This requires libosmo-abis with Change-Id I07f0f79e0cda09766f357032ffb4e7ad643d448a

Change-Id: I710b5af5d0acbdd3febd314849340f2adb7abd80
2016-11-09 15:43:34 +00:00
root 4579978983 om2000: Add support for querying RBS capabilities
Change-Id: Id1fbaf41286f3651ce8f210eb8da05fb51179c96
2016-11-09 15:43:34 +00:00
Holger Hans Peter Freyther 46edbc4162 lchan: Release channel in case of late activation ack
In case of the sysmoBTS and receiving a channel activation ack on a channel
that was marked as broken, release it again.

Use a normal release without SACCH deactivation and release the rqd_ta data.

Also add a local variable 'ts' to shorten some lines.

The typical situation where this would occur is with high latency between BTS
and BSC (or NITB). If a channel activation ack does not arrive in time, a
channel is marked broken, and never recovers after that. This patch will
release the channel again, which will remove the BROKEN_UNUSABLE state and
makes lchan available again. Reported by Rhizomatica.

However, in case of packet loss, i.e. when the channel activation ack never
arrives at the BSC, this patch does not provide a resolution of the
BROKEN_UNUSABLE state.

On dynamic timeslots: clearing the dyn ts state could possibly happen in
lchan_free() instead of in rsl_rx_chan_act_ack(). That's to be done in a
separate patch, if at all.

Tweaked-By: nhofmeyr
Change-Id: I63dc0deaf15ba7c21e20b1e0c7b85f0437e183ed
2016-11-09 15:43:13 +00:00
Harald Welte 686f4d6a85 SGSN: Use dummy all-zero MSISDN value in PDP Context Act on GTP
The GTP protocol specification requires us to include the MSISDN IE in
all non-secondary PDP context activations. However, when no real HLR is
used (e.g. via GSUP), we do not have the MSISDN information available
and so far simply sent a zero-length MSISDN IE in GTP.  The latter is a
violation of the spec.

So to resolve this, we now send a 15-digit all-zero dummy MSISDN IE, as
described in TS 23.003.

Change-Id: I8d0a5d52d6cd2a00b5dda060bd41d45056dfa84d
2016-11-09 15:42:39 +00:00
Harald Welte 424656e527 OM2000: Fix state machien for CF/TRXC on START Result
When receiving the 'Start Result' message, for CF and TRXC MO
we directly transition to performing the Operational Info.  In that
case, we need to return after sending the Operational Info and skip
the usual processing for the default case below.

Change-Id: I99860d198b337ffe461b240bda20dc10e1b5b2cb
2016-11-09 15:11:36 +01:00