ranap_rab_ass: check for more than one RAB assignment req

The spec permits RAB AssignmentRequests with multiple RABs at a time.
Even though one voice call is assigned only one RAB in practice. Since
the current FSM implementation only supports a 1:1 scenario, lets check
if the MSC really assigns only one RAB and block RAB Assignments that do
not fit in this scheme.

Change-Id: I0f1d868fd0b4dc413533d6fcc5482862825181be
Related: OS#5152
This commit is contained in:
Philipp Maier 2022-02-24 14:41:03 +01:00
parent d1f4b9b9a1
commit be9ed71631
5 changed files with 56 additions and 0 deletions

View File

@ -17,3 +17,5 @@ int ranap_rab_ass_resp_ies_replace_inet_addr(RANAP_RAB_AssignmentResponseIEs_t *
bool ranap_rab_ass_req_ies_check_release(RANAP_RAB_AssignmentRequestIEs_t *ies, uint8_t rab_id);
bool ranap_rab_ass_resp_ies_check_failure(RANAP_RAB_AssignmentResponseIEs_t *ies, uint8_t rab_id);
int ranap_rab_ass_req_ies_get_count(RANAP_RAB_AssignmentRequestIEs_t *ies);

View File

@ -689,6 +689,16 @@ int handle_rab_ass_req(struct hnbgw_context_map *map, struct osmo_prim_hdr *oph,
mgw_fsm_priv = talloc_zero(map, struct mgw_fsm_priv);
mgw_fsm_priv->ranap_rab_ass_req_message = message;
/* This FSM only supports RAB assignments with a single RAB assignment only. This limitation has been taken
* into account under the assumption that voice calls typically require a single RAB only. Nevertheless, we
* will block all incoming RAB assignments that try to assign more (or less) than one RAB. */
if (ranap_rab_ass_req_ies_get_count(&message->msg.raB_AssignmentRequestIEs) != 1) {
LOGP(DMGW, LOGL_ERROR,
"mgw_fsm_alloc_and_handle_rab_ass_req() rua_ctx_id=%d, RAB-AssignmentRequest with more than one RAB assignment -- abort!\n",
map->rua_ctx_id);
goto error;
}
/* Parse the RAB Assignment Request now, if it is bad for some reason we will exit early and not bother with
* creating an FSM etc. */
ies = &mgw_fsm_priv->ranap_rab_ass_req_message->msg.raB_AssignmentRequestIEs;

View File

@ -620,3 +620,18 @@ bool ranap_rab_ass_req_ies_check_release(RANAP_RAB_AssignmentRequestIEs_t *ies,
return result;
}
/*! Find out how many RAB items are present in a RAB-SetupOrModifyList inside RANAP_RAB_AssignmentRequestIEs.
* \ptmap[in] ies user provided memory with RANAP_RAB_AssignmentRequestIEs.
* \returns number of RAB items, -1 on failure. */
int ranap_rab_ass_req_ies_get_count(RANAP_RAB_AssignmentRequestIEs_t *ies)
{
/* Make sure we indeed deal with a setup-or-modify list */
if (!(ies->presenceMask & RAB_ASSIGNMENTREQUESTIES_RANAP_RAB_SETUPORMODIFYLIST_PRESENT)) {
RANAP_DEBUG
("Decoding failed, the RANAP RAB AssignmentRequest did not contain a setup-or-modify list!\n");
return -1;
}
return ies->raB_SetupOrModifyList.list.count;
}

View File

@ -320,6 +320,33 @@ void test_ranap_rab_ass_req_ies_check_release(void)
ranap_ran_rx_co_free(&message);
}
void test_ranap_rab_ass_req_ies_get_count(void)
{
int rc;
ranap_message message;
uint8_t testvec[] = {
0x00, 0x00, 0x00, 0x59, 0x00, 0x00, 0x01, 0x00,
0x36, 0x40, 0x52, 0x00, 0x00, 0x01, 0x00, 0x35,
0x00, 0x48, 0x78, 0x22, 0xcd, 0x80, 0x10, 0x2f,
0xa7, 0x20, 0x1a, 0x2c, 0x00, 0x00, 0xf4, 0x4c,
0x08, 0x0a, 0x02, 0x80, 0x00, 0x51, 0x40, 0x00,
0x27, 0x20, 0x28, 0x14, 0x00, 0x67, 0x40, 0x00,
0x00, 0x22, 0x28, 0x14, 0x00, 0x3c, 0x40, 0x00,
0x00, 0x00, 0x50, 0x3d, 0x02, 0x00, 0x02, 0x27,
0xc0, 0x35, 0x00, 0x01, 0x0a, 0x09, 0x01, 0xa2,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x1f, 0x76,
0x00, 0x00, 0x40, 0x01, 0x00, 0x00
};
rc = ranap_ran_rx_co_decode(talloc_asn1_ctx, &message, testvec, sizeof(testvec));
OSMO_ASSERT(rc == 0);
rc = ranap_rab_ass_req_ies_get_count(&message.msg.raB_AssignmentRequestIEs);
printf("ranap_rab_ass_req_ies_get_count rc=%d\n", rc);
ranap_ran_rx_co_free(&message);
}
static const struct log_info_cat log_cat[] = {
[DRANAP] = {
.name = "RANAP", .loglevel = LOGL_DEBUG, .enabled = 1,
@ -382,6 +409,7 @@ int main(int argc, char **argv)
test_ranap_rab_ass_resp_ies_replace_inet_addr();
test_ranap_rab_ass_resp_ies_check_failure();
test_ranap_rab_ass_req_ies_check_release();
test_ranap_rab_ass_req_ies_get_count();
test_cleanup();
return 0;

View File

@ -18,3 +18,4 @@ ranap_rab_ass_resp_ies_check_failure rab_failed_at_hnb=1 (RAB ID 23)
ranap_rab_ass_resp_ies_check_failure rab_failed_at_hnb=0 (RAB ID 44, which is not in the message)
ranap_rab_ass_req_ies_check_release rab_release_req=1 (RAB ID 23)
ranap_rab_ass_req_ies_check_release rab_release_req=0 (RAB ID 44, which is not in the message)
ranap_rab_ass_req_ies_get_count rc=1