osmo-ggsn crashes when concurrent pdp context num 1024 is created, due to
the gsn->pdpa array (of size PDP_MAX, 1024) being full.
The crash happens because return code of gtp_pdp_newpdp was not checked,
and hence a pointer "pdp" pointing to a temporary not-fully-allocated
object was being passed to gsn->cb_create_context_ind() callback.
Let's avoid crashing and instead reject the PDP context.
Related: OS#5469
Change-Id: I0d94ffad97eb4fef477d981bf285bf99740592a3
The previous order of parsing lead to non-optimal information gathering
when pushing events to upper layers.
This patch rearranges parsing of packet data to always gather as much
info as possible for the benefit of the upper layer. This way it can
gather information such as the cause, which is important in the case of
"Non-existent", since user should then drop the context.
First we want to parse the recovery state, but delay cb to upper layers
until we tried to gather the pdp ctx (meaning all except that pdp ctx
should be freed).
Second, we want to parse the cause, in order to know if there's an
associated pdp ctx we can gather from TEID.
Third, once we know if we should expect a meaningul TEID, parse it.
Related: SYS#5435
Change-Id: Idd10b494e8fbac8703c49ecd8f9bbe4246e51c57
The PDP context is searched on the hash which is generated
on context creation from the IMSI in gtp format. - A hash
created from "human-readable" IMSI does not match.
Check user input for length then convert the IMSI to gtp format
before continuing.
Change-Id: Icd2e2bc6068c06fbf5d5fe905ebcda8954f33f04
Currently each user (application) of libgtp needs to manage its own
timers in order to call gtp_retrans_timeout() and gtp_retrans() and
maintain retransmit and duplicate queues working correctly. This adds
unnecesary complexity to applications since nowadays, as a libosmocore
user, libgtp can handle this internally in an easy way.
Furthermore, keeping the timers internal to the library allows for
easier extension of features as well as re-implementation of related
code in the future.
Last but not least, it was detected that existing known applications
(osmo-sgsn, osmo-ggsn, sgsnemu) are not using correctly the API, since
they should be updating their timers through gtp_retrans_timeout()
everytime a message is enqueued/transmitted, otherwise they may fire
gtp_retrans() for retransmition too late in some cases.
Related: OS#4178
Change-Id: Ife7cfd66d6356f413263fe5bda9e43091f5c9e98
This change fixes the following compiler warnings (found by Clang):
gtp.c:2747:13: warning: variable 'pdp' is used uninitialized
whenever 'if' condition is false
[-Wsometimes-uninitialized]
} else if (version == 1) {
gtp.c:2781:14: note: uninitialized use occurs here
OSMO_ASSERT(pdp);
^^^
Shall not happen in general, but let's make Clang happy.
Change-Id: Id471b22afd4c45435589a4edda0a804e66be3a7a
As stated in the comment above, we need to use the tunnel identifier
to find a GTP context, and derive both IMSI and NSAPI from that TID,
when speaking GTP version 0.
This change fixes the following warnings (found with Clang):
gtp.c:2115:22: warning: variable 'pdp' is uninitialized
when used here [-Wuninitialized]
pdp_set_imsi_nsapi(pdp, tid);
^^^
gtp.c:2118:34: warning: variable 'imsi' is uninitialized
when used here [-Wuninitialized]
if (gtp_pdp_getimsi(gsn, &pdp, imsi, nsapi))
^^^^
gtp.c:2118:40: warning: variable 'nsapi' is uninitialized
when used here [-Wuninitialized]
if (gtp_pdp_getimsi(gsn, &pdp, imsi, nsapi))
^^^^^
Change-Id: I8f1c8d0ba2e8189d97fe1bb5c872680e5ad1cd7a
That code was commented out in 0b076a331e
(year 2003), and indeed it makes no sense to call those in current pdp
lifecycle (they are expected to be freed by the application).
Change-Id: I096d8cb8d749ff9b737d6f3f96b1d423660ece37
Since osmo-ggsn can manage several GSN structures simultaneously, it
needs the gsn_t pointer to know the ggsn it should forward the call to.
Related: OS#4165
Change-Id: I33b4fe594d5833993af01cce34737e61e597b320
The libgtp application may have already allocated related resources
associated to the pdp context, so we need to signal its deletion in
order to let the application free the resources.
This should fix the duplication of pdp contexts seen in osmo-ggsn when
"show pdp-context" related VTY commands are used.
It was spotted due to some MS requesting a v4v6 context on a
v4-only APN, where first v4 address was allocated, and then upon v6
allocation create_context_ind() called
gtp_create_context_resp(GTPCAUSE_MISSING_APN) but the first address was
not freed. Upon receiving the callback, osmo-ggsn should now free the
related resources.
Related: OS#4154
Change-Id: I6c6215a4ce478afabc78ffaf5ffb0cf829e41226
Doing so should avoid the crash seen in OS#3956, where a message is
received in osmo-sgsn gtp iface after having received a DeleteCtxAccept
message where pdp and associated cbp is freed. As a result, when new
confirmation arrives, it can still be matched against an old request and
be sent to upper layers providing an already freed cbp.
With this patch, since all queued messages belonging to that pdp are
dropped, confirmation won't find a match and be discarded in libgtp.
In order to be able to drop all req messages belonging to a pdp, a new list
is added to pdp_t and qmsg_t are added to that list when inserted into the per-gsn
req transmit queue. This way upon pdp free time it's simply a
matter of iterating over that list to remove all messages.
There's no need to do same for resp queue, and it'd be actually
counter-productive, because it wouldn't be possible to detect and
discard duplicates anymore after pdp ctx has been freed.
Related: OS#3956
Change-Id: Id86d0b241454d3ad49c64c28087fd2710fa2d17a
Move static global pdp storage arrays to be per GSN. This way now
several GSN per process are supported without collisions.
* pdp_init() is defined in public API but it's actually only intended
for use (and currently only used) internally in gtp_new(). So let's
document that and re-use it for backward compatibility with now
deprecated API, where only one GSN per process is supported.
* Back pointer to gsn_t (pdp->gsn) moved from gtp.c:gtp_new() to
gtp_pdp_newpdp(), since it makes more sense to have it there. This way
backpointer is always set, even in case were app calls pdp_newpdp() API
directly instead of creating them through gtp.c, like osmo-sgsn does.
* Create new versions of required APIs with a pointer to gsn_t where the
pdp ctx is to be created/found. Some APIs receiving a pointer to a pdp
ctx can be left intact because we have a backpointer to its gsn_t.
* pdp_getpdp() is nowhere used, and makes little sense now that we have
pdpa reachable in gsn->pdpa, so let's deprecate it without adding a
replacement.
* Deprecate gtp.h gtp_newpdp(), since it's nowhere used and useless
(does same as new gtp_pdp_newpdp() and doesn't allow for old_pdp to be
passed as parameter).
Fixes: OS#2873
Change-Id: I653cbdc185165592d985e3efab6e3f1add97877b
Code modified actually behaves the same, since gtp_freepdp() also calls
delete cb, and this way it's more consistent with rest of the code base.
Change-Id: I299765816e9d885497110d2e834f7ccdc943052c
* API gtp_freepdp was already there but was not really being used by
anyone currently, so we can change its behaviour to call cb_delete_ctx.
It makes sense to call the cb in there too to be consistent with rest of
APIs.
* Add API gtp_freepdp_teardown, which calls gtp_freepdp on pdp and its
secondary contexts. It will also be used later on by osmo-ggsn.
* Use new APIs in internal code to simplify it.
Change-Id: I9f0b774e9385a7a8d81ec9702f158e2f9a50d571
Move all parsing with same conditions under same blocks to make code
easier to follow and make it more compact.
Change-Id: I52d5a3543ce6cf764bd84303b5a0d8b0643d998d
Before this patch they were not taken into account, which means some
resp messages could stay more time than required enqueued.
Change-Id: Iebf405b2310a34785f3b363cc2a9f415281f6030
Clearing the request and response queue is useful for debugging
to reset "some" state. Otherwise some tests will get un-expected
packets.
Change-Id: I279d1d7cbf5d37dd5609c2b968f317fe9a0e348d
Sometimes the originating pdp ctx causing the Recovery Procedure is
required, in order to drop all pdp ctx but this one, which specs specify
should be handled as valid:
"""
The SGSN receiving the Recovery information element shall handle it as when an
Echo Response message is received but shall consider the PDP context being created as active if the response indicates
successful context activation at the GGSN.
"""
Change-Id: I53e92298f2f6b84d662a3300d922e8c2ccb178bc
With this API, user is expectd to free the PDP ctx when the confirmation
for the release has been received (cb_conf time). This way user can
maintain the pdp ctx alive during all this time. Extra code is added to
gtp_delete_pdp_resp() since it's now possible to match it and push it up
to the user cb_conf.
This way, cb_conf() can be used for locally-initiated DEL CTX REQ, while
delete_context() cb is left for remotely-initiated DEL CTX REQ. In this
later case, when the DEL CTX RESP is sent the ctx is deleted and the
delete_context() is called, where the user can do related actions or
trigger consequence events (in the case of SGSN, it will drop all
related GGSN bits for that PDP ctx and forward the DEACT PDP CTX to the
MS).
Change-Id: I29d366253bb98dcba328c7ce8aa3e4daf8f75e6c
According to 3GPP TS 29.060 section "7.3.5
Delete PDP Context Request", both directions are valid in both GSNs.
This allows osmo-sgsn receive delete ctx indication (cb_delete_context)
in order to implement GGSN initiated requests.
Change-Id: I6927c07be4ddf74defe338d01d947056e15cd14d
Functions not exported in gtp.h should be static.
There's no need to mark functions as extern in the .c file.
Change-Id: Ie61d5c6e0ae45ef3885911cedf71c826ed1705d0
If the version received is not known, pdp is then uninitalized so we
should not be using it. Let's return an error to inform the caller.
Change-Id: Ib3e23b61a3521bd3c9002d3165ca8eff4361a35e
Pau Espin
Keith Whyte
Vadim Yanitskiy
Oliver Smith