Commit Graph

1279 Commits

Author SHA1 Message Date
Pau Espin 2e21a68e83 Use new osmo stat items/ctr APIs
Generated using several semantinc patches with spatch.

Change-Id: I3ee853539949a763a309856bf2e7196415b23741
2021-06-04 16:53:16 +02:00
Pau Espin 6710670cb1 Fill Last Used E-UTRAN PLMN Id when in CSFB
Since recently, osmo-bsc behaves strictly as per specs, meaning it will
only send the "Cell selection indicator after release of all TCH and SDCCH IE"
in RR Channel Release iff:
* "Last Used E-UTRAN PLMN Id" was received in the CommonID sent MSC->BSC
* "Last Used E-UTRAN PLMN Id" was received insider "old BSS to new BSS Information"
  in the HandoverRequest sent MSC->BSC.
On the other hand, CSFB_Indicator from ClearCommand MSC->BSC is nw
ignored and not taken into account.

Hence, let's update osmo-msc to also behave correctly by sending the
Last Used E-UTRAN PLMN ID at CommonID tx time to avoid regressions in
CSFB support when running against newer osmo-bsc.

Let's keep sending the CSFB Indicator in ClearCommand as we used too, in
order to keep compatibility with older BSCs (as per spec).

Related: SYS#5337
Change-Id: Ic5f175b179973d0a50d94f00e15f5a3e332605fc
2021-04-29 14:22:33 +02:00
Vadim Yanitskiy a361cab54a SMS-over-GSUP: notify sender if no transaction found
Change-Id: I4f564610fadbfdbbc33de267786534a5405319f6
2021-04-04 14:09:32 +00:00
Vadim Yanitskiy dd466cfa59 fix _gsm48_cc_trans_free(): send MNCC REL.ind on Clear Request
Calling gsm48_cc_tx_release() before mncc_release_ind() has a side
effect: the former may change CC state to GSM_CSTATE_RELEASE_REQ.
This makes the later send MNCC_REL_CNF instead of MNCC_REL_IND, so
if one of the call leg disconnects due to RF failure, the other one
will not be terminated correctly.

Makes both TC_{mo,mt}_call_clear_request TTCN-3 test cases pass.

Change-Id: I3ad4a99757878de3796027325627c87d9a4e93f1
Related: Id16969fe0de04445d1320a96d35cf1d48cc8cf09
Related: SYS#5340
2021-02-09 18:34:40 +01:00
Vadim Yanitskiy 33144f146a ran_a_decode_cipher_mode_reject(): use gsm0808_get_cause()
Change-Id: I56dd920b931e769ba4d268b09700fe3c9fca4fc6
2021-02-05 20:16:52 +01:00
Vadim Yanitskiy 566ce11df5 submit_to_sms(): fix the use of deprecated gsm_septets2octets()
Change-Id: I9985972f0b1d2b71bfd133c5004201a3a0ffcbd0
2021-02-05 20:15:08 +01:00
Pau Espin e917b1983a main: generate coredump and exit upon SIGABRT received
Previous code relied on abort() switching sigaction to SIG_FDL +
retriggering SIGABRT in case the signal handler returns, which would
then generate the coredump + terminate the process.
However, if a SIGABRT is received from somewhere else (kill -SIGABRT),
then the process would print the talloc report and continue running,
which is not desired.

Change-Id: Iff66eea9ee70850a4d038ece1d8473457023e1ee
Fixes: OS#4865
2020-11-25 18:51:06 +01:00
Harald Welte 4dc5dcf4e0 Use osmo_fd_*_{disable,enable}
Change-Id: I5208124e08d3b403492fe83acee235e61e423450
Depends: libosmocore.git Idb89ba7bc7c129a6304a76900d17f47daf54d17d
2020-11-11 20:14:27 +00:00
Vadim Yanitskiy 33a248724e main: add --vty-ref-mode, use vty_dump_xml_ref_mode()
Change-Id: I66c3521895dd0b9a35e9b75f7766ec8014116246
Depends: Ie2022a7f9e167e5ceacf15350c037dd43768ff40
Related: SYS#4910
2020-10-24 05:25:43 +07:00
Harald Welte aa29e33cb5 Use osmo_fd_setup() whenever applicable
Change-Id: Ib570e2ada619b72001d76d2cae159d78f09d6fb6
2020-10-19 11:38:05 +00:00
Alexander Couzens ae167fcc9a Convert paging response timer into an osmocom own X4 timer
All timeout values should use tdef.

Change-Id: Ic050eb49ba0c5811b43d8d8b44145a1115fd8546
2020-09-26 21:45:09 +02:00
Philipp Maier 9194b33ec1 gsm_04_08: check return code of osmo_mobile_identity_decode_from_l3()
The function gsm48_rx_cm_reest_req() is the only one where the return
code of osmo_mobile_identity_decode_from_l3() is not checked, lets check
it here too.

Change-Id: I37981205870b094b3a40a20197461208daa62698
Fixes: CID#211037
2020-09-25 10:01:36 +00:00
Neels Hofmeyr cbcfe9918b drop duplicate ran_peer_find() vs ran_peer_find_by_addr()
This is the same function existing twice with different names. Keep only one.

Change-Id: If54b54fa61ece0f95564d403e1439fc5f5ededdf
2020-09-25 01:45:08 +02:00
Keith Whyte 192fefe53d Don't Store an SMS in the database when the ESME is not Bound
We may never be able to deliver this SMS if it depends on the ESME, as we will
not resubmit the SMS to the ESME. Better to reject it at this time and have the MS
try again later.

Change-Id: I2c50904349dd4ed229b60b8468d776b817c0bd44
Related: OS#4740
2020-09-22 12:43:14 +00:00
Philipp Maier 8c472bd111 mncc_call: fix memory overrun
The struct gsm_mncc which is created and populated in mncc_call_tx_setup_ind
casted to a union mncc_msg* pointer. This leads to a memory overrun
in mncc_call_tx because the union mncc_msg is larger then the gsm_mncc struct.

To fix this, lets just declare a union mncc_msg and populate the signal
member inside it. This can be handed over to mncc_call_tx. The data in
it will look the same, except that the memory will have the proper
lenght (longer).

Change-Id: Ifff28b3375d6bd5e4f837f25c46736952f7bfa9b
Fixes: CID 214330
2020-09-18 18:08:39 +02:00
Neels Hofmeyr d4099c31c9 fix MGCP timeout timer
Timer X1 is not defined in libosmo-mgcp-client, so this tdef had no effect.
Change this to X2427.
(libosmo-mgcp-client recently moved T2427001 to X2427.)

(X2 is still used in call_leg.c itself)

Related: OS#4539
Related: If097f52701fd81f29bcca1d252f4fb4fca8a04f7 (osmo-mgw)
Change-Id: I9804fdb2c24f49910f2386e3788bd1107b8ebc40
2020-09-18 08:45:38 +00:00
Pau Espin eeda9e123f mncc: Support IPv6 addresses (new version mncc 7)
Change-Id: I6002b648bcb2055dcbbdae3f688f6e2cb7282b7f
2020-09-14 12:41:00 +02:00
Pau Espin 0632717dc1 Support handling IPv6 Transport Address in Handover Request (Ack)
Change-Id: Ie4d07826362d651cd42dc2b4e0af82368a74c774
2020-09-09 13:20:22 +02:00
Pau Espin f9c76e3aa2 Support handling IPv6 Transport Address in Assignment Complete
Change-Id: Ib650bb063404a3068b4cf3c376c6080dc29bebfe
2020-09-08 18:31:25 +02:00
Pau Espin d35abfad72 Support sending IPv6 Transport Address in Assignment Command
Change-Id: Ida43f10a41afbd275233f0ef102287522a2e7099
2020-09-08 18:31:16 +02:00
Keith Whyte 1587ffbc7b vty: allow configuring db path from cfg file
So far, the cmdline argument was the only way to set a database file.
Add a similar config to VTY as 'msc' / 'sms-database'. The cmdline arg is stronger
than the 'database' cfg item. DB is not reloaded from VTY command.

Change-Id: I18d954c30fcceb0b36a620b927fd3a93dcc79f49
2020-08-28 16:25:14 +02:00
Pau Espin c84702c571 Change default SCTP conn NULL->127.0.0.1 to localhost->localhost
"127.0.0.1" is changed to "localhost" to let local NSS decide whether to
use IPv4 or IPv6. In newish systems, IPv6 ::1 will be selected since
IPv6 takes precedence over IPv4.

Similarly, the default source addr needs to be changed from NULL to "localhost"
since for some yet unknwon reason, getaddrinfo(AF_UNSPEC, NULL) returns
first IPv4 "0.0.0.0" and later "::", which is inconsistent with
getaddrinfo("localhost") result, resulting in src=IPv4(0.0.0.0) and
dst=IPv6(::1), which is incompatible and will fail. In any case, since
the default remote address is a local one and it's the client side,
there's no real logical change since the kernel would anyway should have
taken a local address anyway.

Change-Id: I05a5c792ab1d053c6f38ba36d4b9fa6db293fbd0
2020-08-24 07:44:38 +00:00
Vadim Yanitskiy 4d75559dad mncc_builtin: log type of unhandled message in int_mncc_recv()
Change-Id: Ie65b2da4c3a13ac36132a2f8c9c85cc420c7a5a6
2020-08-24 07:35:45 +00:00
Vadim Yanitskiy 880a69391d mncc_builtin: cosmetic: fix coding style in int_mncc_recv()
Change-Id: Iffef3c094a5d030663d312a379e846a8eb917942
2020-08-24 07:35:45 +00:00
Neels Hofmeyr 667d5e0b95 fix crash for unknown MI during Paging Response
Related: OS#4724
Related: I40496bbccbbd9c496cfa57df49e26f124a2b1554 (osmo-ttcn3-hacks)
Change-Id: Ia2c8fa745cfab17ed7114d433f625ddc02ae7b11
2020-08-24 07:34:27 +00:00
Pau Espin 24a885608d Support setting rt-prio and cpu-affinity mask through VTY
Change-Id: I40cf8a86961c1e350b5cd74d6e2cf64a22b7a2b1
Depends: libosmocore.git Change-Id If76a4bd2cc7b3c7adf5d84790a944d78be70e10a
Depends: osmo-gsm-masnuals.git Change-Id Icd75769ef630c3fa985fc5e2154d5521689cdd3c
Related: SYS#4986
2020-08-20 08:44:20 +00:00
Harald Welte 544a32f271 Send "BSSMAP CommonID" to tell BSC about the IMSI
We're already sending the RANAP CommonID message to the RNC,
let's do the same using BSSMAP CommonId towards the BSC.  This
way the BSC knows about the IMSI of the served subscriber, which
is very useful for logging/debugging.

Change-Id: I2552736477663adb250c55728093500e8ae83ebb
Closes: OS#2969
Depends: libosmocore.git I353adc1aa72377f7d4b3336d2ff47791fb73d62c
2020-08-17 11:17:41 +00:00
Vadim Yanitskiy 817ad9054e vty: fix vsub reference counting: call vlr_subscr_put()
Otherwise, each time the 3GPP TS 44.014 MS test commands (TCH loop)
are invoked, both subscriber_mstest_{close,open} functions add +1
to the subscriber's reference count, but never revoke it.

Change-Id: I0cefa5b5a0cb712080ba2afd322db329f19608e3
2020-07-29 05:57:27 +07:00
Vadim Yanitskiy 72e0f09c03 gsm_04_14: fix off-by-one error in create_gsm0414_msg()
This byte is redundant, and must not be allocated in this function.
A consequence of this error is that the MS alwats interprets the
"Sub-channel" IE as test loop A regardless of the specified type.

Here is an example of malformed Close TCH loop (type C) message:

  0f 00 00 04
  x. .. .. ..  - Skip indicator (see 3GPP TS 24.007)
  .x .. .. ..  - Protocol discriminator (see 3GPP TS 24.007)
  .. xx .. ..  - Message type (CLOSE_TCH_LOOP_CMD)
  .. .. !! ..  - (!) Redundant byte from create_gsm0414_msg()
  .. .. .. xx  - (!) The actual "Sub-channel" IE (loop C, X=0)

Change-Id: Ia47225b884439dcd43be307e7351994e55fcd50d
2020-07-29 05:28:54 +07:00
Neels Hofmeyr d9fe7110ea Clear Command: set cause value to "Call Control"
So far, by failing to initialize the cause value, we always send a Clear
Command cause == 0, which actually means "Radio Interface Message Failure".
This is seen in all my logged network traces of osmo-msc lab testing.

"Call Control" seems to be the only cause value that remotely fits a normal
release procedure, even if it was not voice call related, see 3GPP TS 48.008
3.2.1.21.

Related: OS#4664
Change-Id: I1347ed72ae7d7ea73a557b866e764819c5ef8c42
2020-07-28 18:29:58 +02:00
Neels Hofmeyr 59de15614d is_reset_msg: use proper enum for rc value
Change-Id: I88b6204bc3ffac06f92bfc87639ce503b2da24bc
2020-07-09 01:20:19 +02:00
Neels Hofmeyr 5b36d13ba5 sgs_tx_loc_upd_resp_cb(): fix error handling for MI encoding
new_id_ptr should be passed as NULL if encoding the TMSI failed, so initialize
it accordingly.

Also add some bloat to better handle the case of an encoding error, even though
from code analysis that should not be possible here: there is enough buffer,
the MI is a TMSI encoded from a uint32_t...

The problem was introduced by Idfc8e576e10756aeaacf5569f6178068313eb7ea, before
which new_id_len was always 0 when no TMSI was present.

Related: CID#210894
Change-Id: I800c5dca3fdbdedf70a64d9fd5a1bdfd1397f431
2020-07-01 23:33:16 +02:00
Neels Hofmeyr b697274daa refactor: move RESET Osmux TLV parsing to ran_msg_a.c
ran_peer.c is not the proper place to parse messages, because it should be RAN
agnostic. All parsing and encoding belongs in ran_msg_a.c and ran_msg_iu.c.

Move the Osmux TLV parsing into the is_reset_msg op: add supports_osmux
out-parameter (and add a logging fi pointer). To be able to modify msg->l3h,
also make the msgb arg non-const.

In ranap_is_reset_msg(), always return non-support for Osmux.

In bssmap_is_reset_msg(), return 0 if no TLVs were parsed, 1/-1 if an Osmux TLV
was present/not present.

Update the osmux support flag directly where the ConnectionLess message is
received, so that there is only one place responsible for that.

Related: OS#4595
Change-Id: I1ad4a3f9356216dd4bf8c48fba29fd23438810a7
2020-07-01 23:33:16 +02:00
Neels Hofmeyr 83cf10c8a6 propagate Compl L3 Info Cell ID to the VLR subscriber record
As soon as the subscriber is authenticated, update the VLR entry with the
MSC-A's full CGI, including the Cell Id received from the Complete Layer 3
Information.

Thus the Cell Id will be shown by vty 'show subscriber cache' and 'show
connection'.

This is tested by osmo-ttcn3-hacks Ie410714a96353f74a52a104c56fa0a08683e0004.

Related: OS#4627
Change-Id: Iee1781985fb25b21ce27526c6a3768bf70d4dc9a
2020-06-24 19:22:30 +02:00
Neels Hofmeyr 41c0333730 vty 'show connection': show msc_a->via_cell instead of vsub->cgi
For 'show subscriber cache', we print vsub->cgi. For 'show connection', it
makes more sense to print msc_a->via_cell.

This is tested by osmo-ttcn3-hacks Ie410714a96353f74a52a104c56fa0a08683e0004.

Related: OS#4627
Change-Id: I194271af2acb37b4f8cc2d106ab2fd2b0d443589
2020-06-24 19:21:40 +02:00
Neels Hofmeyr 68f50dad76 add comments to clarify some complete l3 details
Change-Id: I6e289900d38d97c346d615b71d36656254e6f2b5
2020-06-24 14:22:52 +02:00
Neels Hofmeyr a509a22b9e add osmo-msc --vty-ref-xml: dump VTY ref XML to stdout
Add only a long option to not clutter the cmdline namespace.

To add a long option without a short letter is slightly complex: use the 'flag'
and 'val' mechanism as in 'man 3 getopt' to write an option index to
long_option.

Make sure that all VTY commands have been added before parsing cmdline options:
move various VTY init further above. For msc_vty_init(), the global msc_network
already needs to be allocated, so also move that.

Depends: Ic74bbdb6dc5ea05f03c791cc70184861e39cd492 (libosmocore)
Change-Id: I9146d5a44427509265420f52ae6540ad93eb14fc
2020-06-23 12:39:29 +00:00
Philipp Maier 7da956e4c6 msc_ho: fix CALL IDENTIFIER in HANDOVER REQUEST
When msc_ho_send_handover_request() generates the HANDOVER REQUEST
message, it does not populate the call_id struct member.

In ran_msg_a.c the struct member call_id is used, but the
call_id_present flag is not set, which also prevents the call_id being
added to the message

Change-Id: I6b1b55b3f5a3092d9557dc2512020c766a9ff744
Related: OS#4582
2020-06-22 16:00:04 +00:00
Philipp Maier f34d945f4f msc_a: add callref as call id to ASSIGNMENT REQ.
The BSSMAP message ASSIGNMENT REQUEST may contain an optional CALL
IDENTIFIER IE. While this IE is optional some BSC implementions may
require it.

Change-Id: I4288f47e4a6d61ec672f431723f6e72c7c6b0799
Related: OS#4582
2020-06-22 16:00:04 +00:00
Harald Welte 53a5ff7da9 remove empty + unused ran_up_l2.c
Change-Id: I5a0fa6a78dd8f32912afc69f4b154caad44a9e78
2020-06-22 14:22:22 +02:00
Neels Hofmeyr 9aac5c2d21 add rudimentary NRI support for MSC pooling
This patch served for a manual testing counterpart for osmo-bsc to implement
MSC pooling.

This enables a basic MSC pooling setup, but for a production setup, osmo-msc
would still lack various features related to unloading subscribers to another
MSC as explained in 3GPP TS 23.236.

Change-Id: Iafe0878a0a2c8669080d757b34a398ea75fced36
2020-06-19 03:58:13 +02:00
Neels Hofmeyr 46d526a3df use new osmo_mobile_identity API everywhere
Depends: Ic3f969e739654c1e8c387aedeeba5cce07fe2307 (libosmocore)
Change-Id: Idfc8e576e10756aeaacf5569f6178068313eb7ea
2020-06-19 03:58:13 +02:00
Philipp Maier 20a6641a3f msc_vty: remove emergency-call command from network
when the VTY write the config file ist prints the configuration line
for emergency-call in network and in msc, however the presence of the
configuration line in network leads to a parsing error on msc startup.
The vty command probably got moved to node msc and it was forgotten
to remove the printing from network.

Change-Id: I4f3dac27723e7852f8f049fcfca5cccdc027734d
Related: OS#4548
2020-06-18 11:55:52 +00:00
Neels Hofmeyr a40adf78c3 vlr_subscr_rx_id_resp(): dont assert on received MI type
The Mobile Identity type is received on the wire, we asserting on its type
constitutes a DoS vector.

Change-Id: I2b2e25ef8e878e91a165018ba49f1609cfb5cbd0
2020-06-03 15:40:39 +00:00
Pau Espin 3694631c1a ran_msg_iu.c: Avoid redefining osmo-iuh global variables
From ASAn on gcc 10.1.0:
+=================================================================
+==269368==ERROR: AddressSanitizer: odr-violation (0x559114a5b880):
+  [1] size=4 'asn1_xer_print' /git/osmo-msc/src/libmsc/ran_msg_iu.c:50:5
+  [2] size=4 'asn1_xer_print' /git/osmo-iuh/src/iu_client.c:85:5
+These globals were registered at these points:
+  [1]:
+    #0 0x7f6208d3869a in __asan_register_globals /build/gcc/src/gcc/libsanitizer/asan/asan_globals.cpp:341
+    #1 0x55911456d221 in _sub_I_00099_1 (/build/new/tmpdir/osmo-msc/tests/msc_vlr/msc_vlr_test_hlr_timeout+0x48d221)
+    #2 0x5591145e8e9c in __libc_csu_init (/build/new/tmpdir/osmo-msc/tests/msc_vlr/msc_vlr_test_hlr_timeout+0x508e9c)
+
+  [2]:
+    #0 0x7f6208d3869a in __asan_register_globals /build/gcc/src/gcc/libsanitizer/asan/asan_globals.cpp:341
+    #1 0x7f6207d8db91 in _sub_I_00099_1 (/build/new/out/lib/libosmo-ranap.so.3+0x47db91)
+    #2 0x7f62096eb0f1 in call_init.part.0 (/lib64/ld-linux-x86-64.so.2+0x110f1)
+
+==269368==HINT: if you don't care about these errors you may set ASAN_OPTIONS=detect_odr_violation=0
+SUMMARY: AddressSanitizer: odr-violation: global 'asn1_xer_print' at /git/osmo-msc/src/libmsc/ran_msg_iu.c:50:5
+==269368==ABORTING

Related: OS#4556
Change-Id: I702e9748eaaf2279c3764ba67f80f00ae9f2526f
2020-05-19 20:32:18 +00:00
Pau Espin c95c0b6dd6 Use OSMO_FD_* instead of deprecated BSC_FD_*
New define is available since libosmocore 1.1.0, and we already require
1.3.0, so no need to update dependenices.
Let's change it to avoid people re-using old BSC_FD_* symbols when
copy-pasting somewhere else.

Change-Id: Ifc89fffac0443d94f3e49555684975b293ef90fb
2020-05-09 19:18:40 +02:00
Vadim Yanitskiy 3c8fc13b39 SMS-over-GSUP: notify sender in case of RPL delivery failure
Change-Id: I8436601c4314395e28829960dc753778c37b1125
2020-04-26 23:55:48 +07:00
Vadim Yanitskiy 4547cf1c99 SMS-over-GSUP: notify sender about malformed GSUP messages
Change-Id: I27f00e69ff045cbf641ef21adf44fcd55cb8f889
2020-04-26 23:55:48 +07:00
Vadim Yanitskiy b1e46b17f7 SMS-over-GSUP: notify sender about unhandled GSUP messages
Change-Id: I7970349bd9d5c56a64c409e619e8b581682fef0b
2020-04-26 23:55:48 +07:00
Vadim Yanitskiy b6ec0999f0 SMS-over-GSUP: respond with error if net->sms_over_gsup is false
Change-Id: If14f8a394e691f86e0acbffb283c3862fe62ffd2
2020-04-26 23:55:48 +07:00
Vadim Yanitskiy 531d3a4b11 SMS-over-GSUP: move net->sms_over_gsup check to gsm411_gsup_rx()
Change-Id: I89988b7148b164af304ecae1f53b74f322fdc7bd
2020-04-26 23:55:48 +07:00
Vadim Yanitskiy 46b0f80e69 SMS-over-GSUP: clarify error message about unexpected MO/MT SMS
Change-Id: I34b25764f9ce9b09ccd28cf23fea01028d0828e0
2020-04-26 14:45:29 +00:00
Harald Welte 61ec0295fc vlr_auth_fsm: Fix compilation with gcc-10
See also: https://alioth-lists.debian.net/pipermail/debian-mobcom-maintainers/Week-of-Mon-20200413/000650.html

Change-Id: If3fdbfa20dec02ba57c582700dff12ebbb7d9439
2020-04-20 18:18:18 +00:00
Neels Hofmeyr ebf55f4b31 fix segfault: unsolicited Paging Response
Do not crash when a Paging Response could not be associated with a VLR
subscriber.

Related: OS#4449
Change-Id: Ie117949dd6da86afaa1a0a6ac57bf2111f6cff43
2020-03-09 21:02:31 +01:00
Vadim Yanitskiy 40b11c9ba4 libmsc/sdp: cosmetic: fix less-than-zero comparison of an unsigned value
Change-Id: I57ed17d8457ada69a3c22233f30339d2c0f65bce
Fixes: CID#206075
2020-02-09 04:05:08 +07:00
Vadim Yanitskiy ef830ef225 osmo-msc: use stderr to print error messages, not stdout
Change-Id: I702dd054d2e881b526f701ca482ec0f64ba8da28
2020-01-29 00:18:23 +07:00
Vadim Yanitskiy 5b19f6ed1e libmsc/gsm_04_08: use DRR in gsm48_rx_rr_pag_resp(), not DMM
Change-Id: I006c2b4c684dc6b96e98dbb82063a0aa37e33c66
2020-01-27 18:21:08 +00:00
Vadim Yanitskiy 6a9a3a779f libmsc/gsm_04_08: make use of msc_a in gsm48_rx_rr_app_info()
Change-Id: I2a0991c9bbf86b7eb248d74334f9472c56a3c964
2020-01-27 18:21:08 +00:00
Vadim Yanitskiy 9b56cd893b VTY: cosmetic: make struct cmd_node for GSMNET_NODE static
We don't need to expose it anyway.

Change-Id: Icbaed6b3b15aa719a19bb4be8fed347073025a22
2020-01-27 18:21:08 +00:00
Vadim Yanitskiy 601af0ca00 vlr_sgs_fsm: add missing break, do not call to_null() twice
Change-Id: Ib5d1d7633ca6c32d7d63bb1481f51355c97b90fb
2020-01-27 18:21:08 +00:00
Vadim Yanitskiy 3daf0c2786 vlr: remove unused parameter 'log_level' of auth_fsm_start()
We unconditionally use logging level of the parent FSM anyway.
All callers of auth_fsm_start() always pass fi->log_level.

Change-Id: If2fdf2564eb56d3d94ec3800bdcb0aabcad4e48d
2020-01-27 18:21:08 +00:00
Vadim Yanitskiy fc2b019cd8 libmsc: move subscriber expiration timer T3212 to libvlr
Since the split of OsmoNiTB, OsmoMSC does not deal with the radio
access network directly. Therefore the only purpose of T3212 is to
control subscriber expiration in the local VLR. The timeout value
indicated in System Information Type 3 needs to be configured
separately in the BSC/RNC.

This means that we don't need to store it in deci-hours anymore.
Let's move T3212 to the group of VLR specific timers, so it can
be configured and introspected using the generic 'timer' command,
and deprecate the old '[no] periodic location update' command.

It should be also noted that in the old code subscriber expiration
timeout was actually set to twice the T3212 value plus one minute.
After this change, we apply the configured value 'as-is', but
keep the old behaviour for 'periodic location update' command.

Change-Id: I9b12066599a7c834a53a93acf5902d91273bc74f
2020-01-25 12:49:42 +07:00
Vadim Yanitskiy baf71a72ec libvlr: use generic osmo_tdef API for T3250, T3260, and T3270
These timers so far were implemented as a list of unsigned integers,
which has never been initialized to any reasonable defaults. Since
they are used as state timeouts in several FSMs, we might end up
staying in some state forever.

Let's migrate to generic osmo_tdef API and use default values from
table 11.2 of 3GPP TS 24.008. This way the user can introspect and
change their values from the VTY / configuration file.

Change-Id: Ia8cf98da0aea0e626c5ff088a833d7359c43847f
Related: OS#4368
2020-01-25 10:52:26 +07:00
Vadim Yanitskiy ffc7f39f01 VTY: add osmo_tdef introspection and configuration commands
This change introduces several new VTY commands letting the user
a possibility to introspect and reconfigure some of the existing
timers implemented using libosmocore's osmo_tdef API.

At the moment this covers the following timers:

  - MGW specific timers:
    - X1 - MGCP response timeout,
    - X2 - RTP stream establishing timeout,

  - RAN specific timers (same names for GERAN and UTRAN):
    - X1 - Authentication and Ciphering timeout,
    - X2 - RAN connection release sanity timeout,
    - X3 - Handover procedure timeout.

The following commands are introduced:

  - 'enable' node:
    - show timer [(mgw|mncc|sccp|geran|utran|sgs)] [TNNNN]

  - 'config-msc' node:
    - timer [(mgw|mncc|sccp|geran|utran|sgs)] [TNNNN] [(<0-2147483647>|default)]

Both MNCC and SCCP related timer definitions are empty at the
moment. Achieved by using osmo_tdef_group API of libosmovty.

Change-Id: I6024c104b6101666c8aa1108a043910eb75db9a5
Related: OS#4368
2020-01-25 10:24:14 +07:00
Vadim Yanitskiy b7ddbf377f VTY: mark 'subscriber create imsi' command as deprecated
Neither it should appear in the interactive VTY nor in documentation.

Change-Id: I208faab69a40948af5d081edbeaf75f586dfb2e4
2020-01-25 08:17:56 +07:00
Vadim Yanitskiy 047dd50bc8 osmo-msc: fix: properly initialize default values for MGW timers
Otherwise they're all set to 0, if not configured in the VTY.

Change-Id: I4a0823c2f0ca50ed7407fb0457c54a485799c585
2020-01-19 03:59:47 +07:00
Pablo Neira Ayuso 83616a8e5f libmsc: SMS, Avoid premature RP-ACK to MS
There was one libmsc commit to openbsc that was
thus far missing in osmo-msc.

This commit completes the work on delayed response
from an ESME. Without this patch, the SMR sends
an RP-ACK to the mobile station, and subsequently a
DELIVER_SM_REPONSE from the ESME provokes either a second
RP-ACK, or an RP-ERROR; both of which result in
"unhandled at this state (IDLE)" from the SMR

After this patch, we have two things corrected:

1) RP-ERROR respects Deliver-SM error cause.
2) No more "unhandled as this state" error from the SMR

Extract from original commit message:
--------
libmsc: annotate esme route in the sms object from deliver_to_esme()

Annotate this esme route, so we can use it to return -EINPROGRESS to
skip sending premature RP-ACK to the mobile station, in case we're
handling sms routes through SMPP.
--------

Fixes: #OS4351
Change-Id: Ic34d398e0a850856e20380ae35e5c2ae5e3c539b
2020-01-15 14:47:04 +00:00
Keith Whyte 2cad562eb2 Trivial: code simplification, return early
This commit also, (for what it is worth) removes a
difference to the same file in openbsc, which I found
while looking for changes that affected SMPP delivery.
This is essentially a "forward-port" of [1]

[1] https://gerrit.osmocom.org/#/c/openbsc/+/3899/

Change-Id: I350c19f5bb70b2656171c096334c2ee83f49df7e
2020-01-13 06:34:35 +01:00
Keith Whyte b67131595f Use GSM411_RP_* and not GSM48_CC_*
d34ed5768c introduced
comparison of GSM411_RP_CAUSE_MO_NUM_UNASSIGNED with
GSM48_CC_CAUSE_UNASSIGNED_NR

For consistency lets use the GSM411_RP constants
in SMS related code.

Change-Id: Ie54966560f66d2dcde905feb2eb19ef90406acd1
2020-01-11 13:07:14 +01:00
Neels Hofmeyr 02dd265d68 vlr.c: fix condition to check MSISDN presence
msisdn_enc is a buffer, its address is always != 0

Change-Id: Ib2294d2cd339c36df599d7d134f979a572ac308a
2020-01-06 18:00:40 +01:00
Neels Hofmeyr 27c8b033fc vlr_gsup_rx: fix uninitialized rc
Change-Id: Id7776a473b8356d1d136d78736698f20accc7a36
2020-01-06 18:00:31 +01:00
Vadim Yanitskiy a79aac0113 libmsc/gsm_04_08.c: fix: verify MI before calling vlr_subscr_rx_id_resp()
During the last congress, we have noticed that OsmoMSC crashes
on receipt of malformed MM Identity Response messages:

  BSSAP
      Message Type: Direct Transfer (0x01)
      Data Link Connection Identifier
          00.. .... = Control Channel: not further specified (0x0)
          ..00 0... = Spare: 0x0
          .... .000 = SAPI: RR/MM/CC (0x0)
      Length: 11
  GSM A-I/F DTAP - Identity Response
      Protocol Discriminator: Mobility Management messages (5)
          .... 0101 = Protocol discriminator: Mobility Management messages (0x5)
          0000 .... = Skip Indicator: No indication of selected PLMN (0)
      01.. .... = Sequence number: 1
      ..01 1001 = DTAP Mobility Management Message Type: Identity Response (0x19)
      Mobile Identity - Format Unknown
          Length: 8
          .... 1... = Odd/even indication: Odd number of identity digits
          .... .111 = Mobile Identity Type: Unknown (7)  <-- This makes OsmoMSC crash
              [Expert Info (Warning/Protocol): Unknown format 7]
                  [Unknown format 7]
                  [Severity level: Warning]
                  [Group: Protocol]

The value '111'B is not a valid Mobile Identity type, and shall be
considered as reserved according to 3GPP TS 24.008, section 10.5.1.4.
Later on it was discovered that '000'B also crashes OsmoMSC in the same way.

The crash itself is provoked by OSMO_ASSERT(0) in vlr_subscr_rx_id_resp().
Let's keep that assert in there, and make sure that:

  - on receipt of MM Identity Response, Mobile Identity type
    matches the one in MM Identity Request;

  - on receipt of RR Ciphering Mode Complete, Mobile Identity
    contains IMEI(SV) if present.

Change-Id: Ica4c90b8eb4d90325313c6eb400fa4a6bc5df825
TTCN-3 test case: I62f23355eb91df2edf9dc837c928cb86b530b743
Fixes: OS#4340
2020-01-05 11:23:09 +00:00
Vadim Yanitskiy 6e72282454 libmsc/gsm_04_11_gsup.c: fix SM-RP-OA encoding for MO SMS over GSUP
We shall not include additional BCD length octet into the value part
of SM-RP-OA (Originating Address) IE. Instead, there should be
ToA/NPI header (1 octet).

Since we do not get ToN/NPI fields from the VLR/HLR, let's assume
the following default values:

  1... .... = Extension: No extension
  .001 .... = Type of number: International (1)
  .... 0001 = Numbering plan: ISDN/telephone (E.164/E.163) (1)

Change-Id: I0f32e2af0ed2d2fea6addf45efbdfee120c2425d
TTCN-3 test case: Ib467eeca6439bc6cce72293fbb5bb48f6d233db9
Related: OS#4324
2019-12-19 22:12:18 +09:00
Vadim Yanitskiy 61f4780f29 libmsc/gsm_04_11_gsup.c: do not init a buffer in gsm411_gsup_mo_fwd_sm_req()
Because there is no real need for that.

Change-Id: I19d4d0de0d5a46bf1de194b966f18ea8a84ced94
2019-12-19 22:08:23 +09:00
Neels Hofmeyr 3d6a8be0f9 sms log tweak
Change-Id: I77e7a1501f74b9045f032c5b6c2322025a11fd59
2019-12-12 15:46:57 +00:00
Neels Hofmeyr a252bcd089 sms db: when storing an SMS, retrieve the ID
seemed like a good idea, but not sure if we need it at all.

Change-Id: I5fa55307a6abb8bbfe56619235d7b79fbbda6caf
2019-12-12 15:46:41 +00:00
Neels Hofmeyr 63b246453b gsup: indicate CN-Domain in SendAuthInfo Requests
In order for osmo-hlr to be able to 100% guarantee distinct INDs for CS and PS,
set CN-Domain = CS in all SendAuthInfo Requests.

In Milenage auth, it is highly desirable that osmo-hlr guarantees use of
distinct INDs for CS and PS domains.  If an MSC and SGSN attached at the same
time use the same IND bucket to generate Milenage SQN, that collision would
rapidly waste SQNs and load osmo-hlr with requesting new auth tuples on each
CS/PS Complete-Layer3.

So far, osmo-msc did not indicate the CN domain in the GSUP SendAuthInfo
Request, which was neither required nor evaluated. The CN-Domain is only sent
for the UpdateLocation Request that usually follows later.

Related: OS#4318
Change-Id: I22f44068268e62801cadbf6542efaf153423cd65
2019-12-12 02:10:06 +01:00
Harald Welte abbdbfbbab msc: exit(2) on unsupported positional arguments on command line
Change-Id: Iad858974e9d97ae14f3da6dc21267aafafcda0ef
2019-12-03 22:19:32 +01:00
Vadim Yanitskiy db4839c267 libmsc: fix potential NULL-pointer dereferences detected by GCC's LTO
Change-Id: Ib7ba8909dce64d1b8ff3a53495fe3eefc446ed8e
2019-12-02 08:44:53 +00:00
Harald Welte 34a8cc33a2 Check for osmo_fsm_register() error return value
Change-Id: I4cce3d6798fe3184a3085d114b749b4645620978
2019-12-01 15:32:09 +01:00
Harald Welte e000050971 check for osmo_ss7_init() error return value
Change-Id: I2bc34f3962ca7355f20757e36a86ab2fd1a7aef6
2019-12-01 13:19:51 +01:00
Neels Hofmeyr b455205783 MNCC v6: add optional SDP to the socket protocol
Add a char buffer of 1024 characters length as space for SDP to pass to /
receive from MNCC.

Actually support receiving MNCC without such an SDP tail. The main reason for
this is to avoid the need to adjust the ttcn3 implementation of MNCC: it would
stop working for older osmo-msc.

Older or non-SIP MNCC peers could operate the previous MNCC protocol unchanged
(save the protocol number bump) without having to implement SDP.

The SDP part in the MNCC protocol will be used in upcoming patch
I8c3b2de53ffae4ec3a66b9dabf308c290a2c999f.

This patch must be merged at the same time as osmo-sip-connector patch
Iaca9ed6611fc5ca8ca749bbbefc31f54bea5e925, so that both sides have a matching
MNCC protocol version number.

Change-Id: Ie16f0804c4d99760cd4a0c544d0889b6313eebb7
2019-11-28 02:52:55 +01:00
Neels Hofmeyr eef4578102 add sdp_msg API: SDP parsing/composition
Rationale: in order to add full SDP to the MNCC protocol (upcoming patch
I8c3b2de53ffae4ec3a66b9dabf308c290a2c999f), we need to parse and compose SDP
messages. Obviously, libosmo-mgcp-client already contains similar code, but
that is unfortunately heavily glued to the actual MGCP implementation. The
simplest solution is to create this separate implementation, copy-pasting from
the existing libosmo-mgcp-client code as is convenient.

This API is added here to probe whether it works well. When it does, the
intention is to "move it up" to osmo-mgw and overhaul the SDP parsing in our
MGCP client and MGCP server APIs using this same API.

Change-Id: If3ce23cd5bab15e2ab4c52ef3e4c75979dffe931
2019-11-28 02:52:55 +01:00
Neels Hofmeyr bde605dfc5 fix incoming call while Paging
Do not free the CC transaction when an MT subscriber is already being Paged.
Instead, invoke another paging request, which paging.c will correctly add to
the list of pending paging response callbacks to run.

A ttcn3 test is linked in the related patch (s.b.).

Related: OS#4240
Related: Ieeae6322d4e80893ea3408c6b74bf8e32bea8e46
Change-Id: Idd4537b5f4817d17e5c87d9a93775a32aee0e7be
2019-11-28 02:52:55 +01:00
Neels Hofmeyr 00a476bc24 msc_a CC: add some basic sanity tests
Change-Id: I9d7d7d4073282abc6c02a6a297c807dc70c5154c
2019-11-28 02:46:05 +01:00
Neels Hofmeyr cc918cb416 fail on invalid RTP address from MGW
When the CRCX OK returns an invalid RTP address, abort the call; fixes
MSC_Tests.TC_invalid_mgcp_crash.

The original crash happened when adding this error handling without this commit
I08c03946605aa12e0a5ce8b3c773704ef5327a7a ("fsm: use deferred deallocation" for
osmo-mgw I7df2e9202b04e7ca7366bb0a8ec53cf3bb14faf3 "fix use-after-free: require
new fsm deferred dealloc, check for term"). With this error handling added,
even though avoiding a crash, the test does not pass yet, because instead of
rejecting the call, it currently composes an Assignment Command without a
Transport Layer Address. Fix that.

Change-Id: I00c3b5ff74c05bcc2b7c39375c33419916a57193
2019-11-28 02:45:40 +01:00
Martin Hauke 3f07daceef Fix some typos
Fix typos and common misspellings in code comments and log messages.

Change-Id: Ie66b89065f2100c1d2125ce5a6c9b1d58df7c8ad
2019-11-19 01:04:34 +00:00
Neels Hofmeyr 8a50cfbc4e BSSMAP: decode Codec List (BSS Supported)
Actually decode the Codec List (BSS Supported) in BSSMAP, in both the Complete
Layer 3 Information and the Assignment Complete messages.

An upcoming patch improves codec negotiation and requires the BSS supported
codecs, which are so far ignored (which is/was a pity as osmo-bsc goes at great
lengths to compose those IEs).

Change-Id: I66c735c79e982388f06b5de783aa584c9d13569e
2019-11-05 01:33:30 +01:00
Neels Hofmeyr e04cd98121 cc trans: remove unused tch_rtp_create
Use of this flag was dropped when adding inter-BSC and inter-MSC Handover
support, I forgot to remove it.

Change-Id: I5ec78e30eb36fbe78a3f7c46bfa44af5a4eb7bf2
2019-11-05 01:33:30 +01:00
Neels Hofmeyr f439ff121f CC: add error handling for CRCX responses
Fix three 'FIXME: ERROR HANDLING' occurences in the code that reacts upon the
MGW providing (or failing to provide) an RTP port for the RAN side. From an
earlier stage of the code, the cleanup for this situation was extremely
complex, and hence the choice was to simply wait for the call to time out and
fail. But since we have implemented safe deallocation of nested FSMs in
libosmocore, the situation has become rather trivial: simply free the CC
transactions, and all the rest will immediately release, and terminate
correctly without crashing.

A ttcn3 test for this is MSC_Tests:TC_invalid_mgcp_crash, which actually also
needs the change to osmo_sockaddr_str_is_nonzero() in preceding patch
I53ddb19a70fda3deb906464e1b89c12d9b4c7cbd, so that a seemingly valid MGCP
message ends up causing a failure in the on_success() branch of
mgcp_client_endpoint_fsm.c.

Change-Id: I8313bed1d782100bebeac7d8fc040557c4cb653e
2019-11-01 17:35:17 +01:00
Neels Hofmeyr 84ce206ae3 use osmo_sockaddr_str_is_nonzero()
Also regard an RTP port as invalid if the IP address is 0.0.0.0.
Achieve this by using osmo_sockaddr_str_is_nonzero() instead of
osmo_sockaddr_str_is_set().

Depends: I73cbcab90cffcdc9a5f8d5281c57c1f87b2c3550 (libosmocore)
Change-Id: I53ddb19a70fda3deb906464e1b89c12d9b4c7cbd
2019-11-01 17:35:17 +01:00
Neels Hofmeyr 523b92f3aa rtp_stream: sanely cancel MGW endpoint FSM notify
libosmo-mgcp-client recently introduced osmo_mgcpc_ep_cancel_notify() to cancel
notification if a notify target FSM deallocates. Use it for sanity in
rtp_stream FSM cleanup, the notify target for endpoint FSMs.

Depends: I41687d7f3a808587ab7f7520f46dcc3c29cff92d (osmo-mgw)
	 I14f7a46031327fb2b2047b998eae6ad0bb7324ad (osmo-mgw)
Change-Id: I351bb8e8fbc46eb629bcd599f6453e2c84c15015
2019-11-01 17:35:17 +01:00
Neels Hofmeyr 33f71a1200 fsm: use deferred deallocation
Since osmo-bsc uses the MGCP client FSMs, it is required to enable this new
feature to guarantee safe operation. The issue is described in detail in commit
logs linked below.

Notably, osmo-msc currently chooses to omit error handling during MGCP events
(marked "FIXME"). An upcoming patch implements this error handling, and would
make osmo-msc vulnerable to crash from unexpected MGCP messages without this.

Deferred FSM deallocation is a more general, simpler approach to
osmo_fsm_term_safely(), so we can switch that off now.

Depends: Ief4dba9ea587c9b4aea69993e965fbb20fb80e78 (libosmocore),
         I0adc13a1a998e953b6c850efa2761350dd07e03a (libosmocore)
Related: I7df2e9202b04e7ca7366bb0a8ec53cf3bb14faf3 (osmo-mgw)
Change-Id: I08c03946605aa12e0a5ce8b3c773704ef5327a7a
2019-11-01 17:33:02 +01:00
Neels Hofmeyr cf90bdb07d send MNCC REL only if MNCC has actually started
Change-Id: I07b2b6c0ee33f5d3e0a060c10cf36d5c7c9f0d9b
2019-10-29 16:46:32 +01:00
Neels Hofmeyr 0c1ed15336 log: ran_msg_a: tweak a message name
Change-Id: I691025cb957e9b87c8af2dc8eb741dcba6ca26e2
2019-10-29 16:46:32 +01:00
Neels Hofmeyr fe5ae8ef5b log: RANAP encode: use RANAP message names instead of BSSAP
Change-Id: Ib0e0630d775a28958ea86802f70cbeec07087f91
2019-10-29 16:46:32 +01:00
Neels Hofmeyr 72fc706af5 BSSMAP log tweak
Before:
  RAN decode: BSSMAP: Rx BSSMAP DT1 COMPLETE LAYER 3
After:
  RAN decode: BSSMAP: COMPLETE LAYER 3

This caught my attention while I was writing up a script to parse osmo-msc
logging to produce ladder diagrams.

Change-Id: I387dde8f2eb3edb35d22ce52dc0ed580978dea36
2019-10-29 16:46:32 +01:00
Neels Hofmeyr c67b4831c4 also log MNCC_SETUP_REQ
If an incoming MNCC_SETUP_REQ ends up in Paging (as usually it does), the early
return so far skipped logging of that MNCC message. Add this logging.

Change-Id: I1495dd562a06cf6c1e9453a1fe111bdf8f4be081
2019-10-29 16:46:32 +01:00
Neels Hofmeyr 467bb87f44 log: drop duplicate MNCC log
Change-Id: I46055a4f7a6ae517772c6794faad8c775454974a
2019-10-21 00:40:31 +02:00
Neels Hofmeyr c192c0bf71 log which DTAP messages are sent to RAN
So far, the logging said only "RAN encode: BSSMAP: DTAP", but not *which* DTAP
message, which is in fact a very interesting detail when reading osmo-msc logs.

Change-Id: I0cb8d1e3307737ffe53730c64bb984adacedb2da
2019-10-21 00:40:31 +02:00