Commit Graph

181 Commits

Author SHA1 Message Date
Andreas Eversberg a4d0e3cc6b Add check to tch_map(), if RTP sockets exist 2014-05-18 22:23:15 +02:00
Holger Hans Peter Freyther f242e7afef db: Fix fall-out with the subscriber removal in the subscriber deletion code
The sender_id is gone so the code that attempted to delete SMS
didn't work anymore. Delete the SMS based on src_addr or the
dest_addr.

Fixes:
======================================================================
ERROR: testSubscriberAddRemove (__main__.TestCtrlNITB)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "tests/ctrl_test_runner.py", line 379, in testSubscriberAddRemove
    r = self.do_set('subscriber-delete-v1', '2620345')
  File "tests/ctrl_test_runner.py", line 114, in do_set
    return self.recv_msgs()[id]
KeyError: 1002
2014-04-30 20:51:28 +02:00
Holger Hans Peter Freyther 6114401b9b db: Add testcase for the db migration. 2014-04-30 15:31:57 +02:00
Holger Hans Peter Freyther e7cc9aa447 sms: Add code to migrate the database to the new schema
This is mostly based on Alexander's migration code. The code
adds transaction handling and some sanity checks and cleanups
to the code. We made the decision to fork the sms_from_result
method and freeze it to that version. This way sms_from_result
can move forward without having to deal with legacy.
2014-04-30 15:31:57 +02:00
Alexander Chemeris ca7ed2d2df sms: Do not store received id in the SMS database.
That was a bad idea from the very beginning. A visible result of this is a wrong
SMS routing when you change subscriber extensions, while having queued SMS. It's
also a very wrong thing from the code layering perspective.

I think the next logical step should be to remove "receiver" pointer from
the gsm_sms structure into a structure, special for the internal SMS queue.
2014-04-30 15:31:57 +02:00
Holger Hans Peter Freyther ca3c256579 sms: Kill the sms->sender and use addr/ton/npi throughout the code
This is an incompatible database schema change. Store the type of
the address in the database for both the sender and the receiver.

Currently it is possible to use SMPP to store a SMS and the NPI
and TON will be lost on the delivery of the SMS. The schema is
changed to make the delivery always use the right NPI/TON. This
patch is not ready for the master branch as there is no upgrade
path for the HLR yet.
2014-04-30 15:31:57 +02:00
Holger Hans Peter Freyther bd30cd3e1f bsc/msc: Extension can never be NULL use strlen instead
Fixes: Coverity CID 1040717
2014-04-04 11:53:18 +02:00
Holger Hans Peter Freyther cb4567f117 msc: Name is never NULL use strlen to check if it is empty
Fixes: Coverity CID 1040716
2014-04-04 11:50:41 +02:00
Holger Hans Peter Freyther d883db027b nitb/ctrl: Implement a command to list all active subscribers
This is only useful for small networks. List the IMSI and MSISDN
of all active subscribers.

Fixes: SYS#266
2014-03-23 16:22:55 +01:00
Holger Hans Peter Freyther 2d99eeb7f2 nitb/ctrl: Implement creating and deleting subscribers
Sadly there is no proper foreign key relationship on the tables
that related to the Subscriber. This means we can't use a DELETE
with Cascade and need to delete everything by hand. To make things
worse maybe the SMS/Paging code is still using the subscriber
making the operation more dangerous. I had added NULL checks for
sender_id/receiver_id at 30C3 so we should not crash in this
situation.

Fixes: SYS#274
2014-03-23 14:05:49 +01:00
Holger Hans Peter Freyther 9dbc3f8db7 nitb/ctrl: Add command to add/modify a subscriber to the database
The test has been manually verified. Executing the select for
the subscribers showed:

sqlite> select * from Subscriber;
1|2014-03-23 12:12:46|2014-03-23 12:19:09|2620345||445567|1||0|

This created a subscriber with the right IMSI, MSISDN and has
it authorized.

Fixes: SYS#275
2014-03-23 14:05:49 +01:00
Andreas Eversberg 63bfdd83ea mncc: Add support for half rate V1 frames to MNCC/RTP interface 2014-03-20 22:36:16 +01:00
Andreas Eversberg 9acbe4cefe mncc: Use helper function to check if an MNCC frame is data (speech/traffic)
Rename method mncc_rcv_tchf() to mncc_rcv_data(), because the check applies
to all types of data frames, not only TCH/F data.
2014-03-20 22:36:16 +01:00
Andreas Eversberg f78fc4e76e mncc: Complete definitions for all speech traffic frames at MNCC interface
The new definitions are: half rate and AMR

Change of definition name for bad frame, because it applies to all types of
traffic, not only TCH/F.

Increase MNCC interface version to 4. Version 3 is skipped, because it was
used by older version of Linux-Call-Router which is incompatible with the
current version of the MNCC interface.
2014-03-20 22:36:16 +01:00
Alexander Chemeris 9e15e187cc sms: Rename gsm340_gen_tpdu() to gsm340_gen_sms_deliver_tpdu()
Rename gsm340_gen_tpdu() to gsm340_gen_sms_deliver_tpdu() to
show that it generates SMS-DELIVER TPDU and is not a generic function.
2014-03-09 19:27:46 +01:00
Alexander Chemeris 1e77e3dc5b db,sms: Rename db_sms_mark_sent() to db_sms_mark_delivered()
In MT-SMS the message is being delivered. Make the naming follow
that. The schema still refers to "sent" while it should be "delivered"
too.
2014-03-09 10:26:11 +01:00
Alexander Chemeris 7e20f64f27 db: Remove the german from the log message 2014-03-07 17:05:23 +01:00
Daniel Willmann 1fc8ec66a3 smpp_smsc: Fix integer overflow in read return value and msgb_alloc()
The size parameter of msgb_alloc is uint16_t so any length value above
65535 will allocate a msgb with incorrect size.

This patch changes the type of rdlen and rc to ssize_t (the return value
of read) and guards against the read length being larger than
UINT16_MAX.

To reproduce the issue run:
echo -en "\x00\x01\x00\x01\x01" |socat stdin tcp:localhost:2775
2014-03-06 23:20:30 +01:00
Daniel Willmann b6f01e77b1 smpp_smsc: Check that the size is large enough to hold actual data
The first 4 bytes are the length including the length field. For
length < 4 the subsequent msgb_put(msg, sizeof(uint32_t)) will fail,
resulting in an abort. The code also expects (in smpp_msgb_cmdid()) the
existence of 4 more bytes for the SMPP command ID.

This patch checks that the length received is large enough to hold all
8 bytes in the msgb and drops the connection if that's not the case.

The issue is reproducible with:
echo -e "\x00\x00\x00\x02\x00" |socat stdin tcp:localhost:2775
2014-03-06 23:20:30 +01:00
Daniel Willmann a4540b2c3b smpp_smsc: Fix socket read() error handling
Read returning -1 is an error here so make sure to print the actual
reason and close the socket. Before this patch we just looped over the
fd with read returning -1 every time.

EINTR is handled to not cause an error and we don't need to check
EAGAIN/EWOULDBLOCK since the callback is only called in case there is
something to read.

To avoid copy&paste issues the check is implemented as a macro and the
log message moved into a separate if.
2014-03-06 23:20:30 +01:00
Holger Hans Peter Freyther 93de8b2591 sms: Address the TODO and schedule the next SMS for an active subscriber
When one SMS has been delivered check if a second SMS can be scheduled
to that subscriber. If nothing can be scheduled kick the normal SMS queue
as one slot has become free now. Otherwise send the SMS and create a
pending entry.
2014-02-24 16:13:04 +01:00
Holger Hans Peter Freyther 024dc77de2 sms: Do not interfere with the SMS queue from within gsm_04_11
It was possible that two SMS would be delivered at the same time
which violates GSM 04.11. We should solely rely on the sms queue
to schedule more SMS to the subscriber.
2014-02-24 14:31:39 +01:00
Harald Welte 7e40be3949 SMPP: UCS2 data_coding is 0x08, not 0x80!
As can clearly be seen from SMPP Spec v3.4 Chapter 5.2.19,
a SUBMIT-SM with data_coding == 0x08 is UCS2, not with 0x80.

Thanks to ciaby@rhizomatica.org for reporting the bug.
2014-02-21 13:21:03 +01:00
Holger Hans Peter Freyther ca114432be sms: Increment the RP Message Reference for each transaction
Each RP-DATA should have a unique msg reference. Currently 42 is
used for all of these. Remember the last reference we used and
increment it on the next SMS. Do not track if the reference is
still in use a clash is a lot less likely now. First unless SMPP
is used only one SMS is delivered at a time, second the transaction
space is a lot smaller than the one for the reference.
2014-02-20 11:35:56 +01:00
Jacob Erlbeck 8e68b56fe5 sms/dtap: Add log messages to analyse SMS message loss
Incoming DTAP messages from MS are discarded during silent calls,
which leads to the repeated delivery of SMS since the ACKs are not
being processed.

This patch adds some log messages that have been helpful to track
this down.

Sponsored-by: On-Waves ehf
2014-01-31 11:17:44 +01:00
Andreas Eversberg dcf38e1c96 Add function to update TRAU muxer after assignment or handover
E1 based BTS use TRAU muxer to decode TRAU frames. After changing
channel from one timeslot to another (due to handover or assignment),
the TRAU muxer must be updated. The call reference of the call is
disconnected from the old channel and connected to the new channel.
2014-01-27 14:39:06 +01:00
Andreas Eversberg caae10b71f Remove obsolete check of conn and lchan pointers not beeing NULL
The check is removed from gsm48_cc_rx_setup() and gsm48_cc_rx_call_conf().
Receiving a layer 3 message implies that the transaction has a subscriber
connection and a logical channel.

This patch fixes the Coverity issues with CID 115311 and CID 1155312.
2014-01-16 20:49:07 +01:00
Andreas Eversberg a83d511b61 Each BTS can be configured for speech support (other than GSM full rate)
Speech codings which are not supported by BTS will be removed from the
bearer capability information element after parsing. This way it is not
required for the MNCC application to consider support of each BTS.

Only GSM full rate is supported by default.
2014-01-14 17:37:02 +01:00
Jacob Erlbeck f46e226428 nitb: Set the DST field in generated MM info messages
Currently the NET_DST information element (see GSM 24.008) is not
included in generated MM info messages even when the DST field in the
timezone info has been set via the VTY or the control interface.

This patch modifies gsm48_tx_mm_info() to append this information
element if (and only if) a non-zero DST has been configured. The
DST IE is not part of GSM 4.8. Therefore it will only be sent, if the
DST offset is configured to a value != 0.

The DST functionality has been verified with wireshark by Jacob.

Sponsored-by: On-Waves ehf
2014-01-08 10:49:26 +01:00
Holger Hans Peter Freyther 095bd36627 smpp: In case we know the receiver set the context for logging 2013-12-29 20:30:02 +01:00
Holger Hans Peter Freyther 249b3f38c5 mncc: Add the context we get from the MNCC interface
Currently we only set the SUBSCR on RSL messages. Extend it to
messages that go through MNCC. For call control/bridging it is
difficult to pick the right subscriber. We should support a list
or at least two legs in the imsi filter context.
2013-12-29 20:24:37 +01:00
Tobias Engel ea730327d1 ussd: Reject and release unhandled SS requests/interrogation
In case the unpack of a USSD request is failing the channel would
remain open and the phone would not receive a response. Simply
reject the interrogation.

Example interrogation:
0000   1b 7b 1c 0d a1 0b 02 01 01 02 01 0e 30 03 04 01
0010   11 7f 01 00
2013-12-28 17:52:23 +01:00
Holger Hans Peter Freyther f76ed2d089 sms: Fix crash on RLL Establish Request timeouts with active call
Sylvain pointed out that in the current crash log the transaction
we try to read the SMS from is actually a transaction for Call
Control. On AMD64 the struct layout is different and that leads to
a crash when the CC transaction is in front of the SMS transaction.

Look at the trans->protocol to fix the crash. The issue got
introduced in 6a3d765bf9 (2010)
when I added the SAPI N Reject handling.

 #0  smpp_sms_cb (subsys=1, signal=4, handler_data=0xbb8270, signal_data=0x7fff33574ea0)
     at smpp_openbsc.c:284
 284		if (sms->source != SMS_SOURCE_SMPP)
 (gdb) bt
 #0  smpp_sms_cb (subsys=1, signal=4, handler_data=0xbb8270, signal_data=0x7fff33574ea0)
     at smpp_openbsc.c:284
 #1  0x00007f424e4a094c in osmo_signal_dispatch (subsys=1, signal=4,
     signal_data=0x7fff33574ea0) at signal.c:105
 #2  0x000000000042b070 in send_signal (sig_no=<optimized out>, trans=<optimized out>,
     sms=<optimized out>, paging_result=<optimized out>) at gsm_04_11.c:125
 #3  0x000000000042ccd2 in gsm411_sapi_n_reject (conn=0xec6790) at gsm_04_11.c:1000
 #4  0x0000000000408983 in send_sapi_reject (link_id=<optimized out>, conn=<optimized out>)
     at bsc_api.c:733
 #5  rll_ind_cb (_data=<optimized out>, lchan=<optimized out>, link_id=<optimized out>,
     rllr_ind=<optimized out>) at bsc_api.c:755
 #6  rll_ind_cb (lchan=<optimized out>, link_id=<optimized out>, _data=<optimized out>,
     rllr_ind=<optimized out>) at bsc_api.c:736
 #7  0x000000000041f8d2 in complete_rllr (rllr=<optimized out>, type=<optimized out>)
     at bsc_rll.c:55
 #8  0x00007f424e4a03bc in osmo_timers_update () at timer.c:243
 #9  0x00007f424e4a069b in osmo_select_main (polling=0) at select.c:133
 #10 0x0000000000407394 in main (argc=<optimized out>, argv=0x7fff33575238) at bsc_hack.c:346
 (gdb) frame 3
 #3  0x000000000042ccd2 in gsm411_sapi_n_reject (conn=0xec6790) at gsm_04_11.c:1000
 1000				send_signal(S_SMS_UNKNOWN_ERROR, trans, sms, 0);
 (gdb) p trans
 $1 = (struct gsm_trans *) 0xedba80
 (gdb) p *trans
  ....
          data = 0x1}}, sms = 0x3439323400000003}}}
 (gdb) p trans->protocol
 $4 = 3 '\003'
2013-12-27 22:57:56 +01:00
Holger Hans Peter Freyther 900394acf3 db: Avoid crash we have seen with the dbi code when reading a SMS
Avoid a crash when reading a SMS and a Subscriber could not be resolved.
It is not clear why the read was failing. The sender_id and the receiver_id
was valid for the given sms. I assume that the database has been locked
due external access to it.

The side-effect is that in case of such a failure the sms_queue will start
to deliver starting from subscriber id = 0 again.

 #1  0x0000000000428bec in sms_from_result (net=0x156a270, result=0x15eda30) at db.c:1146
 #2  0x000000000042a8e0 in db_sms_get_unsent_by_subscr (net=0x156a270,
     min_subscr_id=<optimized out>, failed=<optimized out>) at db.c:1255
 #3  0x000000000042e900 in take_next_sms (smsq=<optimized out>) at sms_queue.c:193
 #4  sms_submit_pending (_data=0x158e300) at sms_queue.c:227
 #5  0x00007f3fd30de3bc in osmo_timers_update () at timer.c:243
 #6  0x00007f3fd30de69b in osmo_select_main (polling=0) at select.c:133
 #7  0x0000000000406fbc in main (argc=9, argv=<optimized out>) at bsc_hack.c:346
 (gdb) frame 1
 #1  0x0000000000428bec in sms_from_result (net=0x156a270, result=0x15eda30) at db.c:1146
 1146		strncpy(sms->src.addr, sms->sender->extension, sizeof(sms->src.addr)-1);
 (gdb) p *sms
 (gdb) p sms->sender
 $1 = (struct gsm_subscriber *) 0x0
 (gdb) p sender_id
 $2 = <optimized out>
2013-12-27 20:20:55 +01:00
Holger Hans Peter Freyther 8effcb747d libmsc: Set the "trans->conn" to NULL to catch invalid usage
Make finding use-after-free more easy and set it to NULL.
2013-12-27 18:07:23 +01:00
Holger Hans Peter Freyther 1a345ca48f lu crash: Fix a crash that likely occurred during the LU procedure
conn->loc_operation is already NULL (e.g. due a five second timeout but
we are still processing a RSL message after we initiated the release
procedure). Do not attempt to authorize a subcriber without knowing the
key_sequence.

This can cause more problems but we will need to test this in the field.

(gdb) bt
 #0  gsm0408_authorize (conn=0x19fc2f0, msg=<optimized out>) at gsm_04_08.c:323
 #1  gsm0408_authorize (conn=0x19fc2f0, msg=<optimized out>) at gsm_04_08.c:319
 #2  0x000000000043a99a in mm_rx_id_resp (conn=0x19fc2f0, msg=<optimized out>)
     at gsm_04_08.c:495
 #3  gsm0408_rcv_mm (msg=<optimized out>, conn=0x19fc2f0) at gsm_04_08.c:1041
 #4  gsm0408_dispatch (conn=0x19fc2f0, msg=<optimized out>) at gsm_04_08.c:3232

(gdb) p *conn
 $5 = {entry = {next = 0x1746930, prev = 0x1a14270}, subscr = 0x1745eb0,
  expire_timer_stopped = 1 '\001', loc_operation = 0x0, sec_operation = 0x0,
  anch_operation = 0x0, silent_call = 0, put_channel = 0, sccp_con = 0x0, in_release = 0,
  lchan = 0x7f8c79007218, ho_lchan = 0x0, bts = 0x1719f90, T10 = {node = {
      rb_parent_color = 0, rb_right = 0x0, rb_left = 0x0}, list = {next = 0x0, prev = 0x0},
    timeout = {tv_sec = 0, tv_usec = 0}, active = 0, cb = 0, data = 0x0},
  secondary_lchan = 0x0}
2013-12-27 17:37:27 +01:00
Holger Hans Peter Freyther 2147bc4cc9 periodic/lu: Attempt to implicitly attach a subscriber instead of rejecting
When modern Smartphones receive "Not in VLR". The baseband firmware
apparently does not try to do an IMSI ATTACH but just remains un-happy
and will not connect to the network anymore.
2013-12-27 17:22:32 +01:00
Holger Hans Peter Freyther defb10fa62 Revert "gsm_04_11: Speculative fix for MT SMS and SAPI 'n Reject"
Let's revert it and see if we can find the real issue about the
sms being invalid. Sylvain has pointed out that we get invoked
from a timer and might not have stopped it properly.

This reverts commit 80ba9b5dd6.
2013-12-27 16:32:59 +01:00
Holger Hans Peter Freyther 80ba9b5dd6 gsm_04_11: Speculative fix for MT SMS and SAPI 'n Reject
I am not sure why it is crashing so this is a speculative fix based on
something we already did in 3e9b2ec257.

 #0  sms_find_pending (smsq=0x2706300, sms=<optimized out>) at sms_queue.c:77
 #1  sms_sms_cb (subsys=<optimized out>, signal=4, handler_data=0x26e2270,
     signal_data=0x7fffdac256c0) at sms_queue.c:396
 #2  0x00007fcdea94394c in osmo_signal_dispatch (subsys=1, signal=4,
     signal_data=0x7fffdac256c0) at signal.c:105
 #3  0x000000000042acc0 in send_signal (sig_no=<optimized out>, trans=<optimized out>,
     sms=<optimized out>, paging_result=<optimized out>) at gsm_04_11.c:124
 #4  0x000000000042c8e2 in gsm411_sapi_n_reject (conn=0x2722d30) at gsm_04_11.c:999
 #5  0x00000000004085d3 in send_sapi_reject (link_id=<optimized out>, conn=<optimized out>)
     at bsc_api.c:733
 #6  rll_ind_cb (_data=<optimized out>, lchan=<optimized out>, link_id=<optimized out>,
     rllr_ind=<optimized out>) at bsc_api.c:755
 #7  rll_ind_cb (lchan=<optimized out>, link_id=<optimized out>, _data=<optimized out>,
     rllr_ind=<optimized out>) at bsc_api.c:736
 #8  0x000000000041f522 in complete_rllr (rllr=<optimized out>, type=<optimized out>)
     at bsc_rll.c:55
 #9  0x00007fcdea9433bc in osmo_timers_update () at timer.c:243
 #10 0x00007fcdea94369b in osmo_select_main (polling=0) at select.c:133
 #11 0x0000000000406fbc in main (argc=9, argv=<optimized out>) at bsc_hack.c:346
2013-12-27 15:26:42 +01:00
Holger Hans Peter Freyther 91acfa0720 sms: Move to gsm_7bit_encode_n in the sms sending code
Do not rely on the potential wrong gsm_7bit_encode result but
use gsm_7bit_encode_n with maximum available space.
2013-12-26 22:33:02 +01:00
Holger Hans Peter Freyther 1f229b344e ussd: Move to use gsm_7bit_encode_n_ussd for USSD encoding
The legacy functions have a bad/wrong return value for the number
of septets in the string. Change the code to use the new functions
which will fix encoding issues as well.
2013-12-26 22:17:45 +01:00
Kevin Redon c9763a3de4 db: Fetch the authorized key using ulonglong
Location Update Requests time out and get rejected because the
subscriber is not authorized. Authorizing the subscriber through
openBSC or sqlite3 doesn't help the subscriber is still seen and
shown as not authorized

The value is read as uint, this is the wrong type it's a (u)longlong
in libdbi 0.9.0 and later.
2013-12-26 16:02:03 +01:00
Andreas Eversberg d074f8f396 Add EFR support to TRAU muxer + test case
Decoding and encoding of FR and EFR TRAU frames are put into seperate
functions. CRC check is done to detect bad EFR TRAU frames.

The test case includes FR and EFR transcoding.

EFR support was tested with Nokia InSite BTS and Siemens BS11.
2013-12-19 10:12:28 +01:00
Jacob Erlbeck 24d3b91d46 bsc: Move gsm48_tx_mm_serv_ack/rej to gsm_04_08_utils.c
These functions are currently located in libmsc/gsm_04_08.c together
with other symbols that (transitively) depend on many external
symbols (and thus libraries) that aren't otherwise needed by e.g.
osmo-bsc.

Since gsm48_tx_mm_serv_ack() will be needed by osmo-bsc, these
functions are moved to avoid the dependency on gsm_04_08.o.

Sponsored-by: On-Waves ehf
2013-11-01 17:12:37 +01:00
Holger Hans Peter Freyther 28e183f385 Revert "bsc/ussd: Send faked CM Service Accept before sending USSD"
This reverts commit 61bd965b04.

No, we should not link to dbi.. and these libraries..
2013-10-31 13:35:28 +01:00
Jacob Erlbeck 61bd965b04 bsc/ussd: Send faked CM Service Accept before sending USSD
The MS do not show the USSD messages yet. This patch modifies the
implementation to insert a CM Service Accept before the ussdNotify
to finish the establishment of the MM connection according to
3GPP TS 04.10/3.2.1.

This fix has been tested with a Blackberry phone that has shown
an ussd_grace_txt after rf_locked has been set to '1'. Without this
patch, that message wasn't shown. The phone has sent a CC Setup
and other messages before processing the channel release message sent
by the BSC, but these messages have not been forwarded to the MSC (as
expected).

Ticket: OW#957
Sponsored-by: On-Waves ehf
2013-10-31 13:29:51 +01:00
Jacob Erlbeck 36722e13da vty: Use vty_install_default() instead of bsc_install_default()
Remove ournode_exit_cmd, ournode_end_cmd, and bsc_install_default()
since this functionality is provided by the current libosmocore.

Replace calls to bsc_install_default() by call to
vty_install_default() with the following semantic patch:

    @rule1@
    expression N;
    @@
    - bsc_install_default(N);
    + vty_install_default(N);

Ticket: OW#952
Sponsored-by: On-Waves ehf
2013-10-30 15:19:00 +01:00
Alexander Huemer 475f513aea ussd: Fix test for RELEASE COMPLETE
A correcsponding change in libosmocore sets text[0] to '\0'.
The test for 0xFF could never have been true.
2013-10-15 13:29:25 +02:00
Holger Hans Peter Freyther 7634ec1de1 db: Remove the struct gsm_network from the database layer
The database code should not know about the network. Move the
setting of the network pointer into the subscriber layer.
2013-10-13 13:44:54 +02:00
Alexander Chemeris bd6d40f1fb nitb: Add "subscriber create" VTY command.
It may be useful in production, but it's really required for
VTY testing of subscriber related commands.
2013-10-05 10:27:47 +02:00