Commit Graph

4533 Commits

Author SHA1 Message Date
Jacob Erlbeck 477c69a9c5 gbproxy: Track all TLLIs (not only LOCAL)
This patch removes all checks for the TLLI type.

Sponsored-by: On-Waves ehf
2014-08-08 08:50:14 +02:00
Holger Hans Peter Freyther b773fbf335 sgsn: Make P-TMSI a local TLLI to avoid clash
Some broken equipment does not convert the P-TMSI to a Local TLLI.
This leads to the SGSN ignoring the GPRS Attach Complete message
from the phone. Proprietary SGSNs and some documentation we found
state that one should always set the two highest bits of a P-TMSI
to one. This will help broken equipment and will avoid a potential
P-TMSI/TLLI clash. The P-TMSI/Local TLLI mapping is now bijective.
2014-08-05 15:20:23 +02:00
Jacob Erlbeck 58cf664d28 gprs: Refactor gbprox_register_tlli()
Currently gbprox_register_tlli() is a rather complex function.

This patch splits it into several smaller functions to ease reviewing
and maintaining it.

Sponsored-by: On-Waves ehf
2014-08-05 15:11:11 +02:00
Holger Hans Peter Freyther 0196c9936c gbproxy/test: Test TLLI expiry
This adds a unit test for gbprox_register_tlli() and
gbprox_remove_stale_tllis().

The dump_peers() function is extended by a cfg parameter to support
a non-global gbproxy_config.

Done with Jacob
2014-08-05 15:02:06 +02:00
Jacob Erlbeck d8a7e22709 gbproxy: Remove broken TLLI comparison
This comparison bit-ored the TLLI with 0xc000 instead of 0xc000000.

Since this has never worked properly yet and since normalizing to
local TLLIs doesn't seem sensible here, the comparison is removed
entirely.

Sponsored-by: On-Waves ehf
2014-08-04 17:13:17 +02:00
Holger Hans Peter Freyther 3fa26448d1 gbproxy: Kill the global gbprox_global_patch_state struct
Move this patching state into the gbproxy_config as well.

Done by Jacob
2014-08-04 16:27:11 +02:00
Holger Hans Peter Freyther 3748ada073 gbproxy: Add a hint to the compiler that all parameters are not NULL
In these functions we assume that peer is not NULL. Add a compiler
attribute in the hope that either coverity or GCC/Clang will help
us to find a misusage.

Done with Jacob
2014-08-04 16:06:20 +02:00
Holger Hans Peter Freyther eece627799 gbproxy: Remove global state from the gbproxy
Global state prevents us from writing simple units tests for
single routines. Go through the code and add pointers to the
gbproxy configuration. Only the vty and the test code remain
using the global gbproxy instance.
2014-08-04 16:01:12 +02:00
Holger Hans Peter Freyther fa7a8bc6eb gprs: The methods moved to gprs_utils.h remove them here
Stop declaring the apn routines in here.

Done with Jacob
2014-08-04 15:44:21 +02:00
Holger Hans Peter Freyther ce1b22e817 gprs: Add testcases for the APN string/octet conversion and fix it
Create a testcase for the gprs_str_to_apn and gprs_apn_to_str
routines. While writing the testcase we noticed it is possible to
write more bytes than should have been allowed. This is fixed by
checking that the max_len is at least 1 (needed to write the first
length octet) and to do the size check before writing to the output.

Modify the signature of gprs_str_to_apn to put the length/size next
to the parameter that requires a size.

Done with Jacob
2014-08-04 15:00:54 +02:00
Holger Hans Peter Freyther 4d9fc422d2 gbproxy: Use gbprox_delete_tlli if possible
Make use of the delete routine in more places and get test coverage
for it.

Done with Jacob
2014-08-04 12:18:07 +02:00
Holger Hans Peter Freyther 7127b0295e gprs: Create a gprs_utils file and move to be shared code in there
We intend to move some of these routines to libosmocore but to avoid
a feature symbol clash we are prefixing these routines with gprs_.

Done with Jacob
2014-08-04 11:52:52 +02:00
Holger Hans Peter Freyther 1ddd9e518e gbproxy: Use gbproxy_ for all structures
The application is called gbproxy but the structures and functions
were inconsistently named as either gbprox or gbproxy. Rename all
structures to use gbproxy.

Done with Jacob
2014-08-04 11:37:50 +02:00
Holger Hans Peter Freyther b900459e96 gbproxy: The dump routines are only used by the test, move it there
Done with Jacob
2014-08-04 11:37:47 +02:00
Holger Hans Peter Freyther 16f30b5373 gbproxy: Have a clear namespace for the public functions
Done with Jacob
2014-08-04 11:37:45 +02:00
Holger Hans Peter Freyther a7027a04dd gbproxy: Remove the global rate counter and place it in the config
Move the global data into the struct and use it. gbprox_reset will
first free data and then re-initialize the structure. This code is
used by the unit test.

Done with Jacob
2014-08-04 11:37:40 +02:00
Holger Hans Peter Freyther d4d36f22ee gbproxy: Correct the method name. We work on TLLIs
Done with Jacob
2014-08-04 11:37:33 +02:00
Holger Hans Peter Freyther 18739ea32d gbproxy: Move the VTY code into the vty file and create public API
Create public accessors to the core of the peer to allow to
simplify the test and separate concerns.

Done with Jacob.
2014-08-04 11:37:28 +02:00
Andreas Eversberg 035b874fdf MNCC: Add IMSI to CALL CONFIRM message
LCR requires IMSI to correlate calls for MPTY (multi party conference)
and ECT (call transfer).
2014-08-04 08:59:16 +02:00
Andreas Eversberg 723a751e5f dyn PDCH: Cleanup of rsl_chan_activate_lchan() and users
Timing advance is stored inside lchan structure, so it is removed from
arguments. This is useful, if other actions are required prior calling
rsl_chan_activate_lchan. (like deactivating PDCH first)

The "shifted TA value" that is required by BS11 is now calculated inside
rsl_chan_activate_lchan and not by each user.

[Rebased by Holger. So some hunks were skipped as the patch
depended on Jolly's HO code]
2014-08-04 08:59:16 +02:00
Harald Welte 1011d5b505 vty: Fix interactive VTY help for silent-sms transmission 2014-08-02 09:58:52 +02:00
Harald Welte c7548a116c DB: produce a backtrace in case of a DB error
This helps us to identify where exactly in our code the DB error
originates from.
2014-08-02 09:58:52 +02:00
Holger Hans Peter Freyther 9b62580595 openbsc: Add new fields for the osmo-bts software
For the osmo-bts software we want to be able to slowly change the
output power. The state is kept inside the trx structure.
2014-07-30 18:20:51 +02:00
Max a5cae441e2 Fix some packaging mistakes detected by lintian.
Signed-off-by: Max Suraev <max.suraev@fairwaves.co>
2014-07-30 08:46:47 +02:00
Holger Hans Peter Freyther 652cdb4699 trau: Cast to remove compiler warning
rtp_proxy.c: In function ‘rtp_decode’:
rtp_proxy.c:199:8: warning: assignment from incompatible pointer type
  frame = msgb_put(new_msg, sizeof(struct gsm_data_frame));
2014-07-24 21:09:31 +02:00
Holger Hans Peter Freyther 922ef5dc86 bts: Remember the last AMR mode that we received
Not every air message contains the AMR mode so we need to remember
it to not confuse receiving equipment like AudioCodes Media Gateways.
2014-07-24 21:05:32 +02:00
Jacob Erlbeck 03551e5f3c gprs: Move LLC IE length fix to BSSGP level
This commit moves the fixing code of the length field of the LLC
information element to the BSSGP patching level since that is not a
part of LLC itself.

Sponsored-by: On-Waves ehf
2014-07-22 17:13:32 +02:00
Jacob Erlbeck 2e2650f8f3 gprs: Parse PTMSI and update TLLI accordingly
This commit adds code to parse the PTMSI in network originated
messages

  - Attach Accept,
  - Routing Area Update Accept, and
  - P-TMSI Reallocation Command (see below)

to keep track of the TLLI identifying the LLC connection.

The P_TMSI Realloc Command specific code is not being tested yet, so
a corresponding notice is logged when such a message will be
received.

NOTE:
  The gbproxy will lose the TLLI when the MS doesn't receive/use
  the message (normally the SGSN remembers the old TLLI for some time
  to avoid this kind of problem). If this happens the MS will
  probably restart the procedure and the network will have to answer
  again eventually using one of the above messages which will
  re-associate the IMSI with the TLLI before the MS can send a
  PDP Context Request message.

Ticket: OW#1192
Sponsored-by: On-Waves ehf
2014-07-22 17:11:57 +02:00
Jacob Erlbeck 35cc03f97d gprs: Use struct to pass context information
Add a struct containing context information from the parts of the
message that have been parsed already. A pointer to this (temporary)
struct is passed to parse/patch functions.

Sponsored-by: On-Waves ehf
2014-07-22 17:10:51 +02:00
Jacob Erlbeck aefaf92d1a gprs: Use shift functions instead of manual parsing
Currently the patching code directly accesses the single bytes to
parse the LLC/DTAP messages.

This patch uses the shift functions instead to parse tlv and similar
structures.

Sponsored-by: On-Waves ehf
2014-07-22 17:08:28 +02:00
Jacob Erlbeck b138106423 gprs: Add TLV parse functions
This adds a set of function that parse a single tlv, lv, tv, or v
encoded information element. They are complementary to the *_put
functions defined in libosmocore's tlv.h file. The functions update
the data and data_len fields unless they are a 'match' function and
the tag field doesn't match.

Sponsored-by: On-Waves ehf
2014-07-22 17:08:10 +02:00
Jacob Erlbeck 040b4012a7 gprs: Fix TLLI cache size computation
Currently the enabled_tllis_count field isn't always decremented when
an element is removed from the TLLI cache list.

This patch adds the missing update and also adjusts the counter
accordingly.

Sponsored-by: On-Waves ehf
2014-07-22 17:05:16 +02:00
Jacob Erlbeck aa3e334608 gprs/test: Rearrange for PTMSI parsing
Add TLLI cache output to gbprox_dump_peers() to include this info
into the test output.

Separate RA Update Req message handling from Attach Request handling.

Note: There is no test case for the P-TMSI Reallocation Command yet.

Sponsored-by: On-Waves ehf
2014-07-22 17:03:23 +02:00
Jacob Erlbeck 25049b93b1 gprs: Add counters related to LLC layer patching
This commit adds the following counters:

  - attach-reqs:   Number of Attach Request messages
  - attach-rejs:   Number of Attach Reject messages
  - tlli-cache:    Size of the TLLI cache

Sponsored-by: On-Waves ehf
2014-07-22 17:02:43 +02:00
Jacob Erlbeck 7dd498de64 gprs/vty: Add commands to manage the TLLI list
These commands manage the TLLI list used to decide whether an APN
shall be patched or not. Note that this list is (currently) only
maintained if IMSI matching is used.

VTY commands (enable node):
  show gbproxy tllis                   show all TLLI entries
  delete-gbproxy-tlli NSEI stale       purge all stale entries
  delete-gbproxy-tlli NSEI imsi IMSI   purge entry with the IMSI given
  delete-gbproxy-tlli NSEI tlli TLLI   purge entry with the TLLI given

Sponsored-by: On-Waves ehf
2014-07-22 17:02:34 +02:00
Jacob Erlbeck 7c101d922e gprs: Track IMSI/TLLI to control APN patching
This patch adds IMSI/TLLI connection tracking and uses it to control
APN patching based on the IMSI. TLLI entries can expire based on age
and/or by limiting the TLLI list size.

VTY config-gbproxy:
  no core-access-point-name                   disable APN patching
  core-access-point-name none                 remove APN if present
  core-access-point-name APN                  replace APN if present
  core-access-point-name none match-imsi RE   remove if IMSI matches
  core-access-point-name APN match-imsi RE    replace if IMSI matches
  tlli-list max-age SECONDS                   expire after SECONDS
  no tlli-list max-age                        don't expire by age
  tlli-list max-length N                      keep N entries only
  no tlli-list max-length                     don't limit list length

RE is an extended regular expression, e.g. ^12345|^23456

Ticket: OW#1192
Sponsored-by: On-Waves ehf
2014-07-22 16:56:33 +02:00
Jacob Erlbeck 006c038212 gprs: Store gbproxy patching state per peer
Currently, all patching state is stored globally in the gbproxy. Thus
the feature cannot be used safely with a concentrating gbproxy (NAT).

This patch moves the state and relevant counters to the gbprox_peer
structure. It adds code to resolve the corresponding peer when
packets are received by looking at BVCI, NSEI, and BSSGP IEs (BVCI,
RAI/LAI/LAC) when the peer is not passed to the
gbprox_patch_bssgp_message() function.

Test cases are also added for the SGSN->BSS case including test cases
with invalid identifiers.

Note that this patch should make it possible to use RAI patching at a
NAT gbproxy as long as the messages are not encrypted.

Ticket: OW#1185
Sponsored-by: On-Waves ehf
2014-07-22 16:53:41 +02:00
Jacob Erlbeck cf02eb1b20 gprs/test: Add Detach messages to test
This patch adds a Detach Request (MO) / Detach Accept sequence to the
test, followed by another (here invalid) Act PDP Context Req which
should be APN patched.

Sponsored-by: On-Waves ehf
2014-07-22 16:19:57 +02:00
Jacob Erlbeck 1166974bca gprs/test: Added GMM Info and fixed TLLI
Add a DTAP GMM Information message with an IMSI in the BSSGP header
to enable the association between IMSI and TLLI.

The TLLI of the Routing Area Update messages is set to foreign.

Sponsored-by: On-Waves ehf
2014-07-22 16:18:40 +02:00
Jacob Erlbeck 736852825a gprs: Add APN patch support for LLC/GSM messages
Patch the APN in every 'Activate PDP Context Request' message to the
value given by the 'core-access-point-name' command. If the command is
given without an APN, the whole APN IE will be removed. If the
command is being prefixed by a 'no', the APN IE remains unmodified.

The patch mode 'llc-gsm' is added to selectively enable the patching
of LLC session management messages. This is enabled implicitely by
the patch mode 'llc'.

Note that the patch mode should not be set to a value not enabling
the patching of LLC GSM messages ('llc-gsm', 'llc', and 'default' are
sufficient to patch 'Activate PDP Context Request' messages).

Ticket: OW#1192
Sponsored-by: On-Waves ehf
2014-07-22 16:07:01 +02:00
Jacob Erlbeck 91fb680236 gprs: Add MCC/MNC patch support for LLC/GMM messages
This patch extends the BSSGP patch code to also patch LLC information
elements along with MCC/MNC patching support for the following messages:

- Attach Request
- Attach Accept
- Routing Area Update Request
- Routing Area Update Accept
- P-TMSI reallocation command

Note that encrypted packets will not be patched.

Ticket: OW#1185
Sponsored-by: On-Waves ehf
2014-07-22 16:05:59 +02:00
Jacob Erlbeck 67a4445675 gprs: Implement BSSGP MCC/MNC patching
This adds a feature to patch the BSSGP MNC/MCC fields of messages going
to and coming from the SGSN. To enable this feature, the gbproxy's
VTY commands 'core-mobile-country-code' and/or
'core-mobile-network-code' must be used. All packets to the SGSN are
patched to match the configured values. Packets received from the
SGSN are patched to the corresponding values as last seen from the BSS
side.

Note that this will probably not work with a gbproxy used for several
BSS simultaneously.

Note also, that MCC/MNC contained in a LLC IE will not be patched.

Ticket: OW#1185
Sponsored-by: On-Waves ehf
2014-07-22 16:04:54 +02:00
Jacob Erlbeck fd636aed1e gprs: Use imsi field instead of imei
The wrong field has been use for the field length computation. This
hadn't any impact so far, since
  sizeof(ctx->imei) == sizeof(ctx->imsi)

This patch fixes the computation to use the right field.

Sponsored-by: On-Waves ehf
2014-07-22 15:51:55 +02:00
Jacob Erlbeck ff0d65aaf6 gprs/test: Make test output more readable
This patch makes a few changes to improve readability:

- change the sendto() hexdump to start with NS instead of BSSGP
- use more specific message descriptions instead of 'UNITDATA'
- add a title line per test

Sponsored-by: On-Waves ehf
2014-07-22 15:48:53 +02:00
Holger Hans Peter Freyther 524edccb61 Merge branch 'zecke/fixes/osmux-nat'
The osmux code doesn't work if the MGCP MGW is behind a NAT (which
is likely to be the case). The usage of endp->ci is troublesome too
not only because of the uint8_t vs. uint32_t mismatch but because
this identity is generated by the MGCP MGW and can clash. This means
that with two clients the wrong call might be connected.

The next bigger thing is that old handles are never cleared. This
code is clearly not ready for deployment.
2014-07-22 15:21:57 +02:00
Holger Hans Peter Freyther a563641d25 osmux: Drop the message in case we don't know the remote yet.
Avoid creating a bogus state that will never go away.
2014-07-22 15:15:13 +02:00
Holger Hans Peter Freyther ea7ef38734 osmux: Qualify the handle by IPv4 address _and_ port
For our usecase several different systems might be behind the
same firewall so we need to distinguish the remote by more than
the IPv4 address.
2014-07-22 15:15:13 +02:00
Holger Hans Peter Freyther 48a071e366 osmux: Extract the dummy message, find the endpoint and set rtp port
Set the remote port for the endpoint. Somehow this needs to propagate
all the way to the handle.
2014-07-22 15:15:13 +02:00
Holger Hans Peter Freyther 07ec8eebe0 osmux: Send the CI as part of the dummy to help to identify a client
We need to discover the remote port as we are likely behind a NAT.
Right now the NAT code will just send to port 1984 on the BSC but
this might not arrive at the BSC. Include the CI (in the future we
need to include the endpoint address or send the dummy to the net
port). This is just an interim solution.
2014-07-22 15:15:06 +02:00
Holger Hans Peter Freyther 25a2db018e osmux: Using the "CI" and calling it "CID" is plain wrong
The CI is a MGCP value that is counted from 0 upwards. The code
is comparing a uint8_t with a uint32_t. This will only work for
up to UINT8_MAX calls and then will silently break. The code should
probably work with the endpoint number and not the CI. For now
truncate things and hope things work.
2014-07-22 15:11:07 +02:00