Commit Graph

13 Commits

Author SHA1 Message Date
Stefan Sperling f83432c25c move creation of insert subscriber data messages to a common function
Move code to create an Insert Subscriber Data message into a common
function which can be shared by hlr.c and luop.c.

As a consequence, we always encode gsup.cn_domain in the corresponding
msgb and must adjust expected output of the 'gsup' test accordingly.

Change-Id: I6a92ca34cdaadca9eacc774bb1ca386c325ba865
Requested-by: neels
Related: OS#2785
2018-05-18 12:18:32 +02:00
Neels Hofmeyr 1b8a1dc00a add error handling to osmo_gsup_configure_wildcard_apn()
Follow-up to I83d9ef2868bbb01e3f1ddb7920fe735aca172b15 as requested in code review.

Change-Id: Ifcee1e0d275741c1172b208600851861adb13238
2018-05-04 16:48:26 +02:00
Neels Hofmeyr 9d307ec7ae add gsup_test to catch OS#3231
Encode an Insert Subscr Data with is_ps == true to trigger the encoding bug
described in OS#3231, i.e. show that it is fixed.

Move osmo_gsup_addr_send() to a separate .c file, so that it can be overridden
in the regression test to just dump the msgb instead.

I used this test to reproduce issue OS#3231, and now that it's here we might as
well keep it, and possibly expand on it in the future.

Related: OS#3231
Change-Id: Id1453351758f3e1a9ff03bd99fefaf51886e77da
2018-05-04 16:12:19 +02:00
Neels Hofmeyr 5aeb438194 fix luop crash: use buffer for APN that remains valid
In osmo_gsup_configure_wildcard_apn(), do not compose APN into a local buffer
that becomes invalid as soon as the function exits. Instead, use a caller
provided buf.

Fixes OS#3231 crash:

  ==20030==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7fffffffd9c0 at pc 0x7ffff6e9b6c2 bp 0x7fffffffd900 sp 0x7fffffffd0b0
  READ of size 2 at 0x7fffffffd9c0 thread T0
      #0 0x7ffff6e9b6c1  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x766c1)
      #1 0x7ffff6314419 in tlv_put ../../../../src/libosmocore/include/osmocom/gsm/tlv.h:107
      #2 0x7ffff6314419 in msgb_tlv_put ../../../../src/libosmocore/include/osmocom/gsm/tlv.h:299
      #3 0x7ffff6314419 in encode_pdp_info ../../../../src/libosmocore/src/gsm/gsup.c:419
      #4 0x7ffff6314419 in osmo_gsup_encode ../../../../src/libosmocore/src/gsm/gsup.c:535
      #5 0x555555580016 in _luop_tx_gsup ../../../src/osmo-hlr/src/luop.c:54
      #6 0x5555555809d8 in lu_op_tx_insert_subscr_data ../../../src/osmo-hlr/src/luop.c:264
      #7 0x55555558b356 in rx_upd_loc_req ../../../src/osmo-hlr/src/hlr.c:306
      #8 0x55555558b356 in read_cb ../../../src/osmo-hlr/src/hlr.c:365
      #9 0x555555586671 in osmo_gsup_server_read_cb ../../../src/osmo-hlr/src/gsup_server.c:105
      #10 0x7ffff5b35911 in ipa_server_conn_read ../../../src/libosmo-abis/src/input/ipa.c:356
      #11 0x7ffff5b35911 in ipa_server_conn_cb ../../../src/libosmo-abis/src/input/ipa.c:387
      #12 0x7ffff5e5541f in osmo_fd_disp_fds ../../../src/libosmocore/src/select.c:216
      #13 0x7ffff5e5541f in osmo_select_main ../../../src/libosmocore/src/select.c:256
      #14 0x5555555791b6 in main ../../../src/osmo-hlr/src/hlr.c:600
      #15 0x7ffff4707a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86)
      #16 0x555555579679 in _start (/usr/local/bin/osmo-hlr+0x25679)

  Address 0x7fffffffd9c0 is located in stack of thread T0 at offset 16 in frame
      #0 0x7ffff63131ff in osmo_gsup_encode ../../../../src/libosmocore/src/gsm/gsup.c:481

    This frame has 1 object(s):
      [32, 64) 'bcd_buf' <== Memory access at offset 16 underflows this variable

Related: OS#3231
Change-Id: I83d9ef2868bbb01e3f1ddb7920fe735aca172b15
2018-05-04 16:02:46 +02:00
Stefan Sperling 93c5b10310 rewrite subscriber_update_notify() without calls into luop
This function relied on implementation details of the luop code.
Port what is necessary for an independent Insert Subscriber Data
Tx operation from the luop code into this function.

A next possible step would be to try to merge both of these
into a common implementation. This will be addressed in a
follow-up change as soon as this change is merged.

The TTCN3 test TC_vty_msisdn_isd is still passing (it currently
triggers the "circuit switched domain" case because it does not
advertise itself as an SGSN in the IPA unit name).

Change-Id: I06c43ece2b48dc63d599000eb6d6d51e08963067
Related: OS#2785
2018-05-02 13:34:38 +02:00
Stefan Sperling 8f8401453c more robust usage of osmo_timer API for osmo-hlr luop timer
Use osmo_timer_setup() to set up the luop timer, instead of
settting the timer up manually.

Delete the timer before the luop is freed to prevent a potential
crash in case the timer is already armed and the function call
chain leading up to lu_op_free() does not cancel the timer.

Found while studying code to prepare work on issue OS#2785.

This change has been tested with 'make check' and TTCN3 HLR tests.

Related: OS#2785
Change-Id: I1a7596675b2d94217895f0f3d3f67b86ef123c2e
2018-03-29 18:17:00 +02:00
Pau Espin fc96f688d4 luop.c: Transform FIXME from warning to pragma message
This way the issue is still visible but we can enable Werror to avoid
introducing new warnings.

Change-Id: I6c9b195bf0e3f853e202cdbdb72d35d83cd2a2ab
2017-12-15 19:05:12 +01:00
Neels Hofmeyr 7ae8d878cf api doc: say that lu_op_tx_del_subscr_data() doesn't free
Change-Id: Ia341d8e5bfc6eb0dc59945281ce88eecfaab057e
2017-10-17 02:03:42 +02:00
Neels Hofmeyr e86437cae4 luop: fix mem leak upon error in lu_op_alloc_conn()
Free allocated luop if osmo_gsup_conn_ccm_get() fails.

Change-Id: I3ebd5fb5e313be452de893248dd58b2bb73ba94a
2017-10-17 02:01:48 +02:00
Neels Hofmeyr 200f56e995 add lu_op_free(), use in luop.c
Add to luop.h, it will be used in db_hlr.c in an upcoming patch.

Change-Id: Ib44d9062edc957d2e0710b7e485604f97e4d5612
2017-10-17 02:01:08 +02:00
Neels Hofmeyr 518335e688 cosmetic: rename db_subscr_get() to db_subscr_get_by_imsi()
There will be more additions, _by_msisdn() and _by_id(), to serve the upcoming
VTY commands, to allow flexibly selecting subscribers as in the old OsmoNITB.

Change-Id: I32fa676ccc5c10eba834c4390c8a42476b9c1961
2017-10-10 02:38:37 +02:00
Max 9cacb6f74b CTRL: add enable/disable packet service cmds
Add commands to enable/disable Packet Service for a given IMSI. Changes
are synced to DB and propagated at runtime to SGSN (in case of disable
command).

Change-Id: I23163ce8667292443ed61cb15c928357dba4b4be
Related: OS#1645
2017-03-06 13:58:04 +01:00
Max ea8b0d46eb Move lu_operation into separate file
Create luop.(c|h) and move lu_operation and corresponding TX
functions there to facilitate re-use in upcoming control interface.

Change-Id: Ic55a45d56b37be2ba43d96f7da2af43b46af9813
Related: OS#1645
2017-02-16 12:29:12 +01:00