From facd57ac565683895368a38ae50a85ebefdbffdf Mon Sep 17 00:00:00 2001 From: Neels Hofmeyr Date: Fri, 15 Dec 2017 03:48:48 +0100 Subject: [PATCH] fix: properly cancel all Paging on IMSI Detach It's not clear cut which code is responsible for canceling pending requests, since the requests list is kept in vlr_subscr, but sending out Paging does certainly not belong in the VLR. Place the requests cleanup in gsm_04_08.c. Add to test_ms_timeout_paging() in msc_vlr_test_ms_timeout.c to verify that a pending paging is canceled on IMSI Detach. Change-Id: Ib8874a9d92f02b0826525b55518332f6899688fd --- include/osmocom/msc/gsm_subscriber.h | 1 + src/libmsc/gsm_04_08.c | 4 ++++ src/libmsc/gsm_subscriber.c | 7 ++++++- tests/msc_vlr/msc_vlr_test_ms_timeout.c | 15 ++++++++++++++- tests/msc_vlr/msc_vlr_test_ms_timeout.err | 21 ++++++++++++++++++--- 5 files changed, 43 insertions(+), 5 deletions(-) diff --git a/include/osmocom/msc/gsm_subscriber.h b/include/osmocom/msc/gsm_subscriber.h index 6b0e3da42..4adfd41b6 100644 --- a/include/osmocom/msc/gsm_subscriber.h +++ b/include/osmocom/msc/gsm_subscriber.h @@ -62,6 +62,7 @@ void subscr_remove_request(struct subscr_request *req); int subscr_rx_paging_response(struct msgb *msg, struct gsm_subscriber_connection *conn); +void subscr_paging_cancel(struct vlr_subscr *vsub, enum gsm_paging_event event); int subscr_paging_dispatch(unsigned int hooknum, unsigned int event, struct msgb *msg, void *data, void *param); diff --git a/src/libmsc/gsm_04_08.c b/src/libmsc/gsm_04_08.c index e370962ea..26ac92319 100644 --- a/src/libmsc/gsm_04_08.c +++ b/src/libmsc/gsm_04_08.c @@ -770,6 +770,10 @@ static int gsm48_rx_mm_imsi_detach_ind(struct gsm_subscriber_connection *conn, s gsm48_mi_type_name(mi_type), mi_string); } else { LOGP(DMM, LOGL_INFO, "IMSI DETACH for %s\n", vlr_subscr_name(vsub)); + + if (vsub->cs.is_paging) + subscr_paging_cancel(vsub, GSM_PAGING_EXPIRED); + vlr_subscr_rx_imsi_detach(vsub); osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_DETACHED, vsub); vlr_subscr_put(vsub); diff --git a/src/libmsc/gsm_subscriber.c b/src/libmsc/gsm_subscriber.c index b3d38d1e8..1a7bf592c 100644 --- a/src/libmsc/gsm_subscriber.c +++ b/src/libmsc/gsm_subscriber.c @@ -52,6 +52,11 @@ #include #include +void subscr_paging_cancel(struct vlr_subscr *vsub, enum gsm_paging_event event) +{ + subscr_paging_dispatch(GSM_HOOK_RR_PAGING, event, NULL, NULL, vsub); +} + int subscr_paging_dispatch(unsigned int hooknum, unsigned int event, struct msgb *msg, void *data, void *param) { @@ -132,7 +137,7 @@ int msc_paging_request(struct vlr_subscr *vsub) static void paging_response_timer_cb(void *data) { struct vlr_subscr *vsub = data; - subscr_paging_dispatch(GSM_HOOK_RR_PAGING, GSM_PAGING_EXPIRED, NULL, NULL, vsub); + subscr_paging_cancel(vsub, GSM_PAGING_EXPIRED); } /*! \brief Start a paging request for vsub, call cbfn(param) when done. diff --git a/tests/msc_vlr/msc_vlr_test_ms_timeout.c b/tests/msc_vlr/msc_vlr_test_ms_timeout.c index 4e0e27d1d..4cfd03513 100644 --- a/tests/msc_vlr/msc_vlr_test_ms_timeout.c +++ b/tests/msc_vlr/msc_vlr_test_ms_timeout.c @@ -258,13 +258,26 @@ void test_ms_timeout_paging() OSMO_ASSERT(vsub); VERBOSE_ASSERT(vsub->cs.is_paging, == false, "%d"); VERBOSE_ASSERT(llist_count(&vsub->cs.requests), == 0, "%d"); + + BTW("Now that the timeout has expired, another Paging is sent on request"); + paging_expect_imsi(imsi); + paging_sent = false; + + send_sms(vsub, vsub, + "Privacy in residential applications is a desirable" + " marketing option."); + + VERBOSE_ASSERT(llist_count(&vsub->cs.requests), == 1, "%d"); vlr_subscr_put(vsub); vsub = NULL; + VERBOSE_ASSERT(paging_sent, == true, "%d"); + VERBOSE_ASSERT(paging_stopped, == false, "%d"); - BTW("subscriber detaches"); + BTW("subscriber detaches, pagings are canceled"); expect_bssap_clear(); ms_sends_msg("050130089910070000006402"); VERBOSE_ASSERT(bssap_clear_sent, == true, "%d"); + VERBOSE_ASSERT(paging_stopped, == true, "%d"); vsub = vlr_subscr_find_by_imsi(net->vlr, imsi); OSMO_ASSERT(!vsub); diff --git a/tests/msc_vlr/msc_vlr_test_ms_timeout.err b/tests/msc_vlr/msc_vlr_test_ms_timeout.err index c8b7e962e..f0c4116ef 100644 --- a/tests/msc_vlr/msc_vlr_test_ms_timeout.err +++ b/tests/msc_vlr/msc_vlr_test_ms_timeout.err @@ -480,16 +480,30 @@ DREF VLR subscr MSISDN:46071 usage decreases to: 1 DREF VLR subscr MSISDN:46071 usage increases to: 2 vsub->cs.is_paging == 0 llist_count(&vsub->cs.requests) == 0 -DREF VLR subscr MSISDN:46071 usage decreases to: 1 --- -- subscriber detaches +- Now that the timeout has expired, another Paging is sent on request +DREF VLR subscr MSISDN:46071 usage increases to: 3 +DMM Subscriber MSISDN:46071 not paged yet, start paging. + RAN_GERAN_A sends out paging request to IMSI 901700000004620, TMSI 0xffffffff, LAC 23 + strcmp(paging_expecting_imsi, imsi) == 0 +DREF VLR subscr MSISDN:46071 usage increases to: 4 + llist_count(&vsub->cs.requests) == 1 +DREF VLR subscr MSISDN:46071 usage decreases to: 3 + paging_sent == 1 + paging_stopped == 0 +--- +- subscriber detaches, pagings are canceled MSC <--RAN_GERAN_A-- MS: GSM48_MT_MM_IMSI_DETACH_IND new conn DREF unknown: MSC conn use + compl_l3 == 1 (0x1) DRLL Dispatching 04.08 message GSM48_MT_MM_IMSI_DETACH_IND (0x5:0x1) DMM IMSI DETACH INDICATION: MI(IMSI)=901700000004620 -DREF VLR subscr MSISDN:46071 usage increases to: 2 +DREF VLR subscr MSISDN:46071 usage increases to: 4 DMM IMSI DETACH for MSISDN:46071 +DPAG Paging failure for MSISDN:46071 (event=1) +DPAG Calling paging cbfn. +DREF VLR subscr MSISDN:46071 usage decreases to: 3 +DREF VLR subscr MSISDN:46071 usage decreases to: 2 DREF VLR subscr MSISDN:46071 usage decreases to: 1 DREF VLR subscr MSISDN:46071 usage decreases to: 0 DREF freeing VLR subscr MSISDN:46071 @@ -498,6 +512,7 @@ DMM msc_subscr_conn_close(vsub=unknown, cause=0): no conn fsm, releasing directl DREF unknown: MSC conn use - compl_l3 == 0 (0x0) DRLL Freeing subscriber connection with NULL subscriber bssap_clear_sent == 1 + paging_stopped == 1 llist_count(&net->subscr_conns) == 0 ===== test_ms_timeout_paging: SUCCESS