From eaf0469a8b4e0fc9416083f97f0a88e06ab305c8 Mon Sep 17 00:00:00 2001
From: Holger Freyther <zecke@selfish.org>
Date: Sat, 6 Jun 2009 13:54:44 +0000
Subject: [PATCH] gsm_04_08.c: Some spoofing protection against two location
 updating requests

Do not allow two location updating requests on the same lchan. Such
an event is certainly spoofed and can confuse the internal logic of
the application. Prevent that.
---
 src/gsm_04_08.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/gsm_04_08.c b/src/gsm_04_08.c
index 7e448dd68..83f38dd8b 100644
--- a/src/gsm_04_08.c
+++ b/src/gsm_04_08.c
@@ -593,6 +593,17 @@ static int mm_rx_loc_upd_req(struct msgb *msg)
 	DEBUGP(DMM, "LUPDREQ: mi_type=0x%02x MI(%s) type=%s\n", mi_type, mi_string,
 		lupd_name(lu->type));
 
+	/*
+	 * Pseudo Spoof detection: Just drop a second/concurrent
+	 * location updating request.
+	 */
+	if (lchan->loc_operation) {
+		DEBUGP(DMM, "LUPDREQ: ignoring request due an existing one: %p.\n",
+			lchan->loc_operation);
+		gsm0408_loc_upd_rej(lchan, GSM48_REJECT_PROTOCOL_ERROR);
+		return 0;
+	}
+
 	allocate_loc_updating_req(lchan);
 
 	switch (mi_type) {