Commit Graph

636 Commits

Author SHA1 Message Date
Vadim Yanitskiy c44342b88c libmsc: fix memory leak (struct msgb) in msc_i_ran_enc()
Function msc_i_ran_enc() calls msc_role_ran_encode(), but unlike the
other callers of this function it does not free() the encoded message.

A simple solution would be to call msgb_free(), like it's done in
the other places.  But a more elegant solution is to modify function
msc_role_ran_encode(), so that it attaches the msgb to OTC_SELECT.
This way there is no need to call msgb_free() here and there.

This change fixes a memleak observed while running ttcn3-msc-test.

Change-Id: I741e082badc32ba9a97c1495c894e1d22e122e3a
Related: OS#5340
2021-12-07 18:43:00 +03:00
Vadim Yanitskiy d405bad32d libmsc: ran_iu_make_security_mode_command(): clarify UIA mask
Change-Id: I7535d5ede5b22c61575a16d15927598e6137392a
2021-12-02 04:47:04 +03:00
Vadim Yanitskiy 35db146e88 libmsc: ran_iu_make_security_mode_command(): improve readability
Change-Id: I14f4f9617f91ed17fb7614f218cb023a0231866d
2021-11-30 13:14:16 +00:00
Vadim Yanitskiy 6d594e4e83 libmsc: fix another memleak (struct gsm_sms) in gsm340_rx_tpdu()
Change-Id: I42e819fb83096c1432df16f501b9d1f6a6160ae7
Fixes: I2c50904349dd4ed229b60b8468d776b817c0bd44
2021-11-29 20:36:35 +00:00
Vadim Yanitskiy ef19fc1ccd libmsc: fix memory leak (struct gsm_sms) in gsm340_rx_tpdu()
If a MO SMS gets successfully routed through SMPP, we return early
in gsm340_rx_tpdu() and leak a chunk of type 'struct gsm_sms'.

Change-Id: I8a745d747f06baa7109418ffe600b27b3c0a5228
Fixes: [1] Ic34d398e0a850856e20380ae35e5c2ae5e3c539b
Fixes: OS#5334
2021-11-29 20:36:35 +00:00
Vadim Yanitskiy 9a28230ef2 VTY: clarify deprecation message for cfg_net_per_loc_upd_cmd
Change-Id: I95636a7713cd90956e46a5b6f8f7ded3bf4f5f0a
2021-11-28 03:44:28 +03:00
Alexander Couzens 2c5e46104e libmsc/gsm_04_08: refactor require ciphering into an own function
Make it more readable.

Change-Id: I9e407f65b282e645feabe714f7f4c3e44fae21e9
2021-11-27 04:39:34 +01:00
Alexander Couzens 8b7d78588a utran: use new UTRAN encryption enum
Depends: libosmocore.git I4b9baff2c2fbd0e339fc769cc69cce58d3a72cdf
Change-Id: If6978d7ed1a78facc2591cfc30fda2721629bffa
2021-11-17 20:18:52 +00:00
Alexander Couzens 2aaff7513b Validate the choosen UTRAN encryption algorithm
RANAP Security Command can include an encryption IE. If it includes
it the RNC can still ignore it (e.g. unsupported encryption) and
return the Security Command Complete with an choosen encryption IE:
"no encryption".
Validate the encryption element and ensure the encryption is included in
the encryption mask.

Closes: OS#4144
Change-Id: Icfc135c8b8ae862defe7114db492af600c26407f
2021-11-05 01:29:05 +01:00
Harald Welte 505a94a610 Make UTRAN encryption algorithms configurable
Allow the user fine-grained control over which UMTS encryption
algorithms are permitted, rather than always permitting UEA1 and UEA2
or neither.

This brings the handling of UEA in line with the handling of A5 for
GERAN.

Change-Id: I91f9e50f9c1439aa19528f887b83ae9de628fcfd
Closes: OS#4144
Depends: osmo-iuh.git I6d2d033b0427bdc84fee61e0f3cb7b29935214bf
2021-11-05 01:29:05 +01:00
Harald Welte 274b70f1a8 Fix enabling of UMTS UEA encryption
The existing code allowed the user to configure UMTS encryption in the
vty, but we never actually passed this information down to RANAP.  As a
result, the RAN had no chance of ever enabling encryption on the air
interface.

Change-Id: Ieaaa6b23b7337b7edb902fad8031e195e0c5e9d2
Related: OS#4144
2021-11-05 01:29:05 +01:00
Vadim Yanitskiy c6921e5068 mncc: rework passing GCR over the MNCC interface
Using *unpacked* 'struct osmo_gcr_parsed' in the MNCC PDUs makes
the protocol even more complicated than it currently is, and
moreover complicates implementing MNCCv8 in the ttcn3-sip-test.

Replace 'struct osmo_gcr_parsed' in 'struct gsm_mncc' with a
fixed-length buffer, which is supposed to hold the Global Call
Reference encoded as per 3GPP TS 29.205.

Indicate presence of GCR using the MNCC_F_GCR flag.

Change-Id: I259b6d7e4cbe26159b9b496356fc7c1c27d54521
Fixes: I705c860e51637b4537cad65a330ecbaaca96dd5b
Related: OS#5164, OS#5282
2021-11-03 21:12:52 +00:00
Vadim Yanitskiy e0661105ac smpp_smsc: use osmo_talloc_replace_string() in smpp_smsc_conf()
Change-Id: Ie3dc0d9673a0410a5908cba77fc352d581bac6f6
Fixes: CID#240711
2021-10-30 02:27:21 +00:00
Vadim Yanitskiy 97b8e76b50 libmsc: struct smsc: drop 'const' qualifier from bind_addr
This pointer holds an address of a string allocated on heap.

Change-Id: I50145b57494aaccd4793f7b0ed2f65a6641db929
Related: CID#240711
2021-10-26 18:42:57 +00:00
Vadim Yanitskiy 583883bf2e libmsc: fix NULL pointer dereference in trans_lcls_compose()
Change-Id: I96342de4cb3e0bc3d3cac7538d4517aa211e8a38
Fixes: CID#240768
2021-10-26 10:25:39 +03:00
Keith Whyte a1a70be593 Add support for LCLS to the MSC
This commit is largely based on work by
Max <msuraev@sysmocom.de>

Adds LCLS parameters for A-interface transactions
This commit also adds a vty option to facilitate globally
disabling LCLS for all calls on this MSC.

Add a global call reference (GCR) to MNCC and therefore
bump the MNCC version to version 8. (This commit has to be
merged at the same time as the corresponing commit in the
osmo-sip-connector for mncc-external use.)

Depends: osmo-sip-connector Id40d7e0fed9356f801b3627c118150055e7232b1
Change-Id: I705c860e51637b4537cad65a330ecbaaca96dd5b
2021-10-25 10:07:48 +00:00
Harald Welte 30811f865c smpp: Fix help string in vty for "alert-notifications"
Without the 'no' prefix, this command is about enabling, not disabling

Change-Id: I3019a0d9271e73030b9d7cd555761e17358ec812
2021-09-28 21:40:40 +02:00
Pau Espin 25b6847f46 cosmetic: fix typos in comments
Change-Id: I89e8eba379f83bcf3061601b02af9f10dbca0f22
2021-08-24 11:42:15 +02:00
Neels Hofmeyr ae98b97382 implement CM Re-Establish for voice calls
Related: SYS#5130
Change-Id: I6fa37d6ca9fcb1637742b40e37b68d67664c9b60
2021-07-29 22:40:59 +02:00
Pau Espin e53ecde83e msc_a.c: Allow MSC_A_EV_CN_CLOSE in state MSC_A_ST_RELEASING
As seen in a running osmo-msc:
"vlr_access_req_fsm.c:153
msc_a(IMSI-....:MSISDN-...:TMSI-0x...:GERAN-A-8:CM_SERVICE_REQ){MSC_A_ST_RELEASING}:
Event MSC_A_EV_CN_CLOSE not permitted"

Also seen in several unit tests, which need update.

The action event handler for that state is actually already
expecting/handling the event by ignoring it, so we should allow it.

Change-Id: I4d30cffab693529aab3ba736419dec116a4dd7ef
2021-07-12 16:37:24 +02:00
Pau Espin 42ac3665c8 sgs_iface.c: Improve logging when paging over SGs
Change-Id: I745d3e904583ddf170ec1a1ceac5a49b72e813e3
2021-07-12 16:37:19 +02:00
Pau Espin 8252959b74 sgs: Use available API to set vlr subscr LastUsedEutranPLMNId
This way it's easier to find out where the vlr subscriber field is set.

Change-Id: I203de82accc896c196cb70037af89be6dc826c05
2021-07-01 18:14:39 +02:00
Neels Hofmeyr 73d093a806 improve logging on encryption, for Ciphering and HO
log the algorithm and all keys instead of just Kc.

Change-Id: If7871dedda2b1fb115e6f00da1379ff2e3d68a10
2021-06-24 01:44:20 +02:00
Neels Hofmeyr db07fdcbfc support A5/4 in inter-BSC handover
Forward the Kc128 key to the new BSS in BSSMAP Handover Request.

Depends: Ieb6e43eef9e57281d54d4b7c63664668df5aef3e (libosmocore)
Change-Id: Id5ce995a741c8e469a50a0c46e53c06a2378bb7e
2021-06-24 01:44:17 +02:00
Neels Hofmeyr 6ce2edcac1 support A5/4 in Cipher Mode Command
Related: SYS#5324
Change-Id: I780a739b9bfbefd4f58be051794fe1a491823e67
2021-06-24 01:27:47 +02:00
Eric Wild a7f8020bfa vty: allow A5/4 encryption in config
Add A5/4 to the internal mask of allowed algorithms.

(Not actually working yet, A5/4 implementation follows in other
patches.)

Related: SYS#5324
Change-Id: I5b46aaa8579f8d069ca39caf996a8795ffe63dd7
2021-06-24 01:27:47 +02:00
Neels Hofmeyr cdcfc80176 ran_msg_a.c: use gsm0808_create_cipher2()
Use new API in Cipher Mode Command to prepare for A5/4 support.

Depends: Ib3906085e0c6e5a496a9f755f0f786238a86ca34 (libosmocore)
Related: SYS#5324
Change-Id: Ib238d367b8d5d07b6ab4cb2e48fbf4ce22ca4476
2021-06-23 23:58:59 +02:00
Vadim Yanitskiy 435f67f43c msc_tx_common_id(): fix potential NULL pointer dereference
Reported by GCC 11.1.0.  msc_a_vsub() may return NULL.

Change-Id: Iebdd6399e819a03258398e6b7b453bda37e45a20
2021-06-06 15:50:42 +02:00
Pau Espin 2e21a68e83 Use new osmo stat items/ctr APIs
Generated using several semantinc patches with spatch.

Change-Id: I3ee853539949a763a309856bf2e7196415b23741
2021-06-04 16:53:16 +02:00
Pau Espin 6710670cb1 Fill Last Used E-UTRAN PLMN Id when in CSFB
Since recently, osmo-bsc behaves strictly as per specs, meaning it will
only send the "Cell selection indicator after release of all TCH and SDCCH IE"
in RR Channel Release iff:
* "Last Used E-UTRAN PLMN Id" was received in the CommonID sent MSC->BSC
* "Last Used E-UTRAN PLMN Id" was received insider "old BSS to new BSS Information"
  in the HandoverRequest sent MSC->BSC.
On the other hand, CSFB_Indicator from ClearCommand MSC->BSC is nw
ignored and not taken into account.

Hence, let's update osmo-msc to also behave correctly by sending the
Last Used E-UTRAN PLMN ID at CommonID tx time to avoid regressions in
CSFB support when running against newer osmo-bsc.

Let's keep sending the CSFB Indicator in ClearCommand as we used too, in
order to keep compatibility with older BSCs (as per spec).

Related: SYS#5337
Change-Id: Ic5f175b179973d0a50d94f00e15f5a3e332605fc
2021-04-29 14:22:33 +02:00
Vadim Yanitskiy a361cab54a SMS-over-GSUP: notify sender if no transaction found
Change-Id: I4f564610fadbfdbbc33de267786534a5405319f6
2021-04-04 14:09:32 +00:00
Vadim Yanitskiy dd466cfa59 fix _gsm48_cc_trans_free(): send MNCC REL.ind on Clear Request
Calling gsm48_cc_tx_release() before mncc_release_ind() has a side
effect: the former may change CC state to GSM_CSTATE_RELEASE_REQ.
This makes the later send MNCC_REL_CNF instead of MNCC_REL_IND, so
if one of the call leg disconnects due to RF failure, the other one
will not be terminated correctly.

Makes both TC_{mo,mt}_call_clear_request TTCN-3 test cases pass.

Change-Id: I3ad4a99757878de3796027325627c87d9a4e93f1
Related: Id16969fe0de04445d1320a96d35cf1d48cc8cf09
Related: SYS#5340
2021-02-09 18:34:40 +01:00
Vadim Yanitskiy 33144f146a ran_a_decode_cipher_mode_reject(): use gsm0808_get_cause()
Change-Id: I56dd920b931e769ba4d268b09700fe3c9fca4fc6
2021-02-05 20:16:52 +01:00
Vadim Yanitskiy 566ce11df5 submit_to_sms(): fix the use of deprecated gsm_septets2octets()
Change-Id: I9985972f0b1d2b71bfd133c5004201a3a0ffcbd0
2021-02-05 20:15:08 +01:00
Harald Welte 4dc5dcf4e0 Use osmo_fd_*_{disable,enable}
Change-Id: I5208124e08d3b403492fe83acee235e61e423450
Depends: libosmocore.git Idb89ba7bc7c129a6304a76900d17f47daf54d17d
2020-11-11 20:14:27 +00:00
Harald Welte aa29e33cb5 Use osmo_fd_setup() whenever applicable
Change-Id: Ib570e2ada619b72001d76d2cae159d78f09d6fb6
2020-10-19 11:38:05 +00:00
Alexander Couzens ae167fcc9a Convert paging response timer into an osmocom own X4 timer
All timeout values should use tdef.

Change-Id: Ic050eb49ba0c5811b43d8d8b44145a1115fd8546
2020-09-26 21:45:09 +02:00
Philipp Maier 9194b33ec1 gsm_04_08: check return code of osmo_mobile_identity_decode_from_l3()
The function gsm48_rx_cm_reest_req() is the only one where the return
code of osmo_mobile_identity_decode_from_l3() is not checked, lets check
it here too.

Change-Id: I37981205870b094b3a40a20197461208daa62698
Fixes: CID#211037
2020-09-25 10:01:36 +00:00
Neels Hofmeyr cbcfe9918b drop duplicate ran_peer_find() vs ran_peer_find_by_addr()
This is the same function existing twice with different names. Keep only one.

Change-Id: If54b54fa61ece0f95564d403e1439fc5f5ededdf
2020-09-25 01:45:08 +02:00
Keith Whyte 192fefe53d Don't Store an SMS in the database when the ESME is not Bound
We may never be able to deliver this SMS if it depends on the ESME, as we will
not resubmit the SMS to the ESME. Better to reject it at this time and have the MS
try again later.

Change-Id: I2c50904349dd4ed229b60b8468d776b817c0bd44
Related: OS#4740
2020-09-22 12:43:14 +00:00
Philipp Maier 8c472bd111 mncc_call: fix memory overrun
The struct gsm_mncc which is created and populated in mncc_call_tx_setup_ind
casted to a union mncc_msg* pointer. This leads to a memory overrun
in mncc_call_tx because the union mncc_msg is larger then the gsm_mncc struct.

To fix this, lets just declare a union mncc_msg and populate the signal
member inside it. This can be handed over to mncc_call_tx. The data in
it will look the same, except that the memory will have the proper
lenght (longer).

Change-Id: Ifff28b3375d6bd5e4f837f25c46736952f7bfa9b
Fixes: CID 214330
2020-09-18 18:08:39 +02:00
Neels Hofmeyr d4099c31c9 fix MGCP timeout timer
Timer X1 is not defined in libosmo-mgcp-client, so this tdef had no effect.
Change this to X2427.
(libosmo-mgcp-client recently moved T2427001 to X2427.)

(X2 is still used in call_leg.c itself)

Related: OS#4539
Related: If097f52701fd81f29bcca1d252f4fb4fca8a04f7 (osmo-mgw)
Change-Id: I9804fdb2c24f49910f2386e3788bd1107b8ebc40
2020-09-18 08:45:38 +00:00
Pau Espin eeda9e123f mncc: Support IPv6 addresses (new version mncc 7)
Change-Id: I6002b648bcb2055dcbbdae3f688f6e2cb7282b7f
2020-09-14 12:41:00 +02:00
Pau Espin 0632717dc1 Support handling IPv6 Transport Address in Handover Request (Ack)
Change-Id: Ie4d07826362d651cd42dc2b4e0af82368a74c774
2020-09-09 13:20:22 +02:00
Pau Espin f9c76e3aa2 Support handling IPv6 Transport Address in Assignment Complete
Change-Id: Ib650bb063404a3068b4cf3c376c6080dc29bebfe
2020-09-08 18:31:25 +02:00
Pau Espin d35abfad72 Support sending IPv6 Transport Address in Assignment Command
Change-Id: Ida43f10a41afbd275233f0ef102287522a2e7099
2020-09-08 18:31:16 +02:00
Keith Whyte 1587ffbc7b vty: allow configuring db path from cfg file
So far, the cmdline argument was the only way to set a database file.
Add a similar config to VTY as 'msc' / 'sms-database'. The cmdline arg is stronger
than the 'database' cfg item. DB is not reloaded from VTY command.

Change-Id: I18d954c30fcceb0b36a620b927fd3a93dcc79f49
2020-08-28 16:25:14 +02:00
Vadim Yanitskiy 4d75559dad mncc_builtin: log type of unhandled message in int_mncc_recv()
Change-Id: Ie65b2da4c3a13ac36132a2f8c9c85cc420c7a5a6
2020-08-24 07:35:45 +00:00
Vadim Yanitskiy 880a69391d mncc_builtin: cosmetic: fix coding style in int_mncc_recv()
Change-Id: Iffef3c094a5d030663d312a379e846a8eb917942
2020-08-24 07:35:45 +00:00
Neels Hofmeyr 667d5e0b95 fix crash for unknown MI during Paging Response
Related: OS#4724
Related: I40496bbccbbd9c496cfa57df49e26f124a2b1554 (osmo-ttcn3-hacks)
Change-Id: Ia2c8fa745cfab17ed7114d433f625ddc02ae7b11
2020-08-24 07:34:27 +00:00