Commit Graph

1237 Commits

Author SHA1 Message Date
Pau Espin 8252959b74 sgs: Use available API to set vlr subscr LastUsedEutranPLMNId
This way it's easier to find out where the vlr subscriber field is set.

Change-Id: I203de82accc896c196cb70037af89be6dc826c05
2021-07-01 18:14:39 +02:00
Neels Hofmeyr 73d093a806 improve logging on encryption, for Ciphering and HO
log the algorithm and all keys instead of just Kc.

Change-Id: If7871dedda2b1fb115e6f00da1379ff2e3d68a10
2021-06-24 01:44:20 +02:00
Neels Hofmeyr db07fdcbfc support A5/4 in inter-BSC handover
Forward the Kc128 key to the new BSS in BSSMAP Handover Request.

Depends: Ieb6e43eef9e57281d54d4b7c63664668df5aef3e (libosmocore)
Change-Id: Id5ce995a741c8e469a50a0c46e53c06a2378bb7e
2021-06-24 01:44:17 +02:00
Neels Hofmeyr 6ce2edcac1 support A5/4 in Cipher Mode Command
Related: SYS#5324
Change-Id: I780a739b9bfbefd4f58be051794fe1a491823e67
2021-06-24 01:27:47 +02:00
Eric Wild a7f8020bfa vty: allow A5/4 encryption in config
Add A5/4 to the internal mask of allowed algorithms.

(Not actually working yet, A5/4 implementation follows in other

Related: SYS#5324
Change-Id: I5b46aaa8579f8d069ca39caf996a8795ffe63dd7
2021-06-24 01:27:47 +02:00
Neels Hofmeyr cdcfc80176 ran_msg_a.c: use gsm0808_create_cipher2()
Use new API in Cipher Mode Command to prepare for A5/4 support.

Depends: Ib3906085e0c6e5a496a9f755f0f786238a86ca34 (libosmocore)
Related: SYS#5324
Change-Id: Ib238d367b8d5d07b6ab4cb2e48fbf4ce22ca4476
2021-06-23 23:58:59 +02:00
Neels Hofmeyr 07c8b7cb2e osmo-msc main: use osmo_select_shutdown()
Change-Id: I75f4637c051ed44628e65dab1bdbbf28dcc9626f
2021-06-22 23:34:34 +02:00
Vadim Yanitskiy 435f67f43c msc_tx_common_id(): fix potential NULL pointer dereference
Reported by GCC 11.1.0.  msc_a_vsub() may return NULL.

Change-Id: Iebdd6399e819a03258398e6b7b453bda37e45a20
2021-06-06 15:50:42 +02:00
Pau Espin 2e21a68e83 Use new osmo stat items/ctr APIs
Generated using several semantinc patches with spatch.

Change-Id: I3ee853539949a763a309856bf2e7196415b23741
2021-06-04 16:53:16 +02:00
Pau Espin 6710670cb1 Fill Last Used E-UTRAN PLMN Id when in CSFB
Since recently, osmo-bsc behaves strictly as per specs, meaning it will
only send the "Cell selection indicator after release of all TCH and SDCCH IE"
in RR Channel Release iff:
* "Last Used E-UTRAN PLMN Id" was received in the CommonID sent MSC->BSC
* "Last Used E-UTRAN PLMN Id" was received insider "old BSS to new BSS Information"
  in the HandoverRequest sent MSC->BSC.
On the other hand, CSFB_Indicator from ClearCommand MSC->BSC is nw
ignored and not taken into account.

Hence, let's update osmo-msc to also behave correctly by sending the
Last Used E-UTRAN PLMN ID at CommonID tx time to avoid regressions in
CSFB support when running against newer osmo-bsc.

Let's keep sending the CSFB Indicator in ClearCommand as we used too, in
order to keep compatibility with older BSCs (as per spec).

Related: SYS#5337
Change-Id: Ic5f175b179973d0a50d94f00e15f5a3e332605fc
2021-04-29 14:22:33 +02:00
Vadim Yanitskiy a361cab54a SMS-over-GSUP: notify sender if no transaction found
Change-Id: I4f564610fadbfdbbc33de267786534a5405319f6
2021-04-04 14:09:32 +00:00
Vadim Yanitskiy dd466cfa59 fix _gsm48_cc_trans_free(): send MNCC REL.ind on Clear Request
Calling gsm48_cc_tx_release() before mncc_release_ind() has a side
effect: the former may change CC state to GSM_CSTATE_RELEASE_REQ.
This makes the later send MNCC_REL_CNF instead of MNCC_REL_IND, so
if one of the call leg disconnects due to RF failure, the other one
will not be terminated correctly.

Makes both TC_{mo,mt}_call_clear_request TTCN-3 test cases pass.

Change-Id: I3ad4a99757878de3796027325627c87d9a4e93f1
Related: Id16969fe0de04445d1320a96d35cf1d48cc8cf09
Related: SYS#5340
2021-02-09 18:34:40 +01:00
Vadim Yanitskiy 33144f146a ran_a_decode_cipher_mode_reject(): use gsm0808_get_cause()
Change-Id: I56dd920b931e769ba4d268b09700fe3c9fca4fc6
2021-02-05 20:16:52 +01:00
Vadim Yanitskiy 566ce11df5 submit_to_sms(): fix the use of deprecated gsm_septets2octets()
Change-Id: I9985972f0b1d2b71bfd133c5004201a3a0ffcbd0
2021-02-05 20:15:08 +01:00
Pau Espin e917b1983a main: generate coredump and exit upon SIGABRT received
Previous code relied on abort() switching sigaction to SIG_FDL +
retriggering SIGABRT in case the signal handler returns, which would
then generate the coredump + terminate the process.
However, if a SIGABRT is received from somewhere else (kill -SIGABRT),
then the process would print the talloc report and continue running,
which is not desired.

Change-Id: Iff66eea9ee70850a4d038ece1d8473457023e1ee
Fixes: OS#4865
2020-11-25 18:51:06 +01:00
Harald Welte 4dc5dcf4e0 Use osmo_fd_*_{disable,enable}
Change-Id: I5208124e08d3b403492fe83acee235e61e423450
Depends: libosmocore.git Idb89ba7bc7c129a6304a76900d17f47daf54d17d
2020-11-11 20:14:27 +00:00
Vadim Yanitskiy 33a248724e main: add --vty-ref-mode, use vty_dump_xml_ref_mode()
Change-Id: I66c3521895dd0b9a35e9b75f7766ec8014116246
Depends: Ie2022a7f9e167e5ceacf15350c037dd43768ff40
Related: SYS#4910
2020-10-24 05:25:43 +07:00
Harald Welte aa29e33cb5 Use osmo_fd_setup() whenever applicable
Change-Id: Ib570e2ada619b72001d76d2cae159d78f09d6fb6
2020-10-19 11:38:05 +00:00
Alexander Couzens ae167fcc9a Convert paging response timer into an osmocom own X4 timer
All timeout values should use tdef.

Change-Id: Ic050eb49ba0c5811b43d8d8b44145a1115fd8546
2020-09-26 21:45:09 +02:00
Philipp Maier 9194b33ec1 gsm_04_08: check return code of osmo_mobile_identity_decode_from_l3()
The function gsm48_rx_cm_reest_req() is the only one where the return
code of osmo_mobile_identity_decode_from_l3() is not checked, lets check
it here too.

Change-Id: I37981205870b094b3a40a20197461208daa62698
Fixes: CID#211037
2020-09-25 10:01:36 +00:00
Neels Hofmeyr cbcfe9918b drop duplicate ran_peer_find() vs ran_peer_find_by_addr()
This is the same function existing twice with different names. Keep only one.

Change-Id: If54b54fa61ece0f95564d403e1439fc5f5ededdf
2020-09-25 01:45:08 +02:00
Keith Whyte 192fefe53d Don't Store an SMS in the database when the ESME is not Bound
We may never be able to deliver this SMS if it depends on the ESME, as we will
not resubmit the SMS to the ESME. Better to reject it at this time and have the MS
try again later.

Change-Id: I2c50904349dd4ed229b60b8468d776b817c0bd44
Related: OS#4740
2020-09-22 12:43:14 +00:00
Philipp Maier 8c472bd111 mncc_call: fix memory overrun
The struct gsm_mncc which is created and populated in mncc_call_tx_setup_ind
casted to a union mncc_msg* pointer. This leads to a memory overrun
in mncc_call_tx because the union mncc_msg is larger then the gsm_mncc struct.

To fix this, lets just declare a union mncc_msg and populate the signal
member inside it. This can be handed over to mncc_call_tx. The data in
it will look the same, except that the memory will have the proper
lenght (longer).

Change-Id: Ifff28b3375d6bd5e4f837f25c46736952f7bfa9b
Fixes: CID 214330
2020-09-18 18:08:39 +02:00
Neels Hofmeyr d4099c31c9 fix MGCP timeout timer
Timer X1 is not defined in libosmo-mgcp-client, so this tdef had no effect.
Change this to X2427.
(libosmo-mgcp-client recently moved T2427001 to X2427.)

(X2 is still used in call_leg.c itself)

Related: OS#4539
Related: If097f52701fd81f29bcca1d252f4fb4fca8a04f7 (osmo-mgw)
Change-Id: I9804fdb2c24f49910f2386e3788bd1107b8ebc40
2020-09-18 08:45:38 +00:00
Pau Espin eeda9e123f mncc: Support IPv6 addresses (new version mncc 7)
Change-Id: I6002b648bcb2055dcbbdae3f688f6e2cb7282b7f
2020-09-14 12:41:00 +02:00
Pau Espin 0632717dc1 Support handling IPv6 Transport Address in Handover Request (Ack)
Change-Id: Ie4d07826362d651cd42dc2b4e0af82368a74c774
2020-09-09 13:20:22 +02:00
Pau Espin f9c76e3aa2 Support handling IPv6 Transport Address in Assignment Complete
Change-Id: Ib650bb063404a3068b4cf3c376c6080dc29bebfe
2020-09-08 18:31:25 +02:00
Pau Espin d35abfad72 Support sending IPv6 Transport Address in Assignment Command
Change-Id: Ida43f10a41afbd275233f0ef102287522a2e7099
2020-09-08 18:31:16 +02:00
Keith Whyte 1587ffbc7b vty: allow configuring db path from cfg file
So far, the cmdline argument was the only way to set a database file.
Add a similar config to VTY as 'msc' / 'sms-database'. The cmdline arg is stronger
than the 'database' cfg item. DB is not reloaded from VTY command.

Change-Id: I18d954c30fcceb0b36a620b927fd3a93dcc79f49
2020-08-28 16:25:14 +02:00
Pau Espin c84702c571 Change default SCTP conn NULL-> to localhost->localhost
"" is changed to "localhost" to let local NSS decide whether to
use IPv4 or IPv6. In newish systems, IPv6 ::1 will be selected since
IPv6 takes precedence over IPv4.

Similarly, the default source addr needs to be changed from NULL to "localhost"
since for some yet unknwon reason, getaddrinfo(AF_UNSPEC, NULL) returns
first IPv4 "" and later "::", which is inconsistent with
getaddrinfo("localhost") result, resulting in src=IPv4( and
dst=IPv6(::1), which is incompatible and will fail. In any case, since
the default remote address is a local one and it's the client side,
there's no real logical change since the kernel would anyway should have
taken a local address anyway.

Change-Id: I05a5c792ab1d053c6f38ba36d4b9fa6db293fbd0
2020-08-24 07:44:38 +00:00
Vadim Yanitskiy 4d75559dad mncc_builtin: log type of unhandled message in int_mncc_recv()
Change-Id: Ie65b2da4c3a13ac36132a2f8c9c85cc420c7a5a6
2020-08-24 07:35:45 +00:00
Vadim Yanitskiy 880a69391d mncc_builtin: cosmetic: fix coding style in int_mncc_recv()
Change-Id: Iffef3c094a5d030663d312a379e846a8eb917942
2020-08-24 07:35:45 +00:00
Neels Hofmeyr 667d5e0b95 fix crash for unknown MI during Paging Response
Related: OS#4724
Related: I40496bbccbbd9c496cfa57df49e26f124a2b1554 (osmo-ttcn3-hacks)
Change-Id: Ia2c8fa745cfab17ed7114d433f625ddc02ae7b11
2020-08-24 07:34:27 +00:00
Pau Espin 24a885608d Support setting rt-prio and cpu-affinity mask through VTY
Change-Id: I40cf8a86961c1e350b5cd74d6e2cf64a22b7a2b1
Depends: libosmocore.git Change-Id If76a4bd2cc7b3c7adf5d84790a944d78be70e10a
Depends: osmo-gsm-masnuals.git Change-Id Icd75769ef630c3fa985fc5e2154d5521689cdd3c
Related: SYS#4986
2020-08-20 08:44:20 +00:00
Harald Welte 544a32f271 Send "BSSMAP CommonID" to tell BSC about the IMSI
We're already sending the RANAP CommonID message to the RNC,
let's do the same using BSSMAP CommonId towards the BSC.  This
way the BSC knows about the IMSI of the served subscriber, which
is very useful for logging/debugging.

Change-Id: I2552736477663adb250c55728093500e8ae83ebb
Closes: OS#2969
Depends: libosmocore.git I353adc1aa72377f7d4b3336d2ff47791fb73d62c
2020-08-17 11:17:41 +00:00
Vadim Yanitskiy 817ad9054e vty: fix vsub reference counting: call vlr_subscr_put()
Otherwise, each time the 3GPP TS 44.014 MS test commands (TCH loop)
are invoked, both subscriber_mstest_{close,open} functions add +1
to the subscriber's reference count, but never revoke it.

Change-Id: I0cefa5b5a0cb712080ba2afd322db329f19608e3
2020-07-29 05:57:27 +07:00
Vadim Yanitskiy 72e0f09c03 gsm_04_14: fix off-by-one error in create_gsm0414_msg()
This byte is redundant, and must not be allocated in this function.
A consequence of this error is that the MS alwats interprets the
"Sub-channel" IE as test loop A regardless of the specified type.

Here is an example of malformed Close TCH loop (type C) message:

  0f 00 00 04
  x. .. .. ..  - Skip indicator (see 3GPP TS 24.007)
  .x .. .. ..  - Protocol discriminator (see 3GPP TS 24.007)
  .. xx .. ..  - Message type (CLOSE_TCH_LOOP_CMD)
  .. .. !! ..  - (!) Redundant byte from create_gsm0414_msg()
  .. .. .. xx  - (!) The actual "Sub-channel" IE (loop C, X=0)

Change-Id: Ia47225b884439dcd43be307e7351994e55fcd50d
2020-07-29 05:28:54 +07:00
Neels Hofmeyr d9fe7110ea Clear Command: set cause value to "Call Control"
So far, by failing to initialize the cause value, we always send a Clear
Command cause == 0, which actually means "Radio Interface Message Failure".
This is seen in all my logged network traces of osmo-msc lab testing.

"Call Control" seems to be the only cause value that remotely fits a normal
release procedure, even if it was not voice call related, see 3GPP TS 48.008

Related: OS#4664
Change-Id: I1347ed72ae7d7ea73a557b866e764819c5ef8c42
2020-07-28 18:29:58 +02:00
Neels Hofmeyr 59de15614d is_reset_msg: use proper enum for rc value
Change-Id: I88b6204bc3ffac06f92bfc87639ce503b2da24bc
2020-07-09 01:20:19 +02:00
Neels Hofmeyr 5b36d13ba5 sgs_tx_loc_upd_resp_cb(): fix error handling for MI encoding
new_id_ptr should be passed as NULL if encoding the TMSI failed, so initialize
it accordingly.

Also add some bloat to better handle the case of an encoding error, even though
from code analysis that should not be possible here: there is enough buffer,
the MI is a TMSI encoded from a uint32_t...

The problem was introduced by Idfc8e576e10756aeaacf5569f6178068313eb7ea, before
which new_id_len was always 0 when no TMSI was present.

Related: CID#210894
Change-Id: I800c5dca3fdbdedf70a64d9fd5a1bdfd1397f431
2020-07-01 23:33:16 +02:00
Neels Hofmeyr b697274daa refactor: move RESET Osmux TLV parsing to ran_msg_a.c
ran_peer.c is not the proper place to parse messages, because it should be RAN
agnostic. All parsing and encoding belongs in ran_msg_a.c and ran_msg_iu.c.

Move the Osmux TLV parsing into the is_reset_msg op: add supports_osmux
out-parameter (and add a logging fi pointer). To be able to modify msg->l3h,
also make the msgb arg non-const.

In ranap_is_reset_msg(), always return non-support for Osmux.

In bssmap_is_reset_msg(), return 0 if no TLVs were parsed, 1/-1 if an Osmux TLV
was present/not present.

Update the osmux support flag directly where the ConnectionLess message is
received, so that there is only one place responsible for that.

Related: OS#4595
Change-Id: I1ad4a3f9356216dd4bf8c48fba29fd23438810a7
2020-07-01 23:33:16 +02:00
Neels Hofmeyr 83cf10c8a6 propagate Compl L3 Info Cell ID to the VLR subscriber record
As soon as the subscriber is authenticated, update the VLR entry with the
MSC-A's full CGI, including the Cell Id received from the Complete Layer 3

Thus the Cell Id will be shown by vty 'show subscriber cache' and 'show

This is tested by osmo-ttcn3-hacks Ie410714a96353f74a52a104c56fa0a08683e0004.

Related: OS#4627
Change-Id: Iee1781985fb25b21ce27526c6a3768bf70d4dc9a
2020-06-24 19:22:30 +02:00
Neels Hofmeyr 41c0333730 vty 'show connection': show msc_a->via_cell instead of vsub->cgi
For 'show subscriber cache', we print vsub->cgi. For 'show connection', it
makes more sense to print msc_a->via_cell.

This is tested by osmo-ttcn3-hacks Ie410714a96353f74a52a104c56fa0a08683e0004.

Related: OS#4627
Change-Id: I194271af2acb37b4f8cc2d106ab2fd2b0d443589
2020-06-24 19:21:40 +02:00
Neels Hofmeyr 68f50dad76 add comments to clarify some complete l3 details
Change-Id: I6e289900d38d97c346d615b71d36656254e6f2b5
2020-06-24 14:22:52 +02:00
Neels Hofmeyr a509a22b9e add osmo-msc --vty-ref-xml: dump VTY ref XML to stdout
Add only a long option to not clutter the cmdline namespace.

To add a long option without a short letter is slightly complex: use the 'flag'
and 'val' mechanism as in 'man 3 getopt' to write an option index to

Make sure that all VTY commands have been added before parsing cmdline options:
move various VTY init further above. For msc_vty_init(), the global msc_network
already needs to be allocated, so also move that.

Depends: Ic74bbdb6dc5ea05f03c791cc70184861e39cd492 (libosmocore)
Change-Id: I9146d5a44427509265420f52ae6540ad93eb14fc
2020-06-23 12:39:29 +00:00
Philipp Maier 7da956e4c6 msc_ho: fix CALL IDENTIFIER in HANDOVER REQUEST
When msc_ho_send_handover_request() generates the HANDOVER REQUEST
message, it does not populate the call_id struct member.

In ran_msg_a.c the struct member call_id is used, but the
call_id_present flag is not set, which also prevents the call_id being
added to the message

Change-Id: I6b1b55b3f5a3092d9557dc2512020c766a9ff744
Related: OS#4582
2020-06-22 16:00:04 +00:00
Philipp Maier f34d945f4f msc_a: add callref as call id to ASSIGNMENT REQ.
The BSSMAP message ASSIGNMENT REQUEST may contain an optional CALL
IDENTIFIER IE. While this IE is optional some BSC implementions may
require it.

Change-Id: I4288f47e4a6d61ec672f431723f6e72c7c6b0799
Related: OS#4582
2020-06-22 16:00:04 +00:00
Harald Welte 53a5ff7da9 remove empty + unused ran_up_l2.c
Change-Id: I5a0fa6a78dd8f32912afc69f4b154caad44a9e78
2020-06-22 14:22:22 +02:00
Neels Hofmeyr 9aac5c2d21 add rudimentary NRI support for MSC pooling
This patch served for a manual testing counterpart for osmo-bsc to implement
MSC pooling.

This enables a basic MSC pooling setup, but for a production setup, osmo-msc
would still lack various features related to unloading subscribers to another
MSC as explained in 3GPP TS 23.236.

Change-Id: Iafe0878a0a2c8669080d757b34a398ea75fced36
2020-06-19 03:58:13 +02:00
Neels Hofmeyr 46d526a3df use new osmo_mobile_identity API everywhere
Depends: Ic3f969e739654c1e8c387aedeeba5cce07fe2307 (libosmocore)
Change-Id: Idfc8e576e10756aeaacf5569f6178068313eb7ea
2020-06-19 03:58:13 +02:00