When SGSN pooling is enabled we need to route some responses based on
IMSI back to the correct SGSN, e.g. PAGING_PS_REJECT.
The IMSI cache keeps track of this IMSI <-> NSE(SGSN) mapping.
Change-Id: If0a8d6cc1d63f2fb2c395cc5d4373a915bc2cb87
Related: OS#4951, OS#4472
The range of SUSPEND/RESUME timers T3/T4 is up to 10s so we should keep
the cache entries valid for this time.
Fixes: OS#4895
Change-Id: I9e88e49981098831f3255938deb868f4503f650f
Related: SYS#5235
When routing a SUSPEND/RESUME we need to keep track of where it came
from so we can send the (N)ACK back to the correct BSS. Use the TLLI
which is present in both messages to cache and retrieve the correct BSS.
A timer runs every two seconds and expires entries that are older than
the timeout (hardcoded to 5 seconds for now).
Related: SYS#4865, OS#4472
Change-Id: I42adf70f560d2bb358a9e1c7614281e8d2967568
This is useful for logging and configuration to identify an SGSN by name
Change-Id: I2a3410dd9bebb242957e13a63ed70e447204203c
Related: SYS#5115, OS#4472
The new gprs_ns2 vty2 support ip-sns and reorganize the
network service configuration
Depends: I163279cf57e84198dc8c53e1c109f5a9474670e9 (libosmocore)
Change-Id: I2a18dcf035f1fc7304a0c7c7c83b5e8e15429d2b
The new NS2 api supports NSE with multiple NS-VC and contains a NS-VC
fsm. FR/GRE support is not working.
The configuration is compatible except for FR/GRE.
Relates: OS#4629
Depends-on: Iaad7b53d44338e5dd81dc2202f23bdcb715af804 (libosmocore)
Depends-on: I6cef42749555e577d5573f2ed8b8bce4cf842a98 (libosmocore)
Change-Id: I92a3bcaf166b091a22d74c7c1586964d33d7cc9d
[ 258s] CC gb_proxy.o
[ 258s] gb_proxy.c: In function 'gbproxy_select_sgsn_bvc':
[ 258s] gb_proxy.c:293:2: error: 'for' loop initial declarations are only allowed in C99 or C11 mode
[ 258s] for (int i = 0; i < ARRAY_SIZE(cell->sgsn_bvc); i++) {
[ 258s] ^
[ 258s] gb_proxy.c:293:2: note: use option -std=c99, -std=gnu99, -std=c11 or -std=gnu11 to compile your
code
Change-Id: I717410b11f1ee38d49e9ca5af593cb59a244ae0a
In order to support SGSN pooling we need to configure the various NRI
parameters such as the bitlen, NULL NRI, and which NRIs are assigned to
which SGSN.
Related: OS#4890, OS#4472
Change-Id: Id67592aa7712e5e04e7264b2fb8f26d57eb7e69e
This function is now used to transmit messages in both directions,
BSS->SGSN and SGSN->BSS.
Print the actual direction in the logs
Change-Id: I31682156dfe88f7ca121a711968e625caed8bd5e
Related: OS#4472
gprs_subscr_get_or_create() can return NULL if no memory can
be allocated. Detected by the compiler on Ubuntu s390x.
Signed-off-by: Steve Langasek <steve.langasek@ubuntu.com>
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Change-Id: I86b3652d46bdd581fe6cbab16b52395a0daaa082
* allow to print not only BSS-side BVCs, but also SGSN-side
* differentiate between SIG and PTP BVC
* print the actual BVC FSM state name instead of just UNBLOCKED/nothing
Change-Id: I8e09a9dc296b15094d191b0451d04457c815d116
When there are multiple SGSNs inside a pool, we need to decide
how much of the per-BVC capacity advertised by the BSS in its
BVC-FLOW-CONTROL we should announce to each of the pool members.
A conservative approach would be to advertise 1/num_sgsn, but
there may also be use case where over-provisioning (announcing more
than an equal share of the capacity) is useful.
Hence, let's introduce "pool bvc-flow-control-ratio <1-100>" in order
to allow the administrator to decide.
Related: OS#4891
Change-Id: Ibe5addf657e7237499ca0205bacfe999ecd1e771
The 'nse' variable had been used both as the input argument of the
SGSN-side NSE, as well as a loop iteration variable. Let's separate
this clearly.
Closes: OS#4904
Change-Id: I375a219cd72eb11a9a0cb7d55a3efb7b83b771ac
After a SGSN-side RESET of the SIG-BVC, all PTP BVC on the SGSN side
are gone. However, the CELLs and the BSS side BVCs continue to exist
(as there may be other SGSNs).
So if a PTP-BVC RESET from the BSS side arrives in such a situation,
and we can find a matching CELL, we still need to check if we need
to create any SGSN-side PTP BVCs instead of simply being happy with
the CELLs already existing.
Change-Id: I1d1562e421082fa4399c73ac31290e4c95718e49
Closes: OS#4903
We must locally terminate + acknowledge any inbound BSSGP-FC-BVC,
and ourselves trigger the transmission of BSSGP-FC-BVC to each
SGSN in the pool.
Related: OS#4891
Depends: libosmcoore.git Ie59be6761177c43456898be9148727f15861a622
Change-Id: Ib6495e5de4bfcf748a98e08743d1a8f2565f8b69
That copy may have made sense while we were doing patching/buffering,
but we're not doing any of that anymore.
Related: OS#4472
Change-Id: I207a869ffac8bf60104f80f9ed58faf0021e5e95
As we now have gbproxy_bvc on both the SGSN and the BSS side
with the same BVCI, using the BVCI alone will no longer render
unique indexes.
Related: OS#4472
Change-Id: I13f3c9e69562a56ad7d3742fdeb2ba48f134fdaa
Rewrite of a large part of osmo-gbproxy in order to prepare
for SGSN pool support. The amount of changes are of such fundamental
nature that it doesn't make sense to try to split this into hundreds
of individual changesets.
Related: OS#4472
Change-Id: Ie0746f17927a9509c3806cc80dc1a31d25df7937
We recently introduced code to libosmocore which allows us to validate
the mandatory IE presence (and length) in a generic way. Let's use it.
Change-Id: I0ea3f5f9566d9bf5a8429c3ee748e3e90cda6cd7
Depends: libosmocore.git I7e4226463f3c935134b5c2c737696fbfd1dd5815
gbprox_relay2peer() is a small wrapper around gbprox_relay2nse(),
but as it manages the transmit error counter, we should use it whenever
possible.
Change-Id: I85ab49ca0a25dd7c54b88c4fdc8838843e6d2209
* ensure the BSSGP PDU header length before reading pdu_type field
* ensure we never process uplink PDUs in downlink and vice-versa
* ensure we never proceses PTP PDUs on SIGNALING BVCI and vice-versa
Change-Id: I6e40aed0283f1a0860ab273606605f7fb28717cf
Depends: libosmocore.git I7e4226463f3c935134b5c2c737696fbfd1dd5815
Those features were introduced a long time ago for one specific use
case at one specific user, and they are not needed anymore. They
complicate the code base significantly and are hard to maintain with
all the upcoming modifications regarding SGSN pool supoprt.
Change-Id: Id9cc2e1c63486491ac5bb68876088a615075fde6
For the common lookup-by-bvci, this should reduce the computational
complexity significantly.
Depends: libosmocore.git I8ef73a62fe9846ce45058eb21cf999dd3eed5741
Change-Id: Ic8e9279fd61a3c514fc3203429f36a468f0e81d3
For the common lookup-by-nsei, this should reduce the computational
complexity significantly.
Depends: libosmocore.git I8ef73a62fe9846ce45058eb21cf999dd3eed5741
Change-Id: Idbb6a362332bb6e3ce22102e7409ae80d0980f44
We will soon also have a list of sgsn-side NSEs, and we need to
differentiate those.
Change-Id: If5accec0c70c01b88927ea07beba6f6488bd9d5a
Related: OS#4472
I cannot really read the code while it contains its historical weird
naming. A "peer" used to be a strange amalgamation of NSE + BVC,
while in reality we can have any number of BVC on top of each NSE.
We recently started to split the peer into a gbproxy_nse_peer + gbproxy_peer.
This takes it one step further and renames gbproxy_peer to gbproxy_bvc,
as that's really what it is.
Change-Id: Iae01067282a6401f6af4cab731202872d2cdb080
With TLVP_PRESENT we only check if a tiven TLV/IE is present,
but don't verify that it's length matches our expectation. This can
lead to out-of-bounds reads, so let's always use TLVP_PRES_LEN.
Change-Id: I1519cff0f6b2fe77f9a91eee17e0055d9df1bce6
The gbproxy_nse is created when the signalling BVC is resetted. When
we delete all bvcs of an nsei we need to remove it as well.
Change-Id: I997b29fef93188565f81bd403bc68840473958c3
Related: SYS#5002
Calling free() with a null-pointer is usually supported and does
nothing. Change gbproxy_{peer,nse}_free() to reflect that behaviour.
Change-Id: Ia32084f81ca8f8cb9ddea3adabd4b44fd766f1c7
Since gbproxy doesn't use bssgp_rcvmsg from libosmocore we need to
implement our own filtering.
Change-Id: I4d1b57b89990945d307f27a58a7f630be0253d5b
Related: SYS#5232
* explicit else clause rather than implicit
* don't continue processing if mandatory BVCI missing from message
Change-Id: I038576b91ae1ece149149d8663de7b8495d24e06
The switch clause was getting a bit too long/nested, let's add
a separate gbprox_rx_bvc_reset_from_bss() function.
Change-Id: If262566e275cca96035045d1194ce102c0942eb6
Both BSSGP messages appear from the SGSN in downlink on BVCI=0.
We must send a copy of this message to each of the BSS side NSEs.
Change-Id: Ia19791b143989eb1490f461d88b9edbd8e3b82be
Closes: OS#4875
We actually need to alter our compiler flags to avoid -Werror=trigraphs
creating trouble:
gb_proxy.c: In function ‘block_unblock_peer’:
gb_proxy.c:875:37: error: trigraph ??) ignored, use -trigraphs to enable [-Werror=trigraphs]
875 | LOGP(DGPRS, LOGL_ERROR, "BVC(%05u/??) Cannot find BSS\n",
|
Fixes: SYS#5233
Change-Id: I93296353dd964602699480faae1248096e331c6a
* use string representations instead of magic numbers whenever possible
* make text actually describe the specific case, rather than copy+paste
* proper order (foobar indication) not (indication ..... foobar)
Change-Id: I232038da26a9963763c5fc9051b87c9182b27d94
We want this level of indirection to support multiple BVCs per NSE. The
current code assumes that an NSE only has one BVC which breaks messages
on the signalling BVC which should only be sent once to an NSE
regardless of the number of BVCs it contains.
Change-Id: I97cc6c8f8c0f1b91577ab8f679c4ae217cc88076
Related: SYS#5226
Previous code relied on abort() switching sigaction to SIG_FDL +
retriggering SIGABRT in case the signal handler returns, which would
then generate the coredump + terminate the process.
However, if a SIGABRT is received from somewhere else (kill -SIGABRT),
then the process would print the talloc report and continue running,
which is not desired.
Change-Id: I65f70a53b6982bff9ea4bd6ff786d8a2f8181eac
Fixes: OS#4865
Previous code relied on abort() switching sigaction to SIG_FDL +
retriggering SIGABRT in case the signal handler returns, which would
then generate the coredump + terminate the process.
However, if a SIGABRT is received from somewhere else (kill -SIGABRT),
then the process would print the talloc report and continue running,
which is not desired.
Change-Id: I1cab4a716cf2fda6353f698888edbcec6228d78b
Fixes: OS#4865
Previous code relied on abort() switching sigaction to SIG_FDL +
retriggering SIGABRT in case the signal handler returns, which would
then generate the coredump + terminate the process.
However, if a SIGABRT is received from somewhere else (kill -SIGABRT),
then the process would print the talloc report and continue running,
which is not desired.
Change-Id: I97559b29328101c7cf340aaf1052c0c406634065
Fixes: OS#4865
This will be needed to use the TLLI as link selector parameter
in osmo-gbproxy in an upcoming patch.
Depends: libosmocore.git I397b32a6e6ea3e9d218446138cceafa9b27685dd
Change-Id: Ia6d5300e63ad23987cbdca824db620305bd583d7
When we receive a PAGING for PS or CS with destination to the entire
BSS area, we need to iterate over all peers and send one copy of the
paging to each of them.
Change-Id: Iecf244238500a354d5a5b40c76f0c0bb8f8c2511
There may very well be many PCUs connected within the same RAC or LAC.
This means we'll need to iterate the list of peers and dispatch it to
each matching peer.
Change-Id: I2c44959661fb53730586f4347cbfbbcece065e13
Commit cce88282388f in libosmocore changed the msg ownership model - the
callback that the user registers is now responsible for freeing the msg.
Change-Id: Iee940aba7d94afefb5957dbe5f0b04dcf951b31c
Related: SYS#4998
* is_config_node is deprecated, so don't set it
* go_parent_cb is only used if we want to do special stuff upon exiting
a node, in osmo-sgsn and gtphub only osmo_ss7_vty_go_parent() needs to
be called
Change-Id: I2008dd9026922d29ee703c59e70d3fecced0ee18
Currently the code reports routing the message to a BVCI but never even
tries to get the peer for it.
Change-Id: Ic72f0f03e5886ab76404915fc60a2796e6881a7a
Related: SYS#4998
When we receive a signalling BVC RESET from the SGSN we want to reset
the signalling BVCs for every peer.
Change-Id: I98c1a53d0e4b9a988e9ddec97ce0c67ded6f6326
Related: SYS#4998
Since NS2 has a different abstraction we mock up the prim send/recv
functions and don't test NS like the old tests did.
Related: SYS#4998
Change-Id: Iecfd0408a35a11638d254c1db3c1d477b1a11524
sgsn_delete_pdp_ctx() should never be called without checking if the GTP
side is available, since it may happen that it has already been released
by the time the mmctx tells us the pdp ctx is gone on the MS side.
Fixes: OS#4817
Change-Id: Ie618874545172ec98355174a2ee041fc4a8bec16
This function is only expected to be called if the GTP side of the PDP
ctx is still alive, since it will tear down the GTP side and then finish
the pending MS side if needed.
The asserts are added to ease debugging since it was noted that a few
callers were using this function without properly checking the status of
the pdp ctx.
Related: OS#4817
Change-Id: I4248e2e9846fec5ae2c8557384da2deb86668c50
The SGSN initialises GTP with gtp_statedir of "./" which may
not be the desired path for writing the gsn_restart file.
When starting from systemd for example, we might write
to the system root.
This patch allows override via the config file.
Closes: OS#4820
Change-Id: Ib3ffb7fd6ea1d9b0286111d8c2cba9da5394ca58
Scenario:
1- For an unknwon reason, sgsn sends DeletePdpCtxReq on GTP towards GGSN.
2- GGSN answers with Error Indication to that pdp ctx which calls
gtp_freepdp()
3- gtp_freepdp() calls libgtp callback cb_delete_context() before freeing the
pointer, in osmo-sgsn callback points to cb_delete_context(), which
removes pctx->ggsn and tries to drop the pdp on the NS side by sending a
DeactPdpReq.
4- While waiting for DeactPdpAck, the MS/PCU sends a DeactPdpReq, and
code was unconditionalyl trying to release the gtp side without checking
if it was alreay released, using pctx->ggsn==NULL and crashing.
This is basically the same logic already in place in regular path
gsm48_rx_gsm_deact_pdp_ack.
Related: OS#4817
Change-Id: I02587a3dc812823d893fc00b904142b75fd190b9
gtphub.c:2915:2: error: ‘snprintf’ argument 4 may overlap destination object ‘buf’ [-Werror=restrict]
2915 | snprintf(pos, len, " port %s", portbuf);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Be better safe and use the stack instead of byte counting in the buffer.
Change-Id: Ied9665ce6bd2633797bbc3a2171e911ada357a22
When compression is turned on, an extra buffer "expnd" is allocated in
the context of msg. This means that when msg is freed, expnd is freed as
well and there is no need for freein it explcicitly, which, when it is
done after freeng msg, causes talloc to abort.
Change-Id: I8959b75e241ffabf9fa34c4cf014721584372b26
3GPP TS 24.008 Section 10.5.7.2 Radio Priority states that the Radio Priority IE is
3 bits as follows:
--------------------------------------------
0 0 1 priority level 1 (highest)
0 1 0 priority level 2
0 1 1 priority level 3
1 0 0 priority level 4 (lowest)
All other values are interpreted as priority
level 4 by this version of the protocol.
--------------------------------------------
However at least the MediaTek MT6753 and MT6592 have been
observed to interpret a value of 0 0 0 in an undetermined way
resulting in lack of access to RACH in the cell.
Fixes: OS#4506
Change-Id: I810cd541eb5764ee3f2c238bcd3a10836228d0b5
As long the SGSN doesn't support PS handover treat unknown RA as invalid
and do an implicit detach.
Fixes ttcn3 crash when an RAU happen within an Attach Request
Change-Id: I6a0b335d51f58c26349f7e0a62b2107d7d351d07
"127.0.0.1" is changed to "localhost" to let local NSS decide whether to
use IPv4 or IPv6. In newish systems, IPv6 ::1 will be selected since
IPv6 takes precedence over IPv4.
Similarly, the default source addr needs to be changed from NULL to "localhost"
since for some yet unknwon reason, getaddrinfo(AF_UNSPEC, NULL) returns
first IPv4 "0.0.0.0" and later "::", which is inconsistent with
getaddrinfo("localhost") result, resulting in src=IPv4(0.0.0.0) and
dst=IPv6(::1), which is incompatible and will fail. In any case, since
the default remote address is a local one and it's the client side,
there's no real logical change since the kernel would anyway should have
taken a local address anyway.
Change-Id: I2f599e1aa449d44136ef20ba5f516ca9b61f3223
3GPP TS 48.018 Section 8.4:
> After any failure affecting the NSE, the party (BSS or SGSN) where
> the failure resided shall reset the signalling BVC. After sending or
> receiving a BVC-RESET PDU for the signalling BVC, the BSS shall stop all
> traffic and initiate the BVC-RESET procedure for all BVCs corresponding
> to PTP functional entities of the underlying network service entity. The
> BSS must complete the BVC-RESET procedure for signalling BVC before
> starting PTP BVC-RESET procedures.
TODO: We should not just trigger a single outbound BVC-RESET message,
but we should re-transmit them until we get a response. This would
likely entail adding FSMs to libosmogb, which we will leave for a later
point - it's anticipated that the NS + BSSGP code is undergoing quite
some changes in the coming months anyway, so leave it for then.
Change-Id: I0b46035b40709c38bb9ab9493c11031a577e3ee0
Closes: OS#4629
Depends: libosmocore.git I353adc1aa72377f7d4b3336d2ff47791fb73d62c
The osmo_ prefix should be only used for official struct/apis of libosmocore.
This commit was done via `sed -i 's/osmo_sockaddr/sgsn_sockaddr/g'`.
In prepartion of introducing a different api of osmo_sockaddr to
libosmocore.
Change-Id: Ibb1ddce9ff1ffe7494de5cdb8ea1843c45fe4566
The MS notifies movement to GMM SUSPEND state because it is for instance
handling a call and cannot use PDCH anymore. Once it releases the TCH it
will ASAP move to either dedicated mode or trigger RAU, which means it
will get out of SUSPEND state. So it doesn't make sense to try paging
the MS when in that state.
This change makes test TC_suspend_nopaging pass.
Related: OS#4616
Change-Id: Ia245899eb9f16c7f839785def4ceb721a1c3a11b
We so far only resumed from suspend upon receiving an explicit BSSGP
RESUME message from the BSS. The latter is only possible in
BSC-colocated PCU, where the BSC can trigger the message when releasing
the dedicated channel. In BTS-colocated PCUs, this is not possible,
and we have to rely on the MS resuming by RAU.
See 3GPP TS 23.060 section 16.2.1.1.1 clause 6:
The MS shall resume GPRS services by sending a Routeing Area Update Request message to the SGSN:
* if the BSS did not successfully request the SGSN to resume GPRS services,
* if the RR Channel Release message was not received before the MS left dedicated mode,
* if the MS locally determines that the conditions for the GPRS suspension have disappeared
Without this patch, the GMM state would forever be stuck in SUSPEND,
which in turn causes the SGSN to page the MS all the time.
Change-Id: I3c09187a27483d95fa0070bbb467f94a2ea3978f
Related: OS4616
Daniel Willmann
Vadim Yanitskiy
Alexander Couzens
Harald Welte
Pau Espin
Keith Whyte
Philipp Maier